denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
17,004 Commits 1 Branch 0 Tags
05b7f1cbfefcaf42b669cc3777da459801756a40
Commit Graph
13313 Commits
Author SHA1 Message Date
Martin Willi 98ed9c6cf2 Migrated kernel_netlink_ipsec to METHOD/INIT macros 2010-02-26 11:44:33 +01:00
Martin Willi 2d49f74e28 Migrated kernel_interface wrapper to METHOD/INIT macros 2010-02-26 11:44:33 +01:00
Martin Willi 667b73721a Added left-/rightikeport ipsec.conf options to use custom IKE ports 2010-02-26 11:44:33 +01:00
Martin Willi cc2eaddee4 Use src/dst ports as configured in ike_cfg 2010-02-26 11:44:33 +01:00
Martin Willi 4e18490ea8 Store custom IKE src/dst ports on ike_cfg 2010-02-26 11:44:33 +01:00
Martin Willi deac3a0a5d Migrated ike_cfg_t to METHOD/INIT macros 2010-02-26 11:44:32 +01:00
Martin Willi 147dd96376 Migrated packet_t to METHOD/INIT macros 2010-02-26 11:44:32 +01:00
Martin Willi dab0560497 Moved socket and socket-raw implementations to plugins 2010-02-26 11:44:32 +01:00
Tobias Brunner eba28948a5 Link all plugins to libstrongswan. 2010-02-25 13:51:05 +01:00
Tobias Brunner 608af0a445 Avoid a race condition that could lead to a segmentation fault. 
Let's assume the callback function of a callback job returns
JOB_REQUEUE_FAIR in one call and JOB_REQUEUE_NONE in the next. Before
this fix, the thread executing the callback job would requeue the job
before unregistering itself. If there was a context switch right after
the job got requeued, and if the thread that requeued the job never got
resumed until a second thread executed the job and, due to the return
value of JOB_REQUEUE_NONE, destroyed it, then when the first thread
eventually got resumed and tried to lock the mutex to unregister itself
the pointer wouldn't be valid anymore, thus resulting in a segmentation fault.
 2010-02-25 09:26:16 +01:00
Martin Willi 3e35a6e7a1 Use side-channel secured mpz_powm_sec of libgmp 5, if available 2010-02-18 17:38:59 +01:00
Martin Willi 7d3a830a71 Updated debian package for NetworkManager-strongswan-1.1.2 2010-02-18 09:51:45 +01:00
Martin Willi e159cd1d1a Version bump and NEWS for NetworkManager-strongswan-1.1.2 release 2010-02-18 09:51:44 +01:00
Martin Willi 0209179a30 Updated german translation 2010-02-18 09:51:40 +01:00
Martin Willi 7613a68f33 Tooltips are translatable 2010-02-18 09:20:13 +01:00
Martin Willi d178eee895 Newer glade requires explicit vertical vboxes 2010-02-18 09:03:17 +01:00
Martin Willi 71070c88b7 Fixed lost renaimings in android plugin 2010-02-18 08:31:10 +01:00
Martin Willi 55699f037f Added Android plugin, currently provides DNS handling on Android 2010-02-17 18:24:11 +01:00
Martin Willi 63b0bc9c2d Invoke missing message() hook for incoming responses 2010-02-17 18:23:14 +01:00
Tobias Brunner 38da64fe12 Detect windows hosts to add specific workarounds. 2010-02-12 10:57:39 +01:00
Tobias Brunner 71baf5a8f0 Adding support for AES GMAC (RFC4543). 2010-02-12 10:57:39 +01:00
Martin Willi 2aa553d773 Do not build own authentication data before we've verified others, we need the other identity in EAP 2010-02-09 16:11:07 +01:00
Tobias Brunner 3cc0cc4332 Increased the buffer for netlink responses. 
If an error occurs while manipulating policies in the kernel, the
original netlink request gets attached to the response.

Prior to Linux 2.6.32 the size in the netlink header of the response was
wrong.
 2010-02-05 20:10:54 +01:00
Andreas Steffen b917f49684 initialize variables to avoid compiler warning 2010-02-05 12:34:37 +01:00
Martin Willi 313a53d4fc Use destination address of ppp interfaces as nexthop in starters default route lookup 2010-02-05 09:28:31 +01:00
Andreas Steffen 6c9c0baee9 init_fetch() changed to fetch_initialize() 2010-02-05 06:17:02 +01:00
Martin Willi 7481f964ae Use child_updown hook in updown plugin, fixes doubled invocation of down script 2010-02-03 11:07:53 +01:00
Andreas Steffen 889ff9389b renamed init_fetch() to fetch_initialize() 2010-02-02 19:44:34 +01:00
Tobias Brunner 41faec0791 Some whitespace and code cleanups concerning the mediation extension. 2010-02-02 15:53:22 +01:00
Tobias Brunner dc5969242f Join pluto's fetching thread instead of detaching it in order to avoid that the leak-detective reports a memleak. 2010-02-02 15:23:39 +01:00
Andreas Steffen b7fd2ea76c corrected captions 2010-02-01 12:44:44 +01:00
Andreas Steffen bf1e0df7c5 warn if loaded local certificate is invalid 2010-02-01 12:29:32 +01:00
Martin Willi 8015c91cb9 Added a ipsec.conf "inactivity" option to configure inactivity timeout for CHILD_SAs 2010-01-27 16:05:11 +01:00
Martin Willi 71da001753 Made inactivity_timeout a per CHILD_SA config option 2010-01-27 15:47:08 +01:00
Martin Willi db05341916 Refactored EAP payload, avoid unaligned word access 2010-01-21 14:43:07 +01:00
Martin Willi 23d2bf84a3 Added a METHOD2() macro that implements a method for two different interfaces 2010-01-21 14:42:08 +01:00
Martin Willi 47498044c3 Support RADIUS messages up to 4096 bytes, RADIUS EAP-Message fragmentation 2010-01-19 16:47:21 +01:00
Martin Willi 7eab4a1be6 Support TLS client authentication Extended Key Usage in x509 generation 2010-01-14 12:00:43 +01:00
Tobias Brunner 776f59f7be Block the signals before the call to sigwait. 2010-01-12 11:52:03 +01:00
Martin Willi aa9eeb5deb Support for closing CHILD/IKE_SA if a CHILD_SA is inactive. 2010-01-12 10:23:42 +01:00
Martin Willi bc6ff2fc99 Added strongswan.conf options to configure retransmission timeouts 2010-01-11 16:42:12 +01:00
Martin Willi 527f7f9b1c Added a "double" getter to libstrongswan settings 2010-01-11 16:39:28 +01:00
Martin Willi dbee988e28 Cast unaligned memcpy() args to char*, avoids over-optimization on ARM 
See http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.faqs/ka3934.html
 2010-01-11 15:35:41 +01:00
Andreas Steffen b979032088 log EAP-only authentication proposal 2010-01-11 11:17:40 +01:00
Andreas Steffen dd37fa8620 pluto and charon are using the same strongSwan Vendor ID 2010-01-11 00:43:46 +01:00
Martin Willi 34948b9971 EAP-MSCHAPv2 is indeed mutual, but is prone to MITM dictionary attacks 2010-01-07 15:56:11 +01:00
Martin Willi f34702ff3f Support EAP-only authentication for mutual and key deriving EAP methods 2010-01-07 15:51:30 +01:00
Martin Willi 12fca6cc9f Indicate and dected support for EAP-only authentication 2010-01-07 14:30:28 +01:00
Martin Willi 023fd8f135 Match to private use algorithms only if we know we are talking to strongSwan 2010-01-07 11:07:53 +01:00
Martin Willi b3349c5694 Interpret private use BEET mode notify only if we know we are talking to strongSwan 2010-01-07 09:37:38 +00:00