denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
10,566 Commits 1 Branch 0 Tags
ec1b4e6638598b5c77684cd01ab4caeaf3e230a4
Commit Graph
8215 Commits
Author SHA1 Message Date
Martin Willi ec1b4e6638 Merge branch 'vip-shunts' 
Installs bypass policies for the physical address if a virtual address is
assigned, and installs a proper source route to actually use the physical
address for bypassed destinations.

Conflicts:
	src/libcharon/plugins/unity/unity_handler.c
 2013-03-01 11:30:13 +01:00
Martin Willi a36b49f3cb Merge branch 'opaque-ports' 
Adds a %opaque port option and support for port ranges in left/rightprotoport.
Currently not supported by any of our kernel backends.
 2013-03-01 11:27:12 +01:00
Martin Willi 53fcc70acc When running with an unprivileged user, initialize supplementary groups 2013-03-01 11:27:01 +01:00
Martin Willi 21dd4c4bea Without MOBIKE, update remote host only if it is behind NAT 2013-03-01 11:26:47 +01:00
Martin Willi 00683b6864 Merge branch 'ikev1-mm-retransmits' 
Fixes retransmit of the last Main Mode or IKE_AUTH message, and correctly
queues Main Mode messages when processing of the last message is still in
progress.
 2013-03-01 11:24:42 +01:00
Martin Willi d634109f1d Merge branch 'tfc-notify' 
Introduces kernel backend features, sends ESP_TFC_PADDING_NOT_SUPPORTED if
kernel does not support it.
 2013-03-01 11:16:58 +01:00
Martin Willi 5c55be4915 Send ESP_TFC_PADDING_NOT_SUPPORTED if the used kernel doesn't support it 2013-03-01 11:12:17 +01:00
Martin Willi 53e62f5d0c Indicate support for processing ESPv3 TFC padding in Netlink IPsec backend 2013-03-01 11:11:51 +01:00
Martin Willi 76f7d80e80 Introduce "features" for the kernel backends returning kernel capabilities 2013-03-01 11:11:24 +01:00
Tobias Brunner 81f9cd39fd openssl: Provide AES-GCM implementation 2013-02-28 18:17:42 +01:00
Tobias Brunner a89ebab62e Fix cleanup in crypto_tester if AEAD implementation fails 2013-02-28 18:17:42 +01:00
Tobias Brunner 5f7f4fa398 Order of arguments in Doxygen comment fixed 2013-02-28 18:17:42 +01:00
Tobias Brunner 8656f35ae1 Fix auth_cfg_t.clone() for single-valued auth rules 
By using the default list enumerator and adding the rules with the public
add() method, clones of auth_cfg_t objects would return the values for
single-valued auth rules in the wrong order (i.e. the oldest instead of the
newest value was returned).  Using the internal enumerator (which the comment
already suggested) fixes this, but the clone will not be a full clone as
it does not contain any old values for single-valued auth rules.  Since
these will never be used anyway, this should be fine.
 2013-02-28 18:11:38 +01:00
Tobias Brunner 6e935c6fe0 Trigger an updown event when destroying an IKE_SA based on INITIAL_CONTACT 
In other cases (i.e. when functions return DESTROY_ME) the event should
already be triggered, but not in this forced situation.
 2013-02-28 18:07:29 +01:00
Tobias Brunner bc07fef09c Use SIGUSR2 for SIG_CANCEL on Android 
SIGRTMIN is defined as 32 while sigset_t is defined as
unsigned long (i.e. holds 32 signals).  Hence, the signal
could never be blocked.  Sending the signal still canceled
threads, but sometimes in situations where they shouldn't
have been canceled (e.g. while holding a lock).

Fixes #298.
 2013-02-26 11:40:34 +01:00
Tobias Brunner 0ac34e9e6a Android.mk updated to latest Makefiles 
Fixes #300.
 2013-02-26 10:11:36 +01:00
Martin Willi e2857be823 For IKEv1 Main Mode, use message hash to detect early retransmissions 
As the message ID is zero in all Main Mode messages, it can't be used to detect
if we are already processing a given message.
 2013-02-25 12:12:38 +01:00
Martin Willi cdf75a39e3 Move initial message dropping to task manager 
When the last request message of the initial tunnel setup is retransmitted,
we must retransmit the response instead of ignoring the request.

Fixes #295.
 2013-02-25 12:12:19 +01:00
Martin Willi 9eaed7a5bb Use INIT macro to initialize IKE_SA manager entries 2013-02-25 12:10:02 +01:00
Martin Willi b443fa6123 Don't reject OPAQUE ports while verifying traffic selector substructure 2013-02-21 11:52:33 +01:00
Martin Willi 0e7ef7f522 Optionally support port ranges in leftprotoport 2013-02-21 11:52:33 +01:00
Martin Willi fd658bce28 Support %opaque keyword in leftprotoport for "opaque" ports 2013-02-21 11:52:33 +01:00
Martin Willi cd41b951ee Pass complete port range over stroke interface for more flexibility 2013-02-21 11:52:33 +01:00
Martin Willi a1db77de7c Use a complete port range in traffic_selector_create_from_{subnet,cidr} 2013-02-21 11:52:33 +01:00
Martin Willi c572b5c8c1 Print OPAQUE traffic selectors as what they are, not as port range 2013-02-21 11:52:33 +01:00
Martin Willi 7b368af61a Support "opaque" ports in traffic selector subset calculation 2013-02-21 10:51:19 +01:00
Martin Willi 7dbe1feef1 Slightly refactor traffic_selector_t.get_subset() 2013-02-21 10:48:48 +01:00
Martin Willi de5d569b24 Migrate remaining traffic selector methods to METHOD macro 2013-02-21 10:28:21 +01:00
Tobias Brunner 0d237763dc openssl: Disable PKCS#7/CMS when building against OpenSSL < 0.9.8g 
Fixes #292.
 2013-02-20 18:34:54 +01:00
Martin Willi a2fd08dd26 Install a route for shunt policies 
If we install a virtual IP, its source route would render the shunt policy
useless, as locally generated traffic wouldn't match. Having a route for each
shunt policy with higher priority chooses the correct source address for
bypassed destinations.
 2013-02-20 16:32:24 +01:00
Martin Willi 122b4b6e6d Include local address for Unity Split-Exclude shunt policies 
If we use a virtual IP, having a shunt policy for just that wouldn't work, as
we want a shunt bypass using the local address.
 2013-02-20 16:15:39 +01:00
Andreas Steffen 371b752f00 treat IF-M and IF-TNCCS remediation instructions/parameters in an equal way 2013-02-19 20:00:57 +01:00
Andreas Steffen 65cdda5cf8 Streamlined log messages in ipseckey plugin 2013-02-19 12:25:00 +01:00
Andreas Steffen a4ddc0bb26 Encode RSA public keys in RFC 3110 DNSKEY format 2013-02-19 12:25:00 +01:00
Andreas Steffen f2145c8d3a Moved configuration from resolver manager to unbound plugin 
Also streamlined log messages in unbound plugin.
 2013-02-19 12:25:00 +01:00
Reto Guadagnini 95650c0836 ipseckey: Report IPSECKEYs with invalid DNSSEC security state 2013-02-19 12:25:00 +01:00
Reto Guadagnini 932717fbde ipseckey: Added "enable" option for the IPSECKEY plugin to strongswan.conf 2013-02-19 12:25:00 +01:00
Reto Guadagnini a77bbc3b8c Added ipseckey plugin, which provides support for public keys in IPSECKEY RRs 2013-02-19 12:25:00 +01:00
Reto Guadagnini cfd07978d0 unbound: Implementation of query method of unbound_resolver_t 2013-02-19 11:57:21 +01:00
Reto Guadagnini 5a4126b490 unbound: Implemented resolver_response_t as unbound_response_t 2013-02-19 11:57:21 +01:00
Reto Guadagnini 62ea67e700 Implemented rr_set_t interface 2013-02-19 11:57:21 +01:00
Reto Guadagnini 4a335a2164 unbound: Implemented rr_t as unbound_rr_t 2013-02-19 11:57:21 +01:00
Reto Guadagnini 9f963a7cfc Added unbound plugin implementing the resolver interface using libunbound 2013-02-19 11:57:21 +01:00
Reto Guadagnini b1505b345b Added manager for DNS resolvers 2013-02-19 11:57:21 +01:00
Reto Guadagnini ffdeeb6609 Added interface for DNS resolvers 2013-02-19 11:57:21 +01:00
Andreas Steffen c381e46855 added missing return statement 2013-02-19 10:24:23 +01:00
Martin Willi 69faf63528 Fix encoding of issuerAndSubject while handling SCEP pending state 2013-02-19 09:53:47 +01:00
Andreas Steffen 0f7cb0caf4 reject PB-Experimental messages with NOSKIP flag set 2013-02-19 09:31:34 +01:00
Andreas Steffen 9b4a8e1ced added parameter descriptions 2013-02-19 07:44:57 +01:00
Andreas Steffen 2c1219c217 removed superfluous debug output 2013-02-15 15:19:16 +01:00