denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
12,694 Commits 1 Branch 0 Tags
954c63a4bc6d12b5a6a9b5e4fa010be9c1727163
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Martin Willi 954c63a4bc Merge branch 'vici' 
Introduces the vici plugin providing a Versatile IKE Configuration Interface
to configure, monitor and control the IKE daemon charon over a stable IPC
socket interface.
 2014-05-07 15:12:09 +02:00
Martin Willi 4787523cc3 NEWS: Add vici plugin news 2014-05-07 14:13:39 +02:00
Martin Willi 1e4ee168c8 vici: Check if header has been received before processing an empty message 
If do_read() returns with EWOULDBLOCK, we must ensure that we actually have
processed the full length header before checking the zero-initialized buffer
length.
 2014-05-07 14:13:39 +02:00
Martin Willi afb7ef4908 vici: Properly filter by CHILD_SA name while undoing start actions 2014-05-07 14:13:39 +02:00
Martin Willi 682c9966fa vici: Fallback to socket listening port if no explicit local port specified 2014-05-07 14:13:39 +02:00
Martin Willi dffd60083d vici: Support a "mtu" value for the tfc_padding option 2014-05-07 14:13:39 +02:00
Martin Willi 5619d40613 vici: Handle the "trap" action as an alias for "route" 2014-05-07 14:13:39 +02:00
Martin Willi e0a34ee459 vici: Document errno values to expect from libvici API 2014-05-07 14:13:39 +02:00
Martin Willi c2b6402eb0 vici: Log owners of a just loaded shared-secret 2014-05-07 14:13:39 +02:00
Martin Willi 41745e24f3 vici: Handle "xauth" as an alias for "eap" secrets 2014-05-07 14:13:38 +02:00
Martin Willi bc006ac1f4 vici: Return number of matching and closed SAs in terminate command 2014-05-07 14:13:38 +02:00
Martin Willi 021a14b7a4 vici: Complete libvici doxygen comments 2014-05-07 14:13:38 +02:00
Martin Willi 374511c52c vici: Ensure we have no active users before mangling event client registrations 2014-05-07 14:13:38 +02:00
Martin Willi 65cc8f5581 vici: Properly skip raise_event() for unknown event names 2014-05-07 14:13:38 +02:00
Martin Willi 3a9a46c20f vici: Increase vici message length header from 16 to 32 bits 
While we currently have no need for messages larger than 65KB, we should design
the protocol to be future-proof, as we plan to keep at least to lowest protocol
layer stable.

To avoid any allocation issues, we currently keep the message size limit at
512KB.
 2014-05-07 14:13:38 +02:00
Martin Willi 7dbf9e1574 vici: Document strongswan.conf options 2014-05-07 14:13:38 +02:00
Martin Willi f3e1ec4a85 vici: Have an explicit "relaxed" keyword for the default revocation policy 2014-05-07 14:13:38 +02:00
Martin Willi 585814470d vici: Use a default child rekey time of 1 hour 2014-05-07 14:13:38 +02:00
Martin Willi 046befeca5 vici: Use a default IKE rekey time of 4 hours 2014-05-07 14:13:38 +02:00
Martin Willi ff3217db4b vici: Add low-level IPC protocol description 2014-05-07 14:13:38 +02:00
Martin Willi c193732162 vici: Fix descending into non-matching sections during key find 2014-05-07 14:13:38 +02:00
Martin Willi eacf864c21 vici: Add an IKE virtual IP and attribute backend 2014-05-07 14:13:38 +02:00
Martin Willi afb8f492ef vici: Support referencing external named pools for peer configs 2014-05-07 14:13:37 +02:00
Martin Willi 3ad9c34c92 vici: Actually add configured virtual IPs to peer config 2014-05-07 14:13:37 +02:00
Martin Willi e651afe67b vici: Use a default rand_time of the difference between hard and soft lifetimes 2014-05-07 14:13:37 +02:00
Martin Willi c520510508 vici: Use a default hard lifetime of 110% of the soft lifetime 2014-05-07 14:13:37 +02:00
Martin Willi 93d60c479a vici: Make unit-tests independent from libcharon and libhydra 
Fixes monolithic build, as we can't depend on the not yet built libcharon.
 2014-05-07 14:13:37 +02:00
Martin Willi 0963a9952c vici: Don't compare unsigned certificate_type_t to -1 2014-05-07 14:13:37 +02:00
Martin Willi e00ce378fa vici: Use non-blocking first read when receiving message during client on_read() 
As select() and finally the watcher may signal an FD even if it does not
actually have data, we must make a non-block read to avoid hanging in the
read callback.
 2014-05-07 14:13:37 +02:00
Martin Willi 7de35b7ff6 vici: Perform specified start_action on connection load, undo it on unload 2014-05-07 14:13:37 +02:00
Martin Willi 96071fdb55 vici: Add a generic log event to raise events for log messages 2014-05-07 14:13:37 +02:00
Martin Willi 2676ffdb9f vici: Be less verbose about client connections 
Instead, log the explicit commands at a higher level.
 2014-05-07 14:13:37 +02:00
Martin Willi 101dba01ce vici: Add a list-certs command to query different certificate types 2014-05-07 14:13:37 +02:00
Martin Willi b57739f721 vici: Support pinning end entity and CA certificates to connections 2014-05-07 14:13:37 +02:00
Martin Willi e6e975ff9d vici: Support missing groups option in auth config 2014-05-07 14:13:37 +02:00
Martin Willi 6efa792d22 vici: Add a load-shared command to load shared IKE and EAP secrets 2014-05-07 14:13:37 +02:00
Martin Willi 559ef7de48 vici: Add a load-key command to load private keys 2014-05-07 14:13:36 +02:00
Martin Willi c12edb2a27 vici: Support loading of different certificate types 2014-05-07 14:13:36 +02:00
Martin Willi de190f62c2 vici: Add a credential backend 2014-05-07 14:13:36 +02:00
Martin Willi e1b65630b2 vici: Add a command listing all or specific loaded connections using events 2014-05-07 14:13:36 +02:00
Martin Willi 501ddf127b vici: Add unload-conn and get-conns commands to manage loaded connections 2014-05-07 14:13:36 +02:00
Martin Willi 37aa250cad vici: Make dispatcher a little more verbose 2014-05-07 14:13:36 +02:00
Martin Willi b3d8bd8d26 vici: Add backend providing in-memory connections 2014-05-07 14:13:36 +02:00
Martin Willi dd5ce0a97a vici: Add generic callback based vici message parsing 2014-05-07 14:13:36 +02:00
Martin Willi 1f2e63ea41 vici: Add a list-policy command to query trap and shunt policies 2014-05-07 14:13:36 +02:00
Martin Willi 5c6e81dcf8 vici: Add install/uninstall commands to manage trap and shunt policies 2014-05-07 14:13:36 +02:00
Martin Willi 550f3f5646 vici: Extract CHILD_SA config lookup method 2014-05-07 14:13:36 +02:00
Martin Willi e567675d29 vici: Refactor socket to clean up locking 
Uses separate locks for socket read and write operations. While holding the
socket reader lock, a different thread can still claim the socket write lock.
This allows to asynchronously send event messages while holding the read
lock.
 2014-05-07 14:13:36 +02:00
Martin Willi 9bfa397eba vici: Fix dispatcher leak when handling unknown request 2014-05-07 14:13:36 +02:00
Martin Willi e2496bda02 vici: Add a test case raising events during request, checks in-order delivery 2014-05-07 14:13:35 +02:00
Martin Willi 3b5808a0f6 vici: Avoid recursive control log invocations 2014-05-07 14:13:35 +02:00
Martin Willi 993bfe95fb vici: Add a callback based recursive parser function 2014-05-07 14:13:35 +02:00
Martin Willi d9ae1c68e5 vici: Add a version command to print daemon and OS version info 2014-05-07 14:13:35 +02:00
Martin Willi c7d4dad66d vici: Implement a terminate command to close IKE or CHILD_SAs 2014-05-07 14:13:35 +02:00
Martin Willi 5f95657c65 vici: Add a control backend, currently to initiate connections by name 2014-05-07 14:13:35 +02:00
Martin Willi ecc4b51048 vici: Support thread cancellation in command callbacks 2014-05-07 14:13:35 +02:00
Martin Willi 045bdf5283 vici: Move dumping to core message class, use it in libvici 2014-05-07 14:13:35 +02:00
Martin Willi 7f4cfdff58 vici: Add convenience value/string/integer getter to libvici 2014-05-07 14:13:35 +02:00
Martin Willi db18495514 vici: Add some convenience getters on message 2014-05-07 14:13:35 +02:00
Martin Willi b40a12a96f vici: Raise events with an optional identifier for specific connections 2014-05-07 14:13:35 +02:00
Martin Willi 293431269b vici: Invoke dispatcher outside of connection log, allowing events from commands 2014-05-07 14:13:35 +02:00
Martin Willi 252025210f vici: Add a query class, currently implementing a list-sas command 2014-05-07 14:13:35 +02:00
Martin Willi eb4fd014b8 vici: Add a libvici low-level client library 2014-05-07 14:13:35 +02:00
Martin Willi 8383d626b9 vici: Provide a command dispatcher handling request and event registration 2014-05-07 14:13:34 +02:00
Martin Willi 8457da7528 vici: Add a fully asynchronous IPC socket segmenting messages on/from stream 2014-05-07 14:13:34 +02:00
Martin Willi 1e39454214 vici: Add a test runner for plugin 2014-05-07 14:13:34 +02:00
Martin Willi 6770cfe34a vici: Add a plugin stub for the "Versatile IKE Control Interface" plugin 2014-05-07 14:13:34 +02:00
Martin Willi d4368689a0 mem-cred: Replace existing equal shared keys during add_shared() 2014-05-07 14:13:34 +02:00
Martin Willi f8223f5f7e mem-cred: Replace existing equal private keys during add_key() 2014-05-07 14:13:34 +02:00
Martin Willi d2b07d3187 watcher: Don't wait for running callback once watcher thread cancelled 
During shutdown, waiting for callbacks might never complete, as queued
callbacks might not get executed under certain conditions. Not the clean fix,
but works good enough for now.

Seen on Windows in vici tests.
 2014-05-07 14:13:34 +02:00
Martin Willi d16d5a245f watcher: Avoid queueing multiple watcher callbacks at the same time 
While we don't add FDs with an active callback to the watched FDSET, we still
can get notifications for callbacks active due the asynchronous processing
of the same.

To avoid queue multiple callbacks, we check for queued callbacks before
activating new ones.
 2014-05-07 14:13:34 +02:00
Martin Willi 874e212f71 processor: Flush pending jobs during cancel(), not destroy 
During shutdown, cancel queued jobs earlier to avoid having cleanup functions
accessing infrastructure not available anymore, for example watcher.
 2014-05-07 14:13:34 +02:00
Martin Willi 9e93251397 utils: Provide a CALLBACK macro, similar to METHOD, but for void* callbacks 
Using the same mechanism as the METHOD macro, the CALLBACK macro defines
a hybrid function signature. It strictly uses a weak void* for the first
function parameter, in contrast to the dynamic METHOD object "this" type.
 2014-05-07 14:13:34 +02:00
Martin Willi dba3c649da travis: --disable-aikgen in "all" tests 
aikgen has a hard dependency on TrouSerS, which we currently don't have in the
travis build.
 2014-05-07 14:12:13 +02:00
Martin Willi f91c7d85c4 Merge branch 'unit-tests' 
Bring some minor improvements to unit testing, including more flexible
configuration.
 2014-04-30 17:23:55 +02:00
Martin Willi 523dd96558 unit-tests: Document the supported env variables 2014-04-30 17:22:48 +02:00
Martin Willi 20924ae28f unit-tests: Add a ck_assert_chunk_eq() convenience macro 2014-04-30 17:22:48 +02:00
Martin Willi 0456aa616f unit-tests: Silence a literal signedness warning raised by GCC 4.6.3 2014-04-30 17:22:48 +02:00
Martin Willi 8dcde902e4 packages: New Debian network-manager-strongswan release 2014-04-24 15:53:38 +02:00
Martin Willi 9c00ec3a86 packages: Hand over network-manager-strongswan debian package maintenance 2014-04-24 15:53:38 +02:00
Martin Willi 1db1e7cd7a packages: Use charon-nm in network-manager-strongswan debian package 2014-04-24 15:53:38 +02:00
Martin Willi 65117a0764 nm: Bump NetworkManager plugin version to 1.3.1 2014-04-24 15:53:38 +02:00
Martin Willi 95083fc6fb Merge branch 'reauth-collision' 
Fixes two collisions between IKE_SA re-authentication and CHILD_SA rekeying.
 2014-04-17 10:14:49 +02:00
Martin Willi 0b3bea3965 ike: Delay actively initiated reauthentication when other exchanges in progress 
If any other IKE or CHILD_SA operation takes places, we should not start
initiating reauthentication to avoid any potential races.
 2014-04-17 09:59:06 +02:00
Martin Willi f02cabbe35 ikev2: Reject CHILD_SA creation/rekeying while deleting an IKE_SA 
If one peer starts reauthentication by deleting the IKE_SA, while the other
starts CHILD_SA rekeying, we run in a race condition. To avoid it, temporarily
reject the rekey attempt while we are in the IKE_SA deleting state.

RFC 4306/5996 is not exactly clear about this collision, but it should be safe
to reject CHILD_SA rekeying during this stage, as the reauth will re-trigger the
CHILD_SA. For non-rekeying CHILD_SA creations, it's up to the peer to retry
establishing the CHILD_SA on the reauthenticated IKE_SA.
 2014-04-17 09:59:06 +02:00
Martin Willi 094963d1b1 ikev2: Apply extensions and conditions before starting rekeying 
The extensions and conditions apply to the rekeyed IKE_SA as well, so we should
migrate them. Especially when using algorithms from private space, we need
EXT_STRONGSWAN to properly select these algorithms during IKE rekeying.
 2014-04-17 09:24:51 +02:00
Martin Willi 713a1122b4 ikev2: Add inherit_pre() to apply config and hosts before IKE_SA rekeying 2014-04-17 09:24:51 +02:00
Martin Willi c4c9d291d2 ikev1: Add an option to accept unencrypted ID/HASH payloads 
Even in Main Mode, some Sonicwall boxes seem to send ID/HASH payloads in
unencrypted form, probably to allow PSK lookup based on the ID payloads. We
by default reject that, but accept it if the
charon.accept_unencrypted_mainmode_messages option is set in strongswan.conf.

Initial patch courtesy of Paul Stewart.
 2014-04-17 08:52:28 +02:00
Martin Willi 8503077175 ikev2: Reject CREATE_CHILD_SA exchange on unestablished IKE_SAs 
Prevents a responder peer to trick us into established state by starting
IKE_SA rekeying before the IKE_SA has been authenticated during IKE_AUTH.

Fixes CVE-2014-2338.
 2014-04-14 13:29:49 +02:00
Martin Willi b87f7840bc Merge branch 'tls-unit-tests' 
Add some initial unit-tests to libtls, testing all supported cipher suites
against self, both with and without client authentication, for all supported
TLS versions.
 2014-04-01 14:53:28 +02:00
Martin Willi 5ba9f73457 tls: Add a test case to check correct enum name mapping of cipher suites 2014-04-01 14:52:18 +02:00
Martin Willi 2c8d77394c tls: Add socket based tests testing all supported suites with TLS 1.2/1.1/1.0 2014-04-01 14:52:18 +02:00
Martin Willi 74162ed997 tls: Remove superfluous initializers in TLS AEAD implementations 2014-04-01 14:52:18 +02:00
Martin Willi e15f64cc81 tls: Support a maximum TLS version to negotiate using TLS socket abstraction 2014-04-01 14:28:55 +02:00
Martin Willi 5313880261 tls: Support a null encryption flag on TLS socket abstraction 2014-04-01 14:28:55 +02:00
Martin Willi ddf5222096 tls: Introduce a generic TLS purpose that accepts NULL encryption ciphers 2014-04-01 14:28:55 +02:00
Martin Willi ac5717c9e9 tls: Export a function to list supported TLS cipher suites 2014-04-01 14:28:55 +02:00
Martin Willi c0efaaebe3 tls: Create a unit-test runner 2014-04-01 14:28:55 +02:00
Martin Willi 70889c42a6 unit-tests: Catch timeouts during test runner deinit function 
The test runner deinit function often cancels all threads from the pool. This
operation might hang on error conditions, hence we should include that hook in
the test timeout to fail properly.
 2014-04-01 14:28:55 +02:00
Martin Willi 4e8ff4f010 unit-tests: Prevent a failing worker thread to go wild after it fails 
A worker raises SIGUSR1 to inform the main thread that the test fails. The main
thread then starts cancelling workers, but the offending thread should be
terminated immediately to prevent it from test continuation.
 2014-04-01 14:28:54 +02:00