denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
10,006 Commits 1 Branch 0 Tags
794d713dca1d9da19aa795e779e485b7c2f51ccb
Commit Graph
204 Commits
Author SHA1 Message Date
Martin Willi 794d713dca Support loading cacert certificates in ipsec.conf ca sections from smartcard 2012-10-24 13:07:53 +02:00
Martin Willi 2abe404927 Refactored stroke smartcard token parsing, support module and slot in leftcert option 2012-10-24 13:07:53 +02:00
Martin Willi 9687cb5100 Load ipsec.conf %smartcard leftcerts with pkcs11 builder 2012-10-24 13:07:52 +02:00
Martin Willi 0c4b9f7cda Add a "ipsec listcounters" command to stroke 2012-10-24 11:34:31 +02:00
Martin Willi f9332e0a8b Add a print method for stroke counters 2012-10-24 11:34:31 +02:00
Martin Willi fc4d1568d1 Add stroke message type counters 2012-10-24 11:34:30 +02:00
Martin Willi 5715af7508 Add stroke counters for invalid IKE messages 2012-10-24 11:34:30 +02:00
Martin Willi 81e0e10344 Add stroke CHILD_SA rekeying counter 2012-10-24 11:34:30 +02:00
Martin Willi a32a8d4a67 Add stroke IKE rekey counters 2012-10-24 11:34:30 +02:00
Martin Willi 47904e3c74 Define stroke counter types to implement 2012-10-24 11:34:11 +02:00
Martin Willi 8554895b95 Add a stub for IKE event counters in stroke 2012-10-24 11:34:11 +02:00
Martin Willi 1fdd62ffce Remove version argument on peer_cfg constructor, use ike_cfg version instead 2012-10-24 10:19:33 +02:00
Martin Willi 9fc7cc6f9b Add IKE version information to ike_cfg_t 2012-10-24 10:18:35 +02:00
Tobias Brunner 3555bacac7 Reload logger configuration on SIGHUP 
Besides changing the configuration this allows to easily rotate log files.

Also moved logger initialization back to daemon_t.
 2012-10-18 14:42:10 +02:00
Martin Willi 82f3549fe2 Fix leak of PINs from ipsec.secrets 2012-10-09 11:54:00 +02:00
Tobias Brunner a05f3b2021 Make sure first argument is an int when using %.*s to print e.g. chunks 2012-09-28 18:01:49 +02:00
Tobias Brunner 4106aea8e4 Made IP address enumeration more flexible 
Also added an option to enumerate addresses on ignored interfaces.
 2012-09-21 18:16:26 +02:00
Tobias Brunner 9ba36c0f7f Make it easy to check if an address is locally usable via changed get_interface() method 2012-09-21 18:16:26 +02:00
Tobias Brunner aed33805ce Don't ignore loopback devices and allow addresses on them being enumerated 2012-09-21 18:16:26 +02:00
Tobias Brunner 8c19323c37 Make stroke user-creds work with XAuth configs 2012-09-18 16:56:17 +02:00
Tobias Brunner b7a500e985 Set AUTH_RULE_IDENTITY_LOOSE for rightid=%<identity> 2012-09-18 14:40:41 +02:00
Martin Willi 1e04488f32 Check for an existing lease in all stroke pools before creating a new one 2012-09-11 16:18:28 +02:00
Martin Willi 28a3d5bfbd Pass full pool list to release_address 2012-09-11 16:18:28 +02:00
Martin Willi 594c58e111 Pass the full list of pools to acquire_address, enumerate in providers 
If the provider has access to the full pool list, it can enumerate
them twice, for example to search for existing leases first, and
only search for new leases in a second step.

Fixes lease enumeration in attr-sql using multiple pools.
 2012-09-11 16:18:28 +02:00
Tobias Brunner f4cc7ea11b Add uniqueids=never to ignore INITIAL_CONTACT notifies 
With uniqueids=no the daemon still deletes any existing IKE_SA with the
same peer if an INITIAL_CONTACT notify is received.  With this new option
it also ignores these notifies.
 2012-09-10 17:37:18 +02:00
Tobias Brunner 383c174a79 Print the name of mem pools instead of the confusing <base>/<size> 2012-09-10 12:42:09 +02:00
Martin Willi 1323dc1138 Merge branch 'multi-vip' 
Brings support for multiple virtual IPs and multiple pools in
left/rigthsourceip definitions. Also introduces the new left/rightdns
options to configure requested DNS server address family and respond
with multiple connection specific servers.
 2012-08-31 12:55:56 +02:00
Tobias Brunner 7240914955 Use eap_vendor_type_from_string() in stroke 2012-08-31 11:40:28 +02:00
Martin Willi d55fe264d1 Pass all configured pool names to attribute provider enumerator 2012-08-30 16:43:43 +02:00
Martin Willi feb8550401 Pass a list instead of a single virtual IP to attribute enumerators 2012-08-30 16:43:42 +02:00
Martin Willi 96c2b3cf89 Support multiple addresses/pools in left/rightsourceip 2012-08-30 16:43:42 +02:00
Martin Willi 497ce2cf51 Support multiple address pools configured on a peer_cfg 2012-08-30 16:43:42 +02:00
Martin Willi 101d26babe Support multiple virtual IPs on peer_cfg and ike_sa classes 2012-08-30 16:43:42 +02:00
Martin Willi 63e460542c Add a stroke attribute_handler requesting DNS servers given with leftdns 2012-08-21 09:38:01 +02:00
Martin Willi 9937ca069a Serve ipsec.conf rightdns servers through stroke attribute provider 2012-08-21 09:38:01 +02:00
Martin Willi 17319aa28d Add a left/rightdns keyword to configure connection specific DNS attributes 2012-08-21 09:38:00 +02:00
Tobias Brunner b223d517c8 Replaced usages of CHARON_*_PORT with calls to get_port(). 2012-08-08 15:12:25 +02:00
Tobias Brunner e7ea057fd2 Make the UDP ports charon listens for packets on (and uses as source ports) configurable. 2012-08-08 15:07:43 +02:00
Martin Willi 874f7c7e2c Don't add ANY identity constraint to auth config, as XAuth rounds don't use one 2012-07-26 12:38:34 +02:00
Martin Willi 46df61dff7 Add an ipsec.conf leftgroups2 parameter for the second authentication round 2012-07-26 11:51:58 +02:00
Martin Willi 87dd205b61 Add a return value to hasher_t.allocate_hash() 2012-07-16 14:55:06 +02:00
Tobias Brunner 8d98f7fef6 Avoid that any % characters (e.g. in %any) are evaluated when logging via stroke 2012-07-12 16:58:00 +02:00
Martin Willi 0619ddfaa4 Refactored heavily #ifdefd capability code to its own libstrongswan class 2012-07-04 11:01:40 +02:00
Martin Willi 0f018a7324 Show some uname() info in "ipsec statusall" 2012-06-28 11:56:40 +02:00
Martin Willi dc6d259635 Show remote EAP/XAuth identity in "statusall" on a separate line 2012-06-27 11:42:00 +02:00
Tobias Brunner 26d77eb3e6 Centralized thread cancellation in processor_t 
This ensures that no threads are active when plugins and the rest of the
daemon are unloaded.

callback_job_t was simplified a lot in the process as its main
functionality is now contained in processor_t.  The parent-child
relationships were abandoned as these were only needed to simplify job
cancellation.
 2012-06-25 17:38:59 +02:00
Martin Willi dd1381e7d3 Show EAP/XAuth identity in "ipsec status", if available 2012-06-25 10:18:35 +02:00
Martin Willi e2dd114f37 Select requested virtual IP family based on remote TS, if no local TS available 2012-06-20 10:02:01 +02:00
Martin Willi 137035cc78 Show what kind of *Swan we run in "ipsec status" 2012-06-14 10:25:48 +02:00
Martin Willi e35bbb9740 Added signature scheme options left/rightauth 2012-06-12 15:01:39 +02:00