aboutsummaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
...
* stroke: Support public key constraints for EAP methodsMartin Willi2015-03-031-1/+8
|
* eap-ttls: Support EAP auth information getter in EAP-TTLSMartin Willi2015-03-031-0/+7
|
* eap-tls: Support EAP auth information getter in EAP-TLSMartin Willi2015-03-031-0/+7
|
* libtls: Add getters for TLS handshake authentication detailsMartin Willi2015-03-037-0/+49
|
* libtls: Merge trustchain auth verification details done during TLS handhsakeMartin Willi2015-03-032-0/+2
|
* ikev2: Merge EAP client authentication details if EAP methods provides themMartin Willi2015-03-031-0/+7
|
* eap: Add an optional authentication details getter to the EAP method interfaceMartin Willi2015-03-031-0/+12
|
* ipsec: Update rereadcacerts/aacerts command description in manpageMartin Willi2015-03-031-6/+9
|
* stroke: Serve ca section CA certificates directly, not over central CA setMartin Willi2015-03-033-5/+85
| | | | | | | This makes these CA certificates independent from the purge issued by reread commands. Certificates loaded by CA sections can be removed through ipsec.conf update/reread, while CA certificates loaded implicitly from ipsec.d/cacerts can individually be reread using ipsec rereadcacerts.
* mem-cred: Add a method to unify certificate references, without adding itMartin Willi2015-03-032-0/+31
| | | | | In contrast to add_cert_ref(), get_cert_ref() does not add the certificate to the set, but only finds a reference to the same certificate, if found.
* stroke: Purge existing CA/AA certificates during rereadMartin Willi2015-03-031-0/+4
|
* stroke: Use separate credential sets for CA/AA certificatesMartin Willi2015-03-031-3/+21
|
* stroke: Refactor load_certdir functionMartin Willi2015-03-031-108/+158
|
* vici: Don't use a default rand_time larger than half of rekey/reauth_timeMartin Willi2015-03-031-3/+11
|
* vici: If a IKE reauth_time is configured, disable the default rekey_timeMartin Willi2015-03-032-2/+19
|
* ikev2: Schedule a timeout for the delete message following passive IKE rekeyingMartin Willi2015-03-031-0/+6
| | | | | | | | | | | | | | | | | | | | | | | Under some conditions it can happen that the CREATE_CHILD_SA exchange for rekeying the IKE_SA initiated by the peer is successful, but the delete message does not follow. For example if processing takes just too long locally, the peer might consider us dead, but we won't notice that. As this leaves the old IKE_SA in IKE_REKEYING state, we currently avoid actively initiating any tasks, such as rekeying or scheduled DPD. This leaves the IKE_SA in a dead and unusable state. To avoid that situation, we schedule a timeout to wait for the DELETE message to follow the CREATE_CHILD_SA, before we actively start to delete the IKE_SA. Alternatively we could start a liveness check on the SA after a timeout to see if the peer still has that state and we can expect the delete to follow. But it is unclear if all peers can handle such messages in this very special state, so we currently don't go for that approach. While we could calculate the timeout based on the local retransmission timeout, the peer might use a different scheme, so a fixed timeout works as well. Fixes #742.
* kernel-netlink: Respect kernel routing priorities for IKE routesMartin Willi2015-03-031-2/+15
| | | | | | | | If a system uses routing metrics, we should honor them when doing (manual) routing lookups for IKE. When enumerating routes, the kernel reports priorities with the RTA_PRIORITY attribute, not RTA_METRICS. We prefer routes with a lower priority value, and fall back to longest prefix match priorities if the priority value is equal.
* enum: Extend printf hook to print flagsThomas Egerer2015-03-033-8/+286
| | | | Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
* unit-tests: Don't fail host_create_from_dns() test if IPv6 not supportedMartin Willi2015-03-021-4/+10
| | | | | On some systems, such as the Ubuntu daily build machine, localhost does not resolve to an IPv6 address. Accept such a lookup failure.
* bliss: Add generated Huffman codes to the repositoryTobias Brunner2015-03-025-14/+860
| | | | | | | | | | | | | While these files are generated they don't really change and are not architecture dependant. The previous solution prevented cross-compilation from the repository as `bliss_huffman` was built for the target system but was then executed on the build host to create the source files, which naturally was bound to fail. The `recreate-bliss-huffman` make target can be used inside the bliss directory to update the source files if needed. Fixes #812.
* Fixed a memory leak in the attribute segmentation codeAndreas Steffen2015-02-273-4/+4
|
* vici: Support ruby gem out-of-tree buildsMartin Willi2015-02-271-1/+3
| | | | | | | Referencing $(srcdir) in the gemspec is not really an option, as "gem build" includes the full path in the gem, so we need to build in $(srcdir). As there does not seem to be a way to control the output of "gem build", we manually move the gem to $(builddir) in OOT builds.
* ha: Always install the CHILD_SAs with the inbound flag set to FALSEMartin Willi2015-02-271-2/+2
| | | | | | | | | The inbound flag is used to determine if we have to install an update or a new SA in the kernel. As we do not have allocated SPIs and therefore can't update an existing SA in the HA plugin, always set the flag to FALSE. Before 698ed656 we had extra logic for that case, but handling it directly in the HA plugin is simpler.
* Updated Ubuntu 14.04 kernel versionAndreas Steffen2015-02-271-1/+1
|
* Fixed compiler warningsAndreas Steffen2015-02-271-2/+3
|
* Allow SHA256 and SHA384 data hash for BLISS signatures.Andreas Steffen2015-02-2616-42/+129
| | | | | The default is SHA512 since this hash function is also used for the c_indices random oracle.
* unit-tests: Completed BLISS testsAndreas Steffen2015-02-256-16/+668
|
* Check for null pointer before applying memwipe()Andreas Steffen2015-02-251-4/+10
|
* Implemented improved BLISS-B signature algorithmAndreas Steffen2015-02-257-47/+356
|
* host-resolver: Do not cancel threads waiting for new queries during cleanupMartin Willi2015-02-241-6/+8
| | | | | | | | | | | | | | | | While it is currently unclear why it happens, canceling threads waiting in the new_query condvar does not work as expected. The behavior is not fully reproducible: Either cancel(), join() or destroying the condvar hangs. The issue has been seen in the http-fetcher unit tests, where the stream service triggers the use of the resolver for "localhost" hosts. It is reproducible with any cleanup following a host_create_from_dns() use on a Ubuntu 14.04 x64 system. Further, the issue is related to the use of libunwind, as only builds with --enable-unwind-backtraces are affected. As we broadcast() the new_query condvar before destruction, a hard cancel() of these threads is actually not required. Instead we let these threads clean up themselves after receiving the condvar signal.
* host-resolver: Disable resolver thread cancellation by defaultMartin Willi2015-02-241-0/+3
| | | | | The default of new threads is cancellable, but the host-resolver thread code clearly expects the opposite.
* unit-tests: Add host_create_from_dns() test cases resolving "localhost"Martin Willi2015-02-241-0/+42
|
* plugin-loader: Do not unload libraries during dlclose(), if supportedMartin Willi2015-02-241-1/+9
| | | | | | | Unloading libraries calls any library constructor/destructor functions. Some libraries can't handle that in our excessive unit test use. GnuTLS leaks a /dev/urandom file descriptor, letting unit tests fail with arbitrary out-of-resources errors.
* unit-tests: Accept numerical protocol/port numbers in traffic selector testsMartin Willi2015-02-231-11/+16
|
* forecast: Explicitly cast sockaddr to fix compiler warningTobias Brunner2015-02-231-1/+1
| | | | On Travis we compile with -Werror.
* configure: Use pkg-config to detect libiptc used by connmark/forecastTobias Brunner2015-02-232-4/+4
| | | | | This ensures the library is available. On Debian/Ubuntu it is a dynamic library provided by the iptables-dev package.
* openssl: Return the proper IV length for OpenSSL cryptersTobias Brunner2015-02-231-1/+1
| | | | | | | For instance, the NULL cipher has a block size of 1 but an IV length of 0. Fixes #854.
* forecast: Add the broadcast/multicast forwarding plugin called forecastMartin Willi2015-02-208-0/+1479
|
* ipsec-types: Support the %unique mark valueMartin Willi2015-02-202-5/+15
|
* connmark: Add CONNMARK rules to select correct output SA based on conntrackMartin Willi2015-02-204-0/+611
| | | | | | | | | | | | | | Currently supports transport mode connections using IPv4 only, and requires a unique mark configured on the connection. To select the correct outbound SA when multiple connections match (i.e. multiple peers connected from the same IP address / NAT router) marks must be configured. This mark should usually be unique, which can be configured in ipsec.conf using mark=0xffffffff. The plugin inserts CONNMARK netfilter target rules: Any peer-initiated flow is tagged with the assigned mark as connmark. On the return path, the mark gets restored from the conntrack entry to select the correct outbound SA.
* bus: Add an ike_update() hook invoked when peer endpoints changeMartin Willi2015-02-204-0/+50
|
* connmark: Add a plugin stubMartin Willi2015-02-204-0/+150
|
* load-tester: Support initiating XAuth authenticationMartin Willi2015-02-201-0/+22
| | | | | | | | As with other configuration backends, XAuth is activated with a two round client authentication using pubkey and xauth. In load-tester, this is configured with initiator_auth=pubkey|xauth. Fixes #835.
* mem-pool: Pass the remote IKE address, to re-acquire() an address during reauthMartin Willi2015-02-206-51/+87
| | | | | | | | | | | With make-before-break IKEv2 re-authentication, virtual IP addresses must be assigned overlapping to the same peer. With the remote IKE address, the backend can detect re-authentication attempts by comparing the remote host address and port. This allows proper reassignment of the virtual IP if it is re-requested. This change removes the mem-pool.reassign_online option, as it is obsolete now. IPs get automatically reassigned if a peer re-requests the same address, and additionally connects from the same address and port.
* ikev2: Schedule a make-before-break completion task to delete old IKE_SAMartin Willi2015-02-208-1/+174
|
* ikev2: Allow task to skip exchange by setting undefined exchange typeMartin Willi2015-02-201-0/+5
|
* ikev2: Trigger make-before-break reauthentication instead of reauth taskMartin Willi2015-02-202-2/+79
|
* ike-sa-manager: Use IKEv1 uniqueness reauthentication detection for IKEv2, tooMartin Willi2015-02-201-12/+8
|
* attribute-handler: Pass full IKE_SA to handler backendsMartin Willi2015-02-2010-79/+61
|
* attribute-provider: Pass full IKE_SA to provider backendsMartin Willi2015-02-2010-65/+55
|
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-04 11:21:23 +0000