From b2c1973ffbfb37b76bf4069779eb6319a40d1ddd Mon Sep 17 00:00:00 2001 From: Martin Willi Date: Mon, 6 Oct 2014 11:52:49 +0200 Subject: ext-auth: Add an ext-auth plugin invoking an external authorization script Original patch courtesy of Vyronas Tsingaras. --- conf/Makefile.am | 1 + conf/plugins/ext-auth.opt | 15 +++++++++++++++ 2 files changed, 16 insertions(+) create mode 100644 conf/plugins/ext-auth.opt (limited to 'conf') diff --git a/conf/Makefile.am b/conf/Makefile.am index ee9ce72ea..e5077391a 100644 --- a/conf/Makefile.am +++ b/conf/Makefile.am @@ -45,6 +45,7 @@ plugins = \ plugins/eap-tnc.opt \ plugins/eap-ttls.opt \ plugins/error-notify.opt \ + plugins/ext-auth.opt \ plugins/gcrypt.opt \ plugins/ha.opt \ plugins/imc-attestation.opt \ diff --git a/conf/plugins/ext-auth.opt b/conf/plugins/ext-auth.opt new file mode 100644 index 000000000..bf127b9d7 --- /dev/null +++ b/conf/plugins/ext-auth.opt @@ -0,0 +1,15 @@ +charon.plugins.ext-auth.script = + Shell script to invoke for peer authorization. + + Command to pass to the system shell for peer authorization. Authorization + is considered successful if the command executes normally with an exit code + of zero. For all other exit codes IKE_SA authorization is rejected. + + The following environment variables get passed to the script: + _IKE_UNIQUE_ID_: The IKE_SA numerical unique identifier. + _IKE_NAME_: The peer configuration connection name. + _IKE_LOCAL_HOST_: Local IKE IP address. + _IKE_REMOTE_HOST_: Remote IKE IP address. + _IKE_LOCAL_ID_: Local IKE identity. + _IKE_REMOTE_ID_: Remote IKE identity. + _IKE_REMOTE_EAP_ID_: Remote EAP or XAuth identity, if used. -- cgit v1.2.3