denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
11,352 Commits 1 Branch 0 Tags
9da5a2ed1e72d1b68feefd5811a089d0881dd87d
Commit Graph
250 Commits
Author SHA1 Message Date
Tobias Brunner 1091edede8 capabilities: CAP_CHOWN might be required by many plugins opening UNIX sockets 
But as the sockets will be created with the user/group of the running
process this might not be required as no change may be needed.
 2013-06-25 17:16:33 +02:00
Tobias Brunner a2eb581781 capabilities: Move global capabilities_t instance to libstrongswan 2013-06-25 17:16:32 +02:00
Martin Willi 483a258ad8 stroke: support %dynamic in left/rightsubnet for dynamic selectors 
This has the same meaning as omitting left/rightsubnet, i.e. replace it
by the IKE address. Supporting %dynamic allows configurations with multiple
dynamic selectors in a left/rightsubnet, each with potentially different
proto/port selectors.
 2013-06-19 16:36:01 +02:00
Martin Willi 4a7c29bf02 stroke: support a specific proto/port for each net defined in left/rightsubnet 2013-06-19 16:36:01 +02:00
Martin Willi de2debf8e0 stroke: add exportconn{cert,chain} commands in addition to exportx509 
The new commands either export a single end entity certificate or the
full trust chain for a specific connection name.
 2013-06-19 16:27:19 +02:00
Tobias Brunner 49d7a98f47 Refactored plugin-loader with improved dependency resolution 
With the new implementation the plugins don't have to be listed in any
special order, dependencies are properly resolved.  The order only
matters if two plugins provide the same feature.
 2013-06-11 11:18:19 +02:00
Tobias Brunner 6040eff900 stroke: Add second password if provided 2013-05-08 15:02:41 +02:00
Tobias Brunner 1c080407b2 stroke: Fail silently if another builder calls PW callback after giving up 
Also reduced the number of tries to 3.
 2013-05-08 15:02:41 +02:00
Tobias Brunner 4a64c3e9a0 stroke: Cache passwords so the user is not prompted multiple times for the same password 
To verify/decrypt a PKCS#12 container a password might be needed
multiple times.  If it was entered correctly we don't want to bother the
user again with another password prompt.
The passwords for MAC creation and encryption could be different so the
user might be prompted multiple times after all.
 2013-05-08 15:02:41 +02:00
Tobias Brunner e240b03e68 stroke: Fix prompt and error messages in passphrase callback 2013-05-08 15:02:41 +02:00
Tobias Brunner 7971278c92 stroke: Load credentials from PKCS#12 files (P12 token) 2013-05-08 15:02:41 +02:00
Tobias Brunner 87692be215 Load any type (RSA/ECDSA) of public key via left|rightsigkey 2013-05-07 17:08:31 +02:00
Tobias Brunner fa1d3d39dc left|rightrsasigkey accepts SSH keys but the key format has to be specified explicitly 
The default is now PKCS#1. With the dns: and ssh: prefixes other formats
can be selected.
 2013-05-07 15:38:28 +02:00
Tobias Brunner c0bbddfa42 Try to load raw keys from ipsec.conf as PKCS#1 blob first 
The DNSKEY builder is quite eager and parses pretty much anything
as RSA key, so this has to be done before.
 2013-05-07 14:08:51 +02:00
Martin Willi 7f4f1e8249 List all stroke counters when "all" is given, and report if connection not known 2013-04-03 14:58:08 +02:00
Tobias Brunner eca499f3d9 Load raw keys before possibly destroying the identity 
If no identity (or %any) is configured the identification_t object is
destroyed and an invalid object was associated with the created pubkey
certificate.
Actually using %any does not work as the certificate would not match
when the client later provides an identity.
 2013-04-01 13:48:34 +02:00
Andreas Steffen 9fa9f68d8d enforce singular of packets 2013-03-22 21:14:04 +01:00
Tobias Brunner 1a71178940 Avoid a race condition when reloading secrets from ipsec.secrets 
With the previous implementation that cleared the secrets in the active
credential set and then loaded the secrets, IKE SA establishment would
fail (as initiator or responder) if secrets are concurrently reloaded
and the required secret was not yet loaded.
 2013-03-20 15:27:34 +01:00
Martin Willi 824864f4e0 Don't try to mmap() empty ipsec.secret files 2013-03-19 13:46:16 +01:00
Martin Willi 41131528a9 In stroke counters, check if we have an IKE_SA before getting the name from it 
Fixes a segfault when receiving an invalid IKE SPI, where we don't have an
IKE_SA for the raised alert.
 2013-03-19 11:20:35 +01:00
Tobias Brunner 6cf79c1e9d Algorithms are not really specific to an IKE version 
But not all of them can be used with IKEv1.

Fixes #314.
 2013-03-18 12:20:47 +01:00
Martin Willi d29246cabe Merge branch 'radius-ext' 
Bring some extensions to eap-radius, namely a virtual IP address provider based
on received Framed-IPs, forwarding of Cisco Unity banners, Interim Accounting
updates and the reporting of sent/received packets.
 2013-03-18 10:13:36 +01:00
Martin Willi 048872f2f7 Merge branch 'stroke-counters' 
Extend stroke counters functionality by connection specific counters, and
a resetcounters command to reset the global or connection counters.
 2013-03-18 10:12:22 +01:00
Martin Willi e85c0f6b84 Merge branch 'stroke-timeout' 
Add a strongswan.conf timeout option for stroke control commands.
 2013-03-18 10:11:46 +01:00
Martin Willi cf729248b2 Add a "resetcounters" command to ipsec, clearing global or connection counters 2013-03-15 10:55:22 +01:00
Martin Willi d022322bed Add connection name specific stroke counters 2013-03-15 10:41:04 +01:00
Martin Willi d28391a244 Report the number of processed packets in "ipsec statusall" 2013-03-14 14:20:54 +01:00
Martin Willi d954a2081b child_sa_t.get_usestats() can additionally return the number of processed packets 2013-03-14 14:20:54 +01:00
Martin Willi 5807f9cfcd Add a stroke command timeout option, and report status of completed command 2013-03-07 11:59:30 +01:00
Martin Willi e82deaf6ce Merge branch 'multi-cert' 
Allows the configuration of multiple certificates in leftcert, and select
the correct certificate to use based on the received certificate requests.
 2013-03-01 11:35:32 +01:00
Martin Willi a36b49f3cb Merge branch 'opaque-ports' 
Adds a %opaque port option and support for port ranges in left/rightprotoport.
Currently not supported by any of our kernel backends.
 2013-03-01 11:27:12 +01:00
Martin Willi cd41b951ee Pass complete port range over stroke interface for more flexibility 2013-02-21 11:52:33 +01:00
Martin Willi a1db77de7c Use a complete port range in traffic_selector_create_from_{subnet,cidr} 2013-02-21 11:52:33 +01:00
Martin Willi e212033ef2 Merge branch 'ike-dscp' 2013-02-14 17:11:35 +01:00
Tobias Brunner 96a2d2077b Fix 'stroke loglevel any' 
Before b46a5cd4 this worked if debug_t was unsigned.  In that case -1,
as returned by enum_from_name(), would result in a large positive number.
So any unknown debug group (including 'any') had the same effect that
was only intended for 'any'.
 2013-02-13 12:18:20 +01:00
Martin Willi 7fbe516f88 Add a ikedscp ipsec.conf option to set DSCP value on outgoing IKE packets 2013-02-06 15:36:36 +01:00
Martin Willi 306a269e34 Add a DSCP configuration value to IKE configs 2013-02-06 15:20:32 +01:00
Tobias Brunner 9ccfeb8ca1 Use proper buffer sizes for parse_smartcard() 2013-01-24 23:35:42 +01:00
Martin Willi 78af36db50 Load multiple comma seperarated certificates in the leftcert option 2013-01-18 09:33:15 +01:00
Martin Willi c4a49008e8 Don't handle right=%any6 as "loose" identity, but as %any 2013-01-14 10:33:14 +01:00
Tobias Brunner 21235e1ec2 Merge branch 'ikev1-fragmentation' 
This adds support for the proprietary IKEv1 fragmentation extension.

Conflicts:
	NEWS
 2013-01-12 11:58:26 +01:00
Volker Rümelin 10eee5fcba Fixed some typos in comments 2013-01-11 10:21:51 +01:00
Tobias Brunner 97973f8609 Use a connection specific option to en-/disable IKEv1 fragmentation 2012-12-24 13:00:01 +01:00
Tobias Brunner 12642a6831 Moved data structures to new collections subfolder 2012-10-24 16:00:49 +02:00
Martin Willi 1efd6c6f2a Make use of new CIDR string ts constructor where appropriate 2012-10-24 13:25:08 +02:00
Martin Willi 4ce55ffb0b Use explicit, larger buffer sizes for smartcard keyids and modules 2012-10-24 13:07:53 +02:00
Martin Willi 794d713dca Support loading cacert certificates in ipsec.conf ca sections from smartcard 2012-10-24 13:07:53 +02:00
Martin Willi 2abe404927 Refactored stroke smartcard token parsing, support module and slot in leftcert option 2012-10-24 13:07:53 +02:00
Martin Willi 9687cb5100 Load ipsec.conf %smartcard leftcerts with pkcs11 builder 2012-10-24 13:07:52 +02:00
Martin Willi 0c4b9f7cda Add a "ipsec listcounters" command to stroke 2012-10-24 11:34:31 +02:00