aboutsummaryrefslogtreecommitdiffstats
path: root/src/libcharon/plugins
Commit message (Collapse)AuthorAgeFilesLines
* Fixed some typos, courtesy of codespellTobias Brunner2017-08-072-2/+2
|
* kernel-netlink: Wipe buffer used to read Netlink messagesTobias Brunner2017-08-071-2/+12
| | | | | | | | | When querying SAs the keys will end up in this buffer (the allocated messages that are returned are already wiped). The kernel also returns XFRM_MSG_NEWSA as response to XFRM_MSG_ALLOCSPI but we can't distinguish this here as we only see the response. References #2388.
* kernel-netlink: Set SPI on outbound policyTobias Brunner2017-08-071-4/+10
| | | | | This should cause the right SA to get used if there are multiple outbound SAs and the policies are installed properly.
* error-notify: Don't stop sending notifies after removing a disconnected listenerTobias Brunner2017-07-271-2/+1
| | | | | | | This prevented new listeners from receiving notifies if they joined after another listener disconnected previously, and if they themselves disconnected their old connection would prevent them again from getting notifies.
* farp: Only remove one tracked entryTobias Brunner2017-07-271-0/+1
| | | | | | | | | Multiple CHILD_SAs sharing the same traffic selectors (e.g. during make-before-break reauthentication) also have the same reqid assigned. If all matching entries are removed we could end up without entry even though an SA exists that still uses these traffic selectors. Fixes #2373.
* kernel-pfroute: Make sure there is a netmask when enumerating subnetsTobias Brunner2017-07-051-2/+2
|
* sql: Use qualified names in SQL query statementsTobias Brunner2017-07-052-49/+54
| | | | | | | VIRTUAL is a new reserved keyword in MySQL 5.7.6 that caused some of these queries to fail. Fixes #2359.
* stroke: Don't load configs with invalid proposalsTobias Brunner2017-07-051-7/+20
| | | | References #2347.
* eap-aka-3gpp: Add plugin that implements 3GPP MILENAGE algorithm in softwareTobias Brunner2017-07-059-0/+1373
| | | | | | | | | | This is similar to the eap-aka-3gpp2 plugin. K (optionally concatenated with OPc) may be configured as binary EAP secret in ipsec.secrets or swanctl.conf. Based on a patch by Thomas Strangert. Fixes #2326.
* eap-sim-file: Remove redundant enumerator allocationTobias Brunner2017-05-261-1/+1
|
* sql: Remove redundant enumerator allocationTobias Brunner2017-05-261-1/+1
| | | | | | Interestingly, this doesn't show up in the regression tests because the compiler removes the first assignment (and thus the allocation) due to -O2 that's included in our default CFLAGS.
* Fixed some typos, courtesy of codespellTobias Brunner2017-05-264-5/+5
|
* linked-list: Change return value of find_first() and signature of its callbackTobias Brunner2017-05-2610-96/+91
| | | | This avoids the unportable five pointer hack.
* linked-list: Change interface of callback for invoke_function()Tobias Brunner2017-05-263-18/+48
| | | | This avoids the unportable five pointer hack.
* Change interface for enumerator_create_filter() callbackTobias Brunner2017-05-2614-257/+343
| | | | | This avoids the unportable 5 pointer hack, but requires enumerating in the callback.
* Migrate all enumerators to venumerate() interface changeTobias Brunner2017-05-2625-132/+256
|
* vici: Make 96-bit truncation for SHA-256 configurableTobias Brunner2017-05-261-0/+11
|
* stroke: Make 96-bit truncation for SHA-256 configurableTobias Brunner2017-05-262-1/+3
|
* android-log: Link against liblogTobias Brunner2017-05-261-0/+1
|
* child-sa: Change API used to set/install policiesTobias Brunner2017-05-231-9/+7
| | | | This way we only have to pass the traffic selectors once.
* tnc-ifmap: Null-terminate buffer to make sscanf()-calls safeTobias Brunner2017-05-231-4/+5
|
* kernel-netlink: Use total retransmit timeout as acquire timeoutTobias Brunner2017-05-232-13/+23
| | | | | | | By using the total retransmit timeout, modifications of timeout settings automatically reflect on the value of xfrm_acq_expires. If set, the value of xfrm_acq_expires configured by the user takes precedence over the calculated value.
* kernel-netlink: Try to add new inbound SA if update failsThomas Egerer2017-05-231-3/+12
| | | | | | | | | | | | | | | When establishing a traffic-triggered CHILD_SA involves the setup of an IKE_SA more than one exchange is required. As a result the temporary acquire state may have expired -- even if the acquire expiration (xfrm_acq_expires) time is set properly (165 by default). The expire message sent by the kernel is not processed in charon since no trap can be found by the trap manager. A possible solution could be to track allocated SPIs. But since this is a corner case and the tracking introduces quite a bit of overhead, it seems much more sensible to add a new state if the update of a state fails with NOT_FOUND. Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
* kernel-pfkey: Update SA addresses if supported by the kernelTobias Brunner2017-05-231-21/+16
| | | | | | Upcoming FreeBSD kernels will support updating the addresses of existing SAs with new SADB_X_EXT_NEW_ADDRESS_SRC|DST extensions for the SADB_UPDATE message.
* kernel-pfkey: Use new encap flag on Mac OS X when updating SAsTobias Brunner2017-05-231-1/+1
|
* kernel-netlink: Update hardware offload attribute when SAs are updatedTobias Brunner2017-05-231-11/+37
|
* kernel-netlink: Base SA update on correct message in multi-message responseTobias Brunner2017-05-231-7/+7
|
* vici: Make hardware offload configurableTobias Brunner2017-05-231-0/+11
|
* child-cfg: Use flags for boolean optionsTobias Brunner2017-05-236-20/+67
| | | | Makes it potentially easier to add new flags.
* kernel-netlink: Enable hardware offloading if configured for an SATobias Brunner2017-05-231-0/+25
|
* kernel-netlink: Directly handle Netlink messages if thread pool is emptyTobias Brunner2017-05-231-1/+2
| | | | | | | | | During initialization of the plugins the thread pool is not yet initialized so there is no watcher thread that could handle the queued Netlink message and the main thread will wait indefinitely for a response. Fixes #2199.
* socket-default: Add an option to force the sending interface via IP_PKTINFOMartin Willi2017-05-231-7/+48
| | | | | | | | | | | | | | | | | | | | | | | | | On Linux, setting the source address is insufficient to force a packet to be sent over a certain path. The kernel uses the best route to select the outgoing interface, even if we set a source address of a lower priority interface. This is not only true for interfaces attaching to the same subnet, but also for unrelated interfaces; the kernel (at least on 4.7) sends out the packet on whatever interface it sees fit, even if that network does not expect packets from the source address we force to. When a better interface becomes available, strongSwan sends its MOBIKE address list update using the old source address. But the kernel sends that packet over the new best interface. If that network drops packets having the unexpected source address from the old path, the MOBIKE update fails and the SA finally times out. To enforce a specific interface for our packet, we explicitly set the interface index from the interface where the source address is installed. According to ip(7), this overrules the specified source address to the primary interface address. As this could have side effects to installations using multiple addresses on a single interface, we disable the option by default for now. This also allows using IPv6 link-local addresses, which won't work if the outbound interface is not set explicitly.
* Add an option to announce support for IKE fragmentation but not sending ↵Tobias Brunner2017-05-231-0/+1
| | | | fragments
* vici: Return key ID from load-key commandTobias Brunner2017-05-232-4/+13
| | | | | We already do this for load-token and this should simplify client implementations.
* attr-sql: Make release of online leases during startup optionalTobias Brunner2017-05-191-8/+12
| | | | This cleanup prevents sharing the same DB between multiple VPN gateways.
* eap-simaka-sql: Fixed database column from use to usedAndreas Steffen2017-04-261-4/+7
|
* vici: Fix type error exception in Python bindingsodi792017-04-191-1/+1
| | | | | | | | | | Line 66 yields "TypeError: can't concat bytes to str" using Python 3.4. "requestdata" was introduced in 22f08609f1b6 but is not actually used. Since the original "request" is not used anywhere else this can be changed to be similar to the other UTF-8 encoding changes in that commit. Fixes: 22f08609f1b6 ("vici: Explicitly set the Python encoding type"). Closes strongswan/strongswan#66.
* kernel-netlink: Avoid O(n^2) copy operations when concatenating Netlink ↵Jiri Horky2017-03-271-7/+13
| | | | | | | | | | | | | | | | | | | | responses When constructing the result, all responses from Netlink were concatenated iteratively, i.e. for each response, the previously acquired result was copied to newly allocated memory and the current response appended to it. This results in O(n^2) copy operations. Instead, we now check for the total final length of the result and copy the individual responses to it in one pass, i.e. in O(n) copy operations. In particular, this issue caused very high CPU usage in memcpy() function as the result is copied over and over. Common way how to hit the issue is when having 1000+ routes and 5+ connecting clients a second. In that case, the memcpy() function can take 50%+ of one CPU thread on a decent CPU and the whole charon daemon is stuck just reading routes and concatenating them together (connecting clients are blocked in that particular case as this is done under mutex). Closes strongswan/strongswan#65. References #2055.
* addrblock: Narrow selectors when rekeying a CHILD_SA as original responderMartin Willi2017-03-241-0/+1
| | | | | | | | | | | | If a the original responder narrows the selectors of its peer in addrblock, the peer gets a subset of that selectors. However, once the original responder initiates rekeying of that CHILD_SA, it sends the full selectors to the peer, and then narrows the received selectors locally for the installation, only. This is insufficient, as the peer ends up with wider selectors, sending traffic that the original responder will reject to the stricter IPsec policy. So additionally narrow the selectors when rekeying CHILD_SAs before sending the TS list to the peer.
* kernel-wfp: Don't redefine IPPROTO_IP* if already definedTobias Brunner2017-03-231-0/+4
|
* vici: Don't fall back to uninstalling traps if a matching shunt was foundTobias Brunner2017-03-231-3/+7
| | | | | | | This is different if `ike` and `child` are provided and uninstall() fails as we call that without knowing whether a matching shunt exists. But if `ike` is not provided we explicitly search for a matching shunt and if found don't need to look for a trap policy.
* Fixed some typos, courtesy of codespellTobias Brunner2017-03-232-2/+2
|
* vici: Document how we pronounce the vici protocol and pluginMartin Willi2017-03-201-3/+3
|
* kernel: Make range of SPIs for IPsec SAs configurableTobias Brunner2017-03-022-6/+20
|
* addrblock: Use dynamic TS narrowing instead of rejecting the whole CHILD_SAMartin Willi2017-03-021-43/+28
| | | | | | | | Previously, the client had to propose no wider selectors than the certificate permits, otherwise the complete CHILD_SA was rejected. However, with IKEv2 we can dynamically narrow the selectors to what the certificate allows. This makes client and gateway configurations very simple by just proposing 0.0.0.0/0, narrowed to selectors the client is permitted to route into the network.
* addrblock: Support an optional non-strict mode accepting certs without addrblockMartin Willi2017-03-021-3/+11
| | | | | | | This allows a gateway to enforce the addrblock policy on certificates that actually have the extension only. For (legacy) certificates not having the extension, traffic selectors are validated/narrowed by other means, most likely by the configuration.
* vici: Only log messages if there actually is a listenerTobias Brunner2017-02-161-0/+7
|
* vici: Let has_event_listeners() actually check if clients are registeredTobias Brunner2017-02-161-2/+4
| | | | | Fixes: 8d96f90a7983 ("vici: Add function to test if an event should be generated")
* vici: Add support for mediation extensionTobias Brunner2017-02-161-1/+85
|
* peer-cfg: Store mediated_by as name and not peer-cfg referenceTobias Brunner2017-02-163-52/+62
| | | | | | | | | This way updates to the mediation config are respected and the order in which configs are configured/loaded does not matter. The SQL plugin currently maintains the strong relationship between mediated and mediation connection (we could theoretically change that to a string too).
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-12 10:52:37 +0000