denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
14,700 Commits 1 Branch 0 Tags
44d3b02b579be9a186031a950ca696532ea1b8a3
Commit Graph
1737 Commits
Author SHA1 Message Date
Andreas Steffen 44d3b02b57 Removed VICI protocol versioning 2015-12-11 18:26:55 +01:00
Andreas Steffen 334119b843 Share vici_cert_info.c with vici_cred.c 2015-12-11 18:26:55 +01:00
Andreas Steffen fad851e2d3 Use VICI 2.0 protocol version for certificate queries 2015-12-11 18:26:54 +01:00
Andreas Steffen 5d909303d8 Sort certificate types during enumeration 2015-12-11 18:26:54 +01:00
Andreas Steffen 75749971e1 Define VICI protocol versions 2015-12-11 18:26:54 +01:00
Tobias Brunner 74270c8c86 vici: Don't report memory usage via leak-detective 
This slowed down the `swanctl --stats` calls in the test scenarios
significantly, with not much added value.
 2015-12-11 18:26:53 +01:00
Andreas Steffen 3317d0e77b Standardized printing of certificate information 
The certificate_printer class allows the printing of certificate
information to a text file (usually stdout). This class is used
by the pki --print and swanctl --list-certs commands as well as
by the stroke plugin.
 2015-12-11 18:26:53 +01:00
Martin Willi 1a8a420c1c vici: Fix documentation about the initiate/terminate timeout 2015-12-07 10:28:45 +01:00
Martin Willi eaca77d03e vici: Honor an optionally passed IKE configuration name in initiate/install 
If two IKE configurations have CHILD configurations with the same name,
we have no control about the CHILD_SA that actually gets controlled. The
new "ike" parameter specifies the peer config name to find the "child" config
under.
 2015-12-07 10:28:45 +01:00
Martin Willi 5e79ae2d65 vici: Support completely asynchronous initiating and termination 
In some situations the vici client is not interested in waiting for a
timeout at all, so don't register a logging callback if the timeout argument
is negative.
 2015-12-07 10:28:45 +01:00
Martin Willi 1db918c4f8 vici: Use an empty local auth round if none given 
While it hardly makes sense to use none for negotiated SAs, it actually does
when installing shunt policies.
 2015-12-07 10:05:07 +01:00
Martin Willi b26ba1b4a4 vici: Limit start action undoing to IKE_SAs using the base peer config name 
If two peer configs use the same child config names, potentailly delete
the wrong CHILD_SA. Check the peer config name as well to avoid that.
 2015-12-07 10:05:07 +01:00
Martin Willi 23b1f71372 vici: Close empty IKE_SAs after undoing CHILD_SA start actions 2015-12-07 10:05:07 +01:00
Martin Willi 2facf18833 vici: Use value based array to store CHILD_SA ids during restart 
The previous approach stored a pointer to a volatile stack variable, which
works for a single ID, but not for multiple.
 2015-12-07 10:05:07 +01:00
Martin Willi f3b2d4a9d8 vici: Undo start actions when unloading configs 2015-12-07 10:05:07 +01:00
Tobias Brunner 63a778a25d vici: Fix clean-local target for Perl bindings if they were not built 
This is called when running `make distclean` (or indirectly via `make
distcheck`).
 2015-12-04 12:10:57 +01:00
Andreas Steffen 7d24aa0624 Extended and refactored vici perl implementation 2015-12-01 14:52:43 +01:00
Andreas Steffen a17b6d469c Built the CPAN file structure for the Vici::Session perl module 2015-12-01 14:52:43 +01:00
Andreas Steffen a101bce862 Implement vici Perl binding 2015-12-01 14:52:43 +01:00
Tobias Brunner de34defcd0 vici: Add get-algorithms command to query loaded algorithms and implementations 2015-11-30 10:55:55 +01:00
Thom Troy ac36ede93c eap-radius: Add ability to configure RADIUS retransmission behavior 
Closes strongswan/strongswan#19.
 2015-11-17 14:25:08 +01:00
Tobias Brunner f9c5c80553 eap-mschapv2: Keep internal state to prevent authentication from succeeding prematurely 
We can't allow a client to send us MSCHAPV2_SUCCESS messages before it
was authenticated successfully.

Fixes CVE-2015-8023.
 2015-11-16 13:19:36 +01:00
Tobias Brunner 176c24b8e1 vici: Attribute certificates are not trusted 2015-11-12 14:45:43 +01:00
Tobias Brunner e5e352e631 vici: Properly add CRLs to the credential set 
add_crl() ensures that old CLRs are not stored in the credential set.
 2015-11-12 14:45:42 +01:00
Tobias Brunner fdfbd401c3 eap-radius: Compare address family when handing out virtual IPs 
This also ensures that the actually released virtual IP is removed from
the list of claimed IPs.

Fixes #1199.
 2015-11-12 14:32:11 +01:00
Tobias Brunner 1d4b767275 eap-mschapv2: Report username if different from EAP-Identity (or IKE identity) 2015-11-12 14:21:06 +01:00
Tobias Brunner 8f5e481953 eap-mschapv2: Provide EAP-MSCHAPv2 username as EAP-Identity 2015-11-12 14:21:06 +01:00
Tobias Brunner a6e0f14fd2 kernel-interface: Pass the same data to del_policy() that was passed to add_policy() 
The additional data can be helpful to identify the exact policy to
delete.
 2015-11-10 16:42:52 +01:00
Tobias Brunner ebeb8c87c5 traffic-selector: Don't end printf'ed list of traffic selectors with a space 2015-11-10 12:13:06 +01:00
Tobias Brunner f4641f9e45 vici: Add option to query leases of pools 
We could later perhaps add filter parameters similar to those of the
`ipsec leases` command (pool name/virtual IP).
 2015-11-10 10:43:25 +01:00
Tobias Brunner bdb8b76515 vici: Return local and remote virtual IPs when listing SAs 2015-11-10 10:43:24 +01:00
Tobias Brunner 0ddec0760a socket-dynamic: Refactor setting source address when sending messages 
Basically the same change as the one for the socket-default plugin.
 2015-11-09 16:44:22 +01:00
Tobias Brunner 47e113a639 socket-default: Refactor setting source address when sending messages 
This ensures we don't pass data (via msg_control) defined in a different
scope to sendmsg().  Actually, some compilers (e.g. GCC 5.2.1) might
optimize the memcpy() call away causing the packets not to get sent from
the intended source address.

It also makes the code clearer than with all these ifdefs.

Fixes #1171.
 2015-11-09 16:43:21 +01:00
Tobias Brunner 99747bed8f socket-default: Refactor retrieval of destination address of received packets 
This makes the code a bit clearer than with the interleaved ifdefs.
 2015-11-09 16:42:20 +01:00
Tobias Brunner 04f22cdabc vici: Add NAT information when listing IKE_SAs 
The `nat-local` and `nat-remote` keys contain information on the NAT
status of the local and remote IKE endpoints, respectively.  If a
responder did not detect a NAT but is configured to fake a NAT situation
this is indicated by `nat-fake` (if an initiator fakes a NAT situation
`nat-local` is set).  If any NAT is detected or faked `nat-any` is set.

Closes strongswan/strongswan#16.
 2015-11-09 11:55:51 +01:00
Tobias Brunner 7b95688124 stroke: Make down-nb actually non-blocking 
Fixes #1191.
 2015-11-09 10:55:46 +01:00
Andreas Steffen a88d958933 Explicitly mention SHA2 algorithm in BLISS OIDs and signature schemes 2015-11-06 14:55:31 +01:00
Tobias Brunner 00c2c87b06 eap-radius: Fix creation of host_t objects based on Framed-IPv6-Address attributes 
Fixes ec490e68ae ("eap-radius: Add support for some basic IPv6-specific RADIUS attributes").
References #1001.
 2015-08-28 16:52:57 +02:00
Tobias Brunner fbb593092e eap-ttls: Limit maximum length of tunneled EAP packet to EAP-TTLS packet 2015-08-27 15:29:16 +02:00
Tobias Brunner e3e208fb9f ha: Close control FIFO if it is not valid 2015-08-27 14:31:42 +02:00
Tobias Brunner c605a96d7f Fix some Doxygen issues 2015-08-27 12:03:11 +02:00
Tobias Brunner 735f929ca7 ike: Only consider number of half-open SAs as responder when deciding whether COOKIEs are sent 2015-08-27 11:18:51 +02:00
Evan Broder 78ed330099 vici: Handle closed sockets in the Ruby gem 
From recvfrom(2) (which UDPSocket#recv backs into):

  The return value will be 0 when the peer has performed an orderly
  shutdown.

(i.e. it will return an empty string)

Previously in this scenario, Vici::Transport#recv_all would spin
forever trying to pull more data off the socket. I'm not entirely
clear what happened that caused strongSwan to shutdown the socket, but
it probably should not cause vici Ruby apps to spin.

Closes strongswan/strongswan#13.
 2015-08-24 11:24:05 +02:00
Tobias Brunner 256e666d22 vici: Optionally check limits when initiating connections 
If the init-limits parameter is set (disabled by default) init limits
will be checked and might prevent new SAs from getting initiated.
 2015-08-21 18:21:13 +02:00
Tobias Brunner b9d7319fb3 vici: Add get_bool() convenience getter for VICI messages 2015-08-21 18:21:13 +02:00
Tobias Brunner ff0abde9ed controller: Optionally adhere to init limits also when initiating IKE_SAs 2015-08-21 18:21:13 +02:00
Tobias Brunner ffa20bad63 stroke: Allow %any as local address 
Actually, resolving addresses in `left` might be overkill as we'll assume
left=local anyway (the only difference is the log message).
 2015-08-21 18:19:26 +02:00
Tobias Brunner 8212f3d9a4 stroke: Add an option to disable side-swapping of configuration options 
In some scenarios it might be preferred to ensure left is always local
and no unintended swaps occur.
 2015-08-21 18:19:26 +02:00
Tobias Brunner 517cc501ef stroke: Change how CA certificates are stored 
Since 11c14bd2f5 CA certificates referenced in ca sections were
enumerated by two credential sets if they were also stored in
ipsec.d/cacerts.  This caused duplicate certificate requests to
get sent.  All CA certificates, whether loaded automatically or
via a ca section, are now stored in stroke_ca_t.

Certificates referenced in ca sections are now also reloaded
when `ipsec rereadcacerts` is used.
 2015-08-20 19:33:41 +02:00
Tobias Brunner 01d3ecbaf0 stroke: Combine CA certificate load methods 
Also use the right credential set for CA cert references loaded from
stroke_ca_t.
 2015-08-20 19:19:38 +02:00