denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
15,990 Commits 1 Branch 0 Tags
f9fbcbb1a00d631bbd9d6ee1209251b3ee85dbaf
Commit Graph
12584 Commits
Author SHA1 Message Date
Tobias Brunner f9fbcbb1a0 bus: Don't trigger child_updown() for rekeyed CHILD_SAs 
We don't trigger it either when they are deleted individually.
 2017-08-07 10:44:05 +02:00
Tobias Brunner d24b831fe7 charon-tkm: Don't select new outbound SA until the policy is installed 
This tries to avoid packet loss during rekeying by delaying the usage of
the new outbound IKE_SA until the old one is deleted.

Note that esa_select() is a no-op in the current TKM implementation. And
the implementation also doesn't benefit from the delayed deletion of the
inbound SA as it calls esa_reset() when the outbound SA is deleted.
 2017-08-07 10:44:05 +02:00
Tobias Brunner 0d42a76275 charon-tkm: Claim to support SPIs on policies 
This fixes rekeying as the delayed installation of the outbound SA
caused the nonce context to be expired already.
 2017-08-07 10:44:05 +02:00
Tobias Brunner a146b4c9ef child-sa: Install outbound SA immediately if kernel supports SPIs on policies 2017-08-07 10:44:05 +02:00
Tobias Brunner 2c116ef589 child-sa: Use flags to track installation of outbound SA and policies separately 2017-08-07 10:44:05 +02:00
Tobias Brunner 2699c8387a kernel-netlink: Set SPI on outbound policy 
This should cause the right SA to get used if there are multiple outbound
SAs and the policies are installed properly.
 2017-08-07 10:44:05 +02:00
Tobias Brunner a46d233c0e kernel-interface: Not all kernel interfaces support SPIs on policies 2017-08-07 10:44:05 +02:00
Andreas Steffen 88501a64ca swid-gen: Share SWID generator between sw-collector, imc-swima and imc-swid 2017-08-04 19:15:26 +02:00
Andreas Steffen 073c179a88 sw-collector: Added --full option 2017-08-03 09:02:54 +02:00
Andreas Steffen bea3f5d07f sw-collector: Added --installed/removed options 2017-08-03 09:02:54 +02:00
Tobias Brunner 95ecc11774 unit-tests: Double escape backslashes in Windows paths in settings test 
That's required when these are used as include paths in settings file
strings.
 2017-07-28 11:22:40 +02:00
Tobias Brunner 67ad553a2c unit-tests: Stringify direction in message asserts early 
x86_64-w64-mingw32-gcc on Windows requires this.
 2017-07-28 11:18:59 +02:00
Tobias Brunner 65064cc33b unit-tests: iv_gen_seq has a dependency on RNG_STRONG 
We currently don't have an RNG in Windows builds.
 2017-07-28 11:18:59 +02:00
Tobias Brunner 8d4ebb3ac4 peer-cfg: Use an rwlock instead of a mutex to safely access child-cfgs 
If multiple threads want to enumerate child-cfgs and potentially lock
other locks (e.g. check out IKE_SAs) while doing so a deadlock could
be caused (as was the case with VICI configs with start_action=start).
It should also improve performance for roadwarrior connections and lots
of clients connecting concurrently.

Fixes #2374.
 2017-07-27 13:34:40 +02:00
Tobias Brunner 578d893b4a credential-manager: Log issuer identity if not found 2017-07-27 13:28:13 +02:00
Tobias Brunner 0b756fbe95 auth-cfg: Don't limit subjectAltName check to received certificates 
Otherwise this won't work if the certificate is only locally available.
 2017-07-27 13:27:19 +02:00
Tobias Brunner 4272a3e9d7 swanctl: Read default socket from swanctl.socket option 
Also read from swanctl.plugins.vici.socket so we get
libstrongswan.plugins.vici.socket if it is defined.

Fixes #2372.
 2017-07-27 13:22:57 +02:00
Tobias Brunner ae48325a59 swanctl: Include config snippets from conf.d subdirectory 
Fixes #2371.
 2017-07-27 13:20:24 +02:00
Tobias Brunner 67402ec77b curl: Enable following redirects 
The maximum number of redirects can be limited. The functionality can also
be disabled.

Fixes #2366.
 2017-07-27 13:15:43 +02:00
Tobias Brunner 791cfe82a1 ikev2: AES-CMAC-PRF-128 only uses the first 64 bits of each nonce 
References #2377.
 2017-07-27 13:09:26 +02:00
Tobias Brunner ed926a73df error-notify: Don't stop sending notifies after removing a disconnected listener 
This prevented new listeners from receiving notifies if they joined
after another listener disconnected previously, and if they themselves
disconnected their old connection would prevent them again from getting
notifies.
 2017-07-27 13:07:24 +02:00
Tobias Brunner 6138b8d629 farp: Only remove one tracked entry 
Multiple CHILD_SAs sharing the same traffic selectors (e.g. during
make-before-break reauthentication) also have the same reqid assigned.
If all matching entries are removed we could end up without entry even
though an SA exists that still uses these traffic selectors.

Fixes #2373.
 2017-07-27 13:07:23 +02:00
Tobias Brunner a0cde76958 ike: Trigger CHILD_INSTALLED state change after corresponding log message 
This way we get the log message in stroke and swanctl as last message
when establishing a connection. It's already like this for the IKE_SA
where IKE_ESTABLISHED is set after the corresponding log message.

Fixes #2364.
 2017-07-27 13:07:23 +02:00
Andreas Steffen f35fbb2b5f sw-collector: sw-collector.first_file setting retrieves creation date from file stats 2017-07-26 19:51:21 +02:00
Tobias Brunner 6b69a66379 swima-collector: Fix compile error if SWID_DIRECTORY is not defined 2017-07-24 11:34:39 +02:00
Tobias Brunner bf565b650c libimcv: Add missing files to Android.mk 2017-07-24 11:31:19 +02:00
Andreas Steffen a9383c2b46 checksum: Compile sw-collector before checksum 2017-07-18 20:02:21 +02:00
Andreas Steffen 8362378a15 checksum: Added pt-tls-client and sw-collector 2017-07-18 07:25:46 +02:00
Andreas Steffen 964bf73237 sw-collector: Moved to its own directory and added man page 2017-07-18 07:25:45 +02:00
Andreas Steffen 34cade8b84 pt-tls-client: Added man page 2017-07-16 15:37:03 +02:00
Andreas Steffen cab4cc3a10 sw-collector: strip arch suffix from package names 2017-07-13 12:03:27 +02:00
Andreas Steffen 5b1dbc3a8d sw-collector: Check for epoch-less Debian package versions 2017-07-12 19:12:22 +02:00
Andreas Steffen eab650d62f libtpmtss: Support of Intel TABRMD interface 2017-07-12 17:07:34 +02:00
Andreas Steffen 3bf8392d36 pt-tls-client: Support for TPM keyids 2017-07-08 23:19:51 +02:00
Andreas Steffen 49d56e1b39 imv-swima: Implemented SW event processing 2017-07-08 23:19:51 +02:00
Andreas Steffen 74aa1626d2 sw-collector: Query central collector database 2017-07-08 23:19:51 +02:00
Andreas Steffen 8ba6bf511e libimcv: Moved REST API from imv_swid and imv_swima to libimcv 2017-07-08 23:19:51 +02:00
Andreas Steffen 7e796bba67 swidtag: strongSwan swidtag file with double underscores 2017-07-08 23:19:51 +02:00
Andreas Steffen 032a5767ad sw-collector: Collects endpoint software events 2017-07-08 23:19:51 +02:00
Andreas Steffen 3a7c594c14 imv-swima: Created SWIMA IMV plugin 2017-07-08 23:19:51 +02:00
Andreas Steffen 2821c0f740 imc-swima: Created SWIMA IMC plugin 2017-07-08 23:19:51 +02:00
Andreas Steffen bf22470623 unit-tests: Added IETF SWIMA PA-TNC attribute tests 2017-07-08 23:19:51 +02:00
Andreas Steffen 84c0366bd3 libimcv: Implemented IETF SW PA-TNC attributes 2017-07-08 23:19:51 +02:00
Andreas Steffen bb87af2a73 libimcv: Fixed memory leak 2017-07-08 23:19:51 +02:00
Andreas Steffen 37205b05e6 libimcv: Corrected order of subscription flags 2017-07-08 23:19:51 +02:00
Andreas Steffen 0cc0b53b2f libimcv: Added IETF Software PA-TNC attributes 2017-07-08 23:19:51 +02:00
Andreas Steffen 8c4c824706 libtncif: Added IETF Software PA-TNC message subtype 2017-07-08 23:19:51 +02:00
Andreas Steffen 6795de0408 libimcv: SWID tag generation and discovery 2017-07-08 23:19:51 +02:00
Andreas Steffen 60da0153ee libimcv: Update database to ISO 19770-2:2015 SWID standard 2017-07-08 23:19:51 +02:00
Tobias Brunner d7dc677ee5 x509: Correctly encode nonce in OCSP request 
The nonce value is encoded as OCTET STRING, however, the extension
values themselves must also be encoded as OCTET STRING.
 2017-07-07 08:57:14 +02:00