denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
17,743 Commits 1 Branch 0 Tags
d2fe921cf5f5fd7940495891afe108d26c1c1ca7
Commit Graph
98 Commits
Author SHA1 Message Date
Tobias Brunner 08a3ee0cce bus: Change ike_update() signature and only call it once 
This avoids multiple events when both addresses change (e.g. switching
address families).
 2021-01-18 11:34:40 +01:00
Tobias Brunner b422f16d10 sys-logger: Optionally log the level of each message 
Fixes #3509.
 2020-10-27 10:42:49 +01:00
Tobias Brunner a3f5e38b7f file-logger: Optionally log the level of each message 
Fixes #3509.
 2020-10-27 10:42:39 +01:00
Tobias Brunner b06374f6a5 file-logger: Set owner/group of log file 
The file is usually opened/created by root, however, if user/group IDs
are configured and the configuration is reloaded, the file will be reopened
as configured user.  Like with UNIX sockets we only attempt to change
the user if we have CAP_CHOWN allowing a start as regular user.

We don't have chown() on Windows, so check for it.
 2020-05-07 09:30:57 +02:00
Josh Soref b3ab7a48cc Spelling fixes 
* accumulating
* acquire
* alignment
* appropriate
* argument
* assign
* attribute
* authenticate
* authentication
* authenticator
* authority
* auxiliary
* brackets
* callback
* camellia
* can't
* cancelability
* certificate
* choinyambuu
* chunk
* collector
* collision
* communicating
* compares
* compatibility
* compressed
* confidentiality
* configuration
* connection
* consistency
* constraint
* construction
* constructor
* database
* decapsulated
* declaration
* decrypt
* derivative
* destination
* destroyed
* details
* devised
* dynamic
* ecapsulation
* encoded
* encoding
* encrypted
* enforcing
* enumerator
* establishment
* excluded
* exclusively
* exited
* expecting
* expire
* extension
* filter
* firewall
* foundation
* fulfillment
* gateways
* hashing
* hashtable
* heartbeats
* identifier
* identifiers
* identities
* identity
* implementers
* indicating
* initialize
* initiate
* initiation
* initiator
* inner
* instantiate
* legitimate
* libraries
* libstrongswan
* logger
* malloc
* manager
* manually
* measurement
* mechanism
* message
* network
* nonexistent
* object
* occurrence
* optional
* outgoing
* packages
* packets
* padding
* particular
* passphrase
* payload
* periodically
* policies
* possible
* previously
* priority
* proposal
* protocol
* provide
* provider
* pseudo
* pseudonym
* public
* qualifier
* quantum
* quintuplets
* reached
* reading
* recommendation to
* recommendation
* recursive
* reestablish
* referencing
* registered
* rekeying
* reliable
* replacing
* representing
* represents
* request
* request
* resolver
* result
* resulting
* resynchronization
* retriable
* revocation
* right
* rollback
* rule
* rules
* runtime
* scenario
* scheduled
* security
* segment
* service
* setting
* signature
* specific
* specified
* speed
* started
* steffen
* strongswan
* subjectaltname
* supported
* threadsafe
* traffic
* tremendously
* treshold
* unique
* uniqueness
* unknown
* until
* upper
* using
* validator
* verification
* version
* version
* warrior

Closes strongswan/strongswan#164.
 2020-02-11 18:23:07 +01:00
Thomas Egerer eed20c21d3 ha: Add auth method for HA IKEv1 key derivation 
Signed-off-by: Thomas Egerer <[email protected]>
 2018-12-07 10:17:56 +01:00
Thomas Egerer 32c190634c custom-logger: Add optional reload method 
The reload of the configuration of the loggers so far only included
the log levels. In order to support the reload of all other options,
a reload function may be implemented.

Signed-off-by: Thomas Egerer <[email protected]>
 2018-08-29 15:55:33 +02:00
Tobias Brunner 1b67166921 Unify format of HSR copyright statements 2018-05-23 16:32:53 +02:00
Tobias Brunner 3a3136ef33 bus: Don't trigger child_updown for deleted CHILD_SAs 
These were rekeyed but have not been destroyed yet.
 2018-04-09 17:13:41 +02:00
Tobias Brunner f9fbcbb1a0 bus: Don't trigger child_updown() for rekeyed CHILD_SAs 
We don't trigger it either when they are deleted individually.
 2017-08-07 10:44:05 +02:00
Tobias Brunner 2e4d110d1e linked-list: Change return value of find_first() and signature of its callback 
This avoids the unportable five pointer hack.
 2017-05-26 13:56:44 +02:00
Tobias Brunner 8a2e4d4a8b linked-list: Change interface of callback for invoke_function() 
This avoids the unportable five pointer hack.
 2017-05-26 13:56:44 +02:00
Tobias Brunner ee5da1633a bus: Re-add ampersand that got lost in refactoring 
Fixes: 4af02c6c61 ("bus: Fix maximum log level for different groups
after removal of a logger")
 2016-11-14 15:15:11 +01:00
Tobias Brunner 4af02c6c61 bus: Fix maximum log level for different groups after removal of a logger 
The log level was incorrectly set to the same value for all groups.

Fixes: dac15e03c8 ("bus: Fix maximum log levels when mixing log/vlog
implementing loggers")
 2016-11-11 15:33:44 +01:00
Tobias Brunner f5fe0ffa2a bus: Add new hooks for derived IKE_SA and CHILD_SA keys 2016-10-04 10:01:49 +02:00
Tobias Brunner dac15e03c8 bus: Fix maximum log levels when mixing log/vlog implementing loggers 
The maximum would not get set correctly when a logger is removed and the
first remaining logger in the list (the one with the highest log level) does
e.g. only implement vlog() while there are other loggers that implement log().
This would result in only max_vlevel getting set correctly while max_level
would incorrectly get set to -1 so that log() would not get called for any
of the loggers anymore.

References #574.
 2016-09-30 18:34:04 +02:00
Tobias Brunner bd71ba0ffb task-manager: Add retransmit cleared alert 2016-06-06 14:11:01 +02:00
Thomas Egerer 9da65eaeb9 task-manager: Add retransmit count to retransmit send alert 
Signed-off-by: Thomas Egerer <[email protected]>
 2016-06-06 14:11:01 +02:00
Andreas Steffen b12c53ce77 Use standard unsigned integer types 2016-03-24 18:52:48 +01:00
Thomas Egerer 2080c7e1e2 charon: Add custom logger to daemon 
This logger can be used to easily register custom logging instances
using __attribute__((constructor)) benefiting from the global reload
mechanism (with reset of log levels).

Note that this is not intended to be used from plugins, which are loaded
after loggers have already been initialized.

Signed-off-by: Thomas Egerer <[email protected]>
 2016-03-01 11:48:52 +01:00
Tobias Brunner 548b993488 file-logger: Add option to print milliseconds within the current second after timestamp 
For this to look right time_format should end with %S or %T.

Closes strongswan/strongswan#18.
 2015-11-09 16:30:00 +01:00
Tobias Brunner 072d9dc3c6 bus: Add new hook called when IKEv1 CHILD_SAs are migrated to a new IKE_SA 
The interface is currently not very nice, but if we ever were able to
safely checkout multiple SAs concurrently we could add something similar
to ike_rekey() and call that when we detect a reauthentication.
 2015-05-21 15:38:31 +02:00
Adrian-Ken Rueegsegger 8262be3cdc Add bool param to ALERT_KEEP_ON_CHILD_SA_FAILURE alert 
The parameter indicates if the alert is raised upon failure to establish
the first CHILD SA of an IKE SA.
 2015-05-04 18:07:29 +02:00
Martin Willi e1fe2781b0 bus: Add an ike_update() hook invoked when peer endpoints change 2015-02-20 15:33:59 +01:00
Tobias Brunner 127a98dc90 ikev1: Move fragment generation to message_t 2014-10-10 09:30:26 +02:00
Tobias Brunner 614359a7d5 bus: Add ike_reestablish_pre hook, called before DNS resolution 
The old hook is renamed to ike_reestablish_post and is now also called
when the initiation of the new IKE_SA failed.
 2014-07-22 11:10:36 +02:00
Martin Willi 8b855a97c2 bus: Properly va_copy() argument list before passing it to printf() functions 
As we later potentially use args again, we can't consume it with printf
functions without copying it first. Clone list before passing it to any
consuming function.

Fixes #621.
 2014-06-19 10:10:54 +02:00
Martin Willi eef7427b0f bus: Add a handle_vips() hook invoked after handling configuration attributes 
Similar to assign_vips() used by a peer assigning virtual IPs to the other peer,
the handle_vips() hook gets invoked on a peers after receiving attributes. On
release of the same attributes the hook gets invoked again.

This is useful to inspect handled attributes, as the ike_updown() hook is
invoked after authentication, when attributes have not been handled yet.
 2014-06-17 15:14:51 +02:00
Martin Willi 7fc98a840b ikev1: Invoke the assign_vips() bus hook for IKEv1 as well 2014-06-16 15:59:17 +02:00
Martin Willi 55c2b47a90 file-logger: Emulate setlinebuf() if not supported by using fflush() 2014-06-04 15:53:09 +02:00
Martin Willi b9dca7057c filelog: Ignore flush_line option if setlinebuf() not supported 2014-06-04 15:53:04 +02:00
Tobias Brunner 73c33ff423 bus: Add a fast-path if log messages don't have to be logged 
For some rwlock_t implementations acquiring the read lock could be quite
expensive even if there are no writers (e.g. because the implementation
requires acquiring a mutex to check for writers) particularly if the
lock is highly contended, like it is for the vlog() method.
 2014-04-24 17:54:15 +02:00
Tobias Brunner 0ceb288815 Fix various API doc issues and typos 
Partially based on an old patch by Adrian-Ken Rueegsegger.
 2013-07-18 18:30:36 +02:00
Martin Willi 58750670cf bus: raise certificate validation alerts using credential manager hook 2013-07-18 16:00:30 +02:00
Martin Willi 61177388bd syslog: setlogmask() to include LOG_INFO 
LOG_INFO seems to be excluded by default on some systems (OS X).
 2013-07-18 12:17:54 +02:00
Martin Willi a485320393 Raise an alert if the responding peer narrowed traffic selectors 2013-06-19 16:11:46 +02:00
Martin Willi 965348cd7a Raise LOCAL_AUTH_FAILED alert after receiving AUTHENTICATION_FAILURE 2013-05-15 17:18:03 +02:00
Martin Willi 5f55fd6e61 Introduce an optional logger_t.vlog() method with format string and arguments 
To have more flexibility in the logging backend, receiving the original format
string and do printf() substitution in the logger may be preferable. An
additional but optional logger method does not touch the behavior of existing
loggers.
 2013-05-06 15:00:15 +02:00
Andreas Steffen 12fa1784d0 emit a single assig_vips bus message for all VIPs 2013-04-06 14:16:30 +02:00
Andreas Steffen ba2880d569 ifmap plugin subscribes to assing_vip bus signal 2013-04-06 11:09:41 +02:00
Martin Willi 335982169a When IKEv1 DPD times out, raise missing SEND_RETRANSMIT_TIMOUT alert 2013-03-14 14:20:54 +01:00
Martin Willi c45cf9048e Raise an alert if an IKE_SA could not have been reauthenticated and expires 2013-03-14 14:20:54 +01:00
Tobias Brunner ef33a4ab82 Fixed some typos, courtesy of codespell 2012-12-20 09:35:26 +01:00
Adrian-Ken Rueegsegger ba8b28b67f Raise an alert if IKE SA is kept 
This alert is raised when the establishment of a child SA fails but the
IKE SA is kept.
 2012-12-20 09:15:07 +01:00
Martin Willi 578f72ceb0 Raise an alert if half-open timeout limit reached 2012-12-19 10:40:33 +01:00
Martin Willi c57fe7ac6f Raise an alert if an authorize() hook fails 2012-12-19 10:40:33 +01:00
Martin Willi 45d6134218 Raise an alert if allocating virtual IPs fails 2012-12-19 10:40:33 +01:00
Martin Willi f285b9efc8 Raise an alert if kernel policy installation fails 2012-12-19 10:40:33 +01:00
Martin Willi bcf3147e0a Raise an alert if kernel SA installation fails 2012-12-19 10:40:33 +01:00
Martin Willi 24f30ec92f Raise an alert on traffic selector mismatch 2012-12-19 10:40:32 +01:00