denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
13,520 Commits 1 Branch 0 Tags
ba0355c4ae8a886d5322a7d07cb691c6966ed019
Commit Graph
10659 Commits
Author SHA1 Message Date
Tobias Brunner ba0355c4ae libimcv: Updated Android.mk to latest Makefile.am 2014-10-13 18:16:40 +02:00
Tobias Brunner f502e503fb android: Remove references to libpts 2014-10-13 17:18:06 +02:00
Tobias Brunner ffa800ce9d libimcv: Remove reference to libpts 2014-10-13 17:17:45 +02:00
Tobias Brunner 17eed801e7 libimcv: Fix Doxygen comments after merging libpts into libimcv 2014-10-13 17:11:57 +02:00
Tobias Brunner 4bae9ec8d1 watcher: Doxygen comment fixed 2014-10-13 16:56:30 +02:00
Tobias Brunner 245979abc0 charon-systemd: Typo in log message fixed 2014-10-13 16:51:20 +02:00
Avesh Agarwal c8719a073d libimcv: Fix harcoded IMCV_DEFAULT_POLICY_SCRIPT name 
I came across an issue with src/libimcv/imcv.c where
IMCV_DEFAULT_POLICY_SCRIPT is hardcoded.

It fails where ipsec_script is renamed to, for example, strongswan from
default ipsec.
 2014-10-13 16:15:33 +02:00
Tobias Brunner 472156eea5 ike: Do remote address updates also when behind static NATs 
We assume that a responder is behind a static NAT (e.g. port forwarding)
and allow remote address updates in such situations.

The problem described in RFC 5996 is only an issue if the NAT mapping
can expire.
 2014-10-13 15:20:17 +02:00
Tobias Brunner f8a565fbcc ike: Remove redundant check for local NAT when handling changed NAT mappings 2014-10-13 15:20:17 +02:00
Andreas Steffen 8b812065f0 Support of multiple directed segmentation contracts 2014-10-11 14:50:08 +02:00
Andreas Steffen ab99939628 unit-tests: Updated Makefile 2014-10-11 14:50:08 +02:00
Andreas Steffen a05ca71d07 unit-tests: Added test for seg_contract_manager 2014-10-11 14:50:08 +02:00
Andreas Steffen 4af020be37 Updated build-database.sh script to 3.13.0-37 kernel 2014-10-11 11:40:43 +02:00
Martin Willi 67f9f09dd3 swanctl: Fix exit codes based on errno 
As fprintf() most likely sets errno, we should save it before printing the
error message.
 2014-10-10 11:42:18 +02:00
Martin Willi d4d85135c5 vici: Cancel processor before calling library_deinit() 
For non-direct libstrongswan users, the deinitialization segfaults because
of the missing worker thread cancellation.
 2014-10-10 11:42:18 +02:00
Martin Willi 3db58e837c vici: Reduce debug level during thread spawning 
We want to avoid libvici users to get a cluttered stderr for no real error.
 2014-10-10 11:42:18 +02:00
Martin Willi 046b547a37 vici: Don't include-depend on libstrongswan for boolean types 
As we want to avoid the libstrongswan include dependencies for libvici, avoid
the use of the bool type. Unfortunately this change may break the ABI for
vici_dump(). As this function is mostly for debugging purposes, we do it
nonetheless; my apologies if somebody already relies on the ABI stability of
that function.
 2014-10-10 11:42:18 +02:00
Martin Willi 6f55149335 vici: Document the ruby gem and add some simple examples 2014-10-10 11:42:18 +02:00
Martin Willi dccb2c6eba vici: Add some simple libvici examples to the README 2014-10-10 11:42:18 +02:00
Martin Willi 56f17733c9 vici: Document the available vici command and event messages 2014-10-10 11:42:18 +02:00
Martin Willi f684be6583 vici: Use "gem"-assisted vici ruby gem building and installation 2014-10-10 11:42:17 +02:00
Martin Willi 1038d96537 vici: Add a ruby gem providing a native vici interface 2014-10-10 11:42:17 +02:00
Martin Willi 94d9398202 vici: Return a success result for the clear-creds command 
Even if the command actually can't fail, this looks more aligned to similar
commands.
 2014-10-10 11:42:17 +02:00
Martin Willi d39e04b557 vici: Fix message encoding type values in documentation 2014-10-10 11:42:17 +02:00
Volker Rümelin 05db0f97e3 ikev1: Add fragmentation support for Windows peers 
I still think ipsec/l2tp with fragmentation support is a useful
fallback option in case the Windows IKEv2 connection fails because
of fragmentation problems.

Tested with Windows XP, 7 and 8.1.
 2014-10-10 10:54:37 +02:00
Tobias Brunner 3633b80147 eap-radius: Add option to set interval for interim accounting updates 
Any interval returned by the RADIUS server in the Access-Accept message
overrides the configured interval.  But it might be useful if RADIUS is
only used for accounting.
 2014-10-10 09:51:13 +02:00
Tobias Brunner 8dbe128c8c message: Limit maximum number of IKEv2 fragments 
The maximum for IKEv1 is already 255 due to the 8-bit fragment number.

With an overhead of 17 bytes (x64) per fragment and a default maximum
of 10000 bytes per packet the maximum memory required is 14 kB
for a fragmented message.
 2014-10-10 09:32:42 +02:00
Tobias Brunner f00a9c1715 packet: Define a global default maximum size for IKE packets 2014-10-10 09:32:42 +02:00
Tobias Brunner 03512c47bf message: Ensure a minimum fragment length 2014-10-10 09:32:41 +02:00
Tobias Brunner f1aa18b2e8 ikev2: Send retransmits using the latest known addresses 
For instance, if a DPD exchange is initiated by the gateway when a
mobile client is roaming and it then gets a new IP address and sends
an address update via MOBIKE, the DPD retransmits would still be sent
to the old address and the SA would eventually get closed.
 2014-10-10 09:32:41 +02:00
Tobias Brunner b678d9e14f ikev2: Send and receive fragmented IKE messages 
If a fragmented message is retransmitted only the first packet is passed
to the alert() hook.
 2014-10-10 09:32:41 +02:00
Tobias Brunner 1446fd8ac9 ike: IKE_SA may fragment IKEv2 messages 2014-10-10 09:32:41 +02:00
Tobias Brunner 7a53fe5511 ike: Do not cache MID of IKEv2 fragments 
This fails if there are unencrypted payloads before an encrypted
fragment payload in the first fragment.
 2014-10-10 09:32:41 +02:00
Tobias Brunner c0f4936a23 message: Fragment and reassemble IKEv2 messages 2014-10-10 09:32:41 +02:00
Tobias Brunner e8ffb256b3 message: Handle encrypted fragment payload similar to the encrypted payload 2014-10-10 09:32:41 +02:00
Tobias Brunner 4c345b15c7 ikev2: Add encrypted fragment payload 2014-10-10 09:32:37 +02:00
Tobias Brunner edfd33455c encrypted_payload: Encrypted payload can be constructed from plaintext 2014-10-10 09:31:17 +02:00
Tobias Brunner 1e0d8f3ec0 encrypted_payload: Expose generate() to generate the plaintext 2014-10-10 09:31:17 +02:00
Tobias Brunner 44996b5866 encrypted_payload: Extract some utility functions 2014-10-10 09:31:17 +02:00
Tobias Brunner 41751a70d9 message: Split generate() in multiple functions 2014-10-10 09:31:16 +02:00
Tobias Brunner 34dc37f3cb ikev2: Negotiate support for IKEv2 fragmentation 2014-10-10 09:31:16 +02:00
Tobias Brunner 7223b642a7 ikev2: Add notify for IKEv2 fragmentation 2014-10-10 09:31:13 +02:00
Tobias Brunner 70e0be072b ikev1: Move defragmentation to message_t 2014-10-10 09:30:26 +02:00
Tobias Brunner 40bab9a176 ike: Move fragmentation to ike_sa_t 
The message() hook on bus_t is now called exactly once before (plain) and
once after fragmenting (!plain), not twice for the complete message and again
for each individual fragment, as was the case in earlier iterations.

For inbound messages the hook is called once for each fragment (!plain)
and twice for the reassembled message.
 2014-10-10 09:30:26 +02:00
Tobias Brunner 2e7a2c06a1 message: fragment() generates message and fragments and caches them 2014-10-10 09:30:26 +02:00
Tobias Brunner e0b35142c1 message: Make packet argument optional in generate() 2014-10-10 09:30:26 +02:00
Tobias Brunner 127a98dc90 ikev1: Move fragment generation to message_t 2014-10-10 09:30:26 +02:00
Tobias Brunner 147fe503af ike: Rename encryption_payload to encrypted_payload 2014-10-10 09:30:25 +02:00
Tobias Brunner 7fb363c8f7 ipsec: Remove unsupported listcards and rereadgroups commands 2014-10-08 18:44:23 +02:00
Tobias Brunner 5bc6947738 ipsec: Document missing commands 2014-10-08 18:44:23 +02:00