denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
19,433 Commits 1 Branch 0 Tags
b6a4cfc70565e8f08f48767e7dee7ce2fb4d17b2
Commit Graph
106 Commits
Author SHA1 Message Date
Tobias Brunner c5b2a8eaa3 child-cfg: Use separate method to get configured traffic selectors 
Optionally with "dynamic" traffic selectors resolved.  A new method
is added for those cases where we actually want to select potentially
narrowed traffic selectors using a supplied list.  The latter now also
always logs details, while the former does not.
 2025-05-28 10:01:19 +02:00
Tobias Brunner 6ed63be612 peer-cfg: Use flags for boolean options 
Makes it potentially easier to add new flags.

The mediation flag is not converted as the #ifdefs make it awkward.
 2025-04-10 08:31:09 +02:00
Tobias Brunner 3af7c6db87 Rename diffie_hellman_t to key_exchange_t and change the interface etc. 
This makes it more generic so we can use it for QSKE methods.
 2022-06-29 10:28:50 +02:00
Tobias Brunner 19ef2aec15 Update copyright headers after acquisition by secunet 2022-06-28 10:22:56 +02:00
Tobias Brunner c9d471091f Use mallinfo2() if available 
mallinfo() is deprecated because it uses `int` for the members of the
returned struct, whereas mallinfo2() uses `size_t`.  It's available
since glibc 2.33.
 2022-04-25 14:16:20 +02:00
Tobias Brunner 07bf428ad1 stroke: List registered KDFs 2022-04-14 18:54:24 +02:00
Andreas Steffen ea41f759b3 stroke: List drbgs in list_algs 2019-10-18 16:24:39 +02:00
Tobias Brunner 55fb268b51 stroke: Lease enumerator is always defined 
This function is only called for existing pools (under the protection of
a read lock).
 2018-09-11 18:18:50 +02:00
Tobias Brunner 84cdfbc9bc child-cfg: Allow suppressing log messages when selecting traffic selectors 
Although being already logged on level 2, these messages are usually just
confusing if they pop up randomly in the log when e.g. querying the configs
or installing traps.  So after this the log messages will only be logged when
actually proposing or selecting traffic selectors during IKE.
 2018-06-28 18:46:42 +02:00
Tobias Brunner 1b67166921 Unify format of HSR copyright statements 2018-05-23 16:32:53 +02:00
Tobias Brunner 2db6d5b8b3 Fixed some typos, courtesy of codespell 2018-02-13 12:19:54 +01:00
Tobias Brunner 2e4d110d1e linked-list: Change return value of find_first() and signature of its callback 
This avoids the unportable five pointer hack.
 2017-05-26 13:56:44 +02:00
Tobias Brunner 749ac175fa child-cfg: Use flags for boolean options 
Makes it potentially easier to add new flags.
 2017-05-23 16:51:15 +02:00
Tobias Brunner 7a0fdbab42 shunt-manager: Add an optional namespace for each shunt 
This will allow us to reuse the names of child configs e.g. when they
are defined in different connections.
 2017-02-16 19:24:07 +01:00
Andreas Steffen 04208ac5d4 xof: Defined Extended Output Functions 2016-07-29 12:36:14 +02:00
Andreas Steffen b12c53ce77 Use standard unsigned integer types 2016-03-24 18:52:48 +01:00
Tobias Brunner db00982dad stroke: Correctly print IKE SPIs stored in network order 2016-03-04 18:43:26 +01:00
Tobias Brunner 8394ea2a42 libhydra: Move kernel interface to libcharon 
This moves hydra->kernel_interface to charon->kernel.
 2016-03-03 17:36:11 +01:00
Tobias Brunner 5d7049b427 stroke: List DH groups for CHILD_SA proposals 
Closes strongswan/strongswan#23.
 2015-12-21 12:14:12 +01:00
Andreas Steffen 02d431022c Refactored certificate management for the vici and stroke interfaces 2015-12-12 00:19:24 +01:00
Andreas Steffen 3317d0e77b Standardized printing of certificate information 
The certificate_printer class allows the printing of certificate
information to a text file (usually stdout). This class is used
by the pki --print and swanctl --list-certs commands as well as
by the stroke plugin.
 2015-12-11 18:26:53 +01:00
Tobias Brunner ebeb8c87c5 traffic-selector: Don't end printf'ed list of traffic selectors with a space 2015-11-10 12:13:06 +01:00
Tobias Brunner 735f929ca7 ike: Only consider number of half-open SAs as responder when deciding whether COOKIEs are sent 2015-08-27 11:18:51 +02:00
Tobias Brunner 70728eb1b6 child-sa: Add a new state to track rekeyed IKEv1 CHILD_SAs 
This is needed to handle DELETEs properly, which was previously done via
CHILD_REKEYING, which we don't use anymore since 5c6a62ceb6 as it prevents
reauthentication.
 2015-03-25 12:00:20 +01:00
Tobias Brunner 8286e2050b stroke: Use %u to print stats returned by mallinfo(3) 
References #886.
 2015-03-13 15:25:53 +01:00
Martin Willi 53cf7fa60a stroke: List CHILD_SA unique ID as the primary identifier, but print reqid, too 2015-02-20 13:34:50 +01:00
Tobias Brunner a04ef18bda stroke: Fix memory leak when printing unknown AC group OIDs 2014-04-09 16:06:17 +02:00
Martin Willi 61b2d815b9 x509: Replace fixed acert group string getter by a more dynamic group enumerator 2014-03-31 11:14:58 +02:00
Martin Willi f6037b5506 stroke: List proposals in statusall without leading '/' in AH SAs 2013-10-11 10:15:21 +02:00
Martin Willi 3070697f9f ike: support multiple addresses, ranges and subnets in IKE address config 
Replace the allowany semantic by a more powerful subnet and IP range matching.
Multiple addresses, DNS names, subnets and ranges can be specified in a comma
separated list. Initiators ignore the ranges/subnets, responders match
configurations against all addresses, ranges and subnets.
 2013-09-04 10:38:37 +02:00
Martin Willi beffdc6ab8 ike-cfg: remove the to be obsoleted allow any parameter in get_my/other_addr 2013-09-04 10:38:37 +02:00
Martin Willi 49032d15be stroke: stop enumerating IKE_SAs in statusall if output stream gets closed 
If the output stream is not interested in more information, it can close the
the stream. Checking for stream errors avoids useless enumeration of IKE_SAs,
saving resources. This allows to use "ipsec statusall | head" to monitor the
daemon, or stop enumerating IKE_SAs after a specific entry has been found.
 2013-08-23 14:27:17 +02:00
Martin Willi 553bb78730 child-sa: replace get_traffic_selectors() with create_ts_enumerator() 
Not directly returning a linked list allows us to change the internals of
the CHILD_SA transparently.
 2013-07-17 17:20:18 +02:00
Tobias Brunner 49d7a98f47 Refactored plugin-loader with improved dependency resolution 
With the new implementation the plugins don't have to be listed in any
special order, dependencies are properly resolved.  The order only
matters if two plugins provide the same feature.
 2013-06-11 11:18:19 +02:00
Andreas Steffen 9fa9f68d8d enforce singular of packets 2013-03-22 21:14:04 +01:00
Tobias Brunner 6cf79c1e9d Algorithms are not really specific to an IKE version 
But not all of them can be used with IKEv1.

Fixes #314.
 2013-03-18 12:20:47 +01:00
Martin Willi d28391a244 Report the number of processed packets in "ipsec statusall" 2013-03-14 14:20:54 +01:00
Martin Willi d954a2081b child_sa_t.get_usestats() can additionally return the number of processed packets 2013-03-14 14:20:54 +01:00
Tobias Brunner 12642a6831 Moved data structures to new collections subfolder 2012-10-24 16:00:49 +02:00
Tobias Brunner 4106aea8e4 Made IP address enumeration more flexible 
Also added an option to enumerate addresses on ignored interfaces.
 2012-09-21 18:16:26 +02:00
Tobias Brunner aed33805ce Don't ignore loopback devices and allow addresses on them being enumerated 2012-09-21 18:16:26 +02:00
Martin Willi 874f7c7e2c Don't add ANY identity constraint to auth config, as XAuth rounds don't use one 2012-07-26 12:38:34 +02:00
Martin Willi 0f018a7324 Show some uname() info in "ipsec statusall" 2012-06-28 11:56:40 +02:00
Martin Willi dc6d259635 Show remote EAP/XAuth identity in "statusall" on a separate line 2012-06-27 11:42:00 +02:00
Martin Willi dd1381e7d3 Show EAP/XAuth identity in "ipsec status", if available 2012-06-25 10:18:35 +02:00
Martin Willi 137035cc78 Show what kind of *Swan we run in "ipsec status" 2012-06-14 10:25:48 +02:00
Andreas Steffen 1d315bddd3 implemented the right|leftallowany feature 2012-06-08 21:24:41 +02:00
Martin Willi 21043198ff Show expiration time of rekeyed CHILD_SAs in statusall 2012-06-05 10:29:43 +02:00
Andreas Steffen 2ac996cb71 list IKEv1 Aggressive Mode in ipsec statusall 2012-05-23 11:12:27 +02:00
Tobias Brunner 5c162dd944 List registered nonce generators in statusall output. 2012-05-18 08:15:41 +02:00