denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
10,653 Commits 1 Branch 0 Tags
c45cf9048e1ccc8ca7b52c761a67adefa3994267
Commit Graph
8287 Commits
Author SHA1 Message Date
Martin Willi c45cf9048e Raise an alert if an IKE_SA could not have been reauthenticated and expires 2013-03-14 14:20:54 +01:00
Martin Willi 68c12fd9f9 Send NAS-Port, NAS-IP and Calling/Called-Station-ID in Accounting-Requests 2013-03-14 14:20:54 +01:00
Martin Willi b4568ca230 Support RADIUS accounting of sent/received packets 2013-03-14 14:20:54 +01:00
Martin Willi d28391a244 Report the number of processed packets in "ipsec statusall" 2013-03-14 14:20:54 +01:00
Martin Willi d954a2081b child_sa_t.get_usestats() can additionally return the number of processed packets 2013-03-14 14:20:54 +01:00
Martin Willi 6b35ab84da Pass correclty sized pointer to lookup_algorithm() in PF_KEY 2013-03-14 14:20:54 +01:00
Martin Willi 7eeeb1c702 kernel_ipsec_t.query_sa() additionally returns the number of processed packets 2013-03-14 14:20:54 +01:00
Martin Willi 003452d18f Send NAS-Port, NAS-IP and Calling/Called-Station-ID in Access-Request 2013-03-13 15:20:11 +01:00
Martin Willi 02bf38890d Forward Cisco Banner received from RADIUS to Unity capable clients 2013-03-12 20:37:35 +01:00
Martin Willi 54b3cbdc78 Add a radius message method to enumerate vendor specific attributes 2013-03-12 20:37:35 +01:00
Martin Willi b4d172aa8e Add Altiga Private Enterprise Numbers that Cisco uses in VPN 3000 2013-03-12 20:31:10 +01:00
Martin Willi f4c8e6def7 In eap-radius, hand out received Framed-IP-Address attributes as virtual IP 2013-03-12 17:44:13 +01:00
Martin Willi 3a23794fa2 Add missing XAuthRespPSK switch case to IKEv1 key derivation 2013-03-12 10:09:23 +01:00
Martin Willi cf6a4ea005 strdup() iface passed to queue_route_reinstall(), fixing double-free 2013-03-11 15:17:50 +01:00
Martin Willi d6b6d1ecdb Support mutliple subnets and ranges as external load-tester addresses 2013-03-11 15:16:13 +01:00
Martin Willi 0897cda33b Add a constructor to create in-memory pools from an address range 2013-03-11 15:12:47 +01:00
Martin Willi 8f727d8007 Clean up IKE_SA state if IKE_SA_INIT request does not have message ID 0 2013-03-11 11:30:47 +01:00
Martin Willi 0235914d2f Ignore fourth Qick Mode message sent by Windows servers. 
Initial patch by Paul Stewart, fixes #289.
 2013-03-11 10:53:55 +01:00
Andreas Steffen f361a85ebb added ITA Echo PA-TNC Subtype and ITA Echo Attribute type 2013-03-11 09:30:20 +01:00
Andreas Steffen a498c7a9c3 moved ar_id from imv_agent to imv_state 2013-03-11 08:54:02 +01:00
Tobias Brunner 2b1e2434e4 esc() is only used if dladdr(3) is available 2013-03-08 16:45:09 +01:00
Tobias Brunner 292ee515db Fix maximum size of a mem_pool_t 2013-03-07 18:21:02 +01:00
Tobias Brunner d6da0a367a New Android release after adding translations and Cert/EAP authentication 
Also fixed a race condition during reauthentication and a freeze that
might happen while disconnecting.
 2013-03-07 14:14:34 +01:00
Tobias Brunner 76de964617 android: Add support for combined certificate and EAP authentication 
This uses RFC 4739 multiple authentication rounds to first
authenticate the client with a certificate followed by an
EAP authentication round with username and password.
 2013-03-07 14:14:34 +01:00
Martin Willi 7d70a14779 Merge branch 'pt-tls' 2013-03-07 14:10:50 +01:00
Martin Willi 9d9042d6d9 As Quick Mode initiator, select a subset of the proposed and the returned TS 
Cisco 5505 firewalls don't return the port if we send a specific one, letting
the is_contained_in() checks fail. Using get_subset() selection builds the
Quick Mode correctly with the common subset of selectors.

Based on an initial patch from Paul Stewart.
 2013-03-07 10:00:06 +01:00
Martin Willi 1db6bf2f3f If TLS peer authentication not required, the client does nonetheless, allow it to fail 2013-03-06 15:53:12 +01:00
Andreas Steffen 486f4b5838 added some otherNames OIDs 2013-03-06 11:50:32 +01:00
Martin Willi ad9af9e2d8 Fix some apidoc in mem_pool.h 2013-03-06 10:26:52 +01:00
Andreas Steffen 1a9dee5d22 instead of cloning use extract_buf() method 2013-03-04 23:21:21 +01:00
Martin Willi b668f1417d Don't invoke addr2line if dladdr() did not yield a filename 2013-03-04 15:50:21 +01:00
Martin Willi 1f69412b4d When receiving critical signals, additionally log backtraces to syslog/files 2013-03-04 15:46:34 +01:00
Martin Willi fe03f51302 backtrace_t.log() takes a NULL file pointer to log to registered dbg() hook 2013-03-04 15:45:03 +01:00
Martin Willi 8b24863b1f Don't use color escapes when printing backtraces to a non-TTY file 2013-03-04 15:07:03 +01:00
Martin Willi 4d17427205 Add a utility function to resolve TTY color escape codes dynamically 2013-03-04 15:04:56 +01:00
Andreas Steffen c88104aa25 make TNC Access Requestor ID available to IMVs 2013-03-03 17:18:09 +01:00
Andreas Steffen c9418d4fd3 added getpwuid_r and initgroups to whitelist 2013-03-03 09:04:49 +01:00
Andreas Steffen eeb69761ae third parameter was not copied 2013-03-02 22:03:07 +01:00
Tobias Brunner 11adf114c1 Fixed Doxygen comments after scanning complete src directory 2013-03-02 18:31:53 +01:00
Tobias Brunner 9804fccea3 Removed backend for old Android frontend patch 
Moved the remaining DNS handler to a new plugin.
 2013-03-02 18:27:23 +01:00
Andreas Steffen b038c62e4a added ERX_SUPPORTED IKEv2 Notify 2013-03-02 17:18:37 +01:00
Andreas Steffen de218eb09c added some new TCG IF-M message subtypes and attributes 2013-03-02 17:03:37 +01:00
Tobias Brunner e88b529a30 android: Mitigate race condition on reauthentication 
If the TUN device gets recreated while another thread in handle_plain()
has not yet called select(2) but already stored the file descriptor of the
old TUN device in its FD set, select() will fail with EBADF.

Fixes #301.
 2013-03-01 17:06:01 +01:00
Tobias Brunner 4c969f7906 openssl: The EVP GCM interface requires at least OpenSSL 1.0.1 2013-03-01 16:57:45 +01:00
Martin Willi 4dd8d5430d Merge branch 'multi-eap' 
Fixes the use of EAP methods in the non-first authentication round if the
initiator demands mutual EAP. Also mutual EAP can now be enforced when the
initiator sets rightauth=eap, not only with rightauth=any.
 2013-03-01 11:36:41 +01:00
Martin Willi e82deaf6ce Merge branch 'multi-cert' 
Allows the configuration of multiple certificates in leftcert, and select
the correct certificate to use based on the received certificate requests.
 2013-03-01 11:35:32 +01:00
Martin Willi adf239abca Merge branch 'systime' 
Add a systime-fix plugin allowing an embedded system to validate certificates
if the system time has not been synchronized after boot. Certificates of
established tunnels can be re-validated after the system time gets valid.
 2013-03-01 11:33:47 +01:00
Martin Willi b611d8ba48 Merge branch 'ikev1-rekeying' 
Migrates Quick Modes to the new Main Mode if an IKEv1 reauthentication replaces
the old Main Mode having a uniqueids=replace policy.
 2013-03-01 11:32:02 +01:00
Martin Willi ec1b4e6638 Merge branch 'vip-shunts' 
Installs bypass policies for the physical address if a virtual address is
assigned, and installs a proper source route to actually use the physical
address for bypassed destinations.

Conflicts:
	src/libcharon/plugins/unity/unity_handler.c
 2013-03-01 11:30:13 +01:00
Martin Willi a36b49f3cb Merge branch 'opaque-ports' 
Adds a %opaque port option and support for port ranges in left/rightprotoport.
Currently not supported by any of our kernel backends.
 2013-03-01 11:27:12 +01:00