diff --git a/HACKING b/HACKING index 2e8479269..02d540a9a 100644 --- a/HACKING +++ b/HACKING @@ -13,8 +13,10 @@ the code, you need the following tools: - automake - autoconf - libtool + - pkg-config - gettext - perl + - python - lex/flex - yacc/bison - gperf diff --git a/Makefile.am b/Makefile.am index 687d896f6..eb083ec79 100644 --- a/Makefile.am +++ b/Makefile.am @@ -1,4 +1,4 @@ -SUBDIRS = src man init testing +SUBDIRS = src man conf init testing if USE_SCRIPTS SUBDIRS += scripts @@ -20,6 +20,9 @@ config_includedir = $(ipseclibdir)/include nodist_config_include_HEADERS = config.h endif +# we leave config files behind intentionally so prevent distcheck from complaining +distuninstallcheck_listfiles = find . -type f \! -name '*.conf' -print + Android.common.mk : Android.common.mk.in configure.ac $(AM_V_GEN) \ sed \ diff --git a/conf/.gitignore b/conf/.gitignore new file mode 100644 index 000000000..6ccd3250e --- /dev/null +++ b/conf/.gitignore @@ -0,0 +1,6 @@ +default.conf +strongswan.conf.5 +strongswan.conf.5.head +strongswan.conf.5.tail +*/*.conf +*/*.tmp \ No newline at end of file diff --git a/conf/Makefile.am b/conf/Makefile.am new file mode 100644 index 000000000..af604b594 --- /dev/null +++ b/conf/Makefile.am @@ -0,0 +1,163 @@ +# make this relative to the location of strongswan.conf +strongswanconfdir = `dirname $(strongswan_conf)` +strongswanddir = $(strongswanconfdir)/strongswan.d +charonconfdir = $(strongswanddir)/charon +# copy these files also to /usr/share +templatesdir = $(pkgdatadir)/templates/config +optionstemplatedir = $(templatesdir)/strongswan.d +pluginstemplatedir = $(templatesdir)/plugins + +options = \ + options/attest.opt \ + options/charon.opt \ + options/charon-logging.opt \ + options/imcv.opt \ + options/manager.opt \ + options/medsrv.opt \ + options/pacman.opt \ + options/pool.opt \ + options/starter.opt \ + options/tnc.opt \ + options/tools.opt + +plugins = \ + plugins/android_log.opt \ + plugins/attr.opt \ + plugins/attr-sql.opt \ + plugins/certexpire.opt \ + plugins/coupling.opt \ + plugins/dhcp.opt \ + plugins/dnscert.opt \ + plugins/duplicheck.opt \ + plugins/eap-aka.opt \ + plugins/eap-aka-3ggp2.opt \ + plugins/eap-dynamic.opt \ + plugins/eap-gtc.opt \ + plugins/eap-peap.opt \ + plugins/eap-radius.opt \ + plugins/eap-sim.opt \ + plugins/eap-simaka-sql.opt \ + plugins/eap-tls.opt \ + plugins/eap-tnc.opt \ + plugins/eap-ttls.opt \ + plugins/error-notify.opt \ + plugins/gcrypt.opt \ + plugins/ha.opt \ + plugins/imc-attestation.opt \ + plugins/imc-os.opt \ + plugins/imc-scanner.opt \ + plugins/imc-swid.opt \ + plugins/imc-test.opt \ + plugins/imv-attestation.opt \ + plugins/imv-os.opt \ + plugins/imv-scanner.opt \ + plugins/imv-test.opt \ + plugins/ipseckey.opt \ + plugins/led.opt \ + plugins/kernel-klips.opt \ + plugins/kernel-libipsec.opt \ + plugins/kernel-netlink.opt \ + plugins/kernel-pfroute.opt \ + plugins/load-tester.opt \ + plugins/lookip.opt \ + plugins/ntru.opt \ + plugins/openssl.opt \ + plugins/pkcs11.opt \ + plugins/radattr.opt \ + plugins/random.opt \ + plugins/resolve.opt \ + plugins/socket-default.opt \ + plugins/sql.opt \ + plugins/stroke.opt \ + plugins/systime-fix.opt \ + plugins/tnc-ifmap.opt \ + plugins/tnc-imc.opt \ + plugins/tnc-imv.opt \ + plugins/tnc-pdp.opt \ + plugins/tnccs-11.opt \ + plugins/tnccs-20.opt \ + plugins/unbound.opt \ + plugins/updown.opt \ + plugins/whitelist.opt \ + plugins/xauth-eap.opt \ + plugins/xauth-pam.opt + +alloptions = $(options) $(plugins) + +confsnippets = $(alloptions:opt=conf) + +# we only install snippets for enabled plugins +plugins_install_tmp = $(charon_plugins:%=plugins/%.tmp) +plugins_install_src = $(charon_plugins:%=plugins/%.conf) +# only install snippets for enabled components +# has to be defined via autoconf as we can't do it with automake conditionals +options_install_src = $(strongswan_options:%=options/%.conf) + +templates_DATA = strongswan.conf +optionstemplate_DATA = $(options_install_src) +pluginstemplate_DATA = $(plugins_install_src) +man_MANS = \ + strongswan.conf.5 + +BUILT_SOURCES = default.conf strongswan.conf.5.main $(confsnippets) +EXTRA_DIST = format-options.py strongswan.conf default.opt \ + default.conf strongswan.conf.5.main $(alloptions) $(confsnippets) + +CLEANFILES=$(man_MANS) + +.opt.conf: + $(AM_V_GEN) \ + case "$<" in \ + *plugins/*) \ + sed \ + -e "s:\@PLUGIN_NAME\@:`basename $< .opt`:" \ + $(srcdir)/default.opt | cat - $< | \ + $(PYTHON) $(srcdir)/format-options.py -f conf -r charon.plugins > $(srcdir)/$@ \ + ;; \ + *) \ + $(PYTHON) $(srcdir)/format-options.py -f conf -r charon.plugins $< > $(srcdir)/$@ \ + ;; \ + esac + +# we need another implicit rule to generate files from the generic template only +# if the rules above did not catch it. this requires an intermediate step that +# generates a copy of the generic config template. +$(plugins_install_tmp): + @mkdir -p $(builddir)/plugins + @cp $(srcdir)/default.conf $(builddir)/$@ + +.tmp.conf: + $(AM_V_GEN) \ + sed \ + -e "s:\@PLUGIN_NAME\@:`basename $< .tmp`:" \ + $(builddir)/$< > $(builddir)/$@ + +strongswan.conf.5.main: $(alloptions) + $(AM_V_GEN) \ + $(PYTHON) $(srcdir)/format-options.py -f man $^ > $@ + +strongswan.conf.5: strongswan.conf.5.head strongswan.conf.5.main strongswan.conf.5.tail + $(AM_V_GEN) \ + cat $^ > $@ + +clean-local: + rm -f plugins/*.conf plugins/*.tmp + +maintainer-clean-local: + cd $(srcdir) && \ + rm -f $(confsnippets) default.conf plugins/*.conf plugins/*.tmp + +install-data-local: $(plugins_install_src) + test -e "$(DESTDIR)${strongswanconfdir}" || $(INSTALL) -d "$(DESTDIR)$(strongswanconfdir)" + test -e "$(DESTDIR)${strongswanddir}" || $(INSTALL) -d "$(DESTDIR)$(strongswanddir)" + test -e "$(DESTDIR)${charonconfdir}" || $(INSTALL) -d "$(DESTDIR)$(charonconfdir)" + test -e "$(DESTDIR)$(strongswanconfdir)/strongswan.conf" || $(INSTALL) -m 644 $(srcdir)/strongswan.conf $(DESTDIR)$(strongswanconfdir)/strongswan.conf || true + for f in $(options_install_src); do \ + name=`basename $$f`; \ + test -f "$(DESTDIR)$(strongswanddir)/$$name" || $(INSTALL) -m 644 -t "$(DESTDIR)$(strongswanddir)" $(srcdir)/$$f || true; \ + done + for f in $(plugins_install_src); do \ + name=`basename $$f`; \ + if test -f "$$f"; then dir=; else dir="$(srcdir)/"; fi; \ + test -f "$(DESTDIR)$(charonconfdir)/$$name" || $(INSTALL) -m 644 -t "$(DESTDIR)$(charonconfdir)" "$$dir$$f" || true; \ + done diff --git a/conf/default.opt b/conf/default.opt new file mode 100644 index 000000000..8c833642d --- /dev/null +++ b/conf/default.opt @@ -0,0 +1,3 @@ +charon.plugins.@PLUGIN_NAME@.load := yes + Whether to load the plugin. Can also be an integer to increase the priority + of this plugin. diff --git a/conf/format-options.py b/conf/format-options.py new file mode 100755 index 000000000..04afed6d6 --- /dev/null +++ b/conf/format-options.py @@ -0,0 +1,337 @@ +#!/usr/bin/env python +# +# Copyright (C) 2014 Tobias Brunner +# Hochschule fuer Technik Rapperswil +# +# This program is free software; you can redistribute it and/or modify it +# under the terms of the GNU General Public License as published by the +# Free Software Foundation; either version 2 of the License, or (at your +# option) any later version. See . +# +# This program is distributed in the hope that it will be useful, but +# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY +# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License +# for more details. + +""" +Parses strongswan.conf option descriptions and produces configuration file +and man page snippets. + +The format for description files is as follows: + +full.option.name [[:]= default] + Short description intended as comment in config snippet + + Long description for use in the man page, with + simple formatting: _italic_, **bold** + + Second paragraph of the long description + +The descriptions must be indented by tabs or spaces but are both optional. +If only a short description is given it is used for both intended usages. +Line breaks within a paragraph of the long description or the short description +are not preserved. But multiple paragraphs will be separated in the man page. +Any formatting in the short description is removed when producing config +snippets. + +Options for which a value is assigned with := are not commented out in the +produced configuration file snippet. This allows to override a default value, +that e.g. has to be preserved for legacy reasons, in the generated default +config. + +To describe sections the following format can be used: + +full.section.name {[#]} + Short description of this section + + Long description as above + +If a # is added between the curly braces the section header will be commented +out in the configuration file snippet, which is useful for example sections. +""" + +import sys +import re +from textwrap import TextWrapper +from optparse import OptionParser + +class ConfigOption: + """Representing a configuration option or described section in strongswan.conf""" + def __init__(self, name, default = None, section = False, commented = False): + self.name = name.split('.')[-1] + self.fullname = name + self.default = default + self.section = section + self.commented = commented + self.desc = [] + self.options = [] + + def __cmp__(self, other): + if self.section == other.section: + return cmp(self.name, other.name) + return 1 if self.section else -1 + + def add_paragraph(self): + """Adds a new paragraph to the description""" + if len(self.desc) and len(self.desc[-1]): + self.desc.append("") + + def add(self, line): + """Adds a line to the last paragraph""" + if not len(self.desc): + self.desc.append(line) + elif not len(self.desc[-1]): + self.desc[-1] = line + else: + self.desc[-1] += ' ' + line + + def adopt(self, other): + """Adopts settings from other, which should be more recently parsed""" + self.default = other.default + self.commented = other.commented + self.desc = other.desc + +class Parser: + """Parses one or more files of configuration options""" + def __init__(self): + self.options = [] + + def parse(self, file): + """Parses the given file and adds all options to the internal store""" + self.__current = None + for line in file: + self.__parse_line(line) + if self.__current: + self.__add_option(self.__current) + + def __parse_line(self, line): + """Parses a single line""" + if re.match(r'^\s*#', line): + return + # option definition + m = re.match(r'^(?P\S+)\s*((?P:)?=\s*(?P.+)?)?\s*$', line) + if m: + if self.__current: + self.__add_option(self.__current) + self.__current = ConfigOption(m.group('name'), m.group('default'), + commented = not m.group('assign')) + return + # section definition + m = re.match(r'^(?P\S+)\s*\{\s*(?P#)?\s*\}\s*$', line) + if m: + if self.__current: + self.__add_option(self.__current) + self.__current = ConfigOption(m.group('name'), section = True, + commented = m.group('comment')) + return + # paragraph separator + m = re.match(r'^\s*$', line) + if m and self.__current: + self.__current.add_paragraph() + # description line + m = re.match(r'^\s+(?P.+?)\s*$', line) + if m and self.__current: + self.__current.add(m.group('text')) + + def __add_option(self, option): + """Adds the given option to the abstract storage""" + option.desc = [desc for desc in option.desc if len(desc)] + parts = option.fullname.split('.') + parent = self.__get_option(parts[:-1], True) + if not parent: + parent = self + found = next((x for x in parent.options if x.name == option.name + and x.section == option.section), None) + if found: + found.adopt(option) + else: + parent.options.append(option) + parent.options.sort() + + def __get_option(self, parts, create = False): + """Searches/Creates the option (section) based on a list of section names""" + option = None + options = self.options + fullname = "" + for name in parts: + fullname += '.' + name if len(fullname) else name + option = next((x for x in options if x.name == name and x.section), None) + if not option: + if not create: + break + option = ConfigOption(fullname, section = True) + options.append(option) + options.sort() + options = option.options + return option + + def get_option(self, name): + """Retrieves the option with the given name""" + return self.__get_option(name.split('.')) + +class TagReplacer: + """Replaces formatting tags in text""" + def __init__(self): + self.__matcher_b = self.__create_matcher('**') + self.__matcher_i = self.__create_matcher('_') + self.__replacer = None + + def __create_matcher(self, tag): + tag = re.escape(tag) + return re.compile(r''' + (^|\s|(?P[(\[])) # prefix with optional opening bracket + (?P''' + tag + r''') # start tag + (?P\w|\S.*?\S) # text + ''' + tag + r''' # end tag + (?P([.,!:)\]]|\(\d+\))*) # punctuation + (?=$|\s) # suffix (don't consume it so that subsequent tags can match) + ''', flags = re.DOTALL | re.VERBOSE) + + def _create_replacer(self): + def replacer(m): + punct = m.group('punct') + if not punct: + punct = '' + return '{0}{1}{2}'.format(m.group(1), m.group('text'), punct) + return replacer + + def replace(self, text): + if not self.__replacer: + self.__replacer = self._create_replacer() + text = re.sub(self.__matcher_b, self.__replacer, text) + return re.sub(self.__matcher_i, self.__replacer, text) + +class GroffTagReplacer(TagReplacer): + def _create_replacer(self): + def replacer(m): + nl = '\n' if m.group(1) else '' + format = 'I' if m.group('tag') == '_' else 'B' + brack = m.group('brack') + if not brack: + brack = '' + punct = m.group('punct') + if not punct: + punct = '' + text = re.sub(r'[\r\n\t]', ' ', m.group('text')) + return '{0}.R{1} "{2}" "{3}" "{4}"\n'.format(nl, format, brack, text, punct) + return replacer + +class ConfFormatter: + """Formats options to a strongswan.conf snippet""" + def __init__(self): + self.__indent = ' ' + self.__wrapper = TextWrapper(width = 80, replace_whitespace = True, + break_long_words = False, break_on_hyphens = False) + self.__tags = TagReplacer() + + def __print_description(self, opt, indent): + if len(opt.desc): + self.__wrapper.initial_indent = '{0}# '.format(self.__indent * indent) + self.__wrapper.subsequent_indent = self.__wrapper.initial_indent + print format(self.__wrapper.fill(self.__tags.replace(opt.desc[0]))) + + def __print_option(self, opt, indent, commented): + """Print a single option with description and default value""" + comment = "# " if commented or opt.commented else "" + self.__print_description(opt, indent) + if opt.default: + print '{0}{1}{2} = {3}'.format(self.__indent * indent, comment, opt.name, opt.default) + else: + print '{0}{1}{2} ='.format(self.__indent * indent, comment, opt.name) + print + + def __print_section(self, section, indent, commented): + """Print a section with all options""" + comment = "# " if commented or section.commented else "" + self.__print_description(section, indent) + print '{0}{1}{2} {{'.format(self.__indent * indent, comment, section.name) + print + for o in section.options: + if o.section: + self.__print_section(o, indent + 1, section.commented) + else: + self.__print_option(o, indent + 1, section.commented) + print '{0}{1}}}'.format(self.__indent * indent, comment) + print + + def format(self, options): + """Print a list of options""" + if not options: + return + for option in options: + if option.section: + self.__print_section(option, 0, False) + else: + self.__print_option(option, 0, False) + +class ManFormatter: + """Formats a list of options into a groff snippet""" + def __init__(self): + self.__wrapper = TextWrapper(width = 80, replace_whitespace = False, + break_long_words = False, break_on_hyphens = False) + self.__tags = GroffTagReplacer() + + def __groffize(self, text): + """Encode text as groff text""" + text = self.__tags.replace(text) + text = re.sub(r'(? { # } + is the full path to the log file. + +charon.filelog..default = 1 + Default loglevel. + + Specifies the default loglevel to be used for subsystems for which no + specific loglevel is defined. + +charon.filelog.. = + Loglevel for a specific subsystem. + +charon.filelog..append = yes + If this option is enabled log entries are appended to the existing file. + +charon.filelog..flush_line = no + Enabling this option disables block buffering and enables line buffering. + +charon.filelog..ike_name = no + Prefix each log entry with the connection name and a unique numerical + identifier for each IKE_SA. + +charon.filelog..time_format + Prefix each log entry with a timestamp. The option accepts a format string + as passed to **strftime**(3). + +charon.syslog {} + Section to define syslog loggers, see LOGGER CONFIGURATION in + **strongswan.conf**(5). + +charon.syslog.identifier + Identifier for use with openlog(3). + + Global identifier used for an **openlog**(3) call, prepended to each log + message by syslog. If not configured, **openlog**(3) is not called, so the + value will depend on system defaults (often the program name). + +charon.syslog. { # } + is one of the supported syslog facilities, see LOGGER + CONFIGURATION in **strongswan.conf**(5). + +charon.syslog..default = 1 + Default loglevel. + + Specifies the default loglevel to be used for subsystems for which no + specific loglevel is defined. + +charon.syslog.. = + Loglevel for a specific subsystem. + +charon.syslog..ike_name = no + Prefix each log entry with the connection name and a unique numerical + identifier for each IKE_SA. diff --git a/conf/options/charon.opt b/conf/options/charon.opt new file mode 100644 index 000000000..c6f4f1e9e --- /dev/null +++ b/conf/options/charon.opt @@ -0,0 +1,284 @@ +charon {} + Options for the charon IKE daemon. + + Options for the charon IKE daemon. + + **Note**: Many of the options in this section also apply to **charon-cmd** + and other **charon** derivatives. Just use their respective name (e.g. + **charon-cmd** instead of **charon**). For many options defaults can be + defined in the **libstrongswan** section. + +charon.block_threshold = 5 + Maximum number of half-open IKE_SAs for a single peer IP. + +charon.cert_cache = yes + Whether relations in validated certificate chains should be cached in + memory. + +charon.cisco_unity = no + Send Cisco Unity vendor ID payload (IKEv1 only). + +charon.close_ike_on_child_failure = no + Close the IKE_SA if setup of the CHILD_SA along with IKE_AUTH failed. + +charon.cookie_threshold = 10 + Number of half-open IKE_SAs that activate the cookie mechanism. + +charon.crypto_test.bench = no + Benchmark crypto algorithms and order them by efficiency. + +charon.crypto_test.bench_size = 1024 + Buffer size used for crypto benchmark. + +charon.crypto_test.bench_time = 50 + Number of iterations to test each algorithm. + +charon.crypto_test.on_add = no + Test crypto algorithms during registration (requires test vectors provided + by the _test-vectors_ plugin). + +charon.crypto_test.on_create = no + Test crypto algorithms on each crypto primitive instantiation. + +charon.crypto_test.required = no + Strictly require at least one test vector to enable an algorithm. + +charon.crypto_test.rng_true = no + Whether to test RNG with TRUE quality; requires a lot of entropy. + +charon.dh_exponent_ansi_x9_42 = yes + Use ANSI X9.42 DH exponent size or optimum size matched to cryptographic + strength. + +charon.dns1 + DNS server assigned to peer via configuration payload (CP). + +charon.dns2 + DNS server assigned to peer via configuration payload (CP). + +charon.dos_protection = yes + Enable Denial of Service protection using cookies and aggressiveness checks. + +charon.ecp_x_coordinate_only = yes + Compliance with the errata for RFC 4753. + +charon.flush_auth_cfg = no + Free objects during authentication (might conflict with plugins). + + If enabled objects used during authentication (certificates, identities + etc.) are released to free memory once an IKE_SA is established. Enabling + this might conflict with plugins that later need access to e.g. the used + certificates. + +charon.fragment_size = 512 + Maximum size (in bytes) of a sent fragment when using the proprietary IKEv1 + fragmentation extension. + +charon.group + Name of the group the daemon changes to after startup. + +charon.half_open_timeout = 30 + Timeout in seconds for connecting IKE_SAs (also see IKE_SA_INIT DROPPING). + +charon.hash_and_url = no + Enable hash and URL support. + +charon.host_resolver.max_threads = 3 + Maximum number of concurrent resolver threads (they are terminated if + unused). + +charon.host_resolver.min_threads = 0 + Minimum number of resolver threads to keep around. + +charon.i_dont_care_about_security_and_use_aggressive_mode_psk = no + Allow IKEv1 Aggressive Mode with pre-shared keys as responder. + + If enabled responders are allowed to use IKEv1 Aggressive Mode with + pre-shared keys, which is discouraged due to security concerns (offline + attacks on the openly transmitted hash of the PSK). + +charon.ignore_routing_tables + A space-separated list of routing tables to be excluded from route lookups. + +charon.ikesa_limit = 0 + Maximum number of IKE_SAs that can be established at the same time before + new connection attempts are blocked. + +charon.ikesa_table_segments = 1 + Number of exclusively locked segments in the hash table. + +charon.ikesa_table_size = 1 + Size of the IKE_SA hash table. + +charon.inactivity_close_ike = no + Whether to close IKE_SA if the only CHILD_SA closed due to inactivity. + +charon.init_limit_half_open = 0 + Limit new connections based on the current number of half open IKE_SAs, see + IKE_SA_INIT DROPPING in **strongswan.conf**(5). + +charon.init_limit_job_load = 0 + Limit new connections based on the number of queued jobs. + + Limit new connections based on the number of jobs currently queued for + processing (see IKE_SA_INIT DROPPING). + +charon.initiator_only = no + Causes charon daemon to ignore IKE initiation requests. + +charon.install_routes = yes + Install routes into a separate routing table for established IPsec tunnels. + +charon.install_virtual_ip = yes + Install virtual IP addresses. + +charon.install_virtual_ip_on + The name of the interface on which virtual IP addresses should be installed. + + The name of the interface on which virtual IP addresses should be installed. + If not specified the addresses will be installed on the outbound interface. + +charon.integrity_test = no + Check daemon, libstrongswan and plugin integrity at startup. + +charon.interfaces_ignore + A comma-separated list of network interfaces that should be ignored, if + **interfaces_use** is specified this option has no effect. + +charon.interfaces_use + A comma-separated list of network interfaces that should be used by charon. + All other interfaces are ignored. + +charon.keep_alive = 20s + NAT keep alive interval. + +charon.leak_detective.detailed = yes + Includes source file names and line numbers in leak detective output. + +charon.leak_detective.usage_threshold = 10240 + Threshold in bytes for leaks to be reported (0 to report all). + +charon.leak_detective.usage_threshold_count = 0 + Threshold in number of allocations for leaks to be reported (0 to report + all). + +charon.load + Plugins to load in the IKE daemon charon. + +charon.load_modular = no + Determine plugins to load via each plugin's load option. + + If enabled, the list of plugins to load is determined via the value of the + _charon.plugins..load_ options. In addition to a simple boolean flag + that option may take an integer value indicating the priority of a plugin, + which would influence the order of a plugin in the plugin list (the default + is 1). If two plugins have the same priority their order in the default + plugin list is preserved. Enabled plugins not found in that list are ordered + alphabetically before other plugins with the same priority. + +charon.max_packet = 10000 + Maximum packet size accepted by charon. + +charon.multiple_authentication = yes + Enable multiple authentication exchanges (RFC 4739). + +charon.nbns1 + WINS servers assigned to peer via configuration payload (CP). + +charon.nbns2 + WINS servers assigned to peer via configuration payload (CP). + +charon.port = 500 + UDP port used locally. If set to 0 a random port will be allocated. + +charon.port_nat_t = 4500 + UDP port used locally in case of NAT-T. If set to 0 a random port will be + allocated. Has to be different from **charon.port**, otherwise a random + port will be allocated. + +charon.process_route = yes + Process RTM_NEWROUTE and RTM_DELROUTE events. + +charon.processor.priority_threads {} + Section to configure the number of reserved threads per priority class + see JOB PRIORITY MANAGEMENT in **strongswan.conf**(5). + +charon.receive_delay = 0 + Delay in ms for receiving packets, to simulate larger RTT. + +charon.receive_delay_response = yes + Delay response messages. + +charon.receive_delay_request = yes + Delay request messages. + +charon.receive_delay_type = 0 + Specific IKEv2 message type to delay, 0 for any. + +charon.replay_window = 32 + Size of the AH/ESP replay window, in packets. + +charon.retransmit_base = 1.8 + Base to use for calculating exponential back off, see IKEv2 RETRANSMISSION + in **strongswan.conf**(5). + +charon.retransmit_timeout = 4.0 + Timeout in seconds before sending first retransmit. + +charon.retransmit_tries = 5 + Number of times to retransmit a packet before giving up. + +charon.retry_initiate_interval = 0 + Interval to use when retrying to initiate an IKE_SA (e.g. if DNS resolution + failed), 0 to disable retries. + +charon.reuse_ikesa = yes + Initiate CHILD_SA within existing IKE_SAs. + +charon.routing_table + Numerical routing table to install routes to. + +charon.routing_table_prio + Priority of the routing table. + +charon.send_delay = 0 + Delay in ms for sending packets, to simulate larger RTT. + +charon.send_delay_response = yes + Delay response messages. + +charon.send_delay_request = yes + Delay request messages. + +charon.send_delay_type = 0 + Specific IKEv2 message type to delay, 0 for any. + +charon.send_vendor_id = no + Send strongSwan vendor ID payload + +charon.threads = 16 + Number of worker threads in charon. + + Number of worker threads in charon. Several of these are reserved for long + running tasks in internal modules and plugins. Therefore, make sure you + don't set this value too low. The number of idle worker threads listed in + _ipsec statusall_ might be used as indicator on the number of reserved + threads. + +charon.tls.cipher + List of TLS encryption ciphers. + +charon.tls.key_exchange + List of TLS key exchange methods. + +charon.tls.mac + List of TLS MAC algorithms. + +charon.tls.suites + List of TLS cipher suites. + +charon.user + Name of the user the daemon changes to after startup. + +charon.x509.enforce_critical = yes + Discard certificates with unsupported or unknown critical extensions. diff --git a/conf/options/imcv.opt b/conf/options/imcv.opt new file mode 100644 index 000000000..a249a7b14 --- /dev/null +++ b/conf/options/imcv.opt @@ -0,0 +1,28 @@ +charon.imcv {} + Defaults for options in this section can be configured in the _libimcv_ + section. + +charon.imcv.assessment_result = yes + Whether IMVs send a standard IETF Assessment Result attribute. + +charon.imcv.database = + Global IMV policy database URI. If it contains a password, make sure to + adjust the permissions of the config file accordingly. + +charon.imcv.os_info.name = + Manually set the name of the client OS (e.g. Ubuntu). + +charon.imcv.os_info.version = + Manually set the version of the client OS (e.g. 12.04 i686). + +charon.imcv.policy_script = ipsec _imv_policy + Script called for each TNC connection to generate IMV policies. + +libimcv.debug_level = 1 + Debug level for a stand-alone _libimcv_ library. + +libimcv.load = random nonce gmp pubkey x509 + Plugins to load in IMC/IMVs with stand-alone _libimcv_ library. + +libimcv.stderr_quiet = no + Disable output to stderr with a stand-alone _libimcv_ library. diff --git a/conf/options/manager.opt b/conf/options/manager.opt new file mode 100644 index 000000000..dbac73110 --- /dev/null +++ b/conf/options/manager.opt @@ -0,0 +1,18 @@ +manager.database = + Credential database URI for manager. If it contains a password, make + sure to adjust the permissions of the config file accordingly. + +manager.debug = no + Enable debugging in manager. + +manager.load = + Plugins to load in manager. + +manager.socket = + FastCGI socket of manager, to run it statically. + +manager.threads = 10 + Threads to use for request handling. + +manager.timeout = 15m + Session timeout for manager. diff --git a/conf/options/medsrv.opt b/conf/options/medsrv.opt new file mode 100644 index 000000000..f673b7e03 --- /dev/null +++ b/conf/options/medsrv.opt @@ -0,0 +1,27 @@ +medsrv.database = + Mediation server database URI. If it contains a password, make + sure to adjust the permissions of the config file accordingly. + +medsrv.debug = no + Debugging in mediation server web application. + +medsrv.dpd = 5m + DPD timeout to use in mediation server plugin. + +medsrv.load = + Plugins to load in mediation server plugin. + +medsrv.password_length = 6 + Minimum password length required for mediation server user accounts. + +medsrv.rekey = 20m + Rekeying time on mediation connections in mediation server plugin. + +medsrv.socket = + Run Mediation server web application statically on socket. + +medsrv.threads = 5 + Number of thread for mediation service web application. + +medsrv.timeout = 15m + Session timeout for mediation service. diff --git a/conf/options/pacman.opt b/conf/options/pacman.opt new file mode 100644 index 000000000..dfb4ba2b1 --- /dev/null +++ b/conf/options/pacman.opt @@ -0,0 +1,7 @@ +pacman.database = + Database URI for the database that stores the package information. If it + contains a password, make sure to adjust the permissions of the config file + accordingly. + +pacman.load = + Plugins to load in package manager. diff --git a/conf/options/pool.opt b/conf/options/pool.opt new file mode 100644 index 000000000..79458c779 --- /dev/null +++ b/conf/options/pool.opt @@ -0,0 +1,7 @@ +pool.database + Database URI for the database that stores IP pools and configuration + attributes. If it contains a password, make sure to adjust the permissions + of the config file accordingly. + +pool.load = + Plugins to load in ipsec pool tool. diff --git a/conf/options/starter.opt b/conf/options/starter.opt new file mode 100644 index 000000000..4e6574d58 --- /dev/null +++ b/conf/options/starter.opt @@ -0,0 +1,5 @@ +starter.load = + Plugins to load in starter. + +starter.load_warning = yes + Disable charon plugin load option warning. diff --git a/conf/options/tnc.opt b/conf/options/tnc.opt new file mode 100644 index 000000000..467723ea6 --- /dev/null +++ b/conf/options/tnc.opt @@ -0,0 +1,2 @@ +charon.tnc.tnc_config = /etc/tnc_config + TNC IMC/IMV configuration file. diff --git a/conf/options/tools.opt b/conf/options/tools.opt new file mode 100644 index 000000000..23e6a1c9f --- /dev/null +++ b/conf/options/tools.opt @@ -0,0 +1,8 @@ +openac.load = + Plugins to load in ipsec openac tool. + +pki.load = + Plugins to load in ipsec pki tool. + +scepclient.load = + Plugins to load in ipsec scepclient tool. diff --git a/conf/plugins/android_log.opt b/conf/plugins/android_log.opt new file mode 100644 index 000000000..801b8bf19 --- /dev/null +++ b/conf/plugins/android_log.opt @@ -0,0 +1,2 @@ +charon.plugins.android_log.loglevel = 1 + Loglevel for logging to Android specific logger. diff --git a/conf/plugins/attr-sql.opt b/conf/plugins/attr-sql.opt new file mode 100644 index 000000000..abd749e3e --- /dev/null +++ b/conf/plugins/attr-sql.opt @@ -0,0 +1,6 @@ +charon.plugins.attr-sql.database + Database URI for attr-sql plugin used by charon. If it contains a password, + make sure to adjust the permissions of the config file accordingly. + +charon.plugins.attr-sql.lease_history = yes + Enable logging of SQL IP pool leases. diff --git a/conf/plugins/attr.opt b/conf/plugins/attr.opt new file mode 100644 index 000000000..f3c187c7b --- /dev/null +++ b/conf/plugins/attr.opt @@ -0,0 +1,14 @@ +charon.plugins.attr {} + Section to specify arbitrary attributes that are assigned to a peer via + configuration payload (CP). + +charon.plugins.attr. + is an attribute name or an integer, values can be an IP address, + subnet or arbitrary value. + + **** can be either _address_, _netmask_, _dns_, _nbns_, _dhcp_, + _subnet_, _split-include_, _split-exclude_ or the numeric identifier of the + attribute type. The assigned value can be an IPv4/IPv6 address, a subnet in + CIDR notation or an arbitrary value depending on the attribute type. For + some attribute types multiple values may be specified as a comma separated + list. diff --git a/conf/plugins/certexpire.opt b/conf/plugins/certexpire.opt new file mode 100644 index 000000000..7c165383a --- /dev/null +++ b/conf/plugins/certexpire.opt @@ -0,0 +1,25 @@ +charon.plugins.certexpire.csv.cron + Cron style string specifying CSV export times. + +charon.plugins.certexpire.csv.empty_string = + String to use in empty intermediate CA fields. + +charon.plugins.certexpire.csv.fixed_fields = yes + Use a fixed intermediate CA field count. + +charon.plugins.certexpire.csv.force = yes + Force export of all trustchains we have a private key for. + +charon.plugins.certexpire.csv.format = %d:%m:%Y + **strftime**(3) format string to export expiration dates as. + +charon.plugins.certexpire.csv.local + **strftime**(3) format string for the CSV file name to export local + certificates to. + +charon.plugins.certexpire.csv.remote + **strftime**(3) format string for the CSV file name to export remote + certificates to. + +charon.plugins.certexpire.csv.separator = , + CSV field separator. diff --git a/conf/plugins/coupling.opt b/conf/plugins/coupling.opt new file mode 100644 index 000000000..179579d47 --- /dev/null +++ b/conf/plugins/coupling.opt @@ -0,0 +1,8 @@ +charon.plugins.coupling.file + File to store coupling list to. + +charon.plugins.coupling.hash = sha1 + Hashing algorithm to fingerprint coupled certificates. + +charon.plugins.coupling.max = 1 + Maximum number of coupling entries to create. diff --git a/conf/plugins/dhcp.opt b/conf/plugins/dhcp.opt new file mode 100644 index 000000000..9c7b86091 --- /dev/null +++ b/conf/plugins/dhcp.opt @@ -0,0 +1,22 @@ +charon.plugins.dhcp.force_server_address = no + Always use the configured server address. + + Always use the configured server address. This might be helpful if the DHCP + server runs on the same host as strongSwan, and the DHCP daemon does not + listen on the loopback interface. In that case the server cannot be reached + via unicast (or even 255.255.255.255) as that would be routed via loopback. + Setting this option to yes and configuring the local broadcast address (e.g. + 192.168.0.255) as server address might work. + +charon.plugins.dhcp.identity_lease = no + Derive user-defined MAC address from hash of IKE identity. + +charon.plugins.dhcp.server = 255.255.255.255 + DHCP server unicast or broadcast IP address. + +charon.plugins.dhcp.interface + Interface name the plugin uses for address allocation. + + Interface name the plugin uses for address allocation. The default is to + bind to any (0.0.0.0) and let the system decide which way to route the + packets to the DHCP server. diff --git a/conf/plugins/dnscert.opt b/conf/plugins/dnscert.opt new file mode 100644 index 000000000..fd5a8d819 --- /dev/null +++ b/conf/plugins/dnscert.opt @@ -0,0 +1,2 @@ +charon.plugins.dnscert.enable = no + Enable fetching of CERT RRs via DNS. diff --git a/conf/plugins/duplicheck.opt b/conf/plugins/duplicheck.opt new file mode 100644 index 000000000..ff54fe3a8 --- /dev/null +++ b/conf/plugins/duplicheck.opt @@ -0,0 +1,5 @@ +charon.plugins.duplicheck.enable = yes + Enable duplicheck plugin (if loaded). + +charon.plugins.duplicheck.socket = unix://${piddir}/charon.dck + Socket provided by the duplicheck plugin. diff --git a/conf/plugins/eap-aka-3ggp2.opt b/conf/plugins/eap-aka-3ggp2.opt new file mode 100644 index 000000000..9e2a42b3f --- /dev/null +++ b/conf/plugins/eap-aka-3ggp2.opt @@ -0,0 +1 @@ +charon.plugins.eap-aka-3ggp2.seq_check = diff --git a/conf/plugins/eap-aka.opt b/conf/plugins/eap-aka.opt new file mode 100644 index 000000000..e8d166db9 --- /dev/null +++ b/conf/plugins/eap-aka.opt @@ -0,0 +1 @@ +charon.plugins.eap-aka.request_identity = yes diff --git a/conf/plugins/eap-dynamic.opt b/conf/plugins/eap-dynamic.opt new file mode 100644 index 000000000..2d50a0aab --- /dev/null +++ b/conf/plugins/eap-dynamic.opt @@ -0,0 +1,13 @@ +charon.plugins.eap-dynamic.preferred = + The preferred EAP method(s) to be used. + + The preferred EAP method(s) to be used. If it is not given the first + registered method will be used initially. If a comma separated list is + given the methods are tried in the given order before trying the rest of + the registered methods. + +charon.plugins.eap-dynamic.prefer_user = no + Prefer peer's proposed EAP methods. + + If enabled the EAP methods proposed in an EAP-Nak message sent by the peer + are preferred over the methods registered locally. diff --git a/conf/plugins/eap-gtc.opt b/conf/plugins/eap-gtc.opt new file mode 100644 index 000000000..3fe8b7d68 --- /dev/null +++ b/conf/plugins/eap-gtc.opt @@ -0,0 +1,2 @@ +charon.plugins.eap-gtc.backend = pam + XAuth backend to be used for credential verification. diff --git a/conf/plugins/eap-peap.opt b/conf/plugins/eap-peap.opt new file mode 100644 index 000000000..6fe88606d --- /dev/null +++ b/conf/plugins/eap-peap.opt @@ -0,0 +1,20 @@ +charon.plugins.eap-peap.fragment_size = 1024 + Maximum size of an EAP-PEAP packet. + +charon.plugins.eap-peap.max_message_count = 32 + Maximum number of processed EAP-PEAP packets (0 = no limit). + +charon.plugins.eap-peap.include_length = no + Include length in non-fragmented EAP-PEAP packets. + +charon.plugins.eap-peap.phase2_method = mschapv2 + Phase2 EAP client authentication method. + +charon.plugins.eap-peap.phase2_piggyback = no + Phase2 EAP Identity request piggybacked by server onto TLS Finished message. + +charon.plugins.eap-peap.phase2_tnc = no + Start phase2 EAP TNC protocol after successful client authentication. + +charon.plugins.eap-peap.request_peer_auth = no + Request peer authentication based on a client certificate. diff --git a/conf/plugins/eap-radius.opt b/conf/plugins/eap-radius.opt new file mode 100644 index 000000000..0edd3458c --- /dev/null +++ b/conf/plugins/eap-radius.opt @@ -0,0 +1,105 @@ +charon.plugins.eap-radius.accounting = no + Send RADIUS accounting information to RADIUS servers. + +charon.plugins.eap-radius.accounting_requires_vip = no + If enabled, accounting is disabled unless an IKE_SA has at least one + virtual IP. + +charon.plugins.eap-radius.class_group = no + Use class attributes in RADIUS-Accept messages as group membership + information. + + Use the _class_ attribute sent in the RADIUS-Accept message as group + membership information that is compared to the groups specified in the + **rightgroups** option in **ipsec.conf**(5). + +charon.plugins.eap-radius.close_all_on_timeout = no + Closes all IKE_SAs if communication with the RADIUS server times out. If it + is not set only the current IKE_SA is closed. + +charon.plugins.eap-radius.dae.enable = no + Enables support for the Dynamic Authorization Extension (RFC 5176). + +charon.plugins.eap-radius.dae.listen = 0.0.0.0 + Address to listen for DAE messages from the RADIUS server. + +charon.plugins.eap-radius.dae.port = 3799 + Port to listen for DAE requests. + +charon.plugins.eap-radius.dae.secret + Shared secret used to verify/sign DAE messages. If set, make sure to adjust + the permissions of the config file accordingly. + +charon.plugins.eap-radius.eap_start = no + Send EAP-Start instead of EAP-Identity to start RADIUS conversation. + +charon.plugins.eap-radius.filter_id = no + Use filter_id attribute as group membership information. + + If the RADIUS _tunnel_type_ attribute with value **ESP** is received, use + the _filter_id_ attribute sent in the RADIUS-Accept message as group + membership information that is compared to the groups specified in the + **rightgroups** option in **ipsec.conf**(5). + +charon.plugins.eap-radius.forward.ike_to_radius + RADIUS attributes to be forwarded from IKEv2 to RADIUS. + + RADIUS attributes to be forwarded from IKEv2 to RADIUS (can be defined by + name or attribute number, a colon can be used to specify vendor-specific + attributes, e.g. Reply-Message, or 11, or 36906:12). + +charon.plugins.eap-radius.forward.radius_to_ike = + Same as ike_to_radius but from RADIUS to IKEv2. + + Same as _charon.plugins.eap-radius.forward.ike_to_radius_ but from RADIUS to + IKEv2, a strongSwan specific private notify (40969) is used to transmit the + attributes. + +charon.plugins.eap-radius.id_prefix + Prefix to EAP-Identity, some AAA servers use a IMSI prefix to select the + EAP method. + +charon.plugins.eap-radius.nas_identifier = strongSwan + NAS-Identifier to include in RADIUS messages. + +charon.plugins.eap-radius.port = 1812 + Port of RADIUS server (authentication). + +charon.plugins.eap-radius.secret = + Shared secret between RADIUS and NAS. If set, make sure to adjust the + permissions of the config file accordingly. + +charon.plugins.eap-radius.server = + IP/Hostname of RADIUS server. + +charon.plugins.eap-radius.servers {} + Section to specify multiple RADIUS servers. + + Section to specify multiple RADIUS servers. The **nas_identifier**, + **secret**, **sockets** and **port** (or **auth_port**) options can be + specified for each server. A server's IP/Hostname can be configured using + the **address** option. The **acct_port** [1813] option can be used to + specify the port used for RADIUS accounting. For each RADIUS server a + priority can be specified using the **preference** [0] option. + +charon.plugins.eap-radius.sockets = 1 + Number of sockets (ports) to use, increase for high load. + +charon.plugins.eap-radius.xauth {} + Section to configure multiple XAuth authentication rounds via RADIUS. + + Section to configure multiple XAuth authentication rounds via RADIUS. + The subsections define so called authentication profiles with arbitrary + names. In each profile section one or more XAuth types can be configured, + with an assigned message. For each type a separate XAuth exchange will be + initiated and all replies get concatenated into the User-Password attribute, + which then gets verified over RADIUS. + + Available XAuth types are **password**, **passcode**, **nextpin**, and + **answer**. This type is not relevant to strongSwan or the AAA server, but + the client may show a different dialog (along with the configured message). + + To use the configured profiles, they have to be configured in the respective + connection in **ipsec.conf**(5) by appending the profile name, separated by + a colon, to the **xauth-radius** XAauth backend configuration in _rightauth_ + or _rightauth2_, for instance, _rightauth2=xauth-radius:profile_. diff --git a/conf/plugins/eap-sim.opt b/conf/plugins/eap-sim.opt new file mode 100644 index 000000000..052454c0e --- /dev/null +++ b/conf/plugins/eap-sim.opt @@ -0,0 +1 @@ +charon.plugins.eap-sim.request_identity = yes diff --git a/conf/plugins/eap-simaka-sql.opt b/conf/plugins/eap-simaka-sql.opt new file mode 100644 index 000000000..6b87a7e94 --- /dev/null +++ b/conf/plugins/eap-simaka-sql.opt @@ -0,0 +1,3 @@ +charon.plugins.eap-simaka-sql.database = + +charon.plugins.eap-simaka-sql.remove_used = no diff --git a/conf/plugins/eap-tls.opt b/conf/plugins/eap-tls.opt new file mode 100644 index 000000000..e7b96523a --- /dev/null +++ b/conf/plugins/eap-tls.opt @@ -0,0 +1,8 @@ +charon.plugins.eap-tls.fragment_size = 1024 + Maximum size of an EAP-TLS packet. + +charon.plugins.eap-tls.max_message_count = 32 + Maximum number of processed EAP-TLS packets (0 = no limit). + +charon.plugins.eap-tls.include_length = yes + Include length in non-fragmented EAP-TLS packets. diff --git a/conf/plugins/eap-tnc.opt b/conf/plugins/eap-tnc.opt new file mode 100644 index 000000000..8e060ceda --- /dev/null +++ b/conf/plugins/eap-tnc.opt @@ -0,0 +1,6 @@ +charon.plugins.eap-tnc.max_message_count = 10 + Maximum number of processed EAP-TNC packets (0 = no limit). + +charon.plugins.eap-tnc.protocol = tnccs-1.1 + IF-TNCCS protocol version to be used (_tnccs-1.1_, _tnccs-2.0_, + _tnccs-dynamic_). diff --git a/conf/plugins/eap-ttls.opt b/conf/plugins/eap-ttls.opt new file mode 100644 index 000000000..21a6cb674 --- /dev/null +++ b/conf/plugins/eap-ttls.opt @@ -0,0 +1,20 @@ +charon.plugins.eap-ttls.fragment_size = 1024 + Maximum size of an EAP-TTLS packet. + +charon.plugins.eap-ttls.max_message_count = 32 + Maximum number of processed EAP-TTLS packets (0 = no limit). + +charon.plugins.eap-ttls.include_length = yes + Include length in non-fragmented EAP-TTLS packets. + +charon.plugins.eap-ttls.phase2_method = md5 + Phase2 EAP client authentication method. + +charon.plugins.eap-ttls.phase2_piggyback = no + Phase2 EAP Identity request piggybacked by server onto TLS Finished message. + +charon.plugins.eap-ttls.phase2_tnc = no + Start phase2 EAP TNC protocol after successful client authentication. + +charon.plugins.eap-ttls.request_peer_auth = no + Request peer authentication based on a client certificate. diff --git a/conf/plugins/error-notify.opt b/conf/plugins/error-notify.opt new file mode 100644 index 000000000..44ea0551e --- /dev/null +++ b/conf/plugins/error-notify.opt @@ -0,0 +1,2 @@ +charon.plugins.error-notify.socket = unix://${piddir}/charon.enfy + Socket provided by the error-notify plugin. diff --git a/conf/plugins/gcrypt.opt b/conf/plugins/gcrypt.opt new file mode 100644 index 000000000..c6b0505d7 --- /dev/null +++ b/conf/plugins/gcrypt.opt @@ -0,0 +1,2 @@ +charon.plugins.gcrypt.quick_random = no + Use faster random numbers in gcrypt; for testing only, produces weak keys! diff --git a/conf/plugins/ha.opt b/conf/plugins/ha.opt new file mode 100644 index 000000000..77d5b7888 --- /dev/null +++ b/conf/plugins/ha.opt @@ -0,0 +1,23 @@ +charon.plugins.ha.autobalance = 0 + Interval in seconds to automatically balance handled segments between nodes. + Set to 0 to disable. + +charon.plugins.ha.fifo_interface = yes + +charon.plugins.ha.heartbeat_delay = 1000 + +charon.plugins.ha.heartbeat_timeout = 2100 + +charon.plugins.ha.local = + +charon.plugins.ha.monitor = yes + +charon.plugins.ha.pools = + +charon.plugins.ha.remote = + +charon.plugins.ha.resync = yes + +charon.plugins.ha.secret = + +charon.plugins.ha.segment_count = 1 diff --git a/conf/plugins/imc-attestation.opt b/conf/plugins/imc-attestation.opt new file mode 100644 index 000000000..9c108053b --- /dev/null +++ b/conf/plugins/imc-attestation.opt @@ -0,0 +1,17 @@ +charon.plugins.imc-attestation.aik_blob = + AIK encrypted private key blob file. + +charon.plugins.imc-attestation.aik_cert = + AIK certificate file. + +charon.plugins.imc-attestation.aik_key = + AIK public key file. + +charon.plugins.imc-attestation.nonce_len = 20 + DH nonce length. + +charon.plugins.imc-attestation.use_quote2 = yes + Use Quote2 AIK signature instead of Quote signature. + +charon.plugins.imc-attestation.pcr_info = yes + Whether to send pcr_before and pcr_after info. \ No newline at end of file diff --git a/conf/plugins/imc-os.opt b/conf/plugins/imc-os.opt new file mode 100644 index 000000000..2a6333f93 --- /dev/null +++ b/conf/plugins/imc-os.opt @@ -0,0 +1,2 @@ +charon.plugins.imc-os.push_info = yes + Send operating system info without being prompted. diff --git a/conf/plugins/imc-scanner.opt b/conf/plugins/imc-scanner.opt new file mode 100644 index 000000000..84e6dfa2f --- /dev/null +++ b/conf/plugins/imc-scanner.opt @@ -0,0 +1,2 @@ +charon.plugins.imc-scanner.push_info = yes + Send open listening ports without being prompted. diff --git a/conf/plugins/imc-swid.opt b/conf/plugins/imc-swid.opt new file mode 100644 index 000000000..67f7c79c4 --- /dev/null +++ b/conf/plugins/imc-swid.opt @@ -0,0 +1,2 @@ +charon.plugins.imc-swid.swid_directory = ${prefix}/share + Directory where SWID tags are located. diff --git a/conf/plugins/imc-test.opt b/conf/plugins/imc-test.opt new file mode 100644 index 000000000..c3169b5af --- /dev/null +++ b/conf/plugins/imc-test.opt @@ -0,0 +1,14 @@ +charon.plugins.imc-test.additional_ids = 0 + Number of additional IMC IDs. + +charon.plugins.imc-test.command = none + Command to be sent to the Test IMV. + +charon.plugins.imc-test.dummy_size = 0 + Size of dummy attribute to be sent to the Test IMV (0 = disabled). + +charon.plugins.imc-test.retry = no + Do a handshake retry. + +charon.plugins.imc-test.retry_command = + Command to be sent to the Test IMV in the handshake retry. diff --git a/conf/plugins/imv-attestation.opt b/conf/plugins/imv-attestation.opt new file mode 100644 index 000000000..c0ae20488 --- /dev/null +++ b/conf/plugins/imv-attestation.opt @@ -0,0 +1,29 @@ +charon.plugins.imv-attestation.cadir = + Path to directory with AIK cacerts. + +charon.plugins.imv-attestation.dh_group = ecp256 + Preferred Diffie-Hellman group. + +charon.plugins.imv-attestation.hash_algorithm = sha256 + Preferred measurement hash algorithm. + +charon.plugins.imv-attestation.min_nonce_len = 0 + DH minimum nonce length. + +charon.plugins.imc-attestation.pcr17_after + Dummy data if the TBOOT log is not retrieved. + +charon.plugins.imc-attestation.pcr17_before + Dummy data if the TBOOT log is not retrieved. + +charon.plugins.imc-attestation.pcr17_meas + Dummy data if the TBOOT log is not retrieved. + +charon.plugins.imc-attestation.pcr18_after + Dummy data if the TBOOT log is not retrieved. + +charon.plugins.imc-attestation.pcr18_before + Dummy data if the TBOOT log is not retrieved. + +charon.plugins.imc-attestation.pcr18_meas + Dummy data if the TBOOT log is not retrieved. diff --git a/conf/plugins/imv-os.opt b/conf/plugins/imv-os.opt new file mode 100644 index 000000000..eab926201 --- /dev/null +++ b/conf/plugins/imv-os.opt @@ -0,0 +1,2 @@ +charon.plugins.imv-os.remediation_uri = + URI pointing to operating system remediation instructions. diff --git a/conf/plugins/imv-scanner.opt b/conf/plugins/imv-scanner.opt new file mode 100644 index 000000000..7af87493b --- /dev/null +++ b/conf/plugins/imv-scanner.opt @@ -0,0 +1,2 @@ +charon.plugins.imv-scanner.remediation_uri = + URI pointing to scanner remediation instructions. diff --git a/conf/plugins/imv-test.opt b/conf/plugins/imv-test.opt new file mode 100644 index 000000000..2cbddc8f6 --- /dev/null +++ b/conf/plugins/imv-test.opt @@ -0,0 +1,2 @@ +charon.plugins.imv-test.rounds = 0 + Number of IMC-IMV retry rounds. diff --git a/conf/plugins/ipseckey.opt b/conf/plugins/ipseckey.opt new file mode 100644 index 000000000..d4cff26dd --- /dev/null +++ b/conf/plugins/ipseckey.opt @@ -0,0 +1,2 @@ +charon.plugins.ipseckey.enable = no + Enable fetching of IPSECKEY RRs via DNS. diff --git a/conf/plugins/kernel-klips.opt b/conf/plugins/kernel-klips.opt new file mode 100644 index 000000000..ad9806e71 --- /dev/null +++ b/conf/plugins/kernel-klips.opt @@ -0,0 +1,5 @@ +charon.plugins.kernel-klips.ipsec_dev_count = 4 + Number of ipsecN devices. + +charon.plugins.kernel-klips.ipsec_dev_mtu = 0 + Set MTU of ipsecN device. diff --git a/conf/plugins/kernel-libipsec.opt b/conf/plugins/kernel-libipsec.opt new file mode 100644 index 000000000..e76db63d9 --- /dev/null +++ b/conf/plugins/kernel-libipsec.opt @@ -0,0 +1,7 @@ +charon.plugins.kernel-libipsec.allow_peer_ts = no + Allow that the remote traffic selector equals the IKE peer. + + Allow that the remote traffic selector equals the IKE peer. The route + installed for such traffic (via TUN device) usually prevents further IKE + traffic. The fwmark options for the _kernel-netlink_ and _socket-default_ + plugins can be used to circumvent that problem. diff --git a/conf/plugins/kernel-netlink.opt b/conf/plugins/kernel-netlink.opt new file mode 100644 index 000000000..a8e421b6e --- /dev/null +++ b/conf/plugins/kernel-netlink.opt @@ -0,0 +1,18 @@ +charon.plugins.kernel-netlink.fwmark = + Firewall mark to set on the routing rule that directs traffic to our routing + table. + + Firewall mark to set on the routing rule that directs traffic to our routing + table. The format is [!]mark[/mask], where the optional exclamation mark + inverts the meaning (i.e. the rule only applies to packets that don't match + the mark). + +charon.plugins.kernel-netlink.roam_events = yes + Whether to trigger roam events when interfaces, addresses or routes change. + +charon.plugins.kernel-netlink.xfrm_acq_expires = 165 + Lifetime of XFRM acquire state in kernel. + + Lifetime of XFRM acquire state in kernel. The value gets written to + /proc/sys/net/core/xfrm_acq_expires. Indirectly controls the delay of XFRM + acquire messages sent. diff --git a/conf/plugins/kernel-pfroute.opt b/conf/plugins/kernel-pfroute.opt new file mode 100644 index 000000000..8b9bb9169 --- /dev/null +++ b/conf/plugins/kernel-pfroute.opt @@ -0,0 +1,3 @@ +charon.plugins.kernel-pfroute.vip_wait = 1000 + Time in ms to wait until virtual IP addresses appear/disappear before + failing. diff --git a/conf/plugins/led.opt b/conf/plugins/led.opt new file mode 100644 index 000000000..9e2f1ac61 --- /dev/null +++ b/conf/plugins/led.opt @@ -0,0 +1,3 @@ +charon.plugins.led.activity_led = + +charon.plugins.led.blink_time = 50 diff --git a/conf/plugins/load-tester.opt b/conf/plugins/load-tester.opt new file mode 100644 index 000000000..7afe32618 --- /dev/null +++ b/conf/plugins/load-tester.opt @@ -0,0 +1,128 @@ +charon.plugins.load-tester {} + Section to configure the load-tester plugin, see LOAD TESTS in + **strongswan.conf**(5) for details. + +charon.plugins.load-tester.addrs {} + Section that contains key/value pairs with address pools (in CIDR notation) + to use for a specific network interface e.g. eth0 = 10.10.0.0/16. + +charon.plugins.load-tester.addrs_keep = no + Whether to keep dynamic addresses even after the associated SA got + terminated. + +charon.plugins.load-tester.addrs_prefix = 16 + Network prefix length to use when installing dynamic addresses. + If set to -1 the full address is used (i.e. 32 or 128). + +charon.plugins.load-tester.ca_dir = + Directory to load (intermediate) CA certificates from. + +charon.plugins.load-tester.child_rekey = 600 + Seconds to start CHILD_SA rekeying after setup. + +charon.plugins.load-tester.delay = 0 + Delay between initiatons for each thread. + +charon.plugins.load-tester.delete_after_established = no + Delete an IKE_SA as soon as it has been established. + +charon.plugins.load-tester.digest = sha1 + Digest algorithm used when issuing certificates. + +charon.plugins.load-tester.dpd_delay = 0 + DPD delay to use in load test. + +charon.plugins.load-tester.dynamic_port = 0 + Base port to be used for requests (each client uses a different port). + +charon.plugins.load-tester.eap_password = default-pwd + EAP secret to use in load test. + +charon.plugins.load-tester.enable = no + Enable the load testing plugin. **WARNING**: Never enable this plugin on + productive systems. It provides preconfigured credentials and allows an + attacker to authenticate as any user. + +charon.plugins.load-tester.esp = aes128-sha1 + CHILD_SA proposal to use for load tests. + +charon.plugins.load-tester.fake_kernel = no + Fake the kernel interface to allow load-testing against self. + +charon.plugins.load-tester.ike_rekey = 0 + Seconds to start IKE_SA rekeying after setup. + +charon.plugins.load-tester.init_limit = 0 + Global limit of concurrently established SAs during load test. + +charon.plugins.load-tester.initiator = 0.0.0.0 + Address to initiate from. + +charon.plugins.load-tester.initiators = 0 + Number of concurrent initiator threads to use in load test. + +charon.plugins.load-tester.initiator_auth = pubkey + Authentication method(s) the intiator uses. + +charon.plugins.load-tester.initiator_id = + Initiator ID used in load test. + +charon.plugins.load-tester.initiator_match = + Initiator ID to match against as responder. + +charon.plugins.load-tester.initiator_tsi = + Traffic selector on initiator side, as proposed by initiator. + +charon.plugins.load-tester.initiator_tsr = + Traffic selector on responder side, as proposed by initiator. + +charon.plugins.load-tester.iterations = 1 + Number of IKE_SAs to initiate by each initiator in load test. + +charon.plugins.load-tester.issuer_cert = + Path to the issuer certificate (if not configured a hard-coded default value + is used). + +charon.plugins.load-tester.issuer_key = + Path to private key that is used to issue certificates (if not configured a + hard-coded default value is used). + +charon.plugins.load-tester.mode = tunnel + IPsec mode to use, one of _tunnel_, _transport_, or _beet_. + +charon.plugins.load-tester.pool = + Provide INTERNAL_IPV4_ADDRs from a named pool. + +charon.plugins.load-tester.preshared_key = + Preshared key to use in load test. + +charon.plugins.load-tester.proposal = aes128-sha1-modp768 + IKE proposal to use in load test. + +charon.plugins.load-tester.responder = 127.0.0.1 + Address to initiation connections to. + +charon.plugins.load-tester.responder_auth = pubkey + Authentication method(s) the responder uses. + +charon.plugins.load-tester.responder_id = + Responder ID used in load test. + +charon.plugins.load-tester.responder_tsi = initiator_tsi + Traffic selector on initiator side, as narrowed by responder. + +charon.plugins.load-tester.responder_tsr = initiator_tsr + Traffic selector on responder side, as narrowed by responder. + +charon.plugins.load-tester.request_virtual_ip = no + Request an INTERNAL_IPV4_ADDR from the server. + +charon.plugins.load-tester.shutdown_when_complete = no + Shutdown the daemon after all IKE_SAs have been established. + +charon.plugins.load-tester.socket = unix://${piddir}/charon.ldt + Socket provided by the load-tester plugin. + +charon.plugins.load-tester.version = 0 + IKE version to use (0 means use IKEv2 as initiator and accept any version as + responder). diff --git a/conf/plugins/lookip.opt b/conf/plugins/lookip.opt new file mode 100644 index 000000000..443eb34bb --- /dev/null +++ b/conf/plugins/lookip.opt @@ -0,0 +1,2 @@ +charon.plugins.lookip.socket = unix://${piddir}/charon.lkp + Socket provided by the lookip plugin. diff --git a/conf/plugins/ntru.opt b/conf/plugins/ntru.opt new file mode 100644 index 000000000..8e1bebd87 --- /dev/null +++ b/conf/plugins/ntru.opt @@ -0,0 +1,8 @@ +charon.plugins.ntru.max_drbg_requests = 4294967294 + Number of pseudo-random bit requests from the DRBG before an automatic + reseeding occurs. + +charon.plugins.ntru.parameter_set = optimum + The following parameter sets are available: **x9_98_speed**, + **x9_98_bandwidth**, **x9_98_balance** and **optimum**, the last set not + being part of the X9.98 standard but having the best performance. diff --git a/conf/plugins/openssl.opt b/conf/plugins/openssl.opt new file mode 100644 index 000000000..55d8dcaa1 --- /dev/null +++ b/conf/plugins/openssl.opt @@ -0,0 +1,5 @@ +charon.plugins.openssl.engine_id = pkcs11 + ENGINE ID to use in the OpenSSL plugin. + +charon.plugins.openssl.fips_mode = 0 + Set OpenSSL FIPS mode: disabled(0), enabled(1), Suite B enabled(2). diff --git a/conf/plugins/pkcs11.opt b/conf/plugins/pkcs11.opt new file mode 100644 index 000000000..f5a202844 --- /dev/null +++ b/conf/plugins/pkcs11.opt @@ -0,0 +1,26 @@ +charon.plugins.pkcs11.modules {} + List of available PKCS#11 modules. + +charon.plugins.pkcs11.load_certs = yes + Whether to load certificates from tokens. + +charon.plugins.pkcs11.reload_certs = no + Reload certificates from all tokens if charon receives a SIGHUP. + +charon.plugins.pkcs11.use_dh = no + Whether the PKCS#11 modules should be used for DH and ECDH (see _use_ecc_ + option). + +charon.plugins.pkcs11.use_ecc = no + Whether the PKCS#11 modules should be used for ECDH and ECDSA public key + operations. ECDSA private keys can be used regardless of this option. + +charon.plugins.pkcs11.use_hasher = no + Whether the PKCS#11 modules should be used to hash data. + +charon.plugins.pkcs11.use_pubkey = no + Whether the PKCS#11 modules should be used for public key operations, even + for keys not stored on tokens. + +charon.plugins.pkcs11.use_rng = no + Whether the PKCS#11 modules should be used as RNG. diff --git a/conf/plugins/radattr.opt b/conf/plugins/radattr.opt new file mode 100644 index 000000000..dcc1bf2f7 --- /dev/null +++ b/conf/plugins/radattr.opt @@ -0,0 +1,9 @@ +charon.plugins.radattr.dir = + Directory where RADIUS attributes are stored in client-ID specific files. + +charon.plugins.radattr.message_id = -1 + Add attributes to all IKE_AUTH messages (-1) or only to the one with the + given message ID. + + Attributes are added to all IKE_AUTH messages by default (-1), or only to + the IKE_AUTH message with the given IKEv2 message ID. diff --git a/conf/plugins/random.opt b/conf/plugins/random.opt new file mode 100644 index 000000000..1cbde288b --- /dev/null +++ b/conf/plugins/random.opt @@ -0,0 +1,9 @@ +charon.plugins.random.random = ${random_device} + File to read random bytes from. + +charon.plugins.random.urandom = ${urandom_device} + File to read pseudo random bytes from. + +charon.plugins.random.strong_equals_true = no + If set to yes the RNG_STRONG class reads random bytes from the same source + as the RNG_TRUE class. diff --git a/conf/plugins/resolve.opt b/conf/plugins/resolve.opt new file mode 100644 index 000000000..ce65eff9e --- /dev/null +++ b/conf/plugins/resolve.opt @@ -0,0 +1,11 @@ +charon.plugins.resolve.file = /etc/resolv.conf + File where to add DNS server entries. + +charon.plugins.resolve.resolvconf.iface_prefix = lo.inet.ipsec. + Prefix used for interface names sent to resolvconf(8). + + Prefix used for interface names sent to **resolvconf**(8). The nameserver + address is appended to this prefix to make it unique. The result has to be + a valid interface name according to the rules defined by resolvconf. Also, + it should have a high priority according to the order defined in + **interface-order**(5). diff --git a/conf/plugins/socket-default.opt b/conf/plugins/socket-default.opt new file mode 100644 index 000000000..483a0f03d --- /dev/null +++ b/conf/plugins/socket-default.opt @@ -0,0 +1,11 @@ +charon.plugins.socket-default.fwmark = + Firewall mark to set on outbound packets. + +charon.plugins.socket-default.set_source = yes + Set source address on outbound packets, if possible. + +charon.plugins.socket-default.use_ipv4 = yes + Listen on IPv4, if possible. + +charon.plugins.socket-default.use_ipv6 = yes + Listen on IPv6, if possible. diff --git a/conf/plugins/sql.opt b/conf/plugins/sql.opt new file mode 100644 index 000000000..f573bba7e --- /dev/null +++ b/conf/plugins/sql.opt @@ -0,0 +1,6 @@ +charon.plugins.sql.database = + Database URI for charon's SQL plugin. If it contains a password, make + sure to adjust the permissions of the config file accordingly. + +charon.plugins.sql.loglevel = -1 + Loglevel for logging to SQL database. diff --git a/conf/plugins/stroke.opt b/conf/plugins/stroke.opt new file mode 100644 index 000000000..2cfc2c6fa --- /dev/null +++ b/conf/plugins/stroke.opt @@ -0,0 +1,15 @@ +charon.plugins.stroke.ignore_missing_ca_basic_constraint = no + Treat certificates in ipsec.d/cacerts and ipsec.conf ca sections as CA + certificates even if they don't contain a CA basic constraint. + +charon.plugins.stroke.max_concurrent = 4 + Maximum number of stroke messages handled concurrently. + +charon.plugins.stroke.prevent_loglevel_changes = no + If enabled log level changes via stroke socket are not allowed. + +charon.plugins.stroke.socket = unix://${piddir}/charon.ctl + Socket provided by the stroke plugin. + +charon.plugins.stroke.timeout = 0 + Timeout in ms for any stroke command. Use 0 to disable the timeout. diff --git a/conf/plugins/systime-fix.opt b/conf/plugins/systime-fix.opt new file mode 100644 index 000000000..7abd03627 --- /dev/null +++ b/conf/plugins/systime-fix.opt @@ -0,0 +1,12 @@ +charon.plugins.systime-fix.interval = 0 + Interval in seconds to check system time for validity. 0 disables the check. + +charon.plugins.systime-fix.reauth = no + Whether to use reauth or delete if an invalid cert lifetime is detected. + +charon.plugins.systime-fix.threshold = + Threshold date where system time is considered valid. Disabled if not + specified. + +charon.plugins.systime-fix.threshold_format = %Y + **strptime**(3) format used to parse threshold option. diff --git a/conf/plugins/tnc-ifmap.opt b/conf/plugins/tnc-ifmap.opt new file mode 100644 index 000000000..155c30697 --- /dev/null +++ b/conf/plugins/tnc-ifmap.opt @@ -0,0 +1,21 @@ +charon.plugins.tnc-ifmap.client_cert = + Path to X.509 certificate file of IF-MAP client. + +charon.plugins.tnc-ifmap.client_key = + Path to private key file of IF-MAP client. + +charon.plugins.tnc-ifmap.device_name = + Unique name of strongSwan server as a PEP and/or PDP device. + +charon.plugins.tnc-ifmap.renew_session_interval = 150 + Interval in seconds between periodic IF-MAP RenewSession requests. + +charon.plugins.tnc-ifmap.server_uri = https://localhost:8444/imap + URI of the form [https://]servername[:port][/path]. + +charon.plugins.tnc-ifmap.server_cert = + Path to X.509 certificate file of IF-MAP server. + +charon.plugins.tnc-ifmap.username_password = + Credentials of IF-MAP client of the form username:password. If set, make + sure to adjust the permissions of the config file accordingly. diff --git a/conf/plugins/tnc-imc.opt b/conf/plugins/tnc-imc.opt new file mode 100644 index 000000000..7c9af2a30 --- /dev/null +++ b/conf/plugins/tnc-imc.opt @@ -0,0 +1,5 @@ +charon.plugins.tnc-imc.dlclose = yes + Unload IMC after use. + +charon.plugins.tnc-imc.preferred_language = en + Preferred language for TNC recommendations. diff --git a/conf/plugins/tnc-imv.opt b/conf/plugins/tnc-imv.opt new file mode 100644 index 000000000..788753ce7 --- /dev/null +++ b/conf/plugins/tnc-imv.opt @@ -0,0 +1,5 @@ +charon.plugins.tnc-imv.dlclose = yes + Unload IMV after use. + +charon.plugins.tnc-imv.recommendation_policy = default + TNC recommendation policy, one of _default_, _any_, or _all_. diff --git a/conf/plugins/tnc-pdp.opt b/conf/plugins/tnc-pdp.opt new file mode 100644 index 000000000..22b00db5e --- /dev/null +++ b/conf/plugins/tnc-pdp.opt @@ -0,0 +1,24 @@ +charon.plugins.tnc-pdp.pt_tls.enable = yes + Enable PT-TLS protocol on the strongSwan PDP. + +charon.plugins.tnc-pdp.pt_tls.port = 271 + PT-TLS server port the strongSwan PDP is listening on. + +charon.plugins.tnc-pdp.radius.enable = yes + Enable RADIUS protocol on the strongSwan PDP. + +charon.plugins.tnc-pdp.radius.method = ttls + EAP tunnel method to be used. + +charon.plugins.tnc-pdp.radius.port = 1812 + RADIUS server port the strongSwan PDP is listening on. + +charon.plugins.tnc-pdp.radius.secret = + Shared RADIUS secret between strongSwan PDP and NAS. If set, make sure to + adjust the permissions of the config file accordingly. + +charon.plugins.tnc-pdp.server = + Name of the strongSwan PDP as contained in the AAA certificate. + +charon.plugins.tnc-pdp.timeout = + Timeout in seconds before closing incomplete connections. diff --git a/conf/plugins/tnccs-11.opt b/conf/plugins/tnccs-11.opt new file mode 100644 index 000000000..eb313fe06 --- /dev/null +++ b/conf/plugins/tnccs-11.opt @@ -0,0 +1,2 @@ +charon.plugins.tnccs-11.max_message_size = 45000 + Maximum size of a PA-TNC message (XML & Base64 encoding). diff --git a/conf/plugins/tnccs-20.opt b/conf/plugins/tnccs-20.opt new file mode 100644 index 000000000..b15bc3fa1 --- /dev/null +++ b/conf/plugins/tnccs-20.opt @@ -0,0 +1,5 @@ +charon.plugins.tnccs-20.max_batch_size = 65522 + Maximum size of a PB-TNC batch (upper limit via PT-EAP = 65529). + +charon.plugins.tnccs-20.max_message_size = 65490 + Maximum size of a PA-TNC message (upper limit via PT-EAP = 65497). diff --git a/conf/plugins/unbound.opt b/conf/plugins/unbound.opt new file mode 100644 index 000000000..f8ca9ca12 --- /dev/null +++ b/conf/plugins/unbound.opt @@ -0,0 +1,17 @@ +charon.plugins.unbound.resolv_conf = /etc/resolv.conf + File to read DNS resolver configuration from. + +charon.plugins.unbound.trust_anchors = /etc/ipsec.d/dnssec.keys + File to read DNSSEC trust anchors from (usually root zone KSK). + + File to read DNSSEC trust anchors from (usually root zone KSK). The format + of the file is the standard DNS Zone file format, anchors can be stored as + DS or DNSKEY entries in the file. + +charon.plugins.unbound.dlv_anchors = + File to read trusted keys for DLV (DNSSEC Lookaside Validation) from. + + File to read trusted keys for DLV (DNSSEC Lookaside Validation) from. It + uses the same format as _trust_anchors_. Only one DLV can be configured, + which is then used as a root trusted DLV, this means that it is a lookaside + for the root. diff --git a/conf/plugins/updown.opt b/conf/plugins/updown.opt new file mode 100644 index 000000000..d8bcc82ab --- /dev/null +++ b/conf/plugins/updown.opt @@ -0,0 +1,7 @@ +charon.plugins.updown.dns_handler = no + Whether the updown script should handle assigned DNS servers (if enabled + they can't be handled by other plugins, like resolve). + + Whether the updown script should handle DNS servers assigned via IKEv1 Mode + Config or IKEv2 Config Payloads (if enabled they can't be handled by other + plugins, like resolve) diff --git a/conf/plugins/whitelist.opt b/conf/plugins/whitelist.opt new file mode 100644 index 000000000..023f7e235 --- /dev/null +++ b/conf/plugins/whitelist.opt @@ -0,0 +1,6 @@ +charon.plugins.whitelist.enable = yes + Enable loaded whitelist plugin. + +charon.plugins.whitelist.socket = unix://${piddir}/charon.wlst + Socket provided by the whitelist plugin. + diff --git a/conf/plugins/xauth-eap.opt b/conf/plugins/xauth-eap.opt new file mode 100644 index 000000000..1663f935c --- /dev/null +++ b/conf/plugins/xauth-eap.opt @@ -0,0 +1,2 @@ +charon.plugins.xauth-eap.backend = radius + EAP plugin to be used as backend for XAuth credential verification. diff --git a/conf/plugins/xauth-pam.opt b/conf/plugins/xauth-pam.opt new file mode 100644 index 000000000..637dea6a6 --- /dev/null +++ b/conf/plugins/xauth-pam.opt @@ -0,0 +1,9 @@ +charon.plugins.xauth-pam.pam_service = login + PAM service to be used for authentication. + +charon.plugins.xauth-pam.session = no + Open/close a PAM session for each active IKE_SA. + +charon.plugins.xauth-pam.trim_email = yes + If an email address is received as an XAuth username, trim it to just the + username part. diff --git a/conf/strongswan.conf b/conf/strongswan.conf new file mode 100644 index 000000000..d90672861 --- /dev/null +++ b/conf/strongswan.conf @@ -0,0 +1,14 @@ +# strongswan.conf - strongSwan configuration file +# +# Refer to the strongswan.conf(5) manpage for details +# +# Configuration changes should be made in the included files + +charon { + load_modular = yes + plugins { + include strongswan.d/charon/*.conf + } +} + +include strongswan.d/*.conf diff --git a/conf/strongswan.conf.5.head.in b/conf/strongswan.conf.5.head.in new file mode 100644 index 000000000..23454e758 --- /dev/null +++ b/conf/strongswan.conf.5.head.in @@ -0,0 +1,127 @@ +.TH STRONGSWAN.CONF 5 "" "@PACKAGE_VERSION@" "strongSwan" +.SH NAME +strongswan.conf \- strongSwan configuration file +.SH DESCRIPTION +While the +.IR ipsec.conf (5) +configuration file is well suited to define IPsec related configuration +parameters, it is not useful for other strongSwan applications to read options +from this file. +The file is hard to parse and only +.I ipsec starter +is capable of doing so. As the number of components of the strongSwan project +is continually growing, a more flexible configuration file was needed, one that +is easy to extend and can be used by all components. With strongSwan 4.2.1 +.IR strongswan.conf (5) +was introduced which meets these requirements. + +.SH SYNTAX +The format of the strongswan.conf file consists of hierarchical +.B sections +and a list of +.B key/value pairs +in each section. Each section has a name, followed by C-Style curly brackets +defining the section body. Each section body contains a set of subsections +and key/value pairs: +.PP +.EX + settings := (section|keyvalue)* + section := name { settings } + keyvalue := key = value\\n +.EE +.PP +Values must be terminated by a newline. +.PP +Comments are possible using the \fB#\fP-character, but be careful: The parser +implementation is currently limited and does not like brackets in comments. +.PP +Section names and keys may contain any printable character except: +.PP +.EX + . { } # \\n \\t space +.EE +.PP +An example file in this format might look like this: +.PP +.EX + a = b + section-one { + somevalue = asdf + subsection { + othervalue = xxx + } + # yei, a comment + yetanother = zz + } + section-two { + x = 12 + } +.EE +.PP +Indentation is optional, you may use tabs or spaces. + +.SH INCLUDING FILES +Using the +.B include +statement it is possible to include other files into strongswan.conf, e.g. +.PP +.EX + include /some/path/*.conf +.EE +.PP +If the file name is not an absolute path, it is considered to be relative +to the directory of the file containing the include statement. The file name +may include shell wildcards (see +.IR sh (1)). +Also, such inclusions can be nested. +.PP +Sections loaded from included files +.I extend +previously loaded sections; already existing values are +.IR replaced . +It is important to note that settings are added relative to the section the +include statement is in. +.PP +As an example, the following three files result in the same final +config as the one given above: +.PP +.EX + a = b + section-one { + somevalue = before include + include include.conf + } + include other.conf + +include.conf: + # settings loaded from this file are added to section-one + # the following replaces the previous value + somevalue = asdf + subsection { + othervalue = yyy + } + yetanother = zz + +other.conf: + # this extends section-one and subsection + section-one { + subsection { + # this replaces the previous value + othervalue = xxx + } + } + section-two { + x = 12 + } +.EE + +.SH READING VALUES +Values are accessed using a dot-separated section list and a key. +With reference to the example above, accessing +.B section-one.subsection.othervalue +will return +.BR xxx . + +.SH DEFINED KEYS +The following keys are currently defined (using dot notation). The default +value (if any) is listed in brackets after the key. diff --git a/conf/strongswan.conf.5.tail.in b/conf/strongswan.conf.5.tail.in new file mode 100644 index 000000000..72aa7f856 --- /dev/null +++ b/conf/strongswan.conf.5.tail.in @@ -0,0 +1,470 @@ +.SH LOGGER CONFIGURATION +Options in +.BR strongswan.conf (5) +provide a much more flexible way to configure loggers for the IKE daemon charon +than using the +.B charondebug +option in +.BR ipsec.conf (5). +.PP +.BR Note : +If any loggers are specified in strongswan.conf, +.B charondebug +does not have any effect. +.PP +There are currently two types of loggers: +.TP +.B File loggers +Log directly to a file and are defined by specifying the full path to the +file as subsection in the +.B charon.filelog +section. To log to the console the two special filenames +.BR stdout " and " stderr +can be used. +.TP +.B Syslog loggers +Log into a syslog facility and are defined by specifying the facility to log to +as the name of a subsection in the +.B charon.syslog +section. The following facilities are currently supported: +.BR daemon " and " auth . +.PP +Multiple loggers can be defined for each type with different log verbosity for +the different subsystems of the daemon. + +.SS Subsystems +.TP +.B dmn +Main daemon setup/cleanup/signal handling +.TP +.B mgr +IKE_SA manager, handling synchronization for IKE_SA access +.TP +.B ike +IKE_SA +.TP +.B chd +CHILD_SA +.TP +.B job +Jobs queueing/processing and thread pool management +.TP +.B cfg +Configuration management and plugins +.TP +.B knl +IPsec/Networking kernel interface +.TP +.B net +IKE network communication +.TP +.B asn +Low-level encoding/decoding (ASN.1, X.509 etc.) +.TP +.B enc +Packet encoding/decoding encryption/decryption operations +.TP +.B tls +libtls library messages +.TP +.B esp +libipsec library messages +.TP +.B lib +libstrongwan library messages +.TP +.B tnc +Trusted Network Connect +.TP +.B imc +Integrity Measurement Collector +.TP +.B imv +Integrity Measurement Verifier +.TP +.B pts +Platform Trust Service +.SS Loglevels +.TP +.B -1 +Absolutely silent +.TP +.B 0 +Very basic auditing logs, (e.g. SA up/SA down) +.TP +.B 1 +Generic control flow with errors, a good default to see whats going on +.TP +.B 2 +More detailed debugging control flow +.TP +.B 3 +Including RAW data dumps in Hex +.TP +.B 4 +Also include sensitive material in dumps, e.g. keys +.SS Example +.PP +.EX + charon { + filelog { + /var/log/charon.log { + time_format = %b %e %T + append = no + default = 1 + } + stderr { + ike = 2 + knl = 3 + ike_name = yes + } + } + syslog { + # enable logging to LOG_DAEMON, use defaults + daemon { + } + # minimalistic IKE auditing logging to LOG_AUTHPRIV + auth { + default = -1 + ike = 0 + } + } + } +.EE + +.SH JOB PRIORITY MANAGEMENT +Some operations in the IKEv2 daemon charon are currently implemented +synchronously and blocking. Two examples for such operations are communication +with a RADIUS server via EAP-RADIUS, or fetching CRL/OCSP information during +certificate chain verification. Under high load conditions, the thread pool may +run out of available threads, and some more important jobs, such as liveness +checking, may not get executed in time. +.PP +To prevent thread starvation in such situations job priorities were introduced. +The job processor will reserve some threads for higher priority jobs, these +threads are not available for lower priority, locking jobs. +.SS Implementation +Currently 4 priorities have been defined, and they are used in charon as +follows: +.TP +.B CRITICAL +Priority for long-running dispatcher jobs. +.TP +.B HIGH +INFORMATIONAL exchanges, as used by liveness checking (DPD). +.TP +.B MEDIUM +Everything not HIGH/LOW, including IKE_SA_INIT processing. +.TP +.B LOW +IKE_AUTH message processing. RADIUS and CRL fetching block here +.PP +Although IKE_SA_INIT processing is computationally expensive, it is explicitly +assigned to the MEDIUM class. This allows charon to do the DH exchange while +other threads are blocked in IKE_AUTH. To prevent the daemon from accepting more +IKE_SA_INIT requests than it can handle, use IKE_SA_INIT DROPPING. +.PP +The thread pool processes jobs strictly by priority, meaning it will consume all +higher priority jobs before looking for ones with lower priority. Further, it +reserves threads for certain priorities. A priority class having reserved +.I n +threads will always have +.I n +threads available for this class (either currently processing a job, or waiting +for one). +.SS Configuration +To ensure that there are always enough threads available for higher priority +tasks, threads must be reserved for each priority class. +.TP +.BR charon.processor.priority_threads.critical " [0]" +Threads reserved for CRITICAL priority class jobs +.TP +.BR charon.processor.priority_threads.high " [0]" +Threads reserved for HIGH priority class jobs +.TP +.BR charon.processor.priority_threads.medium " [0]" +Threads reserved for MEDIUM priority class jobs +.TP +.BR charon.processor.priority_threads.low " [0]" +Threads reserved for LOW priority class jobs +.PP +Let's consider the following configuration: +.PP +.EX + charon { + processor { + priority_threads { + high = 1 + medium = 4 + } + } + } +.EE +.PP +With this configuration, one thread is reserved for HIGH priority tasks. As +currently only liveness checking and stroke message processing is done with +high priority, one or two threads should be sufficient. +.PP +The MEDIUM class mostly processes non-blocking jobs. Unless your setup is +experiencing many blocks in locks while accessing shared resources, threads for +one or two times the number of CPU cores is fine. +.PP +It is usually not required to reserve threads for CRITICAL jobs. Jobs in this +class rarely return and do not release their thread to the pool. +.PP +The remaining threads are available for LOW priority jobs. Reserving threads +does not make sense (until we have an even lower priority). +.SS Monitoring +To see what the threads are actually doing, invoke +.IR "ipsec statusall" . +Under high load, something like this will show up: +.PP +.EX + worker threads: 2 or 32 idle, 5/1/2/22 working, + job queue: 0/0/1/149, scheduled: 198 +.EE +.PP +From 32 worker threads, +.IP 2 +are currently idle. +.IP 5 +are running CRITICAL priority jobs (dispatching from sockets, etc.). +.IP 1 +is currently handling a HIGH priority job. This is actually the thread currently +providing this information via stroke. +.IP 2 +are handling MEDIUM priority jobs, likely IKE_SA_INIT or CREATE_CHILD_SA +messages. +.IP 22 +are handling LOW priority jobs, probably waiting for an EAP-RADIUS response +while processing IKE_AUTH messages. +.PP +The job queue load shows how many jobs are queued for each priority, ready for +execution. The single MEDIUM priority job will get executed immediately, as +we have two spare threads reserved for MEDIUM class jobs. + +.SH IKE_SA_INIT DROPPING +If a responder receives more connection requests per seconds than it can handle, +it does not make sense to accept more IKE_SA_INIT messages. And if they are +queued but can't get processed in time, an answer might be sent after the +client has already given up and restarted its connection setup. This +additionally increases the load on the responder. +.PP +To limit the responder load resulting from new connection attempts, the daemon +can drop IKE_SA_INIT messages just after reception. There are two mechanisms to +decide if this should happen, configured with the following options: +.TP +.BR charon.init_limit_half_open " [0]" +Limit based on the number of half open IKE_SAs. Half open IKE_SAs are SAs in +connecting state, but not yet established. +.TP +.BR charon.init_limit_job_load " [0]" +Limit based on the number of jobs currently queued for processing (sum over all +job priorities). +.PP +The second limit includes load from other jobs, such as rekeying. Choosing a +good value is difficult and depends on the hardware and expected load. +.PP +The first limit is simpler to calculate, but includes the load from new +connections only. If your responder is capable of negotiating 100 tunnels/s, you +might set this limit to 1000. The daemon will then drop new connection attempts +if generating a response would require more than 10 seconds. If you are +allowing for a maximum response time of more than 30 seconds, consider adjusting +the timeout for connecting IKE_SAs +.RB ( charon.half_open_timeout ). +A responder, by default, deletes an IKE_SA if the initiator does not establish +it within 30 seconds. Under high load, a higher value might be required. + +.SH LOAD TESTS +To do stability testing and performance optimizations, the IKE daemon charon +provides the \fIload-tester\fR plugin. This plugin allows one to setup thousands +of tunnels concurrently against the daemon itself or a remote host. +.PP +.B WARNING: +Never enable the load-testing plugin on productive systems. It provides +preconfigured credentials and allows an attacker to authenticate as any user. +.PP +.SS Configuration details +For public key authentication, the responder uses the +.B \(dqCN=srv, OU=load-test, O=strongSwan\(dq +identity. For the initiator, each connection attempt uses a different identity +in the form +.BR "\(dqCN=c1-r1, OU=load-test, O=strongSwan\(dq" , +where the first number inidicates the client number, the second the +authentication round (if multiple authentication rounds are used). +.PP +For PSK authentication, FQDN identities are used. The server uses +.BR srv.strongswan.org , +the client uses an identity in the form +.BR c1-r1.strongswan.org . +.PP +For EAP authentication, the client uses a NAI in the form +.BR 100000000010001@strongswan.org . +.PP +To configure multiple authentication rounds, concatenate multiple methods using, +e.g. +.EX + initiator_auth = pubkey|psk|eap-md5|eap-aka +.EE +.PP +The responder uses a hardcoded certificate based on a 1024-bit RSA key. +This certificate additionally serves as CA certificate. A peer uses the same +private key, but generates client certificates on demand signed by the CA +certificate. Install the Responder/CA certificate on the remote host to +authenticate all clients. +.PP +To speed up testing, the load tester plugin implements a special Diffie-Hellman +implementation called \fImodpnull\fR. By setting +.EX + proposal = aes128-sha1-modpnull +.EE +this wicked fast DH implementation is used. It does not provide any security +at all, but allows one to run tests without DH calculation overhead. +.SS Examples +.PP +In the simplest case, the daemon initiates IKE_SAs against itself using the +loopback interface. This will actually establish double the number of IKE_SAs, +as the daemon is initiator and responder for each IKE_SA at the same time. +Installation of IPsec SAs would fail, as each SA gets installed twice. To +simulate the correct behavior, a fake kernel interface can be enabled which does +not install the IPsec SAs at the kernel level. +.PP +A simple loopback configuration might look like this: +.PP +.EX + charon { + # create new IKE_SAs for each CHILD_SA to simulate + # different clients + reuse_ikesa = no + # turn off denial of service protection + dos_protection = no + + plugins { + load-tester { + # enable the plugin + enable = yes + # use 4 threads to initiate connections + # simultaneously + initiators = 4 + # each thread initiates 1000 connections + iterations = 1000 + # delay each initiation in each thread by 20ms + delay = 20 + # enable the fake kernel interface to + # avoid SA conflicts + fake_kernel = yes + } + } + } +.EE +.PP +This will initiate 4000 IKE_SAs within 20 seconds. You may increase the delay +value if your box can not handle that much load, or decrease it to put more +load on it. If the daemon starts retransmitting messages your box probably can +not handle all connection attempts. +.PP +The plugin also allows one to test against a remote host. This might help to +test against a real world configuration. A connection setup to do stress +testing of a gateway might look like this: +.PP +.EX + charon { + reuse_ikesa = no + threads = 32 + + plugins { + load-tester { + enable = yes + # 10000 connections, ten in parallel + initiators = 10 + iterations = 1000 + # use a delay of 100ms, overall time is: + # iterations * delay = 100s + delay = 100 + # address of the gateway + remote = 1.2.3.4 + # IKE-proposal to use + proposal = aes128-sha1-modp1024 + # use faster PSK authentication instead + # of 1024bit RSA + initiator_auth = psk + responder_auth = psk + # request a virtual IP using configuration + # payloads + request_virtual_ip = yes + # enable CHILD_SA every 60s + child_rekey = 60 + } + } + } +.EE + +.SH IKEv2 RETRANSMISSION +Retransmission timeouts in the IKEv2 daemon charon can be configured globally +using the three keys listed below: +.PP +.RS +.nf +.BR charon.retransmit_base " [1.8]" +.BR charon.retransmit_timeout " [4.0]" +.BR charon.retransmit_tries " [5]" +.fi +.RE +.PP +The following algorithm is used to calculate the timeout: +.PP +.EX + relative timeout = retransmit_timeout * retransmit_base ^ (n-1) +.EE +.PP +Where +.I n +is the current retransmission count. +.PP +Using the default values, packets are retransmitted in: + +.TS +l r r +--- +lB r r. +Retransmission Relative Timeout Absolute Timeout +1 4s 4s +2 7s 11s +3 13s 24s +4 23s 47s +5 42s 89s +giving up 76s 165s +.TE +. +.SH VARIABLES +. +The variables used above are configured as follows: + +.nf +.na +${piddir} @piddir@ +${prefix} @prefix@ +${random_device} @random_device@ +${urandom_device} @urandom_device@ +.ad +.fi +. +.SH FILES +. +.nf +.na +/etc/strongswan.conf configuration file +/etc/strongswan.d/ directory containing included config snippets +/etc/strongswan.d/charon/ plugin specific config snippets +.ad +.fi +. +.SH SEE ALSO +\fBipsec.conf\fR(5), \fBipsec.secrets\fR(5), \fBipsec\fR(8), \fBcharon-cmd\fR(8) + +.SH HISTORY +Written for the +.UR http://www.strongswan.org +strongSwan project +.UE +by Tobias Brunner, Andreas Steffen and Martin Willi. diff --git a/configure.ac b/configure.ac index 10f1e1929..7fe5ee129 100644 --- a/configure.ac +++ b/configure.ac @@ -1,5 +1,5 @@ # -# Copyright (C) 2007-2013 Tobias Brunner +# Copyright (C) 2007-2014 Tobias Brunner # Copyright (C) 2006-2013 Andreas Steffen # Copyright (C) 2006-2013 Martin Willi # Hochschule fuer Technik Rapperswil @@ -302,6 +302,7 @@ AC_PROG_EGREP AC_PROG_AWK AC_PROG_LEX AC_PROG_YACC +AM_PATH_PYTHON(,,[:]) AC_PATH_PROG([PERL], [perl], [], [$PATH:/bin:/usr/bin:/usr/local/bin]) AC_PATH_PROG([GPERF], [gperf], [], [$PATH:/bin:/usr/bin:/usr/local/bin]) @@ -494,6 +495,43 @@ AC_CHECK_FUNC( )] ) +AC_CHECK_FUNC( + [qsort_r], + [ + AC_DEFINE([HAVE_QSORT_R], [], [have qsort_r()]) + # set -Werror so that we get an error for "argument ... has + # incompatible pointer type" warnings + save_CFLAGS="$CFLAGS" + CFLAGS="$CFLAGS -Werror" + AC_MSG_CHECKING([for GNU-style qsort_r]) + AC_COMPILE_IFELSE( + [AC_LANG_PROGRAM( + [[#define _GNU_SOURCE + #include + int cmp (const void *a, const void *b, void *x) { return 0; }]], + [[int arr[] = { 0, 1 }; + qsort_r(arr, 2, sizeof(int), cmp, arr);]])], + [AC_MSG_RESULT([yes]); + AC_DEFINE([HAVE_QSORT_R_GNU], [], [have GNU-style qsort_r()])], + [ + AC_MSG_RESULT([no]); + AC_MSG_CHECKING([for BSD-style qsort_r]) + AC_COMPILE_IFELSE( + [AC_LANG_PROGRAM( + [[#include + int cmp (void *x, const void *a, const void *b) { return 0; }]], + [[int arr[] = { 0, 1 }; + qsort_r(arr, 2, sizeof(int), arr, cmp);]])], + [AC_MSG_RESULT([yes]); + AC_DEFINE([HAVE_QSORT_R_BSD], [], [have BSD-style qsort_r()])], + [AC_MSG_RESULT([no]); + AC_MSG_FAILURE([qsort_r has unknown semantics])]) + ]) + CFLAGS="$save_CFLAGS" + ], + [] +) + AC_CHECK_FUNCS(prctl mallinfo getpass closefrom getpwnam_r getgrnam_r getpwuid_r) AC_CHECK_FUNCS(fmemopen funopen mmap) @@ -1325,12 +1363,32 @@ if test x$ikev2 = xtrue; then AC_DEFINE([USE_IKEV2], [], [support for IKEv2 protocol]) fi +# ==================================================== +# options for enabled modules (see conf/Makefile.am) +# ==================================================== + +strongswan_options= + +AM_COND_IF([USE_ATTR_SQL], [strongswan_options=${strongswan_options}" pool"]) +AM_COND_IF([USE_CHARON], [strongswan_options=${strongswan_options}" charon charon-logging"]) +AM_COND_IF([USE_FILE_CONFIG], [strongswan_options=${strongswan_options}" starter"]) +AM_COND_IF([USE_IMV_ATTESTATION], [strongswan_options=${strongswan_options}" attest"]) +AM_COND_IF([USE_IMCV], [strongswan_options=${strongswan_options}" imcv"]) +AM_COND_IF([USE_IMV_OS], [strongswan_options=${strongswan_options}" pacman"]) +AM_COND_IF([USE_LIBTNCCS], [strongswan_options=${strongswan_options}" tnc"]) +AM_COND_IF([USE_MANAGER], [strongswan_options=${strongswan_options}" manager"]) +AM_COND_IF([USE_MEDSRV], [strongswan_options=${strongswan_options}" medsrv"]) +AM_COND_IF([USE_TOOLS], [strongswan_options=${strongswan_options}" tools"]) + +AC_SUBST(strongswan_options) + # ================= # build Makefiles # ================= AC_CONFIG_FILES([ Makefile + conf/Makefile man/Makefile init/Makefile init/systemd/Makefile @@ -1506,9 +1564,10 @@ AC_CONFIG_FILES([ # ================= AC_CONFIG_FILES([ + conf/strongswan.conf.5.head + conf/strongswan.conf.5.tail man/ipsec.conf.5 man/ipsec.secrets.5 - man/strongswan.conf.5 src/charon-cmd/charon-cmd.8 src/pki/man/pki.1 src/pki/man/pki---gen.1 diff --git a/man/Makefile.am b/man/Makefile.am index 266ef7d3a..fbc78b9ac 100644 --- a/man/Makefile.am +++ b/man/Makefile.am @@ -1,6 +1,5 @@ man_MANS = \ ipsec.conf.5 \ - ipsec.secrets.5 \ - strongswan.conf.5 + ipsec.secrets.5 CLEANFILES = $(man_MANS) diff --git a/man/strongswan.conf.5.in b/man/strongswan.conf.5.in deleted file mode 100644 index 3cfc57e97..000000000 --- a/man/strongswan.conf.5.in +++ /dev/null @@ -1,1773 +0,0 @@ -.TH STRONGSWAN.CONF 5 "2013-10-29" "@PACKAGE_VERSION@" "strongSwan" -.SH NAME -strongswan.conf \- strongSwan configuration file -.SH DESCRIPTION -While the -.IR ipsec.conf (5) -configuration file is well suited to define IPsec related configuration -parameters, it is not useful for other strongSwan applications to read options -from this file. -The file is hard to parse and only -.I ipsec starter -is capable of doing so. As the number of components of the strongSwan project -is continually growing, a more flexible configuration file was needed, one that -is easy to extend and can be used by all components. With strongSwan 4.2.1 -.IR strongswan.conf (5) -was introduced which meets these requirements. - -.SH SYNTAX -The format of the strongswan.conf file consists of hierarchical -.B sections -and a list of -.B key/value pairs -in each section. Each section has a name, followed by C-Style curly brackets -defining the section body. Each section body contains a set of subsections -and key/value pairs: -.PP -.EX - settings := (section|keyvalue)* - section := name { settings } - keyvalue := key = value\\n -.EE -.PP -Values must be terminated by a newline. -.PP -Comments are possible using the \fB#\fP-character, but be careful: The parser -implementation is currently limited and does not like brackets in comments. -.PP -Section names and keys may contain any printable character except: -.PP -.EX - . { } # \\n \\t space -.EE -.PP -An example file in this format might look like this: -.PP -.EX - a = b - section-one { - somevalue = asdf - subsection { - othervalue = xxx - } - # yei, a comment - yetanother = zz - } - section-two { - x = 12 - } -.EE -.PP -Indentation is optional, you may use tabs or spaces. - -.SH INCLUDING FILES -Using the -.B include -statement it is possible to include other files into strongswan.conf, e.g. -.PP -.EX - include /some/path/*.conf -.EE -.PP -If the file name is not an absolute path, it is considered to be relative -to the directory of the file containing the include statement. The file name -may include shell wildcards (see -.IR sh (1)). -Also, such inclusions can be nested. -.PP -Sections loaded from included files -.I extend -previously loaded sections; already existing values are -.IR replaced . -It is important to note that settings are added relative to the section the -include statement is in. -.PP -As an example, the following three files result in the same final -config as the one given above: -.PP -.EX - a = b - section-one { - somevalue = before include - include include.conf - } - include other.conf - -include.conf: - # settings loaded from this file are added to section-one - # the following replaces the previous value - somevalue = asdf - subsection { - othervalue = yyy - } - yetanother = zz - -other.conf: - # this extends section-one and subsection - section-one { - subsection { - # this replaces the previous value - othervalue = xxx - } - } - section-two { - x = 12 - } -.EE - -.SH READING VALUES -Values are accessed using a dot-separated section list and a key. -With reference to the example above, accessing -.B section-one.subsection.othervalue -will return -.BR xxx . - -.SH DEFINED KEYS -The following keys are currently defined (using dot notation). The default -value (if any) is listed in brackets after the key. - -.SS attest section -.TP -.BR attest.database -Path to database with file measurement information -.TP -.BR attest.load -Plugins to load in ipsec attest tool - -.SS charon section -.TP -.BR Note : -Many of these options also apply to \fBcharon\-cmd\fR and other -\fBcharon\fR derivatives. Just use their respective name (e.g. -\fIcharon\-cmd\fR) instead of \fIcharon\fR. -.TP -.BR charon.block_threshold " [5]" -Maximum number of half-open IKE_SAs for a single peer IP -.TP -.BR charon.cisco_unity " [no] -Send Cisco Unity vendor ID payload (IKEv1 only) -.TP -.BR charon.close_ike_on_child_failure " [no]" -Close the IKE_SA if setup of the CHILD_SA along with IKE_AUTH failed -.TP -.BR charon.cookie_threshold " [10]" -Number of half-open IKE_SAs that activate the cookie mechanism -.TP -.BR charon.dns1 -.TQ -.BR charon.dns2 -DNS servers assigned to peer via configuration payload (CP) -.TP -.BR charon.dos_protection " [yes]" -Enable Denial of Service protection using cookies and aggressiveness checks -.TP -.BR charon.filelog -Section to define file loggers, see LOGGER CONFIGURATION -.TP -.BR charon.flush_auth_cfg " [no]" -If enabled objects used during authentication (certificates, identities etc.) -are released to free memory once an IKE_SA is established. -Enabling this might conflict with plugins that later need access to e.g. the -used certificates. -.TP -.BR charon.fragment_size " [512]" -Maximum size (in bytes) of a sent fragment when using the proprietary IKEv1 -fragmentation extension. -.TP -.BR charon.group -Name of the group the daemon changes to after startup -.TP -.BR charon.half_open_timeout " [30]" -Timeout in seconds for connecting IKE_SAs (also see IKE_SA_INIT DROPPING). -.TP -.BR charon.hash_and_url " [no]" -Enable hash and URL support -.TP -.BR charon.i_dont_care_about_security_and_use_aggressive_mode_psk " [no]" -If enabled responders are allowed to use IKEv1 Aggressive Mode with pre-shared -keys, which is discouraged due to security concerns (offline attacks on the -openly transmitted hash of the PSK) -.TP -.BR charon.ignore_routing_tables -A space-separated list of routing tables to be excluded from route lookups -.TP -.BR charon.ikesa_limit " [0]" -Maximum number of IKE_SAs that can be established at the same time before new -connection attempts are blocked -.TP -.BR charon.ikesa_table_segments " [1]" -Number of exclusively locked segments in the hash table -.TP -.BR charon.ikesa_table_size " [1]" -Size of the IKE_SA hash table -.TP -.BR charon.inactivity_close_ike " [no]" -Whether to close IKE_SA if the only CHILD_SA closed due to inactivity -.TP -.BR charon.init_limit_half_open " [0]" -Limit new connections based on the current number of half open IKE_SAs (see -IKE_SA_INIT DROPPING). -.TP -.BR charon.init_limit_job_load " [0]" -Limit new connections based on the number of jobs currently queued for -processing (see IKE_SA_INIT DROPPING). -.TP -.BR charon.initiator_only " [no]" -Causes charon daemon to ignore IKE initiation requests. -.TP -.BR charon.install_routes " [yes]" -Install routes into a separate routing table for established IPsec tunnels -.TP -.BR charon.install_virtual_ip " [yes]" -Install virtual IP addresses -.TP -.BR charon.install_virtual_ip_on -The name of the interface on which virtual IP addresses should be installed. -If not specified the addresses will be installed on the outbound interface. -.TP -.BR charon.interfaces_ignore -A comma-separated list of network interfaces that should be ignored, if -.B charon.interfaces_use -is specified this option has no effect. -.TP -.BR charon.interfaces_use -A comma-separated list of network interfaces that should be used by charon. -All other interfaces are ignored. -.TP -.BR charon.keep_alive " [20s]" -NAT keep alive interval -.TP -.BR charon.load -Plugins to load in the IKEv2 daemon charon -.TP -.BR charon.max_packet " [10000]" -Maximum packet size accepted by charon -.TP -.BR charon.multiple_authentication " [yes]" -Enable multiple authentication exchanges (RFC 4739) -.TP -.BR charon.nbns1 -.TQ -.BR charon.nbns2 -WINS servers assigned to peer via configuration payload (CP) -.TP -.BR charon.port " [500]" -UDP port used locally. If set to 0 a random port will be allocated. -.TP -.BR charon.port_nat_t " [4500]" -UDP port used locally in case of NAT-T. If set to 0 a random port will be -allocated. Has to be different from -.BR charon.port , -otherwise a random port will be allocated. -.TP -.BR charon.process_route " [yes]" -Process RTM_NEWROUTE and RTM_DELROUTE events -.TP -.BR charon.receive_delay " [0]" -Delay in ms for receiving packets, to simulate larger RTT -.TP -.BR charon.receive_delay_response " [yes]" -Delay response messages -.TP -.BR charon.receive_delay_request " [yes]" -Delay request messages -.TP -.BR charon.receive_delay_type " [0]" -Specific IKEv2 message type to delay, 0 for any -.TP -.BR charon.replay_window " [32]" -Size of the AH/ESP replay window, in packets. -.TP -.BR charon.retransmit_base " [1.8]" -Base to use for calculating exponential back off, see IKEv2 RETRANSMISSION -.TP -.BR charon.retransmit_timeout " [4.0] -Timeout in seconds before sending first retransmit -.TP -.BR charon.retransmit_tries " [5]" -Number of times to retransmit a packet before giving up -.TP -.BR charon.retry_initiate_interval " [0]" -Interval to use when retrying to initiate an IKE_SA (e.g. if DNS resolution -failed), 0 to disable retries. -.TP -.BR charon.reuse_ikesa " [yes] -Initiate CHILD_SA within existing IKE_SAs -.TP -.BR charon.routing_table -Numerical routing table to install routes to -.TP -.BR charon.routing_table_prio -Priority of the routing table -.TP -.BR charon.send_delay " [0]" -Delay in ms for sending packets, to simulate larger RTT -.TP -.BR charon.send_delay_response " [yes]" -Delay response messages -.TP -.BR charon.send_delay_request " [yes]" -Delay request messages -.TP -.BR charon.send_delay_type " [0]" -Specific IKEv2 message type to delay, 0 for any -.TP -.BR charon.send_vendor_id " [no] -Send strongSwan vendor ID payload -.TP -.BR charon.syslog -Section to define syslog loggers, see LOGGER CONFIGURATION -.TP -.BR charon.threads " [16]" -Number of worker threads in charon. Several of these are reserved for long -running tasks in internal modules and plugins. Therefore, make sure you don't -set this value too low. The number of idle worker threads listed in -.I ipsec statusall -might be used as indicator on the number of reserved threads. -.TP -.BR charon.user -Name of the user the daemon changes to after startup -.SS charon.plugins subsection -.TP -.BR charon.plugins.android_log.loglevel " [1]" -Loglevel for logging to Android specific logger -.TP -.BR charon.plugins.attr -Section to specify arbitrary attributes that are assigned to a peer via -configuration payload (CP) -.TP -.BR charon.plugins.certexpire.csv.cron -Cron style string specifying CSV export times -.TP -.BR charon.plugins.certexpire.csv.empty_string -String to use in empty intermediate CA fields -.TP -.BR charon.plugins.certexpire.csv.fixed_fields " [yes]" -Use a fixed intermediate CA field count -.TP -.BR charon.plugins.certexpire.csv.force " [yes]" -Force export of all trustchains we have a private key for -.TP -.BR charon.plugins.certexpire.csv.format " [%d:%m:%Y]" -strftime(3) format string to export expiration dates as -.TP -.BR charon.plugins.certexpire.csv.local -strftime(3) format string for the CSV file name to export local certificates to -.TP -.BR charon.plugins.certexpire.csv.remote -strftime(3) format string for the CSV file name to export remote certificates to -.TP -.BR charon.plugins.certexpire.csv.separator " [,]" -CSV field separator -.TP -.BR charon.plugins.coupling.file -File to store coupling list to -.TP -.BR charon.plugins.coupling.hash " [sha1]" -Hashing algorithm to fingerprint coupled certificates -.TP -.BR charon.plugins.coupling.max " [1]" -Maximum number of coupling entries to create -.TP -.BR charon.plugins.dhcp.force_server_address " [no]" -Always use the configured server address. This might be helpful if the DHCP -server runs on the same host as strongSwan, and the DHCP daemon does not listen -on the loopback interface. In that case the server cannot be reached via -unicast (or even 255.255.255.255) as that would be routed via loopback. -Setting this option to yes and configuring the local broadcast address (e.g. -192.168.0.255) as server address might work. -.TP -.BR charon.plugins.dhcp.identity_lease " [no]" -Derive user-defined MAC address from hash of IKEv2 identity -.TP -.BR charon.plugins.dhcp.server " [255.255.255.255]" -DHCP server unicast or broadcast IP address -.TP -.BR charon.plugins.dhcp.interface " []" -Interface name the plugin uses for address allocation. The default is to bind -to any (0.0.0.0) and let the system decide which way to route the packets to -the DHCP server. -.TP -.BR charon.plugins.dnscert.enable " [no]" -Enable fetching of CERT RRs via DNS -.TP -.BR charon.plugins.duplicheck.enable " [yes]" -Enable duplicheck plugin (if loaded) -.TP -.BR charon.plugins.duplicheck.socket " [unix://@piddir@/charon.dck]" -Socket provided by the duplicheck plugin -.TP -.BR charon.plugins.eap-aka.request_identity " [yes]" - -.TP -.BR charon.plugins.eap-aka-3ggp2.seq_check - -.TP -.BR charon.plugins.eap-dynamic.preferred -The preferred EAP method(s) to be used. If it is not given the first -registered method will be used initially. If a comma separated list is given -the methods are tried in the given order before trying the rest of the -registered methods. -.TP -.BR charon.plugins.eap-dynamic.prefer_user " [no]" -If enabled the EAP methods proposed in an EAP-Nak message sent by the peer are -preferred over the methods registered locally. -.TP -.BR charon.plugins.eap-gtc.backend " [pam]" -XAuth backend to be used for credential verification -.TP -.BR charon.plugins.eap-peap.fragment_size " [1024]" -Maximum size of an EAP-PEAP packet -.TP -.BR charon.plugins.eap-peap.max_message_count " [32]" -Maximum number of processed EAP-PEAP packets (0 = no limit) -.TP -.BR charon.plugins.eap-peap.include_length " [no]" -Include length in non-fragmented EAP-PEAP packets -.TP -.BR charon.plugins.eap-peap.phase2_method " [mschapv2]" -Phase2 EAP client authentication method -.TP -.BR charon.plugins.eap-peap.phase2_piggyback " [no]" -Phase2 EAP Identity request piggybacked by server onto TLS Finished message -.TP -.BR charon.plugins.eap-peap.phase2_tnc " [no]" -Start phase2 EAP TNC protocol after successful client authentication -.TP -.BR charon.plugins.eap-peap.request_peer_auth " [no]" -Request peer authentication based on a client certificate -.TP -.BR charon.plugins.eap-radius.accounting " [no]" -Send RADIUS accounting information to RADIUS servers. -.TP -.BR charon.plugins.eap-radius.accounting_requires_vip " [no]" -If enabled, accounting is disabled unless an IKE_SA has at least one virtual IP -.TP -.BR charon.plugins.eap-radius.class_group " [no]" -Use the -.I class -attribute sent in the RADIUS-Accept message as group membership information that -is compared to the groups specified in the -.B rightgroups -option in -.B ipsec.conf (5). -.TP -.BR charon.plugins.eap-radius.close_all_on_timeout " [no]" -Closes all IKE_SAs if communication with the RADIUS server times out. If it is -not set only the current IKE_SA is closed. -.TP -.BR charon.plugins.eap-radius.dae.enable " [no]" -Enables support for the Dynamic Authorization Extension (RFC 5176) -.TP -.BR charon.plugins.eap-radius.dae.listen " [0.0.0.0]" -Address to listen for DAE messages from the RADIUS server -.TP -.BR charon.plugins.eap-radius.dae.port " [3799]" -Port to listen for DAE requests -.TP -.BR charon.plugins.eap-radius.dae.secret -Shared secret used to verify/sign DAE messages -.TP -.BR charon.plugins.eap-radius.eap_start " [no]" -Send EAP-Start instead of EAP-Identity to start RADIUS conversation -.TP -.BR charon.plugins.eap-radius.filter_id " [no]" -If the RADIUS -.I tunnel_type -attribute with value -.B ESP -is received, use the -.I filter_id -attribute sent in the RADIUS-Accept message as group membership information that -is compared to the groups specified in the -.B rightgroups -option in -.B ipsec.conf (5). -.TP -.BR charon.plugins.eap-radius.forward.ike_to_radius -RADIUS attributes to be forwarded from IKEv2 to RADIUS (can be defined by -name or attribute number, a colon can be used to specify vendor-specific -attributes, e.g. Reply-Message, or 11, or 36906:12). -.TP -.BR charon.plugins.eap-radius.forward.radius_to_ike -Same as -.B charon.plugins.eap-radius.forward.ike_to_radius -but from RADIUS to -IKEv2, a strongSwan specific private notify (40969) is used to transmit the -attributes. -.TP -.BR charon.plugins.eap-radius.id_prefix -Prefix to EAP-Identity, some AAA servers use a IMSI prefix to select the -EAP method -.TP -.BR charon.plugins.eap-radius.nas_identifier " [strongSwan]" -NAS-Identifier to include in RADIUS messages -.TP -.BR charon.plugins.eap-radius.port " [1812]" -Port of RADIUS server (authentication) -.TP -.BR charon.plugins.eap-radius.secret -Shared secret between RADIUS and NAS -.TP -.BR charon.plugins.eap-radius.server -IP/Hostname of RADIUS server -.TP -.BR charon.plugins.eap-radius.servers -Section to specify multiple RADIUS servers. The -.BR nas_identifier , -.BR secret , -.B sockets -and -.B port -(or -.BR auth_port ) -options can be specified for each server. A server's IP/Hostname can be -configured using the -.B address -option. The -.BR acct_port " [1813]" -option can be used to specify the port used for RADIUS accounting. -For each RADIUS server a priority can be specified using the -.BR preference " [0]" -option. -.TP -.BR charon.plugins.eap-radius.sockets " [1]" -Number of sockets (ports) to use, increase for high load -.TP -.BR charon.plugins.eap-radius.xauth -Section to configure multiple XAuth authentication rounds via RADIUS. The subsections define so called -authentication profiles with arbitrary names. In each profile section one or more XAuth types can be -configured, with an assigned message. For each type a separate XAuth exchange will be initiated and all -replies get concatenated into the User-Password attribute, which then gets verified over RADIUS. - -Available XAuth types are \fBpassword\fR, \fBpasscode\fR, \fBnextpin\fR, and \fBanswer\fR. This type is -not relevant to strongSwan or the AAA server, but the client may show a different dialog (along with the -configured message). - -To use the configured profiles, they have to be configured in the respective connection in -.IR ipsec.conf (5) -by appending the profile name, separated by a colon, to the -.B xauth-radius -XAauth backend configuration in -.I rightauth -or -.IR rightauth2 , -for instance, -.IR rightauth2=xauth-radius:profile . -.TP -.BR charon.plugins.eap-sim.request_identity " [yes]" - -.TP -.BR charon.plugins.eap-simaka-sql.database - -.TP -.BR charon.plugins.eap-simaka-sql.remove_used " [no]" - -.TP -.BR charon.plugins.eap-tls.fragment_size " [1024]" -Maximum size of an EAP-TLS packet -.TP -.BR charon.plugins.eap-tls.max_message_count " [32]" -Maximum number of processed EAP-TLS packets (0 = no limit) -.TP -.BR charon.plugins.eap-tls.include_length " [yes]" -Include length in non-fragmented EAP-TLS packets -.TP -.BR charon.plugins.eap-tnc.max_message_count " [10]" -Maximum number of processed EAP-TNC packets (0 = no limit) -.TP -.BR charon.plugins.eap-tnc.protocol " [tnccs-1.1]" -IF-TNCCS protocol version to be used (tnccs-1.1, tnccs-2.0, tnccs-dynamic) -.TP -.BR charon.plugins.eap-ttls.fragment_size " [1024]" -Maximum size of an EAP-TTLS packet -.TP -.BR charon.plugins.eap-ttls.max_message_count " [32]" -Maximum number of processed EAP-TTLS packets (0 = no limit) -.TP -.BR charon.plugins.eap-ttls.include_length " [yes]" -Include length in non-fragmented EAP-TTLS packets -.TP -.BR charon.plugins.eap-ttls.phase2_method " [md5]" -Phase2 EAP client authentication method -.TP -.BR charon.plugins.eap-ttls.phase2_piggyback " [no]" -Phase2 EAP Identity request piggybacked by server onto TLS Finished message -.TP -.BR charon.plugins.eap-ttls.phase2_tnc " [no]" -Start phase2 EAP TNC protocol after successful client authentication -.TP -.BR charon.plugins.eap-ttls.request_peer_auth " [no]" -Request peer authentication based on a client certificate -.TP -.BR charon.plugins.error-notify.socket " [unix://@piddir@/charon.enfy]" -Socket provided by the error-notify plugin -.TP -.BR charon.plugins.ha.autobalance " [0]" -Interval in seconds to automatically balance handled segments between nodes. -Set to 0 to disable. -.TP -.BR charon.plugins.ha.fifo_interface " [yes]" - -.TP -.BR charon.plugins.ha.heartbeat_delay " [1000]" - -.TP -.BR charon.plugins.ha.heartbeat_timeout " [2100]" - -.TP -.BR charon.plugins.ha.local - -.TP -.BR charon.plugins.ha.monitor " [yes]" - -.TP -.BR charon.plugins.ha.pools - -.TP -.BR charon.plugins.ha.remote - -.TP -.BR charon.plugins.ha.resync " [yes]" - -.TP -.BR charon.plugins.ha.secret - -.TP -.BR charon.plugins.ha.segment_count " [1]" - -.TP -.BR charon.plugins.ipseckey.enable " [no]" -Enable fetching of IPSECKEY RRs via DNS -.TP -.BR charon.plugins.led.activity_led - -.TP -.BR charon.plugins.led.blink_time " [50]" - -.TP -.BR charon.plugins.kernel-klips.ipsec_dev_count " [4]" -Number of ipsecN devices -.TP -.BR charon.plugins.kernel-klips.ipsec_dev_mtu " [0]" -Set MTU of ipsecN device -.TP -.BR charon.plugins.kernel-libipsec.allow_peer_ts " [no]" -Allow that the remote traffic selector equals the IKE peer. The route installed -for such traffic (via TUN device) usually prevents further IKE traffic. The -fwmark options for the \fIkernel-netlink\fR and \fIsocket-default\fR plugins can -be used to circumvent that problem. -.TP -.BR charon.plugins.kernel-netlink.fwmark -Firewall mark to set on the routing rule that directs traffic to our own routing -table. The format is [!]mark[/mask], where the optional exclamation mark inverts -the meaning (i.e. the rule only applies to packets that don't match the mark). -.TP -.BR charon.plugins.kernel-netlink.roam_events " [yes]" -Whether to trigger roam events when interfaces, addresses or routes change -.TP -.BR charon.plugins.kernel-netlink.xfrm_acq_expires " [165]" -Lifetime of XFRM acquire state in kernel. The value gets written to -/proc/sys/net/core/xfrm_acq_expires. Indirectly controls the delay of XFRM -acquire messages sent. -.TP -.BR charon.plugins.kernel-pfroute.vip_wait " [1000]" -Time in ms to wait until virtual IP addresses appear/disappear before failing. -.TP -.BR charon.plugins.load-tester -Section to configure the load-tester plugin, see LOAD TESTS -.TP -.BR charon.plugins.lookip.socket " [unix://@piddir@/charon.lkp]" -Socket provided by the lookip plugin -.TP -.BR charon.plugins.radattr.dir -Directory where RADIUS attributes are stored in client-ID specific files. -.TP -.BR charon.plugins.radattr.message_id " [-1]" -Attributes are added to all IKE_AUTH messages by default (-1), or only to the -IKE_AUTH message with the given IKEv2 message ID. -.TP -.BR charon.plugins.resolve.file " [/etc/resolv.conf]" -File where to add DNS server entries -.TP -.BR charon.plugins.resolve.resolvconf.iface_prefix " [lo.inet.ipsec.]" -Prefix used for interface names sent to resolvconf(8). The nameserver address -is appended to this prefix to make it unique. The result has to be a valid -interface name according to the rules defined by resolvconf. Also, it should -have a high priority according to the order defined in interface-order(5). -.TP -.BR charon.plugins.socket-default.fwmark -Firewall mark to set on outbound packets. -.TP -.BR charon.plugins.socket-default.set_source " [yes]" -Set source address on outbound packets, if possible. -.TP -.BR charon.plugins.socket-default.use_ipv4 " [yes]" -Listen on IPv4, if possible. -.TP -.BR charon.plugins.socket-default.use_ipv6 " [yes]" -Listen on IPv6, if possible. -.TP -.BR charon.plugins.sql.database -Database URI for charons SQL plugin -.TP -.BR charon.plugins.sql.loglevel " [-1]" -Loglevel for logging to SQL database -.TP -.BR charon.plugins.stroke.ignore_missing_ca_basic_constraint " [no]" -Treat certificates in ipsec.d/cacerts and ipsec.conf ca sections as CA -certificates even if they don't contain a CA basic constraint. -.TP -.BR charon.plugins.stroke.max_concurrent " [4]" -Maximum number of stroke messages handled concurrently -.TP -.BR charon.plugins.stroke.prevent_loglevel_changes " [no]" -If enabled log level changes via stroke socket are not allowed. -.TP -.BR charon.plugins.stroke.socket " [unix://@piddir@/charon.ctl]" -Socket provided by the stroke plugin -.TP -.BR charon.plugins.stroke.timeout " [0]" -Timeout in ms for any stroke command. Use 0 to disable the timeout -.TP -.BR charon.plugins.systime-fix.interval " [0]" -Interval in seconds to check system time for validity. 0 disables the check -.TP -.BR charon.plugins.systime-fix.reauth " [no]" -Whether to use reauth or delete if an invalid cert lifetime is detected -.TP -.BR charon.plugins.systime-fix.threshold -Threshold date where system time is considered valid. Disabled if not specified -.TP -.BR charon.plugins.systime-fix.threshold_format " [%Y]" -strptime(3) format used to parse threshold option -.TP -.BR charon.plugins.tnc-ifmap.client_cert -Path to X.509 certificate file of IF-MAP client -.TP -.BR charon.plugins.tnc-ifmap.client_key -Path to private key file of IF-MAP client -.TP -.BR charon.plugins.tnc-ifmap.device_name -Unique name of strongSwan server as a PEP and/or PDP device -.TP -.BR charon.plugins.tnc-ifmap.renew_session_interval " [150]" -Interval in seconds between periodic IF-MAP RenewSession requests -.TP -.BR charon.plugins.tnc-ifmap.server_uri " [https://localhost:8444/imap]" -URI of the form [https://]servername[:port][/path] -.TP -.BR charon.plugins.tnc-ifmap.server_cert -Path to X.509 certificate file of IF-MAP server -.TP -.BR charon.plugins.tnc-ifmap.username_password -Credentials of IF-MAP client of the form username:password -.TP -.BR charon.plugins.tnc-pdp.pt_tls.enable " [yes]" -Enable PT-TLS protocol on the strongSwan PDP -.TP -.BR charon.plugins.tnc-pdp.pt_tls.port " [271]" -PT-TLS server port the strongSwan PDP is listening on -.TP -.BR charon.plugins.tnc-pdp.radius.enable " [yes]" -Enable RADIUS protocol on the strongSwan PDP -.TP -.BR charon.plugins.tnc-pdp.radius.method " [ttls]" -EAP tunnel method to be used -.TP -.BR charon.plugins.tnc-pdp.radius.port " [1812]" -RADIUS server port the strongSwan PDP is listening on -.TP -.BR charon.plugins.tnc-pdp.radius.secret -Shared RADIUS secret between strongSwan PDP and NAS -.TP -.BR charon.plugins.tnc-pdp.server -Name of the strongSwan PDP as contained in the AAA certificate -.TP -.BR charon.plugins.tnc-pdp.timeout -Timeout in seconds before closing incomplete connections -.TP -.BR charon.plugins.updown.dns_handler " [no]" -Whether the updown script should handle DNS serves assigned via IKEv1 Mode -Config or IKEv2 Config Payloads (if enabled they can't be handled by other -plugins, like resolve) -.TP -.BR charon.plugins.whitelist.enable " [yes]" -Enable loaded whitelist plugin -.TP -.BR charon.plugins.whitelist.socket " [unix://@piddir@/charon.wlst]" -Socket provided by the whitelist plugin -.TP -.BR charon.plugins.xauth-eap.backend " [radius]" -EAP plugin to be used as backend for XAuth credential verification -.TP -.BR charon.plugins.xauth-pam.pam_service " [login]" -PAM service to be used for authentication -.TP -.BR charon.plugins.xauth-pam.session " [no]" -Open/close a PAM session for each active IKE_SA -.TP -.BR charon.plugins.xauth-pam.trim_email " [yes]" -If an email address is given as an XAuth username, trim it to just the -username part. -.SS libstrongswan section -.TP -.BR libstrongswan.cert_cache " [yes]" -Whether relations in validated certificate chains should be cached in memory -.TP -.BR libstrongswan.crypto_test.bench " [no]" - -.TP -.BR libstrongswan.crypto_test.bench_size " [1024]" - -.TP -.BR libstrongswan.crypto_test.bench_time " [50]" - -.TP -.BR libstrongswan.crypto_test.on_add " [no]" -Test crypto algorithms during registration -.TP -.BR libstrongswan.crypto_test.on_create " [no]" -Test crypto algorithms on each crypto primitive instantiation -.TP -.BR libstrongswan.crypto_test.required " [no]" -Strictly require at least one test vector to enable an algorithm -.TP -.BR libstrongswan.crypto_test.rng_true " [no]" -Whether to test RNG with TRUE quality; requires a lot of entropy -.TP -.BR libstrongswan.dh_exponent_ansi_x9_42 " [yes]" -Use ANSI X9.42 DH exponent size or optimum size matched to cryptographical -strength -.TP -.BR libstrongswan.ecp_x_coordinate_only " [yes]" -Compliance with the errata for RFC 4753 -.TP -.BR libstrongswan.host_resolver.max_threads " [3]" -Maximum number of concurrent resolver threads (they are terminated if unused) -.TP -.BR libstrongswan.host_resolver.min_threads " [0]" -Minimum number of resolver threads to keep around -.TP -.BR libstrongswan.integrity_test " [no]" -Check daemon, libstrongswan and plugin integrity at startup -.TP -.BR libstrongswan.leak_detective.detailed " [yes]" -Includes source file names and line numbers in leak detective output -.TP -.BR libstrongswan.leak_detective.usage_threshold " [10240]" -Threshold in bytes for leaks to be reported (0 to report all) -.TP -.BR libstrongswan.leak_detective.usage_threshold_count " [0]" -Threshold in number of allocations for leaks to be reported (0 to report all) -.TP -.BR libstrongswan.processor.priority_threads -Subsection to configure the number of reserved threads per priority class -see JOB PRIORITY MANAGEMENT -.TP -.BR libstrongswan.x509.enforce_critical " [yes]" -Discard certificates with unsupported or unknown critical extensions -.SS libstrongswan.plugins subsection -.TP -.BR libstrongswan.plugins.attr-sql.database -Database URI for attr-sql plugin used by charon -.TP -.BR libstrongswan.plugins.attr-sql.lease_history " [yes]" -Enable logging of SQL IP pool leases -.TP -.BR libstrongswan.plugins.gcrypt.quick_random " [no]" -Use faster random numbers in gcrypt; for testing only, produces weak keys! -.TP -.BR libstrongswan.plugins.ntru.max_drbg_requests " [4294967294]" -Number of pseudo-random bit requests from the DRBG before an automatic -reseeding occurs. -.TP -.BR libstrongswan.plugins.ntru.parameter_set " [optimum]" -The following parameter sets are available: -.BR x9_98_speed , -.BR x9_98_bandwidth , -.B x9_98_balance -and -.BR optimum , -the last set not being part of the X9.98 standard but having the best performance. -.TP -.BR libstrongswan.plugins.openssl.engine_id " [pkcs11]" -ENGINE ID to use in the OpenSSL plugin -.TP -.BR libstrongswan.plugins.openssl.fips_mode " [0]" -Set OpenSSL FIPS mode: disabled(0), enabled(1), Suite B enabled(2) -.TP -.BR libstrongswan.plugins.pkcs11.modules -List of available PKCS#11 modules -.TP -.BR libstrongswan.plugins.pkcs11.load_certs " [yes]" -Whether to load certificates from tokens -.TP -.BR libstrongswan.plugins.pkcs11.reload_certs " [no]" -Reload certificates from all tokens if charon receives a SIGHUP -.TP -.BR libstrongswan.plugins.pkcs11.use_dh " [no]" -Whether the PKCS#11 modules should be used for DH and ECDH (see use_ecc option) -.TP -.BR libstrongswan.plugins.pkcs11.use_ecc " [no]" -Whether the PKCS#11 modules should be used for ECDH and ECDSA public key -operations. ECDSA private keys can be used regardless of this option -.TP -.BR libstrongswan.plugins.pkcs11.use_hasher " [no]" -Whether the PKCS#11 modules should be used to hash data -.TP -.BR libstrongswan.plugins.pkcs11.use_pubkey " [no]" -Whether the PKCS#11 modules should be used for public key operations, even for -keys not stored on tokens -.TP -.BR libstrongswan.plugins.pkcs11.use_rng " [no]" -Whether the PKCS#11 modules should be used as RNG -.TP -.BR libstrongswan.plugins.random.random " [@random_device@]" -File to read random bytes from, instead of @random_device@ -.TP -.BR libstrongswan.plugins.random.urandom " [@urandom_device@]" -File to read pseudo random bytes from, instead of @urandom_device@ -.TP -.BR libstrongswan.plugins.random.strong_equals_true " [no]" -If set to yes the RNG_STRONG class reads random bytes from the same source as -the RNG_TRUE class. -.TP -.BR libstrongswan.plugins.unbound.resolv_conf " [/etc/resolv.conf]" -File to read DNS resolver configuration from -.TP -.BR libstrongswan.plugins.unbound.trust_anchors " [/etc/ipsec.d/dnssec.keys]" -File to read DNSSEC trust anchors from (usually root zone KSK). The format of -the file is the standard DNS Zone file format, anchors can be stored as DS or -DNSKEY entries in the file. -.TP -.BR libstrongswan.plugins.unbound.dlv_anchors -File to read trusted keys for DLV (DNSSEC Lookaside Validation) from. It uses -the same format as \fItrust_anchors\fR. Only one DLV can be configured, which -is then used as a root trusted DLV, this means that it is a lookaside for -the root. -.SS libtls section -.TP -.BR libtls.cipher -List of TLS encryption ciphers -.TP -.BR libtls.key_exchange -List of TLS key exchange methods -.TP -.BR libtls.mac -List of TLS MAC algorithms -.TP -.BR libtls.suites -List of TLS cipher suites -.SS libtnccs section -.TP -.BR libtnccs.tnc_config " [/etc/tnc_config]" -TNC IMC/IMV configuration directory -.PP -.SS libtnccs plugins section -.TP -.BR libtnccs.plugins.tnccs-11.max_message_size " [45000]" -Maximum size of a PA-TNC message (XML & Base64 encoding) -.TP -.BR libtnccs.plugins.tnccs-20.max_batch_size " [65522]" -Maximum size of a PB-TNC batch (upper limit via PT-EAP = 65529) -.TP -.BR libtnccs.plugins.tnccs-20.max_message_size " [65490]" -Maximum size of a PA-TNC message (upper limit via PT-EAP = 65497) -.TP -.BR libtnccs.plugins.tnc-imc.dlclose " [yes]" -Unload IMC after use -.TP -.BR libtnccs.plugins.tnc-imc.preferred_language " [en]" -Preferred language for TNC recommendations -.TP -.BR libtnccs.plugins.tnc-imv.dlclose " [yes]" -Unload IMV after use -.SS libimcv section -.TP -.BR libimcv.assessment_result " [yes]" -Whether IMVs send a standard IETF Assessment Result attribute -.TP -.BR libimcv.database -Global IMV policy database URI -.TP -.BR libimcv.debug_level " [1]" -Debug level for a stand-alone libimcv library -.TP -.BR libimcv.load " [random nonce gmp pubkey x509]" -Plugins to load in IMC/IMVs -.TP -.BR libimcv.os_info.name -Manually set the name of the client OS (e.g. Ubuntu) -.TP -.BR libimcv.os_info.version -Manually set the version of the client OS (e.g. 12.04 i686) -.TP -.BR libimcv.policy_script " [ipsec _imv_policy]" -Script called for each TNC connection to generate IMV policies -.TP -.BR libimcv.stderr_quiet " [no]" -isable output to stderr with a stand-alone libimcv library -.PP -.SS libimcv plugins section -.TP -.BR libimcv.plugins.imc-attestation.aik_blob -AIK encrypted private key blob file -.TP -.BR libimcv.plugins.imc-attestation.aik_cert -AIK certificate file -.TP -.BR libimcv.plugins.imc-attestation.aik_key -AIK public key file -.TP -.BR libimcv.plugins.imv-attestation.nonce_len " [20]" -DH nonce length -.TP -.BR libimcv.plugins.imv-attestation.use_quote2 " [yes]" -Use Quote2 AIK signature instead of Quote signature -.TP -.BR libimcv.plugins.imv-attestation.cadir -Path to directory with AIK cacerts -.TP -.BR libimcv.plugins.imv-attestation.dh_group " [ecp256]" -Preferred Diffie-Hellman group -.TP -.BR libimcv.plugins.imv-attestation.hash_algorithm " [sha256]" -Preferred measurement hash algorithm -.TP -.BR libimcv.plugins.imv-attestation.min_nonce_len " [0]" -DH minimum nonce length -.TP -.BR libimcv.plugins.imv-attestation.remediation_uri -URI pointing to attestation remediation instructions -.TP -.BR libimcv.plugins.imc-os.push_info " [yes]" -Send operating system info without being prompted -.TP -.BR libimcv.plugins.imv-os.remediation_uri -URI pointing to operating system remediation instructions -.TP -.BR libimcv.plugins.imc-scanner.push_info " [yes]" -Send open listening ports without being prompted -.TP -.BR libimcv.plugins.imv-scanner.remediation_uri -URI pointing to scanner remediation instructions -.TP -.BR libimcv.plugins.imc-swid.swid_directory " [@prefix@/share]" -Directory where SWID tags are located -.TP -.BR libimcv.plugins.imc-test.additional_ids " [0]" -Number of additional IMC IDs -.TP -.BR libimcv.plugins.imc-test.command " [none]" -Command to be sent to the Test IMV -.TP -.BR libimcv.plugins.imc-test.dummy_size " [0]" -Size of dummy attribute to be sent to the Test IMV (0 = disabled) -.TP -.BR libimcv.plugins.imv-test.remediation_uri -URI pointing to test remediation instructions -.TP -.BR libimcv.plugins.imc-test.retry " [no]" -Do a handshake retry -.TP -.BR libimcv.plugins.imc-test.retry_command -Command to be sent to the Test IMV in the handshake retry -.TP -.BR libimcv.plugins.imv-test.rounds " [0]" -Number of IMC-IMV retry rounds -.SS manager section -.TP -.BR manager.database -Credential database URI for manager -.TP -.BR manager.debug " [no]" -Enable debugging in manager -.TP -.BR manager.load -Plugins to load in manager -.TP -.BR manager.socket -FastCGI socket of manager, to run it statically -.TP -.BR manager.threads " [10]" -Threads to use for request handling -.TP -.BR manager.timeout " [15m]" -Session timeout for manager -.SS mediation client section -.TP -.BR medcli.database -Mediation client database URI -.TP -.BR medcli.dpd " [5m]" -DPD timeout to use in mediation client plugin -.TP -.BR medcli.rekey " [20m]" -Rekeying time on mediation connections in mediation client plugin -.SS mediation server section -.TP -.BR medsrv.database -Mediation server database URI -.TP -.BR medsrv.debug " [no]" -Debugging in mediation server web application -.TP -.BR medsrv.dpd " [5m]" -DPD timeout to use in mediation server plugin -.TP -.BR medsrv.load -Plugins to load in mediation server plugin -.TP -.BR medsrv.password_length " [6]" -Minimum password length required for mediation server user accounts -.TP -.BR medsrv.rekey " [20m]" -Rekeying time on mediation connections in mediation server plugin -.TP -.BR medsrv.socket -Run Mediation server web application statically on socket -.TP -.BR medsrv.threads " [5]" -Number of thread for mediation service web application -.TP -.BR medsrv.timeout " [15m]" -Session timeout for mediation service -.SS openac section -.TP -.BR openac.load -Plugins to load in ipsec openac tool -.SS pacman section -.TP -.BR pacman.database -Database URI for the database that stores the package information -.SS pki section -.TP -.BR pki.load -Plugins to load in ipsec pki tool -.SS pool section -.TP -.BR pool.load -Plugins to load in ipsec pool tool -.SS pt-tls-client section -.TP -.BR pt-tls-client.load -Plugins to load in ipsec pt-tls-client tool -.SS scepclient section -.TP -.BR scepclient.load -Plugins to load in ipsec scepclient tool -.SS starter section -.TP -.BR starter.load -Plugins to load in starter -.TP -.BR starter.load_warning " [yes]" -Disable charon plugin load option warning - -.SH LOGGER CONFIGURATION -The options described below provide a much more flexible way to configure -loggers for the IKEv2 daemon charon than using the -.B charondebug -option in -.BR ipsec.conf (5). -.PP -.B Please note -that if any loggers are specified in strongswan.conf, -.B charondebug -does not have any effect. -.PP -There are currently two types of loggers defined: -.TP -.B File loggers -Log directly to a file and are defined by specifying the full path to the -file as subsection in the -.B charon.filelog -section. To log to the console the two special filenames -.BR stdout " and " stderr -can be used. -.TP -.B Syslog loggers -Log into a syslog facility and are defined by specifying the facility to log to -as the name of a subsection in the -.B charon.syslog -section. The following facilities are currently supported: -.BR daemon " and " auth . -.PP -Multiple loggers can be defined for each type with different log verbosity for -the different subsystems of the daemon. -.SS Options -.TP -.BR charon.filelog..default " [1]" -.TQ -.BR charon.syslog..default -Specifies the default loglevel to be used for subsystems for which no specific -loglevel is defined. -.TP -.BR charon.filelog.. " []" -.TQ -.BR charon.syslog.. -Specifies the loglevel for the given subsystem. -.TP -.BR charon.filelog..append " [yes]" -If this option is enabled log entries are appended to the existing file. -.TP -.BR charon.filelog..flush_line " [no]" -Enabling this option disables block buffering and enables line buffering. -.TP -.BR charon.filelog..ike_name " [no]" -.TQ -.BR charon.syslog..ike_name -Prefix each log entry with the connection name and a unique numerical -identifier for each IKE_SA. -.TP -.BR charon.filelog..time_format -Prefix each log entry with a timestamp. The option accepts a format string as -passed to -.BR strftime (3). -.TP -.BR charon.syslog.identifier -Global identifier used for an -.BR openlog (3) -call, prepended to each log message by syslog. If not configured, -.BR openlog (3) -is not called, so the value will depend on system defaults (often the program -name). - -.SS Subsystems -.TP -.B dmn -Main daemon setup/cleanup/signal handling -.TP -.B mgr -IKE_SA manager, handling synchronization for IKE_SA access -.TP -.B ike -IKE_SA -.TP -.B chd -CHILD_SA -.TP -.B job -Jobs queueing/processing and thread pool management -.TP -.B cfg -Configuration management and plugins -.TP -.B knl -IPsec/Networking kernel interface -.TP -.B net -IKE network communication -.TP -.B asn -Low-level encoding/decoding (ASN.1, X.509 etc.) -.TP -.B enc -Packet encoding/decoding encryption/decryption operations -.TP -.B tls -libtls library messages -.TP -.B esp -libipsec library messages -.TP -.B lib -libstrongwan library messages -.TP -.B tnc -Trusted Network Connect -.TP -.B imc -Integrity Measurement Collector -.TP -.B imv -Integrity Measurement Verifier -.TP -.B pts -Platform Trust Service -.SS Loglevels -.TP -.B -1 -Absolutely silent -.TP -.B 0 -Very basic auditing logs, (e.g. SA up/SA down) -.TP -.B 1 -Generic control flow with errors, a good default to see whats going on -.TP -.B 2 -More detailed debugging control flow -.TP -.B 3 -Including RAW data dumps in Hex -.TP -.B 4 -Also include sensitive material in dumps, e.g. keys -.SS Example -.PP -.EX - charon { - filelog { - /var/log/charon.log { - time_format = %b %e %T - append = no - default = 1 - } - stderr { - ike = 2 - knl = 3 - ike_name = yes - } - } - syslog { - # enable logging to LOG_DAEMON, use defaults - daemon { - } - # minimalistic IKE auditing logging to LOG_AUTHPRIV - auth { - default = -1 - ike = 0 - } - } - } -.EE - -.SH JOB PRIORITY MANAGEMENT -Some operations in the IKEv2 daemon charon are currently implemented -synchronously and blocking. Two examples for such operations are communication -with a RADIUS server via EAP-RADIUS, or fetching CRL/OCSP information during -certificate chain verification. Under high load conditions, the thread pool may -run out of available threads, and some more important jobs, such as liveness -checking, may not get executed in time. -.PP -To prevent thread starvation in such situations job priorities were introduced. -The job processor will reserve some threads for higher priority jobs, these -threads are not available for lower priority, locking jobs. -.SS Implementation -Currently 4 priorities have been defined, and they are used in charon as -follows: -.TP -.B CRITICAL -Priority for long-running dispatcher jobs. -.TP -.B HIGH -INFORMATIONAL exchanges, as used by liveness checking (DPD). -.TP -.B MEDIUM -Everything not HIGH/LOW, including IKE_SA_INIT processing. -.TP -.B LOW -IKE_AUTH message processing. RADIUS and CRL fetching block here -.PP -Although IKE_SA_INIT processing is computationally expensive, it is explicitly -assigned to the MEDIUM class. This allows charon to do the DH exchange while -other threads are blocked in IKE_AUTH. To prevent the daemon from accepting more -IKE_SA_INIT requests than it can handle, use IKE_SA_INIT DROPPING. -.PP -The thread pool processes jobs strictly by priority, meaning it will consume all -higher priority jobs before looking for ones with lower priority. Further, it -reserves threads for certain priorities. A priority class having reserved -.I n -threads will always have -.I n -threads available for this class (either currently processing a job, or waiting -for one). -.SS Configuration -To ensure that there are always enough threads available for higher priority -tasks, threads must be reserved for each priority class. -.TP -.BR libstrongswan.processor.priority_threads.critical " [0]" -Threads reserved for CRITICAL priority class jobs -.TP -.BR libstrongswan.processor.priority_threads.high " [0]" -Threads reserved for HIGH priority class jobs -.TP -.BR libstrongswan.processor.priority_threads.medium " [0]" -Threads reserved for MEDIUM priority class jobs -.TP -.BR libstrongswan.processor.priority_threads.low " [0]" -Threads reserved for LOW priority class jobs -.PP -Let's consider the following configuration: -.PP -.EX - libstrongswan { - processor { - priority_threads { - high = 1 - medium = 4 - } - } - } -.EE -.PP -With this configuration, one thread is reserved for HIGH priority tasks. As -currently only liveness checking and stroke message processing is done with -high priority, one or two threads should be sufficient. -.PP -The MEDIUM class mostly processes non-blocking jobs. Unless your setup is -experiencing many blocks in locks while accessing shared resources, threads for -one or two times the number of CPU cores is fine. -.PP -It is usually not required to reserve threads for CRITICAL jobs. Jobs in this -class rarely return and do not release their thread to the pool. -.PP -The remaining threads are available for LOW priority jobs. Reserving threads -does not make sense (until we have an even lower priority). -.SS Monitoring -To see what the threads are actually doing, invoke -.IR "ipsec statusall" . -Under high load, something like this will show up: -.PP -.EX - worker threads: 2 or 32 idle, 5/1/2/22 working, - job queue: 0/0/1/149, scheduled: 198 -.EE -.PP -From 32 worker threads, -.IP 2 -are currently idle. -.IP 5 -are running CRITICAL priority jobs (dispatching from sockets, etc.). -.IP 1 -is currently handling a HIGH priority job. This is actually the thread currently -providing this information via stroke. -.IP 2 -are handling MEDIUM priority jobs, likely IKE_SA_INIT or CREATE_CHILD_SA -messages. -.IP 22 -are handling LOW priority jobs, probably waiting for an EAP-RADIUS response -while processing IKE_AUTH messages. -.PP -The job queue load shows how many jobs are queued for each priority, ready for -execution. The single MEDIUM priority job will get executed immediately, as -we have two spare threads reserved for MEDIUM class jobs. - -.SH IKE_SA_INIT DROPPING -If a responder receives more connection requests per seconds than it can handle, -it does not make sense to accept more IKE_SA_INIT messages. And if they are -queued but can't get processed in time, an answer might be sent after the -client has already given up and restarted its connection setup. This -additionally increases the load on the responder. -.PP -To limit the responder load resulting from new connection attempts, the daemon -can drop IKE_SA_INIT messages just after reception. There are two mechanisms to -decide if this should happen, configured with the following options: -.TP -.BR charon.init_limit_half_open " [0]" -Limit based on the number of half open IKE_SAs. Half open IKE_SAs are SAs in -connecting state, but not yet established. -.TP -.BR charon.init_limit_job_load " [0]" -Limit based on the number of jobs currently queued for processing (sum over all -job priorities). -.PP -The second limit includes load from other jobs, such as rekeying. Choosing a -good value is difficult and depends on the hardware and expected load. -.PP -The first limit is simpler to calculate, but includes the load from new -connections only. If your responder is capable of negotiating 100 tunnels/s, you -might set this limit to 1000. The daemon will then drop new connection attempts -if generating a response would require more than 10 seconds. If you are -allowing for a maximum response time of more than 30 seconds, consider adjusting -the timeout for connecting IKE_SAs -.RB ( charon.half_open_timeout ). -A responder, by default, deletes an IKE_SA if the initiator does not establish -it within 30 seconds. Under high load, a higher value might be required. - -.SH LOAD TESTS -To do stability testing and performance optimizations, the IKEv2 daemon charon -provides the load-tester plugin. This plugin allows one to setup thousands of -tunnels concurrently against the daemon itself or a remote host. -.PP -.B WARNING: -Never enable the load-testing plugin on productive systems. It provides -preconfigured credentials and allows an attacker to authenticate as any user. -.SS Options -.TP -.BR charon.plugins.load-tester.addrs -Subsection that contains key/value pairs with address pools (in CIDR notation) -to use for a specific network interface e.g. eth0 = 10.10.0.0/16 -.TP -.BR charon.plugins.load-tester.addrs_keep " [no]" -Whether to keep dynamic addresses even after the associated SA got terminated -.TP -.BR charon.plugins.load-tester.addrs_prefix " [16]" -Network prefix length to use when installing dynamic addresses. If set to -1 the -full address is used (i.e. 32 or 128) -.TP -.BR charon.plugins.load-tester.ca_dir -Directory to load (intermediate) CA certificates from -.TP -.BR charon.plugins.load-tester.child_rekey " [600]" -Seconds to start CHILD_SA rekeying after setup -.TP -.BR charon.plugins.load-tester.delay " [0]" -Delay between initiatons for each thread -.TP -.BR charon.plugins.load-tester.delete_after_established " [no]" -Delete an IKE_SA as soon as it has been established -.TP -.BR charon.plugins.load-tester.digest " [sha1]" -Digest algorithm used when issuing certificates -.TP -.BR charon.plugins.load-tester.dpd_delay " [0]" -DPD delay to use in load test -.TP -.BR charon.plugins.load-tester.dynamic_port " [0]" -Base port to be used for requests (each client uses a different port) -.TP -.BR charon.plugins.load-tester.eap_password " [default-pwd]" -EAP secret to use in load test -.TP -.BR charon.plugins.load-tester.enable " [no]" -Enable the load testing plugin -.TP -.BR charon.plugins.load-tester.esp " [aes128-sha1]" -CHILD_SA proposal to use for load tests -.TP -.BR charon.plugins.load-tester.fake_kernel " [no]" -Fake the kernel interface to allow load-testing against self -.TP -.BR charon.plugins.load-tester.ike_rekey " [0]" -Seconds to start IKE_SA rekeying after setup -.TP -.BR charon.plugins.load-tester.init_limit " [0]" -Global limit of concurrently established SAs during load test -.TP -.BR charon.plugins.load-tester.initiator " [0.0.0.0]" -Address to initiate from -.TP -.BR charon.plugins.load-tester.initiators " [0]" -Number of concurrent initiator threads to use in load test -.TP -.BR charon.plugins.load-tester.initiator_auth " [pubkey]" -Authentication method(s) the intiator uses -.TP -.BR charon.plugins.load-tester.initiator_id -Initiator ID used in load test -.TP -.BR charon.plugins.load-tester.initiator_match -Initiator ID to match against as responder -.TP -.BR charon.plugins.load-tester.initiator_tsi -Traffic selector on initiator side, as proposed by initiator -.TP -.BR charon.plugins.load-tester.initiator_tsr -Traffic selector on responder side, as proposed by initiator -.TP -.BR charon.plugins.load-tester.iterations " [1]" -Number of IKE_SAs to initiate by each initiator in load test -.TP -.BR charon.plugins.load-tester.issuer_cert -Path to the issuer certificate (if not configured a hard-coded value is used) -.TP -.BR charon.plugins.load-tester.issuer_key -Path to private key that is used to issue certificates (if not configured a -hard-coded value is used) -.TP -.BR charon.plugins.load-tester.mode " [tunnel]" -IPsec mode to use, one of \fBtunnel\fR, \fBtransport\fR, or \fBbeet\fR. -.TP -.BR charon.plugins.load-tester.pool -Provide INTERNAL_IPV4_ADDRs from a named pool -.TP -.BR charon.plugins.load-tester.preshared_key " [default-psk]" -Preshared key to use in load test -.TP -.BR charon.plugins.load-tester.proposal " [aes128-sha1-modp768]" -IKE proposal to use in load test -.TP -.BR charon.plugins.load-tester.responder " [127.0.0.1]" -Address to initiation connections to -.TP -.BR charon.plugins.load-tester.responder_auth " [pubkey]" -Authentication method(s) the responder uses -.TP -.BR charon.plugins.load-tester.responder_id -Responder ID used in load test -.TP -.BR charon.plugins.load-tester.responder_tsi " [initiator_tsi]" -Traffic selector on initiator side, as narrowed by responder -.TP -.BR charon.plugins.load-tester.responder_tsr " [initiator_tsr]" -Traffic selector on responder side, as narrowed by responder -.TP -.BR charon.plugins.load-tester.request_virtual_ip " [no]" -Request an INTERNAL_IPV4_ADDR from the server -.TP -.BR charon.plugins.load-tester.shutdown_when_complete " [no]" -Shutdown the daemon after all IKE_SAs have been established -.TP -.BR charon.plugins.load-tester.socket " [unix://@piddir@/charon.ldt]" -Socket provided by the load-tester plugin -.TP -.BR charon.plugins.load-tester.version " [0]" -IKE version to use (0 means use IKEv2 as initiator and accept any version as -responder) -.PP -.SS Configuration details -For public key authentication, the responder uses the -.B \(dqCN=srv, OU=load-test, O=strongSwan\(dq -identity. For the initiator, each connection attempt uses a different identity -in the form -.BR "\(dqCN=c1-r1, OU=load-test, O=strongSwan\(dq" , -where the first number inidicates the client number, the second the -authentication round (if multiple authentication is used). -.PP -For PSK authentication, FQDN identities are used. The server uses -.BR srv.strongswan.org , -the client uses an identity in the form -.BR c1-r1.strongswan.org . -.PP -For EAP authentication, the client uses a NAI in the form -.BR 100000000010001@strongswan.org . -.PP -To configure multiple authentication, concatenate multiple methods using, e.g. -.EX - initiator_auth = pubkey|psk|eap-md5|eap-aka -.EE -.PP -The responder uses a hardcoded certificate based on a 1024-bit RSA key. -This certificate additionally serves as CA certificate. A peer uses the same -private key, but generates client certificates on demand signed by the CA -certificate. Install the Responder/CA certificate on the remote host to -authenticate all clients. -.PP -To speed up testing, the load tester plugin implements a special Diffie-Hellman -implementation called modpnull. By setting -.EX - proposal = aes128-sha1-modpnull -.EE -this wicked fast DH implementation is used. It does not provide any security -at all, but allows one to run tests without DH calculation overhead. -.SS Examples -.PP -In the simplest case, the daemon initiates IKE_SAs against itself using the -loopback interface. This will actually establish double the number of IKE_SAs, -as the daemon is initiator and responder for each IKE_SA at the same time. -Installation of IPsec SAs would fails, as each SA gets installed twice. To -simulate the correct behavior, a fake kernel interface can be enabled which does -not install the IPsec SAs at the kernel level. -.PP -A simple loopback configuration might look like this: -.PP -.EX - charon { - # create new IKE_SAs for each CHILD_SA to simulate - # different clients - reuse_ikesa = no - # turn off denial of service protection - dos_protection = no - - plugins { - load-tester { - # enable the plugin - enable = yes - # use 4 threads to initiate connections - # simultaneously - initiators = 4 - # each thread initiates 1000 connections - iterations = 1000 - # delay each initiation in each thread by 20ms - delay = 20 - # enable the fake kernel interface to - # avoid SA conflicts - fake_kernel = yes - } - } - } -.EE -.PP -This will initiate 4000 IKE_SAs within 20 seconds. You may increase the delay -value if your box can not handle that much load, or decrease it to put more -load on it. If the daemon starts retransmitting messages your box probably can -not handle all connection attempts. -.PP -The plugin also allows one to test against a remote host. This might help to -test against a real world configuration. A connection setup to do stress -testing of a gateway might look like this: -.PP -.EX - charon { - reuse_ikesa = no - threads = 32 - - plugins { - load-tester { - enable = yes - # 10000 connections, ten in parallel - initiators = 10 - iterations = 1000 - # use a delay of 100ms, overall time is: - # iterations * delay = 100s - delay = 100 - # address of the gateway - remote = 1.2.3.4 - # IKE-proposal to use - proposal = aes128-sha1-modp1024 - # use faster PSK authentication instead - # of 1024bit RSA - initiator_auth = psk - responder_auth = psk - # request a virtual IP using configuration - # payloads - request_virtual_ip = yes - # enable CHILD_SA every 60s - child_rekey = 60 - } - } - } -.EE - -.SH IKEv2 RETRANSMISSION -Retransmission timeouts in the IKEv2 daemon charon can be configured globally -using the three keys listed below: -.PP -.RS -.nf -.BR charon.retransmit_base " [1.8]" -.BR charon.retransmit_timeout " [4.0]" -.BR charon.retransmit_tries " [5]" -.fi -.RE -.PP -The following algorithm is used to calculate the timeout: -.PP -.EX - relative timeout = retransmit_timeout * retransmit_base ^ (n-1) -.EE -.PP -Where -.I n -is the current retransmission count. -.PP -Using the default values, packets are retransmitted in: - -.TS -l r r ---- -lB r r. -Retransmission Relative Timeout Absolute Timeout -1 4s 4s -2 7s 11s -3 13s 24s -4 23s 47s -5 42s 89s -giving up 76s 165s -.TE - -.SH FILES -/etc/strongswan.conf - -.SH SEE ALSO -\fBipsec.conf\fR(5), \fBipsec.secrets\fR(5), \fBipsec\fR(8), \fBcharon-cmd\fR(8) - -.SH HISTORY -Written for the -.UR http://www.strongswan.org -strongSwan project -.UE -by Tobias Brunner, Andreas Steffen and Martin Willi. diff --git a/scripts/aes-test.c b/scripts/aes-test.c index f326b7ee1..eb94180f8 100644 --- a/scripts/aes-test.c +++ b/scripts/aes-test.c @@ -556,7 +556,7 @@ int main(int argc, char *argv[]) ctx.in = stdin; ctx.out = stdout; - library_init(NULL); + library_init(NULL, "aes-test"); atexit(library_deinit); while (true) diff --git a/scripts/crypt_burn.c b/scripts/crypt_burn.c index 8101f9cbd..729472e7d 100644 --- a/scripts/crypt_burn.c +++ b/scripts/crypt_burn.c @@ -26,7 +26,7 @@ int main(int argc, char *argv[]) int i = 0, limit = 0; - library_init(NULL); + library_init(NULL, "crypt_burn"); lib->plugins->load(lib->plugins, PLUGINS); atexit(library_deinit); diff --git a/scripts/dh_speed.c b/scripts/dh_speed.c index dc0a2870f..8a782d80b 100644 --- a/scripts/dh_speed.c +++ b/scripts/dh_speed.c @@ -118,7 +118,7 @@ int main(int argc, char *argv[]) usage(); } - library_init(NULL); + library_init(NULL, "dh_speed"); lib->plugins->load(lib->plugins, argv[1]); atexit(library_deinit); diff --git a/scripts/dnssec.c b/scripts/dnssec.c index 0cddfc47e..9d35c7cda 100644 --- a/scripts/dnssec.c +++ b/scripts/dnssec.c @@ -45,7 +45,7 @@ int main(int argc, char *argv[]) rr_set_t *rrset; rr_t *rr; - library_init(NULL); + library_init(NULL, "dnssec"); atexit(library_deinit); dbg = dbg_dnssec; diff --git a/scripts/fetch.c b/scripts/fetch.c index f58b37f89..a7d98c946 100644 --- a/scripts/fetch.c +++ b/scripts/fetch.c @@ -35,7 +35,7 @@ int main(int argc, char *argv[]) { chunk_t res; - library_init(NULL); + library_init(NULL, "fetch"); atexit(library_deinit); lib->plugins->load(lib->plugins, PLUGINS); diff --git a/scripts/hash_burn.c b/scripts/hash_burn.c index 20e5642d4..97eab0d84 100644 --- a/scripts/hash_burn.c +++ b/scripts/hash_burn.c @@ -25,7 +25,7 @@ int main(int argc, char *argv[]) char buffer[1024]; int limit = 0, i = 0; - library_init(NULL); + library_init(NULL, "hash_burn"); lib->plugins->load(lib->plugins, PLUGINS); atexit(library_deinit); diff --git a/scripts/key2keyid.c b/scripts/key2keyid.c index 31f3bee82..e9a4ee692 100644 --- a/scripts/key2keyid.c +++ b/scripts/key2keyid.c @@ -30,7 +30,7 @@ int main(int argc, char *argv[]) char buf[8096]; int read; - library_init(NULL); + library_init(NULL, "key2keyid"); lib->plugins->load(lib->plugins, PLUGINS); atexit(library_deinit); diff --git a/scripts/keyid2sql.c b/scripts/keyid2sql.c index 6e9a1334e..46257891c 100644 --- a/scripts/keyid2sql.c +++ b/scripts/keyid2sql.c @@ -30,7 +30,7 @@ int main(int argc, char *argv[]) char buf[8096]; int read, n; - library_init(NULL); + library_init(NULL, "keyid2sql"); lib->plugins->load(lib->plugins, PLUGINS); atexit(library_deinit); diff --git a/scripts/malloc_speed.c b/scripts/malloc_speed.c index 85d51a281..2038098db 100644 --- a/scripts/malloc_speed.c +++ b/scripts/malloc_speed.c @@ -58,7 +58,7 @@ int main(int argc, char *argv[]) int sizes[16] = { 1, 13, 100, 1000, 16, 10000, 50, 17, 123, 32, 8, 64, 8096, 1024, 123, 9 }; - library_init(NULL); + library_init(NULL, "malloc_speed"); atexit(library_deinit); print_mallinfo(); diff --git a/scripts/pubkey_speed.c b/scripts/pubkey_speed.c index f7e75162a..66279ada3 100644 --- a/scripts/pubkey_speed.c +++ b/scripts/pubkey_speed.c @@ -71,7 +71,7 @@ int main(int argc, char *argv[]) usage(); } - library_init(NULL); + library_init(NULL, "pubkey_speed"); lib->plugins->load(lib->plugins, argv[1]); atexit(library_deinit); diff --git a/scripts/tls_test.c b/scripts/tls_test.c index e1e8ca82b..7ec477aae 100644 --- a/scripts/tls_test.c +++ b/scripts/tls_test.c @@ -251,7 +251,7 @@ static void cleanup() */ static void init() { - library_init(NULL); + library_init(NULL, "tls_test"); dbg = dbg_tls; diff --git a/src/Makefile.am b/src/Makefile.am index f290d9c85..7d11893d1 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -119,9 +119,3 @@ endif if USE_INTEGRITY_TEST SUBDIRS += checksum endif - -EXTRA_DIST = strongswan.conf - -install-exec-local : - test -e "$(DESTDIR)${sysconfdir}" || $(INSTALL) -d "$(DESTDIR)$(sysconfdir)" - test -e "$(DESTDIR)$(sysconfdir)/strongswan.conf" || $(INSTALL) -m 640 $(srcdir)/strongswan.conf $(DESTDIR)$(sysconfdir)/strongswan.conf || true diff --git a/src/_copyright/_copyright.c b/src/_copyright/_copyright.c index f9f0a859d..806f78062 100644 --- a/src/_copyright/_copyright.c +++ b/src/_copyright/_copyright.c @@ -76,7 +76,7 @@ main(int argc, char *argv[]) const char **notice = copyright; const char **co; - library_init(NULL); + library_init(NULL, "_copyright"); atexit(library_deinit); while ((opt = getopt_long(argc, argv, "", opts, NULL)) != EOF) diff --git a/src/charon-cmd/charon-cmd.c b/src/charon-cmd/charon-cmd.c index 0c24fd146..a70d314af 100644 --- a/src/charon-cmd/charon-cmd.c +++ b/src/charon-cmd/charon-cmd.c @@ -322,7 +322,7 @@ int main(int argc, char *argv[]) dbg = dbg_stderr; atexit(library_deinit); - if (!library_init(NULL)) + if (!library_init(NULL, "charon-cmd")) { exit(SS_RC_LIBSTRONGSWAN_INTEGRITY); } @@ -334,12 +334,12 @@ int main(int argc, char *argv[]) } } atexit(libhydra_deinit); - if (!libhydra_init("charon-cmd")) + if (!libhydra_init()) { exit(SS_RC_INITIALIZATION_FAILED); } atexit(libcharon_deinit); - if (!libcharon_init("charon-cmd")) + if (!libcharon_init()) { exit(SS_RC_INITIALIZATION_FAILED); } diff --git a/src/charon-nm/charon-nm.c b/src/charon-nm/charon-nm.c index 9ce6dbaeb..32cec36ec 100644 --- a/src/charon-nm/charon-nm.c +++ b/src/charon-nm/charon-nm.c @@ -161,7 +161,7 @@ int main(int argc, char *argv[]) dbg = dbg_syslog; /* initialize library */ - if (!library_init(NULL)) + if (!library_init(NULL, "charon-nm")) { library_deinit(); exit(SS_RC_LIBSTRONGSWAN_INTEGRITY); @@ -175,7 +175,7 @@ int main(int argc, char *argv[]) exit(SS_RC_DAEMON_INTEGRITY); } - if (!libhydra_init("charon-nm")) + if (!libhydra_init()) { dbg_syslog(DBG_DMN, 1, "initialization failed - aborting charon-nm"); libhydra_deinit(); @@ -183,7 +183,7 @@ int main(int argc, char *argv[]) exit(SS_RC_INITIALIZATION_FAILED); } - if (!libcharon_init("charon-nm")) + if (!libcharon_init()) { dbg_syslog(DBG_DMN, 1, "initialization failed - aborting charon-nm"); goto deinit; diff --git a/src/charon-tkm/src/charon-tkm.c b/src/charon-tkm/src/charon-tkm.c index 3db06743d..9a22f9ad9 100644 --- a/src/charon-tkm/src/charon-tkm.c +++ b/src/charon-tkm/src/charon-tkm.c @@ -250,13 +250,13 @@ int main(int argc, char *argv[]) dbg = dbg_syslog; /* initialize library */ - if (!library_init(NULL)) + if (!library_init(NULL, dmn_name)) { library_deinit(); exit(status); } - if (!libhydra_init(dmn_name)) + if (!libhydra_init()) { dbg_syslog(DBG_DMN, 1, "initialization failed - aborting %s", dmn_name); libhydra_deinit(); @@ -264,7 +264,7 @@ int main(int argc, char *argv[]) exit(status); } - if (!libcharon_init(dmn_name)) + if (!libcharon_init()) { dbg_syslog(DBG_DMN, 1, "initialization failed - aborting %s", dmn_name); goto deinit; diff --git a/src/charon-tkm/src/tkm/tkm.c b/src/charon-tkm/src/tkm/tkm.c index a39221dc2..61eb6056c 100644 --- a/src/charon-tkm/src/tkm/tkm.c +++ b/src/charon-tkm/src/tkm/tkm.c @@ -61,7 +61,7 @@ bool tkm_init() ehandler_init(); ikesock = lib->settings->get_str(lib->settings, "%s.ike_socket", IKE_SOCKET, - charon->name); + lib->ns); if (ike_init(ikesock) != TKM_OK) { tkmlib_final(); @@ -70,7 +70,7 @@ bool tkm_init() DBG1(DBG_DMN, "connected to TKM via socket '%s'", ikesock); eessock = lib->settings->get_str(lib->settings, "%s.ees_socket", EES_SOCKET, - charon->name); + lib->ns); ees_server_init(eessock); DBG1(DBG_DMN, "serving EES requests on socket '%s'", eessock); diff --git a/src/charon-tkm/src/tkm/tkm_diffie_hellman.c b/src/charon-tkm/src/tkm/tkm_diffie_hellman.c index c30a03f39..a34d0b1d4 100644 --- a/src/charon-tkm/src/tkm/tkm_diffie_hellman.c +++ b/src/charon-tkm/src/tkm/tkm_diffie_hellman.c @@ -133,7 +133,7 @@ int register_dh_mapping() enumerator = lib->settings->create_key_value_enumerator(lib->settings, "%s.dh_mapping", - charon->name); + lib->ns); while (enumerator->enumerate(enumerator, &iana_id_str, &tkm_id_str)) { diff --git a/src/charon-tkm/tests/tests.c b/src/charon-tkm/tests/tests.c index 5bbacacf3..18754c717 100644 --- a/src/charon-tkm/tests/tests.c +++ b/src/charon-tkm/tests/tests.c @@ -50,8 +50,8 @@ static bool test_runner_init(bool init) if (init) { - libhydra_init("test_runner"); - libcharon_init("test_runner"); + libhydra_init(); + libcharon_init(); lib->settings->set_int(lib->settings, "test_runner.filelog.stdout.default", 0); charon->load_loggers(charon, NULL, FALSE); @@ -67,9 +67,9 @@ static bool test_runner_init(bool init) countof(features), TRUE); lib->settings->set_int(lib->settings, "%s.dh_mapping.%d", 1, - charon->name, MODP_3072_BIT); + lib->ns, MODP_3072_BIT); lib->settings->set_int(lib->settings, "%s.dh_mapping.%d", 2, - charon->name, MODP_4096_BIT); + lib->ns, MODP_4096_BIT); register_dh_mapping(); plugin_loader_add_plugindirs(BUILDDIR "/src/libstrongswan/plugins", diff --git a/src/charon/charon.c b/src/charon/charon.c index 340f852cd..089ac4570 100644 --- a/src/charon/charon.c +++ b/src/charon/charon.c @@ -289,7 +289,7 @@ int main(int argc, char *argv[]) dbg = dbg_stderr; /* initialize library */ - if (!library_init(NULL)) + if (!library_init(NULL, "charon")) { library_deinit(); exit(SS_RC_LIBSTRONGSWAN_INTEGRITY); @@ -303,7 +303,7 @@ int main(int argc, char *argv[]) exit(SS_RC_DAEMON_INTEGRITY); } - if (!libhydra_init("charon")) + if (!libhydra_init()) { dbg_stderr(DBG_DMN, 1, "initialization failed - aborting charon"); libhydra_deinit(); @@ -311,7 +311,7 @@ int main(int argc, char *argv[]) exit(SS_RC_INITIALIZATION_FAILED); } - if (!libcharon_init("charon")) + if (!libcharon_init()) { dbg_stderr(DBG_DMN, 1, "initialization failed - aborting charon"); goto deinit; diff --git a/src/checksum/checksum_builder.c b/src/checksum/checksum_builder.c index ae9ba93b6..cc8185ecd 100644 --- a/src/checksum/checksum_builder.c +++ b/src/checksum/checksum_builder.c @@ -136,7 +136,7 @@ int main(int argc, char* argv[]) /* avoid confusing leak reports in build process */ setenv("LEAK_DETECTIVE_DISABLE", "1", 0); /* don't use a strongswan.conf, forces integrity check to disabled */ - library_init(""); + library_init("", "checksum_builder"); atexit(library_deinit); integrity = integrity_checker_create(NULL); diff --git a/src/conftest/conftest.c b/src/conftest/conftest.c index faf9df91f..ac6d697a5 100644 --- a/src/conftest/conftest.c +++ b/src/conftest/conftest.c @@ -435,18 +435,18 @@ int main(int argc, char *argv[]) char *suite_file = "suite.conf", *test_file = NULL, *preload, *plugins; file_logger_t *logger; - if (!library_init(NULL)) + if (!library_init(NULL, "conftest")) { library_deinit(); return SS_RC_LIBSTRONGSWAN_INTEGRITY; } - if (!libhydra_init("conftest")) + if (!libhydra_init()) { libhydra_deinit(); library_deinit(); return SS_RC_INITIALIZATION_FAILED; } - if (!libcharon_init("conftest")) + if (!libcharon_init()) { libcharon_deinit(); libhydra_deinit(); diff --git a/src/dumm/ext/dumm.c b/src/dumm/ext/dumm.c index 5acda3a9c..03ecbe40d 100644 --- a/src/dumm/ext/dumm.c +++ b/src/dumm/ext/dumm.c @@ -774,7 +774,7 @@ void Init_dumm() /* there are too many to report, rubyruby... */ setenv("LEAK_DETECTIVE_DISABLE", "1", 1); - library_init(NULL); + library_init(NULL, "dumm"); dumm = dumm_create(NULL); diff --git a/src/dumm/main.c b/src/dumm/main.c index 4cdf4682f..a53e1f67c 100644 --- a/src/dumm/main.c +++ b/src/dumm/main.c @@ -479,7 +479,7 @@ int main(int argc, char *argv[]) enumerator_t *enumerator; guest_t *guest; - library_init(NULL); + library_init(NULL, "dumm"); gtk_init(&argc, &argv); pages = linked_list_create(); diff --git a/src/frontends/android/jni/libandroidbridge/charonservice.c b/src/frontends/android/jni/libandroidbridge/charonservice.c index 60485b66f..03351b721 100644 --- a/src/frontends/android/jni/libandroidbridge/charonservice.c +++ b/src/frontends/android/jni/libandroidbridge/charonservice.c @@ -600,7 +600,7 @@ JNI_METHOD(CharonVpnService, initializeCharon, jboolean, dbg = dbg_android; /* initialize library */ - if (!library_init(NULL)) + if (!library_init(NULL, "charon")) { library_deinit(); return FALSE; @@ -611,7 +611,7 @@ JNI_METHOD(CharonVpnService, initializeCharon, jboolean, set_options(logfile); free(logfile); - if (!libhydra_init("charon")) + if (!libhydra_init()) { libhydra_deinit(); library_deinit(); @@ -626,7 +626,7 @@ JNI_METHOD(CharonVpnService, initializeCharon, jboolean, return FALSE; } - if (!libcharon_init("charon")) + if (!libcharon_init()) { libcharon_deinit(); libipsec_deinit(); diff --git a/src/frontends/osx/charon-xpc/charon-xpc.c b/src/frontends/osx/charon-xpc/charon-xpc.c index 0a30ff866..2235be12d 100644 --- a/src/frontends/osx/charon-xpc/charon-xpc.c +++ b/src/frontends/osx/charon-xpc/charon-xpc.c @@ -133,7 +133,7 @@ int main(int argc, char *argv[]) dbg = dbg_stderr; atexit(library_deinit); - if (!library_init(NULL)) + if (!library_init(NULL, "charon-xpc")) { exit(SS_RC_LIBSTRONGSWAN_INTEGRITY); } @@ -145,12 +145,12 @@ int main(int argc, char *argv[]) } } atexit(libhydra_deinit); - if (!libhydra_init("charon-xpc")) + if (!libhydra_init()) { exit(SS_RC_INITIALIZATION_FAILED); } atexit(libcharon_deinit); - if (!libcharon_init("charon-xpc")) + if (!libcharon_init()) { exit(SS_RC_INITIALIZATION_FAILED); } diff --git a/src/libcharon/daemon.c b/src/libcharon/daemon.c index 5e3ae72b9..0cecd1d3b 100644 --- a/src/libcharon/daemon.c +++ b/src/libcharon/daemon.c @@ -181,7 +181,7 @@ static void handle_syslog_identifier(private_daemon_t *this) char *identifier; identifier = lib->settings->get_str(lib->settings, "%s.syslog.identifier", - NULL, charon->name); + NULL, lib->ns); if (identifier) { /* set identifier, which is prepended to each log line */ if (!this->syslog_identifier || @@ -292,15 +292,15 @@ static void load_sys_logger(private_daemon_t *this, char *facility, sys_logger = add_sys_logger(this, facility, current_loggers); sys_logger->set_options(sys_logger, lib->settings->get_bool(lib->settings, "%s.syslog.%s.ike_name", - FALSE, charon->name, facility)); + FALSE, lib->ns, facility)); def = lib->settings->get_int(lib->settings, "%s.syslog.%s.default", 1, - charon->name, facility); + lib->ns, facility); for (group = 0; group < DBG_MAX; group++) { sys_logger->set_level(sys_logger, group, lib->settings->get_int(lib->settings, "%s.syslog.%s.%N", def, - charon->name, facility, debug_lower_names, group)); + lib->ns, facility, debug_lower_names, group)); } charon->bus->add_logger(charon->bus, &sys_logger->logger); } @@ -318,25 +318,25 @@ static void load_file_logger(private_daemon_t *this, char *filename, char *time_format; time_format = lib->settings->get_str(lib->settings, - "%s.filelog.%s.time_format", NULL, charon->name, filename); + "%s.filelog.%s.time_format", NULL, lib->ns, filename); ike_name = lib->settings->get_bool(lib->settings, - "%s.filelog.%s.ike_name", FALSE, charon->name, filename); + "%s.filelog.%s.ike_name", FALSE, lib->ns, filename); flush_line = lib->settings->get_bool(lib->settings, - "%s.filelog.%s.flush_line", FALSE, charon->name, filename); + "%s.filelog.%s.flush_line", FALSE, lib->ns, filename); append = lib->settings->get_bool(lib->settings, - "%s.filelog.%s.append", TRUE, charon->name, filename); + "%s.filelog.%s.append", TRUE, lib->ns, filename); file_logger = add_file_logger(this, filename, current_loggers); file_logger->set_options(file_logger, time_format, ike_name); file_logger->open(file_logger, flush_line, append); def = lib->settings->get_int(lib->settings, "%s.filelog.%s.default", 1, - charon->name, filename); + lib->ns, filename); for (group = 0; group < DBG_MAX; group++) { file_logger->set_level(file_logger, group, lib->settings->get_int(lib->settings, "%s.filelog.%s.%N", def, - charon->name, filename, debug_lower_names, group)); + lib->ns, filename, debug_lower_names, group)); } charon->bus->add_logger(charon->bus, &file_logger->logger); } @@ -353,7 +353,7 @@ METHOD(daemon_t, load_loggers, void, current_loggers = this->loggers; this->loggers = linked_list_create(); enumerator = lib->settings->create_section_enumerator(lib->settings, - "%s.syslog", charon->name); + "%s.syslog", lib->ns); while (enumerator->enumerate(enumerator, &target)) { load_sys_logger(this, target, current_loggers); @@ -361,7 +361,7 @@ METHOD(daemon_t, load_loggers, void, enumerator->destroy(enumerator); enumerator = lib->settings->create_section_enumerator(lib->settings, - "%s.filelog", charon->name); + "%s.filelog", lib->ns); while (enumerator->enumerate(enumerator, &target)) { load_file_logger(this, target, current_loggers); @@ -473,7 +473,6 @@ static void destroy(private_daemon_t *this) DESTROY_IF(this->public.bus); this->loggers->destroy_function(this->loggers, (void*)logger_entry_destroy); this->mutex->destroy(this->mutex); - free((void*)this->public.name); free(this); } @@ -483,7 +482,7 @@ METHOD(daemon_t, start, void, /* start the engine, go multithreaded */ lib->processor->set_threads(lib->processor, lib->settings->get_int(lib->settings, "%s.threads", - DEFAULT_THREADS, charon->name)); + DEFAULT_THREADS, lib->ns)); } @@ -525,7 +524,7 @@ METHOD(daemon_t, initialize, bool, PLUGIN_DEPENDS(RNG, RNG_STRONG), PLUGIN_DEPENDS(CUSTOM, "socket"), }; - lib->plugins->add_static_features(lib->plugins, charon->name, features, + lib->plugins->add_static_features(lib->plugins, lib->ns, features, countof(features), TRUE); /* load plugins, further infrastructure may need it */ @@ -558,7 +557,7 @@ METHOD(daemon_t, initialize, bool, /** * Create the daemon. */ -private_daemon_t *daemon_create(const char *name) +private_daemon_t *daemon_create() { private_daemon_t *this; @@ -569,7 +568,6 @@ private_daemon_t *daemon_create(const char *name) .load_loggers = _load_loggers, .set_level = _set_level, .bus = bus_create(), - .name = strdup(name ?: "libcharon"), }, .loggers = linked_list_create(), .mutex = mutex_create(MUTEX_TYPE_DEFAULT), @@ -607,7 +605,7 @@ void libcharon_deinit() /** * Described in header. */ -bool libcharon_init(const char *name) +bool libcharon_init() { private_daemon_t *this; @@ -618,7 +616,7 @@ bool libcharon_init(const char *name) return !this->integrity_failed; } - this = daemon_create(name); + this = daemon_create(); /* for uncritical pseudo random numbers */ srandom(time(NULL) + getpid()); diff --git a/src/libcharon/daemon.h b/src/libcharon/daemon.h index 24e623c44..36242bb04 100644 --- a/src/libcharon/daemon.h +++ b/src/libcharon/daemon.h @@ -271,11 +271,6 @@ struct daemon_t { mediation_manager_t *mediation_manager; #endif /* ME */ - /** - * Name of the binary that uses the library (used for settings etc.) - */ - const char *name; - /** * Initialize the daemon. * @@ -324,12 +319,11 @@ extern daemon_t *charon; * calling initialize(). * * libcharon_init() may be called multiple times in a single process, but each - * caller should call libcharon_deinit() for each call to libcharon_init(). + * caller must call libcharon_deinit() for each call to libcharon_init(). * - * @param name name of the binary that uses the library * @return FALSE if integrity check failed */ -bool libcharon_init(const char *name); +bool libcharon_init(); /** * Deinitialize libcharon and destroy the "charon" instance of daemon_t. diff --git a/src/libcharon/network/receiver.c b/src/libcharon/network/receiver.c index 2209f1997..8dfb47b69 100644 --- a/src/libcharon/network/receiver.c +++ b/src/libcharon/network/receiver.c @@ -633,27 +633,27 @@ receiver_t *receiver_create() ); if (lib->settings->get_bool(lib->settings, - "%s.dos_protection", TRUE, charon->name)) + "%s.dos_protection", TRUE, lib->ns)) { this->cookie_threshold = lib->settings->get_int(lib->settings, - "%s.cookie_threshold", COOKIE_THRESHOLD_DEFAULT, charon->name); + "%s.cookie_threshold", COOKIE_THRESHOLD_DEFAULT, lib->ns); this->block_threshold = lib->settings->get_int(lib->settings, - "%s.block_threshold", BLOCK_THRESHOLD_DEFAULT, charon->name); + "%s.block_threshold", BLOCK_THRESHOLD_DEFAULT, lib->ns); } this->init_limit_job_load = lib->settings->get_int(lib->settings, - "%s.init_limit_job_load", 0, charon->name); + "%s.init_limit_job_load", 0, lib->ns); this->init_limit_half_open = lib->settings->get_int(lib->settings, - "%s.init_limit_half_open", 0, charon->name); + "%s.init_limit_half_open", 0, lib->ns); this->receive_delay = lib->settings->get_int(lib->settings, - "%s.receive_delay", 0, charon->name); + "%s.receive_delay", 0, lib->ns); this->receive_delay_type = lib->settings->get_int(lib->settings, - "%s.receive_delay_type", 0, charon->name), + "%s.receive_delay_type", 0, lib->ns), this->receive_delay_request = lib->settings->get_bool(lib->settings, - "%s.receive_delay_request", TRUE, charon->name), + "%s.receive_delay_request", TRUE, lib->ns), this->receive_delay_response = lib->settings->get_bool(lib->settings, - "%s.receive_delay_response", TRUE, charon->name), + "%s.receive_delay_response", TRUE, lib->ns), this->initiator_only = lib->settings->get_bool(lib->settings, - "%s.initiator_only", FALSE, charon->name), + "%s.initiator_only", FALSE, lib->ns), this->hasher = lib->crypto->create_hasher(lib->crypto, HASH_SHA1); if (!this->hasher) diff --git a/src/libcharon/network/sender.c b/src/libcharon/network/sender.c index dd8efc1ec..bed4f35ce 100644 --- a/src/libcharon/network/sender.c +++ b/src/libcharon/network/sender.c @@ -204,13 +204,13 @@ sender_t * sender_create() .got = condvar_create(CONDVAR_TYPE_DEFAULT), .sent = condvar_create(CONDVAR_TYPE_DEFAULT), .send_delay = lib->settings->get_int(lib->settings, - "%s.send_delay", 0, charon->name), + "%s.send_delay", 0, lib->ns), .send_delay_type = lib->settings->get_int(lib->settings, - "%s.send_delay_type", 0, charon->name), + "%s.send_delay_type", 0, lib->ns), .send_delay_request = lib->settings->get_bool(lib->settings, - "%s.send_delay_request", TRUE, charon->name), + "%s.send_delay_request", TRUE, lib->ns), .send_delay_response = lib->settings->get_bool(lib->settings, - "%s.send_delay_response", TRUE, charon->name), + "%s.send_delay_response", TRUE, lib->ns), ); lib->processor->queue_job(lib->processor, diff --git a/src/libcharon/plugins/android_log/android_log_logger.c b/src/libcharon/plugins/android_log/android_log_logger.c index 48bcaa577..99eb66bb1 100644 --- a/src/libcharon/plugins/android_log/android_log_logger.c +++ b/src/libcharon/plugins/android_log/android_log_logger.c @@ -100,7 +100,7 @@ android_log_logger_t *android_log_logger_create() }, .mutex = mutex_create(MUTEX_TYPE_DEFAULT), .level = lib->settings->get_int(lib->settings, - "%s.plugins.android_log.loglevel", 1, charon->name), + "%s.plugins.android_log.loglevel", 1, lib->ns), ); return &this->public; diff --git a/src/libcharon/plugins/certexpire/certexpire_export.c b/src/libcharon/plugins/certexpire/certexpire_export.c index f1205cfd8..4aa84904b 100644 --- a/src/libcharon/plugins/certexpire/certexpire_export.c +++ b/src/libcharon/plugins/certexpire/certexpire_export.c @@ -430,31 +430,31 @@ certexpire_export_t *certexpire_export_create() (hashtable_equals_t)equals, 32), .mutex = mutex_create(MUTEX_TYPE_DEFAULT), .local_path = lib->settings->get_str(lib->settings, - "%s.plugins.certexpire.csv.local", - NULL, charon->name), + "%s.plugins.certexpire.csv.local", + NULL, lib->ns), .remote_path = lib->settings->get_str(lib->settings, - "%s.plugins.certexpire.csv.remote", - NULL, charon->name), + "%s.plugins.certexpire.csv.remote", + NULL, lib->ns), .separator = lib->settings->get_str(lib->settings, - "%s.plugins.certexpire.csv.separator", - ",", charon->name), + "%s.plugins.certexpire.csv.separator", + ",", lib->ns), .format = lib->settings->get_str(lib->settings, - "%s.plugins.certexpire.csv.format", - "%d:%m:%Y", charon->name), + "%s.plugins.certexpire.csv.format", + "%d:%m:%Y", lib->ns), .fixed_fields = lib->settings->get_bool(lib->settings, - "%s.plugins.certexpire.csv.fixed_fields", - TRUE, charon->name), + "%s.plugins.certexpire.csv.fixed_fields", + TRUE, lib->ns), .empty_string = lib->settings->get_str(lib->settings, - "%s.plugins.certexpire.csv.empty_string", - "", charon->name), + "%s.plugins.certexpire.csv.empty_string", + "", lib->ns), .force = lib->settings->get_bool(lib->settings, - "%s.plugins.certexpire.csv.force", - TRUE, charon->name), + "%s.plugins.certexpire.csv.force", + TRUE, lib->ns), ); cron = lib->settings->get_str(lib->settings, "%s.plugins.certexpire.csv.cron", - NULL, charon->name); + NULL, lib->ns); if (cron) { this->cron = certexpire_cron_create(cron, diff --git a/src/libcharon/plugins/coupling/coupling_validator.c b/src/libcharon/plugins/coupling/coupling_validator.c index 958bd2b6d..fc35462e3 100644 --- a/src/libcharon/plugins/coupling/coupling_validator.c +++ b/src/libcharon/plugins/coupling/coupling_validator.c @@ -214,12 +214,11 @@ coupling_validator_t *coupling_validator_create() .mutex = mutex_create(MUTEX_TYPE_DEFAULT), .max_couplings = lib->settings->get_int(lib->settings, "%s.plugins.coupling.max", 1, - charon->name), + lib->ns), ); hash = lib->settings->get_str(lib->settings, - "%s.plugins.coupling.hash", "sha1", - charon->name); + "%s.plugins.coupling.hash", "sha1", lib->ns); this->hasher = lib->crypto->create_hasher(lib->crypto, enum_from_name(hash_algorithm_short_names, hash)); if (!this->hasher) @@ -230,8 +229,7 @@ coupling_validator_t *coupling_validator_create() } path = lib->settings->get_str(lib->settings, - "%s.plugins.coupling.file", NULL, - charon->name); + "%s.plugins.coupling.file", NULL, lib->ns); if (!path) { DBG1(DBG_CFG, "coupling file path unspecified"); diff --git a/src/libcharon/plugins/dhcp/dhcp_socket.c b/src/libcharon/plugins/dhcp/dhcp_socket.c index ac594c8fa..b8c1b4059 100644 --- a/src/libcharon/plugins/dhcp/dhcp_socket.c +++ b/src/libcharon/plugins/dhcp/dhcp_socket.c @@ -734,15 +734,15 @@ dhcp_socket_t *dhcp_socket_create() } this->identity_lease = lib->settings->get_bool(lib->settings, "%s.plugins.dhcp.identity_lease", FALSE, - charon->name); + lib->ns); this->force_dst = lib->settings->get_str(lib->settings, "%s.plugins.dhcp.force_server_address", FALSE, - charon->name); + lib->ns); this->dst = host_create_from_string(lib->settings->get_str(lib->settings, "%s.plugins.dhcp.server", "255.255.255.255", - charon->name), DHCP_SERVER_PORT); + lib->ns), DHCP_SERVER_PORT); iface = lib->settings->get_str(lib->settings, "%s.plugins.dhcp.interface", - NULL, charon->name); + NULL, lib->ns); if (!this->dst) { DBG1(DBG_CFG, "configured DHCP server address invalid"); diff --git a/src/libcharon/plugins/dnscert/dnscert_plugin.c b/src/libcharon/plugins/dnscert/dnscert_plugin.c index 713bc9e3b..1b93480cf 100644 --- a/src/libcharon/plugins/dnscert/dnscert_plugin.c +++ b/src/libcharon/plugins/dnscert/dnscert_plugin.c @@ -74,7 +74,7 @@ METHOD(plugin_t, reload, bool, private_dnscert_plugin_t *this) { bool enabled = lib->settings->get_bool(lib->settings, - "%s.plugins.dnscert.enable", FALSE, charon->name); + "%s.plugins.dnscert.enable", FALSE, lib->ns); if (enabled != this->enabled) { diff --git a/src/libcharon/plugins/duplicheck/duplicheck_notify.c b/src/libcharon/plugins/duplicheck/duplicheck_notify.c index e3a4e17b7..f77b48b09 100644 --- a/src/libcharon/plugins/duplicheck/duplicheck_notify.c +++ b/src/libcharon/plugins/duplicheck/duplicheck_notify.c @@ -130,7 +130,7 @@ duplicheck_notify_t *duplicheck_notify_create() uri = lib->settings->get_str(lib->settings, "%s.plugins.duplicheck.socket", "unix://" DUPLICHECK_SOCKET, - charon->name); + lib->ns); this->service = lib->streams->create_service(lib->streams, uri, 3); if (!this->service) { diff --git a/src/libcharon/plugins/duplicheck/duplicheck_plugin.c b/src/libcharon/plugins/duplicheck/duplicheck_plugin.c index 4d018dbef..689c795d8 100644 --- a/src/libcharon/plugins/duplicheck/duplicheck_plugin.c +++ b/src/libcharon/plugins/duplicheck/duplicheck_plugin.c @@ -93,7 +93,7 @@ plugin_t *duplicheck_plugin_create() private_duplicheck_plugin_t *this; if (!lib->settings->get_bool(lib->settings, - "%s.plugins.duplicheck.enable", TRUE, charon->name)) + "%s.plugins.duplicheck.enable", TRUE, lib->ns)) { return NULL; } diff --git a/src/libcharon/plugins/eap_aka/eap_aka_server.c b/src/libcharon/plugins/eap_aka/eap_aka_server.c index b7608382d..eba7af874 100644 --- a/src/libcharon/plugins/eap_aka/eap_aka_server.c +++ b/src/libcharon/plugins/eap_aka/eap_aka_server.c @@ -721,7 +721,7 @@ eap_aka_server_t *eap_aka_server_create(identification_t *server, this->permanent = peer->clone(peer); this->use_reauth = this->use_pseudonym = this->use_permanent = lib->settings->get_bool(lib->settings, - "%s.plugins.eap-aka.request_identity", TRUE, charon->name); + "%s.plugins.eap-aka.request_identity", TRUE, lib->ns); /* generate a non-zero identifier */ do { diff --git a/src/libcharon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_card.c b/src/libcharon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_card.c index 1bfc39e5a..a71dae78a 100644 --- a/src/libcharon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_card.c +++ b/src/libcharon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_card.c @@ -177,7 +177,7 @@ eap_aka_3gpp2_card_t *eap_aka_3gpp2_card_create(eap_aka_3gpp2_functions_t *f) #else /* !SEQ_CHECK */ FALSE, #endif /* SEQ_CHECK */ - charon->name), + lib->ns), ); eap_aka_3gpp2_get_sqn(this->sqn, 0); diff --git a/src/libcharon/plugins/eap_dynamic/eap_dynamic.c b/src/libcharon/plugins/eap_dynamic/eap_dynamic.c index d24cbd128..3216446af 100644 --- a/src/libcharon/plugins/eap_dynamic/eap_dynamic.c +++ b/src/libcharon/plugins/eap_dynamic/eap_dynamic.c @@ -377,14 +377,14 @@ eap_dynamic_t *eap_dynamic_create(identification_t *server, .server = server->clone(server), .types = linked_list_create(), .prefer_peer = lib->settings->get_bool(lib->settings, - "%s.plugins.eap-dynamic.prefer_peer", FALSE, charon->name), + "%s.plugins.eap-dynamic.prefer_peer", FALSE, lib->ns), ); /* get all supported EAP methods */ get_supported_eap_types(this); /* move preferred methods to the front */ preferred = lib->settings->get_str(lib->settings, - "%s.plugins.eap-dynamic.preferred", NULL, charon->name); + "%s.plugins.eap-dynamic.preferred", NULL, lib->ns); if (preferred) { handle_preferred_eap_types(this, preferred); diff --git a/src/libcharon/plugins/eap_gtc/eap_gtc.c b/src/libcharon/plugins/eap_gtc/eap_gtc.c index 2f64f325c..e751b51b6 100644 --- a/src/libcharon/plugins/eap_gtc/eap_gtc.c +++ b/src/libcharon/plugins/eap_gtc/eap_gtc.c @@ -149,7 +149,7 @@ METHOD(eap_method_t, process_server, status_t, /* get XAuth backend to use for credential verification. Default to PAM * to support legacy EAP-GTC configurations */ backend = lib->settings->get_str(lib->settings, - "%s.plugins.eap-gtc.backend", "pam", charon->name); + "%s.plugins.eap-gtc.backend", "pam", lib->ns); xauth = charon->xauth->create_instance(charon->xauth, backend, XAUTH_SERVER, this->server, this->peer); if (!xauth) diff --git a/src/libcharon/plugins/eap_peap/eap_peap.c b/src/libcharon/plugins/eap_peap/eap_peap.c index 8aba703c5..c24dd578c 100644 --- a/src/libcharon/plugins/eap_peap/eap_peap.c +++ b/src/libcharon/plugins/eap_peap/eap_peap.c @@ -157,18 +157,18 @@ static eap_peap_t *eap_peap_create(private_eap_peap_t * this, if (is_server && !lib->settings->get_bool(lib->settings, "%s.plugins.eap-peap.request_peer_auth", FALSE, - charon->name)) + lib->ns)) { peer = NULL; } frag_size = lib->settings->get_int(lib->settings, "%s.plugins.eap-peap.fragment_size", MAX_FRAGMENT_LEN, - charon->name); + lib->ns); max_msg_count = lib->settings->get_int(lib->settings, "%s.plugins.eap-peap.max_message_count", MAX_MESSAGE_COUNT, - charon->name); + lib->ns); include_length = lib->settings->get_bool(lib->settings, - "%s.plugins.eap-peap.include_length", FALSE, charon->name); + "%s.plugins.eap-peap.include_length", FALSE, lib->ns); tls = tls_create(is_server, server, peer, TLS_PURPOSE_EAP_PEAP, application, NULL); this->tls_eap = tls_eap_create(EAP_PEAP, tls, frag_size, max_msg_count, diff --git a/src/libcharon/plugins/eap_peap/eap_peap_server.c b/src/libcharon/plugins/eap_peap/eap_peap_server.c index 5237cb62c..33b01e95e 100644 --- a/src/libcharon/plugins/eap_peap/eap_peap_server.c +++ b/src/libcharon/plugins/eap_peap/eap_peap_server.c @@ -92,7 +92,7 @@ static status_t start_phase2_auth(private_eap_peap_server_t *this) eap_type_str = lib->settings->get_str(lib->settings, "%s.plugins.eap-peap.phase2_method", "mschapv2", - charon->name); + lib->ns); type = eap_type_from_string(eap_type_str); if (type == 0) { @@ -129,7 +129,7 @@ static status_t start_phase2_auth(private_eap_peap_server_t *this) static status_t start_phase2_tnc(private_eap_peap_server_t *this) { if (this->start_phase2_tnc && lib->settings->get_bool(lib->settings, - "%s.plugins.eap-peap.phase2_tnc", FALSE, charon->name)) + "%s.plugins.eap-peap.phase2_tnc", FALSE, lib->ns)) { DBG1(DBG_IKE, "phase2 method %N selected", eap_type_names, EAP_TNC); this->ph2_method = charon->eap->create_instance(charon->eap, EAP_TNC, @@ -274,7 +274,7 @@ METHOD(tls_application_t, process, status_t, /* Start Phase 2 of EAP-PEAP authentication */ if (lib->settings->get_bool(lib->settings, - "%s.plugins.eap-peap.request_peer_auth", FALSE, charon->name)) + "%s.plugins.eap-peap.request_peer_auth", FALSE, lib->ns)) { return start_phase2_tnc(this); } @@ -425,7 +425,7 @@ eap_peap_server_t *eap_peap_server_create(identification_t *server, .start_phase2_tnc = TRUE, .start_phase2_id = lib->settings->get_bool(lib->settings, "%s.plugins.eap-peap.phase2_piggyback", - FALSE, charon->name), + FALSE, lib->ns), .phase2_result = EAP_FAILURE, .avp = eap_peap_avp_create(TRUE), ); diff --git a/src/libcharon/plugins/eap_radius/eap_radius.c b/src/libcharon/plugins/eap_radius/eap_radius.c index 6087a528f..6719497d3 100644 --- a/src/libcharon/plugins/eap_radius/eap_radius.c +++ b/src/libcharon/plugins/eap_radius/eap_radius.c @@ -188,7 +188,7 @@ void eap_radius_build_attributes(radius_message_t *request) } if (lib->settings->get_bool(lib->settings, "%s.plugins.eap-radius.station_id_with_port", - TRUE, charon->name)) + TRUE, lib->ns)) { station_id_fmt = "%#H"; } @@ -573,12 +573,12 @@ static void process_cfg_attributes(radius_message_t *msg) void eap_radius_process_attributes(radius_message_t *message) { if (lib->settings->get_bool(lib->settings, - "%s.plugins.eap-radius.class_group", FALSE, charon->name)) + "%s.plugins.eap-radius.class_group", FALSE, lib->ns)) { process_class(message); } if (lib->settings->get_bool(lib->settings, - "%s.plugins.eap-radius.filter_id", FALSE, charon->name)) + "%s.plugins.eap-radius.filter_id", FALSE, lib->ns)) { process_filter_id(message); } @@ -720,10 +720,10 @@ eap_radius_t *eap_radius_create(identification_t *server, identification_t *peer .type = EAP_RADIUS, .eap_start = lib->settings->get_bool(lib->settings, "%s.plugins.eap-radius.eap_start", FALSE, - charon->name), + lib->ns), .id_prefix = lib->settings->get_str(lib->settings, "%s.plugins.eap-radius.id_prefix", "", - charon->name), + lib->ns), ); this->client = eap_radius_create_client(); if (!this->client) diff --git a/src/libcharon/plugins/eap_radius/eap_radius_accounting.c b/src/libcharon/plugins/eap_radius/eap_radius_accounting.c index afb661e19..8c780e78d 100644 --- a/src/libcharon/plugins/eap_radius/eap_radius_accounting.c +++ b/src/libcharon/plugins/eap_radius/eap_radius_accounting.c @@ -712,7 +712,7 @@ eap_radius_accounting_t *eap_radius_accounting_create() .mutex = mutex_create(MUTEX_TYPE_DEFAULT), ); if (lib->settings->get_bool(lib->settings, - "%s.plugins.eap-radius.station_id_with_port", TRUE, charon->name)) + "%s.plugins.eap-radius.station_id_with_port", TRUE, lib->ns)) { this->station_id_fmt = "%#H"; } @@ -721,14 +721,14 @@ eap_radius_accounting_t *eap_radius_accounting_create() this->station_id_fmt = "%H"; } if (lib->settings->get_bool(lib->settings, - "%s.plugins.eap-radius.accounting", FALSE, charon->name)) + "%s.plugins.eap-radius.accounting", FALSE, lib->ns)) { singleton = this; charon->bus->add_listener(charon->bus, &this->public.listener); } this->acct_req_vip = lib->settings->get_bool(lib->settings, "%s.plugins.eap-radius.accounting_requires_vip", - FALSE, charon->name); + FALSE, lib->ns); return &this->public; } diff --git a/src/libcharon/plugins/eap_radius/eap_radius_dae.c b/src/libcharon/plugins/eap_radius/eap_radius_dae.c index f22ddc56f..a0bf99efd 100644 --- a/src/libcharon/plugins/eap_radius/eap_radius_dae.c +++ b/src/libcharon/plugins/eap_radius/eap_radius_dae.c @@ -452,11 +452,11 @@ static bool open_socket(private_eap_radius_dae_t *this) host = host_create_from_string( lib->settings->get_str(lib->settings, - "%s.plugins.eap-radius.dae.listen", "0.0.0.0", - charon->name), + "%s.plugins.eap-radius.dae.listen", "0.0.0.0", + lib->ns), lib->settings->get_int(lib->settings, - "%s.plugins.eap-radius.dae.port", RADIUS_DAE_PORT, - charon->name)); + "%s.plugins.eap-radius.dae.port", RADIUS_DAE_PORT, + lib->ns)); if (!host) { DBG1(DBG_CFG, "invalid RADIUS DAE listen address"); @@ -504,7 +504,7 @@ eap_radius_dae_t *eap_radius_dae_create(eap_radius_accounting_t *accounting) .secret = { .ptr = lib->settings->get_str(lib->settings, "%s.plugins.eap-radius.dae.secret", NULL, - charon->name), + lib->ns), }, .hasher = lib->crypto->create_hasher(lib->crypto, HASH_MD5), .signer = lib->crypto->create_signer(lib->crypto, AUTH_HMAC_MD5_128), diff --git a/src/libcharon/plugins/eap_radius/eap_radius_forward.c b/src/libcharon/plugins/eap_radius/eap_radius_forward.c index 3e80e8918..b873e1d69 100644 --- a/src/libcharon/plugins/eap_radius/eap_radius_forward.c +++ b/src/libcharon/plugins/eap_radius/eap_radius_forward.c @@ -438,10 +438,10 @@ eap_radius_forward_t *eap_radius_forward_create() }, .from_attr = parse_selector(lib->settings->get_str(lib->settings, "%s.plugins.eap-radius.forward.ike_to_radius", "", - charon->name)), + lib->ns)), .to_attr = parse_selector(lib->settings->get_str(lib->settings, "%s.plugins.eap-radius.forward.radius_to_ike", "", - charon->name)), + lib->ns)), .from = hashtable_create((hashtable_hash_t)hash, (hashtable_equals_t)equals, 8), .to = hashtable_create((hashtable_hash_t)hash, diff --git a/src/libcharon/plugins/eap_radius/eap_radius_plugin.c b/src/libcharon/plugins/eap_radius/eap_radius_plugin.c index 90a4ef6de..1a48c07e5 100644 --- a/src/libcharon/plugins/eap_radius/eap_radius_plugin.c +++ b/src/libcharon/plugins/eap_radius/eap_radius_plugin.c @@ -100,23 +100,23 @@ static void load_configs(private_eap_radius_plugin_t *this) int auth_port, acct_port, sockets, preference; address = lib->settings->get_str(lib->settings, - "%s.plugins.eap-radius.server", NULL, charon->name); + "%s.plugins.eap-radius.server", NULL, lib->ns); if (address) { /* legacy configuration */ secret = lib->settings->get_str(lib->settings, - "%s.plugins.eap-radius.secret", NULL, charon->name); + "%s.plugins.eap-radius.secret", NULL, lib->ns); if (!secret) { DBG1(DBG_CFG, "no RADIUS secret defined"); return; } nas_identifier = lib->settings->get_str(lib->settings, - "%s.plugins.eap-radius.nas_identifier", "strongSwan", - charon->name); + "%s.plugins.eap-radius.nas_identifier", "strongSwan", + lib->ns); auth_port = lib->settings->get_int(lib->settings, - "%s.plugins.eap-radius.port", AUTH_PORT, charon->name); + "%s.plugins.eap-radius.port", AUTH_PORT, lib->ns); sockets = lib->settings->get_int(lib->settings, - "%s.plugins.eap-radius.sockets", 1, charon->name); + "%s.plugins.eap-radius.sockets", 1, lib->ns); config = radius_config_create(address, address, auth_port, ACCT_PORT, nas_identifier, secret, sockets, 0); if (!config) @@ -129,12 +129,12 @@ static void load_configs(private_eap_radius_plugin_t *this) } enumerator = lib->settings->create_section_enumerator(lib->settings, - "%s.plugins.eap-radius.servers", charon->name); + "%s.plugins.eap-radius.servers", lib->ns); while (enumerator->enumerate(enumerator, §ion)) { address = lib->settings->get_str(lib->settings, "%s.plugins.eap-radius.servers.%s.address", NULL, - charon->name, section); + lib->ns, section); if (!address) { DBG1(DBG_CFG, "RADIUS server '%s' misses address, skipped", section); @@ -142,7 +142,7 @@ static void load_configs(private_eap_radius_plugin_t *this) } secret = lib->settings->get_str(lib->settings, "%s.plugins.eap-radius.servers.%s.secret", NULL, - charon->name, section); + lib->ns, section); if (!secret) { DBG1(DBG_CFG, "RADIUS server '%s' misses secret, skipped", section); @@ -150,22 +150,22 @@ static void load_configs(private_eap_radius_plugin_t *this) } nas_identifier = lib->settings->get_str(lib->settings, "%s.plugins.eap-radius.servers.%s.nas_identifier", "strongSwan", - charon->name, section); + lib->ns, section); auth_port = lib->settings->get_int(lib->settings, "%s.plugins.eap-radius.servers.%s.auth_port", lib->settings->get_int(lib->settings, "%s.plugins.eap-radius.servers.%s.port", - AUTH_PORT, charon->name, section), - charon->name, section); + AUTH_PORT, lib->ns, section), + lib->ns, section); acct_port = lib->settings->get_int(lib->settings, "%s.plugins.eap-radius.servers.%s.acct_port", ACCT_PORT, - charon->name, section); + lib->ns, section); sockets = lib->settings->get_int(lib->settings, "%s.plugins.eap-radius.servers.%s.sockets", 1, - charon->name, section); + lib->ns, section); preference = lib->settings->get_int(lib->settings, "%s.plugins.eap-radius.servers.%s.preference", 0, - charon->name, section); + lib->ns, section); config = radius_config_create(section, address, auth_port, acct_port, nas_identifier, secret, sockets, preference); if (!config) @@ -203,7 +203,7 @@ static bool plugin_cb(private_eap_radius_plugin_t *this, load_configs(this); if (lib->settings->get_bool(lib->settings, - "%s.plugins.eap-radius.dae.enable", FALSE, charon->name)) + "%s.plugins.eap-radius.dae.enable", FALSE, lib->ns)) { this->dae = eap_radius_dae_create(this->accounting); } @@ -368,7 +368,7 @@ void eap_radius_handle_timeout(ike_sa_id_t *id) if (lib->settings->get_bool(lib->settings, "%s.plugins.eap-radius.close_all_on_timeout", - FALSE, charon->name)) + FALSE, lib->ns)) { DBG1(DBG_CFG, "deleting all IKE_SAs after RADIUS timeout"); lib->processor->queue_job(lib->processor, diff --git a/src/libcharon/plugins/eap_radius/eap_radius_xauth.c b/src/libcharon/plugins/eap_radius/eap_radius_xauth.c index e66bbf38f..d00f6bb2c 100644 --- a/src/libcharon/plugins/eap_radius/eap_radius_xauth.c +++ b/src/libcharon/plugins/eap_radius/eap_radius_xauth.c @@ -256,7 +256,7 @@ static bool parse_rounds(private_eap_radius_xauth_t *this, char *profile) } enumerator = lib->settings->create_key_value_enumerator(lib->settings, - "%s.plugins.eap-radius.xauth.%s", charon->name, profile); + "%s.plugins.eap-radius.xauth.%s", lib->ns, profile); while (enumerator->enumerate(enumerator, &type, &message)) { bool invalid = TRUE; diff --git a/src/libcharon/plugins/eap_sim/eap_sim_server.c b/src/libcharon/plugins/eap_sim/eap_sim_server.c index 334e2df1d..f22266bda 100644 --- a/src/libcharon/plugins/eap_sim/eap_sim_server.c +++ b/src/libcharon/plugins/eap_sim/eap_sim_server.c @@ -635,7 +635,7 @@ eap_sim_server_t *eap_sim_server_create(identification_t *server, this->use_reauth = this->use_pseudonym = this->use_permanent = lib->settings->get_bool(lib->settings, "%s.plugins.eap-sim.request_identity", TRUE, - charon->name); + lib->ns); /* generate a non-zero identifier */ do { diff --git a/src/libcharon/plugins/eap_simaka_sql/eap_simaka_sql_plugin.c b/src/libcharon/plugins/eap_simaka_sql/eap_simaka_sql_plugin.c index 6bcc58e66..176321833 100644 --- a/src/libcharon/plugins/eap_simaka_sql/eap_simaka_sql_plugin.c +++ b/src/libcharon/plugins/eap_simaka_sql/eap_simaka_sql_plugin.c @@ -66,7 +66,7 @@ static bool load_db(private_eap_simaka_sql_t *this, uri = lib->settings->get_str(lib->settings, "%s.plugins.eap-simaka-sql.database", NULL, - charon->name); + lib->ns); if (!uri) { DBG1(DBG_CFG, "eap-simaka-sql database URI missing"); @@ -80,7 +80,7 @@ static bool load_db(private_eap_simaka_sql_t *this, } remove_used = lib->settings->get_bool(lib->settings, "%s.plugins.eap-simaka-sql.remove_used", FALSE, - charon->name); + lib->ns); this->provider = eap_simaka_sql_provider_create(this->db, remove_used); this->card = eap_simaka_sql_card_create(this->db, remove_used); diff --git a/src/libcharon/plugins/eap_tls/eap_tls.c b/src/libcharon/plugins/eap_tls/eap_tls.c index 48e38755d..dffbaf266 100644 --- a/src/libcharon/plugins/eap_tls/eap_tls.c +++ b/src/libcharon/plugins/eap_tls/eap_tls.c @@ -145,12 +145,12 @@ static eap_tls_t *eap_tls_create(identification_t *server, frag_size = lib->settings->get_int(lib->settings, "%s.plugins.eap-tls.fragment_size", MAX_FRAGMENT_LEN, - charon->name); + lib->ns); max_msg_count = lib->settings->get_int(lib->settings, "%s.plugins.eap-tls.max_message_count", MAX_MESSAGE_COUNT, - charon->name); + lib->ns); include_length = lib->settings->get_bool(lib->settings, - "%s.plugins.eap-tls.include_length", TRUE, charon->name); + "%s.plugins.eap-tls.include_length", TRUE, lib->ns); tls = tls_create(is_server, server, peer, TLS_PURPOSE_EAP_TLS, NULL, NULL); this->tls_eap = tls_eap_create(EAP_TLS, tls, frag_size, max_msg_count, include_length); diff --git a/src/libcharon/plugins/eap_tnc/eap_tnc.c b/src/libcharon/plugins/eap_tnc/eap_tnc.c index f9ab74258..2147c0482 100644 --- a/src/libcharon/plugins/eap_tnc/eap_tnc.c +++ b/src/libcharon/plugins/eap_tnc/eap_tnc.c @@ -273,10 +273,10 @@ static eap_tnc_t *eap_tnc_create(identification_t *server, ); max_msg_count = lib->settings->get_int(lib->settings, - "%s.plugins.eap-tnc.max_message_count", - EAP_TNC_MAX_MESSAGE_COUNT, charon->name); + "%s.plugins.eap-tnc.max_message_count", + EAP_TNC_MAX_MESSAGE_COUNT, lib->ns); protocol = lib->settings->get_str(lib->settings, - "%s.plugins.eap-tnc.protocol", "tnccs-1.1", charon->name); + "%s.plugins.eap-tnc.protocol", "tnccs-1.1", lib->ns); if (strcaseeq(protocol, "tnccs-2.0")) { type = TNCCS_2_0; diff --git a/src/libcharon/plugins/eap_ttls/eap_ttls.c b/src/libcharon/plugins/eap_ttls/eap_ttls.c index ebd1c5479..703cd3f29 100644 --- a/src/libcharon/plugins/eap_ttls/eap_ttls.c +++ b/src/libcharon/plugins/eap_ttls/eap_ttls.c @@ -147,18 +147,18 @@ static eap_ttls_t *eap_ttls_create(identification_t *server, ); if (is_server && !lib->settings->get_bool(lib->settings, "%s.plugins.eap-ttls.request_peer_auth", FALSE, - charon->name)) + lib->ns)) { peer = NULL; } frag_size = lib->settings->get_int(lib->settings, "%s.plugins.eap-ttls.fragment_size", MAX_FRAGMENT_LEN, - charon->name); + lib->ns); max_msg_count = lib->settings->get_int(lib->settings, "%s.plugins.eap-ttls.max_message_count", MAX_MESSAGE_COUNT, - charon->name); + lib->ns); include_length = lib->settings->get_bool(lib->settings, - "%s.plugins.eap-ttls.include_length", TRUE, charon->name); + "%s.plugins.eap-ttls.include_length", TRUE, lib->ns); tls = tls_create(is_server, server, peer, TLS_PURPOSE_EAP_TTLS, application, NULL); this->tls_eap = tls_eap_create(EAP_TTLS, tls, frag_size, max_msg_count, diff --git a/src/libcharon/plugins/eap_ttls/eap_ttls_server.c b/src/libcharon/plugins/eap_ttls/eap_ttls_server.c index eef8d6682..88c2b88c6 100644 --- a/src/libcharon/plugins/eap_ttls/eap_ttls_server.c +++ b/src/libcharon/plugins/eap_ttls/eap_ttls_server.c @@ -80,7 +80,7 @@ static status_t start_phase2_auth(private_eap_ttls_server_t *this) eap_type_str = lib->settings->get_str(lib->settings, "%s.plugins.eap-ttls.phase2_method", "md5", - charon->name); + lib->ns); type = eap_type_from_string(eap_type_str); if (type == 0) { @@ -115,7 +115,7 @@ static status_t start_phase2_tnc(private_eap_ttls_server_t *this, eap_inner_method_t *inner_method; if (this->start_phase2_tnc && lib->settings->get_bool(lib->settings, - "%s.plugins.eap-ttls.phase2_tnc", FALSE, charon->name)) + "%s.plugins.eap-ttls.phase2_tnc", FALSE, lib->ns)) { DBG1(DBG_IKE, "phase2 method %N selected", eap_type_names, EAP_TNC); this->method = charon->eap->create_instance(charon->eap, EAP_TNC, @@ -242,7 +242,7 @@ METHOD(tls_application_t, process, status_t, /* Start Phase 2 of EAP-TTLS authentication */ if (lib->settings->get_bool(lib->settings, - "%s.plugins.eap-ttls.request_peer_auth", FALSE, charon->name)) + "%s.plugins.eap-ttls.request_peer_auth", FALSE, lib->ns)) { return start_phase2_tnc(this, EAP_TLS); } @@ -301,7 +301,7 @@ METHOD(tls_application_t, build, status_t, if (this->method == NULL && this->start_phase2 && lib->settings->get_bool(lib->settings, - "%s.plugins.eap-ttls.phase2_piggyback", FALSE, charon->name)) + "%s.plugins.eap-ttls.phase2_piggyback", FALSE, lib->ns)) { /* generate an EAP Identity request which will be piggybacked right * onto the TLS Finished message thus initiating EAP-TTLS phase2 diff --git a/src/libcharon/plugins/error_notify/error_notify_socket.c b/src/libcharon/plugins/error_notify/error_notify_socket.c index aafd0a4cd..959c4c67d 100644 --- a/src/libcharon/plugins/error_notify/error_notify_socket.c +++ b/src/libcharon/plugins/error_notify/error_notify_socket.c @@ -142,7 +142,7 @@ error_notify_socket_t *error_notify_socket_create() uri = lib->settings->get_str(lib->settings, "%s.plugins.error-notify.socket", "unix://" ERROR_NOTIFY_SOCKET, - charon->name); + lib->ns); this->service = lib->streams->create_service(lib->streams, uri, 10); if (!this->service) { diff --git a/src/libcharon/plugins/ha/ha_attribute.c b/src/libcharon/plugins/ha/ha_attribute.c index d26c38325..dd55fae8b 100644 --- a/src/libcharon/plugins/ha/ha_attribute.c +++ b/src/libcharon/plugins/ha/ha_attribute.c @@ -309,7 +309,7 @@ static void load_pools(private_ha_attribute_t *this) pool_t *pool; enumerator = lib->settings->create_key_value_enumerator(lib->settings, - "%s.plugins.ha.pools", charon->name); + "%s.plugins.ha.pools", lib->ns); while (enumerator->enumerate(enumerator, &name, &net)) { net = strdup(net); diff --git a/src/libcharon/plugins/ha/ha_plugin.c b/src/libcharon/plugins/ha/ha_plugin.c index 5d4cc6184..493cad5ec 100644 --- a/src/libcharon/plugins/ha/ha_plugin.c +++ b/src/libcharon/plugins/ha/ha_plugin.c @@ -160,19 +160,19 @@ plugin_t *ha_plugin_create() bool fifo, monitor, resync; local = lib->settings->get_str(lib->settings, - "%s.plugins.ha.local", NULL, charon->name); + "%s.plugins.ha.local", NULL, lib->ns); remote = lib->settings->get_str(lib->settings, - "%s.plugins.ha.remote", NULL, charon->name); + "%s.plugins.ha.remote", NULL, lib->ns); secret = lib->settings->get_str(lib->settings, - "%s.plugins.ha.secret", NULL, charon->name); + "%s.plugins.ha.secret", NULL, lib->ns); fifo = lib->settings->get_bool(lib->settings, - "%s.plugins.ha.fifo_interface", TRUE, charon->name); + "%s.plugins.ha.fifo_interface", TRUE, lib->ns); monitor = lib->settings->get_bool(lib->settings, - "%s.plugins.ha.monitor", TRUE, charon->name); + "%s.plugins.ha.monitor", TRUE, lib->ns); resync = lib->settings->get_bool(lib->settings, - "%s.plugins.ha.resync", TRUE, charon->name); + "%s.plugins.ha.resync", TRUE, lib->ns); count = min(SEGMENTS_MAX, lib->settings->get_int(lib->settings, - "%s.plugins.ha.segment_count", 1, charon->name)); + "%s.plugins.ha.segment_count", 1, lib->ns)); if (!local || !remote) { DBG1(DBG_CFG, "HA config misses local/remote address"); diff --git a/src/libcharon/plugins/ha/ha_segments.c b/src/libcharon/plugins/ha/ha_segments.c index cab38c63d..fc7d7a8b4 100644 --- a/src/libcharon/plugins/ha/ha_segments.c +++ b/src/libcharon/plugins/ha/ha_segments.c @@ -470,12 +470,12 @@ ha_segments_t *ha_segments_create(ha_socket_t *socket, ha_kernel_t *kernel, .condvar = condvar_create(CONDVAR_TYPE_DEFAULT), .heartbeat_delay = lib->settings->get_int(lib->settings, "%s.plugins.ha.heartbeat_delay", DEFAULT_HEARTBEAT_DELAY, - charon->name), + lib->ns), .heartbeat_timeout = lib->settings->get_int(lib->settings, "%s.plugins.ha.heartbeat_timeout", DEFAULT_HEARTBEAT_TIMEOUT, - charon->name), + lib->ns), .autobalance = lib->settings->get_int(lib->settings, - "%s.plugins.ha.autobalance", 0, charon->name), + "%s.plugins.ha.autobalance", 0, lib->ns), ); if (monitor) diff --git a/src/libcharon/plugins/ipseckey/ipseckey_plugin.c b/src/libcharon/plugins/ipseckey/ipseckey_plugin.c index 9bc49ba28..9f00abe8b 100644 --- a/src/libcharon/plugins/ipseckey/ipseckey_plugin.c +++ b/src/libcharon/plugins/ipseckey/ipseckey_plugin.c @@ -53,7 +53,7 @@ METHOD(plugin_t, reload, bool, private_ipseckey_plugin_t *this) { bool enabled = lib->settings->get_bool(lib->settings, - "%s.plugins.ipseckey.enable", FALSE, charon->name); + "%s.plugins.ipseckey.enable", FALSE, lib->ns); if (enabled != this->enabled) { diff --git a/src/libcharon/plugins/kernel_libipsec/kernel_libipsec_ipsec.c b/src/libcharon/plugins/kernel_libipsec/kernel_libipsec_ipsec.c index d0744e300..b33580700 100644 --- a/src/libcharon/plugins/kernel_libipsec/kernel_libipsec_ipsec.c +++ b/src/libcharon/plugins/kernel_libipsec/kernel_libipsec_ipsec.c @@ -695,7 +695,7 @@ kernel_libipsec_ipsec_t *kernel_libipsec_ipsec_create() .policies = linked_list_create(), .excludes = linked_list_create(), .allow_peer_ts = lib->settings->get_bool(lib->settings, - "%s.plugins.kernel-libipsec.allow_peer_ts", FALSE, hydra->daemon), + "%s.plugins.kernel-libipsec.allow_peer_ts", FALSE, lib->ns), ); ipsec->events->register_listener(ipsec->events, &this->ipsec_listener); diff --git a/src/libcharon/plugins/kernel_libipsec/kernel_libipsec_plugin.c b/src/libcharon/plugins/kernel_libipsec/kernel_libipsec_plugin.c index 56f526217..e3b688dd6 100644 --- a/src/libcharon/plugins/kernel_libipsec/kernel_libipsec_plugin.c +++ b/src/libcharon/plugins/kernel_libipsec/kernel_libipsec_plugin.c @@ -144,6 +144,6 @@ plugin_t *kernel_libipsec_plugin_create() /* set TUN device as default to install VIPs */ lib->settings->set_str(lib->settings, "%s.install_virtual_ip_on", - this->tun->get_name(this->tun), charon->name); + this->tun->get_name(this->tun), lib->ns); return &this->public.plugin; } diff --git a/src/libcharon/plugins/led/led_listener.c b/src/libcharon/plugins/led/led_listener.c index be80bcde2..3351f6614 100644 --- a/src/libcharon/plugins/led/led_listener.c +++ b/src/libcharon/plugins/led/led_listener.c @@ -230,12 +230,12 @@ led_listener_t *led_listener_create() }, .mutex = mutex_create(MUTEX_TYPE_DEFAULT), .blink_time = lib->settings->get_int(lib->settings, - "%s.plugins.led.blink_time", 50, charon->name), + "%s.plugins.led.blink_time", 50, lib->ns), ); this->activity = open_led(lib->settings->get_str(lib->settings, - "%s.plugins.led.activity_led", NULL, charon->name), - &this->activity_max); + "%s.plugins.led.activity_led", NULL, lib->ns), + &this->activity_max); set_led(this->activity, 0); return &this->public; diff --git a/src/libcharon/plugins/load_tester/load_tester_config.c b/src/libcharon/plugins/load_tester/load_tester_config.c index e4e47c1ac..e133190b4 100644 --- a/src/libcharon/plugins/load_tester/load_tester_config.c +++ b/src/libcharon/plugins/load_tester/load_tester_config.c @@ -236,11 +236,11 @@ static void load_addrs(private_load_tester_config_t *this) mem_pool_t *pool; this->keep = lib->settings->get_bool(lib->settings, - "%s.plugins.load-tester.addrs_keep", FALSE, charon->name); + "%s.plugins.load-tester.addrs_keep", FALSE, lib->ns); this->prefix = lib->settings->get_int(lib->settings, - "%s.plugins.load-tester.addrs_prefix", 16, charon->name); + "%s.plugins.load-tester.addrs_prefix", 16, lib->ns); enumerator = lib->settings->create_key_value_enumerator(lib->settings, - "%s.plugins.load-tester.addrs", charon->name); + "%s.plugins.load-tester.addrs", lib->ns); while (enumerator->enumerate(enumerator, &iface, &token)) { tokens = enumerator_create_token(token, ",", " "); @@ -917,72 +917,71 @@ load_tester_config_t *load_tester_config_create() ); if (lib->settings->get_bool(lib->settings, - "%s.plugins.load-tester.request_virtual_ip", FALSE, charon->name)) + "%s.plugins.load-tester.request_virtual_ip", FALSE, lib->ns)) { this->vip = host_create_from_string("0.0.0.0", 0); } this->pool = lib->settings->get_str(lib->settings, - "%s.plugins.load-tester.pool", NULL, charon->name); + "%s.plugins.load-tester.pool", NULL, lib->ns); this->initiator = lib->settings->get_str(lib->settings, - "%s.plugins.load-tester.initiator", "0.0.0.0", charon->name); + "%s.plugins.load-tester.initiator", "0.0.0.0", lib->ns); this->responder = lib->settings->get_str(lib->settings, - "%s.plugins.load-tester.responder", "127.0.0.1", charon->name); + "%s.plugins.load-tester.responder", "127.0.0.1", lib->ns); this->proposal = proposal_create_from_string(PROTO_IKE, lib->settings->get_str(lib->settings, "%s.plugins.load-tester.proposal", "aes128-sha1-modp768", - charon->name)); + lib->ns)); if (!this->proposal) { /* fallback */ this->proposal = proposal_create_from_string(PROTO_IKE, "aes128-sha1-modp768"); } this->esp = proposal_create_from_string(PROTO_ESP, - lib->settings->get_str(lib->settings, - "%s.plugins.load-tester.esp", "aes128-sha1", - charon->name)); + lib->settings->get_str(lib->settings, + "%s.plugins.load-tester.esp", "aes128-sha1", lib->ns)); if (!this->esp) { /* fallback */ this->esp = proposal_create_from_string(PROTO_ESP, "aes128-sha1"); } this->ike_rekey = lib->settings->get_int(lib->settings, - "%s.plugins.load-tester.ike_rekey", 0, charon->name); + "%s.plugins.load-tester.ike_rekey", 0, lib->ns); this->child_rekey = lib->settings->get_int(lib->settings, - "%s.plugins.load-tester.child_rekey", 600, charon->name); + "%s.plugins.load-tester.child_rekey", 600, lib->ns); this->dpd_delay = lib->settings->get_int(lib->settings, - "%s.plugins.load-tester.dpd_delay", 0, charon->name); + "%s.plugins.load-tester.dpd_delay", 0, lib->ns); this->dpd_timeout = lib->settings->get_int(lib->settings, - "%s.plugins.load-tester.dpd_timeout", 0, charon->name); + "%s.plugins.load-tester.dpd_timeout", 0, lib->ns); this->initiator_auth = lib->settings->get_str(lib->settings, - "%s.plugins.load-tester.initiator_auth", "pubkey", charon->name); + "%s.plugins.load-tester.initiator_auth", "pubkey", lib->ns); this->responder_auth = lib->settings->get_str(lib->settings, - "%s.plugins.load-tester.responder_auth", "pubkey", charon->name); + "%s.plugins.load-tester.responder_auth", "pubkey", lib->ns); this->initiator_id = lib->settings->get_str(lib->settings, - "%s.plugins.load-tester.initiator_id", NULL, charon->name); + "%s.plugins.load-tester.initiator_id", NULL, lib->ns); this->initiator_match = lib->settings->get_str(lib->settings, - "%s.plugins.load-tester.initiator_match", NULL, charon->name); + "%s.plugins.load-tester.initiator_match", NULL, lib->ns); this->responder_id = lib->settings->get_str(lib->settings, - "%s.plugins.load-tester.responder_id", NULL, charon->name); + "%s.plugins.load-tester.responder_id", NULL, lib->ns); this->mode = lib->settings->get_str(lib->settings, - "%s.plugins.load-tester.mode", NULL, charon->name); + "%s.plugins.load-tester.mode", NULL, lib->ns); this->initiator_tsi = lib->settings->get_str(lib->settings, - "%s.plugins.load-tester.initiator_tsi", NULL, charon->name); + "%s.plugins.load-tester.initiator_tsi", NULL, lib->ns); this->responder_tsi =lib->settings->get_str(lib->settings, - "%s.plugins.load-tester.responder_tsi", - this->initiator_tsi, charon->name); + "%s.plugins.load-tester.responder_tsi", + this->initiator_tsi, lib->ns); this->initiator_tsr = lib->settings->get_str(lib->settings, - "%s.plugins.load-tester.initiator_tsr", NULL, charon->name); + "%s.plugins.load-tester.initiator_tsr", NULL, lib->ns); this->responder_tsr =lib->settings->get_str(lib->settings, - "%s.plugins.load-tester.responder_tsr", - this->initiator_tsr, charon->name); + "%s.plugins.load-tester.responder_tsr", + this->initiator_tsr, lib->ns); this->port = lib->settings->get_int(lib->settings, - "%s.plugins.load-tester.dynamic_port", 0, charon->name); + "%s.plugins.load-tester.dynamic_port", 0, lib->ns); this->version = lib->settings->get_int(lib->settings, - "%s.plugins.load-tester.version", IKE_ANY, charon->name); + "%s.plugins.load-tester.version", IKE_ANY, lib->ns); load_addrs(this); diff --git a/src/libcharon/plugins/load_tester/load_tester_control.c b/src/libcharon/plugins/load_tester/load_tester_control.c index f9ec9142f..5f089f5db 100644 --- a/src/libcharon/plugins/load_tester/load_tester_control.c +++ b/src/libcharon/plugins/load_tester/load_tester_control.c @@ -302,7 +302,7 @@ load_tester_control_t *load_tester_control_create() uri = lib->settings->get_str(lib->settings, "%s.plugins.load-tester.socket", "unix://" LOAD_TESTER_SOCKET, - charon->name); + lib->ns); this->service = lib->streams->create_service(lib->streams, uri, 10); if (this->service) { diff --git a/src/libcharon/plugins/load_tester/load_tester_creds.c b/src/libcharon/plugins/load_tester/load_tester_creds.c index 028205bd2..f17d41f46 100644 --- a/src/libcharon/plugins/load_tester/load_tester_creds.c +++ b/src/libcharon/plugins/load_tester/load_tester_creds.c @@ -202,7 +202,7 @@ static private_key_t *load_issuer_key() char *path; path = lib->settings->get_str(lib->settings, - "%s.plugins.load-tester.issuer_key", NULL, charon->name); + "%s.plugins.load-tester.issuer_key", NULL, lib->ns); if (!path) { return lib->creds->create(lib->creds, CRED_PRIVATE_KEY, KEY_RSA, @@ -222,7 +222,7 @@ static certificate_t *load_issuer_cert() char *path; path = lib->settings->get_str(lib->settings, - "%s.plugins.load-tester.issuer_cert", NULL, charon->name); + "%s.plugins.load-tester.issuer_cert", NULL, lib->ns); if (!path) { return lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509, @@ -246,7 +246,7 @@ static void load_ca_certs(private_load_tester_creds_t *this) char *path; path = lib->settings->get_str(lib->settings, - "%s.plugins.load-tester.ca_dir", NULL, charon->name); + "%s.plugins.load-tester.ca_dir", NULL, lib->ns); if (path) { enumerator = enumerator_create_directory(path); @@ -445,11 +445,11 @@ load_tester_creds_t *load_tester_creds_create() char *pwd, *psk, *digest; psk = lib->settings->get_str(lib->settings, - "%s.plugins.load-tester.preshared_key", default_psk, charon->name); + "%s.plugins.load-tester.preshared_key", default_psk, lib->ns); pwd = lib->settings->get_str(lib->settings, - "%s.plugins.load-tester.eap_password", default_pwd, charon->name); + "%s.plugins.load-tester.eap_password", default_pwd, lib->ns); digest = lib->settings->get_str(lib->settings, - "%s.plugins.load-tester.digest", "sha1", charon->name); + "%s.plugins.load-tester.digest", "sha1", lib->ns); INIT(this, .public = { diff --git a/src/libcharon/plugins/load_tester/load_tester_listener.c b/src/libcharon/plugins/load_tester/load_tester_listener.c index 7e832ddc0..068020ef7 100644 --- a/src/libcharon/plugins/load_tester/load_tester_listener.c +++ b/src/libcharon/plugins/load_tester/load_tester_listener.c @@ -126,7 +126,7 @@ load_tester_listener_t *load_tester_listener_create(u_int shutdown_on, }, .delete_after_established = lib->settings->get_bool(lib->settings, "%s.plugins.load-tester.delete_after_established", FALSE, - charon->name), + lib->ns), .shutdown_on = shutdown_on, .config = config, ); diff --git a/src/libcharon/plugins/load_tester/load_tester_plugin.c b/src/libcharon/plugins/load_tester/load_tester_plugin.c index 03557a269..e684f22ce 100644 --- a/src/libcharon/plugins/load_tester/load_tester_plugin.c +++ b/src/libcharon/plugins/load_tester/load_tester_plugin.c @@ -193,7 +193,7 @@ static bool register_load_tester(private_load_tester_plugin_t *this, lib->credmgr->add_set(lib->credmgr, &this->creds->credential_set); if (lib->settings->get_bool(lib->settings, - "%s.plugins.load-tester.shutdown_when_complete", 0, charon->name)) + "%s.plugins.load-tester.shutdown_when_complete", 0, lib->ns)) { shutdown_on = this->iterations * this->initiators; } @@ -262,8 +262,8 @@ plugin_t *load_tester_plugin_create() { private_load_tester_plugin_t *this; - if (!lib->settings->get_bool(lib->settings, - "%s.plugins.load-tester.enable", FALSE, charon->name)) + if (!lib->settings->get_bool(lib->settings, "%s.plugins.load-tester.enable", + FALSE, lib->ns)) { DBG1(DBG_CFG, "disabling load-tester plugin, not configured"); return NULL; @@ -279,19 +279,19 @@ plugin_t *load_tester_plugin_create() }, }, .delay = lib->settings->get_int(lib->settings, - "%s.plugins.load-tester.delay", 0, charon->name), + "%s.plugins.load-tester.delay", 0, lib->ns), .iterations = lib->settings->get_int(lib->settings, - "%s.plugins.load-tester.iterations", 1, charon->name), + "%s.plugins.load-tester.iterations", 1, lib->ns), .initiators = lib->settings->get_int(lib->settings, - "%s.plugins.load-tester.initiators", 0, charon->name), + "%s.plugins.load-tester.initiators", 0, lib->ns), .init_limit = lib->settings->get_int(lib->settings, - "%s.plugins.load-tester.init_limit", 0, charon->name), + "%s.plugins.load-tester.init_limit", 0, lib->ns), .mutex = mutex_create(MUTEX_TYPE_DEFAULT), .condvar = condvar_create(CONDVAR_TYPE_DEFAULT), ); if (lib->settings->get_bool(lib->settings, - "%s.plugins.load-tester.fake_kernel", FALSE, charon->name)) + "%s.plugins.load-tester.fake_kernel", FALSE, lib->ns)) { hydra->kernel_interface->add_ipsec_interface(hydra->kernel_interface, (kernel_ipsec_constructor_t)load_tester_ipsec_create); diff --git a/src/libcharon/plugins/lookip/lookip_socket.c b/src/libcharon/plugins/lookip/lookip_socket.c index d25573bf4..a39eb884a 100644 --- a/src/libcharon/plugins/lookip/lookip_socket.c +++ b/src/libcharon/plugins/lookip/lookip_socket.c @@ -393,8 +393,8 @@ lookip_socket_t *lookip_socket_create(lookip_listener_t *listener) ); uri = lib->settings->get_str(lib->settings, - "%s.plugins.lookip.socket", "unix://" LOOKIP_SOCKET, - charon->name); + "%s.plugins.lookip.socket", "unix://" LOOKIP_SOCKET, + lib->ns); this->service = lib->streams->create_service(lib->streams, uri, 10); if (!this->service) { diff --git a/src/libcharon/plugins/radattr/radattr_listener.c b/src/libcharon/plugins/radattr/radattr_listener.c index 3ce38ed12..aca83aafc 100644 --- a/src/libcharon/plugins/radattr/radattr_listener.c +++ b/src/libcharon/plugins/radattr/radattr_listener.c @@ -180,9 +180,9 @@ radattr_listener_t *radattr_listener_create() .destroy = _destroy, }, .dir = lib->settings->get_str(lib->settings, - "%s.plugins.radattr.dir", NULL, charon->name), + "%s.plugins.radattr.dir", NULL, lib->ns), .mid = lib->settings->get_int(lib->settings, - "%s.plugins.radattr.message_id", -1, charon->name), + "%s.plugins.radattr.message_id", -1, lib->ns), ); return &this->public; diff --git a/src/libcharon/plugins/socket_default/socket_default_socket.c b/src/libcharon/plugins/socket_default/socket_default_socket.c index ea976dfe9..081d3efc7 100644 --- a/src/libcharon/plugins/socket_default/socket_default_socket.c +++ b/src/libcharon/plugins/socket_default/socket_default_socket.c @@ -617,7 +617,7 @@ static int open_socket(private_socket_default_socket_t *this, mark_t mark; fwmark = lib->settings->get_str(lib->settings, - "%s.plugins.socket-default.fwmark", NULL, charon->name); + "%s.plugins.socket-default.fwmark", NULL, lib->ns); if (fwmark && mark_from_string(fwmark, &mark)) { if (setsockopt(skt, SOL_SOCKET, SO_MARK, &mark.value, @@ -657,10 +657,10 @@ static bool use_family(int family) { case AF_INET: return lib->settings->get_bool(lib->settings, - "%s.plugins.socket-default.use_ipv4", TRUE, charon->name); + "%s.plugins.socket-default.use_ipv4", TRUE, lib->ns); case AF_INET6: return lib->settings->get_bool(lib->settings, - "%s.plugins.socket-default.use_ipv6", TRUE, charon->name); + "%s.plugins.socket-default.use_ipv6", TRUE, lib->ns); default: return FALSE; } @@ -735,14 +735,14 @@ socket_default_socket_t *socket_default_socket_create() }, }, .port = lib->settings->get_int(lib->settings, - "%s.port", CHARON_UDP_PORT, charon->name), + "%s.port", CHARON_UDP_PORT, lib->ns), .natt = lib->settings->get_int(lib->settings, - "%s.port_nat_t", CHARON_NATT_PORT, charon->name), + "%s.port_nat_t", CHARON_NATT_PORT, lib->ns), .max_packet = lib->settings->get_int(lib->settings, - "%s.max_packet", MAX_PACKET, charon->name), + "%s.max_packet", MAX_PACKET, lib->ns), .set_source = lib->settings->get_bool(lib->settings, "%s.plugins.socket-default.set_source", TRUE, - charon->name), + lib->ns), ); if (this->port && this->port == this->natt) diff --git a/src/libcharon/plugins/socket_dynamic/socket_dynamic_socket.c b/src/libcharon/plugins/socket_dynamic/socket_dynamic_socket.c index 012f18e31..3161a709f 100644 --- a/src/libcharon/plugins/socket_dynamic/socket_dynamic_socket.c +++ b/src/libcharon/plugins/socket_dynamic/socket_dynamic_socket.c @@ -668,7 +668,7 @@ socket_dynamic_socket_t *socket_dynamic_socket_create() }, .lock = rwlock_create(RWLOCK_TYPE_DEFAULT), .max_packet = lib->settings->get_int(lib->settings, - "%s.max_packet", MAX_PACKET, charon->name), + "%s.max_packet", MAX_PACKET, lib->ns), ); if (pipe(this->notify) != 0) diff --git a/src/libcharon/plugins/sql/sql_logger.c b/src/libcharon/plugins/sql/sql_logger.c index 547e7691e..9a7a6e0ff 100644 --- a/src/libcharon/plugins/sql/sql_logger.c +++ b/src/libcharon/plugins/sql/sql_logger.c @@ -141,7 +141,7 @@ sql_logger_t *sql_logger_create(database_t *db) .db = db, .recursive = thread_value_create(NULL), .level = lib->settings->get_int(lib->settings, - "%s.plugins.sql.loglevel", -1, charon->name), + "%s.plugins.sql.loglevel", -1, lib->ns), ); return &this->public; diff --git a/src/libcharon/plugins/sql/sql_plugin.c b/src/libcharon/plugins/sql/sql_plugin.c index c1b4461d2..c5dd6e8b3 100644 --- a/src/libcharon/plugins/sql/sql_plugin.c +++ b/src/libcharon/plugins/sql/sql_plugin.c @@ -73,7 +73,7 @@ static bool open_database(private_sql_plugin_t *this, char *uri; uri = lib->settings->get_str(lib->settings, "%s.plugins.sql.database", - NULL, charon->name); + NULL, lib->ns); if (!uri) { DBG1(DBG_CFG, "sql plugin: database URI not set"); diff --git a/src/libcharon/plugins/stroke/stroke_control.c b/src/libcharon/plugins/stroke/stroke_control.c index b583bfc53..f770d7c9e 100644 --- a/src/libcharon/plugins/stroke/stroke_control.c +++ b/src/libcharon/plugins/stroke/stroke_control.c @@ -778,7 +778,7 @@ stroke_control_t *stroke_control_create() .destroy = _destroy, }, .timeout = lib->settings->get_int(lib->settings, - "%s.plugins.stroke.timeout", 0, charon->name), + "%s.plugins.stroke.timeout", 0, lib->ns), ); return &this->public; diff --git a/src/libcharon/plugins/stroke/stroke_cred.c b/src/libcharon/plugins/stroke/stroke_cred.c index 43e5739b2..ff93c94d0 100644 --- a/src/libcharon/plugins/stroke/stroke_cred.c +++ b/src/libcharon/plugins/stroke/stroke_cred.c @@ -1379,7 +1379,7 @@ stroke_cred_t *stroke_cred_create() this->force_ca_cert = lib->settings->get_bool(lib->settings, "%s.plugins.stroke.ignore_missing_ca_basic_constraint", - FALSE, charon->name); + FALSE, lib->ns); load_certs(this); load_secrets(this, NULL, SECRETS_FILE, 0, NULL); diff --git a/src/libcharon/plugins/stroke/stroke_socket.c b/src/libcharon/plugins/stroke/stroke_socket.c index 1f6ef6bf1..2fd6cc498 100644 --- a/src/libcharon/plugins/stroke/stroke_socket.c +++ b/src/libcharon/plugins/stroke/stroke_socket.c @@ -763,7 +763,7 @@ stroke_socket_t *stroke_socket_create() .destroy = _destroy, }, .prevent_loglevel_changes = lib->settings->get_bool(lib->settings, - "%s.plugins.stroke.prevent_loglevel_changes", FALSE, charon->name), + "%s.plugins.stroke.prevent_loglevel_changes", FALSE, lib->ns), ); this->cred = stroke_cred_create(); @@ -783,10 +783,10 @@ stroke_socket_t *stroke_socket_create() charon->bus->add_listener(charon->bus, &this->counter->listener); max_concurrent = lib->settings->get_int(lib->settings, - "%s.plugins.stroke.max_concurrent", MAX_CONCURRENT_DEFAULT, - charon->name); + "%s.plugins.stroke.max_concurrent", MAX_CONCURRENT_DEFAULT, + lib->ns); uri = lib->settings->get_str(lib->settings, - "%s.plugins.stroke.socket", "unix://" STROKE_SOCKET, charon->name); + "%s.plugins.stroke.socket", "unix://" STROKE_SOCKET, lib->ns); this->service = lib->streams->create_service(lib->streams, uri, 10); if (!this->service) { diff --git a/src/libcharon/plugins/systime_fix/systime_fix_plugin.c b/src/libcharon/plugins/systime_fix/systime_fix_plugin.c index c8596114c..c1594b0b2 100644 --- a/src/libcharon/plugins/systime_fix/systime_fix_plugin.c +++ b/src/libcharon/plugins/systime_fix/systime_fix_plugin.c @@ -178,9 +178,9 @@ static bool load_validator(private_systime_fix_plugin_t *this) char *str, *fmt; fmt = lib->settings->get_str(lib->settings, - "%s.plugins.%s.threshold_format", "%Y", charon->name, get_name(this)); + "%s.plugins.%s.threshold_format", "%Y", lib->ns, get_name(this)); str = lib->settings->get_str(lib->settings, - "%s.plugins.%s.threshold", NULL, charon->name, get_name(this)); + "%s.plugins.%s.threshold", NULL, lib->ns, get_name(this)); if (!str) { DBG1(DBG_CFG, "no threshold configured for %s, disabled", @@ -274,9 +274,9 @@ plugin_t *systime_fix_plugin_create() }, }, .interval = lib->settings->get_int(lib->settings, - "%s.plugins.%s.interval", 0, charon->name, get_name(this)), + "%s.plugins.%s.interval", 0, lib->ns, get_name(this)), .reauth = lib->settings->get_bool(lib->settings, - "%s.plugins.%s.reauth", FALSE, charon->name, get_name(this)), + "%s.plugins.%s.reauth", FALSE, lib->ns, get_name(this)), ); return &this->public.plugin; diff --git a/src/libcharon/plugins/tnc_ifmap/tnc_ifmap_listener.c b/src/libcharon/plugins/tnc_ifmap/tnc_ifmap_listener.c index 4ad19c530..d2ba2e345 100644 --- a/src/libcharon/plugins/tnc_ifmap/tnc_ifmap_listener.c +++ b/src/libcharon/plugins/tnc_ifmap/tnc_ifmap_listener.c @@ -191,8 +191,8 @@ tnc_ifmap_listener_t *tnc_ifmap_listener_create(bool reload) /* schedule periodic transmission of IF-MAP renewSession request */ reschedule = lib->settings->get_int(lib->settings, - "%s.plugins.tnc-ifmap.renew_session_interval", - IFMAP_RENEW_SESSION_INTERVAL, charon->name); + "%s.plugins.tnc-ifmap.renew_session_interval", + IFMAP_RENEW_SESSION_INTERVAL, lib->ns); job = (job_t*)tnc_ifmap_renew_session_job_create( this->ifmap->get_ref(this->ifmap), reschedule); diff --git a/src/libcharon/plugins/tnc_ifmap/tnc_ifmap_soap.c b/src/libcharon/plugins/tnc_ifmap/tnc_ifmap_soap.c index df7d2e2a1..8f24daea3 100644 --- a/src/libcharon/plugins/tnc_ifmap/tnc_ifmap_soap.c +++ b/src/libcharon/plugins/tnc_ifmap/tnc_ifmap_soap.c @@ -134,8 +134,8 @@ METHOD(tnc_ifmap_soap_t, newSession, bool, /* set PEP and PDP device name (defaults to IF-MAP Publisher ID) */ this->device_name = lib->settings->get_str(lib->settings, - "%s.plugins.tnc-ifmap.device_name", - this->ifmap_publisher_id, charon->name); + "%s.plugins.tnc-ifmap.device_name", + this->ifmap_publisher_id, lib->ns); this->device_name = strdup(this->device_name); return this->session_id && this->ifmap_publisher_id; @@ -731,15 +731,15 @@ static bool soap_init(private_tnc_ifmap_soap_t *this) /* getting configuration parameters from strongswan.conf */ server_uri = lib->settings->get_str(lib->settings, - "%s.plugins.tnc-ifmap.server_uri", IFMAP_URI, charon->name); + "%s.plugins.tnc-ifmap.server_uri", IFMAP_URI, lib->ns); server_cert = lib->settings->get_str(lib->settings, - "%s.plugins.tnc-ifmap.server_cert", NULL, charon->name); + "%s.plugins.tnc-ifmap.server_cert", NULL, lib->ns); client_cert = lib->settings->get_str(lib->settings, - "%s.plugins.tnc-ifmap.client_cert", NULL, charon->name); + "%s.plugins.tnc-ifmap.client_cert", NULL, lib->ns); client_key = lib->settings->get_str(lib->settings, - "%s.plugins.tnc-ifmap.client_key", NULL, charon->name); + "%s.plugins.tnc-ifmap.client_key", NULL, lib->ns); user_pass = lib->settings->get_str(lib->settings, - "%s.plugins.tnc-ifmap.username_password", NULL, charon->name); + "%s.plugins.tnc-ifmap.username_password", NULL, lib->ns); /* load [self-signed] MAP server certificate */ if (!server_cert) diff --git a/src/libcharon/plugins/tnc_pdp/tnc_pdp.c b/src/libcharon/plugins/tnc_pdp/tnc_pdp.c index 31cee9e2b..89237f564 100644 --- a/src/libcharon/plugins/tnc_pdp/tnc_pdp.c +++ b/src/libcharon/plugins/tnc_pdp/tnc_pdp.c @@ -758,19 +758,19 @@ tnc_pdp_t *tnc_pdp_create(void) bool radius_enable, pt_tls_enable; server = lib->settings->get_str(lib->settings, - "%s.plugins.tnc-pdp.server", NULL, charon->name); + "%s.plugins.tnc-pdp.server", NULL, lib->ns); pt_tls_enable = lib->settings->get_bool(lib->settings, - "%s.plugins.tnc-pdp.pt_tls.enable", TRUE, charon->name); + "%s.plugins.tnc-pdp.pt_tls.enable", TRUE, lib->ns); pt_tls_port = lib->settings->get_int(lib->settings, - "%s.plugins.tnc-pdp.pt_tls.port", PT_TLS_PORT, charon->name); + "%s.plugins.tnc-pdp.pt_tls.port", PT_TLS_PORT, lib->ns); radius_enable = lib->settings->get_bool(lib->settings, - "%s.plugins.tnc-pdp.radius.enable", TRUE, charon->name); + "%s.plugins.tnc-pdp.radius.enable", TRUE, lib->ns); radius_port = lib->settings->get_int(lib->settings, - "%s.plugins.tnc-pdp.radius.port", RADIUS_PORT, charon->name); + "%s.plugins.tnc-pdp.radius.port", RADIUS_PORT, lib->ns); secret = lib->settings->get_str(lib->settings, - "%s.plugins.tnc-pdp.radius.secret", NULL, charon->name); + "%s.plugins.tnc-pdp.radius.secret", NULL, lib->ns); eap_type_str = lib->settings->get_str(lib->settings, - "%s.plugins.tnc-pdp.radius.method", "ttls", charon->name); + "%s.plugins.tnc-pdp.radius.method", "ttls", lib->ns); if (!pt_tls_enable && !radius_enable) { diff --git a/src/libcharon/plugins/tnc_pdp/tnc_pdp_connections.c b/src/libcharon/plugins/tnc_pdp/tnc_pdp_connections.c index f789c31d2..6c7659bb1 100644 --- a/src/libcharon/plugins/tnc_pdp/tnc_pdp_connections.c +++ b/src/libcharon/plugins/tnc_pdp/tnc_pdp_connections.c @@ -298,7 +298,7 @@ tnc_pdp_connections_t *tnc_pdp_connections_create(void) .list = linked_list_create(), .lock = rwlock_create(RWLOCK_TYPE_DEFAULT), .timeout = lib->settings->get_int(lib->settings, - "%s.plugins.tnc-pdp.timeout", DEFAULT_TIMEOUT, charon->name), + "%s.plugins.tnc-pdp.timeout", DEFAULT_TIMEOUT, lib->ns), ); return &this->public; diff --git a/src/libcharon/plugins/updown/updown_plugin.c b/src/libcharon/plugins/updown/updown_plugin.c index 3c1aba5cc..d30267dee 100644 --- a/src/libcharon/plugins/updown/updown_plugin.c +++ b/src/libcharon/plugins/updown/updown_plugin.c @@ -58,7 +58,7 @@ static bool plugin_cb(private_updown_plugin_t *this, if (reg) { if (lib->settings->get_bool(lib->settings, - "charon.plugins.updown.dns_handler", FALSE)) + "%s.plugins.updown.dns_handler", FALSE, lib->ns)) { this->handler = updown_handler_create(); hydra->attributes->add_handler(hydra->attributes, diff --git a/src/libcharon/plugins/whitelist/whitelist_control.c b/src/libcharon/plugins/whitelist/whitelist_control.c index 996f263c9..c1b619c3c 100644 --- a/src/libcharon/plugins/whitelist/whitelist_control.c +++ b/src/libcharon/plugins/whitelist/whitelist_control.c @@ -157,7 +157,7 @@ whitelist_control_t *whitelist_control_create(whitelist_listener_t *listener) uri = lib->settings->get_str(lib->settings, "%s.plugins.whitelist.socket", "unix://" WHITELIST_SOCKET, - charon->name); + lib->ns); this->service = lib->streams->create_service(lib->streams, uri, 10); if (!this->service) { diff --git a/src/libcharon/plugins/whitelist/whitelist_listener.c b/src/libcharon/plugins/whitelist/whitelist_listener.c index 382ee3b8b..d0357b410 100644 --- a/src/libcharon/plugins/whitelist/whitelist_listener.c +++ b/src/libcharon/plugins/whitelist/whitelist_listener.c @@ -206,7 +206,7 @@ whitelist_listener_t *whitelist_listener_create() .ids = hashtable_create((hashtable_hash_t)hash, (hashtable_equals_t)equals, 32), .enabled = lib->settings->get_bool(lib->settings, - "%s.plugins.whitelist.enable", FALSE, charon->name), + "%s.plugins.whitelist.enable", FALSE, lib->ns), ); return &this->public; diff --git a/src/libcharon/plugins/xauth_eap/xauth_eap.c b/src/libcharon/plugins/xauth_eap/xauth_eap.c index 5ac4f10d2..f597bb7ae 100644 --- a/src/libcharon/plugins/xauth_eap/xauth_eap.c +++ b/src/libcharon/plugins/xauth_eap/xauth_eap.c @@ -224,7 +224,7 @@ METHOD(xauth_method_t, process, status_t, name = lib->settings->get_str(lib->settings, "%s.plugins.xauth-eap.backend", "radius", - charon->name); + lib->ns); type = eap_type_from_string(name); if (!type) { diff --git a/src/libcharon/plugins/xauth_pam/xauth_pam.c b/src/libcharon/plugins/xauth_pam/xauth_pam.c index 99fda7dad..71c79ecc0 100644 --- a/src/libcharon/plugins/xauth_pam/xauth_pam.c +++ b/src/libcharon/plugins/xauth_pam/xauth_pam.c @@ -142,7 +142,7 @@ METHOD(xauth_method_t, process, status_t, /* trim to username part if email address given */ if (lib->settings->get_bool(lib->settings, "%s.plugins.xauth-pam.trim_email", - TRUE, charon->name)) + TRUE, lib->ns)) { pos = memchr(chunk.ptr, '@', chunk.len); if (pos) @@ -175,9 +175,8 @@ METHOD(xauth_method_t, process, status_t, service = lib->settings->get_str(lib->settings, "%s.plugins.xauth-pam.pam_service", lib->settings->get_str(lib->settings, - "%s.plugins.eap-gtc.pam_service", - "login", charon->name), - charon->name); + "%s.plugins.eap-gtc.pam_service", "login", lib->ns), + lib->ns); if (authenticate(service, user, pass)) { diff --git a/src/libcharon/plugins/xauth_pam/xauth_pam_listener.c b/src/libcharon/plugins/xauth_pam/xauth_pam_listener.c index 1b9c045c7..eb06f54bb 100644 --- a/src/libcharon/plugins/xauth_pam/xauth_pam_listener.c +++ b/src/libcharon/plugins/xauth_pam/xauth_pam_listener.c @@ -136,8 +136,8 @@ xauth_pam_listener_t *xauth_pam_listener_create() "%s.plugins.xauth-pam.pam_service", lib->settings->get_str(lib->settings, "%s.plugins.eap-gtc.pam_service", - "login", charon->name), - charon->name), + "login", lib->ns), + lib->ns), ); return &this->public; diff --git a/src/libcharon/plugins/xauth_pam/xauth_pam_plugin.c b/src/libcharon/plugins/xauth_pam/xauth_pam_plugin.c index f70f30ef3..497ad3dd9 100644 --- a/src/libcharon/plugins/xauth_pam/xauth_pam_plugin.c +++ b/src/libcharon/plugins/xauth_pam/xauth_pam_plugin.c @@ -116,7 +116,7 @@ plugin_t *xauth_pam_plugin_create() }, }, .session = lib->settings->get_str(lib->settings, - "%s.plugins.xauth-pam.session", FALSE, charon->name), + "%s.plugins.xauth-pam.session", FALSE, lib->ns), .listener = xauth_pam_listener_create(), ); diff --git a/src/libcharon/sa/ike_sa.c b/src/libcharon/sa/ike_sa.c index 53da1d7ca..2c15dc5eb 100644 --- a/src/libcharon/sa/ike_sa.c +++ b/src/libcharon/sa/ike_sa.c @@ -2329,11 +2329,11 @@ ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id, bool initiator, .attributes = array_create(sizeof(attribute_entry_t), 0), .unique_id = ref_get(&unique_id), .keepalive_interval = lib->settings->get_time(lib->settings, - "%s.keep_alive", KEEPALIVE_INTERVAL, charon->name), + "%s.keep_alive", KEEPALIVE_INTERVAL, lib->ns), .retry_initiate_interval = lib->settings->get_time(lib->settings, - "%s.retry_initiate_interval", 0, charon->name), + "%s.retry_initiate_interval", 0, lib->ns), .flush_auth_cfg = lib->settings->get_bool(lib->settings, - "%s.flush_auth_cfg", FALSE, charon->name), + "%s.flush_auth_cfg", FALSE, lib->ns), ); if (version == IKEV2) diff --git a/src/libcharon/sa/ike_sa_manager.c b/src/libcharon/sa/ike_sa_manager.c index 5768803aa..f2f81cf33 100644 --- a/src/libcharon/sa/ike_sa_manager.c +++ b/src/libcharon/sa/ike_sa_manager.c @@ -2150,17 +2150,17 @@ ike_sa_manager_t *ike_sa_manager_create() } this->ikesa_limit = lib->settings->get_int(lib->settings, - "%s.ikesa_limit", 0, charon->name); + "%s.ikesa_limit", 0, lib->ns); this->table_size = get_nearest_powerof2(lib->settings->get_int( lib->settings, "%s.ikesa_table_size", - DEFAULT_HASHTABLE_SIZE, charon->name)); + DEFAULT_HASHTABLE_SIZE, lib->ns)); this->table_size = max(1, min(this->table_size, MAX_HASHTABLE_SIZE)); this->table_mask = this->table_size - 1; this->segment_count = get_nearest_powerof2(lib->settings->get_int( lib->settings, "%s.ikesa_table_segments", - DEFAULT_SEGMENT_COUNT, charon->name)); + DEFAULT_SEGMENT_COUNT, lib->ns)); this->segment_count = max(1, min(this->segment_count, this->table_size)); this->segment_mask = this->segment_count - 1; @@ -2200,6 +2200,6 @@ ike_sa_manager_t *ike_sa_manager_create() } this->reuse_ikesa = lib->settings->get_bool(lib->settings, - "%s.reuse_ikesa", TRUE, charon->name); + "%s.reuse_ikesa", TRUE, lib->ns); return &this->public; } diff --git a/src/libcharon/sa/ikev1/task_manager_v1.c b/src/libcharon/sa/ikev1/task_manager_v1.c index 131d812e9..8fc158bba 100644 --- a/src/libcharon/sa/ikev1/task_manager_v1.c +++ b/src/libcharon/sa/ikev1/task_manager_v1.c @@ -1579,7 +1579,7 @@ METHOD(task_manager_t, process_message, status_t, lib->scheduler->schedule_job(lib->scheduler, job, lib->settings->get_int(lib->settings, "%s.half_open_timeout", HALF_OPEN_IKE_SA_TIMEOUT, - charon->name)); + lib->ns)); } this->ike_sa->update_hosts(this->ike_sa, me, other, TRUE); charon->bus->message(charon->bus, msg, TRUE, TRUE); @@ -2082,9 +2082,9 @@ task_manager_v1_t *task_manager_v1_create(ike_sa_t *ike_sa) .frag = { .exchange = ID_PROT, .max_packet = lib->settings->get_int(lib->settings, - "%s.max_packet", MAX_PACKET, charon->name), + "%s.max_packet", MAX_PACKET, lib->ns), .size = lib->settings->get_int(lib->settings, - "%s.fragment_size", MAX_FRAGMENT_SIZE, charon->name), + "%s.fragment_size", MAX_FRAGMENT_SIZE, lib->ns), }, .ike_sa = ike_sa, .rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK), @@ -2092,11 +2092,11 @@ task_manager_v1_t *task_manager_v1_create(ike_sa_t *ike_sa) .active_tasks = linked_list_create(), .passive_tasks = linked_list_create(), .retransmit_tries = lib->settings->get_int(lib->settings, - "%s.retransmit_tries", RETRANSMIT_TRIES, charon->name), + "%s.retransmit_tries", RETRANSMIT_TRIES, lib->ns), .retransmit_timeout = lib->settings->get_double(lib->settings, - "%s.retransmit_timeout", RETRANSMIT_TIMEOUT, charon->name), + "%s.retransmit_timeout", RETRANSMIT_TIMEOUT, lib->ns), .retransmit_base = lib->settings->get_double(lib->settings, - "%s.retransmit_base", RETRANSMIT_BASE, charon->name), + "%s.retransmit_base", RETRANSMIT_BASE, lib->ns), ); if (!this->rng) diff --git a/src/libcharon/sa/ikev1/tasks/aggressive_mode.c b/src/libcharon/sa/ikev1/tasks/aggressive_mode.c index d5d7f2c98..6cc3e04b3 100644 --- a/src/libcharon/sa/ikev1/tasks/aggressive_mode.c +++ b/src/libcharon/sa/ikev1/tasks/aggressive_mode.c @@ -421,7 +421,7 @@ METHOD(task_t, process_r, status_t, case AUTH_PSK: if (!lib->settings->get_bool(lib->settings, "%s.i_dont_care" "_about_security_and_use_aggressive_mode_psk", - FALSE, charon->name)) + FALSE, lib->ns)) { DBG1(DBG_IKE, "Aggressive Mode PSK disabled for " "security reasons"); diff --git a/src/libcharon/sa/ikev1/tasks/isakmp_vendor.c b/src/libcharon/sa/ikev1/tasks/isakmp_vendor.c index 11155b287..e07ac0ab4 100644 --- a/src/libcharon/sa/ikev1/tasks/isakmp_vendor.c +++ b/src/libcharon/sa/ikev1/tasks/isakmp_vendor.c @@ -191,9 +191,9 @@ static void build(private_isakmp_vendor_t *this, message_t *message) int i; strongswan = lib->settings->get_bool(lib->settings, - "%s.send_vendor_id", FALSE, charon->name); + "%s.send_vendor_id", FALSE, lib->ns); cisco_unity = lib->settings->get_bool(lib->settings, - "%s.cisco_unity", FALSE, charon->name); + "%s.cisco_unity", FALSE, lib->ns); ike_cfg = this->ike_sa->get_ike_cfg(this->ike_sa); fragmentation = ike_cfg->fragmentation(ike_cfg) != FRAGMENTATION_NO; if (!this->initiator && fragmentation) diff --git a/src/libcharon/sa/ikev1/tasks/quick_mode.c b/src/libcharon/sa/ikev1/tasks/quick_mode.c index 12ee594b9..6e7da9852 100644 --- a/src/libcharon/sa/ikev1/tasks/quick_mode.c +++ b/src/libcharon/sa/ikev1/tasks/quick_mode.c @@ -194,7 +194,7 @@ static void schedule_inactivity_timeout(private_quick_mode_t *this) if (timeout) { close_ike = lib->settings->get_bool(lib->settings, - "%s.inactivity_close_ike", FALSE, charon->name); + "%s.inactivity_close_ike", FALSE, lib->ns); lib->scheduler->schedule_job(lib->scheduler, (job_t*) inactivity_job_create(this->child_sa->get_reqid(this->child_sa), timeout, close_ike), timeout); diff --git a/src/libcharon/sa/ikev2/task_manager_v2.c b/src/libcharon/sa/ikev2/task_manager_v2.c index 6ce9ba838..ac3be900f 100644 --- a/src/libcharon/sa/ikev2/task_manager_v2.c +++ b/src/libcharon/sa/ikev2/task_manager_v2.c @@ -1229,7 +1229,7 @@ METHOD(task_manager_t, process_message, status_t, lib->scheduler->schedule_job(lib->scheduler, job, lib->settings->get_int(lib->settings, "%s.half_open_timeout", HALF_OPEN_IKE_SA_TIMEOUT, - charon->name)); + lib->ns)); } return SUCCESS; } @@ -1578,11 +1578,11 @@ task_manager_v2_t *task_manager_v2_create(ike_sa_t *ike_sa) .active_tasks = array_create(0, 0), .passive_tasks = array_create(0, 0), .retransmit_tries = lib->settings->get_int(lib->settings, - "%s.retransmit_tries", RETRANSMIT_TRIES, charon->name), + "%s.retransmit_tries", RETRANSMIT_TRIES, lib->ns), .retransmit_timeout = lib->settings->get_double(lib->settings, - "%s.retransmit_timeout", RETRANSMIT_TIMEOUT, charon->name), + "%s.retransmit_timeout", RETRANSMIT_TIMEOUT, lib->ns), .retransmit_base = lib->settings->get_double(lib->settings, - "%s.retransmit_base", RETRANSMIT_BASE, charon->name), + "%s.retransmit_base", RETRANSMIT_BASE, lib->ns), ); return &this->public; diff --git a/src/libcharon/sa/ikev2/tasks/child_create.c b/src/libcharon/sa/ikev2/tasks/child_create.c index 7cfa537a9..df7bc96d6 100644 --- a/src/libcharon/sa/ikev2/tasks/child_create.c +++ b/src/libcharon/sa/ikev2/tasks/child_create.c @@ -293,7 +293,7 @@ static void schedule_inactivity_timeout(private_child_create_t *this) if (timeout) { close_ike = lib->settings->get_bool(lib->settings, - "%s.inactivity_close_ike", FALSE, charon->name); + "%s.inactivity_close_ike", FALSE, lib->ns); lib->scheduler->schedule_job(lib->scheduler, (job_t*) inactivity_job_create(this->child_sa->get_reqid(this->child_sa), timeout, close_ike), timeout); @@ -1072,7 +1072,7 @@ static void handle_child_sa_failure(private_child_create_t *this, { if (message->get_exchange_type(message) == IKE_AUTH && lib->settings->get_bool(lib->settings, - "%s.close_ike_on_child_failure", FALSE, charon->name)) + "%s.close_ike_on_child_failure", FALSE, lib->ns)) { /* we delay the delete for 100ms, as the IKE_AUTH response must arrive * first */ diff --git a/src/libcharon/sa/ikev2/tasks/ike_auth.c b/src/libcharon/sa/ikev2/tasks/ike_auth.c index 8f83c4884..800dab07e 100644 --- a/src/libcharon/sa/ikev2/tasks/ike_auth.c +++ b/src/libcharon/sa/ikev2/tasks/ike_auth.c @@ -120,7 +120,7 @@ struct private_ike_auth_t { static bool multiple_auth_enabled() { return lib->settings->get_bool(lib->settings, - "%s.multiple_authentication", TRUE, charon->name); + "%s.multiple_authentication", TRUE, lib->ns); } /** diff --git a/src/libcharon/sa/ikev2/tasks/ike_cert_pre.c b/src/libcharon/sa/ikev2/tasks/ike_cert_pre.c index 2cbe8f8c5..bd28b29d7 100644 --- a/src/libcharon/sa/ikev2/tasks/ike_cert_pre.c +++ b/src/libcharon/sa/ikev2/tasks/ike_cert_pre.c @@ -428,7 +428,7 @@ static void build_certreqs(private_ike_cert_pre_t *this, message_t *message) message->add_payload(message, (payload_t*)req); if (lib->settings->get_bool(lib->settings, - "%s.hash_and_url", FALSE, charon->name)) + "%s.hash_and_url", FALSE, lib->ns)) { message->add_notify(message, FALSE, HTTP_CERT_LOOKUP_SUPPORTED, chunk_empty); diff --git a/src/libcharon/sa/ikev2/tasks/ike_vendor.c b/src/libcharon/sa/ikev2/tasks/ike_vendor.c index fb29d05cd..16ac16673 100644 --- a/src/libcharon/sa/ikev2/tasks/ike_vendor.c +++ b/src/libcharon/sa/ikev2/tasks/ike_vendor.c @@ -86,7 +86,7 @@ METHOD(task_t, build, status_t, int i; strongswan = lib->settings->get_bool(lib->settings, - "%s.send_vendor_id", FALSE, charon->name); + "%s.send_vendor_id", FALSE, lib->ns); for (i = 0; i < countof(vids); i++) { if (vids[i].extension == EXT_STRONGSWAN && strongswan) diff --git a/src/libhydra/attributes/mem_pool.c b/src/libhydra/attributes/mem_pool.c index 77567ce48..cc45e5629 100644 --- a/src/libhydra/attributes/mem_pool.c +++ b/src/libhydra/attributes/mem_pool.c @@ -573,7 +573,7 @@ static private_mem_pool_t *create_generic(char *name) (hashtable_equals_t)id_equals, 16), .mutex = mutex_create(MUTEX_TYPE_DEFAULT), .reassign_online = lib->settings->get_bool(lib->settings, - "%s.mem-pool.reassign_online", FALSE, hydra->daemon), + "%s.mem-pool.reassign_online", FALSE, lib->ns), ); return this; diff --git a/src/libhydra/hydra.c b/src/libhydra/hydra.c index f531bd5f4..1b5065081 100644 --- a/src/libhydra/hydra.c +++ b/src/libhydra/hydra.c @@ -59,7 +59,6 @@ void libhydra_deinit() this->public.attributes->destroy(this->public.attributes); this->public.kernel_interface->destroy(this->public.kernel_interface); - free((void*)this->public.daemon); free(this); hydra = NULL; } @@ -67,7 +66,7 @@ void libhydra_deinit() /** * Described in header. */ -bool libhydra_init(const char *daemon) +bool libhydra_init() { private_hydra_t *this; @@ -81,7 +80,6 @@ bool libhydra_init(const char *daemon) INIT(this, .public = { .attributes = attribute_manager_create(), - .daemon = strdup(daemon ?: "libhydra"), }, .ref = 1, ); diff --git a/src/libhydra/hydra.h b/src/libhydra/hydra.h index 2a8709d72..94209ff59 100644 --- a/src/libhydra/hydra.h +++ b/src/libhydra/hydra.h @@ -53,11 +53,6 @@ struct hydra_t { * kernel interface to communicate with kernel */ kernel_interface_t *kernel_interface; - - /** - * name of the daemon that initialized the library - */ - const char *daemon; }; /** @@ -70,15 +65,12 @@ extern hydra_t *hydra; /** * Initialize libhydra. * - * The daemon's name is used to load daemon-specific settings. - * * libhydra_init() may be called multiple times in a single process, but each - * caller should call libhydra_deinit() for each call to libhydra_init(). + * caller must call libhydra_deinit() for each call to libhydra_init(). * - * @param daemon name of the daemon that initializes the library * @return FALSE if integrity check failed */ -bool libhydra_init(const char *daemon); +bool libhydra_init(); /** * Deinitialize libhydra. diff --git a/src/libhydra/kernel/kernel_interface.c b/src/libhydra/kernel/kernel_interface.c index cbfddd03b..3e34d20a6 100644 --- a/src/libhydra/kernel/kernel_interface.c +++ b/src/libhydra/kernel/kernel_interface.c @@ -796,12 +796,12 @@ kernel_interface_t *kernel_interface_create() ); ifaces = lib->settings->get_str(lib->settings, - "%s.interfaces_use", NULL, hydra->daemon); + "%s.interfaces_use", NULL, lib->ns); if (!ifaces) { this->ifaces_exclude = TRUE; ifaces = lib->settings->get_str(lib->settings, - "%s.interfaces_ignore", NULL, hydra->daemon); + "%s.interfaces_ignore", NULL, lib->ns); } if (ifaces) { diff --git a/src/libhydra/plugins/attr/attr_provider.c b/src/libhydra/plugins/attr/attr_provider.c index 1a2fa7f28..a27fd57b1 100644 --- a/src/libhydra/plugins/attr/attr_provider.c +++ b/src/libhydra/plugins/attr/attr_provider.c @@ -109,7 +109,7 @@ static void add_legacy_entry(private_attr_provider_t *this, char *key, int nr, host_t *host; char *str; - str = lib->settings->get_str(lib->settings, "%s.%s%d", NULL, hydra->daemon, + str = lib->settings->get_str(lib->settings, "%s.%s%d", NULL, lib->ns, key, nr); if (str) { @@ -179,7 +179,7 @@ static void load_entries(private_attr_provider_t *this) } enumerator = lib->settings->create_key_value_enumerator(lib->settings, - "%s.plugins.attr", hydra->daemon); + "%s.plugins.attr", lib->ns); while (enumerator->enumerate(enumerator, &key, &value)) { configuration_attribute_type_t type; @@ -190,6 +190,10 @@ static void load_entries(private_attr_provider_t *this) char *pos; int i, mask = -1, family; + if (streq(key, "load")) + { + continue; + } type = atoi(key); if (!type) { diff --git a/src/libhydra/plugins/attr_sql/attr_sql_plugin.c b/src/libhydra/plugins/attr_sql/attr_sql_plugin.c index 702872c57..dde90051a 100644 --- a/src/libhydra/plugins/attr_sql/attr_sql_plugin.c +++ b/src/libhydra/plugins/attr_sql/attr_sql_plugin.c @@ -61,7 +61,7 @@ static bool open_database(private_attr_sql_plugin_t *this, char *uri; uri = lib->settings->get_str(lib->settings, - "libhydra.plugins.attr-sql.database", NULL); + "%s.plugins.attr-sql.database", NULL, lib->ns); if (!uri) { DBG1(DBG_CFG, "attr-sql plugin: database URI not set"); @@ -122,6 +122,8 @@ plugin_t *attr_sql_plugin_create() }, }, ); + lib->settings->add_fallback(lib->settings, "%s.plugins.attr-sql", + "libhydra.plugins.attr-sql", lib->ns); return &this->public.plugin; } diff --git a/src/libhydra/plugins/attr_sql/sql_attribute.c b/src/libhydra/plugins/attr_sql/sql_attribute.c index 0a06c419f..d527c3fba 100644 --- a/src/libhydra/plugins/attr_sql/sql_attribute.c +++ b/src/libhydra/plugins/attr_sql/sql_attribute.c @@ -457,7 +457,7 @@ sql_attribute_t *sql_attribute_create(database_t *db) }, .db = db, .history = lib->settings->get_bool(lib->settings, - "libhydra.plugins.attr-sql.lease_history", TRUE), + "%s.plugins.attr-sql.lease_history", TRUE, lib->ns), ); /* close any "online" leases in the case we crashed */ diff --git a/src/libhydra/plugins/kernel_klips/kernel_klips_ipsec.c b/src/libhydra/plugins/kernel_klips/kernel_klips_ipsec.c index a226162c3..a75ccf3b6 100644 --- a/src/libhydra/plugins/kernel_klips/kernel_klips_ipsec.c +++ b/src/libhydra/plugins/kernel_klips/kernel_klips_ipsec.c @@ -311,8 +311,8 @@ static status_t attach_ipsec_dev(char* name, char *phys_name) } mtu = lib->settings->get_int(lib->settings, - "%s.plugins.kernel-klips.ipsec_dev_mtu", 0, - hydra->daemon); + "%s.plugins.kernel-klips.ipsec_dev_mtu", 0, + lib->ns); if (mtu <= 0) { /* guess MTU as physical MTU - ESP overhead [- NAT-T overhead] @@ -2505,8 +2505,8 @@ METHOD(kernel_ipsec_t, del_policy, status_t, static void init_ipsec_devices(private_kernel_klips_ipsec_t *this) { int i, count = lib->settings->get_int(lib->settings, - "%s.plugins.kernel-klips.ipsec_dev_count", - DEFAULT_IPSEC_DEV_COUNT, hydra->daemon); + "%s.plugins.kernel-klips.ipsec_dev_count", + DEFAULT_IPSEC_DEV_COUNT, lib->ns); for (i = 0; i < count; ++i) { @@ -2611,7 +2611,7 @@ kernel_klips_ipsec_t *kernel_klips_ipsec_create() .mutex_pfkey = mutex_create(MUTEX_TYPE_DEFAULT), .install_routes = lib->settings->get_bool(lib->settings, "%s.install_routes", TRUE, - hydra->daemon), + lib->ns), ); /* initialize ipsec devices */ diff --git a/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c b/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c index 24f15d9a1..c864a92f4 100644 --- a/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c +++ b/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c @@ -2685,15 +2685,15 @@ kernel_netlink_ipsec_t *kernel_netlink_ipsec_create() .mutex = mutex_create(MUTEX_TYPE_DEFAULT), .policy_history = TRUE, .install_routes = lib->settings->get_bool(lib->settings, - "%s.install_routes", TRUE, hydra->daemon), + "%s.install_routes", TRUE, lib->ns), .replay_window = lib->settings->get_int(lib->settings, - "%s.replay_window", DEFAULT_REPLAY_WINDOW, hydra->daemon), + "%s.replay_window", DEFAULT_REPLAY_WINDOW, lib->ns), ); this->replay_bmp = (this->replay_window + sizeof(u_int32_t) * 8 - 1) / (sizeof(u_int32_t) * 8); - if (streq(hydra->daemon, "starter")) + if (streq(lib->ns, "starter")) { /* starter has no threads, so we do not register for kernel events */ register_for_events = FALSE; } @@ -2703,7 +2703,7 @@ kernel_netlink_ipsec_t *kernel_netlink_ipsec_create() { fprintf(f, "%u", lib->settings->get_int(lib->settings, "%s.plugins.kernel-netlink.xfrm_acq_expires", - DEFAULT_ACQUIRE_LIFETIME, hydra->daemon)); + DEFAULT_ACQUIRE_LIFETIME, lib->ns)); fclose(f); } diff --git a/src/libhydra/plugins/kernel_netlink/kernel_netlink_net.c b/src/libhydra/plugins/kernel_netlink/kernel_netlink_net.c index 0cbdef1a7..3cf317634 100644 --- a/src/libhydra/plugins/kernel_netlink/kernel_netlink_net.c +++ b/src/libhydra/plugins/kernel_netlink/kernel_netlink_net.c @@ -2125,7 +2125,7 @@ static status_t manage_rule(private_kernel_netlink_net_t *this, int nlmsg_type, netlink_add_attribute(hdr, RTA_PRIORITY, chunk, sizeof(request)); fwmark = lib->settings->get_str(lib->settings, - "%s.plugins.kernel-netlink.fwmark", NULL, hydra->daemon); + "%s.plugins.kernel-netlink.fwmark", NULL, lib->ns); if (fwmark) { #ifdef HAVE_LINUX_FIB_RULES_H @@ -2285,30 +2285,30 @@ kernel_netlink_net_t *kernel_netlink_net_create() .condvar = rwlock_condvar_create(), .roam_lock = spinlock_create(), .routing_table = lib->settings->get_int(lib->settings, - "%s.routing_table", ROUTING_TABLE, hydra->daemon), + "%s.routing_table", ROUTING_TABLE, lib->ns), .routing_table_prio = lib->settings->get_int(lib->settings, - "%s.routing_table_prio", ROUTING_TABLE_PRIO, hydra->daemon), + "%s.routing_table_prio", ROUTING_TABLE_PRIO, lib->ns), .process_route = lib->settings->get_bool(lib->settings, - "%s.process_route", TRUE, hydra->daemon), + "%s.process_route", TRUE, lib->ns), .install_virtual_ip = lib->settings->get_bool(lib->settings, - "%s.install_virtual_ip", TRUE, hydra->daemon), + "%s.install_virtual_ip", TRUE, lib->ns), .install_virtual_ip_on = lib->settings->get_str(lib->settings, - "%s.install_virtual_ip_on", NULL, hydra->daemon), + "%s.install_virtual_ip_on", NULL, lib->ns), .roam_events = lib->settings->get_bool(lib->settings, - "%s.plugins.kernel-netlink.roam_events", TRUE, hydra->daemon), + "%s.plugins.kernel-netlink.roam_events", TRUE, lib->ns), ); timerclear(&this->last_route_reinstall); timerclear(&this->next_roam); check_kernel_features(this); - if (streq(hydra->daemon, "starter")) + if (streq(lib->ns, "starter")) { /* starter has no threads, so we do not register for kernel events */ register_for_events = FALSE; } exclude = lib->settings->get_str(lib->settings, - "%s.ignore_routing_tables", NULL, hydra->daemon); + "%s.ignore_routing_tables", NULL, lib->ns); if (exclude) { char *token; diff --git a/src/libhydra/plugins/kernel_pfkey/kernel_pfkey_ipsec.c b/src/libhydra/plugins/kernel_pfkey/kernel_pfkey_ipsec.c index 98a6f81d5..4704d419f 100644 --- a/src/libhydra/plugins/kernel_pfkey/kernel_pfkey_ipsec.c +++ b/src/libhydra/plugins/kernel_pfkey/kernel_pfkey_ipsec.c @@ -2861,10 +2861,10 @@ kernel_pfkey_ipsec_t *kernel_pfkey_ipsec_create() .mutex_pfkey = mutex_create(MUTEX_TYPE_DEFAULT), .install_routes = lib->settings->get_bool(lib->settings, "%s.install_routes", TRUE, - hydra->daemon), + lib->ns), ); - if (streq(hydra->daemon, "starter")) + if (streq(lib->ns, "starter")) { /* starter has no threads, so we do not register for kernel events */ register_for_events = FALSE; } diff --git a/src/libhydra/plugins/kernel_pfroute/kernel_pfroute_net.c b/src/libhydra/plugins/kernel_pfroute/kernel_pfroute_net.c index 844d7c4b4..a8a57a5a2 100644 --- a/src/libhydra/plugins/kernel_pfroute/kernel_pfroute_net.c +++ b/src/libhydra/plugins/kernel_pfroute/kernel_pfroute_net.c @@ -1785,7 +1785,7 @@ kernel_pfroute_net_t *kernel_pfroute_net_create() .net_changes_lock = mutex_create(MUTEX_TYPE_DEFAULT), .roam_lock = spinlock_create(), .vip_wait = lib->settings->get_int(lib->settings, - "%s.plugins.kernel-pfroute.vip_wait", 1000, hydra->daemon), + "%s.plugins.kernel-pfroute.vip_wait", 1000, lib->ns), ); timerclear(&this->last_route_reinstall); timerclear(&this->next_roam); @@ -1799,7 +1799,7 @@ kernel_pfroute_net_t *kernel_pfroute_net_create() return NULL; } - if (streq(hydra->daemon, "starter")) + if (streq(lib->ns, "starter")) { /* starter has no threads, so we do not register for kernel events */ if (shutdown(this->socket, SHUT_RD) != 0) diff --git a/src/libhydra/plugins/resolve/resolve_handler.c b/src/libhydra/plugins/resolve/resolve_handler.c index 2eee854a9..069466ab5 100644 --- a/src/libhydra/plugins/resolve/resolve_handler.c +++ b/src/libhydra/plugins/resolve/resolve_handler.c @@ -361,7 +361,7 @@ resolve_handler_t *resolve_handler_create() }, .mutex = mutex_create(MUTEX_TYPE_DEFAULT), .file = lib->settings->get_str(lib->settings, "%s.plugins.resolve.file", - RESOLV_CONF, hydra->daemon), + RESOLV_CONF, lib->ns), ); if (stat(RESOLVCONF_EXEC, &st) == 0) @@ -369,7 +369,7 @@ resolve_handler_t *resolve_handler_create() this->use_resolvconf = TRUE; this->iface_prefix = lib->settings->get_str(lib->settings, "%s.plugins.resolve.resolvconf.iface_prefix", - RESOLVCONF_PREFIX, hydra->daemon); + RESOLVCONF_PREFIX, lib->ns); } return &this->public; diff --git a/src/libimcv/imcv.c b/src/libimcv/imcv.c index b5862daee..2a4fd33df 100644 --- a/src/libimcv/imcv.c +++ b/src/libimcv/imcv.c @@ -109,7 +109,7 @@ bool libimcv_init(bool is_imv) else { /* we are the first to initialize libstrongswan */ - if (!library_init(NULL)) + if (!library_init(NULL, "libimcv")) { return FALSE; } @@ -134,6 +134,10 @@ bool libimcv_init(bool is_imv) } ref_get(&libstrongswan_ref); + lib->settings->add_fallback(lib->settings, "%s.imcv", "libimcv", lib->ns); + lib->settings->add_fallback(lib->settings, "%s.plugins", "libimcv.plugins", + lib->ns); + if (libimcv_ref == 0) { char *uri, *script; @@ -149,9 +153,10 @@ bool libimcv_init(bool is_imv) if (is_imv) { uri = lib->settings->get_str(lib->settings, - "libimcv.database", NULL); + "%s.imcv.database", NULL, lib->ns); script = lib->settings->get_str(lib->settings, - "libimcv.policy_script", IMCV_DEFAULT_POLICY_SCRIPT); + "%s.imcv.policy_script", IMCV_DEFAULT_POLICY_SCRIPT, + lib->ns); if (uri) { imcv_db = imv_database_create(uri, script); diff --git a/src/libimcv/imv/imv_msg.c b/src/libimcv/imv/imv_msg.c index 642b47935..e7181750c 100644 --- a/src/libimcv/imv/imv_msg.c +++ b/src/libimcv/imv/imv_msg.c @@ -208,8 +208,8 @@ METHOD(imv_msg_t, send_assessment, TNC_Result, } /* Send an IETF Assessment Result attribute if enabled */ - if (lib->settings->get_bool(lib->settings, "libimcv.assessment_result", - TRUE)) + if (lib->settings->get_bool(lib->settings, "%s.imcv.assessment_result", + TRUE, lib->ns)) { this->state->get_recommendation(this->state, &rec, &eval); attr = ietf_attr_assess_result_create(eval); diff --git a/src/libimcv/imv/imv_policy_manager.c b/src/libimcv/imv/imv_policy_manager.c index 61e0cd05b..afb54d6ec 100644 --- a/src/libimcv/imv/imv_policy_manager.c +++ b/src/libimcv/imv/imv_policy_manager.c @@ -288,7 +288,7 @@ int main(int argc, char *argv[]) atexit(library_deinit); /* initialize library */ - if (!library_init(NULL)) + if (!library_init(NULL, "imv_policy_manager")) { exit(SS_RC_LIBSTRONGSWAN_INTEGRITY); } @@ -328,7 +328,12 @@ int main(int argc, char *argv[]) session_id = atoi(tnc_session_id); /* attach IMV database */ - uri = lib->settings->get_str(lib->settings, "libimcv.database", NULL); + uri = lib->settings->get_str(lib->settings, + "imv_policy_manager.database", + lib->settings->get_str(lib->settings, + "charon.imcv.database", + lib->settings->get_str(lib->settings, + "libimcv.database", NULL))); if (!uri) { fprintf(stderr, "database uri not defined.\n"); diff --git a/src/libimcv/os_info/os_info.c b/src/libimcv/os_info/os_info.c index 17000cd27..06427575c 100644 --- a/src/libimcv/os_info/os_info.c +++ b/src/libimcv/os_info/os_info.c @@ -560,9 +560,9 @@ os_info_t *os_info_create(void) /* As an option OS name and OS version can be configured manually */ name.ptr = lib->settings->get_str(lib->settings, - "libimcv.os_info.name", NULL); + "%s.imcv.os_info.name", NULL, lib->ns); version.ptr = lib->settings->get_str(lib->settings, - "libimcv.os_info.version", NULL); + "%s.imcv.os_info.version", NULL, lib->ns); if (name.ptr && version.ptr) { name.len = strlen(name.ptr); diff --git a/src/libimcv/plugins/imc_os/imc_os.c b/src/libimcv/plugins/imc_os/imc_os.c index 2558be9f8..647a44957 100644 --- a/src/libimcv/plugins/imc_os/imc_os.c +++ b/src/libimcv/plugins/imc_os/imc_os.c @@ -387,7 +387,7 @@ TNC_Result TNC_IMC_BeginHandshake(TNC_IMCID imc_id, return TNC_RESULT_FATAL; } if (lib->settings->get_bool(lib->settings, - "libimcv.plugins.imc-os.push_info", TRUE)) + "%s.plugins.imc-os.push_info", TRUE, lib->ns)) { out_msg = imc_msg_create(imc_os, state, connection_id, imc_id, TNC_IMVID_ANY, msg_types[0]); diff --git a/src/libimcv/plugins/imc_scanner/imc_scanner.c b/src/libimcv/plugins/imc_scanner/imc_scanner.c index c87e827cd..2be6a87df 100644 --- a/src/libimcv/plugins/imc_scanner/imc_scanner.c +++ b/src/libimcv/plugins/imc_scanner/imc_scanner.c @@ -274,7 +274,7 @@ TNC_Result TNC_IMC_BeginHandshake(TNC_IMCID imc_id, return TNC_RESULT_FATAL; } if (lib->settings->get_bool(lib->settings, - "libimcv.plugins.imc-scanner.push_info", TRUE)) + "%s.plugins.imc-scanner.push_info", TRUE, lib->ns)) { out_msg = imc_msg_create(imc_scanner, state, connection_id, imc_id, TNC_IMVID_ANY, msg_types[0]); diff --git a/src/libimcv/plugins/imc_test/imc_test.c b/src/libimcv/plugins/imc_test/imc_test.c index c97d41628..ee982d93b 100644 --- a/src/libimcv/plugins/imc_test/imc_test.c +++ b/src/libimcv/plugins/imc_test/imc_test.c @@ -91,11 +91,11 @@ TNC_Result TNC_IMC_NotifyConnectionChange(TNC_IMCID imc_id, { case TNC_CONNECTION_STATE_CREATE: command = lib->settings->get_str(lib->settings, - "libimcv.plugins.imc-test.command", "none"); + "%s.plugins.imc-test.command", "none", lib->ns); dummy_size = lib->settings->get_int(lib->settings, - "libimcv.plugins.imc-test.dummy_size", 0); + "%s.plugins.imc-test.dummy_size", 0, lib->ns); retry = lib->settings->get_bool(lib->settings, - "libimcv.plugins.imc-test.retry", FALSE); + "%s.plugins.imc-test.retry", FALSE, lib->ns); state = imc_test_state_create(connection_id, command, dummy_size, retry); @@ -107,7 +107,7 @@ TNC_Result TNC_IMC_NotifyConnectionChange(TNC_IMCID imc_id, /* Optionally reserve additional IMC IDs */ additional_ids = lib->settings->get_int(lib->settings, - "libimcv.plugins.imc-test.additional_ids", 0); + "%s.plugins.imc-test.additional_ids", 0, lib->ns); imc_test->reserve_additional_ids(imc_test, additional_ids - imc_test->count_additional_ids(imc_test)); @@ -127,8 +127,8 @@ TNC_Result TNC_IMC_NotifyConnectionChange(TNC_IMCID imc_id, if (!test_state->is_first_handshake(test_state)) { command = lib->settings->get_str(lib->settings, - "libimcv.plugins.imc-test.retry_command", - test_state->get_command(test_state)); + "%s.plugins.imc-test.retry_command", + test_state->get_command(test_state), lib->ns); test_state->set_command(test_state, command); } diff --git a/src/libimcv/plugins/imv_os/imv_os_state.c b/src/libimcv/plugins/imv_os/imv_os_state.c index f7e9a6bc6..4f5a4b039 100644 --- a/src/libimcv/plugins/imv_os/imv_os_state.c +++ b/src/libimcv/plugins/imv_os/imv_os_state.c @@ -494,7 +494,7 @@ METHOD(imv_state_t, get_remediation_instructions, bool, *string = this->remediation_string->get_encoding(this->remediation_string); *uri = lib->settings->get_str(lib->settings, - "libimcv.plugins.imv-os.remediation_uri", NULL); + "%s.plugins.imv-os.remediation_uri", NULL, lib->ns); return TRUE; } diff --git a/src/libimcv/plugins/imv_os/pacman.c b/src/libimcv/plugins/imv_os/pacman.c index 57cc62a08..019e2adb8 100644 --- a/src/libimcv/plugins/imv_os/pacman.c +++ b/src/libimcv/plugins/imv_os/pacman.c @@ -466,12 +466,12 @@ int main(int argc, char *argv[]) atexit(cleanup); /* initialize library */ - if (!library_init(NULL)) + if (!library_init(NULL, "pacman")) { exit(SS_RC_LIBSTRONGSWAN_INTEGRITY); } if (!lib->plugins->load(lib->plugins, - lib->settings->get_str(lib->settings, "attest.load", "sqlite"))) + lib->settings->get_str(lib->settings, "pacman.load", "sqlite"))) { exit(SS_RC_INITIALIZATION_FAILED); } diff --git a/src/libimcv/plugins/imv_scanner/imv_scanner_state.c b/src/libimcv/plugins/imv_scanner/imv_scanner_state.c index 6658683e6..90475d34d 100644 --- a/src/libimcv/plugins/imv_scanner/imv_scanner_state.c +++ b/src/libimcv/plugins/imv_scanner/imv_scanner_state.c @@ -314,7 +314,7 @@ METHOD(imv_state_t, get_remediation_instructions, bool, this->violating_ports); *string = this->remediation_string->get_encoding(this->remediation_string); *uri = lib->settings->get_str(lib->settings, - "libimcv.plugins.imv-scanner.remediation_uri", NULL); + "%s.plugins.imv-scanner.remediation_uri", NULL, lib->ns); return TRUE; } diff --git a/src/libimcv/plugins/imv_test/imv_test_agent.c b/src/libimcv/plugins/imv_test/imv_test_agent.c index cdf0e18cd..42630003b 100644 --- a/src/libimcv/plugins/imv_test/imv_test_agent.c +++ b/src/libimcv/plugins/imv_test/imv_test_agent.c @@ -103,7 +103,7 @@ static TNC_Result receive_msg(private_imv_test_agent_t *this, imv_state_t *state /* add any new IMC and set its number of rounds */ rounds = lib->settings->get_int(lib->settings, - "libimcv.plugins.imv-test.rounds", 0); + "%s.plugins.imv-test.rounds", 0, lib->ns); test_state = (imv_test_state_t*)state; test_state->add_imc(test_state, in_msg->get_src_id(in_msg), rounds); @@ -178,7 +178,7 @@ static TNC_Result receive_msg(private_imv_test_agent_t *this, imv_state_t *state if (result != TNC_RESULT_SUCCESS) { return result; - } + } return this->agent->provide_recommendation(this->agent, state); } @@ -200,7 +200,7 @@ static TNC_Result receive_msg(private_imv_test_agent_t *this, imv_state_t *state out_msg->add_attribute(out_msg, attr); /* send PA-TNC message with excl flag set */ - result = out_msg->send(out_msg, TRUE); + result = out_msg->send(out_msg, TRUE); out_msg->destroy(out_msg); return result; @@ -214,11 +214,11 @@ static TNC_Result receive_msg(private_imv_test_agent_t *this, imv_state_t *state if (result != TNC_RESULT_SUCCESS) { return result; - } + } return this->agent->provide_recommendation(this->agent, state); } else - { + { return TNC_RESULT_SUCCESS; } } diff --git a/src/libpts/plugins/imc_attestation/imc_attestation_process.c b/src/libpts/plugins/imc_attestation/imc_attestation_process.c index 92e2e3abe..fbe81ee48 100644 --- a/src/libpts/plugins/imc_attestation/imc_attestation_process.c +++ b/src/libpts/plugins/imc_attestation/imc_attestation_process.c @@ -109,8 +109,8 @@ bool imc_attestation_process(pa_tnc_attr_t *attr, imc_msg_t *msg, int nonce_len, min_nonce_len; nonce_len = lib->settings->get_int(lib->settings, - "libimcv.plugins.imc-attestation.nonce_len", - DEFAULT_NONCE_LEN); + "%s.plugins.imc-attestation.nonce_len", + DEFAULT_NONCE_LEN, lib->ns); attr_cast = (tcg_pts_attr_dh_nonce_params_req_t*)attr; min_nonce_len = attr_cast->get_min_nonce_len(attr_cast); @@ -165,8 +165,8 @@ bool imc_attestation_process(pa_tnc_attr_t *attr, imc_msg_t *msg, initiator_nonce = attr_cast->get_initiator_nonce(attr_cast); nonce_len = lib->settings->get_int(lib->settings, - "libimcv.plugins.imc-attestation.nonce_len", - DEFAULT_NONCE_LEN); + "%s.plugins.imc-attestation.nonce_len", + DEFAULT_NONCE_LEN, lib->ns); if (nonce_len != initiator_nonce.len) { DBG1(DBG_IMC, "initiator and responder DH nonces " @@ -428,7 +428,8 @@ bool imc_attestation_process(pa_tnc_attr_t *attr, imc_msg_t *msg, } use_quote2 = lib->settings->get_bool(lib->settings, - "libimcv.plugins.imc-attestation.use_quote2", TRUE); + "%s.plugins.imc-attestation.use_quote2", TRUE, + lib->ns); if (!pts->quote_tpm(pts, use_quote2, &pcr_composite, "e_sig)) { DBG1(DBG_IMC, "error occurred during TPM quote operation"); diff --git a/src/libpts/plugins/imc_swid/imc_swid.c b/src/libpts/plugins/imc_swid/imc_swid.c index e1305805a..d4aaeff4d 100644 --- a/src/libpts/plugins/imc_swid/imc_swid.c +++ b/src/libpts/plugins/imc_swid/imc_swid.c @@ -181,8 +181,8 @@ static TNC_Result receive_message(imc_state_t *state, imc_msg_t *in_msg) full_tags = (flags & TCG_SWID_ATTR_REQ_FLAG_R) == 0; swid_directory = lib->settings->get_str(lib->settings, - "libimcv.plugins.imc-swid.swid_directory", - SWID_DIRECTORY); + "%s.plugins.imc-swid.swid_directory", + SWID_DIRECTORY, lib->ns); swid_inventory = swid_inventory_create(full_tags); if (!swid_inventory->collect(swid_inventory, swid_directory, targets)) { diff --git a/src/libpts/plugins/imv_attestation/attest.c b/src/libpts/plugins/imv_attestation/attest.c index 4d25df3f4..6e63c2653 100644 --- a/src/libpts/plugins/imv_attestation/attest.c +++ b/src/libpts/plugins/imv_attestation/attest.c @@ -439,7 +439,7 @@ int main(int argc, char *argv[]) atexit(library_deinit); /* initialize library */ - if (!library_init(NULL)) + if (!library_init(NULL, "attest")) { exit(SS_RC_LIBSTRONGSWAN_INTEGRITY); } diff --git a/src/libpts/plugins/imv_attestation/imv_attestation_agent.c b/src/libpts/plugins/imv_attestation/imv_attestation_agent.c index 957ca9be1..f8026e2a4 100644 --- a/src/libpts/plugins/imv_attestation/imv_attestation_agent.c +++ b/src/libpts/plugins/imv_attestation/imv_attestation_agent.c @@ -712,11 +712,11 @@ imv_agent_if_t *imv_attestation_agent_create(const char *name, TNC_IMVID id, } hash_alg = lib->settings->get_str(lib->settings, - "libimcv.plugins.imv-attestation.hash_algorithm", "sha256"); + "%s.plugins.imv-attestation.hash_algorithm", "sha256", lib->ns); dh_group = lib->settings->get_str(lib->settings, - "libimcv.plugins.imv-attestation.dh_group", "ecp256"); + "%s.plugins.imv-attestation.dh_group", "ecp256", lib->ns); cadir = lib->settings->get_str(lib->settings, - "libimcv.plugins.imv-attestation.cadir", NULL); + "%s.plugins.imv-attestation.cadir", NULL, lib->ns); INIT(this, .public = { diff --git a/src/libpts/plugins/imv_attestation/imv_attestation_build.c b/src/libpts/plugins/imv_attestation/imv_attestation_build.c index f3b13d34b..84023c6c6 100644 --- a/src/libpts/plugins/imv_attestation/imv_attestation_build.c +++ b/src/libpts/plugins/imv_attestation/imv_attestation_build.c @@ -47,7 +47,7 @@ bool imv_attestation_build(imv_msg_t *out_msg, imv_state_t *state, /* Send DH nonce parameters request attribute */ min_nonce_len = lib->settings->get_int(lib->settings, - "libimcv.plugins.imv-attestation.min_nonce_len", 0); + "%s.plugins.imv-attestation.min_nonce_len", 0, lib->ns); attr = tcg_pts_attr_dh_nonce_params_req_create(min_nonce_len, supported_dh_groups); attr->set_noskip_flag(attr, TRUE); diff --git a/src/libpts/plugins/imv_attestation/imv_attestation_process.c b/src/libpts/plugins/imv_attestation/imv_attestation_process.c index b99b84fab..83f74b332 100644 --- a/src/libpts/plugins/imv_attestation/imv_attestation_process.c +++ b/src/libpts/plugins/imv_attestation/imv_attestation_process.c @@ -93,7 +93,7 @@ bool imv_attestation_process(pa_tnc_attr_t *attr, imv_msg_t *out_msg, /* check compliance of responder nonce length */ min_nonce_len = lib->settings->get_int(lib->settings, - "libimcv.plugins.imv-attestation.min_nonce_len", 0); + "%s.plugins.imv-attestation.min_nonce_len", 0, lib->ns); nonce_len = responder_nonce.len; if (nonce_len < PTS_MIN_NONCE_LEN || (min_nonce_len > 0 && nonce_len < min_nonce_len)) @@ -247,7 +247,7 @@ bool imv_attestation_process(pa_tnc_attr_t *attr, imv_msg_t *out_msg, } type = found->get_type(found); arg_int = found->get_arg_int(found); - + switch (type) { default: @@ -300,7 +300,7 @@ bool imv_attestation_process(pa_tnc_attr_t *attr, imv_msg_t *out_msg, e = measurements->create_enumerator(measurements); while (e->enumerate(e, &filename, &measurement)) { - if (pts_db->add_file_measurement(pts_db, + if (pts_db->add_file_measurement(pts_db, platform_info, algo, measurement, filename, is_dir, arg_int) != SUCCESS) { diff --git a/src/libpts/pts/components/ita/ita_comp_ima.c b/src/libpts/pts/components/ita/ita_comp_ima.c index 1531f7a58..c6b4131bf 100644 --- a/src/libpts/pts/components/ita/ita_comp_ima.c +++ b/src/libpts/pts/components/ita/ita_comp_ima.c @@ -951,7 +951,7 @@ pts_component_t *pts_ita_comp_ima_create(u_int32_t depth, .bios_list = linked_list_create(), .ima_list = linked_list_create(), .pcr_info = lib->settings->get_bool(lib->settings, - "libimcv.plugins.imc-attestation.pcr_info", TRUE), + "%s.plugins.imc-attestation.pcr_info", TRUE, lib->ns), .ref = 1, ); diff --git a/src/libpts/pts/components/ita/ita_comp_tboot.c b/src/libpts/pts/components/ita/ita_comp_tboot.c index 8fb5abddf..f4859f801 100644 --- a/src/libpts/pts/components/ita/ita_comp_tboot.c +++ b/src/libpts/pts/components/ita/ita_comp_tboot.c @@ -130,21 +130,21 @@ METHOD(pts_component_t, measure, status_t, /* dummy data since currently the TBOOT log is not retrieved */ time(&this->measurement_time); meas_hex = lib->settings->get_str(lib->settings, - "libimcv.plugins.imc-attestation.pcr17_meas", NULL); + "%s.plugins.imc-attestation.pcr17_meas", NULL, lib->ns); pcr_before_hex = lib->settings->get_str(lib->settings, - "libimcv.plugins.imc-attestation.pcr17_before", NULL); + "%s.plugins.imc-attestation.pcr17_before", NULL, lib->ns); pcr_after_hex = lib->settings->get_str(lib->settings, - "libimcv.plugins.imc-attestation.pcr17_after", NULL); + "%s.plugins.imc-attestation.pcr17_after", NULL, lib->ns); extended_pcr = PCR_TBOOT_POLICY; break; case 1: /* dummy data since currently the TBOOT log is not retrieved */ meas_hex = lib->settings->get_str(lib->settings, - "libimcv.plugins.imc-attestation.pcr18_meas", NULL); + "%s.plugins.imc-attestation.pcr18_meas", NULL, lib->ns); pcr_before_hex = lib->settings->get_str(lib->settings, - "libimcv.plugins.imc-attestation.pcr18_before", NULL); + "%s.plugins.imc-attestation.pcr18_before", NULL, lib->ns); pcr_after_hex = lib->settings->get_str(lib->settings, - "libimcv.plugins.imc-attestation.pcr18_after", NULL); + "%s.plugins.imc-attestation.pcr18_after", NULL, lib->ns); extended_pcr = PCR_TBOOT_MLE; break; default: diff --git a/src/libpts/pts/pts.c b/src/libpts/pts/pts.c index f646d67e1..f528d4520 100644 --- a/src/libpts/pts/pts.c +++ b/src/libpts/pts/pts.c @@ -377,7 +377,7 @@ static void load_aik_blob(private_pts_t *this) u_int32_t aikBlobLen; blob_path = lib->settings->get_str(lib->settings, - "libimcv.plugins.imc-attestation.aik_blob", NULL); + "%s.plugins.imc-attestation.aik_blob", NULL, lib->ns); if (blob_path) { @@ -418,9 +418,9 @@ static void load_aik(private_pts_t *this) char *cert_path, *key_path; cert_path = lib->settings->get_str(lib->settings, - "libimcv.plugins.imc-attestation.aik_cert", NULL); + "%s.plugins.imc-attestation.aik_cert", NULL, lib->ns); key_path = lib->settings->get_str(lib->settings, - "libimcv.plugins.imc-attestation.aik_key", NULL); + "%s.plugins.imc-attestation.aik_key", NULL, lib->ns); if (cert_path) { diff --git a/src/libstrongswan/collections/array.c b/src/libstrongswan/collections/array.c index d0df23a28..642bbb349 100644 --- a/src/libstrongswan/collections/array.c +++ b/src/libstrongswan/collections/array.c @@ -1,4 +1,7 @@ /* + * Copyright (C) 2014 Tobias Brunner + * Hochschule fuer Technik Rapperswil + * * Copyright (C) 2013 Martin Willi * Copyright (C) 2013 revosec AG * @@ -13,8 +16,15 @@ * for more details. */ +#define _GNU_SOURCE /* for qsort_r() */ +#include + #include "array.h" +#ifndef HAVE_QSORT_R +#include +#endif + /** * Data is an allocated block, with potentially unused head and tail: * @@ -43,6 +53,11 @@ struct array_t { void *data; }; +#ifndef HAVE_QSORT_R + /* store data to replicate qsort_r in thread local storage */ + static thread_value_t *sort_data; +#endif + /** maximum number of unused head/tail elements before cleanup */ #define ARRAY_MAX_UNUSED 32 @@ -365,6 +380,113 @@ bool array_remove(array_t *array, int idx, void *data) return TRUE; } +typedef struct { + /** the array */ + array_t *array; + /** comparison function */ + int (*cmp)(const void*,const void*,void*); + /** optional user arg */ + void *arg; +} sort_data_t; + +#ifdef HAVE_QSORT_R_GNU +static int compare_elements(const void *a, const void *b, void *arg) +#elif HAVE_QSORT_R_BSD +static int compare_elements(void *arg, const void *a, const void *b) +#else /* !HAVE_QSORT_R */ +static int compare_elements(const void *a, const void *b) +#endif +{ +#ifdef HAVE_QSORT_R + sort_data_t *data = (sort_data_t*)arg; +#else + sort_data_t *data = sort_data->get(sort_data); +#endif + + if (data->array->esize) + { + return data->cmp(a, b, data->arg); + } + return data->cmp(*(void**)a, *(void**)b, data->arg); +} + +void array_sort(array_t *array, int (*cmp)(const void*,const void*,void*), + void *user) +{ + if (array) + { + sort_data_t data = { + .array = array, + .cmp = cmp, + .arg = user, + }; + void *start; + + start = array->data + get_size(array, array->head); + +#ifdef HAVE_QSORT_R_GNU + qsort_r(start, array->count, get_size(array, 1), compare_elements, + &data); +#elif HAVE_QSORT_R_BSD + qsort_r(start, array->count, get_size(array, 1), &data, + compare_elements); +#else /* !HAVE_QSORT_R */ + sort_data->set(sort_data, &data); + qsort(start, array->count, get_size(array, 1), compare_elements); +#endif + } +} + +typedef struct { + /** the array */ + array_t *array; + /** the key */ + const void *key; + /** comparison function */ + int (*cmp)(const void*,const void*); +} bsearch_data_t; + +static int search_elements(const void *a, const void *b) +{ + bsearch_data_t *data = (bsearch_data_t*)a; + + if (data->array->esize) + { + return data->cmp(data->key, b); + } + return data->cmp(data->key, *(void**)b); +} + +int array_bsearch(array_t *array, const void *key, + int (*cmp)(const void*,const void*), void *out) +{ + int idx = -1; + + if (array) + { + bsearch_data_t data = { + .array = array, + .key = key, + .cmp = cmp, + }; + void *start, *item; + + start = array->data + get_size(array, array->head); + + item = bsearch(&data, start, array->count, get_size(array, 1), + search_elements); + if (item) + { + if (out) + { + memcpy(out, item, get_size(array, 1)); + } + idx = (item - start) / get_size(array, 1); + } + } + return idx; +} + void array_invoke(array_t *array, array_callback_t cb, void *user) { if (array) @@ -427,3 +549,17 @@ void array_destroy_offset(array_t *array, size_t offset) array_invoke_offset(array, offset); array_destroy(array); } + +void arrays_init() +{ +#ifndef HAVE_QSORT_R + sort_data = thread_value_create(NULL); +#endif +} + +void arrays_deinit() +{ +#ifndef HAVE_QSORT_R + sort_data->destroy(sort_data); +#endif +} diff --git a/src/libstrongswan/collections/array.h b/src/libstrongswan/collections/array.h index 6fa151b59..ce702ebfa 100644 --- a/src/libstrongswan/collections/array.h +++ b/src/libstrongswan/collections/array.h @@ -1,4 +1,7 @@ /* + * Copyright (C) 2014 Tobias Brunner + * Hochschule fuer Technik Rapperswil + * * Copyright (C) 2013 Martin Willi * Copyright (C) 2013 revosec AG * @@ -87,7 +90,7 @@ void array_compress(array_t *array); * The enumerater enumerates directly over the array element (pass a pointer to * element types), unless the array is pointer based. If zero is passed as * element size during construction, the enumerator enumerates over the - * deferenced pointer values. + * dereferenced pointer values. * * @param array array to create enumerator for, or NULL * @return enumerator, over elements or pointers @@ -163,6 +166,50 @@ bool array_get(array_t *array, int idx, void *data); */ bool array_remove(array_t *array, int idx, void *data); +/** + * Sort the array. + * + * The comparison function must return an integer less than, equal to, or + * greater than zero if the first argument is considered to be respectively less + * than, equal to, or greater than the second. If two elements compare as + * equal, their order in the sorted array is undefined. + * + * The comparison function receives pointers to the array elements (esize != 0) + * or the actual pointers (esize = 0). The third argument is the user data + * supplied to this function. + * + * @param array array to sort, or NULL + * @param cmp comparison function + * @param user user data to pass to comparison function + */ +void array_sort(array_t *array, int (*cmp)(const void*,const void*,void*), + void *user); + +/** + * Binary search of a sorted array. + * + * The array should be sorted in ascending order according to the given + * comparison function. + * + * The comparison function must return an integer less than, equal to, or + * greater than zero if the first argument (the key) is considered to be + * respectively less than, equal to, or greater than the second. + * + * If there are multiple elements that match the key it is not specified which + * element is returned. + * + * The comparison function receives the key object and a pointer to an array + * element (esize != 0) or an actual pointer (esize = 0). + * + * @param array array to search, or NULL + * @param key key to search for + * @param cmp comparison function + * @param data data to copy element to, or NULL + * @return index of the element if found, -1 if not + */ +int array_bsearch(array_t *array, const void *key, + int (*cmp)(const void*,const void*), void *data); + /** * Invoke a callback for all array members. * @@ -204,4 +251,16 @@ void array_destroy_function(array_t *array, array_callback_t cb, void *user); */ void array_destroy_offset(array_t *array, size_t offset); + +/** + * Required on some platforms to initialize thread local value to implement + * array_sort(). + */ +void arrays_init(); + +/** + * Destroys the thread local value if required. + */ +void arrays_deinit(); + #endif /** ARRAY_H_ @}*/ diff --git a/src/libstrongswan/credentials/credential_manager.c b/src/libstrongswan/credentials/credential_manager.c index de19c8d96..3ec0714b6 100644 --- a/src/libstrongswan/credentials/credential_manager.c +++ b/src/libstrongswan/credentials/credential_manager.c @@ -1349,7 +1349,7 @@ credential_manager_t *credential_manager_create() this->local_sets = thread_value_create((thread_cleanup_t)this->sets->destroy); this->exclusive_local_sets = thread_value_create((thread_cleanup_t)this->sets->destroy); - if (lib->settings->get_bool(lib->settings, "libstrongswan.cert_cache", TRUE)) + if (lib->settings->get_bool(lib->settings, "%s.cert_cache", TRUE, lib->ns)) { this->cache = cert_cache_create(); this->sets->insert_first(this->sets, this->cache); diff --git a/src/libstrongswan/crypto/crypto_factory.c b/src/libstrongswan/crypto/crypto_factory.c index edcabfe58..dba3f6f6d 100644 --- a/src/libstrongswan/crypto/crypto_factory.c +++ b/src/libstrongswan/crypto/crypto_factory.c @@ -967,11 +967,11 @@ crypto_factory_t *crypto_factory_create() .lock = rwlock_create(RWLOCK_TYPE_DEFAULT), .tester = crypto_tester_create(), .test_on_add = lib->settings->get_bool(lib->settings, - "libstrongswan.crypto_test.on_add", FALSE), + "%s.crypto_test.on_add", FALSE, lib->ns), .test_on_create = lib->settings->get_bool(lib->settings, - "libstrongswan.crypto_test.on_create", FALSE), + "%s.crypto_test.on_create", FALSE, lib->ns), .bench = lib->settings->get_bool(lib->settings, - "libstrongswan.crypto_test.bench", FALSE), + "%s.crypto_test.bench", FALSE, lib->ns), ); return &this->public; diff --git a/src/libstrongswan/crypto/crypto_tester.c b/src/libstrongswan/crypto/crypto_tester.c index 5a0dccced..30724b16d 100644 --- a/src/libstrongswan/crypto/crypto_tester.c +++ b/src/libstrongswan/crypto/crypto_tester.c @@ -1207,13 +1207,13 @@ crypto_tester_t *crypto_tester_create() .rng = linked_list_create(), .required = lib->settings->get_bool(lib->settings, - "libstrongswan.crypto_test.required", FALSE), + "%s.crypto_test.required", FALSE, lib->ns), .rng_true = lib->settings->get_bool(lib->settings, - "libstrongswan.crypto_test.rng_true", FALSE), + "%s.crypto_test.rng_true", FALSE, lib->ns), .bench_time = lib->settings->get_int(lib->settings, - "libstrongswan.crypto_test.bench_time", 50), + "%s.crypto_test.bench_time", 50, lib->ns), .bench_size = lib->settings->get_int(lib->settings, - "libstrongswan.crypto_test.bench_size", 1024), + "%s.crypto_test.bench_size", 1024, lib->ns), ); /* enforce a block size of 16, should be fine for all algorithms */ diff --git a/src/libstrongswan/crypto/diffie_hellman.c b/src/libstrongswan/crypto/diffie_hellman.c index f71ebc671..5c1d08de2 100644 --- a/src/libstrongswan/crypto/diffie_hellman.c +++ b/src/libstrongswan/crypto/diffie_hellman.c @@ -444,7 +444,7 @@ diffie_hellman_params_t *diffie_hellman_get_params(diffie_hellman_group_t group) { if (!dh_params[i].public.subgroup.len && lib->settings->get_int(lib->settings, - "libstrongswan.dh_exponent_ansi_x9_42", TRUE)) + "%s.dh_exponent_ansi_x9_42", TRUE, lib->ns)) { dh_params[i].public.exp_len = dh_params[i].public.prime.len; } diff --git a/src/libstrongswan/library.c b/src/libstrongswan/library.c index 72fc2fa44..8472c30a5 100644 --- a/src/libstrongswan/library.c +++ b/src/libstrongswan/library.c @@ -22,6 +22,7 @@ #include #include #include +#include #include #include #include @@ -108,7 +109,7 @@ void library_deinit() } detailed = lib->settings->get_bool(lib->settings, - "libstrongswan.leak_detective.detailed", TRUE); + "%s.leak_detective.detailed", TRUE, lib->ns); /* make sure the cache is clear before unloading plugins */ lib->credmgr->flush_cache(lib->credmgr, CERT_ANY); @@ -142,9 +143,11 @@ void library_deinit() lib->leak_detective->destroy(lib->leak_detective); } + arrays_deinit(); threads_deinit(); backtrace_deinit(); + free((void*)this->public.ns); free(this); lib = NULL; } @@ -234,7 +237,7 @@ static bool check_memwipe() /* * see header file */ -bool library_init(char *settings) +bool library_init(char *settings, const char *namespace) { private_library_t *this; printf_hook_t *pfh; @@ -250,6 +253,7 @@ bool library_init(char *settings) .public = { .get = _get, .set = _set, + .ns = strdup(namespace ?: "libstrongswan"), }, .ref = 1, ); @@ -257,6 +261,7 @@ bool library_init(char *settings) backtrace_init(); threads_init(); + arrays_init(); #ifdef LEAK_DETECTIVE lib->leak_detective = leak_detective_create(); @@ -291,6 +296,9 @@ bool library_init(char *settings) this->objects = hashtable_create((hashtable_hash_t)hash, (hashtable_equals_t)equals, 4); this->public.settings = settings_create(settings); + /* all namespace settings may fall back to libstrongswan */ + lib->settings->add_fallback(lib->settings, lib->ns, "libstrongswan"); + this->public.hosts = host_resolver_create(); this->public.proposal = proposal_keywords_create(); this->public.caps = capabilities_create(); @@ -313,7 +321,7 @@ bool library_init(char *settings) } if (lib->settings->get_bool(lib->settings, - "libstrongswan.integrity_test", FALSE)) + "%s.integrity_test", FALSE, lib->ns)) { #ifdef INTEGRITY_TEST this->public.integrity = integrity_checker_create(CHECKSUM_LIBRARY); diff --git a/src/libstrongswan/library.h b/src/libstrongswan/library.h index e53cf09e2..4125328b7 100644 --- a/src/libstrongswan/library.h +++ b/src/libstrongswan/library.h @@ -1,4 +1,5 @@ /* + * Copyright (C) 2010-2014 Tobias Brunner * Copyright (C) 2008 Martin Willi * Hochschule fuer Technik Rapperswil * @@ -139,6 +140,12 @@ struct library_t { */ bool (*set)(library_t *this, char *name, void *object); + /** + * Namespace used for settings etc. (i.e. the name of the binary that uses + * the library) + */ + const char *ns; + /** * Printf hook registering facility */ @@ -239,12 +246,17 @@ struct library_t { * Initialize library, creates "lib" instance. * * library_init() may be called multiple times in a single process, but each - * caller should call library_deinit() for each call to library_init(). + * caller must call library_deinit() for each call to library_init(). + * + * The settings and namespace arguments are only used on the first call. * * @param settings file to read settings from, may be NULL for default + * @param namespace name of the binary that uses the library, determines + * the first section name when reading config options. + * Defaults to libstrongswan if NULL. * @return FALSE if integrity check failed */ -bool library_init(char *settings); +bool library_init(char *settings, const char *namespace); /** * Deinitialize library, destroys "lib" instance. diff --git a/src/libstrongswan/networking/host_resolver.c b/src/libstrongswan/networking/host_resolver.c index 99a17d17c..10af11a7f 100644 --- a/src/libstrongswan/networking/host_resolver.c +++ b/src/libstrongswan/networking/host_resolver.c @@ -355,11 +355,11 @@ host_resolver_t *host_resolver_create() ); this->min_threads = max(0, lib->settings->get_int(lib->settings, - "libstrongswan.host_resolver.min_threads", - MIN_THREADS_DEFAULT)); + "%s.host_resolver.min_threads", + MIN_THREADS_DEFAULT, lib->ns)); this->max_threads = max(this->min_threads ?: 1, lib->settings->get_int(lib->settings, - "libstrongswan.host_resolver.max_threads", - MAX_THREADS_DEFAULT)); + "%s.host_resolver.max_threads", + MAX_THREADS_DEFAULT, lib->ns)); return &this->public; } diff --git a/src/libstrongswan/plugins/gcrypt/gcrypt_plugin.c b/src/libstrongswan/plugins/gcrypt/gcrypt_plugin.c index 160db042b..44f3f84b1 100644 --- a/src/libstrongswan/plugins/gcrypt/gcrypt_plugin.c +++ b/src/libstrongswan/plugins/gcrypt/gcrypt_plugin.c @@ -194,8 +194,8 @@ plugin_t *gcrypt_plugin_create() /* we currently do not use secure memory */ gcry_control(GCRYCTL_DISABLE_SECMEM, 0); - if (lib->settings->get_bool(lib->settings, - "libstrongswan.plugins.gcrypt.quick_random", FALSE)) + if (lib->settings->get_bool(lib->settings, "%s.plugins.gcrypt.quick_random", + FALSE, lib->ns)) { gcry_control(GCRYCTL_ENABLE_QUICK_RANDOM, 0); } diff --git a/src/libstrongswan/plugins/ntru/ntru_drbg.c b/src/libstrongswan/plugins/ntru/ntru_drbg.c index 6fc13aa0a..181a58939 100644 --- a/src/libstrongswan/plugins/ntru/ntru_drbg.c +++ b/src/libstrongswan/plugins/ntru/ntru_drbg.c @@ -230,8 +230,8 @@ ntru_drbg_t *ntru_drbg_create(u_int32_t strength, chunk_t pers_str, } max_requests = lib->settings->get_int(lib->settings, - "libstrongswan.plugins.ntru.max_drbg_requests", - MAX_DRBG_REQUESTS); + "%s.plugins.ntru.max_drbg_requests", + MAX_DRBG_REQUESTS, lib->ns); INIT(this, .public = { diff --git a/src/libstrongswan/plugins/ntru/ntru_ke.c b/src/libstrongswan/plugins/ntru/ntru_ke.c index a23991b27..39fb261cd 100644 --- a/src/libstrongswan/plugins/ntru/ntru_ke.c +++ b/src/libstrongswan/plugins/ntru/ntru_ke.c @@ -316,7 +316,7 @@ ntru_ke_t *ntru_ke_create(diffie_hellman_group_t group, chunk_t g, chunk_t p) u_int32_t strength; parameter_set = lib->settings->get_str(lib->settings, - "libstrongswan.plugins.ntru.parameter_set", "optimum"); + "%s.plugins.ntru.parameter_set", "optimum", lib->ns); if (streq(parameter_set, "x9_98_speed")) { diff --git a/src/libstrongswan/plugins/openssl/openssl_crl.c b/src/libstrongswan/plugins/openssl/openssl_crl.c index 18aa5ceca..cb02c663c 100644 --- a/src/libstrongswan/plugins/openssl/openssl_crl.c +++ b/src/libstrongswan/plugins/openssl/openssl_crl.c @@ -471,7 +471,7 @@ static bool parse_extensions(private_openssl_crl_t *this) default: ok = X509_EXTENSION_get_critical(ext) == 0 || !lib->settings->get_bool(lib->settings, - "libstrongswan.x509.enforce_critical", TRUE); + "%s.x509.enforce_critical", TRUE, lib->ns); if (!ok) { DBG1(DBG_LIB, "found unsupported critical X.509 " diff --git a/src/libstrongswan/plugins/openssl/openssl_ec_diffie_hellman.c b/src/libstrongswan/plugins/openssl/openssl_ec_diffie_hellman.c index 835ed586e..b487d59a5 100644 --- a/src/libstrongswan/plugins/openssl/openssl_ec_diffie_hellman.c +++ b/src/libstrongswan/plugins/openssl/openssl_ec_diffie_hellman.c @@ -201,7 +201,7 @@ static bool compute_shared_key(private_openssl_ec_diffie_hellman_t *this, * http://www.rfc-editor.org/errata_search.php?eid=9 */ x_coordinate_only = lib->settings->get_bool(lib->settings, - "libstrongswan.ecp_x_coordinate_only", TRUE); + "%s.ecp_x_coordinate_only", TRUE, lib->ns); if (!ecp2chunk(this->ec_group, secret, shared_secret, x_coordinate_only)) { goto error; diff --git a/src/libstrongswan/plugins/openssl/openssl_plugin.c b/src/libstrongswan/plugins/openssl/openssl_plugin.c index ff2508609..f4aef8200 100644 --- a/src/libstrongswan/plugins/openssl/openssl_plugin.c +++ b/src/libstrongswan/plugins/openssl/openssl_plugin.c @@ -522,7 +522,7 @@ plugin_t *openssl_plugin_create() int fips_mode; fips_mode = lib->settings->get_int(lib->settings, - "libstrongswan.plugins.openssl.fips_mode", FIPS_MODE); + "%s.plugins.openssl.fips_mode", FIPS_MODE, lib->ns); #ifdef OPENSSL_FIPS if (fips_mode) { diff --git a/src/libstrongswan/plugins/openssl/openssl_rsa_private_key.c b/src/libstrongswan/plugins/openssl/openssl_rsa_private_key.c index 036f53d23..10a35c1fd 100644 --- a/src/libstrongswan/plugins/openssl/openssl_rsa_private_key.c +++ b/src/libstrongswan/plugins/openssl/openssl_rsa_private_key.c @@ -558,7 +558,7 @@ openssl_rsa_private_key_t *openssl_rsa_private_key_connect(key_type_t type, if (!engine_id) { engine_id = lib->settings->get_str(lib->settings, - "libstrongswan.plugins.openssl.engine_id", "pkcs11"); + "%s.plugins.openssl.engine_id", "pkcs11", lib->ns); } engine = ENGINE_by_id(engine_id); if (!engine) diff --git a/src/libstrongswan/plugins/openssl/openssl_x509.c b/src/libstrongswan/plugins/openssl/openssl_x509.c index 24b12d50c..7a5b206dd 100644 --- a/src/libstrongswan/plugins/openssl/openssl_x509.c +++ b/src/libstrongswan/plugins/openssl/openssl_x509.c @@ -1012,7 +1012,7 @@ static bool parse_extensions(private_openssl_x509_t *this) default: ok = X509_EXTENSION_get_critical(ext) == 0 || !lib->settings->get_bool(lib->settings, - "libstrongswan.x509.enforce_critical", TRUE); + "%s.x509.enforce_critical", TRUE, lib->ns); if (!ok) { char buf[80] = ""; diff --git a/src/libstrongswan/plugins/pkcs11/pkcs11_dh.c b/src/libstrongswan/plugins/pkcs11/pkcs11_dh.c index 2e5af95ff..36cc284bf 100644 --- a/src/libstrongswan/plugins/pkcs11/pkcs11_dh.c +++ b/src/libstrongswan/plugins/pkcs11/pkcs11_dh.c @@ -135,7 +135,7 @@ METHOD(diffie_hellman_t, set_other_public_value, void, }; if (!lib->settings->get_bool(lib->settings, - "libstrongswan.ecp_x_coordinate_only", TRUE)) + "%s.ecp_x_coordinate_only", TRUE, lib->ns)) { /* we only get the x coordinate back */ return; } diff --git a/src/libstrongswan/plugins/pkcs11/pkcs11_manager.c b/src/libstrongswan/plugins/pkcs11/pkcs11_manager.c index 8bda5b66f..96c4a180d 100644 --- a/src/libstrongswan/plugins/pkcs11/pkcs11_manager.c +++ b/src/libstrongswan/plugins/pkcs11/pkcs11_manager.c @@ -338,7 +338,7 @@ pkcs11_manager_t *pkcs11_manager_create(pkcs11_manager_token_event_t cb, ); enumerator = lib->settings->create_section_enumerator(lib->settings, - "libstrongswan.plugins.pkcs11.modules"); + "%s.plugins.pkcs11.modules", lib->ns); while (enumerator->enumerate(enumerator, &module)) { INIT(entry, @@ -346,7 +346,7 @@ pkcs11_manager_t *pkcs11_manager_create(pkcs11_manager_token_event_t cb, ); entry->path = lib->settings->get_str(lib->settings, - "libstrongswan.plugins.pkcs11.modules.%s.path", NULL, module); + "%s.plugins.pkcs11.modules.%s.path", NULL, lib->ns, module); if (!entry->path) { DBG1(DBG_CFG, "PKCS11 module '%s' lacks library path", module); @@ -355,8 +355,8 @@ pkcs11_manager_t *pkcs11_manager_create(pkcs11_manager_token_event_t cb, } entry->lib = pkcs11_library_create(module, entry->path, lib->settings->get_bool(lib->settings, - "libstrongswan.plugins.pkcs11.modules.%s.os_locking", - FALSE, module)); + "%s.plugins.pkcs11.modules.%s.os_locking", + FALSE, lib->ns, module)); if (!entry->lib) { free(entry); diff --git a/src/libstrongswan/plugins/pkcs11/pkcs11_plugin.c b/src/libstrongswan/plugins/pkcs11/pkcs11_plugin.c index 3faa59cae..bd2a2c114 100644 --- a/src/libstrongswan/plugins/pkcs11/pkcs11_plugin.c +++ b/src/libstrongswan/plugins/pkcs11/pkcs11_plugin.c @@ -83,8 +83,8 @@ static void token_event_cb(private_pkcs11_plugin_t *this, pkcs11_library_t *p11, if (add && this->handle_events) { if (lib->settings->get_bool(lib->settings, - "libstrongswan.plugins.pkcs11.modules.%s.load_certs", - TRUE, p11->get_name(p11))) + "%s.plugins.pkcs11.modules.%s.load_certs", + TRUE, lib->ns, p11->get_name(p11))) { creds = pkcs11_creds_create(p11, slot); if (creds) @@ -174,8 +174,8 @@ static bool handle_certs(private_pkcs11_plugin_t *this, METHOD(plugin_t, reload, bool, private_pkcs11_plugin_t *this) { - if (lib->settings->get_bool(lib->settings, - "libstrongswan.plugins.pkcs11.reload_certs", FALSE)) + if (lib->settings->get_bool(lib->settings, "%s.plugins.pkcs11.reload_certs", + FALSE, lib->ns)) { DBG1(DBG_CFG, "reloading certificates from PKCS#11 tokens"); handle_certs(this, NULL, FALSE, NULL); @@ -247,28 +247,28 @@ METHOD(plugin_t, get_features, int, if (!count) { /* initialize only once */ bool use_ecc = lib->settings->get_bool(lib->settings, - "libstrongswan.plugins.pkcs11.use_ecc", FALSE); + "%s.plugins.pkcs11.use_ecc", FALSE, lib->ns); plugin_features_add(f, f_manager, countof(f_manager), &count); /* private key handling for EC keys is not disabled by use_ecc */ plugin_features_add(f, f_privkey, countof(f_privkey), &count); if (lib->settings->get_bool(lib->settings, - "libstrongswan.plugins.pkcs11.use_pubkey", FALSE)) + "%s.plugins.pkcs11.use_pubkey", FALSE, lib->ns)) { plugin_features_add(f, f_pubkey, countof(f_pubkey) - (use_ecc ? 0 : 1), &count); } if (lib->settings->get_bool(lib->settings, - "libstrongswan.plugins.pkcs11.use_hasher", FALSE)) + "%s.plugins.pkcs11.use_hasher", FALSE, lib->ns)) { plugin_features_add(f, f_hash, countof(f_hash), &count); } if (lib->settings->get_bool(lib->settings, - "libstrongswan.plugins.pkcs11.use_rng", FALSE)) + "%s.plugins.pkcs11.use_rng", FALSE, lib->ns)) { plugin_features_add(f, f_rng, countof(f_rng), &count); } if (lib->settings->get_bool(lib->settings, - "libstrongswan.plugins.pkcs11.use_dh", FALSE)) + "%s.plugins.pkcs11.use_dh", FALSE, lib->ns)) { plugin_features_add(f, f_dh, countof(f_dh), &count); if (use_ecc) diff --git a/src/libstrongswan/plugins/plugin_loader.c b/src/libstrongswan/plugins/plugin_loader.c index c9043239b..08a8442ea 100644 --- a/src/libstrongswan/plugins/plugin_loader.c +++ b/src/libstrongswan/plugins/plugin_loader.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2010-2013 Tobias Brunner + * Copyright (C) 2010-2014 Tobias Brunner * Copyright (C) 2007 Martin Willi * Hochschule fuer Technik Rapperswil * @@ -28,6 +28,7 @@ #include #include #include +#include #include #include #include @@ -936,18 +937,146 @@ static bool find_plugin(char *path, char *name, char *buf, char **file) return FALSE; } +/** + * Used to sort plugins by priority + */ +typedef struct { + /* name of the plugin */ + char *name; + /* the plugins priority */ + int prio; + /* default priority */ + int def; +} plugin_priority_t; + +static void plugin_priority_free(const plugin_priority_t *this, int idx, + void *user) +{ + free(this->name); +} + +/** + * Sort plugins and their priority by name + */ +static int plugin_priority_cmp_name(const plugin_priority_t *a, + const plugin_priority_t *b) +{ + return strcmp(a->name, b->name); +} + +/** + * Sort plugins by decreasing priority or default priority then by name + */ +static int plugin_priority_cmp(const plugin_priority_t *a, + const plugin_priority_t *b, void *user) +{ + int diff; + + diff = b->prio - a->prio; + if (!diff) + { /* the same priority, use default order */ + diff = b->def - a->def; + if (!diff) + { /* same default priority (i.e. both were not found in that list) */ + return strcmp(a->name, b->name); + } + } + return diff; +} + + +/** + * Determine the list of plugins to load via load option in each plugin's + * config section. + */ +static char *modular_pluginlist(char *list) +{ + enumerator_t *enumerator; + array_t *given, *final; + plugin_priority_t item, *current, found; + char *plugin, *plugins = NULL; + int i = 0, max_prio; + + if (!lib->settings->get_bool(lib->settings, "%s.load_modular", FALSE, + lib->ns)) + { + return list; + } + + given = array_create(sizeof(plugin_priority_t), 0); + final = array_create(sizeof(plugin_priority_t), 0); + + enumerator = enumerator_create_token(list, " ", " "); + while (enumerator->enumerate(enumerator, &plugin)) + { + item.name = strdup(plugin); + item.prio = i++; + array_insert(given, ARRAY_TAIL, &item); + } + enumerator->destroy(enumerator); + array_sort(given, (void*)plugin_priority_cmp_name, NULL); + /* the maximum priority used for plugins not found in this list */ + max_prio = i + 1; + + enumerator = lib->settings->create_section_enumerator(lib->settings, + "%s.plugins", lib->ns); + while (enumerator->enumerate(enumerator, &plugin)) + { + item.prio = lib->settings->get_int(lib->settings, + "%s.plugins.%s.load", 0, lib->ns, plugin); + if (!item.prio) + { + if (!lib->settings->get_bool(lib->settings, + "%s.plugins.%s.load", FALSE, lib->ns, plugin)) + { + continue; + } + item.prio = 1; + } + item.name = plugin; + item.def = max_prio; + if (array_bsearch(given, &item, (void*)plugin_priority_cmp_name, + &found) != -1) + { + item.def = max_prio - found.prio; + } + array_insert(final, ARRAY_TAIL, &item); + } + enumerator->destroy(enumerator); + array_destroy_function(given, (void*)plugin_priority_free, NULL); + + array_sort(final, (void*)plugin_priority_cmp, NULL); + + enumerator = array_create_enumerator(final); + while (enumerator->enumerate(enumerator, ¤t)) + { + char *prev = plugins; + if (asprintf(&plugins, "%s %s", plugins ?: "", current->name) < 0) + { + plugins = prev; + break; + } + free(prev); + } + enumerator->destroy(enumerator); + array_destroy(final); + return plugins; +} + METHOD(plugin_loader_t, load_plugins, bool, private_plugin_loader_t *this, char *list) { enumerator_t *enumerator; - char *default_path = NULL, *token; + char *default_path = NULL, *plugins, *token; bool critical_failed = FALSE; #ifdef PLUGINDIR default_path = PLUGINDIR; #endif /* PLUGINDIR */ - enumerator = enumerator_create_token(list, " ", " "); + plugins = modular_pluginlist(list); + + enumerator = enumerator_create_token(plugins, " ", " "); while (!critical_failed && enumerator->enumerate(enumerator, &token)) { plugin_entry_t *entry; @@ -1006,6 +1135,10 @@ METHOD(plugin_loader_t, load_plugins, bool, free(this->loaded_plugins); this->loaded_plugins = loaded_plugins_list(this); } + if (plugins != list) + { + free(plugins); + } return !critical_failed; } diff --git a/src/libstrongswan/plugins/plugin_loader.h b/src/libstrongswan/plugins/plugin_loader.h index 164360c30..08a759a00 100644 --- a/src/libstrongswan/plugins/plugin_loader.h +++ b/src/libstrongswan/plugins/plugin_loader.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2012-2013 Tobias Brunner + * Copyright (C) 2012-2014 Tobias Brunner * Copyright (C) 2007 Martin Willi * Hochschule fuer Technik Rapperswil * @@ -67,6 +67,13 @@ struct plugin_loader_t { * for the plugins first, in the order they were added, then the default * path follows. * + * If .load_modular is enabled (where is lib->ns) the plugins to + * load are determined via a load option in their respective plugin config + * section e.g. .plugins..load = . + * The oder is determined by the configured priority. If two plugins have + * the same priority the order as seen in list is preserved. Plugins not + * found in list are loaded first, in alphabetical order. + * * @note Even though this method could be called multiple times this is * currently not really supported in regards to plugin features and their * dependencies (in particular soft dependencies). diff --git a/src/libstrongswan/plugins/random/random_plugin.c b/src/libstrongswan/plugins/random/random_plugin.c index 8ac1ac366..1f1079240 100644 --- a/src/libstrongswan/plugins/random/random_plugin.c +++ b/src/libstrongswan/plugins/random/random_plugin.c @@ -143,11 +143,11 @@ plugin_t *random_plugin_create() ); strong_equals_true = lib->settings->get_bool(lib->settings, - "libstrongswan.plugins.random.strong_equals_true", FALSE); + "%s.plugins.random.strong_equals_true", FALSE, lib->ns); urandom_file = lib->settings->get_str(lib->settings, - "libstrongswan.plugins.random.urandom", DEV_URANDOM); + "%s.plugins.random.urandom", DEV_URANDOM, lib->ns); random_file = lib->settings->get_str(lib->settings, - "libstrongswan.plugins.random.random", DEV_RANDOM); + "%s.plugins.random.random", DEV_RANDOM, lib->ns); if (!open_dev(urandom_file, &dev_urandom) || !open_dev(random_file, &dev_random)) { diff --git a/src/libstrongswan/plugins/unbound/unbound_resolver.c b/src/libstrongswan/plugins/unbound/unbound_resolver.c index 42cdbc6cc..745e59d5b 100644 --- a/src/libstrongswan/plugins/unbound/unbound_resolver.c +++ b/src/libstrongswan/plugins/unbound/unbound_resolver.c @@ -97,14 +97,14 @@ resolver_t *unbound_resolver_create(void) char *resolv_conf, *trust_anchors, *dlv_anchors; resolv_conf = lib->settings->get_str(lib->settings, - "libstrongswan.plugins.unbound.resolv_conf", - RESOLV_CONF_FILE); + "%s.plugins.unbound.resolv_conf", + RESOLV_CONF_FILE, lib->ns); trust_anchors = lib->settings->get_str(lib->settings, - "libstrongswan.plugins.unbound.trust_anchors", - TRUST_ANCHOR_FILE); + "%s.plugins.unbound.trust_anchors", + TRUST_ANCHOR_FILE, lib->ns); dlv_anchors = lib->settings->get_str(lib->settings, - "libstrongswan.plugins.unbound.dlv_anchors", - NULL); + "%s.plugins.unbound.dlv_anchors", + NULL, lib->ns); INIT(this, .public = { diff --git a/src/libstrongswan/plugins/x509/x509_cert.c b/src/libstrongswan/plugins/x509/x509_cert.c index 85c481552..09eda32b3 100644 --- a/src/libstrongswan/plugins/x509/x509_cert.c +++ b/src/libstrongswan/plugins/x509/x509_cert.c @@ -1446,7 +1446,7 @@ static bool parse_certificate(private_x509_cert_t *this) break; default: if (critical && lib->settings->get_bool(lib->settings, - "libstrongswan.x509.enforce_critical", TRUE)) + "%s.x509.enforce_critical", TRUE, lib->ns)) { DBG1(DBG_ASN, "critical '%s' extension not supported", (extn_oid == OID_UNKNOWN) ? "unknown" : diff --git a/src/libstrongswan/plugins/x509/x509_crl.c b/src/libstrongswan/plugins/x509/x509_crl.c index efb70c94c..d6057c30f 100644 --- a/src/libstrongswan/plugins/x509/x509_crl.c +++ b/src/libstrongswan/plugins/x509/x509_crl.c @@ -325,7 +325,7 @@ static bool parse(private_x509_crl_t *this) break; default: if (critical && lib->settings->get_bool(lib->settings, - "libstrongswan.x509.enforce_critical", TRUE)) + "%s.x509.enforce_critical", TRUE, lib->ns)) { DBG1(DBG_ASN, "critical '%s' extension not supported", (extn_oid == OID_UNKNOWN) ? "unknown" : diff --git a/src/libstrongswan/processing/processor.c b/src/libstrongswan/processing/processor.c index adbd95685..012b169e3 100644 --- a/src/libstrongswan/processing/processor.c +++ b/src/libstrongswan/processing/processor.c @@ -545,7 +545,7 @@ processor_t *processor_create() { this->jobs[i] = linked_list_create(); this->prio_threads[i] = lib->settings->get_int(lib->settings, - "libstrongswan.processor.priority_threads.%N", 0, + "%s.processor.priority_threads.%N", 0, lib->ns, job_priority_names, i); } diff --git a/src/libstrongswan/tests/Makefile.am b/src/libstrongswan/tests/Makefile.am index c8c596438..331a5480d 100644 --- a/src/libstrongswan/tests/Makefile.am +++ b/src/libstrongswan/tests/Makefile.am @@ -34,6 +34,7 @@ tests_SOURCES = tests.h tests.c \ suites/test_stream.c \ suites/test_fetch_http.c \ suites/test_utils.c \ + suites/test_settings.c \ suites/test_vectors.c \ suites/test_array.c \ suites/test_ecdsa.c \ diff --git a/src/libstrongswan/tests/suites/test_array.c b/src/libstrongswan/tests/suites/test_array.c index 198ee96c2..ba2aff460 100644 --- a/src/libstrongswan/tests/suites/test_array.c +++ b/src/libstrongswan/tests/suites/test_array.c @@ -1,4 +1,7 @@ /* + * Copyright (C) 2014 Tobias Brunner + * Hochschule fuer Technik Rapperswil + * * Copyright (C) 2013 Martin Willi * Copyright (C) 2013 revosec AG * @@ -274,6 +277,149 @@ START_TEST(test_enumerate) } END_TEST +static int comp_obj(const void *a, const void *b, void *arg) +{ + ck_assert_str_eq(arg, "arg"); + return *(int*)a - *(int*)b; +} + +START_TEST(test_sort_obj) +{ + array_t *array; + int x[][3] = { + {1, 2, 3}, + {1, 3, 2}, + {2, 1, 3}, + {2, 3, 1}, + {3, 1, 2}, + {3, 2, 1}, + }; + char *arg = "arg"; + int i, v; + + for (i = 0; i < countof(x); i++) + { + array = array_create(sizeof(x[i][0]), 0); + array_insert(array, ARRAY_TAIL, &x[i][0]); + array_insert(array, ARRAY_TAIL, &x[i][1]); + array_insert(array, ARRAY_TAIL, &x[i][2]); + + array_sort(array, comp_obj, arg); + + ck_assert(array_get(array, 0, &v)); + ck_assert_int_eq(v, 1); + ck_assert(array_get(array, 1, &v)); + ck_assert_int_eq(v, 2); + ck_assert(array_get(array, 2, &v)); + ck_assert_int_eq(v, 3); + + array_destroy(array); + } +} +END_TEST + +static int comp_ptr(const void *a, const void *b, void *arg) +{ + ck_assert_str_eq(arg, "arg"); + return strcmp(a, b); +} + +START_TEST(test_sort_ptr) +{ + array_t *array; + char *x[][3] = { + {"a", "b", "c"}, + {"a", "c", "b"}, + {"b", "a", "c"}, + {"b", "c", "a"}, + {"c", "a", "b"}, + {"c", "b", "a"}, + }; + char *v, *arg = "arg"; + int i; + + for (i = 0; i < countof(x); i++) + { + array = array_create(0, 0); + array_insert(array, ARRAY_TAIL, x[i][0]); + array_insert(array, ARRAY_TAIL, x[i][1]); + array_insert(array, ARRAY_TAIL, x[i][2]); + + array_sort(array, comp_ptr, arg); + + ck_assert(array_get(array, 0, &v)); + ck_assert_str_eq(v, "a"); + ck_assert(array_get(array, 1, &v)); + ck_assert_str_eq(v, "b"); + ck_assert(array_get(array, 2, &v)); + ck_assert_str_eq(v, "c"); + + array_destroy(array); + } +} +END_TEST + +static int comp_search_obj(const void *a, const void *b) +{ + return *(int*)a - *(int*)b; +} + +START_TEST(test_bsearch_obj) +{ + array_t *array; + int x[] = { 3, 2, 1 }; + int k, v; + + array = array_create(sizeof(x[0]), 0); + array_insert(array, ARRAY_TAIL, &x[0]); + array_insert(array, ARRAY_TAIL, &x[1]); + array_insert(array, ARRAY_TAIL, &x[2]); + + array_sort(array, (void*)comp_search_obj, NULL); + + k = 0; + ck_assert_int_eq(array_bsearch(array, &k, comp_search_obj, &v), -1); + for (k = 1; k < 4; k++) + { + ck_assert_int_eq(array_bsearch(array, &k, comp_search_obj, &v), k-1); + ck_assert_int_eq(v, k); + } + k = 4; + ck_assert_int_eq(array_bsearch(array, &k, comp_search_obj, &v), -1); + array_destroy(array); +} +END_TEST + +static int comp_search_ptr(const void *a, const void *b) +{ + return strcmp(a, b); +} + +START_TEST(test_bsearch_ptr) +{ + array_t *array; + char *x[] = {"c", "b", "a"}; + char *v; + + array = array_create(0, 0); + array_insert(array, ARRAY_TAIL, x[0]); + array_insert(array, ARRAY_TAIL, x[1]); + array_insert(array, ARRAY_TAIL, x[2]); + + array_sort(array, (void*)comp_search_ptr, NULL); + + ck_assert_int_eq(array_bsearch(array, "abc", comp_search_ptr, &v), -1); + ck_assert_int_eq(array_bsearch(array, "a", comp_search_ptr, &v), 0); + ck_assert_str_eq(v, "a"); + ck_assert_int_eq(array_bsearch(array, "b", comp_search_ptr, &v), 1); + ck_assert_str_eq(v, "b"); + ck_assert_int_eq(array_bsearch(array, "c", comp_search_ptr, &v), 2); + ck_assert_str_eq(v, "c"); + + array_destroy(array); +} +END_TEST + static void invoke(void *data, int idx, void *user) { int *y = user, *x = data; @@ -364,6 +510,16 @@ Suite *array_suite_create() tcase_add_test(tc, test_enumerate); suite_add_tcase(s, tc); + tc = tcase_create("sort"); + tcase_add_test(tc, test_sort_obj); + tcase_add_test(tc, test_sort_ptr); + suite_add_tcase(s, tc); + + tc = tcase_create("bsearch"); + tcase_add_test(tc, test_bsearch_obj); + tcase_add_test(tc, test_bsearch_ptr); + suite_add_tcase(s, tc); + tc = tcase_create("invoke"); tcase_add_test(tc, test_invoke); suite_add_tcase(s, tc); diff --git a/src/libstrongswan/tests/suites/test_settings.c b/src/libstrongswan/tests/suites/test_settings.c new file mode 100644 index 000000000..096465191 --- /dev/null +++ b/src/libstrongswan/tests/suites/test_settings.c @@ -0,0 +1,920 @@ +/* + * Copyright (C) 2014 Tobias Brunner + * Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See . + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +#include "test_suite.h" + +#include + +#include +#include +#include +#include + +static char *path = "/tmp/strongswan-settings-test"; +static settings_t *settings; + +static void create_settings(chunk_t contents) +{ + ck_assert(chunk_write(contents, path, 0022, TRUE)); + settings = settings_create(path); +} + +START_SETUP(setup_base_config) +{ + create_settings(chunk_from_str( + "main {\n" + " key1 = val1\n" + " # this gets overridden below\n" + " key2 = val2\n" + " none = \n" + " sub1 {\n" + " key = value\n" + " key2 = value2\n" + " subsub {\n" + " foo = bar\n" + " }\n" + " # subsub is a section and a value\n" + " subsub = section value\n" + " }\n" + " sub% {\n" + " id = %any\n" + " }\n" + " key2 = with spaces\n" + "}\n" + "out = side\n" + "other {\n" + " key1 = other val\n" + " empty {\n" + " }\n" + "}")); +} +END_SETUP + +START_TEARDOWN(teardown_config) +{ + settings->destroy(settings); + unlink(path); +} +END_TEARDOWN + +#define verify_string(expected, key, ...) \ + ck_assert_str_eq(expected, settings->get_str(settings, key, NULL, ##__VA_ARGS__)) +#define verify_null(key, ...) \ + ck_assert(!settings->get_str(settings, key, NULL, ##__VA_ARGS__)) + +START_TEST(test_get_str) +{ + verify_string("val1", "main.key1"); + verify_string("val1", "main..key1"); + verify_string("val1", ".main.key1"); + verify_string("with spaces", "main.key2"); + verify_string("value", "main.sub1.key"); + verify_string("value2", "main.sub1.key2"); + verify_string("bar", "main.sub1.subsub.foo"); + verify_string("section value", "main.sub1.subsub"); + verify_string("%any", "main.sub%%.id"); + verify_string("side", "out"); + verify_string("other val", "other.key1"); + + /* FIXME: should this rather be undefined i.e. return the default value? */ + verify_string("", "main.none"); + + verify_null("main.key3"); + verify_null("other.sub"); +} +END_TEST + +enum { + KEY1, + SUB1 +} settings_test_enum; + +enum_name_t *test_settings_test_names; + +ENUM_BEGIN(test_settings_test_names, KEY1, SUB1, + "key1", "sub1"); +ENUM_END(test_settings_test_names, SUB1); + +START_TEST(test_get_str_printf) +{ + verify_string("val1", "%s.key1", "main"); + verify_string("val1", "%s.%s", "main", "key1"); + verify_string("val1", "%s.%N", "main", test_settings_test_names, KEY1); + verify_string("val1", "%s.%s%d", "main", "key", 1); + verify_string("bar", "%s.sub1.%s.foo", "main", "subsub"); + verify_string("bar", "%s.%N.%s.foo", "main", test_settings_test_names, SUB1, "subsub"); + verify_string("bar", "%s.sub%d.%s.foo", "main", 1, "subsub"); + verify_string("%any", "%s.sub%%.id", "main"); + + /* FIXME: this is a bit inconsistent, while this works */ + verify_string("value2", "main.%s%u.key2", "sub", 1); + /* this won't because no argument is consumed for %u so key1 will be tried + * granted, we never actually used any other specifiers, but we should + * probably document it at least */ + verify_null("main.%s%u.key%d", "sub", 1, 2); + + verify_null("%s.%s%d", "main", "key", 3); +} +END_TEST + +START_TEST(test_set_str) +{ + settings->set_str(settings, "main.key1", "val"); + verify_string("val", "main.key1"); + settings->set_str(settings, "main.key1", "longer value"); + verify_string("longer value", "main.key1"); + settings->set_str(settings, "main", "main val"); + verify_string("main val", "main"); + settings->set_str(settings, "main.sub1.new", "added"); + verify_string("added", "main.sub1.new"); + settings->set_str(settings, "main.sub2.newsub.foo", "bar"); + verify_string("bar", "main.sub2.newsub.foo"); + settings->set_str(settings, "new.newsub.foo", "bar"); + verify_string("bar", "new.newsub.foo"); + settings->set_str(settings, "main.key1", NULL); + verify_null("main.key1"); +} +END_TEST + +START_TEST(test_set_str_printf) +{ + settings->set_str(settings, "%s.key1", "val", "main"); + verify_string("val", "main.key1"); + settings->set_str(settings, "main.%N.new", "added", test_settings_test_names, SUB1); + verify_string("added", "main.sub1.new"); + settings->set_str(settings, "main.%s%d.newsub.%s", "bar", "sub", 2, "foo"); + verify_string("bar", "main.sub2.newsub.foo"); +} +END_TEST + +START_TEST(test_set_default_str) +{ + settings->set_default_str(settings, "main.key1", "default"); + verify_string("val1", "main.key1"); + settings->set_default_str(settings, "main.sub1.new", "added"); + verify_string("added", "main.sub1.new"); + settings->set_str(settings, "main.sub1.new", "changed"); + verify_string("changed", "main.sub1.new"); +} +END_TEST + +START_SETUP(setup_bool_config) +{ + create_settings(chunk_from_str( + "main {\n" + " key1 = yes\n" + " key2 = true\n" + " key3 = Enabled\n" + " key4 = 1\n" + " key5 = no\n" + " key6 = FALSE\n" + " key7 = disabled\n" + " key8 = 0\n" + " key9 = 5\n" + " none = \n" + " foo = bar\n" + "}")); +} +END_SETUP + +#define verify_bool(expected, def, key, ...) \ + ck_assert(expected == settings->get_bool(settings, key, def, ##__VA_ARGS__)) + +START_TEST(test_get_bool) +{ + verify_bool(TRUE, FALSE, "main.key1"); + verify_bool(TRUE, FALSE, "main.key2"); + verify_bool(TRUE, FALSE, "main.key3"); + verify_bool(TRUE, FALSE, "main.key4"); + verify_bool(FALSE, TRUE, "main.key5"); + verify_bool(FALSE, TRUE, "main.key6"); + verify_bool(FALSE, TRUE, "main.key7"); + verify_bool(FALSE, TRUE, "main.key8"); + + verify_bool(FALSE, FALSE, "main.none"); + verify_bool(TRUE, TRUE, "main.none"); + verify_bool(FALSE, FALSE, "main.foo"); + verify_bool(TRUE, TRUE, "main.foo"); + + verify_bool(FALSE, FALSE, "main.key9"); + verify_bool(TRUE, TRUE, "main.key9"); + verify_bool(FALSE, FALSE, "main"); + verify_bool(TRUE, TRUE, "main"); + +} +END_TEST + +START_TEST(test_set_bool) +{ + settings->set_str(settings, "main.key1", "no"); + verify_bool(FALSE, TRUE, "main.key1"); + settings->set_bool(settings, "main.key2", FALSE); + verify_bool(FALSE, TRUE, "main.key2"); + settings->set_str(settings, "main.key3", NULL); + verify_bool(FALSE, FALSE, "main.key3"); + verify_bool(TRUE, TRUE, "main.key3"); + settings->set_bool(settings, "main.key5", TRUE); + verify_bool(TRUE, FALSE, "main.key5"); + settings->set_bool(settings, "main.new", TRUE); + verify_bool(TRUE, FALSE, "main.new"); +} +END_TEST + +START_SETUP(setup_int_config) +{ + create_settings(chunk_from_str( + "main {\n" + " key1 = 5\n" + " # gets cut off\n" + " key2 = 5.5\n" + " key3 = -42\n" + " none = \n" + " foo1 = bar\n" + " foo2 = bar13\n" + " foo3 = 13bar\n" + "}")); +} +END_SETUP + +#define verify_int(expected, def, key, ...) \ + ck_assert_int_eq(expected, settings->get_int(settings, key, def, ##__VA_ARGS__)) + +START_TEST(test_get_int) +{ + verify_int(5, 0, "main.key1"); + verify_int(5, 0, "main.key2"); + verify_int(-42, 0, "main.key3"); + + /* FIXME: do we want this behavior? */ + verify_int(0, 11, "main.none"); + verify_int(0, 11, "main.foo1"); + verify_int(0, 11, "main.foo2"); + verify_int(13, 11, "main.foo3"); + + verify_int(13, 13, "main.key4"); + verify_int(-13, -13, "main"); +} +END_TEST + +START_TEST(test_set_int) +{ + settings->set_str(settings, "main.key1", "13"); + verify_int(13, 0, "main.key1"); + settings->set_int(settings, "main.key2", 6); + verify_int(6, 0, "main.key2"); + settings->set_int(settings, "main.key3", -6); + verify_int(-6, 0, "main.key3"); + settings->set_str(settings, "main.key3", NULL); + verify_int(15, 15, "main.key3"); + settings->set_int(settings, "main.new", 314); + verify_int(314, 0, "main.new"); +} +END_TEST + +START_SETUP(setup_double_config) +{ + create_settings(chunk_from_str( + "main {\n" + " key1 = 5\n" + " key2 = 5.5\n" + " key3 = -42\n" + " key4 = -42.5\n" + " none = \n" + " foo1 = bar\n" + " foo2 = bar13.5\n" + " foo3 = 13.5bar\n" + "}")); +} +END_SETUP + +#define verify_double(expected, def, key, ...) \ + ck_assert(expected == settings->get_double(settings, key, def, ##__VA_ARGS__)) + +START_TEST(test_get_double) +{ + verify_double(5, 0, "main.key1"); + verify_double(5.5, 0, "main.key2"); + verify_double(-42, 0, "main.key3"); + verify_double(-42.5, 0, "main.key4"); + + /* FIXME: do we want this behavior? */ + verify_double(0, 11.5, "main.none"); + verify_double(0, 11.5, "main.foo1"); + verify_double(0, 11.5, "main.foo2"); + verify_double(13.5, 11.5, "main.foo3"); + + verify_double(11.5, 11.5, "main.key5"); + verify_double(-11.5, -11.5, "main"); +} +END_TEST + +START_TEST(test_set_double) +{ + settings->set_str(settings, "main.key1", "5.5"); + verify_double(5.5, 0, "main.key1"); + settings->set_double(settings, "main.key2", 13); + verify_double(13, 0, "main.key2"); + settings->set_double(settings, "main.key3", -13.5); + verify_double(-13.5, 0, "main.key3"); + settings->set_double(settings, "main.key4", 11.5); + verify_double(11.5, 0, "main.key4"); + settings->set_str(settings, "main.key4", NULL); + verify_double(42.5, 42.5, "main.key4"); + settings->set_double(settings, "main.new", 3.14); + verify_double(3.14, 0, "main.new"); +} +END_TEST + +START_SETUP(setup_time_config) +{ + create_settings(chunk_from_str( + "main {\n" + " key1 = 5s\n" + " key2 = 5m\n" + " key3 = 5h\n" + " key4 = 5d\n" + " none = \n" + " foo1 = bar\n" + " foo2 = bar13\n" + " foo3 = 13bar\n" + "}")); +} +END_SETUP + +#define verify_time(expected, def, key, ...) \ + ck_assert_int_eq(expected, settings->get_time(settings, key, def, ##__VA_ARGS__)) + +START_TEST(test_get_time) +{ + verify_time(5, 0, "main.key1"); + verify_time(300, 0, "main.key2"); + verify_time(18000, 0, "main.key3"); + verify_time(432000, 0, "main.key4"); + + /* FIXME: do we want this behavior? */ + verify_time(0, 11, "main.none"); + verify_time(0, 11, "main.foo1"); + verify_time(0, 11, "main.foo2"); + verify_time(13, 11, "main.foo3"); + + verify_time(11, 11, "main.key5"); + verify_time(11, 11, "main"); +} +END_TEST + +START_TEST(test_set_time) +{ + settings->set_str(settings, "main.key1", "15m"); + verify_time(900, 0, "main.key1"); + settings->set_time(settings, "main.key2", 15); + verify_time(15, 0, "main.key2"); + settings->set_str(settings, "main.key3", NULL); + verify_time(300, 300, "main.key3"); + settings->set_time(settings, "main.new", 314); + verify_time(314, 0, "main.new"); +} +END_TEST + +static bool verify_section(linked_list_t *verifier, char *section) +{ + enumerator_t *enumerator; + char *current; + bool result = FALSE; + + enumerator = verifier->create_enumerator(verifier); + while (enumerator->enumerate(enumerator, ¤t)) + { + if (streq(current, section)) + { + verifier->remove_at(verifier, enumerator); + result = TRUE; + break; + } + } + enumerator->destroy(enumerator); + return result; +} + +static void verify_sections(linked_list_t *verifier, char *parent) +{ + enumerator_t *enumerator; + char *section; + + enumerator = settings->create_section_enumerator(settings, parent); + while (enumerator->enumerate(enumerator, §ion)) + { + ck_assert(verify_section(verifier, section)); + } + enumerator->destroy(enumerator); + ck_assert_int_eq(0, verifier->get_count(verifier)); + verifier->destroy(verifier); +} + +START_TEST(test_section_enumerator) +{ + linked_list_t *verifier; + + verifier = linked_list_create_with_items("sub1", "sub%", NULL); + verify_sections(verifier, "main"); + + settings->set_str(settings, "main.sub2.new", "added"); + verifier = linked_list_create_with_items("sub1", "sub%", "sub2", NULL); + verify_sections(verifier, "main"); + + verifier = linked_list_create_with_items("subsub", NULL); + verify_sections(verifier, "main.sub1"); + + verifier = linked_list_create_with_items(NULL); + verify_sections(verifier, "main.sub%%"); + + verifier = linked_list_create_with_items(NULL); + verify_sections(verifier, "main.key1"); + + verifier = linked_list_create_with_items(NULL); + verify_sections(verifier, "main.unknown"); +} +END_TEST + +static bool verify_key_value(linked_list_t *keys, linked_list_t *values, + char *key, char *value) +{ + enumerator_t *enum_keys, *enum_values; + char *current_key, *current_value; + bool result = FALSE; + + enum_keys = keys->create_enumerator(keys); + enum_values = values->create_enumerator(values); + while (enum_keys->enumerate(enum_keys, ¤t_key) && + enum_values->enumerate(enum_values, ¤t_value)) + { + if (streq(current_key, key)) + { + ck_assert_str_eq(current_value, value); + keys->remove_at(keys, enum_keys); + values->remove_at(values, enum_values); + result = TRUE; + break; + } + } + enum_keys->destroy(enum_keys); + enum_values->destroy(enum_values); + return result; +} + +static void verify_key_values(linked_list_t *keys, linked_list_t *values, + char *parent) +{ + enumerator_t *enumerator; + char *key, *value; + + enumerator = settings->create_key_value_enumerator(settings, parent); + while (enumerator->enumerate(enumerator, &key, &value)) + { + ck_assert(verify_key_value(keys, values, key, value)); + } + enumerator->destroy(enumerator); + ck_assert_int_eq(0, keys->get_count(keys)); + keys->destroy(keys); + values->destroy(values); +} + +START_TEST(test_key_value_enumerator) +{ + linked_list_t *keys, *values; + + keys = linked_list_create_with_items("key1", "key2", "none", NULL); + values = linked_list_create_with_items("val1", "with spaces", "", NULL); + verify_key_values(keys, values, "main"); + + keys = linked_list_create_with_items("key", "key2", "subsub", NULL); + values = linked_list_create_with_items("value", "value2", "section value", NULL); + verify_key_values(keys, values, "main.sub1"); + + settings->set_str(settings, "main.sub2.new", "added"); + keys = linked_list_create_with_items("new", NULL); + values = linked_list_create_with_items("added", NULL); + verify_key_values(keys, values, "main.sub2"); + + keys = linked_list_create_with_items(NULL); + values = linked_list_create_with_items(NULL); + verify_key_values(keys, values, "other.empty"); + + settings->set_str(settings, "other.empty.new", "added"); + keys = linked_list_create_with_items("new", NULL); + values = linked_list_create_with_items("added", NULL); + verify_key_values(keys, values, "other.empty"); + + keys = linked_list_create_with_items(NULL); + values = linked_list_create_with_items(NULL); + verify_key_values(keys, values, "main.unknown"); +} +END_TEST + +#define include1 "/tmp/strongswan-settings-test-include1" +#define include2 "/tmp/strongswan-settings-test-include2" + +START_SETUP(setup_include_config) +{ + chunk_t inc1 = chunk_from_str( + "main {\n" + " key1 = n1\n" + " key2 = n2\n" + " none = \n" + " sub1 {\n" + " key3 = value\n" + " }\n" + " sub2 {\n" + " sub3 = val3\n" + " }\n" + " include " include2 "\n" + "}"); + chunk_t inc2 = chunk_from_str( + "key2 = v2\n" + "sub1 {\n" + " key = val\n" + "}"); + ck_assert(chunk_write(inc1, include1, 0022, TRUE)); + ck_assert(chunk_write(inc2, include2, 0022, TRUE)); +} +END_SETUP + +START_TEARDOWN(teardown_include_config) +{ + settings->destroy(settings); + unlink(include2); + unlink(include1); + unlink(path); +} +END_TEARDOWN + +static void verify_include() +{ + verify_string("n1", "main.key1"); + verify_string("v2", "main.key2"); + verify_string("", "main.none"); + verify_string("val", "main.sub1.key"); + verify_string("v2", "main.sub1.key2"); + verify_string("val", "main.sub1.sub1.key"); + verify_string("value", "main.sub1.key3"); + verify_string("value", "main.sub1.include"); + verify_string("val3", "main.sub2.sub3"); +} + +START_TEST(test_include) +{ + chunk_t contents = chunk_from_str( + "main {\n" + " key1 = val1\n" + " key2 = val2\n" + " none = x\n" + " sub1 {\n" + " include = value\n" + " key2 = value2\n" + " include " include2 "\n" + " }\n" + "}\n" + "# currently there must be a newline after include statements\n" + "include " include1 "\n"); + + create_settings(contents); + verify_include(); +} +END_TEST + +START_TEST(test_load_files) +{ + chunk_t contents = chunk_from_str( + "main {\n" + " key1 = val1\n" + " key2 = val2\n" + " none = x\n" + " sub1 {\n" + " include = value\n" + " key2 = v2\n" + " sub1 {\n" + " key = val\n" + " }\n" + " }\n" + "}"); + + create_settings(contents); + + ck_assert(settings->load_files(settings, include1, TRUE)); + verify_include(); + + ck_assert(settings->load_files(settings, include2, FALSE)); + verify_null("main.key1"); + verify_string("v2", "key2"); + verify_string("val", "sub1.key"); + verify_null("main.sub1.key3"); +} +END_TEST + +START_TEST(test_load_files_section) +{ + chunk_t contents = chunk_from_str( + "main {\n" + " key1 = val1\n" + " key2 = val2\n" + " none = x\n" + " sub1 {\n" + " include = value\n" + " key2 = value2\n" + " }\n" + "}"); + + create_settings(contents); + + ck_assert(settings->load_files_section(settings, include1, TRUE, "")); + ck_assert(settings->load_files_section(settings, include2, TRUE, "main.sub1")); + verify_include(); + + /* non existing files are no failure */ + ck_assert(settings->load_files_section(settings, include1".conf", TRUE, "")); + verify_include(); + + /* unreadable files are */ + ck_assert(chunk_write(contents, include1".no", 0444, TRUE)); + ck_assert(!settings->load_files_section(settings, include1".no", TRUE, "")); + unlink(include1".no"); + verify_include(); + + ck_assert(settings->load_files_section(settings, include2, FALSE, "main")); + verify_null("main.key1"); + verify_string("v2", "main.key2"); + verify_string("val", "main.sub1.key"); + verify_null("main.sub1.key3"); + verify_null("main.sub2.sub3"); + + ck_assert(settings->load_files_section(settings, include2, TRUE, "main.sub2")); + verify_string("v2", "main.sub2.key2"); + verify_string("val", "main.sub2.sub1.key"); +} +END_TEST + +START_SETUP(setup_fallback_config) +{ + create_settings(chunk_from_str( + "main {\n" + " key1 = val1\n" + " sub1 {\n" + " key1 = val1\n" + " }\n" + "}\n" + "sub {\n" + " key1 = subval1\n" + " key2 = subval2\n" + " subsub {\n" + " subkey1 = subsubval1\n" + " }\n" + "}\n" + "base {\n" + " key1 = baseval1\n" + " key2 = baseval2\n" + " sub1 {\n" + " key1 = subbase1\n" + " key2 = subbase2\n" + " key3 = subbase3\n" + " subsub {\n" + " subkey1 = subsubbaseval1\n" + " subkey2 = subsubbaseval2\n" + " }\n" + " }\n" + " sub2 {\n" + " key4 = subbase4\n" + " }\n" + "}")); +} +END_SETUP + +START_TEST(test_add_fallback) +{ + linked_list_t *keys, *values; + + settings->add_fallback(settings, "main.sub1", "sub"); + verify_string("val1", "main.sub1.key1"); + verify_string("subval2", "main.sub1.key2"); + verify_string("subsubval1", "main.sub1.subsub.subkey1"); + + /* fallbacks are preserved even if the complete config is replaced */ + settings->load_files(settings, path, FALSE); + verify_string("val1", "main.sub1.key1"); + verify_string("subval2", "main.sub1.key2"); + verify_string("subsubval1", "main.sub1.subsub.subkey1"); + + keys = linked_list_create_with_items("sub1", NULL); + verify_sections(keys, "main"); + keys = linked_list_create_with_items("subsub", NULL); + verify_sections(keys, "main.sub1"); + + keys = linked_list_create_with_items("key1", NULL); + values = linked_list_create_with_items("val1", NULL); + verify_key_values(keys, values, "main"); + + keys = linked_list_create_with_items("key1", "key2", NULL); + values = linked_list_create_with_items("val1", "subval2", NULL); + verify_key_values(keys, values, "main.sub1"); + + keys = linked_list_create_with_items("subkey1", NULL); + values = linked_list_create_with_items("subsubval1", NULL); + verify_key_values(keys, values, "main.sub1.subsub"); + + settings->add_fallback(settings, "main", "base"); + verify_string("val1", "main.key1"); + verify_string("baseval2", "main.key2"); + verify_string("val1", "main.sub1.key1"); + verify_string("subval2", "main.sub1.key2"); + verify_string("subsubval1", "main.sub1.subsub.subkey1"); + verify_string("subsubbaseval2", "main.sub1.subsub.subkey2"); + verify_string("subbase3", "main.sub1.key3"); + verify_string("subbase4", "main.sub2.key4"); + + + keys = linked_list_create_with_items("sub1", "sub2", NULL); + verify_sections(keys, "main"); + keys = linked_list_create_with_items("subsub", NULL); + verify_sections(keys, "main.sub1"); + + keys = linked_list_create_with_items("key1", "key2", NULL); + values = linked_list_create_with_items("val1", "baseval2", NULL); + verify_key_values(keys, values, "main"); + + keys = linked_list_create_with_items("key1", "key2", "key3", NULL); + values = linked_list_create_with_items("val1", "subval2", "subbase3", NULL); + verify_key_values(keys, values, "main.sub1"); + + keys = linked_list_create_with_items("subkey1", "subkey2", NULL); + values = linked_list_create_with_items("subsubval1", "subsubbaseval2", NULL); + verify_key_values(keys, values, "main.sub1.subsub"); + + settings->set_str(settings, "main.sub1.key2", "val2"); + verify_string("val2", "main.sub1.key2"); + settings->set_str(settings, "main.sub1.subsub.subkey2", "val2"); + verify_string("val2", "main.sub1.subsub.subkey2"); + verify_string("subsubval1", "main.sub1.subsub.subkey1"); +} +END_TEST + +START_TEST(test_add_fallback_printf) +{ + settings->add_fallback(settings, "%s.sub1", "sub", "main"); + verify_string("val1", "main.sub1.key1"); + verify_string("subval2", "main.sub1.key2"); + verify_string("subsubval1", "main.sub1.subsub.subkey1"); + + settings->add_fallback(settings, "%s.%s2", "%s.%s1", "main", "sub"); + verify_string("val1", "main.sub2.key1"); + verify_string("subval2", "main.sub2.key2"); + verify_string("subsubval1", "main.sub2.subsub.subkey1"); +} +END_TEST + +START_SETUP(setup_invalid_config) +{ + create_settings(chunk_from_str( + "# section without name\n" + "{\n" + " key1 = val1\n" + "}\n" + "main {\n" + " key2 = val2\n" + " # value without key\n" + " = val3\n" + " key4 = val4\n" + " # key without value does not change it\n" + " key4\n" + " # subsection without name\n" + " {\n" + " key5 = val5\n" + " }\n" + " # empty include pattern\n" + " include\n" + " key6 = val6\n" + "}")); +} +END_SETUP + +START_TEST(test_invalid) +{ + linked_list_t *keys, *values; + chunk_t contents; + + verify_null("key1"); + verify_null(".key1"); + verify_null("%s.key1", ""); + verify_string("val2", "main.key2"); + verify_string("val4", "main.key4"); + verify_null("main..key5"); + verify_string("val6", "main.key6"); + + keys = linked_list_create_with_items("main", NULL); + verify_sections(keys, ""); + + keys = linked_list_create_with_items(NULL); + verify_sections(keys, "main"); + + keys = linked_list_create_with_items("key2", "key4", "key6", NULL); + values = linked_list_create_with_items("val2", "val4", "val6", NULL); + verify_key_values(keys, values, "main"); + + /* FIXME: we should probably fix this */ + contents = chunk_from_str( + "requires = newline"); + ck_assert(chunk_write(contents, path, 0022, TRUE)); + ck_assert(!settings->load_files(settings, path, FALSE)); + + contents = chunk_from_str( + "unterminated {\n" + " not = valid\n"); + ck_assert(chunk_write(contents, path, 0022, TRUE)); + ck_assert(!settings->load_files(settings, path, FALSE)); + + contents = chunk_from_str( + "singleline { not = valid }\n"); + ck_assert(chunk_write(contents, path, 0022, TRUE)); + ck_assert(!settings->load_files(settings, path, FALSE)); +} +END_TEST + +Suite *settings_suite_create() +{ + Suite *s; + TCase *tc; + + s = suite_create("settings"); + + tc = tcase_create("get/set_str (basic behavior)"); + tcase_add_checked_fixture(tc, setup_base_config, teardown_config); + tcase_add_test(tc, test_get_str); + tcase_add_test(tc, test_get_str_printf); + tcase_add_test(tc, test_set_str); + tcase_add_test(tc, test_set_str_printf); + tcase_add_test(tc, test_set_default_str); + suite_add_tcase(s, tc); + + tc = tcase_create("get/set_bool"); + tcase_add_checked_fixture(tc, setup_bool_config, teardown_config); + tcase_add_test(tc, test_get_bool); + tcase_add_test(tc, test_set_bool); + suite_add_tcase(s, tc); + + tc = tcase_create("get/set_int"); + tcase_add_checked_fixture(tc, setup_int_config, teardown_config); + tcase_add_test(tc, test_get_int); + tcase_add_test(tc, test_set_int); + suite_add_tcase(s, tc); + + tc = tcase_create("get/set_double"); + tcase_add_checked_fixture(tc, setup_double_config, teardown_config); + tcase_add_test(tc, test_get_double); + tcase_add_test(tc, test_set_double); + suite_add_tcase(s, tc); + + tc = tcase_create("get/set_time"); + tcase_add_checked_fixture(tc, setup_time_config, teardown_config); + tcase_add_test(tc, test_get_time); + tcase_add_test(tc, test_set_time); + suite_add_tcase(s, tc); + + tc = tcase_create("section enumerator"); + tcase_add_checked_fixture(tc, setup_base_config, teardown_config); + tcase_add_test(tc, test_section_enumerator); + suite_add_tcase(s, tc); + + tc = tcase_create("key/value enumerator"); + tcase_add_checked_fixture(tc, setup_base_config, teardown_config); + tcase_add_test(tc, test_key_value_enumerator); + suite_add_tcase(s, tc); + + tc = tcase_create("include/load_files[_section]"); + tcase_add_checked_fixture(tc, setup_include_config, teardown_include_config); + tcase_add_test(tc, test_include); + tcase_add_test(tc, test_load_files); + tcase_add_test(tc, test_load_files_section); + suite_add_tcase(s, tc); + + tc = tcase_create("fallback"); + tcase_add_checked_fixture(tc, setup_fallback_config, teardown_config); + tcase_add_test(tc, test_add_fallback); + tcase_add_test(tc, test_add_fallback_printf); + suite_add_tcase(s, tc); + + tc = tcase_create("invalid data"); + tcase_add_checked_fixture(tc, setup_invalid_config, teardown_config); + tcase_add_test(tc, test_invalid); + suite_add_tcase(s, tc); + + return s; +} diff --git a/src/libstrongswan/tests/test_runner.c b/src/libstrongswan/tests/test_runner.c index 1e46cfe8e..0b26ee128 100644 --- a/src/libstrongswan/tests/test_runner.c +++ b/src/libstrongswan/tests/test_runner.c @@ -65,7 +65,7 @@ static array_t *load_suites(test_configuration_t configs[], bool old = FALSE; int i; - library_init(NULL); + library_init(NULL, "test-runner"); test_setup_handler(); @@ -178,7 +178,7 @@ static bool call_fixture(test_case_t *tcase, bool up) */ static bool pre_test(test_runner_init_t init) { - library_init(NULL); + library_init(NULL, "test-runner"); /* use non-blocking RNG to generate keys fast */ lib->settings->set_default_str(lib->settings, diff --git a/src/libstrongswan/tests/tests.h b/src/libstrongswan/tests/tests.h index 0a51a3e59..82a5137c1 100644 --- a/src/libstrongswan/tests/tests.h +++ b/src/libstrongswan/tests/tests.h @@ -27,6 +27,7 @@ TEST_SUITE(threading_suite_create) TEST_SUITE(watcher_suite_create) TEST_SUITE(stream_suite_create) TEST_SUITE(utils_suite_create) +TEST_SUITE(settings_suite_create) TEST_SUITE(vectors_suite_create) TEST_SUITE_DEPEND(ecdsa_suite_create, PRIVKEY_GEN, KEY_ECDSA) TEST_SUITE_DEPEND(rsa_suite_create, PRIVKEY_GEN, KEY_RSA) diff --git a/src/libstrongswan/utils/leak_detective.c b/src/libstrongswan/utils/leak_detective.c index ff80bbc89..6f5a2c87a 100644 --- a/src/libstrongswan/utils/leak_detective.c +++ b/src/libstrongswan/utils/leak_detective.c @@ -754,11 +754,11 @@ METHOD(leak_detective_t, usage, void, size_t sum = 0; thresh = lib->settings->get_int(lib->settings, - "libstrongswan.leak_detective.usage_threshold", 10240); + "%s.leak_detective.usage_threshold", 10240, lib->ns); thresh_count = lib->settings->get_int(lib->settings, - "libstrongswan.leak_detective.usage_threshold_count", 0); + "%s.leak_detective.usage_threshold_count", 0, lib->ns); detailed = lib->settings->get_bool(lib->settings, - "libstrongswan.leak_detective.detailed", TRUE); + "%s.leak_detective.detailed", TRUE, lib->ns); leaks = print_traces(this, cb, user, thresh, thresh_count, detailed, &whitelisted, &sum); diff --git a/src/libstrongswan/utils/settings.c b/src/libstrongswan/utils/settings.c index 809ca10ab..a2c892211 100644 --- a/src/libstrongswan/utils/settings.c +++ b/src/libstrongswan/utils/settings.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2010 Tobias Brunner + * Copyright (C) 2010-2014 Tobias Brunner * Copyright (C) 2008 Martin Willi * Hochschule fuer Technik Rapperswil * @@ -31,6 +31,8 @@ #include "settings.h" +#include "collections/array.h" +#include "collections/hashtable.h" #include "collections/linked_list.h" #include "threading/rwlock.h" #include "utils/debug.h" @@ -77,15 +79,20 @@ struct section_t { */ char *name; + /** + * fallback sections, as section_t + */ + array_t *fallbacks; + /** * subsections, as section_t */ - linked_list_t *sections; + array_t *sections; /** * key value pairs, as kv_t */ - linked_list_t *kv; + array_t *kv; }; /** @@ -134,8 +141,6 @@ static section_t *section_create(char *name) section_t *this; INIT(this, .name = strdupnull(name), - .sections = linked_list_create(), - .kv = linked_list_create(), ); return this; } @@ -145,37 +150,73 @@ static section_t *section_create(char *name) */ static void section_destroy(section_t *this) { - this->kv->destroy_function(this->kv, (void*)kv_destroy); - this->sections->destroy_function(this->sections, (void*)section_destroy); + array_destroy_function(this->sections, (void*)section_destroy, NULL); + array_destroy_function(this->kv, (void*)kv_destroy, NULL); + array_destroy(this->fallbacks); free(this->name); free(this); } /** - * Purge contents of a section + * Purge contents of a section, returns if section can be safely removed. */ -static void section_purge(section_t *this) +static bool section_purge(section_t *this) { - this->kv->destroy_function(this->kv, (void*)kv_destroy); - this->kv = linked_list_create(); - this->sections->destroy_function(this->sections, (void*)section_destroy); - this->sections = linked_list_create(); + section_t *current; + int i; + + array_destroy_function(this->kv, (void*)kv_destroy, NULL); + this->kv = NULL; + /* we ensure sections used as fallback, or configured with fallbacks (or + * having any such subsections) are not removed */ + for (i = array_count(this->sections) - 1; i >= 0; i--) + { + array_get(this->sections, i, ¤t); + if (section_purge(current)) + { + array_remove(this->sections, i, NULL); + section_destroy(current); + } + } + return !this->fallbacks && !array_count(this->sections); } /** * callback to find a section by name */ -static bool section_find(section_t *this, char *name) +static int section_find(const void *a, const void *b) { - return streq(this->name, name); + const char *key = a; + const section_t *item = b; + return strcmp(key, item->name); +} + +/** + * callback to sort sections by name + */ +static int section_sort(const void *a, const void *b, void *user) +{ + const section_t *sa = a, *sb = b; + return strcmp(sa->name, sb->name); } /** * callback to find a kv pair by key */ -static bool kv_find(kv_t *this, char *key) +static int kv_find(const void *a, const void *b) { - return streq(this->key, key); + const char *key = a; + const kv_t *item = b; + return strcmp(key, item->key); +} + +/** + * callback to sort kv pairs by key + */ +static int kv_sort(const void *a, const void *b, void *user) +{ + const kv_t *kva = a, *kvb = b; + return strcmp(kva->key, kvb->key); } /** @@ -184,17 +225,16 @@ static bool kv_find(kv_t *this, char *key) static bool print_key(char *buf, int len, char *start, char *key, va_list args) { va_list copy; + char *pos = start; bool res; - char *pos; va_copy(copy, args); - while (start < key) + while (TRUE) { - pos = strchr(start, '%'); + pos = memchr(pos, '%', key - pos); if (!pos) { - start += strlen(start) + 1; - continue; + break; } pos++; switch (*pos) @@ -215,11 +255,7 @@ static bool print_key(char *buf, int len, char *start, char *key, va_list args) DBG1(DBG_CFG, "settings with %%%c not supported!", *pos); break; } - start = pos; - if (*start) - { - start++; - } + pos++; } res = vsnprintf(buf, len, key, copy) < len; va_end(copy); @@ -251,14 +287,17 @@ static section_t *find_section_buffered(section_t *section, { return NULL; } - if (section->sections->find_first(section->sections, - (linked_list_match_t)section_find, - (void**)&found, buf) != SUCCESS) + if (!strlen(buf)) + { + found = section; + } + else if (array_bsearch(section->sections, buf, section_find, &found) == -1) { if (ensure) { found = section_create(buf); - section->sections->insert_last(section->sections, found); + array_insert_create(§ion->sections, ARRAY_TAIL, found); + array_sort(section->sections, section_sort, NULL); } } if (found && pos) @@ -269,30 +308,74 @@ static section_t *find_section_buffered(section_t *section, } /** - * Find a section by a given key (thread-safe). + * Find all sections via a given key considering fallbacks, using buffered key, + * reusable buffer. */ -static section_t *find_section(private_settings_t *this, section_t *section, - char *key, va_list args) +static void find_sections_buffered(section_t *section, char *start, char *key, + va_list args, char *buf, int len, array_t **sections) { - char buf[128], keybuf[512]; - section_t *found; + section_t *found = NULL, *fallback; + char *pos; + int i; - if (snprintf(keybuf, sizeof(keybuf), "%s", key) >= sizeof(keybuf)) + if (!section) { - return NULL; + return; + } + pos = strchr(key, '.'); + if (pos) + { + *pos = '\0'; + } + if (!print_key(buf, len, start, key, args)) + { + return; + } + if (pos) + { /* restore so we can follow fallbacks */ + *pos = '.'; + } + if (!strlen(buf)) + { + found = section; + } + else + { + array_bsearch(section->sections, buf, section_find, &found); + } + if (found) + { + if (pos) + { + find_sections_buffered(found, start, pos+1, args, buf, len, + sections); + } + else + { + array_insert_create(sections, ARRAY_TAIL, found); + for (i = 0; i < array_count(found->fallbacks); i++) + { + array_get(found->fallbacks, i, &fallback); + array_insert_create(sections, ARRAY_TAIL, fallback); + } + } + } + if (section->fallbacks) + { + for (i = 0; i < array_count(section->fallbacks); i++) + { + array_get(section->fallbacks, i, &fallback); + find_sections_buffered(fallback, start, key, args, buf, len, + sections); + } } - this->lock->read_lock(this->lock); - found = find_section_buffered(section, keybuf, keybuf, args, buf, - sizeof(buf), FALSE); - this->lock->unlock(this->lock); - return found; } /** * Ensure that the section with the given key exists (thread-safe). */ static section_t *ensure_section(private_settings_t *this, section_t *section, - char *key, va_list args) + const char *key, va_list args) { char buf[128], keybuf[512]; section_t *found; @@ -309,14 +392,93 @@ static section_t *ensure_section(private_settings_t *this, section_t *section, return found; } +/** + * Find a section by a given key with its fallbacks (not thread-safe!). + * Sections are returned in depth-first order (array is allocated). NULL is + * returned if no sections are found. + */ +static array_t *find_sections(private_settings_t *this, section_t *section, + char *key, va_list args) +{ + char buf[128], keybuf[512]; + array_t *sections = NULL; + + if (snprintf(keybuf, sizeof(keybuf), "%s", key) >= sizeof(keybuf)) + { + return NULL; + } + find_sections_buffered(section, keybuf, keybuf, args, buf, + sizeof(buf), §ions); + return sections; +} + +/** + * Check if the given fallback section already exists + */ +static bool fallback_exists(section_t *section, section_t *fallback) +{ + if (section == fallback) + { + return TRUE; + } + else if (section->fallbacks) + { + section_t *existing; + int i; + + for (i = 0; i < array_count(section->fallbacks); i++) + { + array_get(section->fallbacks, i, &existing); + if (existing == fallback) + { + return TRUE; + } + } + } + return FALSE; +} + +/** + * Ensure that the section with the given key exists and add the given fallback + * section (thread-safe). + */ +static void add_fallback_to_section(private_settings_t *this, + section_t *section, const char *key, va_list args, + section_t *fallback) +{ + char buf[128], keybuf[512]; + section_t *found; + + if (snprintf(keybuf, sizeof(keybuf), "%s", key) >= sizeof(keybuf)) + { + return; + } + this->lock->write_lock(this->lock); + found = find_section_buffered(section, keybuf, keybuf, args, buf, + sizeof(buf), TRUE); + if (!fallback_exists(found, fallback)) + { + /* to ensure sections referred to as fallback are not purged, we create + * the array there too */ + if (!fallback->fallbacks) + { + fallback->fallbacks = array_create(0, 0); + } + array_insert_create(&found->fallbacks, ARRAY_TAIL, fallback); + } + this->lock->unlock(this->lock); +} + /** * Find the key/value pair for a key, using buffered key, reusable buffer * If "ensure" is TRUE, the sections (and key/value pair) are created if they * don't exist. + * Fallbacks are only considered if "ensure" is FALSE. */ static kv_t *find_value_buffered(section_t *section, char *start, char *key, va_list args, char *buf, int len, bool ensure) { + int i; char *pos; kv_t *kv = NULL; section_t *found = NULL; @@ -330,25 +492,40 @@ static kv_t *find_value_buffered(section_t *section, char *start, char *key, if (pos) { *pos = '\0'; - pos++; - if (!print_key(buf, len, start, key, args)) { return NULL; } - if (section->sections->find_first(section->sections, - (linked_list_match_t)section_find, - (void**)&found, buf) != SUCCESS) + /* restore so we can retry for fallbacks */ + *pos = '.'; + if (!strlen(buf)) { - if (!ensure) + found = section; + } + else if (array_bsearch(section->sections, buf, section_find, + &found) == -1) + { + if (ensure) { - return NULL; + found = section_create(buf); + array_insert_create(§ion->sections, ARRAY_TAIL, found); + array_sort(section->sections, section_sort, NULL); } - found = section_create(buf); - section->sections->insert_last(section->sections, found); + } + if (found) + { + kv = find_value_buffered(found, start, pos+1, args, buf, len, + ensure); + } + if (!kv && !ensure && section->fallbacks) + { + for (i = 0; !kv && i < array_count(section->fallbacks); i++) + { + array_get(section->fallbacks, i, &found); + kv = find_value_buffered(found, start, key, args, buf, len, + ensure); + } } - return find_value_buffered(found, start, pos, args, buf, len, - ensure); } else { @@ -356,13 +533,22 @@ static kv_t *find_value_buffered(section_t *section, char *start, char *key, { return NULL; } - if (section->kv->find_first(section->kv, (linked_list_match_t)kv_find, - (void**)&kv, buf) != SUCCESS) + if (array_bsearch(section->kv, buf, kv_find, &kv) == -1) { if (ensure) { kv = kv_create(buf, NULL); - section->kv->insert_last(section->kv, kv); + array_insert_create(§ion->kv, ARRAY_TAIL, kv); + array_sort(section->kv, kv_sort, NULL); + } + else if (section->fallbacks) + { + for (i = 0; !kv && i < array_count(section->fallbacks); i++) + { + array_get(section->fallbacks, i, &found); + kv = find_value_buffered(found, start, key, args, buf, len, + ensure); + } } } } @@ -429,7 +615,7 @@ static void set_value(private_settings_t *this, section_t *section, } METHOD(settings_t, get_str, char*, - private_settings_t *this, char *key, char *def, ...) + private_settings_t *this, char *key, char *def, ...) { char *value; va_list args; @@ -470,7 +656,7 @@ inline bool settings_value_as_bool(char *value, bool def) } METHOD(settings_t, get_bool, bool, - private_settings_t *this, char *key, bool def, ...) + private_settings_t *this, char *key, bool def, ...) { char *value; va_list args; @@ -500,7 +686,7 @@ inline int settings_value_as_int(char *value, int def) } METHOD(settings_t, get_int, int, - private_settings_t *this, char *key, int def, ...) + private_settings_t *this, char *key, int def, ...) { char *value; va_list args; @@ -530,7 +716,7 @@ inline double settings_value_as_double(char *value, double def) } METHOD(settings_t, get_double, double, - private_settings_t *this, char *key, double def, ...) + private_settings_t *this, char *key, double def, ...) { char *value; va_list args; @@ -576,7 +762,7 @@ inline u_int32_t settings_value_as_time(char *value, u_int32_t def) } METHOD(settings_t, get_time, u_int32_t, - private_settings_t *this, char *key, u_int32_t def, ...) + private_settings_t *this, char *key, u_int32_t def, ...) { char *value; va_list args; @@ -588,7 +774,7 @@ METHOD(settings_t, get_time, u_int32_t, } METHOD(settings_t, set_str, void, - private_settings_t *this, char *key, char *value, ...) + private_settings_t *this, char *key, char *value, ...) { va_list args; va_start(args, value); @@ -597,7 +783,7 @@ METHOD(settings_t, set_str, void, } METHOD(settings_t, set_bool, void, - private_settings_t *this, char *key, bool value, ...) + private_settings_t *this, char *key, bool value, ...) { va_list args; va_start(args, value); @@ -606,7 +792,7 @@ METHOD(settings_t, set_bool, void, } METHOD(settings_t, set_int, void, - private_settings_t *this, char *key, int value, ...) + private_settings_t *this, char *key, int value, ...) { char val[16]; va_list args; @@ -619,7 +805,7 @@ METHOD(settings_t, set_int, void, } METHOD(settings_t, set_double, void, - private_settings_t *this, char *key, double value, ...) + private_settings_t *this, char *key, double value, ...) { char val[64]; va_list args; @@ -632,7 +818,7 @@ METHOD(settings_t, set_double, void, } METHOD(settings_t, set_time, void, - private_settings_t *this, char *key, u_int32_t value, ...) + private_settings_t *this, char *key, u_int32_t value, ...) { char val[16]; va_list args; @@ -645,7 +831,7 @@ METHOD(settings_t, set_time, void, } METHOD(settings_t, set_default_str, bool, - private_settings_t *this, char *key, char *value, ...) + private_settings_t *this, char *key, char *value, ...) { char *old; va_list args; @@ -664,64 +850,144 @@ METHOD(settings_t, set_default_str, bool, return FALSE; } +/** + * Data for enumerators + */ +typedef struct { + /** settings_t instance */ + private_settings_t *settings; + /** sections to enumerate */ + array_t *sections; + /** sections/keys that were already enumerated */ + hashtable_t *seen; +} enumerator_data_t; + +/** + * Destroy enumerator data + */ +static void enumerator_destroy(enumerator_data_t *this) +{ + this->settings->lock->unlock(this->settings->lock); + this->seen->destroy(this->seen); + array_destroy(this->sections); + free(this); +} + /** * Enumerate section names, not sections */ -static bool section_filter(void *null, section_t **in, char **out) +static bool section_filter(hashtable_t *seen, section_t **in, char **out) { *out = (*in)->name; + if (seen->get(seen, *out)) + { + return FALSE; + } + seen->put(seen, *out, *out); return TRUE; } -METHOD(settings_t, create_section_enumerator, enumerator_t*, - private_settings_t *this, char *key, ...) +/** + * Enumerate sections of the given section + */ +static enumerator_t *section_enumerator(section_t *section, + enumerator_data_t *data) { - section_t *section; + return enumerator_create_filter(array_create_enumerator(section->sections), + (void*)section_filter, data->seen, NULL); +} + +METHOD(settings_t, create_section_enumerator, enumerator_t*, + private_settings_t *this, char *key, ...) +{ + enumerator_data_t *data; + array_t *sections; va_list args; + this->lock->read_lock(this->lock); va_start(args, key); - section = find_section(this, this->top, key, args); + sections = find_sections(this, this->top, key, args); va_end(args); - if (!section) + if (!sections) { + this->lock->unlock(this->lock); return enumerator_create_empty(); } - this->lock->read_lock(this->lock); - return enumerator_create_filter( - section->sections->create_enumerator(section->sections), - (void*)section_filter, this->lock, (void*)this->lock->unlock); + INIT(data, + .settings = this, + .sections = sections, + .seen = hashtable_create(hashtable_hash_str, hashtable_equals_str, 8), + ); + return enumerator_create_nested(array_create_enumerator(sections), + (void*)section_enumerator, data, (void*)enumerator_destroy); } /** * Enumerate key and values, not kv_t entries */ -static bool kv_filter(void *null, kv_t **in, char **key, +static bool kv_filter(hashtable_t *seen, kv_t **in, char **key, void *none, char **value) { *key = (*in)->key; + if (seen->get(seen, *key)) + { + return FALSE; + } *value = (*in)->value; + seen->put(seen, *key, *key); return TRUE; } +/** + * Enumerate key/value pairs of the given section + */ +static enumerator_t *kv_enumerator(section_t *section, enumerator_data_t *data) +{ + return enumerator_create_filter(array_create_enumerator(section->kv), + (void*)kv_filter, data->seen, NULL); +} + METHOD(settings_t, create_key_value_enumerator, enumerator_t*, - private_settings_t *this, char *key, ...) + private_settings_t *this, char *key, ...) +{ + enumerator_data_t *data; + array_t *sections; + va_list args; + + this->lock->read_lock(this->lock); + va_start(args, key); + sections = find_sections(this, this->top, key, args); + va_end(args); + + if (!sections) + { + this->lock->unlock(this->lock); + return enumerator_create_empty(); + } + INIT(data, + .settings = this, + .sections = sections, + .seen = hashtable_create(hashtable_hash_str, hashtable_equals_str, 8), + ); + return enumerator_create_nested(array_create_enumerator(sections), + (void*)kv_enumerator, data, (void*)enumerator_destroy); +} + +METHOD(settings_t, add_fallback, void, + private_settings_t *this, const char *key, const char *fallback, ...) { section_t *section; va_list args; - va_start(args, key); - section = find_section(this, this->top, key, args); + /* find/create the fallback */ + va_start(args, fallback); + section = ensure_section(this, this->top, fallback, args); va_end(args); - if (!section) - { - return enumerator_create_empty(); - } - this->lock->read_lock(this->lock); - return enumerator_create_filter( - section->kv->create_enumerator(section->kv), - (void*)kv_filter, this->lock, (void*)this->lock->unlock); + va_start(args, fallback); + add_fallback_to_section(this, this->top, key, args, section); + va_end(args); } /** @@ -881,15 +1147,15 @@ static bool parse_section(linked_list_t *contents, char *file, int level, section->name); continue; } - if (section->sections->find_first(section->sections, - (linked_list_match_t)section_find, - (void**)&sub, key) != SUCCESS) + if (array_bsearch(section->sections, key, section_find, + &sub) == -1) { sub = section_create(key); if (parse_section(contents, file, level, &inner, sub)) { - section->sections->insert_last(section->sections, - sub); + array_insert_create(§ion->sections, ARRAY_TAIL, + sub); + array_sort(section->sections, section_sort, NULL); continue; } section_destroy(sub); @@ -916,12 +1182,11 @@ static bool parse_section(linked_list_t *contents, char *file, int level, section->name); continue; } - if (section->kv->find_first(section->kv, - (linked_list_match_t)kv_find, - (void**)&kv, key) != SUCCESS) + if (array_bsearch(section->kv, key, kv_find, &kv) == -1) { kv = kv_create(key, value); - section->kv->insert_last(section->kv, kv); + array_insert_create(§ion->kv, ARRAY_TAIL, kv); + array_sort(section->kv, kv_sort, NULL); } else { /* replace with the most recently read value */ @@ -1092,37 +1357,37 @@ static void section_extend(section_t *base, section_t *extension) section_t *sec; kv_t *kv; - enumerator = extension->sections->create_enumerator(extension->sections); + enumerator = array_create_enumerator(extension->sections); while (enumerator->enumerate(enumerator, (void**)&sec)) { section_t *found; - if (base->sections->find_first(base->sections, - (linked_list_match_t)section_find, (void**)&found, - sec->name) == SUCCESS) + if (array_bsearch(base->sections, sec->name, section_find, + &found) != -1) { section_extend(found, sec); } else { - extension->sections->remove_at(extension->sections, enumerator); - base->sections->insert_last(base->sections, sec); + array_remove_at(extension->sections, enumerator); + array_insert_create(&base->sections, ARRAY_TAIL, sec); + array_sort(base->sections, section_sort, NULL); } } enumerator->destroy(enumerator); - enumerator = extension->kv->create_enumerator(extension->kv); + enumerator = array_create_enumerator(extension->kv); while (enumerator->enumerate(enumerator, (void**)&kv)) { kv_t *found; - if (base->kv->find_first(base->kv, (linked_list_match_t)kv_find, - (void**)&found, kv->key) == SUCCESS) + if (array_bsearch(base->kv, kv->key, kv_find, &found) != -1) { found->value = kv->value; } else { - extension->kv->remove_at(extension->kv, enumerator); - base->kv->insert_last(base->kv, kv); + array_remove_at(extension->kv, enumerator); + array_insert_create(&base->kv, ARRAY_TAIL, kv); + array_sort(base->kv, kv_sort, NULL); } } enumerator->destroy(enumerator); @@ -1179,13 +1444,13 @@ static bool load_files_internal(private_settings_t *this, section_t *parent, } METHOD(settings_t, load_files, bool, - private_settings_t *this, char *pattern, bool merge) + private_settings_t *this, char *pattern, bool merge) { return load_files_internal(this, this->top, pattern, merge); } METHOD(settings_t, load_files_section, bool, - private_settings_t *this, char *pattern, bool merge, char *key, ...) + private_settings_t *this, char *pattern, bool merge, char *key, ...) { section_t *section; va_list args; @@ -1202,7 +1467,7 @@ METHOD(settings_t, load_files_section, bool, } METHOD(settings_t, destroy, void, - private_settings_t *this) + private_settings_t *this) { section_destroy(this->top); this->contents->destroy_function(this->contents, (void*)free); @@ -1232,6 +1497,7 @@ settings_t *settings_create(char *file) .set_default_str = _set_default_str, .create_section_enumerator = _create_section_enumerator, .create_key_value_enumerator = _create_key_value_enumerator, + .add_fallback = _add_fallback, .load_files = _load_files, .load_files_section = _load_files_section, .destroy = _destroy, diff --git a/src/libstrongswan/utils/settings.h b/src/libstrongswan/utils/settings.h index df0c534e9..46403c4d3 100644 --- a/src/libstrongswan/utils/settings.h +++ b/src/libstrongswan/utils/settings.h @@ -268,6 +268,31 @@ struct settings_t { enumerator_t* (*create_key_value_enumerator)(settings_t *this, char *section, ...); + /** + * Add a fallback for the given section. + * + * Example: When the fallback 'section-two' is configured for + * 'section-one.two' any failed lookup for a section or key in + * 'section-one.two' will result in a lookup for the same section/key + * in 'section-two'. + * + * @note Lookups are depth-first and currently strictly top-down. + * For instance, if app.sec had lib1.sec as fallback and lib1 had lib2 as + * fallback the keys/sections in lib2.sec would not be considered. But if + * app had lib3 as fallback the contents of lib3.sec would (as app is passed + * during the initial lookup). In the last example the order during + * enumerations would be app.sec, lib1.sec, lib3.sec. + * + * @note Additional arguments will be applied to both section format + * strings so they must be compatible. + * + * @param section section for which a fallback is configured, printf style + * @param fallback fallback section, printf style + * @param ... argument list for section and fallback + */ + void (*add_fallback)(settings_t *this, const char *section, + const char *fallback, ...); + /** * Load settings from the files matching the given pattern. * diff --git a/src/libtls/tls.c b/src/libtls/tls.c index 6d33d843d..6b51e7593 100644 --- a/src/libtls/tls.c +++ b/src/libtls/tls.c @@ -471,6 +471,7 @@ tls_t *tls_create(bool is_server, identification_t *server, .application = application, .purpose = purpose, ); + lib->settings->add_fallback(lib->settings, "%s.tls", "libtls", lib->ns); this->crypto = tls_crypto_create(&this->public, cache); this->alert = tls_alert_create(); diff --git a/src/libtls/tls_crypto.c b/src/libtls/tls_crypto.c index 12aa049a2..cc73ebaeb 100644 --- a/src/libtls/tls_crypto.c +++ b/src/libtls/tls_crypto.c @@ -711,7 +711,8 @@ static void filter_key_exchange_config_suites(private_tls_crypto_t *this, int i, remaining = 0; char *token, *config; - config = lib->settings->get_str(lib->settings, "libtls.key_exchange", NULL); + config = lib->settings->get_str(lib->settings, "%s.tls.key_exchange", NULL, + lib->ns); if (config) { for (i = 0; i < *count; i++) @@ -765,7 +766,8 @@ static void filter_cipher_config_suites(private_tls_crypto_t *this, int i, remaining = 0; char *token, *config; - config = lib->settings->get_str(lib->settings, "libtls.cipher", NULL); + config = lib->settings->get_str(lib->settings, "%s.tls.cipher", NULL, + lib->ns); if (config) { for (i = 0; i < *count; i++) @@ -830,7 +832,8 @@ static void filter_mac_config_suites(private_tls_crypto_t *this, int i, remaining = 0; char *token, *config; - config = lib->settings->get_str(lib->settings, "libtls.mac", NULL); + config = lib->settings->get_str(lib->settings, "%s.tls.mac", NULL, + lib->ns); if (config) { for (i = 0; i < *count; i++) @@ -879,7 +882,8 @@ static void filter_specific_config_suites(private_tls_crypto_t *this, int i, remaining = 0, suite; char *token, *config; - config = lib->settings->get_str(lib->settings, "libtls.suites", NULL); + config = lib->settings->get_str(lib->settings, "%s.tls.suites", NULL, + lib->ns); if (config) { for (i = 0; i < *count; i++) diff --git a/src/libtnccs/plugins/tnc_imc/tnc_imc.c b/src/libtnccs/plugins/tnc_imc/tnc_imc.c index 7c52ab384..2d556d9d9 100644 --- a/src/libtnccs/plugins/tnc_imc/tnc_imc.c +++ b/src/libtnccs/plugins/tnc_imc/tnc_imc.c @@ -302,7 +302,7 @@ METHOD(imc_t, destroy, void, private_tnc_imc_t *this) { if (this->handle && lib->settings->get_bool(lib->settings, - "libtnccs.plugins.tnc-imc.dlclose", TRUE)) + "%s.plugins.tnc-imc.dlclose", TRUE, lib->ns)) { dlclose(this->handle); } diff --git a/src/libtnccs/plugins/tnc_imc/tnc_imc_manager.c b/src/libtnccs/plugins/tnc_imc/tnc_imc_manager.c index 311598fa9..459b6d710 100644 --- a/src/libtnccs/plugins/tnc_imc/tnc_imc_manager.c +++ b/src/libtnccs/plugins/tnc_imc/tnc_imc_manager.c @@ -224,7 +224,7 @@ METHOD(imc_manager_t, get_preferred_language, char*, private_tnc_imc_manager_t *this) { return lib->settings->get_str(lib->settings, - "libtnccs.plugins.tnc-imc.preferred_language", "en"); + "%s.plugins.tnc-imc.preferred_language", "en", lib->ns); } METHOD(imc_manager_t, notify_connection_change, void, diff --git a/src/libtnccs/plugins/tnc_imv/tnc_imv.c b/src/libtnccs/plugins/tnc_imv/tnc_imv.c index ebf904513..ab2e55253 100644 --- a/src/libtnccs/plugins/tnc_imv/tnc_imv.c +++ b/src/libtnccs/plugins/tnc_imv/tnc_imv.c @@ -298,7 +298,7 @@ METHOD(imv_t, destroy, void, private_tnc_imv_t *this) { if (this->handle && lib->settings->get_bool(lib->settings, - "libtnccs.plugins.tnc-imv.dlclose", TRUE)) + "%s.plugins.tnc-imv.dlclose", TRUE, lib->ns)) { dlclose(this->handle); } diff --git a/src/libtnccs/plugins/tnc_imv/tnc_imv_manager.c b/src/libtnccs/plugins/tnc_imv/tnc_imv_manager.c index 12ea20319..56245015b 100644 --- a/src/libtnccs/plugins/tnc_imv/tnc_imv_manager.c +++ b/src/libtnccs/plugins/tnc_imv/tnc_imv_manager.c @@ -460,7 +460,8 @@ imv_manager_t* tnc_imv_manager_create(void) policy = enum_from_name(recommendation_policy_names, lib->settings->get_str(lib->settings, - "libtnccs.plugins.tnc-imv.recommendation_policy", "default")); + "%s.plugins.tnc-imv.recommendation_policy", + "default", lib->ns)); this->policy = (policy != -1) ? policy : RECOMMENDATION_POLICY_DEFAULT; DBG1(DBG_TNC, "TNC recommendation policy is '%N'", recommendation_policy_names, this->policy); diff --git a/src/libtnccs/plugins/tnccs_11/tnccs_11.c b/src/libtnccs/plugins/tnccs_11/tnccs_11.c index 91854b587..28c5e52b7 100644 --- a/src/libtnccs/plugins/tnccs_11/tnccs_11.c +++ b/src/libtnccs/plugins/tnccs_11/tnccs_11.c @@ -662,7 +662,7 @@ tnccs_t* tnccs_11_create(bool is_server, .callback = cb, .mutex = mutex_create(MUTEX_TYPE_DEFAULT), .max_msg_len = lib->settings->get_int(lib->settings, - "libtnccs.plugins.tnccs-11.max_message_size", 45000), + "%s.plugins.tnccs-11.max_message_size", 45000, lib->ns), .ref = 1, ); diff --git a/src/libtnccs/plugins/tnccs_20/tnccs_20.c b/src/libtnccs/plugins/tnccs_20/tnccs_20.c index b631ef579..f78b85a68 100644 --- a/src/libtnccs/plugins/tnccs_20/tnccs_20.c +++ b/src/libtnccs/plugins/tnccs_20/tnccs_20.c @@ -1063,9 +1063,9 @@ tnccs_t* tnccs_20_create(bool is_server, .mutex = mutex_create(MUTEX_TYPE_DEFAULT), .messages = linked_list_create(), .max_batch_len = lib->settings->get_int(lib->settings, - "libtnccs.plugins.tnccs-20.max_batch_size", 65522), + "%s.plugins.tnccs-20.max_batch_size", 65522, lib->ns), .max_msg_len = lib->settings->get_int(lib->settings, - "libtnccs.plugins.tnccs-20.max_message_size", 65490), + "%s.plugins.tnccs-20.max_message_size", 65490, lib->ns), .ref = 1, ); diff --git a/src/libtnccs/tnc/tnc.c b/src/libtnccs/tnc/tnc.c index fdf0412d1..7cdd363b3 100644 --- a/src/libtnccs/tnc/tnc.c +++ b/src/libtnccs/tnc/tnc.c @@ -70,8 +70,10 @@ void libtnccs_init(void) }, .ref = 1, ); - tnc = &this->public; + lib->settings->add_fallback(lib->settings, "%s.tnc", "libtnccs", lib->ns); + lib->settings->add_fallback(lib->settings, "%s.plugins", "libtnccs.plugins", + lib->ns); } /** @@ -247,7 +249,7 @@ bool tnc_manager_register(plugin_t *plugin, plugin_feature_t *feature, { load_imcvs_from_config( lib->settings->get_str(lib->settings, - "libtnccs.tnc_config", "/etc/tnc_config"), + "%s.tnc.tnc_config", "/etc/tnc_config", lib->ns), is_imc); } } diff --git a/src/manager/main.c b/src/manager/main.c index 5c845b157..b6169082f 100644 --- a/src/manager/main.c +++ b/src/manager/main.c @@ -34,7 +34,7 @@ int main (int arc, char *argv[]) bool debug; int threads, timeout; - library_init(NULL); + library_init(NULL, "manager"); if (!lib->plugins->load(lib->plugins, lib->settings->get_str(lib->settings, "manager.load", PLUGINS))) { diff --git a/src/medsrv/main.c b/src/medsrv/main.c index 6f08b97e5..745fcc359 100644 --- a/src/medsrv/main.c +++ b/src/medsrv/main.c @@ -33,7 +33,7 @@ int main(int arc, char *argv[]) char *uri; int timeout, threads; - library_init(NULL); + library_init(NULL, "medsrv"); if (!lib->plugins->load(lib->plugins, lib->settings->get_str(lib->settings, "medsrv.load", PLUGINS))) { diff --git a/src/openac/openac.c b/src/openac/openac.c index 1996025e2..8862e9ab0 100644 --- a/src/openac/openac.c +++ b/src/openac/openac.c @@ -229,7 +229,7 @@ int main(int argc, char **argv) /* initialize library */ atexit(library_deinit); - if (!library_init(NULL)) + if (!library_init(NULL, "openac")) { exit(SS_RC_LIBSTRONGSWAN_INTEGRITY); } diff --git a/src/pki/pki.c b/src/pki/pki.c index ecc0702cd..eb614dd7f 100644 --- a/src/pki/pki.c +++ b/src/pki/pki.c @@ -168,7 +168,7 @@ static void remove_callback() int main(int argc, char *argv[]) { atexit(library_deinit); - if (!library_init(NULL)) + if (!library_init(NULL, "pki")) { exit(SS_RC_LIBSTRONGSWAN_INTEGRITY); } diff --git a/src/pool/pool.c b/src/pool/pool.c index 05043cd8c..265974860 100644 --- a/src/pool/pool.c +++ b/src/pool/pool.c @@ -1212,7 +1212,7 @@ int main(int argc, char *argv[]) atexit(library_deinit); /* initialize library */ - if (!library_init(NULL)) + if (!library_init(NULL, "pool")) { exit(SS_RC_LIBSTRONGSWAN_INTEGRITY); } @@ -1227,11 +1227,16 @@ int main(int argc, char *argv[]) { exit(SS_RC_INITIALIZATION_FAILED); } - - uri = lib->settings->get_str(lib->settings, "libhydra.plugins.attr-sql.database", NULL); + /* TODO: make database URI or setting key configurable via command line */ + uri = lib->settings->get_str(lib->settings, + "pool.database", + lib->settings->get_str(lib->settings, + "charon.plugins.attr-sql.database", + lib->settings->get_str(lib->settings, + "libhydra.plugins.attr-sql.database", NULL))); if (!uri) { - fprintf(stderr, "database URI libhydra.plugins.attr-sql.database not set.\n"); + fprintf(stderr, "database URI pool.database not set.\n"); exit(SS_RC_INITIALIZATION_FAILED); } db = lib->db->create(lib->db, uri); diff --git a/src/pt-tls-client/pt-tls-client.c b/src/pt-tls-client/pt-tls-client.c index e7d75f078..90edb0c8e 100644 --- a/src/pt-tls-client/pt-tls-client.c +++ b/src/pt-tls-client/pt-tls-client.c @@ -166,7 +166,7 @@ static void init() PLUGIN_PROVIDE(CUSTOM, "pt-tls-client"), PLUGIN_DEPENDS(CUSTOM, "tnccs-manager"), }; - library_init(NULL); + library_init(NULL, "pt-tls-client"); libtnccs_init(); dbg = dbg_pt_tls; diff --git a/src/scepclient/scepclient.c b/src/scepclient/scepclient.c index ec892cc0b..d7abcb423 100644 --- a/src/scepclient/scepclient.c +++ b/src/scepclient/scepclient.c @@ -487,7 +487,7 @@ int main(int argc, char **argv) err_t ugh = NULL; /* initialize library */ - if (!library_init(NULL)) + if (!library_init(NULL, "scepclient")) { library_deinit(); exit(SS_RC_LIBSTRONGSWAN_INTEGRITY); diff --git a/src/starter/starter.c b/src/starter/starter.c index 06eb142bd..33916c95c 100644 --- a/src/starter/starter.c +++ b/src/starter/starter.c @@ -419,10 +419,10 @@ int main (int argc, char **argv) bool attach_gdb = FALSE; bool load_warning = FALSE; - library_init(NULL); + library_init(NULL, "starter"); atexit(library_deinit); - libhydra_init("starter"); + libhydra_init(); atexit(libhydra_deinit); /* parse command line */ diff --git a/src/stroke/stroke.c b/src/stroke/stroke.c index 75f014516..69c8ea2a4 100644 --- a/src/stroke/stroke.c +++ b/src/stroke/stroke.c @@ -480,7 +480,7 @@ int main(int argc, char *argv[]) const stroke_token_t *token; int res = 0; - library_init(NULL); + library_init(NULL, "stroke"); atexit(library_deinit); if (argc < 2) diff --git a/src/strongswan.conf b/src/strongswan.conf deleted file mode 100644 index 0d82dedfa..000000000 --- a/src/strongswan.conf +++ /dev/null @@ -1,34 +0,0 @@ -# strongswan.conf - strongSwan configuration file - -charon { - - # number of worker threads in charon - threads = 16 - - # send strongswan vendor ID? - # send_vendor_id = yes - - plugins { - - sql { - # loglevel to log into sql database - loglevel = -1 - - # URI to the database - # database = sqlite:///path/to/file.db - # database = mysql://user:password@localhost/database - } - } - - # ... -} - -pluto { - -} - -libstrongswan { - - # set to no, the DH exponent size is optimized - # dh_exponent_ansi_x9_42 = no -}