denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
5,927 Commits 1 Branch 0 Tags
c5770f864fc78d5f9b92bd885c37e3f952a31a97
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Tobias Brunner c5770f864f Allow responder to use ike_mobike_t.roam. 
After getting a response the responder updates the IPsec SAs.
 2010-10-12 11:11:05 +02:00
Tobias Brunner 261b2572d1 Send list of additional addresses even if current path is still valid. 2010-10-12 11:11:05 +02:00
Tobias Brunner bab56a4abb Extracted path checking in ike_sa_t.roam into separate functions. 2010-10-12 11:11:05 +02:00
Tobias Brunner 769c69facc Added support for responders to change their address via MOBIKE. 
If the original responder updates its list of additional addresses we
check if the remote endpoint changed and update the IPsec SAs if it did,
as we assume the original address became unavailable and the responder
already updated the SAs on its side.
 2010-10-12 11:11:05 +02:00
Tobias Brunner 13876431d6 Explicitly configure MOBIKE tasks to update the list of additional addresses. 2010-10-12 11:11:05 +02:00
Tobias Brunner 31e7dc4dfd Improved check for first IKE_AUTH message in ike_mobike task. 
If the original responder initiated a MOBIKE exchange, the previous
check was not always correct.
 2010-10-12 11:11:05 +02:00
Tobias Brunner c817e7bb90 Migrated ike_mobike task to INIT/METHOD macros. 2010-10-12 11:11:05 +02:00
Tobias Brunner be90134211 Simplified apply_port function in mobike task. 2010-10-12 11:11:04 +02:00
Tobias Brunner ec0c756d07 Do not fire roam events based on local route changes. 
These kernel events are triggered on address changes, which is
problematic when deleting virtual IP addresses.
 2010-10-12 11:11:04 +02:00
Tobias Brunner 29607690a8 If a changed route has no src, try to find it via interface. 2010-10-12 11:11:04 +02:00
Tobias Brunner 0ac6d2e658 Get source address from interface if the route does not provide one. 2010-10-12 11:11:04 +02:00
Tobias Brunner cd26eedc5c Do not update hosts based on retransmitted messages. 2010-10-12 11:11:04 +02:00
Tobias Brunner d5bd775126 Do not update remote host if we are behind a NAT. 2010-10-12 11:11:04 +02:00
Tobias Brunner f22ba072e8 draft-ietf-ipsecme-eap-mutual will be released as RFC 5998. 2010-09-16 10:27:49 +02:00
Tobias Brunner 41f525becd Added missing options (corrected some default values). 2010-09-10 12:01:20 +02:00
Tobias Brunner 3f71c5d95f Moved load-tester configuration to a separate section. 2010-09-10 12:01:20 +02:00
Tobias Brunner b2bcc57737 Added information about logger configuration. 2010-09-10 12:01:20 +02:00
Tobias Brunner fa8c06903f More information about IKEv2 retransmissions added. 2010-09-10 12:01:20 +02:00
Tobias Brunner 320cecd2dd Adding most of the strongswan.conf options from the wiki. 2010-09-10 12:01:20 +02:00
Tobias Brunner 483c1feb7e Added strongswan.conf(5) stub. 2010-09-10 12:01:19 +02:00
Tobias Brunner 0a1233e642 Moved man pages for config files to a separate directory. 2010-09-10 12:01:19 +02:00
Tobias Brunner 3f9ba3be66 Conditional exclusion of tls_test script completed. 2010-09-09 13:21:38 +02:00
Tobias Brunner 6d4ae46768 Fixed typo. 2010-09-09 13:21:38 +02:00
Tobias Brunner b1baa90846 Fixed copy/paste error. 2010-09-09 10:10:43 +02:00
Tobias Brunner 3255e489be Of course, mark is also supported by pluto. 2010-09-06 12:04:26 +02:00
Tobias Brunner a674c79a37 mark_in and mark_out are also supported by pluto. 2010-09-06 11:53:59 +02:00
Tobias Brunner ddc961c369 Fixed left-/rightnexthop ipsec.conf options. 2010-09-03 11:47:42 +02:00
Tobias Brunner 1dfd6d18ff pluto: Removed unused lifetime from raw_eroute. 2010-09-02 19:04:26 +02:00
Tobias Brunner b5be105aaf pluto: Added support for statically configured reqids. 2010-09-02 19:04:25 +02:00
Tobias Brunner fe962bc788 testing: Added ikev1 xfrm mark scenarios. 2010-09-02 19:04:25 +02:00
Tobias Brunner f8edbc22c7 pluto: Make marks available in updown script. 2010-09-02 19:04:25 +02:00
Tobias Brunner 190ee00c94 pluto: Fixed comparison of connections, if marks are specified. 2010-09-02 19:04:25 +02:00
Tobias Brunner a280ba9525 pluto: Store xfrm marks on connection and use them when installing SAs and policies. 2010-09-02 19:04:25 +02:00
Tobias Brunner a0d13f42e6 starter: Some whitespace cleanup. 2010-09-02 19:04:25 +02:00
Tobias Brunner f23e7394ae pluto: Added PLUTO_UDP_ENC argument to updown script. 
This contains the remote UDP port in case of UDP encapsulated ESP.
 2010-09-02 19:04:25 +02:00
Tobias Brunner 3251294ceb pluto: Return value fixed. 2010-09-02 19:04:25 +02:00
Tobias Brunner d499bdf393 pluto: Removed bare shunt table. 2010-09-02 19:04:24 +02:00
Tobias Brunner b8bf01ddee Do not install routes for pluto. 
There are some incompatibilities with e.g. passthrough policies.
Pluto installs required source routes via updown script.
 2010-09-02 19:04:24 +02:00
Tobias Brunner 76467e030c pluto: Handle changed NAT mappings via libhydra's kernel interface. 2010-09-02 19:04:24 +02:00
Tobias Brunner a0cbce9e7c pluto: Removed no_klips flag (--noklips option). 2010-09-02 19:04:24 +02:00
Tobias Brunner eeca1b0466 pluto: Removed references to KLIPS from documentation, log messages and comments. 2010-09-02 19:04:24 +02:00
Tobias Brunner 6374671110 pluto: Added --debug-kernel as alias for --debug-klips. 2010-09-02 19:04:24 +02:00
Tobias Brunner ebdbf28a4a pluto: Replaced DBG_KLIPS with DBG_KERNEL. 2010-09-02 19:04:24 +02:00
Tobias Brunner 8dade8e6eb pluto: Removed the KLIPS preprocessor flag. 2010-09-02 19:04:24 +02:00
Tobias Brunner fc06e34e46 pluto: Removed unneeded kernel abstractions. 2010-09-02 19:04:23 +02:00
Tobias Brunner 36ff473016 pluto: Completely removed struct kernel_ops. 2010-09-02 19:04:23 +02:00
Tobias Brunner 296972aeaf pluto: Refactored PF_KEY capabilities registration. 
Although we use the kernel interface from libhydra we still need this to make
the available algorithms known to pluto.
 2010-09-02 19:04:23 +02:00
Tobias Brunner 4f898afc22 pluto: Removed unneeded functions from PF_KEY interface. 
We still use the algorithm registration.
 2010-09-02 19:04:23 +02:00
Tobias Brunner 03ee9623f3 pluto: Completely removed orphaned_holds. 2010-09-02 19:04:23 +02:00
Tobias Brunner f6697eadb9 Scheduler and processor have been moved to libstrongswan. 
Also reverts 0c21dc000d as the dependency
to libcharon is no longer required.
 2010-09-02 19:04:23 +02:00
Tobias Brunner 44b4f0d06f pluto: Install IN policy of a shunt eroute with protocol. 2010-09-02 19:04:23 +02:00
Tobias Brunner 9052216813 pluto: Fixed byte-order of ports in traffic selectors. 2010-09-02 19:04:23 +02:00
Tobias Brunner 80c0328eec testing: Print output of 'make oldconfig' to STDOUT, besides logging it. 2010-09-02 19:04:23 +02:00
Tobias Brunner f32c0ce7b6 testing: Only sleep after a host has actually been started. 2010-09-02 19:04:22 +02:00
Tobias Brunner ad808bc2a2 testing: Build strongSwan a bit faster using make -j. 2010-09-02 19:04:22 +02:00
Tobias Brunner 38dd45c480 testing: Force the UML Kernel to x86. 2010-09-02 19:04:22 +02:00
Tobias Brunner 91ea48352c testing: Adding kernel-netlink to pluto.load statements. 2010-09-02 19:04:22 +02:00
Tobias Brunner cc9cfc2e11 testing: Added missing host alice to test.conf. 2010-09-02 19:04:22 +02:00
Tobias Brunner 06cdeac25f Charon specific strongswan.conf options generalized. 2010-09-02 19:04:22 +02:00
Tobias Brunner c6fd7549e8 pluto: Listen for kernel events via libhydra's kernel interface. 2010-09-02 19:04:22 +02:00
Tobias Brunner 40bbff5dbf pluto: Adapted kernel.c to changed kernel interface. 2010-09-02 19:04:22 +02:00
Tobias Brunner 71b6d2ff5e Adapted child_sa_t to changed kernel interface. 2010-09-02 19:04:22 +02:00
Tobias Brunner 34cf6def83 Fixing installation of trap policies (SPI=0) in kernel interface. 2010-09-02 19:04:21 +02:00
Tobias Brunner c3f4d68f0d pluto: Do not close all file descriptors on startup, just redirect stdin, stdout and stderr to /dev/null. 
Otherwise the pipe used to synchronize pluto->events with the main
thread would be closed.
 2010-09-02 19:04:21 +02:00
Tobias Brunner 8808edfb4c pluto: Added a generic event queue. 
This allows to easily execute arbitrary callbacks in the context of the pluto
main thread (e.g. in order to synchronize with threads from the thread-pool).
 2010-09-02 19:04:21 +02:00
Tobias Brunner 4cf459a054 pluto: Fixed the reqid that is passed to the updown script. 2010-09-02 19:04:21 +02:00
Tobias Brunner 199a415710 pluto: Migrated setup_half_ipsec_sa to libhydra's kernel interface. 2010-09-02 19:04:21 +02:00
Tobias Brunner 44643c2d01 pluto: Removed unneeded get_proto_reqid. 
We will use the same reqid for all protocols, as in charon.
 2010-09-02 19:04:21 +02:00
Tobias Brunner 717d60f13f pluto: Added missing return_on in out_sa. 2010-09-02 19:04:21 +02:00
Tobias Brunner 1d61bcaabd pluto: Use time_monotonic() instead of time() for use time calculation. 
That's because get_sa_info now returns a monotonic timestamp.
 2010-09-02 19:04:21 +02:00
Tobias Brunner 91f44a8bfc pluto: Removed KLIPS specific code from was_eroute_idle. 2010-09-02 19:04:21 +02:00
Tobias Brunner 013698d51e pluto: Migrated get_sa_info to libhydra's kernel interface. 2010-09-02 19:04:21 +02:00
Tobias Brunner 95898bcc56 pluto: Migrated teardown_half_ipsec_sa to libhydra's kernel interface. 2010-09-02 19:04:20 +02:00
Tobias Brunner 3ecf66c9e3 pluto: Adapted sag_eroute to the new signature of eroute_connection. 2010-09-02 19:04:20 +02:00
Tobias Brunner 952487d689 pluto: Migrated raw_eroute to libhydra's kernel interface. 
This introduces a new struct to pass the protocol information like spis.
Also adapted eroute_connection and the simple calls of raw_eroute to
the new signature.
 2010-09-02 19:04:20 +02:00
Tobias Brunner deea15f04e pluto: Added a function to create a traffic_selector_t from an ip_subnet. 2010-09-02 19:04:20 +02:00
Tobias Brunner 230aa11fb4 pluto: Migrated update_ipsec_sa to libhydra's kernel interface. 2010-09-02 19:04:20 +02:00
Tobias Brunner 1ad497c78f pluto: Functions to convert IKEv1 ESP algos to IKEv2 identifiers added. 2010-09-02 19:04:20 +02:00
Tobias Brunner 7dd0c17cd4 pluto: Refactored IKEv2/IKEv1 crypto algorithm conversion functions. 2010-09-02 19:04:20 +02:00
Tobias Brunner 6da26f3008 Do not overwrite the original mode when installing policies. 
The mode is later used to decide if a route has to be installed.
 2010-09-02 19:04:20 +02:00
Tobias Brunner afc4505e11 pluto: Removed KLIPS specific algorithm detection. 2010-09-02 19:04:19 +02:00
Tobias Brunner 54f42e350e pluto: Removed KLIPS specific bare shunt scanning. 2010-09-02 19:04:19 +02:00
Tobias Brunner 749d3cccaf Added support for different policy types in kernel_netlink plugin. 2010-09-02 19:04:19 +02:00
Tobias Brunner bd7a2f3bfc Added an option to specify the type of a policy to kernel_ipsec.add_policy. 
This will later allow us to support pluto's passthrough and drop
policies in charon.
 2010-09-02 19:04:19 +02:00
Tobias Brunner 6a066ad19b pluto: Migrated get_my_cpi to libhydra's kernel interface. 2010-09-02 19:04:19 +02:00
Tobias Brunner 89f0cca111 pluto: Migrated get_ipsec_spi to libhydra's kernel interface. 2010-09-02 19:04:19 +02:00
Tobias Brunner 55be07a15f Added support for combined IPComp/ESP/AH policies in kernel_netlink plugin. 2010-09-02 19:04:19 +02:00
Tobias Brunner b4872c1e09 Replaced the protocol argument in add_policy with an optional SPI for an AH SA. 2010-09-02 19:04:19 +02:00
Tobias Brunner c5fb6882f2 Initialize the thread pool in pluto. 2010-09-02 19:04:19 +02:00
Tobias Brunner bb381e26c6 Refer to scheduler and processor via lib and not hydra. 2010-09-02 19:04:18 +02:00
Tobias Brunner e18556e9e9 Moved scheduler and thread pool to libstrongswan. 2010-09-02 19:04:18 +02:00
Tobias Brunner 062a602216 Moved all kernel plugins to libhydra. 2010-09-02 19:01:26 +02:00
Tobias Brunner 08c0d340b8 Moved ipsec_transform_t to kernel_ipsec.h in libhydra. 
Because of this libfreeswan, pluto, starter etc. now depend on that
file (and libhydra). This resolved some duplicate declarations.
 2010-09-02 19:01:25 +02:00
Tobias Brunner f6659688ab Refer to kernel interface via hydra and not charon. 2010-09-02 19:01:25 +02:00
Tobias Brunner 6f449d2efd Moved kernel interface to libhydra. 2010-09-02 19:01:25 +02:00
Tobias Brunner 9f166d9ac2 Removed references to protocol_id_t from kernel interface. 
Instead we use the actual IP protocol identifier (the conversion now happens in
child_sa_t and kernel_handler_t).
 2010-09-02 19:01:25 +02:00
Tobias Brunner 9d94174242 Migrated child_sa_t to INIT/METHOD macros. 2010-09-02 19:01:25 +02:00
Tobias Brunner ba26508d05 Moved roam job creation to kernel event handler. 2010-09-02 19:01:25 +02:00
Tobias Brunner 61e8e73206 Refer to scheduler via hydra and not charon. 2010-09-02 19:01:24 +02:00
Tobias Brunner 8c387909eb Moved scheduler_t to libhydra. 2010-09-02 19:01:24 +02:00