denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
9,136 Commits 1 Branch 0 Tags
e07122436c5ad5135f9d62d8f07b26fbe82df6b1
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Tobias Brunner e07122436c Make sure that all features of critical plugins are loaded 2012-06-25 17:03:07 +02:00
Tobias Brunner bc6d944705 Added an option to rename the ipsec script during installation 
Also rename the man page and adjust all references in the script, the
man page and other files.

Closes #194.
 2012-06-25 16:53:38 +02:00
Tobias Brunner d86cf32b4b Removed -o argument when creating .../ipsec.d with install 
This should have been removed with 2b52d5cb41.
 2012-06-25 16:37:34 +02:00
Tobias Brunner 34a80708e2 Updated ipsec script man page after removing pluto 2012-06-25 16:37:34 +02:00
Tobias Brunner 738b9121cb Use mac_t and PRF and signer wrappers in cmac plugin 2012-06-25 16:35:06 +02:00
Tobias Brunner 83cb52b044 Use mac_t and PRF and signer wrappers in xcbc plugin 2012-06-25 16:35:06 +02:00
Tobias Brunner c4a3c9672a Make the hmac_t interface a generic interface for message authentication codes 2012-06-25 16:35:06 +02:00
Tobias Brunner 228d096e42 Simplified creation of PRFs and signers in openssl and hmac plugins 2012-06-25 16:35:06 +02:00
Tobias Brunner 01850f5d55 Function to convert PRFs to hash algorithms added 2012-06-25 16:35:06 +02:00
Tobias Brunner 903093d439 hasher_algorithm_from_integrity() optionally returns truncation length 2012-06-25 16:35:06 +02:00
Tobias Brunner 73d032e412 Use simple wrappers for HMAC based PRF and signer in openssl plugin 2012-06-25 16:35:06 +02:00
Tobias Brunner 63420c6e13 Use simple wrappers for HMAC based PRF and signer in hmac plugin 2012-06-25 16:35:06 +02:00
Tobias Brunner 57ff4be874 Simple wrappers for HMAC based prf_t and signer_t implementations added 2012-06-25 16:35:06 +02:00
Tobias Brunner 8391c1d0b1 Refactored OpenSSL based HMAC implementation 2012-06-25 16:35:06 +02:00
Tobias Brunner 7beb31aae4 Fixed IPv6 source address lookup 
Because Linux kernels prior to 3.0 do not support RTA_PREFSRC for
IPv6 routes we didn't use NLM_F_DUMP to get all routes.
Still routes installed with policies are installed also for IPv6.
So since only one route is returned without DUMP, and we ignore
all routes from our own routing table, no source address was found
during roaming if DST of the installed route included the IKE peer.

With newer kernels we can now use DUMP as we did for IPv4 already,
for older kernels we do so if our own routes are installed in a
separate routing table, otherwise we still use GET.
 2012-06-25 16:29:59 +02:00
Tobias Brunner 720ba902c5 Enable xauth-generic by default but don't build it if IKEv1 is disabled 2012-06-25 11:07:49 +02:00
Tobias Brunner 2e4c807bf3 Remove CREDITS from distribution 2012-06-25 11:07:35 +02:00
Tobias Brunner 20bda203f9 The AUTHORS file is required by automake 2012-06-25 10:59:27 +02:00
Tobias Brunner d50b9be571 LICENSE file updated 2012-06-25 10:52:16 +02:00
Tobias Brunner c236f19e50 ldaphost and ldapbase ca section keywords are deprecated 2012-06-25 10:52:16 +02:00
Tobias Brunner 693805cc98 Removed pluto-specifics from ipsec script 2012-06-25 10:52:16 +02:00
Tobias Brunner f5a3b95a39 README file cleaned up and updated 2012-06-25 10:52:16 +02:00
Tobias Brunner e91157a4b6 Fix SIGSEGV if kernel install fails during Quick Mode as responder. 2012-06-22 11:34:38 +02:00
Tobias Brunner aa8898bc45 Fixed compile error because of charon->name in certexpire plugin. 2012-06-21 13:59:18 +02:00
Tobias Brunner 5d227c79a9 Doxygen fix in PKCS#7 wrapper 2012-06-19 13:32:59 +02:00
Tobias Brunner 6d3702ed61 testing: List IPv6 routing table in IPv6 test cases. 2012-06-15 16:46:27 +02:00
Tobias Brunner 5c1332bf7c NLM_F_DUMP includes NLM_F_ROOT. 2012-06-15 16:46:27 +02:00
Tobias Brunner 8ec51f83e5 Don't create roam jobs based on cached/cloned routes. 2012-06-15 16:44:18 +02:00
Tobias Brunner 9896b6bd58 Don't compare ports when comparing cached routes. 
At least src_ip has a port set sometimes.
 2012-06-15 16:44:07 +02:00
Tobias Brunner 31bcaf604a starter: Fixed parsing of %defaultroute. 2012-06-15 10:46:56 +02:00
Tobias Brunner dd38e9fc83 scepclient: Fixed Makefile after removing enable-smartcard configure option. 2012-06-13 15:08:14 +02:00
Tobias Brunner f7cbc0fafe Use proper defines for IPV6_PKTINFO on Mac OS X Lion and newer. 2012-06-13 15:02:10 +02:00
Tobias Brunner 2015c46985 Some updates to the INSTALL document. 2012-06-13 12:24:23 +02:00
Tobias Brunner 6d599fb964 Removed remaining pluto related configure options. 2012-06-13 11:33:32 +02:00
Tobias Brunner 25fb9d3f4a starter: Print additional help texts for selected deprecated keywords. 2012-06-12 16:15:03 +02:00
Tobias Brunner 9707d9db79 starter: Improved how deprecated keywords are handled. 
We only throw a warning now instead of rejecting the config.
 2012-06-12 16:15:03 +02:00
Tobias Brunner 5c7a219804 Revert "starter: Don't treat unsupported keywords as fatal errors just report them." 
This reverts commit e55876a657.
 2012-06-12 16:15:03 +02:00
Tobias Brunner e7c01bed49 starter: Fixed parsing of left|right=%any. 2012-06-12 10:16:51 +02:00
Tobias Brunner 4d21846912 starter: Fix comparison of connections. 2012-06-11 17:33:32 +02:00
Tobias Brunner 3e2ff81e5d starter: Removed all unsupported keywords. 2012-06-11 17:33:32 +02:00
Tobias Brunner e55876a657 starter: Don't treat unsupported keywords as fatal errors just report them. 2012-06-11 17:33:32 +02:00
Tobias Brunner fff4b74db2 Bye bye Pluto! 
Charon will take over IKEv1 duties from here.  This also removes
libfreeswan and whack.
 2012-06-11 17:33:32 +02:00
Tobias Brunner 4a54860986 _copyright: Replicate copyright text here instead of calling libfreeswan. 2012-06-11 17:33:32 +02:00
Tobias Brunner ee3026a1e2 starter: Remove all ties to pluto/libfreeswan. 
Moved some types/constants in the process.
 2012-06-11 17:33:32 +02:00
Tobias Brunner 5b09310e67 starter: Use custom type for SA specific options (flags). 2012-06-11 17:33:31 +02:00
Tobias Brunner 29906e0eab starter: Parse left|rightprotoport directly in confread.c. 2012-06-11 17:33:31 +02:00
Tobias Brunner eca839b0a7 starter: No special handling for left|rightsubnet, just pass it on as string. 2012-06-11 17:33:31 +02:00
Tobias Brunner 6ce841b213 starter: Use host_t to parse left|rightsourceip. 
Also for the yet unused natip option.
 2012-06-11 17:33:31 +02:00
Tobias Brunner 0ac29be793 starter: Remove left|rightsubnetwithin option (charon narrows left|rightsubnet down accordingly). 2012-06-11 17:33:31 +02:00
Tobias Brunner 8dd094e185 starter: Don't resolve any addresses in starter. 
Also removed remains of some unknown iface option.
 2012-06-11 17:33:31 +02:00
Tobias Brunner efc69e9f38 starter: Removed pfs and pfsgroup options (handled via esp option). 2012-06-11 17:33:31 +02:00
Tobias Brunner 6d065f14ae starter: Store mode of the IPsec SA/policy in a separate member. 2012-06-11 17:33:30 +02:00
Tobias Brunner f82365ad27 starter: Use custom type to mark seen keywords. 2012-06-11 17:33:30 +02:00
Tobias Brunner 57323f6259 starter: Remove left|rightnexthop option. 
Charon does this lookup dynamically.
 2012-06-11 17:33:30 +02:00
Tobias Brunner 753ca22f9c Implement strdupnull() macro as static inline function. 
This avoids compiler warnings if the argument is a const char*.
 2012-06-11 17:33:30 +02:00
Tobias Brunner 7cce0e96f2 starter: Replaced all usages of clone_str() with strdupnull(). 2012-06-11 17:33:30 +02:00
Tobias Brunner e838c39ba9 starter: Parse authby as string. 2012-06-11 17:33:30 +02:00
Tobias Brunner 041e763b77 starter: Remove main parts of pluto support (invoke, whack). 2012-06-11 17:33:30 +02:00
Tobias Brunner 95e41fb80a starter: Drop support for %defaultroute. 2012-06-11 17:33:29 +02:00
Tobias Brunner 163b227386 starter: Migrated logging to libstrongswan. 2012-06-11 17:33:29 +02:00
Tobias Brunner bcfb6b8efc starter: Remove unneeded starter_exec function. 2012-06-11 17:33:29 +02:00
Tobias Brunner d7c3fd5421 scepclient: Option added to read PKCS#10 certificate request from a file. 2012-06-11 17:33:29 +02:00
Tobias Brunner cea9bf563a scepclient: Option added to read self-signed certificate from a file. 2012-06-11 17:33:29 +02:00
Tobias Brunner 3a7c6b39b5 scepclient: Generate uppercase transaction ID. 2012-06-11 17:33:29 +02:00
Tobias Brunner f79b665243 scepclient: Use HTTP 1.0 for all requests. 2012-06-11 17:33:28 +02:00
Tobias Brunner 1d81b1ab18 scepclient: Options added to specify digest/signature algorithms. 
Also changed the defaults to DES/MD5 as that's what should be used
if GetCACaps is not used to learn the issuers capabilities.
 2012-06-11 17:33:28 +02:00
Tobias Brunner cc55783f36 Added function to convert integrity algorithms to hash algorithms (if based on one). 2012-06-11 17:33:28 +02:00
Tobias Brunner 82e526ce81 Properly encode 0 in ASN.1. 
According to X.690 an INTEGER object always has at least one content
octet.
 2012-06-11 17:09:20 +02:00
Tobias Brunner e8120632ae Don't use chunk_skip() in asn1_length(). 
chunk_skip() returns chunk_empty if the length of the chunk is equal to
the number of bytes to skip, this is problematic as asn1_length() modifies
the original chunk.  asn1_parser_t for instance uses the modified chunk to
later calculate the length of the resulting ASN.1 object which produces
incorrect results if it is based on chunk_empty.
 2012-06-11 17:09:20 +02:00
Tobias Brunner 6e6d78a561 Changed memory management and call logic in PKCS#7 parser/generator. 2012-06-11 17:09:20 +02:00
Tobias Brunner 2bf125f0ed Changed memory management and attribute handling in PKCS#9 wrapper. 2012-06-11 17:09:20 +02:00
Tobias Brunner f912fedc9b scepclient: Also number CA certificates in case there is more than one. 
Also, only number them if there are multiple certificates.
 2012-06-11 17:09:19 +02:00
Tobias Brunner 04ff78aa33 scepclient: Store received RA certificates, using CA cert name as base. 2012-06-11 17:09:19 +02:00
Tobias Brunner c6a2aa49b4 scepclient: Use pkcs7_t and pkcs9_t, remove all dependencies to pluto/libfreeswan. 2012-06-11 17:09:19 +02:00
Tobias Brunner ea92d4f305 Added get_attributes() method to pkcs7_t. 2012-06-11 17:09:19 +02:00
Tobias Brunner dd93aefc09 scepclient: Local generation of file names. 2012-06-11 17:09:19 +02:00
Tobias Brunner 50e51bee54 scepclient: Replaced usages of datatot(). 2012-06-11 17:09:19 +02:00
Tobias Brunner a2ddcc3695 scepclient: Migrated logging to libstrongswan. 2012-06-11 17:09:19 +02:00
Tobias Brunner a69d8dd000 Log group added for applications other than daemons. 2012-06-11 17:09:19 +02:00
Tobias Brunner 25924d3e45 scepclient: Some code cleanup. 2012-06-11 17:09:19 +02:00
Tobias Brunner 07f0abd7ac Updated PKCS#7 parser/generator in libstrongswan. 
Added some functionality from pluto's version, updated usage of asn1
and crypto primitives. It does compile but is not really tested yet.
 2012-06-11 17:09:19 +02:00
Tobias Brunner 4a10eda1a0 starter: Go back to single threaded mode. 
Mixing multiple threads and fork(2) wasn't a very good idea it seems.
At least in some environments this caused strange side-effects.
 2012-06-08 14:12:07 +02:00
Tobias Brunner 05ca56558c Disabled listening for kernel events in starter. 2012-06-08 14:12:06 +02:00
Tobias Brunner 9e9295ed10 Properly handle empty RDN values in DN strings. 2012-06-07 16:50:11 +02:00
Tobias Brunner 9041c074b3 Properly install policies with ports in PF_KEY kernel interface. 2012-06-07 14:37:00 +02:00
Tobias Brunner b200fa573b starter: Only handle SIGCHLD asynchronously and the rest in pselect(2). 2012-06-06 14:23:25 +02:00
Tobias Brunner 18a3741042 starter: (De-)Initialize logging when forking. 2012-06-05 09:22:16 +02:00
Tobias Brunner 402ae88af9 starter: Close open file descriptors when forking daemons. 2012-06-04 18:09:56 +02:00
Tobias Brunner 89c97952bd starter: Changed signal handling now that starter is multi-threaded. 2012-06-04 18:09:56 +02:00
Tobias Brunner c8f7a114b6 Mark CHILD_SAs used for trap policies to uninstall them properly. 
If the installation failed the state is not CHILD_ROUTED which means the
wrong priority is used to uninstall the policies.  This is a problem for
kernel interfaces that keep track of installed policies as now the proper
policy is not found (if the priority is considered).
 2012-06-04 18:04:48 +02:00
Tobias Brunner 93d9a02e9e NEWS for 4.6.4 added. 2012-05-31 17:40:01 +02:00
Tobias Brunner 79d5c4f06b Fixed return values of several functions (e.g. return FALSE for pointer types). 2012-05-31 17:39:04 +02:00
Tobias Brunner 77e4282643 Avoid queueing more than one retry initiate job. 2012-05-30 15:32:52 +02:00
Tobias Brunner 60c82591c5 Retry IKE_SA initiation if DNS resolution failed. 
This is disabled by default and can be enabled with the
charon.retry_initiate_interval option in strongswan.conf.
 2012-05-30 15:32:52 +02:00
Tobias Brunner eac9d77059 Job added to re-initiate an IKE_SA. 2012-05-30 15:32:52 +02:00
Tobias Brunner 53915f14ae Fix MOBIKE address update if responder address changed. 
Use the source address of the current MOBIKE message as peer address
instead of assuming the address cached on the IKE_SA is still valid.
 2012-05-25 17:05:53 +02:00
Tobias Brunner a46fe56858 Resolve hosts before reauthenticating due to address change. 2012-05-25 17:05:53 +02:00
Tobias Brunner c6da59f014 Don't queue delete_ike_sa job when setting IKE_DELETING. 
This avoids deleting IKE_SAs during reauthentication (without
trying to reestablish them).
 2012-05-25 17:05:53 +02:00
Tobias Brunner 7457143072 During reauthentication reestablish IKE_SA even if deleting the old one fails. 2012-05-25 17:05:53 +02:00
Tobias Brunner 23470d849a Integrated main parts of IKE_REAUTH task into ike_sa_t.reestablish. 2012-05-25 17:05:53 +02:00