denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
20,067 Commits 1 Branch 0 Tags
main
Commit Graph
15501 Commits
Author SHA1 Message Date
Tobias Brunner e8130a9498 ipseckey: Refactor creation of certificate enumerator 
Reduces nesting and fixes a memory leak (rrsig_enum).
 2013-10-11 15:45:41 +02:00
Tobias Brunner de5ea570f1 ipseckey: Depend on plugin features to create public key and certificate objects 2013-10-11 15:45:41 +02:00
Tobias Brunner 6ecf1aab35 unbound: Add support for DLV (DNSSEC Lookaside Validation) 
Fixes #392.
 2013-10-11 15:45:25 +02:00
Tobias Brunner cd25d291f7 kernel-libipsec: Don't ignore policies of type != POLICY_IPSEC 
This actually broke rekeying due to the DROP policies that are
temporarily added, which broke the refcount as the ignored policies
were not ignored in del_policy() (the type is not known there).
 2013-10-11 15:32:44 +02:00
Tobias Brunner eeb34af069 kernel-libipsec: Add an option to allow remote TS to match the IKE peer 
Setting the fwmark options for the kernel-netlink and socket-default
plugins allow this kind of setup.

It is probably required to set net.ipv4.conf.all.rp_filter to 2 to make
it work.
 2013-10-11 15:32:44 +02:00
Tobias Brunner 80f8b3a6d8 socket-default: Allow setting firewall mark on outbound packets 2013-10-11 15:32:44 +02:00
Tobias Brunner 51fefe4606 kernel-netlink: Allow setting firewall marks on routing rule 2013-10-11 15:32:44 +02:00
Tobias Brunner 434e530f75 ipsec_types: Add utility function to parse mark_t from strings 2013-10-11 15:32:44 +02:00
Tobias Brunner bd085dd978 attr-sql: Use a serializable transaction when inserting identities 2013-10-11 15:29:10 +02:00
Tobias Brunner b283a6e9ef database: Add support for serializable transactions 2013-10-11 15:29:10 +02:00
Tobias Brunner e745f5f69f sql: Don't use MyISAM engine and set collation/charset for all tables 
The MyISAM engine doesn't support transactions.
 2013-10-11 15:16:05 +02:00
Tobias Brunner 03c801cb2b pool: Change transaction handling 2013-10-11 15:16:05 +02:00
Tobias Brunner ec6ad6b086 pool: Move the pool utility to its own directory in src 2013-10-11 15:16:05 +02:00
Tobias Brunner 5abe3c52d3 attr-sql: Handle concurrent insertion of identities 
If the same identity is added concurrently by two threads (or by the
pool utility) INSERT might fail even though the SELECT was unsuccessful
before.

We are currently not able to lock the identities table in a portable way
(something like SELECT ... FOR UPDATE on MySQL).
 2013-10-11 15:16:05 +02:00
Tobias Brunner 4b8b1354ce attr-sql: Don't use database transactions in create_attribute_enumerator 
There could, of course, be race conditions when enumerating the attributes,
but those probably don't matter (e.g. missing an attribute that was
concurrently added).

Transactions are more intended to revert multiple changes if anything
fails in the process.
 2013-10-11 15:16:05 +02:00
Tobias Brunner fad11d602d sqlite: Implement transaction handling 2013-10-11 15:16:05 +02:00
Tobias Brunner f3cb889c9b mysql: Implement transaction handling 2013-10-11 15:16:04 +02:00
Tobias Brunner 947b76cda8 database: Add interface to handle transactions 2013-10-11 15:16:04 +02:00
Tobias Brunner 5f6a40827e mysql: Ensure connections are properly released in multi-threaded environments 2013-10-11 15:16:04 +02:00
Tobias Brunner ec91f15e3b crypto-factory: Try next available RNG implementation if constructor fails 2013-10-11 15:13:25 +02:00
Tobias Brunner 2e22333fbc crypto-factory: Order entries by algorithm identifier and (optionally) speed 2013-10-11 15:13:25 +02:00
Tobias Brunner e2c9a03d15 Remove HASH_PREFERRED, usages are replaced with HASH_SHA1, which is required for IKEv2 anyway 2013-10-11 15:13:25 +02:00
Tobias Brunner 3473cbab9c vstr: Forward actual field width 
fmt_field_width is a flag that indicates if a field width
is defined in obj_field_width.
 2013-10-11 15:12:16 +02:00
Martin Willi fc566632da unit-tests: support testing when leak-detective has not been enabled 2013-10-11 15:12:16 +02:00
Martin Willi 795cbb98c6 printf-hook-builtin: Print NaN/Infinity floating point values as such 2013-10-11 11:06:09 +02:00
Martin Willi 8af9bf70f5 printf-hook-builtin: Correctly round up floating point values 2013-10-11 11:06:09 +02:00
Martin Willi edc7a3d02f printf-hook-builtin: Add some preliminary floating point support 
This minimalistic implementation has no aspiration for completeness or
accuracy, and just provides what we need.
 2013-10-11 11:06:09 +02:00
Martin Willi 7e6a4cdc84 printf-hook-builtin: Support GNU %m specifier 2013-10-11 11:06:09 +02:00
Martin Willi cabe5c0ff4 printf-hook-builtin: Add a new "builtin" backend using its own printf() routines 
Overloads printf C library functions by a self-contained implementation,
based on klibc. Does not yet feature all the required default formatters,
including those for floating point values.
 2013-10-11 11:06:02 +02:00
Martin Willi ebca34d782 printf-hook: Add some basic printf() string/integer test functions 2013-10-11 11:05:37 +02:00
Martin Willi 243048248b printf-hook: Move glibc/vstr printf hook backends to separate files 2013-10-11 11:05:30 +02:00
Martin Willi d53002f088 libipsec: Enforce byte/packet lifetimes on SAs 2013-10-11 10:23:18 +02:00
Martin Willi 12fdc2b16b kernel-libipsec: Support ESPv3 TFC padding 2013-10-11 10:23:18 +02:00
Martin Willi 293515f95c libipsec: remove extra RFC4303 TFC padding appended to inner payload 2013-10-11 10:23:17 +02:00
Martin Willi d53f9b9637 kernel-libipsec: Support query_sa() to report usage statistics 2013-10-11 10:23:17 +02:00
Martin Willi b08967d6d8 libipsec: Support usage statistics and query_sa() on IPsec SAs 2013-10-11 10:23:17 +02:00
Martin Willi d7083b6541 kernel: Use a time_t to report use time in query_policy() 2013-10-11 10:23:17 +02:00
Martin Willi c99458e94e kernel: Use a time_t to report use time in query_sa() 2013-10-11 10:23:17 +02:00
Martin Willi 4817595876 updown: Install forwarding rules with the actually used protocol 2013-10-11 10:15:22 +02:00
Martin Willi c5d9b133e0 updown: Add a PLUTO_PROTO variable set to 'ah' or 'esp' 2013-10-11 10:15:21 +02:00
Martin Willi e48e530b44 starter: Reject connections having both 'ah' and 'esp' keywords set 
We currently don't support mixed proposals or bundles, so don't create the
illusion we would.
 2013-10-11 10:15:21 +02:00
Martin Willi 757343d90e ike: Define keylength for aescmac algorithm 2013-10-11 10:15:21 +02:00
Martin Willi a1379e3210 ikev1: Support parsing of AH+IPComp proposals 2013-10-11 10:15:21 +02:00
Martin Willi 25f74be8f9 starter: Remove obsolete 'auth' option 2013-10-11 10:15:21 +02:00
Martin Willi d489e75579 ikev1: Accept more than two certificate payloads 2013-10-11 10:15:21 +02:00
Martin Willi 3771b85806 ikev1: Support en-/decoding of SA payloads with AH algorithms 2013-10-11 10:15:21 +02:00
Martin Willi 44e6aa4fb7 kernel-handler: Whitespace cleanups 2013-10-11 10:15:21 +02:00
Martin Willi f6037b5506 stroke: List proposals in statusall without leading '/' in AH SAs 2013-10-11 10:15:21 +02:00
Martin Willi 4bf92306eb ikev1: Delete quick modes with the negotiated SA protocol 2013-10-11 10:15:21 +02:00
Martin Willi 5d569e07fd trap-manager: Install trap with SA protocol of the first configured proposal 2013-10-11 10:15:21 +02:00