denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
13,502 Commits 1 Branch 0 Tags
ef90d5ab1598cd5d81556ddb18845a7d4dc75d8c
Commit Graph
1542 Commits
Author SHA1 Message Date
Martin Willi d4d85135c5 vici: Cancel processor before calling library_deinit() 
For non-direct libstrongswan users, the deinitialization segfaults because
of the missing worker thread cancellation.
 2014-10-10 11:42:18 +02:00
Martin Willi 3db58e837c vici: Reduce debug level during thread spawning 
We want to avoid libvici users to get a cluttered stderr for no real error.
 2014-10-10 11:42:18 +02:00
Martin Willi 046b547a37 vici: Don't include-depend on libstrongswan for boolean types 
As we want to avoid the libstrongswan include dependencies for libvici, avoid
the use of the bool type. Unfortunately this change may break the ABI for
vici_dump(). As this function is mostly for debugging purposes, we do it
nonetheless; my apologies if somebody already relies on the ABI stability of
that function.
 2014-10-10 11:42:18 +02:00
Martin Willi 6f55149335 vici: Document the ruby gem and add some simple examples 2014-10-10 11:42:18 +02:00
Martin Willi dccb2c6eba vici: Add some simple libvici examples to the README 2014-10-10 11:42:18 +02:00
Martin Willi 56f17733c9 vici: Document the available vici command and event messages 2014-10-10 11:42:18 +02:00
Martin Willi f684be6583 vici: Use "gem"-assisted vici ruby gem building and installation 2014-10-10 11:42:17 +02:00
Martin Willi 1038d96537 vici: Add a ruby gem providing a native vici interface 2014-10-10 11:42:17 +02:00
Martin Willi 94d9398202 vici: Return a success result for the clear-creds command 
Even if the command actually can't fail, this looks more aligned to similar
commands.
 2014-10-10 11:42:17 +02:00
Martin Willi d39e04b557 vici: Fix message encoding type values in documentation 2014-10-10 11:42:17 +02:00
Tobias Brunner 3633b80147 eap-radius: Add option to set interval for interim accounting updates 
Any interval returned by the RADIUS server in the Access-Accept message
overrides the configured interval.  But it might be useful if RADIUS is
only used for accounting.
 2014-10-10 09:51:13 +02:00
Tobias Brunner f00a9c1715 packet: Define a global default maximum size for IKE packets 2014-10-10 09:32:42 +02:00
Martin Willi b2c1973ffb ext-auth: Add an ext-auth plugin invoking an external authorization script 
Original patch courtesy of Vyronas Tsingaras.
 2014-10-06 18:30:46 +02:00
Martin Willi 6890bdc7a0 updown: Use process abstraction to invoke updown script 2014-10-06 18:24:39 +02:00
Shea Levy 213e02b872 stroke: Allow specifying the ipsec.secrets location in strongswan.conf 2014-10-02 14:31:00 +02:00
Martin Willi 455e213cb0 vici: Add a command to reload strongswan.conf 2014-09-22 13:44:27 +02:00
Tobias Brunner de622eb1f9 eap-radius: Forward Cisco and Microsoft specific DNS/NBNS attributes 
Fixes #677.
 2014-09-09 10:56:16 +02:00
Martin Willi e1c7e1bc1f ha: Don't adopt IKEv1 children when building without IKEv1 support 
The adopt_children_job_create() function is not available when IKEv1 support
is disabled. Fixes uncommon builds using --enable-ha --disable-ikev1.

Fixes #690.
 2014-08-28 10:19:57 +02:00
Martin Willi cfdc620a3f unity: Do not bump TS to 0.0.0.0/0 as initiator when no Split-Include received 
When having the unity plugin enabled and both peers send the Unity Vendor ID,
we proposed 0.0.0.0/0 as traffic selector, even if no Split-Include has been
received on the SA. This can break compatibility with some responders, as
they don't narrow the TS themselves, but expect the configured TS.
 2014-08-25 10:02:44 +02:00
Tobias Brunner a45ba880c8 unity: Handle narrowing according to roles in the IKE_SA 
Since the narrow hook types reflect the roles in the Quick Mode exchange
the plugin behaved incorrectly if the server initiated the CHILD_SA
rekeying.
 2014-08-25 09:59:43 +02:00
Tobias Brunner 44870e5313 xauth-pam: Add workaround for null-terminated passwords 
Fixes #631.
 2014-07-07 11:14:02 +02:00
Tobias Brunner 28a79e4e0c stroke: Don't log unspecified options of conn and ca sections 2014-06-30 13:29:26 +02:00
Tobias Brunner 3b16c2b55d libvici: Add missing argument to Doxygen comment 2014-06-30 13:16:16 +02:00
Tobias Brunner ed01c1afff Fixed some typos 2014-06-30 13:16:16 +02:00
Tobias Brunner 4431e1e04d updown: Force subnet address to be numeric 2014-06-25 16:17:15 +02:00
Martin Willi fc8ca5f2f2 eap-radius: Increase buffer for accounting attributes to maximum attribute size 
Fixes #624.
 2014-06-25 13:11:34 +02:00
Tobias Brunner 8661c56d38 vici: Install libvici in ipseclibdir like we do with other libraries 2014-06-19 14:42:07 +02:00
Tobias Brunner c005073d0b kernel-interface: Add destination prefix to get_nexthop() 
This allows to determine the next hop to reach a subnet, for instance, when
installing routes for shunt policies.
 2014-06-19 14:33:40 +02:00
Martin Willi 9f950af17a load-tester: Add a crl option to include a CRL uri in generated certificates 2014-06-19 10:48:27 +02:00
Martin Willi 5885ec2a27 vici: Support memory stats without leak-detective on Windows 2014-06-17 17:55:45 +02:00
Martin Willi 65689ce76a vici: Add a stats command returning various daemon infos and statistics 2014-06-17 17:55:45 +02:00
Martin Willi d73a46171d vici: Support a replay_window CHILD_SA option 2014-06-17 16:41:31 +02:00
Martin Willi d5367d2262 starter: Add a replay_window connection option 2014-06-17 16:41:31 +02:00
Martin Willi 30c009c2fe kernel-interface: Add a replay_window parameter to add_sa() 2014-06-17 16:41:30 +02:00
Martin Willi 2d846c2035 socket-win: Use non-overlapped I/O and socket event selection 
The use of overlapped I/O was incorrect, as we passed stack based buffers, but
did not cancel/wait for pending completion on all sockets. Our receive-from-all
socket interface is actually tricky to implement using overlapped I/O. Switch
to WSAEventSelect() event management, which can be canceled properly while
working in a select()-like way.
 2014-06-17 15:19:25 +02:00
Andreas Steffen dacb75f5c0 Split swanctl --raw mode into single-line and --pretty mode 2014-06-14 15:40:22 +02:00
Martin Willi cab59c73fc windows: Use WINAPI call convention for Windows API callbacks 
For x86_64 it does not actually matter, but for i686 builds the call convention
is different with WINAPI.
 2014-06-06 16:28:28 +02:00
Martin Willi 4b9848a2cc kernel-wfp: Include Windows header patch for MinGW 4.8.1 2014-06-04 16:32:12 +02:00
Martin Willi 75afbeee21 kernel-wfp: Clone acquire traffic selectors only if they exist 2014-06-04 16:32:11 +02:00
Martin Willi 78bde29a7c kernel-wfp: Install routes for trap policies 2014-06-04 16:32:11 +02:00
Martin Willi e36d1d4124 kernel-wfp: Refactor route management to separate function 2014-06-04 16:32:11 +02:00
Martin Willi 4a8ba369b6 kernel-wfp: Install tunnel mode policies to appropriate sub-layers 
While it is unclear if this has any effect at all, we prefer specific sublayers
to install policies as suggested.
 2014-06-04 16:32:11 +02:00
Martin Willi be32be01a8 kernel-wfp: Declare GUIDs and auth/cipher configs missing in some MinGW builds 2014-06-04 16:32:11 +02:00
Martin Willi 4b51280344 kernel-wfp: Support multiple traffic selectors on tunnel mode SAs 2014-06-04 16:32:11 +02:00
Martin Willi 5e6e214ab4 kernel-iph: Implicitly enable IP forwarding when installing routes 2014-06-04 16:32:11 +02:00
Martin Willi c7d30c2ad1 kernel-wfp: Show a warning for packets the kernel drops in its IPsec layers 2014-06-04 16:32:10 +02:00
Martin Willi a4f3b363da kernel-wfp: Set flag to get UDP encapsulation with tunnel mode working 
Having this flag set fixes connections initiated by the Windows host, but
unfortunately does not yet fix incoming connections. Connection state issue?
We still see 0xc00000e2 error events, translating to INTERNAL_ERROR.
 2014-06-04 16:32:10 +02:00
Martin Willi 6de788704b kernel-wfp: Install tunnel and trap forward policies 2014-06-04 16:32:10 +02:00
Martin Willi 1678f0a999 kernel-wfp: Manually create a ProviderContext to attach individual filters 
This gives us more flexibility than using the intransparent FwpmIPsecTunnelAdd,
and fixes the issues we have seen with trap policies. Forward filters are
still missing, but required for site-to-site tunnels.
 2014-06-04 16:32:10 +02:00
Martin Willi 1ca2b1615a kernel-wfp: Print filter weight in "ipsecdump filters" 2014-06-04 16:32:10 +02:00