denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
12,280 Commits 1 Branch 0 Tags
fe7269c089ddb18d4d2778002a7f249148966f19
Commit Graph
9674 Commits
Author SHA1 Message Date
Martin Willi fe7269c089 charon-cmd: Document new proposal options in manpage 2014-02-06 15:58:13 +01:00
Martin Willi c9e85424a8 charon-cmd: Add --esp/--ah-proposal options to specify CHILD_SA proposals 2014-02-06 15:58:07 +01:00
Martin Willi 2796cf59bc charon-cmd: Add an --ike-proposal option to specify non-default IKE proposals 2014-02-06 15:57:36 +01:00
Martin Willi 1df1430146 charon-cmd: Block SIGUSR1 on worker threads 
To properly shut down charon-cmd with leak reports, only the main thread
should catch SIGUSR1 to shut down the application. Work threads should ignore
SIGUSR1 to avoid any hard application termination.
 2014-02-06 15:57:36 +01:00
Andreas Steffen 0edd13b6c8 Document ipsec attest --session command 2014-02-05 12:06:46 +01:00
Andreas Steffen 24f59868c4 Allow output of session time in UTC 2014-02-05 12:06:22 +01:00
Andreas Steffen d6804e3041 Added missing semicolon in SQL statements 2014-02-05 10:15:56 +01:00
Andreas Steffen 523c2874fb Added Android 4.3.1 to products database table 2014-02-04 19:49:34 +01:00
Andreas Steffen 2a43f7fd9e Added new Android versions to PTS database 2014-02-04 06:59:01 +01:00
Martin Willi 1f4883008e unit-tests: Add some test cases for HTTP GET/POST fetches 2014-01-31 12:18:32 +01:00
Martin Willi 1691b19900 unit-tests: Fix test_runner_run() apidoc 2014-01-29 13:38:10 +01:00
Tobias Brunner 3114cecdbe pki: Declare correct section in pki --issue man page 2014-01-24 16:17:46 +01:00
Martin Willi d048a319df ike: Restart inactivity counter after doing a CHILD_SA rekey 
When doing a rekey for a CHILD_SA, the use counters get reset. An inactivity
job is queued for a time unrelated to the rekey time, so it might happen
that the inactivity job gets executed just after rekeying. If this happens,
inactivity is detected even if we had traffic on the rekeyed CHILD_SA just
before rekeying.

This change implies that inactivity checks can't handle inactivity timeouts
for rekeyed CHILD_SAs, and therefore requires that inactivity timeout is shorter
than the rekey time to have any effect.
 2014-01-23 16:19:22 +01:00
Martin Willi 763e035335 child-sa: Add a getter for CHILD_SA install time 2014-01-23 16:19:22 +01:00
Andrea Bonomi 2312504d1e xauth-pam: Open/close a PAM session for each connected client 
Signed-off-by: Andrea Bonomi <[email protected]>
 2014-01-23 16:07:04 +01:00
Martin Willi 7dc8bf495b xauth-pam: Sanitize XAuth attributes before passing them to PAM 2014-01-23 16:07:04 +01:00
Martin Willi c7c2e24a56 ikev2: Add Cisco FRAGMENTATION vendor ID 
Courtesy of C.J. Adams-Collier, ZeroLag Communications, Inc.
 2014-01-23 16:04:04 +01:00
Martin Willi 2c6d204bec ikev2: Add Cisco Copyright vendor ID 
Courtesy of C.J. Adams-Collier, ZeroLag Communications, Inc.
 2014-01-23 16:04:01 +01:00
Martin Willi f84d1cb2f9 ikev2: Add Cisco Delete Reason vendor ID 
Courtesy of C.J. Adams-Collier, ZeroLag Communications, Inc.
 2014-01-23 16:03:55 +01:00
Martin Willi a8d8e631f9 ikev2: Use a more dynamic vendor ID database, as we use with IKEv1 2014-01-23 16:02:18 +01:00
Martin Willi 853498155e libpts: Use chunk_map() instead of non-portable mmap() 2014-01-23 15:55:33 +01:00
Martin Willi 7ae878c357 tnccs: Use chunk_map() instead of non-portable mmap() 2014-01-23 15:55:33 +01:00
Martin Willi 88fa7f62be pem: Use chunk_map() instead of non-portable mmap() 2014-01-23 15:55:33 +01:00
Martin Willi ecdef634aa stroke: Use chunk_map() instead of non-portable mmap() 2014-01-23 15:55:32 +01:00
Martin Willi b8d0103e31 radattr: Use chunk_map() instead of non-portable mmap() 2014-01-23 15:55:32 +01:00
Martin Willi 39badc53cd libfast: Use chunk_map() instead of non-portable mmap() 2014-01-23 15:55:32 +01:00
Martin Willi 69be6a9e05 integrity-checker: Use chunk_map() instead of non-portable mmap() 2014-01-23 15:55:32 +01:00
Martin Willi b9ee059ca9 chunk: Externalize error reporting in chunk_write() 
This avoids passing that arbitrary label just for error messages, and gives
greater flexibility in handling errors.
 2014-01-23 15:55:32 +01:00
Martin Willi 37374a292a chunk: Provide a fallback chunk_map() if mmap is not available 2014-01-23 15:55:32 +01:00
Martin Willi 1c4a3459f7 chunk: Use dynamically allocated buffer in chunk_from_fd() 
When acting on files, we can use fstat() to estimate the buffer size. On
non-file FDs, we dynamically increase an allocated buffer.

Additionally we slightly change the function signature to properly handle
zero-length files and add appropriate unit tests.
 2014-01-23 15:55:32 +01:00
Martin Willi 595b6d9a82 chunk: Add functions to map file contents to a chunk 2014-01-23 15:55:32 +01:00
Tobias Brunner 21c18f536d unity: Send all traffic selectors in a single UNITY_SPLIT_INCLUDE attribute 
Cisco clients only handle the first such attribute.
 2014-01-23 10:35:21 +01:00
Tobias Brunner f8262aa1a6 unity: Change local TS to 0.0.0.0/0 as responder 
Cisco clients and Shrew expect a remote TS of 0.0.0.0/0 if Unity is
used, otherwise Quick Mode fails.
 2014-01-23 10:35:21 +01:00
Tobias Brunner 685579d6d8 unity: Send UNITY_SPLIT_INCLUDE attributes with proper padding 
The additional 6 bytes are not actually padding but are parsed by the
Cisco client as protocol and src and dst ports (each two bytes but
strangely only the first two in network order).
 2014-01-23 10:35:21 +01:00
Tobias Brunner fe2a2d1885 kernel-netlink: Set selector on transport mode IPComp SAs 2014-01-23 10:27:13 +01:00
Tobias Brunner cc04a6db3e kernel-netlink: Selectively add selector on SAs that use IPComp 
Don't add a selector to tunnel mode SAs, these might serve multiple
traffic selectors but with only one selector on the SA only the traffic
matching the first one would actually get tunneled.
 2014-01-23 10:27:12 +01:00
Tobias Brunner 7e3bbcf77a updown: Increase buffer size for script and environment variables 2014-01-23 10:27:12 +01:00
Tobias Brunner 6d1198e71d updown: Allow IPIP traffic if IPComp was negotiated 
The kernel implicitly creates an IPIP SA if an IPComp SA is installed.
This SA is used inbound for small packets that are not compressed.

Since the addresses are different (they are the tunnel addresses not
those of the tunneled traffic) additional rules are required if the
traffic selector does not cover the tunnel addresses (e.g. due to a NAT).

For SAs with multiple traffic selectors duplicate rules will get installed.
 2014-01-23 10:27:12 +01:00
Tobias Brunner cf4a7395aa updown: Add PLUTO_IPCOMP to indicate if IPComp was negotiated 2014-01-23 10:27:12 +01:00
Tobias Brunner 72a92d4f7d curl: Replace spaces in URIs with %20 
cURL requires the URIs to be URL-encoded. Apparently, some CAs encode CRL
URIs with spaces in them.

Fixes #454.
 2014-01-23 10:19:30 +01:00
Tobias Brunner ccb6758e5b utils: Add strreplace function 2014-01-23 10:18:23 +01:00
Tobias Brunner f44b1eb444 stroke: Ensure the buffer of strings in a stroke_msg_t is null-terminated 
Otherwise a malicious user could send an unterminated string to cause
unterminated reads.
 2014-01-23 10:15:07 +01:00
Tobias Brunner 5ab03863b0 stroke: Add an option to prevent log level changes via stroke socket 2014-01-23 10:15:07 +01:00
Tobias Brunner 040cf911a6 pki: Make sure no command registers too many options 2014-01-23 10:12:24 +01:00
Tobias Brunner 079e6c2b04 pki: Increase MAX_COMMANDS to cover all currently available commands 
Fixes #452.
 2014-01-23 10:12:15 +01:00
Tobias Brunner 2b8224fce3 pki: Print a warning if MAX_COMMANDS is too low 2014-01-23 10:10:53 +01:00
Tobias Brunner b0e14fcba6 pki: Properly use ?: when defining option arrays 2014-01-23 10:10:53 +01:00
Tobias Brunner 54ca25800c agent: Keep CAP_DAC_OVERRIDE to connect to ssh-agent socket 
This is also required if charon-cmd is used with capability dropping.
 2014-01-23 10:08:23 +01:00
Tobias Brunner 53d2164c5d ike: Simplify error handling if name resolution failed 
This avoids a second name resolution attempt just to determine if %any
etc. was configured.

Fixes #440.
 2014-01-23 10:04:19 +01:00
Tobias Brunner be8af56e7a ike: Use proper hostname(s) when name resolution failed 
Was wrong since 0edce68767.

Fixes #440.
 2014-01-23 10:03:50 +01:00