denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
10,675 Commits 1 Branch 0 Tags
d29246cabe581f4937e740e251a935e629556f86
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Martin Willi d29246cabe Merge branch 'radius-ext' 
Bring some extensions to eap-radius, namely a virtual IP address provider based
on received Framed-IPs, forwarding of Cisco Unity banners, Interim Accounting
updates and the reporting of sent/received packets.
 2013-03-18 10:13:36 +01:00
Martin Willi 048872f2f7 Merge branch 'stroke-counters' 
Extend stroke counters functionality by connection specific counters, and
a resetcounters command to reset the global or connection counters.
 2013-03-18 10:12:22 +01:00
Martin Willi e85c0f6b84 Merge branch 'stroke-timeout' 
Add a strongswan.conf timeout option for stroke control commands.
 2013-03-18 10:11:46 +01:00
Martin Willi cb14ecb1d3 Merge branch 'netlink-align' 
Fixes some Netlink alignment issues, and then refactors Netlink XFRM message
attribute handling.
 2013-03-18 10:09:35 +01:00
Martin Willi 94163816fa Use netlink_add_attribute() to copy over attributes during update_sa() 2013-03-15 16:02:01 +01:00
Martin Willi 0d9f31e1ed Use a helper function to add XFRM_MARK attribute 2013-03-15 16:02:01 +01:00
Martin Willi 6dfc633927 Use netlink_reserve() helper function in XFRM to simplify message construction 2013-03-15 16:02:01 +01:00
Martin Willi 6359ab04f4 Add a Netlink utility function to add a RTA header and reserve space for data 2013-03-15 14:32:51 +01:00
Martin Willi 53c98f098f Correctly check buffer length in netlink_add_attribute() 2013-03-15 14:32:25 +01:00
Martin Willi 6ac601f543 Avoid unneeded termination of netlink algorithm name arrays with END_OF_LIST 2013-03-15 14:01:15 +01:00
Martin Willi cf729248b2 Add a "resetcounters" command to ipsec, clearing global or connection counters 2013-03-15 10:55:22 +01:00
Martin Willi d022322bed Add connection name specific stroke counters 2013-03-15 10:41:04 +01:00
Martin Willi a34ffd1c05 Add a chunk_from_str() initializer that does not include 0-terminator 2013-03-15 10:36:33 +01:00
Martin Willi e813d218f1 Don't create interim update entries if RADIUS accounting is disabled 2013-03-14 16:44:09 +01:00
Martin Willi d019764ab6 Add support for RADIUS Interim accounting updates 2013-03-14 16:35:11 +01:00
Martin Willi 1ba1cd0c9b Add an option to delete any established IKE_SA if RADIUS server is not responding 2013-03-14 15:42:30 +01:00
Martin Willi 49960f021d Make check whether to use IKEv1 fragmentation more readable 2013-03-14 14:20:55 +01:00
Martin Willi 552b8ad5f5 Send Acct-Terminate-Cause based on some alerts catched on the bus 
Currently supported are user disconnects, session timeouts and if the peer does
not respond on IKE packets or DPDs.
 2013-03-14 14:20:55 +01:00
Martin Willi 335982169a When IKEv1 DPD times out, raise missing SEND_RETRANSMIT_TIMOUT alert 2013-03-14 14:20:54 +01:00
Martin Willi c45cf9048e Raise an alert if an IKE_SA could not have been reauthenticated and expires 2013-03-14 14:20:54 +01:00
Martin Willi 68c12fd9f9 Send NAS-Port, NAS-IP and Calling/Called-Station-ID in Accounting-Requests 2013-03-14 14:20:54 +01:00
Martin Willi b4568ca230 Support RADIUS accounting of sent/received packets 2013-03-14 14:20:54 +01:00
Martin Willi d28391a244 Report the number of processed packets in "ipsec statusall" 2013-03-14 14:20:54 +01:00
Martin Willi d954a2081b child_sa_t.get_usestats() can additionally return the number of processed packets 2013-03-14 14:20:54 +01:00
Martin Willi 6b35ab84da Pass correclty sized pointer to lookup_algorithm() in PF_KEY 2013-03-14 14:20:54 +01:00
Martin Willi 7eeeb1c702 kernel_ipsec_t.query_sa() additionally returns the number of processed packets 2013-03-14 14:20:54 +01:00
Martin Willi 003452d18f Send NAS-Port, NAS-IP and Calling/Called-Station-ID in Access-Request 2013-03-13 15:20:11 +01:00
Martin Willi 02bf38890d Forward Cisco Banner received from RADIUS to Unity capable clients 2013-03-12 20:37:35 +01:00
Martin Willi 54b3cbdc78 Add a radius message method to enumerate vendor specific attributes 2013-03-12 20:37:35 +01:00
Martin Willi b4d172aa8e Add Altiga Private Enterprise Numbers that Cisco uses in VPN 3000 2013-03-12 20:31:10 +01:00
Martin Willi f4c8e6def7 In eap-radius, hand out received Framed-IP-Address attributes as virtual IP 2013-03-12 17:44:13 +01:00
Martin Willi 3a23794fa2 Add missing XAuthRespPSK switch case to IKEv1 key derivation 2013-03-12 10:09:23 +01:00
Martin Willi cf6a4ea005 strdup() iface passed to queue_route_reinstall(), fixing double-free 2013-03-11 15:17:50 +01:00
Martin Willi d6b6d1ecdb Support mutliple subnets and ranges as external load-tester addresses 2013-03-11 15:16:13 +01:00
Martin Willi 0897cda33b Add a constructor to create in-memory pools from an address range 2013-03-11 15:12:47 +01:00
Martin Willi d3f5a05e29 When adding Netlink attributes, increase header length with potential alignment 
If the payload is unaligned, we must make sure the total netlink message
length includes the added alignment for the first attribute.
 2013-03-11 12:32:21 +01:00
Martin Willi 8f727d8007 Clean up IKE_SA state if IKE_SA_INIT request does not have message ID 0 2013-03-11 11:30:47 +01:00
Martin Willi 0235914d2f Ignore fourth Qick Mode message sent by Windows servers. 
Initial patch by Paul Stewart, fixes #289.
 2013-03-11 10:53:55 +01:00
Martin Willi 7d70a14779 Merge branch 'pt-tls' 2013-03-07 14:10:50 +01:00
Martin Willi 83e2c81924 If controller operations have a callback, don't succeed before hook gets called 2013-03-07 12:17:01 +01:00
Martin Willi 5807f9cfcd Add a stroke command timeout option, and report status of completed command 2013-03-07 11:59:30 +01:00
Martin Willi 9d9042d6d9 As Quick Mode initiator, select a subset of the proposed and the returned TS 
Cisco 5505 firewalls don't return the port if we send a specific one, letting
the is_contained_in() checks fail. Using get_subset() selection builds the
Quick Mode correctly with the common subset of selectors.

Based on an initial patch from Paul Stewart.
 2013-03-07 10:00:06 +01:00
Martin Willi 1db6bf2f3f If TLS peer authentication not required, the client does nonetheless, allow it to fail 2013-03-06 15:53:12 +01:00
Martin Willi ad9af9e2d8 Fix some apidoc in mem_pool.h 2013-03-06 10:26:52 +01:00
Martin Willi b668f1417d Don't invoke addr2line if dladdr() did not yield a filename 2013-03-04 15:50:21 +01:00
Martin Willi 1f69412b4d When receiving critical signals, additionally log backtraces to syslog/files 2013-03-04 15:46:34 +01:00
Martin Willi fe03f51302 backtrace_t.log() takes a NULL file pointer to log to registered dbg() hook 2013-03-04 15:45:03 +01:00
Martin Willi 8b24863b1f Don't use color escapes when printing backtraces to a non-TTY file 2013-03-04 15:07:03 +01:00
Martin Willi 4d17427205 Add a utility function to resolve TTY color escape codes dynamically 2013-03-04 15:04:56 +01:00
Martin Willi 4dd8d5430d Merge branch 'multi-eap' 
Fixes the use of EAP methods in the non-first authentication round if the
initiator demands mutual EAP. Also mutual EAP can now be enforced when the
initiator sets rightauth=eap, not only with rightauth=any.
 2013-03-01 11:36:41 +01:00
Martin Willi e82deaf6ce Merge branch 'multi-cert' 
Allows the configuration of multiple certificates in leftcert, and select
the correct certificate to use based on the received certificate requests.
 2013-03-01 11:35:32 +01:00
Martin Willi adf239abca Merge branch 'systime' 
Add a systime-fix plugin allowing an embedded system to validate certificates
if the system time has not been synchronized after boot. Certificates of
established tunnels can be re-validated after the system time gets valid.
 2013-03-01 11:33:47 +01:00
Martin Willi b611d8ba48 Merge branch 'ikev1-rekeying' 
Migrates Quick Modes to the new Main Mode if an IKEv1 reauthentication replaces
the old Main Mode having a uniqueids=replace policy.
 2013-03-01 11:32:02 +01:00
Martin Willi ec1b4e6638 Merge branch 'vip-shunts' 
Installs bypass policies for the physical address if a virtual address is
assigned, and installs a proper source route to actually use the physical
address for bypassed destinations.

Conflicts:
	src/libcharon/plugins/unity/unity_handler.c
 2013-03-01 11:30:13 +01:00
Martin Willi a36b49f3cb Merge branch 'opaque-ports' 
Adds a %opaque port option and support for port ranges in left/rightprotoport.
Currently not supported by any of our kernel backends.
 2013-03-01 11:27:12 +01:00
Martin Willi 53fcc70acc When running with an unprivileged user, initialize supplementary groups 2013-03-01 11:27:01 +01:00
Martin Willi 21dd4c4bea Without MOBIKE, update remote host only if it is behind NAT 2013-03-01 11:26:47 +01:00
Martin Willi 00683b6864 Merge branch 'ikev1-mm-retransmits' 
Fixes retransmit of the last Main Mode or IKE_AUTH message, and correctly
queues Main Mode messages when processing of the last message is still in
progress.
 2013-03-01 11:24:42 +01:00
Martin Willi d634109f1d Merge branch 'tfc-notify' 
Introduces kernel backend features, sends ESP_TFC_PADDING_NOT_SUPPORTED if
kernel does not support it.
 2013-03-01 11:16:58 +01:00
Martin Willi 5c55be4915 Send ESP_TFC_PADDING_NOT_SUPPORTED if the used kernel doesn't support it 2013-03-01 11:12:17 +01:00
Martin Willi 53e62f5d0c Indicate support for processing ESPv3 TFC padding in Netlink IPsec backend 2013-03-01 11:11:51 +01:00
Martin Willi 76f7d80e80 Introduce "features" for the kernel backends returning kernel capabilities 2013-03-01 11:11:24 +01:00
Martin Willi 61f1693df1 Support different authentication schemes for PT-TLS 2013-02-28 16:46:08 +01:00
Martin Willi 807f2facd0 Request a TLS client certificate even if no peer identity is given 
This allows a peer to perform client authentication if it wants, but skip
it if not.
 2013-02-28 16:46:08 +01:00
Martin Willi 257c80cb5b Wrap tls_t.get_{server,peer}_id methods in tls_socket_t 2013-02-28 16:46:08 +01:00
Martin Willi 2de481e32b Delegate tls_t.get_{peer,server}_id to handshake layer 
This allows to get updated peer identities if the peer can't authenticate,
or does when it is optional.
 2013-02-28 16:46:08 +01:00
Martin Willi 2ae0c9e618 Implement a SASL PLAIN mechanism using shared secrets 2013-02-28 16:46:07 +01:00
Martin Willi 66d8fd690c Implement SASL authentication in PT-TLS client 2013-02-28 16:46:07 +01:00
Martin Willi 3542c4f18a Implement SASL authentication in PT-TLS server 2013-02-28 16:46:07 +01:00
Martin Willi 5b1a10836c Define PT-TLS SASL result codes 2013-02-28 16:46:07 +01:00
Martin Willi 4a801beb3e Define an interface for SASL mechanisms and provide a static factory 2013-02-28 16:46:07 +01:00
Martin Willi 806126eab2 Pass a client identity to pt_tls_client, usable for TLS or SASL authentication 2013-02-28 16:46:07 +01:00
Martin Willi 55854ecc25 Don't close underlying file descriptor before destroying a tls_socket 
tls_socket cleanup usually sends a TLS close notify, for which it uses a valid
socket.
 2013-02-28 16:46:07 +01:00
Martin Willi d8a94c18c6 Apply a mutual EAP auth_cfg not before the EAP method completes 2013-02-26 13:15:27 +01:00
Martin Willi cc787697b8 Be a little more verbose why a peer_cfg is inacceptable 2013-02-26 13:15:27 +01:00
Martin Willi 289b9b7b31 Refactor auth_cfg applying to a common function 2013-02-26 13:15:27 +01:00
Martin Willi e2857be823 For IKEv1 Main Mode, use message hash to detect early retransmissions 
As the message ID is zero in all Main Mode messages, it can't be used to detect
if we are already processing a given message.
 2013-02-25 12:12:38 +01:00
Martin Willi cdf75a39e3 Move initial message dropping to task manager 
When the last request message of the initial tunnel setup is retransmitted,
we must retransmit the response instead of ignoring the request.

Fixes #295.
 2013-02-25 12:12:19 +01:00
Martin Willi 9eaed7a5bb Use INIT macro to initialize IKE_SA manager entries 2013-02-25 12:10:02 +01:00
Martin Willi b443fa6123 Don't reject OPAQUE ports while verifying traffic selector substructure 2013-02-21 11:52:33 +01:00
Martin Willi 0abeac3a0b Document ipsec.conf leftprotoport extensions in manpage 2013-02-21 11:52:33 +01:00
Martin Willi 0e7ef7f522 Optionally support port ranges in leftprotoport 2013-02-21 11:52:33 +01:00
Martin Willi fd658bce28 Support %opaque keyword in leftprotoport for "opaque" ports 2013-02-21 11:52:33 +01:00
Martin Willi cd41b951ee Pass complete port range over stroke interface for more flexibility 2013-02-21 11:52:33 +01:00
Martin Willi a1db77de7c Use a complete port range in traffic_selector_create_from_{subnet,cidr} 2013-02-21 11:52:33 +01:00
Martin Willi c572b5c8c1 Print OPAQUE traffic selectors as what they are, not as port range 2013-02-21 11:52:33 +01:00
Martin Willi 7b368af61a Support "opaque" ports in traffic selector subset calculation 2013-02-21 10:51:19 +01:00
Martin Willi 7dbe1feef1 Slightly refactor traffic_selector_t.get_subset() 2013-02-21 10:48:48 +01:00
Martin Willi de5d569b24 Migrate remaining traffic selector methods to METHOD macro 2013-02-21 10:28:21 +01:00
Martin Willi a2fd08dd26 Install a route for shunt policies 
If we install a virtual IP, its source route would render the shunt policy
useless, as locally generated traffic wouldn't match. Having a route for each
shunt policy with higher priority chooses the correct source address for
bypassed destinations.
 2013-02-20 16:32:24 +01:00
Martin Willi 122b4b6e6d Include local address for Unity Split-Exclude shunt policies 
If we use a virtual IP, having a shunt policy for just that wouldn't work, as
we want a shunt bypass using the local address.
 2013-02-20 16:15:39 +01:00
Martin Willi 3dc9d427c9 After IKEv1 reauthentication, reinstall VIP routes after migrating CHILD_SAs 
During IKEv1 reauthentication, the virtual IP gets removed, then reinstalled.
The CHILD_SAs get migrated, but any associated route gets removed from the
kernel. Reinstall routes after adding the virtual IP again.
 2013-02-20 09:16:00 +01:00
Martin Willi f836d433a9 When detecting a duplicate IKEv1 SA, adopt children, as it might be a rekeying 2013-02-20 08:57:17 +01:00
Martin Willi 295e42a47f systime-fix disables certificate lifetime validation if system time not synced 
The system time can be periodically checked. If it gets valid, certificates get
rechecked with the current lifetime. If certificates are invalid, associated
IKE_SAs can be closed or reauthenticated.
 2013-02-19 17:11:14 +01:00
Martin Willi 0ed31e7284 Add a stub for systime-fix, a plugin handling certificate lifetimes gracefully 2013-02-19 14:49:38 +01:00
Martin Willi de399f550d Add a cert_validator hook allowing plugins to provide custom lifetime checking 2013-02-19 14:31:18 +01:00
Martin Willi 790e00aaa9 Make cert_validator_t.validate optional to implement 2013-02-19 14:31:18 +01:00
Martin Willi 69faf63528 Fix encoding of issuerAndSubject while handling SCEP pending state 2013-02-19 09:53:47 +01:00
Martin Willi b5b76df012 Add a timeout to clean up PDP RADIUS connections 2013-02-14 17:20:09 +01:00
Martin Willi dadd9744b6 Keep the PDP connections lock while accessing its objects 
When we introduce connection timeouts, the state may disappear at any time.
This change prevents that, but is not very clear. We probably have to refactor
connection handling.
 2013-02-14 17:19:56 +01:00