denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
16,151 Commits 1 Branch 0 Tags
de280c2e031730dc3c2ddcc291b1db5ee61a97d9
Commit Graph
74 Commits
Author SHA1 Message Date
Tobias Brunner 15e745cf4d child-rekey: Don't install outbound SA in case of lost collisions 
This splits the SA installation also on the initiator, so we can avoid
installing the outbound SA if we lost a rekey collision, which might
have caused traffic loss depending on the timing of the DELETEs that are
sent in both directions.
 2017-08-07 10:46:00 +02:00
Tobias Brunner 2c116ef589 child-sa: Use flags to track installation of outbound SA and policies separately 2017-08-07 10:44:05 +02:00
Tobias Brunner 67ad553a2c unit-tests: Stringify direction in message asserts early 
x86_64-w64-mingw32-gcc on Windows requires this.
 2017-07-28 11:18:59 +02:00
Tobias Brunner 525cc46cab Change interface for enumerator_create_filter() callback 
This avoids the unportable 5 pointer hack, but requires enumerating in
the callback.
 2017-05-26 13:56:44 +02:00
Tobias Brunner 10c7a66806 unit-tests: Check installed IPsec SAs in child-rekey tests 2017-05-23 18:46:50 +02:00
Tobias Brunner 72655fe411 unit-tests: Add assert to check for installed IPsec SAs 2017-05-23 18:46:50 +02:00
Tobias Brunner 2b581b59f0 unit-tests: Migrate cached IPsec SAs to new IKE_SAs during rekeying 2017-05-23 18:46:49 +02:00
Tobias Brunner d80055baae unit-tests: Keep track of installed IPsec SAs in mock kernel_ipsec_t implementation 2017-05-23 18:46:49 +02:00
Tobias Brunner 44107cb7b7 child-delete: Delay the removal of the inbound SA of rekeyed CHILD_SAs 
After deleting a rekeyed CHILD_SA we uninstall the outbound SA but don't
destroy the CHILD_SA (and the inbound SA) immediately.  We delay it
a few seconds or until the SA expires to allow delayed packets to get
processed. The CHILD_SA remains in state CHILD_DELETING until it finally
gets destroyed.
 2017-05-23 18:46:49 +02:00
Tobias Brunner 0cbf75eb94 child-sa: Remove state to track installation of half the SA again 2017-05-23 18:46:49 +02:00
Tobias Brunner d94c122439 unit-tests: Overload helper macro to check for outbound SA state 2017-05-23 18:46:49 +02:00
Tobias Brunner dc3710e987 ikev2: Delay installation of outbound SAs during rekeying on the responder 
The responder has all the information needed to install both SAs before
the initiator does.  So if the responder immediately installs the outbound
SA it might send packets using the new SA which the initiator is not yet
able to process.  This can be avoided by delaying the installation of the
outbound SA until the replaced SA is deleted.
 2017-05-23 18:46:06 +02:00
Tobias Brunner 2f6ec15dff unit-tests: Add test cases for MID sync exchanges 2017-02-08 15:11:00 +01:00
Tobias Brunner 22f13dcecd proposal: Copy SPI and proposal number from correct proposal in select() 
If charon.prefer_configured_proposals is disabled select() is called on
the received proposal. This incorrectly set the SPI to 0 as the
configured proposal has no SPI set.

Fixes #2190.
 2017-02-06 11:14:31 +01:00
Tobias Brunner 9665686bd8 daemon: Use separate method to set default loggers 
This way it is not necessary to pass the same values to reload the
loggers.
 2017-01-25 14:58:09 +01:00
Tobias Brunner 89054d9dcb unit-tests: Enable optional logging in libcharon unit tests 2016-10-05 14:27:05 +02:00
Tobias Brunner 9e5065d877 unit-tests: Add more tests for proposal creation 2016-10-05 14:27:05 +02:00
Tobias Brunner 9b191d5975 proposal: Make DH groups mandatory in IKE proposals parsed from strings 
References #2051.
 2016-10-05 14:26:55 +02:00
Tobias Brunner a6d7aed78a libcharon: Add exchange_tests to .gitignore 2016-07-25 14:01:26 +02:00
Tobias Brunner 5435a9a062 unit-tests: Add tests for expires after CHILD_SA rekeying 2016-06-17 18:48:08 +02:00
Tobias Brunner d707a19733 unit-tests: Add test for CHILD_SA rekey if a retry due to an INVALID_KE_PAYLOAD is delayed 2016-06-17 18:48:08 +02:00
Tobias Brunner b4f24ac0f6 unit-tests: Add test for collision between IKE_SA rekey and CHILD_SA creation 2016-06-17 18:48:08 +02:00
Tobias Brunner 46cbdcace9 unit-tests: Add tests for IKE rekeying if INVALID_KE_PAYLOAD notifies are received 2016-06-17 18:48:07 +02:00
Tobias Brunner aae9510148 proposal: Handle MODP_NONE in both directions when selecting proposals 2016-06-17 18:48:07 +02:00
Tobias Brunner 2e33d1f9ae unit-tests: Add test for rekey collision if one CREATE_CHILD_SA response is delayed 2016-06-17 18:48:06 +02:00
Tobias Brunner 566134b25a unit-tests: Add tests for IKE_SA rekeying if collision is not detected by one peer 2016-06-17 18:48:06 +02:00
Tobias Brunner 0a2cad40a6 unit-tests: Add tests for IKE/CHILD delete collisions 2016-06-17 18:48:06 +02:00
Tobias Brunner 7b3eccfff4 unit-tests: Add tests for IKE/CHILD rekey collisions 2016-06-17 18:48:05 +02:00
Tobias Brunner 7015994a94 unit-tests: Add tests for collisions between IKE_SA rekeying and deletion 2016-06-17 18:48:05 +02:00
Tobias Brunner 72c295df5b unit-tests: Add tests for IKE SA deletion 2016-06-17 18:48:05 +02:00
Tobias Brunner 40d9a4c892 unit-tests: Only deliver messages to the SA they are addressed to 2016-06-17 18:48:05 +02:00
Tobias Brunner 498a46d22f unit-tests: Add test for simple IKE rekey collision 2016-06-17 18:48:05 +02:00
Tobias Brunner bb3899739d ikev2: Add a new state to track rekeyed IKE_SAs 
This makes handling such IKE_SAs more specifically compared to keeping them
in state IKE_CONNECTING or IKE_ESTABLISHED (which we did when we lost a
collision - even triggering the ike_updown event), or using IKE_REKEYING for
them, which would also be ambiguous.

For instance, we can now reject anything but DELETES for such SAs.
 2016-06-17 18:48:05 +02:00
Tobias Brunner b5695bbffc unit-tests: Add tests for IKE_SA rekeying 2016-06-17 18:48:04 +02:00
Tobias Brunner d7b3ee6cca unit-tests: Add asserts against IKE_SAs 2016-06-17 18:48:04 +02:00
Tobias Brunner 735bd4ca14 unit-tests: Make sure to flush the IKE_SA manager before destroying the sender 
As the static plugin that creates and destroys the default sender was
not initialized because of the missing socket the daemon won't destroy
our sender.  Test cases will eventually have to flush the IKE_SA manager to
satisfy the leak detective.  However, in case of a test failure and if there
are IKE_SAs in the manager the daemon will flush the SAs when deinitializing,
which will cause deletes to get sent.  This crashes if the sender is already
destroyed.
 2016-06-17 18:48:04 +02:00
Tobias Brunner b76c1decd4 unit-tests: Return status from process_message() 2016-06-17 18:48:04 +02:00
Tobias Brunner 7c6e0c2979 unit-tests: Use wrapper for add_listener in bus_t related asserts 2016-06-17 18:48:04 +02:00
Tobias Brunner 5d10ef316d unit-tests: Provide a wrapper around bus_t::add_listener and unregister them during cleanup 
In case listeners on the stack are triggered while cleaning up after a
test failed (e.g. via ike_sa_manager_t::flush) remaining listeners defined on
the stack would cause a segmentation fault.
 2016-06-17 18:48:04 +02:00
Tobias Brunner b6a3c444e4 unit-tests: Add tests where a peer is not aware of a CHILD_SA rekey collision 2016-06-17 18:48:04 +02:00
Tobias Brunner f97bac5594 unit-tests: Test for rekeying if INVALID_KE_PAYLOAD notifies are received 2016-06-17 18:48:03 +02:00
Tobias Brunner 557e262f04 unit-tests: Make IKE and ESP proposals configurable 2016-06-17 18:48:03 +02:00
Tobias Brunner 42af3b4cce unit-tests: Add tests for CHILD_SA rekeying/deletion collisions 2016-06-17 18:48:03 +02:00
Tobias Brunner 62a2567b06 unit-tests: Add asserts against job scheduling 2016-06-17 18:48:03 +02:00
Tobias Brunner cdbf942889 ikev2: Use CHILD_REKEYED for replaced CHILD_SAs after rekeying 
This allows handling collisions better, in particular with deletions.
 2016-06-17 18:48:03 +02:00
Tobias Brunner b79beba518 unit-tests: Add asserts against task queues of IKE_SAs 2016-06-17 18:48:03 +02:00
Tobias Brunner fa098aa97c unit-tests: Add unit tests for basic CHILD_SA rekeying 2016-06-17 18:48:02 +02:00
Tobias Brunner 14588d99a4 unit-tests: Add asserts against ike|child_rekey hooks 2016-06-17 18:48:02 +02:00
Tobias Brunner 5d7f03dcaa unit-tests: Match in and outbound SPIs in SA asserts 
Since we use unique sequential SPIs that should be OK.
 2016-06-17 18:48:02 +02:00
Tobias Brunner dda5aab0f4 unit-tests: Register nonce generator and make first nonce byte configurable 2016-06-17 18:48:02 +02:00