denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
15,803 Commits 1 Branch 0 Tags
44107cb7b75551e02afd56061534495c10b94de3
Commit Graph
15803 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Tobias Brunner d648d61375 ike-init: Fix compiler warning 2015-05-05 10:55:13 +02:00
Martin Willi 54d0d20bda swanctl: Fix --uri option 
As we now pass the vici connection to the command dispatcher callback, we can't
parse the --uri option to create the connection from the same callback. Instead
pre-process the common command options in a separate loop, and ignore the same
options while processing the actual command.
 2015-05-05 10:46:48 +02:00
Tobias Brunner 5a201e6bd0 Merge branch 'tkm-fixes' 
This fixes several issues with charon-tkm (e.g. nonce context ID leaks during
rekey collisions).
 2015-05-04 18:29:01 +02:00
Adrian-Ken Rueegsegger 38b65d7186 charon-tkm: Also store local SPI in SAD 2015-05-04 18:07:52 +02:00
Reto Buerki 0b308faf6d ike-init: Make nonceg a member of ike_init struct 
This allows to control the life-cycle of a nonce in the context of the
ike init task. In the TKM use-case the nonce generator cannot be
destroyed before the ike init task is finalized, otherwise the created
nonce is detected as stale.
 2015-05-04 18:07:51 +02:00
Reto Buerki 72376234cb child-create: Make nonceg a member of child_create struct 
This allows to control the life-cycle of a nonce in the context of the
child create task. In the TKM use-case, it is required to reset the
nonce context if the created nonce is not consumed. This happens if the
child SA negotiation fails and it is detected before the SA is
established via the TKM kernel plugin (i.e. rekey collision).
 2015-05-04 18:07:51 +02:00
Reto Buerki 8cdc563258 charon-tkm: Reset stale nonce contexts 
If the nonce generator detects a stale nonce upon destroy(), it resets
the context in the TKM and releases associated resources in the ID
manager and chunk map.

Also, do not acquire the nonce context ID in tkm_nonceg_create function
but rather when the nonce is actually created by get_nonce().

The nonces created with get_nonce must also be registered in the chunk map.
 2015-05-04 18:07:51 +02:00
Reto Buerki a8ca50e635 charon-tkm: Drop unneeded nonceg get_id function 2015-05-04 18:07:51 +02:00
Adrian-Ken Rueegsegger 5460098cce charon-tkm: Remove ESA nonce mappings from chunk map 2015-05-04 18:07:51 +02:00
Reto Buerki a0cf92a650 charon-tkm: Drop obsolete TKM_LIMIT define 2015-05-04 18:07:51 +02:00
Adrian-Ken Rueegsegger 2783bd17a4 charon-tkm: Select other ESA if any is present upon deletion 
In the case that multiple ESAs exist (e.g. rekey collision) for a
security policy, make sure to select one of the remaining ESAs.
 2015-05-04 18:07:51 +02:00
Adrian-Ken Rueegsegger c7ce0d96cd charon-tkm: Add get_other_esa_id function to TKM kernel SAD 
The function gets the ESA id for another entry associated with the same
security policy as the specified ESA.
 2015-05-04 18:07:50 +02:00
Adrian-Ken Rueegsegger ded14df603 charon-tkm: Only skip creation of first child SA 
Use the new is_first boolean parameter of the
ALERT_KEEP_ON_CHILD_SA_FAILURE alert to determine if the failure was
caused by the first CHILD SA.
 2015-05-04 18:07:50 +02:00
Adrian-Ken Rueegsegger 8262be3cdc Add bool param to ALERT_KEEP_ON_CHILD_SA_FAILURE alert 
The parameter indicates if the alert is raised upon failure to establish
the first CHILD SA of an IKE SA.
 2015-05-04 18:07:29 +02:00
Adrian-Ken Rueegsegger 9ae6b507b9 charon-tkm: Fix SAD insertion when adding ESA 
Commit f5fc592 added the reqid to the SAD. The insert call swapped the
order of the esa_id and reqid parameters.
 2015-05-04 17:23:51 +02:00
Timo Teräs 17d3435693 vici: Default to certificate subject for identity 
If id is not specified and certificate authentication is used, use the
certificate subject name as identity. Simplifies configuration as in most cases
this is the right thing to do.

Signed-off-by: Timo Teräs <timo.teras@iki.fi>
 2015-05-04 13:42:51 +02:00
Timo Teräs acbdf8c806 swanctl: Implement monitoring of IKE_SA and CHILD_SA changes 
Signed-off-by: Timo Teräs <timo.teras@iki.fi>
 2015-05-04 13:39:08 +02:00
Timo Teräs a7e4a2d6c2 vici: Add support for ike_sa and child_sa updown notifications 
Useful for monitoring and management purposes.

Signed-off-by: Timo Teräs <timo.teras@iki.fi>
 2015-05-04 13:38:39 +02:00
Timo Teräs 8d96f90a79 vici: Add function to test if an event should be generated 
Useful to avoid generating vici messages if they are not needed and their
generation is heavy operation.

Signed-off-by: Timo Teräs <timo.teras@iki.fi>
 2015-05-04 13:35:18 +02:00
Romain Francoise ea79cd6ade swanctl: Add missing unit in install-time log 2015-05-04 13:25:30 +02:00
Romain Francoise f5db98c038 init: Don't build/install legacy systemd service if charon isn't built 
If the user configures the build to only include charon-systemd the
"legacy" systemd service isn't useful, so skip its generation and
installation.
 2015-05-04 13:25:30 +02:00
Martin Willi b821575093 crypt-burn: free() associated data after test 2015-05-04 13:24:33 +02:00
Andreas Steffen 362e87e3e0 testing: Updated carol's certificate from research CA and dave's certificate from sales CA 2015-04-26 16:52:06 +02:00
Andreas Steffen d04e47a9eb testing: Wait for DH crypto tests to complete 2015-04-26 11:51:49 +02:00
Andreas Steffen 79b5a33c11 imv_policy_manager: Added capability to execute an allow or block shell command string 2015-04-26 10:55:24 +02:00
Andreas Steffen ce354443bf testing: Migration of KVM framework to Linux 4.x kernel 2015-04-25 18:05:00 +02:00
Andreas Steffen 17a2e00a31 Version bump to 5.3.1dr1 2015-04-24 11:35:42 +02:00
Andreas Steffen c1c6506391 Fixed PB-TNC directionality debug message 2015-04-24 11:16:16 +02:00
Tobias Brunner c5a41c9162 ike-vendor: Add some Microsoft vendor IDs 2015-04-21 15:30:51 +02:00
Tobias Brunner 1f3dbb1b67 apidoc: Fix rebuild in out-of-tree builds 2015-04-20 17:40:52 +02:00
Tobias Brunner e4d2c9f187 leak-detective: Use passed callback to report leaks 
This prevented `stroke memusage` from reporting the leaks on the
console.  Instead, they were sent to the callbacks set up by libstrongswan.

Fixes a426851f63 ("leak-detective: Use callback functions to report
leaks and usage information").
 2015-04-20 11:22:55 +02:00
Tobias Brunner f9342fac8f openssl: Don't refer to EVP_des_ecb() if OpenSSL is built without DES support 
While DES-ECB is not registered by the plugin in this case (so the
function will never actually be called), the compiler still warns
about the implicitly declared function.
 2015-04-17 17:43:58 +02:00
Martin Willi bef227c580 apidoc: Fix make target dependency find precedence 2015-04-16 17:10:42 +02:00
Martin Willi d49330a9a8 Merge branch 'utils-split' 
Split up the almighty utils.[ch] to separate files in the utils/utils subfolder.
These are not meant to include manually, but bring back some order to all
this functionality included through utils.h.

Additionally give some love to apidoc generation.
 2015-04-16 16:50:27 +02:00
Martin Willi 882c993b89 apidoc: Conditionally run doxygen if any header/Markdown files have changed 2015-04-16 15:28:37 +02:00
Martin Willi 377f13f794 apidoc: Set QUIET to YES, suppressing any parsing/generating status output 
As WARNING messages still get printed, this makes spotting any warnings much
simpler.
 2015-04-16 15:28:28 +02:00
Martin Willi 4eabc35b97 apidoc: Enable documentation of static functions 
As we scan for header files only, this does not affect any local functions,
but documents any static inlines we define in header files.
 2015-04-16 15:28:25 +02:00
Martin Willi b3811cfd52 strerror: Move to its own Doxygen subgroup 2015-04-16 14:50:41 +02:00
Martin Willi 80e05dc8fd utils: Clean up includes 2015-04-16 14:50:41 +02:00
Martin Willi 04f12ecd29 align: Move min/max/padding/alignment functions to separate files 2015-04-16 14:50:40 +02:00
Martin Willi eaa02bc925 time: Move time related functions to separate files 2015-04-16 14:50:24 +02:00
Martin Willi 1f2326ce58 object: Move OO programming helper macros to a separate header file 2015-04-16 14:50:05 +02:00
Martin Willi 1e02eddb72 status: Move status_t type and functions to separate files 2015-04-16 14:50:05 +02:00
Martin Willi 001a22e2c1 path: Move path related utility functions to separate files 2015-04-16 14:50:04 +02:00
Martin Willi 7585a85f1a tty: Move tty related functions to separate files 2015-04-16 14:50:04 +02:00
Martin Willi 7802ab88a1 memory: Move memory manipulation related functions to separate files 2015-04-16 14:50:02 +02:00
Martin Willi bbfe7a80b1 string: Move string related utility functions to separate files 2015-04-16 14:49:19 +02:00
Martin Willi 03cf888277 byteorder: Move byte order related functions to separate header file 2015-04-16 14:49:19 +02:00
Martin Willi 95726f7617 types: Use generic type definitions to separate header file 2015-04-16 14:49:19 +02:00
Martin Willi 717313c542 atomics: Move atomics/recounting support to separate files 2015-04-16 14:49:19 +02:00