denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
12,784 Commits 1 Branch 0 Tags
e163427d9f16077ca3dcee81686047091be77722
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Martin Willi e163427d9f auth-cfg: Cast literal default value to pointer type 
Fixes a clang warning.
 2014-05-16 15:42:07 +02:00
Martin Willi 0746e38c51 unbound: Explicitly cast from ldns RR type/class to our types 
These definitions are directly derived from the RFC, so it should be safe
to cast them. clang complains about the different types, so cast them
explicitly.
 2014-05-16 15:42:06 +02:00
Martin Willi fb515325cc x509: Remove some unused ASN1 OID constants 2014-05-16 15:42:06 +02:00
Martin Willi d3cf9ca322 aes: Remove unused build variants 
The AES code historically has different build options for various size/speed
trade-offs. We never made use of them, so just drop the obsolete code. The code
now has four hard-coded fixed tables, both inverse and original.
 2014-05-16 15:42:06 +02:00
Martin Willi e20e0a0586 swanctl: Increase default debug level to 1 
We initially intended to silence debugging only during thread initialization,
not for swanctl in general.
 2014-05-14 16:28:01 +02:00
Martin Willi 80b56fb468 vici: Support the close_action keyword, as we have it documented 2014-05-14 16:26:53 +02:00
Martin Willi cdc42256b0 ikev1: Fix debugging log when remote traffic selector selection fails 2014-05-14 10:01:57 +02:00
Martin Willi b1b01840b6 child-sa: Reclaim old state if SA updating is not supported 
If the state stays at UPDATING, the fallback using IKEv1 rekeying fails as
the task manager refuses to rekey a CHILD_SA in non-INSTALLED state.
 2014-05-09 08:49:08 +02:00
Martin Willi b30c09eaff NEWS: Add swanctl news 2014-05-08 09:35:59 +02:00
Martin Willi 2df905474a Merge branch 'swanctl' 
Adds a swanctl command line tool to manage the IKE daemon charon using the
VICI interface provided by the vici plugin.
 2014-05-07 16:05:39 +02:00
Martin Willi b1076bc8fd swanctl: By default print local swanctl version with --version 
But add a --daemon option to query the IKE daemon for its version.
 2014-05-07 15:48:17 +02:00
Martin Willi 92884b4683 swanctl: Install empty credential folders with appropriate permissions 2014-05-07 15:48:17 +02:00
Martin Willi 2230f18358 swanctl: Document most swanctl.conf options in manpage 2014-05-07 15:48:17 +02:00
Martin Willi d909e51918 swanctl: Keep swanctl.conf man/template section order as defined 2014-05-07 15:48:17 +02:00
Martin Willi ae98a39e71 conf: Add a format-options --nosort option to keep order of sections as defined 2014-05-07 15:48:17 +02:00
Martin Willi 85d26e0c87 swanctl: Add a swanctl command overview manpage 2014-05-07 15:48:17 +02:00
Martin Willi 1312eab036 swanctl: Change syntax of secrets to accept identities with special chars 
Having identity strings in the settings key is problematic, as the parser can't
handle arbitrary characters in it. Further, the space separation makes it
impossible to define identities with spaces.

The new format uses key prefixes, similar to those used in local/remote auth
sections of connections. The secrets section takes subsections with type
prefixes, and each subsection uses "id" prefixes to define an arbitrary
number of identities.
 2014-05-07 15:48:16 +02:00
Martin Willi a2875525ae swanctl: List local and remote addresses in list-conns 2014-05-07 15:48:16 +02:00
Martin Willi 43306afe8e swanctl: Add a list-pools command to summarize pool status 2014-05-07 15:48:15 +02:00
Martin Willi a77acc183a swanctl: Add a load-pools command to (re-)load pool configurations from file 2014-05-07 15:48:15 +02:00
Martin Willi 4ee33b44df swanctl: Encode connection "pools" as list items 2014-05-07 15:48:15 +02:00
Martin Willi 250c6e3d90 swanctl: Fix enumeration of registered commands if MAX_COMMANDS is hit 2014-05-07 15:48:15 +02:00
Martin Willi 7b35c02db4 swanctl: Implement a --log command to trace debugging log 2014-05-07 15:48:15 +02:00
Martin Willi 3b22e8e995 swanctl: Add a swanctl.conf template file 2014-05-07 15:48:15 +02:00
Martin Willi 2d5c3a0f0f swanctl: Implement a --list-certs command to print or export daemon certificates 2014-05-07 15:48:15 +02:00
Martin Willi ebe78940aa swanctl: Be more verbose while loading connections and credentials 2014-05-07 15:48:15 +02:00
Martin Willi 51bdc1f3f1 swanctl: Add a list-conns command to query loaded connections 2014-05-07 15:48:14 +02:00
Martin Willi da866234bb swanctl: Register --version as last command 2014-05-07 15:48:14 +02:00
Martin Willi c1e413db49 swanctl: Support groups, certs and cacerts keywords 2014-05-07 15:48:14 +02:00
Martin Willi 818acc8638 swanctl: Load shared secrets from the swanctl.conf secrets section 2014-05-07 15:48:14 +02:00
Martin Willi d622e6da0f swanctl: Load different private keys with load-creds 2014-05-07 15:48:14 +02:00
Martin Willi 2c1511dbf8 swanctl: Add a command to (re-)load credentials 2014-05-07 15:48:14 +02:00
Martin Willi 7c8a907895 swanctl: Use a ./configure-able swanctl base directory 2014-05-07 15:48:14 +02:00
Martin Willi 991c9b5e77 swanctl: After loading connections, unload those that are not in config anymore 2014-05-07 15:48:14 +02:00
Martin Willi ee599d14ad swanctl: Implement a load-conn command to load connections from a file 2014-05-07 15:48:13 +02:00
Martin Willi 283b0b9e92 swanctl: Implement a list-pols command to query trap/shunt policies 2014-05-07 15:48:13 +02:00
Martin Willi 90ae636ccb swanctl: Implement install/uninstall commands to manage shunt/trap policies 2014-05-07 15:48:13 +02:00
Martin Willi 073be3cad4 swanctl: Add a version command to query daemon and OS info 2014-05-07 15:48:13 +02:00
Martin Willi 3dc377b37f swanctl: Add a terminate command 2014-05-07 15:48:13 +02:00
Martin Willi cb1c409b84 swanctl: Add a subcommand to initiate connections by name 2014-05-07 15:48:13 +02:00
Martin Willi 86910faeca swanctl: Add a list-sas command to query active IKE_SAs 2014-05-07 15:48:13 +02:00
Martin Willi e381e69f9b swanctl: Add a stub for a vici based configuration and control utility 2014-05-07 15:48:10 +02:00
Martin Willi 4c56c4621b libcharon: Execute scripts defined in strongswan.conf during startup/shutdown 2014-05-07 15:47:23 +02:00
Martin Willi 954c63a4bc Merge branch 'vici' 
Introduces the vici plugin providing a Versatile IKE Configuration Interface
to configure, monitor and control the IKE daemon charon over a stable IPC
socket interface.
 2014-05-07 15:12:09 +02:00
Martin Willi 4787523cc3 NEWS: Add vici plugin news 2014-05-07 14:13:39 +02:00
Martin Willi 1e4ee168c8 vici: Check if header has been received before processing an empty message 
If do_read() returns with EWOULDBLOCK, we must ensure that we actually have
processed the full length header before checking the zero-initialized buffer
length.
 2014-05-07 14:13:39 +02:00
Martin Willi afb7ef4908 vici: Properly filter by CHILD_SA name while undoing start actions 2014-05-07 14:13:39 +02:00
Martin Willi 682c9966fa vici: Fallback to socket listening port if no explicit local port specified 2014-05-07 14:13:39 +02:00
Martin Willi dffd60083d vici: Support a "mtu" value for the tfc_padding option 2014-05-07 14:13:39 +02:00
Martin Willi 5619d40613 vici: Handle the "trap" action as an alias for "route" 2014-05-07 14:13:39 +02:00
Martin Willi e0a34ee459 vici: Document errno values to expect from libvici API 2014-05-07 14:13:39 +02:00
Martin Willi c2b6402eb0 vici: Log owners of a just loaded shared-secret 2014-05-07 14:13:39 +02:00
Martin Willi 41745e24f3 vici: Handle "xauth" as an alias for "eap" secrets 2014-05-07 14:13:38 +02:00
Martin Willi bc006ac1f4 vici: Return number of matching and closed SAs in terminate command 2014-05-07 14:13:38 +02:00
Martin Willi 021a14b7a4 vici: Complete libvici doxygen comments 2014-05-07 14:13:38 +02:00
Martin Willi 374511c52c vici: Ensure we have no active users before mangling event client registrations 2014-05-07 14:13:38 +02:00
Martin Willi 65cc8f5581 vici: Properly skip raise_event() for unknown event names 2014-05-07 14:13:38 +02:00
Martin Willi 3a9a46c20f vici: Increase vici message length header from 16 to 32 bits 
While we currently have no need for messages larger than 65KB, we should design
the protocol to be future-proof, as we plan to keep at least to lowest protocol
layer stable.

To avoid any allocation issues, we currently keep the message size limit at
512KB.
 2014-05-07 14:13:38 +02:00
Martin Willi 7dbf9e1574 vici: Document strongswan.conf options 2014-05-07 14:13:38 +02:00
Martin Willi f3e1ec4a85 vici: Have an explicit "relaxed" keyword for the default revocation policy 2014-05-07 14:13:38 +02:00
Martin Willi 585814470d vici: Use a default child rekey time of 1 hour 2014-05-07 14:13:38 +02:00
Martin Willi 046befeca5 vici: Use a default IKE rekey time of 4 hours 2014-05-07 14:13:38 +02:00
Martin Willi ff3217db4b vici: Add low-level IPC protocol description 2014-05-07 14:13:38 +02:00
Martin Willi c193732162 vici: Fix descending into non-matching sections during key find 2014-05-07 14:13:38 +02:00
Martin Willi eacf864c21 vici: Add an IKE virtual IP and attribute backend 2014-05-07 14:13:38 +02:00
Martin Willi afb8f492ef vici: Support referencing external named pools for peer configs 2014-05-07 14:13:37 +02:00
Martin Willi 3ad9c34c92 vici: Actually add configured virtual IPs to peer config 2014-05-07 14:13:37 +02:00
Martin Willi e651afe67b vici: Use a default rand_time of the difference between hard and soft lifetimes 2014-05-07 14:13:37 +02:00
Martin Willi c520510508 vici: Use a default hard lifetime of 110% of the soft lifetime 2014-05-07 14:13:37 +02:00
Martin Willi 93d60c479a vici: Make unit-tests independent from libcharon and libhydra 
Fixes monolithic build, as we can't depend on the not yet built libcharon.
 2014-05-07 14:13:37 +02:00
Martin Willi 0963a9952c vici: Don't compare unsigned certificate_type_t to -1 2014-05-07 14:13:37 +02:00
Martin Willi e00ce378fa vici: Use non-blocking first read when receiving message during client on_read() 
As select() and finally the watcher may signal an FD even if it does not
actually have data, we must make a non-block read to avoid hanging in the
read callback.
 2014-05-07 14:13:37 +02:00
Martin Willi 7de35b7ff6 vici: Perform specified start_action on connection load, undo it on unload 2014-05-07 14:13:37 +02:00
Martin Willi 96071fdb55 vici: Add a generic log event to raise events for log messages 2014-05-07 14:13:37 +02:00
Martin Willi 2676ffdb9f vici: Be less verbose about client connections 
Instead, log the explicit commands at a higher level.
 2014-05-07 14:13:37 +02:00
Martin Willi 101dba01ce vici: Add a list-certs command to query different certificate types 2014-05-07 14:13:37 +02:00
Martin Willi b57739f721 vici: Support pinning end entity and CA certificates to connections 2014-05-07 14:13:37 +02:00
Martin Willi e6e975ff9d vici: Support missing groups option in auth config 2014-05-07 14:13:37 +02:00
Martin Willi 6efa792d22 vici: Add a load-shared command to load shared IKE and EAP secrets 2014-05-07 14:13:37 +02:00
Martin Willi 559ef7de48 vici: Add a load-key command to load private keys 2014-05-07 14:13:36 +02:00
Martin Willi c12edb2a27 vici: Support loading of different certificate types 2014-05-07 14:13:36 +02:00
Martin Willi de190f62c2 vici: Add a credential backend 2014-05-07 14:13:36 +02:00
Martin Willi e1b65630b2 vici: Add a command listing all or specific loaded connections using events 2014-05-07 14:13:36 +02:00
Martin Willi 501ddf127b vici: Add unload-conn and get-conns commands to manage loaded connections 2014-05-07 14:13:36 +02:00
Martin Willi 37aa250cad vici: Make dispatcher a little more verbose 2014-05-07 14:13:36 +02:00
Martin Willi b3d8bd8d26 vici: Add backend providing in-memory connections 2014-05-07 14:13:36 +02:00
Martin Willi dd5ce0a97a vici: Add generic callback based vici message parsing 2014-05-07 14:13:36 +02:00
Martin Willi 1f2e63ea41 vici: Add a list-policy command to query trap and shunt policies 2014-05-07 14:13:36 +02:00
Martin Willi 5c6e81dcf8 vici: Add install/uninstall commands to manage trap and shunt policies 2014-05-07 14:13:36 +02:00
Martin Willi 550f3f5646 vici: Extract CHILD_SA config lookup method 2014-05-07 14:13:36 +02:00
Martin Willi e567675d29 vici: Refactor socket to clean up locking 
Uses separate locks for socket read and write operations. While holding the
socket reader lock, a different thread can still claim the socket write lock.
This allows to asynchronously send event messages while holding the read
lock.
 2014-05-07 14:13:36 +02:00
Martin Willi 9bfa397eba vici: Fix dispatcher leak when handling unknown request 2014-05-07 14:13:36 +02:00
Martin Willi e2496bda02 vici: Add a test case raising events during request, checks in-order delivery 2014-05-07 14:13:35 +02:00
Martin Willi 3b5808a0f6 vici: Avoid recursive control log invocations 2014-05-07 14:13:35 +02:00
Martin Willi 993bfe95fb vici: Add a callback based recursive parser function 2014-05-07 14:13:35 +02:00
Martin Willi d9ae1c68e5 vici: Add a version command to print daemon and OS version info 2014-05-07 14:13:35 +02:00
Martin Willi c7d4dad66d vici: Implement a terminate command to close IKE or CHILD_SAs 2014-05-07 14:13:35 +02:00
Martin Willi 5f95657c65 vici: Add a control backend, currently to initiate connections by name 2014-05-07 14:13:35 +02:00
Martin Willi ecc4b51048 vici: Support thread cancellation in command callbacks 2014-05-07 14:13:35 +02:00
Martin Willi 045bdf5283 vici: Move dumping to core message class, use it in libvici 2014-05-07 14:13:35 +02:00