9 years agoAdd TKM_CTX_ESA (ESP SA context id)
Adrian-Ken Rueegsegger [Fri, 14 Sep 2012 08:29:38 +0000 (10:29 +0200)]
Add TKM_CTX_ESA (ESP SA context id)

9 years agoUse rng to generate local ESP SPIs
Adrian-Ken Rueegsegger [Wed, 12 Sep 2012 09:52:08 +0000 (11:52 +0200)]
Use rng to generate local ESP SPIs

9 years agocharon-tkm: Register kernel_netlink_net
Adrian-Ken Rueegsegger [Tue, 11 Sep 2012 17:17:23 +0000 (19:17 +0200)]
charon-tkm: Register kernel_netlink_net

Explicitly register kernel netlink net implementation and avoid loading
the whole kernel-netlink plugin since the kernel netlink ipsec part is

9 years agoDo not return shared secret in TKM Diffie-Hellman
Adrian-Ken Rueegsegger [Tue, 11 Sep 2012 17:13:29 +0000 (19:13 +0200)]
Do not return shared secret in TKM Diffie-Hellman

Since the TKM handles all relevant key material, charon-tkm must not
have access to it anymore. Thus the ike_dh_get_shared_secret operation
is not available anymore.

9 years agoRemove keymat proxy from TKM keymat
Adrian-Ken Rueegsegger [Tue, 11 Sep 2012 17:04:55 +0000 (19:04 +0200)]
Remove keymat proxy from TKM keymat

Since the TKM completely handles key derivation and installation there
is no need for the keymat proxy anymore.

9 years agoRemove netlink proxy from TKM kernel interface
Reto Buerki [Tue, 11 Sep 2012 16:32:50 +0000 (18:32 +0200)]
Remove netlink proxy from TKM kernel interface

The TKM is now able to manage simple child SAs, so there is no need for
the netlink proxy anymore.

9 years agoAvoid proxy for bypass_socket, enable_udp_decap
Reto Buerki [Tue, 11 Sep 2012 16:24:21 +0000 (18:24 +0200)]
Avoid proxy for bypass_socket, enable_udp_decap

This is in preparation for the removal of the netlink kernel proxy. The
code is copied as-is from the kernel_netlink_ipsec plugin.

9 years agoImplement CHILD SA key derivation using TKM
Adrian-Ken Rueegsegger [Mon, 10 Sep 2012 08:43:05 +0000 (10:43 +0200)]
Implement CHILD SA key derivation using TKM

ESP SAs are created when adding CHILD SAs via the kernel ipsec

The encr_i key is used to transfer the context id of the parent IKE SA
from the keymat to the TKM kernel ipsec interface.

9 years agoRegister TKM kernel ipsec interface in charon-tkm
Adrian-Ken Rueegsegger [Fri, 7 Sep 2012 13:17:25 +0000 (15:17 +0200)]
Register TKM kernel ipsec interface in charon-tkm

9 years agoAdd TKM kernel ipsec skeleton
Adrian-Ken Rueegsegger [Fri, 7 Sep 2012 12:58:35 +0000 (14:58 +0200)]
Add TKM kernel ipsec skeleton

The existing kernel netlink ipsec interface is currently used as proxy
to perform the actual work. It will be gradually removed as the TKM
implements the needed features.

9 years agochunk_map: Store key, value pair in entry_t struct
Reto Buerki [Fri, 7 Sep 2012 13:44:37 +0000 (15:44 +0200)]
chunk_map: Store key, value pair in entry_t struct

To make the chunk map more robust it now stores a clone of the data
chunk given on insertion. The entry struct is needed to properly free
the allocated chunk after use.

9 years agoCall ike_isa_auth_psk in listener authorize hook
Reto Buerki [Thu, 6 Sep 2012 16:17:26 +0000 (18:17 +0200)]
Call ike_isa_auth_psk in listener authorize hook

This exchange initiates the AUTH verification in the TKM.

9 years agolistener: Register message hook
Reto Buerki [Fri, 31 Aug 2012 10:58:00 +0000 (12:58 +0200)]
listener: Register message hook

Use the message hook to save the AUTHENTICATION payload of an incoming
IKE_AUTH message.

The AUTH payload will be passed on to the TKM ike_isa_auth operation in
the authorize hook.

9 years agokeymat: Add AUTH payload setter/getter functions
Reto Buerki [Thu, 6 Sep 2012 15:27:45 +0000 (17:27 +0200)]
keymat: Add AUTH payload setter/getter functions

These functions are used in the TKM specific bus listener to
store/retrieve the AUTH payload chunk in the message/authorize hooks.

9 years agoRegister TKM bus listener in charon-tkm
Reto Buerki [Fri, 31 Aug 2012 09:13:39 +0000 (11:13 +0200)]
Register TKM bus listener in charon-tkm

9 years agoAdd TKM specific bus listener skeleton
Reto Buerki [Fri, 31 Aug 2012 09:11:30 +0000 (11:11 +0200)]
Add TKM specific bus listener skeleton

This listener gets informed about IKE authorization rounds and will be
used to call ike_isa_auth on a given ISA.

9 years agoAdd ISA context id getter to TKM keymat
Reto Buerki [Fri, 31 Aug 2012 09:24:45 +0000 (11:24 +0200)]
Add ISA context id getter to TKM keymat

9 years agokeymat: Acquire AE context ID on initialization
Reto Buerki [Fri, 31 Aug 2012 08:13:55 +0000 (10:13 +0200)]
keymat: Acquire AE context ID on initialization

9 years agoAdd TKM_CTX_AE (Authenticated Endpoint context)
Reto Buerki [Thu, 30 Aug 2012 13:07:21 +0000 (15:07 +0200)]
Add TKM_CTX_AE (Authenticated Endpoint context)

9 years agokeymat: Acquire ISA context ID on initialization
Reto Buerki [Thu, 30 Aug 2012 12:42:19 +0000 (14:42 +0200)]
keymat: Acquire ISA context ID on initialization

9 years agoAdd TKM_CTX_ISA (IKE SA context)
Reto Buerki [Thu, 30 Aug 2012 12:36:06 +0000 (14:36 +0200)]
Add TKM_CTX_ISA (IKE SA context)

9 years agoUse remote PSK signature computed by TKM
Reto Buerki [Thu, 30 Aug 2012 11:57:58 +0000 (13:57 +0200)]
Use remote PSK signature computed by TKM

9 years agokeymat: Check for aes256-sha512 in derive_ike_keys
Reto Buerki [Thu, 30 Aug 2012 09:25:14 +0000 (11:25 +0200)]
keymat: Check for aes256-sha512 in derive_ike_keys

Return FALSE if peers try to use other algorithm combinations.

9 years agokeymat: Call ike_isa_sign_psk in get_psk_sig
Adrian-Ken Rueegsegger [Wed, 29 Aug 2012 16:32:28 +0000 (18:32 +0200)]
keymat: Call ike_isa_sign_psk in get_psk_sig

Get PSK signed AUTH octets from TKM in initiator case.

9 years agoFactor out AEAD transform creation
Reto Buerki [Wed, 29 Aug 2012 08:38:47 +0000 (10:38 +0200)]
Factor out AEAD transform creation

Introduce static aead_create_from_keys function to initialize AEAD
transforms from key chunks.

9 years agoAdd keymat IKE key derivation test case
Reto Buerki [Wed, 29 Aug 2012 07:48:14 +0000 (09:48 +0200)]
Add keymat IKE key derivation test case

9 years agokeymat: Create inbound and outbound AEAD transforms
Reto Buerki [Wed, 29 Aug 2012 07:44:17 +0000 (09:44 +0200)]
keymat: Create inbound and outbound AEAD transforms

Create and initialize AEAD transforms with keys derived by the TKM.
Return these transforms in the get_aead function.

IKE keys used by charon are derived by TKM now.

9 years agokeymat: Extract enc,inc algorithms from proposal
Reto Buerki [Wed, 29 Aug 2012 07:41:02 +0000 (09:41 +0200)]
keymat: Extract enc,inc algorithms from proposal

Extract encryption and integrity algorithms from proposal and check them
before deriving IKE keys.

9 years agokeymat: Call TKM Isa_Create procedure
Reto Buerki [Fri, 24 Aug 2012 14:17:27 +0000 (16:17 +0200)]
keymat: Call TKM Isa_Create procedure

9 years agoImplement chunk_to_sequence function
Reto Buerki [Fri, 24 Aug 2012 10:58:47 +0000 (12:58 +0200)]
Implement chunk_to_sequence function

This function converts a given chunk to a variable-length byte sequence.

9 years agoImplement sequence_to_chunk function
Reto Buerki [Fri, 24 Aug 2012 10:16:17 +0000 (12:16 +0200)]
Implement sequence_to_chunk function

This function converts a given TKM variable-length byte sequence to

9 years agokeymat: Log nonce and DH context ids
Adrian-Ken Rueegsegger [Wed, 22 Aug 2012 09:27:30 +0000 (11:27 +0200)]
keymat: Log nonce and DH context ids

9 years agoAdd context id getter to TKM DH implementation
Adrian-Ken Rueegsegger [Wed, 22 Aug 2012 09:17:14 +0000 (11:17 +0200)]
Add context id getter to TKM DH implementation

9 years agokeymat: Get context id of local nonce
Adrian-Ken Rueegsegger [Wed, 22 Aug 2012 09:05:44 +0000 (11:05 +0200)]
keymat: Get context id of local nonce

To derive IKE keys using TKM the nonce context id of the local nonce is needed.
Get the id for a given chunk using the chunk map.

9 years agononceg: Insert id mapping when allocating nonce
Adrian-Ken Rueegsegger [Wed, 22 Aug 2012 08:53:08 +0000 (10:53 +0200)]
nonceg: Insert id mapping when allocating nonce

9 years agoAdd chunk map
Adrian-Ken Rueegsegger [Wed, 22 Aug 2012 08:17:59 +0000 (10:17 +0200)]
Add chunk map

This data structure allows to store mappings of chunks to ids. This will
be used to map nonces to their corresponding nonce context ids.

9 years agoAdd context id getter to TKM nonce generator
Adrian-Ken Rueegsegger [Tue, 21 Aug 2012 12:31:13 +0000 (14:31 +0200)]
Add context id getter to TKM nonce generator

9 years agoid_manager: Use calloc instead of malloc
Reto Buerki [Tue, 21 Aug 2012 13:29:30 +0000 (15:29 +0200)]
id_manager: Use calloc instead of malloc

This way we don't need to manually initialize the slot status; free
slots are now indicated by 0 though.

9 years agoUse ikev2 keymat proxy
Reto Buerki [Tue, 21 Aug 2012 10:38:50 +0000 (12:38 +0200)]
Use ikev2 keymat proxy

Forward incoming calls to default ikev2 keymat instance. This is needed
to make a stepwise migration to TKM keymat possible. It will be removed
once the corresponding parts are implemented in the TKM.

9 years agoAdd skeleton for TKM keymat variant
Reto Buerki [Tue, 21 Aug 2012 10:17:05 +0000 (12:17 +0200)]
Add skeleton for TKM keymat variant

9 years agoid_manager: Use limits given by TKM
Reto Buerki [Thu, 9 Aug 2012 14:13:55 +0000 (16:13 +0200)]
id_manager: Use limits given by TKM

9 years agoPass context limits on to id manager
Reto Buerki [Thu, 9 Aug 2012 13:18:05 +0000 (15:18 +0200)]
Pass context limits on to id manager

9 years agoRequest limits from TKM on init
Reto Buerki [Thu, 9 Aug 2012 13:12:40 +0000 (15:12 +0200)]
Request limits from TKM on init

9 years agoid_manager: Use array of bool instead of list
Reto Buerki [Thu, 9 Aug 2012 10:47:58 +0000 (12:47 +0200)]
id_manager: Use array of bool instead of list

Instead of storing the acquired context ids in a linked list, use an
array of booleans for the job. A boolean value of true in the array
designates an available context id.

9 years agoUse id manager to acquire DH context id
Reto Buerki [Wed, 8 Aug 2012 14:59:19 +0000 (16:59 +0200)]
Use id manager to acquire DH context id

9 years agoAdd TKM_CTX_DH (Diffie-Hellman context) to id manager
Reto Buerki [Wed, 8 Aug 2012 14:56:30 +0000 (16:56 +0200)]
Add TKM_CTX_DH (Diffie-Hellman context) to id manager

9 years agoUse id manager to acquire nonce context id
Reto Buerki [Tue, 7 Aug 2012 15:46:45 +0000 (17:46 +0200)]
Use id manager to acquire nonce context id

9 years agoAdd initial TKM Diffie-Hellman implementation
Reto Buerki [Tue, 24 Jul 2012 08:40:26 +0000 (10:40 +0200)]
Add initial TKM Diffie-Hellman implementation

The tkm_diffie_hellman_t plugin acquires a DH context from the Trusted
Key Manager and uses it to get a DH public value and the calculated
shared secret. Proper context handling is still missing though, the
plugin currently uses context ID 1.

The get_shared_secret function will be removed as soon as the TKM
specific keymat is ready.

9 years agocharon-tkm: Register tkm nonce generator
Reto Buerki [Tue, 12 Jun 2012 12:39:33 +0000 (14:39 +0200)]
charon-tkm: Register tkm nonce generator

9 years agotkm_nonceg: Return nonce generated by TKM
Reto Buerki [Tue, 12 Jun 2012 09:05:14 +0000 (11:05 +0200)]
tkm_nonceg: Return nonce generated by TKM

9 years agoInitialize TKM client library in tkm.c
Reto Buerki [Thu, 7 Jun 2012 15:45:34 +0000 (17:45 +0200)]
Initialize TKM client library in tkm.c

9 years agoIntroduce TKM specific charon daemon (charon-tkm)
Reto Buerki [Fri, 18 May 2012 12:09:24 +0000 (14:09 +0200)]
Introduce TKM specific charon daemon (charon-tkm)

Analogous to charon-nm the charon-tkm daemon is a specialized charon
instance used in combination with the trusted key manager (TKM) written
in Ada.

The charon-tkm is basically a copy of the charon-nm code which will
register it's own TKM specific plugins.

The daemon binary is built using the gprbuild utility. This is needed
because it uses the tkm-rpc Ada library and consequently the Ada
runtime. gprbuild takes care of the complete binding and linker steps
required to properly initialize the Ada runtime.

9 years agostarter: Make daemon name configurable
Adrian-Ken Rueegsegger [Tue, 22 Jan 2013 15:13:15 +0000 (16:13 +0100)]
starter: Make daemon name configurable

A daemon can be specified using the '--daemon' command line parameter. This
tells starter to invoke a daemon other than 'charon'.

Additionally the ipsec script uses the environment variable DAEMON_NAME to tell
the starter which daemon to use.

9 years agoAdd configure option --enable-unit-tests
Adrian-Ken Rueegsegger [Fri, 18 May 2012 19:19:52 +0000 (21:19 +0200)]
Add configure option --enable-unit-tests

This configure option enables check-based unit testing. Check is a unit
test framework for C [1].

The unit tests can be executed by issuing the following command in the
toplevel build directory:

make check

[1] -

9 years agoLoad arbitrary (non-host) attributes from strongswan.conf
Tobias Brunner [Fri, 22 Feb 2013 17:59:52 +0000 (18:59 +0100)]
Load arbitrary (non-host) attributes from strongswan.conf

This allows to e.g. load Cisco-specific attributes that contain FQDNs.

9 years agoDon't try to mmap() empty ipsec.secret files
Martin Willi [Tue, 19 Mar 2013 12:44:11 +0000 (13:44 +0100)]
Don't try to mmap() empty ipsec.secret files

9 years agoDelete IKE_SAs if responder does not initiate XAuth exchange within a certain time...
Tobias Brunner [Fri, 21 Sep 2012 10:14:29 +0000 (12:14 +0200)]
Delete IKE_SAs if responder does not initiate XAuth exchange within a certain time frame

9 years agotesting: Rename interfaces and bridges so they are easier to identify
Tobias Brunner [Fri, 8 Mar 2013 13:47:42 +0000 (14:47 +0100)]
testing: Rename interfaces and bridges so they are easier to identify

This simplifies capturing traffic with Wireshark on the host as each of
the guest's interfaces is clearly identified.
The three bridges were previously numbered starting from 0, this scheme
is restored here.

9 years agotesting: Don't use a specific version for the QEMU machine type
Tobias Brunner [Fri, 8 Mar 2013 13:18:54 +0000 (14:18 +0100)]
testing: Don't use a specific version for the QEMU machine type

The previously used pc-1.1 is not yet available on e.g. Ubuntu 12.04.
With 'pc' the most current supported version of that type is used.

9 years agoNEWS about xauth-noauth added
Tobias Brunner [Tue, 19 Mar 2013 09:58:58 +0000 (10:58 +0100)]
NEWS about xauth-noauth added

9 years agoMake sure that xauth-noauth is not used accidentally
Tobias Brunner [Tue, 19 Mar 2013 09:57:17 +0000 (10:57 +0100)]
Make sure that xauth-noauth is not used accidentally

It has to be selected explicitly with rightauth2=xauth-noauth.

9 years agoAdded xauth-noauth plugin
Tobias Brunner [Mon, 4 Feb 2013 17:55:54 +0000 (18:55 +0100)]
Added xauth-noauth plugin

This XAuth backend does not do any authentication of client credentials
but simply sends a successful XAuth status to the client, thereby
concluding the XAuth exchange.  This can be useful to fallback to basic
RSA authentication with clients that can not be configured without XAuth

9 years agoIn stroke counters, check if we have an IKE_SA before getting the name from it
Martin Willi [Tue, 19 Mar 2013 10:20:35 +0000 (11:20 +0100)]
In stroke counters, check if we have an IKE_SA before getting the name from it

Fixes a segfault when receiving an invalid IKE SPI, where we don't have an
IKE_SA for the raised alert.

9 years agoAdd an "esp" load-tester option to configure custom CHILD_SA ESP proposal
Martin Willi [Mon, 18 Mar 2013 13:29:37 +0000 (14:29 +0100)]
Add an "esp" load-tester option to configure custom CHILD_SA ESP proposal

9 years agoAlgorithms are not really specific to an IKE version
Tobias Brunner [Mon, 18 Mar 2013 11:18:44 +0000 (12:18 +0100)]
Algorithms are not really specific to an IKE version

But not all of them can be used with IKEv1.

Fixes #314.

9 years agoAdd some 5.0.3 NEWS
Martin Willi [Mon, 18 Mar 2013 09:47:26 +0000 (10:47 +0100)]
Add some 5.0.3 NEWS

9 years agoMerge branch 'radius-ext'
Martin Willi [Mon, 18 Mar 2013 09:13:36 +0000 (10:13 +0100)]
Merge branch 'radius-ext'

Bring some extensions to eap-radius, namely a virtual IP address provider based
on received Framed-IPs, forwarding of Cisco Unity banners, Interim Accounting
updates and the reporting of sent/received packets.

9 years agoMerge branch 'stroke-counters'
Martin Willi [Mon, 18 Mar 2013 09:12:22 +0000 (10:12 +0100)]
Merge branch 'stroke-counters'

Extend stroke counters functionality by connection specific counters, and
a resetcounters command to reset the global or connection counters.

9 years agoMerge branch 'stroke-timeout'
Martin Willi [Mon, 18 Mar 2013 09:11:46 +0000 (10:11 +0100)]
Merge branch 'stroke-timeout'

Add a strongswan.conf timeout option for stroke control commands.

9 years agoMerge branch 'netlink-align'
Martin Willi [Mon, 18 Mar 2013 09:09:35 +0000 (10:09 +0100)]
Merge branch 'netlink-align'

Fixes some Netlink alignment issues, and then refactors Netlink XFRM message
attribute handling.

9 years agoUse netlink_add_attribute() to copy over attributes during update_sa()
Martin Willi [Fri, 15 Mar 2013 15:01:32 +0000 (16:01 +0100)]
Use netlink_add_attribute() to copy over attributes during update_sa()

9 years agoUse a helper function to add XFRM_MARK attribute
Martin Willi [Fri, 15 Mar 2013 14:17:13 +0000 (15:17 +0100)]
Use a helper function to add XFRM_MARK attribute

9 years agoUse netlink_reserve() helper function in XFRM to simplify message construction
Martin Willi [Fri, 15 Mar 2013 14:05:00 +0000 (15:05 +0100)]
Use netlink_reserve() helper function in XFRM to simplify message construction

9 years agoAdd a Netlink utility function to add a RTA header and reserve space for data
Martin Willi [Fri, 15 Mar 2013 13:32:51 +0000 (14:32 +0100)]
Add a Netlink utility function to add a RTA header and reserve space for data

9 years agoCorrectly check buffer length in netlink_add_attribute()
Martin Willi [Fri, 15 Mar 2013 13:32:25 +0000 (14:32 +0100)]
Correctly check buffer length in netlink_add_attribute()

9 years agoAvoid unneeded termination of netlink algorithm name arrays with END_OF_LIST
Martin Willi [Fri, 15 Mar 2013 13:01:15 +0000 (14:01 +0100)]
Avoid unneeded termination of netlink algorithm name arrays with END_OF_LIST

9 years agoAdd a "resetcounters" command to ipsec, clearing global or connection counters
Martin Willi [Fri, 15 Mar 2013 09:55:22 +0000 (10:55 +0100)]
Add a "resetcounters" command to ipsec, clearing global or connection counters

9 years agoAdd connection name specific stroke counters
Martin Willi [Fri, 15 Mar 2013 09:41:04 +0000 (10:41 +0100)]
Add connection name specific stroke counters

9 years agoAdd a chunk_from_str() initializer that does not include 0-terminator
Martin Willi [Thu, 3 Jan 2013 13:09:05 +0000 (14:09 +0100)]
Add a chunk_from_str() initializer that does not include 0-terminator

9 years agoDon't create interim update entries if RADIUS accounting is disabled
Martin Willi [Thu, 14 Mar 2013 15:44:09 +0000 (16:44 +0100)]
Don't create interim update entries if RADIUS accounting is disabled

9 years agoAdd support for RADIUS Interim accounting updates
Martin Willi [Thu, 14 Mar 2013 15:35:11 +0000 (16:35 +0100)]
Add support for RADIUS Interim accounting updates

9 years agoAdd an option to delete any established IKE_SA if RADIUS server is not responding
Martin Willi [Thu, 14 Mar 2013 13:01:17 +0000 (14:01 +0100)]
Add an option to delete any established IKE_SA if RADIUS server is not responding

9 years agoMake check whether to use IKEv1 fragmentation more readable
Martin Willi [Wed, 13 Mar 2013 15:08:12 +0000 (16:08 +0100)]
Make check whether to use IKEv1 fragmentation more readable

9 years agoSend Acct-Terminate-Cause based on some alerts catched on the bus
Martin Willi [Wed, 13 Mar 2013 14:53:39 +0000 (15:53 +0100)]
Send Acct-Terminate-Cause based on some alerts catched on the bus

Currently supported are user disconnects, session timeouts and if the peer does
not respond on IKE packets or DPDs.

9 years agoWhen IKEv1 DPD times out, raise missing SEND_RETRANSMIT_TIMOUT alert
Martin Willi [Wed, 13 Mar 2013 15:06:54 +0000 (16:06 +0100)]
When IKEv1 DPD times out, raise missing SEND_RETRANSMIT_TIMOUT alert

9 years agoRaise an alert if an IKE_SA could not have been reauthenticated and expires
Martin Willi [Wed, 13 Mar 2013 14:52:16 +0000 (15:52 +0100)]
Raise an alert if an IKE_SA could not have been reauthenticated and expires

9 years agoSend NAS-Port, NAS-IP and Calling/Called-Station-ID in Accounting-Requests
Martin Willi [Wed, 13 Mar 2013 14:19:07 +0000 (15:19 +0100)]
Send NAS-Port, NAS-IP and Calling/Called-Station-ID in Accounting-Requests

9 years agoSupport RADIUS accounting of sent/received packets
Martin Willi [Wed, 13 Mar 2013 10:52:38 +0000 (11:52 +0100)]
Support RADIUS accounting of sent/received packets

9 years agoReport the number of processed packets in "ipsec statusall"
Martin Willi [Wed, 13 Mar 2013 10:46:32 +0000 (11:46 +0100)]
Report the number of processed packets in "ipsec statusall"

9 years agochild_sa_t.get_usestats() can additionally return the number of processed packets
Martin Willi [Wed, 13 Mar 2013 10:38:02 +0000 (11:38 +0100)]
child_sa_t.get_usestats() can additionally return the number of processed packets

9 years agoPass correclty sized pointer to lookup_algorithm() in PF_KEY
Martin Willi [Wed, 13 Mar 2013 10:33:53 +0000 (11:33 +0100)]
Pass correclty sized pointer to lookup_algorithm() in PF_KEY

9 years agokernel_ipsec_t.query_sa() additionally returns the number of processed packets
Martin Willi [Wed, 13 Mar 2013 10:31:36 +0000 (11:31 +0100)]
kernel_ipsec_t.query_sa() additionally returns the number of processed packets

9 years agoSend NAS-Port, NAS-IP and Calling/Called-Station-ID in Access-Request
Martin Willi [Wed, 13 Mar 2013 10:11:49 +0000 (11:11 +0100)]
Send NAS-Port, NAS-IP and Calling/Called-Station-ID in Access-Request

9 years agoForward Cisco Banner received from RADIUS to Unity capable clients
Martin Willi [Tue, 12 Mar 2013 19:33:08 +0000 (20:33 +0100)]
Forward Cisco Banner received from RADIUS to Unity capable clients

9 years agoAdd a radius message method to enumerate vendor specific attributes
Martin Willi [Tue, 12 Mar 2013 19:32:05 +0000 (20:32 +0100)]
Add a radius message method to enumerate vendor specific attributes

9 years agoAdd Altiga Private Enterprise Numbers that Cisco uses in VPN 3000
Martin Willi [Tue, 12 Mar 2013 19:31:10 +0000 (20:31 +0100)]
Add Altiga Private Enterprise Numbers that Cisco uses in VPN 3000

9 years agoIn eap-radius, hand out received Framed-IP-Address attributes as virtual IP
Martin Willi [Tue, 12 Mar 2013 16:44:13 +0000 (17:44 +0100)]
In eap-radius, hand out received Framed-IP-Address attributes as virtual IP

9 years agoAdd missing XAuthRespPSK switch case to IKEv1 key derivation
Martin Willi [Fri, 8 Mar 2013 14:21:36 +0000 (15:21 +0100)]
Add missing XAuthRespPSK switch case to IKEv1 key derivation

9 years agostrdup() iface passed to queue_route_reinstall(), fixing double-free
Martin Willi [Mon, 11 Mar 2013 14:17:50 +0000 (15:17 +0100)]
strdup() iface passed to queue_route_reinstall(), fixing double-free

9 years agoSupport mutliple subnets and ranges as external load-tester addresses
Martin Willi [Mon, 11 Mar 2013 14:16:13 +0000 (15:16 +0100)]
Support mutliple subnets and ranges as external load-tester addresses