denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
8,249 Commits 1 Branch 0 Tags
0293f0959711c5241a0ec4d91706cad009982ced
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Tobias Brunner ef511fc03d Add support for dnQualifier in DNs. 2012-03-29 10:01:55 +02:00
Tobias Brunner a281494abd Added NEWS about resolvconf support. 2012-03-27 10:44:21 +02:00
Tobias Brunner ed2cab08d2 Make resolvconf interface prefix configurable. 2012-03-27 10:44:21 +02:00
Tobias Brunner caae5a5c0f Added support for the resolvconf framework in resolve plugin. 
If /sbin/resolvconf is found nameservers are not written directly to
/etc/resolv.conf but instead resolvconf is invoked.
 2012-03-27 10:44:21 +02:00
Tobias Brunner 817ab8a8d4 Don't cast second argument of mem_printf_hook (%b) to size_t. 
Also treat the given number as unsigned int.

Due to the printf hook registration the second argument of
mem_printf_hook (if called via printf etc.) is always of type int*.
Casting this to a size_t pointer and then dereferencing that as int does
not work on big endian machines if int is smaller than size_t (e.g. on ppc64).

In order to make this change work if the argument is of a type larger
than int, size_t for instance, the second argument for %b has to be casted
to (u_)int.
 2012-03-27 09:10:34 +02:00
Tobias Brunner adfd3b992f smp: Use proper signed type to get return value of read(2). 2012-03-27 09:10:33 +02:00
Tobias Brunner 008e2df477 pluto: Use time_monotonic() instead of a custom implementation. 2012-03-27 09:10:33 +02:00
Tobias Brunner 8e066237a7 Don't include individual glib headers in nm plugin. 
Expections are glib/gi18n.h, glib/gi18n-lib.h, glib/gprintf.h and
glib/gstdio.h.
 2012-03-26 15:23:17 +02:00
Tobias Brunner cd6b5bf8e9 Clear peer addresses during HA update. 2012-03-09 10:30:37 +01:00
Tobias Brunner 72b2811204 Simplified some route lookups now that we store all peer addresses in a list. 2012-03-09 10:22:21 +01:00
Tobias Brunner 94bbc60256 Renamed list of additional peer addresses as it now stores all known addresses. 2012-03-09 10:17:42 +01:00
Tobias Brunner 2fe624cca9 Store the peer's current address as additional known address on the IKE_SA. 
This allows to switch back to the original address after switching to
any of the additional addresses.
 2012-03-09 10:08:41 +01:00
Tobias Brunner 0808d60ebf maemo: New upstream release. 2012-02-27 18:15:51 +01:00
Tobias Brunner 686cfd4e34 Added support for untruncated MD5 and SHA1 HMACs in ESP as used in RFC 4595. 
This requires a Linux kernel >= 2.6.33.
 2012-02-27 14:31:19 +01:00
Tobias Brunner a190ec0ac5 Compiler warnings fixed. 2012-02-14 16:09:44 +01:00
Tobias Brunner 0f7d381cfe pluto: Print expiry time more properly. 2012-02-14 09:38:00 +01:00
Tobias Brunner 7efde9011e pluto: Drop support for legacy PSK format. 
Any line in ipsec.secrets starting with " or ' was treated as PSK
without ID selectors by pluto.  This prevented it from supporting DNs
like "C=CH, O=Linux strongSwan, OU=Sales, [email protected]" as
ID selectors.

PSKs defined in this legacy format can easily be updated by changing

"thisIsASecret"

into

: PSK "thisIsASecret"
 2012-02-08 13:36:32 +01:00
Tobias Brunner b96eb46d5c Some Doxygen fixes. 2012-02-07 11:20:46 +01:00
Tobias Brunner dcefa26787 Moved and clarified NEWS about PKCS#8 plugin. 2012-02-01 18:32:28 +01:00
Tobias Brunner e81260d426 Moved log message for unexpected ASN.1 objects to level 2. 
This avoids error messages if later builders can successfully decode something.
 2012-02-01 18:27:46 +01:00
Tobias Brunner fd1ff46f61 Added support for PKCS#5 v2 schemes when decrypting PKCS#8 files. 2012-02-01 18:27:46 +01:00
Tobias Brunner 1f2e036b3e NEWS about pkcs8 plugin added. 2012-02-01 18:27:46 +01:00
Tobias Brunner cab127cba6 Added support for encrypted PKCS#8 files (for some PKCS#5 v1.5 schemes). 2012-02-01 18:27:46 +01:00
Tobias Brunner db3334dc32 Added support to parse PKCS#8 encoded ECDSA private keys. 2012-02-01 18:27:45 +01:00
Tobias Brunner 27f8a61df3 OpenSSL plugin parses ECDSA private keys with explicitly specified EC parameters. 
This is needed in case the key itself does not contain the parameters,
which is the case for PKCS#8.
 2012-02-01 18:27:45 +01:00
Tobias Brunner b20c54ff3f Add builder part for parameters from algorithmIdentifier. 2012-02-01 18:27:45 +01:00
Tobias Brunner 25c6d26c1d Return parsed parameters from algorithmIdentifier if they are an OID (aka EC named curve). 
Explicit EC parameters are not supported with this function, but before this
change no parameters were actually ever returned.
 2012-02-01 18:27:45 +01:00
Tobias Brunner 9255aa87ec Parse RSA private keys from PKCS#8 encoded blobs. 2012-02-01 18:27:45 +01:00
Tobias Brunner 5ec525c1d1 Added PKCS#8 stub plugin. 2012-02-01 18:27:45 +01:00
Tobias Brunner 9ec66bc1a5 Added an option to load CA certificates without CA basic constraint. 
Enabling this option treats all certificates in ipsec.d/cacerts and
ipsec.conf ca sections as CA certificates even if they do not contain a
CA basic constraint.
 2012-02-01 14:34:52 +01:00
Tobias Brunner 7171d8765e Disable crypto benchmarking if CLOCK_THREAD_CPUTIME_ID is not available. 2012-01-30 11:04:55 +01:00
Tobias Brunner f1ba06c1c6 Cache list of plugin names to further simplify its usage. 
Also helpful for ipsec statusall to avoid having to enumerate plugins.
 2012-01-19 12:37:42 +01:00
Tobias Brunner fdf1f239ef Log list of loaded plugins in main PKI help output. 2012-01-19 11:56:43 +01:00
Tobias Brunner 576298a3ef Simplified logging of list of loaded plugins. 2012-01-19 11:56:03 +01:00
Tobias Brunner ad1aaf4be3 Function added to plugin_loader to get a list of the names of loaded plugins. 2012-01-19 11:51:51 +01:00
Tobias Brunner 9d17c1a679 Starter depends on whack/stroke on Android. 
With this change whack and stroke get installed automatically if starter is
enabled.
 2012-01-12 19:19:47 +01:00
Tobias Brunner 2e0b478a01 Android 4 requires LOCAL_MODULE_TAGS to be set for all modules. 
Because all packages are now marked as optional executables that are to
be installed on the final system have to be added to PRODUCT_PACKAGES in
build/target/product/core.mk.  Dependencies (such as libraries) are
installed automatically.
 2012-01-12 19:18:35 +01:00
Tobias Brunner 35a1986142 Fixed additional typos in comments and log messages. 2012-01-12 11:42:42 +01:00
Tobias Brunner 17e3a92661 Fix gettid() on Android, which is defined in unistd.h there. 2012-01-12 11:08:22 +01:00
Tobias Brunner 66f16d9629 Use native gettid() if available (which is the case on Android). 2012-01-10 18:31:33 +01:00
Tobias Brunner 190cd8a475 pluto: Use srand() to initialize the C library PRNG. 
Otherwise rekey and DPD times would always be the same after a restart.
 2012-01-04 13:19:29 +01:00
Tobias Brunner 7c0c2349a9 Make number of concurrently handled stroke messages configurable. 2011-12-29 18:41:39 +01:00
Tobias Brunner 8ff513a863 Limit the number of concurrently handled stroke messages. 
This avoids clogging the thread pool with potentially blocking jobs.
 2011-12-29 18:39:34 +01:00
Tobias Brunner e86b685da5 Allow callers to force ASN.1 date encoding as GENERALIZEDTIME. 2011-12-23 18:07:39 +01:00
Tobias Brunner f4095fdc8a Avoid integer overflow when parsing ASN.1 dates. 
This only works properly if sizeof(time_t) > 4.
 2011-12-23 16:38:28 +01:00
Tobias Brunner 20d752b4ff pki: Avoid integer overflow when calculating certificate lifetimes. 
This only works properly if sizeof(time_t) > 4.
 2011-12-23 16:33:24 +01:00
Tobias Brunner 1267127c11 Properly ASN.1 encode dates in certificates depending on the year. 2011-12-23 16:29:41 +01:00
Tobias Brunner 70a4737690 pluto: Fixed expiration date test. 2011-12-23 15:32:06 +01:00
Tobias Brunner fc726f1359 Fix deadlock in trap_manager_t during acquire. 
Also fixes a TOCTOU issue regarding the use of entry_t.pending.

The deadlock was caused because the rwlock was being locked while
waiting for an IKE_SA. Triggering the deadlock was a bit tricky, here
is the description by Thomas Egerer (the reporter of this issue):

"
The deadlock occurs when the following happens (in the given order):

a) an IKE_SA is built and a thread is processing the IKE_AUTH request,
   which can take a bit longer when a smartcard is involved. This
   causes the ike_sa_manager to lock a particular IKE_SA exclusively.
b) an acquire is triggered which causes the rwlock in the trap_manager
   to be read-locked, the subsequent call to
   ike_sa_manager->checkout_by_config has to wait until a) unlocks
   it's ike_sa.
c) a child_cfg contained in the peer_cfg belonging to the ike_sa
   a) has locked is routed causes the child_configs contained
   in the peer config to be locked by c) while the actual routing
   code within trap_manager tries to writelock it's rwlock.

That's about it. As soon as a) finishes authentication of the peer
and tries to find a matching child sa it will try to lock the child
configs of the peer config which is not possible since it has been
locked by c).

Thread | Resource locked                | Resource desired
-------+--------------------------------+--------------------------------
  (a)  | ike_sa in ike_sa_manager       | child_cfgs of peer_cfg
       |                                |
  (b)  | rwlock in trap-manager (read)  | ike_sa in ike_sa_manager
       |                                |
  (c)  | child_cfgs of peer_cfg         | rwlock in trap-manager (write)
"

With this patch thread (b) now does not hold the lock while waiting for
the IKE_SA. Thus (c) can get the write lock, and (a) can subsequently
lock the mutex in the peer_cfg which then finally allows (b) to checkout
the IKE_SA.
 2011-12-23 11:07:14 +01:00
Tobias Brunner 5317dd6887 Added atomic compare and swap operations. 
Using a GCC atomic builtin if available or a global mutex otherwise.
 2011-12-23 11:04:55 +01:00
Tobias Brunner d6656f11e4 Fixed flush() method of trap_manager_t. 
A segmentation fault could have happened during destruction of the trap
manager after calling flush().
 2011-12-23 10:38:10 +01:00
Tobias Brunner cc4b48e886 Also log PGP parsing in ASN log group. 2011-12-16 16:44:38 +01:00
Tobias Brunner b6e0784385 Log messages for PKCS1 and PEM parsing in ASN log group. 2011-12-16 16:44:38 +01:00
Tobias Brunner eb497205e3 Log most X.509 related messages in new ASN log group. 2011-12-16 16:44:38 +01:00
Tobias Brunner c7f3a056dd Log ASN.1 parsing in new ASN debug group. 2011-12-16 16:44:38 +01:00
Tobias Brunner 54d096a712 Added ASN debug group to log low-level encoding/decoding (ASN.1, X.509). 
This will allow us to remove quite some clutter from the LIB debug group
for higher debug levels.
 2011-12-16 16:44:38 +01:00
Tobias Brunner c17f6f96e2 Log native thread ID when a thread is created. 
If possible gettid() is used, otherwise pthread_self() is logged (which is
not completely portable, but seems to work on most supported platforms).
 2011-12-16 16:44:38 +01:00
Tobias Brunner b24287c269 Log worker thread ID with two digits. 2011-12-16 16:44:38 +01:00
Tobias Brunner a5951a2861 Make sure the certificate cache is flushed when plugins are unloaded. 
This avoids segmentation faults when plugins implementing cert_t are
already unloaded when the cache is flushed during destruction.
 2011-12-15 12:20:09 +01:00
Tobias Brunner 49b44c98c1 Charon also supports type=passthrough|drop. 2011-12-14 19:01:39 +01:00
Tobias Brunner b768d6a4a5 Documented xauth_identity in ipsec.conf(5) man page. 2011-12-14 18:04:39 +01:00
Tobias Brunner 6d4c6b8f41 Documented binary secrets in ipsec.secrets(5) man page. 2011-12-14 17:46:27 +01:00
Tobias Brunner 3eff54a5ca Added missing libsimaka files to Android.mk. 2011-12-14 16:38:30 +01:00
Tobias Brunner 406c5a593b Destroy mediation managers before unloading plugins. 2011-12-14 14:24:37 +01:00
Tobias Brunner b4f037bb08 libfast: Fixed compiler warning. 2011-11-25 10:22:41 +01:00
Tobias Brunner 5ddeaf2884 Fixed compiler warnings for DH groups that define no subgroup. 2011-11-25 10:18:03 +01:00
Tobias Brunner a660f1426e Fixed missing initializer compiler warning. 2011-11-25 09:52:19 +01:00
Tobias Brunner b46a5cd4ef Fixed check for log groups when debug_t is unsigned. 
The range and signedness of enum types is up to the compiler.
 2011-11-25 09:48:32 +01:00
Tobias Brunner 282dcb9974 Fixed check of max_poll_time as it is an unsigned int. 2011-11-25 09:46:45 +01:00
Tobias Brunner edad908792 Fixed compiler warnings regarding enum comparison. 
Warnings like

  comparison of unsigned expression < 0 is always false

are reported with -Wextra when enum types that are compiled to an
unsigned type (which is up to the compiler) are checked for negativity.
 2011-11-25 09:40:30 +01:00
Tobias Brunner 4f775afda9 Added missing Android.mk files to distribution. 2011-11-22 18:31:12 +01:00
Tobias Brunner 727fe0f99e libfreeswan: Fixed compiler warning. 2011-11-09 19:20:10 +01:00
Tobias Brunner 4de8f280e1 pkcs11: Fixed a bug when creating public keys. 2011-11-09 17:39:24 +01:00
Tobias Brunner fe11d4bd64 Properly disable starter and pluto in top Android.mk. 2011-11-09 17:35:59 +01:00
Tobias Brunner 856baca23e Fixed monolithic build of libcharon with libtnccs enabled. 2011-11-08 18:35:11 +01:00
Tobias Brunner 59c5f048bb Correctly refer to tnc-tnccs plugin when building monolithically. 2011-11-08 18:35:11 +01:00
Tobias Brunner b12ad862c1 Calculate checksums for libsimaka and libtls. 
These are currently not checked though. And because they don't define a
<libname>_init function an warning is reported when the checksum is
calculated.
 2011-11-08 18:35:11 +01:00
Tobias Brunner 89bad63bac Defer calculation of checksums until installation. 
The checksum is now calculated from the installed libraries and plugins.
This allows to calculate checksums for plugins linking to libraries like
libtls as these are relinked during installation.
 2011-11-08 18:35:11 +01:00
Tobias Brunner 4ad67fe7d5 Fixed formatting for longer plugin names in checksum_builder output. 2011-11-08 18:35:11 +01:00
Tobias Brunner 9192f78f70 Don't link libtnccs to checksum_builder. 
Linking is only required for libraries defining global symbols used by
plugins to which the plugins do not link themselves.
 2011-11-08 18:35:11 +01:00
Tobias Brunner 48e87e12ab Revert "fixed integrity tests of plugins using libtls or libtnccs" 
This reverts commit b597ac4a4c (not
completely).
 2011-11-08 18:35:11 +01:00
Tobias Brunner e034cc9ca9 Revert "fixed integrity tests of plugins using libsimaka" 
This reverts commit 8c42f16dee.

Conflicts:

	src/charon/Makefile.am
 2011-11-08 18:35:11 +01:00
Tobias Brunner 9b6502ade8 maemo: New upstream release. 2011-11-08 18:35:11 +01:00
Tobias Brunner 866858527d Fix 'ipsec pool --status' for empty pools. 2011-11-04 15:07:54 +01:00
Tobias Brunner 39b30518c2 Syntax error in sqlite.sql fixed. 2011-11-04 14:37:22 +01:00
Tobias Brunner 5fd8e53002 Some Android NEWS added. 2011-11-04 12:24:16 +01:00
Tobias Brunner 2e94a02115 Don't build pluto and starter by default on Android. 2011-11-04 12:20:21 +01:00
Tobias Brunner 051226d5c0 Silently install route again, even if it did not change. 
Address/interface changes can cause the route to disappear. Afterwards
the route might look the same but that does not mean it is still installed.
 2011-11-04 11:11:17 +01:00
Tobias Brunner 25d59e9e2d Compile warning fixed in kernel interfaces. 2011-11-04 11:11:17 +01:00
Tobias Brunner f3eef176f4 Common spelling errors fixed. 2011-11-03 19:30:17 +01:00
Tobias Brunner 602ee58e45 NEWS about pkcs11 plugin added. 2011-11-03 18:39:57 +01:00
Tobias Brunner 53e2fc690e pkcs11: Documented use_pubkey option in strongswan.conf(5). 2011-11-03 18:36:34 +01:00
Tobias Brunner 1bdd255ed3 pkcs11: Make public key operations on tokens optional. 2011-11-03 17:56:40 +01:00
Tobias Brunner 5b85b94e27 pkcs11: Make sure a key can be used for a given signature scheme. 2011-11-02 20:27:55 +01:00
Tobias Brunner 58d0a8d49b pkcs11: Register ECDSA feature. 2011-11-02 20:27:55 +01:00
Tobias Brunner fd48b220ed pkcs11: We have to create our own hashes for some signature schemes. 2011-11-02 20:27:55 +01:00
Tobias Brunner 30a3ede8ce pkcs11: Lookup the public key of a private key by CKA_ID. 
Currently this only works if a public key object with the same ID is
available, if there isn't one we could search for a certificate with the
same ID and extract the key from there.
 2011-11-02 20:27:55 +01:00
Tobias Brunner 5d2fccf439 pkcs11: Search for private keys in a more generic way. 
Also, don't extract the public key directly from the private key. Some
tokens actually do not return the public exponent (it's not required).
We have to find a different way to get the public key.
 2011-11-02 20:27:55 +01:00
Tobias Brunner 9e3b1e1495 pkcs11: Added support to encode ECDSA public keys. 2011-11-02 20:27:55 +01:00
Tobias Brunner 36d1627f6e pkcs11: Parse ECDSA public keys and find/create them on tokens. 2011-11-02 20:27:55 +01:00