denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
20,067 Commits 1 Branch 0 Tags
main
Commit Graph
15501 Commits
Author SHA1 Message Date
Tobias Brunner efb4cb0bf9 charon-cmd: Stop processing options if an argument is missing or an option not recognized 2013-05-08 12:30:33 +02:00
Tobias Brunner 410abbd35f charon-cmd: Properly initialize options with no additional lines 2013-05-07 17:08:31 +02:00
Tobias Brunner e07e489d5f agent: Use sshkey plugin to parse keys, adds support for ECDSA 2013-05-07 17:08:31 +02:00
Tobias Brunner dd9e366814 sshkey: Add support for ECDSA keys 2013-05-07 17:08:31 +02:00
Tobias Brunner 87692be215 Load any type (RSA/ECDSA) of public key via left|rightsigkey 2013-05-07 17:08:31 +02:00
Tobias Brunner fa1d3d39dc left|rightrsasigkey accepts SSH keys but the key format has to be specified explicitly 
The default is now PKCS#1. With the dns: and ssh: prefixes other formats
can be selected.
 2013-05-07 15:38:28 +02:00
Tobias Brunner cc4408abcb sshkey: Added builder for SSHKEY RSA keys 2013-05-07 15:38:28 +02:00
Tobias Brunner 584d656b77 Add sshkey plugin stub that will parse RFC 4253 public keys 2013-05-07 14:08:51 +02:00
Tobias Brunner c0bbddfa42 Try to load raw keys from ipsec.conf as PKCS#1 blob first 
The DNSKEY builder is quite eager and parses pretty much anything
as RSA key, so this has to be done before.
 2013-05-07 14:08:51 +02:00
Tobias Brunner ee7b73832c charon-cmd: Add --agent option to authenticate using ssh-agent(1) 
The socket path is read from the SSH_AUTH_SOCK environment variable.
So using this with sudo might require the -E command line (or an appropriate
sudoers config) to preserve the environment.
 2013-05-07 14:08:51 +02:00
Tobias Brunner 4dc50bf9de charon-cmd: Use loose matching of gateway identity 2013-05-07 13:53:48 +02:00
Martin Willi c9a323c1d9 kernel-pfroute: allow only one thread to do a route look up simultaneously 
Otherwise we mess up the sequence number another thread is waiting for.
 2013-05-06 17:01:13 +02:00
Martin Willi 5c12700f9a kernel-interface: query SAD for last use time if SPD query didn't yield one 2013-05-06 17:01:13 +02:00
Martin Willi bdaf9f97e6 child-sa: query SAD/SPD just for what we actually need to update statistics 2013-05-06 17:01:13 +02:00
Martin Willi 470aad7e0c kernel-pfkey: be less verbose about unexpected sequence numbers 2013-05-06 17:01:13 +02:00
Martin Willi df919d50d0 kernel-pfkey: install exclude routes if kernel-net requires them 2013-05-06 17:01:13 +02:00
Martin Willi 580b768d03 kernel-pfroute: add a feature flag requesting "exclude" routes 
If routes installed along with policies covering the peer address affect local
IKE/ESP packets, they won't get routed correctly. To work around this issue,
the kernel interface can install "exclude" routes for the IKE peer. Not all
networking backends require this workaround, hence we export a flag for it
if it is required.
 2013-05-06 17:01:13 +02:00
Martin Willi bd520193a4 kernel-pfroute: remove unused interface address refcounting 2013-05-06 17:01:13 +02:00
Martin Willi 77b6f19694 kernel-pfroute: mark IPs installed on tun device as virtual 2013-05-06 17:00:55 +02:00
Martin Willi 2a2d7a4dc8 kernel-pfroute: install virtual IPs using dedicated tun devices 2013-05-06 16:10:13 +02:00
Martin Willi ca4a14ae83 kernel-pfkey: when installing a route for a virtual IP, use its interface 
When installing a route over a tun device for a virtual IP, the route must
be set over the tun, not the IKE interface.
 2013-05-06 16:10:13 +02:00
Martin Willi f52cf07532 kernel-interface: get_address_by_ts() can tell if a returned IP is virtual 2013-05-06 16:10:13 +02:00
Martin Willi 1a2a8bffed kernel-interface: support enumeration of virtual-only IPs 2013-05-06 16:10:13 +02:00
Martin Willi 5f7f8c92ca kernel-pfkey: refactor route installation to a dedicate function 2013-05-06 16:10:13 +02:00
Martin Willi 121783035c kernel-pfroute: split /0 routes to avoid conflict with default route 2013-05-06 16:10:13 +02:00
Martin Willi f8646dd65e kernel-pfkey: check if we have a gateway before comparing them 2013-05-06 16:10:13 +02:00
Martin Willi d4260c5f7f kernel-pfkey: install route along with input, not forward policies 
As forwarding policies are not available on all systems (OS X), using the
forward policy to attach the route is a bad pick. Using input policies allows
OS X to install routes.
 2013-05-06 16:10:13 +02:00
Martin Willi 6e879a59fc kernel-pfroute: rescan address list for an interface if its state changes 
It seems that we don't get address notifications if the interface is down
on OS X.
 2013-05-06 16:10:13 +02:00
Martin Willi 0fd409db77 kernel-pfroute: add newly appearing interfaces to the interface cache 2013-05-06 16:10:12 +02:00
Martin Willi 9bc342eae4 kernel-pfroute: implement get_nexthop() 2013-05-06 16:10:12 +02:00
Martin Willi 272bcac894 kernel-pfroute: install and uninstall routes 2013-05-06 16:10:12 +02:00
Martin Willi 3a7f4b5c8d kernel-pfroute: collect replies received for our own queries 2013-05-06 16:10:12 +02:00
Martin Willi b1c6b68e4c kernel-pfroute: refactor PF_ROUTE message processing, use an enumerator 2013-05-06 16:10:12 +02:00
Martin Willi 889efae4cf kernel-pfkey: use an int to set esp_port with a sysctl on OS X 2013-05-06 16:10:12 +02:00
Martin Willi 9650bf3cc7 kernel-pfroute: use INIT() macro for allocations 2013-05-06 16:10:12 +02:00
Martin Willi 0e107f03ac kernel-pfroute: use only a single PF_ROUTE socket for both events and queries 2013-05-06 16:10:12 +02:00
Martin Willi e8002956c9 kernel-pfroute: fix length check when receiving PF_ROUTE messages 2013-05-06 16:10:12 +02:00
Martin Willi 64f309e735 kernel-pfkey: remove obsolete pluto specific behavior 2013-05-06 16:10:12 +02:00
Martin Willi bc6275d21c kernel-netlink: remove obsolete pluto specific behavior 2013-05-06 16:10:11 +02:00
Martin Willi 2af65b26d9 tun_device: add a getter for the address previously passed to set_address() 2013-05-06 16:10:11 +02:00
Martin Willi 60babe0236 tun_device: add a getter for the underlying file descriptor 2013-05-06 16:10:11 +02:00
Martin Willi d947d0d61a tun-device: use host_create_netmask() to calculate interface netmask 2013-05-06 16:10:11 +02:00
Martin Willi 2d8a01d1c6 host: add a netmask constructor taking the number of network bits 2013-05-06 16:10:11 +02:00
Martin Willi 4dc83e9fac host: remove unused host_t.get_differences() method 2013-05-06 16:10:11 +02:00
Martin Willi 7749eb0d2a host: print %#H format specifiers not as %any, but with the port 2013-05-06 16:10:11 +02:00
Martin Willi 344a4e54be host: initialize sockaddr->sa_len if it is available 2013-05-06 16:10:11 +02:00
Martin Willi 60ed88b2c7 child-sa: pass traffic selector to add_sa() regardless of IPsec mode 
This lets the kernel backend decide what to do with it, and in fact all kernel
interfaces already handle this correctly.
 2013-05-06 16:10:11 +02:00
Martin Willi dc35d097b3 socket-default: to bind to one dynamic port on OS X, create v4 socket before v6 
It seems that the order of binding sockets of different address families to the
same dynamic port must be v6-before-v4 on Linux, but v4-before-v6 on OS X.
 2013-05-06 16:10:11 +02:00
Martin Willi a30727fe2b socket-default: refactor socket pair opening to a function 2013-05-06 16:10:11 +02:00
Martin Willi 6948df3220 socket-default: Don't try to send packet if we haven't a socket for given family 2013-05-06 16:10:10 +02:00