denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
9,755 Commits 1 Branch 0 Tags
bc6ec4de7314885d2725bccc186a527bda37c2bc
Commit Graph
932 Commits
Author SHA1 Message Date
Tobias Brunner bc6ec4de73 Option added to enforce a configured destination address for DHCP packets 2012-09-13 10:59:24 +02:00
Martin Willi 1e04488f32 Check for an existing lease in all stroke pools before creating a new one 2012-09-11 16:18:28 +02:00
Martin Willi 28a3d5bfbd Pass full pool list to release_address 2012-09-11 16:18:28 +02:00
Martin Willi 594c58e111 Pass the full list of pools to acquire_address, enumerate in providers 
If the provider has access to the full pool list, it can enumerate
them twice, for example to search for existing leases first, and
only search for new leases in a second step.

Fixes lease enumeration in attr-sql using multiple pools.
 2012-09-11 16:18:28 +02:00
Martin Willi cf85ebbfec Support RADIUS accounting when using IKEv1 with xauth-eap and eap-radius 2012-09-11 15:22:22 +02:00
Martin Willi 37095ce1c1 Fix leak while enumerating RADIUS Framed-IPs from IKE_SA 2012-09-11 15:22:22 +02:00
Tobias Brunner f4cc7ea11b Add uniqueids=never to ignore INITIAL_CONTACT notifies 
With uniqueids=no the daemon still deletes any existing IKE_SA with the
same peer if an INITIAL_CONTACT notify is received.  With this new option
it also ignores these notifies.
 2012-09-10 17:37:18 +02:00
Tobias Brunner 383c174a79 Print the name of mem pools instead of the confusing <base>/<size> 2012-09-10 12:42:09 +02:00
Andreas Steffen 6f93927b6c introduced sending of standard IETF Assessment Result PA-TNC attribute by IMVs 2012-09-09 05:13:50 +02:00
Tobias Brunner d2e8f20d94 Clear virtual IPs before storing assigned ones on the IKE_SA 
Otherwise we'll end up with duplicate or invalid VIPs stored on the
IKE_SA.
 2012-09-05 14:35:57 +02:00
Martin Willi 1323dc1138 Merge branch 'multi-vip' 
Brings support for multiple virtual IPs and multiple pools in
left/rigthsourceip definitions. Also introduces the new left/rightdns
options to configure requested DNS server address family and respond
with multiple connection specific servers.
 2012-08-31 12:55:56 +02:00
Tobias Brunner 868409139b Merge branch 'eap-client-select' 
This brings support for EAP-Nak payloads on the client (to select a
specific or supported method), and the server (via the eap-dynamic
plugin which selects a method supported/requested by the client).
 2012-08-31 12:25:41 +02:00
Tobias Brunner 333c3b6228 Added an option to prefer types sent by peer in eap-dynamic plugin 2012-08-31 11:42:03 +02:00
Tobias Brunner 3dde55e67b eap-dynamic plugin handles EAP-Nak messages and selects a method supported by the peer 2012-08-31 11:42:03 +02:00
Tobias Brunner a2f1d75eae Preferred EAP methods for eap-dynamic can be configured 2012-08-31 11:42:03 +02:00
Tobias Brunner a2a61ec2e2 The eap-dynamic plugin uses the first supported method as default 2012-08-31 11:42:03 +02:00
Tobias Brunner 700ff5def9 Added eap-dynamic plugin which can proxy any other EAP method 2012-08-31 11:42:01 +02:00
Tobias Brunner 7240914955 Use eap_vendor_type_from_string() in stroke 2012-08-31 11:40:28 +02:00
Tobias Brunner cc4eec56f7 Encode EAP-Naks in expanded format if we got an expanded type request 
Since methods defined by the IETF (vendor ID 0) could also be encoded in
expanded type format the previous check was insufficient.
 2012-08-31 11:40:27 +02:00
Tobias Brunner 78e8dca94f Allow clients to request a configured EAP method via EAP-Nak 2012-08-31 11:40:27 +02:00
Tobias Brunner af04233e14 Send EAP-Nak with supported types if requested type is unsupported 2012-08-31 11:40:27 +02:00
Martin Willi 980c468cdc DHCP plugin returns virtual IPs for IPv4 requests only 2012-08-30 16:43:44 +02:00
Martin Willi 769446a8c7 Check address family in HA virtual IP backend 2012-08-30 16:43:44 +02:00
Martin Willi 7b83cc62e0 Handle comma separated pools as multiple pool names in SQL plugin 2012-08-30 16:43:43 +02:00
Martin Willi d55fe264d1 Pass all configured pool names to attribute provider enumerator 2012-08-30 16:43:43 +02:00
Martin Willi feb8550401 Pass a list instead of a single virtual IP to attribute enumerators 2012-08-30 16:43:42 +02:00
Martin Willi 96c2b3cf89 Support multiple addresses/pools in left/rightsourceip 2012-08-30 16:43:42 +02:00
Martin Willi 497ce2cf51 Support multiple address pools configured on a peer_cfg 2012-08-30 16:43:42 +02:00
Martin Willi 101d26babe Support multiple virtual IPs on peer_cfg and ike_sa classes 2012-08-30 16:43:42 +02:00
Andreas Steffen 014d007000 use pen_type_t for PA Message Subtype 2012-08-23 10:49:00 +02:00
Martin Willi e0d3014a17 Add a DNS attribute handler to updown, passing servers to updown script 2012-08-21 09:38:01 +02:00
Martin Willi 63e460542c Add a stroke attribute_handler requesting DNS servers given with leftdns 2012-08-21 09:38:01 +02:00
Martin Willi 9937ca069a Serve ipsec.conf rightdns servers through stroke attribute provider 2012-08-21 09:38:01 +02:00
Martin Willi 17319aa28d Add a left/rightdns keyword to configure connection specific DNS attributes 2012-08-21 09:38:00 +02:00
Tobias Brunner ba27bf2af0 CAP_AUDIT_WRITE is now required by xauth-pam not eap-gtc plugin 2012-08-17 14:24:48 +02:00
Tobias Brunner 113d2a6b99 Removed manual EAP method registration in eap-gtc plugin 2012-08-17 14:24:37 +02:00
Tobias Brunner aaefeafb49 Enable UDP decapsulation for both address families 
Since the 3.5 Linux kernel both UDP implementations have a separate static
flag to indicate whether ANY sockets enabled UDP decapsulation.
As we only ever enabled it for one address family (in earlier versions IPv4
only, now for IPv6, if supported, and for IPv4 otherwise) UDP decapsulation
wouldn't work anymore (at least for one address family).
 2012-08-16 15:26:37 +02:00
Tobias Brunner 11b514bff6 Correctly transmit EAP-MSCHAPv2 user name if it contains a domain part 2012-08-16 10:03:49 +02:00
Tobias Brunner e4ef4c9877 Merge branch 'android-ndk' 
This branch comes with some preliminary changes for the user-land IPsec
implementation and the Android App.

One important change is that the UDP ports used by the socket-default plugin
were made configurable (either via ./configure or strongswan.conf).
Also, the plugin does randomly allocate a port if it is configured to 0,
which is useful for client implementations.  A consequence of these
changes is that the local UDP port used when creating ike_cfg_t objects has
to be fetched from the socket.
 2012-08-13 10:45:39 +02:00
Tobias Brunner 000668d308 Doxygen fix 2012-08-11 16:50:22 +02:00
Martin Willi 27128c1e32 EAP-GTC can use any XAuth backend, including xauth-pam 
This makes EAP-GTC a generic plain password authentication method,
as it is used with XAuth. Instead of verifying credentials with
PAM, any backend can be configured. The default is xauth-pam,
providing the same functionality as EAP-GTC in strongSwan 4.x.
 2012-08-10 10:43:44 +02:00
Martin Willi b9e4916321 Add xauth-pam, an XAuth backend verifying credentials with PAM 2012-08-10 10:43:44 +02:00
Andreas Steffen da21793679 make max_message_size parameter consistent with similar options 2012-08-09 14:11:08 +02:00
Tobias Brunner 6fbf4472ea Added option to prevent socket-default from setting the source address on outbound packets 2012-08-08 15:39:07 +02:00
Tobias Brunner 224ab4c59b socket-default plugin allocates random ports if configured to 0. 
Also added strongswan.conf options to change the ports.
 2012-08-08 15:30:27 +02:00
Tobias Brunner b223d517c8 Replaced usages of CHARON_*_PORT with calls to get_port(). 2012-08-08 15:12:25 +02:00
Tobias Brunner a7babe25ee Added get_port() method to socket_t to learn the listening port. 2012-08-08 15:12:25 +02:00
Tobias Brunner 896941d365 Improved how NAT-T keepalives are handled in sockets/receiver. 2012-08-08 15:12:24 +02:00
Tobias Brunner e49abcede0 Let kernel interfaces decide how to enable UDP decapsulation of ESP packets. 2012-08-08 15:12:24 +02:00
Tobias Brunner 064da8b96b Add Non-ESP marker in sender and not individual socket plugins. 2012-08-08 15:12:24 +02:00