denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
11,380 Commits 1 Branch 0 Tags
bb802daacc8a8ade78c3d3af89cea3e0cad9ca5a
Commit Graph
11380 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Andreas Steffen bb802daacc Fixed libipsec/rw-suite-b scenario 2013-07-01 12:32:45 +02:00
Martin Willi 282e4d2c7c eap-radius: fix add_attribute/framed_ip method signatures 2013-07-01 11:53:52 +02:00
Andreas Steffen 3405156f97 Added libipsec/rw-suite-b scenario 2013-07-01 11:04:14 +02:00
Andreas Steffen 9ea77350ce Fixed index.txt for strongSwan EC CA 2013-07-01 11:01:11 +02:00
Andreas Steffen 6c969fee94 Don't backup old package lists 2013-07-01 10:00:43 +02:00
Tobias Brunner c949a4d501 Reuse reqid when restarting CHILD_SAs for dpd|closeaction=restart 2013-07-01 09:58:34 +02:00
Tobias Brunner 4c74fa664b Reuse reqid for trap policies installed for dpd|closeaction=hold 2013-07-01 09:58:25 +02:00
Andreas Steffen 156e552caf Added libipsec/net2net-cert scenario 2013-06-29 22:23:45 +02:00
Reto Buerki 1cfefd38a2 Add type=transport to tkm/host2host-* connections 
Explicitly specify transport mode in connection configuration of the
responding host (sun).
 2013-06-29 15:07:10 +02:00
Andreas Steffen b1f1e5e5f2 5.1.0 changes for test cases 2013-06-29 00:07:15 +02:00
Tobias Brunner b1b0cce396 processor: Simplified the main loop 2013-06-28 17:02:06 +02:00
Tobias Brunner 6ca25ccc04 processor: Don't hold the lock while destroying jobs 
If a lock is held when queue_job() is called and the same lock is
required during the destruction of a job, holding the internal lock
in the processor while calling destroy() could result in a deadlock.
 2013-06-28 17:02:05 +02:00
Tobias Brunner 50daffb784 dhcp: Use chunk_hash_static() to calculate ID-based MAC addresses 2013-06-28 17:00:29 +02:00
Tobias Brunner f95205f580 integrity-checker: Use chunk_hash_static() to calculate checksums 2013-06-28 17:00:29 +02:00
Tobias Brunner ed235dbbf2 chunk: Add predictable hash function 
Since chunk_hash() is randomized its output is not predictable, that is,
it is only within the same process.
 2013-06-28 17:00:29 +02:00
Tobias Brunner b7b5432ff8 stroke: Changed how proto/port are specified in left|rightsubnet 
Using a colon as separator conflicts with IPv6 addresses.
 2013-06-28 15:10:09 +02:00
Tobias Brunner b18a531715 plugin-loader: Removed unused path argument of load() method 
Multiple additional search paths can be added with the add_path()
method.
 2013-06-28 10:44:15 +02:00
Tobias Brunner 9da142b4dc tnc-pdp: Initialize TNC-PDP in plugin callback with proper dependencies 2013-06-27 18:02:53 +02:00
Andreas Steffen 5b7536c803 Attestation IMV requests platform info if not received 2013-06-27 17:30:14 +02:00
Tobias Brunner 75ff252324 integrity-checker: Fix checksum calculation after randomizing chunk_hash() 2013-06-27 15:34:08 +02:00
Tobias Brunner fcc33c0cd4 unit-tests: Print loaded plugins 2013-06-27 11:27:13 +02:00
Tobias Brunner a6357a62b4 unit-tests: RSA key generation might take longer than 4 seconds 
Check uses a default timeout of 4 seconds for each test case, generating
keys of 6 different key sizes might take longer than that.
 2013-06-27 11:06:47 +02:00
Tobias Brunner 65d23c7c90 tests: Properly load plugins from build directory 
Calling load() incrementally does not really work as dependencies
wouldn't be resolved properly if a required feature was to be provided
by a plugin that is loaded later with a separate call to load().
 2013-06-27 11:06:47 +02:00
Tobias Brunner f2086e42ff plugin-loader: Method added to provide additional search paths for plugins 2013-06-27 10:27:24 +02:00
Andreas Steffen 71c7b43541 Support blacklist field in PTS database 2013-06-26 12:07:09 +02:00
Andreas Steffen de8de88fa7 Updated PTS demo database 2013-06-26 10:14:25 +02:00
Andreas Steffen f4dcbe3bf2 Device can be member of multiple groups 2013-06-25 18:43:07 +02:00
Tobias Brunner 78e6f69e5a Adding NEWS for 5.1.0 2013-06-25 17:51:42 +02:00
Tobias Brunner 9da5a2ed1e Merge branch 'check-caps' 
Plugins may now ensure the process has all the required capabilities.
Some minor changes to UID/GID handling are also included.
 2013-06-25 17:17:40 +02:00
Tobias Brunner ac2ffde4ae capabilities: Return effective UID/GID if user did not configure anything 2013-06-25 17:16:33 +02:00
Tobias Brunner 68b7448eab capabilities: Make the user and group charon(-nm) changes to configurable 2013-06-25 17:16:33 +02:00
Tobias Brunner 5e80e387bd capabilities: Report effective UID/GID after dropping capabilities 2013-06-25 17:16:33 +02:00
Tobias Brunner 1091edede8 capabilities: CAP_CHOWN might be required by many plugins opening UNIX sockets 
But as the sockets will be created with the user/group of the running
process this might not be required as no change may be needed.
 2013-06-25 17:16:33 +02:00
Tobias Brunner 1937538440 capabilities: Handle CAP_CHOWN specially as it might not be required 2013-06-25 17:16:33 +02:00
Tobias Brunner 9c354c659f capabilities: Check effective UID as fallback if capabilities are not supported 2013-06-25 17:16:33 +02:00
Tobias Brunner 9fd2583e6b kernel-netlink: Make CAP_NET_ADMIN capability optional 
It is not required to use the kernel-net part of the plugin.
 2013-06-25 17:16:32 +02:00
Tobias Brunner 405f5ab9e9 farp: Require CAP_NET_RAW capability to open AF_PACKET socket 2013-06-25 17:16:32 +02:00
Tobias Brunner 6f15f5e632 dhcp: Require CAP_NET_BIND_SERVICE and CAP_NET_RAW to open/bind sockets 2013-06-25 17:16:32 +02:00
Tobias Brunner 1dd61bf13d socket-default: Require CAP_NET_BIND_SERVICE for ports < 1024 
Since we don't know which ports are used with socket-dynamic we can't
demand the capability there, but it might still be required.
 2013-06-25 17:16:32 +02:00
Tobias Brunner 41b8546ac0 capabilities: Only plugins that require CAP_NET_ADMIN demand it 
The daemon as such does not require this capability.
 2013-06-25 17:16:32 +02:00
Tobias Brunner a2eb581781 capabilities: Move global capabilities_t instance to libstrongswan 2013-06-25 17:16:32 +02:00
Tobias Brunner 2e21bac19a capabilities: Ensure required capabilities are actually held by the process/user 2013-06-25 17:16:32 +02:00
Martin Willi a650242643 ikev2: keep the CHILD_SA we delete as initiator in the list to destroy 
If the responder not correctly send the correct protocol or SPI in the delete
response, we should remove the CHILD_SA regardless.
 2013-06-25 14:03:51 +02:00
Andreas Steffen 72631301eb Some IMV policy managers expect a TEXT string 2013-06-25 12:47:07 +02:00
Andreas Steffen 59c9ec107f Assign default group to newly created devices 2013-06-25 11:49:32 +02:00
Andreas Steffen 632e5b0b99 Set device creation date if it hasn't been set yet 2013-06-24 20:18:16 +02:00
Tobias Brunner e8db483f41 unit-tester: RSA test was removed 2013-06-24 16:01:23 +02:00
Andreas Steffen 7867c1a315 Aligned AR Identity types to IF-IMV 1.4 R5 draft 2013-06-24 00:23:50 +02:00
Andreas Steffen 69c4715bf8 Send PA-TNC assessment result even if no workitems are available 2013-06-24 00:22:38 +02:00
Andreas Steffen 02497901d0 Some pacman fixes 2013-06-23 16:23:19 +02:00