denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
13,512 Commits 1 Branch 0 Tags
472156eea5ce67d9769ed2f3f9ff24e48460d4e9
Commit Graph
13512 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Tobias Brunner 472156eea5 ike: Do remote address updates also when behind static NATs 
We assume that a responder is behind a static NAT (e.g. port forwarding)
and allow remote address updates in such situations.

The problem described in RFC 5996 is only an issue if the NAT mapping
can expire.
 2014-10-13 15:20:17 +02:00
Tobias Brunner f8a565fbcc ike: Remove redundant check for local NAT when handling changed NAT mappings 2014-10-13 15:20:17 +02:00
Andreas Steffen cb5ad2ba3d testing: Lower batch size to demonstrated segmetation of TCG/SWID Tag ID Inventory attribute 2014-10-11 15:01:21 +02:00
Andreas Steffen 8b812065f0 Support of multiple directed segmentation contracts 2014-10-11 14:50:08 +02:00
Andreas Steffen ab99939628 unit-tests: Updated Makefile 2014-10-11 14:50:08 +02:00
Andreas Steffen a05ca71d07 unit-tests: Added test for seg_contract_manager 2014-10-11 14:50:08 +02:00
Andreas Steffen a5e6a479d4 Added KVM config for 3.16 and 3.17 kernels 2014-10-11 14:50:08 +02:00
Andreas Steffen 4af020be37 Updated build-database.sh script to 3.13.0-37 kernel 2014-10-11 11:40:43 +02:00
Tobias Brunner 83efded313 testing: Ensure no guest is running when modifying images 
Sometimes guests are not stopped properly. If images are then modified
they will be corrupted.
 2014-10-10 19:03:50 +02:00
Tobias Brunner b7b2f9379d testing: Enable virtio console for guests 
This allows accessing the guests with `virsh console <name>`.

Using a serial console would also be possible but our kernel configs
have no serial drivers enabled, CONFIG_VIRTIO_CONSOLE is enabled though.
So to avoid having to recompile the kernels let's do it this way, only
requires rebuilding the guest images.

References #729.
 2014-10-10 19:03:28 +02:00
Martin Willi ef90d5ab15 Merge branch 'vici-ruby' 
Adds a ruby gem for the VICI protocol, along with some documentation
improvements and some minor fixes to vici and swanctl.
 2014-10-10 11:43:43 +02:00
Martin Willi 7431ad0de5 NEWS: Introduce the vici ruby gem 2014-10-10 11:42:18 +02:00
Martin Willi 67f9f09dd3 swanctl: Fix exit codes based on errno 
As fprintf() most likely sets errno, we should save it before printing the
error message.
 2014-10-10 11:42:18 +02:00
Martin Willi d4d85135c5 vici: Cancel processor before calling library_deinit() 
For non-direct libstrongswan users, the deinitialization segfaults because
of the missing worker thread cancellation.
 2014-10-10 11:42:18 +02:00
Martin Willi 3db58e837c vici: Reduce debug level during thread spawning 
We want to avoid libvici users to get a cluttered stderr for no real error.
 2014-10-10 11:42:18 +02:00
Martin Willi 046b547a37 vici: Don't include-depend on libstrongswan for boolean types 
As we want to avoid the libstrongswan include dependencies for libvici, avoid
the use of the bool type. Unfortunately this change may break the ABI for
vici_dump(). As this function is mostly for debugging purposes, we do it
nonetheless; my apologies if somebody already relies on the ABI stability of
that function.
 2014-10-10 11:42:18 +02:00
Martin Willi 6f55149335 vici: Document the ruby gem and add some simple examples 2014-10-10 11:42:18 +02:00
Martin Willi dccb2c6eba vici: Add some simple libvici examples to the README 2014-10-10 11:42:18 +02:00
Martin Willi 56f17733c9 vici: Document the available vici command and event messages 2014-10-10 11:42:18 +02:00
Martin Willi f684be6583 vici: Use "gem"-assisted vici ruby gem building and installation 2014-10-10 11:42:17 +02:00
Martin Willi 409f1fc144 configure: Add global --enable-ruby-gems and --with-rubygemdir options 
This provides the options to build and install ruby gems for components
providing them, such as vici.
 2014-10-10 11:42:17 +02:00
Martin Willi 1038d96537 vici: Add a ruby gem providing a native vici interface 2014-10-10 11:42:17 +02:00
Martin Willi 94d9398202 vici: Return a success result for the clear-creds command 
Even if the command actually can't fail, this looks more aligned to similar
commands.
 2014-10-10 11:42:17 +02:00
Martin Willi d39e04b557 vici: Fix message encoding type values in documentation 2014-10-10 11:42:17 +02:00
Volker Rümelin 05db0f97e3 ikev1: Add fragmentation support for Windows peers 
I still think ipsec/l2tp with fragmentation support is a useful
fallback option in case the Windows IKEv2 connection fails because
of fragmentation problems.

Tested with Windows XP, 7 and 8.1.
 2014-10-10 10:54:37 +02:00
Tobias Brunner 3633b80147 eap-radius: Add option to set interval for interim accounting updates 
Any interval returned by the RADIUS server in the Access-Accept message
overrides the configured interval.  But it might be useful if RADIUS is
only used for accounting.
 2014-10-10 09:51:13 +02:00
Tobias Brunner 55758bec3a NEWS: IKEv2 fragmentation mentioned 2014-10-10 09:48:06 +02:00
Tobias Brunner cb9374009f Merge branch 'ikev2-fragmentation' 
This adds support for IKEv2 fragmentation as per RFC 7383.
 2014-10-10 09:35:27 +02:00
Tobias Brunner 1836c1845b testing: Add ikev2/net2net-fragmentation scenario 2014-10-10 09:33:23 +02:00
Tobias Brunner 144b40e07c testing: Update ikev1/net2net-fragmentation scenario 2014-10-10 09:32:42 +02:00
Tobias Brunner 8dbe128c8c message: Limit maximum number of IKEv2 fragments 
The maximum for IKEv1 is already 255 due to the 8-bit fragment number.

With an overhead of 17 bytes (x64) per fragment and a default maximum
of 10000 bytes per packet the maximum memory required is 14 kB
for a fragmented message.
 2014-10-10 09:32:42 +02:00
Tobias Brunner f00a9c1715 packet: Define a global default maximum size for IKE packets 2014-10-10 09:32:42 +02:00
Tobias Brunner 03512c47bf message: Ensure a minimum fragment length 2014-10-10 09:32:41 +02:00
Tobias Brunner f1aa18b2e8 ikev2: Send retransmits using the latest known addresses 
For instance, if a DPD exchange is initiated by the gateway when a
mobile client is roaming and it then gets a new IP address and sends
an address update via MOBIKE, the DPD retransmits would still be sent
to the old address and the SA would eventually get closed.
 2014-10-10 09:32:41 +02:00
Tobias Brunner b678d9e14f ikev2: Send and receive fragmented IKE messages 
If a fragmented message is retransmitted only the first packet is passed
to the alert() hook.
 2014-10-10 09:32:41 +02:00
Tobias Brunner 1446fd8ac9 ike: IKE_SA may fragment IKEv2 messages 2014-10-10 09:32:41 +02:00
Tobias Brunner 7a53fe5511 ike: Do not cache MID of IKEv2 fragments 
This fails if there are unencrypted payloads before an encrypted
fragment payload in the first fragment.
 2014-10-10 09:32:41 +02:00
Tobias Brunner c0f4936a23 message: Fragment and reassemble IKEv2 messages 2014-10-10 09:32:41 +02:00
Tobias Brunner e8ffb256b3 message: Handle encrypted fragment payload similar to the encrypted payload 2014-10-10 09:32:41 +02:00
Tobias Brunner 4c345b15c7 ikev2: Add encrypted fragment payload 2014-10-10 09:32:37 +02:00
Tobias Brunner edfd33455c encrypted_payload: Encrypted payload can be constructed from plaintext 2014-10-10 09:31:17 +02:00
Tobias Brunner 1e0d8f3ec0 encrypted_payload: Expose generate() to generate the plaintext 2014-10-10 09:31:17 +02:00
Tobias Brunner 44996b5866 encrypted_payload: Extract some utility functions 2014-10-10 09:31:17 +02:00
Tobias Brunner 41751a70d9 message: Split generate() in multiple functions 2014-10-10 09:31:16 +02:00
Tobias Brunner 34dc37f3cb ikev2: Negotiate support for IKEv2 fragmentation 2014-10-10 09:31:16 +02:00
Tobias Brunner 7223b642a7 ikev2: Add notify for IKEv2 fragmentation 2014-10-10 09:31:13 +02:00
Tobias Brunner 70e0be072b ikev1: Move defragmentation to message_t 2014-10-10 09:30:26 +02:00
Tobias Brunner 40bab9a176 ike: Move fragmentation to ike_sa_t 
The message() hook on bus_t is now called exactly once before (plain) and
once after fragmenting (!plain), not twice for the complete message and again
for each individual fragment, as was the case in earlier iterations.

For inbound messages the hook is called once for each fragment (!plain)
and twice for the reassembled message.
 2014-10-10 09:30:26 +02:00
Tobias Brunner 2e7a2c06a1 message: fragment() generates message and fragments and caches them 2014-10-10 09:30:26 +02:00
Tobias Brunner e0b35142c1 message: Make packet argument optional in generate() 2014-10-10 09:30:26 +02:00