denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
11,291 Commits 1 Branch 0 Tags
b61c78d3c297dd593e323320250deb6963880765
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Tobias Brunner b61c78d3c2 Merge branch 'kernel-libipsec' 
Adds a new kernel interface plugin that uses TUN devices and libipsec to
provide IPsec process in userland.

It works on Linux, FreeBSD and Mac OS X.  In particular the latter two
platforms may gain from this approach as their respective kernels don't
provide support for AES-GCM.

kernel-pfroute has been improved (source address lookup) and a second
plugin (osx-attr) installs configuration attributes (currently DNS
servers only) via SystemConfiguration on Mac OS X.
 2013-06-21 17:07:41 +02:00
Tobias Brunner 12488efa78 kernel-pfroute: Simplify route lookup after fixing sockaddr parsing 2013-06-21 17:03:22 +02:00
Tobias Brunner 4b3fea3d54 kernel-pfroute: Alignment of sockaddrs is not always the same 2013-06-21 17:03:22 +02:00
Tobias Brunner aa33d2e6eb kernel-pfroute: struct sockaddr arguments are 4 byte aligned 
This was noticed on Mac OS X where, if the default route is returned,
RTA_NETMASK has sa_len set to 0, but skipping zero bytes to read the
next address makes no sense, of course.  Using 0 for sa_len seems
a bit strange, in particular, because struct sockaddr has by definition
a minimum length of 16 bytes.  But it seems FreeBSD actually does the
same.
 2013-06-21 17:03:22 +02:00
Tobias Brunner 23ea59a95c kernel-libipsec: Ignore failures when installing routes for multicast or broadcast policies 2013-06-21 17:03:22 +02:00
Tobias Brunner b0629f7d9b kernel-pfroute: Improve route lookup depending on information we get back 
Kernels don't provide the same information for all routes.
 2013-06-21 17:03:22 +02:00
Tobias Brunner 1c697ff1c5 kernel-pfroute: Try to ensure we get a source address or interface name 2013-06-21 17:03:22 +02:00
Tobias Brunner 01955eec71 ike: Force NAT-T/UDP encapsulation if kernel interface requires it 2013-06-21 17:03:21 +02:00
Tobias Brunner 35fe41f7d0 kernel-libipsec: Add a feature to request UDP encapsulation of ESP packets 2013-06-21 17:03:21 +02:00
Tobias Brunner 66aaabf342 tun-device: Packets sent over utun devices on Mac OS X have the protocol family prepended 2013-06-21 17:03:21 +02:00
Tobias Brunner 34b0ad0653 kernel-pfroute: Use DST as nexthop for host routes 
These are created as cache/clone on Mac OS X.
 2013-06-21 17:03:21 +02:00
Tobias Brunner d6c17e96b2 kernel-pfroute: Implement get_source_addr() 2013-06-21 17:03:21 +02:00
Tobias Brunner f58f8bf409 kernel-pfroute: Properly install routes with interface and gateway 2013-06-21 17:03:21 +02:00
Tobias Brunner 1f31a2bc2e kernel-libipsec: Install a gateway for routes on platforms other than Linux 
This seems required e.g. on FreeBSD but doesn't work on Linux.
 2013-06-21 17:03:21 +02:00
Tobias Brunner 93e4df3761 kernel-pfroute: Activate TUN device before setting address 
On FreeBSD, for some reason, we don't learn the interface is up
otherwise.  Even though ifconfig lists it as up at the same time.
 2013-06-21 17:03:21 +02:00
Tobias Brunner c8a56512a6 tun-device: Avoid opening /dev/tunX multiple times (e.g. on FreeBSD) 2013-06-21 17:03:21 +02:00
Tobias Brunner dcaf8d570c kernel-libipsec: Router reads packets from multiple TUN devices 
These devices are collected via kernel_listener_t interface.
 2013-06-21 17:03:21 +02:00
Tobias Brunner 7045defbff kernel-libipsec: Use separate class to route packets between charon, libipsec and TUN device 2013-06-21 17:03:21 +02:00
Tobias Brunner 554c4276a5 kernel-pfroute: Raise tun event when creating/destroying TUN devices for virtual IPs 2013-06-21 17:03:21 +02:00
Tobias Brunner 4868d1c3bc kernel: Add an event kernel interfaces can raise if they create/destroy a TUN device 2013-06-21 17:03:21 +02:00
Tobias Brunner 0d2ad63fe2 printf-hook: Avoid double-free when freeing Vstr config 
Thread-specific objects get freed when the thread value object is
destroyed (wasn't the case earlier, i.e. before 2b19dd35), which
may cause the second call to vstr_free_conf() to fail in an assert
in Vstr (depending on how it was built).
 2013-06-21 17:03:20 +02:00
Tobias Brunner 587bdf8768 kernel-libipsec: Track policies and automatically install routes 
The routes direct traffic matching the remote traffic selector to the
TUN device.

If the remote traffic selector includes the IKE peer a very specific route
is installed to allow IKE traffic.
 2013-06-21 17:03:20 +02:00
Tobias Brunner 44a49681fd kernel-libipsec: Handle packets between charon socket, libipsec and TUN device 2013-06-21 17:03:20 +02:00
Tobias Brunner 59be6ddd08 kernel-libipsec: Create a TUN device and use it to install virtual IPs 2013-06-21 17:03:20 +02:00
Tobias Brunner 279e0d42bd kernel-libipsec: Add plugin that implements kernel_ipsec_t using libipsec 2013-06-21 17:03:20 +02:00
Tobias Brunner 3cd7ba4960 kernel-netlink: Routes don't require a gateway/nexthop 2013-06-21 17:03:20 +02:00
Tobias Brunner 1b3b7ba54d charon-cmd: Document auxiliary options 2013-06-21 17:00:49 +02:00
Tobias Brunner 4d62ad7571 charon-cmd: Link strongswan.conf(5) and charon-cmd(8) man pages 2013-06-21 16:35:19 +02:00
Tobias Brunner 5991f09565 charon-cmd: Use fixed number of character to align command descriptions 
If the command and argument is longer than that write the first line of
description to the following line.
 2013-06-21 16:04:46 +02:00
Tobias Brunner 5e185047e1 charon-cmd: Shortened and fixed command descriptions 2013-06-21 16:04:45 +02:00
Tobias Brunner 463314b55a charon-cmd: Simplify usage output for authentication profiles 
The man page describes the min full.
 2013-06-21 16:04:45 +02:00
Tobias Brunner e8d6b91ebd charon-cmd: Add Aggressive Mode profiles to man page 2013-06-21 16:04:45 +02:00
Tobias Brunner 0d60489bf8 charon-cmd: Add man page for charon-cmd(8) 2013-06-21 16:04:45 +02:00
Tobias Brunner 295d595b49 charon-cmd: Add --debug argument to set the default log level 2013-06-21 15:55:52 +02:00
Tobias Brunner 4049ec42bf charon-cmd: Handle simple command line arguments like --help before the others 2013-06-21 15:51:42 +02:00
Tobias Brunner 0d25c4ef87 plugin-loader: Move logging of failed features to status() 
Still log an error message if critical features fail, as loaded
plugins/features are not logged in that case.

This way loaded plugins are printed before failed features and
the relation is easier to make for users.  It also allows programs
to log this message on a different level.
 2013-06-21 15:22:46 +02:00
Tobias Brunner 607f8e9906 plugin-loader: Add method to print loaded plugins on a given log level 2013-06-21 15:17:53 +02:00
Tobias Brunner 34ee14dd28 plugin-loader: Collect statistics while loading features, print them in case features failed to load 
There is no need to explicitly search for failed features in critical
plugins as this is now detected while loading the features.
 2013-06-21 15:13:25 +02:00
Tobias Brunner 681e53c70c plugin-loader: Use different log level if failed feature is in critical plugin 2013-06-21 15:13:25 +02:00
Tobias Brunner 13d2d8f634 plugin-loader: Log message when failing to load plugin 2013-06-21 15:13:25 +02:00
Tobias Brunner 51b9d7513d plugin-loader: Reduce verbosity while loading plugins 2013-06-21 15:13:25 +02:00
Tobias Brunner 0adf165c7e Fix crash if the initiator has no suitable proposal available 
Could be triggered with a typo in the ike or esp options when ! is used.
 2013-06-21 11:09:03 +02:00
Tobias Brunner 8c88ca0fcf stroke: Add statusall-nb as alias for statusallnb 2013-06-21 10:51:41 +02:00
Tobias Brunner 4182c86aed stroke: Add non-blocking versions of up and down 
stroke up-nb and stroke down-nb do not block until the command has
finished.  Instead, they return right after initiating the respective
operation.
 2013-06-21 10:49:39 +02:00
Tobias Brunner 9afc6e6a70 starter: Make ipsec.conf path configurable via command line 2013-06-21 10:08:56 +02:00
Tobias Brunner c0d0391a51 pubkey: Improve comparison of raw public key certificate objects 2013-06-21 10:02:25 +02:00
Tobias Brunner 4d04e2c63b utils: Remove volatile qualifier from refcount_t typedef 
It's not really required anymore (if it ever was) and may cause compiler
warnings when using the non atomic versions of ref_get/ref_put.
 2013-06-19 09:28:30 +02:00
Tobias Brunner c6f1929a45 socket-default: Make sure sockets are open when checking with FD_ISSET 2013-06-14 17:25:16 +02:00
Tobias Brunner 1889837767 socket-default: Properly initialize NAT-T port if opening regular socket failed 2013-06-14 16:42:56 +02:00
Tobias Brunner 92f102c21b android: Forward initiator flag to libipsec when adding IPsec SA 2013-06-13 13:55:58 +02:00
Tobias Brunner 52d7c530e9 libipsec: Add initiator flag to definition of ipsec_sa_mgr_t.add_sa() 2013-06-13 13:54:05 +02:00
Tobias Brunner 44fb978169 ha: Fix CHILD_SA installation in ha_dispatcher after adding initiator flag 2013-06-13 13:17:55 +02:00
Tobias Brunner f5f7053bcd leak-detective: Resolve hooked functions during initialization 
If uses of dlopen(), e.g. when loading plugins, produce errors an error
string could get allocated dynamically.  At this point realloc() might not
yet be resolved and when dlsym() is later called by leak detective to do
so the error string might get freed while leak detective is disabled and
real_free() will be called with a pointer into one of leak detective's
memory blocks instead of a pointer to the block itself, causing a SIGSEGV.
 2013-06-11 15:48:26 +02:00
Tobias Brunner 3873526f3e Properly compare CHILD_SAs during rekey collision 
The previous code did not properly check for the situation when the
DELETE for a redundant CHILD_SA created by a responder during a
CHILD_SA rekey collision arrives before the responder's answer to the
initiator's winning CREATE_CHILD_SA request.
 2013-06-11 14:00:02 +02:00
Tobias Brunner 5744226e92 Merge branch 'plugin-loader' 
Improves how plugin loader resolves dependencies between plugins.  The
old loader had problems if plugins had dependencies on features provided
by plugins listed later in the plugin list.  For instance, it was not
possible to use the X.509 implementation provided by the x509 plugin
while using all the crypto primitives provided by the openssl plugin.
Because the x509 plugin has a dependency on SHA1, the old loader skipped
that plugin until it loaded a SHA1 implementation.  Because the loader
also loaded all features with resolved dependencies provided by a specific
plugin it would, while loading the openssl plugin's SHA1 implementation,
also load its X.509 implementation.  So to use the x509 plugin it was
necessary to load the sha1 plugin before it so that its dependencies
could be properly resolved.

With the new implementation the plugins don't have to be in a specific
order to resolve dependencies.  But the order still matters if two
plugins provide the same feature.

Also, support for the get_features() interface was added to all plugins.
 2013-06-11 11:36:40 +02:00
Tobias Brunner 31a416a5b2 Removed stray *_plugin_create() declarations from header files 2013-06-11 11:18:19 +02:00
Tobias Brunner 460488b180 eap-radius: Do initialization in a plugin feature callback 2013-06-11 11:18:19 +02:00
Tobias Brunner 49d7a98f47 Refactored plugin-loader with improved dependency resolution 
With the new implementation the plugins don't have to be listed in any
special order, dependencies are properly resolved.  The order only
matters if two plugins provide the same feature.
 2013-06-11 11:18:19 +02:00
Tobias Brunner facc781500 android-log: Use plugin features 2013-06-11 11:18:19 +02:00
Tobias Brunner df60999b5f android-dns: Use plugin features to register attribute handler 2013-06-11 11:18:19 +02:00
Tobias Brunner e183a6c36d maemo: Use plugin features 2013-06-11 11:18:19 +02:00
Tobias Brunner 6d766925b2 medsrv: Use plugin features with dependency on database implementation 2013-06-11 11:18:19 +02:00
Tobias Brunner da7c3f8900 medcli: Use plugin features with dependency on database implementation 2013-06-11 11:18:19 +02:00
Tobias Brunner d0ccae4dd2 whitelist: Use plugin features to register listener 2013-06-11 11:18:19 +02:00
Tobias Brunner 49d333ac67 updown: Use plugin features to register listener and attribute handler 2013-06-11 11:18:19 +02:00
Tobias Brunner 819cb66298 unity: Use plugin features to register listener and attribute handler/provider 2013-06-11 11:18:19 +02:00
Tobias Brunner b033d59d1e unit-tester: Use plugin features 2013-06-11 11:18:19 +02:00
Tobias Brunner e1360331e9 uci: Use plugin features to register backend and credential set 2013-06-11 11:18:19 +02:00
Tobias Brunner 36f27c1506 systime-fix: Use plugin features to register validator 2013-06-11 11:18:19 +02:00
Tobias Brunner c1f5841bb2 smp: Use plugin features 2013-06-11 11:18:19 +02:00
Tobias Brunner 64b0c2575f radattr: Use plugin features to register listener 2013-06-11 11:18:18 +02:00
Tobias Brunner d94c0913b1 lookip: Use plugin features to register listener 2013-06-11 11:18:18 +02:00
Tobias Brunner dfe97d63d8 led: Use plugin features to register listener 2013-06-11 11:18:18 +02:00
Tobias Brunner da04914933 test-vectors: Use plugin features 2013-06-11 11:18:18 +02:00
Tobias Brunner 17f00db6d6 revocation: Use plugin features with soft dependencies on fetcher and en-/decoding 2013-06-11 11:18:18 +02:00
Tobias Brunner 25da1943b3 padlock: Use plugin features to properly register algorithms 2013-06-11 11:18:18 +02:00
Tobias Brunner 7756c0383e pkcs11: Use plugin_features_add() in get_features() 2013-06-11 11:18:18 +02:00
Tobias Brunner 886a40d75e plugin-feature: Added helper function to extend arrays of plugin features 2013-06-11 11:18:18 +02:00
Tobias Brunner c172a92bfb constraints: Use plugin features with soft dependency on X.509 decoding 2013-06-11 11:18:18 +02:00
Tobias Brunner e3bdf03af4 blowfish: Use plugin features to properly register crypter 2013-06-11 11:18:18 +02:00
Tobias Brunner 8f49a8d0a6 resolve: Use plugin features to register attribute handler 2013-06-11 11:18:18 +02:00
Tobias Brunner 44d5e10d9e attr: Use plugin features to register attribute provider 2013-06-11 11:18:18 +02:00
Tobias Brunner 21d094f402 ipseckey: Allow en-/disabling at runtime using plugin reload feature 2013-06-11 11:18:18 +02:00
Tobias Brunner 82d3f5122b ipseckey: Use plugin features and depend on RESOLVER 
Also fixed a double-free of the resolver instance.
 2013-06-11 11:18:18 +02:00
Tobias Brunner d895721489 unbound: Use plugin features and provide RESOLVER 2013-06-11 11:18:18 +02:00
Tobias Brunner f5bd1a5e09 plugin-feature: Add feature for DNSSEC-enabled resolvers 2013-06-11 11:18:18 +02:00
Tobias Brunner 924196d6d4 ha: Use plugin features to register listeners and attribute provider 2013-06-11 11:18:18 +02:00
Tobias Brunner e5f4b3ca5b farp: Use plugin features to register listener 2013-06-11 11:18:17 +02:00
Tobias Brunner aa71f5f515 error-notify: Use plugin features to register listener 2013-06-11 11:18:17 +02:00
Tobias Brunner 57c29f6895 duplicheck: Use plugin features to register listener 2013-06-11 11:18:17 +02:00
Tobias Brunner 6c51ff745c coupling: Use plugin features and soft depend on SHA1 2013-06-11 11:18:17 +02:00
Tobias Brunner 0c52198bc1 certexpire: Use plugin features to register listener 2013-06-11 11:18:17 +02:00
Tobias Brunner 94ca7252c1 addrblock: Use plugin features with soft dependency on X.509 decoding 2013-06-11 11:18:17 +02:00
Tobias Brunner 12459a4dc8 dhcp: Use plugin features with dependency to RNG implementation 2013-06-11 11:18:17 +02:00
Tobias Brunner 11a27ea28f sql: Use plugin features with dependency to database backend 2013-06-11 11:18:17 +02:00
Tobias Brunner 989ec772b5 attr-sql: Use plugin features with dependency to database backend 2013-06-11 11:18:17 +02:00
Tobias Brunner 8a6cc1e35f plugin-feature: Function added to exactly compare plugin features 2013-06-11 11:18:17 +02:00
Tobias Brunner 270e425b24 Socket plugins soft depend on the kernel-ipsec plugin feature 
On most platforms calls to methods to bypass the IKE sockets and enabling
UDP decapsulation are required.
 2013-06-11 11:18:17 +02:00
Tobias Brunner c50da645b8 Merge branch 'unit-tests' 
Adds a test runner and several test suites for libstrongswan.
Also adds an option to produce a test coverage report.

Several bugs were fixed in the process and chunk_hash() was replaced
with an improved implementation based on SipHash-2-4 (with a randomly
allocated key to prevent hash flooding attacks).
 2013-06-11 11:16:30 +02:00
Tobias Brunner bde35a6fb2 Suppress log messages during tests 2013-06-11 11:03:13 +02:00