denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
10,495 Commits 1 Branch 0 Tags
e212033ef2012ff9be098ce2a9ee0da39c662c31
Commit Graph
8155 Commits
Author SHA1 Message Date
Martin Willi e212033ef2 Merge branch 'ike-dscp' 2013-02-14 17:11:35 +01:00
Martin Willi 285668b6e3 Check if recommendations is set before applying language preference 2013-02-14 17:09:28 +01:00
Martin Willi a9df87bf89 PT-TLS dispatcher TNCCS constructor takes peer identities to pass to factory 2013-02-14 17:09:28 +01:00
Martin Willi 8b56943222 Merge branch 'pt-tls' 2013-02-14 17:06:07 +01:00
Martin Willi 46ae05dd17 Remove leading zeros in SCEP certificate serialNumbers 2013-02-14 16:56:32 +01:00
Tobias Brunner 96a2d2077b Fix 'stroke loglevel any' 
Before b46a5cd4 this worked if debug_t was unsigned.  In that case -1,
as returned by enum_from_name(), would result in a large positive number.
So any unknown debug group (including 'any') had the same effect that
was only intended for 'any'.
 2013-02-13 12:18:20 +01:00
Andreas Steffen bac1052dea treat EAP identities as user IDs 2013-02-12 21:58:03 +01:00
Andreas Steffen 2a421163bf make TNC client authentication type available to IMVs 2013-02-12 20:38:05 +01:00
Andreas Steffen 3e56352815 determine underlying IF-T transport protocol 2013-02-12 12:25:39 +01:00
Andreas Steffen bd1ee5bdc4 make AR identities available to IMVs via IF-IMV 1.4 draft 2013-02-11 15:30:44 +01:00
Andreas Steffen ebb87f08f7 Make IKE/EAP IDs available to TNC server/client 2013-02-11 15:30:44 +01:00
Tobias Brunner 98063d8187 Don't use a time_t variable with fscanf when parsing uptime 
Because "%u" is used as format string in the fscanf call that parses the
uptime and because the length of time_t varies on different platforms
and architectures the value was not written properly if time_t was longer
than an unsigned int and depending on how the target variable was aligned
on the stack.  Since there is no conversion specifier to properly parse a
time_t value we use the appropriate integer type instead.
 2013-02-08 11:33:13 +01:00
Tobias Brunner af5452ba76 Allow more than one CERTREQ payload for IKEv2 
There is no reason not to do so (RFC 5996 explicitly mentions multiple
CERTREQ payloads) and some implementations seem to use the same behavior
as had to be used with IKEv1 (i.e. each CA in its own CERTREQ payload).
 2013-02-08 11:28:56 +01:00
Martin Willi f476ff84f3 Add a --httptimeout option to scepclient 2013-02-08 11:09:33 +01:00
Martin Willi 763e86c093 Use CURL_TIMEOUT and not CURL_CONNECTTIMEOUT for FETCHER_TIMEOUT in curl 
This allows us to use this timeout beyond DNS resolution. For the initial
connect, we use a hardcoded timeout of 10s for now.
 2013-02-08 11:08:06 +01:00
Martin Willi 7fbe516f88 Add a ikedscp ipsec.conf option to set DSCP value on outgoing IKE packets 2013-02-06 15:36:36 +01:00
Martin Willi 5b15bd5f9d Set configured DSCP value while generating IKE packets 2013-02-06 15:20:32 +01:00
Martin Willi 306a269e34 Add a DSCP configuration value to IKE configs 2013-02-06 15:20:32 +01:00
Martin Willi ea5917afd8 Set DSCP values when sending IP packets in socket-default 2013-02-06 15:20:32 +01:00
Martin Willi 6e82269ee6 Don't send a packet in default socket if family is not IPv4 nor IPv6 2013-02-06 15:20:32 +01:00
Martin Willi 1116689944 Add a DSCP value with getter/setter on packet_t 2013-02-06 15:20:32 +01:00
Martin Willi 6c37daaa3b Avoid extensive casting of sockaddr types in socket-default by using a union 
Additionally fixes a strict-aliasing rule compiler warning with older gcc.
 2013-02-06 15:20:32 +01:00
Martin Willi 82c884c015 Set sockaddr family on ifreq instead of casted familiy specific sockaddr 
Fixes a strict-aliasing rule compiler warning with older gcc.
 2013-02-06 15:20:32 +01:00
Andreas Steffen cf29fc075a time is a time_t pointer 2013-02-04 13:05:29 +01:00
Andreas Steffen ba62be506a improved control when an attribute request is sent 2013-02-03 20:48:05 +01:00
Andreas Steffen 459c50ccb8 print PEN value 0xfffffe as Unassigned 2013-02-03 18:52:59 +01:00
Andreas Steffen 818fe7c024 send an error attribute if vendor ID or type of received attribute is reserved 2013-02-03 18:52:03 +01:00
Tobias Brunner a3a190b7bd openssl: Properly honor OPENSSL_NO_* defines 2013-01-31 17:33:23 +01:00
Tobias Brunner 25637aa5d8 Fix Doxygen comment for rdrand plugin 2013-01-31 12:11:37 +01:00
Tobias Brunner 58fd1f3eef Don't use pointer to a union member in host_create_from_string_and_family() 2013-01-25 13:18:50 +01:00
Tobias Brunner 572a707765 Properly check MSB in openssl plugin's PKCS#7 implementation 2013-01-24 23:36:02 +01:00
Tobias Brunner 9ccfeb8ca1 Use proper buffer sizes for parse_smartcard() 2013-01-24 23:35:42 +01:00
Tobias Brunner 677812dc66 Cast first argument for %.*s to int 2013-01-24 23:35:42 +01:00
Tobias Brunner bacbf91c5c Removed unused command name when printing usage info for lookip 2013-01-24 23:35:41 +01:00
Tobias Brunner d7bd0ad7df Removed unused argument 2013-01-24 23:35:34 +01:00
Tobias Brunner 4cd3fb788d Properly read data from stream in pki --pkcs7 2013-01-24 19:13:41 +01:00
Tobias Brunner 27a814b527 Properly destroy mem_cred object on pki --pkcs7 --help 2013-01-24 19:13:41 +01:00
Tobias Brunner 39896d92ed Try to determine OS type if name and version are configured 2013-01-24 19:13:41 +01:00
Tobias Brunner 24cdf5340e Add missing va_end() call 2013-01-24 19:13:41 +01:00
Tobias Brunner 69c6a60176 g_thread_init() is deprecated since Glib 2.23 2013-01-24 19:13:40 +01:00
Tobias Brunner 2ec3552fce Fix check-in of IKE_SA when IKE_SA_INIT fails and hash table is enabled 
Setting the responder SPI to 0 can only be done while generating the
response, otherwise we'd fail to check in the IKE_SA again in case the
hash table is enabled.  That's because we use the responder SPI as hash
value since 5.0.0.
 2013-01-24 19:13:40 +01:00
Adrian-Ken Rueegsegger a25047e412 Return SS_RC_INITIALIZATION_FAILED if pid file exists 
Let charon return SS_RC_INITIALIZATION_FAILED if an existing pid file is found.
Starter only terminates itself if the result code of the daemon is a valid
SS_RC_* value.
 2013-01-23 15:59:21 +01:00
Tobias Brunner 4eb09d14e2 Avoid a deadlock when installing a trap policy failed 2013-01-23 15:51:47 +01:00
Martin Willi 8d631ebabd Encode IETF Numeric Version Service Pack Version with two byte words 2013-01-22 14:45:56 +01:00
Adrian-Ken Rueegsegger 113ff13322 starter: Add --attach-gdb option to usage text 2013-01-22 11:03:19 +01:00
Adrian-Ken Rueegsegger cf3c72c480 Fix IKE SA inherit API doc 2013-01-22 11:02:20 +01:00
Martin Willi 325efdaca8 Filter TS list for Split-Includes before printing them to debug log 2013-01-21 12:15:51 +01:00
Tobias Brunner ae82265a46 Add the ability to use a named pool for conftest configs 2013-01-21 11:46:20 +01:00
Martin Willi 16ef69d70a Pass a constructor callback to create TNCCS server instances while dispatching 2013-01-17 16:34:34 +01:00
Martin Willi 04a9a99bc1 Create pt_tls_client with separate server address and identity 2013-01-16 16:36:57 +01:00