denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
9,855 Commits 1 Branch 0 Tags
4bc24ba794102ab4843ab80396e983bb22e6c4d9
Commit Graph
1969 Commits
Author SHA1 Message Date
Tobias Brunner d2e8f20d94 Clear virtual IPs before storing assigned ones on the IKE_SA 
Otherwise we'll end up with duplicate or invalid VIPs stored on the
IKE_SA.
 2012-09-05 14:35:57 +02:00
Martin Willi 4c892fe533 In mode_config, destroy temporary pool list instead of the virtual IP list twice 2012-09-05 14:18:52 +02:00
Martin Willi 1323dc1138 Merge branch 'multi-vip' 
Brings support for multiple virtual IPs and multiple pools in
left/rigthsourceip definitions. Also introduces the new left/rightdns
options to configure requested DNS server address family and respond
with multiple connection specific servers.
 2012-08-31 12:55:56 +02:00
Tobias Brunner 868409139b Merge branch 'eap-client-select' 
This brings support for EAP-Nak payloads on the client (to select a
specific or supported method), and the server (via the eap-dynamic
plugin which selects a method supported/requested by the client).
 2012-08-31 12:25:41 +02:00
Tobias Brunner 7f2e3091ee Log the proper type for virtual EAP methods 2012-08-31 11:42:03 +02:00
Tobias Brunner 333c3b6228 Added an option to prefer types sent by peer in eap-dynamic plugin 2012-08-31 11:42:03 +02:00
Tobias Brunner 3dde55e67b eap-dynamic plugin handles EAP-Nak messages and selects a method supported by the peer 2012-08-31 11:42:03 +02:00
Tobias Brunner a2f1d75eae Preferred EAP methods for eap-dynamic can be configured 2012-08-31 11:42:03 +02:00
Tobias Brunner a2a61ec2e2 The eap-dynamic plugin uses the first supported method as default 2012-08-31 11:42:03 +02:00
Tobias Brunner 700ff5def9 Added eap-dynamic plugin which can proxy any other EAP method 2012-08-31 11:42:01 +02:00
Tobias Brunner 7240914955 Use eap_vendor_type_from_string() in stroke 2012-08-31 11:40:28 +02:00
Tobias Brunner 576490ab09 Added method to enumerate EAP types contained in an EAP-Nak 2012-08-31 11:40:28 +02:00
Tobias Brunner cc4eec56f7 Encode EAP-Naks in expanded format if we got an expanded type request 
Since methods defined by the IETF (vendor ID 0) could also be encoded in
expanded type format the previous check was insufficient.
 2012-08-31 11:40:27 +02:00
Tobias Brunner 78e8dca94f Allow clients to request a configured EAP method via EAP-Nak 2012-08-31 11:40:27 +02:00
Tobias Brunner 34742f1bf8 Virtual EAP methods handle EAP-Naks themselves 2012-08-31 11:40:27 +02:00
Tobias Brunner af04233e14 Send EAP-Nak with supported types if requested type is unsupported 2012-08-31 11:40:27 +02:00
Tobias Brunner 7cad171da8 Filter invalid EAP authentication types when enumerating them 
Valid authentication types defined by the IETF are 4-253 and 255.
 2012-08-31 11:37:45 +02:00
Martin Willi 980c468cdc DHCP plugin returns virtual IPs for IPv4 requests only 2012-08-30 16:43:44 +02:00
Martin Willi 769446a8c7 Check address family in HA virtual IP backend 2012-08-30 16:43:44 +02:00
Martin Willi 7b83cc62e0 Handle comma separated pools as multiple pool names in SQL plugin 2012-08-30 16:43:43 +02:00
Martin Willi b5d2bf975b Request and acquire multiple virtual IPs in IKEv1 Mode Config 2012-08-30 16:43:43 +02:00
Martin Willi 61d6ccf51c Request and acquire multiple virtual IPs in IKEv2 configuration payload 2012-08-30 16:43:43 +02:00
Martin Willi d55fe264d1 Pass all configured pool names to attribute provider enumerator 2012-08-30 16:43:43 +02:00
Martin Willi feb8550401 Pass a list instead of a single virtual IP to attribute enumerators 2012-08-30 16:43:42 +02:00
Martin Willi 96c2b3cf89 Support multiple addresses/pools in left/rightsourceip 2012-08-30 16:43:42 +02:00
Martin Willi 497ce2cf51 Support multiple address pools configured on a peer_cfg 2012-08-30 16:43:42 +02:00
Martin Willi 101d26babe Support multiple virtual IPs on peer_cfg and ike_sa classes 2012-08-30 16:43:42 +02:00
Tobias Brunner a21fac9a85 Log configured IKE_SA proposals as initiator 2012-08-24 13:43:14 +02:00
Tobias Brunner d2b4dff5dd Log configured CHILD_SA proposals as initiator 2012-08-24 13:43:14 +02:00
Tobias Brunner 1184493407 Fall back to local address as IKEv1 identity if nothing else is configured 2012-08-24 12:55:01 +02:00
Tobias Brunner 20915d6fa7 Apply send delay before adding non-ESP marker 
Otherwise the packet header could not be parsed correctly when NAT-T is
used.
 2012-08-24 11:23:36 +02:00
Andreas Steffen 014d007000 use pen_type_t for PA Message Subtype 2012-08-23 10:49:00 +02:00
Tobias Brunner 078755d099 Added a method to enumerate registered EAP methods 2012-08-21 16:48:47 +02:00
Martin Willi e0d3014a17 Add a DNS attribute handler to updown, passing servers to updown script 2012-08-21 09:38:01 +02:00
Martin Willi 63e460542c Add a stroke attribute_handler requesting DNS servers given with leftdns 2012-08-21 09:38:01 +02:00
Martin Willi 9937ca069a Serve ipsec.conf rightdns servers through stroke attribute provider 2012-08-21 09:38:01 +02:00
Martin Willi 17319aa28d Add a left/rightdns keyword to configure connection specific DNS attributes 2012-08-21 09:38:00 +02:00
Martin Willi f26796deb5 Remove unused src/dst variables in send_no_marker() 2012-08-21 09:34:32 +02:00
Martin Willi 10bdc7a968 Remove the unused second IKE_SA entry match function argument 
LLVMs clang complains about this parameter, so remove it.
 2012-08-20 17:42:14 +02:00
Adrian-Ken Rueegsegger acf27437cd Add keymat_t constructor registration function 
Using the register_constructor function enables custom keymat_t
implementations per IKE version. If no constructor is registered the
default behavior is preserved.
 2012-08-20 13:02:47 +02:00
Tobias Brunner ba27bf2af0 CAP_AUDIT_WRITE is now required by xauth-pam not eap-gtc plugin 2012-08-17 14:24:48 +02:00
Tobias Brunner 113d2a6b99 Removed manual EAP method registration in eap-gtc plugin 2012-08-17 14:24:37 +02:00
Tobias Brunner 91c0e0e3d9 Enable build of eap-tls, eap-ttls and eap-peap on Android 2012-08-17 13:55:44 +02:00
Tobias Brunner aaefeafb49 Enable UDP decapsulation for both address families 
Since the 3.5 Linux kernel both UDP implementations have a separate static
flag to indicate whether ANY sockets enabled UDP decapsulation.
As we only ever enabled it for one address family (in earlier versions IPv4
only, now for IPv6, if supported, and for IPv4 otherwise) UDP decapsulation
wouldn't work anymore (at least for one address family).
 2012-08-16 15:26:37 +02:00
Tobias Brunner 11b514bff6 Correctly transmit EAP-MSCHAPv2 user name if it contains a domain part 2012-08-16 10:03:49 +02:00
Tobias Brunner 09ae3d79ca Merge branch 'android-app' 
This branch introduces a userland IPsec implementation (libipsec) and an
Android App which targets the VpnService API that is provided by Android 4+.

The implementation is based on the bachelor thesis 'Userland IPsec for
Android 4' by Giuliano Grassi and Ralf Sager.
 2012-08-13 12:07:52 +02:00
Tobias Brunner e4ef4c9877 Merge branch 'android-ndk' 
This branch comes with some preliminary changes for the user-land IPsec
implementation and the Android App.

One important change is that the UDP ports used by the socket-default plugin
were made configurable (either via ./configure or strongswan.conf).
Also, the plugin does randomly allocate a port if it is configured to 0,
which is useful for client implementations.  A consequence of these
changes is that the local UDP port used when creating ike_cfg_t objects has
to be fetched from the socket.
 2012-08-13 10:45:39 +02:00
Tobias Brunner 000668d308 Doxygen fix 2012-08-11 16:50:22 +02:00
Martin Willi cd55a3cb77 Use actual daemon name to enable XAuth/PSK with aggressive mode 2012-08-10 11:53:18 +02:00
Martin Willi 27128c1e32 EAP-GTC can use any XAuth backend, including xauth-pam 
This makes EAP-GTC a generic plain password authentication method,
as it is used with XAuth. Instead of verifying credentials with
PAM, any backend can be configured. The default is xauth-pam,
providing the same functionality as EAP-GTC in strongSwan 4.x.
 2012-08-10 10:43:44 +02:00