denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
9,908 Commits 1 Branch 0 Tags
3f6e13f55327404ee354bb5dd43e6ba55864cf24
Commit Graph
1983 Commits
Author SHA1 Message Date
Martin Willi 3f6e13f553 Load a multiple load-tester CA certificates from a directory 2012-10-16 13:43:54 +02:00
Martin Willi 24eb73b4fa Added load-tester options to read issuing CA certificate and key from files 2012-10-16 13:43:53 +02:00
Tobias Brunner 418dcf3aae Fixed compilation of android_handler_t 2012-10-11 11:12:52 +02:00
Martin Willi 82f3549fe2 Fix leak of PINs from ipsec.secrets 2012-10-09 11:54:00 +02:00
Andreas Steffen 41d344e8ea allow has_noskip_flag to contain TRUE_OR_FALSE 2012-10-07 16:26:02 +02:00
Andreas Steffen cd198f48f2 test first and up in the outer while loop 2012-10-07 12:46:19 +02:00
Tobias Brunner 48651d8d02 Ensure UNSUPPORTED_CRITICAL_PAYLOAD notify contains correct payload type 2012-09-28 22:31:06 +02:00
Tobias Brunner 2a43350334 Missed one in 6c10cece 2012-09-28 20:55:40 +02:00
Tobias Brunner 3973ffa4f6 Request is never NULL when responding with an INFORMATIONAL message 2012-09-28 19:10:03 +02:00
Tobias Brunner 6c10cecebf Completed state handling in isakmp_cert_pre 
Should not be a problem, but makes static analyzers happy.
 2012-09-28 19:01:09 +02:00
Tobias Brunner a13c6a900e Added missing continue statement in ha socket error handling 2012-09-28 18:52:43 +02:00
Tobias Brunner 0273245877 Fixed snprintf check in tnc-ifmap plugin 2012-09-28 18:49:16 +02:00
Tobias Brunner 911e3156a0 Use %x to print uint32 as long ints are 64-bit long on x64 Linux 2012-09-28 18:09:08 +02:00
Tobias Brunner a05f3b2021 Make sure first argument is an int when using %.*s to print e.g. chunks 2012-09-28 18:01:49 +02:00
Tobias Brunner 4bc24ba794 Avoid memory leak when sending RADIUS accounting start message failed 2012-09-28 17:43:02 +02:00
Tobias Brunner f3d98a6b78 Correctly initialize payload length of encrypted payload 2012-09-28 16:30:26 +02:00
Tobias Brunner 9f22002706 The eap argument of send_response is never NULL 2012-09-28 16:28:54 +02:00
Tobias Brunner 9d5b688a11 Properly initialize sockaddr_in struct in fast and dhcp plugins 2012-09-28 16:28:46 +02:00
Tobias Brunner 45178362c8 Clarified error message if enabling UDP decapsulation fails 2012-09-27 10:49:17 +02:00
Tobias Brunner 2d39f79b9b IKE_AUTH_LIFETIME task is not defined if IKEv2 is disabled 
Fixes #229.
 2012-09-25 09:31:47 +02:00
Tobias Brunner 2e2feffb67 Don't check interface of inbound message if interfaces are not filtered 
We don't have a proper kernel-net interface on Android yet, so the check
for a usable interface does not work there.
 2012-09-24 17:12:18 +02:00
Tobias Brunner 4106aea8e4 Made IP address enumeration more flexible 
Also added an option to enumerate addresses on ignored interfaces.
 2012-09-21 18:16:26 +02:00
Tobias Brunner 090c556ce8 Drop packets received on ignored interfaces 2012-09-21 18:16:26 +02:00
Tobias Brunner 9ba36c0f7f Make it easy to check if an address is locally usable via changed get_interface() method 2012-09-21 18:16:26 +02:00
Tobias Brunner aed33805ce Don't ignore loopback devices and allow addresses on them being enumerated 2012-09-21 18:16:26 +02:00
Tobias Brunner 6676769e8c Make sure we propose a dynamic TS if we don't have hosts to derive a TS from 
7ee37114 removed this behavior.
 2012-09-21 18:14:17 +02:00
Martin Willi 77c37ea5e0 As Unity responder, don't change the proposed TS at all, racoon doesn't like that 2012-09-18 17:17:48 +02:00
Martin Willi 336dd7a9c7 Don't complain about multiple TS in IKEv1, as it supported with Unity 2012-09-18 17:17:48 +02:00
Martin Willi 7a7deec283 As initiator, narrow received Unity attributes to configured TS 2012-09-18 17:17:48 +02:00
Martin Willi b8db3775f3 When using Unity, bump up remote TS as initiator to 0.0.0.0/0, too 2012-09-18 17:17:48 +02:00
Martin Willi 284ed1b352 Enable Cisco Unity only if Unity vendor id received 2012-09-18 17:17:48 +02:00
Martin Willi 6e60807637 Exchange 0.0.0.0/0 traffic selectors with Unity, narrowing after exchange 2012-09-18 17:17:48 +02:00
Martin Willi f2463f1bd6 Add a Unity attribute provider that adds Split-Includes for TS 2012-09-18 17:17:47 +02:00
Martin Willi e39e697429 Check if subset calculation actually yields a TS in Unity narrowing 2012-09-18 17:17:47 +02:00
Martin Willi 92b5066705 Request Unity configuration attributes for IKEv1 only 2012-09-18 17:17:47 +02:00
Martin Willi 5ff012f717 Add Cisco Unity client support for Split-Include and Local-LAN 2012-09-18 17:17:47 +02:00
Martin Willi 7ee37114c9 Derive a dynamic TS to multiple virtual IPs 2012-09-18 17:11:03 +02:00
Martin Willi abdb82fcc5 Use the vararg list constructor in quick mode task 2012-09-18 17:11:03 +02:00
Tobias Brunner 8c19323c37 Make stroke user-creds work with XAuth configs 2012-09-18 16:56:17 +02:00
Tobias Brunner b7a500e985 Set AUTH_RULE_IDENTITY_LOOSE for rightid=%<identity> 2012-09-18 14:40:41 +02:00
Tobias Brunner 3a8852c76f Add AUTH_RULE_IDENTITY_LOOSE which allows to use IDr loosely as initiator 
If it is set on an auth config IDr will not be sent, and later the configured
identity will not only be checked against the returned IDr, but also
against other identities contained in the responder's certificate.
 2012-09-18 11:16:10 +02:00
Tobias Brunner 6d30954ae8 Removed the unneeded socket-raw plugin 2012-09-14 14:10:14 +02:00
Tobias Brunner a889cfe5e1 Change traffic selectors during Quick Mode in case of a NAT in transport mode 
Windows 7 sends its internal address as TSi.  While we don't support the
NAT-T drafts as used by Windows XP it is interesting to note that the
client there omits the TSi payload which then would automatically get set
to the public IP address of the client.

Fixes #220.
 2012-09-14 09:40:18 +02:00
Tobias Brunner 4c57c63062 Added possibility to register custom proposal keywords 
Keyword lookup and registration are handled via the new lib->proposal object.
 2012-09-13 15:44:46 +02:00
Tobias Brunner 995875210a Removed len argument from proposal_get_token() 
Also use enumerators instead of lexparser.h to parse proposal strings.
 2012-09-13 15:44:01 +02:00
Tobias Brunner bc6ec4de73 Option added to enforce a configured destination address for DHCP packets 2012-09-13 10:59:24 +02:00
Tobias Brunner 455accc687 Ensure traffic selectors are dynamic before calling set_address() when deriving them 2012-09-12 18:13:47 +02:00
Martin Willi d4cca1beea Always send a configuration payload in IKEv1 TRANSACTIONs, even if it is empty 2012-09-11 17:20:17 +02:00
Martin Willi c4acf37502 Don't use host address for dynamic TS in IKEv1 if a virtual IP was expected 2012-09-11 16:18:29 +02:00
Martin Willi 7d82aaea8d Don't use host address for dynamic TS in IKEv2 if a virtual IP was expected 2012-09-11 16:18:28 +02:00