denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
3,329 Commits 1 Branch 0 Tags
1e0d1ae213e276828e912b10b8c7cd7fa6600d36
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Martin Willi d2ac1443d3 always encode EAP usernames as ID_KEY_ID 2009-02-18 15:03:33 +00:00
Martin Willi 2d887e8e08 removed unused extract_last_token() and the required memrchr implementation 2009-02-18 09:45:54 +00:00
Martin Willi 6ce32d8719 do not operate on strongswan-padlock on non-x86 2009-02-17 18:30:02 +00:00
Martin Willi 160fdc9d17 added missing kernel-netlink plugin 2009-02-17 09:38:42 +00:00
Martin Willi bd29dab446 fixed build on non-i386 architectures 2009-02-17 09:34:52 +00:00
Martin Willi b08e64a912 build strongswan-padlock on i386 only 2009-02-16 16:49:43 +00:00
Martin Willi 69eb1461ba use separate distribution tarballs for NetworkManager applet 2009-02-16 16:11:16 +00:00
Martin Willi 842e05d5de use a slightly adopted package versioning scheme 
NM applet uses strongSwan independent versions
 2009-02-16 16:05:30 +00:00
Martin Willi 0f9a47a880 added Makefile to build ubuntu PPA source packages 2009-02-16 16:03:09 +00:00
Martin Willi f4cb848eef initial version of new modular strongswan debian packages 
"strongswan" metapackage adds similar functionality as old debian packages
  "network-manager-strongswan" depends on required strongSwan packages
 2009-02-16 12:48:35 +00:00
Martin Willi b81d8cd3cc changed [4856] to dynamically choose traffic selector family 2009-02-11 13:09:52 +00:00
Martin Willi 8837080353 respect family when assigning pool addresses 2009-02-11 12:50:04 +00:00
Martin Willi 95f1735f87 send proper AUTHENTICATION_FAILED if EAP method is successful, but AUTH mismatches 2009-02-10 17:21:44 +00:00
Martin Willi 04a7a1c309 free unneeded retransmission packet when exchange completes 2009-02-09 10:45:51 +00:00
Martin Willi d34030a810 increase nonce size to 32 bytes, required when using SHA384/512 PRFs 2008-12-31 08:58:49 +00:00
Martin Willi 4856241c1e added some NEWS for 4.2.10 2008-12-22 12:48:50 +00:00
Martin Willi 12d4186f5c fixed a potential memory leak when reusing mobike task 2008-12-19 14:34:40 +00:00
Martin Willi f6035833fa RNG tests based on FIPS 140-1 2008-12-18 16:24:22 +00:00
Martin Willi 2241a29571 support for Padlock RNG 2008-12-18 16:21:05 +00:00
Martin Willi 5045eeba7b proper feature probing for padlock 2008-12-17 15:40:01 +00:00
Martin Willi 9bcc9bb60e updated documentation 
some minor cleanups
calloc does not need an additional memset(0)
 2008-12-17 09:00:22 +00:00
Martin Willi 097e4b8ff9 purge certificates after IKE_AUTH response has been built 2008-12-16 15:48:36 +00:00
Martin Willi 764e8b2211 reimplemented certificate cache: 
fixes unsafe certificate caching
	use fixed array instead of a list
	fine grained per-slot locking
	use cache hits for housekeeping
 2008-12-15 15:41:48 +00:00
Martin Willi 482218f075 signal each entry condvar after enumeration, required if wait_for_entry is called 2008-12-15 09:19:04 +00:00
Martin Willi abfde23ae9 added an additional frame to lock profiling backtraces 2008-12-15 09:13:43 +00:00
Martin Willi 50901d2550 do not respawn cancelled threads if we are shutting down 2008-12-12 15:57:12 +00:00
Martin Willi 248a1f57bb fixed possible deadlock in checkin_and_destroy 2008-12-12 10:40:45 +00:00
Martin Willi d183adbc9d avoid DNS lookup if possible 2008-12-12 10:38:53 +00:00
Martin Willi 3993b91334 execute events if difference is 0, prevents a busywait 2008-12-12 09:16:31 +00:00
Martin Willi 8006835ec1 load tester got a "shutdown_when_complete" option, allows performance test using "time" 2008-12-12 09:14:37 +00:00
Martin Willi 30841a0305 daemon exports main_thread_id, sends SIGTERM to the main thread in daemon_kill 2008-12-12 09:13:06 +00:00
Martin Willi 7a485e90bd leak detective binds execution to a signle core, avoids corruption on SMP machines 2008-12-12 09:10:52 +00:00
Martin Willi f2bd424c89 wait until all IKE_SAs are in-house before destroying them 2008-12-12 08:33:48 +00:00
Martin Willi c636092c94 fixed usage of "leases" command 2008-12-11 12:49:41 +00:00
Martin Willi 6b83549d1a list assigned leases using "ipsec leases" 2008-12-10 13:00:02 +00:00
Martin Willi ed2bcd0315 added IKE_SA established timer to "ipsec statusall" 2008-12-10 09:59:35 +00:00
Martin Willi d5d5bc0f16 using rwlock to parallel build credentials 2008-12-09 15:57:51 +00:00
Martin Willi 5e5b2dc105 use thread-safe variant of gmtime 2008-12-09 15:00:30 +00:00
Martin Willi 6144daba9d fixed load-tester shared key lookup 2008-12-09 14:45:56 +00:00
Martin Willi 7023d49ee1 purge auth_info when IKE_SA is established, releases cert memory 2008-12-09 14:34:15 +00:00
Martin Willi a1466a3ec2 limit number of ADDITIONAL_IPV*_ADDR notifies 2008-12-09 14:32:57 +00:00
Martin Willi 2e03196551 list pools and usage in ipsec statusall 2008-12-09 13:24:12 +00:00
Martin Willi adf9965272 extended stroke in-memory pool to use hash-tables 
supports online/offline leases
	properly reassign addresses to identities
 2008-12-09 13:23:42 +00:00
Martin Willi 20fbc4277e fixed hashtable->get_count() after doubling table size 2008-12-09 11:13:52 +00:00
Martin Willi 15ed045c87 require explicit enabling of load-testing plugin 2008-12-09 09:11:37 +00:00
Martin Willi 5bdc8fc794 generating different initiator identities, configs and certificates on the fly 2008-12-08 19:18:28 +00:00
Martin Willi aa5c5d3fde removed debugging leftovers 2008-12-08 19:15:38 +00:00
Martin Willi 474998099f fixed out-of-tree build of scepclient 2008-12-08 16:00:33 +00:00
Martin Willi df68b54f4e basic x509 certificate generation 2008-12-08 15:29:36 +00:00
Martin Willi 9eb85cffe1 whitelisted another pthread_setspecific implementation 2008-12-08 15:27:24 +00:00
Martin Willi d21b3549f7 accept NULL values in hashtable enumerator 2008-12-05 12:34:17 +00:00
Martin Willi 19e0010f51 hashtable enumerator enumerates over both, key and values 2008-12-05 10:01:52 +00:00
Martin Willi a6d7a6107c added actual ikev2bis draft 2008-12-05 09:41:20 +00:00
Martin Willi 876d5c63a3 pass identity to release_address(), allows providers to do a lookup by id 2008-12-05 09:40:50 +00:00
Martin Willi 7710a286ca fixed copy-paste bug (double-free) 2008-12-04 10:10:37 +00:00
Martin Willi d0eee69822 reset pointer for a clean destruction 2008-12-04 10:09:21 +00:00
Martin Willi 3bfd0fe3f2 handling peer_match with higher priority tan ike_match to select correct config if IPs are equal 2008-12-04 10:00:03 +00:00
Martin Willi 0442562516 leak whitelisting of OPENSSL_config() 2008-12-04 09:23:53 +00:00
Martin Willi 70691c31b2 fixed double free of host in selector2ts 2008-12-03 09:15:29 +00:00
Martin Willi efd0fe21e4 ref_get()/ref_put() use atomic gcc operations if supported, thanks to Thomas Jarosch for the patch 2008-12-02 12:14:32 +00:00
Martin Willi 6905f794bb added a --disable-threads ./configure option for pluto 2008-12-02 09:01:57 +00:00
Martin Willi 2671a8fcee use DBG_ANY to set all loglevels 2008-12-02 08:52:46 +00:00
Martin Willi f464d75070 added time.h include for struct tm 2008-12-02 08:46:15 +00:00
Martin Willi 394eb35b0c some task queueing improvements: 
- do not pass CHILD_SAs to task constructor, might not
	  be valid anymore during execution (late lookup)
	- use sub-tasks to delete CHILD/IKE_SA after rekeying,
	  as we want to execute the delete before additional
	  queued tasks
 2008-12-01 18:38:28 +00:00
Martin Willi 405cc1d924 schedule rekeying when activating passive IKE_SAs 2008-11-28 16:19:19 +00:00
Martin Willi dd6b7af3f7 do not delete passive IKE_SAs 2008-11-28 15:44:25 +00:00
Martin Willi c610f42430 added a PASSIVE IKE_SA state to manage it externally 2008-11-28 10:49:14 +00:00
Martin Willi ddef455219 pass SKd to derive_ike_keys() to have a more interoperable API 2008-11-28 09:51:44 +00:00
Martin Willi 9a1263c3c1 fixed a double-unlock bug, showed up when using rwlocks in backend manager 2008-11-28 08:22:55 +00:00
Martin Willi ced41695dc use rwlocks in backend manager to allow simultaneous access 2008-11-27 15:34:17 +00:00
Martin Willi 96eb7b44a0 use a rwlock in attribute manager to allow simultaneous access 2008-11-27 15:22:41 +00:00
Martin Willi c50ad6f613 remove attribute provider in SQL plugin destruction 2008-11-27 14:33:41 +00:00
Martin Willi ac812491aa added an include hack to build starter without gmp.h 2008-11-27 10:20:25 +00:00
Martin Willi 140d0081bf fixed pluto out-of-tree builds 2008-11-27 10:18:38 +00:00
Martin Willi 9413628b87 token enumerator missed the last token if it contains only a single char 2008-11-27 09:21:52 +00:00
Martin Willi d2de674b9a checkin of non-existing IKE_SAs 
removed unneeded checkin() return values
 2008-11-26 14:32:55 +00:00
Martin Willi 09f407a14f removed private parser function pointers, allows compiler to inline 2008-11-26 10:54:08 +00:00
Martin Willi 98bcdfe2c9 removed private generator function pointers, allows compiler to inline 2008-11-26 10:42:54 +00:00
Martin Willi e2cb07d713 inlined some short chunk functions, showed up in the profiler 2008-11-26 10:08:36 +00:00
Martin Willi 4fd233a73e memxor() tweaks, as it is heavily used in xcbc 2008-11-26 10:06:59 +00:00
Martin Willi f1f09810fb fixed set_message_id() on IKE_SA 
added missing bus->message() hook invocation
whitespace cleanups
 2008-11-24 13:59:30 +00:00
Martin Willi b09ca74720 set message IDs on IKE_SAs 2008-11-24 12:46:06 +00:00
Martin Willi addfea95df moved the IPV6_IPSEC_POLICY definition to the ipsec plugins, fixes uClibc build 2008-11-24 08:22:05 +00:00
Martin Willi 18e2788fbe added a "load_tester.auth" option: "pubkey" (default) or "psk" 2008-11-23 11:58:41 +00:00
Martin Willi 88d4acd4de proper cancellation of load-testing initiators 2008-11-23 11:17:30 +00:00
Martin Willi a20abb81e9 added a MODP_NULL Diffie Hellman group to avoid calculation overhead in load-testing 2008-11-22 16:14:55 +00:00
Martin Willi 8f45ece098 expecting int sized length arguments to chunk_split, as vararg functions use integers 2008-11-21 08:11:24 +00:00
Martin Willi fc3ef71fa7 fixed lock-profiler help message 2008-11-19 15:37:46 +00:00
Martin Willi 3aaf7908d1 refactored and cleaned up child_sa interface 
replaced add/update calls by a install() call
	allocating SPIs always externally
	support installation of non-allocated CHILD_SAs
	some other cleanups
 2008-11-19 15:31:27 +00:00
Martin Willi 0d1a57e496 setting default port of own address to have a proper fallback if src addr lookup fails 2008-11-18 10:10:36 +00:00
Martin Willi 32f59c56f1 consider interfaces we do not monitor as up (e.g. lo) 
fixes load-testing against 127.0.0.1
 2008-11-18 09:52:28 +00:00
Martin Willi 49653b6bc3 separated updown listener to its own class 
caching interface names to properly remove rules if interface has changed
 2008-11-17 09:29:27 +00:00
Martin Willi 21bf86f740 using aligned buffers for netlink 2008-11-14 14:23:11 +00:00
Martin Willi 32ec3c1a8b fallback to reauthentication if peer does not support CHILD_SA rekeying 2008-11-14 14:05:47 +00:00
Martin Willi dad8eceea3 fall back to reauthentication if IKE rekeying fails with NO_ADDITIONAL_SAS 2008-11-14 13:58:16 +00:00
Martin Willi 8d50c19833 also use correct encap parameter in PF_KEY 2008-11-14 13:15:26 +00:00
Martin Willi fd2ebf0cf9 fixed encap enabling in xfrm (using new encap state, not the old one) 2008-11-14 13:12:07 +00:00
Martin Willi fb6c8591a3 do not use a route if outgoing interface is down 
other cleanups
 2008-11-14 13:04:22 +00:00
Martin Willi a65e1c5c3a rta->rta_len is NOT the payload data length, use RTA_PAYLOAD(rta) instead! 2008-11-14 10:30:26 +00:00
Martin Willi f5812086f8 do not use public interface for functions which are local anyway 2008-11-14 09:38:49 +00:00