aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* vici: If a IKE reauth_time is configured, disable the default rekey_timeMartin Willi2015-03-032-2/+19
|
* ikev2: Schedule a timeout for the delete message following passive IKE rekeyingMartin Willi2015-03-031-0/+6
| | | | | | | | | | | | | | | | | | | | | | | Under some conditions it can happen that the CREATE_CHILD_SA exchange for rekeying the IKE_SA initiated by the peer is successful, but the delete message does not follow. For example if processing takes just too long locally, the peer might consider us dead, but we won't notice that. As this leaves the old IKE_SA in IKE_REKEYING state, we currently avoid actively initiating any tasks, such as rekeying or scheduled DPD. This leaves the IKE_SA in a dead and unusable state. To avoid that situation, we schedule a timeout to wait for the DELETE message to follow the CREATE_CHILD_SA, before we actively start to delete the IKE_SA. Alternatively we could start a liveness check on the SA after a timeout to see if the peer still has that state and we can expect the delete to follow. But it is unclear if all peers can handle such messages in this very special state, so we currently don't go for that approach. While we could calculate the timeout based on the local retransmission timeout, the peer might use a different scheme, so a fixed timeout works as well. Fixes #742.
* kernel-netlink: Respect kernel routing priorities for IKE routesMartin Willi2015-03-031-2/+15
| | | | | | | | If a system uses routing metrics, we should honor them when doing (manual) routing lookups for IKE. When enumerating routes, the kernel reports priorities with the RTA_PRIORITY attribute, not RTA_METRICS. We prefer routes with a lower priority value, and fall back to longest prefix match priorities if the priority value is equal.
* enum: Extend printf hook to print flagsThomas Egerer2015-03-033-8/+286
| | | | Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
* unit-tests: Don't fail host_create_from_dns() test if IPv6 not supportedMartin Willi2015-03-021-4/+10
| | | | | On some systems, such as the Ubuntu daily build machine, localhost does not resolve to an IPv6 address. Accept such a lookup failure.
* bliss: Add generated Huffman codes to the repositoryTobias Brunner2015-03-025-14/+860
| | | | | | | | | | | | | While these files are generated they don't really change and are not architecture dependant. The previous solution prevented cross-compilation from the repository as `bliss_huffman` was built for the target system but was then executed on the build host to create the source files, which naturally was bound to fail. The `recreate-bliss-huffman` make target can be used inside the bliss directory to update the source files if needed. Fixes #812.
* Fixed a memory leak in the attribute segmentation codeAndreas Steffen2015-02-273-4/+4
|
* vici: Support ruby gem out-of-tree buildsMartin Willi2015-02-271-1/+3
| | | | | | | Referencing $(srcdir) in the gemspec is not really an option, as "gem build" includes the full path in the gem, so we need to build in $(srcdir). As there does not seem to be a way to control the output of "gem build", we manually move the gem to $(builddir) in OOT builds.
* ha: Always install the CHILD_SAs with the inbound flag set to FALSEMartin Willi2015-02-271-2/+2
| | | | | | | | | The inbound flag is used to determine if we have to install an update or a new SA in the kernel. As we do not have allocated SPIs and therefore can't update an existing SA in the HA plugin, always set the flag to FALSE. Before 698ed656 we had extra logic for that case, but handling it directly in the HA plugin is simpler.
* Updated Ubuntu 14.04 kernel versionAndreas Steffen2015-02-271-1/+1
|
* Fixed compiler warningsAndreas Steffen2015-02-271-2/+3
|
* travis: Disable unwind backtraces regardless of LEAK_DETECTIVE optionMartin Willi2015-02-261-3/+1
| | | | | | | While d0d85683 works around a crasher related to the use of libunwind, other build hangs have been seen in the all test cases. Try to --disable-unwind-backtraces to see if libunwind is really related to those and if it fixes these issues.
* Version bump to 5.3.0dr1Andreas Steffen2015-02-262-1/+4
|
* Allow SHA256 and SHA384 data hash for BLISS signatures.Andreas Steffen2015-02-2617-42/+133
| | | | | The default is SHA512 since this hash function is also used for the c_indices random oracle.
* unit-tests: Completed BLISS testsAndreas Steffen2015-02-256-16/+668
|
* Check for null pointer before applying memwipe()Andreas Steffen2015-02-251-4/+10
|
* Implemented improved BLISS-B signature algorithmAndreas Steffen2015-02-2513-47/+359
|
* host-resolver: Do not cancel threads waiting for new queries during cleanupMartin Willi2015-02-241-6/+8
| | | | | | | | | | | | | | | | While it is currently unclear why it happens, canceling threads waiting in the new_query condvar does not work as expected. The behavior is not fully reproducible: Either cancel(), join() or destroying the condvar hangs. The issue has been seen in the http-fetcher unit tests, where the stream service triggers the use of the resolver for "localhost" hosts. It is reproducible with any cleanup following a host_create_from_dns() use on a Ubuntu 14.04 x64 system. Further, the issue is related to the use of libunwind, as only builds with --enable-unwind-backtraces are affected. As we broadcast() the new_query condvar before destruction, a hard cancel() of these threads is actually not required. Instead we let these threads clean up themselves after receiving the condvar signal.
* host-resolver: Disable resolver thread cancellation by defaultMartin Willi2015-02-241-0/+3
| | | | | The default of new threads is cancellable, but the host-resolver thread code clearly expects the opposite.
* unit-tests: Add host_create_from_dns() test cases resolving "localhost"Martin Willi2015-02-241-0/+42
|
* travis: Disable forecast/connmark plugins in monolithic buildsMartin Willi2015-02-241-0/+4
| | | | | | Ubuntu 12.04 does not seem to provide a sane pkg-config for libiptc or libip4tc. The monolithic build fails due to missing symbols, so disable it until we have a newer Ubuntu release.
* plugin-loader: Do not unload libraries during dlclose(), if supportedMartin Willi2015-02-241-1/+9
| | | | | | | Unloading libraries calls any library constructor/destructor functions. Some libraries can't handle that in our excessive unit test use. GnuTLS leaks a /dev/urandom file descriptor, letting unit tests fail with arbitrary out-of-resources errors.
* unit-tests: Accept numerical protocol/port numbers in traffic selector testsMartin Willi2015-02-231-11/+16
|
* forecast: Explicitly cast sockaddr to fix compiler warningTobias Brunner2015-02-231-1/+1
| | | | On Travis we compile with -Werror.
* configure: Use pkg-config to detect libiptc used by connmark/forecastTobias Brunner2015-02-233-4/+10
| | | | | This ensures the library is available. On Debian/Ubuntu it is a dynamic library provided by the iptables-dev package.
* openssl: Return the proper IV length for OpenSSL cryptersTobias Brunner2015-02-231-1/+1
| | | | | | | For instance, the NULL cipher has a block size of 1 but an IV length of 0. Fixes #854.
* Merge branch 'forecast'Martin Willi2015-02-2024-0/+1673
|\ | | | | | | | | | | | | Implement a forecast plugin that supports forwarding of multi- and broadcast messages between a LAN and clients or between connected clients. It uses IPsec policy marks to send packets over multiple identical multi- and broadcast policies.
| * NEWS: Introduce forecast multicast/broadcast forwarding pluginMartin Willi2015-02-201-0/+7
| |
| * testing: Add a forecast test caseMartin Willi2015-02-2011-0/+152
| |
| * testing: Build forecast pluginMartin Willi2015-02-201-0/+1
| |
| * forecast: Document strongswan.conf optionsMartin Willi2015-02-202-0/+30
| |
| * forecast: Add the broadcast/multicast forwarding plugin called forecastMartin Willi2015-02-209-0/+1483
|/
* Merge branch 'connmark'Martin Willi2015-02-2027-8/+951
|\ | | | | | | | | | | | | | | Introduce a connmark plugin that uses Netfilter conntracks mark to select the correct return-path SAs for client-initiated connections. This can be used to distinguish transport mode clients behind the same NAT router. Fixes #365.
| * NEWS: Introduce connmark pluginMartin Willi2015-02-201-0/+6
| |
| * testing: Add a connmark plugin testMartin Willi2015-02-209-0/+109
| | | | | | | | | | | | | | | | | | | | In this test two hosts establish a transport mode connection from behind moon. sun uses the connmark plugin to distinguish the flows. This is an example that shows how one can terminate L2TP/IPsec connections from two hosts behind the same NAT. For simplification of the test, we use an SSH connection instead, but this works for any connection initiated flow that conntrack can track.
| * testing: Build strongSwan with the connmark pluginMartin Willi2015-02-201-0/+1
| |
| * testing: Install iptables-dev to guest imagesMartin Willi2015-02-201-1/+1
| |
| * travis: Install iptables-dev for connmark plugin in "all" testsMartin Willi2015-02-201-1/+1
| |
| * ipsec-types: Support the %unique mark valueMartin Willi2015-02-203-6/+18
| |
| * connmark: Add CONNMARK rules to select correct output SA based on conntrackMartin Willi2015-02-204-0/+611
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently supports transport mode connections using IPv4 only, and requires a unique mark configured on the connection. To select the correct outbound SA when multiple connections match (i.e. multiple peers connected from the same IP address / NAT router) marks must be configured. This mark should usually be unique, which can be configured in ipsec.conf using mark=0xffffffff. The plugin inserts CONNMARK netfilter target rules: Any peer-initiated flow is tagged with the assigned mark as connmark. On the return path, the mark gets restored from the conntrack entry to select the correct outbound SA.
| * bus: Add an ike_update() hook invoked when peer endpoints changeMartin Willi2015-02-204-0/+50
| |
| * connmark: Add a plugin stubMartin Willi2015-02-205-0/+154
|/
* load-tester: Support initiating XAuth authenticationMartin Willi2015-02-201-0/+22
| | | | | | | | As with other configuration backends, XAuth is activated with a two round client authentication using pubkey and xauth. In load-tester, this is configured with initiator_auth=pubkey|xauth. Fixes #835.
* Merge branch 'make-before-break'Martin Willi2015-02-2047-99/+597
|\ | | | | | | | | Introduce an alternative make-before-break reauthentication scheme in addition to the traditional break-before-make.
| * NEWS: Introduce make-before-break reauthenticationMartin Willi2015-02-201-0/+9
| |
| * testing: Update description and test evaluation of host2host-transport-natMartin Willi2015-02-203-9/+8
| | | | | | | | | | | | | | | | As we now reuse the reqid for identical SAs, the behavior changes for transport connections to multiple peers behind the same NAT. Instead of rejecting the SA, we now have two valid SAs active. For the reverse path, however, sun sends traffic always over the newer SA, resembling the behavior before we introduced explicit SA conflicts for different reqids.
| * testing: Be a little more flexible in testing for established CHILD_SA modesMartin Willi2015-02-208-21/+21
| | | | | | | | | | As we now print the reqid parameter in the CHILD_SA details, adapt the grep to still match the CHILD_SA mode and protocol.
| * testing: Add a test scenario for make-before-break reauth using a virtual IPMartin Willi2015-02-209-0/+100
| |
| * testing: Add a test scenario for make-before-break reauth without a virtual IPMartin Willi2015-02-209-0/+97
| |
| * mem-pool: Pass the remote IKE address, to re-acquire() an address during reauthMartin Willi2015-02-207-55/+87
| | | | | | | | | | | | | | | | | | | | | | With make-before-break IKEv2 re-authentication, virtual IP addresses must be assigned overlapping to the same peer. With the remote IKE address, the backend can detect re-authentication attempts by comparing the remote host address and port. This allows proper reassignment of the virtual IP if it is re-requested. This change removes the mem-pool.reassign_online option, as it is obsolete now. IPs get automatically reassigned if a peer re-requests the same address, and additionally connects from the same address and port.
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-04 16:19:03 +0000