denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
10,705 Commits 1 Branch 0 Tags
601de9f36f0ed811d9af243c052a925b4bbca807
Commit Graph
8334 Commits
Author SHA1 Message Date
Adrian-Ken Rueegsegger 601de9f36f Add context id getter to TKM nonce generator 2013-03-19 15:23:46 +01:00
Reto Buerki ebe592a393 id_manager: Use calloc instead of malloc 
This way we don't need to manually initialize the slot status; free
slots are now indicated by 0 though.
 2013-03-19 15:23:46 +01:00
Reto Buerki 1ee792f9ea Use ikev2 keymat proxy 
Forward incoming calls to default ikev2 keymat instance. This is needed
to make a stepwise migration to TKM keymat possible. It will be removed
once the corresponding parts are implemented in the TKM.
 2013-03-19 15:23:45 +01:00
Reto Buerki 5b3bcdfada Add skeleton for TKM keymat variant 2013-03-19 15:23:45 +01:00
Reto Buerki 84967b4439 id_manager: Use limits given by TKM 2013-03-19 15:23:45 +01:00
Reto Buerki 50e35e66d2 Pass context limits on to id manager 2013-03-19 15:23:45 +01:00
Reto Buerki ef5372395a Request limits from TKM on init 2013-03-19 15:23:45 +01:00
Reto Buerki 7aa573a50e id_manager: Use array of bool instead of list 
Instead of storing the acquired context ids in a linked list, use an
array of booleans for the job. A boolean value of true in the array
designates an available context id.
 2013-03-19 15:23:45 +01:00
Reto Buerki 49c513c1d9 Use id manager to acquire DH context id 2013-03-19 15:23:45 +01:00
Reto Buerki 65a777f7fb Add TKM_CTX_DH (Diffie-Hellman context) to id manager 2013-03-19 15:23:45 +01:00
Reto Buerki c38459d77d Use id manager to acquire nonce context id 2013-03-19 15:23:45 +01:00
Reto Buerki f3cd7f50de Add initial TKM Diffie-Hellman implementation 
The tkm_diffie_hellman_t plugin acquires a DH context from the Trusted
Key Manager and uses it to get a DH public value and the calculated
shared secret. Proper context handling is still missing though, the
plugin currently uses context ID 1.

The get_shared_secret function will be removed as soon as the TKM
specific keymat is ready.
 2013-03-19 15:23:45 +01:00
Reto Buerki d51305aa3f charon-tkm: Register tkm nonce generator 2013-03-19 15:23:45 +01:00
Reto Buerki 8e95bf455d tkm_nonceg: Return nonce generated by TKM 2013-03-19 15:23:45 +01:00
Reto Buerki 3d2746309e Initialize TKM client library in tkm.c 2013-03-19 15:23:45 +01:00
Reto Buerki 559fe48c50 Introduce TKM specific charon daemon (charon-tkm) 
Analogous to charon-nm the charon-tkm daemon is a specialized charon
instance used in combination with the trusted key manager (TKM) written
in Ada.

The charon-tkm is basically a copy of the charon-nm code which will
register it's own TKM specific plugins.

The daemon binary is built using the gprbuild utility. This is needed
because it uses the tkm-rpc Ada library and consequently the Ada
runtime. gprbuild takes care of the complete binding and linker steps
required to properly initialize the Ada runtime.
 2013-03-19 15:23:45 +01:00
Adrian-Ken Rueegsegger 4dc3ef94a1 starter: Make daemon name configurable 
A daemon can be specified using the '--daemon' command line parameter. This
tells starter to invoke a daemon other than 'charon'.

Additionally the ipsec script uses the environment variable DAEMON_NAME to tell
the starter which daemon to use.
 2013-03-19 15:23:45 +01:00
Tobias Brunner deafaf51f1 Load arbitrary (non-host) attributes from strongswan.conf 
This allows to e.g. load Cisco-specific attributes that contain FQDNs.
 2013-03-19 15:21:30 +01:00
Martin Willi 824864f4e0 Don't try to mmap() empty ipsec.secret files 2013-03-19 13:46:16 +01:00
Tobias Brunner 8a0a1ae857 Delete IKE_SAs if responder does not initiate XAuth exchange within a certain time frame 2013-03-19 12:00:00 +01:00
Tobias Brunner 3c34e15ee4 Make sure that xauth-noauth is not used accidentally 
It has to be selected explicitly with rightauth2=xauth-noauth.
 2013-03-19 11:23:03 +01:00
Tobias Brunner e4013bb904 Added xauth-noauth plugin 
This XAuth backend does not do any authentication of client credentials
but simply sends a successful XAuth status to the client, thereby
concluding the XAuth exchange.  This can be useful to fallback to basic
RSA authentication with clients that can not be configured without XAuth
authentication.
 2013-03-19 11:23:03 +01:00
Martin Willi 41131528a9 In stroke counters, check if we have an IKE_SA before getting the name from it 
Fixes a segfault when receiving an invalid IKE SPI, where we don't have an
IKE_SA for the raised alert.
 2013-03-19 11:20:35 +01:00
Martin Willi a0f1c4cf29 Add an "esp" load-tester option to configure custom CHILD_SA ESP proposal 2013-03-18 14:30:21 +01:00
Tobias Brunner 6cf79c1e9d Algorithms are not really specific to an IKE version 
But not all of them can be used with IKEv1.

Fixes #314.
 2013-03-18 12:20:47 +01:00
Martin Willi d29246cabe Merge branch 'radius-ext' 
Bring some extensions to eap-radius, namely a virtual IP address provider based
on received Framed-IPs, forwarding of Cisco Unity banners, Interim Accounting
updates and the reporting of sent/received packets.
 2013-03-18 10:13:36 +01:00
Martin Willi 048872f2f7 Merge branch 'stroke-counters' 
Extend stroke counters functionality by connection specific counters, and
a resetcounters command to reset the global or connection counters.
 2013-03-18 10:12:22 +01:00
Martin Willi e85c0f6b84 Merge branch 'stroke-timeout' 
Add a strongswan.conf timeout option for stroke control commands.
 2013-03-18 10:11:46 +01:00
Martin Willi cb14ecb1d3 Merge branch 'netlink-align' 
Fixes some Netlink alignment issues, and then refactors Netlink XFRM message
attribute handling.
 2013-03-18 10:09:35 +01:00
Martin Willi 94163816fa Use netlink_add_attribute() to copy over attributes during update_sa() 2013-03-15 16:02:01 +01:00
Martin Willi 0d9f31e1ed Use a helper function to add XFRM_MARK attribute 2013-03-15 16:02:01 +01:00
Martin Willi 6dfc633927 Use netlink_reserve() helper function in XFRM to simplify message construction 2013-03-15 16:02:01 +01:00
Martin Willi 6359ab04f4 Add a Netlink utility function to add a RTA header and reserve space for data 2013-03-15 14:32:51 +01:00
Martin Willi 53c98f098f Correctly check buffer length in netlink_add_attribute() 2013-03-15 14:32:25 +01:00
Martin Willi 6ac601f543 Avoid unneeded termination of netlink algorithm name arrays with END_OF_LIST 2013-03-15 14:01:15 +01:00
Martin Willi cf729248b2 Add a "resetcounters" command to ipsec, clearing global or connection counters 2013-03-15 10:55:22 +01:00
Martin Willi d022322bed Add connection name specific stroke counters 2013-03-15 10:41:04 +01:00
Martin Willi a34ffd1c05 Add a chunk_from_str() initializer that does not include 0-terminator 2013-03-15 10:36:33 +01:00
Martin Willi e813d218f1 Don't create interim update entries if RADIUS accounting is disabled 2013-03-14 16:44:09 +01:00
Martin Willi d019764ab6 Add support for RADIUS Interim accounting updates 2013-03-14 16:35:11 +01:00
Martin Willi 1ba1cd0c9b Add an option to delete any established IKE_SA if RADIUS server is not responding 2013-03-14 15:42:30 +01:00
Martin Willi 49960f021d Make check whether to use IKEv1 fragmentation more readable 2013-03-14 14:20:55 +01:00
Martin Willi 552b8ad5f5 Send Acct-Terminate-Cause based on some alerts catched on the bus 
Currently supported are user disconnects, session timeouts and if the peer does
not respond on IKE packets or DPDs.
 2013-03-14 14:20:55 +01:00
Martin Willi 335982169a When IKEv1 DPD times out, raise missing SEND_RETRANSMIT_TIMOUT alert 2013-03-14 14:20:54 +01:00
Martin Willi c45cf9048e Raise an alert if an IKE_SA could not have been reauthenticated and expires 2013-03-14 14:20:54 +01:00
Martin Willi 68c12fd9f9 Send NAS-Port, NAS-IP and Calling/Called-Station-ID in Accounting-Requests 2013-03-14 14:20:54 +01:00
Martin Willi b4568ca230 Support RADIUS accounting of sent/received packets 2013-03-14 14:20:54 +01:00
Martin Willi d28391a244 Report the number of processed packets in "ipsec statusall" 2013-03-14 14:20:54 +01:00
Martin Willi d954a2081b child_sa_t.get_usestats() can additionally return the number of processed packets 2013-03-14 14:20:54 +01:00
Martin Willi 6b35ab84da Pass correclty sized pointer to lookup_algorithm() in PF_KEY 2013-03-14 14:20:54 +01:00