denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
10,746 Commits 1 Branch 0 Tags
e472129aa363daa3a3b7eb619442c158b1409c3f
Commit Graph
10746 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Reto Buerki 65a777f7fb Add TKM_CTX_DH (Diffie-Hellman context) to id manager 2013-03-19 15:23:45 +01:00
Reto Buerki c38459d77d Use id manager to acquire nonce context id 2013-03-19 15:23:45 +01:00
Reto Buerki f3cd7f50de Add initial TKM Diffie-Hellman implementation 
The tkm_diffie_hellman_t plugin acquires a DH context from the Trusted
Key Manager and uses it to get a DH public value and the calculated
shared secret. Proper context handling is still missing though, the
plugin currently uses context ID 1.

The get_shared_secret function will be removed as soon as the TKM
specific keymat is ready.
 2013-03-19 15:23:45 +01:00
Reto Buerki d51305aa3f charon-tkm: Register tkm nonce generator 2013-03-19 15:23:45 +01:00
Reto Buerki 8e95bf455d tkm_nonceg: Return nonce generated by TKM 2013-03-19 15:23:45 +01:00
Reto Buerki 3d2746309e Initialize TKM client library in tkm.c 2013-03-19 15:23:45 +01:00
Reto Buerki 559fe48c50 Introduce TKM specific charon daemon (charon-tkm) 
Analogous to charon-nm the charon-tkm daemon is a specialized charon
instance used in combination with the trusted key manager (TKM) written
in Ada.

The charon-tkm is basically a copy of the charon-nm code which will
register it's own TKM specific plugins.

The daemon binary is built using the gprbuild utility. This is needed
because it uses the tkm-rpc Ada library and consequently the Ada
runtime. gprbuild takes care of the complete binding and linker steps
required to properly initialize the Ada runtime.
 2013-03-19 15:23:45 +01:00
Adrian-Ken Rueegsegger 4dc3ef94a1 starter: Make daemon name configurable 
A daemon can be specified using the '--daemon' command line parameter. This
tells starter to invoke a daemon other than 'charon'.

Additionally the ipsec script uses the environment variable DAEMON_NAME to tell
the starter which daemon to use.
 2013-03-19 15:23:45 +01:00
Adrian-Ken Rueegsegger 0aa5a46669 Add configure option --enable-unit-tests 
This configure option enables check-based unit testing. Check is a unit
test framework for C [1].

The unit tests can be executed by issuing the following command in the
toplevel build directory:

make check

[1] - http://check.sourceforge.net/
 2013-03-19 15:23:44 +01:00
Tobias Brunner deafaf51f1 Load arbitrary (non-host) attributes from strongswan.conf 
This allows to e.g. load Cisco-specific attributes that contain FQDNs.
 2013-03-19 15:21:30 +01:00
Martin Willi 824864f4e0 Don't try to mmap() empty ipsec.secret files 2013-03-19 13:46:16 +01:00
Tobias Brunner 8a0a1ae857 Delete IKE_SAs if responder does not initiate XAuth exchange within a certain time frame 2013-03-19 12:00:00 +01:00
Tobias Brunner 7a87381840 testing: Rename interfaces and bridges so they are easier to identify 
This simplifies capturing traffic with Wireshark on the host as each of
the guest's interfaces is clearly identified.
The three bridges were previously numbered starting from 0, this scheme
is restored here.
 2013-03-19 11:50:39 +01:00
Tobias Brunner 9525e9c506 testing: Don't use a specific version for the QEMU machine type 
The previously used pc-1.1 is not yet available on e.g. Ubuntu 12.04.
With 'pc' the most current supported version of that type is used.
 2013-03-19 11:50:39 +01:00
Tobias Brunner e34666a4ed NEWS about xauth-noauth added 2013-03-19 11:23:03 +01:00
Tobias Brunner 3c34e15ee4 Make sure that xauth-noauth is not used accidentally 
It has to be selected explicitly with rightauth2=xauth-noauth.
 2013-03-19 11:23:03 +01:00
Tobias Brunner e4013bb904 Added xauth-noauth plugin 
This XAuth backend does not do any authentication of client credentials
but simply sends a successful XAuth status to the client, thereby
concluding the XAuth exchange.  This can be useful to fallback to basic
RSA authentication with clients that can not be configured without XAuth
authentication.
 2013-03-19 11:23:03 +01:00
Martin Willi 41131528a9 In stroke counters, check if we have an IKE_SA before getting the name from it 
Fixes a segfault when receiving an invalid IKE SPI, where we don't have an
IKE_SA for the raised alert.
 2013-03-19 11:20:35 +01:00
Martin Willi a0f1c4cf29 Add an "esp" load-tester option to configure custom CHILD_SA ESP proposal 2013-03-18 14:30:21 +01:00
Tobias Brunner 6cf79c1e9d Algorithms are not really specific to an IKE version 
But not all of them can be used with IKEv1.

Fixes #314.
 2013-03-18 12:20:47 +01:00
Martin Willi 96776d6f77 Add some 5.0.3 NEWS 2013-03-18 10:48:21 +01:00
Martin Willi d29246cabe Merge branch 'radius-ext' 
Bring some extensions to eap-radius, namely a virtual IP address provider based
on received Framed-IPs, forwarding of Cisco Unity banners, Interim Accounting
updates and the reporting of sent/received packets.
 2013-03-18 10:13:36 +01:00
Martin Willi 048872f2f7 Merge branch 'stroke-counters' 
Extend stroke counters functionality by connection specific counters, and
a resetcounters command to reset the global or connection counters.
 2013-03-18 10:12:22 +01:00
Martin Willi e85c0f6b84 Merge branch 'stroke-timeout' 
Add a strongswan.conf timeout option for stroke control commands.
 2013-03-18 10:11:46 +01:00
Martin Willi cb14ecb1d3 Merge branch 'netlink-align' 
Fixes some Netlink alignment issues, and then refactors Netlink XFRM message
attribute handling.
 2013-03-18 10:09:35 +01:00
Martin Willi 94163816fa Use netlink_add_attribute() to copy over attributes during update_sa() 2013-03-15 16:02:01 +01:00
Martin Willi 0d9f31e1ed Use a helper function to add XFRM_MARK attribute 2013-03-15 16:02:01 +01:00
Martin Willi 6dfc633927 Use netlink_reserve() helper function in XFRM to simplify message construction 2013-03-15 16:02:01 +01:00
Martin Willi 6359ab04f4 Add a Netlink utility function to add a RTA header and reserve space for data 2013-03-15 14:32:51 +01:00
Martin Willi 53c98f098f Correctly check buffer length in netlink_add_attribute() 2013-03-15 14:32:25 +01:00
Martin Willi 6ac601f543 Avoid unneeded termination of netlink algorithm name arrays with END_OF_LIST 2013-03-15 14:01:15 +01:00
Martin Willi cf729248b2 Add a "resetcounters" command to ipsec, clearing global or connection counters 2013-03-15 10:55:22 +01:00
Martin Willi d022322bed Add connection name specific stroke counters 2013-03-15 10:41:04 +01:00
Martin Willi a34ffd1c05 Add a chunk_from_str() initializer that does not include 0-terminator 2013-03-15 10:36:33 +01:00
Martin Willi e813d218f1 Don't create interim update entries if RADIUS accounting is disabled 2013-03-14 16:44:09 +01:00
Martin Willi d019764ab6 Add support for RADIUS Interim accounting updates 2013-03-14 16:35:11 +01:00
Martin Willi 1ba1cd0c9b Add an option to delete any established IKE_SA if RADIUS server is not responding 2013-03-14 15:42:30 +01:00
Martin Willi 49960f021d Make check whether to use IKEv1 fragmentation more readable 2013-03-14 14:20:55 +01:00
Martin Willi 552b8ad5f5 Send Acct-Terminate-Cause based on some alerts catched on the bus 
Currently supported are user disconnects, session timeouts and if the peer does
not respond on IKE packets or DPDs.
 2013-03-14 14:20:55 +01:00
Martin Willi 335982169a When IKEv1 DPD times out, raise missing SEND_RETRANSMIT_TIMOUT alert 2013-03-14 14:20:54 +01:00
Martin Willi c45cf9048e Raise an alert if an IKE_SA could not have been reauthenticated and expires 2013-03-14 14:20:54 +01:00
Martin Willi 68c12fd9f9 Send NAS-Port, NAS-IP and Calling/Called-Station-ID in Accounting-Requests 2013-03-14 14:20:54 +01:00
Martin Willi b4568ca230 Support RADIUS accounting of sent/received packets 2013-03-14 14:20:54 +01:00
Martin Willi d28391a244 Report the number of processed packets in "ipsec statusall" 2013-03-14 14:20:54 +01:00
Martin Willi d954a2081b child_sa_t.get_usestats() can additionally return the number of processed packets 2013-03-14 14:20:54 +01:00
Martin Willi 6b35ab84da Pass correclty sized pointer to lookup_algorithm() in PF_KEY 2013-03-14 14:20:54 +01:00
Martin Willi 7eeeb1c702 kernel_ipsec_t.query_sa() additionally returns the number of processed packets 2013-03-14 14:20:54 +01:00
Martin Willi 003452d18f Send NAS-Port, NAS-IP and Calling/Called-Station-ID in Access-Request 2013-03-13 15:20:11 +01:00
Martin Willi 02bf38890d Forward Cisco Banner received from RADIUS to Unity capable clients 2013-03-12 20:37:35 +01:00
Martin Willi 54b3cbdc78 Add a radius message method to enumerate vendor specific attributes 2013-03-12 20:37:35 +01:00