denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
11,160 Commits 1 Branch 0 Tags
64b0c2575f3b1ee47c709ff37fbae9f4e9429230
Commit Graph
2326 Commits
Author SHA1 Message Date
Tobias Brunner 64b0c2575f radattr: Use plugin features to register listener 2013-06-11 11:18:18 +02:00
Tobias Brunner d94c0913b1 lookip: Use plugin features to register listener 2013-06-11 11:18:18 +02:00
Tobias Brunner dfe97d63d8 led: Use plugin features to register listener 2013-06-11 11:18:18 +02:00
Tobias Brunner 21d094f402 ipseckey: Allow en-/disabling at runtime using plugin reload feature 2013-06-11 11:18:18 +02:00
Tobias Brunner 82d3f5122b ipseckey: Use plugin features and depend on RESOLVER 
Also fixed a double-free of the resolver instance.
 2013-06-11 11:18:18 +02:00
Tobias Brunner 924196d6d4 ha: Use plugin features to register listeners and attribute provider 2013-06-11 11:18:18 +02:00
Tobias Brunner e5f4b3ca5b farp: Use plugin features to register listener 2013-06-11 11:18:17 +02:00
Tobias Brunner aa71f5f515 error-notify: Use plugin features to register listener 2013-06-11 11:18:17 +02:00
Tobias Brunner 57c29f6895 duplicheck: Use plugin features to register listener 2013-06-11 11:18:17 +02:00
Tobias Brunner 6c51ff745c coupling: Use plugin features and soft depend on SHA1 2013-06-11 11:18:17 +02:00
Tobias Brunner 0c52198bc1 certexpire: Use plugin features to register listener 2013-06-11 11:18:17 +02:00
Tobias Brunner 94ca7252c1 addrblock: Use plugin features with soft dependency on X.509 decoding 2013-06-11 11:18:17 +02:00
Tobias Brunner 12459a4dc8 dhcp: Use plugin features with dependency to RNG implementation 2013-06-11 11:18:17 +02:00
Tobias Brunner 11a27ea28f sql: Use plugin features with dependency to database backend 2013-06-11 11:18:17 +02:00
Tobias Brunner 270e425b24 Socket plugins soft depend on the kernel-ipsec plugin feature 
On most platforms calls to methods to bypass the IKE sockets and enabling
UDP decapsulation are required.
 2013-06-11 11:18:17 +02:00
Tobias Brunner de42bf35f9 Converted test for recursive mutex_t 2013-06-11 11:03:11 +02:00
Tobias Brunner 4e67f19528 Converted tests for chunk_t 2013-06-11 11:03:11 +02:00
Tobias Brunner e09461bf77 Converted and added tests for hashtable_t 2013-06-11 11:03:10 +02:00
Tobias Brunner 0298be5705 Converted tests for identification_t 2013-06-11 11:03:10 +02:00
Tobias Brunner 3cbacad40b Remove obsolete enumerator/linked_list tests in unit_tester plugin 2013-06-11 11:03:10 +02:00
Emanuil Hristov 2ce403438f updown: pass IKE_SA unique ID in PLUTO_UNIQUEID 2013-05-16 10:13:22 +02:00
Martin Willi 965348cd7a Raise LOCAL_AUTH_FAILED alert after receiving AUTHENTICATION_FAILURE 2013-05-15 17:18:03 +02:00
Tobias Brunner 6040eff900 stroke: Add second password if provided 2013-05-08 15:02:41 +02:00
Tobias Brunner 1c080407b2 stroke: Fail silently if another builder calls PW callback after giving up 
Also reduced the number of tries to 3.
 2013-05-08 15:02:41 +02:00
Tobias Brunner 4a64c3e9a0 stroke: Cache passwords so the user is not prompted multiple times for the same password 
To verify/decrypt a PKCS#12 container a password might be needed
multiple times.  If it was entered correctly we don't want to bother the
user again with another password prompt.
The passwords for MAC creation and encryption could be different so the
user might be prompted multiple times after all.
 2013-05-08 15:02:41 +02:00
Tobias Brunner e240b03e68 stroke: Fix prompt and error messages in passphrase callback 2013-05-08 15:02:41 +02:00
Tobias Brunner 7971278c92 stroke: Load credentials from PKCS#12 files (P12 token) 2013-05-08 15:02:41 +02:00
Tobias Brunner 87692be215 Load any type (RSA/ECDSA) of public key via left|rightsigkey 2013-05-07 17:08:31 +02:00
Tobias Brunner fa1d3d39dc left|rightrsasigkey accepts SSH keys but the key format has to be specified explicitly 
The default is now PKCS#1. With the dns: and ssh: prefixes other formats
can be selected.
 2013-05-07 15:38:28 +02:00
Tobias Brunner c0bbddfa42 Try to load raw keys from ipsec.conf as PKCS#1 blob first 
The DNSKEY builder is quite eager and parses pretty much anything
as RSA key, so this has to be done before.
 2013-05-07 14:08:51 +02:00
Martin Willi 5c12700f9a kernel-interface: query SAD for last use time if SPD query didn't yield one 2013-05-06 17:01:13 +02:00
Martin Willi bdaf9f97e6 child-sa: query SAD/SPD just for what we actually need to update statistics 2013-05-06 17:01:13 +02:00
Martin Willi 60ed88b2c7 child-sa: pass traffic selector to add_sa() regardless of IPsec mode 
This lets the kernel backend decide what to do with it, and in fact all kernel
interfaces already handle this correctly.
 2013-05-06 16:10:11 +02:00
Martin Willi dc35d097b3 socket-default: to bind to one dynamic port on OS X, create v4 socket before v6 
It seems that the order of binding sockets of different address families to the
same dynamic port must be v6-before-v4 on Linux, but v4-before-v6 on OS X.
 2013-05-06 16:10:11 +02:00
Martin Willi a30727fe2b socket-default: refactor socket pair opening to a function 2013-05-06 16:10:11 +02:00
Martin Willi 6948df3220 socket-default: Don't try to send packet if we haven't a socket for given family 2013-05-06 16:10:10 +02:00
Martin Willi e9326eba13 socket-default: Use -1 if socket is not available, as 0 is actually a valid fd 2013-05-06 16:10:10 +02:00
Martin Willi a0f6f39343 proposals: try next if IKEv2 algorithm could not be mapped to IKEv1 2013-05-06 15:54:32 +02:00
Martin Willi d3874008e8 socket-dynamic: when sending from port zero, allocate a free port dynamically 2013-05-06 15:28:26 +02:00
Martin Willi 5e9144a21f controller: clean up job data if a thread gets cancelled waiting in a function 
Controller functions are thread cancellation points, so register a cancellation
handler cleaning up job data.
 2013-05-06 15:28:26 +02:00
Martin Willi 0be946dce3 Use the GEN silent rule when generating files with sed 2013-05-06 15:04:56 +02:00
Martin Willi 5f55fd6e61 Introduce an optional logger_t.vlog() method with format string and arguments 
To have more flexibility in the logging backend, receiving the original format
string and do printf() substitution in the logger may be preferable. An
additional but optional logger method does not touch the behavior of existing
loggers.
 2013-05-06 15:00:15 +02:00
Martin Willi e93f386dbb Raise an ALERT_PROPOSAL_MISMATCH_CHILD also when receiving NO_PROPOSAL_CHOSEN 2013-05-06 14:56:50 +02:00
Martin Willi 00080d2b8b Raise an ALERT_PROPOSAL_MISMATCH_IKE also when receiving NO_PROPOSAL_CHOSEN 2013-05-06 14:56:50 +02:00
Martin Willi aea7ce3c64 eap-radius: add an option to disable accounting for tunnels without virtual IP 2013-05-06 14:56:01 +02:00
Martin Willi 69620a48e8 eap-radius: use IKE_SA unique id instead of peer identity to manage virtual IPs 
Fixes some corner cases if multiple tunnels use the same peer identity.
 2013-05-06 14:56:01 +02:00
Martin Willi a3854d8371 Don't unset IKE_SA on bus before we released virtual IPs and attributes 2013-05-06 14:56:01 +02:00
Andreas Steffen 2d902d7e7c fixed typo 2013-04-19 18:33:41 +02:00
Andreas Steffen 654c88bca8 Added charon.initiator_only option which causes charon to ignore IKE initiation requests by peers 2013-04-14 19:57:49 +02:00
Martin Willi b2b99e61c8 eap-radius: Add an option to exclude ports from Called/Calling-Station-Id 2013-04-10 13:48:03 +02:00