denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
11,325 Commits 1 Branch 0 Tags
8fbfe03e4e8694178df4486aa366701a6dc21d19
Commit Graph
11325 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Andreas Steffen 8fbfe03e4e Ignore non-matching protocols 2013-06-21 23:25:25 +02:00
Andreas Steffen e5dd8a1d34 Introduced workitems to Scanner IMV 2013-06-21 23:25:24 +02:00
Andreas Steffen adf8a05a3d Removed obsoleted strongswan.conf options 2013-06-21 23:25:24 +02:00
Andreas Steffen da99df1443 Added ITA components to database 2013-06-21 23:25:24 +02:00
Andreas Steffen 10bb71261c Added soft dependency on database plugin 2013-06-21 23:25:24 +02:00
Andreas Steffen a2e30d601a fixed SQL query 2013-06-21 23:25:24 +02:00
Andreas Steffen 4cf568a785 Shortened names of default policy groups 2013-06-21 23:25:24 +02:00
Andreas Steffen 19ce03be73 Store device with product ID 2013-06-21 23:25:24 +02:00
Andreas Steffen bf250acb06 Database changes needed to integrate Cygnet backend 2013-06-21 23:25:24 +02:00
Andreas Steffen 01afff71cb Implemented get|set_action_flag() methods 2013-06-21 23:25:24 +02:00
Andreas Steffen a45a2c9291 Implemented hierarchical policy groups 2013-06-21 23:25:24 +02:00
Andreas Steffen b1da8368d0 Introduced workitems to Attestation IMV 2013-06-21 23:25:23 +02:00
Andreas Steffen 7e9bdd20aa pts_meas_algo_probe() and pts_dh_group_probe() got lost 2013-06-21 23:25:23 +02:00
Andreas Steffen c174c116fe Converted all IMVs to use generic IF-IMV API 2013-06-21 23:25:23 +02:00
Andreas Steffen ea2663ec03 Remove the constructor from the IMV agent interface 2013-06-21 23:25:23 +02:00
Andreas Steffen 97f0a7ea77 Defined a generic IMV agent interface 2013-06-21 23:25:23 +02:00
Andreas Steffen 7513a09ee5 Moved all functionality into imv_os_agent_t class turning imv_os_t into an IF-IMV skeleton 2013-06-21 23:25:23 +02:00
Andreas Steffen 99c6a5f8a4 Moved batch_ending into separate source file 2013-06-21 23:25:23 +02:00
Andreas Steffen e1db511bbd do not process workitems with NULL result 2013-06-21 23:25:23 +02:00
Andreas Steffen c219d7e31f fixed enumeration of workitems for a given session 2013-06-21 23:25:23 +02:00
Andreas Steffen 65148217b0 generate workitems based on group policy 2013-06-21 23:25:23 +02:00
Andreas Steffen 0fca778254 Added file and directory reference measurements to workitems 2013-06-21 23:25:22 +02:00
Andreas Steffen 2964562199 add overall recommendation to session database entry 2013-06-21 23:25:22 +02:00
Andreas Steffen 4f6bf1a843 don't define a default database URI 2013-06-21 23:25:22 +02:00
Andreas Steffen 1ecff25917 created a simple IMV Policy Manager 2013-06-21 23:25:22 +02:00
Andreas Steffen 1571a11fa4 register received scanner attributes 2013-06-21 23:25:22 +02:00
Andreas Steffen 9d63ad17d4 used tnc_policy_update functions for default policy 2013-06-21 23:25:22 +02:00
Andreas Steffen a6266485be refactored IMV policy management 2013-06-21 23:25:22 +02:00
Andreas Steffen 4f9aabbfd7 implemented policy rules for OS IMV 2013-06-21 23:25:22 +02:00
Andreas Steffen 7daf6d8cc5 check for zero-length device ID 2013-06-21 23:25:22 +02:00
Andreas Steffen 033834719d ITA-HSR/Device ID attribute & IMV OS state machine 2013-06-21 23:25:22 +02:00
Andreas Steffen bb9d8b1853 execute an _imv_policy script 2013-06-21 23:25:22 +02:00
Andreas Steffen b8db66de15 implemented IMV session control 2013-06-21 23:25:21 +02:00
Andreas Steffen 1f179c63b3 Manage files and directories 2013-06-21 23:25:21 +02:00
Tobias Brunner b61c78d3c2 Merge branch 'kernel-libipsec' 
Adds a new kernel interface plugin that uses TUN devices and libipsec to
provide IPsec process in userland.

It works on Linux, FreeBSD and Mac OS X.  In particular the latter two
platforms may gain from this approach as their respective kernels don't
provide support for AES-GCM.

kernel-pfroute has been improved (source address lookup) and a second
plugin (osx-attr) installs configuration attributes (currently DNS
servers only) via SystemConfiguration on Mac OS X.
 2013-06-21 17:07:41 +02:00
Martin Willi 45dcf4df57 osx-attr: add plugin installing config attributes using SystemConfiguration 
Currently installs DNS servers only, by prepending IP addresses to the
DNS configuration of the primary networking service.
 2013-06-21 17:03:22 +02:00
Tobias Brunner 12488efa78 kernel-pfroute: Simplify route lookup after fixing sockaddr parsing 2013-06-21 17:03:22 +02:00
Tobias Brunner 4b3fea3d54 kernel-pfroute: Alignment of sockaddrs is not always the same 2013-06-21 17:03:22 +02:00
Tobias Brunner aa33d2e6eb kernel-pfroute: struct sockaddr arguments are 4 byte aligned 
This was noticed on Mac OS X where, if the default route is returned,
RTA_NETMASK has sa_len set to 0, but skipping zero bytes to read the
next address makes no sense, of course.  Using 0 for sa_len seems
a bit strange, in particular, because struct sockaddr has by definition
a minimum length of 16 bytes.  But it seems FreeBSD actually does the
same.
 2013-06-21 17:03:22 +02:00
Tobias Brunner 23ea59a95c kernel-libipsec: Ignore failures when installing routes for multicast or broadcast policies 2013-06-21 17:03:22 +02:00
Tobias Brunner b0629f7d9b kernel-pfroute: Improve route lookup depending on information we get back 
Kernels don't provide the same information for all routes.
 2013-06-21 17:03:22 +02:00
Tobias Brunner 1c697ff1c5 kernel-pfroute: Try to ensure we get a source address or interface name 2013-06-21 17:03:22 +02:00
Tobias Brunner 01955eec71 ike: Force NAT-T/UDP encapsulation if kernel interface requires it 2013-06-21 17:03:21 +02:00
Tobias Brunner 35fe41f7d0 kernel-libipsec: Add a feature to request UDP encapsulation of ESP packets 2013-06-21 17:03:21 +02:00
Tobias Brunner 66aaabf342 tun-device: Packets sent over utun devices on Mac OS X have the protocol family prepended 2013-06-21 17:03:21 +02:00
Tobias Brunner 34b0ad0653 kernel-pfroute: Use DST as nexthop for host routes 
These are created as cache/clone on Mac OS X.
 2013-06-21 17:03:21 +02:00
Tobias Brunner d6c17e96b2 kernel-pfroute: Implement get_source_addr() 2013-06-21 17:03:21 +02:00
Tobias Brunner f58f8bf409 kernel-pfroute: Properly install routes with interface and gateway 2013-06-21 17:03:21 +02:00
Tobias Brunner 1f31a2bc2e kernel-libipsec: Install a gateway for routes on platforms other than Linux 
This seems required e.g. on FreeBSD but doesn't work on Linux.
 2013-06-21 17:03:21 +02:00
Tobias Brunner 93e4df3761 kernel-pfroute: Activate TUN device before setting address 
On FreeBSD, for some reason, we don't learn the interface is up
otherwise.  Even though ifconfig lists it as up at the same time.
 2013-06-21 17:03:21 +02:00