denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
11,691 Commits 1 Branch 0 Tags
cc5bedbb98f97a0adf18482d230f7ddc15d098b3
Commit Graph
1286 Commits
Author SHA1 Message Date
Andreas Steffen cc5bedbb98 Callback job is not needed any more 2013-07-31 22:13:49 +02:00
Tobias Brunner 1cf8022839 unity: Handle multi-valued UNITY_SPLIT_INCLUDE/UNITY_LOCAL_LAN attributes 
Cisco devices seem to add 6 bytes of padding between each address/mask
pair.

Fixes #366.
 2013-07-29 21:44:27 +02:00
Andreas Steffen ef580b0137 tnc-pdp now uses watcher_t 2013-07-29 17:16:21 +02:00
Martin Willi 3a399574c2 eap-radius: do RADIUS/IKE attribute forwarding in XAuth backend 2013-07-29 09:00:49 +02:00
Martin Willi c434b2a4a9 eap-radius: support plain XAuth RADIUS authentication using User-Password 2013-07-29 09:00:49 +02:00
Martin Willi 9aeb6cea4c eap-radius: export function to build common attributes of Access-Request 2013-07-29 09:00:48 +02:00
Martin Willi 94ec80e74c eap-radius: export function to process common attributes of Access-Accept 2013-07-29 09:00:48 +02:00
Tobias Brunner 16748bdff7 socket-dynamic: Properly initialize IPv6 address 2013-07-24 16:17:22 +02:00
Tobias Brunner 0c76d820dc tnc-ifmap: Use proper cast for length when using %.*s 2013-07-24 10:54:47 +02:00
Tobias Brunner 62293ed271 coupling: Fix call to call_hook() 2013-07-22 17:53:56 +02:00
Tobias Brunner a14d907e33 tnc-pdp: Fix reading port setting from strongswan.conf 2013-07-22 17:43:54 +02:00
Martin Willi b4b3959b22 stream-service: move CAP_CHOWN check from plugins to service constructor 
A plugin service can be a TCP socket now, so it does not make much sense
to strictly check for CAP_CHOWN.
 2013-07-18 16:00:31 +02:00
Martin Willi 8fc89db7b6 certexpire: add an option to enforce exporting trustchains having a private key 2013-07-18 16:00:31 +02:00
Martin Willi 868abd0626 error-notify: catch and forward some alerts related to certificate validation 2013-07-18 16:00:30 +02:00
Martin Willi 4d7a762871 credmgr: introduce a hook function to catch trust chain validation errors 2013-07-18 16:00:30 +02:00
Martin Willi f7cff7fac4 lookip: double size of id field in message 2013-07-18 16:00:30 +02:00
Martin Willi f33d1d503f error-notify: increase size of string/identity fields in messages 2013-07-18 16:00:30 +02:00
Martin Willi 0a35ae781d whitelist: use a read-copy when listing entries 
While this requires a little more overhead, we can free the lock should the
stream block, allowing other threads to add/remove entries.
 2013-07-18 16:00:30 +02:00
Martin Willi 0ccc5bb216 whitelist: fix error handling when creating the socket fails 2013-07-18 16:00:30 +02:00
Martin Willi d3278c1f73 lookip: fix error handling when creating the socket fails 2013-07-18 16:00:30 +02:00
Martin Willi cfdb5f4855 error-notify: fix error handling when creating the socket fails 2013-07-18 16:00:30 +02:00
Martin Willi 5f755cef46 eap-radius: use watcher instead of receiver thread on DAE socket 2013-07-18 16:00:30 +02:00
Martin Willi c0db5d3845 dhcp: use watcher instead of dedicated receiver thread 2013-07-18 16:00:30 +02:00
Martin Willi 17028e29c2 farp: use watcher instead of dedicated receiver thread 2013-07-18 16:00:29 +02:00
Martin Willi 73da4ed849 load-tester: use a stream service to dispatch control connections 2013-07-18 16:00:29 +02:00
Martin Willi e11c02c8f1 whitelist: use a stream service to accept client connections 
Use SOCK_STREAM, as we don't have SOCK_SEQPACKET on TCP. To have network
transparency, the message now uses network byte order.
 2013-07-18 16:00:29 +02:00
Martin Willi 091d0afa21 lookip: use stream service with async I/O dispatching 
Now uses SOCK_STREAM, as SOCK_SEQPACKET is not available over TCP. To have
network transparency, the message now uses network byte order.
 2013-07-18 16:00:29 +02:00
Martin Willi c2a6fdf286 error-notify: use a stream service to accept client connections 
As TCP does not have SOCK_SEQPACKET, we now use SOCK_STREAM for the error-notify
socket. To have network transparency, the message now uses network byte order.
 2013-07-18 16:00:29 +02:00
Martin Willi 83faec5abe duplicheck: use a stream service to accept client connections 
As we can't use SOCK_SEQPACKET over TCP, we now have to provide message
boundaries ourselves. We do this by appending a 16-bit length header to each
sent duplicate identity.
 2013-07-18 16:00:29 +02:00
Martin Willi 065907b99d stroke: use a stream service to handle stroke requests 2013-07-18 16:00:29 +02:00
Tobias Brunner 29bdfb4086 kernel-libipsec: Fail route installation if remote TS matches peer 2013-07-18 15:41:13 +02:00
Tobias Brunner dfc9902013 capabilities: Some plugins don't actually require capabilities at runtime 2013-07-18 15:25:35 +02:00
Martin Willi 19cb07b890 automake: replace INCLUDES by AM_CPPFLAGS 
INCLUDES are now deprecated and throw warnings when using automake 1.13.
We now also differentiate AM_CPPFLAGS and AM_CFLAGS, where includes and
defines are passed to AM_CPPFLAGS only.
 2013-07-18 14:59:19 +02:00
Martin Willi 2e9e2fa848 eap-sim-pcsc: fix compiler warning 2013-07-18 14:59:19 +02:00
Tobias Brunner 79b6ead1e4 unity: Replicate default behavior if no UNITY_SPLIT_INCLUDE attributes were received 2013-07-17 18:23:57 +02:00
Tobias Brunner 56b0fac8c9 unity: Allow UNITY_LOCAL_LAN to be longer than 8 bytes 2013-07-17 18:23:57 +02:00
Tobias Brunner c7d0b80abb unity: Fix memory leak in provider 2013-07-17 18:23:57 +02:00
Martin Willi 553bb78730 child-sa: replace get_traffic_selectors() with create_ts_enumerator() 
Not directly returning a linked list allows us to change the internals of
the CHILD_SA transparently.
 2013-07-17 17:20:18 +02:00
Tobias Brunner f067348134 kernel-libipsec: Log error if no local address is found when installing routes 2013-07-15 14:37:31 +02:00
Tobias Brunner 591f923134 stroke: Add certificates extracted from PKCS#12 files to correct credential set 
Only keys and shared secrets are moved from the temporary credential set after
loading all secrets.
 2013-07-15 10:59:13 +02:00
Tobias Brunner d27f225d9a Use strpfx() helper where appropriate 2013-07-08 18:49:30 +02:00
Tobias Brunner 598bec78fa socket-default: Add options to disable address families 2013-07-05 09:48:27 +02:00
Tobias Brunner eafd7ee7e1 net: Socket implementations report the address families they support 2013-07-05 09:48:01 +02:00
Martin Willi 282e4d2c7c eap-radius: fix add_attribute/framed_ip method signatures 2013-07-01 11:53:52 +02:00
Tobias Brunner 4c74fa664b Reuse reqid for trap policies installed for dpd|closeaction=hold 2013-07-01 09:58:25 +02:00
Tobias Brunner 50daffb784 dhcp: Use chunk_hash_static() to calculate ID-based MAC addresses 2013-06-28 17:00:29 +02:00
Tobias Brunner b7b5432ff8 stroke: Changed how proto/port are specified in left|rightsubnet 
Using a colon as separator conflicts with IPv6 addresses.
 2013-06-28 15:10:09 +02:00
Tobias Brunner 9da142b4dc tnc-pdp: Initialize TNC-PDP in plugin callback with proper dependencies 2013-06-27 18:02:53 +02:00
Tobias Brunner 1091edede8 capabilities: CAP_CHOWN might be required by many plugins opening UNIX sockets 
But as the sockets will be created with the user/group of the running
process this might not be required as no change may be needed.
 2013-06-25 17:16:33 +02:00
Tobias Brunner 405f5ab9e9 farp: Require CAP_NET_RAW capability to open AF_PACKET socket 2013-06-25 17:16:32 +02:00