denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
14,849 Commits 1 Branch 0 Tags
e32504352d36df85248969c2069fabe63f72127b
Commit Graph
202 Commits
Author SHA1 Message Date
Tobias Brunner e32504352d vici: Correctly return IKE SPIs stored in network order 2016-03-04 18:43:26 +01:00
Tobias Brunner 1ecec95dff vici: Add support for pubkey constraints with EAP-TLS 
This is a feature currently supported by stroke.
 2016-03-04 16:19:54 +01:00
Tobias Brunner 3c23a75120 auth-cfg: Make IKE signature schemes configurable 
This also restores the charon.signature_authentication_constraints
functionality, that is, if no explicit IKE signature schemes are
configured we apply all regular signature constraints as IKE constraints.
 2016-03-04 16:19:54 +01:00
Tobias Brunner c13eb73719 vici: Don't redirect all SAs if no selectors are given 
This avoid confusion and redirecting all SAs can now easily be done
explicitly (e.g. peer_ip=0.0.0.0/0).
 2016-03-04 16:03:00 +01:00
Tobias Brunner 27074f3155 vici: Match subnets and ranges against peer IP in redirect command 2016-03-04 16:03:00 +01:00
Tobias Brunner bef4518de7 vici: Match identity with wildcards against remote ID in redirect command 2016-03-04 16:02:59 +01:00
Tobias Brunner 43b46b26ea vici: Add redirect command 
This allows redirecting IKE_SAs by multiple different selectors, if none
are given all SAs are redirected.
 2016-03-04 16:02:59 +01:00
Tobias Brunner 28649f6d91 libhydra: Remove empty unused library 2016-03-03 17:36:11 +01:00
Tobias Brunner 8394ea2a42 libhydra: Move kernel interface to libcharon 
This moves hydra->kernel_interface to charon->kernel.
 2016-03-03 17:36:11 +01:00
Tobias Brunner 35d0b8b152 vici: Provide ports of local and remote IKE endpoints 2016-03-03 17:13:35 +01:00
Tobias Brunner fedb16236c vici: Correctly document 'up' key for updown events 
Instead of sending 'no' it is omitted when an SA goes down.
 2016-03-01 11:05:34 +01:00
Andreas Steffen ffd29ab30a vici: Support multiple named raw ublic keys 2016-01-10 00:12:57 +01:00
Andreas Steffen abe6d07463 swanctl: Load pubkeys with load-creds 2016-01-09 07:23:30 +01:00
Andreas Steffen 4c38c79452 vici: list-cert sends subject, not-before and not-after attributes for pubkeys 2016-01-09 07:23:30 +01:00
Andreas Steffen 87371460f6 vici: Support of raw public keys 2016-01-09 07:23:29 +01:00
Andreas Steffen 9121f6cce1 vici: Enable transport encoding of CERT_TRUSTED_PUBKEY objects 2016-01-03 06:28:49 +01:00
Tobias Brunner a1dfbb7557 vici: Use correct constant when checking for integrity algorithm 
Currently both have the value 1024 so no real harm done.
 2015-12-21 12:14:12 +01:00
Tobias Brunner ade20d06c6 vici: CHILD_SA proposals never contain a PRF 2015-12-21 12:14:12 +01:00
Andreas Steffen 92b051bd4a vici: allow legacy shortcuts in cert queries 2015-12-19 10:30:17 +01:00
Andreas Steffen f553aea2c2 Use 128 bit security in README.pod examples 2015-12-18 15:08:33 +01:00
Andreas Hofmeister a073e4c95e Improvements to the VICI Perl bindings by Andreas Hofmeister 
- Switch.pm, which was implemented as a source filter, has been deprecated in
  Perl 5.10 and was later removed from the core modules in Perl 5.14 or so.

  Unfortunately, its replacement, the given/when/default construct, has since
  been downgraded to "experimental" status because of problems with the underlying
  "smart-match" operator.

  Thus, as of Perl 5.22, Perl still has no actually usable "switch"-like construct.

  So just use boring, old and ugly "if/elsif/else" constructs instead, which are
  compatible with almost any Perl version.

- None of the Perl modules here does anything that would require "AutoLoader".

- "Exporter" can be used to export plain functions into another modules name
  space. But the things that were exported here are meant to be called as
  methods.  In this case, it is neither necessary nor advisable to export those
  symbols.

  Just export nothing (the POD documentation already said so).

- It is usually the calling script that enables (or does not enable) warnings
  globally. When a module says "use warnings;" however, the caller looses control
  over what warnings should be enabled in that module.
 2015-12-18 14:25:59 +01:00
Andreas Steffen cc874350b8 Apply pubkey and signature constraints in vici plugin 2015-12-17 17:49:48 +01:00
Andreas Steffen 02d431022c Refactored certificate management for the vici and stroke interfaces 2015-12-12 00:19:24 +01:00
Andreas Steffen 4df09fe563 Modified vici_cert_info class for use with load_creds and vici_cred 2015-12-11 22:14:38 +01:00
Andreas Steffen 44d3b02b57 Removed VICI protocol versioning 2015-12-11 18:26:55 +01:00
Andreas Steffen 334119b843 Share vici_cert_info.c with vici_cred.c 2015-12-11 18:26:55 +01:00
Andreas Steffen fad851e2d3 Use VICI 2.0 protocol version for certificate queries 2015-12-11 18:26:54 +01:00
Andreas Steffen 5d909303d8 Sort certificate types during enumeration 2015-12-11 18:26:54 +01:00
Andreas Steffen 75749971e1 Define VICI protocol versions 2015-12-11 18:26:54 +01:00
Tobias Brunner 74270c8c86 vici: Don't report memory usage via leak-detective 
This slowed down the `swanctl --stats` calls in the test scenarios
significantly, with not much added value.
 2015-12-11 18:26:53 +01:00
Martin Willi 1a8a420c1c vici: Fix documentation about the initiate/terminate timeout 2015-12-07 10:28:45 +01:00
Martin Willi eaca77d03e vici: Honor an optionally passed IKE configuration name in initiate/install 
If two IKE configurations have CHILD configurations with the same name,
we have no control about the CHILD_SA that actually gets controlled. The
new "ike" parameter specifies the peer config name to find the "child" config
under.
 2015-12-07 10:28:45 +01:00
Martin Willi 5e79ae2d65 vici: Support completely asynchronous initiating and termination 
In some situations the vici client is not interested in waiting for a
timeout at all, so don't register a logging callback if the timeout argument
is negative.
 2015-12-07 10:28:45 +01:00
Martin Willi 1db918c4f8 vici: Use an empty local auth round if none given 
While it hardly makes sense to use none for negotiated SAs, it actually does
when installing shunt policies.
 2015-12-07 10:05:07 +01:00
Martin Willi b26ba1b4a4 vici: Limit start action undoing to IKE_SAs using the base peer config name 
If two peer configs use the same child config names, potentailly delete
the wrong CHILD_SA. Check the peer config name as well to avoid that.
 2015-12-07 10:05:07 +01:00
Martin Willi 23b1f71372 vici: Close empty IKE_SAs after undoing CHILD_SA start actions 2015-12-07 10:05:07 +01:00
Martin Willi 2facf18833 vici: Use value based array to store CHILD_SA ids during restart 
The previous approach stored a pointer to a volatile stack variable, which
works for a single ID, but not for multiple.
 2015-12-07 10:05:07 +01:00
Martin Willi f3b2d4a9d8 vici: Undo start actions when unloading configs 2015-12-07 10:05:07 +01:00
Tobias Brunner 63a778a25d vici: Fix clean-local target for Perl bindings if they were not built 
This is called when running `make distclean` (or indirectly via `make
distcheck`).
 2015-12-04 12:10:57 +01:00
Andreas Steffen 7d24aa0624 Extended and refactored vici perl implementation 2015-12-01 14:52:43 +01:00
Andreas Steffen a17b6d469c Built the CPAN file structure for the Vici::Session perl module 2015-12-01 14:52:43 +01:00
Andreas Steffen a101bce862 Implement vici Perl binding 2015-12-01 14:52:43 +01:00
Tobias Brunner de34defcd0 vici: Add get-algorithms command to query loaded algorithms and implementations 2015-11-30 10:55:55 +01:00
Tobias Brunner 176c24b8e1 vici: Attribute certificates are not trusted 2015-11-12 14:45:43 +01:00
Tobias Brunner e5e352e631 vici: Properly add CRLs to the credential set 
add_crl() ensures that old CLRs are not stored in the credential set.
 2015-11-12 14:45:42 +01:00
Tobias Brunner f4641f9e45 vici: Add option to query leases of pools 
We could later perhaps add filter parameters similar to those of the
`ipsec leases` command (pool name/virtual IP).
 2015-11-10 10:43:25 +01:00
Tobias Brunner bdb8b76515 vici: Return local and remote virtual IPs when listing SAs 2015-11-10 10:43:24 +01:00
Tobias Brunner 04f22cdabc vici: Add NAT information when listing IKE_SAs 
The `nat-local` and `nat-remote` keys contain information on the NAT
status of the local and remote IKE endpoints, respectively.  If a
responder did not detect a NAT but is configured to fake a NAT situation
this is indicated by `nat-fake` (if an initiator fakes a NAT situation
`nat-local` is set).  If any NAT is detected or faked `nat-any` is set.

Closes strongswan/strongswan#16.
 2015-11-09 11:55:51 +01:00
Tobias Brunner c605a96d7f Fix some Doxygen issues 2015-08-27 12:03:11 +02:00
Tobias Brunner 735f929ca7 ike: Only consider number of half-open SAs as responder when deciding whether COOKIEs are sent 2015-08-27 11:18:51 +02:00