denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
11,946 Commits 1 Branch 0 Tags
e8130a94981744c0e3ceb8ea1d4599cd2838e444
Commit Graph
1330 Commits
Author SHA1 Message Date
Tobias Brunner e8130a9498 ipseckey: Refactor creation of certificate enumerator 
Reduces nesting and fixes a memory leak (rrsig_enum).
 2013-10-11 15:45:41 +02:00
Tobias Brunner de5ea570f1 ipseckey: Depend on plugin features to create public key and certificate objects 2013-10-11 15:45:41 +02:00
Tobias Brunner cd25d291f7 kernel-libipsec: Don't ignore policies of type != POLICY_IPSEC 
This actually broke rekeying due to the DROP policies that are
temporarily added, which broke the refcount as the ignored policies
were not ignored in del_policy() (the type is not known there).
 2013-10-11 15:32:44 +02:00
Tobias Brunner eeb34af069 kernel-libipsec: Add an option to allow remote TS to match the IKE peer 
Setting the fwmark options for the kernel-netlink and socket-default
plugins allow this kind of setup.

It is probably required to set net.ipv4.conf.all.rp_filter to 2 to make
it work.
 2013-10-11 15:32:44 +02:00
Tobias Brunner 80f8b3a6d8 socket-default: Allow setting firewall mark on outbound packets 2013-10-11 15:32:44 +02:00
Tobias Brunner e745f5f69f sql: Don't use MyISAM engine and set collation/charset for all tables 
The MyISAM engine doesn't support transactions.
 2013-10-11 15:16:05 +02:00
Martin Willi 12fdc2b16b kernel-libipsec: Support ESPv3 TFC padding 2013-10-11 10:23:18 +02:00
Martin Willi d53f9b9637 kernel-libipsec: Support query_sa() to report usage statistics 2013-10-11 10:23:17 +02:00
Martin Willi d7083b6541 kernel: Use a time_t to report use time in query_policy() 2013-10-11 10:23:17 +02:00
Martin Willi c99458e94e kernel: Use a time_t to report use time in query_sa() 2013-10-11 10:23:17 +02:00
Martin Willi c5d9b133e0 updown: Add a PLUTO_PROTO variable set to 'ah' or 'esp' 2013-10-11 10:15:21 +02:00
Martin Willi f6037b5506 stroke: List proposals in statusall without leading '/' in AH SAs 2013-10-11 10:15:21 +02:00
Martin Willi 0576412989 stroke: Configure proposal with AH protocol if 'ah' option set 2013-10-11 10:15:20 +02:00
Andreas Steffen 3588299fb8 Keep a copy of the tnccs instance for PT-TLS handover 2013-10-09 19:03:07 +02:00
Tobias Brunner 3e3db3743e xauth-pam: Make trimming of email addresses optional 
Fixes #430.
 2013-10-04 10:49:54 +02:00
Tobias Brunner e4b7b48c1e eap-radius: Increase buffer for attributes sent in RADIUS accounting messages 
64 bytes might be too short for user names/identities.
 2013-09-27 13:37:12 +02:00
Tobias Brunner 90031b2fc7 load-tester: Fix crash if private key was not loaded successfully 
Fixes #417.
 2013-09-24 09:27:12 +02:00
Andreas Steffen 2c4d772a79 Implemented TCG/PB-PDP_Referral message 2013-09-17 21:57:08 +02:00
Martin Willi 791fde1669 stroke: don't remove a matching peer config if used by other child configs 
When configurations get merged during add, we should not remove peer configs
if other connection entries use the same peer config.
 2013-09-13 13:56:31 +02:00
Tobias Brunner 4eb6149ae8 sockets: Initialize the whole ancillary data buffer not only the actual struct 
This avoids uninitialized bytes that Valgrind seems to notice otherwise.

Fixes #395.
 2013-09-10 13:42:59 +02:00
Andreas Steffen c1ebc7b1cc Fixed double free causing swapped ends to crash 2013-09-07 08:25:10 +02:00
Martin Willi 1fd5c7fbac load-tester: support extended traffic selector syntax, as in leftsubnet 
In addition the initiator may use %unique as port, using a distinct port for
each connection, starting from 1025.
 2013-09-04 10:49:48 +02:00
Martin Willi 47b4a51402 load-tester: add an option to test transport/beet connections 2013-09-04 10:49:48 +02:00
Martin Willi 3070697f9f ike: support multiple addresses, ranges and subnets in IKE address config 
Replace the allowany semantic by a more powerful subnet and IP range matching.
Multiple addresses, DNS names, subnets and ranges can be specified in a comma
separated list. Initiators ignore the ranges/subnets, responders match
configurations against all addresses, ranges and subnets.
 2013-09-04 10:38:37 +02:00
Martin Willi beffdc6ab8 ike-cfg: remove the to be obsoleted allow any parameter in get_my/other_addr 2013-09-04 10:38:37 +02:00
Martin Willi a858064455 stroke: ignore a leftsourceip if a rightsourceip is given as well 
As we always negotiate virtual IPs in charon, having both left- and
rightsourceip is not allowed. Both in IKEv1 and IKEv2 we support a single
configuration payload exchange only.
 2013-09-04 10:33:38 +02:00
Martin Willi 2bae838d5e stroke: re-enable modeconfig keyword 2013-09-04 10:33:38 +02:00
Martin Willi 9aeaa7396e peer-cfg: add a pull/push mode option to use with mode config 2013-09-04 10:33:37 +02:00
Martin Willi 45797bd50b xauth-generic: honor requested XAuth credential types as a client 
Support requesting of XAuth PINs and print XAuth messages.
 2013-09-03 16:26:19 +02:00
Martin Willi d787ada894 eap-radius: support XAuth configuration profiles, defining multiple XAuth rounds 2013-09-03 16:26:19 +02:00
Martin Willi 510ecf612a xauth: add a configuration string option to be passed to XAuth instances 
The configuration string is appended to the XAuth backend name, separated by
a colon. The configuration string is passed untouched to the backend, where
it can change the behavior of the XAuth module.
 2013-09-03 16:26:19 +02:00
Andreas Steffen 0d9e375193 Selectively enable PT-TLS and/or RADIUS sockets in tnc-pdp plugin 2013-08-26 20:36:07 +02:00
Martin Willi 49032d15be stroke: stop enumerating IKE_SAs in statusall if output stream gets closed 
If the output stream is not interested in more information, it can close the
the stream. Checking for stream errors avoids useless enumeration of IKE_SAs,
saving resources. This allows to use "ipsec statusall | head" to monitor the
daemon, or stop enumerating IKE_SAs after a specific entry has been found.
 2013-08-23 14:27:17 +02:00
Andreas Steffen 1e92d5f114 Process PB-TNC batches received via PT-TLS asynchronously 2013-08-19 09:52:12 +02:00
Andreas Steffen 6aff4b5ce8 Show host address of peer connecting to PT-TLS socket 2013-08-15 23:34:23 +02:00
Andreas Steffen f420d5f380 enabled SASL PLAIN authentication 2013-08-15 23:34:22 +02:00
Andreas Steffen 8327c44b74 PT-TLS connection is properly terminated 2013-08-15 23:34:22 +02:00
Andreas Steffen 12b3db5006 moved tnc_imv plugin to libtnccs thanks to recommendation callback function 2013-08-15 23:34:22 +02:00
Andreas Steffen e8f65c5cde Moved tnc-tnccs, tnc-imc, tnccs-11, tnccs-20 and tnccs-dynamic libcharon plugins to libtnccs 2013-08-15 23:34:22 +02:00
Andreas Steffen 180a2f2642 rapid PT-TLS AR/PDP prototype 2013-08-15 23:34:22 +02:00
Andreas Steffen f5b5d262e8 Add PT-TLS interface to strongSwan PDP 2013-08-15 23:34:22 +02:00
Martin Willi 881e9a7e2e updown: remove description of unsupported PLUTO_ variables 
These have been set by pluto, but are not by charons updown plugin.
 2013-08-08 14:48:32 +02:00
Tobias Brunner 58e32e4871 tnc-pdp: Initialize struct msghdr properly when reading RADIUS messages 
Before this e.g. msg_controllen was not initialized properly which could
cause invalid reads.
 2013-07-31 22:16:58 +02:00
Tobias Brunner d12fc14616 whitelist: Fix compilation on FreeBSD 2013-07-31 22:16:58 +02:00
Andreas Steffen cc5bedbb98 Callback job is not needed any more 2013-07-31 22:13:49 +02:00
Tobias Brunner 1cf8022839 unity: Handle multi-valued UNITY_SPLIT_INCLUDE/UNITY_LOCAL_LAN attributes 
Cisco devices seem to add 6 bytes of padding between each address/mask
pair.

Fixes #366.
 2013-07-29 21:44:27 +02:00
Andreas Steffen ef580b0137 tnc-pdp now uses watcher_t 2013-07-29 17:16:21 +02:00
Martin Willi 3a399574c2 eap-radius: do RADIUS/IKE attribute forwarding in XAuth backend 2013-07-29 09:00:49 +02:00
Martin Willi c434b2a4a9 eap-radius: support plain XAuth RADIUS authentication using User-Password 2013-07-29 09:00:49 +02:00
Martin Willi 9aeb6cea4c eap-radius: export function to build common attributes of Access-Request 2013-07-29 09:00:48 +02:00