denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
17,368 Commits 1 Branch 0 Tags
60777574c189cd781721d2b54577bcb2fb26510d
Commit Graph
70 Commits
Author SHA1 Message Date
Tobias Brunner 60777574c1 charon-nm: Add support for custom server ports 2020-02-14 13:36:16 +01:00
Tobias Brunner 19e64e101d charon-nm: Add support for a specific remote identity 2020-02-14 11:19:49 +01:00
Josh Soref b3ab7a48cc Spelling fixes 
* accumulating
* acquire
* alignment
* appropriate
* argument
* assign
* attribute
* authenticate
* authentication
* authenticator
* authority
* auxiliary
* brackets
* callback
* camellia
* can't
* cancelability
* certificate
* choinyambuu
* chunk
* collector
* collision
* communicating
* compares
* compatibility
* compressed
* confidentiality
* configuration
* connection
* consistency
* constraint
* construction
* constructor
* database
* decapsulated
* declaration
* decrypt
* derivative
* destination
* destroyed
* details
* devised
* dynamic
* ecapsulation
* encoded
* encoding
* encrypted
* enforcing
* enumerator
* establishment
* excluded
* exclusively
* exited
* expecting
* expire
* extension
* filter
* firewall
* foundation
* fulfillment
* gateways
* hashing
* hashtable
* heartbeats
* identifier
* identifiers
* identities
* identity
* implementers
* indicating
* initialize
* initiate
* initiation
* initiator
* inner
* instantiate
* legitimate
* libraries
* libstrongswan
* logger
* malloc
* manager
* manually
* measurement
* mechanism
* message
* network
* nonexistent
* object
* occurrence
* optional
* outgoing
* packages
* packets
* padding
* particular
* passphrase
* payload
* periodically
* policies
* possible
* previously
* priority
* proposal
* protocol
* provide
* provider
* pseudo
* pseudonym
* public
* qualifier
* quantum
* quintuplets
* reached
* reading
* recommendation to
* recommendation
* recursive
* reestablish
* referencing
* registered
* rekeying
* reliable
* replacing
* representing
* represents
* request
* request
* resolver
* result
* resulting
* resynchronization
* retriable
* revocation
* right
* rollback
* rule
* rules
* runtime
* scenario
* scheduled
* security
* segment
* service
* setting
* signature
* specific
* specified
* speed
* started
* steffen
* strongswan
* subjectaltname
* supported
* threadsafe
* traffic
* tremendously
* treshold
* unique
* uniqueness
* unknown
* until
* upper
* using
* validator
* verification
* version
* version
* warrior

Closes strongswan/strongswan#164.
 2020-02-11 18:23:07 +01:00
Tobias Brunner 18bee9306a nm: Replace deprecated g_type_class_add_private() 
Fixes #2765, #3197.
 2020-02-05 10:54:37 +01:00
Tobias Brunner 9486a2e5b0 ike-cfg: Pass arguments as struct 2019-04-25 14:31:33 +02:00
Tobias Brunner 05b7f1cbfe charon-nm: Add IPv6 support 2019-03-14 13:42:08 +01:00
Tobias Brunner 0af3a4f103 charon-nm: Handle IPv6 DNS server attributes 2019-03-14 13:42:08 +01:00
Tobias Brunner 0b117dc960 charon-nm: Set local address to %any so IPv6 may be used as outer address 2019-03-14 13:42:08 +01:00
Tobias Brunner 5538e29071 charon-nm: Request virtual IPv6 address and appropriate TS 2019-03-14 13:42:08 +01:00
SC Lee 3a41febb1c charon-nm: Parse any type of private key in need_secrets 
Previously, when the user supplied an ECDSA key for public key authentication,
the user was always asked to provide a password, even if the key was not
encrypted.

Related: 954f73ea6e ("charon-nm: Parse any type of private key not only RSA")
Closes strongswan/strongswan#108.
 2018-07-09 12:21:43 +02:00
Tobias Brunner 1b67166921 Unify format of HSR copyright statements 2018-05-23 16:32:53 +02:00
Tobias Brunner 7b72909774 controller: Add option to force destruction of an IKE_SA 
It's optionally possible to wait for a timeout to destroy the SA.
 2018-05-22 10:06:07 +02:00
Tobias Brunner 954f73ea6e charon-nm: Parse any type of private key not only RSA 2018-03-07 15:23:03 +01:00
Tobias Brunner ee8c25516a charon-nm: Fix building list of DNS/MDNS servers with libnm 
g_variant_builder_add() creates a new GVariant using g_variant_new() and
then adds it to the builder.  Passing a GVariant probably adds the
pointer to the array, not the value.  I think an alternative fix would
be to use "@u" as type string for the g_variant_builder_add() call, then
the already allocated GVariant is adopted.

Fixes: 9a71b7219c ("charon-nm: Port to libnm")
 2018-02-22 09:05:48 +01:00
Tobias Brunner 268a1bfa34 charon-nm: Remove unused variable 2018-02-05 15:11:03 +01:00
Lubomir Rintel 9a71b7219c charon-nm: Port to libnm 
libnm-glib is deprecated for several years and reaching the end of its
life. Let's switch to the more up-to-date library.

Closes strongswan/strongswan#85.
 2017-12-22 10:05:10 +01:00
Tobias Brunner 525cc46cab Change interface for enumerator_create_filter() callback 
This avoids the unportable 5 pointer hack, but requires enumerating in
the callback.
 2017-05-26 13:56:44 +02:00
Tobias Brunner 95a63bf281 Migrate all enumerators to venumerate() interface change 2017-05-26 13:56:44 +02:00
Tobias Brunner 749ac175fa child-cfg: Use flags for boolean options 
Makes it potentially easier to add new flags.
 2017-05-23 16:51:15 +02:00
Defunct 4ac68f02f2 charon-nm: IKE/ESP proposal customization support 
Closes strongswan/strongswan#69.
 2017-05-08 14:33:58 +02:00
Tobias Brunner 07bbd2f642 nm: Enable IKE fragmentation 2016-10-20 08:03:26 +02:00
Tobias Brunner 97c74b565b nm: Make global CA directory configurable 2016-10-04 10:27:35 +02:00
Tobias Brunner a28c6269a4 nm: Remove dummy TUN device 
Recent NM releases don't insist on getting a device back from VPN
plugins.
 2016-10-04 09:57:14 +02:00
Tobias Brunner f201d86deb nm: Pass external gateway to NM 
This seems to be required by newer versions.
 2016-09-05 15:41:16 +02:00
Tobias Brunner 9e74a0952e nm: Enforce min. length for PSKs in backend 2016-09-05 15:41:15 +02:00
Tobias Brunner 2ba5dadb12 peer-cfg: Use struct to pass data to constructor 2016-04-09 16:51:01 +02:00
Tobias Brunner 8a00a8452d child-cfg: Use struct to pass data to constructor 2016-04-09 16:51:01 +02:00
Andreas Steffen b12c53ce77 Use standard unsigned integer types 2016-03-24 18:52:48 +01:00
Martin Willi b9be25ea39 attribute-handler: Pass full IKE_SA to handler backends 2015-02-20 13:34:56 +01:00
Martin Willi 751363275f attributes: Move the configuration attributes framework to libcharon 2015-02-20 13:34:55 +01:00
Martin Willi 5421092b75 plugin-loader: Support a reload() callback for static features 2014-09-22 13:55:12 +02:00
Martin Willi 8d74ec9e80 ike: Add an additional but separate AEAD proposal to CHILD config 
This currently has no effect: We don't include AEAD algorithms in the default
ESP proposal, as we don't know if it is supported by the backend. But as we
hopefully get an algorithm query mechanism on kernel interfaces some day, we
add the appropriate functionality nonetheless.
 2014-05-16 16:51:19 +02:00
Martin Willi 879e3d12ca ike: Add an additional but separate AEAD proposal to IKE config, if supported 2014-05-16 16:51:19 +02:00
Tobias Brunner f738753abc nm: Fix NULL-pointer dereference when handling TUN device failure 2014-04-09 16:35:46 +02:00
Tobias Brunner c489c5881a charon-nm: No additional secrets are required once a password has been entered 
Recent versions of NM will call need_secrets() as long as it returns TRUE,
but then fail as the number of calls is limited by an assert.

Fixes #547.
 2014-03-18 14:53:40 +01:00
Tobias Brunner 54ca25800c agent: Keep CAP_DAC_OVERRIDE to connect to ssh-agent socket 
This is also required if charon-cmd is used with capability dropping.
 2014-01-23 10:08:23 +01:00
Tobias Brunner 5ae822cfcd nm: Handle PSK option in NM backend 2013-11-27 18:36:58 +01:00
Martin Willi 3070697f9f ike: support multiple addresses, ranges and subnets in IKE address config 
Replace the allowany semantic by a more powerful subnet and IP range matching.
Multiple addresses, DNS names, subnets and ranges can be specified in a comma
separated list. Initiators ignore the ranges/subnets, responders match
configurations against all addresses, ranges and subnets.
 2013-09-04 10:38:37 +02:00
Martin Willi 9aeaa7396e peer-cfg: add a pull/push mode option to use with mode config 2013-09-04 10:33:37 +02:00
Martin Willi 896abbefc5 nm: omit deprecated g_type_init() when using >= GLIB 2.36 2013-07-18 14:21:17 +02:00
Tobias Brunner a2eb581781 capabilities: Move global capabilities_t instance to libstrongswan 2013-06-25 17:16:32 +02:00
Tobias Brunner 2e21bac19a capabilities: Ensure required capabilities are actually held by the process/user 2013-06-25 17:16:32 +02:00
Tobias Brunner 1b33e6c4ca charon-nm: Add dependencies to CERT_DECODE and PRIVKEY plugin features 
This ensures the NM-specific credential set is unloaded before any
implementation of certificate/key objects, which causes a segmentation
fault during shutdown.
 2013-03-19 16:25:26 +01:00
Tobias Brunner 3651c8dcd5 charon-nm: Prevent NM from changing the default route 
This is not required as we install our own (narrow) route(s) in our own
routing table. This should allow split tunneling if configured on the
gateway.
 2013-03-19 16:25:26 +01:00
Tobias Brunner 9cf09ecad7 charon-nm: Use VIP (if any) as local address 
NM will install this address on the provided device.
 2013-03-19 16:25:26 +01:00
Tobias Brunner c15eea7306 charon-nm: Pass a dummy TUN device to NetworkManager 
NetworkManager modifies the addresses etc. on this interface so using
"lo" is not optimal. With the dummy interface NM is free to do its
thing.
 2013-03-19 16:25:26 +01:00
Tobias Brunner b7645a5d30 charon-nm: Fix NM plugin utility macros 2013-03-19 16:25:26 +01:00
Martin Willi 306a269e34 Add a DSCP configuration value to IKE configs 2013-02-06 15:20:32 +01:00
Tobias Brunner 69c6a60176 g_thread_init() is deprecated since Glib 2.23 2013-01-24 19:13:40 +01:00
Tobias Brunner 365d9a6f67 Added an option that allows to force IKEv1 fragmentation 2013-01-12 11:54:32 +01:00