aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* mutex: Use atomics to set current thread in recursive mutexTobias Brunner2014-09-091-9/+12
| | | | | | | | Because this->thread is also read by threads that don't hold the mutex the previous implementation was problematic (especially since pthread_t is an opaque type of unknown length). Fixes #654.
* curl: Log error code tooTobias Brunner2014-09-091-2/+5
| | | | It seems libcurl does not always return an error message.
* unit-tests: Add option to exclude specific test suitesTobias Brunner2014-09-092-14/+32
| | | | | Listing test suites in TESTS_SUITES_EXCLUDE allows excluding specific test suites from running.
* openssl: Report correct key length for EC keys when not using NIST curvesTobias Brunner2014-09-022-22/+2
| | | | Fixes #688.
* credmgr: Fix copy and paste error in add_validatorThomas Egerer2014-08-291-1/+1
| | | | | | | | | This won't hurt as long as sets and validators are of the same class. But as soon as one of the object's class is changed this will cause either a compile error (best option), or result (most likely) in a crash. Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
* Generated new test certificatesAndreas Steffen2014-08-2876-351/+542
|
* ha: Don't adopt IKEv1 children when building without IKEv1 supportMartin Willi2014-08-281-0/+2
| | | | | | | The adopt_children_job_create() function is not available when IKEv1 support is disabled. Fixes uncommon builds using --enable-ha --disable-ikev1. Fixes #690.
* testing: Make sure the kernel exists when startingTobias Brunner2014-08-251-0/+1
|
* unity: Do not bump TS to 0.0.0.0/0 as initiator when no Split-Include receivedMartin Willi2014-08-251-1/+21
| | | | | | | When having the unity plugin enabled and both peers send the Unity Vendor ID, we proposed 0.0.0.0/0 as traffic selector, even if no Split-Include has been received on the SA. This can break compatibility with some responders, as they don't narrow the TS themselves, but expect the configured TS.
* unity: Handle narrowing according to roles in the IKE_SATobias Brunner2014-08-251-16/+33
| | | | | | Since the narrow hook types reflect the roles in the Quick Mode exchange the plugin behaved incorrectly if the server initiated the CHILD_SA rekeying.
* Merge branch 'push-mode-reauth'Martin Willi2014-08-256-16/+123
|\ | | | | | | | | Fixes IKEv1 re-authentication when using push mode by reassigning the same IP lease to the client.
| * ikev1: Defer Mode Config push after CHILD adoption when using XAuthMartin Willi2014-08-254-6/+40
| |
| * ikev1: Defer Mode Config push after CHILD adoption and reauth detectionMartin Willi2014-08-252-10/+35
| | | | | | | | | | | | | | | | When an initiator starts reauthentication on a connection that uses push mode to assign a virtual IP, we can't execute the Mode Config before releasing the virtual IP. Otherwise we would request a new and different lease, which the client probably can't handle. Defer Mode Config execution, so the same IP gets first released then reassigned during reauthentication.
| * ikev1: Extend adopt_children_job by task queuing, executed after adoptionMartin Willi2014-08-252-0/+48
|/
* ikev1: Accept Quick Mode DELETES while Quick Mode rekeying is activeMartin Willi2014-08-251-2/+21
| | | | | | | | | | If a peer immediately sends DELETE messages when completing Quick Mode rekeying, the third Quick Mode message and the DELETE are sent simultaneously. This implies that DELETE messages may arrive before the completing third Quick Mode message. Handle this case by ignoring the DELETE INFORMATIONAL in Quick Mode and let the delete task handle it.
* utils: Check if the parameter passed to countof() is actually an array typeMartin Willi2014-08-251-1/+2
| | | | This should avoid errors such as the one fixed with 118b2879.
* utils: Add some initial build time assertion macrosMartin Willi2014-08-251-0/+14
| | | | | These are useful to assert constants during build time. We evaluate the expression to 0 when valid, so we can safely use the evaluated value.
* starter: Do not close all file descriptors after fork()Martin Willi2014-08-251-1/+0
| | | | | | | | As we use libstrongswan and expect that it still works after the fork, we can't just closefrom() all file descriptors. Watcher, for example, uses a pipe to notify FDSET changes, which must be kept open. Reverts 652ddf5ce2fad08f6569096dd56a821500cc5ba4.
* ike-sa-manager: Use transient hasher for IKE_SA_INIT hash calculationChristophe Gouault2014-08-251-32/+11
| | | | | | | | | | | | | | | | To check if a received IKE_SA_INIT request is a new request or a retransmit, charon maintains hashes of the pending IKE_SA_INIT exchanges. However, the hash calculation is not reentrant because a single hasher is used for the whole IKE SA manager. It leads to bogus calculations under high load and hence dropped messages on responder (IkeInInvalidSpi incremented). Don't share a single hasher in the IKE SA manager, create a transient one whenever a message must be hashed. Signed-off-by: Christophe Gouault <christophe.gouault@6wind.com>
* diffie-hellman: Explicitly initialize DH exponent sizes during initializationMartin Willi2014-08-253-8/+38
| | | | | | | | To avoid any race conditions when multiple threads call and initialize diffie_hellman_get_params(), explicitly examine the optimum DH exponent size during library initialization. Fixes #655.
* kernel-pfroute: Fix kernel response handlingTobias Brunner2014-08-191-2/+3
| | | | | | | | | | | | | The condvar is signaled for every handled message received from the kernel not only for replies (this changed with 2a2d7a4dc8). This may cause segfaults because this->reply is not set when the waiting thread is woken due to an IP address change. Since this->reply is only set when it is actually the expected reply (and only one request is sent at a time, thanks to c9a323c1d9) we only have to make sure the reply is there (and clear it once we handled it). Using separate condvars could also be an option in the future.
* configure: Add additional includes when checking for linux/fib_rules.hTobias Brunner2014-08-111-2/+2
| | | | This seems to be required on Cent OS 6.5.
* starter: Wait indefinitely for charon when using --attach-gdbMartin Willi2014-08-081-3/+7
| | | | | This makes sure the user has time to set break points etc. before it runs charon under gdb.
* starter: Don't monitor child if debugger is attachedThomas Egerer2014-08-081-0/+5
| | | | Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
* Added Debian 7.6 to IMV databaseAndreas Steffen2014-08-061-0/+35
|
* unused os_info_t object removedAndreas Steffen2014-08-061-1/+0
|
* Updated build-database.sh to 3.13.0-32-generic Ubuntu kernelAndreas Steffen2014-08-061-1/+1
|
* imv-swid: Use pkg-config to check for libjson-cTobias Brunner2014-07-304-6/+8
| | | | | | | | | The package/library is called libjson-c on recent distributions. Some like Ubuntu 14.04 provide symlinks with the old name but these will eventually disappear. Using pkg-config allows us to easily check for it (with a fallback) and configure the proper compiler flags. Fixes #663.
* dns-proxy: Don't use proxy socket if we fail to bypass itTobias Brunner2014-07-301-0/+2
| | | | | | | | | This will result in an infinite loop as packets sent over that socket will again pass through the TUN device and the DNS proxy. Apparently, bypassing fails when airplane mode is enabled. Fixes #662.
* swanctl: Fix documentation of options for send_cert settingTobias Brunner2014-07-281-4/+4
|
* android: New release after adding certificate import, DNS proxy and GUI changesTobias Brunner2014-07-221-2/+2
|
* Merge branch 'android-dns-proxy'Tobias Brunner2014-07-2216-30/+1215
|\ | | | | | | | | | | | | | | | | | | | | | | | | Adds a DNS proxy feature that uses VPN-protected sockets to resolve the VPN gateway's hostname while reestablishing the IKE_SA, which is required because we keep the TUN device up to avoid leaking plaintext traffic. The TUN device is recreated without DNS servers before reestablishing in case the VPN server pushed DNS servers to the client that are only reachable via VPN. Fixes #622.
| * android: For keyingtries > 0 notify the GUI if the limit is reached when ↵Tobias Brunner2014-07-221-0/+17
| | | | | | | | | | | | | | | | | | | | reestablishing The IKE_SA is destroyed anyway, so letting the GUI remain in "connecting" state would be incorrect. We still use keyingtries=0 for now, though. And we still abort after the first failed attempt initially, in case there is a configuration error.
| * android: Terminate IKE_SA if initial IKE_SA_INIT failsTobias Brunner2014-07-221-1/+23
| | | | | | | | | | | | | | | | | | | | Since VpnStateService.disconnect() is now not called until the error dialog is dismissed the daemon would continue to try connecting. So while the error dialog is shown the connection might actually be successfully established in the background, which is not intended. This way the IKE_SA is destroyed right after sending the IKE_SA_INIT of the second connection attempt (due to keyingtries=0).
| * android: Only allow DNS queries for the configured hostnameTobias Brunner2014-07-221-0/+2
| |
| * android: Add optional filter functionality to DNS proxyTobias Brunner2014-07-222-3/+119
| | | | | | | | | | If specified only queries for a list of allowed host names will be proxied.
| * android: Recreate the TUN device without DNS when reestablishing IKE_SAsTobias Brunner2014-07-221-0/+38
| | | | | | | | | | This enables DNS resolution while reestablishing if the VPN gateway pushed DNS servers to the client that are only reachable via VPN.
| * android: Add method to BuilderAdapter to re-establish without DNS-related dataTobias Brunner2014-07-223-5/+113
| | | | | | | | | | | | Non-DNS data is cached in the BuilderAdapter so the TUN device can be recreated easily (since the CHILD_SA is gone we couldn't actually gather that information).
| * android: Use DNS proxy when reestablishing IKE_SAsTobias Brunner2014-07-221-4/+44
| |
| * bus: Add ike_reestablish_pre hook, called before DNS resolutionTobias Brunner2014-07-225-13/+74
| | | | | | | | | | The old hook is renamed to ike_reestablish_post and is now also called when the initiation of the new IKE_SA failed.
| * android: Add DNS proxy implementationTobias Brunner2014-07-223-0/+388
| | | | | | | | | | | | | | This class proxies DNS requests over VPN-protected UDP sockets. It is not really Android specific and might be useful for kernel-libipsec or libipsec in general too, so we could maybe move it later to libipsec (might need some portability work).
| * ip_packet: Add function to easily encode UDP packetsTobias Brunner2014-07-222-0/+29
| |
| * ip_packet: Apply transport protocol ports when encoding IP packetTobias Brunner2014-07-222-10/+30
| |
| * ip_packet: Add getter for IP payloadTobias Brunner2014-07-222-5/+25
| |
| * ip_packet: Allow creation of IP packets from dataTobias Brunner2014-07-222-1/+164
| |
| * chunk: Add function to calculate Internet Checksums according to RFC 1071Tobias Brunner2014-07-223-0/+105
| |
| * ip_packet: Parse ports from TCP and UDP headersTobias Brunner2014-07-221-7/+63
|/
* Merge branch 'android-state-updates'Tobias Brunner2014-07-223-12/+17
|\ | | | | | | | | | | | | | | The GUI reflects the state of the IKE daemon more closely by switching back to the "connecting" state when the IKE_SA or CHILD_SA is down and is getting reestablished. Fixes #616.
| * android: Delay disconnecting on errors until user dismisses themTobias Brunner2014-07-222-4/+6
| | | | | | | | | | If e.g. reauthentication fails we don't want to close the TUN device until the user acknowledged the error and is thus aware of the failure.
| * android: Set CHILD_STATE_DOWN when the IKE_SA gets reestablishedTobias Brunner2014-07-221-1/+7
| |
generated by cgit v1.2.3 (git 2.25.1) at 2025-07-29 20:37:03 +0000