denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
15,626 Commits 1 Branch 0 Tags
e00bc9f6b298bf2ae8151bee83c346d6f867c0cb
Commit Graph
3642 Commits
Author SHA1 Message Date
Martin Willi 578f72ceb0 Raise an alert if half-open timeout limit reached 2012-12-19 10:40:33 +01:00
Martin Willi c57fe7ac6f Raise an alert if an authorize() hook fails 2012-12-19 10:40:33 +01:00
Martin Willi 45d6134218 Raise an alert if allocating virtual IPs fails 2012-12-19 10:40:33 +01:00
Martin Willi f285b9efc8 Raise an alert if kernel policy installation fails 2012-12-19 10:40:33 +01:00
Martin Willi bcf3147e0a Raise an alert if kernel SA installation fails 2012-12-19 10:40:33 +01:00
Martin Willi 24f30ec92f Raise an alert on traffic selector mismatch 2012-12-19 10:40:32 +01:00
Martin Willi c794455666 Raise alerts when enforcing IKE_SA unique policy 2012-12-19 10:40:32 +01:00
Martin Willi 5dd9c3087f Raise an alert if CHILD_SA proposals mismatch 2012-12-19 10:40:32 +01:00
Martin Willi bab949bb26 Raise an alert if IKE proposals mismatch 2012-12-19 10:40:32 +01:00
Martin Willi 3f7f5388a5 Raise an alert of generating local authentication data fails 2012-12-19 10:40:32 +01:00
Tobias Brunner 0080daa787 Fix deadlock in IMC/IMV managers 
Since reserve_id() might be called from e.g. notify_connection_change()
using a write lock will not work as this can't be acquired while holding
the read lock.

Also, with the previous code it was possible that two IMCs/IMVs added by
two threads at the same time would get the same ID assigned.
 2012-12-18 15:59:29 +01:00
Tobias Brunner 6a8eeba540 Properly select IMC/IMV according to given primary ID in reserve_id() 2012-12-18 15:59:29 +01:00
Martin Willi d9d0f12222 If load-tester requests a virtual IP, use a dynamic local traffic selector 2012-12-17 14:22:25 +01:00
Tobias Brunner 283898d6e0 Fix traffic selectors also as initiator in case of transport mode over NAT 2012-12-13 15:27:29 +01:00
Tobias Brunner 2990671748 Fix debug output if responder selected invalid traffic selectors during QM 2012-12-13 15:27:28 +01:00
Martin Willi df75cc5c5f Migrate RADIUS accounting state while IKE_SA unique id changes during rekey 2012-12-11 10:40:59 +01:00
Martin Willi 251b740712 Migrate cache and fire lookip events for unique_id change during IKE_SA rekey 2012-12-10 17:04:26 +01:00
Martin Willi 43b4c2ea75 Inherit virtual IP and attributes from old to new, not from new to old 2012-12-10 17:01:00 +01:00
Andreas Steffen 92e75e4535 optionally skip dlclose() of IMCs/IMVs in order to track memory leaks 2012-12-09 19:35:23 +01:00
Martin Willi 137ea41f45 Properly trigger ike_updown() event if IKEv1 DPD times out 
Fixes missing RADIUS Accounting Stop, #257.
 2012-12-04 11:11:50 +01:00
Martin Willi 01bc9bf428 Fix GPL license header to properly "sed" it 2012-11-30 18:00:33 +01:00
Martin Willi c543616315 Add locking to IMC/IMV managers to add/remove IMC/IMVs on the fly 2012-11-30 15:49:23 +01:00
Martin Willi 016d343a50 Add wrappers to IMC/IMV managers loading IMC/IMVs from function pointers 2012-11-30 15:48:20 +01:00
Martin Willi be18ee8123 If adding an IMC/IMV fails, terminate() it only if it has been initialize()d 2012-11-30 15:48:13 +01:00
Martin Willi fd885fd390 Add an IMV constructor taking a set of custom TNC_IMV functions 2012-11-30 15:48:02 +01:00
Martin Willi f1f500c724 Add an IMC constructor taking a set of custom TNC_IMC functions 2012-11-30 15:47:59 +01:00
Martin Willi cd74959465 Clean up memory management when loading IMC/IMVs from files 2012-11-30 15:47:34 +01:00
Martin Willi db9c8b6fba Fix passing of IKE_SA unique_id over lookip socket 2012-11-30 13:44:12 +01:00
Martin Willi 48828ff0db Store load-tester address leases in a hashtable for fast removal 2012-11-29 10:22:52 +01:00
Martin Willi d88597f0dd Don't wait while removing external IPs used for load testing 2012-11-29 10:22:51 +01:00
Martin Willi b185cdd16d Install virtual IPs via interface name, and use an interface lookup where required 2012-11-29 10:22:51 +01:00
Martin Willi 0a54d3e1a1 load-tester can dynamically install a dedicated external IP for each IKE_SA 
For consistency, the local/remote parameters have been replaced by the
initiator/responder options. As initiator, the initiator option can
be overriden by an addrs section taking key/value pairs with address
pools to use on a specific interface.
 2012-11-29 10:22:51 +01:00
Martin Willi 50bd755871 Add an optional kernel-interface parameter to install IPs with a custom prefix 2012-11-29 10:22:51 +01:00
Martin Willi fdd94fc846 Add a delay option to load-tester socket 2012-11-29 10:22:51 +01:00
Martin Willi cf85f6b296 Indicate message retransmissions while initiating load-test batches 2012-11-29 10:22:51 +01:00
Martin Willi 3c79b7b7db Add alerts for sent/received message retransmissions and timeout 2012-11-29 10:22:51 +01:00
Martin Willi 93ceaa7e64 Initiate each load-testing connection with a fresh peer config 2012-11-29 10:22:51 +01:00
Martin Willi b7acd90763 Initiate IKE_SAs trigger over load-tester socket in parallel 2012-11-29 10:22:51 +01:00
Martin Willi 965f7bd54f Add a simple load-tester utility to initiate over control socket 2012-11-29 10:22:51 +01:00
Martin Willi d65683eef4 Add a load-tester control socket to manually trigger initiation 2012-11-29 10:22:50 +01:00
Martin Willi 2685020ace Lookip plugin additionally reports the IKE_SA unique identifier 2012-11-29 10:00:45 +01:00
Martin Willi b5d27839ad Do not send 0.0.0.0/0 traffic selectors as Split-Include Unity attributes 
It seems that iOS devices don't like them.
 2012-11-22 12:13:44 +01:00
Martin Willi 2354b10576 Add an ikesa_limit option to limit number of IKE_SAs as responder 2012-11-16 10:27:36 +01:00
Martin Willi 5b89e3b061 Pass PLUTO_XAUTH_ID to updown script 2012-11-16 09:56:05 +01:00
Martin Willi de4c1def83 libcharon can be initialized more than once 2012-11-14 10:14:37 +01:00
Andreas Steffen 3de9a31a49 centralized processing of assessment information 2012-11-12 10:45:38 +01:00
Tobias Brunner eba65182e4 Include 'aggressive' when comparing peer_cfg_t objects 2012-11-07 12:44:58 +01:00
Tobias Brunner bf0bcee9ec Fixed output of longer debug messages 
(v)snprintf(3) returns the length without terminating null byte but the
length given as parameter must include it.
 2012-11-07 12:44:58 +01:00
Tobias Brunner ed05a1a3b7 'signal' is a keyword in MySQL 5.5 
Fixes #251.
 2012-11-07 12:37:23 +01:00
Tobias Brunner 214c081dd6 Log sent vendor IDs for IKEv1 2012-11-02 15:52:19 +01:00