denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
8,286 Commits 1 Branch 0 Tags
7e84c4275c03b1aaf3c4a2077b08f67173fad382
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Tobias Brunner 7e84c4275c Removed auth_cfg_t.replace_value() and replaced usages with add(). 
replace_value() was used to replace identities. Since for these the latest is
now returned by get(), adding the new identity with add() is sufficient.
 2012-04-18 18:50:14 +02:00
Tobias Brunner ebc1ffe451 Changed the order and semantics of rules we expect only once in auth_cfg_t. 
These rules are now inserted at the front of the internal list, this
allows to retrieve the rule added last with get(). For other rules the
order in which they are added is maintained (this allows to properly
enumerate them).
 2012-04-18 18:50:14 +02:00
Tobias Brunner 80067cf9e6 Store password with remote ID to tie it stronger to a specific connection. 2012-04-18 13:32:49 +02:00
Tobias Brunner 9f1b303afc Added stroke user-creds command, to set username/password for a connection. 2012-04-17 14:20:58 +02:00
Tobias Brunner 7b00fdeb84 Added method to add additional shared secrets to stroke_cred_t. 2012-04-17 14:20:58 +02:00
Tobias Brunner ff5cb888f6 Additional prompt keyword added to stroke. 2012-04-17 14:20:58 +02:00
Tobias Brunner 4c31657d2c Typo fixed. 2012-04-17 14:20:58 +02:00
Tobias Brunner 7fd6c078b6 Use IP address as ID as responder if not configured or no IDr received. 2012-04-16 14:09:51 +02:00
Tobias Brunner b241a37411 Fall back on IP address as IDi if none is configured at all. 2012-04-16 13:44:27 +02:00
Tobias Brunner b447af658c Use auth_cfg_t.replace_value where appropriate. 2012-04-16 13:44:27 +02:00
Tobias Brunner 68cca941cf Added a simple method to replace the value of a rule in auth_cfg_t. 2012-04-16 13:44:27 +02:00
Tobias Brunner 4b32bde48e Fixed IDi in case neither left nor leftid is configured. 2012-04-16 13:44:27 +02:00
Tobias Brunner 4e2e77d540 Typo fixed in NEWS. 2012-04-14 08:41:32 +02:00
Tobias Brunner ae9ce83511 Properly initialize src in ike_sa_t.is_any_path_valid(). 2012-04-06 10:54:44 +02:00
Tobias Brunner bad192069f Make AES-CMAC actually usable for IKEv2. 2012-04-04 10:51:46 +02:00
Tobias Brunner 37d43ebbde Doxygen fixes. 2012-04-03 10:56:47 +02:00
Tobias Brunner d7590217c3 Added NEWS about cmac plugin. 2012-04-03 10:48:03 +02:00
Tobias Brunner 811e7490f6 Added test vectors for AES-CMAC. 2012-04-03 10:45:09 +02:00
Tobias Brunner c0d39c205c Implemented AES-CMAC based PRF and signer. 
The cmac plugin implements AES-CMAC as defined in RFC 4493 and the
signer and PRF based on it as defined in RFC 4494 and RFC 4615,
respectively.
 2012-04-03 10:40:47 +02:00
Tobias Brunner 9a6b1cb412 Fixed GNU license header in hmac and xcbc plugins. 2012-04-03 10:33:59 +02:00
Tobias Brunner ef511fc03d Add support for dnQualifier in DNs. 2012-03-29 10:01:55 +02:00
Tobias Brunner a281494abd Added NEWS about resolvconf support. 2012-03-27 10:44:21 +02:00
Tobias Brunner ed2cab08d2 Make resolvconf interface prefix configurable. 2012-03-27 10:44:21 +02:00
Tobias Brunner caae5a5c0f Added support for the resolvconf framework in resolve plugin. 
If /sbin/resolvconf is found nameservers are not written directly to
/etc/resolv.conf but instead resolvconf is invoked.
 2012-03-27 10:44:21 +02:00
Tobias Brunner 817ab8a8d4 Don't cast second argument of mem_printf_hook (%b) to size_t. 
Also treat the given number as unsigned int.

Due to the printf hook registration the second argument of
mem_printf_hook (if called via printf etc.) is always of type int*.
Casting this to a size_t pointer and then dereferencing that as int does
not work on big endian machines if int is smaller than size_t (e.g. on ppc64).

In order to make this change work if the argument is of a type larger
than int, size_t for instance, the second argument for %b has to be casted
to (u_)int.
 2012-03-27 09:10:34 +02:00
Tobias Brunner adfd3b992f smp: Use proper signed type to get return value of read(2). 2012-03-27 09:10:33 +02:00
Tobias Brunner 008e2df477 pluto: Use time_monotonic() instead of a custom implementation. 2012-03-27 09:10:33 +02:00
Tobias Brunner 8e066237a7 Don't include individual glib headers in nm plugin. 
Expections are glib/gi18n.h, glib/gi18n-lib.h, glib/gprintf.h and
glib/gstdio.h.
 2012-03-26 15:23:17 +02:00
Tobias Brunner cd6b5bf8e9 Clear peer addresses during HA update. 2012-03-09 10:30:37 +01:00
Tobias Brunner 72b2811204 Simplified some route lookups now that we store all peer addresses in a list. 2012-03-09 10:22:21 +01:00
Tobias Brunner 94bbc60256 Renamed list of additional peer addresses as it now stores all known addresses. 2012-03-09 10:17:42 +01:00
Tobias Brunner 2fe624cca9 Store the peer's current address as additional known address on the IKE_SA. 
This allows to switch back to the original address after switching to
any of the additional addresses.
 2012-03-09 10:08:41 +01:00
Tobias Brunner 0808d60ebf maemo: New upstream release. 2012-02-27 18:15:51 +01:00
Tobias Brunner 686cfd4e34 Added support for untruncated MD5 and SHA1 HMACs in ESP as used in RFC 4595. 
This requires a Linux kernel >= 2.6.33.
 2012-02-27 14:31:19 +01:00
Tobias Brunner a190ec0ac5 Compiler warnings fixed. 2012-02-14 16:09:44 +01:00
Tobias Brunner 0f7d381cfe pluto: Print expiry time more properly. 2012-02-14 09:38:00 +01:00
Tobias Brunner 7efde9011e pluto: Drop support for legacy PSK format. 
Any line in ipsec.secrets starting with " or ' was treated as PSK
without ID selectors by pluto.  This prevented it from supporting DNs
like "C=CH, O=Linux strongSwan, OU=Sales, [email protected]" as
ID selectors.

PSKs defined in this legacy format can easily be updated by changing

"thisIsASecret"

into

: PSK "thisIsASecret"
 2012-02-08 13:36:32 +01:00
Tobias Brunner b96eb46d5c Some Doxygen fixes. 2012-02-07 11:20:46 +01:00
Tobias Brunner dcefa26787 Moved and clarified NEWS about PKCS#8 plugin. 2012-02-01 18:32:28 +01:00
Tobias Brunner e81260d426 Moved log message for unexpected ASN.1 objects to level 2. 
This avoids error messages if later builders can successfully decode something.
 2012-02-01 18:27:46 +01:00
Tobias Brunner fd1ff46f61 Added support for PKCS#5 v2 schemes when decrypting PKCS#8 files. 2012-02-01 18:27:46 +01:00
Tobias Brunner 1f2e036b3e NEWS about pkcs8 plugin added. 2012-02-01 18:27:46 +01:00
Tobias Brunner cab127cba6 Added support for encrypted PKCS#8 files (for some PKCS#5 v1.5 schemes). 2012-02-01 18:27:46 +01:00
Tobias Brunner db3334dc32 Added support to parse PKCS#8 encoded ECDSA private keys. 2012-02-01 18:27:45 +01:00
Tobias Brunner 27f8a61df3 OpenSSL plugin parses ECDSA private keys with explicitly specified EC parameters. 
This is needed in case the key itself does not contain the parameters,
which is the case for PKCS#8.
 2012-02-01 18:27:45 +01:00
Tobias Brunner b20c54ff3f Add builder part for parameters from algorithmIdentifier. 2012-02-01 18:27:45 +01:00
Tobias Brunner 25c6d26c1d Return parsed parameters from algorithmIdentifier if they are an OID (aka EC named curve). 
Explicit EC parameters are not supported with this function, but before this
change no parameters were actually ever returned.
 2012-02-01 18:27:45 +01:00
Tobias Brunner 9255aa87ec Parse RSA private keys from PKCS#8 encoded blobs. 2012-02-01 18:27:45 +01:00
Tobias Brunner 5ec525c1d1 Added PKCS#8 stub plugin. 2012-02-01 18:27:45 +01:00
Tobias Brunner 9ec66bc1a5 Added an option to load CA certificates without CA basic constraint. 
Enabling this option treats all certificates in ipsec.d/cacerts and
ipsec.conf ca sections as CA certificates even if they do not contain a
CA basic constraint.
 2012-02-01 14:34:52 +01:00
Tobias Brunner 7171d8765e Disable crypto benchmarking if CLOCK_THREAD_CPUTIME_ID is not available. 2012-01-30 11:04:55 +01:00
Tobias Brunner f1ba06c1c6 Cache list of plugin names to further simplify its usage. 
Also helpful for ipsec statusall to avoid having to enumerate plugins.
 2012-01-19 12:37:42 +01:00
Tobias Brunner fdf1f239ef Log list of loaded plugins in main PKI help output. 2012-01-19 11:56:43 +01:00
Tobias Brunner 576298a3ef Simplified logging of list of loaded plugins. 2012-01-19 11:56:03 +01:00
Tobias Brunner ad1aaf4be3 Function added to plugin_loader to get a list of the names of loaded plugins. 2012-01-19 11:51:51 +01:00
Tobias Brunner 9d17c1a679 Starter depends on whack/stroke on Android. 
With this change whack and stroke get installed automatically if starter is
enabled.
 2012-01-12 19:19:47 +01:00
Tobias Brunner 2e0b478a01 Android 4 requires LOCAL_MODULE_TAGS to be set for all modules. 
Because all packages are now marked as optional executables that are to
be installed on the final system have to be added to PRODUCT_PACKAGES in
build/target/product/core.mk.  Dependencies (such as libraries) are
installed automatically.
 2012-01-12 19:18:35 +01:00
Tobias Brunner 35a1986142 Fixed additional typos in comments and log messages. 2012-01-12 11:42:42 +01:00
Tobias Brunner 17e3a92661 Fix gettid() on Android, which is defined in unistd.h there. 2012-01-12 11:08:22 +01:00
Tobias Brunner 66f16d9629 Use native gettid() if available (which is the case on Android). 2012-01-10 18:31:33 +01:00
Tobias Brunner 190cd8a475 pluto: Use srand() to initialize the C library PRNG. 
Otherwise rekey and DPD times would always be the same after a restart.
 2012-01-04 13:19:29 +01:00
Tobias Brunner 7c0c2349a9 Make number of concurrently handled stroke messages configurable. 2011-12-29 18:41:39 +01:00
Tobias Brunner 8ff513a863 Limit the number of concurrently handled stroke messages. 
This avoids clogging the thread pool with potentially blocking jobs.
 2011-12-29 18:39:34 +01:00
Tobias Brunner e86b685da5 Allow callers to force ASN.1 date encoding as GENERALIZEDTIME. 2011-12-23 18:07:39 +01:00
Tobias Brunner f4095fdc8a Avoid integer overflow when parsing ASN.1 dates. 
This only works properly if sizeof(time_t) > 4.
 2011-12-23 16:38:28 +01:00
Tobias Brunner 20d752b4ff pki: Avoid integer overflow when calculating certificate lifetimes. 
This only works properly if sizeof(time_t) > 4.
 2011-12-23 16:33:24 +01:00
Tobias Brunner 1267127c11 Properly ASN.1 encode dates in certificates depending on the year. 2011-12-23 16:29:41 +01:00
Tobias Brunner 70a4737690 pluto: Fixed expiration date test. 2011-12-23 15:32:06 +01:00
Tobias Brunner fc726f1359 Fix deadlock in trap_manager_t during acquire. 
Also fixes a TOCTOU issue regarding the use of entry_t.pending.

The deadlock was caused because the rwlock was being locked while
waiting for an IKE_SA. Triggering the deadlock was a bit tricky, here
is the description by Thomas Egerer (the reporter of this issue):

"
The deadlock occurs when the following happens (in the given order):

a) an IKE_SA is built and a thread is processing the IKE_AUTH request,
   which can take a bit longer when a smartcard is involved. This
   causes the ike_sa_manager to lock a particular IKE_SA exclusively.
b) an acquire is triggered which causes the rwlock in the trap_manager
   to be read-locked, the subsequent call to
   ike_sa_manager->checkout_by_config has to wait until a) unlocks
   it's ike_sa.
c) a child_cfg contained in the peer_cfg belonging to the ike_sa
   a) has locked is routed causes the child_configs contained
   in the peer config to be locked by c) while the actual routing
   code within trap_manager tries to writelock it's rwlock.

That's about it. As soon as a) finishes authentication of the peer
and tries to find a matching child sa it will try to lock the child
configs of the peer config which is not possible since it has been
locked by c).

Thread | Resource locked                | Resource desired
-------+--------------------------------+--------------------------------
  (a)  | ike_sa in ike_sa_manager       | child_cfgs of peer_cfg
       |                                |
  (b)  | rwlock in trap-manager (read)  | ike_sa in ike_sa_manager
       |                                |
  (c)  | child_cfgs of peer_cfg         | rwlock in trap-manager (write)
"

With this patch thread (b) now does not hold the lock while waiting for
the IKE_SA. Thus (c) can get the write lock, and (a) can subsequently
lock the mutex in the peer_cfg which then finally allows (b) to checkout
the IKE_SA.
 2011-12-23 11:07:14 +01:00
Tobias Brunner 5317dd6887 Added atomic compare and swap operations. 
Using a GCC atomic builtin if available or a global mutex otherwise.
 2011-12-23 11:04:55 +01:00
Tobias Brunner d6656f11e4 Fixed flush() method of trap_manager_t. 
A segmentation fault could have happened during destruction of the trap
manager after calling flush().
 2011-12-23 10:38:10 +01:00
Tobias Brunner cc4b48e886 Also log PGP parsing in ASN log group. 2011-12-16 16:44:38 +01:00
Tobias Brunner b6e0784385 Log messages for PKCS1 and PEM parsing in ASN log group. 2011-12-16 16:44:38 +01:00
Tobias Brunner eb497205e3 Log most X.509 related messages in new ASN log group. 2011-12-16 16:44:38 +01:00
Tobias Brunner c7f3a056dd Log ASN.1 parsing in new ASN debug group. 2011-12-16 16:44:38 +01:00
Tobias Brunner 54d096a712 Added ASN debug group to log low-level encoding/decoding (ASN.1, X.509). 
This will allow us to remove quite some clutter from the LIB debug group
for higher debug levels.
 2011-12-16 16:44:38 +01:00
Tobias Brunner c17f6f96e2 Log native thread ID when a thread is created. 
If possible gettid() is used, otherwise pthread_self() is logged (which is
not completely portable, but seems to work on most supported platforms).
 2011-12-16 16:44:38 +01:00
Tobias Brunner b24287c269 Log worker thread ID with two digits. 2011-12-16 16:44:38 +01:00
Tobias Brunner a5951a2861 Make sure the certificate cache is flushed when plugins are unloaded. 
This avoids segmentation faults when plugins implementing cert_t are
already unloaded when the cache is flushed during destruction.
 2011-12-15 12:20:09 +01:00
Tobias Brunner 49b44c98c1 Charon also supports type=passthrough|drop. 2011-12-14 19:01:39 +01:00
Tobias Brunner b768d6a4a5 Documented xauth_identity in ipsec.conf(5) man page. 2011-12-14 18:04:39 +01:00
Tobias Brunner 6d4c6b8f41 Documented binary secrets in ipsec.secrets(5) man page. 2011-12-14 17:46:27 +01:00
Tobias Brunner 3eff54a5ca Added missing libsimaka files to Android.mk. 2011-12-14 16:38:30 +01:00
Tobias Brunner 406c5a593b Destroy mediation managers before unloading plugins. 2011-12-14 14:24:37 +01:00
Tobias Brunner b4f037bb08 libfast: Fixed compiler warning. 2011-11-25 10:22:41 +01:00
Tobias Brunner 5ddeaf2884 Fixed compiler warnings for DH groups that define no subgroup. 2011-11-25 10:18:03 +01:00
Tobias Brunner a660f1426e Fixed missing initializer compiler warning. 2011-11-25 09:52:19 +01:00
Tobias Brunner b46a5cd4ef Fixed check for log groups when debug_t is unsigned. 
The range and signedness of enum types is up to the compiler.
 2011-11-25 09:48:32 +01:00
Tobias Brunner 282dcb9974 Fixed check of max_poll_time as it is an unsigned int. 2011-11-25 09:46:45 +01:00
Tobias Brunner edad908792 Fixed compiler warnings regarding enum comparison. 
Warnings like

  comparison of unsigned expression < 0 is always false

are reported with -Wextra when enum types that are compiled to an
unsigned type (which is up to the compiler) are checked for negativity.
 2011-11-25 09:40:30 +01:00
Tobias Brunner 4f775afda9 Added missing Android.mk files to distribution. 2011-11-22 18:31:12 +01:00
Tobias Brunner 727fe0f99e libfreeswan: Fixed compiler warning. 2011-11-09 19:20:10 +01:00
Tobias Brunner 4de8f280e1 pkcs11: Fixed a bug when creating public keys. 2011-11-09 17:39:24 +01:00
Tobias Brunner fe11d4bd64 Properly disable starter and pluto in top Android.mk. 2011-11-09 17:35:59 +01:00
Tobias Brunner 856baca23e Fixed monolithic build of libcharon with libtnccs enabled. 2011-11-08 18:35:11 +01:00
Tobias Brunner 59c5f048bb Correctly refer to tnc-tnccs plugin when building monolithically. 2011-11-08 18:35:11 +01:00
Tobias Brunner b12ad862c1 Calculate checksums for libsimaka and libtls. 
These are currently not checked though. And because they don't define a
<libname>_init function an warning is reported when the checksum is
calculated.
 2011-11-08 18:35:11 +01:00
Tobias Brunner 89bad63bac Defer calculation of checksums until installation. 
The checksum is now calculated from the installed libraries and plugins.
This allows to calculate checksums for plugins linking to libraries like
libtls as these are relinked during installation.
 2011-11-08 18:35:11 +01:00
Tobias Brunner 4ad67fe7d5 Fixed formatting for longer plugin names in checksum_builder output. 2011-11-08 18:35:11 +01:00
Tobias Brunner 9192f78f70 Don't link libtnccs to checksum_builder. 
Linking is only required for libraries defining global symbols used by
plugins to which the plugins do not link themselves.
 2011-11-08 18:35:11 +01:00