denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
12,041 Commits 1 Branch 0 Tags
796787625799637b872db7722b449b54433b5568
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Martin Willi d402e87d16 whitelist: Read multiple commands until client closes connection 
This restores the same behavior we had before e11c02c8, and fixes the whitelist
add/remove-from command.
 2013-10-29 14:22:52 +01:00
Martin Willi 1ba47fa565 charon-xpc: Load missing eap-md5 plugin after enabling it 2013-10-28 15:18:11 +01:00
Martin Willi 9f2a4d3315 charon-xpc: Disable warnings about deprecated functions 
This avoids all the deprecated warnings when using OpenSSL functins.
 2013-10-28 14:51:59 +01:00
Martin Willi f5ea7d781f charon-xpc: Avoid -all_load linker flag 
This seems to be not required anymore with the LLVM 5 toolchain.
 2013-10-28 14:51:51 +01:00
Martin Willi a1c2ed8820 charon-xpc: Properly xpc_retain() connections we xpc_release() 2013-10-28 14:51:40 +01:00
Martin Willi 888d8d73ab charon-xpc: Properly cast SA identifier to uintptr representation 2013-10-28 14:51:28 +01:00
Martin Willi 3e40dbb128 charon-xpc: Don’t build against libvstr anymore 
We now have our own printf backend and use it instead of Vstr.
 2013-10-28 14:51:03 +01:00
Martin Willi 6a3cfbdc0d charon-xpc: Build with EAP-MD5 support 2013-10-28 14:49:19 +01:00
Martin Willi 9df621d21f utils: Fix check for fmemopen() fallback implementation 2013-10-24 15:58:49 +02:00
Martin Willi 8465514157 unit-tests: Set sa_len in sockaddr template data, if required 2013-10-24 15:37:21 +02:00
Martin Willi e71c57467c printf-hook-builtin: Don't rely on isinf() return value signedness 
Many systems don't return a negative value for negative infinities; so do
a separate check.
 2013-10-24 15:37:20 +02:00
Martin Willi 5ce3c9b15a watcher: Rebuild fdset when select() fails 
This should make sure we refresh the fdset if a user closes an FD it just
removed. Some selects() seem to complain about the bad FD before signaling the
notification pipe.
 2013-10-24 15:37:20 +02:00
Martin Willi 1a20a22d09 rwlock: Disable thread cancelability while waiting in (fallback) rwlock 
An rwlock wait is not a thread cancellation point. As a canceled thread
would not have released the mutex, the rwlock would have been left in unusable
state.
 2013-10-24 14:53:53 +02:00
Martin Willi 181d071363 rwlock: Don't use buggy pthread_rwlock on OS X 
Recursive read locks don't seem to work properly, at least on 10.9.
 2013-10-24 14:53:47 +02:00
Martin Willi 2077d996a9 utils: Provide a fmemopen(3) fallback using BSD funopen() 2013-10-24 13:17:05 +02:00
Martin Willi b08292a520 semaphore: Support cancellation in wait functions of semaphore fallback 
Semaphore wait functions should be a thread cancellation point, but did
not properly release the mutex in the fallback implementation.
 2013-10-23 16:08:40 +02:00
Martin Willi 47c76c1b05 rwlock: Re-acquire rwlock even if condvar wait times out 
A caller expects that the associated rwlock is held, whether the condvar
gets signaled or the wait times out.
 2013-10-23 11:52:26 +02:00
Martin Willi fc566632da unit-tests: support testing when leak-detective has not been enabled 2013-10-11 15:12:16 +02:00
Martin Willi 390d2b50b3 NEWS: Updates for the ah, libipsec-usestats and printf-hook merges 2013-10-11 11:42:13 +02:00
Martin Willi 5900d6d469 Merge branch 'printf-hook' 
Adds a custom printf hook implementation as a fallback if neither the glibc
style hooks nor vstr is available. This can avoid the Vstr dependency on some
systems at the cost of slower and less complete printf functions.
 2013-10-11 11:12:38 +02:00
Martin Willi 795cbb98c6 printf-hook-builtin: Print NaN/Infinity floating point values as such 2013-10-11 11:06:09 +02:00
Martin Willi 8af9bf70f5 printf-hook-builtin: Correctly round up floating point values 2013-10-11 11:06:09 +02:00
Martin Willi edc7a3d02f printf-hook-builtin: Add some preliminary floating point support 
This minimalistic implementation has no aspiration for completeness or
accuracy, and just provides what we need.
 2013-10-11 11:06:09 +02:00
Martin Willi 7e6a4cdc84 printf-hook-builtin: Support GNU %m specifier 2013-10-11 11:06:09 +02:00
Martin Willi cabe5c0ff4 printf-hook-builtin: Add a new "builtin" backend using its own printf() routines 
Overloads printf C library functions by a self-contained implementation,
based on klibc. Does not yet feature all the required default formatters,
including those for floating point values.
 2013-10-11 11:06:02 +02:00
Martin Willi ebca34d782 printf-hook: Add some basic printf() string/integer test functions 2013-10-11 11:05:37 +02:00
Martin Willi 243048248b printf-hook: Move glibc/vstr printf hook backends to separate files 2013-10-11 11:05:30 +02:00
Martin Willi 11282d0054 Merge branch 'libipsec-usestats' 
Brings SA usage statistics and volume based expiration to libipsec and the
associated kernel-libipsec plugin. Additionally removes any ESPv3 style TFC
padding found in incoming packets.
 2013-10-11 10:25:35 +02:00
Martin Willi d53002f088 libipsec: Enforce byte/packet lifetimes on SAs 2013-10-11 10:23:18 +02:00
Martin Willi 12fdc2b16b kernel-libipsec: Support ESPv3 TFC padding 2013-10-11 10:23:18 +02:00
Martin Willi 293515f95c libipsec: remove extra RFC4303 TFC padding appended to inner payload 2013-10-11 10:23:17 +02:00
Martin Willi d53f9b9637 kernel-libipsec: Support query_sa() to report usage statistics 2013-10-11 10:23:17 +02:00
Martin Willi b08967d6d8 libipsec: Support usage statistics and query_sa() on IPsec SAs 2013-10-11 10:23:17 +02:00
Martin Willi d7083b6541 kernel: Use a time_t to report use time in query_policy() 2013-10-11 10:23:17 +02:00
Martin Willi c99458e94e kernel: Use a time_t to report use time in query_sa() 2013-10-11 10:23:17 +02:00
Martin Willi b59bcba2b3 Merge branch 'ah' 
Brings support for Security Associations integrity protected by the
Authentication Header protocol, both to IKEv1 and IKEv2. Currently only plain
AH is supported, but no (now deprecated) RFC2401 style AH+ESP bundles.
 2013-10-11 10:15:43 +02:00
Martin Willi 5fdbb3c6ad ipsec.conf: Add a description for the new 'ah' keyword. 2013-10-11 10:15:22 +02:00
Martin Willi fa7815538f testing: Add an IKEv1 host2host AH transport mode test case 2013-10-11 10:15:22 +02:00
Martin Willi ef4560121d testing: Add an IKEv1 net2net AH test case 2013-10-11 10:15:22 +02:00
Martin Willi 80a82b8d67 testing: Add an IKEv2 host2host AH transport mode test case 2013-10-11 10:15:22 +02:00
Martin Willi 850bab6d58 testing: Add an IKEv2 net2net AH test case 2013-10-11 10:15:22 +02:00
Martin Willi 71d468ec90 testing: Allow AH packets in default INPUT/OUTPUT chains 2013-10-11 10:15:22 +02:00
Martin Willi 4817595876 updown: Install forwarding rules with the actually used protocol 2013-10-11 10:15:22 +02:00
Martin Willi c5d9b133e0 updown: Add a PLUTO_PROTO variable set to 'ah' or 'esp' 2013-10-11 10:15:21 +02:00
Martin Willi e48e530b44 starter: Reject connections having both 'ah' and 'esp' keywords set 
We currently don't support mixed proposals or bundles, so don't create the
illusion we would.
 2013-10-11 10:15:21 +02:00
Martin Willi 757343d90e ike: Define keylength for aescmac algorithm 2013-10-11 10:15:21 +02:00
Martin Willi a1379e3210 ikev1: Support parsing of AH+IPComp proposals 2013-10-11 10:15:21 +02:00
Martin Willi 25f74be8f9 starter: Remove obsolete 'auth' option 2013-10-11 10:15:21 +02:00
Martin Willi d489e75579 ikev1: Accept more than two certificate payloads 2013-10-11 10:15:21 +02:00
Martin Willi 3771b85806 ikev1: Support en-/decoding of SA payloads with AH algorithms 2013-10-11 10:15:21 +02:00
Martin Willi 44e6aa4fb7 kernel-handler: Whitespace cleanups 2013-10-11 10:15:21 +02:00
Martin Willi f6037b5506 stroke: List proposals in statusall without leading '/' in AH SAs 2013-10-11 10:15:21 +02:00
Martin Willi 4bf92306eb ikev1: Delete quick modes with the negotiated SA protocol 2013-10-11 10:15:21 +02:00
Martin Willi 5d569e07fd trap-manager: Install trap with SA protocol of the first configured proposal 2013-10-11 10:15:21 +02:00
Martin Willi 21b096f3b8 child-sa: Save protocol during SPI allocation 
This allows us to properly delete the incomplete SA with the correct protocol
should negotiation fail.
 2013-10-11 10:15:21 +02:00
Martin Willi 908fe1632d ikev1: Negotiate SPI with the first/negotiated proposal protocol 2013-10-11 10:15:21 +02:00
Martin Willi cdab8630d9 ikev2: Allocate SPI with the protocol of the first/negotiated proposal 2013-10-11 10:15:21 +02:00
Martin Willi f0c59e1cf8 proposal: Strip redundant integrity algos for ESP proposals only 2013-10-11 10:15:21 +02:00
Martin Willi 0576412989 stroke: Configure proposal with AH protocol if 'ah' option set 2013-10-11 10:15:20 +02:00
Martin Willi a07b97e804 starter: Add an 'ah' keyword for Authentication Header Security Associations 2013-10-11 10:15:20 +02:00
Martin Willi d2e4dd75b7 ikev1: Accept reauthentication attempts with a keep unique policy from same host 
When we have a "keep" unique policy in place, we have to be less strict in
rejecting Main/Aggressive Modes to enforce it. If the host/port equals to
that of an existing ISAKMP SA, we assume it is a reauthentication attempt
and accept the new SA (to replace the old).
 2013-09-30 13:51:12 +02:00
Martin Willi 9c19d7ca31 ikev1: Don't log a reauthentication detection message if no children adopted 
When a replace unique policy is in place, the children get adopted during
the uniqueness check. In this case the message is just misleading.
 2013-09-30 13:51:11 +02:00
Martin Willi ee99f37ecc ikev1: Delay a potential delete for a duplicate IKE_SA having a replace policy 
Sending a DELETE for the replaced SA immediately is problematic during
reauthentication, as the peer might have associated the Quick Modes to the
old SA, and also delete them.

With this change the delete for the old ISAKMP SA is usually omitted, as it
is gets implicitly deleted by the reauth.
 2013-09-30 13:51:11 +02:00
Martin Willi 25260a290d .gitignore: Add .dirstamp files touched by automake 2013-09-13 14:12:35 +02:00
Martin Willi 2b84ccd6a6 libipsec: fix memory management when cloning ip_packet 2013-09-13 13:56:44 +02:00
Martin Willi 96136a1229 libipsec: check for a policy with the reqid of the SA on decapsulation 
To prevent a client from sending a packet with a source address of a different
client, we require a policy bound via reqid to the decapsulating SA.
 2013-09-13 13:56:43 +02:00
Martin Willi 791fde1669 stroke: don't remove a matching peer config if used by other child configs 
When configurations get merged during add, we should not remove peer configs
if other connection entries use the same peer config.
 2013-09-13 13:56:31 +02:00
Martin Willi 38fb8e4ed5 NEWS: 5.1.1 update for merged branches 2013-09-04 11:06:58 +02:00
Martin Willi 1fd5c7fbac load-tester: support extended traffic selector syntax, as in leftsubnet 
In addition the initiator may use %unique as port, using a distinct port for
each connection, starting from 1025.
 2013-09-04 10:49:48 +02:00
Martin Willi 47b4a51402 load-tester: add an option to test transport/beet connections 2013-09-04 10:49:48 +02:00
Martin Willi 60fcbb8ba8 Merge branch 'ike-address-ranges' 
Adds support for multiple subnets and address ranges in left/right ipsec.conf
options. As responder the connection is acceptable if the address is in one of
the ranges/subnets. To initiate connections, at least one single IP or hostname
is required for the peer address.
 2013-09-04 10:43:35 +02:00
Martin Willi 6301ec0ac5 man: add support for multiple addresses/ranges/subnets in ipsec.conf left= 2013-09-04 10:38:37 +02:00
Martin Willi 3070697f9f ike: support multiple addresses, ranges and subnets in IKE address config 
Replace the allowany semantic by a more powerful subnet and IP range matching.
Multiple addresses, DNS names, subnets and ranges can be specified in a comma
separated list. Initiators ignore the ranges/subnets, responders match
configurations against all addresses, ranges and subnets.
 2013-09-04 10:38:37 +02:00
Martin Willi beffdc6ab8 ike-cfg: remove the to be obsoleted allow any parameter in get_my/other_addr 2013-09-04 10:38:37 +02:00
Martin Willi 62282ec0ed backends: use ike_cfg host matching functions 2013-09-04 10:38:37 +02:00
Martin Willi 6f666192bb ike-cfg: add methods to match a host against configured local/remote addresses 2013-09-04 10:38:37 +02:00
Martin Willi 7446fa2860 trap-manager: use ike_cfg resolver functions 2013-09-04 10:38:37 +02:00
Martin Willi 0edce68767 ike-sa: use ike_cfg resolver functions 2013-09-04 10:38:36 +02:00
Martin Willi e743275cae ike-cfg: add a method to resolve local/remote hosts with port 2013-09-04 10:38:36 +02:00
Martin Willi f7cb6eaaa8 Merge branch 'ikev1-pushmode' 
Implements Mode Config Push mode in IKEv1 using the existing modeconfig=push
ipsec.conf option.
 2013-09-04 10:35:26 +02:00
Martin Willi a858064455 stroke: ignore a leftsourceip if a rightsourceip is given as well 
As we always negotiate virtual IPs in charon, having both left- and
rightsourceip is not allowed. Both in IKEv1 and IKEv2 we support a single
configuration payload exchange only.
 2013-09-04 10:33:38 +02:00
Martin Willi 16149401e9 man: update ipsec.conf modeconfig keyword 2013-09-04 10:33:38 +02:00
Martin Willi e3311e9b87 ikev1: implement mode config push mode 2013-09-04 10:33:38 +02:00
Martin Willi 2bae838d5e stroke: re-enable modeconfig keyword 2013-09-04 10:33:38 +02:00
Martin Willi 9aeaa7396e peer-cfg: add a pull/push mode option to use with mode config 2013-09-04 10:33:37 +02:00
Martin Willi 478f9e772b Merge branch 'xauth-radius-multi' 
Introduces multiple rounds in the eap-radius XAuth backend, concatenating
answers to a single password to verify using a RADIUS User-Password attribute.
This is known to work fine with iOS and OS X clients, allowing two-factor
authentication with proper dialogs.

Different XAuth "profiles" for each backend can be selected using a generic
colon sperated suffix for the XAuth string.
 2013-09-03 16:36:25 +02:00
Martin Willi e8b36eb92f charon-cmd: support prompting for a PIN 
To support a Password and PIN XAuth combo, additionally support multiple
prompts for different credential types.
 2013-09-03 16:26:19 +02:00
Martin Willi 45797bd50b xauth-generic: honor requested XAuth credential types as a client 
Support requesting of XAuth PINs and print XAuth messages.
 2013-09-03 16:26:19 +02:00
Martin Willi 3482cc9cf6 attributes: shorten some Unity and XAuth attribute short names 2013-09-03 16:26:19 +02:00
Martin Willi 61b0079881 message: print type of configuration payload 2013-09-03 16:26:19 +02:00
Martin Willi 8e4b258030 message: print attributes for IKEv1 configuration payloads as well 2013-09-03 16:26:19 +02:00
Martin Willi d787ada894 eap-radius: support XAuth configuration profiles, defining multiple XAuth rounds 2013-09-03 16:26:19 +02:00
Martin Willi 510ecf612a xauth: add a configuration string option to be passed to XAuth instances 
The configuration string is appended to the XAuth backend name, separated by
a colon. The configuration string is passed untouched to the backend, where
it can change the behavior of the XAuth module.
 2013-09-03 16:26:19 +02:00
Martin Willi b656f63efe testing: support a .gitignored testing.conf.local for site-local configurations 2013-08-29 15:55:23 +02:00
Martin Willi a0cd955f42 charon-xpc: add a note how to build the source tarball 2013-08-29 12:28:54 +02:00
Martin Willi 74ee1120d7 charon-xpc: include and prefer AES-GCM algorithms in ESP proposal 2013-08-29 11:37:07 +02:00
Martin Willi 49032d15be stroke: stop enumerating IKE_SAs in statusall if output stream gets closed 
If the output stream is not interested in more information, it can close the
the stream. Checking for stream errors avoids useless enumeration of IKE_SAs,
saving resources. This allows to use "ipsec statusall | head" to monitor the
daemon, or stop enumerating IKE_SAs after a specific entry has been found.
 2013-08-23 14:27:17 +02:00
Martin Willi a24515c515 backtrace: rename clone() method clashing with system call 
Fixes #376.
 2013-08-09 09:13:39 +02:00
Martin Willi 881e9a7e2e updown: remove description of unsupported PLUTO_ variables 
These have been set by pluto, but are not by charons updown plugin.
 2013-08-08 14:48:32 +02:00
Martin Willi 3b6d8855e8 scripts: link against librt only if required 
With glibc, this seems to be the case for 2.17 and older versions only.
 2013-08-08 09:12:52 +02:00