denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
14,680 Commits 1 Branch 0 Tags
1db918c4f89fa97ecf04ec29b07960e7cf91fa5c
Commit Graph
1727 Commits
Author SHA1 Message Date
Martin Willi cd41b951ee Pass complete port range over stroke interface for more flexibility 2013-02-21 11:52:33 +01:00
Martin Willi a1db77de7c Use a complete port range in traffic_selector_create_from_{subnet,cidr} 2013-02-21 11:52:33 +01:00
Martin Willi 122b4b6e6d Include local address for Unity Split-Exclude shunt policies 
If we use a virtual IP, having a shunt policy for just that wouldn't work, as
we want a shunt bypass using the local address.
 2013-02-20 16:15:39 +01:00
Andreas Steffen 371b752f00 treat IF-M and IF-TNCCS remediation instructions/parameters in an equal way 2013-02-19 20:00:57 +01:00
Martin Willi 295e42a47f systime-fix disables certificate lifetime validation if system time not synced 
The system time can be periodically checked. If it gets valid, certificates get
rechecked with the current lifetime. If certificates are invalid, associated
IKE_SAs can be closed or reauthenticated.
 2013-02-19 17:11:14 +01:00
Martin Willi 0ed31e7284 Add a stub for systime-fix, a plugin handling certificate lifetimes gracefully 2013-02-19 14:49:38 +01:00
Andreas Steffen 65cdda5cf8 Streamlined log messages in ipseckey plugin 2013-02-19 12:25:00 +01:00
Reto Guadagnini 95650c0836 ipseckey: Report IPSECKEYs with invalid DNSSEC security state 2013-02-19 12:25:00 +01:00
Reto Guadagnini 932717fbde ipseckey: Added "enable" option for the IPSECKEY plugin to strongswan.conf 2013-02-19 12:25:00 +01:00
Reto Guadagnini a77bbc3b8c Added ipseckey plugin, which provides support for public keys in IPSECKEY RRs 2013-02-19 12:25:00 +01:00
Andreas Steffen c381e46855 added missing return statement 2013-02-19 10:24:23 +01:00
Andreas Steffen 0f7cb0caf4 reject PB-Experimental messages with NOSKIP flag set 2013-02-19 09:31:34 +01:00
Martin Willi b5b76df012 Add a timeout to clean up PDP RADIUS connections 2013-02-14 17:20:09 +01:00
Martin Willi dadd9744b6 Keep the PDP connections lock while accessing its objects 
When we introduce connection timeouts, the state may disappear at any time.
This change prevents that, but is not very clear. We probably have to refactor
connection handling.
 2013-02-14 17:19:56 +01:00
Martin Willi 37884ab10f Add locking to TNC-PDP connections 2013-02-14 17:19:49 +01:00
Martin Willi e212033ef2 Merge branch 'ike-dscp' 2013-02-14 17:11:35 +01:00
Martin Willi 285668b6e3 Check if recommendations is set before applying language preference 2013-02-14 17:09:28 +01:00
Martin Willi 8b56943222 Merge branch 'pt-tls' 2013-02-14 17:06:07 +01:00
Tobias Brunner 96a2d2077b Fix 'stroke loglevel any' 
Before b46a5cd4 this worked if debug_t was unsigned.  In that case -1,
as returned by enum_from_name(), would result in a large positive number.
So any unknown debug group (including 'any') had the same effect that
was only intended for 'any'.
 2013-02-13 12:18:20 +01:00
Andreas Steffen bac1052dea treat EAP identities as user IDs 2013-02-12 21:58:03 +01:00
Andreas Steffen 2a421163bf make TNC client authentication type available to IMVs 2013-02-12 20:38:05 +01:00
Andreas Steffen 3e56352815 determine underlying IF-T transport protocol 2013-02-12 12:25:39 +01:00
Andreas Steffen bd1ee5bdc4 make AR identities available to IMVs via IF-IMV 1.4 draft 2013-02-11 15:30:44 +01:00
Andreas Steffen ebb87f08f7 Make IKE/EAP IDs available to TNC server/client 2013-02-11 15:30:44 +01:00
Martin Willi 7fbe516f88 Add a ikedscp ipsec.conf option to set DSCP value on outgoing IKE packets 2013-02-06 15:36:36 +01:00
Martin Willi 306a269e34 Add a DSCP configuration value to IKE configs 2013-02-06 15:20:32 +01:00
Martin Willi ea5917afd8 Set DSCP values when sending IP packets in socket-default 2013-02-06 15:20:32 +01:00
Martin Willi 6e82269ee6 Don't send a packet in default socket if family is not IPv4 nor IPv6 2013-02-06 15:20:32 +01:00
Martin Willi 6c37daaa3b Avoid extensive casting of sockaddr types in socket-default by using a union 
Additionally fixes a strict-aliasing rule compiler warning with older gcc.
 2013-02-06 15:20:32 +01:00
Tobias Brunner 9ccfeb8ca1 Use proper buffer sizes for parse_smartcard() 2013-01-24 23:35:42 +01:00
Tobias Brunner bacbf91c5c Removed unused command name when printing usage info for lookip 2013-01-24 23:35:41 +01:00
Martin Willi 325efdaca8 Filter TS list for Split-Includes before printing them to debug log 2013-01-21 12:15:51 +01:00
Martin Willi 78af36db50 Load multiple comma seperarated certificates in the leftcert option 2013-01-18 09:33:15 +01:00
Martin Willi 9191e5e11a TNCCS plugins don't depend on EAP-TNC, but can be used by other transports, too 2013-01-15 17:43:05 +01:00
Martin Willi c4a49008e8 Don't handle right=%any6 as "loose" identity, but as %any 2013-01-14 10:33:14 +01:00
Tobias Brunner 21235e1ec2 Merge branch 'ikev1-fragmentation' 
This adds support for the proprietary IKEv1 fragmentation extension.

Conflicts:
	NEWS
 2013-01-12 11:58:26 +01:00
Tobias Brunner 365d9a6f67 Added an option that allows to force IKEv1 fragmentation 2013-01-12 11:54:32 +01:00
Volker Rümelin 10eee5fcba Fixed some typos in comments 2013-01-11 10:21:51 +01:00
Tobias Brunner 97973f8609 Use a connection specific option to en-/disable IKEv1 fragmentation 2012-12-24 13:00:01 +01:00
Andreas Steffen 9787b9f2e0 Send empty CDATA batch if TNC client has no data to send 2012-12-23 22:16:30 +01:00
Tobias Brunner ef33a4ab82 Fixed some typos, courtesy of codespell 2012-12-20 09:35:26 +01:00
Martin Willi 32c3ac95e4 Add missing error_notify_msg.h to distribution tarball 2012-12-19 10:40:33 +01:00
Martin Willi 3044085006 Add an error-notify sample application to listen to error notifications 2012-12-19 10:40:33 +01:00
Martin Willi 0aaf5ccfa6 Add an error-notify plugin to send catched alerts to listening applications 2012-12-19 10:40:33 +01:00
Martin Willi c794455666 Raise alerts when enforcing IKE_SA unique policy 2012-12-19 10:40:32 +01:00
Tobias Brunner 0080daa787 Fix deadlock in IMC/IMV managers 
Since reserve_id() might be called from e.g. notify_connection_change()
using a write lock will not work as this can't be acquired while holding
the read lock.

Also, with the previous code it was possible that two IMCs/IMVs added by
two threads at the same time would get the same ID assigned.
 2012-12-18 15:59:29 +01:00
Tobias Brunner 6a8eeba540 Properly select IMC/IMV according to given primary ID in reserve_id() 2012-12-18 15:59:29 +01:00
Martin Willi d9d0f12222 If load-tester requests a virtual IP, use a dynamic local traffic selector 2012-12-17 14:22:25 +01:00
Martin Willi df75cc5c5f Migrate RADIUS accounting state while IKE_SA unique id changes during rekey 2012-12-11 10:40:59 +01:00
Martin Willi 251b740712 Migrate cache and fire lookip events for unique_id change during IKE_SA rekey 2012-12-10 17:04:26 +01:00