denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
7,400 Commits 1 Branch 0 Tags
b9d61f78d36bac7b731d7b21e0b06d95dc39506e
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Tobias Brunner f35578acb1 Renamed 'use' database column as that is a keyword in MySQL. 
Reported by Stefan Tomas.
 2011-09-01 09:59:37 +02:00
Tobias Brunner 7ebf021d37 typos: initator->initiator, authenticaion->authentication. 2011-08-15 16:31:04 +02:00
Tobias Brunner 19e12db79c pluto: Some whitespace cleanup. 2011-08-15 15:53:26 +02:00
Tobias Brunner 9af9c6772b If we close a duplicate SA, it is also no authentication failure. 2011-08-12 10:11:39 +02:00
Tobias Brunner d9eaecd373 If local authentication fails, it is not really a peer auth failure. 2011-08-12 10:04:02 +02:00
Tobias Brunner ccbe380377 Throw an alert if authentication of the peer fails (not only for initiator). 2011-08-12 10:04:02 +02:00
Tobias Brunner 7ab19d571d Throw an alert when the peer address cannot be resolved during initiation. 2011-08-12 09:59:27 +02:00
Tobias Brunner ff4b25f9b7 Throw an alert via bus_t when remote authentication fails. 2011-08-12 09:59:27 +02:00
Tobias Brunner 45048eae23 Verify that executables are available and set (pluto|charon)start accordingly. 
Some distributions enable both daemons but then distribute the
executables in two separate packages.  If only one package is installed
but both daemons are enabled in ipsec.conf, starter will try to start
the non existing daemon over and over again, and will each time readd
the configs to the other daemon.
 2011-08-11 13:38:05 +02:00
Tobias Brunner 1d5aae4b53 Fixed syntax in MySQL script. 2011-08-08 16:15:28 +02:00
Tobias Brunner 6820ae78c1 maemo: New upstream release. 2011-08-05 14:45:17 +02:00
Tobias Brunner c5c10a2409 maemo: Define _GNU_SOURCE to make llabs available. 
llabs is defined in C99, thus requires e.g. _USE_ISOC99 to be defined.
features.h on Maemo defines _USE_ISOC99 in fewer cases than newer versions
of it do on other platforms.
 2011-08-05 14:40:01 +02:00
Tobias Brunner d135a5a5a3 maemo: Libraries are installed in lib/ipsec, binaries in libexec not lib. 2011-08-05 14:31:45 +02:00
Tobias Brunner 7a4d3fa81c maemo: Don't overwrite location of libexec. 2011-08-05 14:29:23 +02:00
Tobias Brunner 6b444c5934 Migrated peer_cfg_t to INIT/METHOD macros. 2011-08-03 15:17:34 +02:00
Tobias Brunner 846f846a39 Added tnc Doxygen group to libcharon. 2011-08-03 11:01:08 +02:00
Tobias Brunner 3cc54439c1 Moved PEN to libstrongswan Doxygen group. 2011-08-03 11:01:03 +02:00
Tobias Brunner ac8bb6498a Doxygen group for BIO added. 2011-08-03 10:54:32 +02:00
Tobias Brunner 0057427008 Disable policy history for pluto. 
pluto tracks usage of policies already in its own way.
 2011-08-02 18:34:49 +02:00
Tobias Brunner 889a62a8d4 pluto: --debug-kernel aliasing was not fully complete. 2011-08-02 18:15:50 +02:00
Tobias Brunner b29ed3715c jhash.h is not part of the distribution anymore. 2011-08-02 16:14:16 +02:00
Tobias Brunner 5baaaa5ed5 Properly initialize ike_sa_t. 2011-08-01 13:08:15 +02:00
Tobias Brunner acf380bc05 Properly initialize the UCI plugin. 2011-08-01 13:06:09 +02:00
Tobias Brunner aeb6590bda Build libtncif on Android. 2011-07-29 17:41:14 +02:00
Tobias Brunner 088d73b7b0 File lists in Android.mk files updated. 2011-07-29 17:40:29 +02:00
Tobias Brunner 241cf8e791 Update fallback drop policies if required. 2011-07-29 12:34:51 +02:00
Tobias Brunner 2e370a300d Allow routing table IDs > 255 when filtering them. 2011-07-29 12:16:18 +02:00
Tobias Brunner 50937e8b80 DUMM: Allow addresses to be configured with net prefix. 2011-07-29 12:14:02 +02:00
Tobias Brunner 0511c93d46 Fixed host_create_from_subnet when no prefix is given. 2011-07-29 12:11:20 +02:00
Tobias Brunner f1c1965d64 Install fallback drop policies for all three directions. 2011-07-28 16:56:15 +02:00
Tobias Brunner d7a59f1976 Install fallback drop policies to avoid transmitting unencrypted packets. 
During the update of a CHILD_SA (e.g. caused by MOBIKE) the old policy
is first uninstalled and then the new one is installed.  In the short
time in between, where no policy is available in the kernel, unencrypted
packets could have been transmitted.
 2011-07-27 13:44:33 +02:00
Tobias Brunner fbedc6a45b Remove policies in kernel interfaces based on their priority. 
This allows to unroute a connection while the same connection is
currently established.  In this case both CHILD_SAs share the same
reqid but the installed policies have different priorities.
 2011-07-27 13:41:35 +02:00
Tobias Brunner a2e377fcfd Added missing include in mysql plugin. 
This was previously pulled in via linked_list.h->iterator.h->library.h.
 2011-07-26 15:47:01 +02:00
Tobias Brunner 45945fa137 Added tnc, imc, imv debug message groups to man page. 2011-07-26 09:38:13 +02:00
Tobias Brunner 446ff101c2 Added a log message when roam jobs get created. 2011-07-21 19:44:42 +02:00
Tobias Brunner cbf5c2c61c Readded docs for some arguments to global functions. 
Those were overzealously removed in 28623fc538.
 2011-07-21 18:38:43 +02:00
Tobias Brunner 92032fd4d6 Fixed sleep command in two test cases. 2011-07-21 16:34:37 +02:00
Tobias Brunner 107ea60f5c Added NEWS about job priorities and IKE_SA_INIT dropping. 2011-07-21 16:26:30 +02:00
Tobias Brunner 4f3ca916c5 Documentation about job priorities added to man page. 
Also includes docs about IKE_SA_INIT dropping.
 2011-07-21 16:17:08 +02:00
Tobias Brunner f3bb1bd039 Fixed common misspellings. 
Mostly found by 'codespell'.
 2011-07-20 16:14:10 +02:00
Tobias Brunner 20a44a5c66 Removed old ikev2bis draft. 2011-07-20 15:57:29 +02:00
Tobias Brunner 355728110a Added missing load-tester options to man page. 2011-07-18 19:01:18 +02:00
Tobias Brunner d604e79185 Count running load-tester threads properly. 2011-07-18 18:46:50 +02:00
Tobias Brunner ebbdc3250b Fix load-tester.shutdown_when_complete option. 
It didn't work when used together with delete_after_established=yes.
 2011-07-18 18:46:50 +02:00
Tobias Brunner 369c2e1dee Fix listener registration in load-tester plugin. 
This fixes the load-tester.shutdown_when_complete option.
 2011-07-18 18:46:50 +02:00
Tobias Brunner 93095183dd Added news about policy history. 2011-07-06 13:03:45 +02:00
Tobias Brunner 17927ca615 Record usage history of policies in PF_KEY kernel interface. 
The implementation is nearly the same as in the Netlink kernel interface.
 2011-07-06 12:56:34 +02:00
Tobias Brunner 4e9e4372f5 Simplified destruction of policy_sa_t objects in Netlink interface. 2011-07-06 12:49:54 +02:00
Tobias Brunner 0c2ce1905a Adapted shunt manager to changed kernel interface (reqid in del_policy). 2011-07-06 12:48:26 +02:00
Tobias Brunner 674bc34322 Some code cleanup in Netlink kernel interface. 2011-07-06 09:43:46 +02:00
Tobias Brunner 108357b106 Some code cleanup in PF_KEY kernel interface. 2011-07-06 09:43:46 +02:00
Tobias Brunner 9f49464d56 Reduce memory usage of policy history caching. 
Only cache data as needed (e.g. traffic selectors only for forward
policies) and at most once for each IPsec SA.
 2011-07-06 09:43:46 +02:00
Tobias Brunner a07568cf6a Use has_more in decrypt_payloads instead of calling enumerate twice. 2011-07-06 09:43:46 +02:00
Tobias Brunner 1142726ba0 Added linked_list_t.has_more which checks if any elements follow an enumerator's current position. 2011-07-06 09:43:46 +02:00
Tobias Brunner 2bf9d39da6 Make sure the enumerator stops after all items have been enumerated. 
This also changes how insert_before behaves, before enumeration items
are inserted first, after enumeration last.
 2011-07-06 09:43:46 +02:00
Tobias Brunner c225f9b558 Keep the mutex locked as long as possible when deleting policies. 
This change tries to prevent a race condition where a thread tries to
install the same policy another thread is currently deleting. If the
second thread releases the mutex in del_policy too early the first
thread could assume the policy does not exist (as it is not cached
anymore) but would not be able to actually install it if the second
thread was not yet able to delete it.
 2011-07-06 09:43:46 +02:00
Tobias Brunner bd4f7dab75 Properly unlock the policy if no change in the kernel is required. 2011-07-06 09:43:46 +02:00
Tobias Brunner 32fbad4ec2 Make sure access to policy is thread-safe during installation of route. 2011-07-06 09:43:46 +02:00
Tobias Brunner 629fd2f4f6 Finally removed deprecated iterator_t. 2011-07-06 09:43:46 +02:00
Tobias Brunner 203497d80e Removed unneeded and confusing insert_after method from linked_list_t. 2011-07-06 09:43:46 +02:00
Tobias Brunner 47daa0e6fe Replaced more complex iterator usages. 2011-07-06 09:43:45 +02:00
Tobias Brunner 67405ce808 Added a function to reset the enumerator of a linked list. 2011-07-06 09:43:45 +02:00
Tobias Brunner 572abc6cbd Replaced ike_sa_t.create_additional_address_iterator with enumerator. 2011-07-06 09:43:45 +02:00
Tobias Brunner 4bbce1ef37 Replaced ike_sa_t.create_child_sa_iterator with enumerator. 
This required two new methods on ike_sa_t. One returns the number of
CHILD_SAs and one allows to remove a CHILD_SA.
 2011-07-06 09:43:45 +02:00
Tobias Brunner 4f9c691adb Replaced pkcs7_t.create_certificate_iterator with enumerator. 
The method is currently not used.
 2011-07-06 09:43:45 +02:00
Tobias Brunner e26304348c Replaced simple iterator usages. 2011-07-06 09:43:45 +02:00
Tobias Brunner 28623fc538 "this" removed from comments. 2011-07-06 09:43:45 +02:00
Tobias Brunner f0ba8ae042 Record the history of a policy installed in the kernel. 
This allows to properly delete a policy e.g. if reauth=yes and
auto=route, because reqids are increased during reauthentication.

It also avoids overriding an installed policy with a trap policy.
 2011-07-06 09:43:45 +02:00
Tobias Brunner 328f22e1d3 Add the reqid to kernel_ipsec_t.del_policy. 2011-07-06 09:43:45 +02:00
Tobias Brunner 0b6ff2a9fe Added a replace function to linked_list_t. 2011-07-06 09:43:45 +02:00
Tobias Brunner fbf014b0c1 Added an insert_after and insert_before function to linked_list_t. 2011-07-06 09:43:45 +02:00
Tobias Brunner 178760012c Migrated linked_list_t to INIT/METHOD macros. 2011-07-06 09:43:45 +02:00
Tobias Brunner 3ee8fed445 Cache the most recent reqid in the PF_KEY kernel interface. 
This makes the PF_KEY kernel interface behave the same as the Netlink
kernel interface.
 2011-07-06 09:43:45 +02:00
Tobias Brunner a7edbd219f Added news about library dir change. 2011-07-05 15:26:50 +02:00
Tobias Brunner 60d62b9e5c Don't install the libraries directly in lib/. 
Instead use a subdirectory (prefix/lib/ipsec by default). Also moved the
plugins from libexec to a subdirectory of that dir.
 2011-07-05 14:42:14 +02:00
Tobias Brunner fbdef639d6 COPYING updated to the most current version (address was incorrect). 2011-06-08 16:49:08 +02:00
Tobias Brunner 289c424589 Fix integrity checks with monolithic build. 2011-06-08 15:46:07 +02:00
Tobias Brunner dcc1ad6a23 Prevent deadlock while shutting down thread pool. 
During destruction the main thread locks the mutex in processor_t and
waits on a condvar for threads to have terminated.  Because the mutex
has also to be locked to decrement the thread count the condvar cannot
be signaled before doing that as otherwise the main thread might already
be waiting to join the threads while locking the mutex and thus causing
a deadlock.
 2011-06-08 11:44:42 +02:00
Tobias Brunner 876961cf0e Properly print time differences. 
time_t is not necessarily of type int.
 2011-06-07 17:52:34 +02:00
Tobias Brunner 1b185ea490 Use proper printf specifiers to print u_int64_t and uintptr_t. 2011-06-07 17:30:57 +02:00
Tobias Brunner bf870ffbe7 Default value for keyingtries documented properly. 2011-05-31 09:03:23 +02:00
Tobias Brunner 608657519a ipsec: Wait longer for starter to quit before killing it. 
As starter waits up to 10 seconds for either daemon to quit, killing it
already after 5 seconds is too early.
 2011-05-26 12:43:01 +02:00
Tobias Brunner ae9d5e7ce1 Option to enable duplicheck plugin fixed. 2011-05-26 12:37:41 +02:00
Tobias Brunner 617061072b Renamed option to enable unit tests as plugin is named unit-tester. 
To correctly enable a plugin the names used in the ARG_ENABL_SET and
ADD_PLUGIN macros have to match (and they have, of course, to match the
plugin's name).
 2011-05-24 19:28:54 +02:00
Tobias Brunner ee0fb2ab81 Keep count of remaining elements to enumerate in hashtable_t. 
This improves performance during enumeration as not all buckets have to be
checked.
 2011-05-24 19:23:45 +02:00
Tobias Brunner 8af0177189 Replaced linked_list_t usage in hashtable_t with custom list implementation. 
With this change inserting elements into a hashtable_t object is now
nearly as fast as inserting them into a linked_list_t object, whereas
before it was up to seven times slower.  Additionally, the memory
footprint of a hashtable is now significantly smaller.  The lookup
performance is also nearly doubled.
 2011-05-24 19:23:45 +02:00
Tobias Brunner c74ece334d pluto: Made helper functions in event_queue static. 2011-05-24 19:23:45 +02:00
Tobias Brunner b3c4475076 Compiler warning fixed. 2011-05-24 19:23:45 +02:00
Tobias Brunner d30df6ff3d stroke: Usage output updated. 2011-05-16 18:47:52 +02:00
Tobias Brunner 92abe2bd68 Update working thread count without allocation. 2011-05-16 18:28:03 +02:00
Tobias Brunner 21692169b9 Make sure working thread count is correctly updated 2011-05-16 15:24:16 +02:00
Tobias Brunner 700296ccbe maemo: New upstream release. 2011-05-16 14:15:08 +02:00
Tobias Brunner 0e080d9b64 Don't compile login() in openssl_rsa_private_key_t if ENGINE support is disabled in OpenSSL. 2011-05-13 13:11:11 +02:00
Tobias Brunner 38a93a3cd9 fetcher.c added to Android.mk. 2011-05-13 13:09:38 +02:00
Tobias Brunner 38865eced3 Return correct status code in kernel_netlink_ipsec_t.query_sa. 2011-05-10 15:45:42 +02:00
Tobias Brunner 70f918ec1d chunk_clear not clear_chunk. 2011-05-10 15:40:46 +02:00
Tobias Brunner 5832d5058b Typo in NEWS fixed. 2011-05-05 10:31:33 +02:00
Tobias Brunner bf3c371531 Note about certificates added to CA section in ipsec.conf man page. 2011-05-05 10:30:51 +02:00
Tobias Brunner a855af9544 testing: Properly align numbers of succeeded and failed tests in overview page. 2011-05-05 10:29:52 +02:00
Tobias Brunner e296fc2d26 testing: Add crumbtrail to overview page which lists all tests. 2011-05-05 10:29:52 +02:00