denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
17,442 Commits 1 Branch 0 Tags
7b15ecf82e544d26eaa767cf48f6a288288f7b8c
Commit Graph
2163 Commits
Author SHA1 Message Date
Martin Willi 5c12700f9a kernel-interface: query SAD for last use time if SPD query didn't yield one 2013-05-06 17:01:13 +02:00
Martin Willi dc35d097b3 socket-default: to bind to one dynamic port on OS X, create v4 socket before v6 
It seems that the order of binding sockets of different address families to the
same dynamic port must be v6-before-v4 on Linux, but v4-before-v6 on OS X.
 2013-05-06 16:10:11 +02:00
Martin Willi a30727fe2b socket-default: refactor socket pair opening to a function 2013-05-06 16:10:11 +02:00
Martin Willi 6948df3220 socket-default: Don't try to send packet if we haven't a socket for given family 2013-05-06 16:10:10 +02:00
Martin Willi e9326eba13 socket-default: Use -1 if socket is not available, as 0 is actually a valid fd 2013-05-06 16:10:10 +02:00
Martin Willi d3874008e8 socket-dynamic: when sending from port zero, allocate a free port dynamically 2013-05-06 15:28:26 +02:00
Martin Willi 0be946dce3 Use the GEN silent rule when generating files with sed 2013-05-06 15:04:56 +02:00
Martin Willi aea7ce3c64 eap-radius: add an option to disable accounting for tunnels without virtual IP 2013-05-06 14:56:01 +02:00
Martin Willi 69620a48e8 eap-radius: use IKE_SA unique id instead of peer identity to manage virtual IPs 
Fixes some corner cases if multiple tunnels use the same peer identity.
 2013-05-06 14:56:01 +02:00
Andreas Steffen 2d902d7e7c fixed typo 2013-04-19 18:33:41 +02:00
Martin Willi b2b99e61c8 eap-radius: Add an option to exclude ports from Called/Calling-Station-Id 2013-04-10 13:48:03 +02:00
Andreas Steffen 12fa1784d0 emit a single assig_vips bus message for all VIPs 2013-04-06 14:16:30 +02:00
Andreas Steffen ba2880d569 ifmap plugin subscribes to assing_vip bus signal 2013-04-06 11:09:41 +02:00
Tobias Brunner 14edee56bf unity: Check IKE_SA in only after enumerating virtual IPs 2013-04-05 16:03:10 +02:00
Andreas Steffen 2a4915e87a cleaned up XML code in tnccs-11 plugin 2013-04-04 17:12:07 +02:00
Martin Willi 9c84bbcbc0 duplicheck: track multiple IKE_SAs in checking state to avoid any races 
When two consequent duplicates have been detected, track state of each checking
IKE_SA separately, avoiding potential race conditions between the active SA
and the different SAs in checking state.
 2013-04-04 15:51:48 +02:00
Andreas Steffen 93f53a78b5 fixed memory leak 2013-04-03 21:38:04 +02:00
Andreas Steffen 3ea6fcb593 properly handle orphaned renewSession jobs 2013-04-03 21:38:04 +02:00
Andreas Steffen 91503c2112 support chunked HTTP responses 2013-04-03 21:38:04 +02:00
Andreas Steffen 1044710b04 implemented periodic IF-MAP RenewSession request 2013-04-03 21:38:04 +02:00
Martin Willi 7f4f1e8249 List all stroke counters when "all" is given, and report if connection not known 2013-04-03 14:58:08 +02:00
Andreas Steffen d4a1ae3af1 allow retrieval of private keys from other credential sets 2013-04-02 08:55:40 +02:00
Andreas Steffen c2c4125cde improve checking of sent and received http messages 2013-04-02 08:55:40 +02:00
Tobias Brunner eca499f3d9 Load raw keys before possibly destroying the identity 
If no identity (or %any) is configured the identification_t object is
destroyed and an invalid object was associated with the created pubkey
certificate.
Actually using %any does not work as the certificate would not match
when the client later provides an identity.
 2013-04-01 13:48:34 +02:00
Tobias Brunner a009aedb0b ipseckey: Use proper daemon name for enable option 2013-04-01 13:46:09 +02:00
Tobias Brunner 53ac177cde Properly handle situation if no resolver plugins are loaded 2013-04-01 13:44:04 +02:00
Andreas Steffen 5a516a83da fixed capability metadata 2013-03-31 22:15:42 +02:00
Andreas Steffen 45e2be2399 renamed tnc_ifmap2 plugin to tnc_ifmap 2013-03-31 16:37:30 +02:00
Andreas Steffen bde8e287d9 removed obsoleted tnc_ifmap plugin 2013-03-31 16:07:08 +02:00
Andreas Steffen 4581767493 implemented http basic authentication 2013-03-31 15:59:32 +02:00
Andreas Steffen e8675cb35d parse IF-MAP server URI 2013-03-31 11:39:06 +02:00
Andreas Steffen 4f4875ff13 implemented publish_enforcement_report and endSession methods 2013-03-30 13:19:27 +01:00
Andreas Steffen 628fee4563 implemented publish_ike_sa method 2013-03-30 09:15:16 +01:00
Andreas Steffen c6f9b1fb1f ifmap message type is known 2013-03-30 08:22:33 +01:00
Andreas Steffen b02bdc1e06 implemented publish_device_ip method 2013-03-30 08:11:10 +01:00
Andreas Steffen 14bf3cc1bd added IF-MAP SOAP error handling 2013-03-30 08:10:39 +01:00
Andreas Steffen cd13c9a90f created tnc_ifmap2_soap_msg class 2013-03-29 23:09:11 +01:00
Andreas Steffen b885c3cde6 implement NewSession and PurgePublisher messages using the libxml2 library 2013-03-29 22:29:12 +01:00
Andreas Steffen e99aab35de set up a new IF-MAP session 2013-03-29 09:42:06 +01:00
Tobias Brunner 54781f5f34 Fixed Doxygen comment in eap_radius plugin 2013-03-27 11:08:55 +01:00
Tobias Brunner 237bb5d467 error-notify: Close file descriptors in case clients are still connected 2013-03-25 18:34:54 +01:00
Tobias Brunner 38c410b1aa ipseckey: NULL pointer dereference fixed in error case 2013-03-25 17:02:45 +01:00
Tobias Brunner cf95d2926c Fixed some typos, courtesy of codespell 2013-03-25 10:59:37 +01:00
Andreas Steffen 9fa9f68d8d enforce singular of packets 2013-03-22 21:14:04 +01:00
Tobias Brunner 48d82a7dc7 asprintf(3) requires _GNU_SOURCE to be defined 2013-03-22 19:42:15 +01:00
Tobias Brunner 03237238b8 Check return value of asprintf(3) when converting AR identity 
Using chunk_t.ptr as target was also not optimal as it resulted in
a compiler warning.
 2013-03-22 11:34:16 +01:00
Andreas Steffen a1bc67d6c9 Switch encoding of AR Identity Value from binary to UTF-8 2013-03-22 10:37:49 +01:00
Martin Willi dd3c243844 Add a load-tester option to keep allocated external address until shutdown 2013-03-21 10:29:23 +01:00
Tobias Brunner 1a71178940 Avoid a race condition when reloading secrets from ipsec.secrets 
With the previous implementation that cleared the secrets in the active
credential set and then loaded the secrets, IKE SA establishment would
fail (as initiator or responder) if secrets are concurrently reloaded
and the required secret was not yet loaded.
 2013-03-20 15:27:34 +01:00
Martin Willi e2d2b542f1 Add an option to autobalance a HA cluster automatically 2013-03-19 16:54:20 +01:00