denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
17,442 Commits 1 Branch 0 Tags
7b15ecf82e544d26eaa767cf48f6a288288f7b8c
Commit Graph
2163 Commits
Author SHA1 Message Date
Martin Willi 33524f02f9 Check if for some reason we handle a HA segment on both nodes 2013-03-19 16:50:39 +01:00
Martin Willi 21f40fe891 Acquire HA segment lock while sending heartbeat 2013-03-19 16:50:39 +01:00
Tobias Brunner e8526ae991 Removed unused variable 'id' 2013-03-19 16:37:40 +01:00
Martin Willi 2071dd63d6 Fix scheduling of heartbeat sending in HA plugin 
e0efd7c1 switches to automated job rescheduling for HA heartbeat. However,
send_status() is initially called directly, which will not reschedule the job
as required.
 2013-03-19 15:48:27 +01:00
Martin Willi 5cf3afd1fa Fix compiler warning in HA plugin 2013-03-19 15:48:27 +01:00
Martin Willi 824864f4e0 Don't try to mmap() empty ipsec.secret files 2013-03-19 13:46:16 +01:00
Tobias Brunner e4013bb904 Added xauth-noauth plugin 
This XAuth backend does not do any authentication of client credentials
but simply sends a successful XAuth status to the client, thereby
concluding the XAuth exchange.  This can be useful to fallback to basic
RSA authentication with clients that can not be configured without XAuth
authentication.
 2013-03-19 11:23:03 +01:00
Martin Willi 41131528a9 In stroke counters, check if we have an IKE_SA before getting the name from it 
Fixes a segfault when receiving an invalid IKE SPI, where we don't have an
IKE_SA for the raised alert.
 2013-03-19 11:20:35 +01:00
Martin Willi a0f1c4cf29 Add an "esp" load-tester option to configure custom CHILD_SA ESP proposal 2013-03-18 14:30:21 +01:00
Tobias Brunner 6cf79c1e9d Algorithms are not really specific to an IKE version 
But not all of them can be used with IKEv1.

Fixes #314.
 2013-03-18 12:20:47 +01:00
Martin Willi d29246cabe Merge branch 'radius-ext' 
Bring some extensions to eap-radius, namely a virtual IP address provider based
on received Framed-IPs, forwarding of Cisco Unity banners, Interim Accounting
updates and the reporting of sent/received packets.
 2013-03-18 10:13:36 +01:00
Martin Willi 048872f2f7 Merge branch 'stroke-counters' 
Extend stroke counters functionality by connection specific counters, and
a resetcounters command to reset the global or connection counters.
 2013-03-18 10:12:22 +01:00
Martin Willi e85c0f6b84 Merge branch 'stroke-timeout' 
Add a strongswan.conf timeout option for stroke control commands.
 2013-03-18 10:11:46 +01:00
Martin Willi cf729248b2 Add a "resetcounters" command to ipsec, clearing global or connection counters 2013-03-15 10:55:22 +01:00
Martin Willi d022322bed Add connection name specific stroke counters 2013-03-15 10:41:04 +01:00
Martin Willi e813d218f1 Don't create interim update entries if RADIUS accounting is disabled 2013-03-14 16:44:09 +01:00
Martin Willi d019764ab6 Add support for RADIUS Interim accounting updates 2013-03-14 16:35:11 +01:00
Martin Willi 1ba1cd0c9b Add an option to delete any established IKE_SA if RADIUS server is not responding 2013-03-14 15:42:30 +01:00
Martin Willi 552b8ad5f5 Send Acct-Terminate-Cause based on some alerts catched on the bus 
Currently supported are user disconnects, session timeouts and if the peer does
not respond on IKE packets or DPDs.
 2013-03-14 14:20:55 +01:00
Martin Willi 68c12fd9f9 Send NAS-Port, NAS-IP and Calling/Called-Station-ID in Accounting-Requests 2013-03-14 14:20:54 +01:00
Martin Willi b4568ca230 Support RADIUS accounting of sent/received packets 2013-03-14 14:20:54 +01:00
Martin Willi d28391a244 Report the number of processed packets in "ipsec statusall" 2013-03-14 14:20:54 +01:00
Martin Willi d954a2081b child_sa_t.get_usestats() can additionally return the number of processed packets 2013-03-14 14:20:54 +01:00
Martin Willi 7eeeb1c702 kernel_ipsec_t.query_sa() additionally returns the number of processed packets 2013-03-14 14:20:54 +01:00
Martin Willi 003452d18f Send NAS-Port, NAS-IP and Calling/Called-Station-ID in Access-Request 2013-03-13 15:20:11 +01:00
Martin Willi 02bf38890d Forward Cisco Banner received from RADIUS to Unity capable clients 2013-03-12 20:37:35 +01:00
Martin Willi f4c8e6def7 In eap-radius, hand out received Framed-IP-Address attributes as virtual IP 2013-03-12 17:44:13 +01:00
Martin Willi d6b6d1ecdb Support mutliple subnets and ranges as external load-tester addresses 2013-03-11 15:16:13 +01:00
Martin Willi 5807f9cfcd Add a stroke command timeout option, and report status of completed command 2013-03-07 11:59:30 +01:00
Andreas Steffen 1a9dee5d22 instead of cloning use extract_buf() method 2013-03-04 23:21:21 +01:00
Tobias Brunner 11adf114c1 Fixed Doxygen comments after scanning complete src directory 2013-03-02 18:31:53 +01:00
Tobias Brunner 9804fccea3 Removed backend for old Android frontend patch 
Moved the remaining DNS handler to a new plugin.
 2013-03-02 18:27:23 +01:00
Martin Willi e82deaf6ce Merge branch 'multi-cert' 
Allows the configuration of multiple certificates in leftcert, and select
the correct certificate to use based on the received certificate requests.
 2013-03-01 11:35:32 +01:00
Martin Willi adf239abca Merge branch 'systime' 
Add a systime-fix plugin allowing an embedded system to validate certificates
if the system time has not been synchronized after boot. Certificates of
established tunnels can be re-validated after the system time gets valid.
 2013-03-01 11:33:47 +01:00
Martin Willi ec1b4e6638 Merge branch 'vip-shunts' 
Installs bypass policies for the physical address if a virtual address is
assigned, and installs a proper source route to actually use the physical
address for bypassed destinations.

Conflicts:
	src/libcharon/plugins/unity/unity_handler.c
 2013-03-01 11:30:13 +01:00
Martin Willi a36b49f3cb Merge branch 'opaque-ports' 
Adds a %opaque port option and support for port ranges in left/rightprotoport.
Currently not supported by any of our kernel backends.
 2013-03-01 11:27:12 +01:00
Martin Willi cd41b951ee Pass complete port range over stroke interface for more flexibility 2013-02-21 11:52:33 +01:00
Martin Willi a1db77de7c Use a complete port range in traffic_selector_create_from_{subnet,cidr} 2013-02-21 11:52:33 +01:00
Martin Willi 122b4b6e6d Include local address for Unity Split-Exclude shunt policies 
If we use a virtual IP, having a shunt policy for just that wouldn't work, as
we want a shunt bypass using the local address.
 2013-02-20 16:15:39 +01:00
Andreas Steffen 371b752f00 treat IF-M and IF-TNCCS remediation instructions/parameters in an equal way 2013-02-19 20:00:57 +01:00
Martin Willi 295e42a47f systime-fix disables certificate lifetime validation if system time not synced 
The system time can be periodically checked. If it gets valid, certificates get
rechecked with the current lifetime. If certificates are invalid, associated
IKE_SAs can be closed or reauthenticated.
 2013-02-19 17:11:14 +01:00
Martin Willi 0ed31e7284 Add a stub for systime-fix, a plugin handling certificate lifetimes gracefully 2013-02-19 14:49:38 +01:00
Andreas Steffen 65cdda5cf8 Streamlined log messages in ipseckey plugin 2013-02-19 12:25:00 +01:00
Reto Guadagnini 95650c0836 ipseckey: Report IPSECKEYs with invalid DNSSEC security state 2013-02-19 12:25:00 +01:00
Reto Guadagnini 932717fbde ipseckey: Added "enable" option for the IPSECKEY plugin to strongswan.conf 2013-02-19 12:25:00 +01:00
Reto Guadagnini a77bbc3b8c Added ipseckey plugin, which provides support for public keys in IPSECKEY RRs 2013-02-19 12:25:00 +01:00
Andreas Steffen c381e46855 added missing return statement 2013-02-19 10:24:23 +01:00
Andreas Steffen 0f7cb0caf4 reject PB-Experimental messages with NOSKIP flag set 2013-02-19 09:31:34 +01:00
Martin Willi b5b76df012 Add a timeout to clean up PDP RADIUS connections 2013-02-14 17:20:09 +01:00
Martin Willi dadd9744b6 Keep the PDP connections lock while accessing its objects 
When we introduce connection timeouts, the state may disappear at any time.
This change prevents that, but is not very clear. We probably have to refactor
connection handling.
 2013-02-14 17:19:56 +01:00