denozord/strongswan-ext
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
13,115 Commits 3 Branches 0 Tags
d345f0b75d3f341c21223de4e4f7380303f3fa28
Commit Graph
10340 Commits
Author SHA1 Message Date
Andreas Steffen 927dff2366 The policy_started check is not needed any more 2014-06-18 14:01:02 +02:00
Tobias Brunner abe116cdf8 ikev1: Allow late connection switching based on XAuth username 2014-06-18 09:30:07 +02:00
Tobias Brunner aba55fdffe identification: Only use either , or / to separate RDNs 
If a DN starts with a slash (or whitespace and a slash) slashes will
be used, otherwise commas.
 2014-06-18 09:24:03 +02:00
Tobias Brunner 846fd70eec sshkey: Fix loading of ECDSA keys from files 2014-06-18 09:16:24 +02:00
Tobias Brunner 1cda692110 sshkey: Add support to parse SSH public keys from files with left|rightsigkey 2014-06-18 09:16:24 +02:00
Martin Willi 5885ec2a27 vici: Support memory stats without leak-detective on Windows 2014-06-17 17:55:45 +02:00
Martin Willi df93458685 swanctl: Add a --stats command to print daemon infos and statistics 2014-06-17 17:55:45 +02:00
Martin Willi 65689ce76a vici: Add a stats command returning various daemon infos and statistics 2014-06-17 17:55:45 +02:00
Martin Willi 19ea055092 swanctl: Support private key decryption passhprases in swanctl.conf 
While there is no real security benefit of storing private keys encrypted if
the passphrase is stored along with it, there still seems to be demand for this
functionality. We add it for compatibility with ipsec.secrets, even if it is
not really recommended.
 2014-06-17 17:52:14 +02:00
Martin Willi 5b7725f3b0 swanctl: Document replay_window option 2014-06-17 16:49:02 +02:00
Martin Willi d73a46171d vici: Support a replay_window CHILD_SA option 2014-06-17 16:41:31 +02:00
Martin Willi d5367d2262 starter: Add a replay_window connection option 2014-06-17 16:41:31 +02:00
Martin Willi 823ce4a37f kernel-pfkey: Support connection specific replay window sizes up to 32 packets 2014-06-17 16:41:30 +02:00
Martin Willi 44098fbaca kernel-netlink: Support connection specific replay window sizes 2014-06-17 16:41:30 +02:00
Martin Willi 30c009c2fe kernel-interface: Add a replay_window parameter to add_sa() 2014-06-17 16:41:30 +02:00
Martin Willi bdcaa5e680 child-cfg: Store connection specific replay window on CHILD_SA config 2014-06-17 15:42:02 +02:00
Martin Willi dff39a4c5b windows: Declare strerror_s() 
Older MinGW versions seem to miss this function declaration. Fixes build on
Travis using Ubuntu 12.04.
 2014-06-17 15:23:33 +02:00
Martin Willi 1bcf850738 windows: Extend strerror_r/s by extended POSIX errno strings 2014-06-17 15:23:33 +02:00
Martin Willi c2119cded4 windows: Implement strerror_r using strerror_s 2014-06-17 15:23:33 +02:00
Martin Willi 8b5d41a274 windows: Wrap most Winsock2 Posix functions to set errno 
While Winsock provides many Posix compatibility functions, they do not set
errno, but use WSAGetLastError() for error reporting. The wrapped functions
derive an errno from WSAGetLastError() on failure.
 2014-06-17 15:23:32 +02:00
Martin Willi bc1139480f watcher: Prevent race condition spawning multiple watcher threads 
If file descriptors get added and removed in rapid succession, the active
watcher thread might not take notice of it and continues running. However, add()
spawns a watcher thread whenever a file descriptor is added to an empty set.
This could result in multiple watcher threads, which is fixed by a proper
check for running watchers.
 2014-06-17 15:19:47 +02:00
Martin Willi 23750961d5 thread-value: Defer cleanup handling to thread termination on Windows 
Instead of cleaning up all thread-values during destruction, cleanup handler
is invoked when a thread detaches. Thread detaching is cough using the Windows
DllMain() entry point, and allows us to basically revert 204098a7.

Using this mechanism, we make sure that the cleanup handler is invoked by the
the correct thread. Further, this mechanism works for externally-spawned
threads which run outside of our thread_cb() routine, and works more efficiently
with short-running threads.
 2014-06-17 15:19:40 +02:00
Martin Willi 2d846c2035 socket-win: Use non-overlapped I/O and socket event selection 
The use of overlapped I/O was incorrect, as we passed stack based buffers, but
did not cancel/wait for pending completion on all sockets. Our receive-from-all
socket interface is actually tricky to implement using overlapped I/O. Switch
to WSAEventSelect() event management, which can be canceled properly while
working in a select()-like way.
 2014-06-17 15:19:25 +02:00
Martin Willi eef7427b0f bus: Add a handle_vips() hook invoked after handling configuration attributes 
Similar to assign_vips() used by a peer assigning virtual IPs to the other peer,
the handle_vips() hook gets invoked on a peers after receiving attributes. On
release of the same attributes the hook gets invoked again.

This is useful to inspect handled attributes, as the ike_updown() hook is
invoked after authentication, when attributes have not been handled yet.
 2014-06-17 15:14:51 +02:00
Martin Willi 7fc98a840b ikev1: Invoke the assign_vips() bus hook for IKEv1 as well 2014-06-16 15:59:17 +02:00
Martin Willi 9d257034d8 ike: Create an enumerator for (un-)handled configuration attributes on IKE_SA 2014-06-16 15:59:17 +02:00
Martin Willi 5ae3221075 ike: Store unhandled attributes on IKE_SA as well 2014-06-16 15:59:16 +02:00
Andreas Steffen dacb75f5c0 Split swanctl --raw mode into single-line and --pretty mode 2014-06-14 15:40:22 +02:00
Andreas Steffen 3a9602d58b Allow multiple hash values in the file reference database 2014-06-10 16:48:15 +02:00
Andreas Steffen 8fc0eae37b Added Android 4.3 and 4.4.3 to imv database 2014-06-10 16:19:00 +02:00
Andreas Steffen 6d092615e3 Added missing units (s = seconds) 2014-06-10 16:18:23 +02:00
Andreas Steffen 352fd7a94b Fixes in SWID entity support 2014-06-08 11:13:51 +02:00
Martin Willi 9c62511c08 windows: Link against psapi32 
On some version GetModuleFileNameEx/GetModuleInformation is in psapi32 instead
of kernel32. We link to both libraries to make sure we have it.
 2014-06-06 16:28:28 +02:00
Martin Willi 8c2c63e09d backtrace: Use GetModuleInformation/GetModuleFileNameEx directly on Win32 
The K32 variants are actually needed on 64-bit only.
 2014-06-06 16:28:28 +02:00
Martin Willi cab59c73fc windows: Use WINAPI call convention for Windows API callbacks 
For x86_64 it does not actually matter, but for i686 builds the call convention
is different with WINAPI.
 2014-06-06 16:28:28 +02:00
Andreas Steffen e247acb8a9 Ubuntu 14.04 updated to 3.13.0-29 kernel 2014-06-06 11:18:17 +02:00
Andreas Steffen 438df3d696 Extended pt-tls-client PLUGINS list 2014-06-06 11:18:17 +02:00
Andreas Steffen b23c7d6a38 Updated REST API 2014-06-06 10:56:12 +02:00
Tobias Brunner 35e08cde3c android: Add all Android.mk files to the tarball 2014-06-06 10:12:26 +02:00
Martin Willi f48c26bce3 pki: Support complex trustchain and revocation checking in --verify 2014-06-04 16:34:16 +02:00
Martin Willi 74eedc8061 unit-tests: Zero-initialize chunk to avoid free on non-successful fetch 
If the fetch fails, the fetcher is not required to return an empty chunk. Avoid
the resulting invalid free() by initializing data.ptr to NULL.
 2014-06-04 16:34:16 +02:00
Martin Willi 8a072fc50a winhttp: Support basic authentication for URLs having credentials 2014-06-04 16:34:16 +02:00
Martin Willi 2e0816e1df winhttp: Support new response code fetcher option 2014-06-04 16:34:15 +02:00
Martin Willi 6f90fc8061 winhttp: Implement a http(s) fetcher based on Microsofts WinHTTP API 2014-06-04 16:34:15 +02:00
Martin Willi 4b9848a2cc kernel-wfp: Include Windows header patch for MinGW 4.8.1 2014-06-04 16:32:12 +02:00
Martin Willi 75afbeee21 kernel-wfp: Clone acquire traffic selectors only if they exist 2014-06-04 16:32:11 +02:00
Martin Willi 78bde29a7c kernel-wfp: Install routes for trap policies 2014-06-04 16:32:11 +02:00
Martin Willi e36d1d4124 kernel-wfp: Refactor route management to separate function 2014-06-04 16:32:11 +02:00
Martin Willi 4a8ba369b6 kernel-wfp: Install tunnel mode policies to appropriate sub-layers 
While it is unclear if this has any effect at all, we prefer specific sublayers
to install policies as suggested.
 2014-06-04 16:32:11 +02:00
Martin Willi be32be01a8 kernel-wfp: Declare GUIDs and auth/cipher configs missing in some MinGW builds 2014-06-04 16:32:11 +02:00