Tobias Brunner
a889cfe5e1
Change traffic selectors during Quick Mode in case of a NAT in transport mode
...
Windows 7 sends its internal address as TSi. While we don't support the
NAT-T drafts as used by Windows XP it is interesting to note that the
client there omits the TSi payload which then would automatically get set
to the public IP address of the client.
Fixes #220 .
2012-09-14 09:40:18 +02:00
Tobias Brunner
7d786057b4
Merge branch 'custom-crypto'
...
This provides plugins with an interface to register keywords for
proposals (e.g. when parsing the esp and ike options from ipsec.conf)
and the possibility to register identifiers for kernel algorithms.
It is based on patches contributed by Nanoteq Pty Ltd.
2012-09-13 15:50:52 +02:00
Tobias Brunner
08ad639f32
Added algorithm lookup via kernel_interface_t to the various kernel interfaces
2012-09-13 15:48:49 +02:00
Tobias Brunner
524fb37ccd
Added possibility to register custom kernel algorithms to kernel interface
2012-09-13 15:44:47 +02:00
Tobias Brunner
4c57c63062
Added possibility to register custom proposal keywords
...
Keyword lookup and registration are handled via the new lib->proposal object.
2012-09-13 15:44:46 +02:00
Tobias Brunner
995875210a
Removed len argument from proposal_get_token()
...
Also use enumerators instead of lexparser.h to parse proposal strings.
2012-09-13 15:44:01 +02:00
Tobias Brunner
1962e12fd3
Make arguments for enumerator_create_token|directory const
2012-09-13 15:42:38 +02:00
Francois ten Krooden
8c2ec47149
Moved proposal_keywords to proposal_keywords_static
...
Added new proposal keywords with function to reference the static keywords.
2012-09-13 15:42:38 +02:00
Tobias Brunner
bc6ec4de73
Option added to enforce a configured destination address for DHCP packets
2012-09-13 10:59:24 +02:00
Andreas Steffen
493f85b696
version bump to 5.0.1rc1
2012-09-12 23:56:12 +02:00
Tobias Brunner
4a4d20de9d
Allow calls to set_address() for any host-sized TS, not only dynamic ones
...
This fixes CHILD_SA updates (e.g. due to MOBIKE), which were broken
since 4cb0783
2012-09-12 18:14:01 +02:00
Tobias Brunner
455accc687
Ensure traffic selectors are dynamic before calling set_address() when deriving them
2012-09-12 18:13:47 +02:00
Tobias Brunner
fa96a350c2
Consistently log XFRM mark masks with 0 prefix in kernel-netlink plugin
2012-09-12 17:40:36 +02:00
Tobias Brunner
dc80ef0cde
starter: Added --nolog option to suppress logging in starter itself
...
Fixes #224 .
2012-09-12 17:15:14 +02:00
Tobias Brunner
629cdca82c
Updates to strongswan.conf(5) man page (added several missing options)
2012-09-12 16:53:45 +02:00
Tobias Brunner
72970b458d
Some updates to ipsec.conf(5) man page
2012-09-12 16:53:45 +02:00
Tobias Brunner
23b4d3a52f
starter: Allow %any also for protocol in left|rightprotoport
2012-09-12 16:53:45 +02:00
Martin Willi
ab2c989c32
Don't allow NULL encryption with PEAP
2012-09-12 13:19:52 +02:00
Martin Willi
acada66a35
Use memmove on overlapping regions, and operate with correct sizeof()
2012-09-12 13:19:52 +02:00
Martin Willi
fb3cf1b708
Whitespace cleanups in tls_eap
2012-09-12 13:19:52 +02:00
Martin Willi
5b96503e13
Use uintptr_t in mem pool to avoid compiler warning if sizeof(void*) != sizeof(int)
2012-09-12 13:19:52 +02:00
Andreas Steffen
979027ae04
ikev1 hybrid authentication does not need client certificates
2012-09-12 12:42:24 +02:00
Andreas Steffen
e1588893f5
corrected topology in ikev2/rw-radius-accounting scenario
2012-09-12 12:26:39 +02:00
Andreas Steffen
9ce931f3af
added ikev2/rw-eap-dynamic scenario
2012-09-12 12:15:17 +02:00
Martin Willi
d4cca1beea
Always send a configuration payload in IKEv1 TRANSACTIONs, even if it is empty
2012-09-11 17:20:17 +02:00
Martin Willi
c4acf37502
Don't use host address for dynamic TS in IKEv1 if a virtual IP was expected
2012-09-11 16:18:29 +02:00
Martin Willi
7d82aaea8d
Don't use host address for dynamic TS in IKEv2 if a virtual IP was expected
2012-09-11 16:18:28 +02:00
Martin Willi
4cb0783f3c
Don't return a subset for a dynamic TS unless set_address has been called
2012-09-11 16:18:28 +02:00
Martin Willi
c7294f7a58
Send FAILED_CP_REQUIRED if a configuration payload was expected, but not received
2012-09-11 16:18:28 +02:00
Martin Willi
1e04488f32
Check for an existing lease in all stroke pools before creating a new one
2012-09-11 16:18:28 +02:00
Martin Willi
28a3d5bfbd
Pass full pool list to release_address
2012-09-11 16:18:28 +02:00
Martin Willi
594c58e111
Pass the full list of pools to acquire_address, enumerate in providers
...
If the provider has access to the full pool list, it can enumerate
them twice, for example to search for existing leases first, and
only search for new leases in a second step.
Fixes lease enumeration in attr-sql using multiple pools.
2012-09-11 16:18:28 +02:00
Martin Willi
dc7b79d8a5
Add a linked list constructor initializing from an enumerator
2012-09-11 16:18:28 +02:00
Martin Willi
f942588f95
Add a responder narrow() hook to change TS in the kernel, but not on the wire
2012-09-11 16:14:39 +02:00
Martin Willi
cf85ebbfec
Support RADIUS accounting when using IKEv1 with xauth-eap and eap-radius
2012-09-11 15:22:22 +02:00
Martin Willi
37095ce1c1
Fix leak while enumerating RADIUS Framed-IPs from IKE_SA
2012-09-11 15:22:22 +02:00
Tobias Brunner
f4cc7ea11b
Add uniqueids=never to ignore INITIAL_CONTACT notifies
...
With uniqueids=no the daemon still deletes any existing IKE_SA with the
same peer if an INITIAL_CONTACT notify is received. With this new option
it also ignores these notifies.
2012-09-10 17:37:18 +02:00
Martin Willi
c51af950b1
Add random plugin options to strongswan.conf.5
2012-09-10 17:07:51 +02:00
Martin Willi
7b68cd9212
Add strongswan.conf runtime options for /dev/[u]random files
...
Fixes #221 .
2012-09-10 17:07:51 +02:00
Andreas Steffen
98521f0821
this is the correct evaltest
2012-09-10 15:53:03 +02:00
Andreas Steffen
2dd0883fb7
recovered ikev2/ip-two-pools-mixed evaltest
2012-09-10 15:46:50 +02:00
Andreas Steffen
d401bcfe97
adapted ip-pool evaltests
2012-09-10 15:41:27 +02:00
Tobias Brunner
4065e2504c
Use the proper types for comma separated attributes read from strongswan.conf
...
Attributes of different address families previously were mapped to
the same attribute type (the one derived from the address family of the
first address).
2012-09-10 15:17:17 +02:00
Tobias Brunner
383c174a79
Print the name of mem pools instead of the confusing <base>/<size>
2012-09-10 12:42:09 +02:00
Tobias Brunner
747fd544a7
Properly remove broadcast address from mem pools
2012-09-10 11:44:18 +02:00
Andreas Steffen
32e30f15cb
use base IMC ID if src IMC ID is not supported
2012-09-10 00:07:54 +02:00
Andreas Steffen
3b51f34040
added libimcv.assessment_result to strongswan.conf man page
2012-09-09 23:50:32 +02:00
Andreas Steffen
a785bb8797
make sending of IETF Assessment Result attributes configurable
2012-09-09 23:24:23 +02:00
Andreas Steffen
6f93927b6c
introduced sending of standard IETF Assessment Result PA-TNC attribute by IMVs
2012-09-09 05:13:50 +02:00
Tobias Brunner
bcf8cdd556
Only initiate an exchange from send_dpd() if a task was actually queued
...
Otherwise, the initiator would prematurely initiate Quick Mode if it has
DPD enabled and XAuth is used.
2012-09-07 18:05:22 +02:00
Tobias Brunner