denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
9,268 Commits 1 Branch 0 Tags
e2ed7bfd22d82617aca4eb91ac4ce5a35cda22d4
Commit Graph
1787 Commits
Author SHA1 Message Date
Martin Willi e2ed7bfd22 Add a return value to aead_t.encrypt() 2012-07-16 14:53:32 +02:00
Martin Willi d19f0ae3e0 Don't modify the message string passed to logger, as it gets reused 2012-07-13 15:43:04 +02:00
Martin Willi c6343cf0ad Log to a malloc()ed buffer if the on-stack buffer is not large enough 2012-07-13 13:23:29 +02:00
Martin Willi 1b40b74de0 Pass opaque data to printf hooks and print_in_hook() 2012-07-13 13:23:29 +02:00
Tobias Brunner 893c3a4ead Simplify NAT-D payload creation if UDP encapsulation is forced 
We don't need any address lookups in that case as the content of the
payload is generated randomly anyway.
 2012-07-13 11:13:43 +02:00
Andreas Steffen 22e97e4f1f updated Copyright info 2012-07-13 10:42:40 +02:00
Andreas Steffen 968c83cdeb restrict PA-TNC messages to maximum size 2012-07-12 21:26:18 +02:00
Tobias Brunner 8d98f7fef6 Avoid that any % characters (e.g. in %any) are evaluated when logging via stroke 2012-07-12 16:58:00 +02:00
Andreas Steffen c9c3da66a8 removed unused variables 2012-07-11 23:15:44 +02:00
Andreas Steffen c56667f1db fixed logging of unsupported TNCCS version 2012-07-11 17:09:05 +02:00
Andreas Steffen 1de4af66d5 PB-TNC Client sends empty CLOSE batch only in DECIDED state 2012-07-11 17:09:05 +02:00
Andreas Steffen a287a3cdcd have_recommendation() accepts NULL arguments 2012-07-11 17:09:05 +02:00
Andreas Steffen b8b678a567 send empty SDATA batch if no recommendation is available yet, but in order to avoid loops only if no empty CDATA batch was received 2012-07-11 17:09:05 +02:00
Andreas Steffen a5c79d0175 moved batch size calculation into pb_tnc_batch_t 2012-07-11 17:09:05 +02:00
Andreas Steffen d7dcbc95a9 make maximum PB-TNC batch size configurable 2012-07-11 17:09:05 +02:00
Andreas Steffen 3a16bec8f9 limit the size of a PB-TNC batch to the maximum EAP-TNC packet size 2012-07-11 17:09:05 +02:00
Andreas Steffen 6245edf37e eliminate message length field in EAP-TNC 2012-07-11 17:09:05 +02:00
Andreas Steffen a04c51aea9 due to single fragment, total length does not have to be included 2012-07-11 17:09:04 +02:00
Andreas Steffen 4492ffc907 EAP-TNC does not support fragmentation 2012-07-11 17:09:04 +02:00
Martin Willi 07836f559d Send cert request based on peers configured authentication class 2012-07-10 17:15:59 +02:00
Martin Willi 3128e7fa7c Don't send CERTREQs when initiating aggressive mode PSK 2012-07-09 12:05:23 +02:00
Martin Willi 0619ddfaa4 Refactored heavily #ifdefd capability code to its own libstrongswan class 2012-07-04 11:01:40 +02:00
Tobias Brunner 644c6c968d Use spin locks to update IKE_SAs in controller_t 
This ensures the listeners don't miss any events after the SAs have been
checked out in the asynchronously executed jobs.  This is a matter of
memory visibility and not primary a matter of exclusive access.
 2012-07-04 10:13:50 +02:00
Tobias Brunner c9355ea4a0 Fixed job handling in controller_t 
Also IKE_SAs are now checked out in the jobs and not before.
 2012-07-04 10:13:49 +02:00
Martin Willi 9d2968e272 As a responder, don't start a TRANSACTION request if we expect one from the initiator 2012-06-29 13:40:31 +02:00
Andreas Steffen 5f451f2d6a IMCs and IMVs might depend on X.509 certificates or trusted public keys 2012-06-28 17:55:02 +02:00
Martin Willi 0f018a7324 Show some uname() info in "ipsec statusall" 2012-06-28 11:56:40 +02:00
Tobias Brunner bd858af851 libcharon also requires kernel interfaces and a socket implementation 2012-06-27 12:15:09 +02:00
Martin Willi 271377905d Defer quick mode initiation if we expect a mode config request 2012-06-27 11:42:56 +02:00
Martin Willi 8ff45cfd99 Queue a mode config task as responder if we need a virtual IP 2012-06-27 11:42:56 +02:00
Martin Willi c2a391746c Add basic support for XAuth responder authentication 2012-06-27 11:42:56 +02:00
Martin Willi a9aa75b90e Map XAuth responder authentication methods between IKEv1 and IKEv2 2012-06-27 11:42:56 +02:00
Martin Willi dc6d259635 Show remote EAP/XAuth identity in "statusall" on a separate line 2012-06-27 11:42:00 +02:00
Tobias Brunner aa54ecef44 Use static plugin features in libcharon to define essential dependencies 2012-06-27 11:31:16 +02:00
Martin Willi 5def45b890 Ignore a received %any virtual IP for installation 2012-06-26 18:00:40 +02:00
Tobias Brunner 9866c26c5b Also build charon's IKEv1 implementation on Android 2012-06-26 07:56:15 +02:00
Tobias Brunner 8497c5d147 Missing source file added to libcharon's Android.mk 2012-06-26 07:56:15 +02:00
Tobias Brunner e0efd7c121 Make rescheduling a job more predictable 
This avoids race conditions between calls to cancel() and jobs that like
to be rescheduled.  If jobs were able to reschedule themselves it would
theoretically be possible that two worker threads have the same job
assigned (the one currently executing the job and the one executing the
same but rescheduled job if it already is time to execute it), this means
that cancel() could be called twice for that job.

Creating a new job based on the current one and reschedule that is also
OK, but rescheduling itself is more efficient for jobs that need to be
executed often.
 2012-06-25 17:49:12 +02:00
Tobias Brunner 26d77eb3e6 Centralized thread cancellation in processor_t 
This ensures that no threads are active when plugins and the rest of the
daemon are unloaded.

callback_job_t was simplified a lot in the process as its main
functionality is now contained in processor_t.  The parent-child
relationships were abandoned as these were only needed to simplify job
cancellation.
 2012-06-25 17:38:59 +02:00
Tobias Brunner 7fec83af28 Give processor_t more control over the lifecycle of a job 
Jobs are now destroyed by the processor, but they are allowed to
reschedule themselves.  That is, parts of the reschedule functionality
already provided by callback_job_t is moved to the processor.  Not yet
fully supported is JOB_REQUEUE_DIRECT and canceling jobs.

Note: job_t.destroy() is now called not only for queued jobs but also
after execution or cancellation of jobs.  job_t.status can be used to
decide what to do in said method.
 2012-06-25 17:10:28 +02:00
Andreas Steffen 554a697a84 support Cisco Unity VID 2012-06-25 11:09:06 +02:00
Martin Willi 0ba1ddaa24 Enforce uniqueids=keep based on XAuth identity 2012-06-25 10:18:35 +02:00
Martin Willi f145ea29e0 Don't send XAUTH_OK if a hook prevents SA to establish 2012-06-25 10:18:35 +02:00
Martin Willi 0c32b9c62f Enforce uniqueids=keep only for non-XAuth Main/Agressive Modes 2012-06-25 10:18:35 +02:00
Martin Willi dd1381e7d3 Show EAP/XAuth identity in "ipsec status", if available 2012-06-25 10:18:35 +02:00
Martin Willi 0fbfcf2a3a Use XAuth/EAP remote identity for uniqueness check 2012-06-25 10:18:34 +02:00
Martin Willi de5e8fb4e0 Add missing XAuth name variable when complaining about missing XAuth backend 2012-06-25 10:09:27 +02:00
Tobias Brunner e91157a4b6 Fix SIGSEGV if kernel install fails during Quick Mode as responder. 2012-06-22 11:34:38 +02:00
Tobias Brunner aa8898bc45 Fixed compile error because of charon->name in certexpire plugin. 2012-06-21 13:59:18 +02:00
Martin Willi e2dd114f37 Select requested virtual IP family based on remote TS, if no local TS available 2012-06-20 10:02:01 +02:00