denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
10,985 Commits 1 Branch 0 Tags
2d8a01d1c60ab84c0f9185bd7c18e8aa9738221c
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Martin Willi 2d8a01d1c6 host: add a netmask constructor taking the number of network bits 2013-05-06 16:10:11 +02:00
Martin Willi 4dc83e9fac host: remove unused host_t.get_differences() method 2013-05-06 16:10:11 +02:00
Martin Willi 7749eb0d2a host: print %#H format specifiers not as %any, but with the port 2013-05-06 16:10:11 +02:00
Martin Willi 344a4e54be host: initialize sockaddr->sa_len if it is available 2013-05-06 16:10:11 +02:00
Martin Willi 60ed88b2c7 child-sa: pass traffic selector to add_sa() regardless of IPsec mode 
This lets the kernel backend decide what to do with it, and in fact all kernel
interfaces already handle this correctly.
 2013-05-06 16:10:11 +02:00
Martin Willi dc35d097b3 socket-default: to bind to one dynamic port on OS X, create v4 socket before v6 
It seems that the order of binding sockets of different address families to the
same dynamic port must be v6-before-v4 on Linux, but v4-before-v6 on OS X.
 2013-05-06 16:10:11 +02:00
Martin Willi a30727fe2b socket-default: refactor socket pair opening to a function 2013-05-06 16:10:11 +02:00
Martin Willi 6948df3220 socket-default: Don't try to send packet if we haven't a socket for given family 2013-05-06 16:10:10 +02:00
Martin Willi e9326eba13 socket-default: Use -1 if socket is not available, as 0 is actually a valid fd 2013-05-06 16:10:10 +02:00
Martin Willi b0ccd14f2a semaphore: similar to thread_create(), semaphore_create() is used by Mach 
The compiler spits no warning, but the wrong symbol is used when calling
semaphore_create() from strongSwan. Override the name with a #define to force
the use of our semaphore_create().
 2013-05-06 16:06:48 +02:00
Martin Willi 0c586c0099 .gitignore: add OS X .DS_Store files 2013-05-06 16:06:48 +02:00
Martin Willi 922e2d1d62 Merge branch 'charon-cmd' 
Introduce a simple IKEv1/IKEv2 command line client, charon-cmd. It does
not need any configuration files at all, but takes a few command line arguments
to establish connections as a road warrior.
 2013-05-06 16:01:25 +02:00
Martin Willi 68fc0fe32e charon-cmd: add an option to set a different server identity 2013-05-06 15:54:35 +02:00
Martin Willi a0f6f39343 proposals: try next if IKEv2 algorithm could not be mapped to IKEv1 2013-05-06 15:54:32 +02:00
Martin Willi d2e2b9a2da charon-cmd: add support for different IKEv1/IKEv2 authentication profiles 2013-05-06 15:54:31 +02:00
Martin Willi d6b0c28b25 charon-cmd: support multi-line help text for each option in usage 2013-05-06 15:54:29 +02:00
Martin Willi 8e53682cd9 charon-cmd: add --local/remote-ts options to set traffic selectors 2013-05-06 15:54:27 +02:00
Martin Willi 7a86bccd50 charon-cmd: Use dynamic ports with the socket-default plugin 2013-05-06 15:28:27 +02:00
Martin Willi 69333acee0 settings: Add a set_default_str() to set a different default for a key 
The value is set only if it is not configured in strongswan.conf or has
not been set() otherwise.
 2013-05-06 15:28:27 +02:00
Martin Willi 3ca58c32be charon-cmd: prompt for EAP passwords on-demand using a callback credential set 2013-05-06 15:28:27 +02:00
Martin Willi b48941ae16 charon-cmd: authenticate with EAP if no private key is given 2013-05-06 15:28:27 +02:00
Martin Willi 7bcd96e43d charon-cmd: pass arguments to all handlers, even if already handled 2013-05-06 15:28:27 +02:00
Martin Willi 9dfd9275f0 charon-cmd: build long_opts only once when reading arguments in charon-cmd 2013-05-06 15:28:27 +02:00
Martin Willi f0749552a6 charon-cmd: add support for using dynamic ports in charon-cmd 2013-05-06 15:28:26 +02:00
Martin Willi d3874008e8 socket-dynamic: when sending from port zero, allocate a free port dynamically 2013-05-06 15:28:26 +02:00
Martin Willi 5e9144a21f controller: clean up job data if a thread gets cancelled waiting in a function 
Controller functions are thread cancellation points, so register a cancellation
handler cleaning up job data.
 2013-05-06 15:28:26 +02:00
Martin Willi 2baa7bbedb charon-cmd: load certificates and RSA private keys 2013-05-06 15:28:26 +02:00
Martin Willi 78d7a0f7e2 charon-cmd: add a connection object and its initiation to charon-cmd 2013-05-06 15:28:26 +02:00
Martin Willi be44723de0 charon-cmd: move command line options to separate file, obsolete short options 2013-05-06 15:28:26 +02:00
Martin Willi 1fed10beb2 charon-cmd: add a stub for charon-cmd, a simple command line IKE client 2013-05-06 15:28:26 +02:00
Martin Willi b4e9f74e42 Merge branch 'leak-detective-dlsym' 
Replaces the use of deprecated glibc malloc hooks by overloading malloc calls
and find the originals using dlsym(RTLD_NEXT).

On OS X, we now support the use of leak detective by changing the default
malloc zone functions, backtraces get resolved using atos.

It seems that the performance bottleneck now is stack unwinding. Unfortunately
a new libunwind based backtrace() is not much faster than the libc variant; we
keep that option nonetheless for platforms without backtrace().
 2013-05-06 15:15:58 +02:00
Martin Willi 40f2a5306a scripts: add a simple test utility to do some malloc() benchmarking/profiling 2013-05-06 15:15:24 +02:00
Martin Willi 29324299fe backtrace: use atos instead of addr2line on OS X to resolve source lines 2013-05-06 15:15:24 +02:00
Martin Willi 83714577a9 backtrace: add an alternative stack unwinding implementation using libunwind 2013-05-06 15:15:24 +02:00
Martin Willi d8f6f0c01c leak-detective: add support for OS X by hooking default malloc zone 2013-05-06 15:15:24 +02:00
Martin Willi 50fbd32472 leak-detective: remove unused malloc call counters 2013-05-06 15:15:24 +02:00
Martin Willi 3117824f55 leak-detective: align allocations on both 32 and 64-bit systems to 32 bytes 2013-05-06 15:15:24 +02:00
Martin Willi 7e3f6299d5 leak-detective: call tzset() explicitly before enabling leak detective 
tzset() is hard to whitelist on some systems, as there is no symbol involved.
Call tzset() explicitly before initialization to avoid false positives.
 2013-05-06 15:15:24 +02:00
Martin Willi 17211b6b9a leak-detective: override malloc functions instead of using deprecated hooks 
malloc hooks have become deprecated, and their use has always been problematic,
especially in multi-threaded applications. Replace the functionality by
overriding all malloc functions and query the system allocator functions
using dlsym() with RTLD_NEXT.
 2013-05-06 15:15:24 +02:00
Martin Willi e9b3bd5434 Merge branch 'silent-automake' 
Adds support for --enable/disable-silent-rules when building with Automake
1.11 or 1.12. make V=0 or V=1 can be used to build with a different verbosity
than ./configured.
 2013-05-06 15:05:40 +02:00
Martin Willi d0f01a581d Add -s to make if --enable-silent-rules is ./configured 2013-05-06 15:04:56 +02:00
Martin Willi 0be946dce3 Use the GEN silent rule when generating files with sed 2013-05-06 15:04:56 +02:00
Martin Willi f932677f0c Use the GEN silent rule when generating oid database with perl 2013-05-06 15:04:56 +02:00
Martin Willi 9f1dfd88c8 Use the GEN silent rule when generating gperf files 2013-05-06 15:04:56 +02:00
Martin Willi 84c00e71b7 Provide the --enable-silent-rules ./configure option with automake 1.11 and 1.12 2013-05-06 15:04:56 +02:00
Martin Willi 5f55fd6e61 Introduce an optional logger_t.vlog() method with format string and arguments 
To have more flexibility in the logging backend, receiving the original format
string and do printf() substitution in the logger may be preferable. An
additional but optional logger method does not touch the behavior of existing
loggers.
 2013-05-06 15:00:15 +02:00
Martin Willi e93f386dbb Raise an ALERT_PROPOSAL_MISMATCH_CHILD also when receiving NO_PROPOSAL_CHOSEN 2013-05-06 14:56:50 +02:00
Martin Willi 00080d2b8b Raise an ALERT_PROPOSAL_MISMATCH_IKE also when receiving NO_PROPOSAL_CHOSEN 2013-05-06 14:56:50 +02:00
Martin Willi aea7ce3c64 eap-radius: add an option to disable accounting for tunnels without virtual IP 2013-05-06 14:56:01 +02:00
Martin Willi 69620a48e8 eap-radius: use IKE_SA unique id instead of peer identity to manage virtual IPs 
Fixes some corner cases if multiple tunnels use the same peer identity.
 2013-05-06 14:56:01 +02:00
Martin Willi a3854d8371 Don't unset IKE_SA on bus before we released virtual IPs and attributes 2013-05-06 14:56:01 +02:00
Martin Willi 9312fbc73d In memwipe_check(), don't put magic on stack when calling do_magic() 
Otherwise the magic might be on the stack while checking it.
 2013-05-03 14:17:37 +02:00
Martin Willi 1657b4ef26 Dump stack if memwipe() check fails 2013-05-03 11:41:51 +02:00
Martin Willi cf1696cab9 Allow SHA1_Init()/SHA1_Update() to fail if OpenSSL version >= 1.0 2013-04-10 18:10:30 +02:00
Martin Willi b52771fbb2 Check RSA_public_decrypt() length before constructing and comparing a chunk 
If decryption fails, it returns -1. chunk_equals() should catch that error,
but be more explicit in error checking.
 2013-04-10 18:10:30 +02:00
Martin Willi 97d975b7bb RSA_check_key() may return -1 if it fails 2013-04-10 18:10:30 +02:00
Martin Willi 96a09ce226 RAND_bytes/RAND_pseudo_bytes returns -1 if it is not supported by RAND method 2013-04-10 18:10:30 +02:00
Martin Willi 0faaab20cd Check return value of ECDSA_Verify() correctly 2013-04-10 18:10:30 +02:00
Martin Willi b2b99e61c8 eap-radius: Add an option to exclude ports from Called/Calling-Station-Id 2013-04-10 13:48:03 +02:00
Martin Willi 9c84bbcbc0 duplicheck: track multiple IKE_SAs in checking state to avoid any races 
When two consequent duplicates have been detected, track state of each checking
IKE_SA separately, avoiding potential race conditions between the active SA
and the different SAs in checking state.
 2013-04-04 15:51:48 +02:00
Martin Willi bee8b5e385 Refactor check_for_rekeyed_child() in quick_mode task 2013-04-03 17:08:00 +02:00
Martin Willi ac48d9e458 Reuse reqid of an existing Quick Mode, even if it has been rekeyed 
If two peers rekey Quick Modes at the same time, the original Quick Mode is
in REKEYING state and hence the requid is not reused. This is required though,
as two identical policies won't work if they have different requids.
 2013-04-03 15:56:26 +02:00
Martin Willi 7f4f1e8249 List all stroke counters when "all" is given, and report if connection not known 2013-04-03 14:58:08 +02:00
Martin Willi bee6515a28 Defer CHILD_SA rekeying if allocating an SPI fails 2013-04-03 12:25:27 +02:00
Martin Willi 3f4300ed1e Accept a certificate/key pair to use client authentication in tls_test 2013-04-02 16:09:17 +02:00
Martin Willi c59f3dcb68 Use new strongSwan HA kernel patchset keeping iptables ABI 
Allows us to install stock debian iptables without the need for patching and
compiling our own.
 2013-03-26 10:31:29 +01:00
Martin Willi b5f3c1f785 Define SSHCONF from strongswan testing directory, not TESTDIR 
This fixes the use of SSHCONF in the ssh wrapper script before ./do-tests
had a chance to create the required symlinks.
 2013-03-26 10:31:29 +01:00
Martin Willi 0ba8842348 Lazy unmount guest filesystem after building image, as it still might be busy 2013-03-26 10:31:29 +01:00
Martin Willi dd3c243844 Add a load-tester option to keep allocated external address until shutdown 2013-03-21 10:29:23 +01:00
Martin Willi e2d2b542f1 Add an option to autobalance a HA cluster automatically 2013-03-19 16:54:20 +01:00
Martin Willi 33524f02f9 Check if for some reason we handle a HA segment on both nodes 2013-03-19 16:50:39 +01:00
Martin Willi 21f40fe891 Acquire HA segment lock while sending heartbeat 2013-03-19 16:50:39 +01:00
Martin Willi 2071dd63d6 Fix scheduling of heartbeat sending in HA plugin 
e0efd7c1 switches to automated job rescheduling for HA heartbeat. However,
send_status() is initially called directly, which will not reschedule the job
as required.
 2013-03-19 15:48:27 +01:00
Martin Willi 5cf3afd1fa Fix compiler warning in HA plugin 2013-03-19 15:48:27 +01:00
Martin Willi 824864f4e0 Don't try to mmap() empty ipsec.secret files 2013-03-19 13:46:16 +01:00
Martin Willi 41131528a9 In stroke counters, check if we have an IKE_SA before getting the name from it 
Fixes a segfault when receiving an invalid IKE SPI, where we don't have an
IKE_SA for the raised alert.
 2013-03-19 11:20:35 +01:00
Martin Willi a0f1c4cf29 Add an "esp" load-tester option to configure custom CHILD_SA ESP proposal 2013-03-18 14:30:21 +01:00
Martin Willi 96776d6f77 Add some 5.0.3 NEWS 2013-03-18 10:48:21 +01:00
Martin Willi d29246cabe Merge branch 'radius-ext' 
Bring some extensions to eap-radius, namely a virtual IP address provider based
on received Framed-IPs, forwarding of Cisco Unity banners, Interim Accounting
updates and the reporting of sent/received packets.
 2013-03-18 10:13:36 +01:00
Martin Willi 048872f2f7 Merge branch 'stroke-counters' 
Extend stroke counters functionality by connection specific counters, and
a resetcounters command to reset the global or connection counters.
 2013-03-18 10:12:22 +01:00
Martin Willi e85c0f6b84 Merge branch 'stroke-timeout' 
Add a strongswan.conf timeout option for stroke control commands.
 2013-03-18 10:11:46 +01:00
Martin Willi cb14ecb1d3 Merge branch 'netlink-align' 
Fixes some Netlink alignment issues, and then refactors Netlink XFRM message
attribute handling.
 2013-03-18 10:09:35 +01:00
Martin Willi 94163816fa Use netlink_add_attribute() to copy over attributes during update_sa() 2013-03-15 16:02:01 +01:00
Martin Willi 0d9f31e1ed Use a helper function to add XFRM_MARK attribute 2013-03-15 16:02:01 +01:00
Martin Willi 6dfc633927 Use netlink_reserve() helper function in XFRM to simplify message construction 2013-03-15 16:02:01 +01:00
Martin Willi 6359ab04f4 Add a Netlink utility function to add a RTA header and reserve space for data 2013-03-15 14:32:51 +01:00
Martin Willi 53c98f098f Correctly check buffer length in netlink_add_attribute() 2013-03-15 14:32:25 +01:00
Martin Willi 6ac601f543 Avoid unneeded termination of netlink algorithm name arrays with END_OF_LIST 2013-03-15 14:01:15 +01:00
Martin Willi cf729248b2 Add a "resetcounters" command to ipsec, clearing global or connection counters 2013-03-15 10:55:22 +01:00
Martin Willi d022322bed Add connection name specific stroke counters 2013-03-15 10:41:04 +01:00
Martin Willi a34ffd1c05 Add a chunk_from_str() initializer that does not include 0-terminator 2013-03-15 10:36:33 +01:00
Martin Willi e813d218f1 Don't create interim update entries if RADIUS accounting is disabled 2013-03-14 16:44:09 +01:00
Martin Willi d019764ab6 Add support for RADIUS Interim accounting updates 2013-03-14 16:35:11 +01:00
Martin Willi 1ba1cd0c9b Add an option to delete any established IKE_SA if RADIUS server is not responding 2013-03-14 15:42:30 +01:00
Martin Willi 49960f021d Make check whether to use IKEv1 fragmentation more readable 2013-03-14 14:20:55 +01:00
Martin Willi 552b8ad5f5 Send Acct-Terminate-Cause based on some alerts catched on the bus 
Currently supported are user disconnects, session timeouts and if the peer does
not respond on IKE packets or DPDs.
 2013-03-14 14:20:55 +01:00
Martin Willi 335982169a When IKEv1 DPD times out, raise missing SEND_RETRANSMIT_TIMOUT alert 2013-03-14 14:20:54 +01:00
Martin Willi c45cf9048e Raise an alert if an IKE_SA could not have been reauthenticated and expires 2013-03-14 14:20:54 +01:00
Martin Willi 68c12fd9f9 Send NAS-Port, NAS-IP and Calling/Called-Station-ID in Accounting-Requests 2013-03-14 14:20:54 +01:00
Martin Willi b4568ca230 Support RADIUS accounting of sent/received packets 2013-03-14 14:20:54 +01:00