denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
12,077 Commits 1 Branch 0 Tags
1254ad01b9f7977b0d2d7be8f734f8c10a702727
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Martin Willi 1254ad01b9 unit-tests: Fix a compiler warning in identification tests 2013-11-06 10:31:01 +01:00
Martin Willi 382fa8b419 unit-tests: Clean up memory in new asn1 unit tests 
Test runner checks for leaks when leak detective is enabled.
 2013-11-06 10:31:00 +01:00
Martin Willi 712940d161 unit-tests: Pass linked_list->invoke* varargs as uintptr_t 
Passing integers of unspecified length may result in passing an integer shorter
than uintptr_t. When reading them back, we might get more data than passed,
resulting in a failure.
 2013-11-06 10:31:00 +01:00
Martin Willi f7b8396af0 unit-tests: Initialize backtracing before printing any backtraces 2013-11-06 10:31:00 +01:00
Martin Willi bbb62267e0 thread: Note that tread_cancellation_point temporarily activates cancelability 2013-11-06 10:31:00 +01:00
Martin Willi 7a13990964 backtrace: Support backtracing even if library is not initialized 
But of course backtracing must be initialized anyway using backtrace_init().
 2013-11-06 10:31:00 +01:00
Martin Willi a5860cddae unit-tests: Enable libstrongswan tests even if --enable-unit-tests not set 
As we don't depend on the check framework anymore, we can enable the unit tests
by default. These are built/executed with "make check" only, so it makes no
sense to disable them.
 2013-11-06 10:31:00 +01:00
Martin Willi 6531afb557 automake: Don't use parallel test harness being the default with automake 1.13 
We have no need for the parallel test harness, and we prefer to have the output
of make check on the console
 2013-11-06 10:30:59 +01:00
Martin Willi 35e8eb93a0 unit-tests: Implement testing framework without "check" 2013-11-06 10:30:59 +01:00
Martin Willi 56866ecf3d leak-detective: Call {gm,local}time_r() to allocate static buffer 
On OS X Mavericks, these functions use a static allocation and are hard
to whitelist using other means.
 2013-11-06 10:30:59 +01:00
Martin Willi ef6d78d6ef leak-detective: Register OS X specific hooks just once 
If we initialize libstrongswan more than once in the same process, we may
not register the hooks twice.
 2013-11-06 10:30:59 +01:00
Martin Willi f192526c3f leak-detective: Reset leak list during cleanup 
This resets leak detective state should it get created/destroyed more than once.
 2013-11-06 10:30:59 +01:00
Martin Willi a426851f63 leak-detective: Use callback functions to report leaks and usage information 
This is more flexible than printing reports to a FILE.
 2013-11-06 10:30:59 +01:00
Martin Willi 9ae1140118 unit-tests: Move test suites to its own subfolder 2013-11-06 10:30:58 +01:00
Martin Willi 10900ed7e7 charon-xpc: Set AUTH_RULE_IDENTITY_LOOSE on responder config 
This allows the server to use a different IKE identity as long as the
configured hostname is contained in the certificate.
 2013-11-01 12:05:48 +01:00
Martin Willi b76e96e2ef ike: Don't immediately DPD after deferred DELETEs following IKE_SA rekeying 
Some peers seem to defer DELETEs a few seconds after rekeying the IKE_SA, which
is perfectly valid. For short(er) DPD delays, this leads to the situation where
we send a DPD request during set_state(), but the IKE_SA has no hosts set yet.
Avoid that DPD by resetting the INBOUND timestamp during set_state().
 2013-11-01 11:33:29 +01:00
Martin Willi 7f4a13fffb identification: Properly check length before comparing for binary DN equality 
Fixes CVE-2013-6075.
 2013-10-31 21:57:07 +01:00
Martin Willi ed3eb62723 unit-tests: Additionally do reverse match checking with empty identities 2013-10-31 21:57:07 +01:00
Martin Willi e02b12e374 unit-tests: Test matching against some empty data identities 2013-10-31 21:57:07 +01:00
Martin Willi df12b3a61f unit-tests: Test for equality against some empty data identities 2013-10-31 21:57:07 +01:00
Martin Willi c409be2506 unit-tests: Let identity equality test fail if a->equals(b) != b->equals(a) 2013-10-31 21:57:07 +01:00
Martin Willi d402e87d16 whitelist: Read multiple commands until client closes connection 
This restores the same behavior we had before e11c02c8, and fixes the whitelist
add/remove-from command.
 2013-10-29 14:22:52 +01:00
Martin Willi 1ba47fa565 charon-xpc: Load missing eap-md5 plugin after enabling it 2013-10-28 15:18:11 +01:00
Martin Willi 9f2a4d3315 charon-xpc: Disable warnings about deprecated functions 
This avoids all the deprecated warnings when using OpenSSL functins.
 2013-10-28 14:51:59 +01:00
Martin Willi f5ea7d781f charon-xpc: Avoid -all_load linker flag 
This seems to be not required anymore with the LLVM 5 toolchain.
 2013-10-28 14:51:51 +01:00
Martin Willi a1c2ed8820 charon-xpc: Properly xpc_retain() connections we xpc_release() 2013-10-28 14:51:40 +01:00
Martin Willi 888d8d73ab charon-xpc: Properly cast SA identifier to uintptr representation 2013-10-28 14:51:28 +01:00
Martin Willi 3e40dbb128 charon-xpc: Don’t build against libvstr anymore 
We now have our own printf backend and use it instead of Vstr.
 2013-10-28 14:51:03 +01:00
Martin Willi 6a3cfbdc0d charon-xpc: Build with EAP-MD5 support 2013-10-28 14:49:19 +01:00
Martin Willi 9df621d21f utils: Fix check for fmemopen() fallback implementation 2013-10-24 15:58:49 +02:00
Martin Willi 8465514157 unit-tests: Set sa_len in sockaddr template data, if required 2013-10-24 15:37:21 +02:00
Martin Willi e71c57467c printf-hook-builtin: Don't rely on isinf() return value signedness 
Many systems don't return a negative value for negative infinities; so do
a separate check.
 2013-10-24 15:37:20 +02:00
Martin Willi 5ce3c9b15a watcher: Rebuild fdset when select() fails 
This should make sure we refresh the fdset if a user closes an FD it just
removed. Some selects() seem to complain about the bad FD before signaling the
notification pipe.
 2013-10-24 15:37:20 +02:00
Martin Willi 1a20a22d09 rwlock: Disable thread cancelability while waiting in (fallback) rwlock 
An rwlock wait is not a thread cancellation point. As a canceled thread
would not have released the mutex, the rwlock would have been left in unusable
state.
 2013-10-24 14:53:53 +02:00
Martin Willi 181d071363 rwlock: Don't use buggy pthread_rwlock on OS X 
Recursive read locks don't seem to work properly, at least on 10.9.
 2013-10-24 14:53:47 +02:00
Martin Willi 2077d996a9 utils: Provide a fmemopen(3) fallback using BSD funopen() 2013-10-24 13:17:05 +02:00
Martin Willi b08292a520 semaphore: Support cancellation in wait functions of semaphore fallback 
Semaphore wait functions should be a thread cancellation point, but did
not properly release the mutex in the fallback implementation.
 2013-10-23 16:08:40 +02:00
Martin Willi 47c76c1b05 rwlock: Re-acquire rwlock even if condvar wait times out 
A caller expects that the associated rwlock is held, whether the condvar
gets signaled or the wait times out.
 2013-10-23 11:52:26 +02:00
Martin Willi fc566632da unit-tests: support testing when leak-detective has not been enabled 2013-10-11 15:12:16 +02:00
Martin Willi 390d2b50b3 NEWS: Updates for the ah, libipsec-usestats and printf-hook merges 2013-10-11 11:42:13 +02:00
Martin Willi 5900d6d469 Merge branch 'printf-hook' 
Adds a custom printf hook implementation as a fallback if neither the glibc
style hooks nor vstr is available. This can avoid the Vstr dependency on some
systems at the cost of slower and less complete printf functions.
 2013-10-11 11:12:38 +02:00
Martin Willi 795cbb98c6 printf-hook-builtin: Print NaN/Infinity floating point values as such 2013-10-11 11:06:09 +02:00
Martin Willi 8af9bf70f5 printf-hook-builtin: Correctly round up floating point values 2013-10-11 11:06:09 +02:00
Martin Willi edc7a3d02f printf-hook-builtin: Add some preliminary floating point support 
This minimalistic implementation has no aspiration for completeness or
accuracy, and just provides what we need.
 2013-10-11 11:06:09 +02:00
Martin Willi 7e6a4cdc84 printf-hook-builtin: Support GNU %m specifier 2013-10-11 11:06:09 +02:00
Martin Willi cabe5c0ff4 printf-hook-builtin: Add a new "builtin" backend using its own printf() routines 
Overloads printf C library functions by a self-contained implementation,
based on klibc. Does not yet feature all the required default formatters,
including those for floating point values.
 2013-10-11 11:06:02 +02:00
Martin Willi ebca34d782 printf-hook: Add some basic printf() string/integer test functions 2013-10-11 11:05:37 +02:00
Martin Willi 243048248b printf-hook: Move glibc/vstr printf hook backends to separate files 2013-10-11 11:05:30 +02:00
Martin Willi 11282d0054 Merge branch 'libipsec-usestats' 
Brings SA usage statistics and volume based expiration to libipsec and the
associated kernel-libipsec plugin. Additionally removes any ESPv3 style TFC
padding found in incoming packets.
 2013-10-11 10:25:35 +02:00
Martin Willi d53002f088 libipsec: Enforce byte/packet lifetimes on SAs 2013-10-11 10:23:18 +02:00
Martin Willi 12fdc2b16b kernel-libipsec: Support ESPv3 TFC padding 2013-10-11 10:23:18 +02:00
Martin Willi 293515f95c libipsec: remove extra RFC4303 TFC padding appended to inner payload 2013-10-11 10:23:17 +02:00
Martin Willi d53f9b9637 kernel-libipsec: Support query_sa() to report usage statistics 2013-10-11 10:23:17 +02:00
Martin Willi b08967d6d8 libipsec: Support usage statistics and query_sa() on IPsec SAs 2013-10-11 10:23:17 +02:00
Martin Willi d7083b6541 kernel: Use a time_t to report use time in query_policy() 2013-10-11 10:23:17 +02:00
Martin Willi c99458e94e kernel: Use a time_t to report use time in query_sa() 2013-10-11 10:23:17 +02:00
Martin Willi b59bcba2b3 Merge branch 'ah' 
Brings support for Security Associations integrity protected by the
Authentication Header protocol, both to IKEv1 and IKEv2. Currently only plain
AH is supported, but no (now deprecated) RFC2401 style AH+ESP bundles.
 2013-10-11 10:15:43 +02:00
Martin Willi 5fdbb3c6ad ipsec.conf: Add a description for the new 'ah' keyword. 2013-10-11 10:15:22 +02:00
Martin Willi fa7815538f testing: Add an IKEv1 host2host AH transport mode test case 2013-10-11 10:15:22 +02:00
Martin Willi ef4560121d testing: Add an IKEv1 net2net AH test case 2013-10-11 10:15:22 +02:00
Martin Willi 80a82b8d67 testing: Add an IKEv2 host2host AH transport mode test case 2013-10-11 10:15:22 +02:00
Martin Willi 850bab6d58 testing: Add an IKEv2 net2net AH test case 2013-10-11 10:15:22 +02:00
Martin Willi 71d468ec90 testing: Allow AH packets in default INPUT/OUTPUT chains 2013-10-11 10:15:22 +02:00
Martin Willi 4817595876 updown: Install forwarding rules with the actually used protocol 2013-10-11 10:15:22 +02:00
Martin Willi c5d9b133e0 updown: Add a PLUTO_PROTO variable set to 'ah' or 'esp' 2013-10-11 10:15:21 +02:00
Martin Willi e48e530b44 starter: Reject connections having both 'ah' and 'esp' keywords set 
We currently don't support mixed proposals or bundles, so don't create the
illusion we would.
 2013-10-11 10:15:21 +02:00
Martin Willi 757343d90e ike: Define keylength for aescmac algorithm 2013-10-11 10:15:21 +02:00
Martin Willi a1379e3210 ikev1: Support parsing of AH+IPComp proposals 2013-10-11 10:15:21 +02:00
Martin Willi 25f74be8f9 starter: Remove obsolete 'auth' option 2013-10-11 10:15:21 +02:00
Martin Willi d489e75579 ikev1: Accept more than two certificate payloads 2013-10-11 10:15:21 +02:00
Martin Willi 3771b85806 ikev1: Support en-/decoding of SA payloads with AH algorithms 2013-10-11 10:15:21 +02:00
Martin Willi 44e6aa4fb7 kernel-handler: Whitespace cleanups 2013-10-11 10:15:21 +02:00
Martin Willi f6037b5506 stroke: List proposals in statusall without leading '/' in AH SAs 2013-10-11 10:15:21 +02:00
Martin Willi 4bf92306eb ikev1: Delete quick modes with the negotiated SA protocol 2013-10-11 10:15:21 +02:00
Martin Willi 5d569e07fd trap-manager: Install trap with SA protocol of the first configured proposal 2013-10-11 10:15:21 +02:00
Martin Willi 21b096f3b8 child-sa: Save protocol during SPI allocation 
This allows us to properly delete the incomplete SA with the correct protocol
should negotiation fail.
 2013-10-11 10:15:21 +02:00
Martin Willi 908fe1632d ikev1: Negotiate SPI with the first/negotiated proposal protocol 2013-10-11 10:15:21 +02:00
Martin Willi cdab8630d9 ikev2: Allocate SPI with the protocol of the first/negotiated proposal 2013-10-11 10:15:21 +02:00
Martin Willi f0c59e1cf8 proposal: Strip redundant integrity algos for ESP proposals only 2013-10-11 10:15:21 +02:00
Martin Willi 0576412989 stroke: Configure proposal with AH protocol if 'ah' option set 2013-10-11 10:15:20 +02:00
Martin Willi a07b97e804 starter: Add an 'ah' keyword for Authentication Header Security Associations 2013-10-11 10:15:20 +02:00
Martin Willi d2e4dd75b7 ikev1: Accept reauthentication attempts with a keep unique policy from same host 
When we have a "keep" unique policy in place, we have to be less strict in
rejecting Main/Aggressive Modes to enforce it. If the host/port equals to
that of an existing ISAKMP SA, we assume it is a reauthentication attempt
and accept the new SA (to replace the old).
 2013-09-30 13:51:12 +02:00
Martin Willi 9c19d7ca31 ikev1: Don't log a reauthentication detection message if no children adopted 
When a replace unique policy is in place, the children get adopted during
the uniqueness check. In this case the message is just misleading.
 2013-09-30 13:51:11 +02:00
Martin Willi ee99f37ecc ikev1: Delay a potential delete for a duplicate IKE_SA having a replace policy 
Sending a DELETE for the replaced SA immediately is problematic during
reauthentication, as the peer might have associated the Quick Modes to the
old SA, and also delete them.

With this change the delete for the old ISAKMP SA is usually omitted, as it
is gets implicitly deleted by the reauth.
 2013-09-30 13:51:11 +02:00
Martin Willi 25260a290d .gitignore: Add .dirstamp files touched by automake 2013-09-13 14:12:35 +02:00
Martin Willi 2b84ccd6a6 libipsec: fix memory management when cloning ip_packet 2013-09-13 13:56:44 +02:00
Martin Willi 96136a1229 libipsec: check for a policy with the reqid of the SA on decapsulation 
To prevent a client from sending a packet with a source address of a different
client, we require a policy bound via reqid to the decapsulating SA.
 2013-09-13 13:56:43 +02:00
Martin Willi 791fde1669 stroke: don't remove a matching peer config if used by other child configs 
When configurations get merged during add, we should not remove peer configs
if other connection entries use the same peer config.
 2013-09-13 13:56:31 +02:00
Martin Willi 38fb8e4ed5 NEWS: 5.1.1 update for merged branches 2013-09-04 11:06:58 +02:00
Martin Willi 1fd5c7fbac load-tester: support extended traffic selector syntax, as in leftsubnet 
In addition the initiator may use %unique as port, using a distinct port for
each connection, starting from 1025.
 2013-09-04 10:49:48 +02:00
Martin Willi 47b4a51402 load-tester: add an option to test transport/beet connections 2013-09-04 10:49:48 +02:00
Martin Willi 60fcbb8ba8 Merge branch 'ike-address-ranges' 
Adds support for multiple subnets and address ranges in left/right ipsec.conf
options. As responder the connection is acceptable if the address is in one of
the ranges/subnets. To initiate connections, at least one single IP or hostname
is required for the peer address.
 2013-09-04 10:43:35 +02:00
Martin Willi 6301ec0ac5 man: add support for multiple addresses/ranges/subnets in ipsec.conf left= 2013-09-04 10:38:37 +02:00
Martin Willi 3070697f9f ike: support multiple addresses, ranges and subnets in IKE address config 
Replace the allowany semantic by a more powerful subnet and IP range matching.
Multiple addresses, DNS names, subnets and ranges can be specified in a comma
separated list. Initiators ignore the ranges/subnets, responders match
configurations against all addresses, ranges and subnets.
 2013-09-04 10:38:37 +02:00
Martin Willi beffdc6ab8 ike-cfg: remove the to be obsoleted allow any parameter in get_my/other_addr 2013-09-04 10:38:37 +02:00
Martin Willi 62282ec0ed backends: use ike_cfg host matching functions 2013-09-04 10:38:37 +02:00
Martin Willi 6f666192bb ike-cfg: add methods to match a host against configured local/remote addresses 2013-09-04 10:38:37 +02:00
Martin Willi 7446fa2860 trap-manager: use ike_cfg resolver functions 2013-09-04 10:38:37 +02:00
Martin Willi 0edce68767 ike-sa: use ike_cfg resolver functions 2013-09-04 10:38:36 +02:00
Martin Willi e743275cae ike-cfg: add a method to resolve local/remote hosts with port 2013-09-04 10:38:36 +02:00