denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
12,350 Commits 1 Branch 0 Tags
abd5c7bea2c0c5e9fc14ad81a6fed67a6f573261
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Tobias Brunner abd5c7bea2 libtnccs: Move settings to <ns>.tnc and <ns>.plugins with fallback 2014-02-12 14:34:34 +01:00
Tobias Brunner 505a69eba4 attr: Silently skip over load option 2014-02-12 14:34:34 +01:00
Tobias Brunner 127f65db16 Prevent 'make distcheck' from complaining about config files we leave in /etc 2014-02-12 14:34:34 +01:00
Tobias Brunner d56a23c515 conf: Create automatically generated config snippets in build dir 2014-02-12 14:34:34 +01:00
Tobias Brunner 7f535b3938 conf: Install config snippets in /usr/share/strongswan/templates/config too 2014-02-12 14:34:34 +01:00
Tobias Brunner 6a2de77f2e conf: Only install config snippets if they don't exist yet 2014-02-12 14:34:34 +01:00
Tobias Brunner fc380b175d conf: Move load-tester options to plugin specific file 2014-02-12 14:34:34 +01:00
Tobias Brunner 828815b0d8 conf: Options of all plugins documented 
Some options are still missing descriptions though.
 2014-02-12 14:34:34 +01:00
Tobias Brunner da8b16a160 conf: Add logger example config 2014-02-12 14:34:34 +01:00
Tobias Brunner 5da20b3dc6 conf: Converted charon options 2014-02-12 14:34:33 +01:00
Tobias Brunner c4bb26b849 conf: Split strongswan.conf(5) man page and use generated snippet 2014-02-12 14:34:33 +01:00
Tobias Brunner 7f62b7d02d conf: Generate groff snippet for configuration options 2014-02-12 14:34:33 +01:00
Tobias Brunner 91cc523ca7 conf: Generate strongswan.conf(5) man page in different directory 2014-02-12 14:34:33 +01:00
Tobias Brunner 1b98f85821 conf: Generate and install config sippets for option descriptions 
The strongswan.d directory is also created relative to the configured
location of strongswan.conf.
 2014-02-12 14:34:33 +01:00
Tobias Brunner e90b37b9c3 conf: Script to convert option descriptions to man page and config snippets added 2014-02-12 14:34:33 +01:00
Tobias Brunner dee50a6046 conf: Create /etc/strongswan.d directory and include .conf files 2014-02-12 14:34:33 +01:00
Tobias Brunner 45e19c7c88 conf: Simplified strongswan.conf template 2014-02-12 14:34:33 +01:00
Tobias Brunner c75acc4c44 conf: Install strongswan.conf template from a separate directory 2014-02-12 14:34:33 +01:00
Tobias Brunner 9925eeabd2 settings: Add support to enumerate sections and key/value pairs with fallbacks 2014-02-12 14:34:33 +01:00
Tobias Brunner f4da1989cd settings: Implement subsections and key/value pairs with sorted arrays 
Is a bit more memory efficient (also due to lazy instantiation) and
lookups for sections with lots of subsections/keys (e.g. charon.plugins) are
faster.
 2014-02-12 14:34:33 +01:00
Tobias Brunner b3613c49a2 array: Add fallback for qsort_r using thread-local value 
Cygwin for example does not support qsort_r.
 2014-02-12 14:34:33 +01:00
Tobias Brunner 190a278854 plugin-loader: Optionally use load option in each plugin section to load plugins 
This now works because all plugins use the same config namespace.

If <ns>.load_modular is true, the list of plugins to load is determined
via the value of the <ns>.plugins.<name>.load options.

Using includes the following is possible:

charon {
  load_modular = yes
  plugins {
    include strongswan.d/charon/*.conf
  }
}

charon-cmd {
  load_modular = yes
  plugins {
    include strongswan.d/charon-cmd/*.conf
  }
}

Where each .conf file would contain something like:

<name> {
  load = yes
  <option> = <value>
}

To increase the priority of individual plugins load = <priority> can be
used (the default is 1).  For instance, to use openssl instead of the
built-in crypto plugins set in strongswan.d/charon/openssl.conf:

openssl {
  load = 10
}

If two plugins have the same priority their order in the default plugin
list is preserved.  Plugins not found in that list are ordered
alphabetically before other plugins with the same priority.
 2014-02-12 14:34:33 +01:00
Tobias Brunner 79962d9e99 array: Add array_bsearch function 2014-02-12 14:34:33 +01:00
Tobias Brunner 132b00ce02 array: Add array_sort function 2014-02-12 14:34:33 +01:00
Tobias Brunner 1c306c0ee9 libcharon: Remove unused charon->name 2014-02-12 14:34:33 +01:00
Tobias Brunner 9222bfc695 charon-tkm: Use lib->ns instead of charon->name 2014-02-12 14:34:32 +01:00
Tobias Brunner d223fe807a libcharon: Use lib->ns instead of charon->name 2014-02-12 14:34:32 +01:00
Tobias Brunner 10c4f4e1fd libhydra: Remove unused hydra->daemon 2014-02-12 14:34:32 +01:00
Tobias Brunner d347a130f5 libhydra: Use lib->ns instead of hydra->daemon 2014-02-12 14:34:32 +01:00
Tobias Brunner 409adef43c libtls: Move settings to <ns>.tls with fallback to libtls 2014-02-12 14:34:32 +01:00
Tobias Brunner eb9b375aa1 attr-sql: Use namespace for attr-sql config, with fallback 2014-02-12 14:34:32 +01:00
Tobias Brunner 8dc6e71632 lib: All settings use configured namespace 2014-02-12 14:34:32 +01:00
Tobias Brunner 7a684aece4 lib: Add default config fallback for configured namespace 
All settings in the configured global namespace fall back to libstrongswan.
 2014-02-12 14:34:32 +01:00
Tobias Brunner dbed07782b unit-tests: Test how settings_t handles some invalid data 2014-02-12 14:34:32 +01:00
Tobias Brunner 1713d88278 settings: Add method that allows to define fallback sections for other sections 
The fallbacks are currently only used for single value lookups.
Enumerators are not affected by them.
 2014-02-12 14:34:32 +01:00
Tobias Brunner ef72d4cc3f settings: Make print_key() not rely on null-terminated beginning of key buffer 
The key to print (e.g. until the next .) still has to be
null-terminated.
 2014-02-12 14:34:32 +01:00
Tobias Brunner 24d2bb7793 unit-tests: Add tests for includes and file loading in settings_t 2014-02-12 14:34:32 +01:00
Tobias Brunner 25ee33ba65 settings: Allow empty strings in section key 2014-02-12 14:34:32 +01:00
Tobias Brunner 9f9a6b0681 unit-tests: Add tests for enumerators in settings_t 2014-02-12 14:34:32 +01:00
Tobias Brunner cd0523e0a4 unit-tests: Add tests for setters in settings_t 2014-02-12 14:34:31 +01:00
Tobias Brunner 9f2870216d unit-tests: Add basic tests for settings_t 2014-02-12 14:34:31 +01:00
Tobias Brunner 34d3bfcf14 lib: Add global config namespace 2014-02-12 14:34:31 +01:00
Tobias Brunner 4f8bd6d404 pool: Typo in Makefile fixed 2014-02-12 14:34:09 +01:00
Tobias Brunner b84b5410a4 Merge branch 'sql-install' 
SQL schemas and example data (IMV) are now part of the distribution and
installed in $prefix/share/strongswan.  This way no extra copy is needed
for the test suite and distributions can easily pack those files together
with the plugins.
 2014-02-12 14:27:21 +01:00
Tobias Brunner 6e288ed19c pool: Install SQL schemas from src/pool 
This allows us to install the schemas if either the attr-sql or sql
plugin is enabled, since both use the same schema (at least in parts).
 2014-02-12 14:21:26 +01:00
Tobias Brunner b2cd0870a3 sql: Set default values for some fields in addresses table 2014-02-12 14:08:34 +01:00
Tobias Brunner 9942e43dc6 testing: Use installed PTS SQL schema and data instead of local copy 2014-02-12 14:08:34 +01:00
Tobias Brunner 96e8715e32 testing: Use installed SQL schema instead of local copy 2014-02-12 14:08:34 +01:00
Tobias Brunner de7f5305d9 libimcv: Install SQL files in /usr/share/strongswan/templates/database 2014-02-12 14:08:34 +01:00
Tobias Brunner 9ca9d99bc4 sql: Install SQL schemas in /usr/share/strongswan/templates/database 2014-02-12 14:08:34 +01:00
Tobias Brunner 68539c38e2 sql: Remove unused cred.sql snippet 2014-02-12 14:08:34 +01:00
Tobias Brunner ebc665be4d asn1: Support dates before 1970-01-01 (i.e. when time_t gets negative) 
On x86 we allow "overflows" around 1969/1970 but not for other dates.

Fixes #509.
 2014-02-12 13:54:05 +01:00
Tobias Brunner addc34d5f0 asn1: Add additional validation for parsed ASN.1 date/time values 2014-02-12 13:53:57 +01:00
Tobias Brunner 9e1ce63915 ikev1: Fix config switching due to failed authentication during Aggressive mode 
The encoded ID payload gets destroyed by the authenticator, which caused
a segmentation fault after the switch.

Fixes #501.
 2014-02-12 13:53:03 +01:00
Tobias Brunner 822b22c96f kernel-pfroute: Don't cache route entries if installation fails 2014-02-12 13:52:25 +01:00
Tobias Brunner f0f78b74d4 kernel-netlink: Don't cache route entries if installation fails 
Fixes #500.
 2014-02-12 13:52:01 +01:00
Tobias Brunner 5e75f50b70 identification: Fix printing of empty RDNs on FreeBSD 
On FreeBSD (null) is printed for NULL even if the precision is 0.
 2014-02-12 13:45:42 +01:00
Tobias Brunner f8c9c03de0 tests: Fix test for printing NULL on FreeBSD 2014-02-12 13:45:42 +01:00
Tobias Brunner 44e6dbf04d testing: Add ssh script to distribution 2014-02-12 10:53:17 +01:00
Tobias Brunner 3114cecdbe pki: Declare correct section in pki --issue man page 2014-01-24 16:17:46 +01:00
Tobias Brunner fa9b6e88a0 Merge branch 'unity-fixes' 
Improves compatibility with the Cisco and Shrew clients.

Fixes #445.
 2014-01-23 11:19:38 +01:00
Tobias Brunner 21c18f536d unity: Send all traffic selectors in a single UNITY_SPLIT_INCLUDE attribute 
Cisco clients only handle the first such attribute.
 2014-01-23 10:35:21 +01:00
Tobias Brunner f8262aa1a6 unity: Change local TS to 0.0.0.0/0 as responder 
Cisco clients and Shrew expect a remote TS of 0.0.0.0/0 if Unity is
used, otherwise Quick Mode fails.
 2014-01-23 10:35:21 +01:00
Tobias Brunner 685579d6d8 unity: Send UNITY_SPLIT_INCLUDE attributes with proper padding 
The additional 6 bytes are not actually padding but are parsed by the
Cisco client as protocol and src and dst ports (each two bytes but
strangely only the first two in network order).
 2014-01-23 10:35:21 +01:00
Tobias Brunner 6b95565767 Merge branch 'ipcomp' 
Fixes compatibility issues between firewall rules (leftfirewall=yes)
and IPComp (compress=yes), plus issues with IPComp when used with
multiple subnets in left|rightsubnet.

Fixes #436.
 2014-01-23 10:31:04 +01:00
Tobias Brunner 571025a609 testing: Add ikev2/host2host-transport-nat scenario 2014-01-23 10:27:13 +01:00
Tobias Brunner 62e050e0ef testing: Add ipv6/rw-compress-ikev2 scenario 2014-01-23 10:27:13 +01:00
Tobias Brunner 6055e347f8 testing: Add ikev2/compress-nat scenario 2014-01-23 10:27:13 +01:00
Tobias Brunner 1fde30cc23 testing: Enable firewall for ikev2/compress scenario 
Additionally, send a regular (small) ping as the kernel does not
compress small packets and handles those differently inbound.
 2014-01-23 10:27:13 +01:00
Tobias Brunner fe2a2d1885 kernel-netlink: Set selector on transport mode IPComp SAs 2014-01-23 10:27:13 +01:00
Tobias Brunner cc04a6db3e kernel-netlink: Selectively add selector on SAs that use IPComp 
Don't add a selector to tunnel mode SAs, these might serve multiple
traffic selectors but with only one selector on the SA only the traffic
matching the first one would actually get tunneled.
 2014-01-23 10:27:12 +01:00
Tobias Brunner 7e3bbcf77a updown: Increase buffer size for script and environment variables 2014-01-23 10:27:12 +01:00
Tobias Brunner 6d1198e71d updown: Allow IPIP traffic if IPComp was negotiated 
The kernel implicitly creates an IPIP SA if an IPComp SA is installed.
This SA is used inbound for small packets that are not compressed.

Since the addresses are different (they are the tunnel addresses not
those of the tunneled traffic) additional rules are required if the
traffic selector does not cover the tunnel addresses (e.g. due to a NAT).

For SAs with multiple traffic selectors duplicate rules will get installed.
 2014-01-23 10:27:12 +01:00
Tobias Brunner cf4a7395aa updown: Add PLUTO_IPCOMP to indicate if IPComp was negotiated 2014-01-23 10:27:12 +01:00
Tobias Brunner 72a92d4f7d curl: Replace spaces in URIs with %20 
cURL requires the URIs to be URL-encoded. Apparently, some CAs encode CRL
URIs with spaces in them.

Fixes #454.
 2014-01-23 10:19:30 +01:00
Tobias Brunner ccb6758e5b utils: Add strreplace function 2014-01-23 10:18:23 +01:00
Tobias Brunner f44b1eb444 stroke: Ensure the buffer of strings in a stroke_msg_t is null-terminated 
Otherwise a malicious user could send an unterminated string to cause
unterminated reads.
 2014-01-23 10:15:07 +01:00
Tobias Brunner 5ab03863b0 stroke: Add an option to prevent log level changes via stroke socket 2014-01-23 10:15:07 +01:00
Tobias Brunner 040cf911a6 pki: Make sure no command registers too many options 2014-01-23 10:12:24 +01:00
Tobias Brunner 079e6c2b04 pki: Increase MAX_COMMANDS to cover all currently available commands 
Fixes #452.
 2014-01-23 10:12:15 +01:00
Tobias Brunner 2b8224fce3 pki: Print a warning if MAX_COMMANDS is too low 2014-01-23 10:10:53 +01:00
Tobias Brunner b0e14fcba6 pki: Properly use ?: when defining option arrays 2014-01-23 10:10:53 +01:00
Tobias Brunner 2d7852d29a configure: Add -Wno-format-security to default CFLAGS 
Either due to a change in Ubuntu 13.10 or GCC 4.8 -Wno-format has no
effect if -Wformat-security is enabled (which it is on Ubuntu) so we
also disable the latter by default.
 2014-01-23 10:08:53 +01:00
Tobias Brunner 54ca25800c agent: Keep CAP_DAC_OVERRIDE to connect to ssh-agent socket 
This is also required if charon-cmd is used with capability dropping.
 2014-01-23 10:08:23 +01:00
Tobias Brunner 53d2164c5d ike: Simplify error handling if name resolution failed 
This avoids a second name resolution attempt just to determine if %any
etc. was configured.

Fixes #440.
 2014-01-23 10:04:19 +01:00
Tobias Brunner be8af56e7a ike: Use proper hostname(s) when name resolution failed 
Was wrong since 0edce68767.

Fixes #440.
 2014-01-23 10:03:50 +01:00
Tobias Brunner 72ffb20318 ikev2: Wipe (optional) shared secret during CHILD_SA key derivation 2014-01-23 09:54:18 +01:00
Tobias Brunner e465c006e5 checksum must be the last subdir included 
Otherwise charon-cmd will not yet be installed when the checksums are
calculated (now from the install dir, not the build dir).

Fixes #496.
 2014-01-23 09:43:45 +01:00
Tobias Brunner a40c66194e checksum: Read executables from DESTDIR 
This allows to recreate the checksums after the installed binaries have
been modified e.g. with strip.

Fixes #491.
 2014-01-21 14:53:46 +01:00
Tobias Brunner 303ec3956c unit-tests: Add environment variable to reduce the number of generated keys 
If TESTS_REDUCED_KEYLENGTHS is set RSA and ECDSA keys are only generated
for the lowest configured key length.

Fixes #474.
 2014-01-20 15:40:15 +01:00
Tobias Brunner 3d097e1024 unit-tests: Generate RSA key with 768 bits not 786 2014-01-20 15:40:09 +01:00
Tobias Brunner 2ff62bee04 checksum: Set rpath including DESTDIR for checksum_builder 
This way libraries to which checksum_builder does not itself link,
like libtls and libradius, are found during DESTDIR installs.

Fixes #476.
 2014-01-08 11:24:24 +01:00
Tobias Brunner 94e10f15e5 test-asn1: Fix skipping of >2038 tests on i386 
The two constants overflow time_t on i386 (they also produced a compiler
warning without type suffix) so the comparison with TIME_32_BIT_SIGNED_MAX
did not work as intended.

Fixes #477.
 2014-01-06 18:23:40 +01:00
Tobias Brunner d62a6ec3f9 chunk: Fix chunk_mac/hash tests on big-endian systems 
Our SipHash-2-4 implementation returns the result in host order, while
the test vectors are little-endian.  Use a custom comparison function to
account for this.

Fixes #478.
 2014-01-06 17:31:07 +01:00
Tobias Brunner 13f2d3a2f6 utils: Fix %T printf hook on big-endian systems 
The cast to a bool* cut of the actual value on big-endian systems
if bool was shorter than int because the bool argument to printf gets
promoted to an int.

Fixes #479.
 2014-01-06 15:30:02 +01:00
Tobias Brunner 0773c7fd71 checksum: Delay building of checksum_builder until required by make install 
This ensures PLUGINDIR includes any DESTDIR set during make install.
 2014-01-06 14:38:34 +01:00
Tobias Brunner 5d826357b8 checksum: Remove unnecessary pluto symbol 2014-01-06 13:37:12 +01:00
Tobias Brunner 261fd9d33b stroke: Fix error message if parsing leftsourceip fails 2014-01-06 12:55:45 +01:00
Tobias Brunner bfa2201537 tun-device: Include system headers before our own 
On CentOS 6.5 the sys/capability.h header file defines _LINUX_TYPES_H
without actually including that header, preventing its later inclusion
here.

As library.h (via which the capabilities headers are included) is not
actually required in tun_device.[ch], moving the inclusion of tun_device.h
would not strictly be necessary.  But it's probably a good idea to
include our own headers after system headers anyway, for if one of the
recursively included files at a later point includes library.h we'd have
the same problem again.
 2013-12-20 11:33:16 +01:00
Tobias Brunner 7c4629060a aes-test: Fix compiler warnings from older versions of GCC 2013-12-19 11:02:23 +01:00