denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
18,298 Commits 1 Branch 0 Tags
4e5a2037e7b48eed1fd012bfb60ab09cc0fb235c
Commit Graph
18298 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Martin Willi cde6a9ec9f Refactored IKEv2 cert/certreq payload processing to multiple functions 2013-01-11 10:21:56 +01:00
Martin Willi bf10ee9495 Refactored IKEv1 cert payload processing to multiple functions 2013-01-11 10:21:56 +01:00
Volker Rümelin 6d3e7a64a0 IKEv1 support for PKCS#7 wrapped certificates 2013-01-11 10:21:56 +01:00
Volker Rümelin 10eee5fcba Fixed some typos in comments 2013-01-11 10:21:51 +01:00
Pavel Kopchyk 3365bddccf Fixed some typos in Ukrainian translation 2013-01-09 05:30:55 +01:00
Thomas Klute 13c177852f conftest: Add support for time_format and ike_name options in log sections 
Both options are well supported for normal operation but were completely
ignored by conftest, which used hard coded defaults. File options are
still missing but could be added in a similar way.
 2013-01-08 11:12:44 +01:00
Thomas Klute b78698f755 conftest: Fix log level settings for stdout 
This patch fixes bug #272 ("conftest ignores log settings for stdout").
http://wiki.strongswan.org/issues/272

According to the documentation of add_logger in src/libcharon/bus/bus.h,
the relevant log levels of a logger are registered with the logging
subsystem when adding the logger. If the log levels change later, the
logger must be re-added to propagate the new settings. In conftest.c,
the stdout logger is initialized and added before reading the logging
settings, but wasn't re-added after reading the settings.
 2013-01-08 11:12:10 +01:00
Thomas Klute 4e51cf895e conftest: Make outgoing sequence number set by reset_seq configurable 
This is useful for certain test cases. Passing the sequence number to
the callback requires a new struct that contains both the number and the
xfrm_usersa_id. The new configuration parameter is called oseq in
accordance with the kernel name, see the comment in the reset_cb
callback function for details.
 2013-01-08 11:10:13 +01:00
Martin Willi ff318ad3e1 Include opensslconf.h before checking its defines 2013-01-03 11:12:05 +01:00
Martin Willi 2b9e597b54 Don't build OpenSSL PKCS#7 code if OPENSSL_NO_CMS defined 2013-01-03 11:05:49 +01:00
Andreas Steffen 1c65b6c305 make pacman.sh run under cron 2012-12-26 09:28:17 +01:00
Tobias Brunner 97973f8609 Use a connection specific option to en-/disable IKEv1 fragmentation 2012-12-24 13:00:01 +01:00
Tobias Brunner e645c15b9c Include source port in init hash for fragmented messages 2012-12-24 12:29:31 +01:00
Tobias Brunner 2f62bb1549 Add an option to en-/disable IKE fragmentation 
Fragments are always accepted but will not be sent if disabled.  The
vendor ID is only sent if the option is enabled.
 2012-12-24 12:29:31 +01:00
Tobias Brunner 5cafefcd5d Split larger messages into fragments if IKE fragmentation is supported by peer 2012-12-24 12:29:31 +01:00
Tobias Brunner c849305ad7 Log message size for in- and outbound IKE messages 2012-12-24 12:29:30 +01:00
Tobias Brunner 07df944c9c Add support to create IKE fragments 
All fragments currently use the same fragment ID (1) as that's what
other implementations are doing.
 2012-12-24 12:29:30 +01:00
Tobias Brunner c4daac2c0b Log added NAT-T vendor IDs 2012-12-24 12:29:27 +01:00
Tobias Brunner 667720c801 Detect a peer's support for IKE fragmentation 
Fragments are accepted even if this vendor ID is not seen.
 2012-12-24 12:29:27 +01:00
Tobias Brunner fe26ddada9 Map fragmented initial initial Main or Aggressive Mode messages to the same IKE_SA 2012-12-24 12:29:27 +01:00
Tobias Brunner b816037739 Allow ID_PROT/AGGRESSIVE messages for established IKE_SAs if they contain fragments 
Other implementations send fragments always in an initial message type
even for transaction or quick mode exchanges.
 2012-12-24 12:29:27 +01:00
Tobias Brunner 8fc8383439 Don't handle fragmented messages larger than charon.max_packet 2012-12-24 12:29:27 +01:00
Tobias Brunner 7d85f94165 Don't update an IKE_SA-entry's cached message ID when handling fragments 2012-12-24 12:29:26 +01:00
Tobias Brunner 30216000d3 Store inbound IKE fragments and reassemble the message when all fragments are received 2012-12-24 12:29:26 +01:00
Andreas Steffen 6be6a52405 deleted newly constructed attributes in send_assessment 2012-12-24 12:06:12 +01:00
Dmitry Korzhevin a0117b9122 Added Russian and Ukrainian strings for Android client 2012-12-24 12:06:12 +01:00
Tobias Brunner 9b1659f52c Add message rules to properly handle IKE fragments 
These are sent in unencrypted messages and are the only payload
contained in such messages.
 2012-12-24 10:24:48 +01:00
Tobias Brunner ddfad8b67e Reset the encrypted flag when handling IKE messages that contain a fragment 
Racoon sets the encrypted bit for messages containing a fragment, but these
messages are not really encrypted (the fragmented message is though).
 2012-12-24 10:24:48 +01:00
Tobias Brunner 8f0ab6dd36 Payload added to handle IKE fragments 2012-12-24 10:24:48 +01:00
Martin Willi 656e01eab3 Add parantheses to avoid compiler warning 2012-12-24 10:12:23 +01:00
Andreas Steffen 9787b9f2e0 Send empty CDATA batch if TNC client has no data to send 2012-12-23 22:16:30 +01:00
Tobias Brunner ef33a4ab82 Fixed some typos, courtesy of codespell 2012-12-20 09:35:26 +01:00
Adrian-Ken Rueegsegger ba8b28b67f Raise an alert if IKE SA is kept 
This alert is raised when the establishment of a child SA fails but the
IKE SA is kept.
 2012-12-20 09:15:07 +01:00
Reto Buerki a7409773e6 stroke: Drop unneeded [MY|OTHER]_NETBITS 2012-12-19 11:24:02 +01:00
Reto Buerki 31944a4366 stroke: Enable install_policy in add_connection() 2012-12-19 11:23:52 +01:00
Volker Rümelin 0ff8d20a89 Add support for draft-ietf-ipsec-nat-t-ike-03 and earlier 
This adds support for early versions of the draft that eventually
resulted in RFC 3947.
 2012-12-19 11:03:42 +01:00
Martin Willi ecdd5aedac NEWS about error-notify 2012-12-19 10:43:35 +01:00
Martin Willi 32c3ac95e4 Add missing error_notify_msg.h to distribution tarball 2012-12-19 10:40:33 +01:00
Martin Willi 3044085006 Add an error-notify sample application to listen to error notifications 2012-12-19 10:40:33 +01:00
Martin Willi 0aaf5ccfa6 Add an error-notify plugin to send catched alerts to listening applications 2012-12-19 10:40:33 +01:00
Martin Willi 578f72ceb0 Raise an alert if half-open timeout limit reached 2012-12-19 10:40:33 +01:00
Martin Willi c57fe7ac6f Raise an alert if an authorize() hook fails 2012-12-19 10:40:33 +01:00
Martin Willi 45d6134218 Raise an alert if allocating virtual IPs fails 2012-12-19 10:40:33 +01:00
Martin Willi f285b9efc8 Raise an alert if kernel policy installation fails 2012-12-19 10:40:33 +01:00
Martin Willi bcf3147e0a Raise an alert if kernel SA installation fails 2012-12-19 10:40:33 +01:00
Martin Willi 24f30ec92f Raise an alert on traffic selector mismatch 2012-12-19 10:40:32 +01:00
Martin Willi c794455666 Raise alerts when enforcing IKE_SA unique policy 2012-12-19 10:40:32 +01:00
Martin Willi 5dd9c3087f Raise an alert if CHILD_SA proposals mismatch 2012-12-19 10:40:32 +01:00
Martin Willi bab949bb26 Raise an alert if IKE proposals mismatch 2012-12-19 10:40:32 +01:00
Martin Willi 3f7f5388a5 Raise an alert of generating local authentication data fails 2012-12-19 10:40:32 +01:00