denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
7,089 Commits 1 Branch 0 Tags
47f2da4ef9f1a7fa0a34f00efdd9885f622867b9
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Tobias Brunner 93095183dd Added news about policy history. 2011-07-06 13:03:45 +02:00
Tobias Brunner 17927ca615 Record usage history of policies in PF_KEY kernel interface. 
The implementation is nearly the same as in the Netlink kernel interface.
 2011-07-06 12:56:34 +02:00
Tobias Brunner 4e9e4372f5 Simplified destruction of policy_sa_t objects in Netlink interface. 2011-07-06 12:49:54 +02:00
Tobias Brunner 0c2ce1905a Adapted shunt manager to changed kernel interface (reqid in del_policy). 2011-07-06 12:48:26 +02:00
Tobias Brunner 674bc34322 Some code cleanup in Netlink kernel interface. 2011-07-06 09:43:46 +02:00
Tobias Brunner 108357b106 Some code cleanup in PF_KEY kernel interface. 2011-07-06 09:43:46 +02:00
Tobias Brunner 9f49464d56 Reduce memory usage of policy history caching. 
Only cache data as needed (e.g. traffic selectors only for forward
policies) and at most once for each IPsec SA.
 2011-07-06 09:43:46 +02:00
Tobias Brunner a07568cf6a Use has_more in decrypt_payloads instead of calling enumerate twice. 2011-07-06 09:43:46 +02:00
Tobias Brunner 1142726ba0 Added linked_list_t.has_more which checks if any elements follow an enumerator's current position. 2011-07-06 09:43:46 +02:00
Tobias Brunner 2bf9d39da6 Make sure the enumerator stops after all items have been enumerated. 
This also changes how insert_before behaves, before enumeration items
are inserted first, after enumeration last.
 2011-07-06 09:43:46 +02:00
Tobias Brunner c225f9b558 Keep the mutex locked as long as possible when deleting policies. 
This change tries to prevent a race condition where a thread tries to
install the same policy another thread is currently deleting. If the
second thread releases the mutex in del_policy too early the first
thread could assume the policy does not exist (as it is not cached
anymore) but would not be able to actually install it if the second
thread was not yet able to delete it.
 2011-07-06 09:43:46 +02:00
Tobias Brunner bd4f7dab75 Properly unlock the policy if no change in the kernel is required. 2011-07-06 09:43:46 +02:00
Tobias Brunner 32fbad4ec2 Make sure access to policy is thread-safe during installation of route. 2011-07-06 09:43:46 +02:00
Tobias Brunner 629fd2f4f6 Finally removed deprecated iterator_t. 2011-07-06 09:43:46 +02:00
Tobias Brunner 203497d80e Removed unneeded and confusing insert_after method from linked_list_t. 2011-07-06 09:43:46 +02:00
Tobias Brunner 47daa0e6fe Replaced more complex iterator usages. 2011-07-06 09:43:45 +02:00
Tobias Brunner 67405ce808 Added a function to reset the enumerator of a linked list. 2011-07-06 09:43:45 +02:00
Tobias Brunner 572abc6cbd Replaced ike_sa_t.create_additional_address_iterator with enumerator. 2011-07-06 09:43:45 +02:00
Tobias Brunner 4bbce1ef37 Replaced ike_sa_t.create_child_sa_iterator with enumerator. 
This required two new methods on ike_sa_t. One returns the number of
CHILD_SAs and one allows to remove a CHILD_SA.
 2011-07-06 09:43:45 +02:00
Tobias Brunner 4f9c691adb Replaced pkcs7_t.create_certificate_iterator with enumerator. 
The method is currently not used.
 2011-07-06 09:43:45 +02:00
Tobias Brunner e26304348c Replaced simple iterator usages. 2011-07-06 09:43:45 +02:00
Tobias Brunner 28623fc538 "this" removed from comments. 2011-07-06 09:43:45 +02:00
Tobias Brunner f0ba8ae042 Record the history of a policy installed in the kernel. 
This allows to properly delete a policy e.g. if reauth=yes and
auto=route, because reqids are increased during reauthentication.

It also avoids overriding an installed policy with a trap policy.
 2011-07-06 09:43:45 +02:00
Tobias Brunner 328f22e1d3 Add the reqid to kernel_ipsec_t.del_policy. 2011-07-06 09:43:45 +02:00
Tobias Brunner 0b6ff2a9fe Added a replace function to linked_list_t. 2011-07-06 09:43:45 +02:00
Tobias Brunner fbf014b0c1 Added an insert_after and insert_before function to linked_list_t. 2011-07-06 09:43:45 +02:00
Tobias Brunner 178760012c Migrated linked_list_t to INIT/METHOD macros. 2011-07-06 09:43:45 +02:00
Tobias Brunner 3ee8fed445 Cache the most recent reqid in the PF_KEY kernel interface. 
This makes the PF_KEY kernel interface behave the same as the Netlink
kernel interface.
 2011-07-06 09:43:45 +02:00
Tobias Brunner a7edbd219f Added news about library dir change. 2011-07-05 15:26:50 +02:00
Tobias Brunner 60d62b9e5c Don't install the libraries directly in lib/. 
Instead use a subdirectory (prefix/lib/ipsec by default). Also moved the
plugins from libexec to a subdirectory of that dir.
 2011-07-05 14:42:14 +02:00
Tobias Brunner fbdef639d6 COPYING updated to the most current version (address was incorrect). 2011-06-08 16:49:08 +02:00
Tobias Brunner 289c424589 Fix integrity checks with monolithic build. 2011-06-08 15:46:07 +02:00
Tobias Brunner dcc1ad6a23 Prevent deadlock while shutting down thread pool. 
During destruction the main thread locks the mutex in processor_t and
waits on a condvar for threads to have terminated.  Because the mutex
has also to be locked to decrement the thread count the condvar cannot
be signaled before doing that as otherwise the main thread might already
be waiting to join the threads while locking the mutex and thus causing
a deadlock.
 2011-06-08 11:44:42 +02:00
Tobias Brunner 876961cf0e Properly print time differences. 
time_t is not necessarily of type int.
 2011-06-07 17:52:34 +02:00
Tobias Brunner 1b185ea490 Use proper printf specifiers to print u_int64_t and uintptr_t. 2011-06-07 17:30:57 +02:00
Tobias Brunner bf870ffbe7 Default value for keyingtries documented properly. 2011-05-31 09:03:23 +02:00
Tobias Brunner 608657519a ipsec: Wait longer for starter to quit before killing it. 
As starter waits up to 10 seconds for either daemon to quit, killing it
already after 5 seconds is too early.
 2011-05-26 12:43:01 +02:00
Tobias Brunner ae9d5e7ce1 Option to enable duplicheck plugin fixed. 2011-05-26 12:37:41 +02:00
Tobias Brunner 617061072b Renamed option to enable unit tests as plugin is named unit-tester. 
To correctly enable a plugin the names used in the ARG_ENABL_SET and
ADD_PLUGIN macros have to match (and they have, of course, to match the
plugin's name).
 2011-05-24 19:28:54 +02:00
Tobias Brunner ee0fb2ab81 Keep count of remaining elements to enumerate in hashtable_t. 
This improves performance during enumeration as not all buckets have to be
checked.
 2011-05-24 19:23:45 +02:00
Tobias Brunner 8af0177189 Replaced linked_list_t usage in hashtable_t with custom list implementation. 
With this change inserting elements into a hashtable_t object is now
nearly as fast as inserting them into a linked_list_t object, whereas
before it was up to seven times slower.  Additionally, the memory
footprint of a hashtable is now significantly smaller.  The lookup
performance is also nearly doubled.
 2011-05-24 19:23:45 +02:00
Tobias Brunner c74ece334d pluto: Made helper functions in event_queue static. 2011-05-24 19:23:45 +02:00
Tobias Brunner b3c4475076 Compiler warning fixed. 2011-05-24 19:23:45 +02:00
Tobias Brunner d30df6ff3d stroke: Usage output updated. 2011-05-16 18:47:52 +02:00
Tobias Brunner 92abe2bd68 Update working thread count without allocation. 2011-05-16 18:28:03 +02:00
Tobias Brunner 21692169b9 Make sure working thread count is correctly updated 2011-05-16 15:24:16 +02:00
Tobias Brunner 700296ccbe maemo: New upstream release. 2011-05-16 14:15:08 +02:00
Tobias Brunner 0e080d9b64 Don't compile login() in openssl_rsa_private_key_t if ENGINE support is disabled in OpenSSL. 2011-05-13 13:11:11 +02:00
Tobias Brunner 38a93a3cd9 fetcher.c added to Android.mk. 2011-05-13 13:09:38 +02:00
Tobias Brunner 38865eced3 Return correct status code in kernel_netlink_ipsec_t.query_sa. 2011-05-10 15:45:42 +02:00
Tobias Brunner 70f918ec1d chunk_clear not clear_chunk. 2011-05-10 15:40:46 +02:00
Tobias Brunner 5832d5058b Typo in NEWS fixed. 2011-05-05 10:31:33 +02:00
Tobias Brunner bf3c371531 Note about certificates added to CA section in ipsec.conf man page. 2011-05-05 10:30:51 +02:00
Tobias Brunner a855af9544 testing: Properly align numbers of succeeded and failed tests in overview page. 2011-05-05 10:29:52 +02:00
Tobias Brunner e296fc2d26 testing: Add crumbtrail to overview page which lists all tests. 2011-05-05 10:29:52 +02:00
Tobias Brunner ca25eb9eb3 testing: Directly link to index.html of tests to allow browsing via file://. 2011-05-05 10:29:52 +02:00
Tobias Brunner e8ae55f64b testing: Avoid adding additional spacing around testresults. 2011-05-05 10:29:52 +02:00
Tobias Brunner 074919dcc5 testing: Replace back link in results with crumbtrail to improve navigation. 2011-05-05 10:29:51 +02:00
Tobias Brunner b4c9ab9c79 Cache group name in sys_logger_t to avoid problems with Vstr. 
Because syslog(3) is not replaced when using the Vstr wrapper, %N can
not be resolved properly.
 2011-05-03 10:50:28 +02:00
Tobias Brunner b7cb8100c4 Migrated sys_logger_t to INIT/METHOD macros. 2011-05-03 10:21:58 +02:00
Tobias Brunner 5bbe0ee18c Migrated file_logger_t to INIT/METHOD macros. 2011-05-03 10:21:03 +02:00
Tobias Brunner 7b12521679 Removed superfluous parameter missed in e5e5bcc92f. 2011-05-02 17:13:14 +02:00
Tobias Brunner 68447302d6 Typo fixed. 2011-04-28 12:50:30 +02:00
Tobias Brunner 67ec2be665 IKEv2 was only partially the default for connections with auto=route and auto=start. 
Connections with auto=route and auto=start that did not have
keyexchange=ikev2 explicitly specified did get added to charon,
but did not get routed or started by charon.
 2011-04-27 11:33:06 +02:00
Tobias Brunner cce8f65232 Fixed two typos in kernel-pfroute plugin. 2011-04-26 17:58:39 +02:00
Tobias Brunner dd0696ec8e Use strncpy when reading smartcard keyids from ipsec.secrets. 2011-04-19 18:00:16 +02:00
Tobias Brunner 6e0c82141f pluto: Replaced some strcpy usages with strncpy. 2011-04-19 17:35:57 +02:00
Tobias Brunner 81b598ca5f openac: --out is a mandatory argument. 2011-04-19 17:35:57 +02:00
Tobias Brunner 2bf1d44f7b openac: Fixed potential overflow while reading passphrase. 2011-04-19 13:48:51 +02:00
Tobias Brunner 68e9275134 openac: Make sure path is null-terminated. 2011-04-19 13:48:51 +02:00
Tobias Brunner 2653c08513 pluto: Make sure connection name is null-terminated during DPD restart. 2011-04-19 13:48:51 +02:00
Tobias Brunner f36a6ebd30 starter: Make sure interface name is null-terminated. 2011-04-19 13:48:51 +02:00
Tobias Brunner e0d388f2e3 Use proper return value for ietf_attr_t.compare. 2011-04-19 13:48:50 +02:00
Tobias Brunner e78c915241 scepclient: Proper handling of multiple received certificates. 2011-04-19 13:48:50 +02:00
Tobias Brunner 00b9f755f8 pool: Proper cleanup in error cases when adding addresses from a file. 2011-04-19 13:48:50 +02:00
Tobias Brunner e5143952f0 pool: Proper handling of address family when adding addresses. 2011-04-19 13:48:50 +02:00
Tobias Brunner a5543f99e4 Added missing return in iterator_t.insert_before of linked_list_t. 2011-04-19 13:48:50 +02:00
Tobias Brunner 75cf0cc012 pluto: Clarified parsing of long durations. 2011-04-19 13:48:50 +02:00
Tobias Brunner 1c004bebd8 Clearly mark switch cases that fall through. 2011-04-19 13:48:50 +02:00
Tobias Brunner 119fc2d3d7 Added missing break statement. 2011-04-19 13:48:50 +02:00
Tobias Brunner 73ac1f2040 pluto: Avoid potential null-pointer dereference when checking CRLs. 2011-04-19 13:48:50 +02:00
Tobias Brunner a61b696380 pluto: Added missing PF_KEY debug messages. 
libfreeswan does not use the version of the PF_KEY header file provided
in src/include/linux so this list is not exactly up to date.
 2011-04-19 13:48:50 +02:00
Tobias Brunner f526b35c45 Properly copy interface name if unknown. 
We use a static string if the interface name is unknown, so using memcpy
with IFNAMSIZ is incorrect as that would overrun the static string.
 2011-04-19 13:48:50 +02:00
Tobias Brunner 82017bf417 pluto: from_state is strictly lower than STATE_IKE_ROOF. 2011-04-19 13:48:50 +02:00
Tobias Brunner c8bb9a2ec6 Fixed typo in unit-tester plugin. 2011-04-19 13:48:49 +02:00
Tobias Brunner 823d2f5035 pluto: Fixed check for NAT-T keepalives. 2011-04-14 18:11:47 +02:00
Tobias Brunner 3bec23d88c pluto: Properly initialize constants. 2011-04-14 18:11:46 +02:00
Tobias Brunner 7223229924 pluto: Avoid hiding outer parameter. 2011-04-14 18:11:46 +02:00
Tobias Brunner 33c9e8b28d pluto: Use %zu to print values of type size_t. 2011-04-14 18:11:46 +02:00
Tobias Brunner 8e4da8f2e8 Use %tx to print a value of type ptrdiff_t. 2011-04-14 18:11:46 +02:00
Tobias Brunner e5e5bcc92f Removed superfluous parameter to printf. 2011-04-14 18:11:46 +02:00
Tobias Brunner b0fd7d1482 Proper cleanup if IDs in ipsec.secrets cannot be parsed. 2011-04-14 18:11:45 +02:00
Tobias Brunner 3c3c832a10 Fixed potential memory leak in host_create_any. 2011-04-14 18:11:45 +02:00
Tobias Brunner 6045eaa54a pluto: Fixed potential memory leak in atoaddr. 2011-04-14 18:11:45 +02:00
Tobias Brunner 862ef49f85 Fixed potential memory leak when processing routes from the kernel. 2011-04-14 18:11:45 +02:00
Tobias Brunner 29388829fa Do proper cleanup in error case in pki req. 2011-04-14 18:11:45 +02:00
Tobias Brunner 3fe6c0b27e Do proper cleanup in some error cases in pki signcrl. 2011-04-14 18:11:44 +02:00
Tobias Brunner 809750d72b pluto: Fixed potential memory leak when processing requested virtual IPs. 2011-04-14 18:10:52 +02:00
Tobias Brunner 267d47d6f2 pluto: Properly free buffer in error cases in read_packet. 2011-04-14 18:10:27 +02:00
Tobias Brunner 3c0c321776 Neither rekey nor del can be NULL. 2011-04-14 18:10:27 +02:00