Tobias Brunner
aa71f5f515
error-notify: Use plugin features to register listener
2013-06-11 11:18:17 +02:00
Tobias Brunner
57c29f6895
duplicheck: Use plugin features to register listener
2013-06-11 11:18:17 +02:00
Tobias Brunner
6c51ff745c
coupling: Use plugin features and soft depend on SHA1
2013-06-11 11:18:17 +02:00
Tobias Brunner
0c52198bc1
certexpire: Use plugin features to register listener
2013-06-11 11:18:17 +02:00
Tobias Brunner
94ca7252c1
addrblock: Use plugin features with soft dependency on X.509 decoding
2013-06-11 11:18:17 +02:00
Tobias Brunner
12459a4dc8
dhcp: Use plugin features with dependency to RNG implementation
2013-06-11 11:18:17 +02:00
Tobias Brunner
11a27ea28f
sql: Use plugin features with dependency to database backend
2013-06-11 11:18:17 +02:00
Tobias Brunner
270e425b24
Socket plugins soft depend on the kernel-ipsec plugin feature
...
On most platforms calls to methods to bypass the IKE sockets and enabling
UDP decapsulation are required.
2013-06-11 11:18:17 +02:00
Tobias Brunner
de42bf35f9
Converted test for recursive mutex_t
2013-06-11 11:03:11 +02:00
Tobias Brunner
4e67f19528
Converted tests for chunk_t
2013-06-11 11:03:11 +02:00
Tobias Brunner
e09461bf77
Converted and added tests for hashtable_t
2013-06-11 11:03:10 +02:00
Tobias Brunner
0298be5705
Converted tests for identification_t
2013-06-11 11:03:10 +02:00
Tobias Brunner
3cbacad40b
Remove obsolete enumerator/linked_list tests in unit_tester plugin
2013-06-11 11:03:10 +02:00
Emanuil Hristov
2ce403438f
updown: pass IKE_SA unique ID in PLUTO_UNIQUEID
2013-05-16 10:13:22 +02:00
Tobias Brunner
6040eff900
stroke: Add second password if provided
2013-05-08 15:02:41 +02:00
Tobias Brunner
1c080407b2
stroke: Fail silently if another builder calls PW callback after giving up
...
Also reduced the number of tries to 3.
2013-05-08 15:02:41 +02:00
Tobias Brunner
4a64c3e9a0
stroke: Cache passwords so the user is not prompted multiple times for the same password
...
To verify/decrypt a PKCS#12 container a password might be needed
multiple times. If it was entered correctly we don't want to bother the
user again with another password prompt.
The passwords for MAC creation and encryption could be different so the
user might be prompted multiple times after all.
2013-05-08 15:02:41 +02:00
Tobias Brunner
e240b03e68
stroke: Fix prompt and error messages in passphrase callback
2013-05-08 15:02:41 +02:00
Tobias Brunner
7971278c92
stroke: Load credentials from PKCS#12 files (P12 token)
2013-05-08 15:02:41 +02:00
Tobias Brunner
87692be215
Load any type (RSA/ECDSA) of public key via left|rightsigkey
2013-05-07 17:08:31 +02:00
Tobias Brunner
fa1d3d39dc
left|rightrsasigkey accepts SSH keys but the key format has to be specified explicitly
...
The default is now PKCS#1. With the dns: and ssh: prefixes other formats
can be selected.
2013-05-07 15:38:28 +02:00
Tobias Brunner
c0bbddfa42
Try to load raw keys from ipsec.conf as PKCS#1 blob first
...
The DNSKEY builder is quite eager and parses pretty much anything
as RSA key, so this has to be done before.
2013-05-07 14:08:51 +02:00
Martin Willi
5c12700f9a
kernel-interface: query SAD for last use time if SPD query didn't yield one
2013-05-06 17:01:13 +02:00
Martin Willi
dc35d097b3
socket-default: to bind to one dynamic port on OS X, create v4 socket before v6
...
It seems that the order of binding sockets of different address families to the
same dynamic port must be v6-before-v4 on Linux, but v4-before-v6 on OS X.
2013-05-06 16:10:11 +02:00
Martin Willi
a30727fe2b
socket-default: refactor socket pair opening to a function
2013-05-06 16:10:11 +02:00
Martin Willi
6948df3220
socket-default: Don't try to send packet if we haven't a socket for given family
2013-05-06 16:10:10 +02:00
Martin Willi
e9326eba13
socket-default: Use -1 if socket is not available, as 0 is actually a valid fd
2013-05-06 16:10:10 +02:00
Martin Willi
d3874008e8
socket-dynamic: when sending from port zero, allocate a free port dynamically
2013-05-06 15:28:26 +02:00
Martin Willi
0be946dce3
Use the GEN silent rule when generating files with sed
2013-05-06 15:04:56 +02:00
Martin Willi
aea7ce3c64
eap-radius: add an option to disable accounting for tunnels without virtual IP
2013-05-06 14:56:01 +02:00
Martin Willi
69620a48e8
eap-radius: use IKE_SA unique id instead of peer identity to manage virtual IPs
...
Fixes some corner cases if multiple tunnels use the same peer identity.
2013-05-06 14:56:01 +02:00
Andreas Steffen
2d902d7e7c
fixed typo
2013-04-19 18:33:41 +02:00
Martin Willi
b2b99e61c8
eap-radius: Add an option to exclude ports from Called/Calling-Station-Id
2013-04-10 13:48:03 +02:00
Andreas Steffen
12fa1784d0
emit a single assig_vips bus message for all VIPs
2013-04-06 14:16:30 +02:00
Andreas Steffen
ba2880d569
ifmap plugin subscribes to assing_vip bus signal
2013-04-06 11:09:41 +02:00
Tobias Brunner
14edee56bf
unity: Check IKE_SA in only after enumerating virtual IPs
2013-04-05 16:03:10 +02:00
Andreas Steffen
2a4915e87a
cleaned up XML code in tnccs-11 plugin
2013-04-04 17:12:07 +02:00
Martin Willi
9c84bbcbc0
duplicheck: track multiple IKE_SAs in checking state to avoid any races
...
When two consequent duplicates have been detected, track state of each checking
IKE_SA separately, avoiding potential race conditions between the active SA
and the different SAs in checking state.
2013-04-04 15:51:48 +02:00
Andreas Steffen
93f53a78b5
fixed memory leak
2013-04-03 21:38:04 +02:00
Andreas Steffen
3ea6fcb593
properly handle orphaned renewSession jobs
2013-04-03 21:38:04 +02:00
Andreas Steffen
91503c2112
support chunked HTTP responses
2013-04-03 21:38:04 +02:00
Andreas Steffen
1044710b04
implemented periodic IF-MAP RenewSession request
2013-04-03 21:38:04 +02:00
Martin Willi
7f4f1e8249
List all stroke counters when "all" is given, and report if connection not known
2013-04-03 14:58:08 +02:00
Andreas Steffen
d4a1ae3af1
allow retrieval of private keys from other credential sets
2013-04-02 08:55:40 +02:00
Andreas Steffen
c2c4125cde
improve checking of sent and received http messages
2013-04-02 08:55:40 +02:00
Tobias Brunner
eca499f3d9
Load raw keys before possibly destroying the identity
...
If no identity (or %any) is configured the identification_t object is
destroyed and an invalid object was associated with the created pubkey
certificate.
Actually using %any does not work as the certificate would not match
when the client later provides an identity.
2013-04-01 13:48:34 +02:00
Tobias Brunner
a009aedb0b
ipseckey: Use proper daemon name for enable option
2013-04-01 13:46:09 +02:00
Tobias Brunner
53ac177cde
Properly handle situation if no resolver plugins are loaded
2013-04-01 13:44:04 +02:00
Andreas Steffen
5a516a83da
fixed capability metadata
2013-03-31 22:15:42 +02:00
Andreas Steffen
45e2be2399
renamed tnc_ifmap2 plugin to tnc_ifmap
2013-03-31 16:37:30 +02:00
Tobias Brunner