denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
14,410 Commits 1 Branch 0 Tags
f25f4192c7ea7f3ccb6759dc000a3272e9c4e815
Commit Graph
14410 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Tobias Brunner 9292357030 ike-sa: Resolve hosts before reestablishing an IKE_SA 2013-09-23 11:49:52 +02:00
Tobias Brunner e3f64a79c2 android: Several plugins were moved from libcharon to libtnccs 
These were moved in commits e8f65c5cde and 12b3db5006.
 2013-09-23 11:49:52 +02:00
Tobias Brunner c3ee829eee android: Properly handle failures while initializing charon 2013-09-23 11:49:52 +02:00
Ansis Atteka 255b9dac5d kernel-netlink: Allow to override xfrm_acq_expires value 
When using auto=route, current xfrm_acq_expires default value
implies that tunnel can be down for up to 165 seconds, if
other peer rejected first IKE request with an AUTH_FAILED or
NO_PROPOSAL_CHOSEN error message. These error messages are
completely normal in setups where another application
pushes configuration to both strongSwans without waiting
for acknowledgment that they have updated their configurations.

This patch allows strongswan to override xfrm_acq_expires default
value by setting charon.plugins.kernel-netlink.xfrm_acq_expires in
strongswan.conf.

Signed-off-by: Ansis Atteka <[email protected]>
 2013-09-23 10:45:14 +02:00
Andreas Steffen 2c4d772a79 Implemented TCG/PB-PDP_Referral message 2013-09-17 21:57:08 +02:00
Andreas Steffen ddfc589600 Allow vendor-specific PB-TNC messages 2013-09-17 11:19:11 +02:00
Andreas Steffen ab155e6907 ignore *.1 manpage files 2013-09-17 10:58:53 +02:00
Andreas Steffen f4dd49a5fd Version bump to 5.1.1dr4 2013-09-17 10:57:46 +02:00
Tobias Brunner aadf2e01e7 Merge branch 'pubkeys' 
Adds support to pki --pub to convert public keys to other formats
including SSH keys and DNSKEYs.  SSH public keys can also be read
from files in the format used by OpenSSH.
 2013-09-13 15:30:40 +02:00
Tobias Brunner 075e80368b sshkey: Add support for parsing keys from files 2013-09-13 15:23:49 +02:00
Tobias Brunner b2a5317596 sshkey: Add encoding for ECDSA keys 2013-09-13 15:23:49 +02:00
Tobias Brunner d6b3cc87ca openssl: Add support for generic encoding of EC public keys 2013-09-13 15:23:49 +02:00
Tobias Brunner 90afd2c929 pki: --pub also accepts public keys (i.e. to convert them to a different format) 2013-09-13 15:23:49 +02:00
Tobias Brunner 21626bdf77 pki: Add support to encode public keys in SSH key format 2013-09-13 15:23:49 +02:00
Tobias Brunner f40e9f4d16 sshkey: Add encoder for RSA keys 2013-09-13 15:23:49 +02:00
Tobias Brunner 3b939e20a9 openssl: Add generic RSA public key encoding 2013-09-13 15:23:49 +02:00
Tobias Brunner b5cc7053c8 openssl: Add helper function to convert BIGNUMs to chunks 2013-09-13 15:23:49 +02:00
Tobias Brunner a3232fa802 pki: Load dnskey plugin to encode public keys in RFC 3110 format 2013-09-13 15:23:48 +02:00
Tobias Brunner d6c43847be Merge branch 'man-pki' 
This adds man pages for all pki sub-commands and promotes pki to a
regular program installed in $prefix/bin.

The usage output of several commands was fixed too.
 2013-09-13 15:17:04 +02:00
Tobias Brunner ed56c86ec1 pki: Don't print an error if no arguments are given 2013-09-13 15:14:00 +02:00
Tobias Brunner 0dc8ba8779 pki: Install pki(1) as utility directly in $prefix/bin 
ipsec pki is maintained as alias.
 2013-09-13 15:07:36 +02:00
Tobias Brunner 1a8ffea315 pki: Add example commands to setup a simple CA 2013-09-13 15:07:36 +02:00
Tobias Brunner b068c4ec9d pki: Add pki --verify man page 2013-09-13 15:07:36 +02:00
Tobias Brunner 4adeaa5eb9 pki: Add pki --pub man page 2013-09-13 15:07:36 +02:00
Tobias Brunner a319eff80d pki: Add pki --print man page 2013-09-13 15:07:35 +02:00
Tobias Brunner e69fd30538 pki: Add pki --keyid man page 2013-09-13 15:07:35 +02:00
Tobias Brunner 558771400e pki: Add pki --pkcs7 man page 2013-09-13 15:07:35 +02:00
Tobias Brunner bb8e2e1759 pki: Add pki --req man page 2013-09-13 15:07:35 +02:00
Tobias Brunner 96aa5a1ddd pki: Add pki --signcrl man page 2013-09-13 15:07:35 +02:00
Tobias Brunner 42e3a21e24 pki: Add pki --issue man page 2013-09-13 15:07:35 +02:00
Tobias Brunner 3a643b8901 pki: Add pki --self man page 
Can be opened with "man pki --self".
 2013-09-13 15:07:35 +02:00
Tobias Brunner a612f6e338 pki: Add pki --gen man page 
Can be opened with "man pki --gen".
 2013-09-13 15:07:29 +02:00
Tobias Brunner 34cff9349b pki: Add ipsec-pki(8) man page 
Can be opened either with "man ipsec pki" or "man ipsec-pki".

Since man(1) only supports one level of subpages, the forthcoming man
pages for each command will have to be opened with "man pki --<command>".
 2013-09-13 14:32:51 +02:00
Tobias Brunner b07aee496a strongswan.conf: Use configured piddir for UNIX sockets 2013-09-13 14:32:51 +02:00
Tobias Brunner 8250fc10e8 Build generated man pages via configure script 2013-09-13 14:32:51 +02:00
Tobias Brunner f5dcb38ead resolve: Remove comment when using resolvconf(8) 
Since comments in resolv.conf are only valid at the beginning of a line
resolvconf(8) seems to have started treating any text after
'nameserver <ip>' as additional IP addresses for name servers.

Since it ignores comments, and we can easily remove the added servers
again, there is no point to add any.

Fixes #410.
 2013-09-13 14:13:21 +02:00
Martin Willi 25260a290d .gitignore: Add .dirstamp files touched by automake 2013-09-13 14:12:35 +02:00
Martin Willi 2b84ccd6a6 libipsec: fix memory management when cloning ip_packet 2013-09-13 13:56:44 +02:00
Martin Willi 96136a1229 libipsec: check for a policy with the reqid of the SA on decapsulation 
To prevent a client from sending a packet with a source address of a different
client, we require a policy bound via reqid to the decapsulating SA.
 2013-09-13 13:56:43 +02:00
Martin Willi 791fde1669 stroke: don't remove a matching peer config if used by other child configs 
When configurations get merged during add, we should not remove peer configs
if other connection entries use the same peer config.
 2013-09-13 13:56:31 +02:00
Tobias Brunner 11ac36b016 conftest: Don't load plugins incrementally 
This is not supported by the plugin loader, so we simply combine the
plugin lists and load them all at once.
 2013-09-13 11:44:04 +02:00
Tobias Brunner fafa768478 ikev1: Fix double free when searching for redundant CHILD_SAs 
Fixes #411.
 2013-09-13 10:14:45 +02:00
Tobias Brunner be8179abd2 Build all IMC/IMVs with -no-undefined 2013-09-12 01:44:50 +02:00
Tobias Brunner 7d87b24634 pt-tls-client: Report loaded plugins 2013-09-12 01:44:49 +02:00
Tobias Brunner 5d45bcfc5f pt-tls-client: Abort if no tnccs-manager is available 2013-09-12 01:44:49 +02:00
Tobias Brunner 9af44ef5d9 Build all shared libraries with -no-undefined and link them properly 
The flag is required to convince libtool on Cygwin to build DLLs. But on
Windows these shared libraries can not have undefined symbols, so we have to
link them explicitly to the libraries they reference.

For plugins this is currently not done, so only the monolithic build is
supported.  The plugin loader wouldn't be able to load DLLs anyway, as
it tries to load files that don't exist on Cygwin.
 2013-09-12 01:44:49 +02:00
Tobias Brunner 3cb4552da6 configure: libtls and libtnccs etc. all require libstrongswan 2013-09-12 01:44:49 +02:00
Tobias Brunner bf32cdfbf6 tun_device: Add warning if TUN devices are not supported by platform 2013-09-12 01:44:49 +02:00
Andreas Steffen 5ec08a6a05 Make sure libstrongswan is initialized first in IMCs and IMVs 2013-09-11 20:58:18 +02:00
Tobias Brunner 4eb6149ae8 sockets: Initialize the whole ancillary data buffer not only the actual struct 
This avoids uninitialized bytes that Valgrind seems to notice otherwise.

Fixes #395.
 2013-09-10 13:42:59 +02:00