denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
19,910 Commits 1 Branch 0 Tags
dc8fa5fea5d70016065fefb0da2745e13b3c1884
Commit Graph
49 Commits
Author SHA1 Message Date
Tobias Brunner 5cab5672e7 Define plugin version in all existing plugins 2025-08-22 15:32:39 +02:00
Tobias Brunner c5b2a8eaa3 child-cfg: Use separate method to get configured traffic selectors 
Optionally with "dynamic" traffic selectors resolved.  A new method
is added for those cases where we actually want to select potentially
narrowed traffic selectors using a supplied list.  The latter now also
always logs details, while the former does not.
 2025-05-28 10:01:19 +02:00
Tobias Brunner 19ef2aec15 Update copyright headers after acquisition by secunet 2022-06-28 10:22:56 +02:00
Josh Soref b3ab7a48cc Spelling fixes 
* accumulating
* acquire
* alignment
* appropriate
* argument
* assign
* attribute
* authenticate
* authentication
* authenticator
* authority
* auxiliary
* brackets
* callback
* camellia
* can't
* cancelability
* certificate
* choinyambuu
* chunk
* collector
* collision
* communicating
* compares
* compatibility
* compressed
* confidentiality
* configuration
* connection
* consistency
* constraint
* construction
* constructor
* database
* decapsulated
* declaration
* decrypt
* derivative
* destination
* destroyed
* details
* devised
* dynamic
* ecapsulation
* encoded
* encoding
* encrypted
* enforcing
* enumerator
* establishment
* excluded
* exclusively
* exited
* expecting
* expire
* extension
* filter
* firewall
* foundation
* fulfillment
* gateways
* hashing
* hashtable
* heartbeats
* identifier
* identifiers
* identities
* identity
* implementers
* indicating
* initialize
* initiate
* initiation
* initiator
* inner
* instantiate
* legitimate
* libraries
* libstrongswan
* logger
* malloc
* manager
* manually
* measurement
* mechanism
* message
* network
* nonexistent
* object
* occurrence
* optional
* outgoing
* packages
* packets
* padding
* particular
* passphrase
* payload
* periodically
* policies
* possible
* previously
* priority
* proposal
* protocol
* provide
* provider
* pseudo
* pseudonym
* public
* qualifier
* quantum
* quintuplets
* reached
* reading
* recommendation to
* recommendation
* recursive
* reestablish
* referencing
* registered
* rekeying
* reliable
* replacing
* representing
* represents
* request
* request
* resolver
* result
* resulting
* resynchronization
* retriable
* revocation
* right
* rollback
* rule
* rules
* runtime
* scenario
* scheduled
* security
* segment
* service
* setting
* signature
* specific
* specified
* speed
* started
* steffen
* strongswan
* subjectaltname
* supported
* threadsafe
* traffic
* tremendously
* treshold
* unique
* uniqueness
* unknown
* until
* upper
* using
* validator
* verification
* version
* version
* warrior

Closes strongswan/strongswan#164.
 2020-02-11 18:23:07 +01:00
Tobias Brunner 84cdfbc9bc child-cfg: Allow suppressing log messages when selecting traffic selectors 
Although being already logged on level 2, these messages are usually just
confusing if they pop up randomly in the log when e.g. querying the configs
or installing traps.  So after this the log messages will only be logged when
actually proposing or selecting traffic selectors during IKE.
 2018-06-28 18:46:42 +02:00
Tobias Brunner 1b67166921 Unify format of HSR copyright statements 2018-05-23 16:32:53 +02:00
Tobias Brunner 525cc46cab Change interface for enumerator_create_filter() callback 
This avoids the unportable 5 pointer hack, but requires enumerating in
the callback.
 2017-05-26 13:56:44 +02:00
Tobias Brunner 95a63bf281 Migrate all enumerators to venumerate() interface change 2017-05-26 13:56:44 +02:00
Tobias Brunner 7a0fdbab42 shunt-manager: Add an optional namespace for each shunt 
This will allow us to reuse the names of child configs e.g. when they
are defined in different connections.
 2017-02-16 19:24:07 +01:00
Tobias Brunner 8a00a8452d child-cfg: Use struct to pass data to constructor 2016-04-09 16:51:01 +02:00
Andreas Steffen b12c53ce77 Use standard unsigned integer types 2016-03-24 18:52:48 +01:00
Tobias Brunner 28649f6d91 libhydra: Remove empty unused library 2016-03-03 17:36:11 +01:00
Martin Willi b9be25ea39 attribute-handler: Pass full IKE_SA to handler backends 2015-02-20 13:34:56 +01:00
Martin Willi bc9ded9dbf attribute-provider: Pass full IKE_SA to provider backends 2015-02-20 13:34:56 +01:00
Martin Willi 751363275f attributes: Move the configuration attributes framework to libcharon 2015-02-20 13:34:55 +01:00
Martin Willi fa42367ca1 unity: Reference IKE_SAs by the IKEv1 COOKIEs, improving lookup performance 
When handling thousands of IKE_SAs, the unique ID based lookup is rather slow,
as we have no indexing.
 2015-02-20 13:34:52 +01:00
Martin Willi db80d0d2da ike-sa-manager: Remove IKE_SA checkout by CHILD_SA reqid 2015-02-20 13:34:51 +01:00
Tobias Brunner 02df52fd2b unity: Only do narrowing of responder's TS if we received 0.0.0.0/0 
iOS and Mac OS X clients establish individual IPsec SAs for the traffic
selectors received in Split-Include attributes (might have been different
in earlier releases).  If we return 0.0.0.0/0 as TSr that either results
in a bunch of Quick Mode exchanges (for each TS), or with the latest
client releases an error notify (ATTRIBUTES_NOT_SUPPORTED).
We also can't install the IPsec SA with all configured subnets as that
would cause conflicts if the client later negotiates SAs for other subnets,
which iOS 8 does based on traffic to such subnets.

For Shrew and the Cisco client, which propose 0.0.0.0/0, we still need to
override the narrowed TS with 0.0.0.0/0, as they otherwise won't accept
the Quick Mode response.  Likewise, we also have to narrow the TS before
installing the IPsec SAs and policies.

So we basically have to follow the client's proposal and only modify TSr
if we received 0.0.0.0/0.  Since we don't get the original TS in the
narrow hook we handle the inbound QM messages and make note of IKE_SAs on
which we received a TSr of 0.0.0.0/0.

Fixes #737.
 2014-12-05 10:12:46 +01:00
Martin Willi cfdc620a3f unity: Do not bump TS to 0.0.0.0/0 as initiator when no Split-Include received 
When having the unity plugin enabled and both peers send the Unity Vendor ID,
we proposed 0.0.0.0/0 as traffic selector, even if no Split-Include has been
received on the SA. This can break compatibility with some responders, as
they don't narrow the TS themselves, but expect the configured TS.
 2014-08-25 10:02:44 +02:00
Tobias Brunner a45ba880c8 unity: Handle narrowing according to roles in the IKE_SA 
Since the narrow hook types reflect the roles in the Quick Mode exchange
the plugin behaved incorrectly if the server initiated the CHILD_SA
rekeying.
 2014-08-25 09:59:43 +02:00
Martin Willi 4163421f91 plugins: Don't link with -rdynamic on Windows 2014-06-04 15:53:02 +02:00
Tobias Brunner 21c18f536d unity: Send all traffic selectors in a single UNITY_SPLIT_INCLUDE attribute 
Cisco clients only handle the first such attribute.
 2014-01-23 10:35:21 +01:00
Tobias Brunner f8262aa1a6 unity: Change local TS to 0.0.0.0/0 as responder 
Cisco clients and Shrew expect a remote TS of 0.0.0.0/0 if Unity is
used, otherwise Quick Mode fails.
 2014-01-23 10:35:21 +01:00
Tobias Brunner 685579d6d8 unity: Send UNITY_SPLIT_INCLUDE attributes with proper padding 
The additional 6 bytes are not actually padding but are parsed by the
Cisco client as protocol and src and dst ports (each two bytes but
strangely only the first two in network order).
 2014-01-23 10:35:21 +01:00
Tobias Brunner 1cf8022839 unity: Handle multi-valued UNITY_SPLIT_INCLUDE/UNITY_LOCAL_LAN attributes 
Cisco devices seem to add 6 bytes of padding between each address/mask
pair.

Fixes #366.
 2013-07-29 21:44:27 +02:00
Martin Willi 19cb07b890 automake: replace INCLUDES by AM_CPPFLAGS 
INCLUDES are now deprecated and throw warnings when using automake 1.13.
We now also differentiate AM_CPPFLAGS and AM_CFLAGS, where includes and
defines are passed to AM_CPPFLAGS only.
 2013-07-18 14:59:19 +02:00
Tobias Brunner 79b6ead1e4 unity: Replicate default behavior if no UNITY_SPLIT_INCLUDE attributes were received 2013-07-17 18:23:57 +02:00
Tobias Brunner 56b0fac8c9 unity: Allow UNITY_LOCAL_LAN to be longer than 8 bytes 2013-07-17 18:23:57 +02:00
Tobias Brunner c7d0b80abb unity: Fix memory leak in provider 2013-07-17 18:23:57 +02:00
Tobias Brunner 819cb66298 unity: Use plugin features to register listener and attribute handler/provider 2013-06-11 11:18:19 +02:00
Tobias Brunner 14edee56bf unity: Check IKE_SA in only after enumerating virtual IPs 2013-04-05 16:03:10 +02:00
Martin Willi ec1b4e6638 Merge branch 'vip-shunts' 
Installs bypass policies for the physical address if a virtual address is
assigned, and installs a proper source route to actually use the physical
address for bypassed destinations.

Conflicts:
	src/libcharon/plugins/unity/unity_handler.c
 2013-03-01 11:30:13 +01:00
Martin Willi a1db77de7c Use a complete port range in traffic_selector_create_from_{subnet,cidr} 2013-02-21 11:52:33 +01:00
Martin Willi 122b4b6e6d Include local address for Unity Split-Exclude shunt policies 
If we use a virtual IP, having a shunt policy for just that wouldn't work, as
we want a shunt bypass using the local address.
 2013-02-20 16:15:39 +01:00
Martin Willi 325efdaca8 Filter TS list for Split-Includes before printing them to debug log 2013-01-21 12:15:51 +01:00
Tobias Brunner ef33a4ab82 Fixed some typos, courtesy of codespell 2012-12-20 09:35:26 +01:00
Martin Willi b5d27839ad Do not send 0.0.0.0/0 traffic selectors as Split-Include Unity attributes 
It seems that iOS devices don't like them.
 2012-11-22 12:13:44 +01:00
Tobias Brunner 531f32d62a Compiler warning fixed 2012-11-02 15:39:51 +01:00
Martin Willi 6e8f88dba3 Exclude dynamic TS from Unity Split-Include attributes 2012-10-30 09:14:44 +01:00
Tobias Brunner 12642a6831 Moved data structures to new collections subfolder 2012-10-24 16:00:49 +02:00
Martin Willi 77c37ea5e0 As Unity responder, don't change the proposed TS at all, racoon doesn't like that 2012-09-18 17:17:48 +02:00
Martin Willi 7a7deec283 As initiator, narrow received Unity attributes to configured TS 2012-09-18 17:17:48 +02:00
Martin Willi b8db3775f3 When using Unity, bump up remote TS as initiator to 0.0.0.0/0, too 2012-09-18 17:17:48 +02:00
Martin Willi 284ed1b352 Enable Cisco Unity only if Unity vendor id received 2012-09-18 17:17:48 +02:00
Martin Willi 6e60807637 Exchange 0.0.0.0/0 traffic selectors with Unity, narrowing after exchange 2012-09-18 17:17:48 +02:00
Martin Willi f2463f1bd6 Add a Unity attribute provider that adds Split-Includes for TS 2012-09-18 17:17:47 +02:00
Martin Willi e39e697429 Check if subset calculation actually yields a TS in Unity narrowing 2012-09-18 17:17:47 +02:00
Martin Willi 92b5066705 Request Unity configuration attributes for IKEv1 only 2012-09-18 17:17:47 +02:00
Martin Willi 5ff012f717 Add Cisco Unity client support for Split-Include and Local-LAN 2012-09-18 17:17:47 +02:00