denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
5,352 Commits 1 Branch 0 Tags
c118559afec96f5cd18509b9157b9c07724d550c
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Martin Willi c118559afe Fix use of snprintf() in IETF attributes to string conversion 2010-07-28 10:54:48 +02:00
Martin Willi 018543f3a8 Fix use of snprintf() in identification DN to ASCII conversion 2010-07-28 10:54:47 +02:00
Martin Willi c8bd06c7cf More NEWS for HA functionality 2010-07-28 10:49:58 +02:00
Martin Willi 98d0343870 Implemented a HA enabled in-memory address pool 2010-07-28 10:06:19 +02:00
Martin Willi 7455ab063f Added a function to segmentate a generic integer 2010-07-28 10:06:19 +02:00
Martin Willi c03b64a4ac Reserving does not work, as our pools do not support acquiring arbitrary addresses 
This reverts commit d1384080b3.
 2010-07-27 12:05:39 +02:00
Martin Willi 45c992474c Mem pool does not support multiple leases for an identity 2010-07-27 09:54:27 +02:00
Martin Willi 7eeb687d59 Flush any remaining cache state if an IKE_SA goes down 2010-07-27 09:18:06 +02:00
Martin Willi 1c1f132abe Added NEWS related to HA functionality 2010-07-26 15:41:33 +02:00
Martin Willi fa4f71c819 Synchronize EAP-Identity of remote peer 2010-07-26 15:10:54 +02:00
Martin Willi d1384080b3 Reserve virtual IP of passive IKE_SAs in the local pool 2010-07-26 15:01:24 +02:00
Martin Willi 65d15aff73 Added strongswan.conf options for HA heartbeat 2010-07-26 14:30:19 +02:00
Martin Willi 08e266a119 Log CHILD_SA segment responsibility 2010-07-26 13:53:54 +02:00
Martin Willi 3e6736f67e Pass initiator parameter to distinguish between original and exchange initiator 2010-07-26 13:53:53 +02:00
Martin Willi b2e447e24a Pass the CREATE_CHILD_SA initiator flag to the child_keys parameter 2010-07-26 13:53:53 +02:00
Martin Willi aa334daa9b Use a sync message cache to resynchronize IKE_SAs without rekeying 2010-07-26 13:53:49 +02:00
Martin Willi 2031002d42 Log received HA message types 2010-07-26 11:33:00 +02:00
Martin Willi f2eebed2a3 Add enum names for HA message types 2010-07-26 11:33:00 +02:00
Martin Willi 51217527e6 Delay resynchronization request until starter has loaded the configurations 2010-07-26 11:33:00 +02:00
Martin Willi 2cbc48ecab Replaces in_segment() by a more generic get_segment() function 2010-07-26 11:33:00 +02:00
Martin Willi ad2488fcdf Use distinct message types for HA message ID updates 2010-07-26 10:15:17 +02:00
Martin Willi 00c1bd0606 Migrated ha plugin to INIT/METHOD macros 2010-07-26 10:15:17 +02:00
Martin Willi fe2434cfd7 Added NEWS for the eap-simaka-sql plugin 2010-07-23 16:02:28 +02:00
Martin Willi e87b78c6ad Multiple RADIUS server NEWS 2010-07-21 17:27:06 +02:00
Martin Willi ce7967c50c Implemented support for multiple RADIUS servers 2010-07-21 17:25:09 +02:00
Martin Willi 58d2ef6e14 Migrated eap-radius plugin to INIT/METHOD macros 2010-07-21 17:09:27 +02:00
Martin Willi 5b6c220d13 Added log statement if peer requests EAP, but current config does not allow it 2010-07-21 17:09:15 +02:00
Martin Willi 83b957107f Revert "Warn about manual plugin load directives for pluto/charon" 
This reverts commit 5c46726d0d.
 2010-07-14 07:17:16 +02:00
Martin Willi 5c46726d0d Warn about manual plugin load directives for pluto/charon 2010-07-13 14:43:45 +02:00
Martin Willi 15d9904406 Remove plugin load directives from default strongswan.conf 2010-07-13 14:28:11 +02:00
Martin Willi 7f3a946874 Added NEWS about --signcrl and PEM support in pki utility 2010-07-13 14:18:19 +02:00
Martin Willi b5b95c75de Added pki PEM encoding support for certificates, CRLs and PKCS10 requests 2010-07-13 14:14:39 +02:00
Martin Willi e3b987f79b Added support for Certificate, CRL and PKCS10 encoding to PEM plugin 2010-07-13 13:53:33 +02:00
Martin Willi 0406eeaacb Support different encoding types in certificate.get_encoding() 2010-07-13 13:53:20 +02:00
Martin Willi da9724e6d0 Renamed key_encod{ing,der}_t and constants, prepare for generic credential encoding 2010-07-13 11:29:35 +02:00
Martin Willi 24d327ab4d Moved keys/key_encoding.[ch] to cred_encoding.[ch] 2010-07-13 11:02:35 +02:00
Martin Willi e1c51fd859 Fixed doxygen group of cert_validator interface 2010-07-13 10:42:02 +02:00
Martin Willi e9448cfc2f Added NEWS for revocation/addrblock plugin 2010-07-13 10:26:07 +02:00
Martin Willi f90d465ce2 Added addrblock plugin to RFC3779 test cases 2010-07-13 10:26:07 +02:00
Martin Willi 1f457546c1 Added revocation plugin to ikev2 crl/ocsp test cases 2010-07-13 10:26:07 +02:00
Martin Willi e57a29c731 Moved X509 ipAddrBlock checking to the addrblock plugin 2010-07-13 10:26:07 +02:00
Martin Willi be715344c2 Added a hook to narrow traffic selectors for CHILD_SAs 2010-07-13 10:26:07 +02:00
Martin Willi 88fa56b1ad Moved bus_t to METHOD/INIT macros 2010-07-13 10:26:07 +02:00
Martin Willi 1c8c924610 Moved addrblock plugin to libcharon 2010-07-13 10:26:07 +02:00
Martin Willi c2e5cee413 Moved CRL/OCSP checking to a dedicated plugin called revocation 2010-07-13 10:26:07 +02:00
Martin Willi c1f9dad672 Made some useful methods in the credential manager public 2010-07-13 10:26:07 +02:00
Martin Willi 5f9e62c54f Moved X509 addrBlock validation to a separate addrblock plugin 2010-07-13 10:26:07 +02:00
Martin Willi 2feb16f5dd Added a certificate validation hook to the credential manager 2010-07-13 10:26:07 +02:00
Martin Willi c3a9bef08e Migrated credential manager to INIT/METHOD macros 2010-07-13 10:26:07 +02:00
Martin Willi 2ccc02a4fd Moved credential manager to libstrongswan 2010-07-13 10:26:07 +02:00
Martin Willi 2ca7db1337 Move pathlen constraint checking to X509 specific checks 2010-07-13 10:26:06 +02:00
Martin Willi 5db798c8e0 Charon uses a generic trunstchain length limit, not only for X509 certificates 2010-07-13 10:26:06 +02:00
Martin Willi 01bb70e4ad Combined the OCSP/CRL options to a signle Online check option 2010-07-13 10:26:06 +02:00
Martin Willi 52f97c3893 Do not interpret long class attributes (such as from NPS) as group 2010-07-09 13:53:43 +02:00
Martin Willi cfa1c07604 Group membership constraint is fulfilled if subject is member in one of the groups 2010-07-09 13:51:58 +02:00
Martin Willi 6f07f5e3d4 The file logger supports a time prefix using a strftime() format specifier 2010-07-08 17:44:19 +02:00
Martin Willi 4cc9afe35f Print identity to a lease address on the same line for simpler greping 2010-07-08 17:44:19 +02:00
Martin Willi 6c4cd8fa15 Implemented missing bypass_socket() method in load-testers faked kernel interface 2010-07-07 10:01:32 +02:00
Martin Willi 4f99093235 Show mallinfo() data in statusall, if available 2010-07-06 16:28:25 +02:00
Martin Willi 380106ab0d Avoid relocking while enumerator is alive 2010-07-06 16:28:25 +02:00
Martin Willi a4c0da1669 Added support for group membership information containted in the RADIUS class attribute 2010-07-05 09:41:04 +02:00
Martin Willi 4172574bfb Use the group constraint in a more generic fashion, not only for attribute certificates 2010-07-05 09:41:04 +02:00
Martin Willi 53913d764e Use the responder side configured EAP-Identity directly, if given 2010-07-05 09:41:04 +02:00
Martin Willi ec6caa1367 Copy EAP specific attributes to auth config only 2010-07-05 09:41:04 +02:00
Martin Willi 02571374c4 Recreate IKE_SA_INIT related tasks only if they have completed 2010-06-30 13:48:47 +02:00
Martin Willi 6a4a47511f Show contents of the CP payload in message_t stringification 2010-06-24 15:46:28 +02:00
Martin Willi 1e723d739c Support the subnet attribute in the attr plugin 2010-06-24 15:46:28 +02:00
Martin Willi 07c5aacce8 Select subjectAltName address family using address length in openssl plugin 2010-06-24 12:01:18 +02:00
Martin Willi 7a74295e42 Select subjectAltName address family using address length in x509 plugin 2010-06-24 12:01:18 +02:00
Martin Willi 5d31217232 Ignore IKEv2 packets in pluto with any minor version 2010-06-22 11:14:07 +02:00
Martin Willi 169eae5229 Accept IKE packets with any minor version in RAW socket 2010-06-22 11:14:07 +02:00
Martin Willi 5493ffde0b traffic_selector_t is gone into libstrongswan, migrate printf hook registration, too. 2010-06-07 15:06:09 +02:00
Martin Willi 550d9085fa Flush auth configs, create new keymat during SA reset 2010-06-07 14:59:39 +02:00
Martin Willi dbdb69f908 Recreate IKE_INIT/IKE_NATD/IKE_VENDOR tasks if we reset SA during IKE_AUTH 2010-06-07 14:58:57 +02:00
Martin Willi 8b56ec20f3 Reacquire keymat from new IKE_SA during task migration 2010-06-07 14:56:24 +02:00
Martin Willi d5ad6eb1e0 Flush certificate cache on CA delete 2010-06-07 13:51:18 +02:00
Martin Willi a3ffa9edfd Log non-empty task queues in statusall 2010-06-07 11:59:37 +02:00
Martin Willi ea340ee840 Wrap task enumerator in ike_sa 2010-06-07 11:37:55 +02:00
Martin Willi 8bced61b76 Migrated ike_sa_t to INIT/METHOD macros 2010-06-07 09:30:27 +00:00
Martin Willi 665c18bd85 Added support for task enumeration in task_manager_t 2010-06-07 10:45:25 +02:00
Martin Willi 9560a3166f Migrated task_manager_t to INIT/METHOD macros 2010-06-07 10:37:00 +02:00
Martin Willi d43775ae58 Accept ARP requests with an ethernet trailer, but trim it 2010-06-03 08:39:33 +02:00
Martin Willi d2c358742a Added a EAP-SIM/AKA backend reading triplets/quintuplets from a SQL database 2010-06-02 15:59:44 +02:00
Martin Willi 2f57e6da0e Disable close action for a redundant CHILD_SA resulting from a rekey collision 
If a rekey collision is detected, the winning peer of the nonce compare
will delete the redundant CHILD_SA. The other peer should not enforce the
close action on this CHILD, as it would reestablish the redundat CHILD_SA.
Thanks to Thomas Egerer from secunet for pointing this out and the initial
patchset.
 2010-06-02 11:48:52 +02:00
Martin Willi fe02d99b96 Use wrapped getters for close/dpd action 2010-06-02 11:48:51 +02:00
Martin Willi 4c401ea216 Wrap getters for dpd/close action into CHILD_SA, allows us to override them 2010-06-02 11:48:44 +02:00
Martin Willi 80b5661a9b Added generated manpages to .gitignore 2010-05-31 13:41:25 +02:00
Martin Willi a2cf26f1c1 Changed default lifetime of certificates to 3 years 2010-05-31 13:15:19 +02:00
Martin Willi 70ac7c43a5 Support extendedKeyUsage flags in self-signed certificates 2010-05-31 13:15:05 +02:00
Martin Willi 2e08be79a3 Send empty SIM/AKA-NOTIFICATION response for non-success codes, too 2010-05-27 15:04:25 +02:00
Martin Willi ddf29f5b07 Added support for reading raw PUT/POST data from HTTP request 2010-05-27 09:30:14 +02:00
Martin Willi f00a101590 Unwrap subjectKeyIdentifier from OCTET_STRING 2010-05-26 16:09:50 +02:00
Martin Willi 24632bc0e8 Fixed compiler warning in invocation of crl_is_newer() 2010-05-21 16:41:13 +02:00
Martin Willi 09f38ebe54 Use CAs subjectKeyIdentifier as CRLs authorityKeyIdentifier 2010-05-21 16:38:19 +02:00
Martin Willi 0c73ceff0a Added a --signcrl command to the pki utility 2010-05-21 16:25:51 +02:00
Martin Willi 13c593f126 Added support for CRL generation to x509 plugin 2010-05-21 16:25:51 +02:00
Martin Willi aab861608a Removed is_newer() from certificate_t, obsoleting all implementations 2010-05-21 16:25:51 +02:00
Martin Willi 8029e5efd2 Added generic implementations for crl_is_newer/certificate_is_newer 2010-05-21 16:25:51 +02:00
Martin Willi 654218a31b Migrated x509_crl_t to INIT/METHOD macros 2010-05-21 16:25:51 +02:00
Martin Willi 6d7eed9a37 Implemented X.509 CRL reading using OpenSSL 2010-05-21 16:25:51 +02:00