denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
10,163 Commits 1 Branch 0 Tags
be18ee8123d6de3984a04f9feb1e457b7c45b0b5
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Martin Willi be18ee8123 If adding an IMC/IMV fails, terminate() it only if it has been initialize()d 2012-11-30 15:48:13 +01:00
Martin Willi fd885fd390 Add an IMV constructor taking a set of custom TNC_IMV functions 2012-11-30 15:48:02 +01:00
Martin Willi f1f500c724 Add an IMC constructor taking a set of custom TNC_IMC functions 2012-11-30 15:47:59 +01:00
Martin Willi cd74959465 Clean up memory management when loading IMC/IMVs from files 2012-11-30 15:47:34 +01:00
Martin Willi db9c8b6fba Fix passing of IKE_SA unique_id over lookip socket 2012-11-30 13:44:12 +01:00
Martin Willi 78b2a2b148 Add load-tester NEWS 2012-11-29 10:29:17 +01:00
Martin Willi 48828ff0db Store load-tester address leases in a hashtable for fast removal 2012-11-29 10:22:52 +01:00
Martin Willi 7277e4719e Consolidated %any(6) host_t parsing 2012-11-29 10:22:52 +01:00
Martin Willi 98d0fd25a8 Remove numeric conversion from resolver, it is done directly in host_t 2012-11-29 10:22:52 +01:00
Martin Willi 47f35b46a1 host_create_from_dns() tries a numeric conversion before asking resolver 2012-11-29 10:22:51 +01:00
Martin Willi f5fe52bf9a Add a host_t constructor from string, but with a specific family 2012-11-29 10:22:51 +01:00
Martin Willi d88597f0dd Don't wait while removing external IPs used for load testing 2012-11-29 10:22:51 +01:00
Martin Willi b185cdd16d Install virtual IPs via interface name, and use an interface lookup where required 2012-11-29 10:22:51 +01:00
Martin Willi 0a54d3e1a1 load-tester can dynamically install a dedicated external IP for each IKE_SA 
For consistency, the local/remote parameters have been replaced by the
initiator/responder options. As initiator, the initiator option can
be overriden by an addrs section taking key/value pairs with address
pools to use on a specific interface.
 2012-11-29 10:22:51 +01:00
Martin Willi 50bd755871 Add an optional kernel-interface parameter to install IPs with a custom prefix 2012-11-29 10:22:51 +01:00
Martin Willi fdd94fc846 Add a delay option to load-tester socket 2012-11-29 10:22:51 +01:00
Martin Willi cf85f6b296 Indicate message retransmissions while initiating load-test batches 2012-11-29 10:22:51 +01:00
Martin Willi 3c79b7b7db Add alerts for sent/received message retransmissions and timeout 2012-11-29 10:22:51 +01:00
Martin Willi 93ceaa7e64 Initiate each load-testing connection with a fresh peer config 2012-11-29 10:22:51 +01:00
Martin Willi b7acd90763 Initiate IKE_SAs trigger over load-tester socket in parallel 2012-11-29 10:22:51 +01:00
Martin Willi 965f7bd54f Add a simple load-tester utility to initiate over control socket 2012-11-29 10:22:51 +01:00
Martin Willi d65683eef4 Add a load-tester control socket to manually trigger initiation 2012-11-29 10:22:50 +01:00
Martin Willi 2685020ace Lookip plugin additionally reports the IKE_SA unique identifier 2012-11-29 10:00:45 +01:00
Martin Willi b5d27839ad Do not send 0.0.0.0/0 traffic selectors as Split-Include Unity attributes 
It seems that iOS devices don't like them.
 2012-11-22 12:13:44 +01:00
Martin Willi 2354b10576 Add an ikesa_limit option to limit number of IKE_SAs as responder 2012-11-16 10:27:36 +01:00
Martin Willi 5b89e3b061 Pass PLUTO_XAUTH_ID to updown script 2012-11-16 09:56:05 +01:00
Martin Willi 07474b6062 libtnc can be initialized more than once 2012-11-14 10:14:40 +01:00
Martin Willi de4c1def83 libcharon can be initialized more than once 2012-11-14 10:14:37 +01:00
Martin Willi 8edb6248f8 libhydra can be initialized more than once 2012-11-14 10:14:34 +01:00
Martin Willi 1e5e1fb685 libstrongswan can be initialized more than once 2012-11-14 10:14:31 +01:00
Martin Willi 6e8f88dba3 Exclude dynamic TS from Unity Split-Include attributes 2012-10-30 09:14:44 +01:00
Martin Willi 828cefc313 Fix RSA encryption padding terminator in gmp plugin, broken with 5025135f 2012-10-24 20:26:10 +02:00
Martin Willi 2fc0232a39 Add a scepclient option to specify a CA identifier to fetch certs for 2012-10-24 16:28:58 +02:00
Martin Willi c4894cc172 Send certificate requests in load-tester 2012-10-24 13:25:45 +02:00
Martin Willi 0f3c5f8502 Add load-tester traffic selector configuration options 2012-10-24 13:25:13 +02:00
Martin Willi 1efd6c6f2a Make use of new CIDR string ts constructor where appropriate 2012-10-24 13:25:08 +02:00
Martin Willi fd6c0c8fb4 Add a traffic selector constructor creating a TS directly from a CIDR string 2012-10-24 13:25:02 +02:00
Martin Willi 8fc7bbc6ba Add NEWS about explicitly loaded pkcs11 certificates from ipsec.conf 2012-10-24 13:16:39 +02:00
Martin Willi 712e81306f PKCS#11 library search using keyid uses a fallback to look for certificates 2012-10-24 13:07:54 +02:00
Martin Willi aa51d5dd25 Increase the limit of acceptable IKEv1 CERTREQ payloads to 20 2012-10-24 13:07:53 +02:00
Martin Willi 4ce55ffb0b Use explicit, larger buffer sizes for smartcard keyids and modules 2012-10-24 13:07:53 +02:00
Martin Willi cd844e1c97 Remove obsolete pluto smartcard syntax in ipsec.secrets.5 2012-10-24 13:07:53 +02:00
Martin Willi f6d8fb3687 Updated ipsec.conf.5 regarding (CA) certificates loaded from smartcards 2012-10-24 13:07:53 +02:00
Martin Willi 434902b302 Add a strongswan.conf option to disable loading of all certificates from a pkcs11 module 2012-10-24 13:07:53 +02:00
Martin Willi 794d713dca Support loading cacert certificates in ipsec.conf ca sections from smartcard 2012-10-24 13:07:53 +02:00
Martin Willi 2abe404927 Refactored stroke smartcard token parsing, support module and slot in leftcert option 2012-10-24 13:07:53 +02:00
Martin Willi 36e47a409b Explicit pkcs11 certificate loading can enforce a module and a slot 2012-10-24 13:07:53 +02:00
Martin Willi 5d4c27d077 Be less verbose if loading PKCS#11 certificate fails 2012-10-24 13:07:53 +02:00
Martin Willi 05e266ea9d Add leftcert ipsec.conf.5 documentation about smartcard certificates 2012-10-24 13:07:53 +02:00
Martin Willi 9687cb5100 Load ipsec.conf %smartcard leftcerts with pkcs11 builder 2012-10-24 13:07:52 +02:00
Martin Willi fbd3863571 Add a builder to load specific pkcs11 certificates by keyid 2012-10-24 13:07:52 +02:00
Martin Willi ffe42fa405 If no pkcs11 public key for a private key found, search for a certificate 2012-10-24 13:07:52 +02:00
Martin Willi 44fdc62f82 Move pkcs11 public key lookup function declaration to header file 2012-10-24 13:07:52 +02:00
Martin Willi 6910e5c753 Add NEWS about proposals with PRFs different from integrity protection algorithms 2012-10-24 11:52:59 +02:00
Martin Willi 5b2e669ba2 Add ipsec.conf.5 documentation for explicit PRFs in IKE proposals 2012-10-24 11:49:37 +02:00
Martin Willi 7ee16e4b85 Only add an implicit PRF based on the MAC alg if no PRF given in proposal 2012-10-24 11:49:37 +02:00
Martin Willi 60e59b7e7f Add proposal keywords to explicitly specify PRF algorithms 2012-10-24 11:49:36 +02:00
Martin Willi 343e998927 Added NEWS about lookip plugin 2012-10-24 11:47:18 +02:00
Martin Willi a7f5eb1035 Add an interactive mode in lookip tool, demonstrate lasting connections 2012-10-24 11:43:34 +02:00
Martin Willi 9d422bb1b0 Send a lookip NOT_FOUND reply if a lookup yields no results 2012-10-24 11:43:34 +02:00
Martin Willi f6fb2b98e9 lookup function of lookip listener returns the number of matches 2012-10-24 11:43:34 +02:00
Martin Willi 31576ceddf Handle multiple lookip connections using a single FDSET 2012-10-24 11:43:34 +02:00
Martin Willi 28683ef137 Renamed list to store listening lookip clients 2012-10-24 11:43:34 +02:00
Martin Willi bae50c7393 Handle client subscriptions in lookip plugin 2012-10-24 11:43:34 +02:00
Martin Willi 7650dd9a4f Add a lookip server side UNIX socket processing LOOKUP and DUMP requests 2012-10-24 11:43:34 +02:00
Martin Willi d59e6db614 Add a simple command line utility to query the lookip plugin 2012-10-24 11:43:34 +02:00
Martin Willi 7877c463ea Defined on-the-wire format used on lookip socket 2012-10-24 11:43:34 +02:00
Martin Willi 1edaa79c06 Add a lookip function to register virtual IP notification listeners 2012-10-24 11:43:34 +02:00
Martin Willi 9c54b445e2 Add a lookup method to lookip plugin, using a callback to invoke 2012-10-24 11:43:34 +02:00
Martin Willi 2caa27d42e Add a lookip listener that collects the information we are interested in 2012-10-24 11:43:34 +02:00
Martin Willi e0d7c1eda7 Add a lookip plugin stub to lookup connections by virtual IP 2012-10-24 11:43:33 +02:00
Martin Willi a19d591388 Add NEWS about stroke counters 2012-10-24 11:39:13 +02:00
Martin Willi 3202f4a381 Add "listcounters" command to ipsec.8 manpage 2012-10-24 11:34:31 +02:00
Martin Willi 0c4b9f7cda Add a "ipsec listcounters" command to stroke 2012-10-24 11:34:31 +02:00
Martin Willi f9332e0a8b Add a print method for stroke counters 2012-10-24 11:34:31 +02:00
Martin Willi 2232d88569 Support field with specifiers in %N printf hook 2012-10-24 11:34:30 +02:00
Martin Willi fc4d1568d1 Add stroke message type counters 2012-10-24 11:34:30 +02:00
Martin Willi 5715af7508 Add stroke counters for invalid IKE messages 2012-10-24 11:34:30 +02:00
Martin Willi 81e0e10344 Add stroke CHILD_SA rekeying counter 2012-10-24 11:34:30 +02:00
Martin Willi a32a8d4a67 Add stroke IKE rekey counters 2012-10-24 11:34:30 +02:00
Martin Willi 418f4bc7a5 Raise a bus alert when IKE message body parsing fails 2012-10-24 11:34:30 +02:00
Martin Willi 2b95ab7620 Raise a bus alert when IKE message header parsing fails 2012-10-24 11:34:30 +02:00
Martin Willi f6f16131d0 Raise a bus alert when a received message contains unknown SPIs 2012-10-24 11:34:30 +02:00
Martin Willi 47904e3c74 Define stroke counter types to implement 2012-10-24 11:34:11 +02:00
Martin Willi 8554895b95 Add a stub for IKE event counters in stroke 2012-10-24 11:34:11 +02:00
Martin Willi b2265a2738 Add a load-tester option to define the IKE version to use for testing 2012-10-24 10:19:33 +02:00
Martin Willi e19b23e0b9 Remove peer_cfg IKE version matching, as it is done in ike_cfg matching 2012-10-24 10:19:33 +02:00
Martin Willi 7910116384 Respect IKE version while selecting an ike_cfg as responder 2012-10-24 10:19:33 +02:00
Martin Willi 1fdd62ffce Remove version argument on peer_cfg constructor, use ike_cfg version instead 2012-10-24 10:19:33 +02:00
Martin Willi 9fc7cc6f9b Add IKE version information to ike_cfg_t 2012-10-24 10:18:35 +02:00
Martin Willi cf62d073f1 Move ike_version_t definition from peer_cfg_t to ike_cfg_t 2012-10-24 10:17:36 +02:00
Martin Willi a70851c941 Remove unused this parameter to load_issuer_cert/key(), as it is uninitialized 2012-10-16 14:11:14 +02:00
Martin Willi c1024a6bd6 Generate a load-tester certificate only for DN or subjectAltName identities 2012-10-16 13:43:54 +02:00
Martin Willi db97d67825 Add a load-tester initiator_match option to match custom initiator_id 2012-10-16 13:43:54 +02:00
Martin Willi 5359c7a437 Encode non-DN load-tester identities as subjectAltNames 2012-10-16 13:43:54 +02:00
Martin Willi 562b89ccee Add a load-tester digest option for issuing peer certificates 2012-10-16 13:43:54 +02:00
Martin Willi 3f6e13f553 Load a multiple load-tester CA certificates from a directory 2012-10-16 13:43:54 +02:00
Martin Willi 24eb73b4fa Added load-tester options to read issuing CA certificate and key from files 2012-10-16 13:43:53 +02:00
Martin Willi 7f3bf2b12f Remove outdated TODO information 2012-10-10 13:10:28 +02:00
Martin Willi 82f3549fe2 Fix leak of PINs from ipsec.secrets 2012-10-09 11:54:00 +02:00