denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
9,770 Commits 1 Branch 0 Tags
b7a500e985811549c42e817ce48d3b6fc2fb45bf
Commit Graph
7590 Commits
Author SHA1 Message Date
Tobias Brunner b7a500e985 Set AUTH_RULE_IDENTITY_LOOSE for rightid=%<identity> 2012-09-18 14:40:41 +02:00
Tobias Brunner e6fcc172f8 Use AUTH_RULE_IDENTITY_LOOSE in NetworkManager backend 2012-09-18 14:40:40 +02:00
Tobias Brunner e596d0ef1e android: Use AUTH_RULE_IDENTITY_LOOSE 2012-09-18 11:21:49 +02:00
Tobias Brunner 3a8852c76f Add AUTH_RULE_IDENTITY_LOOSE which allows to use IDr loosely as initiator 
If it is set on an auth config IDr will not be sent, and later the configured
identity will not only be checked against the returned IDr, but also
against other identities contained in the responder's certificate.
 2012-09-18 11:16:10 +02:00
Tobias Brunner cf1ec85207 New Android release after fixing Unicode conversion bug 2012-09-17 10:55:10 +02:00
Tobias Brunner b7c54cf226 android: Fix conversion of actual Unicode strings (i.e. bytes!=chars) 2012-09-17 10:30:39 +02:00
Tobias Brunner 6d30954ae8 Removed the unneeded socket-raw plugin 2012-09-14 14:10:14 +02:00
Tobias Brunner a889cfe5e1 Change traffic selectors during Quick Mode in case of a NAT in transport mode 
Windows 7 sends its internal address as TSi.  While we don't support the
NAT-T drafts as used by Windows XP it is interesting to note that the
client there omits the TSi payload which then would automatically get set
to the public IP address of the client.

Fixes #220.
 2012-09-14 09:40:18 +02:00
Tobias Brunner 08ad639f32 Added algorithm lookup via kernel_interface_t to the various kernel interfaces 2012-09-13 15:48:49 +02:00
Tobias Brunner 524fb37ccd Added possibility to register custom kernel algorithms to kernel interface 2012-09-13 15:44:47 +02:00
Tobias Brunner 4c57c63062 Added possibility to register custom proposal keywords 
Keyword lookup and registration are handled via the new lib->proposal object.
 2012-09-13 15:44:46 +02:00
Tobias Brunner 995875210a Removed len argument from proposal_get_token() 
Also use enumerators instead of lexparser.h to parse proposal strings.
 2012-09-13 15:44:01 +02:00
Tobias Brunner 1962e12fd3 Make arguments for enumerator_create_token|directory const 2012-09-13 15:42:38 +02:00
Francois ten Krooden 8c2ec47149 Moved proposal_keywords to proposal_keywords_static 
Added new proposal keywords with function to reference the static keywords.
 2012-09-13 15:42:38 +02:00
Tobias Brunner bc6ec4de73 Option added to enforce a configured destination address for DHCP packets 2012-09-13 10:59:24 +02:00
Tobias Brunner 4a4d20de9d Allow calls to set_address() for any host-sized TS, not only dynamic ones 
This fixes CHILD_SA updates (e.g. due to MOBIKE), which were broken
since 4cb0783.
 2012-09-12 18:14:01 +02:00
Tobias Brunner 455accc687 Ensure traffic selectors are dynamic before calling set_address() when deriving them 2012-09-12 18:13:47 +02:00
Tobias Brunner fa96a350c2 Consistently log XFRM mark masks with 0 prefix in kernel-netlink plugin 2012-09-12 17:40:36 +02:00
Tobias Brunner dc80ef0cde starter: Added --nolog option to suppress logging in starter itself 
Fixes #224.
 2012-09-12 17:15:14 +02:00
Tobias Brunner 23b4d3a52f starter: Allow %any also for protocol in left|rightprotoport 2012-09-12 16:53:45 +02:00
Martin Willi ab2c989c32 Don't allow NULL encryption with PEAP 2012-09-12 13:19:52 +02:00
Martin Willi acada66a35 Use memmove on overlapping regions, and operate with correct sizeof() 2012-09-12 13:19:52 +02:00
Martin Willi fb3cf1b708 Whitespace cleanups in tls_eap 2012-09-12 13:19:52 +02:00
Martin Willi 5b96503e13 Use uintptr_t in mem pool to avoid compiler warning if sizeof(void*) != sizeof(int) 2012-09-12 13:19:52 +02:00
Martin Willi d4cca1beea Always send a configuration payload in IKEv1 TRANSACTIONs, even if it is empty 2012-09-11 17:20:17 +02:00
Martin Willi c4acf37502 Don't use host address for dynamic TS in IKEv1 if a virtual IP was expected 2012-09-11 16:18:29 +02:00
Martin Willi 7d82aaea8d Don't use host address for dynamic TS in IKEv2 if a virtual IP was expected 2012-09-11 16:18:28 +02:00
Martin Willi 4cb0783f3c Don't return a subset for a dynamic TS unless set_address has been called 2012-09-11 16:18:28 +02:00
Martin Willi c7294f7a58 Send FAILED_CP_REQUIRED if a configuration payload was expected, but not received 2012-09-11 16:18:28 +02:00
Martin Willi 1e04488f32 Check for an existing lease in all stroke pools before creating a new one 2012-09-11 16:18:28 +02:00
Martin Willi 28a3d5bfbd Pass full pool list to release_address 2012-09-11 16:18:28 +02:00
Martin Willi 594c58e111 Pass the full list of pools to acquire_address, enumerate in providers 
If the provider has access to the full pool list, it can enumerate
them twice, for example to search for existing leases first, and
only search for new leases in a second step.

Fixes lease enumeration in attr-sql using multiple pools.
 2012-09-11 16:18:28 +02:00
Martin Willi dc7b79d8a5 Add a linked list constructor initializing from an enumerator 2012-09-11 16:18:28 +02:00
Martin Willi f942588f95 Add a responder narrow() hook to change TS in the kernel, but not on the wire 2012-09-11 16:14:39 +02:00
Martin Willi cf85ebbfec Support RADIUS accounting when using IKEv1 with xauth-eap and eap-radius 2012-09-11 15:22:22 +02:00
Martin Willi 37095ce1c1 Fix leak while enumerating RADIUS Framed-IPs from IKE_SA 2012-09-11 15:22:22 +02:00
Tobias Brunner f4cc7ea11b Add uniqueids=never to ignore INITIAL_CONTACT notifies 
With uniqueids=no the daemon still deletes any existing IKE_SA with the
same peer if an INITIAL_CONTACT notify is received.  With this new option
it also ignores these notifies.
 2012-09-10 17:37:18 +02:00
Martin Willi 7b68cd9212 Add strongswan.conf runtime options for /dev/[u]random files 
Fixes #221.
 2012-09-10 17:07:51 +02:00
Tobias Brunner 4065e2504c Use the proper types for comma separated attributes read from strongswan.conf 
Attributes of different address families previously were mapped to
the same attribute type (the one derived from the address family of the
first address).
 2012-09-10 15:17:17 +02:00
Tobias Brunner 383c174a79 Print the name of mem pools instead of the confusing <base>/<size> 2012-09-10 12:42:09 +02:00
Tobias Brunner 747fd544a7 Properly remove broadcast address from mem pools 2012-09-10 11:44:18 +02:00
Andreas Steffen 32e30f15cb use base IMC ID if src IMC ID is not supported 2012-09-10 00:07:54 +02:00
Andreas Steffen a785bb8797 make sending of IETF Assessment Result attributes configurable 2012-09-09 23:24:23 +02:00
Andreas Steffen 6f93927b6c introduced sending of standard IETF Assessment Result PA-TNC attribute by IMVs 2012-09-09 05:13:50 +02:00
Tobias Brunner bcf8cdd556 Only initiate an exchange from send_dpd() if a task was actually queued 
Otherwise, the initiator would prematurely initiate Quick Mode if it has
DPD enabled and XAuth is used.
 2012-09-07 18:05:22 +02:00
Tobias Brunner ccba4f1533 android: New release after adding certificate authentication and reauth fix 2012-09-06 14:54:37 +02:00
Tobias Brunner 3babde90bb Trigger ike_updown event caused by retransmits only after reestablish() has been called 
This allows listeners to migrate to the new IKE_SA with the
ike_reestablish event without having to worry about an ike_updown event
for the old IKE_SA.
 2012-09-06 11:27:28 +02:00
Tobias Brunner d7d2a5ec38 android: Properly handle reauthentication initiated by the client 2012-09-06 11:27:07 +02:00
Tobias Brunner 0326ceda64 android: Create a new VpnService.Builder after VPN has been established 2012-09-06 11:25:24 +02:00
Tobias Brunner 4dbb193190 Add ike_reestablish() event that is triggered when an IKE_SA is reestablished 
This is particularly useful during reauthentication to get the new
IKE_SA.
 2012-09-06 11:25:14 +02:00