denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
14,624 Commits 1 Branch 0 Tags
85af8400dfdcdce3ac2a05e53e1a28ad708b7c8a
Commit Graph
14624 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Tobias Brunner 85af8400df android: Fix build after updating Linux headers 
Since we don't use the kernel-netlink plugin anymore and the headers
in the NDK are reasonably recent, we don't need this anymore (at least
when building the app).

Fixes #1172.
 2015-11-12 14:09:25 +01:00
Tobias Brunner 41feeddd48 Merge branch 'tkm-spi-label' 
Adds the charon-tkm.spi_label and charon-tkm.spi_mask options to encode
a specific value/label in otherwise randomly generated IKE SPIs.
 2015-11-11 15:45:50 +01:00
Adrian-Ken Rueegsegger e63589a7dc charon-tkm: Register SPI generator callback 
Set get_spi callback of IKE SA manager to TKM-specific implementation.
 2015-11-11 15:39:49 +01:00
Adrian-Ken Rueegsegger efff791675 charon-tkm: Implement SPI generator 
The get_spi callback returns a random SPI with a label encoded according
to the spi_label and spi_mask parameters read from the strongswan.conf.
 2015-11-11 15:39:49 +01:00
Tobias Brunner 8623ae9fc6 settings: Add settings_value_as_uint64() helper function 2015-11-11 15:39:49 +01:00
Tobias Brunner ee09094899 ike-sa-manager: Allow plugins to provide IKE SPIs via a callback 
Plugins must depend on `libcharon-sa-managers` to ensure the manager
exists.
 2015-11-11 15:39:45 +01:00
Tobias Brunner 301ccbe0a3 libcharon: Publish IKE_SA/CHILD_SA managers as custom plugin feature 2015-11-11 15:39:08 +01:00
Tobias Brunner 7b5dcc9f27 ikev1: Also use message hashes for Quick Mode for the early retransmission check 
We already did so during Phase 1 but because all three Quick Mode
message have the same message ID we occasionally dropped the third
message as retransmit, so we do it there too.  For INFORMATIONAL
and TRANSACTION exchanges we don't expect more than one inbound message
with the same message ID so we still use them there.

Fixes #1198.
 2015-11-11 11:01:56 +01:00
Andreas Steffen 019c7c2310 testing: Check for leases in swanctl/ip-pool scenario 2015-11-11 08:43:43 +01:00
Andreas Steffen 0748517582 Version bump to 5.3.4dr3 2015-11-10 16:54:38 +01:00
Andreas Steffen 946bc3a3f5 testing: Fixed some more timing issues 2015-11-10 16:54:38 +01:00
Tobias Brunner 4aff445202 kernel-netlink: Allow IPsec policies to replace shunt policies 
Shunt policies don't have a reqid set, so we allow unequal reqids in
this particular case (i.e. if one of the reqids is 0).
 2015-11-10 16:42:53 +01:00
Tobias Brunner baff14d049 kernel-pfkey: Make absolutely sure we always delete the right policy cache entry 2015-11-10 16:42:53 +01:00
Tobias Brunner 33400876d4 kernel-netlink: Make absolutely sure we always delete the right policy cache entry 2015-11-10 16:42:53 +01:00
Tobias Brunner a6e0f14fd2 kernel-interface: Pass the same data to del_policy() that was passed to add_policy() 
The additional data can be helpful to identify the exact policy to
delete.
 2015-11-10 16:42:52 +01:00
Tobias Brunner e265839093 kernel-netlink: Remove the unused policy_history flag 
This was used with pluto, which had its own policy tracking.
 2015-11-10 15:42:16 +01:00
Thomas Egerer db61c37690 kernel-interface: Return bool for kernel interface registration 
If the (un)registering of a kernel interface (net or ipsec) fails, the
plugin loader will never know, since the appropriate functions always
returns TRUE.  By making the (un)register functions return a boolean
value, the loader can detect a failure during initializing the kernel
interface and abort charon startup if desired.
 2015-11-10 15:40:14 +01:00
Tobias Brunner e8f2c13f9a trap-manager: Also clean up remote address in error cases 
Fixes #1201.
 2015-11-10 14:00:11 +01:00
Tobias Brunner ebeb8c87c5 traffic-selector: Don't end printf'ed list of traffic selectors with a space 2015-11-10 12:13:06 +01:00
Tobias Brunner c2967484a0 swanctl: Add option to query leases with --get-pools 2015-11-10 10:43:25 +01:00
Tobias Brunner f4641f9e45 vici: Add option to query leases of pools 
We could later perhaps add filter parameters similar to those of the
`ipsec leases` command (pool name/virtual IP).
 2015-11-10 10:43:25 +01:00
Tobias Brunner 304a9a97e8 swanctl: List virtual IPs in --list-sas 2015-11-10 10:43:24 +01:00
Tobias Brunner bdb8b76515 vici: Return local and remote virtual IPs when listing SAs 2015-11-10 10:43:24 +01:00
Tobias Brunner 0ddec0760a socket-dynamic: Refactor setting source address when sending messages 
Basically the same change as the one for the socket-default plugin.
 2015-11-09 16:44:22 +01:00
Tobias Brunner 47e113a639 socket-default: Refactor setting source address when sending messages 
This ensures we don't pass data (via msg_control) defined in a different
scope to sendmsg().  Actually, some compilers (e.g. GCC 5.2.1) might
optimize the memcpy() call away causing the packets not to get sent from
the intended source address.

It also makes the code clearer than with all these ifdefs.

Fixes #1171.
 2015-11-09 16:43:21 +01:00
Tobias Brunner 99747bed8f socket-default: Refactor retrieval of destination address of received packets 
This makes the code a bit clearer than with the interleaved ifdefs.
 2015-11-09 16:42:20 +01:00
Tobias Brunner 9953e76c3d Merge branch 'medsrv-js-css' 
Removes the outdated version of MooTools and actually all
JavaScript code as that stuff can now be done with CSS directly.

Fixes #1190.
 2015-11-09 16:37:02 +01:00
Tobias Brunner b153d07bab medsrv: Replace remaining JavaScript code with CSS 2015-11-09 16:36:48 +01:00
Tobias Brunner 3e48b244d8 medsrv: Replace the JavaScript focus() calls with HTML5's autofocus 2015-11-09 16:36:42 +01:00
Tobias Brunner c9401f9ca3 conftest: Add configuration option to report milliseconds in file logger 2015-11-09 16:31:14 +01:00
Tobias Brunner 548b993488 file-logger: Add option to print milliseconds within the current second after timestamp 
For this to look right time_format should end with %S or %T.

Closes strongswan/strongswan#18.
 2015-11-09 16:30:00 +01:00
Tobias Brunner 8484d2b01d ike-natd: Create fake NAT-D payloads in a more static way 
In some scenarios an IKE_SA might get restarted multiple times (e.g.
due to retransmits and delayed INVALID_KE_PAYLOAD notifies) so that
two IKE_SA_INIT messages might be sent that only differ in the
previously randomly generated NAT_DETECTION_SOURCE_IP payload.
This could cause an authentication failure on the responder if the two
peers don't use the same IKE_SA_INIT message in their InitiatorSignedOctets.

While the payload is generated in a reproducible way it will still change
when the daemon is restarted, which should make detecting the payloads
as fake a bit harder (compared to e.g. just using 0.0.0.0:0 as address).

Fixes #1131.
 2015-11-09 16:25:59 +01:00
Andreas Steffen 2533c857ba testing: Added Debian 7.9 to IMV database 2015-11-09 15:18:39 +01:00
Tobias Brunner 10051b01e9 testing: Reduce runtime of all tests that use SQLite databases by storing them in ramfs 2015-11-09 15:18:39 +01:00
Tobias Brunner 3102da20a7 testing: tnc/tnccs-20-hcd-eap scenario does not use SWID IMV/strongTNC 2015-11-09 15:18:38 +01:00
Tobias Brunner e873cb5a28 testing: Add test config to create and remove a directory for DBs stored in ramfs 2015-11-09 15:18:38 +01:00
Tobias Brunner 10fa70ee5c testing: Improve runtime of TNC tests by storing the SQLite DB in ramfs 
This saves about 50%-70% of the time needed for scenarios that use a DB.
 2015-11-09 15:18:38 +01:00
Tobias Brunner f24ec20ebb testing: Fix test constraints in ikev2/rw-ntru-bliss scenario 
Changed with a88d958933 ("Explicitly mention SHA2 algorithm in BLISS
OIDs and signature schemes").
 2015-11-09 15:18:38 +01:00
Andreas Steffen 529357f09a testing: Use sha3 plugin in ikev2/rw-cert scenario 2015-11-09 15:18:38 +01:00
Tobias Brunner 4ae2919518 mediation: Reschedule initiate mediation job if SA is not yet found 
If the job gets queued for a newly created IKE_SA it might not yet be
checked in when the job is running, reschedule the job in that case.

This should fix the two p2pnat test scenarios, which occasionally
failed because one of the peers did not initiate the connection to
the mediation server.
 2015-11-09 15:18:38 +01:00
Tobias Brunner bcad0f761f testing: Report the actual strongSwan and kernel versions 2015-11-09 15:18:37 +01:00
Tobias Brunner 5a919312b3 testing: Record strongSwan version when building from tarball 2015-11-09 15:18:37 +01:00
Tobias Brunner aee35392d1 testing: Record strongSwan version when building from source tree 2015-11-09 15:18:37 +01:00
Tobias Brunner d4908c06c1 testing: Report time required for all scenarios on test overview page 2015-11-09 15:18:37 +01:00
Tobias Brunner 0ea16f6b15 ike-sa-manager: Signal entries that we don't actually check out 
In some cases we call wait_for_entry() but don't actually check out the
entry afterwards (e.g. because it doesn't match certain criteria).  So
there won't be a call to checkin() for such entries causing waiting
threads to get signaled.  Instead, such threads would be blocked until
another thread properly checks out/in the entry (or does a blocking
enumeration).
 2015-11-09 15:18:37 +01:00
Tobias Brunner 1d528cfb8d ike-sa-manager: Signal waiting threads after check out/in for uniqueness check 
Fixes 758b1caa0e ("ikev1: Prevent deadlock when checking for duplicate IKEv1 SAs")
 2015-11-09 15:18:37 +01:00
Tobias Brunner f7234e5e9f testing: Remove old SWID tags when building from repository 
This fixes the TNC-PDP scenarios.
 2015-11-09 15:18:36 +01:00
Tobias Brunner e22a663129 testing: Don't log anything to the console if auth.log or daemon.log do not exist 2015-11-09 15:18:36 +01:00
Tobias Brunner 12f08e07e1 testing: Simplify fetching of swanctl --list-* output 2015-11-09 15:18:36 +01:00
Tobias Brunner bde9fb6fa1 testing: Don't run redundant crypto tests in sql/rw-cert scenario 
They run in all other rw-cert scenarios but in the SQL version there is
no change in the loaded crypto plugins.
 2015-11-09 15:18:36 +01:00