denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
9,951 Commits 1 Branch 0 Tags
21037942e83c6493e2e5565460fc841babe1daab
Commit Graph
1993 Commits
Author SHA1 Message Date
Tobias Brunner 21037942e8 Update routed connections in trap manager 
Before this change, modified configs that have been updated with ipsec reload,
could properly be started manually, but the old config would get used if
triggered via trap policies.
 2012-10-18 14:42:10 +02:00
Tobias Brunner 3555bacac7 Reload logger configuration on SIGHUP 
Besides changing the configuration this allows to easily rotate log files.

Also moved logger initialization back to daemon_t.
 2012-10-18 14:42:10 +02:00
Tobias Brunner d35d669180 Make syslog and file loggers configurable at runtime 2012-10-18 14:42:10 +02:00
Tobias Brunner 292d8f41c3 Resolve hosts by DNS name in separate threads so we can cancel them 
getaddrinfo(3) may block a long time so proper termination of the daemon may
block if DNS servers are not reachable.

getaddrinfo(3) is an optional cancellation point in posix threads so it
might still block a shutdown but at least on Android (with the signal based
pthread_cancel implementation) it works, on Linux starter will kill charon
anyway after a while.
 2012-10-18 10:57:55 +02:00
Tobias Brunner 1d6dc62727 Added a new alert that is raised if peer does not respond to initial IKE message 2012-10-16 14:16:17 +02:00
Martin Willi a70851c941 Remove unused this parameter to load_issuer_cert/key(), as it is uninitialized 2012-10-16 14:11:14 +02:00
Martin Willi c1024a6bd6 Generate a load-tester certificate only for DN or subjectAltName identities 2012-10-16 13:43:54 +02:00
Martin Willi db97d67825 Add a load-tester initiator_match option to match custom initiator_id 2012-10-16 13:43:54 +02:00
Martin Willi 5359c7a437 Encode non-DN load-tester identities as subjectAltNames 2012-10-16 13:43:54 +02:00
Martin Willi 562b89ccee Add a load-tester digest option for issuing peer certificates 2012-10-16 13:43:54 +02:00
Martin Willi 3f6e13f553 Load a multiple load-tester CA certificates from a directory 2012-10-16 13:43:54 +02:00
Martin Willi 24eb73b4fa Added load-tester options to read issuing CA certificate and key from files 2012-10-16 13:43:53 +02:00
Tobias Brunner 418dcf3aae Fixed compilation of android_handler_t 2012-10-11 11:12:52 +02:00
Martin Willi 82f3549fe2 Fix leak of PINs from ipsec.secrets 2012-10-09 11:54:00 +02:00
Andreas Steffen 41d344e8ea allow has_noskip_flag to contain TRUE_OR_FALSE 2012-10-07 16:26:02 +02:00
Andreas Steffen cd198f48f2 test first and up in the outer while loop 2012-10-07 12:46:19 +02:00
Tobias Brunner 48651d8d02 Ensure UNSUPPORTED_CRITICAL_PAYLOAD notify contains correct payload type 2012-09-28 22:31:06 +02:00
Tobias Brunner 2a43350334 Missed one in 6c10cece 2012-09-28 20:55:40 +02:00
Tobias Brunner 3973ffa4f6 Request is never NULL when responding with an INFORMATIONAL message 2012-09-28 19:10:03 +02:00
Tobias Brunner 6c10cecebf Completed state handling in isakmp_cert_pre 
Should not be a problem, but makes static analyzers happy.
 2012-09-28 19:01:09 +02:00
Tobias Brunner a13c6a900e Added missing continue statement in ha socket error handling 2012-09-28 18:52:43 +02:00
Tobias Brunner 0273245877 Fixed snprintf check in tnc-ifmap plugin 2012-09-28 18:49:16 +02:00
Tobias Brunner 911e3156a0 Use %x to print uint32 as long ints are 64-bit long on x64 Linux 2012-09-28 18:09:08 +02:00
Tobias Brunner a05f3b2021 Make sure first argument is an int when using %.*s to print e.g. chunks 2012-09-28 18:01:49 +02:00
Tobias Brunner 4bc24ba794 Avoid memory leak when sending RADIUS accounting start message failed 2012-09-28 17:43:02 +02:00
Tobias Brunner f3d98a6b78 Correctly initialize payload length of encrypted payload 2012-09-28 16:30:26 +02:00
Tobias Brunner 9f22002706 The eap argument of send_response is never NULL 2012-09-28 16:28:54 +02:00
Tobias Brunner 9d5b688a11 Properly initialize sockaddr_in struct in fast and dhcp plugins 2012-09-28 16:28:46 +02:00
Tobias Brunner 45178362c8 Clarified error message if enabling UDP decapsulation fails 2012-09-27 10:49:17 +02:00
Tobias Brunner 2d39f79b9b IKE_AUTH_LIFETIME task is not defined if IKEv2 is disabled 
Fixes #229.
 2012-09-25 09:31:47 +02:00
Tobias Brunner 2e2feffb67 Don't check interface of inbound message if interfaces are not filtered 
We don't have a proper kernel-net interface on Android yet, so the check
for a usable interface does not work there.
 2012-09-24 17:12:18 +02:00
Tobias Brunner 4106aea8e4 Made IP address enumeration more flexible 
Also added an option to enumerate addresses on ignored interfaces.
 2012-09-21 18:16:26 +02:00
Tobias Brunner 090c556ce8 Drop packets received on ignored interfaces 2012-09-21 18:16:26 +02:00
Tobias Brunner 9ba36c0f7f Make it easy to check if an address is locally usable via changed get_interface() method 2012-09-21 18:16:26 +02:00
Tobias Brunner aed33805ce Don't ignore loopback devices and allow addresses on them being enumerated 2012-09-21 18:16:26 +02:00
Tobias Brunner 6676769e8c Make sure we propose a dynamic TS if we don't have hosts to derive a TS from 
7ee37114 removed this behavior.
 2012-09-21 18:14:17 +02:00
Martin Willi 77c37ea5e0 As Unity responder, don't change the proposed TS at all, racoon doesn't like that 2012-09-18 17:17:48 +02:00
Martin Willi 336dd7a9c7 Don't complain about multiple TS in IKEv1, as it supported with Unity 2012-09-18 17:17:48 +02:00
Martin Willi 7a7deec283 As initiator, narrow received Unity attributes to configured TS 2012-09-18 17:17:48 +02:00
Martin Willi b8db3775f3 When using Unity, bump up remote TS as initiator to 0.0.0.0/0, too 2012-09-18 17:17:48 +02:00
Martin Willi 284ed1b352 Enable Cisco Unity only if Unity vendor id received 2012-09-18 17:17:48 +02:00
Martin Willi 6e60807637 Exchange 0.0.0.0/0 traffic selectors with Unity, narrowing after exchange 2012-09-18 17:17:48 +02:00
Martin Willi f2463f1bd6 Add a Unity attribute provider that adds Split-Includes for TS 2012-09-18 17:17:47 +02:00
Martin Willi e39e697429 Check if subset calculation actually yields a TS in Unity narrowing 2012-09-18 17:17:47 +02:00
Martin Willi 92b5066705 Request Unity configuration attributes for IKEv1 only 2012-09-18 17:17:47 +02:00
Martin Willi 5ff012f717 Add Cisco Unity client support for Split-Include and Local-LAN 2012-09-18 17:17:47 +02:00
Martin Willi 7ee37114c9 Derive a dynamic TS to multiple virtual IPs 2012-09-18 17:11:03 +02:00
Martin Willi abdb82fcc5 Use the vararg list constructor in quick mode task 2012-09-18 17:11:03 +02:00
Tobias Brunner 8c19323c37 Make stroke user-creds work with XAuth configs 2012-09-18 16:56:17 +02:00
Tobias Brunner b7a500e985 Set AUTH_RULE_IDENTITY_LOOSE for rightid=%<identity> 2012-09-18 14:40:41 +02:00