3b16c2b55d
libvici: Add missing argument to Doxygen comment
2014-06-30 13:16:16 +02:00
ed01c1afff
Fixed some typos
2014-06-30 13:16:16 +02:00
4431e1e04d
updown: Force subnet address to be numeric
2014-06-25 16:17:15 +02:00
fc8ca5f2f2
eap-radius: Increase buffer for accounting attributes to maximum attribute size
...
Fixes #624 .
2014-06-25 13:11:34 +02:00
5195416d90
android: Update Android.mk files to match changes due to the Windows port
...
Makes them easier to compare to the original Makefile.am.
2014-06-24 15:53:25 +02:00
8661c56d38
vici: Install libvici in ipseclibdir like we do with other libraries
2014-06-19 14:42:07 +02:00
c005073d0b
kernel-interface: Add destination prefix to get_nexthop()
...
This allows to determine the next hop to reach a subnet, for instance, when
installing routes for shunt policies.
2014-06-19 14:33:40 +02:00
981466251f
shunt-manager: Install passthrough policies with highest priority
...
This avoids conflicts with regular IPsec policies.
Similarly, use the lowest priority for drop policies.
2014-06-19 14:20:33 +02:00
9f950af17a
load-tester: Add a crl option to include a CRL uri in generated certificates
2014-06-19 10:48:27 +02:00
8b855a97c2
bus: Properly va_copy() argument list before passing it to printf() functions
...
As we later potentially use args again, we can't consume it with printf
functions without copying it first. Clone list before passing it to any
consuming function.
Fixes #621 .
2014-06-19 10:10:54 +02:00
758dc8a953
child-sa: Set replay window on both inbound and outbound SA
...
While the outbound SA actually does not need a replay window, the kernel rejects
zero replay windows on SAs using ESN. The ESN flag is required to use the full
sequence number in ICV calculation, hence we set the replay window.
This restores the behavior we had before 30c009c2
2014-06-18 16:54:19 +02:00
abe116cdf8
ikev1: Allow late connection switching based on XAuth username
2014-06-18 09:30:07 +02:00
5885ec2a27
vici: Support memory stats without leak-detective on Windows
2014-06-17 17:55:45 +02:00
65689ce76a
vici: Add a stats command returning various daemon infos and statistics
2014-06-17 17:55:45 +02:00
d73a46171d
vici: Support a replay_window CHILD_SA option
2014-06-17 16:41:31 +02:00
d5367d2262
starter: Add a replay_window connection option
2014-06-17 16:41:31 +02:00
30c009c2fe
kernel-interface: Add a replay_window parameter to add_sa()
2014-06-17 16:41:30 +02:00
bdcaa5e680
child-cfg: Store connection specific replay window on CHILD_SA config
2014-06-17 15:42:02 +02:00
2d846c2035
socket-win: Use non-overlapped I/O and socket event selection
...
The use of overlapped I/O was incorrect, as we passed stack based buffers, but
did not cancel/wait for pending completion on all sockets. Our receive-from-all
socket interface is actually tricky to implement using overlapped I/O. Switch
to WSAEventSelect() event management, which can be canceled properly while
working in a select()-like way.
2014-06-17 15:19:25 +02:00
eef7427b0f
bus: Add a handle_vips() hook invoked after handling configuration attributes
...
Similar to assign_vips() used by a peer assigning virtual IPs to the other peer,
the handle_vips() hook gets invoked on a peers after receiving attributes. On
release of the same attributes the hook gets invoked again.
This is useful to inspect handled attributes, as the ike_updown() hook is
invoked after authentication, when attributes have not been handled yet.
2014-06-17 15:14:51 +02:00
7fc98a840b
ikev1: Invoke the assign_vips() bus hook for IKEv1 as well
2014-06-16 15:59:17 +02:00
9d257034d8
ike: Create an enumerator for (un-)handled configuration attributes on IKE_SA
2014-06-16 15:59:17 +02:00
5ae3221075
ike: Store unhandled attributes on IKE_SA as well
2014-06-16 15:59:16 +02:00
dacb75f5c0
Split swanctl --raw mode into single-line and --pretty mode
2014-06-14 15:40:22 +02:00
cab59c73fc
windows: Use WINAPI call convention for Windows API callbacks
...
For x86_64 it does not actually matter, but for i686 builds the call convention
is different with WINAPI.
2014-06-06 16:28:28 +02:00
4b9848a2cc
kernel-wfp: Include Windows header patch for MinGW 4.8.1
2014-06-04 16:32:12 +02:00
75afbeee21
kernel-wfp: Clone acquire traffic selectors only if they exist
2014-06-04 16:32:11 +02:00
78bde29a7c
kernel-wfp: Install routes for trap policies
2014-06-04 16:32:11 +02:00
e36d1d4124
kernel-wfp: Refactor route management to separate function
2014-06-04 16:32:11 +02:00
4a8ba369b6
kernel-wfp: Install tunnel mode policies to appropriate sub-layers
...
While it is unclear if this has any effect at all, we prefer specific sublayers
to install policies as suggested.
2014-06-04 16:32:11 +02:00
be32be01a8
kernel-wfp: Declare GUIDs and auth/cipher configs missing in some MinGW builds
2014-06-04 16:32:11 +02:00
4b51280344
kernel-wfp: Support multiple traffic selectors on tunnel mode SAs
2014-06-04 16:32:11 +02:00
4b09bd6c29
child-sa: Pass the number of total policies tied to an SA to the kernel
...
This will be useful if the kernel backend has to know how many policies
follow an SA install, for example if it must install all policies concurrently.
2014-06-04 16:32:11 +02:00
5e6e214ab4
kernel-iph: Implicitly enable IP forwarding when installing routes
2014-06-04 16:32:11 +02:00
c7d30c2ad1
kernel-wfp: Show a warning for packets the kernel drops in its IPsec layers
2014-06-04 16:32:10 +02:00
a4f3b363da
kernel-wfp: Set flag to get UDP encapsulation with tunnel mode working
...
Having this flag set fixes connections initiated by the Windows host, but
unfortunately does not yet fix incoming connections. Connection state issue?
We still see 0xc00000e2 error events, translating to INTERNAL_ERROR.
2014-06-04 16:32:10 +02:00
6de788704b
kernel-wfp: Install tunnel and trap forward policies
2014-06-04 16:32:10 +02:00
1678f0a999
kernel-wfp: Manually create a ProviderContext to attach individual filters
...
This gives us more flexibility than using the intransparent FwpmIPsecTunnelAdd,
and fixes the issues we have seen with trap policies. Forward filters are
still missing, but required for site-to-site tunnels.
2014-06-04 16:32:10 +02:00
1ca2b1615a
kernel-wfp: Print filter weight in "ipsecdump filters"
2014-06-04 16:32:10 +02:00
c6f189e448
kernel-wfp: Add support for trap policies and acquires
2014-06-04 16:32:10 +02:00
11e7d0677c
socket-win: Install IKE bypass policies using bypass_socket()
2014-06-04 16:32:10 +02:00
f206e069f1
kernel-wfp: Implement bypass_socket() using dedicated filter rules
2014-06-04 16:32:09 +02:00
2868314028
kernel-wfp: Register for WFP Net events
2014-06-04 16:32:09 +02:00
6aaa432741
kernel-wfp: Add some missing IPv6 GUIDs, fix IPv6 host conversion
2014-06-04 16:32:09 +02:00
288dc68596
kernel-wfp: Add an ipsecdump "filters" command to print IPsec related filters
2014-06-04 16:32:09 +02:00
489a4f2192
kernel-wfp: Add an ipsecdump utility to show installed SAs/SPs on Windows
2014-06-04 16:32:09 +02:00
9c974c329d
kernel-wfp: Depend on used RNG plugin features
2014-06-04 16:32:09 +02:00
5a5b9925f8
kernel-wfp: Implement update_sa()
2014-06-04 16:32:09 +02:00
1987b70989
kernel-wfp: Configure ports for SAs using UDP encapsulation
2014-06-04 16:32:09 +02:00
9b5c95648f
kernel-wfp: Refactor SA context construction, and use IPsecSaContextCreate1()
2014-06-04 16:32:08 +02:00
Tobias Brunner