denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
11,188 Commits 1 Branch 0 Tags
61345afb22194d788c190dbd02046796f7043600
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Martin Willi 61345afb22 Merge branch 'init-auth-fail' 
Properly notifies the responder if authentication of an IKE_SA or installation
of a CHILD_SA fails as initiator, keeping SA state on peers consistent.
 2013-06-11 15:54:27 +02:00
Martin Willi e196c41bd2 ikev2: if installing a CHILD_SA as initiator fails, notify the responder 2013-06-11 15:54:27 +02:00
Martin Willi 2788634c8c Merge branch 'scep-bind' 
Extend fetcher interface by an option to specify a source IP, implement
it in the curl plugin and provide a --bind option in scepclient.
 2013-06-11 15:54:26 +02:00
Martin Willi ff3fff4dc9 ikev2: raise LOCAL_AUTH_FAILED when receiving INFORMATIONAL with AUTH_FAILED 2013-06-11 15:54:26 +02:00
Martin Willi 78af570fd5 scepclient: support a --bind option to fetch from a specific source IP 2013-06-11 15:54:26 +02:00
Martin Willi ca74bf7a06 ikev2: close an established IKE_SA when receiving AUTHENTICATION_FAILED 
RFC 5996 compatible implementations MAY send an INFORMATIONAL message
with an AUTHENTICATION_FAILED if the initiator failed to authenticate us.
Handle such a message like a DELETE for an IKE_SA.
 2013-06-11 15:54:26 +02:00
Martin Willi fe20f752f1 curl: add an option to fetch bound to a local source address 2013-06-11 15:54:26 +02:00
Martin Willi eaafcec190 ikev2: if responder authentication fails, send AUTHENTICATION_FAILED 
According to RFC 5996, we MAY send an INFORMATIONAL message having an
AUTHENTICATION_FAILED. We don't do any retransmits, though, but just close
the IKE_SA after one message has been sent, avoiding the danger that an
unauthenticated IKE_SA stays alive.
 2013-06-11 15:54:26 +02:00
Martin Willi 44d9970f4c Allow IPComp on NATed connections, both for IKEv1 and IKEv2 
While this was problematic in earlier releases, it seems that it works just
fine the way we handle compression now. So there is no need to disable it over
NATed connections or when using forceencaps.
 2013-06-11 15:54:25 +02:00
Martin Willi 0adfffb6dd fetcher: add missing "continue" when handling FETCH_CALLBACK 2013-06-11 15:54:25 +02:00
Martin Willi 169bf6745e attr: fix a compiler warning that family is used uninitialized (seen with -Os) 2013-06-05 15:20:37 +02:00
Martin Willi bc1c92c9e9 Strictly memwipe_check() for magic only in the affected buffer 
Passing back the buffer address we memwipe() is not ideal, as it could, in
theory, change the behavior of the compiler and not-optimize memwipe(). But
as checking a larger stack is very difficult for different architectures
and compilers, we do it nonetheless for now.
 2013-06-05 15:02:18 +02:00
Martin Willi 21bade294b traffic-selector: inet_pton is successful only if it returns 1 2013-05-16 11:01:27 +02:00
Martin Willi e8b2ce1e72 capabilities: leak-detective using dlsym() does not need CAP_SYS_NICE anymore 2013-05-15 17:20:47 +02:00
Martin Willi b1bd63547b capabilities: initialize supplementary groups only when doing a setuid() 2013-05-15 17:20:47 +02:00
Martin Willi 2e9201f4ef af-alg: fix number of signers after adding untruncated HMAC-SHA-512 (1f2a34d6) 2013-05-15 17:20:36 +02:00
Martin Willi 965348cd7a Raise LOCAL_AUTH_FAILED alert after receiving AUTHENTICATION_FAILURE 2013-05-15 17:18:03 +02:00
Martin Willi a8849e0713 Merge branch 'tun-vip' 
Beside some OS X love, this merge introduces virtual IP and route installation
support on the pfkey/pfroute kernel interfaces.

Each virtual IP gets installed on a dedicated TUN device. As Linux-like source
routes are not supported, routes for the negotiated traffic selectors get
installed using the TUN device.

To prevent IKE packets from using those routes, special exclude routes get
installed to the IKE gateway. This works for most road-warrior deployments, but
certainly does not for some more exotic configurations, such as those using
virtual-IP-to-host. Mobility is not yet supported, either.
 2013-05-06 17:07:36 +02:00
Martin Willi c9a323c1d9 kernel-pfroute: allow only one thread to do a route look up simultaneously 
Otherwise we mess up the sequence number another thread is waiting for.
 2013-05-06 17:01:13 +02:00
Martin Willi 5c12700f9a kernel-interface: query SAD for last use time if SPD query didn't yield one 2013-05-06 17:01:13 +02:00
Martin Willi bdaf9f97e6 child-sa: query SAD/SPD just for what we actually need to update statistics 2013-05-06 17:01:13 +02:00
Martin Willi 470aad7e0c kernel-pfkey: be less verbose about unexpected sequence numbers 2013-05-06 17:01:13 +02:00
Martin Willi df919d50d0 kernel-pfkey: install exclude routes if kernel-net requires them 2013-05-06 17:01:13 +02:00
Martin Willi 580b768d03 kernel-pfroute: add a feature flag requesting "exclude" routes 
If routes installed along with policies covering the peer address affect local
IKE/ESP packets, they won't get routed correctly. To work around this issue,
the kernel interface can install "exclude" routes for the IKE peer. Not all
networking backends require this workaround, hence we export a flag for it
if it is required.
 2013-05-06 17:01:13 +02:00
Martin Willi bd520193a4 kernel-pfroute: remove unused interface address refcounting 2013-05-06 17:01:13 +02:00
Martin Willi 77b6f19694 kernel-pfroute: mark IPs installed on tun device as virtual 2013-05-06 17:00:55 +02:00
Martin Willi 2a2d7a4dc8 kernel-pfroute: install virtual IPs using dedicated tun devices 2013-05-06 16:10:13 +02:00
Martin Willi ca4a14ae83 kernel-pfkey: when installing a route for a virtual IP, use its interface 
When installing a route over a tun device for a virtual IP, the route must
be set over the tun, not the IKE interface.
 2013-05-06 16:10:13 +02:00
Martin Willi f52cf07532 kernel-interface: get_address_by_ts() can tell if a returned IP is virtual 2013-05-06 16:10:13 +02:00
Martin Willi 1a2a8bffed kernel-interface: support enumeration of virtual-only IPs 2013-05-06 16:10:13 +02:00
Martin Willi 5f7f8c92ca kernel-pfkey: refactor route installation to a dedicate function 2013-05-06 16:10:13 +02:00
Martin Willi 121783035c kernel-pfroute: split /0 routes to avoid conflict with default route 2013-05-06 16:10:13 +02:00
Martin Willi f8646dd65e kernel-pfkey: check if we have a gateway before comparing them 2013-05-06 16:10:13 +02:00
Martin Willi d4260c5f7f kernel-pfkey: install route along with input, not forward policies 
As forwarding policies are not available on all systems (OS X), using the
forward policy to attach the route is a bad pick. Using input policies allows
OS X to install routes.
 2013-05-06 16:10:13 +02:00
Martin Willi 6e879a59fc kernel-pfroute: rescan address list for an interface if its state changes 
It seems that we don't get address notifications if the interface is down
on OS X.
 2013-05-06 16:10:13 +02:00
Martin Willi 0fd409db77 kernel-pfroute: add newly appearing interfaces to the interface cache 2013-05-06 16:10:12 +02:00
Martin Willi 9bc342eae4 kernel-pfroute: implement get_nexthop() 2013-05-06 16:10:12 +02:00
Martin Willi 272bcac894 kernel-pfroute: install and uninstall routes 2013-05-06 16:10:12 +02:00
Martin Willi 3a7f4b5c8d kernel-pfroute: collect replies received for our own queries 2013-05-06 16:10:12 +02:00
Martin Willi b1c6b68e4c kernel-pfroute: refactor PF_ROUTE message processing, use an enumerator 2013-05-06 16:10:12 +02:00
Martin Willi 889efae4cf kernel-pfkey: use an int to set esp_port with a sysctl on OS X 2013-05-06 16:10:12 +02:00
Martin Willi 9650bf3cc7 kernel-pfroute: use INIT() macro for allocations 2013-05-06 16:10:12 +02:00
Martin Willi 0e107f03ac kernel-pfroute: use only a single PF_ROUTE socket for both events and queries 2013-05-06 16:10:12 +02:00
Martin Willi e8002956c9 kernel-pfroute: fix length check when receiving PF_ROUTE messages 2013-05-06 16:10:12 +02:00
Martin Willi 64f309e735 kernel-pfkey: remove obsolete pluto specific behavior 2013-05-06 16:10:12 +02:00
Martin Willi bc6275d21c kernel-netlink: remove obsolete pluto specific behavior 2013-05-06 16:10:11 +02:00
Martin Willi 2af65b26d9 tun_device: add a getter for the address previously passed to set_address() 2013-05-06 16:10:11 +02:00
Martin Willi 60babe0236 tun_device: add a getter for the underlying file descriptor 2013-05-06 16:10:11 +02:00
Martin Willi d947d0d61a tun-device: use host_create_netmask() to calculate interface netmask 2013-05-06 16:10:11 +02:00
Martin Willi 2d8a01d1c6 host: add a netmask constructor taking the number of network bits 2013-05-06 16:10:11 +02:00
Martin Willi 4dc83e9fac host: remove unused host_t.get_differences() method 2013-05-06 16:10:11 +02:00
Martin Willi 7749eb0d2a host: print %#H format specifiers not as %any, but with the port 2013-05-06 16:10:11 +02:00
Martin Willi 344a4e54be host: initialize sockaddr->sa_len if it is available 2013-05-06 16:10:11 +02:00
Martin Willi 60ed88b2c7 child-sa: pass traffic selector to add_sa() regardless of IPsec mode 
This lets the kernel backend decide what to do with it, and in fact all kernel
interfaces already handle this correctly.
 2013-05-06 16:10:11 +02:00
Martin Willi dc35d097b3 socket-default: to bind to one dynamic port on OS X, create v4 socket before v6 
It seems that the order of binding sockets of different address families to the
same dynamic port must be v6-before-v4 on Linux, but v4-before-v6 on OS X.
 2013-05-06 16:10:11 +02:00
Martin Willi a30727fe2b socket-default: refactor socket pair opening to a function 2013-05-06 16:10:11 +02:00
Martin Willi 6948df3220 socket-default: Don't try to send packet if we haven't a socket for given family 2013-05-06 16:10:10 +02:00
Martin Willi e9326eba13 socket-default: Use -1 if socket is not available, as 0 is actually a valid fd 2013-05-06 16:10:10 +02:00
Martin Willi b0ccd14f2a semaphore: similar to thread_create(), semaphore_create() is used by Mach 
The compiler spits no warning, but the wrong symbol is used when calling
semaphore_create() from strongSwan. Override the name with a #define to force
the use of our semaphore_create().
 2013-05-06 16:06:48 +02:00
Martin Willi 0c586c0099 .gitignore: add OS X .DS_Store files 2013-05-06 16:06:48 +02:00
Martin Willi 922e2d1d62 Merge branch 'charon-cmd' 
Introduce a simple IKEv1/IKEv2 command line client, charon-cmd. It does
not need any configuration files at all, but takes a few command line arguments
to establish connections as a road warrior.
 2013-05-06 16:01:25 +02:00
Martin Willi 68fc0fe32e charon-cmd: add an option to set a different server identity 2013-05-06 15:54:35 +02:00
Martin Willi a0f6f39343 proposals: try next if IKEv2 algorithm could not be mapped to IKEv1 2013-05-06 15:54:32 +02:00
Martin Willi d2e2b9a2da charon-cmd: add support for different IKEv1/IKEv2 authentication profiles 2013-05-06 15:54:31 +02:00
Martin Willi d6b0c28b25 charon-cmd: support multi-line help text for each option in usage 2013-05-06 15:54:29 +02:00
Martin Willi 8e53682cd9 charon-cmd: add --local/remote-ts options to set traffic selectors 2013-05-06 15:54:27 +02:00
Martin Willi 7a86bccd50 charon-cmd: Use dynamic ports with the socket-default plugin 2013-05-06 15:28:27 +02:00
Martin Willi 69333acee0 settings: Add a set_default_str() to set a different default for a key 
The value is set only if it is not configured in strongswan.conf or has
not been set() otherwise.
 2013-05-06 15:28:27 +02:00
Martin Willi 3ca58c32be charon-cmd: prompt for EAP passwords on-demand using a callback credential set 2013-05-06 15:28:27 +02:00
Martin Willi b48941ae16 charon-cmd: authenticate with EAP if no private key is given 2013-05-06 15:28:27 +02:00
Martin Willi 7bcd96e43d charon-cmd: pass arguments to all handlers, even if already handled 2013-05-06 15:28:27 +02:00
Martin Willi 9dfd9275f0 charon-cmd: build long_opts only once when reading arguments in charon-cmd 2013-05-06 15:28:27 +02:00
Martin Willi f0749552a6 charon-cmd: add support for using dynamic ports in charon-cmd 2013-05-06 15:28:26 +02:00
Martin Willi d3874008e8 socket-dynamic: when sending from port zero, allocate a free port dynamically 2013-05-06 15:28:26 +02:00
Martin Willi 5e9144a21f controller: clean up job data if a thread gets cancelled waiting in a function 
Controller functions are thread cancellation points, so register a cancellation
handler cleaning up job data.
 2013-05-06 15:28:26 +02:00
Martin Willi 2baa7bbedb charon-cmd: load certificates and RSA private keys 2013-05-06 15:28:26 +02:00
Martin Willi 78d7a0f7e2 charon-cmd: add a connection object and its initiation to charon-cmd 2013-05-06 15:28:26 +02:00
Martin Willi be44723de0 charon-cmd: move command line options to separate file, obsolete short options 2013-05-06 15:28:26 +02:00
Martin Willi 1fed10beb2 charon-cmd: add a stub for charon-cmd, a simple command line IKE client 2013-05-06 15:28:26 +02:00
Martin Willi b4e9f74e42 Merge branch 'leak-detective-dlsym' 
Replaces the use of deprecated glibc malloc hooks by overloading malloc calls
and find the originals using dlsym(RTLD_NEXT).

On OS X, we now support the use of leak detective by changing the default
malloc zone functions, backtraces get resolved using atos.

It seems that the performance bottleneck now is stack unwinding. Unfortunately
a new libunwind based backtrace() is not much faster than the libc variant; we
keep that option nonetheless for platforms without backtrace().
 2013-05-06 15:15:58 +02:00
Martin Willi 40f2a5306a scripts: add a simple test utility to do some malloc() benchmarking/profiling 2013-05-06 15:15:24 +02:00
Martin Willi 29324299fe backtrace: use atos instead of addr2line on OS X to resolve source lines 2013-05-06 15:15:24 +02:00
Martin Willi 83714577a9 backtrace: add an alternative stack unwinding implementation using libunwind 2013-05-06 15:15:24 +02:00
Martin Willi d8f6f0c01c leak-detective: add support for OS X by hooking default malloc zone 2013-05-06 15:15:24 +02:00
Martin Willi 50fbd32472 leak-detective: remove unused malloc call counters 2013-05-06 15:15:24 +02:00
Martin Willi 3117824f55 leak-detective: align allocations on both 32 and 64-bit systems to 32 bytes 2013-05-06 15:15:24 +02:00
Martin Willi 7e3f6299d5 leak-detective: call tzset() explicitly before enabling leak detective 
tzset() is hard to whitelist on some systems, as there is no symbol involved.
Call tzset() explicitly before initialization to avoid false positives.
 2013-05-06 15:15:24 +02:00
Martin Willi 17211b6b9a leak-detective: override malloc functions instead of using deprecated hooks 
malloc hooks have become deprecated, and their use has always been problematic,
especially in multi-threaded applications. Replace the functionality by
overriding all malloc functions and query the system allocator functions
using dlsym() with RTLD_NEXT.
 2013-05-06 15:15:24 +02:00
Martin Willi e9b3bd5434 Merge branch 'silent-automake' 
Adds support for --enable/disable-silent-rules when building with Automake
1.11 or 1.12. make V=0 or V=1 can be used to build with a different verbosity
than ./configured.
 2013-05-06 15:05:40 +02:00
Martin Willi d0f01a581d Add -s to make if --enable-silent-rules is ./configured 2013-05-06 15:04:56 +02:00
Martin Willi 0be946dce3 Use the GEN silent rule when generating files with sed 2013-05-06 15:04:56 +02:00
Martin Willi f932677f0c Use the GEN silent rule when generating oid database with perl 2013-05-06 15:04:56 +02:00
Martin Willi 9f1dfd88c8 Use the GEN silent rule when generating gperf files 2013-05-06 15:04:56 +02:00
Martin Willi 84c00e71b7 Provide the --enable-silent-rules ./configure option with automake 1.11 and 1.12 2013-05-06 15:04:56 +02:00
Martin Willi 5f55fd6e61 Introduce an optional logger_t.vlog() method with format string and arguments 
To have more flexibility in the logging backend, receiving the original format
string and do printf() substitution in the logger may be preferable. An
additional but optional logger method does not touch the behavior of existing
loggers.
 2013-05-06 15:00:15 +02:00
Martin Willi e93f386dbb Raise an ALERT_PROPOSAL_MISMATCH_CHILD also when receiving NO_PROPOSAL_CHOSEN 2013-05-06 14:56:50 +02:00
Martin Willi 00080d2b8b Raise an ALERT_PROPOSAL_MISMATCH_IKE also when receiving NO_PROPOSAL_CHOSEN 2013-05-06 14:56:50 +02:00
Martin Willi aea7ce3c64 eap-radius: add an option to disable accounting for tunnels without virtual IP 2013-05-06 14:56:01 +02:00
Martin Willi 69620a48e8 eap-radius: use IKE_SA unique id instead of peer identity to manage virtual IPs 
Fixes some corner cases if multiple tunnels use the same peer identity.
 2013-05-06 14:56:01 +02:00
Martin Willi a3854d8371 Don't unset IKE_SA on bus before we released virtual IPs and attributes 2013-05-06 14:56:01 +02:00