denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
11,787 Commits 1 Branch 0 Tags
beffdc6ab8cb5139c9e0b0ee2e7585c5262e702f
Commit Graph
1306 Commits
Author SHA1 Message Date
Martin Willi beffdc6ab8 ike-cfg: remove the to be obsoleted allow any parameter in get_my/other_addr 2013-09-04 10:38:37 +02:00
Martin Willi a858064455 stroke: ignore a leftsourceip if a rightsourceip is given as well 
As we always negotiate virtual IPs in charon, having both left- and
rightsourceip is not allowed. Both in IKEv1 and IKEv2 we support a single
configuration payload exchange only.
 2013-09-04 10:33:38 +02:00
Martin Willi 2bae838d5e stroke: re-enable modeconfig keyword 2013-09-04 10:33:38 +02:00
Martin Willi 9aeaa7396e peer-cfg: add a pull/push mode option to use with mode config 2013-09-04 10:33:37 +02:00
Martin Willi 45797bd50b xauth-generic: honor requested XAuth credential types as a client 
Support requesting of XAuth PINs and print XAuth messages.
 2013-09-03 16:26:19 +02:00
Martin Willi d787ada894 eap-radius: support XAuth configuration profiles, defining multiple XAuth rounds 2013-09-03 16:26:19 +02:00
Martin Willi 510ecf612a xauth: add a configuration string option to be passed to XAuth instances 
The configuration string is appended to the XAuth backend name, separated by
a colon. The configuration string is passed untouched to the backend, where
it can change the behavior of the XAuth module.
 2013-09-03 16:26:19 +02:00
Andreas Steffen 0d9e375193 Selectively enable PT-TLS and/or RADIUS sockets in tnc-pdp plugin 2013-08-26 20:36:07 +02:00
Martin Willi 49032d15be stroke: stop enumerating IKE_SAs in statusall if output stream gets closed 
If the output stream is not interested in more information, it can close the
the stream. Checking for stream errors avoids useless enumeration of IKE_SAs,
saving resources. This allows to use "ipsec statusall | head" to monitor the
daemon, or stop enumerating IKE_SAs after a specific entry has been found.
 2013-08-23 14:27:17 +02:00
Andreas Steffen 1e92d5f114 Process PB-TNC batches received via PT-TLS asynchronously 2013-08-19 09:52:12 +02:00
Andreas Steffen 6aff4b5ce8 Show host address of peer connecting to PT-TLS socket 2013-08-15 23:34:23 +02:00
Andreas Steffen f420d5f380 enabled SASL PLAIN authentication 2013-08-15 23:34:22 +02:00
Andreas Steffen 8327c44b74 PT-TLS connection is properly terminated 2013-08-15 23:34:22 +02:00
Andreas Steffen 12b3db5006 moved tnc_imv plugin to libtnccs thanks to recommendation callback function 2013-08-15 23:34:22 +02:00
Andreas Steffen e8f65c5cde Moved tnc-tnccs, tnc-imc, tnccs-11, tnccs-20 and tnccs-dynamic libcharon plugins to libtnccs 2013-08-15 23:34:22 +02:00
Andreas Steffen 180a2f2642 rapid PT-TLS AR/PDP prototype 2013-08-15 23:34:22 +02:00
Andreas Steffen f5b5d262e8 Add PT-TLS interface to strongSwan PDP 2013-08-15 23:34:22 +02:00
Martin Willi 881e9a7e2e updown: remove description of unsupported PLUTO_ variables 
These have been set by pluto, but are not by charons updown plugin.
 2013-08-08 14:48:32 +02:00
Tobias Brunner 58e32e4871 tnc-pdp: Initialize struct msghdr properly when reading RADIUS messages 
Before this e.g. msg_controllen was not initialized properly which could
cause invalid reads.
 2013-07-31 22:16:58 +02:00
Tobias Brunner d12fc14616 whitelist: Fix compilation on FreeBSD 2013-07-31 22:16:58 +02:00
Andreas Steffen cc5bedbb98 Callback job is not needed any more 2013-07-31 22:13:49 +02:00
Tobias Brunner 1cf8022839 unity: Handle multi-valued UNITY_SPLIT_INCLUDE/UNITY_LOCAL_LAN attributes 
Cisco devices seem to add 6 bytes of padding between each address/mask
pair.

Fixes #366.
 2013-07-29 21:44:27 +02:00
Andreas Steffen ef580b0137 tnc-pdp now uses watcher_t 2013-07-29 17:16:21 +02:00
Martin Willi 3a399574c2 eap-radius: do RADIUS/IKE attribute forwarding in XAuth backend 2013-07-29 09:00:49 +02:00
Martin Willi c434b2a4a9 eap-radius: support plain XAuth RADIUS authentication using User-Password 2013-07-29 09:00:49 +02:00
Martin Willi 9aeb6cea4c eap-radius: export function to build common attributes of Access-Request 2013-07-29 09:00:48 +02:00
Martin Willi 94ec80e74c eap-radius: export function to process common attributes of Access-Accept 2013-07-29 09:00:48 +02:00
Tobias Brunner 16748bdff7 socket-dynamic: Properly initialize IPv6 address 2013-07-24 16:17:22 +02:00
Tobias Brunner 0c76d820dc tnc-ifmap: Use proper cast for length when using %.*s 2013-07-24 10:54:47 +02:00
Tobias Brunner 62293ed271 coupling: Fix call to call_hook() 2013-07-22 17:53:56 +02:00
Tobias Brunner a14d907e33 tnc-pdp: Fix reading port setting from strongswan.conf 2013-07-22 17:43:54 +02:00
Martin Willi b4b3959b22 stream-service: move CAP_CHOWN check from plugins to service constructor 
A plugin service can be a TCP socket now, so it does not make much sense
to strictly check for CAP_CHOWN.
 2013-07-18 16:00:31 +02:00
Martin Willi 8fc89db7b6 certexpire: add an option to enforce exporting trustchains having a private key 2013-07-18 16:00:31 +02:00
Martin Willi 868abd0626 error-notify: catch and forward some alerts related to certificate validation 2013-07-18 16:00:30 +02:00
Martin Willi 4d7a762871 credmgr: introduce a hook function to catch trust chain validation errors 2013-07-18 16:00:30 +02:00
Martin Willi f7cff7fac4 lookip: double size of id field in message 2013-07-18 16:00:30 +02:00
Martin Willi f33d1d503f error-notify: increase size of string/identity fields in messages 2013-07-18 16:00:30 +02:00
Martin Willi 0a35ae781d whitelist: use a read-copy when listing entries 
While this requires a little more overhead, we can free the lock should the
stream block, allowing other threads to add/remove entries.
 2013-07-18 16:00:30 +02:00
Martin Willi 0ccc5bb216 whitelist: fix error handling when creating the socket fails 2013-07-18 16:00:30 +02:00
Martin Willi d3278c1f73 lookip: fix error handling when creating the socket fails 2013-07-18 16:00:30 +02:00
Martin Willi cfdb5f4855 error-notify: fix error handling when creating the socket fails 2013-07-18 16:00:30 +02:00
Martin Willi 5f755cef46 eap-radius: use watcher instead of receiver thread on DAE socket 2013-07-18 16:00:30 +02:00
Martin Willi c0db5d3845 dhcp: use watcher instead of dedicated receiver thread 2013-07-18 16:00:30 +02:00
Martin Willi 17028e29c2 farp: use watcher instead of dedicated receiver thread 2013-07-18 16:00:29 +02:00
Martin Willi 73da4ed849 load-tester: use a stream service to dispatch control connections 2013-07-18 16:00:29 +02:00
Martin Willi e11c02c8f1 whitelist: use a stream service to accept client connections 
Use SOCK_STREAM, as we don't have SOCK_SEQPACKET on TCP. To have network
transparency, the message now uses network byte order.
 2013-07-18 16:00:29 +02:00
Martin Willi 091d0afa21 lookip: use stream service with async I/O dispatching 
Now uses SOCK_STREAM, as SOCK_SEQPACKET is not available over TCP. To have
network transparency, the message now uses network byte order.
 2013-07-18 16:00:29 +02:00
Martin Willi c2a6fdf286 error-notify: use a stream service to accept client connections 
As TCP does not have SOCK_SEQPACKET, we now use SOCK_STREAM for the error-notify
socket. To have network transparency, the message now uses network byte order.
 2013-07-18 16:00:29 +02:00
Martin Willi 83faec5abe duplicheck: use a stream service to accept client connections 
As we can't use SOCK_SEQPACKET over TCP, we now have to provide message
boundaries ourselves. We do this by appending a 16-bit length header to each
sent duplicate identity.
 2013-07-18 16:00:29 +02:00
Martin Willi 065907b99d stroke: use a stream service to handle stroke requests 2013-07-18 16:00:29 +02:00