denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
12,692 Commits 1 Branch 0 Tags
1e4ee168c80fdb9931190d511cb8bca604df8a7a
Commit Graph
1446 Commits
Author SHA1 Message Date
Tobias Brunner aaefeafb49 Enable UDP decapsulation for both address families 
Since the 3.5 Linux kernel both UDP implementations have a separate static
flag to indicate whether ANY sockets enabled UDP decapsulation.
As we only ever enabled it for one address family (in earlier versions IPv4
only, now for IPv6, if supported, and for IPv4 otherwise) UDP decapsulation
wouldn't work anymore (at least for one address family).
 2012-08-16 15:26:37 +02:00
Tobias Brunner 11b514bff6 Correctly transmit EAP-MSCHAPv2 user name if it contains a domain part 2012-08-16 10:03:49 +02:00
Tobias Brunner e4ef4c9877 Merge branch 'android-ndk' 
This branch comes with some preliminary changes for the user-land IPsec
implementation and the Android App.

One important change is that the UDP ports used by the socket-default plugin
were made configurable (either via ./configure or strongswan.conf).
Also, the plugin does randomly allocate a port if it is configured to 0,
which is useful for client implementations.  A consequence of these
changes is that the local UDP port used when creating ike_cfg_t objects has
to be fetched from the socket.
 2012-08-13 10:45:39 +02:00
Tobias Brunner 000668d308 Doxygen fix 2012-08-11 16:50:22 +02:00
Martin Willi 27128c1e32 EAP-GTC can use any XAuth backend, including xauth-pam 
This makes EAP-GTC a generic plain password authentication method,
as it is used with XAuth. Instead of verifying credentials with
PAM, any backend can be configured. The default is xauth-pam,
providing the same functionality as EAP-GTC in strongSwan 4.x.
 2012-08-10 10:43:44 +02:00
Martin Willi b9e4916321 Add xauth-pam, an XAuth backend verifying credentials with PAM 2012-08-10 10:43:44 +02:00
Andreas Steffen da21793679 make max_message_size parameter consistent with similar options 2012-08-09 14:11:08 +02:00
Tobias Brunner 6fbf4472ea Added option to prevent socket-default from setting the source address on outbound packets 2012-08-08 15:39:07 +02:00
Tobias Brunner 224ab4c59b socket-default plugin allocates random ports if configured to 0. 
Also added strongswan.conf options to change the ports.
 2012-08-08 15:30:27 +02:00
Tobias Brunner b223d517c8 Replaced usages of CHARON_*_PORT with calls to get_port(). 2012-08-08 15:12:25 +02:00
Tobias Brunner a7babe25ee Added get_port() method to socket_t to learn the listening port. 2012-08-08 15:12:25 +02:00
Tobias Brunner 896941d365 Improved how NAT-T keepalives are handled in sockets/receiver. 2012-08-08 15:12:24 +02:00
Tobias Brunner e49abcede0 Let kernel interfaces decide how to enable UDP decapsulation of ESP packets. 2012-08-08 15:12:24 +02:00
Tobias Brunner 064da8b96b Add Non-ESP marker in sender and not individual socket plugins. 2012-08-08 15:12:24 +02:00
Tobias Brunner 65da43e2fc Handle Non-ESP marker in receiver and not individual socket plugins. 2012-08-08 15:12:24 +02:00
Tobias Brunner 162621ed57 Moved Android specific logger to separate plugin. 
This is mainly because the other parts of the existing android plugin
can not be built in the NDK (access to keystore and system properties are
not part of the stable NDK libraries).
 2012-08-08 15:07:43 +02:00
Tobias Brunner e7ea057fd2 Make the UDP ports charon listens for packets on (and uses as source ports) configurable. 2012-08-08 15:07:43 +02:00
Tobias Brunner 63ac6d00b0 Proper fallback if capability dropping is not available 2012-07-27 14:46:42 +02:00
Martin Willi 874f7c7e2c Don't add ANY identity constraint to auth config, as XAuth rounds don't use one 2012-07-26 12:38:34 +02:00
Martin Willi 46df61dff7 Add an ipsec.conf leftgroups2 parameter for the second authentication round 2012-07-26 11:51:58 +02:00
Martin Willi 09e3717525 Fix EAP-MSCHAPv2 master key derivation, broken with 87dd205b 2012-07-18 16:46:05 +02:00
Martin Willi 6719889e0a Use centralized hasher names in coupling plugin 2012-07-17 17:32:03 +02:00
Andreas Steffen 931da8202b handled return values in tnc-pdp 2012-07-16 22:54:38 +02:00
Martin Willi ff9e46772f Handle PRF failures in eap-aka-3gpp2 2012-07-16 14:55:08 +02:00
Martin Willi 511f0b18b9 Cleaned up memory management and return values for encryption payload 2012-07-16 14:55:07 +02:00
Martin Willi 87dd205b61 Add a return value to hasher_t.allocate_hash() 2012-07-16 14:55:06 +02:00
Martin Willi e185612dd8 Add a return value to keymat_v1_t.{get,update,confirm}_iv 2012-07-16 14:55:06 +02:00
Martin Willi 8bd6a30af1 Add a return value to hasher_t.get_hash() 2012-07-16 14:55:06 +02:00
Martin Willi ce73fc19db Add a return value to crypter_t.set_key() 2012-07-16 14:53:38 +02:00
Martin Willi e35abbe588 Add a return value to crypter_t.encrypt 2012-07-16 14:53:37 +02:00
Tobias Brunner e59f983160 Check rng return value when generating identity in eap-simaka-reauth plugin 2012-07-16 14:53:36 +02:00
Tobias Brunner e37f9ac2c9 Check rng return value when generating pseudonym in eap-simaka-pseudonym plugin 2012-07-16 14:53:36 +02:00
Tobias Brunner 8beeb8e116 Check rng return value when generating nonces in eap-aka plugin 2012-07-16 14:53:36 +02:00
Tobias Brunner 18ce1bb721 Check rng return value when generating nonces in eap-sim plugin 2012-07-16 14:53:36 +02:00
Tobias Brunner 10b6ca5fb2 Check rng return value when generating RAND in eap-aka-3gpp2 plugin 2012-07-16 14:53:36 +02:00
Tobias Brunner 162f489a27 Check rng return value when generating challenges in eap-md5 and mschapv2 plugins 2012-07-16 14:53:36 +02:00
Tobias Brunner 7ae2671036 Check rng return value when generating Transaction IDs in DHCP plugin 2012-07-16 14:53:36 +02:00
Martin Willi 2d56575d52 Add a return value to signer_t.set_key() 2012-07-16 14:53:33 +02:00
Martin Willi 86d2cdc1ed Add a return value to simaka_crypto_t.derive_keys_*() 2012-07-16 14:53:33 +02:00
Martin Willi 5fb719e0de Add a return value to radius_message_t.sign() 2012-07-16 14:53:33 +02:00
Martin Willi 264e702109 Add a return value to simaka_message_t.generate() 2012-07-16 14:53:33 +02:00
Martin Willi d19f0ae3e0 Don't modify the message string passed to logger, as it gets reused 2012-07-13 15:43:04 +02:00
Andreas Steffen 22e97e4f1f updated Copyright info 2012-07-13 10:42:40 +02:00
Andreas Steffen 968c83cdeb restrict PA-TNC messages to maximum size 2012-07-12 21:26:18 +02:00
Tobias Brunner 8d98f7fef6 Avoid that any % characters (e.g. in %any) are evaluated when logging via stroke 2012-07-12 16:58:00 +02:00
Andreas Steffen c9c3da66a8 removed unused variables 2012-07-11 23:15:44 +02:00
Andreas Steffen c56667f1db fixed logging of unsupported TNCCS version 2012-07-11 17:09:05 +02:00
Andreas Steffen 1de4af66d5 PB-TNC Client sends empty CLOSE batch only in DECIDED state 2012-07-11 17:09:05 +02:00
Andreas Steffen a287a3cdcd have_recommendation() accepts NULL arguments 2012-07-11 17:09:05 +02:00
Andreas Steffen b8b678a567 send empty SDATA batch if no recommendation is available yet, but in order to avoid loops only if no empty CDATA batch was received 2012-07-11 17:09:05 +02:00