denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
11,486 Commits 1 Branch 0 Tags
893da0411f86f1f36db14f9d2dfd3bed07aa0c05
Commit Graph
11486 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Martin Willi 893da0411f ike-sa: use arrays instead of linked lists in long lived collections 
This saves about 1.5KB of memory per IKE_SA.
 2013-07-17 17:20:17 +02:00
Martin Willi 4730c4b32b unit-tests: implement tests for array collection 2013-07-17 17:20:17 +02:00
Martin Willi 2621ff4d40 array: introduce an array collection storing elements very efficiently 
Currently we use the very versatile linked-list collection to store elements
with variable count. This is fine, but very inefficient: Due to the many
methods in the linked list, on 64-bit platforms an empty list alone is more
than 200 bytes. As we currently have about 50 lists per IKE_SA/CHILD_SA pair,
this takes up to 10KB just for managing the empty lists. This is about the
half of memory used by an IKE_SA/CHILD_SA pair, and obviously way too much.

The new array type is not an object, but a collection of functions on an
abstract type.

The following lists are per IKE_SA and should be considered for a replacement
with more efficient arrays (this uses load-testers on-demand created dynamic
configurations, other scenarios have different lists):

14 -> ike_sa_create() @ src/libcharon/sa/ike_sa.c:2198
10 -> auth_cfg_create() @ src/libstrongswan/credentials/auth_cfg.c:1088
 6 -> task_manager_v2_create() @ src/libcharon/sa/ikev2/task_manager_v2.c:1505
 6 -> proposal_create() @ src/libcharon/config/proposal.c:592
 5 -> peer_cfg_create() @ src/libcharon/config/peer_cfg.c:657
 4 -> child_sa_create() @ src/libcharon/sa/child_sa.c:1090
 2 -> child_cfg_create() @ src/libcharon/config/child_cfg.c:536
 1 -> ike_cfg_create() @ src/libcharon/config/ike_cfg.c:330
 1 -> put_connected_peers() @ src/libcharon/sa/ike_sa_manager.c:854
 2013-07-17 17:20:17 +02:00
Tobias Brunner f067348134 kernel-libipsec: Log error if no local address is found when installing routes 2013-07-15 14:37:31 +02:00
Tobias Brunner 1ee1163214 dumm: Sort templates by name 2013-07-15 14:37:05 +02:00
Tobias Brunner 9e7a45bec2 testing: Don't load certificates explicitly and delete CA certificates in PKCS#12 scenarios 
Certificates are now properly extracted from PKCS#12 files.
 2013-07-15 11:27:07 +02:00
Tobias Brunner 591f923134 stroke: Add certificates extracted from PKCS#12 files to correct credential set 
Only keys and shared secrets are moved from the temporary credential set after
loading all secrets.
 2013-07-15 10:59:13 +02:00
Tobias Brunner e0b868f79e pkcs12: Add plugin dependencies with soft dependencies on the most common algorithms 2013-07-15 10:48:19 +02:00
Martin Willi 1e54e40f5d leak-detective: remove hdr entry when reallocating zero bytes 2013-07-12 20:00:16 +02:00
Martin Willi c93cf85356 leak-detective: print total of allocated/leaked bytes in usage/report 2013-07-12 20:00:14 +02:00
Martin Willi 783b55cc5c dumm: add include for in.h, if_bridge.h now uses struct in6_addr 2013-07-12 18:21:24 +02:00
Andreas Steffen 126778679f Recognize critical IssuingDistributionPoint CRL extension 2013-07-12 09:00:47 +02:00
Andreas Steffen 0a013e1af5 Override policy recommendation in enforcement 2013-07-11 10:34:00 +02:00
Andreas Steffen 9e0182b922 openssl plugin can replace random, hmac, and gcm plugins 2013-07-10 20:38:07 +02:00
Andreas Steffen 3910fb3715 Added openssl-ikev2/net2net-pkcs12 scenario 2013-07-10 20:25:49 +02:00
Andreas Steffen 49a26e5b57 Added ikev2/net2net-pkcs12 scenario 2013-07-10 20:17:44 +02:00
Andreas Steffen fad3396f96 Version bump to 5.1.0dr3 2013-07-10 17:50:25 +02:00
Andreas Steffen 3b569df215 conntrack -F makes ikev2/nat-rw scenario to work always 2013-07-10 17:50:25 +02:00
Martin Willi 81959e6406 leak-detective: add a usage threshold option based on the number of allocations 2013-07-10 17:28:45 +02:00
Martin Willi 82d0317be6 leak-detective: set_state() only affects the calling thread 
The only user (bfd backtraces) is fine with that, and we really should not
mess the enable flag while doing allocations with other threads.
 2013-07-10 17:28:32 +02:00
Martin Willi f960b39061 leak-detective: take a copy of backtrace while printing traces 
As we don't want to hold the lock, we must make sure backtraces keep valid
while printing them.
 2013-07-10 17:28:24 +02:00
Martin Willi d9c459e855 backtrace: add a clone() method 2013-07-10 17:28:18 +02:00
Martin Willi 3b26f04cf4 leak-detective: remove hdr from the allocation list during realloc() 
If realloc moves an allocation, the original allocation gets freed. We
therefore must remove the hdr from the list, as it is invalid. We can add it
afterwards once it has been updated, allowing us to unlock the list during
reallocation.
 2013-07-10 16:37:08 +02:00
Andreas Steffen 979801278f Fixed alignment of device ID column 2013-07-10 11:37:22 +02:00
Tobias Brunner b23bd71466 android: New release after adding support for EAP-TNC 
Also disabled listening on IPv6 because the Linux kernel currently does
not support UDP encapsulation for IPv6.
 2013-07-08 18:51:07 +02:00
Tobias Brunner f32eb48e9a Merge branch 'android-byod' 
Adds support for EAP-TNC with a custom Android-specific IMC that
collects data such as installed packages, file hashes or system
settings.

Some parts of the implementation are based on the bachelor semester
project 'strongSwan Android 4 Client with Endpoint Assessment' by
Christoph Bühler and Patrick Lötscher.
 2013-07-08 18:50:09 +02:00
Tobias Brunner 7ccf02ee93 android: Properly handle dotted-quad notation of IPv6 addresses 
For nestat output like ::ffff:127.0.0.1:9876 we shall not treat 127 as
port but 9876 instead.
 2013-07-08 18:49:30 +02:00
Tobias Brunner 97f1dfb3ec android: Allow IMC state to be dismissed with a swipe gesture 2013-07-08 18:49:30 +02:00
Tobias Brunner a9f94d7efb android: Use explicit locale when converting settings names 
Apparently, these functions use the user's default locale which might not
yield the expected result (e.g. lowercase I is not i in the Turkish
locale but ı instead).
 2013-07-08 18:49:30 +02:00
Tobias Brunner e1a98e7956 android: Add information about transmitted data if EAP-TNC is selected 2013-07-08 18:49:30 +02:00
Tobias Brunner 9390499584 android: Reuse certificate selector as generic two line button 2013-07-08 18:49:30 +02:00
Tobias Brunner 671614d229 android: Add device ID in BeginHandshake 2013-07-08 18:49:30 +02:00
Tobias Brunner 8a5bffb0fe android: Add new VpnType to enable BYOD features 2013-07-08 18:49:30 +02:00
Tobias Brunner d27f225d9a Use strpfx() helper where appropriate 2013-07-08 18:49:30 +02:00
Tobias Brunner f460facdca utils: Add helper function to check a string for a given prefix 2013-07-08 18:49:30 +02:00
Tobias Brunner 985dcab1c2 utils: Convert string helper macros to static inline functions 2013-07-08 18:49:29 +02:00
Tobias Brunner 2ecda3421a android: Use a different set of plugins if BYOD features are enabled 2013-07-08 18:49:29 +02:00
Tobias Brunner 6e872fea7a android: IMC state fragment is a button that shows remediation instructions or log 2013-07-08 18:49:29 +02:00
Tobias Brunner 254d8679c6 android: Show remediation instructions instead of log on failure 2013-07-08 18:49:29 +02:00
Tobias Brunner 873f389b37 android: Properly hide the IMC state fragment initially 2013-07-08 18:49:29 +02:00
Tobias Brunner 0ef98957a7 android: Add activity that displays a list of remediation instructions 
On large displays a two-pane layout is used that displays the list next
to the actual instructions.
 2013-07-08 18:49:29 +02:00
Tobias Brunner 611d35e8e8 android: Add fragment for a list of remediation instructions 
This fragment can later be used in one- or two-pane layouts.
 2013-07-08 18:49:29 +02:00
Tobias Brunner b6e05f6518 android: Add adapter for remediation instructions 2013-07-08 18:49:29 +02:00
Tobias Brunner ea022bb194 android: Add fragment that displays a single remediation instruction 2013-07-08 18:49:29 +02:00
Tobias Brunner c469cd2a66 android: RemediationInstruction implements Parcelable interface 2013-07-08 18:49:29 +02:00
Tobias Brunner 2b91085701 android: Background for state panels provides separator 2013-07-08 18:49:29 +02:00
Tobias Brunner e5bf6dcddc android: Add fragment that displays the IMC state 
The fragment hides itself if the state is unknown or the assessment
succeeded.
 2013-07-08 18:49:29 +02:00
Tobias Brunner a05acd7629 android: Handle and store IETF remediation instructions 2013-07-08 18:49:28 +02:00
Tobias Brunner 0484989dbd android: Add a parser for XML remediation instructions 2013-07-08 18:49:28 +02:00
Tobias Brunner a8dc42b295 android: Show different error message depending on IMC state 2013-07-08 18:49:28 +02:00