denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
6,646 Commits 1 Branch 0 Tags
adba3c695d511721bc62b43af49d2e3a93619ce9
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Martin Willi 21f411b861 Use a boolean expression for refcount check, fixes refcounting if bool is a signed char 2011-03-09 07:52:13 +01:00
Martin Willi 5f47296f22 Migrated sim_manager to INIT/METHOD macros 2011-03-08 16:42:27 +01:00
Martin Willi 7b3bfe4b6c Protect sim card/provider/hook (un-)registration with a rwlock 2011-03-08 16:42:27 +01:00
Martin Willi f58db72482 Splitted sim_manager.h header to sim_{card,provider,hooks}.h 2011-03-08 16:42:27 +01:00
Martin Willi 50110dfef8 Align netlink attributes properly if rta_len not a multiple of RTA_ALIGNTO 2011-03-02 16:07:38 +01:00
Martin Willi 007c47088c Implemented permanent certificate coupling plugin 2011-02-28 16:39:40 +01:00
Martin Willi 0d6d992589 Update duplicheck entry during IKE rekeying 2011-02-28 15:37:18 +00:00
Martin Willi b85be69079 Remove entry from active duplicate list only if it was not in checking 2011-02-28 15:37:18 +00:00
Martin Willi ee0f53e189 Added an example application listening to duplicheck notifications 2011-02-28 15:37:18 +00:00
Martin Willi 3883150779 Notify duplicate detections over a UNIX sockets to listening applications 2011-02-28 15:37:18 +00:00
Martin Willi 3e74ebbecc Added an advanced duplicate checking plugin with liveness check of old SA 2011-02-28 15:37:18 +00:00
Martin Willi 8ce567e69e Invert check to delete unestablished IKE_SAs to not delete them once established 2011-02-28 15:37:17 +00:00
Martin Willi 320e98c2ac Added whitelist plugin NEWS 2011-02-28 15:00:46 +01:00
Martin Willi c893bf7e5c Added a whitelist command line utility to control whitelist plugin 2011-02-28 15:00:46 +01:00
Martin Willi 53f2a7c712 Added a UNIX socket based control backend to whitelist plugin 2011-02-28 15:00:46 +01:00
Martin Willi 5e603aba4e Implemented a in-memory peer identity whitelist plugin 2011-02-28 15:00:46 +01:00
Martin Willi e44ebdcfc8 Slightly change IKE_SA destruction order to inherit properly during ike_rekey task destruction 2011-02-28 10:31:36 +00:00
Martin Willi d17304cd29 Added a pseudo EAP type to allow an implementation to select the real type dynamically 2011-02-22 16:09:45 +01:00
Martin Willi 07bda3feea Whitelisted another tzset variant and dlsym 2011-02-18 16:08:01 +01:00
Martin Willi e131f11779 Migrated kernel_pfroute_net to INIT/METHOD macros 2011-02-17 09:39:25 +00:00
Martin Willi 887abfb1e7 Migrated kernel_netlink_net to INIT/METHOD macros 2011-02-17 09:34:53 +00:00
Martin Willi caf20266e0 Fixed tnc-imc/imv library names when building monolithic 2011-02-08 11:22:02 +01:00
Martin Willi 234955d1ea Check for libxml when building tnccs_11, use autoconf libxml CFLAGS/LIBS 2011-02-08 11:11:01 +01:00
Martin Willi 91f8ce562d tnccs_11 does not link against libtls, just uses its headers 2011-02-08 11:09:27 +01:00
Martin Willi 6ccb23e80b Whitespace cleanups in tnc code 2011-02-08 11:03:10 +01:00
Martin Willi c6c7c7001c Add a prefix to the global visible tnc names to avoid name clashes, move to tncifimv 2011-02-08 11:03:10 +01:00
Martin Willi 3683c0424f Fixed compiler warning 2011-02-08 11:03:10 +01:00
Martin Willi 3af88e4657 tnccs_11 does not link to libtnc anymore 2011-02-08 11:03:10 +01:00
Martin Willi 10a6019ec6 Implement correct signature for pb_tnc_msg->process() 2011-02-08 10:57:41 +01:00
Martin Willi 11a6f29944 Fixed doxygen groups in libcharon tnc subtree 2011-02-08 10:57:41 +01:00
Martin Willi 6cc11bccd1 Fixed various doxygen errors in tnc plugins 2011-02-08 10:57:40 +01:00
Martin Willi 0700c153e7 Fixed function parameter description 2011-02-08 10:14:56 +01:00
Martin Willi 94030a670b Report correct key size if a cipher is not supported 2011-02-07 16:39:33 +01:00
Martin Willi 7e0eae4985 Replace hashtable key if a put operation replaces value 
Fixes a crash if lifetime of key is bound to value (i.e. key == value)
 2011-02-03 17:09:09 +01:00
Martin Willi bf3e482141 Fix check to increase hashtable size properly 2011-02-03 17:08:53 +01:00
Martin Willi b49d047bfc Invoke the per-round authorize() hook before purging current auth info on IKE_SA 2011-02-03 17:08:39 +01:00
Martin Willi 4536e669a8 Filter out non-matching ike_cfg in backend manager, so backends don't have to 2011-02-03 10:12:16 +01:00
Martin Willi 2b7686b5d8 Migrated ike_auth to INIT/METHOD macros, fixes missing initial_contact initialization 2011-02-02 15:13:39 +01:00
Martin Willi fe79cd4257 Accept non-encrypted INFORMATIONALs for ME connectivity checks 2011-02-01 09:47:36 +01:00
Martin Willi 1d34612f07 Do not use destroyed rng/hasher if IKE_SA has been flush()ed 2011-02-01 09:25:55 +01:00
Martin Willi a846bf06e8 Add missing AUTH_RULE for trusted self-signed peer certificates 2011-02-01 09:25:10 +01:00
Martin Willi 5c89a00f05 Do not log potentially hundreds of cert requests for unknown CAs at level 1 2011-01-28 08:29:23 +01:00
Martin Willi 60b71def1a Use wrapped threading functions in ha plugin 2011-01-20 15:52:29 +01:00
Martin Willi 44b6b8f9d5 Load load-tester plugin before kernel interfaces, fixes fake_kernel option 2011-01-19 16:43:00 +01:00
Martin Willi 8118707845 Increase tls_writer buffer by at least 4 bytes 2011-01-19 14:41:59 +01:00
Martin Willi 7cfa84f540 Whitelist gnutls init function 2011-01-17 18:20:12 +01:00
Martin Willi 2ca52c8048 Implemented an alternative HTTP fetcher based on libsoup 2011-01-17 18:20:06 +01:00
Martin Willi a8a7a31700 Added simple fetcher tool to test fetcher implementations 2011-01-17 18:19:59 +01:00
Martin Willi b94feb4b05 backtrace->contains_function takes multiple names, speeding up whitelist check drastically 2011-01-17 18:19:44 +01:00
Martin Willi ec8426a349 Add some common glib non-leaks to whitelist 2011-01-17 18:19:36 +01:00
Martin Willi c4048cd61f Add missing va_end to va_start in curl_fetcher 2011-01-17 18:19:17 +01:00
Martin Willi d27a8e5011 Do not pass an enum type to va_arg 2011-01-17 18:18:58 +01:00
Martin Willi ff5538e5c0 Use newer Linux capability native API, if available 2011-01-17 18:18:21 +01:00
Martin Willi 2b52d5cb41 Do not install config files with user/group, as it might not exist on build machine 2011-01-17 18:08:17 +01:00
Martin Willi 64e06d4f8f Compare ending address in ts->equals, fixes redundant traffic selector elimination 2011-01-14 13:24:08 +01:00
Martin Willi 983a5e88d3 Revert "Send INITIAL_CONTACT even if we have a unique policy" 
It makes sense to omit INITIAL_CONTACT if don't have a unique policy,
as a client might want to connect from different devices to the same
account.

This reverts commit 719c33b41a.
 2011-01-13 10:50:46 +01:00
Martin Willi 9bac426bf3 Fixed memory cleanup if no DHCP transaction found for an OFFER 2011-01-13 10:36:16 +01:00
Martin Willi 2082417df3 Force port update as responder when initiator switches to 4500 in IKE_AUTH 2011-01-12 14:37:15 +01:00
Martin Willi 8ba805f4db Avoid variable name overloading 2011-01-12 14:37:09 +01:00
Martin Willi 719c33b41a Send INITIAL_CONTACT even if we have a unique policy 2011-01-10 11:54:10 +01:00
Martin Willi 96c4addcbd Added NEWS for ipsec.conf certpolicy and key strength options 2011-01-07 15:51:35 +01:00
Martin Willi 44e513a320 Added support for trustchain key strength checking to rightauth option 2011-01-07 15:51:35 +01:00
Martin Willi 6367de28ad Added a left/rightcertpolicy keyword to specify certificatePolicy requirements 2011-01-07 15:51:35 +01:00
Martin Willi 1ed482d808 Fix nonce comparison in rekey collisions, lowest nonce loses 2011-01-07 15:51:35 +01:00
Martin Willi fb1e7df13f Added delta CRL NEWS 2011-01-05 18:20:11 +01:00
Martin Willi 77eee25f5a Added constraints plugin NEWS 2011-01-05 18:15:44 +01:00
Martin Willi f078346476 Added conftest NEWS 2011-01-05 18:09:49 +01:00
Martin Willi 41ed02940e Added NEWS about INITIAL_CONTACT support 2011-01-05 18:05:09 +01:00
Martin Willi 6f5892f5c7 Destroy existing IKE_SAs with same identities when receiving INITIAL_CONTACT 2011-01-05 16:46:08 +01:00
Martin Willi a4a1e24d37 Send INITIAL_CONTACT for the first IKE_SA if it has a unique policy 2011-01-05 16:46:08 +01:00
Martin Willi 240bd7dbb7 Migrated ike_sa_manager_t to INIT/METHOD macros, some cleanups 2011-01-05 16:46:08 +01:00
Martin Willi 5b0e6c593a Added option to use a different key when rebuilding AUTH 2011-01-05 16:46:07 +01:00
Martin Willi 7721fc6695 Do not print empty DN identities as invalid 2011-01-05 16:46:07 +01:00
Martin Willi 3fd3f8dea8 Added support for empty subjects DNs to pki --issue 2011-01-05 16:46:07 +01:00
Martin Willi 97d30f0010 Added support for OCSP responder URIs to conftest 2011-01-05 16:46:07 +01:00
Martin Willi 7b3740d958 Added support for delta CRL checking to revocation plugin 2011-01-05 16:46:07 +01:00
Martin Willi 0110c26a04 Use incremented serial of base CRL when signing delta CRL 2011-01-05 16:46:06 +01:00
Martin Willi 2e90006f96 Show base CRL of delta CRLs in listcrls 2011-01-05 16:46:06 +01:00
Martin Willi 76cfaf13c1 Verify trustchain for each candidate certificate only once 2011-01-05 16:46:06 +01:00
Martin Willi 3a89b3c52f Provide CRLs received in CERT payloads to trustchain verification 2011-01-05 16:46:06 +01:00
Martin Willi 1a79d76abc Added an AUTH_HELPER for revocation certificates 2011-01-05 16:46:06 +01:00
Martin Willi 968e5e665b Added support for CDPs to conftest 2011-01-05 16:46:06 +01:00
Martin Willi 85b9e9be99 Added CDP support to mem_cred 2011-01-05 16:46:06 +01:00
Martin Willi d3a18dade1 Check for issuer only if we actually got a CRL 2011-01-05 16:46:06 +01:00
Martin Willi 06e6535151 Updated conftest README 2011-01-05 16:46:06 +01:00
Martin Willi dbec133eb8 Added support for custom file loggers, loglevel settings 2011-01-05 16:46:06 +01:00
Martin Willi c5f213cc0f Check inhibitAnyPolicy in constraints plugin 2011-01-05 16:46:05 +01:00
Martin Willi b088fd4a76 Slightly renamed different policyConstraints to distinguish them better 2011-01-05 16:46:05 +01:00
Martin Willi 6a339fffc7 Added inhibitAnyPolicy constraint support to pki tool 2011-01-05 16:46:05 +01:00
Martin Willi 07eee80401 Added support for inhibitAnyPolicy constraint to x509 plugin 2011-01-05 16:46:05 +01:00
Martin Willi b3d359e58f Use a generic getter for all numerical X.509 constraints 2011-01-05 16:46:05 +01:00
Martin Willi b1703d6cb3 Check inhibitPolicyMapping in constraints plugin 2011-01-05 16:46:05 +01:00
Martin Willi 927120a128 Check requireExplicitPolicy in constraints plugin 2011-01-05 16:46:04 +01:00
Martin Willi 8469625fdc Include subject cert to temporary auth info before completing trustchain 2011-01-05 16:46:04 +01:00
Martin Willi 5eae41c6d8 Fail silently when trying to convert IPv6 address to v4 family host 2011-01-05 16:46:04 +01:00
Martin Willi 6aba6ff061 Pass an additional anchor flag to validate() hook if we reach the root CA 2011-01-05 16:46:04 +01:00
Martin Willi 09e319d419 Always pass auth info to validate(), use pathlen to check for user certificate 2011-01-05 16:46:04 +01:00
Martin Willi 98ef286580 Merge test config into suite config, instead of having two distinct configs 2011-01-05 16:46:04 +01:00
Martin Willi de8521f6f2 Added support for delta CRLs to pki tool 2011-01-05 16:46:04 +01:00
Martin Willi 55e4d8982f Added support for delta CRLs to x509 plugin 2011-01-05 16:46:03 +01:00