denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
7,140 Commits 1 Branch 0 Tags
ac8bb6498a61caa133027b912a7a5c23d5a4755c
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Tobias Brunner ac8bb6498a Doxygen group for BIO added. 2011-08-03 10:54:32 +02:00
Tobias Brunner 0057427008 Disable policy history for pluto. 
pluto tracks usage of policies already in its own way.
 2011-08-02 18:34:49 +02:00
Tobias Brunner 889a62a8d4 pluto: --debug-kernel aliasing was not fully complete. 2011-08-02 18:15:50 +02:00
Tobias Brunner b29ed3715c jhash.h is not part of the distribution anymore. 2011-08-02 16:14:16 +02:00
Tobias Brunner 5baaaa5ed5 Properly initialize ike_sa_t. 2011-08-01 13:08:15 +02:00
Tobias Brunner acf380bc05 Properly initialize the UCI plugin. 2011-08-01 13:06:09 +02:00
Tobias Brunner aeb6590bda Build libtncif on Android. 2011-07-29 17:41:14 +02:00
Tobias Brunner 088d73b7b0 File lists in Android.mk files updated. 2011-07-29 17:40:29 +02:00
Tobias Brunner 241cf8e791 Update fallback drop policies if required. 2011-07-29 12:34:51 +02:00
Tobias Brunner 2e370a300d Allow routing table IDs > 255 when filtering them. 2011-07-29 12:16:18 +02:00
Tobias Brunner 50937e8b80 DUMM: Allow addresses to be configured with net prefix. 2011-07-29 12:14:02 +02:00
Tobias Brunner 0511c93d46 Fixed host_create_from_subnet when no prefix is given. 2011-07-29 12:11:20 +02:00
Tobias Brunner f1c1965d64 Install fallback drop policies for all three directions. 2011-07-28 16:56:15 +02:00
Tobias Brunner d7a59f1976 Install fallback drop policies to avoid transmitting unencrypted packets. 
During the update of a CHILD_SA (e.g. caused by MOBIKE) the old policy
is first uninstalled and then the new one is installed.  In the short
time in between, where no policy is available in the kernel, unencrypted
packets could have been transmitted.
 2011-07-27 13:44:33 +02:00
Tobias Brunner fbedc6a45b Remove policies in kernel interfaces based on their priority. 
This allows to unroute a connection while the same connection is
currently established.  In this case both CHILD_SAs share the same
reqid but the installed policies have different priorities.
 2011-07-27 13:41:35 +02:00
Tobias Brunner a2e377fcfd Added missing include in mysql plugin. 
This was previously pulled in via linked_list.h->iterator.h->library.h.
 2011-07-26 15:47:01 +02:00
Tobias Brunner 45945fa137 Added tnc, imc, imv debug message groups to man page. 2011-07-26 09:38:13 +02:00
Tobias Brunner 446ff101c2 Added a log message when roam jobs get created. 2011-07-21 19:44:42 +02:00
Tobias Brunner cbf5c2c61c Readded docs for some arguments to global functions. 
Those were overzealously removed in 28623fc538.
 2011-07-21 18:38:43 +02:00
Tobias Brunner 92032fd4d6 Fixed sleep command in two test cases. 2011-07-21 16:34:37 +02:00
Tobias Brunner 107ea60f5c Added NEWS about job priorities and IKE_SA_INIT dropping. 2011-07-21 16:26:30 +02:00
Tobias Brunner 4f3ca916c5 Documentation about job priorities added to man page. 
Also includes docs about IKE_SA_INIT dropping.
 2011-07-21 16:17:08 +02:00
Tobias Brunner f3bb1bd039 Fixed common misspellings. 
Mostly found by 'codespell'.
 2011-07-20 16:14:10 +02:00
Tobias Brunner 20a44a5c66 Removed old ikev2bis draft. 2011-07-20 15:57:29 +02:00
Tobias Brunner 355728110a Added missing load-tester options to man page. 2011-07-18 19:01:18 +02:00
Tobias Brunner d604e79185 Count running load-tester threads properly. 2011-07-18 18:46:50 +02:00
Tobias Brunner ebbdc3250b Fix load-tester.shutdown_when_complete option. 
It didn't work when used together with delete_after_established=yes.
 2011-07-18 18:46:50 +02:00
Tobias Brunner 369c2e1dee Fix listener registration in load-tester plugin. 
This fixes the load-tester.shutdown_when_complete option.
 2011-07-18 18:46:50 +02:00
Tobias Brunner 93095183dd Added news about policy history. 2011-07-06 13:03:45 +02:00
Tobias Brunner 17927ca615 Record usage history of policies in PF_KEY kernel interface. 
The implementation is nearly the same as in the Netlink kernel interface.
 2011-07-06 12:56:34 +02:00
Tobias Brunner 4e9e4372f5 Simplified destruction of policy_sa_t objects in Netlink interface. 2011-07-06 12:49:54 +02:00
Tobias Brunner 0c2ce1905a Adapted shunt manager to changed kernel interface (reqid in del_policy). 2011-07-06 12:48:26 +02:00
Tobias Brunner 674bc34322 Some code cleanup in Netlink kernel interface. 2011-07-06 09:43:46 +02:00
Tobias Brunner 108357b106 Some code cleanup in PF_KEY kernel interface. 2011-07-06 09:43:46 +02:00
Tobias Brunner 9f49464d56 Reduce memory usage of policy history caching. 
Only cache data as needed (e.g. traffic selectors only for forward
policies) and at most once for each IPsec SA.
 2011-07-06 09:43:46 +02:00
Tobias Brunner a07568cf6a Use has_more in decrypt_payloads instead of calling enumerate twice. 2011-07-06 09:43:46 +02:00
Tobias Brunner 1142726ba0 Added linked_list_t.has_more which checks if any elements follow an enumerator's current position. 2011-07-06 09:43:46 +02:00
Tobias Brunner 2bf9d39da6 Make sure the enumerator stops after all items have been enumerated. 
This also changes how insert_before behaves, before enumeration items
are inserted first, after enumeration last.
 2011-07-06 09:43:46 +02:00
Tobias Brunner c225f9b558 Keep the mutex locked as long as possible when deleting policies. 
This change tries to prevent a race condition where a thread tries to
install the same policy another thread is currently deleting. If the
second thread releases the mutex in del_policy too early the first
thread could assume the policy does not exist (as it is not cached
anymore) but would not be able to actually install it if the second
thread was not yet able to delete it.
 2011-07-06 09:43:46 +02:00
Tobias Brunner bd4f7dab75 Properly unlock the policy if no change in the kernel is required. 2011-07-06 09:43:46 +02:00
Tobias Brunner 32fbad4ec2 Make sure access to policy is thread-safe during installation of route. 2011-07-06 09:43:46 +02:00
Tobias Brunner 629fd2f4f6 Finally removed deprecated iterator_t. 2011-07-06 09:43:46 +02:00
Tobias Brunner 203497d80e Removed unneeded and confusing insert_after method from linked_list_t. 2011-07-06 09:43:46 +02:00
Tobias Brunner 47daa0e6fe Replaced more complex iterator usages. 2011-07-06 09:43:45 +02:00
Tobias Brunner 67405ce808 Added a function to reset the enumerator of a linked list. 2011-07-06 09:43:45 +02:00
Tobias Brunner 572abc6cbd Replaced ike_sa_t.create_additional_address_iterator with enumerator. 2011-07-06 09:43:45 +02:00
Tobias Brunner 4bbce1ef37 Replaced ike_sa_t.create_child_sa_iterator with enumerator. 
This required two new methods on ike_sa_t. One returns the number of
CHILD_SAs and one allows to remove a CHILD_SA.
 2011-07-06 09:43:45 +02:00
Tobias Brunner 4f9c691adb Replaced pkcs7_t.create_certificate_iterator with enumerator. 
The method is currently not used.
 2011-07-06 09:43:45 +02:00
Tobias Brunner e26304348c Replaced simple iterator usages. 2011-07-06 09:43:45 +02:00
Tobias Brunner 28623fc538 "this" removed from comments. 2011-07-06 09:43:45 +02:00
Tobias Brunner f0ba8ae042 Record the history of a policy installed in the kernel. 
This allows to properly delete a policy e.g. if reauth=yes and
auto=route, because reqids are increased during reauthentication.

It also avoids overriding an installed policy with a trap policy.
 2011-07-06 09:43:45 +02:00
Tobias Brunner 328f22e1d3 Add the reqid to kernel_ipsec_t.del_policy. 2011-07-06 09:43:45 +02:00
Tobias Brunner 0b6ff2a9fe Added a replace function to linked_list_t. 2011-07-06 09:43:45 +02:00
Tobias Brunner fbf014b0c1 Added an insert_after and insert_before function to linked_list_t. 2011-07-06 09:43:45 +02:00
Tobias Brunner 178760012c Migrated linked_list_t to INIT/METHOD macros. 2011-07-06 09:43:45 +02:00
Tobias Brunner 3ee8fed445 Cache the most recent reqid in the PF_KEY kernel interface. 
This makes the PF_KEY kernel interface behave the same as the Netlink
kernel interface.
 2011-07-06 09:43:45 +02:00
Tobias Brunner a7edbd219f Added news about library dir change. 2011-07-05 15:26:50 +02:00
Tobias Brunner 60d62b9e5c Don't install the libraries directly in lib/. 
Instead use a subdirectory (prefix/lib/ipsec by default). Also moved the
plugins from libexec to a subdirectory of that dir.
 2011-07-05 14:42:14 +02:00
Tobias Brunner fbdef639d6 COPYING updated to the most current version (address was incorrect). 2011-06-08 16:49:08 +02:00
Tobias Brunner 289c424589 Fix integrity checks with monolithic build. 2011-06-08 15:46:07 +02:00
Tobias Brunner dcc1ad6a23 Prevent deadlock while shutting down thread pool. 
During destruction the main thread locks the mutex in processor_t and
waits on a condvar for threads to have terminated.  Because the mutex
has also to be locked to decrement the thread count the condvar cannot
be signaled before doing that as otherwise the main thread might already
be waiting to join the threads while locking the mutex and thus causing
a deadlock.
 2011-06-08 11:44:42 +02:00
Tobias Brunner 876961cf0e Properly print time differences. 
time_t is not necessarily of type int.
 2011-06-07 17:52:34 +02:00
Tobias Brunner 1b185ea490 Use proper printf specifiers to print u_int64_t and uintptr_t. 2011-06-07 17:30:57 +02:00
Tobias Brunner bf870ffbe7 Default value for keyingtries documented properly. 2011-05-31 09:03:23 +02:00
Tobias Brunner 608657519a ipsec: Wait longer for starter to quit before killing it. 
As starter waits up to 10 seconds for either daemon to quit, killing it
already after 5 seconds is too early.
 2011-05-26 12:43:01 +02:00
Tobias Brunner ae9d5e7ce1 Option to enable duplicheck plugin fixed. 2011-05-26 12:37:41 +02:00
Tobias Brunner 617061072b Renamed option to enable unit tests as plugin is named unit-tester. 
To correctly enable a plugin the names used in the ARG_ENABL_SET and
ADD_PLUGIN macros have to match (and they have, of course, to match the
plugin's name).
 2011-05-24 19:28:54 +02:00
Tobias Brunner ee0fb2ab81 Keep count of remaining elements to enumerate in hashtable_t. 
This improves performance during enumeration as not all buckets have to be
checked.
 2011-05-24 19:23:45 +02:00
Tobias Brunner 8af0177189 Replaced linked_list_t usage in hashtable_t with custom list implementation. 
With this change inserting elements into a hashtable_t object is now
nearly as fast as inserting them into a linked_list_t object, whereas
before it was up to seven times slower.  Additionally, the memory
footprint of a hashtable is now significantly smaller.  The lookup
performance is also nearly doubled.
 2011-05-24 19:23:45 +02:00
Tobias Brunner c74ece334d pluto: Made helper functions in event_queue static. 2011-05-24 19:23:45 +02:00
Tobias Brunner b3c4475076 Compiler warning fixed. 2011-05-24 19:23:45 +02:00
Tobias Brunner d30df6ff3d stroke: Usage output updated. 2011-05-16 18:47:52 +02:00
Tobias Brunner 92abe2bd68 Update working thread count without allocation. 2011-05-16 18:28:03 +02:00
Tobias Brunner 21692169b9 Make sure working thread count is correctly updated 2011-05-16 15:24:16 +02:00
Tobias Brunner 700296ccbe maemo: New upstream release. 2011-05-16 14:15:08 +02:00
Tobias Brunner 0e080d9b64 Don't compile login() in openssl_rsa_private_key_t if ENGINE support is disabled in OpenSSL. 2011-05-13 13:11:11 +02:00
Tobias Brunner 38a93a3cd9 fetcher.c added to Android.mk. 2011-05-13 13:09:38 +02:00
Tobias Brunner 38865eced3 Return correct status code in kernel_netlink_ipsec_t.query_sa. 2011-05-10 15:45:42 +02:00
Tobias Brunner 70f918ec1d chunk_clear not clear_chunk. 2011-05-10 15:40:46 +02:00
Tobias Brunner 5832d5058b Typo in NEWS fixed. 2011-05-05 10:31:33 +02:00
Tobias Brunner bf3c371531 Note about certificates added to CA section in ipsec.conf man page. 2011-05-05 10:30:51 +02:00
Tobias Brunner a855af9544 testing: Properly align numbers of succeeded and failed tests in overview page. 2011-05-05 10:29:52 +02:00
Tobias Brunner e296fc2d26 testing: Add crumbtrail to overview page which lists all tests. 2011-05-05 10:29:52 +02:00
Tobias Brunner ca25eb9eb3 testing: Directly link to index.html of tests to allow browsing via file://. 2011-05-05 10:29:52 +02:00
Tobias Brunner e8ae55f64b testing: Avoid adding additional spacing around testresults. 2011-05-05 10:29:52 +02:00
Tobias Brunner 074919dcc5 testing: Replace back link in results with crumbtrail to improve navigation. 2011-05-05 10:29:51 +02:00
Tobias Brunner b4c9ab9c79 Cache group name in sys_logger_t to avoid problems with Vstr. 
Because syslog(3) is not replaced when using the Vstr wrapper, %N can
not be resolved properly.
 2011-05-03 10:50:28 +02:00
Tobias Brunner b7cb8100c4 Migrated sys_logger_t to INIT/METHOD macros. 2011-05-03 10:21:58 +02:00
Tobias Brunner 5bbe0ee18c Migrated file_logger_t to INIT/METHOD macros. 2011-05-03 10:21:03 +02:00
Tobias Brunner 7b12521679 Removed superfluous parameter missed in e5e5bcc92f. 2011-05-02 17:13:14 +02:00
Tobias Brunner 68447302d6 Typo fixed. 2011-04-28 12:50:30 +02:00
Tobias Brunner 67ec2be665 IKEv2 was only partially the default for connections with auto=route and auto=start. 
Connections with auto=route and auto=start that did not have
keyexchange=ikev2 explicitly specified did get added to charon,
but did not get routed or started by charon.
 2011-04-27 11:33:06 +02:00
Tobias Brunner cce8f65232 Fixed two typos in kernel-pfroute plugin. 2011-04-26 17:58:39 +02:00
Tobias Brunner dd0696ec8e Use strncpy when reading smartcard keyids from ipsec.secrets. 2011-04-19 18:00:16 +02:00
Tobias Brunner 6e0c82141f pluto: Replaced some strcpy usages with strncpy. 2011-04-19 17:35:57 +02:00
Tobias Brunner 81b598ca5f openac: --out is a mandatory argument. 2011-04-19 17:35:57 +02:00
Tobias Brunner 2bf1d44f7b openac: Fixed potential overflow while reading passphrase. 2011-04-19 13:48:51 +02:00
Tobias Brunner 68e9275134 openac: Make sure path is null-terminated. 2011-04-19 13:48:51 +02:00
Tobias Brunner 2653c08513 pluto: Make sure connection name is null-terminated during DPD restart. 2011-04-19 13:48:51 +02:00
Tobias Brunner f36a6ebd30 starter: Make sure interface name is null-terminated. 2011-04-19 13:48:51 +02:00