aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
| * openssl: Add a generic private key loaderTobias Brunner2016-10-057-18/+129
| |
| * pkcs1: Support building of KEY_ANY private keysTobias Brunner2016-10-052-5/+73
| | | | | | | | | | We try to detect the type of key by parsing the basic structure of the passed ASN.1 blob.
| * pki: Drop -priv suffix to specify private key typesTobias Brunner2016-10-054-16/+23
|/
* ikev2: Only add NAT-D notifies to DPDs as initiatorTobias Brunner2016-10-041-8/+15
| | | | | | | | | | If a responder is natted it will usually be a static NAT (unless it's a mediated connection) in which case adding these notifies makes not much sense (if the initiator's NAT mapping had changed the responder wouldn't be able to reach it anyway). It's also problematic as some clients refuse to respond to DPDs if they contain such notifies. Fixes #2126.
* pkcs11: Look for the CKA_ID of the cert if it doesn't match the subjectKeyIdRaphael Geissert2016-10-041-4/+152
| | | | | | | | | | | | | | charon-nm fails to find the private key when its CKA_ID doesn't match the subjectKeyIdentifier of the X.509 certificate. In such cases, the private key builder now falls back to enumerating all the certificates, looking for one that matches the supplied subjectKeyIdentifier. It then uses the CKA_ID of that certificate to find the corresponding private key. It effectively means that PKCS#11 tokens where the only identifier to relate the certificate, the public key, and the private key is the CKA_ID are now supported by charon-nm. Fixes #490.
* nm: Make global CA directory configurableTobias Brunner2016-10-043-1/+6
|
* Merge branch 'ikev1-rekey-deletion'Tobias Brunner2016-10-042-11/+15
|\ | | | | | | | | | | | | | | | | | | | | | | Sends a DELETE when rekeyed IKE_SAs are deleted. This fixes issues with peers (e.g. Cisco) that continue to send DPDs on the old SA and then delete all SAs if no response is received. But since the DELETE could get dropped this might not fix the issue in all cases. Also, when terminating an IKE_SA DELETES for all CHILD_SAs are now sent before sending one for the IKE_SA and destroying it. Fixes #2090.
| * ikev1: Activate task to delete the IKE_SA in state IKE_REKEYINGTobias Brunner2016-10-041-0/+8
| | | | | | | | It does not have any CHILD_SAs attached at that point.
| * ikev1: Delete Quick Mode SAs before the ISAKMP SATobias Brunner2016-10-041-2/+2
| | | | | | | | | | After the ISAKMP_DELETE task has been executed the IKE_SA is destroyed so we wouldn't be able to send deletes for the Quick Mode SAs.
| * ikev1: Send DELETE for rekeyed IKE_SAsTobias Brunner2016-10-041-9/+5
|/ | | | | | If we silently delete the IKE_SA the other peer might still use it even if only to send DPDs. If we don't answer to DPDs that might result in the deletion of the new IKE_SA too.
* starter: Install an empty ipsec.secrets fileTobias Brunner2016-10-043-2/+4
|
* starter: Don't generate a key/certificate if ipsec.secrets does not existTobias Brunner2016-10-042-70/+0
|
* watcher: Avoid allocations due to enumeratorsTobias Brunner2016-10-041-37/+83
| | | | | Since the FD set could get rebuilt quite often this change avoids having to allocate memory just to enumerate the registered FDs.
* Merge branch 'enable-fragmentation'Tobias Brunner2016-10-046-13/+16
|\ | | | | | | | | This enables IKE fragmentation by default. And also increases the default fragment size to 1280 bytes (the default for IPv6).
| * vici: Enable IKE fragmentation by defaultTobias Brunner2016-10-042-4/+4
| |
| * starter: Enable IKE fragmentation by defaultTobias Brunner2016-10-042-4/+6
| |
| * ike: Set default IKE fragment size to 1280Tobias Brunner2016-10-042-5/+6
|/ | | | | | This is the minimum size an IPv6 implementation must support. This makes it the default for IPv4 too, which presumably is also generally routable (otherwise, setting this to 0 falls back to the minimum of 576 for IPv4).
* Merge commit 'derived-keys'Tobias Brunner2016-10-047-91/+241
|\ | | | | | | | | Adds new listener hooks that work similar to the existing ike|child_keys hooks but receive the derived IKE and CHILD_SA keys.
| * ikev2: Send derived CHILD_SA keys to the busTobias Brunner2016-10-041-26/+43
| |
| * ikev2: Send derived IKE_SA keys to busTobias Brunner2016-10-041-26/+30
| |
| * ikev1: Send derived CHILD_SA keys to the busTobias Brunner2016-10-041-14/+26
| |
| * ikev1: Send derived IKE_SA keys to busTobias Brunner2016-10-041-14/+11
| |
| * bus: Add new hooks for derived IKE_SA and CHILD_SA keysTobias Brunner2016-10-043-11/+131
|/
* nm: Remove dummy TUN deviceTobias Brunner2016-10-041-36/+0
| | | | | Recent NM releases don't insist on getting a device back from VPN plugins.
* nm: Fix comment in service file in /etc/NetworkManager/VPNTobias Brunner2016-10-041-1/+1
|
* nm: Remove generated service file in `make clean`Tobias Brunner2016-10-041-1/+1
|
* nm: Don't add generated AppStream metadata to tarballTobias Brunner2016-10-041-1/+0
|
* bus: Fix maximum log levels when mixing log/vlog implementing loggersTobias Brunner2016-09-301-12/+20
| | | | | | | | | | | The maximum would not get set correctly when a logger is removed and the first remaining logger in the list (the one with the highest log level) does e.g. only implement vlog() while there are other loggers that implement log(). This would result in only max_vlevel getting set correctly while max_level would incorrectly get set to -1 so that log() would not get called for any of the loggers anymore. References #574.
* kernel-netlink: Pass zero mark to kernel if mask is setTobias Brunner2016-09-301-2/+2
| | | | | | The kernel will apply the mask to the mark on the packet and then compare it to the configured mark. So to match only unmarked packets we have to be able to set 0/0xffffffff.
* kernel-netlink: Support configuring XFRM policy hashing thresholdsTobias Brunner2016-09-302-0/+136
| | | | | | | | | | | | | | | | | | | | | | | | If the number of flows over a gateway exceeds the flow cache size of the Linux kernel, policy lookup gets very expensive. Policies covering more than a single address don't get hash-indexed by default, which results in wasting most of the cycles in xfrm_policy_lookup_bytype() and its xfrm_policy_match() use. Starting with several hundred policies the overhead gets inacceptable. Starting with Linux 3.18, Linux can hash the first n-bit of a policy subnet to perform indexed lookup. With correctly chosen netbits, this can completely eliminate the performance impact of policy lookups, freeing the resources for ESP crypto. WARNING: Due to a bug in kernels 3.19 through 4.7, the kernel crashes with a NULL pointer dereference if a socket policy is installed while hash thresholds are changed. And because the hashtable rebuild triggered by the threshold change that causes this is scheduled it might also happen if the socket policies are seemingly installed after setting the thresholds. The fix for this bug - 6916fb3b10b3 ("xfrm: Ignore socket policies when rebuilding hash tables") - is included since 4.8 (and might get backported). As a workaround `charon.plugins.kernel-netlink.port_bypass` may be enabled to replace the socket policies that allow IKE traffic with port specific bypass policies.
* include: Update xfrm.h to Linux v4.3Martin Willi2016-09-301-0/+22
| | | | | We strip the newly introduced <linux/in6.h> include, as this clashes with the <netinet/in6.h> include.
* Merge branch 'fwd-out-policies-optional'Tobias Brunner2016-09-286-44/+93
|\ | | | | | | | | | | This makes the FWD policies in the out direction optional (disabled by default). They may be enabled (e.g. if conflicting drop policies are used) via the policies_fwd_out swanctl.conf option.
| * child-sa: Only install outbound FWD policies if explicitly configuredTobias Brunner2016-09-281-14/+27
| | | | | | | | | | | | They are only required if drop policies would otherwise prevent forwarding traffic. This reduces the number of policies and avoids conflicts e.g. with SPD hash thresholds.
| * testing: Enable outbound FWD policies in swanctl/manual-prio scenarioTobias Brunner2016-09-281-5/+6
| |
| * vici: Make installation of outbound FWD policies configurableTobias Brunner2016-09-282-25/+36
| |
| * child-cfg: Add setting that controls whether outbound FWD policies are installedTobias Brunner2016-09-282-0/+24
|/
* kernel-netlink: Update cached reqid when updating policiesTobias Brunner2016-09-281-0/+2
|
* testing: Added swanctl/net2net-multicast scenarioAndreas Steffen2016-09-279-0/+166
|
* testing: Added ikev2/net2net-multicast scenarioAndreas Steffen2016-09-279-0/+125
|
* travis: Use a more recent OS X imageTobias Brunner2016-09-272-2/+3
| | | | Using the xcode8 image does not work currently (libcurl is not found).
* Version bump to 5.5.1dr55.5.1dr5Andreas Steffen2016-09-223-2/+5
|
* testing: Added swanctl/net2net-sha3-rsa-cert and swanctl/rw-eap-tls-sha3-rsa ↵Andreas Steffen2016-09-2246-0/+1139
| | | | scenarios
* gmp: Support of SHA-3 RSA signaturesAndreas Steffen2016-09-2224-167/+274
|
* bliss sampler unit-test: Fixed enumeration typeAndreas Steffen2016-09-221-2/+2
|
* bliss: bliss_sampler expects XOF typeAndreas Steffen2016-09-221-4/+3
|
* unit-tests: MGF1 tests depend on an XOF implementation not just a hash functionTobias Brunner2016-09-211-2/+2
| | | | | If the mgf1 plugin was not enabled (e.g. with the default configure options) the tests failed.
* Version bump to 5.5.1dr45.5.1dr4Andreas Steffen2016-09-213-4/+10
|
* mgf1: Refactored MGF1 as an XOFAndreas Steffen2016-09-2160-644/+966
|
* leak-detective: Fix compile warning due to unused variable if LD is disabledTobias Brunner2016-09-201-1/+1
|
* Merge branch 'testing-leak-detective'Tobias Brunner2016-09-2016-75/+179
|\ | | | | | | | | Test scenarios now fail if any leaks are detected by the leak detective. Several leaks found this way have been fixed.
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-04 17:31:43 +0000