denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
11,751 Commits 1 Branch 0 Tags
74ee1120d722b7bcfc14a09ec1c4f226738dc8d6
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Martin Willi 74ee1120d7 charon-xpc: include and prefer AES-GCM algorithms in ESP proposal 2013-08-29 11:37:07 +02:00
Martin Willi 49032d15be stroke: stop enumerating IKE_SAs in statusall if output stream gets closed 
If the output stream is not interested in more information, it can close the
the stream. Checking for stream errors avoids useless enumeration of IKE_SAs,
saving resources. This allows to use "ipsec statusall | head" to monitor the
daemon, or stop enumerating IKE_SAs after a specific entry has been found.
 2013-08-23 14:27:17 +02:00
Martin Willi a24515c515 backtrace: rename clone() method clashing with system call 
Fixes #376.
 2013-08-09 09:13:39 +02:00
Martin Willi 881e9a7e2e updown: remove description of unsupported PLUTO_ variables 
These have been set by pluto, but are not by charons updown plugin.
 2013-08-08 14:48:32 +02:00
Martin Willi 3b6d8855e8 scripts: link against librt only if required 
With glibc, this seems to be the case for 2.17 and older versions only.
 2013-08-08 09:12:52 +02:00
Martin Willi 62e1c80803 scripts: link malloc_speed against librt 2013-08-08 09:09:00 +02:00
Martin Willi 8fa7c5c191 charon-xpc: load missing ctr/ccm/gcm plugins 2013-07-31 16:28:11 +02:00
Martin Willi aafb6fa6c2 charon-xpc: use kernel-libipsec instead of kernel-pfkey 2013-07-31 11:41:37 +02:00
Martin Willi 546235d34c charon-xpc: fix TS getting after changing CHILD_SA API 2013-07-31 11:41:31 +02:00
Martin Willi 83a0b74da8 keychain: be less verbose when loading certificates 2013-07-31 11:41:16 +02:00
Martin Willi 68957d1811 NEWS: mention xauth-radius backend in eap-radius plugin 2013-07-29 11:08:54 +02:00
Martin Willi 2cfe88aacb testing: enforce xauth-eap in ikev1/xauth-rsa-eap-md5-radius 
As eap-radius now provides its own XAuth backend and eap-radius is loaded before
xauth-eap, we have to enforce the exact XAuth backend to use.
 2013-07-29 10:35:59 +02:00
Martin Willi 14dfdf7dac Merge branch 'xauth-radius' 
Implements verification of XAuth credentials using simple RADIUS User-Name and
(encrypted) User-Password attributes. The XAuth backend is implemented in the
eap-radius plugin, reusing all existing infrastructure and features found in
that plugin, including RADIUS accounting.
 2013-07-29 09:00:56 +02:00
Martin Willi 9d75f04eee testing: add a testcase for plain XAuth RADIUS authentication 2013-07-29 09:00:49 +02:00
Martin Willi 44bb1dc3da charon-cmd: add --eap-identity and --xauth-username options 2013-07-29 09:00:49 +02:00
Martin Willi 3a399574c2 eap-radius: do RADIUS/IKE attribute forwarding in XAuth backend 2013-07-29 09:00:49 +02:00
Martin Willi c434b2a4a9 eap-radius: support plain XAuth RADIUS authentication using User-Password 2013-07-29 09:00:49 +02:00
Martin Willi 6bc0ce020d libradius: support encryption of User-Password attributes 2013-07-29 09:00:48 +02:00
Martin Willi 84044f9c73 utils: add round_up/down() helper functions 2013-07-29 09:00:48 +02:00
Martin Willi 15483a6223 libradius: refactor generic RADIUS en-/decryption function to a message method 2013-07-29 09:00:48 +02:00
Martin Willi 9aeb6cea4c eap-radius: export function to build common attributes of Access-Request 2013-07-29 09:00:48 +02:00
Martin Willi 94ec80e74c eap-radius: export function to process common attributes of Access-Accept 2013-07-29 09:00:48 +02:00
Martin Willi 7612a6e42f mem-pool: add option for reusing online leases, and disable it by default 
Mainly for reauthentication with third party implementations, we allowed to
reuse an online lease, but only for the same peer identity and when it
explicitly requested the same address.

This has always been problematic, because it changes the reqid of the CHILD_SA
with the same traffic selectors, breaking the old tunnel. As we now reject
such policy overwrites, this usually lets the installation of the new policies
fail. We therefore disable reassignment of online leases by default.
 2013-07-29 08:56:09 +02:00
Martin Willi c5d2d867f1 mem-pool: replace per-identity online/offline lists by more efficient arrays 
This saves two lists per connected peer identity, up to 0.4KB.
 2013-07-29 08:55:21 +02:00
Martin Willi d882880e87 mem-pool: refcount online lease when reassigning it to another tunnel 
When we reassign an online lease for the same peer, we have to refcount it.
Otherwise we would set it offline if one of the tunnels goes down, but it is
actually still in use by a the second tunnel. This can finally lead in
assigning the same virtual IP to different peers.
 2013-07-26 13:12:22 +02:00
Martin Willi dcd5129c25 processor: force synchronous execute_job() if set_threads(0) has been called 
During daemon shutdown, some idle threads might be lingering around even if
set_threads(0) already has been called. To avoid any races, we enforce
synchronous execution of the job.
 2013-07-19 15:30:22 +02:00
Martin Willi 2fa92ad256 proposal: correctly enumerate registered AEADs to build default IKE proposal 
AEADs are not returned (anymore) with the encryption enumerator.
 2013-07-19 15:05:17 +02:00
Martin Willi cb6c4e0430 identification: parse identities having a "@@" prefix as ID_RFC822_ADDR 
Original patch by Gerald Richter.
 2013-07-18 16:45:10 +02:00
Martin Willi c3b8335cfb NEWS: mention watcher and stream services 2013-07-18 16:10:48 +02:00
Martin Willi 666dff70eb Merge branch 'ipc-service' 
Adds network transparency and TCP support to the IPC interfaces of different
plugins using the new stream and stream service classes. A central watcher
thread can watch multiple file descriptors to handle connection requests
for these and other services using only a single thread.
 2013-07-18 16:03:14 +02:00
Martin Willi b4b3959b22 stream-service: move CAP_CHOWN check from plugins to service constructor 
A plugin service can be a TCP socket now, so it does not make much sense
to strictly check for CAP_CHOWN.
 2013-07-18 16:00:31 +02:00
Martin Willi 1897dd730f processor: remove the now unused get_threads() method again 2013-07-18 16:00:31 +02:00
Martin Willi ea009869e9 watcher: use processors new execute_job() to notify FDs 
Just queueing is problematic, as all threads might be busy waiting for events
that the queued (but never executed) job delivers.
 2013-07-18 16:00:31 +02:00
Martin Willi 6653e6c13e processor: add an execute_job() method to directly execute an important job 
If all worker threads are busy and waiting for an event, we must ensure that
a job delivering that event gets executed. This new method has this property
for CRITICAL jobs, using a worker if we have one, but executing the job directly
if not.
 2013-07-18 16:00:31 +02:00
Martin Willi 55240835b0 watcher: properly support multiple watch callback types for the same FD 2013-07-18 16:00:31 +02:00
Martin Willi d0c25a3f23 watcher: read multiple notifications if available 
Use non-blocking I/O on the read end of the notify pipe. This also makes sure
the read does not block should select() signal data while there is none.
 2013-07-18 16:00:31 +02:00
Martin Willi 8fc89db7b6 certexpire: add an option to enforce exporting trustchains having a private key 2013-07-18 16:00:31 +02:00
Martin Willi 868abd0626 error-notify: catch and forward some alerts related to certificate validation 2013-07-18 16:00:30 +02:00
Martin Willi 58750670cf bus: raise certificate validation alerts using credential manager hook 2013-07-18 16:00:30 +02:00
Martin Willi 4d7a762871 credmgr: introduce a hook function to catch trust chain validation errors 2013-07-18 16:00:30 +02:00
Martin Willi f7cff7fac4 lookip: double size of id field in message 2013-07-18 16:00:30 +02:00
Martin Willi f33d1d503f error-notify: increase size of string/identity fields in messages 2013-07-18 16:00:30 +02:00
Martin Willi 0a35ae781d whitelist: use a read-copy when listing entries 
While this requires a little more overhead, we can free the lock should the
stream block, allowing other threads to add/remove entries.
 2013-07-18 16:00:30 +02:00
Martin Willi 0ccc5bb216 whitelist: fix error handling when creating the socket fails 2013-07-18 16:00:30 +02:00
Martin Willi d3278c1f73 lookip: fix error handling when creating the socket fails 2013-07-18 16:00:30 +02:00
Martin Willi cfdb5f4855 error-notify: fix error handling when creating the socket fails 2013-07-18 16:00:30 +02:00
Martin Willi 46666dd3c1 kernel-pfroute: use watcher to receive kernel events 2013-07-18 16:00:30 +02:00
Martin Willi 7f698daef9 kernel-pfkey: use watcher to receive networking events 2013-07-18 16:00:30 +02:00
Martin Willi f4f77d7467 kernel-netlink: use watcher to receive kernel events for net/ipsec 2013-07-18 16:00:30 +02:00
Martin Willi 5f755cef46 eap-radius: use watcher instead of receiver thread on DAE socket 2013-07-18 16:00:30 +02:00
Martin Willi c0db5d3845 dhcp: use watcher instead of dedicated receiver thread 2013-07-18 16:00:30 +02:00
Martin Willi 17028e29c2 farp: use watcher instead of dedicated receiver thread 2013-07-18 16:00:29 +02:00
Martin Willi 73da4ed849 load-tester: use a stream service to dispatch control connections 2013-07-18 16:00:29 +02:00
Martin Willi e11c02c8f1 whitelist: use a stream service to accept client connections 
Use SOCK_STREAM, as we don't have SOCK_SEQPACKET on TCP. To have network
transparency, the message now uses network byte order.
 2013-07-18 16:00:29 +02:00
Martin Willi 091d0afa21 lookip: use stream service with async I/O dispatching 
Now uses SOCK_STREAM, as SOCK_SEQPACKET is not available over TCP. To have
network transparency, the message now uses network byte order.
 2013-07-18 16:00:29 +02:00
Martin Willi c2a6fdf286 error-notify: use a stream service to accept client connections 
As TCP does not have SOCK_SEQPACKET, we now use SOCK_STREAM for the error-notify
socket. To have network transparency, the message now uses network byte order.
 2013-07-18 16:00:29 +02:00
Martin Willi 83faec5abe duplicheck: use a stream service to accept client connections 
As we can't use SOCK_SEQPACKET over TCP, we now have to provide message
boundaries ourselves. We do this by appending a 16-bit length header to each
sent duplicate identity.
 2013-07-18 16:00:29 +02:00
Martin Willi 065907b99d stroke: use a stream service to handle stroke requests 2013-07-18 16:00:29 +02:00
Martin Willi 4701929266 stream: allow async read/write callback to destroy the stream explicitly 2013-07-18 16:00:29 +02:00
Martin Willi c9d1742b5d stream: don't close underlying socket when creating a stream from it 2013-07-18 16:00:29 +02:00
Martin Willi 58d0dadddc watcher: add some debugging statements 2013-07-18 16:00:29 +02:00
Martin Willi 91a2ae644c watcher: if the processor has no threads, execute the job with watcher thread 
This is important during shutdown, where we might need to signal some FDs while
all idle threads are gone already.
 2013-07-18 16:00:29 +02:00
Martin Willi 50720d7ce9 processor: add a getter for the threads passed to set_threads() 2013-07-18 16:00:29 +02:00
Martin Willi a0e3a7363f watcher: unregister a watcher FD if its thread gets cancelled 2013-07-18 16:00:29 +02:00
Martin Willi a558ba16f3 watcher: release threads waiting in remove() when watcher thread gets cancelled 
During daemon shutdown, users might call remove() after processor.set_threads(0)
has been called. This gets problematic, as a watch event might be unable
to signal completion when no threads are available anymore. Work around this
issue by cancelling waiters once processor.cancel() has been called.
 2013-07-18 16:00:29 +02:00
Martin Willi e6e8a2b2e0 stream: support keeping the service alive outside of service callback 2013-07-18 16:00:28 +02:00
Martin Willi d57b9e7c82 stream: add read/write_all() methods to stream 2013-07-18 16:00:28 +02:00
Martin Willi 1d1ef9e7ca stream: support cancellation of stream service callback 2013-07-18 16:00:28 +02:00
Martin Willi 047a190600 stream: use a service constructor to create services 
It does not make much sense to reference running services in the manager,
especially as unregistration would need the URI (which a user would have to
store instead of the service reference).
 2013-07-18 16:00:28 +02:00
Martin Willi fbdc65debb stream: replace print/vprint() convenience functions by a FILE* getter 
While this will complicate the implementation of streams not based on a fd,
it allows us to unleash the full power of FILE based convenience functions.
 2013-07-18 16:00:28 +02:00
Martin Willi 70d1ccec96 stream: add a concurrency option to services, limiting parallel callbacks 2013-07-18 16:00:28 +02:00
Martin Willi db0e160ba2 stream: add a job priority option to stream services 2013-07-18 16:00:28 +02:00
Martin Willi 441bb9e7b7 stream: add backlog option to stream services, forward to listen() 2013-07-18 16:00:28 +02:00
Martin Willi c5597a4b56 stream: add support for TCP stream services 2013-07-18 16:00:28 +02:00
Martin Willi db1c8aa460 stream: add support for TCP streams 2013-07-18 16:00:28 +02:00
Martin Willi f04746d9b4 stream: add support for UNIX stream services 2013-07-18 16:00:28 +02:00
Martin Willi b785cfe05b stream: add support for UNIX streams 2013-07-18 16:00:28 +02:00
Martin Willi c1fd8c22ce stream: support async operation using watcher 2013-07-18 16:00:28 +02:00
Martin Willi 7a23588195 stream: add printf()-style covenience functions 2013-07-18 16:00:28 +02:00
Martin Willi 2ba276017d stream: create library instance of stream-manager 2013-07-18 16:00:28 +02:00
Martin Willi d6ff53940f stream: add a manager to dynamically register streams and services 2013-07-18 16:00:28 +02:00
Martin Willi daf1880b39 stream: add a stream service class abstracting services using BSD sockets 2013-07-18 16:00:27 +02:00
Martin Willi b6b940001a stream: add a stream class abstracting BSD sockets 
Currently only synchronous operation is supported, but this will be extended
with asynchronous methods using the new watcher.
 2013-07-18 16:00:27 +02:00
Martin Willi 32b2a5e04b watcher: add a centralized an generic facility to monitor file descriptors 2013-07-18 16:00:27 +02:00
Martin Willi 56b753ca04 NEWS: leak-detective improvements 2013-07-18 15:17:35 +02:00
Martin Willi 2334ae56e0 NEWS: add keychain plugin 2013-07-18 15:07:00 +02:00
Martin Willi af2db7a651 autoconf: replace autogen.sh custom script with a call to autoreconf -i 2013-07-18 14:59:19 +02:00
Martin Willi 19cb07b890 automake: replace INCLUDES by AM_CPPFLAGS 
INCLUDES are now deprecated and throw warnings when using automake 1.13.
We now also differentiate AM_CPPFLAGS and AM_CFLAGS, where includes and
defines are passed to AM_CPPFLAGS only.
 2013-07-18 14:59:19 +02:00
Martin Willi c577b5eb44 autoconf: rename configure.in to configure.ac 
configure.ac has been the recommended name for autoconf input for several
years now. Newer autotools start to complain about the configure.in, so we
finally change it.
 2013-07-18 14:59:19 +02:00
Martin Willi 2e9e2fa848 eap-sim-pcsc: fix compiler warning 2013-07-18 14:59:19 +02:00
Martin Willi 896abbefc5 nm: omit deprecated g_type_init() when using >= GLIB 2.36 2013-07-18 14:21:17 +02:00
Martin Willi 2d5a20061a soup: omit deprecated g_type_init() when using >= GLIB 2.36 2013-07-18 14:20:57 +02:00
Martin Willi b146ecbc4e libfast: cancel thread if it fails to accept fcgi sessions 2013-07-18 12:24:38 +02:00
Martin Willi 890f20989f libfast: add a fast_ prefix to all classes, avoiding namespace clashes 2013-07-18 12:24:38 +02:00
Martin Willi 569d114de8 Merge branch 'charon-xpc' 
Implement a charon daemon controlled by the Apple specific XPC mechanism,
acting as a backend for a yet to build unprivileged GUI. The keychain plugin
coming with this merge provides certificates from the OS X keychain service.
 2013-07-18 12:18:32 +02:00
Martin Willi b9c47eae06 xpc: allow easy copy & pase of ./configure instructions 2013-07-18 12:17:56 +02:00
Martin Willi 7f1adbe94e xpc: use -idirafter to build against openssl headers from /usr/include 2013-07-18 12:17:56 +02:00
Martin Willi 06e8712cb3 xpc: forward some risen alerts over XPC to App 2013-07-18 12:17:56 +02:00
Martin Willi e7ee45ef38 xpc: enable close_ike_on_child_failure 2013-07-18 12:17:56 +02:00
Martin Willi e37c5d46d3 xpc: send a "connecting" event when establishing a connection starts 2013-07-18 12:17:56 +02:00