denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
13,002 Commits 1 Branch 0 Tags
b50d486e78a387bc06f7f60d5e74dd08d48ea9a7
Commit Graph
2741 Commits
Author SHA1 Message Date
Martin Willi b50d486e78 kernel-wfp: Add some notes about query_sa/policy() support 2014-06-04 16:32:06 +02:00
Martin Willi f351d9ef7d kernel-wfp: Reference SA/SP sets by SPI and destination, not reqid 
This allows us to have multiple CHILD_SAs for the same reqid, and brings
rekeying support.
 2014-06-04 16:32:06 +02:00
Martin Willi 4a8b85684f kernel-wfp: Add support for tunnel mode connections 2014-06-04 16:32:06 +02:00
Martin Willi f5ddda7f57 kernel-wfp: Register a WFP provider to manage IPsec tunnels 2014-06-04 16:32:06 +02:00
Martin Willi 149fc48e03 kernel-wfp: Preliminary support for transport mode connections 2014-06-04 16:32:06 +02:00
Martin Willi b1ba0a666c kernel-wfp: Fix/Complete some fwpuclnt functionality in MinGW 
While MinGW declares all the required symbols, some of them are missing in the
library files. We provide missing variables locally, functions get a stub
that call the GetProcAddress()ed function from the DLL.

Also some MinGW headers define some enum values incorrectly, we overload these
using defines.
 2014-06-04 16:32:06 +02:00
Martin Willi ebb9362d85 kernel-wfp: Open and close a WFP engine 2014-06-04 16:32:06 +02:00
Martin Willi 96ab7a8022 kernel-wfp: Create userland state for SAs/policies to install in kernel 2014-06-04 16:32:06 +02:00
Martin Willi 8d91eee3fc kernel-wfp: Add a stub for a Windows Filtering Platform based IPsec backend 2014-06-04 16:32:05 +02:00
Martin Willi fb0b539084 socket-win: Implement a Windows socket plugin using Winsock2 2014-06-04 16:31:09 +02:00
Martin Willi dfb23fa159 vici: Add Windows support 2014-06-04 15:53:12 +02:00
Martin Willi 55c2b47a90 file-logger: Emulate setlinebuf() if not supported by using fflush() 2014-06-04 15:53:09 +02:00
Martin Willi ee2498e3d6 bus: Build syslog logger depending on syslog() availability 2014-06-04 15:53:05 +02:00
Martin Willi 87b43dd8b0 libcharon: Link against Winsock2 on Windows 2014-06-04 15:53:04 +02:00
Martin Willi b9dca7057c filelog: Ignore flush_line option if setlinebuf() not supported 2014-06-04 15:53:04 +02:00
Martin Willi 87664d92ca controller: Remove unused <dlfcn.h> include 2014-06-04 15:53:03 +02:00
Martin Willi c6503d451a charon: Don't use syslog() if not supported 2014-06-04 15:53:03 +02:00
Martin Willi d1eff687cf encoding: Don't explicitly include <arpa/inet.h> 2014-06-04 15:53:03 +02:00
Martin Willi 3ecfc83c6b payload: Use common prefixes for all payload type identifiers 
The old identifiers did not use a proper namespace and often clashed with
other defines.
 2014-06-04 15:53:03 +02:00
Martin Willi 4163421f91 plugins: Don't link with -rdynamic on Windows 2014-06-04 15:53:02 +02:00
Andreas Steffen 59db666094 Detect RADIUS packet retransmissions 2014-05-31 20:37:57 +02:00
Martin Willi b9dd46d8a9 peer-cfg: Add missing UNIQUE_NEVER to unique_policy_names 2014-05-19 18:05:51 +02:00
Martin Willi 2f893f278d proposal: Don't return a default IKE proposal without encryption/AEAD algs 2014-05-16 16:51:19 +02:00
Martin Willi 8d74ec9e80 ike: Add an additional but separate AEAD proposal to CHILD config 
This currently has no effect: We don't include AEAD algorithms in the default
ESP proposal, as we don't know if it is supported by the backend. But as we
hopefully get an algorithm query mechanism on kernel interfaces some day, we
add the appropriate functionality nonetheless.
 2014-05-16 16:51:19 +02:00
Martin Willi 879e3d12ca ike: Add an additional but separate AEAD proposal to IKE config, if supported 2014-05-16 16:51:19 +02:00
Martin Willi 356846db5d child-cfg: Allow passing NULL as proposal to add_proposal() 
Making the API consistent to the one of ike_cfg.
 2014-05-16 16:01:21 +02:00
Martin Willi 3312c447ef ike-cfg: Allow passing NULL to add_proposal() 
This simplifies adding default proposals with constructors potentially
returning NULL.
 2014-05-16 16:01:21 +02:00
Martin Willi 8642f8bdb7 proposal: Use an additional "default" constructor specific to AEAD algorithms 
This allows a caller to create a separated proposal for supported AEAD
algorithms, as required by RFC 5996.
 2014-05-16 16:01:21 +02:00
Martin Willi 0fc4dd429d proposal: Don't include AEAD algorithms in the default proposal 
According to RFC 5996 3.3 we should use a separate proposal for AEAD algorithms.
This was not clear in RFC 5282, hence we previously included both AEAD and
non-AEAD algorithms in a single proposal.
 2014-05-16 16:01:21 +02:00
Martin Willi 064fe9c963 enum: Return boolean result for enum_from_name() lookup 
Handling the result for enum_from_name() is difficult, as checking for
negative return values requires a cast if the enum type is unsigned. The new
signature clearly differentiates lookup result from lookup value.

Further, this actually allows to convert real -1 enum values, which could not
be distinguished from "not-found" and the -1 return value.

This also fixes several clang warnings where enums are unsigned.
 2014-05-16 15:42:07 +02:00
Martin Willi f5bbbd480c xauth-pam: Fix header include guard 2014-05-16 15:42:07 +02:00
Martin Willi 2cf5e97dd2 eap-peap: Remove dead SoH code from PEAP 
clang complains about the unused variables.
 2014-05-16 15:42:07 +02:00
Martin Willi 80b56fb468 vici: Support the close_action keyword, as we have it documented 2014-05-14 16:26:53 +02:00
Martin Willi cdc42256b0 ikev1: Fix debugging log when remote traffic selector selection fails 2014-05-14 10:01:57 +02:00
Andreas Steffen 8d59090349 Implemented PT-EAP protocol (RFC 7171) 2014-05-12 06:59:21 +02:00
Martin Willi b1b01840b6 child-sa: Reclaim old state if SA updating is not supported 
If the state stays at UPDATING, the fallback using IKEv1 rekeying fails as
the task manager refuses to rekey a CHILD_SA in non-INSTALLED state.
 2014-05-09 08:49:08 +02:00
Martin Willi 4c56c4621b libcharon: Execute scripts defined in strongswan.conf during startup/shutdown 2014-05-07 15:47:23 +02:00
Martin Willi 1e4ee168c8 vici: Check if header has been received before processing an empty message 
If do_read() returns with EWOULDBLOCK, we must ensure that we actually have
processed the full length header before checking the zero-initialized buffer
length.
 2014-05-07 14:13:39 +02:00
Martin Willi afb7ef4908 vici: Properly filter by CHILD_SA name while undoing start actions 2014-05-07 14:13:39 +02:00
Martin Willi 682c9966fa vici: Fallback to socket listening port if no explicit local port specified 2014-05-07 14:13:39 +02:00
Martin Willi dffd60083d vici: Support a "mtu" value for the tfc_padding option 2014-05-07 14:13:39 +02:00
Martin Willi 5619d40613 vici: Handle the "trap" action as an alias for "route" 2014-05-07 14:13:39 +02:00
Martin Willi e0a34ee459 vici: Document errno values to expect from libvici API 2014-05-07 14:13:39 +02:00
Martin Willi c2b6402eb0 vici: Log owners of a just loaded shared-secret 2014-05-07 14:13:39 +02:00
Martin Willi 41745e24f3 vici: Handle "xauth" as an alias for "eap" secrets 2014-05-07 14:13:38 +02:00
Martin Willi bc006ac1f4 vici: Return number of matching and closed SAs in terminate command 2014-05-07 14:13:38 +02:00
Martin Willi 021a14b7a4 vici: Complete libvici doxygen comments 2014-05-07 14:13:38 +02:00
Martin Willi 374511c52c vici: Ensure we have no active users before mangling event client registrations 2014-05-07 14:13:38 +02:00
Martin Willi 65cc8f5581 vici: Properly skip raise_event() for unknown event names 2014-05-07 14:13:38 +02:00
Martin Willi 3a9a46c20f vici: Increase vici message length header from 16 to 32 bits 
While we currently have no need for messages larger than 65KB, we should design
the protocol to be future-proof, as we plan to keep at least to lowest protocol
layer stable.

To avoid any allocation issues, we currently keep the message size limit at
512KB.
 2014-05-07 14:13:38 +02:00