denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
10,607 Commits 1 Branch 0 Tags
1a9dee5d22b10649a581bcf5871079a4e1800b9a
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Martin Willi b668f1417d Don't invoke addr2line if dladdr() did not yield a filename 2013-03-04 15:50:21 +01:00
Martin Willi 1f69412b4d When receiving critical signals, additionally log backtraces to syslog/files 2013-03-04 15:46:34 +01:00
Martin Willi fe03f51302 backtrace_t.log() takes a NULL file pointer to log to registered dbg() hook 2013-03-04 15:45:03 +01:00
Martin Willi 8b24863b1f Don't use color escapes when printing backtraces to a non-TTY file 2013-03-04 15:07:03 +01:00
Martin Willi 4d17427205 Add a utility function to resolve TTY color escape codes dynamically 2013-03-04 15:04:56 +01:00
Martin Willi 4dd8d5430d Merge branch 'multi-eap' 
Fixes the use of EAP methods in the non-first authentication round if the
initiator demands mutual EAP. Also mutual EAP can now be enforced when the
initiator sets rightauth=eap, not only with rightauth=any.
 2013-03-01 11:36:41 +01:00
Martin Willi e82deaf6ce Merge branch 'multi-cert' 
Allows the configuration of multiple certificates in leftcert, and select
the correct certificate to use based on the received certificate requests.
 2013-03-01 11:35:32 +01:00
Martin Willi adf239abca Merge branch 'systime' 
Add a systime-fix plugin allowing an embedded system to validate certificates
if the system time has not been synchronized after boot. Certificates of
established tunnels can be re-validated after the system time gets valid.
 2013-03-01 11:33:47 +01:00
Martin Willi b611d8ba48 Merge branch 'ikev1-rekeying' 
Migrates Quick Modes to the new Main Mode if an IKEv1 reauthentication replaces
the old Main Mode having a uniqueids=replace policy.
 2013-03-01 11:32:02 +01:00
Martin Willi ec1b4e6638 Merge branch 'vip-shunts' 
Installs bypass policies for the physical address if a virtual address is
assigned, and installs a proper source route to actually use the physical
address for bypassed destinations.

Conflicts:
	src/libcharon/plugins/unity/unity_handler.c
 2013-03-01 11:30:13 +01:00
Martin Willi a36b49f3cb Merge branch 'opaque-ports' 
Adds a %opaque port option and support for port ranges in left/rightprotoport.
Currently not supported by any of our kernel backends.
 2013-03-01 11:27:12 +01:00
Martin Willi 53fcc70acc When running with an unprivileged user, initialize supplementary groups 2013-03-01 11:27:01 +01:00
Martin Willi 21dd4c4bea Without MOBIKE, update remote host only if it is behind NAT 2013-03-01 11:26:47 +01:00
Martin Willi 00683b6864 Merge branch 'ikev1-mm-retransmits' 
Fixes retransmit of the last Main Mode or IKE_AUTH message, and correctly
queues Main Mode messages when processing of the last message is still in
progress.
 2013-03-01 11:24:42 +01:00
Martin Willi d634109f1d Merge branch 'tfc-notify' 
Introduces kernel backend features, sends ESP_TFC_PADDING_NOT_SUPPORTED if
kernel does not support it.
 2013-03-01 11:16:58 +01:00
Martin Willi 5c55be4915 Send ESP_TFC_PADDING_NOT_SUPPORTED if the used kernel doesn't support it 2013-03-01 11:12:17 +01:00
Martin Willi 53e62f5d0c Indicate support for processing ESPv3 TFC padding in Netlink IPsec backend 2013-03-01 11:11:51 +01:00
Martin Willi 76f7d80e80 Introduce "features" for the kernel backends returning kernel capabilities 2013-03-01 11:11:24 +01:00
Martin Willi d8a94c18c6 Apply a mutual EAP auth_cfg not before the EAP method completes 2013-02-26 13:15:27 +01:00
Martin Willi cc787697b8 Be a little more verbose why a peer_cfg is inacceptable 2013-02-26 13:15:27 +01:00
Martin Willi 289b9b7b31 Refactor auth_cfg applying to a common function 2013-02-26 13:15:27 +01:00
Martin Willi e2857be823 For IKEv1 Main Mode, use message hash to detect early retransmissions 
As the message ID is zero in all Main Mode messages, it can't be used to detect
if we are already processing a given message.
 2013-02-25 12:12:38 +01:00
Martin Willi cdf75a39e3 Move initial message dropping to task manager 
When the last request message of the initial tunnel setup is retransmitted,
we must retransmit the response instead of ignoring the request.

Fixes #295.
 2013-02-25 12:12:19 +01:00
Martin Willi 9eaed7a5bb Use INIT macro to initialize IKE_SA manager entries 2013-02-25 12:10:02 +01:00
Martin Willi b443fa6123 Don't reject OPAQUE ports while verifying traffic selector substructure 2013-02-21 11:52:33 +01:00
Martin Willi 0abeac3a0b Document ipsec.conf leftprotoport extensions in manpage 2013-02-21 11:52:33 +01:00
Martin Willi 0e7ef7f522 Optionally support port ranges in leftprotoport 2013-02-21 11:52:33 +01:00
Martin Willi fd658bce28 Support %opaque keyword in leftprotoport for "opaque" ports 2013-02-21 11:52:33 +01:00
Martin Willi cd41b951ee Pass complete port range over stroke interface for more flexibility 2013-02-21 11:52:33 +01:00
Martin Willi a1db77de7c Use a complete port range in traffic_selector_create_from_{subnet,cidr} 2013-02-21 11:52:33 +01:00
Martin Willi c572b5c8c1 Print OPAQUE traffic selectors as what they are, not as port range 2013-02-21 11:52:33 +01:00
Martin Willi 7b368af61a Support "opaque" ports in traffic selector subset calculation 2013-02-21 10:51:19 +01:00
Martin Willi 7dbe1feef1 Slightly refactor traffic_selector_t.get_subset() 2013-02-21 10:48:48 +01:00
Martin Willi de5d569b24 Migrate remaining traffic selector methods to METHOD macro 2013-02-21 10:28:21 +01:00
Martin Willi a2fd08dd26 Install a route for shunt policies 
If we install a virtual IP, its source route would render the shunt policy
useless, as locally generated traffic wouldn't match. Having a route for each
shunt policy with higher priority chooses the correct source address for
bypassed destinations.
 2013-02-20 16:32:24 +01:00
Martin Willi 122b4b6e6d Include local address for Unity Split-Exclude shunt policies 
If we use a virtual IP, having a shunt policy for just that wouldn't work, as
we want a shunt bypass using the local address.
 2013-02-20 16:15:39 +01:00
Martin Willi 3dc9d427c9 After IKEv1 reauthentication, reinstall VIP routes after migrating CHILD_SAs 
During IKEv1 reauthentication, the virtual IP gets removed, then reinstalled.
The CHILD_SAs get migrated, but any associated route gets removed from the
kernel. Reinstall routes after adding the virtual IP again.
 2013-02-20 09:16:00 +01:00
Martin Willi f836d433a9 When detecting a duplicate IKEv1 SA, adopt children, as it might be a rekeying 2013-02-20 08:57:17 +01:00
Martin Willi 295e42a47f systime-fix disables certificate lifetime validation if system time not synced 
The system time can be periodically checked. If it gets valid, certificates get
rechecked with the current lifetime. If certificates are invalid, associated
IKE_SAs can be closed or reauthenticated.
 2013-02-19 17:11:14 +01:00
Martin Willi 0ed31e7284 Add a stub for systime-fix, a plugin handling certificate lifetimes gracefully 2013-02-19 14:49:38 +01:00
Martin Willi de399f550d Add a cert_validator hook allowing plugins to provide custom lifetime checking 2013-02-19 14:31:18 +01:00
Martin Willi 790e00aaa9 Make cert_validator_t.validate optional to implement 2013-02-19 14:31:18 +01:00
Martin Willi 69faf63528 Fix encoding of issuerAndSubject while handling SCEP pending state 2013-02-19 09:53:47 +01:00
Martin Willi b5b76df012 Add a timeout to clean up PDP RADIUS connections 2013-02-14 17:20:09 +01:00
Martin Willi dadd9744b6 Keep the PDP connections lock while accessing its objects 
When we introduce connection timeouts, the state may disappear at any time.
This change prevents that, but is not very clear. We probably have to refactor
connection handling.
 2013-02-14 17:19:56 +01:00
Martin Willi 37884ab10f Add locking to TNC-PDP connections 2013-02-14 17:19:49 +01:00
Martin Willi d20a2cc5f3 Add IF-M message subtype getter to IMC/IMV messages 2013-02-14 17:18:24 +01:00
Martin Willi bbe9261bbf Use a generic constructor to create PA-TNC error attributes 2013-02-14 17:18:00 +01:00
Martin Willi 4755ab505d Add a global return_success() method implementation 2013-02-14 17:17:45 +01:00
Martin Willi de32b8aed6 Add a convenience method to check pen_type_t for vendor and type 2013-02-14 17:17:30 +01:00
Martin Willi d03b338487 Add a comparison function for pen_type_t 2013-02-14 17:17:22 +01:00
Martin Willi 9db54bbcd4 Whitespace and comment cleanups in pen.[ch] 2013-02-14 17:17:07 +01:00
Martin Willi e212033ef2 Merge branch 'ike-dscp' 2013-02-14 17:11:35 +01:00
Martin Willi 285668b6e3 Check if recommendations is set before applying language preference 2013-02-14 17:09:28 +01:00
Martin Willi a9df87bf89 PT-TLS dispatcher TNCCS constructor takes peer identities to pass to factory 2013-02-14 17:09:28 +01:00
Martin Willi 8b56943222 Merge branch 'pt-tls' 2013-02-14 17:06:07 +01:00
Martin Willi 46ae05dd17 Remove leading zeros in SCEP certificate serialNumbers 2013-02-14 16:56:32 +01:00
Martin Willi f476ff84f3 Add a --httptimeout option to scepclient 2013-02-08 11:09:33 +01:00
Martin Willi 763e86c093 Use CURL_TIMEOUT and not CURL_CONNECTTIMEOUT for FETCHER_TIMEOUT in curl 
This allows us to use this timeout beyond DNS resolution. For the initial
connect, we use a hardcoded timeout of 10s for now.
 2013-02-08 11:08:06 +01:00
Martin Willi 88f4cd3988 Add ikedscp documentation to ipsec.conf.5 2013-02-06 15:42:14 +01:00
Martin Willi 7fbe516f88 Add a ikedscp ipsec.conf option to set DSCP value on outgoing IKE packets 2013-02-06 15:36:36 +01:00
Martin Willi 5b15bd5f9d Set configured DSCP value while generating IKE packets 2013-02-06 15:20:32 +01:00
Martin Willi 306a269e34 Add a DSCP configuration value to IKE configs 2013-02-06 15:20:32 +01:00
Martin Willi ea5917afd8 Set DSCP values when sending IP packets in socket-default 2013-02-06 15:20:32 +01:00
Martin Willi 6e82269ee6 Don't send a packet in default socket if family is not IPv4 nor IPv6 2013-02-06 15:20:32 +01:00
Martin Willi 1116689944 Add a DSCP value with getter/setter on packet_t 2013-02-06 15:20:32 +01:00
Martin Willi 6c37daaa3b Avoid extensive casting of sockaddr types in socket-default by using a union 
Additionally fixes a strict-aliasing rule compiler warning with older gcc.
 2013-02-06 15:20:32 +01:00
Martin Willi 82c884c015 Set sockaddr family on ifreq instead of casted familiy specific sockaddr 
Fixes a strict-aliasing rule compiler warning with older gcc.
 2013-02-06 15:20:32 +01:00
Martin Willi 8d631ebabd Encode IETF Numeric Version Service Pack Version with two byte words 2013-01-22 14:45:56 +01:00
Martin Willi 325efdaca8 Filter TS list for Split-Includes before printing them to debug log 2013-01-21 12:15:51 +01:00
Martin Willi 51dbcf6497 After merging the used trustchain with config, move used certificate to front 2013-01-18 11:59:27 +01:00
Martin Willi 11a7abf554 Add ipsec.conf.5 updates regarding multiple certificates in leftcert 2013-01-18 09:33:15 +01:00
Martin Willi 9a06a93ce7 Try to build a trustchain for all configured certificates before enforcing one 
This enables the daemon to select from multiple configured certificates
by building trustchains against the received certificate requests.
 2013-01-18 09:33:15 +01:00
Martin Willi 78af36db50 Load multiple comma seperarated certificates in the leftcert option 2013-01-18 09:33:15 +01:00
Martin Willi f29783af8c Make AUTH_RULE_SUBJECT cert multi-valued 
Constraints having multiple subject certs defined are fulfilled if
authentication used one of the listed certificates.
 2013-01-18 09:33:15 +01:00
Martin Willi 16ef69d70a Pass a constructor callback to create TNCCS server instances while dispatching 2013-01-17 16:34:34 +01:00
Martin Willi 04a9a99bc1 Create pt_tls_client with separate server address and identity 2013-01-16 16:36:57 +01:00
Martin Willi bb5037a5e5 Create pt_tls_dispatcher with separate server address and identity 2013-01-16 15:02:14 +01:00
Martin Willi 18d56a1891 Add a libpttls providing NEA PT-TLS / TNC IF-T for TLS transport layer 2013-01-16 13:53:32 +01:00
Martin Willi 435348f406 Send TLS close notify during tls_socket_t destruction 2013-01-15 17:43:05 +01:00
Martin Willi 7bbf7aa97a Send TLS close notify if application returns SUCCESS 2013-01-15 17:43:05 +01:00
Martin Willi c43e8fdec4 Block TLS read when sending data, but have to wait for the handshake data first 2013-01-15 17:43:05 +01:00
Martin Willi 9191e5e11a TNCCS plugins don't depend on EAP-TNC, but can be used by other transports, too 2013-01-15 17:43:05 +01:00
Martin Willi 7fb81886b9 Add a bio_reader_t constructor variant freeing passed data during destruction 2013-01-15 17:43:05 +01:00
Martin Willi ee90c78998 Use a more POSIXy tls_socket interface with more flexibility. 
If an unsufficient read buffer is provided, application data gets cached
for subsequent read() calls.
 2013-01-15 17:43:05 +01:00
Martin Willi 47af9848a2 Add a chunk_from_str() initializer that does not include 0-terminator 2013-01-15 17:43:05 +01:00
Martin Willi 1449e6dd55 Reseed rdrand after every 128bit sample only 2013-01-15 17:41:54 +01:00
Martin Willi c4a49008e8 Don't handle right=%any6 as "loose" identity, but as %any 2013-01-14 10:33:14 +01:00
Martin Willi 426f34baf9 Respect given address family when resolving "%any" 2013-01-14 10:26:12 +01:00
Martin Willi 54a1a75b2f Don't use bio_writer_t.skip() to write length field when appending more data 
If the writer reallocates its buffer, the length pointer might not be valid
anymore, or even worse, point to an arbitrary allocation.
 2013-01-11 14:57:08 +01:00
Martin Willi 2f0441a3a6 Add rdrand NEWS 2013-01-11 10:48:57 +01:00
Martin Willi 2cd6c5115b Use raw opcodes for rdrand to build with older binutils 2013-01-11 10:45:14 +01:00
Martin Willi 19ae23452a Provide RNG_TRUE quality in rdrand by mixing reseeded outputs using AES 2013-01-11 10:45:14 +01:00
Martin Willi b9148ea232 Provide RNG_STRONG quality in rdrand by forcing PRNG reseed after every sample 2013-01-11 10:45:14 +01:00
Martin Willi 9fe24b004d Provide RNG_WEAK quality random generator in rdrand 2013-01-11 10:45:14 +01:00
Martin Willi ed8dc6f132 Add a rdrand plugin stub detecting availability of RDRAND instructions 2013-01-11 10:45:14 +01:00
Martin Willi 0e0870aef7 Add NEWS about improved Windows IKEv1 compatibility 2013-01-11 10:31:25 +01:00
Martin Willi 1954cc7720 Streamline debug output when receiving intermediate CA certificates in IKEv1 2013-01-11 10:24:23 +01:00
Martin Willi cde6a9ec9f Refactored IKEv2 cert/certreq payload processing to multiple functions 2013-01-11 10:21:56 +01:00
Martin Willi bf10ee9495 Refactored IKEv1 cert payload processing to multiple functions 2013-01-11 10:21:56 +01:00