denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
8,307 Commits 1 Branch 0 Tags
f99d8b10c9f5b5024b4b1e5f5d1e56e2519cdadc
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Martin Willi f99d8b10c9 Added a dedicated sender flush method, delay sender destruction until users gone 2012-05-02 10:22:59 +02:00
Martin Willi 1b7debcc04 Keep COOKIEs enabled once threshold is hit, until we see no COOKIEs for a few secs 
Toggling COOKIEs on/off is problematic: After doing a COOKIE exchange as
initiator, we can't know if the completing IKE_SA_INIT message is to our first
request or the one with the COOKIE. If the responder just enabled/disabled
COOKIEs and packets get retransmitted, both might be true. Avoiding COOKIE
behavior toggling improves the situation, but does not solve the problem during
the initial COOKIE activation.
 2012-04-17 10:02:21 +02:00
Martin Willi d0d600e1ef Added a note about DH/keymat lifecycle for custom implementations 2012-04-17 10:02:21 +02:00
Martin Willi a59a03670b Reuse existing DH value when retrying IKE_SA_INIT with a COOKIE 2012-04-17 10:02:21 +02:00
Martin Willi 10f24e6599 Don't invoke child_updown hook twice as responder 2012-04-11 17:45:12 +02:00
Martin Willi 4ef867f578 Accept zero-length certificate request payloads 2012-04-11 17:22:23 +02:00
Martin Willi 4bc7577db2 More detailed NEWS about RADIUS extensions 2012-04-02 13:58:21 +02:00
Martin Willi bc403eb1e5 Fixed crash and locking issues while unrouting connections via stroke 2012-03-13 10:56:22 +01:00
Martin Willi 4bbd943038 Include radattr RADIUS attribute only if an EAP payload is present 2012-03-06 16:08:32 +01:00
Martin Willi bb0b203186 By default include radattr RADIUS attribute in any IKE_AUTH exchange 2012-03-06 16:08:29 +01:00
Martin Willi 45f20f8a79 farp plugin sends ARP responses for any tunneled address, not only virtual IPs 2012-03-06 16:06:33 +01:00
Martin Willi 21796bac9a Be less verbose if we don't have a local address for a tunnel 2012-03-06 16:05:58 +01:00
Martin Willi 4d7a2128b6 Re-resolve hosts on additional keyingtries 2012-03-06 16:05:28 +01:00
Martin Willi d1fbb0a4b3 Renamed radius_server to radius_config, as some real RADIUS server functionality is coming 2012-03-05 18:31:30 +01:00
Martin Willi 2e3615e4ad Prefer EAP-Identity to read radattr RADIUS attribute file 2012-03-05 18:08:04 +01:00
Martin Willi 4cd176d525 Invoke ike_updown hook on authentication failure not before response sent 2012-03-05 18:08:04 +01:00
Martin Willi 0853ff39c5 Build libradius if radattr plugin is enabled 2012-03-05 18:08:04 +01:00
Martin Willi 3ccc8a191c Inject RADIUS attribute in radattr plugin read from an identity specific file 2012-03-05 18:08:04 +01:00
Martin Willi caf4b88efc Added a radattr plugin that prints any received RADIUS notify to console 2012-03-05 18:08:04 +01:00
Martin Willi f0f94e2ce6 Moved generic RADIUS protocol support to a dedicated libradius 2012-03-05 18:08:04 +01:00
Martin Willi 990fda9d88 Removed libcharon dependencies from generic RADIUS protocol support 2012-03-05 18:06:15 +01:00
Martin Willi 99cb353968 Forward specifcied RADIUS attributes between AAA backend and client 2012-03-05 18:06:15 +01:00
Martin Willi 007d5b9218 Defined a private status notify to transport arbitrary RADIUS attributes 2012-03-05 18:06:14 +01:00
Martin Willi c158ccd960 Implemented RADIUS DAE response retransmission 2012-03-05 18:06:14 +01:00
Martin Willi fbaf5cd213 Be a little more verbose before starting IKE_SA reauthentication 2012-03-05 18:06:14 +01:00
Martin Willi 4d19f7c5bf Process RADIUS DAE CoA updates, updating lifetimes 2012-03-05 18:06:14 +01:00
Martin Willi a07b69734b Send an AUTH_LIFETIME update after updating the lifetime, but can not reauth actively 2012-03-05 18:06:14 +01:00
Martin Willi d23c159658 Use faster ike_sa_id and a delete job to handle RADIUS DAE Delete-Request 2012-03-05 18:06:14 +01:00
Martin Willi 245e3c52a2 Refactored RADIUS DAE IKE_SA lookup 2012-03-05 18:06:14 +01:00
Martin Willi 964b0c144e Pass RADIUS DAE client address a host_t instead of sockaddr struct 2012-03-05 18:06:14 +01:00
Martin Willi 9756c143f0 Send RADIUS DAE Disconnect-ACK/NAK on Disconnect-Request 2012-03-05 18:06:14 +01:00
Martin Willi 392618d4ec Support signing of RADIUS response messages 2012-03-05 18:06:13 +01:00
Martin Willi 2bf3858955 Act on RADIUS DAE Disconnect requests 2012-03-05 18:06:13 +01:00
Martin Willi 76b6b19f8d Verify received RADIUS DAE requests 2012-03-05 18:06:13 +01:00
Martin Willi e8a8179706 Support verification of RADIUS request messages 2012-03-05 18:06:13 +01:00
Martin Willi 3bc1829211 Rename RADIUS message constructors to handle both, requests and responses 2012-03-05 18:06:13 +01:00
Martin Willi 6319ce63cf Enable RADIUS DAE listening if configured 2012-03-05 18:06:13 +01:00
Martin Willi 85932ad24e Added infrastructure to listen to RADIUS Dynamic Authorization Extension requests 2012-03-05 18:06:13 +01:00
Martin Willi 3a42c08904 Added Dynamic Authorization Extension RADIUS message codes 2012-03-05 18:06:13 +01:00
Martin Willi c61341a58f Set IKE_SA lifetime based on RADIUS Session-Timeout attribute 2012-03-05 18:06:13 +01:00
Martin Willi bdcf441703 Set hard timeouts when setting a lifetime 2012-03-05 18:06:13 +01:00
Martin Willi e9fcf1c6cc Fix IKE_SA timeout debug output on 64bit platforms 2012-03-05 18:06:13 +01:00
Martin Willi 3a2660f189 Encode IPv6 virtual IPs in a Framed-IPv6-Prefix attribute 2012-02-24 11:20:16 +01:00
Martin Willi d15ae70c8c Refactored construction of RADIUS accounting messages 2012-02-24 11:12:18 +01:00
Martin Willi d93f204ca5 Include port numbers in Calling-Station-Id, too 2012-02-24 10:49:29 +01:00
Martin Willi 802ed08dff Use large enough buffers for IPv6 addresses in Calling-Station-Id 2012-02-24 10:13:08 +01:00
Martin Willi 434cdbac09 Send client external address as Calling-Station-Id in RADIUS accounting 2012-02-24 10:05:23 +01:00
Martin Willi ae10ee6d0b Double check if a cached suite is available, overwrite any old suite state 2012-02-07 11:42:57 +01:00
Martin Willi 06c150365d Fix TLS EAP-MSK derivation, uses different order of randoms than key expansion 2012-02-07 10:54:53 +01:00
Martin Willi 1dabf5bfc7 Filter TLS suite MAC by HMAC algorithm, as the hash is not necessarily the same 2012-02-07 10:54:53 +01:00
Martin Willi 32dc2b0243 Update usage for all children in RADIUS accounting just before sending Stop 2012-02-06 10:51:40 +01:00
Martin Willi e5747e7a83 Check if ClusterIP directory could be opened before enumerating it 2012-02-06 10:51:39 +01:00
Martin Willi 85dd6a8deb Trigger DPD not before IKE_SA state gets updated 2012-02-02 10:35:50 +01:00
Martin Willi 916cdca851 Don't retransmit, rekey, reauth or DPD check SAs when in PASSIVE state 2012-02-02 10:34:04 +01:00
Martin Willi a895801270 Added TLS session resumption NEWS 2012-02-01 12:13:00 +01:00
Martin Willi a345aa2639 Added RADIUS accounting NEWS 2012-02-01 12:07:32 +01:00
Martin Willi 503dee4d2f Added RADIUS accounting option to strongswan.conf manual 2012-02-01 11:35:13 +01:00
Martin Willi 0399edef71 Support RADIUS accounting messages containing Framed-IP and Inbound/Outbound-Octets 2012-01-30 19:16:49 +01:00
Martin Willi 8e5b4aa023 Open RADIUS accounting sockets to exchange accounting messages 2012-01-30 19:15:20 +01:00
Martin Willi a69aff5f17 Support signing of RADIUS accounting messages 2012-01-30 19:13:20 +01:00
Martin Willi 370de553f8 RADIUS message constructor accepts a message code parameter 2012-01-30 19:11:08 +01:00
Martin Willi 023800ba62 Build libstrongswan if libfast gets built 2012-01-24 18:23:44 +01:00
Martin Willi 498d172c33 Use correct time_t variables to store ARG_TIME options 2012-01-18 10:31:45 +01:00
Martin Willi f8b2906929 Use the TLS socket splicing in tls_test script 2011-12-31 13:14:49 +01:00
Martin Willi 3a87c89b1b Added a tls_socket_t.splice method to wrap a file descriptor into TLS 2011-12-31 13:14:49 +01:00
Martin Willi 6a5c86b7ad Implemented TLS session resumption both as client and as server 2011-12-31 13:14:49 +01:00
Martin Willi ca5767621b Implemented a TLS session cache 2011-12-31 13:14:49 +01:00
Martin Willi 703c0db894 Check for cipherspec changes after each handshake message 2011-12-31 13:14:49 +01:00
Martin Willi 4caa380625 Separated cipherspec checking and switching, allowing us to defer the second 2011-12-31 13:14:49 +01:00
Martin Willi 84da59f609 Be less verbose about TLS extensions 2011-12-24 14:14:25 +01:00
Martin Willi ed57dfca3f In TLS 1.2, PRF and HASH function use at least SHA-256, not the MAC hash function 2011-12-24 12:42:28 +01:00
Martin Willi 6b01216422 Added a getter for the tls_socket file descriptor 2011-12-24 12:42:25 +01:00
Martin Willi 8b8fcfd631 Be less verbose if plugin dependecy not satisfied 2011-12-07 13:42:10 +01:00
Martin Willi 005b02cbe3 Create a dummy pthread key for value "0", as some buggy PKCS#11 libraries mangle it 2011-12-07 13:42:07 +01:00
Martin Willi b2e493ab58 Fixed proposal numbering check in sa_payload 2011-11-21 09:12:00 +01:00
Martin Willi 3fcacd283e Fix unaligned aliasing warning in raw socket 2011-11-17 18:22:07 +01:00
Martin Willi 37276728f3 Added some NEWS for 4.6.0 2011-10-14 10:29:01 +02:00
Martin Willi 58fcdc4f06 Don't enforce features with soft dependencies before all plugins are loaded 2011-10-14 10:05:49 +02:00
Martin Willi 67c1d36554 Add features support tp eap-simaka-reauth plugin 2011-10-14 10:05:49 +02:00
Martin Willi e9655e7417 Add features support to eap-simaka-pseudonym plugin 2011-10-14 10:05:49 +02:00
Martin Willi f91cba1874 Add features support to eap-simaka-sql plugin 2011-10-14 10:05:49 +02:00
Martin Willi a07f2a4b9b Don't try to load a feature again after failure 2011-10-14 10:05:49 +02:00
Martin Willi 9894b91ca9 Don't load eap-sim-file plugin if no valid triplet file found 2011-10-14 10:05:49 +02:00
Martin Willi 59c4e88b16 Reset registration function for each plugin during feature loading 2011-10-14 10:05:49 +02:00
Martin Willi 9099e4fd3c Add features support to eap-sim-pcsc plugin 2011-10-14 10:05:49 +02:00
Martin Willi 5f17a09323 Add features support to eap-sim-file plugin 2011-10-14 10:05:48 +02:00
Martin Willi 49458758f6 Add features support to eap-sim plugin 2011-10-14 10:05:48 +02:00
Martin Willi 1cb9a6d8ba Add features support to eap-aka-3gpp2 plugin 2011-10-14 10:05:48 +02:00
Martin Willi c12c334925 Add a plugin feature registration callback for SIM/AKA backends 2011-10-14 10:05:48 +02:00
Martin Willi 4ae99247b5 Add features support to eap-aka plugin 2011-10-14 10:05:48 +02:00
Martin Willi e64d1141ff Add features support to fips-prf plugin 2011-10-14 10:05:48 +02:00
Martin Willi 756b504e40 Add features support to socket-raw plugin 2011-10-14 10:05:48 +02:00
Martin Willi 85d11ce9bd Add features support to socket-dynamic plugin 2011-10-14 10:05:48 +02:00
Martin Willi 8c5aacc270 Add features support to socket-default plugin 2011-10-14 10:05:48 +02:00
Martin Willi 8b6881cfc5 Added socket plugin feature loading callback 2011-10-14 10:05:48 +02:00
Martin Willi 3b62d5bad8 Add features support to kernel-klips plugin 2011-10-14 10:05:48 +02:00
Martin Willi 8da1f9f25d Add features support to kernel-pfroute plugin 2011-10-14 10:05:48 +02:00
Martin Willi e99cb0673d Add features support to kernel-pfkey plugin 2011-10-14 10:05:47 +02:00
Martin Willi 278e5f3d7a Add features support to kernel-netlink plugin 2011-10-14 10:05:47 +02:00
Martin Willi 33a8860eac Added macro to define CUSTOM plugin features 2011-10-14 10:05:47 +02:00