denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
6,800 Commits 1 Branch 0 Tags
f8b26c452a37094495f5b6321984bb698cb7dc6e
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Martin Willi f8b26c452a Added proposal keywords for ESN support 2011-04-20 12:26:58 +02:00
Martin Willi bd01b9d8b2 Install ESN SAs if such a proposal has been negotiated 2011-04-20 12:26:58 +02:00
Martin Willi 05e9589783 Copy ESN enabled replay state during update_sa, if supported 2011-04-20 12:26:58 +02:00
Martin Willi ee8c89e2ee Add ESN support to kernel netlink plugin, including custom replay windows 2011-04-20 12:26:58 +02:00
Martin Willi 4876d4f3b3 Added an esn parameter to the kernel interface add_sa functions 2011-04-20 12:26:57 +02:00
Martin Willi f7925cad04 Updated copy of linux/xfrm.h to 2.6.39, featuring ESN support 2011-04-20 12:26:57 +02:00
Martin Willi cf6ca6d729 Add plugin reloading NEWS 2011-04-15 13:05:02 +02:00
Martin Willi 2b3c87b49a Set broadcast flag in DHCP requests when sending broadcasts 2011-04-15 13:00:23 +02:00
Martin Willi 96409be320 Add reload support to attr plugin 2011-04-15 10:07:13 +02:00
Martin Willi 00b4b4b0d1 Migrated attr plugin to INIT/METHOD macros 2011-04-15 10:07:13 +02:00
Martin Willi f0331baf1a Added reload support to eap-radius plugin 2011-04-15 10:07:13 +02:00
Martin Willi 3b71d3d033 Reload strongswan.conf and plugins supporting reloading on SIGHUP 2011-04-15 10:07:13 +02:00
Martin Willi fd3c12bf06 Accept NULL files in load_files[_section] as we do in constructor 2011-04-15 10:07:13 +02:00
Martin Willi 32973044b0 Added a merge option to optionally reload files instead of merging them 2011-04-15 10:07:13 +02:00
Martin Willi ed49e9a303 Added plugin_loader method to reload plugin configurations 2011-04-15 10:07:13 +02:00
Martin Willi c55818ebb0 Added a (not yet implemented) plugin_t method to reload plugin configuration 2011-04-15 10:07:13 +02:00
Martin Willi 787b5884aa Added a get_name() function to plugin_t, create_plugin_enumerator enumerates over plugin_t 2011-04-15 10:07:12 +02:00
Martin Willi 6e2791715b Migrated remaining plugin_t implementations to INIT/METHOD macros 2011-04-15 10:07:12 +02:00
Martin Willi 2b36342551 Migrated plugin_loader to INIT/METHOD macros 2011-04-15 10:07:12 +02:00
Martin Willi 2db8b58f62 Continue without client authentication if no matching certificate found 2011-04-14 20:02:12 +02:00
Martin Willi 6a8f1a578f Ignore TLS certificate requests as peer if peer authentication disabled 2011-04-14 20:02:12 +02:00
Martin Willi 1c21f47a06 Send TLS Server Name Indication as peer if server identity is a FQDN 2011-04-14 20:02:12 +02:00
Martin Willi eea2bdb203 Fix tls_writer wrap functions 2011-04-14 20:02:11 +02:00
Martin Willi 2a277867be Show full blown traffic selector in log_ts hook 2011-04-14 09:21:58 +02:00
Martin Willi f486bf2666 Fix compiler warning after fetcher_t.fetch signature change 2011-04-12 09:29:24 +02:00
Martin Willi 8dad3072c6 Use an IV size of zero for DES in ECB mode 2011-04-08 14:55:46 +02:00
Martin Willi 6dc36a73e2 Fixed debug statement if algorithm benchmarking enabled 2011-04-08 14:55:10 +02:00
Martin Willi 2f02375a82 Added support for DES_ECB to af-alg, required for eap-mschapv2 2011-04-05 15:20:38 +02:00
Martin Willi ce9352b3d7 Migrated eap_sim_pcsc plugin to INIT/METHOD macros 2011-04-04 09:31:45 +02:00
Martin Willi 13d72e90c1 Slightly reformatted SIM pcsc code 2011-04-04 09:21:54 +02:00
Martin Willi 4ceb31f941 Added alloc/stream options to fetcher test utility 2011-04-04 08:48:27 +02:00
Martin Willi f27705cea1 Added support for FETCH_CALLBACK to soup fetcher 2011-04-04 08:48:27 +02:00
Martin Willi c5a46f3b63 Support FETCH_CALLBACK in curl fetcher 2011-04-04 08:48:27 +02:00
Martin Willi 13eda8e903 Added a new FETCH_CALLBACK option to fetch data without allocation 2011-04-04 08:48:27 +02:00
Martin Willi 5131c62517 Migrated fetcher_manager to INIT/METHOD macros 2011-04-04 08:48:27 +02:00
Martin Willi 952fb7b5a1 Increase whitelist message identity buffer to 128 bytes 2011-03-23 14:18:15 +01:00
Martin Willi fc2e43eb27 Fix order of PURGE_* flags to be compatible with STROKE_PURGE_* keywords 2011-03-23 09:28:40 +01:00
Martin Willi f8d2f903bf Added a strongswan.conf "enabled" option for duplicheck plugin 2011-03-17 17:34:11 +01:00
Martin Willi c236b214f2 Added strongswan.conf and runtime option to enable/disable whitelist plugin 2011-03-17 17:15:16 +01:00
Martin Willi 3ced6b51e4 Move establish/inherit of rekeyed IKE_SAs to delete messages 
Having the inherit() function delayed to the IKE_SA establish procedure
was problematic. The task destroy function was never a good place and
results in locking/cleanup problems. After establishing the SA, it
should be really checked in ASAP to avoid any triggered DPD checks
to get lost.
 2011-03-15 15:20:09 +01:00
Martin Willi f42156a8c8 Wrap IKE delete after rekey into rekey task for responder, too 2011-03-15 11:51:53 +01:00
Martin Willi 11f89bc948 Do not invoke processor restart() if not required 
Doing so might result in a deadlock during shutdown if a delayed
restart is locked on the bus during the debug statement.
 2011-03-15 11:48:19 +01:00
Martin Willi 41080cbbd9 Migrated ike_rekey task to INIT/METHOD macros 2011-03-15 11:30:02 +01:00
Martin Willi 21f411b861 Use a boolean expression for refcount check, fixes refcounting if bool is a signed char 2011-03-09 07:52:13 +01:00
Martin Willi 5f47296f22 Migrated sim_manager to INIT/METHOD macros 2011-03-08 16:42:27 +01:00
Martin Willi 7b3bfe4b6c Protect sim card/provider/hook (un-)registration with a rwlock 2011-03-08 16:42:27 +01:00
Martin Willi f58db72482 Splitted sim_manager.h header to sim_{card,provider,hooks}.h 2011-03-08 16:42:27 +01:00
Martin Willi 50110dfef8 Align netlink attributes properly if rta_len not a multiple of RTA_ALIGNTO 2011-03-02 16:07:38 +01:00
Martin Willi 007c47088c Implemented permanent certificate coupling plugin 2011-02-28 16:39:40 +01:00
Martin Willi 0d6d992589 Update duplicheck entry during IKE rekeying 2011-02-28 15:37:18 +00:00
Martin Willi b85be69079 Remove entry from active duplicate list only if it was not in checking 2011-02-28 15:37:18 +00:00
Martin Willi ee0f53e189 Added an example application listening to duplicheck notifications 2011-02-28 15:37:18 +00:00
Martin Willi 3883150779 Notify duplicate detections over a UNIX sockets to listening applications 2011-02-28 15:37:18 +00:00
Martin Willi 3e74ebbecc Added an advanced duplicate checking plugin with liveness check of old SA 2011-02-28 15:37:18 +00:00
Martin Willi 8ce567e69e Invert check to delete unestablished IKE_SAs to not delete them once established 2011-02-28 15:37:17 +00:00
Martin Willi 320e98c2ac Added whitelist plugin NEWS 2011-02-28 15:00:46 +01:00
Martin Willi c893bf7e5c Added a whitelist command line utility to control whitelist plugin 2011-02-28 15:00:46 +01:00
Martin Willi 53f2a7c712 Added a UNIX socket based control backend to whitelist plugin 2011-02-28 15:00:46 +01:00
Martin Willi 5e603aba4e Implemented a in-memory peer identity whitelist plugin 2011-02-28 15:00:46 +01:00
Martin Willi e44ebdcfc8 Slightly change IKE_SA destruction order to inherit properly during ike_rekey task destruction 2011-02-28 10:31:36 +00:00
Martin Willi d17304cd29 Added a pseudo EAP type to allow an implementation to select the real type dynamically 2011-02-22 16:09:45 +01:00
Martin Willi 07bda3feea Whitelisted another tzset variant and dlsym 2011-02-18 16:08:01 +01:00
Martin Willi e131f11779 Migrated kernel_pfroute_net to INIT/METHOD macros 2011-02-17 09:39:25 +00:00
Martin Willi 887abfb1e7 Migrated kernel_netlink_net to INIT/METHOD macros 2011-02-17 09:34:53 +00:00
Martin Willi caf20266e0 Fixed tnc-imc/imv library names when building monolithic 2011-02-08 11:22:02 +01:00
Martin Willi 234955d1ea Check for libxml when building tnccs_11, use autoconf libxml CFLAGS/LIBS 2011-02-08 11:11:01 +01:00
Martin Willi 91f8ce562d tnccs_11 does not link against libtls, just uses its headers 2011-02-08 11:09:27 +01:00
Martin Willi 6ccb23e80b Whitespace cleanups in tnc code 2011-02-08 11:03:10 +01:00
Martin Willi c6c7c7001c Add a prefix to the global visible tnc names to avoid name clashes, move to tncifimv 2011-02-08 11:03:10 +01:00
Martin Willi 3683c0424f Fixed compiler warning 2011-02-08 11:03:10 +01:00
Martin Willi 3af88e4657 tnccs_11 does not link to libtnc anymore 2011-02-08 11:03:10 +01:00
Martin Willi 10a6019ec6 Implement correct signature for pb_tnc_msg->process() 2011-02-08 10:57:41 +01:00
Martin Willi 11a6f29944 Fixed doxygen groups in libcharon tnc subtree 2011-02-08 10:57:41 +01:00
Martin Willi 6cc11bccd1 Fixed various doxygen errors in tnc plugins 2011-02-08 10:57:40 +01:00
Martin Willi 0700c153e7 Fixed function parameter description 2011-02-08 10:14:56 +01:00
Martin Willi 94030a670b Report correct key size if a cipher is not supported 2011-02-07 16:39:33 +01:00
Martin Willi 7e0eae4985 Replace hashtable key if a put operation replaces value 
Fixes a crash if lifetime of key is bound to value (i.e. key == value)
 2011-02-03 17:09:09 +01:00
Martin Willi bf3e482141 Fix check to increase hashtable size properly 2011-02-03 17:08:53 +01:00
Martin Willi b49d047bfc Invoke the per-round authorize() hook before purging current auth info on IKE_SA 2011-02-03 17:08:39 +01:00
Martin Willi 4536e669a8 Filter out non-matching ike_cfg in backend manager, so backends don't have to 2011-02-03 10:12:16 +01:00
Martin Willi 2b7686b5d8 Migrated ike_auth to INIT/METHOD macros, fixes missing initial_contact initialization 2011-02-02 15:13:39 +01:00
Martin Willi fe79cd4257 Accept non-encrypted INFORMATIONALs for ME connectivity checks 2011-02-01 09:47:36 +01:00
Martin Willi 1d34612f07 Do not use destroyed rng/hasher if IKE_SA has been flush()ed 2011-02-01 09:25:55 +01:00
Martin Willi a846bf06e8 Add missing AUTH_RULE for trusted self-signed peer certificates 2011-02-01 09:25:10 +01:00
Martin Willi 5c89a00f05 Do not log potentially hundreds of cert requests for unknown CAs at level 1 2011-01-28 08:29:23 +01:00
Martin Willi 60b71def1a Use wrapped threading functions in ha plugin 2011-01-20 15:52:29 +01:00
Martin Willi 44b6b8f9d5 Load load-tester plugin before kernel interfaces, fixes fake_kernel option 2011-01-19 16:43:00 +01:00
Martin Willi 8118707845 Increase tls_writer buffer by at least 4 bytes 2011-01-19 14:41:59 +01:00
Martin Willi 7cfa84f540 Whitelist gnutls init function 2011-01-17 18:20:12 +01:00
Martin Willi 2ca52c8048 Implemented an alternative HTTP fetcher based on libsoup 2011-01-17 18:20:06 +01:00
Martin Willi a8a7a31700 Added simple fetcher tool to test fetcher implementations 2011-01-17 18:19:59 +01:00
Martin Willi b94feb4b05 backtrace->contains_function takes multiple names, speeding up whitelist check drastically 2011-01-17 18:19:44 +01:00
Martin Willi ec8426a349 Add some common glib non-leaks to whitelist 2011-01-17 18:19:36 +01:00
Martin Willi c4048cd61f Add missing va_end to va_start in curl_fetcher 2011-01-17 18:19:17 +01:00
Martin Willi d27a8e5011 Do not pass an enum type to va_arg 2011-01-17 18:18:58 +01:00
Martin Willi ff5538e5c0 Use newer Linux capability native API, if available 2011-01-17 18:18:21 +01:00
Martin Willi 2b52d5cb41 Do not install config files with user/group, as it might not exist on build machine 2011-01-17 18:08:17 +01:00
Martin Willi 64e06d4f8f Compare ending address in ts->equals, fixes redundant traffic selector elimination 2011-01-14 13:24:08 +01:00
Martin Willi 983a5e88d3 Revert "Send INITIAL_CONTACT even if we have a unique policy" 
It makes sense to omit INITIAL_CONTACT if don't have a unique policy,
as a client might want to connect from different devices to the same
account.

This reverts commit 719c33b41a.
 2011-01-13 10:50:46 +01:00
Martin Willi 9bac426bf3 Fixed memory cleanup if no DHCP transaction found for an OFFER 2011-01-13 10:36:16 +01:00