aboutsummaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
...
* vici: Handle closed sockets in the Ruby gemEvan Broder2015-08-241-1/+5
| | | | | | | | | | | | | | | | From recvfrom(2) (which UDPSocket#recv backs into): The return value will be 0 when the peer has performed an orderly shutdown. (i.e. it will return an empty string) Previously in this scenario, Vici::Transport#recv_all would spin forever trying to pull more data off the socket. I'm not entirely clear what happened that caused strongSwan to shutdown the socket, but it probably should not cause vici Ruby apps to spin. Closes strongswan/strongswan#13.
* starter: Don't flush SAs in the kernelTobias Brunner2015-08-213-14/+0
| | | | | If starter is not used we don't do that either. And this allows us to move the stuff in libhydra back to libcharon.
* starter: Don't flush policies in the kernelTobias Brunner2015-08-211-1/+0
| | | | | | | | | | | We can't control which policies we flush, so if policies are installed and used outside of strongSwan for other protocols we'd flush them too. And if installpolicies=no is used we probably shouldn't flush policies either. Luckily already existing policies are not treated as fatal errors anymore, so not flushing policies should not be that much of an issue (in case of a crash in dynamic setups, e.g. with virtual IPs, policies could be left behind even after restarting the connections and properly terminating the daemon).
* kernel-pfkey: Only flush SAs of types we actually manageTobias Brunner2015-08-211-13/+26
|
* kernel-netlink: Only flush SAs of types we actually manageTobias Brunner2015-08-211-6/+19
|
* vici: Optionally check limits when initiating connectionsTobias Brunner2015-08-212-1/+7
| | | | | If the init-limits parameter is set (disabled by default) init limits will be checked and might prevent new SAs from getting initiated.
* vici: Add get_bool() convenience getter for VICI messagesTobias Brunner2015-08-213-0/+94
|
* controller: Optionally adhere to init limits also when initiating IKE_SAsTobias Brunner2015-08-2115-20/+71
|
* ike: Also track initiating IKE_SAs as half-openTobias Brunner2015-08-211-1/+0
|
* stroke: Allow %any as local addressTobias Brunner2015-08-211-3/+7
| | | | | Actually, resolving addresses in `left` might be overkill as we'll assume left=local anyway (the only difference is the log message).
* stroke: Add an option to disable side-swapping of configuration optionsTobias Brunner2015-08-211-33/+46
| | | | | In some scenarios it might be preferred to ensure left is always local and no unintended swaps occur.
* ikev1: Assign different job priorities for inbound IKEv1 messagesTobias Brunner2015-08-211-2/+12
|
* child-rekey: Don't add a REKEY_SA notify if the child-create task is ↵Tobias Brunner2015-08-211-6/+9
| | | | deleting the SA
* child-create: Cache proposed IPsec protocolTobias Brunner2015-08-211-10/+13
| | | | | This allows us to DELETE CHILD_SAs on failures that occur before we retrieved the selected proposal.
* child-create: Don't attempt to delete the SA if we don't have all the ↵Tobias Brunner2015-08-211-8/+10
| | | | | | | information Since we only support single protocols we could probably guess it and always send a DELETE.
* child-rekey: Remove redundant migrate() call for child-create sub-taskTobias Brunner2015-08-211-2/+1
| | | | | | | When retrying due to a DH group mismatch this is already done by the child-create task itself. And in other cases where the task returns NEED_MORE we actually will need access to a possible proposal to properly delete it.
* child-create: Fix crash when retrying CHILD_SA rekeying due to a DH group ↵Tobias Brunner2015-08-211-0/+1
| | | | | | | | | | mismatch If the responder declines our KE payload during a CHILD_SA rekeying migrate() is called to reuse the child-create task. But the child-rekey task then calls the same method again. Fixes: 32df0d81fb46 ("child-create: Destroy nonceg in migrate()")
* auth-cfg: Don't enforce EAP_RADIUSTobias Brunner2015-08-211-1/+2
| | | | | Basically the same as e79b0e07e4ab. EAP_RADIUS is also a virtual method that will identify itself as a different EAP method later.
* stroke: Change how CA certificates are storedTobias Brunner2015-08-205-58/+285
| | | | | | | | | | | Since 11c14bd2f5 CA certificates referenced in ca sections were enumerated by two credential sets if they were also stored in ipsec.d/cacerts. This caused duplicate certificate requests to get sent. All CA certificates, whether loaded automatically or via a ca section, are now stored in stroke_ca_t. Certificates referenced in ca sections are now also reloaded when `ipsec rereadcacerts` is used.
* stroke: Combine CA certificate load methodsTobias Brunner2015-08-201-82/+74
| | | | | Also use the right credential set for CA cert references loaded from stroke_ca_t.
* stroke: Atomically replace CA and AA certificates when reloading themTobias Brunner2015-08-201-34/+45
| | | | | Previously it was possible that certificates were not found between the time the credential sets were cleared and the certificates got readded.
* mem-cred: We don't need a write lock when looking for a certificateTobias Brunner2015-08-201-1/+1
|
* mem-cred: Add a method to atomically replace all certificatesTobias Brunner2015-08-202-10/+58
|
* ikev1: Fix handling of overlapping Quick Mode exchangesTobias Brunner2015-08-203-2/+70
| | | | | | | | | | | | | In some cases the third message of a Quick Mode exchange might arrive after the first message of a subsequent Quick Mode exchange. Previously these messages were handled incorrectly and the second Quick Mode exchange failed. Some implementations might even try to establish multiple Quick Modes simultaneously, which is explicitly allowed in RFC 2409. We don't fully support that, though, in particular in case of retransmits. Fixes #1076.
* kernel-pfkey: Add support for AES-GCMTobias Brunner2015-08-201-3/+11
| | | | | | | | | | The next release of FreeBSD will support this. While Linux defines constants for AES-GCM in pfkeyv2.h since 2.6.25 it does not actually support it. When SAs are installed via PF_KEY only a lookup in XFRM's list of encryption algorithms is done, but AES-GCM is in a different table for AEAD algorithms (there is currently no lookup function to find algorithms in that table via PF_KEY identifier).
* auth-cfg: Don't enforce EAP_DYNAMICTobias Brunner2015-08-201-1/+2
| | | | | We now store the actual method on the auth config, which won't match anymore if rightauth=eap-dynamic is configured.
* ikev2: Compare initiator flag again, partially reverts 17ec1c74deTobias Brunner2015-08-202-1/+5
| | | | | We should ignore messages that have the flag set incorrectly. This restores RFC compliance which was broken since the mentioned commit.
* ikev2: Drop IKE_SA_INIT messages that don't have the initiator flag setTobias Brunner2015-08-201-1/+3
| | | | | | | | | | | While this doesn't really create any problems it is not 100% correct to accept such messages because, of course, the sender of an IKE_SA_INIT request is always the original initiator of an IKE_SA. We currently don't check the flag later, so we wouldn't notice if the peer doesn't set it in later messages (ike_sa_id_t.equals doesn't compare it anymore since we added support for IKEv1, in particular since 17ec1c74de).
* ikev1: Pass current auth-cfg when looking for key to determine auth methodTobias Brunner2015-08-191-1/+1
| | | | | | | | | If multiple certificates use the same subjects we might choose the wrong one otherwise. This way we use the one referenced with leftcert and stored in the auth-cfg and we actually do the same thing later in the pubkey authenticator. Fixes #1077.
* ikev2: Store outer EAP method used to authenticate remote peer in auth-cfgTobias Brunner2015-08-191-0/+9
| | | | | | | This allows symmetric configuration of EAP methods (i.e. the same value in leftauth and rightauth) when mutual EAP-only authentication is used. Previously the client had to configure rightauth=eap or rightauth=any, which prevented it from using this same config as responder.
* imc: get_default_pwd_status(), as it currently is, works on Windows tooTobias Brunner2015-08-191-8/+8
| | | | This fixes the build on Windows.
* ike: Use the original port when remote resolves to %anyTobias Brunner2015-08-191-1/+3
| | | | | | When reestablishing the IKE_SA we should still use the original port when right resolves to %any as some implementations might not like initial IKE messages on port 4500 (especially for IKEv1).
* trap-manager: Enable auto=route with right=%any for transport mode connectionsTobias Brunner2015-08-191-27/+118
| | | | Fixes #196.
* Added reason string support to HCD IMVAndreas Steffen2015-08-182-1/+78
|
* Fixed patches format delimited by CR/LFAndreas Steffen2015-08-182-26/+32
|
* Use PWG HCD PA-TNC subtypes to transport HCD attributesAndreas Steffen2015-08-185-118/+276
|
* Add default password determination capability to os_infoAndreas Steffen2015-08-182-2/+18
|
* Reintroduced ietf_attr_fwd_enabled()Andreas Steffen2015-08-185-1/+319
|
* Defined PWG HCD PA-TNC subtypesAndreas Steffen2015-08-184-96/+217
|
* Added os_info support to HCD IMCAndreas Steffen2015-08-181-0/+14
|
* Subscribed Scanner IMC/IMV to IETF_FIREWALL PA subtypeAndreas Steffen2015-08-182-4/+4
|
* Implemented HCD IMC and IMVAndreas Steffen2015-08-1811-0/+1949
|
* Defined HCD PA subtype in PWG namespaceAndreas Steffen2015-08-182-2/+32
|
* Completed implementation of PWG HCD attributesAndreas Steffen2015-08-189-9/+567
|
* Defined generic non-nul terminated string PA-TNC attributeAndreas Steffen2015-08-189-59/+81
|
* Support of HCD Firewall Setting PA-TNC attributeAndreas Steffen2015-08-185-12/+20
|
* Defined generic boolean PA-TNC attributeAndreas Steffen2015-08-1810-434/+136
|
* Defined PWG HCD IF-M attributesAndreas Steffen2015-08-186-4/+191
|
* Fixed the implemention of the IF-M segmentation protocolAndreas Steffen2015-08-1813-51/+97
| | | | | | | The first segment only fit if the segmentation envelope attribute was preceded by a Max Attribute Size Response attribute. The improved implementation fills up the first PA-TNC message with the first segment up to the maximum message size.
* kernel-netlink: Avoid route dump if routing rule excludes traffic with a ↵Tobias Brunner2015-08-181-7/+33
| | | | | | | | | | | certain mark If the routing rule we use to direct traffic to our own routing table excludes traffic with a certain mark (fwmark = !<mark>) we can simplify the route lookup and avoid dumping all routes by passing the mark to the request. That way our own routes are ignored and we get the preferred route back without having to dump and analyze all routes, which is quite a burden on hosts with lots of routes.
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-05 10:20:08 +0000