denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
11,566 Commits 1 Branch 0 Tags
2d5a20061a44bf3fe5fe8c6c9607fc4c95330f00
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Martin Willi 2d5a20061a soup: omit deprecated g_type_init() when using >= GLIB 2.36 2013-07-18 14:20:57 +02:00
Martin Willi b146ecbc4e libfast: cancel thread if it fails to accept fcgi sessions 2013-07-18 12:24:38 +02:00
Martin Willi 890f20989f libfast: add a fast_ prefix to all classes, avoiding namespace clashes 2013-07-18 12:24:38 +02:00
Martin Willi 569d114de8 Merge branch 'charon-xpc' 
Implement a charon daemon controlled by the Apple specific XPC mechanism,
acting as a backend for a yet to build unprivileged GUI. The keychain plugin
coming with this merge provides certificates from the OS X keychain service.
 2013-07-18 12:18:32 +02:00
Martin Willi b9c47eae06 xpc: allow easy copy & pase of ./configure instructions 2013-07-18 12:17:56 +02:00
Martin Willi 7f1adbe94e xpc: use -idirafter to build against openssl headers from /usr/include 2013-07-18 12:17:56 +02:00
Martin Willi 06e8712cb3 xpc: forward some risen alerts over XPC to App 2013-07-18 12:17:56 +02:00
Martin Willi e7ee45ef38 xpc: enable close_ike_on_child_failure 2013-07-18 12:17:56 +02:00
Martin Willi e37c5d46d3 xpc: send a "connecting" event when establishing a connection starts 2013-07-18 12:17:56 +02:00
Martin Willi 3ffa310c44 xpc: use osx-attr plugin to install configuration attributes 2013-07-18 12:17:56 +02:00
Martin Willi c7ac7f92e9 xpc: update README with new events, markdown style fixes 2013-07-18 12:17:55 +02:00
Martin Willi 4edcc86149 xpc: send child_updown events over XPC channel 2013-07-18 12:17:55 +02:00
Martin Willi d60c8d2c74 xpc: support termination of IKE_SAs using XPC RPC on connection channel 2013-07-18 12:17:55 +02:00
Martin Willi 790ad9e677 xpc: move XPC RPC reply creation to command dispatching 2013-07-18 12:17:55 +02:00
Martin Willi a0c125eacb xpc: terminate daemon when last XPC connection to App gone 2013-07-18 12:17:55 +02:00
Martin Willi 6aae6268d7 xpc: fix some refcounting issues related to XPC connections 2013-07-18 12:17:55 +02:00
Martin Willi 22bffc647d xpc: no need to clear channel table, they are bound to IKE_SA lifetime 2013-07-18 12:17:55 +02:00
Martin Willi 1a3f71d97a xpc: add support for logging over XPC channels 2013-07-18 12:17:55 +02:00
Martin Willi fbc89786b5 xpc: don't warn about pointer signedness mismatch (-Wno-pointer-sign) 2013-07-18 12:17:55 +02:00
Martin Willi dcf8a3c78b xpc: add a description of the basic XPC protocol to README 2013-07-18 12:17:55 +02:00
Martin Willi d5966e71e9 xpc: use the same XPC message "type" mechanism on Mach service as on channels 2013-07-18 12:17:55 +02:00
Martin Willi 39d15dde67 xpc: ask App for passwords using connection specific channel 2013-07-18 12:17:55 +02:00
Martin Willi 8279ce99c4 xpc: use IKE_SA specific XPC return channels for further communication 2013-07-18 12:17:55 +02:00
Martin Willi bc74e18223 xpc: don't send certificate requests, there are too many when using keychain 2013-07-18 12:17:55 +02:00
Martin Willi 5016370390 xpc: build with support for the keychain plugin 2013-07-18 12:17:55 +02:00
Martin Willi e73a653451 xpc: add support for initiate simple IKEv2 EAP connections 2013-07-18 12:17:54 +02:00
Martin Willi 3dcc9d7aa7 xpc: move dispatching to dedicated class, using dedicated thread 2013-07-18 12:17:54 +02:00
Martin Willi 4204d1d71a xpc: use non-inlining variant of vstr, compiler does not like it 2013-07-18 12:17:54 +02:00
Martin Willi 6f8c626b81 xpc: add Xcode project for a charon controlled through XPC 2013-07-18 12:17:54 +02:00
Martin Willi 61177388bd syslog: setlogmask() to include LOG_INFO 
LOG_INFO seems to be excluded by default on some systems (OS X).
 2013-07-18 12:17:54 +02:00
Martin Willi 55dacbfac2 keychain: flush certificate cache after reloading System keychain 2013-07-18 12:17:54 +02:00
Martin Willi 57dce77ba6 keychain: monitor changes in the system keychain, reload when necessary 2013-07-18 12:17:54 +02:00
Martin Willi dcd8bdde4f keychain: use SearchCopyNext keychain enumeration for System certs as well 
SecItemCopyMatching seems to be problematic regarding memory management. And
as there does not seem to be a good alternative to enumerate the System Roots
keychain using the SecItemCopyMatching API, we stick to the deprecated
enumeration functions for now.
 2013-07-18 12:17:54 +02:00
Martin Willi 0bdd453392 keychain: load certificates from System Roots Keychain 2013-07-18 12:17:54 +02:00
Martin Willi bc6c7bf39e keychain: load certificates only once during startup, improving performance 2013-07-18 12:17:54 +02:00
Martin Willi 6f00ddb90c keychain: support on-the-fly enumeration of trusted/untrusted certificates 2013-07-18 12:17:54 +02:00
Martin Willi 7b8edabd8a keychain: add a stub for a credential plugin using OS X Keychain Services 2013-07-18 12:17:54 +02:00
Martin Willi 5d36f04ee2 credmgr: stop querying for secrets once we get a perfect match 2013-07-18 12:17:54 +02:00
Martin Willi 69039e83f8 credmgr: don't use pointers for id_match_t enum values 2013-07-18 12:17:54 +02:00
Martin Willi c3e7b3de0b openssl: parse X.509 extended key usage from extension parsing loop 
Otherwise parsing gets aborted if unknown critical extensions are handled as
error.
 2013-07-18 12:17:53 +02:00
Martin Willi 3f55f203ee openssl: show which critical X.509 extension is not supported 2013-07-18 12:17:53 +02:00
Martin Willi 437a6feb07 hashtable: add common hashtable hash/equals functions for pointer/string keys 2013-07-18 12:17:53 +02:00
Martin Willi 01c0267778 thread: implicitly create thread_t if an external thread calls thread_current() 2013-07-18 12:17:53 +02:00
Martin Willi 2b0c8ee37d ike-sa: uninstall CHILD_SAs before removing virtual IPs 
a3854d83 changed cleanup order. But we should remove CHILD_SAs first, as routes
for CHILD_SAs might get deleted while removing virtual IPs, resulting in
an error when a CHILD_SA tries to uninstall its route.
 2013-07-18 10:35:38 +02:00
Martin Willi 20ea35679e Merge branch 'array' 
Introduces a new lightweight array collection having minimal memory overhead.
The new class replaces various linked lists that are used during the full
lifetime of an SA, reducing memory requirements by about 5KB or more per tunnel.
 2013-07-17 17:28:18 +02:00
Martin Willi c6f1d0de94 child-sa: refactor proxy transport mode address lookup 2013-07-17 17:20:18 +02:00
Martin Willi 2745ae264a child-sa: replace traffic selector lists by arrays 
Saves up to another 0.5KB of memory per CHILD_SA.
 2013-07-17 17:20:18 +02:00
Martin Willi 553bb78730 child-sa: replace get_traffic_selectors() with create_ts_enumerator() 
Not directly returning a linked list allows us to change the internals of
the CHILD_SA transparently.
 2013-07-17 17:20:18 +02:00
Martin Willi 6207fadb6c ikev2: replace linked lists by arrays in task manager 
Eliminates another three lists, 0.5KB per IKE_SA.
 2013-07-17 17:20:18 +02:00
Martin Willi 926776ec80 auth-cfg: use array instead of linked list 
Saves another 4 linked lists (1KB) per IKE_SA
 2013-07-17 17:20:18 +02:00
Martin Willi c907b57f56 proposal: use array to store proposal list 
Removes another two linked lists (0.5KB) of memory per IKE/CHILD_SA pair.
 2013-07-17 17:20:18 +02:00
Martin Willi 5cd64f979c proposal: use a single list to store all transforms 
Beside that it makes the code actually simpler, it reduces the number of lists
stored by each IKE_SA and each CHILD_SA by 4, which can be up to 1KB per SA.
 2013-07-17 17:20:17 +02:00
Martin Willi 893da0411f ike-sa: use arrays instead of linked lists in long lived collections 
This saves about 1.5KB of memory per IKE_SA.
 2013-07-17 17:20:17 +02:00
Martin Willi 4730c4b32b unit-tests: implement tests for array collection 2013-07-17 17:20:17 +02:00
Martin Willi 2621ff4d40 array: introduce an array collection storing elements very efficiently 
Currently we use the very versatile linked-list collection to store elements
with variable count. This is fine, but very inefficient: Due to the many
methods in the linked list, on 64-bit platforms an empty list alone is more
than 200 bytes. As we currently have about 50 lists per IKE_SA/CHILD_SA pair,
this takes up to 10KB just for managing the empty lists. This is about the
half of memory used by an IKE_SA/CHILD_SA pair, and obviously way too much.

The new array type is not an object, but a collection of functions on an
abstract type.

The following lists are per IKE_SA and should be considered for a replacement
with more efficient arrays (this uses load-testers on-demand created dynamic
configurations, other scenarios have different lists):

14 -> ike_sa_create() @ src/libcharon/sa/ike_sa.c:2198
10 -> auth_cfg_create() @ src/libstrongswan/credentials/auth_cfg.c:1088
 6 -> task_manager_v2_create() @ src/libcharon/sa/ikev2/task_manager_v2.c:1505
 6 -> proposal_create() @ src/libcharon/config/proposal.c:592
 5 -> peer_cfg_create() @ src/libcharon/config/peer_cfg.c:657
 4 -> child_sa_create() @ src/libcharon/sa/child_sa.c:1090
 2 -> child_cfg_create() @ src/libcharon/config/child_cfg.c:536
 1 -> ike_cfg_create() @ src/libcharon/config/ike_cfg.c:330
 1 -> put_connected_peers() @ src/libcharon/sa/ike_sa_manager.c:854
 2013-07-17 17:20:17 +02:00
Martin Willi 1e54e40f5d leak-detective: remove hdr entry when reallocating zero bytes 2013-07-12 20:00:16 +02:00
Martin Willi c93cf85356 leak-detective: print total of allocated/leaked bytes in usage/report 2013-07-12 20:00:14 +02:00
Martin Willi 783b55cc5c dumm: add include for in.h, if_bridge.h now uses struct in6_addr 2013-07-12 18:21:24 +02:00
Martin Willi 81959e6406 leak-detective: add a usage threshold option based on the number of allocations 2013-07-10 17:28:45 +02:00
Martin Willi 82d0317be6 leak-detective: set_state() only affects the calling thread 
The only user (bfd backtraces) is fine with that, and we really should not
mess the enable flag while doing allocations with other threads.
 2013-07-10 17:28:32 +02:00
Martin Willi f960b39061 leak-detective: take a copy of backtrace while printing traces 
As we don't want to hold the lock, we must make sure backtraces keep valid
while printing them.
 2013-07-10 17:28:24 +02:00
Martin Willi d9c459e855 backtrace: add a clone() method 2013-07-10 17:28:18 +02:00
Martin Willi 3b26f04cf4 leak-detective: remove hdr from the allocation list during realloc() 
If realloc moves an allocation, the original allocation gets freed. We
therefore must remove the hdr from the list, as it is invalid. We can add it
afterwards once it has been updated, allowing us to unlock the list during
reallocation.
 2013-07-10 16:37:08 +02:00
Martin Willi 324b90cc46 openssl: RAND_pseudo_bytes() returns 0 if bytes are not cryptographically strong 
For our purposes with RNG_WEAK this is fine, so accept a zero return value.
 2013-07-04 11:09:54 +02:00
Martin Willi 282e4d2c7c eap-radius: fix add_attribute/framed_ip method signatures 2013-07-01 11:53:52 +02:00
Martin Willi a650242643 ikev2: keep the CHILD_SA we delete as initiator in the list to destroy 
If the responder not correctly send the correct protocol or SPI in the delete
response, we should remove the CHILD_SA regardless.
 2013-06-25 14:03:51 +02:00
Martin Willi 45dcf4df57 osx-attr: add plugin installing config attributes using SystemConfiguration 
Currently installs DNS servers only, by prepending IP addresses to the
DNS configuration of the primary networking service.
 2013-06-21 17:03:22 +02:00
Martin Willi 9d6a147c81 Merge branch 'unit-tests-ecdsa' 
Adds support for testing plugin functionality to test-runner. Introduces some
good/bad tests for ECDSA/RSA which would have caught those RSA/ECDSA signature
vulnerabilities.
 2013-06-21 10:53:23 +02:00
Martin Willi 092550b03a leak-detective: (re-)whitelist some OpenSSL functions 
Some static allocations in plugins won't get freed, because in the test case
process the plugins are not destroyed. If a plugin would clean up allocations
done while just using the plugin, these show up as leak in the child process,
letting tests fail.
 2013-06-21 10:53:23 +02:00
Martin Willi ef687db734 unit-tests: load plugins in test-runner from build directory 2013-06-21 10:53:23 +02:00
Martin Willi b950fc48da unit-tests: link test-runner against -lpthread 2013-06-21 10:53:23 +02:00
Martin Willi 1ffdb4f3d0 unit-tester: remove obsolete rsa_gen test, now covered in unit-tests 2013-06-21 10:53:23 +02:00
Martin Willi df1a1a0901 unit-tests: add RSA test cases, very similar to ECDSA 2013-06-21 10:53:23 +02:00
Martin Willi eabf4af0f8 unit-tests: test with /dev/urandom if random plugin is in use 2013-06-21 10:53:22 +02:00
Martin Willi d0c09c84a5 unit-tests: test supported ECDSA schemes only 2013-06-21 10:53:22 +02:00
Martin Willi 2bedb0f270 Move test-runners has_feature() function to plugin loader 2013-06-21 10:53:22 +02:00
Martin Willi df76881f11 unit-tests: enforce CET/CEST timezone to properly test non-UTC time formatting 2013-06-21 10:53:22 +02:00
Martin Willi 44886a0667 unit-tests: don't use ck_assert() to test a cleared chunk, as it allocates data 
The new allocation might be in the freed area, affecting the test result.
 2013-06-21 10:53:22 +02:00
Martin Willi 52bff13848 unit-tests: define 64-bit constats with ULL, fixing compiler warning on 32-bit 2013-06-21 10:53:22 +02:00
Martin Willi a5b63a3e5c Limit cleanup of .gc{no,da} files to src and scripts subfolders 
Other folders in the build tree might not be related to the strongSwan tree,
or are not even accessible.
 2013-06-21 10:53:21 +02:00
Martin Willi a88cab095d unit-tests: test some zeroed ECDSA signatures that never should succeed 2013-06-21 10:53:21 +02:00
Martin Willi 7e23f53242 unit-tests: perform signing/validation with keys ECDSA keys generated or loaded 2013-06-21 10:53:21 +02:00
Martin Willi eabb0befdc unit-tests: add an ECDSA test case loading keys 2013-06-21 10:53:21 +02:00
Martin Willi d18ff88faf unit-tests: perform a first ECDSA test case if ECDSA is supported 2013-06-21 10:53:21 +02:00
Martin Willi 200f38ad4c unit-tests: add a helper function checking if a plugin feature is available 2013-06-21 10:53:21 +02:00
Martin Willi cb1745f7a6 unit-tests: add a test case checking if all test vectors have been passed 2013-06-21 10:53:20 +02:00
Martin Willi e9e4759733 crypto-factory: count the number of test vector failures during registration 2013-06-21 10:53:20 +02:00
Martin Willi 3714979427 unit-tests: load all libstrongswan plugins in test-runner 2013-06-21 10:53:20 +02:00
Martin Willi 888dbac50e ikev2: use protocol of selected proposal to delete a failed CHILD_SA 
Depending on the failure, the protocol might not yet be set on the CHILD_SA.
 2013-06-20 12:09:46 +02:00
Martin Willi 47ec2e407b charon-cmd: use a copy of pid in initiate callback 
When cancelling a connection that gets established, cmd_connection_t gets
freed before terminate() is called. This results in kill()ing invalid PID.
 2013-06-20 11:02:28 +02:00
Martin Willi e044a1a9e5 charon-cmd: add IKEv1 aggressive mode profiles 2013-06-20 11:01:37 +02:00
Martin Willi 40b0a15cb5 NEWS: Add first bunch of 5.1.0 highlights 2013-06-20 10:29:25 +02:00
Martin Willi 4e8142e8e9 Merge branch 'nat-transport' 
Enable transport mode in NAT situations when using IKEv2. Additionally brings
an extended leftsubnet format, where each subnet can take a separate protocol
and port.
 2013-06-19 16:36:27 +02:00
Martin Willi 24df067810 man: update ipsec.conf.5, describing new proto/port definition within leftsubnet 2013-06-19 16:36:01 +02:00
Martin Willi 483a258ad8 stroke: support %dynamic in left/rightsubnet for dynamic selectors 
This has the same meaning as omitting left/rightsubnet, i.e. replace it
by the IKE address. Supporting %dynamic allows configurations with multiple
dynamic selectors in a left/rightsubnet, each with potentially different
proto/port selectors.
 2013-06-19 16:36:01 +02:00
Martin Willi 3d1af879d2 kernel-netlink: install selectors on SA for transport/BEET mode without proto/port 
If a transport/BEET SA has different selectors for different proto/ports,
installing just the proto/port of the first SA would break any additional
selector.
 2013-06-19 16:36:01 +02:00
Martin Willi 4a7c29bf02 stroke: support a specific proto/port for each net defined in left/rightsubnet 2013-06-19 16:36:01 +02:00
Martin Willi ad5ad02ade ikev2: properly fall back to tunnel mode if transport/BEET mode not configured 2013-06-19 16:36:01 +02:00
Martin Willi 975457c4d8 ikev2: support transport mode over NAT 2013-06-19 16:36:01 +02:00
Martin Willi 4f88ad669a Merge branch 'consistent-reqid' 
Checks if a trap policy exists when installing a CHILD_SA as responder,
reuse that reqid and keeping the trap untouched. This makes auto=route on
both sides more reliable.

In addition, we no prevent to refcount an existing policy if the reqid differs;
this should not happen anymore. We now can properly reject new CHILD_SAs in
such conflicts, instead of silently breaking an existing policy.
 2013-06-19 16:31:06 +02:00