denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
8,993 Commits 1 Branch 0 Tags
9e9295ed1010ec7511ed76a0984246f450fcf6b5
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Tobias Brunner 9e9295ed10 Properly handle empty RDN values in DN strings. 2012-06-07 16:50:11 +02:00
Tobias Brunner 9041c074b3 Properly install policies with ports in PF_KEY kernel interface. 2012-06-07 14:37:00 +02:00
Tobias Brunner b200fa573b starter: Only handle SIGCHLD asynchronously and the rest in pselect(2). 2012-06-06 14:23:25 +02:00
Tobias Brunner 18a3741042 starter: (De-)Initialize logging when forking. 2012-06-05 09:22:16 +02:00
Tobias Brunner 402ae88af9 starter: Close open file descriptors when forking daemons. 2012-06-04 18:09:56 +02:00
Tobias Brunner 89c97952bd starter: Changed signal handling now that starter is multi-threaded. 2012-06-04 18:09:56 +02:00
Tobias Brunner c8f7a114b6 Mark CHILD_SAs used for trap policies to uninstall them properly. 
If the installation failed the state is not CHILD_ROUTED which means the
wrong priority is used to uninstall the policies.  This is a problem for
kernel interfaces that keep track of installed policies as now the proper
policy is not found (if the priority is considered).
 2012-06-04 18:04:48 +02:00
Tobias Brunner 93d9a02e9e NEWS for 4.6.4 added. 2012-05-31 17:40:01 +02:00
Tobias Brunner 79d5c4f06b Fixed return values of several functions (e.g. return FALSE for pointer types). 2012-05-31 17:39:04 +02:00
Tobias Brunner 77e4282643 Avoid queueing more than one retry initiate job. 2012-05-30 15:32:52 +02:00
Tobias Brunner 60c82591c5 Retry IKE_SA initiation if DNS resolution failed. 
This is disabled by default and can be enabled with the
charon.retry_initiate_interval option in strongswan.conf.
 2012-05-30 15:32:52 +02:00
Tobias Brunner eac9d77059 Job added to re-initiate an IKE_SA. 2012-05-30 15:32:52 +02:00
Tobias Brunner 53915f14ae Fix MOBIKE address update if responder address changed. 
Use the source address of the current MOBIKE message as peer address
instead of assuming the address cached on the IKE_SA is still valid.
 2012-05-25 17:05:53 +02:00
Tobias Brunner a46fe56858 Resolve hosts before reauthenticating due to address change. 2012-05-25 17:05:53 +02:00
Tobias Brunner c6da59f014 Don't queue delete_ike_sa job when setting IKE_DELETING. 
This avoids deleting IKE_SAs during reauthentication (without
trying to reestablish them).
 2012-05-25 17:05:53 +02:00
Tobias Brunner 7457143072 During reauthentication reestablish IKE_SA even if deleting the old one fails. 2012-05-25 17:05:53 +02:00
Tobias Brunner 23470d849a Integrated main parts of IKE_REAUTH task into ike_sa_t.reestablish. 2012-05-25 17:05:53 +02:00
Tobias Brunner 12715f1953 Fixed route lookup in case MOBIKE is not enabled. 2012-05-25 17:05:53 +02:00
Tobias Brunner daab61e51f Added encapsulation mode transform attribute to IPComp proposal. 2012-05-25 09:26:42 +02:00
Tobias Brunner 18dac73f02 Updated ipsec.conf(5) to reflect changes to IPComp support. 2012-05-24 15:32:28 +02:00
Tobias Brunner 6695b48582 Add an additional proposal without IPComp to SA payload. 2012-05-24 15:32:28 +02:00
Tobias Brunner 3451ecd7ac Added log message if peer does not accept/provide IPComp proposal. 2012-05-24 15:32:28 +02:00
Tobias Brunner 47b448b807 Added support to negotiate IPComp during Quick Mode. 2012-05-24 15:32:28 +02:00
Tobias Brunner 647cd741e8 Added support for IKEv1 IPComp proposals in SA payload. 2012-05-24 15:32:28 +02:00
Tobias Brunner 7a75cae856 Added support for IKEv1 IPComp proposals in proposal substructure. 2012-05-24 15:32:27 +02:00
Tobias Brunner 00e11bcefd Fix memleak during Quick Mode in case no SPI can be allocated from kernel. 2012-05-24 15:32:27 +02:00
Tobias Brunner 624bb24d12 Properly filter IKEv1 proposals consisting of multiple proposal payloads. 
Since a proposal_t object is created for each transform contained in the
proposal payload, it does not work to simply remove the last proposal_t
object added to the list (there may be several other extracted from the
previous proposal payload).
 2012-05-24 15:32:27 +02:00
Tobias Brunner fda9f104b4 Fixed check for loaded plugins with feature types that are not compared exactly. 
Previously e.g. RNGs with weaker strength would have overwritten stronger
ones.
 2012-05-24 15:15:34 +02:00
Tobias Brunner 0e5d587df7 get_match() method added to hashtable_t. 2012-05-24 15:15:34 +02:00
Tobias Brunner 9eac6106d0 Use a hashtable to check for already loaded plugin features. 2012-05-23 17:50:05 +02:00
Tobias Brunner a9cfd29c10 Hash function for plugin features added. 2012-05-23 17:50:05 +02:00
Tobias Brunner 1a624ff45a Switch to alternative peer config in IKEv1 Main and Aggressive Mode. 2012-05-21 15:49:25 +02:00
Tobias Brunner 9e19cb912d Destroy Netlink socket only after deleting remaining source routes. 2012-05-21 13:33:13 +02:00
Tobias Brunner 769696450a Properly munmap/close file if loading IMC/IMV fails. 2012-05-18 12:32:31 +02:00
Tobias Brunner 7a56c35fc9 Remove executable flag from source files. 2012-05-18 10:04:08 +02:00
Tobias Brunner 22bf44c8b9 Use separate Doxygen groups for IKEv1 and IKEv2 entities (authenticators, tasks etc.). 2012-05-18 10:04:08 +02:00
Tobias Brunner 7959a3faec Removed superfluous @param in bus.h. 2012-05-18 09:57:01 +02:00
Tobias Brunner 7684ca2e8c whitelist: Make sure listed IDs are null-terminated. 2012-05-18 09:57:01 +02:00
Tobias Brunner 816f7f238f pkcs8: Initialize salt and IV properly. 2012-05-18 08:36:37 +02:00
Tobias Brunner 5c162dd944 List registered nonce generators in statusall output. 2012-05-18 08:15:41 +02:00
Tobias Brunner b826b192ba Add enumerator for registered nonce generators. 2012-05-18 08:15:41 +02:00
Tobias Brunner b3089ab74c Free name of application using libcharon. 2012-05-15 11:37:07 +02:00
Tobias Brunner d3590016e9 starter: Initialize thread pool so kernel events are consumed. 2012-05-15 08:55:19 +02:00
Tobias Brunner c732e22019 Fix route reinstallation if preferred source IP is not on outgoing interface. 2012-05-07 19:00:47 +02:00
Tobias Brunner 5de5b04ce4 Fixed #include in tnc-ifmap plugin. 2012-05-07 11:22:51 +02:00
Tobias Brunner 0aa90701f6 It seems charon-nm has to be linked against libnm-util. 
That's at least the case for NetworkManager 0.9.4 in Ubuntu 12.04.
 2012-05-03 15:17:57 +02:00
Tobias Brunner 983c667481 Use proper getter for settings in sender and receiver. 2012-05-03 13:57:04 +02:00
Tobias Brunner 42500c274a Use name from initialization to access settings in libcharon. 
Also fixes several whitespace errors.
 2012-05-03 13:57:04 +02:00
Tobias Brunner 18758e3d2e Store the name of the binary using libcharon to enable specific settings. 2012-05-03 13:57:04 +02:00
Tobias Brunner 37d9334366 Changed default path to charon for NM frontend. 2012-05-03 13:57:04 +02:00
Tobias Brunner b64f333612 Integrate nm plugin directly in charon-nm. 2012-05-03 13:57:03 +02:00
Tobias Brunner 1c7a733e36 Added a small libcharon wrapper intended to directly host the nm plugin. 
For this reason it reclaims the --enable-nm configure option.
 2012-05-03 13:38:14 +02:00
Tobias Brunner 94b48e071a Provide plugin list from charon, not internally in libcharon. 2012-05-03 13:14:07 +02:00
Tobias Brunner 088020fbac Updated Android.mk for 5.0 (no IKEv1 support yet). 2012-05-03 09:37:35 +02:00
Tobias Brunner ed7186cbe1 NEWS about route reinstallation added. 2012-05-02 15:24:48 +02:00
Tobias Brunner bc798c9ce8 Route reinstallation in kernel_ipsec_t implementations is not needed anymore. 2012-05-02 15:24:47 +02:00
Tobias Brunner f834249c59 Reinstall routes in kernel-netlink plugin, if interfaces get reactivated or IPs reappear. 2012-05-02 15:24:47 +02:00
Tobias Brunner 74ba22c992 Keep track of installed source routes in kernel-netlink plugin. 2012-05-02 14:56:08 +02:00
Tobias Brunner d55c240474 NEWS about bus_t refactorings added. 2012-05-02 14:45:38 +02:00
Tobias Brunner ead92870b8 Loggers specify what log messages they want to receive during registration. 
This also allows us to generate the log message only once for all
loggers that need it (avoids calls to custom printf specifier callbacks).

To update the log levels loggers can simply be registered again.
 2012-05-02 14:45:38 +02:00
Tobias Brunner d724fcd624 Ensure that multi-line log messages are not torn apart. 2012-05-02 14:45:38 +02:00
Tobias Brunner 4d21000cf7 Added recursive read_lock support to our own implementation of rwlock_t. 2012-05-02 14:45:38 +02:00
Tobias Brunner 0e474f9148 Use a separate interface for loggers. 
The new interface does not allow loggers to unregister themselves from
the bus.  This allows us to use a rwlock_t for them.

The latter also means that loggers can now be called concurrently by
multiple threads.
 2012-05-02 14:45:38 +02:00
Tobias Brunner f9f867899a Use a separate list and mutex for loggers. 
This avoids deadlocks caused by extensive listener_t implementations
which might want to acquire a lock which is currently held by another
thread wanting to log messages. Since the latter requires that thread
to acquire the same lock the initial thread currently holds this
previously resulted in a deadlock.

With this change logging messages does not require threads to acquire
the main lock in bus_t and thus avoids the deadlock.
 2012-05-02 14:45:38 +02:00
Tobias Brunner ecb5abd7fa Fixed return value of controller_t functions if callback returns FALSE. 2012-05-02 14:45:38 +02:00
Tobias Brunner 052e0a17b8 Use wrapped semaphore in callback_job_t. 2012-05-02 14:45:38 +02:00
Tobias Brunner aac20ec784 Removed remaining parts of controller_t.listen() implementation. 2012-05-02 14:45:38 +02:00
Tobias Brunner a629513961 Remove obsolete bus_t.listen() method. 2012-05-02 14:45:38 +02:00
Tobias Brunner 5a073784e2 Implement wait_for_listener in controller_t with semaphores. 
This eliminates even the slightest chance of a deadlock.
 2012-05-02 14:45:37 +02:00
Tobias Brunner 8f6c13271c Added a wrapper class around POSIX semaphores. 2012-05-02 14:45:37 +02:00
Tobias Brunner b6e9c41861 Implement bus_t.listen() directly in controller_t (the only user). 
This will hopefully allow us to later simplify bus_t.
 2012-05-02 14:45:37 +02:00
Tobias Brunner 13de38e354 Documented strongswan.conf options for radattr plugin. 2012-05-01 13:32:43 +02:00
Tobias Brunner 88206458ce Properly initialize optional subject in PEM builder. 2012-04-30 10:48:57 +02:00
Tobias Brunner 00d79edc20 Typo fixed. 2012-04-30 10:47:42 +02:00
Tobias Brunner 23cb8ba72b Fixed null-pointer dereference in smp plugin. 2012-04-26 08:54:04 +02:00
Tobias Brunner 7d85bebc49 pluto: Fix for null-terminated XAuth secrets (as sent by Android 4). 2012-04-24 09:25:38 +02:00
Tobias Brunner 5895c2e948 Option added to set identifier for syslog(3) logging. 
This identifier is added to each log message by syslog.
 2012-04-20 09:26:12 +02:00
Tobias Brunner 7e84c4275c Removed auth_cfg_t.replace_value() and replaced usages with add(). 
replace_value() was used to replace identities. Since for these the latest is
now returned by get(), adding the new identity with add() is sufficient.
 2012-04-18 18:50:14 +02:00
Tobias Brunner ebc1ffe451 Changed the order and semantics of rules we expect only once in auth_cfg_t. 
These rules are now inserted at the front of the internal list, this
allows to retrieve the rule added last with get(). For other rules the
order in which they are added is maintained (this allows to properly
enumerate them).
 2012-04-18 18:50:14 +02:00
Tobias Brunner 80067cf9e6 Store password with remote ID to tie it stronger to a specific connection. 2012-04-18 13:32:49 +02:00
Tobias Brunner 9f1b303afc Added stroke user-creds command, to set username/password for a connection. 2012-04-17 14:20:58 +02:00
Tobias Brunner 7b00fdeb84 Added method to add additional shared secrets to stroke_cred_t. 2012-04-17 14:20:58 +02:00
Tobias Brunner ff5cb888f6 Additional prompt keyword added to stroke. 2012-04-17 14:20:58 +02:00
Tobias Brunner 4c31657d2c Typo fixed. 2012-04-17 14:20:58 +02:00
Tobias Brunner 7fd6c078b6 Use IP address as ID as responder if not configured or no IDr received. 2012-04-16 14:09:51 +02:00
Tobias Brunner b241a37411 Fall back on IP address as IDi if none is configured at all. 2012-04-16 13:44:27 +02:00
Tobias Brunner b447af658c Use auth_cfg_t.replace_value where appropriate. 2012-04-16 13:44:27 +02:00
Tobias Brunner 68cca941cf Added a simple method to replace the value of a rule in auth_cfg_t. 2012-04-16 13:44:27 +02:00
Tobias Brunner 4b32bde48e Fixed IDi in case neither left nor leftid is configured. 2012-04-16 13:44:27 +02:00
Tobias Brunner 4e2e77d540 Typo fixed in NEWS. 2012-04-14 08:41:32 +02:00
Tobias Brunner ae9ce83511 Properly initialize src in ike_sa_t.is_any_path_valid(). 2012-04-06 10:54:44 +02:00
Tobias Brunner bad192069f Make AES-CMAC actually usable for IKEv2. 2012-04-04 10:51:46 +02:00
Tobias Brunner 37d43ebbde Doxygen fixes. 2012-04-03 10:56:47 +02:00
Tobias Brunner d7590217c3 Added NEWS about cmac plugin. 2012-04-03 10:48:03 +02:00
Tobias Brunner 811e7490f6 Added test vectors for AES-CMAC. 2012-04-03 10:45:09 +02:00
Tobias Brunner c0d39c205c Implemented AES-CMAC based PRF and signer. 
The cmac plugin implements AES-CMAC as defined in RFC 4493 and the
signer and PRF based on it as defined in RFC 4494 and RFC 4615,
respectively.
 2012-04-03 10:40:47 +02:00
Tobias Brunner 9a6b1cb412 Fixed GNU license header in hmac and xcbc plugins. 2012-04-03 10:33:59 +02:00
Tobias Brunner ef511fc03d Add support for dnQualifier in DNs. 2012-03-29 10:01:55 +02:00
Tobias Brunner a281494abd Added NEWS about resolvconf support. 2012-03-27 10:44:21 +02:00
Tobias Brunner ed2cab08d2 Make resolvconf interface prefix configurable. 2012-03-27 10:44:21 +02:00