denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
11,655 Commits 1 Branch 0 Tags
16748bdff7c9aa9a3a75c57f0aa875b95ba55574
Commit Graph
2456 Commits
Author SHA1 Message Date
Tobias Brunner 16748bdff7 socket-dynamic: Properly initialize IPv6 address 2013-07-24 16:17:22 +02:00
Tobias Brunner 0c76d820dc tnc-ifmap: Use proper cast for length when using %.*s 2013-07-24 10:54:47 +02:00
Tobias Brunner 62293ed271 coupling: Fix call to call_hook() 2013-07-22 17:53:56 +02:00
Tobias Brunner a14d907e33 tnc-pdp: Fix reading port setting from strongswan.conf 2013-07-22 17:43:54 +02:00
Martin Willi 2fa92ad256 proposal: correctly enumerate registered AEADs to build default IKE proposal 
AEADs are not returned (anymore) with the encryption enumerator.
 2013-07-19 15:05:17 +02:00
Tobias Brunner 0ceb288815 Fix various API doc issues and typos 
Partially based on an old patch by Adrian-Ken Rueegsegger.
 2013-07-18 18:30:36 +02:00
Martin Willi b4b3959b22 stream-service: move CAP_CHOWN check from plugins to service constructor 
A plugin service can be a TCP socket now, so it does not make much sense
to strictly check for CAP_CHOWN.
 2013-07-18 16:00:31 +02:00
Martin Willi 8fc89db7b6 certexpire: add an option to enforce exporting trustchains having a private key 2013-07-18 16:00:31 +02:00
Martin Willi 868abd0626 error-notify: catch and forward some alerts related to certificate validation 2013-07-18 16:00:30 +02:00
Martin Willi 58750670cf bus: raise certificate validation alerts using credential manager hook 2013-07-18 16:00:30 +02:00
Martin Willi 4d7a762871 credmgr: introduce a hook function to catch trust chain validation errors 2013-07-18 16:00:30 +02:00
Martin Willi f7cff7fac4 lookip: double size of id field in message 2013-07-18 16:00:30 +02:00
Martin Willi f33d1d503f error-notify: increase size of string/identity fields in messages 2013-07-18 16:00:30 +02:00
Martin Willi 0a35ae781d whitelist: use a read-copy when listing entries 
While this requires a little more overhead, we can free the lock should the
stream block, allowing other threads to add/remove entries.
 2013-07-18 16:00:30 +02:00
Martin Willi 0ccc5bb216 whitelist: fix error handling when creating the socket fails 2013-07-18 16:00:30 +02:00
Martin Willi d3278c1f73 lookip: fix error handling when creating the socket fails 2013-07-18 16:00:30 +02:00
Martin Willi cfdb5f4855 error-notify: fix error handling when creating the socket fails 2013-07-18 16:00:30 +02:00
Martin Willi 5f755cef46 eap-radius: use watcher instead of receiver thread on DAE socket 2013-07-18 16:00:30 +02:00
Martin Willi c0db5d3845 dhcp: use watcher instead of dedicated receiver thread 2013-07-18 16:00:30 +02:00
Martin Willi 17028e29c2 farp: use watcher instead of dedicated receiver thread 2013-07-18 16:00:29 +02:00
Martin Willi 73da4ed849 load-tester: use a stream service to dispatch control connections 2013-07-18 16:00:29 +02:00
Martin Willi e11c02c8f1 whitelist: use a stream service to accept client connections 
Use SOCK_STREAM, as we don't have SOCK_SEQPACKET on TCP. To have network
transparency, the message now uses network byte order.
 2013-07-18 16:00:29 +02:00
Martin Willi 091d0afa21 lookip: use stream service with async I/O dispatching 
Now uses SOCK_STREAM, as SOCK_SEQPACKET is not available over TCP. To have
network transparency, the message now uses network byte order.
 2013-07-18 16:00:29 +02:00
Martin Willi c2a6fdf286 error-notify: use a stream service to accept client connections 
As TCP does not have SOCK_SEQPACKET, we now use SOCK_STREAM for the error-notify
socket. To have network transparency, the message now uses network byte order.
 2013-07-18 16:00:29 +02:00
Martin Willi 83faec5abe duplicheck: use a stream service to accept client connections 
As we can't use SOCK_SEQPACKET over TCP, we now have to provide message
boundaries ourselves. We do this by appending a 16-bit length header to each
sent duplicate identity.
 2013-07-18 16:00:29 +02:00
Martin Willi 065907b99d stroke: use a stream service to handle stroke requests 2013-07-18 16:00:29 +02:00
Tobias Brunner 29bdfb4086 kernel-libipsec: Fail route installation if remote TS matches peer 2013-07-18 15:41:13 +02:00
Tobias Brunner dfc9902013 capabilities: Some plugins don't actually require capabilities at runtime 2013-07-18 15:25:35 +02:00
Martin Willi 19cb07b890 automake: replace INCLUDES by AM_CPPFLAGS 
INCLUDES are now deprecated and throw warnings when using automake 1.13.
We now also differentiate AM_CPPFLAGS and AM_CFLAGS, where includes and
defines are passed to AM_CPPFLAGS only.
 2013-07-18 14:59:19 +02:00
Martin Willi 2e9e2fa848 eap-sim-pcsc: fix compiler warning 2013-07-18 14:59:19 +02:00
Martin Willi 61177388bd syslog: setlogmask() to include LOG_INFO 
LOG_INFO seems to be excluded by default on some systems (OS X).
 2013-07-18 12:17:54 +02:00
Tobias Brunner 07a9d5c91a ike: Fix reestablishing SAs if no child-creating tasks are queued 2013-07-18 10:40:08 +02:00
Martin Willi 2b0c8ee37d ike-sa: uninstall CHILD_SAs before removing virtual IPs 
a3854d83 changed cleanup order. But we should remove CHILD_SAs first, as routes
for CHILD_SAs might get deleted while removing virtual IPs, resulting in
an error when a CHILD_SA tries to uninstall its route.
 2013-07-18 10:35:38 +02:00
Tobias Brunner 79b6ead1e4 unity: Replicate default behavior if no UNITY_SPLIT_INCLUDE attributes were received 2013-07-17 18:23:57 +02:00
Tobias Brunner 56b0fac8c9 unity: Allow UNITY_LOCAL_LAN to be longer than 8 bytes 2013-07-17 18:23:57 +02:00
Tobias Brunner c7d0b80abb unity: Fix memory leak in provider 2013-07-17 18:23:57 +02:00
Tobias Brunner a9ffb48f21 ikev1: Reestablish IKE_SA/CHILD_SAs if it gets deleted by the peer 
We call ike_sa_t.reestablish() so the IKE_SA is only recreated if any
CHILD_SA requires it.
 2013-07-17 18:16:59 +02:00
Tobias Brunner 68db844f99 ike: Migrate queued CHILD_SA-creating tasks when reestablishing an IKE_SA 2013-07-17 18:16:58 +02:00
Oliver Smith b79fdab878 ikev1: Support closeaction of CHILD_SA. 
When a CHILD_SA is closed in IKEv1, if it is not being rekeyed and
closeaction has been set, we can now perform a restart or hold as is
currently done for IKEv2.
 2013-07-17 18:16:58 +02:00
Tobias Brunner 84693a3d79 linked-list: Remove barely used has_more() method 
This required some refactoring when handling encrypted payloads.

Also changed log messages so that "encrypted payload" is logged instead
of "encryption payload" (even if we internally still call it that) as
that's the name used in RFC 5996.
 2013-07-17 17:42:53 +02:00
Martin Willi c6f1d0de94 child-sa: refactor proxy transport mode address lookup 2013-07-17 17:20:18 +02:00
Martin Willi 2745ae264a child-sa: replace traffic selector lists by arrays 
Saves up to another 0.5KB of memory per CHILD_SA.
 2013-07-17 17:20:18 +02:00
Martin Willi 553bb78730 child-sa: replace get_traffic_selectors() with create_ts_enumerator() 
Not directly returning a linked list allows us to change the internals of
the CHILD_SA transparently.
 2013-07-17 17:20:18 +02:00
Martin Willi 6207fadb6c ikev2: replace linked lists by arrays in task manager 
Eliminates another three lists, 0.5KB per IKE_SA.
 2013-07-17 17:20:18 +02:00
Martin Willi c907b57f56 proposal: use array to store proposal list 
Removes another two linked lists (0.5KB) of memory per IKE/CHILD_SA pair.
 2013-07-17 17:20:18 +02:00
Martin Willi 5cd64f979c proposal: use a single list to store all transforms 
Beside that it makes the code actually simpler, it reduces the number of lists
stored by each IKE_SA and each CHILD_SA by 4, which can be up to 1KB per SA.
 2013-07-17 17:20:17 +02:00
Martin Willi 893da0411f ike-sa: use arrays instead of linked lists in long lived collections 
This saves about 1.5KB of memory per IKE_SA.
 2013-07-17 17:20:17 +02:00
Tobias Brunner f067348134 kernel-libipsec: Log error if no local address is found when installing routes 2013-07-15 14:37:31 +02:00
Tobias Brunner 591f923134 stroke: Add certificates extracted from PKCS#12 files to correct credential set 
Only keys and shared secrets are moved from the temporary credential set after
loading all secrets.
 2013-07-15 10:59:13 +02:00
Tobias Brunner d27f225d9a Use strpfx() helper where appropriate 2013-07-08 18:49:30 +02:00