denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
9,190 Commits 1 Branch 0 Tags
0619ddfaa4c374025844257648c61f71e1fdfcb5
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Tobias Brunner 644c6c968d Use spin locks to update IKE_SAs in controller_t 
This ensures the listeners don't miss any events after the SAs have been
checked out in the asynchronously executed jobs.  This is a matter of
memory visibility and not primary a matter of exclusive access.
 2012-07-04 10:13:50 +02:00
Tobias Brunner 12fa85c664 Added wrapper for POSIX spin locks 2012-07-04 10:13:49 +02:00
Tobias Brunner c9355ea4a0 Fixed job handling in controller_t 
Also IKE_SAs are now checked out in the jobs and not before.
 2012-07-04 10:13:49 +02:00
Tobias Brunner 901dbc1077 openssl: Ensure the thread ID is never zero 
This might otherwise cause problems because OpenSSL tries to lock
mutexes recursively if it assumes the lock is held by a different
thread e.g. during FIPS initialization.
 2012-07-03 12:02:57 +02:00
Tobias Brunner a60e92a2c8 Added GPL header to AndroidConfigLocal.h 2012-06-29 16:51:29 +02:00
Tobias Brunner f3af4969a7 Added GPL header to scripts 2012-06-29 16:51:29 +02:00
Tobias Brunner 1a06ba1849 Added LICENSE file to the distribution 2012-06-29 16:51:29 +02:00
Tobias Brunner f59240e9ae Added OpenSSL/GPL exception to LICENSE file 
Also updated other parts of the license.
 2012-06-29 16:51:29 +02:00
Tobias Brunner e516068965 Removed superfluous remove_hasher() call in md5 plugin 2012-06-29 16:23:20 +02:00
Tobias Brunner bbbffac3ab Defined a macro to replace strerror(3) with calls to thread-safe wrapper 2012-06-28 13:14:52 +02:00
Tobias Brunner 2a59527659 Thread-safe wrapper around strerror(3)/strerror_r(3) added 2012-06-28 13:14:52 +02:00
Tobias Brunner bd858af851 libcharon also requires kernel interfaces and a socket implementation 2012-06-27 12:15:09 +02:00
Tobias Brunner 8122ae8cd8 gcrypt: Register SHA1 first as HASH_PREFERRED depends on it 2012-06-27 11:31:16 +02:00
Tobias Brunner aa54ecef44 Use static plugin features in libcharon to define essential dependencies 2012-06-27 11:31:16 +02:00
Tobias Brunner ec3b332bf8 Use static plugin features in charon-nm 2012-06-27 11:31:16 +02:00
Tobias Brunner f102c5f341 Mask the configured mark value to ensure it is in range 2012-06-26 12:50:58 +02:00
Tobias Brunner 66e12b926e Some updates in ipsec.conf(5) for 5.0.0 2012-06-26 12:39:53 +02:00
Tobias Brunner 92250a48a9 Added MAC wrappers to Android.mk 2012-06-26 07:58:04 +02:00
Tobias Brunner 9866c26c5b Also build charon's IKEv1 implementation on Android 2012-06-26 07:56:15 +02:00
Tobias Brunner 43d01ab2f6 Build nonce plugin on Android 2012-06-26 07:56:15 +02:00
Tobias Brunner 8497c5d147 Missing source file added to libcharon's Android.mk 2012-06-26 07:56:15 +02:00
Tobias Brunner 67307ad724 scepclient: Added support to build it on Android 2012-06-26 07:56:15 +02:00
Tobias Brunner 197dbf5f72 Added support for the curl plugin on Android 2012-06-26 07:56:14 +02:00
Tobias Brunner 63afd833b9 Avoid SIGSEGV during shutdown if charon is not started as root 2012-06-25 19:00:00 +02:00
Tobias Brunner f97c269e0c NEWS about thread pool updates added 2012-06-25 18:18:07 +02:00
Tobias Brunner e0efd7c121 Make rescheduling a job more predictable 
This avoids race conditions between calls to cancel() and jobs that like
to be rescheduled.  If jobs were able to reschedule themselves it would
theoretically be possible that two worker threads have the same job
assigned (the one currently executing the job and the one executing the
same but rescheduled job if it already is time to execute it), this means
that cancel() could be called twice for that job.

Creating a new job based on the current one and reschedule that is also
OK, but rescheduling itself is more efficient for jobs that need to be
executed often.
 2012-06-25 17:49:12 +02:00
Tobias Brunner 26d77eb3e6 Centralized thread cancellation in processor_t 
This ensures that no threads are active when plugins and the rest of the
daemon are unloaded.

callback_job_t was simplified a lot in the process as its main
functionality is now contained in processor_t.  The parent-child
relationships were abandoned as these were only needed to simplify job
cancellation.
 2012-06-25 17:38:59 +02:00
Tobias Brunner 7fec83af28 Give processor_t more control over the lifecycle of a job 
Jobs are now destroyed by the processor, but they are allowed to
reschedule themselves.  That is, parts of the reschedule functionality
already provided by callback_job_t is moved to the processor.  Not yet
fully supported is JOB_REQUEUE_DIRECT and canceling jobs.

Note: job_t.destroy() is now called not only for queued jobs but also
after execution or cancellation of jobs.  job_t.status can be used to
decide what to do in said method.
 2012-06-25 17:10:28 +02:00
Tobias Brunner 18d21a57df Added a method to plugin_loader_t to add 'static' plugin features 
This allows daemons and other components to register plugin features
like those provided by plugins (following the same lifecycle).

The added features are internally handled like they were added by a
plugin.
 2012-06-25 17:03:07 +02:00
Tobias Brunner e07122436c Make sure that all features of critical plugins are loaded 2012-06-25 17:03:07 +02:00
Tobias Brunner bc6d944705 Added an option to rename the ipsec script during installation 
Also rename the man page and adjust all references in the script, the
man page and other files.

Closes #194.
 2012-06-25 16:53:38 +02:00
Tobias Brunner d86cf32b4b Removed -o argument when creating .../ipsec.d with install 
This should have been removed with 2b52d5cb41.
 2012-06-25 16:37:34 +02:00
Tobias Brunner 34a80708e2 Updated ipsec script man page after removing pluto 2012-06-25 16:37:34 +02:00
Tobias Brunner 738b9121cb Use mac_t and PRF and signer wrappers in cmac plugin 2012-06-25 16:35:06 +02:00
Tobias Brunner 83cb52b044 Use mac_t and PRF and signer wrappers in xcbc plugin 2012-06-25 16:35:06 +02:00
Tobias Brunner c4a3c9672a Make the hmac_t interface a generic interface for message authentication codes 2012-06-25 16:35:06 +02:00
Tobias Brunner 228d096e42 Simplified creation of PRFs and signers in openssl and hmac plugins 2012-06-25 16:35:06 +02:00
Tobias Brunner 01850f5d55 Function to convert PRFs to hash algorithms added 2012-06-25 16:35:06 +02:00
Tobias Brunner 903093d439 hasher_algorithm_from_integrity() optionally returns truncation length 2012-06-25 16:35:06 +02:00
Tobias Brunner 73d032e412 Use simple wrappers for HMAC based PRF and signer in openssl plugin 2012-06-25 16:35:06 +02:00
Tobias Brunner 63420c6e13 Use simple wrappers for HMAC based PRF and signer in hmac plugin 2012-06-25 16:35:06 +02:00
Tobias Brunner 57ff4be874 Simple wrappers for HMAC based prf_t and signer_t implementations added 2012-06-25 16:35:06 +02:00
Tobias Brunner 8391c1d0b1 Refactored OpenSSL based HMAC implementation 2012-06-25 16:35:06 +02:00
Tobias Brunner 7beb31aae4 Fixed IPv6 source address lookup 
Because Linux kernels prior to 3.0 do not support RTA_PREFSRC for
IPv6 routes we didn't use NLM_F_DUMP to get all routes.
Still routes installed with policies are installed also for IPv6.
So since only one route is returned without DUMP, and we ignore
all routes from our own routing table, no source address was found
during roaming if DST of the installed route included the IKE peer.

With newer kernels we can now use DUMP as we did for IPv4 already,
for older kernels we do so if our own routes are installed in a
separate routing table, otherwise we still use GET.
 2012-06-25 16:29:59 +02:00
Tobias Brunner 720ba902c5 Enable xauth-generic by default but don't build it if IKEv1 is disabled 2012-06-25 11:07:49 +02:00
Tobias Brunner 2e4c807bf3 Remove CREDITS from distribution 2012-06-25 11:07:35 +02:00
Tobias Brunner 20bda203f9 The AUTHORS file is required by automake 2012-06-25 10:59:27 +02:00
Tobias Brunner d50b9be571 LICENSE file updated 2012-06-25 10:52:16 +02:00
Tobias Brunner c236f19e50 ldaphost and ldapbase ca section keywords are deprecated 2012-06-25 10:52:16 +02:00
Tobias Brunner 693805cc98 Removed pluto-specifics from ipsec script 2012-06-25 10:52:16 +02:00
Tobias Brunner f5a3b95a39 README file cleaned up and updated 2012-06-25 10:52:16 +02:00
Tobias Brunner e91157a4b6 Fix SIGSEGV if kernel install fails during Quick Mode as responder. 2012-06-22 11:34:38 +02:00
Tobias Brunner aa8898bc45 Fixed compile error because of charon->name in certexpire plugin. 2012-06-21 13:59:18 +02:00
Tobias Brunner 5d227c79a9 Doxygen fix in PKCS#7 wrapper 2012-06-19 13:32:59 +02:00
Tobias Brunner 6d3702ed61 testing: List IPv6 routing table in IPv6 test cases. 2012-06-15 16:46:27 +02:00
Tobias Brunner 5c1332bf7c NLM_F_DUMP includes NLM_F_ROOT. 2012-06-15 16:46:27 +02:00
Tobias Brunner 8ec51f83e5 Don't create roam jobs based on cached/cloned routes. 2012-06-15 16:44:18 +02:00
Tobias Brunner 9896b6bd58 Don't compare ports when comparing cached routes. 
At least src_ip has a port set sometimes.
 2012-06-15 16:44:07 +02:00
Tobias Brunner 31bcaf604a starter: Fixed parsing of %defaultroute. 2012-06-15 10:46:56 +02:00
Tobias Brunner dd38e9fc83 scepclient: Fixed Makefile after removing enable-smartcard configure option. 2012-06-13 15:08:14 +02:00
Tobias Brunner f7cbc0fafe Use proper defines for IPV6_PKTINFO on Mac OS X Lion and newer. 2012-06-13 15:02:10 +02:00
Tobias Brunner 2015c46985 Some updates to the INSTALL document. 2012-06-13 12:24:23 +02:00
Tobias Brunner 6d599fb964 Removed remaining pluto related configure options. 2012-06-13 11:33:32 +02:00
Tobias Brunner 25fb9d3f4a starter: Print additional help texts for selected deprecated keywords. 2012-06-12 16:15:03 +02:00
Tobias Brunner 9707d9db79 starter: Improved how deprecated keywords are handled. 
We only throw a warning now instead of rejecting the config.
 2012-06-12 16:15:03 +02:00
Tobias Brunner 5c7a219804 Revert "starter: Don't treat unsupported keywords as fatal errors just report them." 
This reverts commit e55876a657.
 2012-06-12 16:15:03 +02:00
Tobias Brunner e7c01bed49 starter: Fixed parsing of left|right=%any. 2012-06-12 10:16:51 +02:00
Tobias Brunner 4d21846912 starter: Fix comparison of connections. 2012-06-11 17:33:32 +02:00
Tobias Brunner 3e2ff81e5d starter: Removed all unsupported keywords. 2012-06-11 17:33:32 +02:00
Tobias Brunner e55876a657 starter: Don't treat unsupported keywords as fatal errors just report them. 2012-06-11 17:33:32 +02:00
Tobias Brunner fff4b74db2 Bye bye Pluto! 
Charon will take over IKEv1 duties from here.  This also removes
libfreeswan and whack.
 2012-06-11 17:33:32 +02:00
Tobias Brunner 4a54860986 _copyright: Replicate copyright text here instead of calling libfreeswan. 2012-06-11 17:33:32 +02:00
Tobias Brunner ee3026a1e2 starter: Remove all ties to pluto/libfreeswan. 
Moved some types/constants in the process.
 2012-06-11 17:33:32 +02:00
Tobias Brunner 5b09310e67 starter: Use custom type for SA specific options (flags). 2012-06-11 17:33:31 +02:00
Tobias Brunner 29906e0eab starter: Parse left|rightprotoport directly in confread.c. 2012-06-11 17:33:31 +02:00
Tobias Brunner eca839b0a7 starter: No special handling for left|rightsubnet, just pass it on as string. 2012-06-11 17:33:31 +02:00
Tobias Brunner 6ce841b213 starter: Use host_t to parse left|rightsourceip. 
Also for the yet unused natip option.
 2012-06-11 17:33:31 +02:00
Tobias Brunner 0ac29be793 starter: Remove left|rightsubnetwithin option (charon narrows left|rightsubnet down accordingly). 2012-06-11 17:33:31 +02:00
Tobias Brunner 8dd094e185 starter: Don't resolve any addresses in starter. 
Also removed remains of some unknown iface option.
 2012-06-11 17:33:31 +02:00
Tobias Brunner efc69e9f38 starter: Removed pfs and pfsgroup options (handled via esp option). 2012-06-11 17:33:31 +02:00
Tobias Brunner 6d065f14ae starter: Store mode of the IPsec SA/policy in a separate member. 2012-06-11 17:33:30 +02:00
Tobias Brunner f82365ad27 starter: Use custom type to mark seen keywords. 2012-06-11 17:33:30 +02:00
Tobias Brunner 57323f6259 starter: Remove left|rightnexthop option. 
Charon does this lookup dynamically.
 2012-06-11 17:33:30 +02:00
Tobias Brunner 753ca22f9c Implement strdupnull() macro as static inline function. 
This avoids compiler warnings if the argument is a const char*.
 2012-06-11 17:33:30 +02:00
Tobias Brunner 7cce0e96f2 starter: Replaced all usages of clone_str() with strdupnull(). 2012-06-11 17:33:30 +02:00
Tobias Brunner e838c39ba9 starter: Parse authby as string. 2012-06-11 17:33:30 +02:00
Tobias Brunner 041e763b77 starter: Remove main parts of pluto support (invoke, whack). 2012-06-11 17:33:30 +02:00
Tobias Brunner 95e41fb80a starter: Drop support for %defaultroute. 2012-06-11 17:33:29 +02:00
Tobias Brunner 163b227386 starter: Migrated logging to libstrongswan. 2012-06-11 17:33:29 +02:00
Tobias Brunner bcfb6b8efc starter: Remove unneeded starter_exec function. 2012-06-11 17:33:29 +02:00
Tobias Brunner d7c3fd5421 scepclient: Option added to read PKCS#10 certificate request from a file. 2012-06-11 17:33:29 +02:00
Tobias Brunner cea9bf563a scepclient: Option added to read self-signed certificate from a file. 2012-06-11 17:33:29 +02:00
Tobias Brunner 3a7c6b39b5 scepclient: Generate uppercase transaction ID. 2012-06-11 17:33:29 +02:00
Tobias Brunner f79b665243 scepclient: Use HTTP 1.0 for all requests. 2012-06-11 17:33:28 +02:00
Tobias Brunner 1d81b1ab18 scepclient: Options added to specify digest/signature algorithms. 
Also changed the defaults to DES/MD5 as that's what should be used
if GetCACaps is not used to learn the issuers capabilities.
 2012-06-11 17:33:28 +02:00
Tobias Brunner cc55783f36 Added function to convert integrity algorithms to hash algorithms (if based on one). 2012-06-11 17:33:28 +02:00
Tobias Brunner 82e526ce81 Properly encode 0 in ASN.1. 
According to X.690 an INTEGER object always has at least one content
octet.
 2012-06-11 17:09:20 +02:00
Tobias Brunner e8120632ae Don't use chunk_skip() in asn1_length(). 
chunk_skip() returns chunk_empty if the length of the chunk is equal to
the number of bytes to skip, this is problematic as asn1_length() modifies
the original chunk.  asn1_parser_t for instance uses the modified chunk to
later calculate the length of the resulting ASN.1 object which produces
incorrect results if it is based on chunk_empty.
 2012-06-11 17:09:20 +02:00
Tobias Brunner 6e6d78a561 Changed memory management and call logic in PKCS#7 parser/generator. 2012-06-11 17:09:20 +02:00
Tobias Brunner 2bf125f0ed Changed memory management and attribute handling in PKCS#9 wrapper. 2012-06-11 17:09:20 +02:00