denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
15,200 Commits 1 Branch 0 Tags
f5e8bc18fda03b8d0baf2b54883ddb18f6059807
Commit Graph
3514 Commits
Author SHA1 Message Date
Martin Willi 553bb78730 child-sa: replace get_traffic_selectors() with create_ts_enumerator() 
Not directly returning a linked list allows us to change the internals of
the CHILD_SA transparently.
 2013-07-17 17:20:18 +02:00
Martin Willi 6207fadb6c ikev2: replace linked lists by arrays in task manager 
Eliminates another three lists, 0.5KB per IKE_SA.
 2013-07-17 17:20:18 +02:00
Martin Willi c907b57f56 proposal: use array to store proposal list 
Removes another two linked lists (0.5KB) of memory per IKE/CHILD_SA pair.
 2013-07-17 17:20:18 +02:00
Martin Willi 5cd64f979c proposal: use a single list to store all transforms 
Beside that it makes the code actually simpler, it reduces the number of lists
stored by each IKE_SA and each CHILD_SA by 4, which can be up to 1KB per SA.
 2013-07-17 17:20:17 +02:00
Martin Willi 893da0411f ike-sa: use arrays instead of linked lists in long lived collections 
This saves about 1.5KB of memory per IKE_SA.
 2013-07-17 17:20:17 +02:00
Tobias Brunner f067348134 kernel-libipsec: Log error if no local address is found when installing routes 2013-07-15 14:37:31 +02:00
Tobias Brunner 591f923134 stroke: Add certificates extracted from PKCS#12 files to correct credential set 
Only keys and shared secrets are moved from the temporary credential set after
loading all secrets.
 2013-07-15 10:59:13 +02:00
Tobias Brunner d27f225d9a Use strpfx() helper where appropriate 2013-07-08 18:49:30 +02:00
Tobias Brunner c9df0f989d android: Added support to build tnc-imc plugin 2013-07-08 18:49:25 +02:00
Tobias Brunner 4672078190 android: Added support to build eap-tnc, tnc-tnccs and tnccs-20 plugins 2013-07-08 18:49:25 +02:00
Tobias Brunner 598bec78fa socket-default: Add options to disable address families 2013-07-05 09:48:27 +02:00
Tobias Brunner bf92887af1 ike: Resolve hosts only for address families currently supported 2013-07-05 09:48:26 +02:00
Tobias Brunner eafd7ee7e1 net: Socket implementations report the address families they support 2013-07-05 09:48:01 +02:00
Martin Willi 282e4d2c7c eap-radius: fix add_attribute/framed_ip method signatures 2013-07-01 11:53:52 +02:00
Tobias Brunner c949a4d501 Reuse reqid when restarting CHILD_SAs for dpd|closeaction=restart 2013-07-01 09:58:34 +02:00
Tobias Brunner 4c74fa664b Reuse reqid for trap policies installed for dpd|closeaction=hold 2013-07-01 09:58:25 +02:00
Tobias Brunner 50daffb784 dhcp: Use chunk_hash_static() to calculate ID-based MAC addresses 2013-06-28 17:00:29 +02:00
Tobias Brunner b7b5432ff8 stroke: Changed how proto/port are specified in left|rightsubnet 
Using a colon as separator conflicts with IPv6 addresses.
 2013-06-28 15:10:09 +02:00
Tobias Brunner b18a531715 plugin-loader: Removed unused path argument of load() method 
Multiple additional search paths can be added with the add_path()
method.
 2013-06-28 10:44:15 +02:00
Tobias Brunner 9da142b4dc tnc-pdp: Initialize TNC-PDP in plugin callback with proper dependencies 2013-06-27 18:02:53 +02:00
Tobias Brunner 1091edede8 capabilities: CAP_CHOWN might be required by many plugins opening UNIX sockets 
But as the sockets will be created with the user/group of the running
process this might not be required as no change may be needed.
 2013-06-25 17:16:33 +02:00
Tobias Brunner 405f5ab9e9 farp: Require CAP_NET_RAW capability to open AF_PACKET socket 2013-06-25 17:16:32 +02:00
Tobias Brunner 6f15f5e632 dhcp: Require CAP_NET_BIND_SERVICE and CAP_NET_RAW to open/bind sockets 2013-06-25 17:16:32 +02:00
Tobias Brunner 1dd61bf13d socket-default: Require CAP_NET_BIND_SERVICE for ports < 1024 
Since we don't know which ports are used with socket-dynamic we can't
demand the capability there, but it might still be required.
 2013-06-25 17:16:32 +02:00
Tobias Brunner 41b8546ac0 capabilities: Only plugins that require CAP_NET_ADMIN demand it 
The daemon as such does not require this capability.
 2013-06-25 17:16:32 +02:00
Tobias Brunner a2eb581781 capabilities: Move global capabilities_t instance to libstrongswan 2013-06-25 17:16:32 +02:00
Tobias Brunner 2e21bac19a capabilities: Ensure required capabilities are actually held by the process/user 2013-06-25 17:16:32 +02:00
Martin Willi a650242643 ikev2: keep the CHILD_SA we delete as initiator in the list to destroy 
If the responder not correctly send the correct protocol or SPI in the delete
response, we should remove the CHILD_SA regardless.
 2013-06-25 14:03:51 +02:00
Tobias Brunner e8db483f41 unit-tester: RSA test was removed 2013-06-24 16:01:23 +02:00
Andreas Steffen 7867c1a315 Aligned AR Identity types to IF-IMV 1.4 R5 draft 2013-06-24 00:23:50 +02:00
Andreas Steffen 10bb71261c Added soft dependency on database plugin 2013-06-21 23:25:24 +02:00
Andreas Steffen 2964562199 add overall recommendation to session database entry 2013-06-21 23:25:22 +02:00
Andreas Steffen 9d63ad17d4 used tnc_policy_update functions for default policy 2013-06-21 23:25:22 +02:00
Martin Willi 45dcf4df57 osx-attr: add plugin installing config attributes using SystemConfiguration 
Currently installs DNS servers only, by prepending IP addresses to the
DNS configuration of the primary networking service.
 2013-06-21 17:03:22 +02:00
Tobias Brunner 23ea59a95c kernel-libipsec: Ignore failures when installing routes for multicast or broadcast policies 2013-06-21 17:03:22 +02:00
Tobias Brunner 01955eec71 ike: Force NAT-T/UDP encapsulation if kernel interface requires it 2013-06-21 17:03:21 +02:00
Tobias Brunner 35fe41f7d0 kernel-libipsec: Add a feature to request UDP encapsulation of ESP packets 2013-06-21 17:03:21 +02:00
Tobias Brunner 1f31a2bc2e kernel-libipsec: Install a gateway for routes on platforms other than Linux 
This seems required e.g. on FreeBSD but doesn't work on Linux.
 2013-06-21 17:03:21 +02:00
Tobias Brunner dcaf8d570c kernel-libipsec: Router reads packets from multiple TUN devices 
These devices are collected via kernel_listener_t interface.
 2013-06-21 17:03:21 +02:00
Tobias Brunner 7045defbff kernel-libipsec: Use separate class to route packets between charon, libipsec and TUN device 2013-06-21 17:03:21 +02:00
Tobias Brunner 587bdf8768 kernel-libipsec: Track policies and automatically install routes 
The routes direct traffic matching the remote traffic selector to the
TUN device.

If the remote traffic selector includes the IKE peer a very specific route
is installed to allow IKE traffic.
 2013-06-21 17:03:20 +02:00
Tobias Brunner 44a49681fd kernel-libipsec: Handle packets between charon socket, libipsec and TUN device 2013-06-21 17:03:20 +02:00
Tobias Brunner 59be6ddd08 kernel-libipsec: Create a TUN device and use it to install virtual IPs 2013-06-21 17:03:20 +02:00
Tobias Brunner 279e0d42bd kernel-libipsec: Add plugin that implements kernel_ipsec_t using libipsec 2013-06-21 17:03:20 +02:00
Tobias Brunner 607f8e9906 plugin-loader: Add method to print loaded plugins on a given log level 2013-06-21 15:17:53 +02:00
Tobias Brunner 0adf165c7e Fix crash if the initiator has no suitable proposal available 
Could be triggered with a typo in the ike or esp options when ! is used.
 2013-06-21 11:09:03 +02:00
Martin Willi 1ffdb4f3d0 unit-tester: remove obsolete rsa_gen test, now covered in unit-tests 2013-06-21 10:53:23 +02:00
Martin Willi 888dbac50e ikev2: use protocol of selected proposal to delete a failed CHILD_SA 
Depending on the failure, the protocol might not yet be set on the CHILD_SA.
 2013-06-20 12:09:46 +02:00
Martin Willi 483a258ad8 stroke: support %dynamic in left/rightsubnet for dynamic selectors 
This has the same meaning as omitting left/rightsubnet, i.e. replace it
by the IKE address. Supporting %dynamic allows configurations with multiple
dynamic selectors in a left/rightsubnet, each with potentially different
proto/port selectors.
 2013-06-19 16:36:01 +02:00
Martin Willi 4a7c29bf02 stroke: support a specific proto/port for each net defined in left/rightsubnet 2013-06-19 16:36:01 +02:00