denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
989 Commits 1 Branch 0 Tags
6e9bbf18b8c6477a245832e9014c873ee833326d
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Martin Willi 6e9bbf18b8 added HOST_ACCESS for firewall script as default 2006-09-18 11:38:37 +00:00
Martin Willi 5fded5139e more debugging output for PSK authentication 2006-09-18 11:38:11 +00:00
Martin Willi a2cf2812c4 some cleanups here and there 2006-09-18 11:37:40 +00:00
Martin Willi a7371600b0 proper error handling for socket creation 2006-09-18 06:44:38 +00:00
Martin Willi b9024ee058 handle certificate parsing error more generous 2006-09-14 13:14:58 +00:00
Martin Willi 8a95c322c5 fixed certificate verification bug! 2006-09-14 12:22:08 +00:00
Martin Willi 567e2a7822 fixed memleak when receiving invalid certificate 2006-09-14 12:15:41 +00:00
Martin Willi d7934d0cfc implemented updown script to handle firewalling 2006-09-12 13:50:14 +00:00
Martin Willi a095243f60 add priority management for kernel policy 
let ROUTED policies installed, until manuall removed
introduced new naming scheme to allow proper shutdown of IKE/CHILD_SAs
ike_sa_manager cleanups
 2006-09-08 13:10:52 +00:00
Martin Willi 1239c6f40b implemented handling of dpdaction and dpddelay ipsec.conf parameters 2006-09-08 06:12:02 +00:00
Martin Willi a655f5c09c reuse reqid when a ROUTED child_sa gets INSTALLED 
fixed a bug in retransmission code
added support for the "keyingtries" ipsec.conf parameter
added support for the "dpddelay" ipsec.conf parameter
done some work for "dpdaction" behavior
some other cleanups and fixes
 2006-09-05 14:07:25 +00:00
Martin Willi da8ab11e91 fixed a at-least-one-year-old bug which caused crashed in the scheduler 2006-08-31 06:48:10 +00:00
Martin Willi c705698293 added raw socket filter for IPv6 2006-08-31 06:18:15 +00:00
Martin Willi 053842f4e7 implemented NAT detection for IPv6 2006-08-31 06:17:41 +00:00
Martin Willi 1f7fd2ced8 removed unneeded constructor 2006-08-31 06:16:52 +00:00
Martin Willi 48d9883a3e initial support for IPv6 (more testing needed) 
socket works (without v6 filter)
  traffic selector handle IPv4/v4 cleanly
    improvements in traffic selector code
  kernel interface accepts v6 traffic selectors and hosts
  host_t class has full IPv6 support
 2006-08-30 17:12:56 +00:00
Martin Willi 51d4876814 added stddef.h include for compilers which do not support the offsetof() directive 2006-08-28 09:02:51 +00:00
Martin Willi 4c23a8c9ec moved interface enumeration code to socket, where it belongs 
query interfaces every time we need it to respect changes in network config
added address listing on startup and "ipsec statusall"
 2006-08-28 08:45:22 +00:00
Martin Willi fa8d578d94 fixed crash bug when doing "ipsec down" with an unknown connection 2006-08-25 09:19:42 +00:00
Martin Willi 9be547c0ed added name property in CHILD_SA, allows proper status output 2006-08-25 09:07:37 +00:00
Martin Willi 7106403bd8 2006-08-25 07:42:48 +00:00
Martin Willi c3e7aeb102 fixed bug which prevented port float when nat is detected 2006-08-25 07:37:22 +00:00
Martin Willi a1310b6b92 updated Changelog and other docs 2006-08-23 11:48:33 +00:00
Martin Willi d03ab568a6 fixed rekeying behavior when proposing an inacceptable DH group (INVALID_KE_PAYLOAD) 2006-08-23 09:25:41 +00:00
Martin Willi 3183006de2 implement proper handling of most simultaneous IKE_SA rekeying cases 2006-08-23 07:30:43 +00:00
Martin Willi f698448ea3 implemented proper refcounting using atomic operations 2006-07-28 09:45:18 +00:00
Martin Willi fe04e93a8b implemented IKE_SA rekeying 
uses ikelifetime, rekeymargin and rekeyfuzz config settings
	no handling of simultaneus exchanges yet!
 2006-07-27 12:18:40 +00:00
Martin Willi 45f76a7ddd added possibility to route CHILD_SAs, without to set them up 
support for auto=route parameter
	support for ipsec route and ipsec unroute
	initiating of CHILD and/or IKE_SAs based on kernel acquires
 2006-07-21 13:31:53 +00:00
Martin Willi c0593835f4 reuse an existing IKE_SA to set up additional CHILD_SAs 2006-07-20 14:57:49 +00:00
Martin Willi 8dfbe71b34 introduced refcounting on policy and connections 
aren't stored in the IKE_SA anymore, they are queried on the fly
	are immutable now, allows it to share them
policy selection based on traffic selectors, leads to valid lookup results
	rekeying queries the policy based on its traffic selectors
 2006-07-20 10:09:32 +00:00
Martin Willi 92ee45a0ee cleanups in kernel interface code 
added proper traffic selector to string conversion
some cleanups here & there
 2006-07-18 12:53:54 +00:00
Martin Willi e6cfe0eecc fixed UDP decapsulation by adding inbound bypass policy for send socket 2006-07-14 12:53:06 +00:00
Martin Willi 106e9fc6f8 updated mixed tests to new charon output 2006-07-14 12:29:26 +00:00
Martin Willi ead36455a9 reenabled module tests for charon 2006-07-14 11:16:49 +00:00
Martin Willi b34be51cef fixed bug which erroneously detected KE payload when rekeying 2006-07-14 08:18:48 +00:00
Martin Willi e3109c02ac added IPsec bypass policy to receiving socket, allows incoming IKE traffic on host2host tunnels when using NAT 2006-07-14 08:08:55 +00:00
Martin Willi 325e497798 improved logging on verify errors for some payloads 
enforcing IKE_SA shutdown, even when transactions are outstanding
proper reject of CREATE_CHILD_SA message with KE payload
 2006-07-13 12:49:35 +00:00
Martin Willi 7af345e11e added test cases from NAT team 
updated all IKEv2 tests to work with new status output
 2006-07-13 12:45:18 +00:00
Martin Willi 1279eda042 added tcpdumpcount function from NATT guys 
added possibility to mount the strongswan tree into all UMLs
added script for installing from shared tree in all UMLs
added script to shut down all UMLs properly
 2006-07-13 12:43:52 +00:00
Martin Willi be247b817b removed in favour of tests from NAT team 2006-07-13 12:00:36 +00:00
Martin Willi 4c04f30a51 fixed CREATE_CHILD_SA transaction dispatching 2006-07-13 08:51:24 +00:00
Martin Willi bcb95ced3d added CHILD_SA states, which allows us to detect further simultaneous transactions 
reimplemented the buggy message id handling
 2006-07-13 08:26:54 +00:00
Martin Willi cb5c41cde9 updated some inline docs 2006-07-12 14:08:52 +00:00
Martin Willi 0d379627de fixed crypter/signer in/out to conform with standard 2006-07-12 14:08:13 +00:00
Martin Willi b68afb7bd8 fixed payload order 2006-07-12 14:07:30 +00:00
Martin Willi a846ffdb48 added message id logging 2006-07-12 14:06:25 +00:00
Martin Willi e7356568b2 added all currently known notify payload types 2006-07-12 14:05:57 +00:00
Martin Willi aeeb4f4f97 added policy cache to kernel interface 
allows refcounting of multiple installed policies
	finally brings us stable simultaneous rekeying
 2006-07-12 11:42:36 +00:00
Martin Willi 269f7f448b leak detective blanks memory on free & alloc, allows further membug detection 2006-07-12 11:15:31 +00:00
Martin Willi 4c19900ce8 code cleanups 2006-07-12 11:13:48 +00:00
Martin Willi abba7ecb9d further work done for simultaneous rekeying/delete 
still some cases which cause trouble
 2006-07-10 14:24:04 +00:00
Martin Willi c5d2d7c023 fixed compiler warnings in parser when using -O2 2006-07-07 12:48:27 +00:00
Martin Willi af2faa1f1d reenabled check_expiry 2006-07-07 12:25:25 +00:00
Martin Willi c71d53ba4e updated copyright information 2006-07-07 08:49:06 +00:00
Martin Willi 698d774918 reimplemented CHILD_SA rekeying & delete 
no simultanous transaction with CHILD_SAs yet!
 2006-07-07 07:04:07 +00:00
Martin Willi efa40c11e4 updated NEWS 2006-07-05 14:13:45 +00:00
Martin Willi d109b48968 added support for leftprotoport and rightprotoport 2006-07-05 13:13:07 +00:00
Martin Willi 5f0eb96fc4 improved CHILD_SA output for "ipsec statusall" 2006-07-05 13:11:55 +00:00
Martin Willi b190424716 updated whitelist (getprotobynumber) 2006-07-05 13:10:47 +00:00
Martin Willi 3dd3c5f39e redesigned IKE_SA using a transaction mechanism: 
removed old state machine
  reimplemented IKE_SA setup and delete
  implemented dead peer detection
  implemented keep-alives
  a lot of fixes
  no rekeying yet
 2006-07-05 10:53:20 +00:00
Martin Willi b12af2ead6 fixed compiler warnings 2006-07-05 10:09:42 +00:00
Martin Willi 57d02978cf made thread ids unsigned again, to avoid negative thread ids on some systems 2006-07-04 13:30:49 +00:00
Martin Willi 1135f79898 fixed memleak when initiating a connection already up 2006-07-04 13:29:16 +00:00
Martin Willi 318dc7b6c4 updated leak detective whitelist 2006-07-04 13:26:20 +00:00
Martin Willi f141214e64 applied latest NATT patch with some fixes and cleanups 2006-07-04 13:25:00 +00:00
Martin Willi 2f89902d07 applied new changes from NATT team 
DPD only done when no IPsec and IKE traffic processed
	minor changes here and there
 2006-06-23 14:02:30 +00:00
Martin Willi 2891590b05 some message code cleanups 2006-06-23 14:00:15 +00:00
Martin Willi eecb2da87d fixed identification_t clone to apply function pointers 2006-06-23 13:20:17 +00:00
Martin Willi 4b24dd2d7d cleaner error handling on UDP encapsultion sockopt failure 2006-06-22 13:05:15 +00:00
Martin Willi 6f51c9f184 added mysterious UDP encapsulation socket option to get encapsulation working 2006-06-22 12:57:49 +00:00
Martin Willi 1396815afb first merge of NATT code 2006-06-22 06:36:28 +00:00
Martin Willi 6bf1352032 fixed testing build 2006-06-21 12:58:02 +00:00
Martin Willi e986c40bc7 updated for 4.0.1 release 2006-06-21 12:14:40 +00:00
Martin Willi 7e81e97543 updated news for 4.0.1 release 2006-06-21 12:11:29 +00:00
Martin Willi b29bfa7c76 fixed whitelist detection 2006-06-20 11:03:47 +00:00
Martin Willi 986d23bd6e reworked function ignore mechanism to not-report whitelist 
rather than overriding functions
 2006-06-20 10:05:56 +00:00
Martin Willi 13b8fa0e8d fixed execv call args to work when using strictcrl and syslog 2006-06-20 10:04:35 +00:00
Martin Willi 5c6b5bf599 fixed bug: usage of already freed mem 2006-06-20 09:53:25 +00:00
Martin Willi aed58dcc93 readded local_credential_store 
added sendcert policy to connection
some other cleanups
 2006-06-20 08:43:57 +00:00
Martin Willi b965b8456b fixed SPI when acting as initiator of rekeying 2006-06-19 09:27:14 +00:00
Martin Willi c65a4fff3f fixed SPI when rekeying and deleting CHILD_SAs 2006-06-19 08:54:19 +00:00
Martin Willi 891dfaf983 change key derivation order to fullfill RFC 2006-06-19 08:11:42 +00:00
Martin Willi f7eb60dd5e 2006-06-16 14:10:49 +00:00
Martin Willi c859ec9592 fixed compilation error 2006-06-15 13:41:06 +00:00
Martin Willi c15c3d4be9 updated for release 2006-06-15 13:23:06 +00:00
Martin Willi 147fe5095d fixed aes code, we support now aes128, aes192, aes256 in IKE 2006-06-15 13:14:09 +00:00
Martin Willi c095388f7f added support for "ike" and "esp" keywords 
fixed bugs in proposal code
algorithm selection for charon works now with ipsec.conf
a lot of other fixes
 2006-06-15 11:09:11 +00:00
Martin Willi 3efbf98312 implemented clean spi allocation behavior when using multiple proposals 2006-06-15 11:06:22 +00:00
Martin Willi 525a5538db fixed logleve(l) keyword typo 2006-06-15 11:03:41 +00:00
Martin Willi 56f1a8f2d6 handling of "rekey=no" parameter added 2006-06-15 11:02:15 +00:00
Martin Willi ad038f770d changed default algorithms to: 
ike: aes128-sha-modp2048
  esp: aes128-sha1, 3des-md5
 2006-06-15 11:01:17 +00:00
Martin Willi b7e3329f17 fixed down keyword 2006-06-13 10:11:45 +00:00
Martin Willi fa32cd3c47 debug and logging improvements 2006-06-13 10:01:04 +00:00
Martin Willi 22ff6f578f 2006-06-13 10:00:19 +00:00
Martin Willi 50f98119dd using same reqid if a child sa rekeys an existing one 2006-06-12 08:36:41 +00:00
Martin Willi a2a3fb3e25 workaround for peers rekeying at the same time 
loading lifetime policies from ipsec.conf
 2006-06-12 07:33:20 +00:00
Martin Willi 695723d4e8 old child_sa gets deleted after rekeying 
rekeying almost complete, but:
	IKE_SA get in an invalid state when both initiate rekeying at the same time,
 2006-06-09 15:12:43 +00:00
Martin Willi b543bef50c improved kernel interface logging 2006-06-09 08:41:41 +00:00
Martin Willi 0bb32cb5f3 fixed clone/destroy behavior when not using CAs 2006-06-09 07:40:40 +00:00
Martin Willi 5c131a016b specifying keysize in bits, as it is required in IKEv2 
added generic kernel SA algorithm handling, which brings us:
        aes-128, aes-256, blowfish, des, 3des and null encryption for CHILD_SAs
 2006-06-09 07:31:30 +00:00