denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
14,746 Commits 1 Branch 0 Tags
67a38ac6f104030cc61a71f4a3fa10908658410d
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Tobias Brunner 1a79525559 testing: Fix some IKEv1 scenarios after listing DH groups for CHILD_SAs 2015-12-21 12:14:12 +01:00
Tobias Brunner 5d7049b427 stroke: List DH groups for CHILD_SA proposals 
Closes strongswan/strongswan#23.
 2015-12-21 12:14:12 +01:00
Tobias Brunner a1dfbb7557 vici: Use correct constant when checking for integrity algorithm 
Currently both have the value 1024 so no real harm done.
 2015-12-21 12:14:12 +01:00
Tobias Brunner ade20d06c6 vici: CHILD_SA proposals never contain a PRF 2015-12-21 12:14:12 +01:00
Tobias Brunner 1c3aa9bfc8 stroke: Fix --utc option for list* commands 
Fixes: dcb168413f ("stroke: Add --daemon option")
 2015-12-17 16:56:20 +01:00
Tobias Brunner 891e9e95ea Merge branch 'command-max-lines' 
Make sure commands registered in pki and swanctl don't exceed the
maximum number of lines available for their usage summary.

Closes strongswan/strongswan#22.
 2015-12-16 12:28:22 +01:00
Tobias Brunner 3f2c305226 swanctl: Slightly change usage summary for --list-certs 2015-12-16 12:20:35 +01:00
Tobias Brunner b0f00b2a3c swanctl: Never print more than MAX_LINES of usage summary 
Print a warning if a registered command exceeds that limit.
 2015-12-16 12:09:20 +01:00
Tobias Brunner 50e190e8ad pki: Increase MAX_LINES 
The --issue and --self commands both define 10 lines of usage summary
text.
 2015-12-16 12:09:18 +01:00
Tobias Brunner 8ea64a78d6 pki: Never print more than MAX_LINES of usage summary 
Print a warning if a registered command exceeds that limit.
 2015-12-16 12:07:13 +01:00
Tobias Brunner bf5754adcd travis: Enable IPv6 on build hosts 
Since the move to Google Compute Engine (GCE) IPv6 has been disabled
on the build hosts, causing several tests to fail.  Lets try to get at
least local IPv6 connectivity up again.
 2015-12-15 15:03:47 +01:00
Tobias Brunner 0f13f719e1 libstrongswan: Updated Android.mk to current Makefile.am 2015-12-14 19:05:41 +01:00
Tobias Brunner 020d8c8f26 configure: Fix typo when enabling CPAN modules as dependency 
Fixes: a17b6d469c ("Built the CPAN file structure for the Vici::Session perl module")
 2015-12-14 11:49:51 +01:00
Tobias Brunner 74270c8c86 vici: Don't report memory usage via leak-detective 
This slowed down the `swanctl --stats` calls in the test scenarios
significantly, with not much added value.
 2015-12-11 18:26:53 +01:00
Tobias Brunner ae37090e65 testing: Use expect-connection in swanctl scenarios 
Only in net2net-start do we have to use `sleep` to ensure the SA is
up when the tests are running.
 2015-12-11 18:26:53 +01:00
Tobias Brunner b77e25c381 testing: The expect-connection helper may use swanctl to check for connections 
Depending on the plugin configuration in the test scenario either
`ipsec statusall` or `swanctl --list-conns` is used to check for a named
connection.
 2015-12-11 18:26:53 +01:00
Tobias Brunner 36d42daf4d imv-attestation: Fix memory leaks when creating functional components 2015-12-11 15:18:38 +01:00
Tobias Brunner 7f52715655 ipsec: Fix stop command on systems where sleep(1) only supports integers 
Fixes #1231.
 2015-12-10 11:46:21 +01:00
Tobias Brunner 84a3077e78 conf: Add support for escaping dots in section/option names 2015-12-04 18:22:44 +01:00
Tobias Brunner 63a778a25d vici: Fix clean-local target for Perl bindings if they were not built 
This is called when running `make distclean` (or indirectly via `make
distcheck`).
 2015-12-04 12:10:57 +01:00
Tobias Brunner 731cf55579 swanctl: Add --list-algs command to query loaded algorithms 2015-11-30 10:55:55 +01:00
Tobias Brunner de34defcd0 vici: Add get-algorithms command to query loaded algorithms and implementations 2015-11-30 10:55:55 +01:00
Tobias Brunner 33895f4bc5 NEWS: Added changes since 5.3.4 2015-11-26 10:38:10 +01:00
Tobias Brunner e36b1e2edb travis: Enable OS X build 2015-11-23 11:42:52 +01:00
Tobias Brunner 88b85e022a sigwaitinfo() may fail with EINTR if interrupted by an unblocked signal not in the set 
Fixes #1213.
 2015-11-23 11:37:19 +01:00
Tobias Brunner b675909662 kernel-pfkey: Enable ENCR_CAMELLIA_CBC when it's available 
Fixes #1214.
 2015-11-23 11:20:30 +01:00
Tobias Brunner 45c5b992e0 man: Update description of the actions performed for different dpdaction values 
For instance, charon does not unroute `auto=route` connections with
`dpdaction=clear`.
 2015-11-18 14:55:15 +01:00
Tobias Brunner 5461efe7b9 utils: Use the more low-level __NR_ prefix to refer to the syscall number 
The __NR_ constants are also defined in the Android headers.
 2015-11-17 17:21:36 +01:00
Tobias Brunner 453e204ac4 NEWS: Add info about CVE-2015-8023 2015-11-16 13:19:36 +01:00
Tobias Brunner f9c5c80553 eap-mschapv2: Keep internal state to prevent authentication from succeeding prematurely 
We can't allow a client to send us MSCHAPV2_SUCCESS messages before it
was authenticated successfully.

Fixes CVE-2015-8023.
 2015-11-16 13:19:36 +01:00
Tobias Brunner fe48e4ae31 android: Suppress compiler warnings about missing field initializers 
Triggered by -Wextra for many INIT usages where we only partially
initialize a struct.
 2015-11-13 18:24:45 +01:00
Tobias Brunner ef4279f2e5 utils: Provide a fallback for sigwaitinfo() if needed 
Apparently, not available on Mac OS X 10.10 Yosemite. We don't provide
this on Windows.
 2015-11-13 18:24:45 +01:00
Tobias Brunner 268d029c15 init: Make sure basic networking is up in systemd unit 
Connections with auto=route might otherwise not work.

References #1188.
 2015-11-13 10:20:11 +01:00
Tobias Brunner 176c24b8e1 vici: Attribute certificates are not trusted 2015-11-12 14:45:43 +01:00
Tobias Brunner e5e352e631 vici: Properly add CRLs to the credential set 
add_crl() ensures that old CLRs are not stored in the credential set.
 2015-11-12 14:45:42 +01:00
Tobias Brunner 322a11ccbb mode-config: Reassign migrated virtual IP if client requests %any 
If we mistakenly detect a new IKE_SA as a reauthentication the client
won't request the previous virtual IP, but since we already migrated
it we already triggered the assign_vips() hook, so we should reassign
the migrated virtual IP.

Fixes #1152.
 2015-11-12 14:42:36 +01:00
Tobias Brunner e161238e8e revocation: Allow CRLs to be encoded in PEM format 
Since the textual representation for a CRL is now standardized
in RFC 7468 one could argue that we should accept that too, even
though RFC 5280 explicitly demands CRLs fetched via HTTP/FTP to
be in DER format.  But in particular for file URIs enforcing that
seems inconvenient.

Fixes #1203.
 2015-11-12 14:40:44 +01:00
Tobias Brunner 15d715dace curl: Be less strict when considering status codes as errors 
For file:// URIs the code is 0 on success. We now do the same libcurl
would do with CURLOPT_FAILONERROR enabled.

Fixes #1203.
 2015-11-12 14:40:37 +01:00
Tobias Brunner fdfbd401c3 eap-radius: Compare address family when handing out virtual IPs 
This also ensures that the actually released virtual IP is removed from
the list of claimed IPs.

Fixes #1199.
 2015-11-12 14:32:11 +01:00
Tobias Brunner d801fedb19 Merge branch 'eap-mschapv2-eap-identity' 
This replaces the EAP-Identity with the EAP-MSCHAPv2 username, which
ensures the client is known with an authenticated identity.  Previously
a client with a valid username could use a different identity (e.g. the
name of a different user) in the EAP-Identity exchange.  Since we use
the EAP-Identity for uniqueness checks etc. this could be problematic.
The EAP-MSCHAPv2 username is now explicitly logged if it is different
from the EAP-Identity (or IKE identity).

Fixes #1182.
 2015-11-12 14:22:28 +01:00
Tobias Brunner 1d4b767275 eap-mschapv2: Report username if different from EAP-Identity (or IKE identity) 2015-11-12 14:21:06 +01:00
Tobias Brunner 8f5e481953 eap-mschapv2: Provide EAP-MSCHAPv2 username as EAP-Identity 2015-11-12 14:21:06 +01:00
Tobias Brunner 310a099be4 auth-cfg: Prefer merged rules over existing ones when moving them 
This is particularly important for single valued rules (e.g.
identities).  When copying values this is already handled correctly
by the enumerator and add().
 2015-11-12 14:21:06 +01:00
Tobias Brunner 3af7e09271 android: Add some (older) unit tests 2015-11-12 14:12:43 +01:00
Tobias Brunner 9e81f33b55 android: Properly handle shorter types in BufferedByteWriter 
In Java all integer types are signed, when a negative integer is casted
to a larger type (e.g. int to long) then due to sign extension the upper
bytes are not 0.  So writing that value to a byte array does not produce
the expected result.  By overloading the putX() methods we make sure to
upcast the values correctly.
 2015-11-12 14:12:13 +01:00
Tobias Brunner a50f3037ad android: Migrate to the Gradle build system 
This uses a manual way to trigger the NDK build (the default with
on-the-fly Android.mk files does not work for us).
 2015-11-12 14:11:37 +01:00
Tobias Brunner 073761ec41 android: Provide a fallback for sigwaitinfo() 2015-11-12 14:11:21 +01:00
Tobias Brunner 9be6b2e0b5 android: Replace AndroidConfigLocal.h with a header in utils/compat 2015-11-12 14:10:33 +01:00
Tobias Brunner 85af8400df android: Fix build after updating Linux headers 
Since we don't use the kernel-netlink plugin anymore and the headers
in the NDK are reasonably recent, we don't need this anymore (at least
when building the app).

Fixes #1172.
 2015-11-12 14:09:25 +01:00
Tobias Brunner 41feeddd48 Merge branch 'tkm-spi-label' 
Adds the charon-tkm.spi_label and charon-tkm.spi_mask options to encode
a specific value/label in otherwise randomly generated IKE SPIs.
 2015-11-11 15:45:50 +01:00
Tobias Brunner 8623ae9fc6 settings: Add settings_value_as_uint64() helper function 2015-11-11 15:39:49 +01:00
Tobias Brunner ee09094899 ike-sa-manager: Allow plugins to provide IKE SPIs via a callback 
Plugins must depend on `libcharon-sa-managers` to ensure the manager
exists.
 2015-11-11 15:39:45 +01:00
Tobias Brunner 301ccbe0a3 libcharon: Publish IKE_SA/CHILD_SA managers as custom plugin feature 2015-11-11 15:39:08 +01:00
Tobias Brunner 7b5dcc9f27 ikev1: Also use message hashes for Quick Mode for the early retransmission check 
We already did so during Phase 1 but because all three Quick Mode
message have the same message ID we occasionally dropped the third
message as retransmit, so we do it there too.  For INFORMATIONAL
and TRANSACTION exchanges we don't expect more than one inbound message
with the same message ID so we still use them there.

Fixes #1198.
 2015-11-11 11:01:56 +01:00
Tobias Brunner 4aff445202 kernel-netlink: Allow IPsec policies to replace shunt policies 
Shunt policies don't have a reqid set, so we allow unequal reqids in
this particular case (i.e. if one of the reqids is 0).
 2015-11-10 16:42:53 +01:00
Tobias Brunner baff14d049 kernel-pfkey: Make absolutely sure we always delete the right policy cache entry 2015-11-10 16:42:53 +01:00
Tobias Brunner 33400876d4 kernel-netlink: Make absolutely sure we always delete the right policy cache entry 2015-11-10 16:42:53 +01:00
Tobias Brunner a6e0f14fd2 kernel-interface: Pass the same data to del_policy() that was passed to add_policy() 
The additional data can be helpful to identify the exact policy to
delete.
 2015-11-10 16:42:52 +01:00
Tobias Brunner e265839093 kernel-netlink: Remove the unused policy_history flag 
This was used with pluto, which had its own policy tracking.
 2015-11-10 15:42:16 +01:00
Tobias Brunner e8f2c13f9a trap-manager: Also clean up remote address in error cases 
Fixes #1201.
 2015-11-10 14:00:11 +01:00
Tobias Brunner ebeb8c87c5 traffic-selector: Don't end printf'ed list of traffic selectors with a space 2015-11-10 12:13:06 +01:00
Tobias Brunner c2967484a0 swanctl: Add option to query leases with --get-pools 2015-11-10 10:43:25 +01:00
Tobias Brunner f4641f9e45 vici: Add option to query leases of pools 
We could later perhaps add filter parameters similar to those of the
`ipsec leases` command (pool name/virtual IP).
 2015-11-10 10:43:25 +01:00
Tobias Brunner 304a9a97e8 swanctl: List virtual IPs in --list-sas 2015-11-10 10:43:24 +01:00
Tobias Brunner bdb8b76515 vici: Return local and remote virtual IPs when listing SAs 2015-11-10 10:43:24 +01:00
Tobias Brunner 0ddec0760a socket-dynamic: Refactor setting source address when sending messages 
Basically the same change as the one for the socket-default plugin.
 2015-11-09 16:44:22 +01:00
Tobias Brunner 47e113a639 socket-default: Refactor setting source address when sending messages 
This ensures we don't pass data (via msg_control) defined in a different
scope to sendmsg().  Actually, some compilers (e.g. GCC 5.2.1) might
optimize the memcpy() call away causing the packets not to get sent from
the intended source address.

It also makes the code clearer than with all these ifdefs.

Fixes #1171.
 2015-11-09 16:43:21 +01:00
Tobias Brunner 99747bed8f socket-default: Refactor retrieval of destination address of received packets 
This makes the code a bit clearer than with the interleaved ifdefs.
 2015-11-09 16:42:20 +01:00
Tobias Brunner 9953e76c3d Merge branch 'medsrv-js-css' 
Removes the outdated version of MooTools and actually all
JavaScript code as that stuff can now be done with CSS directly.

Fixes #1190.
 2015-11-09 16:37:02 +01:00
Tobias Brunner b153d07bab medsrv: Replace remaining JavaScript code with CSS 2015-11-09 16:36:48 +01:00
Tobias Brunner 3e48b244d8 medsrv: Replace the JavaScript focus() calls with HTML5's autofocus 2015-11-09 16:36:42 +01:00
Tobias Brunner c9401f9ca3 conftest: Add configuration option to report milliseconds in file logger 2015-11-09 16:31:14 +01:00
Tobias Brunner 548b993488 file-logger: Add option to print milliseconds within the current second after timestamp 
For this to look right time_format should end with %S or %T.

Closes strongswan/strongswan#18.
 2015-11-09 16:30:00 +01:00
Tobias Brunner 8484d2b01d ike-natd: Create fake NAT-D payloads in a more static way 
In some scenarios an IKE_SA might get restarted multiple times (e.g.
due to retransmits and delayed INVALID_KE_PAYLOAD notifies) so that
two IKE_SA_INIT messages might be sent that only differ in the
previously randomly generated NAT_DETECTION_SOURCE_IP payload.
This could cause an authentication failure on the responder if the two
peers don't use the same IKE_SA_INIT message in their InitiatorSignedOctets.

While the payload is generated in a reproducible way it will still change
when the daemon is restarted, which should make detecting the payloads
as fake a bit harder (compared to e.g. just using 0.0.0.0:0 as address).

Fixes #1131.
 2015-11-09 16:25:59 +01:00
Tobias Brunner 10051b01e9 testing: Reduce runtime of all tests that use SQLite databases by storing them in ramfs 2015-11-09 15:18:39 +01:00
Tobias Brunner 3102da20a7 testing: tnc/tnccs-20-hcd-eap scenario does not use SWID IMV/strongTNC 2015-11-09 15:18:38 +01:00
Tobias Brunner e873cb5a28 testing: Add test config to create and remove a directory for DBs stored in ramfs 2015-11-09 15:18:38 +01:00
Tobias Brunner 10fa70ee5c testing: Improve runtime of TNC tests by storing the SQLite DB in ramfs 
This saves about 50%-70% of the time needed for scenarios that use a DB.
 2015-11-09 15:18:38 +01:00
Tobias Brunner f24ec20ebb testing: Fix test constraints in ikev2/rw-ntru-bliss scenario 
Changed with a88d958933 ("Explicitly mention SHA2 algorithm in BLISS
OIDs and signature schemes").
 2015-11-09 15:18:38 +01:00
Tobias Brunner 4ae2919518 mediation: Reschedule initiate mediation job if SA is not yet found 
If the job gets queued for a newly created IKE_SA it might not yet be
checked in when the job is running, reschedule the job in that case.

This should fix the two p2pnat test scenarios, which occasionally
failed because one of the peers did not initiate the connection to
the mediation server.
 2015-11-09 15:18:38 +01:00
Tobias Brunner bcad0f761f testing: Report the actual strongSwan and kernel versions 2015-11-09 15:18:37 +01:00
Tobias Brunner 5a919312b3 testing: Record strongSwan version when building from tarball 2015-11-09 15:18:37 +01:00
Tobias Brunner aee35392d1 testing: Record strongSwan version when building from source tree 2015-11-09 15:18:37 +01:00
Tobias Brunner d4908c06c1 testing: Report time required for all scenarios on test overview page 2015-11-09 15:18:37 +01:00
Tobias Brunner 0ea16f6b15 ike-sa-manager: Signal entries that we don't actually check out 
In some cases we call wait_for_entry() but don't actually check out the
entry afterwards (e.g. because it doesn't match certain criteria).  So
there won't be a call to checkin() for such entries causing waiting
threads to get signaled.  Instead, such threads would be blocked until
another thread properly checks out/in the entry (or does a blocking
enumeration).
 2015-11-09 15:18:37 +01:00
Tobias Brunner 1d528cfb8d ike-sa-manager: Signal waiting threads after check out/in for uniqueness check 
Fixes 758b1caa0e ("ikev1: Prevent deadlock when checking for duplicate IKEv1 SAs")
 2015-11-09 15:18:37 +01:00
Tobias Brunner f7234e5e9f testing: Remove old SWID tags when building from repository 
This fixes the TNC-PDP scenarios.
 2015-11-09 15:18:36 +01:00
Tobias Brunner e22a663129 testing: Don't log anything to the console if auth.log or daemon.log do not exist 2015-11-09 15:18:36 +01:00
Tobias Brunner 12f08e07e1 testing: Simplify fetching of swanctl --list-* output 2015-11-09 15:18:36 +01:00
Tobias Brunner bde9fb6fa1 testing: Don't run redundant crypto tests in sql/rw-cert scenario 
They run in all other rw-cert scenarios but in the SQL version there is
no change in the loaded crypto plugins.
 2015-11-09 15:18:36 +01:00
Tobias Brunner 1091b3a636 testing: Fix CRL URIs in ipv6/net2net-ip4-in-ip6-ikev* scenarios 2015-11-09 15:18:36 +01:00
Tobias Brunner bb66b4d56b testing: Speed up OCSP scenarios 
Don't make clients wait for the TCP connections to timeout by dropping
packets.  By rejecting them the OCSP requests fail immediately.
 2015-11-09 15:18:35 +01:00
Tobias Brunner 0ee4a333a8 testing: Speed up ifdown calls in ikev2/mobike scenarios 
ifdown calls bind's rndc, which tries to access TCP port 953 on lo.
If these packets are dropped by the firewall we have to wait for the TCP
connections to time out, which takes quite a while.
 2015-11-09 15:18:35 +01:00
Tobias Brunner cbaafa03c7 testing: Avoid delays with ping by using -W and -i options 
With -W we reduce timeouts when we don't expect a response.  With -i the
interval between pings is reduced (mostly in case of auto=route where
the first ping yields no reply).
 2015-11-09 15:18:35 +01:00
Tobias Brunner f519acd42f testing: Remove nearly all sleep calls from pretest and posttest scripts 
By consistently using the `expect-connection` helper we can avoid pretty
much all previously needed calls to sleep.
 2015-11-09 15:18:35 +01:00
Tobias Brunner 747b64875f ikev1: Fix calculation of DPD timeout 
A DPD timeout job is queued whenever a DPD is sent, i.e. after the
DPD delay already has elapsed, so we have to compensate for that.
 2015-11-09 15:18:34 +01:00
Tobias Brunner f36b6d49af testing: Adapt tests to retransmission settings and reduce DPD delay/timeout 2015-11-09 15:18:34 +01:00
Tobias Brunner 50a43fbb97 ipsec: Quit script quicker for ipsec stop 
It rarely takes 1 second or longer to terminate the daemon.  This
decreases the runtime of the post test step a lot where `ipsec stop`
is called for multiple hosts in each test case (10-15 minutes over all
test cases).
 2015-11-09 15:18:34 +01:00
Tobias Brunner 8713e32435 testing: Only send two retransmits after 1 second each to fail negative tests earlier 2015-11-09 15:18:34 +01:00
Tobias Brunner 9a0871ab94 testing: Add a base strongswan.conf file used by all hosts in all scenarios 
We will use this to set some defaults (e.g. timeouts to make testing
negative tests quicker).  We don't want these settings to show up in the
configs of the actual scenarios though.
 2015-11-09 15:18:34 +01:00