denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
18,821 Commits 1 Branch 0 Tags
ed2d548fee7f786f0dcf79191bba008ec09f2e7f
Commit Graph
2349 Commits
Author SHA1 Message Date
Martin Willi 553bb78730 child-sa: replace get_traffic_selectors() with create_ts_enumerator() 
Not directly returning a linked list allows us to change the internals of
the CHILD_SA transparently.
 2013-07-17 17:20:18 +02:00
Tobias Brunner f067348134 kernel-libipsec: Log error if no local address is found when installing routes 2013-07-15 14:37:31 +02:00
Tobias Brunner 591f923134 stroke: Add certificates extracted from PKCS#12 files to correct credential set 
Only keys and shared secrets are moved from the temporary credential set after
loading all secrets.
 2013-07-15 10:59:13 +02:00
Tobias Brunner d27f225d9a Use strpfx() helper where appropriate 2013-07-08 18:49:30 +02:00
Tobias Brunner 598bec78fa socket-default: Add options to disable address families 2013-07-05 09:48:27 +02:00
Tobias Brunner eafd7ee7e1 net: Socket implementations report the address families they support 2013-07-05 09:48:01 +02:00
Martin Willi 282e4d2c7c eap-radius: fix add_attribute/framed_ip method signatures 2013-07-01 11:53:52 +02:00
Tobias Brunner 4c74fa664b Reuse reqid for trap policies installed for dpd|closeaction=hold 2013-07-01 09:58:25 +02:00
Tobias Brunner 50daffb784 dhcp: Use chunk_hash_static() to calculate ID-based MAC addresses 2013-06-28 17:00:29 +02:00
Tobias Brunner b7b5432ff8 stroke: Changed how proto/port are specified in left|rightsubnet 
Using a colon as separator conflicts with IPv6 addresses.
 2013-06-28 15:10:09 +02:00
Tobias Brunner 9da142b4dc tnc-pdp: Initialize TNC-PDP in plugin callback with proper dependencies 2013-06-27 18:02:53 +02:00
Tobias Brunner 1091edede8 capabilities: CAP_CHOWN might be required by many plugins opening UNIX sockets 
But as the sockets will be created with the user/group of the running
process this might not be required as no change may be needed.
 2013-06-25 17:16:33 +02:00
Tobias Brunner 405f5ab9e9 farp: Require CAP_NET_RAW capability to open AF_PACKET socket 2013-06-25 17:16:32 +02:00
Tobias Brunner 6f15f5e632 dhcp: Require CAP_NET_BIND_SERVICE and CAP_NET_RAW to open/bind sockets 2013-06-25 17:16:32 +02:00
Tobias Brunner 1dd61bf13d socket-default: Require CAP_NET_BIND_SERVICE for ports < 1024 
Since we don't know which ports are used with socket-dynamic we can't
demand the capability there, but it might still be required.
 2013-06-25 17:16:32 +02:00
Tobias Brunner 41b8546ac0 capabilities: Only plugins that require CAP_NET_ADMIN demand it 
The daemon as such does not require this capability.
 2013-06-25 17:16:32 +02:00
Tobias Brunner a2eb581781 capabilities: Move global capabilities_t instance to libstrongswan 2013-06-25 17:16:32 +02:00
Tobias Brunner 2e21bac19a capabilities: Ensure required capabilities are actually held by the process/user 2013-06-25 17:16:32 +02:00
Tobias Brunner e8db483f41 unit-tester: RSA test was removed 2013-06-24 16:01:23 +02:00
Andreas Steffen 7867c1a315 Aligned AR Identity types to IF-IMV 1.4 R5 draft 2013-06-24 00:23:50 +02:00
Andreas Steffen 10bb71261c Added soft dependency on database plugin 2013-06-21 23:25:24 +02:00
Andreas Steffen 2964562199 add overall recommendation to session database entry 2013-06-21 23:25:22 +02:00
Andreas Steffen 9d63ad17d4 used tnc_policy_update functions for default policy 2013-06-21 23:25:22 +02:00
Martin Willi 45dcf4df57 osx-attr: add plugin installing config attributes using SystemConfiguration 
Currently installs DNS servers only, by prepending IP addresses to the
DNS configuration of the primary networking service.
 2013-06-21 17:03:22 +02:00
Tobias Brunner 23ea59a95c kernel-libipsec: Ignore failures when installing routes for multicast or broadcast policies 2013-06-21 17:03:22 +02:00
Tobias Brunner 35fe41f7d0 kernel-libipsec: Add a feature to request UDP encapsulation of ESP packets 2013-06-21 17:03:21 +02:00
Tobias Brunner 1f31a2bc2e kernel-libipsec: Install a gateway for routes on platforms other than Linux 
This seems required e.g. on FreeBSD but doesn't work on Linux.
 2013-06-21 17:03:21 +02:00
Tobias Brunner dcaf8d570c kernel-libipsec: Router reads packets from multiple TUN devices 
These devices are collected via kernel_listener_t interface.
 2013-06-21 17:03:21 +02:00
Tobias Brunner 7045defbff kernel-libipsec: Use separate class to route packets between charon, libipsec and TUN device 2013-06-21 17:03:21 +02:00
Tobias Brunner 587bdf8768 kernel-libipsec: Track policies and automatically install routes 
The routes direct traffic matching the remote traffic selector to the
TUN device.

If the remote traffic selector includes the IKE peer a very specific route
is installed to allow IKE traffic.
 2013-06-21 17:03:20 +02:00
Tobias Brunner 44a49681fd kernel-libipsec: Handle packets between charon socket, libipsec and TUN device 2013-06-21 17:03:20 +02:00
Tobias Brunner 59be6ddd08 kernel-libipsec: Create a TUN device and use it to install virtual IPs 2013-06-21 17:03:20 +02:00
Tobias Brunner 279e0d42bd kernel-libipsec: Add plugin that implements kernel_ipsec_t using libipsec 2013-06-21 17:03:20 +02:00
Martin Willi 1ffdb4f3d0 unit-tester: remove obsolete rsa_gen test, now covered in unit-tests 2013-06-21 10:53:23 +02:00
Martin Willi 483a258ad8 stroke: support %dynamic in left/rightsubnet for dynamic selectors 
This has the same meaning as omitting left/rightsubnet, i.e. replace it
by the IKE address. Supporting %dynamic allows configurations with multiple
dynamic selectors in a left/rightsubnet, each with potentially different
proto/port selectors.
 2013-06-19 16:36:01 +02:00
Martin Willi 4a7c29bf02 stroke: support a specific proto/port for each net defined in left/rightsubnet 2013-06-19 16:36:01 +02:00
Martin Willi de2debf8e0 stroke: add exportconn{cert,chain} commands in addition to exportx509 
The new commands either export a single end entity certificate or the
full trust chain for a specific connection name.
 2013-06-19 16:27:19 +02:00
Martin Willi 24303f99f7 dhcp: search for transactions only for connections having a poolname "dhcp" 
When a connection has a single pool that queries recursively the DHCP backend,
we shouldn't return any attributes directly from DHCP when queried for that
pool.
 2013-06-18 09:50:29 +02:00
Tobias Brunner c6f1929a45 socket-default: Make sure sockets are open when checking with FD_ISSET 2013-06-14 17:25:16 +02:00
Tobias Brunner 1889837767 socket-default: Properly initialize NAT-T port if opening regular socket failed 2013-06-14 16:42:56 +02:00
Tobias Brunner 44fb978169 ha: Fix CHILD_SA installation in ha_dispatcher after adding initiator flag 2013-06-13 13:17:55 +02:00
Martin Willi a8c9454423 kernel-interface: add an exchange initiator parameter to add_sa() 
This new flag gives the kernel-interface a hint how it should priorize the
use of newly installed SAs during rekeying.

Consider the following rekey procedure in IKEv2:

Initiator  ---    Responder

I1 -------CREATE-------> R1
I2 <------CREATE--------
   -------DELETE-------> R2
I3 <------DELETE--------

SAs are always handled as pairs, the following happens at the SA level:

  * Initiator starts the exchange at I1
  * Responder installs new SA pair at R1
  * Initiator installs new SA pair at I2
  * Responder removes old SA pair at R2
  * Initiator removes old SA pair at I3

This makes sure SAs get installed/removed overlapping during rekeying. However,
to avoid any packet loss, it is crucial that the new outbound SA gets
activated at the correct position:

  * as exchange initiator, in I2
  * as exchange responder, in R2

This should guarantee that we don't use the new outbound SA before the peer
could install its corresponding inbound SA.

The new parameter allows the kernel backend to install the new SA with
appropriate priorities, i.e. it should:

  * as exchange inititator, have the new outbound SA installed with higher
    priority than the old SA
  * as exchange responder, have the new outbound SA installed with lower
    priority than the old SA

While we could split up the SA installation at the responder, this approach
has another advantage: it allows the kernel backend to switch SAs based on
other criteria, for example when receiving traffic on the new inbound SA.
 2013-06-11 15:58:48 +02:00
Tobias Brunner 31a416a5b2 Removed stray *_plugin_create() declarations from header files 2013-06-11 11:18:19 +02:00
Tobias Brunner 460488b180 eap-radius: Do initialization in a plugin feature callback 2013-06-11 11:18:19 +02:00
Tobias Brunner 49d7a98f47 Refactored plugin-loader with improved dependency resolution 
With the new implementation the plugins don't have to be listed in any
special order, dependencies are properly resolved.  The order only
matters if two plugins provide the same feature.
 2013-06-11 11:18:19 +02:00
Tobias Brunner facc781500 android-log: Use plugin features 2013-06-11 11:18:19 +02:00
Tobias Brunner df60999b5f android-dns: Use plugin features to register attribute handler 2013-06-11 11:18:19 +02:00
Tobias Brunner e183a6c36d maemo: Use plugin features 2013-06-11 11:18:19 +02:00
Tobias Brunner 6d766925b2 medsrv: Use plugin features with dependency on database implementation 2013-06-11 11:18:19 +02:00
Tobias Brunner da7c3f8900 medcli: Use plugin features with dependency on database implementation 2013-06-11 11:18:19 +02:00