aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* Defined generic non-nul terminated string PA-TNC attributeAndreas Steffen2015-08-189-59/+81
|
* Support of HCD Firewall Setting PA-TNC attributeAndreas Steffen2015-08-185-12/+20
|
* Defined generic boolean PA-TNC attributeAndreas Steffen2015-08-1810-434/+136
|
* Defined PWG HCD IF-M attributesAndreas Steffen2015-08-186-4/+191
|
* Fixed the implemention of the IF-M segmentation protocolAndreas Steffen2015-08-1813-51/+97
| | | | | | | The first segment only fit if the segmentation envelope attribute was preceded by a Max Attribute Size Response attribute. The improved implementation fills up the first PA-TNC message with the first segment up to the maximum message size.
* kernel-netlink: Avoid route dump if routing rule excludes traffic with a ↵Tobias Brunner2015-08-181-7/+33
| | | | | | | | | | | certain mark If the routing rule we use to direct traffic to our own routing table excludes traffic with a certain mark (fwmark = !<mark>) we can simplify the route lookup and avoid dumping all routes by passing the mark to the request. That way our own routes are ignored and we get the preferred route back without having to dump and analyze all routes, which is quite a burden on hosts with lots of routes.
* include: Update (rt)netlink.h to the latest UAPI versionTobias Brunner2015-08-182-689/+230
|
* sql: Also do a reversed ID matchTobias Brunner2015-08-171-2/+9
| | | | | | | This is required for the case where IDr is not sent (i.e. is %any). The backend manager does the same. Fixes #1044.
* ha: Recreate the control FIFO if the file exists but is not a FIFOTobias Brunner2015-08-171-13/+68
| | | | | | This may happen if something like `echo ... > /path/to/fifo` is used before the plugin was able to create the FIFO. In that case we'd end up in a loop always reading the same values from the static file.
* ikev1: Assume a default key length of 128-bit for AES-CBCTobias Brunner2015-08-171-0/+11
| | | | | | | | | | Some implementations don't send a Key Length attribute for AES-128. This was allowed for IKE in early drafts of RFC 3602, however, some implementations also seem to do it for ESP, where it never was allowed. And the final version of RFC 3602 demands a Key Length attribute for both phases so they shouldn't do it anymore anyway. Fixes #1064.
* auth-cfg: Matching one CA should be enough, similar to peer certificatesTobias Brunner2015-08-171-15/+20
| | | | | | | | | | Not sure if defining multiple CA constraints and enforcing _all_ of them, i.e. the previous behavior, makes even sense. To ensure a very specific chain it should be enough to define the last intermediate CA. On the other hand, the ability to define multiple CAs could simplify configuration. This can currently only be used with swanctl/VICI based configs as `rightca` only takes a single DN.
* vici: Add option to disable policy installation for CHILD_SAsTobias Brunner2015-08-172-1/+12
|
* child-sa: Fix refcounting of allocated reqidsTobias Brunner2015-08-171-3/+12
| | | | | | | | | | | During a rekeying we want to reuse the current reqid, but if the new SA does not allocate it via kernel-interface the state there will disappear when the old SA is destroyed after the rekeying. When the IKE_SA is later reauthenticated with make-before-break reauthentication the new CHILD_SAs there will get new reqids as no existing state is found in the kernel-interface, breaking policy installation in the kernel. Fixes: a49393954f31 ("child-sa: Use any fixed reqid configured on the CHILD_SA config")
* identification: Remove unused ID_USER_ID typeTobias Brunner2015-08-172-11/+3
|
* man: Clarify identity parsing and identity type prefixesTobias Brunner2015-08-171-6/+58
| | | | References #1028.
* pki: Add --dn command to extract the subject DN of a certificateTobias Brunner2015-08-178-80/+133
|
* scripts: Add script to extract the ASN.1 subject DN from a certificateTobias Brunner2015-08-172-1/+157
| | | | | | This can be useful if the subject DN has to be configured with the asn1dn: prefix in ipsec.conf (e.g. because the actual encoding can't be created by strongSwan's string parser/encoder).
* plugin-feature: Add vendor specific EAP method registration macrosTobias Brunner2015-08-173-9/+20
| | | | | | | | | | | Vendor specific EAP methods may be registered with: PLUGIN_CALLBACK(eap_method_register, <constructor>), PLUGIN_PROVIDE(EAP_SERVER_VENDOR, <type>, <vendor>), Same for client implementations via EAP_PEER_VENDOR. References #969.
* eap-radius: Use Framed-IPv6-Address attributes to send IPv6 VIPs in ↵Tobias Brunner2015-08-171-4/+2
| | | | | | | | | accounting messages This attribute is more appropriate for single IPv6 virtual IPs than the Framed-IPv6-Prefix attribute. Fixes #1001.
* eap-radius: Add support for some basic IPv6-specific RADIUS attributesTobias Brunner2015-08-173-2/+23
| | | | | | These are defined in RFC 6911. Fixes #1001.
* utils: Check for dirfd(3)Tobias Brunner2015-08-172-1/+10
| | | | | Not all POSIX compatible systems might provide it yet. If not, we close the lowest FD to close and hope it gets reused by opendir().
* utils: Directly use syscall() to close open FDs in closefrom()Tobias Brunner2015-08-172-6/+54
| | | | | | | This avoids any allocations, since calling malloc() after fork() is potentially unsafe. Fixes #990.
* utils: Don't use directory enumerator to close open FDs in closefrom()Tobias Brunner2015-08-171-24/+36
| | | | | | | | | | Calling malloc() after fork() is potentially unsafe, so we should avoid it if possible. opendir() will still require an allocation but that's less than the variant using the enumerator wrapper, thus, decreasing the conflict potential. This way we can also avoid closing the FD for the enumerated directory itself. References #990.
* Merge branch 'vici-updown'Tobias Brunner2015-08-175-51/+236
|\ | | | | | | | | | | | | Documents the ike/child-updown events and adds a ike/child-rekey event and a new listen() method in the Python VICI bindings to listen for arbitrary events (similar to the listen_events() method in the Ruby bindings).
| * vici: Add listen methods to receive arbitrary events in Python libraryTobias Brunner2015-08-171-0/+34
| |
| * vici: Move event (un-)registration to a helper method in Python libraryTobias Brunner2015-08-173-49/+60
| | | | | | | | | | Also make sure events are unregistered in case of exceptions in streamed_request().
| * vici: Add ike/child-rekey eventsTobias Brunner2015-08-172-0/+108
| |
| * vici: Document the ike/child-updown eventsTobias Brunner2015-08-171-0/+23
| |
| * vici: Don't include a child-sas section in ike-updown eventTobias Brunner2015-08-171-2/+0
| | | | | | | | | | | | This makes it clearer that only the data concerning the IKE_SA is transmitted (there could be CHILD_SAs e.g. during IKEv1 reauthentication).
| * vici: Explicitly notify listeners of the type of ike/child-updown eventTobias Brunner2015-08-171-0/+11
|/
* Version bump to 5.3.3dr55.3.3dr5Andreas Steffen2015-08-161-1/+1
|
* Fixed AR identities in mutual TNC measurements caseAndreas Steffen2015-08-153-2/+11
|
* kernel-pfroute: Don't install virtual IPs if charon.install_virtual_ip is ↵Tobias Brunner2015-08-131-0/+17
| | | | disabled
* load-tester: Include string.h for strcmp() on some platformsTobias Brunner2015-08-131-0/+1
|
* Initialize variables that some compilers seem to warn aboutTobias Brunner2015-08-134-4/+4
|
* Fixed some typosTobias Brunner2015-08-135-8/+8
|
* kernel-netlink: When adding a policy do an update if it already existsTobias Brunner2015-08-131-1/+9
| | | | | | | | | | This may be the case when SAs are reestablished after a crash of the IKE daemon. We could actually always do updates. The kernel doesn't care, the only difference is the possible EEXIST if XFRM_MSG_NEWPOLICY is used. The advantage of not doing this, though, is that we get a warning in the log if a policy already exists, as that should usually not be the case.
* kernel-pfkey: When adding policies do an update if they already existTobias Brunner2015-08-131-1/+10
| | | | | This may be the case when SAs are reestablished after a crash of the IKE daemon.
* pki: Optionally extract public key from given private key in --issueTobias Brunner2015-08-102-6/+30
| | | | Fixes #618.
* conf: Clarify resolution for two time settingsTobias Brunner2015-08-102-4/+4
| | | | Fixes #1061.
* Version bump to 5.3.3dr45.3.3dr4Andreas Steffen2015-08-101-1/+1
|
* identification: Use UTF8String instead of the legacy T61String to encode DNsTobias Brunner2015-08-061-1/+1
| | | | | | | When strings in RDNs contain characters outside the character set for PrintableString use UTF8String as the passed string is most likely in that encoding (RFC 5280 actually recommends to use only those two string types).
* whitelist: Use hash() method so DNs with different string types matchTobias Brunner2015-08-061-1/+1
| | | | | | | | | | strongSwan uses PrintableString when encoding DNs from strings (if the character set permits it, otherwise T61String is currently used) but certificates might be encoded with UTF8String even for simple ASCII strings. By ignoring this string type when hashing RDNs we make sure the same hash results in this case as long as the actual string values are the same. Fixes #991.
* identification: Add hash() methodTobias Brunner2015-08-063-3/+135
| | | | | | | Compared to hashing the encoding we can ignore string types of RDNs when hashing DNs, making hash() compatible to equals() that does the same. Fixes #991.
* pkcs11: Fix encoding of RSA keys if unnecessarily zero prefixedTobias Brunner2015-08-061-3/+8
| | | | | | | | | | | | | | Some tokens/libraries seem to prefix all numbers with zero bytes even if not necessary (e.g. the default exponent 0x010001). If we don't fix that, the fingerprints calculated based on the retrieved values will be incorrect. Even if the pkcs1 plugin can properly handle numbers that are not in two's complement since a81bd670b086 ("Added PUBKEY_RSA_MODULUS encoding type") we prefix them with zero if necessary as other encoders might expect them in two's complement. Fixes #1012.
* updown: Pass virtual IPs assigned to a peer to the updown scriptTobias Brunner2015-08-062-8/+20
| | | | | | Previously only received virtual IPs were available. References #1008.
* eap-radius: Don't send RADIUS Accounting Start messages twiceTobias Brunner2015-08-061-0/+5
| | | | | | | | If a client does Mode Config during reauthentication the assign_vips() event might be triggered twice, we should not send another Start message in that case. Fixes #937.
* eap-radius: Change trigger for Accounting Start messages for IKEv1Tobias Brunner2015-08-062-6/+13
| | | | | | | | | | | | | | | | | | | | | Some clients won't do Mode Config or XAuth during reauthentication. Because Start messages previously were triggered by TRANSACTION exchanges none were sent for new SAs of such clients, while Stop messages were still sent for the old SAs when they were destroyed. This resulted in an incorrect state on the RADIUS server. Since 31be582399 the assign_vips() event is also triggered during reauthentication if the client does not do a Mode Config exchange. So instead of waiting for a TRANSACTION exchange we trigger the Start message when a virtual IP is assigned to a client. With this the charon.plugins.eap-radius.accounting_requires_vip option would not have any effect for IKEv1 anymore. However, it previously also only worked if the client did an XAuth exchange, which is probably rarely used without virtual IPs, so this might not be much of a regression. Fixes #937.
* testing: Update AAA certificate on Freeradius as wellAndreas Steffen2015-08-052-42/+42
|
* testing: Updated expired AAA server certificateAndreas Steffen2015-08-049-88/+115
|
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-07 04:45:06 +0000