denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
8,301 Commits 1 Branch 0 Tags
501c163859c77ec31b9c75d1c311cfba8863fe24
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Martin Willi 1b7debcc04 Keep COOKIEs enabled once threshold is hit, until we see no COOKIEs for a few secs 
Toggling COOKIEs on/off is problematic: After doing a COOKIE exchange as
initiator, we can't know if the completing IKE_SA_INIT message is to our first
request or the one with the COOKIE. If the responder just enabled/disabled
COOKIEs and packets get retransmitted, both might be true. Avoiding COOKIE
behavior toggling improves the situation, but does not solve the problem during
the initial COOKIE activation.
 2012-04-17 10:02:21 +02:00
Martin Willi d0d600e1ef Added a note about DH/keymat lifecycle for custom implementations 2012-04-17 10:02:21 +02:00
Martin Willi a59a03670b Reuse existing DH value when retrying IKE_SA_INIT with a COOKIE 2012-04-17 10:02:21 +02:00
Martin Willi 10f24e6599 Don't invoke child_updown hook twice as responder 2012-04-11 17:45:12 +02:00
Martin Willi 4ef867f578 Accept zero-length certificate request payloads 2012-04-11 17:22:23 +02:00
Martin Willi 4bc7577db2 More detailed NEWS about RADIUS extensions 2012-04-02 13:58:21 +02:00
Martin Willi bc403eb1e5 Fixed crash and locking issues while unrouting connections via stroke 2012-03-13 10:56:22 +01:00
Martin Willi 4bbd943038 Include radattr RADIUS attribute only if an EAP payload is present 2012-03-06 16:08:32 +01:00
Martin Willi bb0b203186 By default include radattr RADIUS attribute in any IKE_AUTH exchange 2012-03-06 16:08:29 +01:00
Martin Willi 45f20f8a79 farp plugin sends ARP responses for any tunneled address, not only virtual IPs 2012-03-06 16:06:33 +01:00
Martin Willi 21796bac9a Be less verbose if we don't have a local address for a tunnel 2012-03-06 16:05:58 +01:00
Martin Willi 4d7a2128b6 Re-resolve hosts on additional keyingtries 2012-03-06 16:05:28 +01:00
Martin Willi d1fbb0a4b3 Renamed radius_server to radius_config, as some real RADIUS server functionality is coming 2012-03-05 18:31:30 +01:00
Martin Willi 2e3615e4ad Prefer EAP-Identity to read radattr RADIUS attribute file 2012-03-05 18:08:04 +01:00
Martin Willi 4cd176d525 Invoke ike_updown hook on authentication failure not before response sent 2012-03-05 18:08:04 +01:00
Martin Willi 0853ff39c5 Build libradius if radattr plugin is enabled 2012-03-05 18:08:04 +01:00
Martin Willi 3ccc8a191c Inject RADIUS attribute in radattr plugin read from an identity specific file 2012-03-05 18:08:04 +01:00
Martin Willi caf4b88efc Added a radattr plugin that prints any received RADIUS notify to console 2012-03-05 18:08:04 +01:00
Martin Willi f0f94e2ce6 Moved generic RADIUS protocol support to a dedicated libradius 2012-03-05 18:08:04 +01:00
Martin Willi 990fda9d88 Removed libcharon dependencies from generic RADIUS protocol support 2012-03-05 18:06:15 +01:00
Martin Willi 99cb353968 Forward specifcied RADIUS attributes between AAA backend and client 2012-03-05 18:06:15 +01:00
Martin Willi 007d5b9218 Defined a private status notify to transport arbitrary RADIUS attributes 2012-03-05 18:06:14 +01:00
Martin Willi c158ccd960 Implemented RADIUS DAE response retransmission 2012-03-05 18:06:14 +01:00
Martin Willi fbaf5cd213 Be a little more verbose before starting IKE_SA reauthentication 2012-03-05 18:06:14 +01:00
Martin Willi 4d19f7c5bf Process RADIUS DAE CoA updates, updating lifetimes 2012-03-05 18:06:14 +01:00
Martin Willi a07b69734b Send an AUTH_LIFETIME update after updating the lifetime, but can not reauth actively 2012-03-05 18:06:14 +01:00
Martin Willi d23c159658 Use faster ike_sa_id and a delete job to handle RADIUS DAE Delete-Request 2012-03-05 18:06:14 +01:00
Martin Willi 245e3c52a2 Refactored RADIUS DAE IKE_SA lookup 2012-03-05 18:06:14 +01:00
Martin Willi 964b0c144e Pass RADIUS DAE client address a host_t instead of sockaddr struct 2012-03-05 18:06:14 +01:00
Martin Willi 9756c143f0 Send RADIUS DAE Disconnect-ACK/NAK on Disconnect-Request 2012-03-05 18:06:14 +01:00
Martin Willi 392618d4ec Support signing of RADIUS response messages 2012-03-05 18:06:13 +01:00
Martin Willi 2bf3858955 Act on RADIUS DAE Disconnect requests 2012-03-05 18:06:13 +01:00
Martin Willi 76b6b19f8d Verify received RADIUS DAE requests 2012-03-05 18:06:13 +01:00
Martin Willi e8a8179706 Support verification of RADIUS request messages 2012-03-05 18:06:13 +01:00
Martin Willi 3bc1829211 Rename RADIUS message constructors to handle both, requests and responses 2012-03-05 18:06:13 +01:00
Martin Willi 6319ce63cf Enable RADIUS DAE listening if configured 2012-03-05 18:06:13 +01:00
Martin Willi 85932ad24e Added infrastructure to listen to RADIUS Dynamic Authorization Extension requests 2012-03-05 18:06:13 +01:00
Martin Willi 3a42c08904 Added Dynamic Authorization Extension RADIUS message codes 2012-03-05 18:06:13 +01:00
Martin Willi c61341a58f Set IKE_SA lifetime based on RADIUS Session-Timeout attribute 2012-03-05 18:06:13 +01:00
Martin Willi bdcf441703 Set hard timeouts when setting a lifetime 2012-03-05 18:06:13 +01:00
Martin Willi e9fcf1c6cc Fix IKE_SA timeout debug output on 64bit platforms 2012-03-05 18:06:13 +01:00
Martin Willi 3a2660f189 Encode IPv6 virtual IPs in a Framed-IPv6-Prefix attribute 2012-02-24 11:20:16 +01:00
Martin Willi d15ae70c8c Refactored construction of RADIUS accounting messages 2012-02-24 11:12:18 +01:00
Martin Willi d93f204ca5 Include port numbers in Calling-Station-Id, too 2012-02-24 10:49:29 +01:00
Martin Willi 802ed08dff Use large enough buffers for IPv6 addresses in Calling-Station-Id 2012-02-24 10:13:08 +01:00
Martin Willi 434cdbac09 Send client external address as Calling-Station-Id in RADIUS accounting 2012-02-24 10:05:23 +01:00
Martin Willi ae10ee6d0b Double check if a cached suite is available, overwrite any old suite state 2012-02-07 11:42:57 +01:00
Martin Willi 06c150365d Fix TLS EAP-MSK derivation, uses different order of randoms than key expansion 2012-02-07 10:54:53 +01:00
Martin Willi 1dabf5bfc7 Filter TLS suite MAC by HMAC algorithm, as the hash is not necessarily the same 2012-02-07 10:54:53 +01:00
Martin Willi 32dc2b0243 Update usage for all children in RADIUS accounting just before sending Stop 2012-02-06 10:51:40 +01:00
Martin Willi e5747e7a83 Check if ClusterIP directory could be opened before enumerating it 2012-02-06 10:51:39 +01:00
Martin Willi 85dd6a8deb Trigger DPD not before IKE_SA state gets updated 2012-02-02 10:35:50 +01:00
Martin Willi 916cdca851 Don't retransmit, rekey, reauth or DPD check SAs when in PASSIVE state 2012-02-02 10:34:04 +01:00
Martin Willi a895801270 Added TLS session resumption NEWS 2012-02-01 12:13:00 +01:00
Martin Willi a345aa2639 Added RADIUS accounting NEWS 2012-02-01 12:07:32 +01:00
Martin Willi 503dee4d2f Added RADIUS accounting option to strongswan.conf manual 2012-02-01 11:35:13 +01:00
Martin Willi 0399edef71 Support RADIUS accounting messages containing Framed-IP and Inbound/Outbound-Octets 2012-01-30 19:16:49 +01:00
Martin Willi 8e5b4aa023 Open RADIUS accounting sockets to exchange accounting messages 2012-01-30 19:15:20 +01:00
Martin Willi a69aff5f17 Support signing of RADIUS accounting messages 2012-01-30 19:13:20 +01:00
Martin Willi 370de553f8 RADIUS message constructor accepts a message code parameter 2012-01-30 19:11:08 +01:00
Martin Willi 023800ba62 Build libstrongswan if libfast gets built 2012-01-24 18:23:44 +01:00
Martin Willi 498d172c33 Use correct time_t variables to store ARG_TIME options 2012-01-18 10:31:45 +01:00
Martin Willi f8b2906929 Use the TLS socket splicing in tls_test script 2011-12-31 13:14:49 +01:00
Martin Willi 3a87c89b1b Added a tls_socket_t.splice method to wrap a file descriptor into TLS 2011-12-31 13:14:49 +01:00
Martin Willi 6a5c86b7ad Implemented TLS session resumption both as client and as server 2011-12-31 13:14:49 +01:00
Martin Willi ca5767621b Implemented a TLS session cache 2011-12-31 13:14:49 +01:00
Martin Willi 703c0db894 Check for cipherspec changes after each handshake message 2011-12-31 13:14:49 +01:00
Martin Willi 4caa380625 Separated cipherspec checking and switching, allowing us to defer the second 2011-12-31 13:14:49 +01:00
Martin Willi 84da59f609 Be less verbose about TLS extensions 2011-12-24 14:14:25 +01:00
Martin Willi ed57dfca3f In TLS 1.2, PRF and HASH function use at least SHA-256, not the MAC hash function 2011-12-24 12:42:28 +01:00
Martin Willi 6b01216422 Added a getter for the tls_socket file descriptor 2011-12-24 12:42:25 +01:00
Martin Willi 8b8fcfd631 Be less verbose if plugin dependecy not satisfied 2011-12-07 13:42:10 +01:00
Martin Willi 005b02cbe3 Create a dummy pthread key for value "0", as some buggy PKCS#11 libraries mangle it 2011-12-07 13:42:07 +01:00
Martin Willi b2e493ab58 Fixed proposal numbering check in sa_payload 2011-11-21 09:12:00 +01:00
Martin Willi 3fcacd283e Fix unaligned aliasing warning in raw socket 2011-11-17 18:22:07 +01:00
Martin Willi 37276728f3 Added some NEWS for 4.6.0 2011-10-14 10:29:01 +02:00
Martin Willi 58fcdc4f06 Don't enforce features with soft dependencies before all plugins are loaded 2011-10-14 10:05:49 +02:00
Martin Willi 67c1d36554 Add features support tp eap-simaka-reauth plugin 2011-10-14 10:05:49 +02:00
Martin Willi e9655e7417 Add features support to eap-simaka-pseudonym plugin 2011-10-14 10:05:49 +02:00
Martin Willi f91cba1874 Add features support to eap-simaka-sql plugin 2011-10-14 10:05:49 +02:00
Martin Willi a07f2a4b9b Don't try to load a feature again after failure 2011-10-14 10:05:49 +02:00
Martin Willi 9894b91ca9 Don't load eap-sim-file plugin if no valid triplet file found 2011-10-14 10:05:49 +02:00
Martin Willi 59c4e88b16 Reset registration function for each plugin during feature loading 2011-10-14 10:05:49 +02:00
Martin Willi 9099e4fd3c Add features support to eap-sim-pcsc plugin 2011-10-14 10:05:49 +02:00
Martin Willi 5f17a09323 Add features support to eap-sim-file plugin 2011-10-14 10:05:48 +02:00
Martin Willi 49458758f6 Add features support to eap-sim plugin 2011-10-14 10:05:48 +02:00
Martin Willi 1cb9a6d8ba Add features support to eap-aka-3gpp2 plugin 2011-10-14 10:05:48 +02:00
Martin Willi c12c334925 Add a plugin feature registration callback for SIM/AKA backends 2011-10-14 10:05:48 +02:00
Martin Willi 4ae99247b5 Add features support to eap-aka plugin 2011-10-14 10:05:48 +02:00
Martin Willi e64d1141ff Add features support to fips-prf plugin 2011-10-14 10:05:48 +02:00
Martin Willi 756b504e40 Add features support to socket-raw plugin 2011-10-14 10:05:48 +02:00
Martin Willi 85d11ce9bd Add features support to socket-dynamic plugin 2011-10-14 10:05:48 +02:00
Martin Willi 8c5aacc270 Add features support to socket-default plugin 2011-10-14 10:05:48 +02:00
Martin Willi 8b6881cfc5 Added socket plugin feature loading callback 2011-10-14 10:05:48 +02:00
Martin Willi 3b62d5bad8 Add features support to kernel-klips plugin 2011-10-14 10:05:48 +02:00
Martin Willi 8da1f9f25d Add features support to kernel-pfroute plugin 2011-10-14 10:05:48 +02:00
Martin Willi e99cb0673d Add features support to kernel-pfkey plugin 2011-10-14 10:05:47 +02:00
Martin Willi 278e5f3d7a Add features support to kernel-netlink plugin 2011-10-14 10:05:47 +02:00
Martin Willi 33a8860eac Added macro to define CUSTOM plugin features 2011-10-14 10:05:47 +02:00
Martin Willi 29d30991f3 Added kernel_ipsec/net plugin feature loading callbacks 2011-10-14 10:05:47 +02:00