denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
11,801 Commits 1 Branch 0 Tags
9b8137fdd386cd24a69644eb696a82a5bc47f8e2
Commit Graph
9279 Commits
Author SHA1 Message Date
Andreas Steffen 9b8137fdd3 Added tags table and some tag samples 2013-09-05 11:29:23 +02:00
Andreas Steffen b28686d530 swid_inventory object has a get_count method 2013-09-04 21:56:25 +02:00
Andreas Steffen bd3eaaef9b Count collected SWID tags or tag IDs 2013-09-04 21:30:36 +02:00
Andreas Steffen cee1a86385 Proceed with attestation only if Attestation IMC returns a discovery response 2013-09-04 21:30:36 +02:00
Tobias Brunner a4b996c0bc libipsec: Properly initialize variables when creating AEAD wrapper 2013-09-04 16:18:29 +02:00
Tobias Brunner c742905f50 android: Fix compilation after PTS header files were moved 2013-09-04 16:18:29 +02:00
Tobias Brunner cd764f42b9 libpts: Android.mk updated 2013-09-04 16:18:29 +02:00
Martin Willi 1fd5c7fbac load-tester: support extended traffic selector syntax, as in leftsubnet 
In addition the initiator may use %unique as port, using a distinct port for
each connection, starting from 1025.
 2013-09-04 10:49:48 +02:00
Martin Willi 47b4a51402 load-tester: add an option to test transport/beet connections 2013-09-04 10:49:48 +02:00
Martin Willi 3070697f9f ike: support multiple addresses, ranges and subnets in IKE address config 
Replace the allowany semantic by a more powerful subnet and IP range matching.
Multiple addresses, DNS names, subnets and ranges can be specified in a comma
separated list. Initiators ignore the ranges/subnets, responders match
configurations against all addresses, ranges and subnets.
 2013-09-04 10:38:37 +02:00
Martin Willi beffdc6ab8 ike-cfg: remove the to be obsoleted allow any parameter in get_my/other_addr 2013-09-04 10:38:37 +02:00
Martin Willi 62282ec0ed backends: use ike_cfg host matching functions 2013-09-04 10:38:37 +02:00
Martin Willi 6f666192bb ike-cfg: add methods to match a host against configured local/remote addresses 2013-09-04 10:38:37 +02:00
Martin Willi 7446fa2860 trap-manager: use ike_cfg resolver functions 2013-09-04 10:38:37 +02:00
Martin Willi 0edce68767 ike-sa: use ike_cfg resolver functions 2013-09-04 10:38:36 +02:00
Martin Willi e743275cae ike-cfg: add a method to resolve local/remote hosts with port 2013-09-04 10:38:36 +02:00
Martin Willi a858064455 stroke: ignore a leftsourceip if a rightsourceip is given as well 
As we always negotiate virtual IPs in charon, having both left- and
rightsourceip is not allowed. Both in IKEv1 and IKEv2 we support a single
configuration payload exchange only.
 2013-09-04 10:33:38 +02:00
Martin Willi e3311e9b87 ikev1: implement mode config push mode 2013-09-04 10:33:38 +02:00
Martin Willi 2bae838d5e stroke: re-enable modeconfig keyword 2013-09-04 10:33:38 +02:00
Martin Willi 9aeaa7396e peer-cfg: add a pull/push mode option to use with mode config 2013-09-04 10:33:37 +02:00
Martin Willi e8b36eb92f charon-cmd: support prompting for a PIN 
To support a Password and PIN XAuth combo, additionally support multiple
prompts for different credential types.
 2013-09-03 16:26:19 +02:00
Martin Willi 45797bd50b xauth-generic: honor requested XAuth credential types as a client 
Support requesting of XAuth PINs and print XAuth messages.
 2013-09-03 16:26:19 +02:00
Martin Willi 3482cc9cf6 attributes: shorten some Unity and XAuth attribute short names 2013-09-03 16:26:19 +02:00
Martin Willi 61b0079881 message: print type of configuration payload 2013-09-03 16:26:19 +02:00
Martin Willi 8e4b258030 message: print attributes for IKEv1 configuration payloads as well 2013-09-03 16:26:19 +02:00
Martin Willi d787ada894 eap-radius: support XAuth configuration profiles, defining multiple XAuth rounds 2013-09-03 16:26:19 +02:00
Martin Willi 510ecf612a xauth: add a configuration string option to be passed to XAuth instances 
The configuration string is appended to the XAuth backend name, separated by
a colon. The configuration string is passed untouched to the backend, where
it can change the behavior of the XAuth module.
 2013-09-03 16:26:19 +02:00
Andreas Steffen 7a425fb24c Use ipsec_DATA destination 2013-09-02 14:20:33 +02:00
Andreas Steffen 0c2348581c Install SWID tag also in /share/ 2013-09-02 14:01:05 +02:00
Andreas Steffen 9f85122af9 Generate strongSwan SWID tag 2013-09-02 13:08:41 +02:00
Andreas Steffen 86f00e6aff Added regids table and some sample reqid data 2013-09-02 12:00:47 +02:00
Andreas Steffen d1696c0eaa Corrected debug class to DBG_IMC 2013-09-02 12:00:46 +02:00
Tobias Brunner 10a69c32c2 conftest: Fix hook constructor resolution via dlsym() 
AM_CPPFLAGS only takes preprocessor flags like -I or -D, so it did not
forward -rdynamic to the linker (--export-dynamic), which meant that the
symbols defined in the executable itself were not resolvable via dlsym().

Fixes #394.
 2013-08-30 19:45:51 +02:00
Andreas Steffen 4e2a176229 SWID IMC implements recursive tag collection in /usr/share 2013-08-30 16:25:55 +02:00
Mathias Krause 45b80880f8 kernel-pfroute: Fix mixed up memset() call in get_route() 
The retry code introduced in dc8b083 got the memset() arguments wrong.
Fix this to ensure the buffer gets zeroed, for real.

It probably doesn't matter as we do reset the message length on retry, so
the stale data shouldn't be seen by anyone.

Found-by: git grep 'memset\s*\([^,]*,\s*[^,]*,\s*0\s*\)'
 2013-08-29 18:56:39 +02:00
Martin Willi a0cd955f42 charon-xpc: add a note how to build the source tarball 2013-08-29 12:28:54 +02:00
Martin Willi 74ee1120d7 charon-xpc: include and prefer AES-GCM algorithms in ESP proposal 2013-08-29 11:37:07 +02:00
Andreas Steffen 1e82e27ac5 Added TCG-SWID error handling 2013-08-28 22:53:57 +02:00
Andreas Steffen 7bda0f0c8b Added tzset memory leak to whitelist 2013-08-28 22:51:17 +02:00
Andreas Steffen 0d9e375193 Selectively enable PT-TLS and/or RADIUS sockets in tnc-pdp plugin 2013-08-26 20:36:07 +02:00
Tobias Brunner f0c54e8c15 chunk: Print chunks without separator if + modifier is used 2013-08-24 16:22:51 +02:00
Tobias Brunner 32a145fdbd utils: Add case-insensitive version of strpfx() 2013-08-24 16:22:51 +02:00
Martin Willi 49032d15be stroke: stop enumerating IKE_SAs in statusall if output stream gets closed 
If the output stream is not interested in more information, it can close the
the stream. Checking for stream errors avoids useless enumeration of IKE_SAs,
saving resources. This allows to use "ipsec statusall | head" to monitor the
daemon, or stop enumerating IKE_SAs after a specific entry has been found.
 2013-08-23 14:27:17 +02:00
Tobias Brunner d7ae0b254d kernel: Restore enumeration of all addresses when searching for address in TS 
Since f52cf07532 addresses on ignored, down or loopback interfaces were
not considered as valid addresses anymore when searching for an address
contained in the local traffic selector.  This meant that route
installation failed, for instance, if charon.install_virtual_ip_on was
set to 'lo', or, on gateways, if internal interfaces were ignored with
the charon.interfaces_* options.
 2013-08-21 17:01:03 +02:00
Tobias Brunner 85ca2f7441 conftest: Disable reset_seq hook on systems other than Linux 
Fixes #386.
 2013-08-21 11:27:28 +02:00
Tobias Brunner e001cc2b07 kernel-netlink: Fix calculation of ESN bitmap length 
While bmp_len stores the number of u_int32_t the allocated bitmap
actually consists of those integers.
 2013-08-21 08:28:12 +02:00
Andreas Steffen e626821677 Version bump to 5.1.1dr1 2013-08-19 10:03:23 +02:00
Andreas Steffen 1e92d5f114 Process PB-TNC batches received via PT-TLS asynchronously 2013-08-19 09:52:12 +02:00
Andreas Steffen 9dc3b2053d Optimize TLS socket buffer for TLS_MAX_FRAGMENT_LEN 2013-08-19 09:50:57 +02:00
Andreas Steffen 70a80ef5d4 Output handler of a given workitem 2013-08-16 14:14:13 +02:00