Commit message (Collapse) | Author | Age | Files | Lines | ||
---|---|---|---|---|---|---|
... | ||||||
* | swanctl: Fix --uri option | Martin Willi | 2015-05-05 | 1 | -9/+36 | |
| | | | | | | | As we now pass the vici connection to the command dispatcher callback, we can't parse the --uri option to create the connection from the same callback. Instead pre-process the common command options in a separate loop, and ignore the same options while processing the actual command. | |||||
* | charon-tkm: Also store local SPI in SAD | Adrian-Ken Rueegsegger | 2015-05-04 | 4 | -27/+36 | |
| | ||||||
* | ike-init: Make nonceg a member of ike_init struct | Reto Buerki | 2015-05-04 | 1 | -20/+17 | |
| | | | | | | | This allows to control the life-cycle of a nonce in the context of the ike init task. In the TKM use-case the nonce generator cannot be destroyed before the ike init task is finalized, otherwise the created nonce is detected as stale. | |||||
* | child-create: Make nonceg a member of child_create struct | Reto Buerki | 2015-05-04 | 1 | -12/+16 | |
| | | | | | | | | This allows to control the life-cycle of a nonce in the context of the child create task. In the TKM use-case, it is required to reset the nonce context if the created nonce is not consumed. This happens if the child SA negotiation fails and it is detected before the SA is established via the TKM kernel plugin (i.e. rekey collision). | |||||
* | charon-tkm: Reset stale nonce contexts | Reto Buerki | 2015-05-04 | 2 | -18/+30 | |
| | | | | | | | | | | | If the nonce generator detects a stale nonce upon destroy(), it resets the context in the TKM and releases associated resources in the ID manager and chunk map. Also, do not acquire the nonce context ID in tkm_nonceg_create function but rather when the nonce is actually created by get_nonce(). The nonces created with get_nonce must also be registered in the chunk map. | |||||
* | charon-tkm: Drop unneeded nonceg get_id function | Reto Buerki | 2015-05-04 | 3 | -16/+0 | |
| | ||||||
* | charon-tkm: Remove ESA nonce mappings from chunk map | Adrian-Ken Rueegsegger | 2015-05-04 | 1 | -0/+2 | |
| | ||||||
* | charon-tkm: Drop obsolete TKM_LIMIT define | Reto Buerki | 2015-05-04 | 1 | -2/+0 | |
| | ||||||
* | charon-tkm: Select other ESA if any is present upon deletion | Adrian-Ken Rueegsegger | 2015-05-04 | 1 | -1/+12 | |
| | | | | | In the case that multiple ESAs exist (e.g. rekey collision) for a security policy, make sure to select one of the remaining ESAs. | |||||
* | charon-tkm: Add get_other_esa_id function to TKM kernel SAD | Adrian-Ken Rueegsegger | 2015-05-04 | 3 | -0/+103 | |
| | | | | | The function gets the ESA id for another entry associated with the same security policy as the specified ESA. | |||||
* | charon-tkm: Only skip creation of first child SA | Adrian-Ken Rueegsegger | 2015-05-04 | 1 | -0/+9 | |
| | | | | | | Use the new is_first boolean parameter of the ALERT_KEEP_ON_CHILD_SA_FAILURE alert to determine if the failure was caused by the first CHILD SA. | |||||
* | Add bool param to ALERT_KEEP_ON_CHILD_SA_FAILURE alert | Adrian-Ken Rueegsegger | 2015-05-04 | 2 | -3/+8 | |
| | | | | | The parameter indicates if the alert is raised upon failure to establish the first CHILD SA of an IKE SA. | |||||
* | charon-tkm: Fix SAD insertion when adding ESA | Adrian-Ken Rueegsegger | 2015-05-04 | 1 | -1/+1 | |
| | | | | | Commit f5fc592 added the reqid to the SAD. The insert call swapped the order of the esa_id and reqid parameters. | |||||
* | vici: Default to certificate subject for identity | Timo Teräs | 2015-05-04 | 1 | -0/+37 | |
| | | | | | | | | If id is not specified and certificate authentication is used, use the certificate subject name as identity. Simplifies configuration as in most cases this is the right thing to do. Signed-off-by: Timo Teräs <timo.teras@iki.fi> | |||||
* | swanctl: Implement monitoring of IKE_SA and CHILD_SA changes | Timo Teräs | 2015-05-04 | 2 | -2/+84 | |
| | | | | Signed-off-by: Timo Teräs <timo.teras@iki.fi> | |||||
* | vici: Add support for ike_sa and child_sa updown notifications | Timo Teräs | 2015-05-04 | 3 | -0/+137 | |
| | | | | | | Useful for monitoring and management purposes. Signed-off-by: Timo Teräs <timo.teras@iki.fi> | |||||
* | vici: Add function to test if an event should be generated | Timo Teräs | 2015-05-04 | 2 | -0/+74 | |
| | | | | | | | Useful to avoid generating vici messages if they are not needed and their generation is heavy operation. Signed-off-by: Timo Teräs <timo.teras@iki.fi> | |||||
* | swanctl: Add missing unit in install-time log | Romain Francoise | 2015-05-04 | 1 | -1/+1 | |
| | ||||||
* | imv_policy_manager: Added capability to execute an allow or block shell ↵ | Andreas Steffen | 2015-04-26 | 1 | -1/+21 | |
| | | | | command string | |||||
* | Fixed PB-TNC directionality debug message | Andreas Steffen | 2015-04-24 | 1 | -1/+1 | |
| | ||||||
* | ike-vendor: Add some Microsoft vendor IDs | Tobias Brunner | 2015-04-21 | 1 | -0/+10 | |
| | ||||||
* | leak-detective: Use passed callback to report leaks | Tobias Brunner | 2015-04-20 | 1 | -2/+2 | |
| | | | | | | | | This prevented `stroke memusage` from reporting the leaks on the console. Instead, they were sent to the callbacks set up by libstrongswan. Fixes a426851f6362 ("leak-detective: Use callback functions to report leaks and usage information"). | |||||
* | openssl: Don't refer to EVP_des_ecb() if OpenSSL is built without DES support | Tobias Brunner | 2015-04-17 | 1 | -0/+2 | |
| | | | | | | While DES-ECB is not registered by the plugin in this case (so the function will never actually be called), the compiler still warns about the implicitly declared function. | |||||
* | strerror: Move to its own Doxygen subgroup | Martin Willi | 2015-04-16 | 1 | -1/+2 | |
| | ||||||
* | utils: Clean up includes | Martin Willi | 2015-04-16 | 2 | -36/+31 | |
| | ||||||
* | align: Move min/max/padding/alignment functions to separate files | Martin Willi | 2015-04-16 | 6 | -109/+154 | |
| | ||||||
* | time: Move time related functions to separate files | Martin Willi | 2015-04-16 | 6 | -191/+238 | |
| | ||||||
* | object: Move OO programming helper macros to a separate header file | Martin Willi | 2015-04-16 | 3 | -107/+128 | |
| | ||||||
* | status: Move status_t type and functions to separate files | Martin Willi | 2015-04-16 | 6 | -116/+125 | |
| | ||||||
* | path: Move path related utility functions to separate files | Martin Willi | 2015-04-16 | 6 | -201/+249 | |
| | ||||||
* | tty: Move tty related functions to separate files | Martin Willi | 2015-04-16 | 6 | -110/+157 | |
| | ||||||
* | memory: Move memory manipulation related functions to separate files | Martin Willi | 2015-04-16 | 6 | -380/+424 | |
| | ||||||
* | string: Move string related utility functions to separate files | Martin Willi | 2015-04-16 | 6 | -155/+199 | |
| | ||||||
* | byteorder: Move byte order related functions to separate header file | Martin Willi | 2015-04-16 | 3 | -137/+163 | |
| | ||||||
* | types: Use generic type definitions to separate header file | Martin Willi | 2015-04-16 | 3 | -63/+89 | |
| | ||||||
* | atomics: Move atomics/recounting support to separate files | Martin Willi | 2015-04-16 | 6 | -183/+251 | |
| | ||||||
* | unit-tests: Further increase the test vector testing timeout | Martin Willi | 2015-04-16 | 1 | -1/+1 | |
| | | | | Some build bots running make check seem to have longer for the DH testing. | |||||
* | test-vectors: Define test vector symbols as extern | Martin Willi | 2015-04-16 | 1 | -7/+7 | |
| | | | | | | We don't actually define a vector, but only prototype the test vector implemented in a different file. GCC uses the correct symbol during testing, but clang correctly complains about duplicated symbols during linking. | |||||
* | Fix years in some copyright statements | Tobias Brunner | 2015-04-16 | 4 | -4/+4 | |
| | ||||||
* | aesni: Fix doxygen groups | Martin Willi | 2015-04-15 | 1 | -2/+2 | |
| | ||||||
* | kernel-netlink: Don't mangle verbosity during test initialization | Martin Willi | 2015-04-15 | 1 | -2/+0 | |
| | | | | | We now properly manage thread verbosity in the test framework, and don't need to silence thread spawning messages. | |||||
* | unit-tests: Set test verbosity just after test suite loading | Martin Willi | 2015-04-15 | 1 | -10/+9 | |
| | | | | | | We see any plugin startup messages during suite configuration, where initialization is called once to query plugin features. No need to be verbose and show these messages once again in the first test. | |||||
* | crypto-factory: Remove obsolete transform testing functions | Martin Willi | 2015-04-15 | 2 | -54/+0 | |
| | ||||||
* | unit-tests: Use progressive testing of transforms with test vectors | Martin Willi | 2015-04-15 | 1 | -7/+26 | |
| | | | | | | This allows us to show which transform from which plugin failed. Also, we use the new cleanup handler functionality that allows proper deinitialization on failure or timeout. | |||||
* | transform: Add a getter for the enum_names for a specific transform type | Martin Willi | 2015-04-15 | 2 | -0/+40 | |
| | ||||||
* | enum-names: Fail gracefully when passing a NULL value as enum names | Martin Willi | 2015-04-15 | 2 | -1/+15 | |
| | ||||||
* | crypto-factory: Add enumerator method to support individual transform testing | Martin Willi | 2015-04-15 | 2 | -0/+127 | |
| | ||||||
* | unit-tests: Invoke all registered thread cleanup handlers on test failure | Martin Willi | 2015-04-15 | 1 | -0/+3 | |
| | | | | | | | | | | | If a test fails in a timeout or a test failure, longjmp() is used to restore the thread context and handle test failure. However, there might be unreleased resources, namely locks, which prevent the library to clean up properly after finishing the test. By using thread cleanup handlers, we can release any test subject internal or test specific external resources on test failure. We do so by calling all registered cleanup handlers. | |||||
* | thread: Add a function to pop and call all registered cleanup handlers | Martin Willi | 2015-04-15 | 4 | -0/+78 | |
| | ||||||
* | thread: Don't acquire lock for thread_cleanup_push/pop | Martin Willi | 2015-04-15 | 1 | -5/+0 | |
| | | | | | This is called only by the thread for its own thread_t, and does not need synchronization. |