denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
12,692 Commits 1 Branch 0 Tags
1e4ee168c80fdb9931190d511cb8bca604df8a7a
Commit Graph
1446 Commits
Author SHA1 Message Date
Martin Willi c7d4dad66d vici: Implement a terminate command to close IKE or CHILD_SAs 2014-05-07 14:13:35 +02:00
Martin Willi 5f95657c65 vici: Add a control backend, currently to initiate connections by name 2014-05-07 14:13:35 +02:00
Martin Willi ecc4b51048 vici: Support thread cancellation in command callbacks 2014-05-07 14:13:35 +02:00
Martin Willi 045bdf5283 vici: Move dumping to core message class, use it in libvici 2014-05-07 14:13:35 +02:00
Martin Willi 7f4cfdff58 vici: Add convenience value/string/integer getter to libvici 2014-05-07 14:13:35 +02:00
Martin Willi db18495514 vici: Add some convenience getters on message 2014-05-07 14:13:35 +02:00
Martin Willi b40a12a96f vici: Raise events with an optional identifier for specific connections 2014-05-07 14:13:35 +02:00
Martin Willi 293431269b vici: Invoke dispatcher outside of connection log, allowing events from commands 2014-05-07 14:13:35 +02:00
Martin Willi 252025210f vici: Add a query class, currently implementing a list-sas command 2014-05-07 14:13:35 +02:00
Martin Willi eb4fd014b8 vici: Add a libvici low-level client library 2014-05-07 14:13:35 +02:00
Martin Willi 8383d626b9 vici: Provide a command dispatcher handling request and event registration 2014-05-07 14:13:34 +02:00
Martin Willi 8457da7528 vici: Add a fully asynchronous IPC socket segmenting messages on/from stream 2014-05-07 14:13:34 +02:00
Martin Willi 1e39454214 vici: Add a test runner for plugin 2014-05-07 14:13:34 +02:00
Martin Willi 6770cfe34a vici: Add a plugin stub for the "Versatile IKE Control Interface" plugin 2014-05-07 14:13:34 +02:00
Christophe Gouault 7b08063e70 load-tester: Fix race condition issuing same SPI 
Due to an unprotected incrementation, two load-tester initiators occasionally
use the same SPI under high load, and hence generate 2 IPsec SAs with the same
identifier. The responder IPsec stack will refuse to configure the second SA.

Use an atomic incrementation to avoid this race condition.

Signed-off-by: Christophe Gouault <[email protected]>
 2014-04-24 17:54:15 +02:00
Christophe Gouault 2cbaa63295 load-tester: Fix race condition issuing same identity 
Due to an unprotected incrementation, two load-tester initiators occasionally
use the same identifier under high load. The responder typically drops one of
the connections.

Use an atomic incrementation to avoid this race condition.

Signed-off-by: Christophe Gouault <[email protected]>
 2014-04-24 17:54:15 +02:00
Martin Willi 713a1122b4 ikev2: Add inherit_pre() to apply config and hosts before IKE_SA rekeying 2014-04-17 09:24:51 +02:00
Tobias Brunner abd7d3be9c eap-mschapv2: Fix potential leaks in case of invalid messages from servers 2014-04-09 18:27:02 +02:00
Tobias Brunner a04ef18bda stroke: Fix memory leak when printing unknown AC group OIDs 2014-04-09 16:06:17 +02:00
Martin Willi e15f64cc81 tls: Support a maximum TLS version to negotiate using TLS socket abstraction 2014-04-01 14:28:55 +02:00
Martin Willi 5313880261 tls: Support a null encryption flag on TLS socket abstraction 2014-04-01 14:28:55 +02:00
Tobias Brunner 3b09c02ec0 Properly hash pointers for hash tables where appropriate 
Simply using the pointer is not optimal for our hash table
implementation, which simply masks the key to determine the bucket.
 2014-03-31 14:32:44 +02:00
Tobias Brunner 00b91c4325 eap-radius: Add option to not close IKE_SAs on timeouts during interim accouting updates 
Fixes #528.
 2014-03-31 14:32:44 +02:00
Martin Willi 61b2d815b9 x509: Replace fixed acert group string getter by a more dynamic group enumerator 2014-03-31 11:14:58 +02:00
Tobias Brunner fc4f8fc30e tnc-pdp: Fix monolithic build 2014-03-20 15:29:27 +01:00
Tobias Brunner 67dc5d393c tnc-ifmap: Get a reference to the client cert as it is also used in an auth config 2014-03-10 14:31:42 +01:00
Tobias Brunner 849e401b37 stroke: Use thread-safe dirname(3) 2014-02-24 12:04:11 +01:00
Tobias Brunner aa693d763a stroke: Use dirname(3) correctly 2014-02-24 12:04:10 +01:00
Tobias Brunner 5a04056295 stroke: Use proper modifiers to print size_t arguments 2014-02-18 16:46:25 +01:00
Tobias Brunner 7867ae42ab lookip: Properly return from disconnect callback job 
References #518.
 2014-02-18 11:21:51 +01:00
Martin Willi 961409b668 lookip: Disconnect asynchronously to avoid dead-locking watcher unregistration 
While it really would be desirable to allow stream destruction during on_read()
callbacks, this does not work anymore since e49b2998. Until we have a proper
solution for this issue, use asynchronous disconnects for the only user doing
so.

Fixes #518.
 2014-02-17 09:48:55 +01:00
Tobias Brunner d223fe807a libcharon: Use lib->ns instead of charon->name 2014-02-12 14:34:32 +01:00
Tobias Brunner d347a130f5 libhydra: Use lib->ns instead of hydra->daemon 2014-02-12 14:34:32 +01:00
Tobias Brunner 6e288ed19c pool: Install SQL schemas from src/pool 
This allows us to install the schemas if either the attr-sql or sql
plugin is enabled, since both use the same schema (at least in parts).
 2014-02-12 14:21:26 +01:00
Tobias Brunner b2cd0870a3 sql: Set default values for some fields in addresses table 2014-02-12 14:08:34 +01:00
Tobias Brunner 9ca9d99bc4 sql: Install SQL schemas in /usr/share/strongswan/templates/database 2014-02-12 14:08:34 +01:00
Tobias Brunner 68539c38e2 sql: Remove unused cred.sql snippet 2014-02-12 14:08:34 +01:00
Martin Willi ac2dc3b726 updown: Return an empty DNS server enumerator if no IKE_SA available 
The one existing caller does not handle a NULL return and always expects
an enumerator; and returning FALSE does not make sense anyway.
 2014-02-06 16:38:39 +01:00
Andrea Bonomi 2312504d1e xauth-pam: Open/close a PAM session for each connected client 
Signed-off-by: Andrea Bonomi <[email protected]>
 2014-01-23 16:07:04 +01:00
Martin Willi 7dc8bf495b xauth-pam: Sanitize XAuth attributes before passing them to PAM 2014-01-23 16:07:04 +01:00
Martin Willi ecdef634aa stroke: Use chunk_map() instead of non-portable mmap() 2014-01-23 15:55:32 +01:00
Martin Willi b8d0103e31 radattr: Use chunk_map() instead of non-portable mmap() 2014-01-23 15:55:32 +01:00
Martin Willi b9ee059ca9 chunk: Externalize error reporting in chunk_write() 
This avoids passing that arbitrary label just for error messages, and gives
greater flexibility in handling errors.
 2014-01-23 15:55:32 +01:00
Tobias Brunner 21c18f536d unity: Send all traffic selectors in a single UNITY_SPLIT_INCLUDE attribute 
Cisco clients only handle the first such attribute.
 2014-01-23 10:35:21 +01:00
Tobias Brunner f8262aa1a6 unity: Change local TS to 0.0.0.0/0 as responder 
Cisco clients and Shrew expect a remote TS of 0.0.0.0/0 if Unity is
used, otherwise Quick Mode fails.
 2014-01-23 10:35:21 +01:00
Tobias Brunner 685579d6d8 unity: Send UNITY_SPLIT_INCLUDE attributes with proper padding 
The additional 6 bytes are not actually padding but are parsed by the
Cisco client as protocol and src and dst ports (each two bytes but
strangely only the first two in network order).
 2014-01-23 10:35:21 +01:00
Tobias Brunner 7e3bbcf77a updown: Increase buffer size for script and environment variables 2014-01-23 10:27:12 +01:00
Tobias Brunner cf4a7395aa updown: Add PLUTO_IPCOMP to indicate if IPComp was negotiated 2014-01-23 10:27:12 +01:00
Tobias Brunner f44b1eb444 stroke: Ensure the buffer of strings in a stroke_msg_t is null-terminated 
Otherwise a malicious user could send an unterminated string to cause
unterminated reads.
 2014-01-23 10:15:07 +01:00
Tobias Brunner 5ab03863b0 stroke: Add an option to prevent log level changes via stroke socket 2014-01-23 10:15:07 +01:00