strongswan.git
4 years agostroke: Serve ca section CA certificates directly, not over central CA set
Martin Willi [Fri, 6 Feb 2015 11:43:33 +0000 (12:43 +0100)]
stroke: Serve ca section CA certificates directly, not over central CA set

This makes these CA certificates independent from the purge issued by reread
commands. Certificates loaded by CA sections can be removed through ipsec.conf
update/reread, while CA certificates loaded implicitly from ipsec.d/cacerts
can individually be reread using ipsec rereadcacerts.

4 years agomem-cred: Add a method to unify certificate references, without adding it
Martin Willi [Fri, 6 Feb 2015 11:34:30 +0000 (12:34 +0100)]
mem-cred: Add a method to unify certificate references, without adding it

In contrast to add_cert_ref(), get_cert_ref() does not add the certificate to
the set, but only finds a reference to the same certificate, if found.

4 years agostroke: Purge existing CA/AA certificates during reread
Martin Willi [Fri, 6 Feb 2015 11:22:32 +0000 (12:22 +0100)]
stroke: Purge existing CA/AA certificates during reread

4 years agostroke: Use separate credential sets for CA/AA certificates
Martin Willi [Fri, 6 Feb 2015 11:21:12 +0000 (12:21 +0100)]
stroke: Use separate credential sets for CA/AA certificates

4 years agostroke: Refactor load_certdir function
Martin Willi [Fri, 6 Feb 2015 10:58:17 +0000 (11:58 +0100)]
stroke: Refactor load_certdir function

4 years agovici: Don't use a default rand_time larger than half of rekey/reauth_time
Martin Willi [Tue, 3 Feb 2015 10:56:15 +0000 (11:56 +0100)]
vici: Don't use a default rand_time larger than half of rekey/reauth_time

4 years agovici: If a IKE reauth_time is configured, disable the default rekey_time
Martin Willi [Tue, 3 Feb 2015 10:53:09 +0000 (11:53 +0100)]
vici: If a IKE reauth_time is configured, disable the default rekey_time

4 years agoikev2: Schedule a timeout for the delete message following passive IKE rekeying
Martin Willi [Tue, 25 Nov 2014 13:21:34 +0000 (14:21 +0100)]
ikev2: Schedule a timeout for the delete message following passive IKE rekeying

Under some conditions it can happen that the CREATE_CHILD_SA exchange for
rekeying the IKE_SA initiated by the peer is successful, but the delete message
does not follow. For example if processing takes just too long locally, the
peer might consider us dead, but we won't notice that.

As this leaves the old IKE_SA in IKE_REKEYING state, we currently avoid actively
initiating any tasks, such as rekeying or scheduled DPD. This leaves the IKE_SA
in a dead and unusable state. To avoid that situation, we schedule a timeout
to wait for the DELETE message to follow the CREATE_CHILD_SA, before we
actively start to delete the IKE_SA.

Alternatively we could start a liveness check on the SA after a timeout to see
if the peer still has that state and we can expect the delete to follow. But
it is unclear if all peers can handle such messages in this very special state,
so we currently don't go for that approach.

While we could calculate the timeout based on the local retransmission timeout,
the peer might use a different scheme, so a fixed timeout works as well.

Fixes #742.

4 years agokernel-netlink: Respect kernel routing priorities for IKE routes
Martin Willi [Thu, 15 Jan 2015 14:05:42 +0000 (15:05 +0100)]
kernel-netlink: Respect kernel routing priorities for IKE routes

If a system uses routing metrics, we should honor them when doing (manual)
routing lookups for IKE. When enumerating routes, the kernel reports priorities
with the RTA_PRIORITY attribute, not RTA_METRICS. We prefer routes with a
lower priority value, and fall back to longest prefix match priorities if
the priority value is equal.

4 years agoenum: Extend printf hook to print flags
Thomas Egerer [Thu, 22 Jan 2015 17:23:42 +0000 (18:23 +0100)]
enum: Extend printf hook to print flags

Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
4 years agounit-tests: Don't fail host_create_from_dns() test if IPv6 not supported
Martin Willi [Mon, 2 Mar 2015 13:05:44 +0000 (14:05 +0100)]
unit-tests: Don't fail host_create_from_dns() test if IPv6 not supported

On some systems, such as the Ubuntu daily build machine, localhost does not
resolve to an IPv6 address. Accept such a lookup failure.

4 years agobliss: Add generated Huffman codes to the repository
Tobias Brunner [Tue, 17 Feb 2015 15:47:29 +0000 (16:47 +0100)]
bliss: Add generated Huffman codes to the repository

While these files are generated they don't really change and are not
architecture dependant.  The previous solution prevented cross-compilation
from the repository as `bliss_huffman` was built for the target system but
was then executed on the build host to create the source files, which
naturally was bound to fail.

The `recreate-bliss-huffman` make target can be used inside the bliss
directory to update the source files if needed.

Fixes #812.

4 years agoFixed a memory leak in the attribute segmentation code
Andreas Steffen [Fri, 27 Feb 2015 14:13:07 +0000 (15:13 +0100)]
Fixed a memory leak in the attribute segmentation code

4 years agovici: Support ruby gem out-of-tree builds
Martin Willi [Fri, 27 Feb 2015 10:40:50 +0000 (11:40 +0100)]
vici: Support ruby gem out-of-tree builds

Referencing $(srcdir) in the gemspec is not really an option, as "gem build"
includes the full path in the gem, so we need to build in $(srcdir). As there
does not seem to be a way to control the output of "gem build", we manually
move the gem to $(builddir) in OOT builds.

4 years agoha: Always install the CHILD_SAs with the inbound flag set to FALSE
Martin Willi [Fri, 27 Feb 2015 09:54:38 +0000 (10:54 +0100)]
ha: Always install the CHILD_SAs with the inbound flag set to FALSE

The inbound flag is used to determine if we have to install an update or a new
SA in the kernel. As we do not have allocated SPIs and therefore can't update
an existing SA in the HA plugin, always set the flag to FALSE.

Before 698ed656 we had extra logic for that case, but handling it directly in
the HA plugin is simpler.

4 years agoUpdated Ubuntu 14.04 kernel version
Andreas Steffen [Fri, 27 Feb 2015 07:45:37 +0000 (08:45 +0100)]
Updated Ubuntu 14.04 kernel version

4 years agoFixed compiler warnings
Andreas Steffen [Fri, 27 Feb 2015 07:44:16 +0000 (08:44 +0100)]
Fixed compiler warnings

4 years agotravis: Disable unwind backtraces regardless of LEAK_DETECTIVE option
Martin Willi [Thu, 26 Feb 2015 09:39:50 +0000 (10:39 +0100)]
travis: Disable unwind backtraces regardless of LEAK_DETECTIVE option

While d0d85683 works around a crasher related to the use of libunwind, other
build hangs have been seen in the all test cases. Try to
--disable-unwind-backtraces to see if libunwind is really related to those
and if it fixes these issues.

4 years agoVersion bump to 5.3.0dr1
Andreas Steffen [Thu, 26 Feb 2015 08:12:54 +0000 (09:12 +0100)]
Version bump to 5.3.0dr1

4 years agoAllow SHA256 and SHA384 data hash for BLISS signatures.
Andreas Steffen [Wed, 25 Feb 2015 20:12:30 +0000 (21:12 +0100)]
Allow SHA256 and SHA384 data hash for BLISS signatures.

The default is SHA512 since this hash function is also
used for the c_indices random oracle.

4 years agounit-tests: Completed BLISS tests
Andreas Steffen [Mon, 23 Feb 2015 19:28:50 +0000 (20:28 +0100)]
unit-tests: Completed BLISS tests

4 years agoCheck for null pointer before applying memwipe()
Andreas Steffen [Mon, 2 Feb 2015 10:36:14 +0000 (11:36 +0100)]
Check for null pointer before applying memwipe()

4 years agoImplemented improved BLISS-B signature algorithm
Andreas Steffen [Sat, 31 Jan 2015 01:16:15 +0000 (02:16 +0100)]
Implemented improved BLISS-B signature algorithm

4 years agohost-resolver: Do not cancel threads waiting for new queries during cleanup
Martin Willi [Tue, 24 Feb 2015 15:00:38 +0000 (16:00 +0100)]
host-resolver: Do not cancel threads waiting for new queries during cleanup

While it is currently unclear why it happens, canceling threads waiting in the
new_query condvar does not work as expected. The behavior is not fully
reproducible: Either cancel(), join() or destroying the condvar hangs.

The issue has been seen in the http-fetcher unit tests, where the stream service
triggers the use of the resolver for "localhost" hosts. It is reproducible with
any cleanup following a host_create_from_dns() use on a Ubuntu 14.04 x64 system.
Further, the issue is related to the use of libunwind, as only builds with
--enable-unwind-backtraces are affected.

As we broadcast() the new_query condvar before destruction, a hard cancel() of
these threads is actually not required. Instead we let these threads clean up
themselves after receiving the condvar signal.

4 years agohost-resolver: Disable resolver thread cancellation by default
Martin Willi [Tue, 24 Feb 2015 14:59:35 +0000 (15:59 +0100)]
host-resolver: Disable resolver thread cancellation by default

The default of new threads is cancellable, but the host-resolver thread code
clearly expects the opposite.

4 years agounit-tests: Add host_create_from_dns() test cases resolving "localhost"
Martin Willi [Tue, 24 Feb 2015 14:56:37 +0000 (15:56 +0100)]
unit-tests: Add host_create_from_dns() test cases resolving "localhost"

4 years agotravis: Disable forecast/connmark plugins in monolithic builds
Martin Willi [Tue, 24 Feb 2015 10:27:53 +0000 (11:27 +0100)]
travis: Disable forecast/connmark plugins in monolithic builds

Ubuntu 12.04 does not seem to provide a sane pkg-config for libiptc or libip4tc.
The monolithic build fails due to missing symbols, so disable it until we have
a newer Ubuntu release.

4 years agoplugin-loader: Do not unload libraries during dlclose(), if supported
Martin Willi [Tue, 24 Feb 2015 10:50:21 +0000 (11:50 +0100)]
plugin-loader: Do not unload libraries during dlclose(), if supported

Unloading libraries calls any library constructor/destructor functions. Some
libraries can't handle that in our excessive unit test use. GnuTLS leaks
a /dev/urandom file descriptor, letting unit tests fail with arbitrary
out-of-resources errors.

4 years agounit-tests: Accept numerical protocol/port numbers in traffic selector tests
Martin Willi [Mon, 23 Feb 2015 17:39:52 +0000 (18:39 +0100)]
unit-tests: Accept numerical protocol/port numbers in traffic selector tests

4 years agoforecast: Explicitly cast sockaddr to fix compiler warning
Tobias Brunner [Mon, 23 Feb 2015 11:13:56 +0000 (12:13 +0100)]
forecast: Explicitly cast sockaddr to fix compiler warning

On Travis we compile with -Werror.

4 years agoconfigure: Use pkg-config to detect libiptc used by connmark/forecast
Tobias Brunner [Mon, 23 Feb 2015 11:11:22 +0000 (12:11 +0100)]
configure: Use pkg-config to detect libiptc used by connmark/forecast

This ensures the library is available.  On Debian/Ubuntu it is a dynamic
library provided by the iptables-dev package.

4 years agoopenssl: Return the proper IV length for OpenSSL crypters
Tobias Brunner [Fri, 20 Feb 2015 12:34:04 +0000 (13:34 +0100)]
openssl: Return the proper IV length for OpenSSL crypters

For instance, the NULL cipher has a block size of 1 but an IV length
of 0.

Fixes #854.

4 years agoMerge branch 'forecast'
Martin Willi [Fri, 20 Feb 2015 15:01:44 +0000 (16:01 +0100)]
Merge branch 'forecast'

Implement a forecast plugin that supports forwarding of multi- and broadcast
messages between a LAN and clients or between connected clients. It uses
IPsec policy marks to send packets over multiple identical multi- and broadcast
policies.

4 years agoNEWS: Introduce forecast multicast/broadcast forwarding plugin
Martin Willi [Fri, 5 Dec 2014 15:12:12 +0000 (16:12 +0100)]
NEWS: Introduce forecast multicast/broadcast forwarding plugin

4 years agotesting: Add a forecast test case
Martin Willi [Thu, 18 Dec 2014 15:05:24 +0000 (16:05 +0100)]
testing: Add a forecast test case

4 years agotesting: Build forecast plugin
Martin Willi [Thu, 18 Dec 2014 15:02:45 +0000 (16:02 +0100)]
testing: Build forecast plugin

4 years agoforecast: Document strongswan.conf options
Martin Willi [Fri, 5 Dec 2014 15:07:16 +0000 (16:07 +0100)]
forecast: Document strongswan.conf options

4 years agoforecast: Add the broadcast/multicast forwarding plugin called forecast
Martin Willi [Fri, 5 Dec 2014 14:50:24 +0000 (15:50 +0100)]
forecast: Add the broadcast/multicast forwarding plugin called forecast

4 years agoMerge branch 'connmark'
Martin Willi [Fri, 20 Feb 2015 14:59:19 +0000 (15:59 +0100)]
Merge branch 'connmark'

Introduce a connmark plugin that uses Netfilter conntracks mark to select the
correct return-path SAs for client-initiated connections. This can be used
to distinguish transport mode clients behind the same NAT router.

Fixes #365.

4 years agoNEWS: Introduce connmark plugin
Martin Willi [Tue, 18 Nov 2014 10:41:44 +0000 (11:41 +0100)]
NEWS: Introduce connmark plugin

4 years agotesting: Add a connmark plugin test
Martin Willi [Tue, 18 Nov 2014 10:33:28 +0000 (11:33 +0100)]
testing: Add a connmark plugin test

In this test two hosts establish a transport mode connection from behind
moon. sun uses the connmark plugin to distinguish the flows.

This is an example that shows how one can terminate L2TP/IPsec connections
from two hosts behind the same NAT. For simplification of the test, we use
an SSH connection instead, but this works for any connection initiated flow
that conntrack can track.

4 years agotesting: Build strongSwan with the connmark plugin
Martin Willi [Mon, 17 Nov 2014 17:06:29 +0000 (18:06 +0100)]
testing: Build strongSwan with the connmark plugin

4 years agotesting: Install iptables-dev to guest images
Martin Willi [Mon, 17 Nov 2014 17:06:05 +0000 (18:06 +0100)]
testing: Install iptables-dev to guest images

4 years agotravis: Install iptables-dev for connmark plugin in "all" tests
Martin Willi [Mon, 17 Nov 2014 11:07:36 +0000 (12:07 +0100)]
travis: Install iptables-dev for connmark plugin in "all" tests

4 years agoipsec-types: Support the %unique mark value
Martin Willi [Mon, 17 Nov 2014 10:59:38 +0000 (11:59 +0100)]
ipsec-types: Support the %unique mark value

4 years agoconnmark: Add CONNMARK rules to select correct output SA based on conntrack
Martin Willi [Fri, 14 Nov 2014 11:57:53 +0000 (12:57 +0100)]
connmark: Add CONNMARK rules to select correct output SA based on conntrack

Currently supports transport mode connections using IPv4 only, and requires
a unique mark configured on the connection.

To select the correct outbound SA when multiple connections match (i.e.
multiple peers connected from the same IP address / NAT router) marks must be
configured. This mark should usually be unique, which can be configured in
ipsec.conf using mark=0xffffffff.

The plugin inserts CONNMARK netfilter target rules: Any peer-initiated flow
is tagged with the assigned mark as connmark. On the return path, the mark
gets restored from the conntrack entry to select the correct outbound SA.

4 years agobus: Add an ike_update() hook invoked when peer endpoints change
Martin Willi [Tue, 9 Dec 2014 12:20:44 +0000 (13:20 +0100)]
bus: Add an ike_update() hook invoked when peer endpoints change

4 years agoconnmark: Add a plugin stub
Martin Willi [Fri, 14 Nov 2014 10:01:45 +0000 (11:01 +0100)]
connmark: Add a plugin stub

4 years agoload-tester: Support initiating XAuth authentication
Martin Willi [Tue, 27 Jan 2015 09:40:39 +0000 (10:40 +0100)]
load-tester: Support initiating XAuth authentication

As with other configuration backends, XAuth is activated with a two round
client authentication using pubkey and xauth. In load-tester, this is configured
with initiator_auth=pubkey|xauth.

Fixes #835.

4 years agoMerge branch 'make-before-break'
Martin Willi [Wed, 4 Feb 2015 10:50:12 +0000 (11:50 +0100)]
Merge branch 'make-before-break'

Introduce an alternative make-before-break reauthentication scheme in addition
to the traditional break-before-make.

4 years agoNEWS: Introduce make-before-break reauthentication
Martin Willi [Wed, 4 Feb 2015 10:47:56 +0000 (11:47 +0100)]
NEWS: Introduce make-before-break reauthentication

4 years agotesting: Update description and test evaluation of host2host-transport-nat
Martin Willi [Wed, 12 Nov 2014 15:52:52 +0000 (16:52 +0100)]
testing: Update description and test evaluation of host2host-transport-nat

As we now reuse the reqid for identical SAs, the behavior changes for
transport connections to multiple peers behind the same NAT. Instead of
rejecting the SA, we now have two valid SAs active. For the reverse path,
however, sun sends traffic always over the newer SA, resembling the behavior
before we introduced explicit SA conflicts for different reqids.

4 years agotesting: Be a little more flexible in testing for established CHILD_SA modes
Martin Willi [Wed, 12 Nov 2014 11:09:04 +0000 (12:09 +0100)]
testing: Be a little more flexible in testing for established CHILD_SA modes

As we now print the reqid parameter in the CHILD_SA details, adapt the grep
to still match the CHILD_SA mode and protocol.

4 years agotesting: Add a test scenario for make-before-break reauth using a virtual IP
Martin Willi [Mon, 10 Nov 2014 14:36:48 +0000 (15:36 +0100)]
testing: Add a test scenario for make-before-break reauth using a virtual IP

4 years agotesting: Add a test scenario for make-before-break reauth without a virtual IP
Martin Willi [Mon, 10 Nov 2014 14:36:08 +0000 (15:36 +0100)]
testing: Add a test scenario for make-before-break reauth without a virtual IP

4 years agomem-pool: Pass the remote IKE address, to re-acquire() an address during reauth
Martin Willi [Tue, 4 Nov 2014 15:32:33 +0000 (16:32 +0100)]
mem-pool: Pass the remote IKE address, to re-acquire() an address during reauth

With make-before-break IKEv2 re-authentication, virtual IP addresses must be
assigned overlapping to the same peer. With the remote IKE address, the backend
can detect re-authentication attempts by comparing the remote host address and
port. This allows proper reassignment of the virtual IP if it is re-requested.

This change removes the mem-pool.reassign_online option, as it is obsolete now.
IPs get automatically reassigned if a peer re-requests the same address, and
additionally connects from the same address and port.

4 years agoikev2: Schedule a make-before-break completion task to delete old IKE_SA
Martin Willi [Tue, 4 Nov 2014 12:41:48 +0000 (13:41 +0100)]
ikev2: Schedule a make-before-break completion task to delete old IKE_SA

4 years agoikev2: Allow task to skip exchange by setting undefined exchange type
Martin Willi [Tue, 4 Nov 2014 12:54:29 +0000 (13:54 +0100)]
ikev2: Allow task to skip exchange by setting undefined exchange type

4 years agoikev2: Trigger make-before-break reauthentication instead of reauth task
Martin Willi [Mon, 3 Nov 2014 15:37:29 +0000 (16:37 +0100)]
ikev2: Trigger make-before-break reauthentication instead of reauth task

4 years agoMerge branch 'attr-migrate'
Martin Willi [Wed, 4 Feb 2015 10:38:58 +0000 (11:38 +0100)]
Merge branch 'attr-migrate'

Migrates the attribute framework and associated plugins from libhydra back
to libcharon. libcharon is the only user of this framework since pluto is gone.
With these changes, we can pass the full IKE_SA state to attribute providers
and handlers, bringing more flexibility to these plugins.

4 years agoike-sa-manager: Use IKEv1 uniqueness reauthentication detection for IKEv2, too
Martin Willi [Mon, 3 Nov 2014 15:00:13 +0000 (16:00 +0100)]
ike-sa-manager: Use IKEv1 uniqueness reauthentication detection for IKEv2, too

4 years agoattribute-handler: Pass full IKE_SA to handler backends
Martin Willi [Tue, 4 Nov 2014 14:53:50 +0000 (15:53 +0100)]
attribute-handler: Pass full IKE_SA to handler backends

4 years agoattribute-provider: Pass full IKE_SA to provider backends
Martin Willi [Tue, 4 Nov 2014 14:38:07 +0000 (15:38 +0100)]
attribute-provider: Pass full IKE_SA to provider backends

4 years agoattribute-manager: Pass full IKE_SA to handler methods
Martin Willi [Tue, 4 Nov 2014 14:20:41 +0000 (15:20 +0100)]
attribute-manager: Pass full IKE_SA to handler methods

4 years agoattribute-manager: Pass the full IKE_SA to provider methods
Martin Willi [Tue, 4 Nov 2014 14:11:42 +0000 (15:11 +0100)]
attribute-manager: Pass the full IKE_SA to provider methods

4 years agounit-tester: Drop the old unit-tester libcharon plugin
Martin Willi [Tue, 4 Nov 2014 14:00:15 +0000 (15:00 +0100)]
unit-tester: Drop the old unit-tester libcharon plugin

While it has some tests that we don't directly cover with the new unit tests,
most of them require special infrastructure and therefore have not been used
for a long time.

4 years agoattributes: Move the configuration attributes framework to libcharon
Martin Willi [Tue, 4 Nov 2014 13:45:34 +0000 (14:45 +0100)]
attributes: Move the configuration attributes framework to libcharon

4 years agolibcharon: Add a test runner
Martin Willi [Fri, 12 Dec 2014 11:44:32 +0000 (12:44 +0100)]
libcharon: Add a test runner

4 years agoattr-sql: Move plugin to libcharon
Martin Willi [Tue, 4 Nov 2014 13:22:20 +0000 (14:22 +0100)]
attr-sql: Move plugin to libcharon

4 years agoMerge branch 'tkm-reqid-alloc'
Martin Willi [Wed, 4 Feb 2015 10:31:47 +0000 (11:31 +0100)]
Merge branch 'tkm-reqid-alloc'

Fixes expires raised by charon-tkm to actually use a proto/dst/SPI tuple to
identify CHILD_SAs.

4 years agoattr: Move plugin to libcharon
Martin Willi [Tue, 4 Nov 2014 13:19:03 +0000 (14:19 +0100)]
attr: Move plugin to libcharon

4 years agotesting: Add tkm xfrmproxy-expire test
Reto Buerki [Thu, 18 Dec 2014 10:49:05 +0000 (11:49 +0100)]
testing: Add tkm xfrmproxy-expire test

This test asserts that the handling of XFRM expire messages from the
kernel are handled correctly by the xfrm-proxy and the Esa Event Service
(EES) in charon-tkm.

4 years agoresolve: Move plugin back to libcharon
Martin Willi [Tue, 4 Nov 2014 13:13:34 +0000 (14:13 +0100)]
resolve: Move plugin back to libcharon

Since pluto is gone, all existing users build upon libcharon.

4 years agotesting: Assert ees acquire messages in xfrmproxy tests
Reto Buerki [Thu, 18 Dec 2014 09:43:42 +0000 (10:43 +0100)]
testing: Assert ees acquire messages in xfrmproxy tests

4 years agocharon-tkm: Use get_dst_host getter in EES callback
Reto Buerki [Fri, 19 Dec 2014 08:11:12 +0000 (09:11 +0100)]
charon-tkm: Use get_dst_host getter in EES callback

Use the new get_dst_host getter to retrieve the destination host from
the SAD using the reqid, spi and protocol values received from the
xfrm-proxy.

4 years agocharon-tkm: Add get_dst_host getter to SAD
Reto Buerki [Fri, 19 Dec 2014 07:54:22 +0000 (08:54 +0100)]
charon-tkm: Add get_dst_host getter to SAD

This function returns the destination host of an SAD entry for given
reqid, spi and protocol arguments or NULL if not found.

4 years agocharon-tkm: Improve SAD get_esa_id log messages
Reto Buerki [Fri, 19 Dec 2014 07:52:19 +0000 (08:52 +0100)]
charon-tkm: Improve SAD get_esa_id log messages

4 years agocharon-tkm: Store reqid in SAD
Reto Buerki [Thu, 18 Dec 2014 16:58:26 +0000 (17:58 +0100)]
charon-tkm: Store reqid in SAD

4 years agocharon-tkm: Store remote SPI in SAD
Reto Buerki [Thu, 18 Dec 2014 15:49:16 +0000 (16:49 +0100)]
charon-tkm: Store remote SPI in SAD

Store the remote instead of the local SPI in the SAD when adding a new
entry in the kernel plugin's add_sa() function.

Since only one ESA context must be destroyed for an inbound/outbound
CHILD SA pair, it does not matter which SPI is used to retrieve it in
the del_sa function.

4 years agocharon-tkm: Make CHILD/ESP SA database public
Reto Buerki [Thu, 18 Dec 2014 15:24:07 +0000 (16:24 +0100)]
charon-tkm: Make CHILD/ESP SA database public

Make the CHILD/ESP SA database a public member of the global tkm_t
struct.

4 years agoMerge branch 'reqid-alloc'
Martin Willi [Thu, 19 Feb 2015 17:18:51 +0000 (18:18 +0100)]
Merge branch 'reqid-alloc'

With these changes, charon dynamically allocates reqids for CHILD_SAs. This
allows the reuse of reqids for identical policies, and basically allows multiple
CHILD_SAs with the same selectors. As reqids do not uniquely define a CHILD_SA,
a new unique identifier for CHILD_SAs is introduced, and the kernel backends
use a proto/dst/SPI tuple to identify CHILD_SAs.

charon-tkm is not yet updated and expires are actually broken with this merge.
As some significant refactorings are required, this is fixed using a separate
merge.

References #422, #431, #463.

4 years agocharon-tkm: Fix logger entity name in tests.c
Reto Buerki [Thu, 18 Dec 2014 15:16:49 +0000 (16:16 +0100)]
charon-tkm: Fix logger entity name in tests.c

Change 'test_runner' to 'test-runner'.

4 years agoike: Consistently log CHILD_SAs with their unique_id instead of their reqid
Martin Willi [Tue, 28 Oct 2014 09:54:38 +0000 (10:54 +0100)]
ike: Consistently log CHILD_SAs with their unique_id instead of their reqid

4 years agotesting: Assert proper ESA deletion
Reto Buerki [Thu, 18 Dec 2014 16:32:09 +0000 (17:32 +0100)]
testing: Assert proper ESA deletion

Extend the tkm/host2host-initiator testcase by asserting proper ESA
deletion after connection shutdown.

4 years agounity: Reference IKE_SAs by the IKEv1 COOKIEs, improving lookup performance
Martin Willi [Mon, 27 Oct 2014 15:16:13 +0000 (16:16 +0100)]
unity: Reference IKE_SAs by the IKEv1 COOKIEs, improving lookup performance

When handling thousands of IKE_SAs, the unique ID based lookup is rather slow,
as we have no indexing.

4 years agoike-sa-manager: Remove IKE_SA checkout by CHILD_SA reqid
Martin Willi [Mon, 27 Oct 2014 15:08:59 +0000 (16:08 +0100)]
ike-sa-manager: Remove IKE_SA checkout by CHILD_SA reqid

4 years agomigrate-job: Do CHILD_SA reqid lookup locally
Martin Willi [Mon, 27 Oct 2014 15:03:05 +0000 (16:03 +0100)]
migrate-job: Do CHILD_SA reqid lookup locally

4 years agokernel-interface: Raise mapping event with a proto/SPI/dst tuple
Martin Willi [Mon, 27 Oct 2014 14:38:47 +0000 (15:38 +0100)]
kernel-interface: Raise mapping event with a proto/SPI/dst tuple

4 years agoinactivity-job: Schedule job by CHILD_SA unique ID instead of reqid
Martin Willi [Mon, 27 Oct 2014 14:19:09 +0000 (15:19 +0100)]
inactivity-job: Schedule job by CHILD_SA unique ID instead of reqid

4 years agocharon-tkm: Fix compilation of ees_callback.c
Reto Buerki [Mon, 17 Nov 2014 14:15:19 +0000 (15:15 +0100)]
charon-tkm: Fix compilation of ees_callback.c

Update the call to hydra->kernel_interface->expire to make
ees_callback.c compile again. The required destination host argument is
set to NULL for now.

4 years agokernel-interface: Raise expires with a proto/SPI/dst tuple instead of reqid
Martin Willi [Mon, 27 Oct 2014 14:07:05 +0000 (15:07 +0100)]
kernel-interface: Raise expires with a proto/SPI/dst tuple instead of reqid

4 years agocontroller: Use the CHILD_SA unique_id to terminate CHILD_SAs
Martin Willi [Mon, 27 Oct 2014 13:03:32 +0000 (14:03 +0100)]
controller: Use the CHILD_SA unique_id to terminate CHILD_SAs

4 years agoswanctl: List CHILD_SA unique ID as the primary identifier, but print reqid, too
Martin Willi [Mon, 27 Oct 2014 12:54:51 +0000 (13:54 +0100)]
swanctl: List CHILD_SA unique ID as the primary identifier, but print reqid, too

4 years agostroke: List CHILD_SA unique ID as the primary identifier, but print reqid, too
Martin Willi [Mon, 27 Oct 2014 13:07:14 +0000 (14:07 +0100)]
stroke: List CHILD_SA unique ID as the primary identifier, but print reqid, too

4 years agovici: Include the CHILD_SA unique ID in list-sa event
Martin Willi [Mon, 27 Oct 2014 12:51:59 +0000 (13:51 +0100)]
vici: Include the CHILD_SA unique ID in list-sa event

4 years agoike: Maintain per-IKE_SA CHILD_SAs in the global CHILD_SA manager
Martin Willi [Thu, 23 Oct 2014 14:52:25 +0000 (16:52 +0200)]
ike: Maintain per-IKE_SA CHILD_SAs in the global CHILD_SA manager

4 years agochild-sa-manager: Add a global manager storing CHILD_SA relations
Martin Willi [Thu, 23 Oct 2014 13:42:21 +0000 (15:42 +0200)]
child-sa-manager: Add a global manager storing CHILD_SA relations

To quickly check out IKE_SAs and find associated CHILD_SAs, the
child_sa_manager stores relations between CHILD_SAs and IKE_SAs. It provides
CHILD_SA specific IKE_SA checkout functions wrapping the ike_sa_manager.

4 years agochild-sa: Replace reqid based marks by "unique" marks
Martin Willi [Thu, 13 Nov 2014 14:26:10 +0000 (15:26 +0100)]
child-sa: Replace reqid based marks by "unique" marks

As we now use the same reqid for multiple CHILD_SAs with the same selectors,
having marks based on the reqid makes not that much sense anymore. Instead we
use unique marks that use a custom identifier. This identifier is reused during
rekeying, keeping the marks constant for any rule relying on it (for example
installed by updown).

This also simplifies handling of reqid allocation, as we do not have to query
the marks that is not yet assigned for an unknown reqid.

4 years agochild-sa: Introduce a unique CHILD_SA identifier
Martin Willi [Thu, 23 Oct 2014 09:27:25 +0000 (11:27 +0200)]
child-sa: Introduce a unique CHILD_SA identifier

As the reqid is not that unique even among multiple IKE_SAs anymore, we need
an identifier to uniquely identify a specific CHILD_SA instance.

4 years agochild-sa: Delegate reqid allocation to the kernel interface
Martin Willi [Tue, 21 Oct 2014 09:36:18 +0000 (11:36 +0200)]
child-sa: Delegate reqid allocation to the kernel interface