denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
13,532 Commits 1 Branch 0 Tags
784916e28dbbba0e0a02a5b2ea0ef5286b70d340
Commit Graph
10669 Commits
Author SHA1 Message Date
Martin Willi 784916e28d process: Don't use the shells built-in echo in tests 
On OS X, the /bin/sh built-in echo does not support -n.
 2014-10-14 16:33:10 +02:00
Martin Willi b16ea3415f process: Don't use absolute path names for true/false/cat in unit tests 
But use the (builtin) shell commands instead, as on OS X true/false are under
/usr/bin.
 2014-10-14 16:33:10 +02:00
Martin Willi 4e37bdbf57 kernel-pfroute: Check for RTM_IFANNOUNCE availability 
This message is not available on OS X.
 2014-10-14 16:33:10 +02:00
Martin Willi 5b2d89b3c3 process: Include missing <signal.h> for raise(3) 
Fixes OS X build.
 2014-10-14 16:33:10 +02:00
Tobias Brunner 15dee933de ip-packet: Fix removal of TFC padding for IPv6 
The IPv6 length field denotes the payload length after the 40 bytes header.

Fixes: 293515f95c ("libipsec: remove extra RFC4303 TFC padding appended to inner payload")
 2014-10-14 14:10:33 +02:00
Tobias Brunner 283229bcb7 vici: Add vici.gemspec.in and vici.rb to distribution 2014-10-14 11:26:41 +02:00
Tobias Brunner 3307de1f8d android: Implement get_contracts() method in IMC state object 2014-10-14 10:37:55 +02:00
Tobias Brunner f4e6f89aa9 android: libpts does not exist anymore, don't attempt to load it 2014-10-14 10:12:16 +02:00
Tobias Brunner bed09f2baf android: Update receive_message() to new imc_msg_t.receive() signature 2014-10-13 18:16:47 +02:00
Tobias Brunner 668fbd4907 libimcv: Add fallback if IPSEC_SCRIPT is not defined 
This is the case on Android.
 2014-10-13 18:16:47 +02:00
Tobias Brunner ba0355c4ae libimcv: Updated Android.mk to latest Makefile.am 2014-10-13 18:16:40 +02:00
Tobias Brunner f502e503fb android: Remove references to libpts 2014-10-13 17:18:06 +02:00
Tobias Brunner ffa800ce9d libimcv: Remove reference to libpts 2014-10-13 17:17:45 +02:00
Tobias Brunner 17eed801e7 libimcv: Fix Doxygen comments after merging libpts into libimcv 2014-10-13 17:11:57 +02:00
Tobias Brunner 4bae9ec8d1 watcher: Doxygen comment fixed 2014-10-13 16:56:30 +02:00
Tobias Brunner 245979abc0 charon-systemd: Typo in log message fixed 2014-10-13 16:51:20 +02:00
Avesh Agarwal c8719a073d libimcv: Fix harcoded IMCV_DEFAULT_POLICY_SCRIPT name 
I came across an issue with src/libimcv/imcv.c where
IMCV_DEFAULT_POLICY_SCRIPT is hardcoded.

It fails where ipsec_script is renamed to, for example, strongswan from
default ipsec.
 2014-10-13 16:15:33 +02:00
Tobias Brunner 472156eea5 ike: Do remote address updates also when behind static NATs 
We assume that a responder is behind a static NAT (e.g. port forwarding)
and allow remote address updates in such situations.

The problem described in RFC 5996 is only an issue if the NAT mapping
can expire.
 2014-10-13 15:20:17 +02:00
Tobias Brunner f8a565fbcc ike: Remove redundant check for local NAT when handling changed NAT mappings 2014-10-13 15:20:17 +02:00
Andreas Steffen 8b812065f0 Support of multiple directed segmentation contracts 2014-10-11 14:50:08 +02:00
Andreas Steffen ab99939628 unit-tests: Updated Makefile 2014-10-11 14:50:08 +02:00
Andreas Steffen a05ca71d07 unit-tests: Added test for seg_contract_manager 2014-10-11 14:50:08 +02:00
Andreas Steffen 4af020be37 Updated build-database.sh script to 3.13.0-37 kernel 2014-10-11 11:40:43 +02:00
Martin Willi 67f9f09dd3 swanctl: Fix exit codes based on errno 
As fprintf() most likely sets errno, we should save it before printing the
error message.
 2014-10-10 11:42:18 +02:00
Martin Willi d4d85135c5 vici: Cancel processor before calling library_deinit() 
For non-direct libstrongswan users, the deinitialization segfaults because
of the missing worker thread cancellation.
 2014-10-10 11:42:18 +02:00
Martin Willi 3db58e837c vici: Reduce debug level during thread spawning 
We want to avoid libvici users to get a cluttered stderr for no real error.
 2014-10-10 11:42:18 +02:00
Martin Willi 046b547a37 vici: Don't include-depend on libstrongswan for boolean types 
As we want to avoid the libstrongswan include dependencies for libvici, avoid
the use of the bool type. Unfortunately this change may break the ABI for
vici_dump(). As this function is mostly for debugging purposes, we do it
nonetheless; my apologies if somebody already relies on the ABI stability of
that function.
 2014-10-10 11:42:18 +02:00
Martin Willi 6f55149335 vici: Document the ruby gem and add some simple examples 2014-10-10 11:42:18 +02:00
Martin Willi dccb2c6eba vici: Add some simple libvici examples to the README 2014-10-10 11:42:18 +02:00
Martin Willi 56f17733c9 vici: Document the available vici command and event messages 2014-10-10 11:42:18 +02:00
Martin Willi f684be6583 vici: Use "gem"-assisted vici ruby gem building and installation 2014-10-10 11:42:17 +02:00
Martin Willi 1038d96537 vici: Add a ruby gem providing a native vici interface 2014-10-10 11:42:17 +02:00
Martin Willi 94d9398202 vici: Return a success result for the clear-creds command 
Even if the command actually can't fail, this looks more aligned to similar
commands.
 2014-10-10 11:42:17 +02:00
Martin Willi d39e04b557 vici: Fix message encoding type values in documentation 2014-10-10 11:42:17 +02:00
Volker Rümelin 05db0f97e3 ikev1: Add fragmentation support for Windows peers 
I still think ipsec/l2tp with fragmentation support is a useful
fallback option in case the Windows IKEv2 connection fails because
of fragmentation problems.

Tested with Windows XP, 7 and 8.1.
 2014-10-10 10:54:37 +02:00
Tobias Brunner 3633b80147 eap-radius: Add option to set interval for interim accounting updates 
Any interval returned by the RADIUS server in the Access-Accept message
overrides the configured interval.  But it might be useful if RADIUS is
only used for accounting.
 2014-10-10 09:51:13 +02:00
Tobias Brunner 8dbe128c8c message: Limit maximum number of IKEv2 fragments 
The maximum for IKEv1 is already 255 due to the 8-bit fragment number.

With an overhead of 17 bytes (x64) per fragment and a default maximum
of 10000 bytes per packet the maximum memory required is 14 kB
for a fragmented message.
 2014-10-10 09:32:42 +02:00
Tobias Brunner f00a9c1715 packet: Define a global default maximum size for IKE packets 2014-10-10 09:32:42 +02:00
Tobias Brunner 03512c47bf message: Ensure a minimum fragment length 2014-10-10 09:32:41 +02:00
Tobias Brunner f1aa18b2e8 ikev2: Send retransmits using the latest known addresses 
For instance, if a DPD exchange is initiated by the gateway when a
mobile client is roaming and it then gets a new IP address and sends
an address update via MOBIKE, the DPD retransmits would still be sent
to the old address and the SA would eventually get closed.
 2014-10-10 09:32:41 +02:00
Tobias Brunner b678d9e14f ikev2: Send and receive fragmented IKE messages 
If a fragmented message is retransmitted only the first packet is passed
to the alert() hook.
 2014-10-10 09:32:41 +02:00
Tobias Brunner 1446fd8ac9 ike: IKE_SA may fragment IKEv2 messages 2014-10-10 09:32:41 +02:00
Tobias Brunner 7a53fe5511 ike: Do not cache MID of IKEv2 fragments 
This fails if there are unencrypted payloads before an encrypted
fragment payload in the first fragment.
 2014-10-10 09:32:41 +02:00
Tobias Brunner c0f4936a23 message: Fragment and reassemble IKEv2 messages 2014-10-10 09:32:41 +02:00
Tobias Brunner e8ffb256b3 message: Handle encrypted fragment payload similar to the encrypted payload 2014-10-10 09:32:41 +02:00
Tobias Brunner 4c345b15c7 ikev2: Add encrypted fragment payload 2014-10-10 09:32:37 +02:00
Tobias Brunner edfd33455c encrypted_payload: Encrypted payload can be constructed from plaintext 2014-10-10 09:31:17 +02:00
Tobias Brunner 1e0d8f3ec0 encrypted_payload: Expose generate() to generate the plaintext 2014-10-10 09:31:17 +02:00
Tobias Brunner 44996b5866 encrypted_payload: Extract some utility functions 2014-10-10 09:31:17 +02:00
Tobias Brunner 41751a70d9 message: Split generate() in multiple functions 2014-10-10 09:31:16 +02:00