strongswan.git
6 years agoosx-attr: add plugin installing config attributes using SystemConfiguration
Martin Willi [Wed, 15 May 2013 13:56:17 +0000 (15:56 +0200)]
osx-attr: add plugin installing config attributes using SystemConfiguration

Currently installs DNS servers only, by prepending IP addresses to the
DNS configuration of the primary networking service.

6 years agokernel-pfroute: Simplify route lookup after fixing sockaddr parsing
Tobias Brunner [Tue, 18 Jun 2013 16:06:46 +0000 (18:06 +0200)]
kernel-pfroute: Simplify route lookup after fixing sockaddr parsing

6 years agokernel-pfroute: Alignment of sockaddrs is not always the same
Tobias Brunner [Tue, 18 Jun 2013 15:50:51 +0000 (17:50 +0200)]
kernel-pfroute: Alignment of sockaddrs is not always the same

6 years agokernel-pfroute: struct sockaddr arguments are 4 byte aligned
Tobias Brunner [Tue, 18 Jun 2013 14:55:03 +0000 (16:55 +0200)]
kernel-pfroute: struct sockaddr arguments are 4 byte aligned

This was noticed on Mac OS X where, if the default route is returned,
RTA_NETMASK has sa_len set to 0, but skipping zero bytes to read the
next address makes no sense, of course.  Using 0 for sa_len seems
a bit strange, in particular, because struct sockaddr has by definition
a minimum length of 16 bytes.  But it seems FreeBSD actually does the
same.

6 years agokernel-libipsec: Ignore failures when installing routes for multicast or broadcast...
Tobias Brunner [Mon, 17 Jun 2013 19:51:23 +0000 (21:51 +0200)]
kernel-libipsec: Ignore failures when installing routes for multicast or broadcast policies

6 years agokernel-pfroute: Improve route lookup depending on information we get back
Tobias Brunner [Mon, 17 Jun 2013 13:56:44 +0000 (15:56 +0200)]
kernel-pfroute: Improve route lookup depending on information we get back

Kernels don't provide the same information for all routes.

6 years agokernel-pfroute: Try to ensure we get a source address or interface name
Tobias Brunner [Mon, 17 Jun 2013 13:38:35 +0000 (15:38 +0200)]
kernel-pfroute: Try to ensure we get a source address or interface name

6 years agoike: Force NAT-T/UDP encapsulation if kernel interface requires it
Tobias Brunner [Mon, 17 Jun 2013 08:23:04 +0000 (10:23 +0200)]
ike: Force NAT-T/UDP encapsulation if kernel interface requires it

6 years agokernel-libipsec: Add a feature to request UDP encapsulation of ESP packets
Tobias Brunner [Mon, 17 Jun 2013 08:13:56 +0000 (10:13 +0200)]
kernel-libipsec: Add a feature to request UDP encapsulation of ESP packets

6 years agotun-device: Packets sent over utun devices on Mac OS X have the protocol family prepended
Tobias Brunner [Sun, 16 Jun 2013 18:05:08 +0000 (20:05 +0200)]
tun-device: Packets sent over utun devices on Mac OS X have the protocol family prepended

6 years agokernel-pfroute: Use DST as nexthop for host routes
Tobias Brunner [Sun, 16 Jun 2013 16:59:13 +0000 (18:59 +0200)]
kernel-pfroute: Use DST as nexthop for host routes

These are created as cache/clone on Mac OS X.

6 years agokernel-pfroute: Implement get_source_addr()
Tobias Brunner [Sun, 16 Jun 2013 09:40:16 +0000 (11:40 +0200)]
kernel-pfroute: Implement get_source_addr()

6 years agokernel-pfroute: Properly install routes with interface and gateway
Tobias Brunner [Sun, 16 Jun 2013 08:49:25 +0000 (10:49 +0200)]
kernel-pfroute: Properly install routes with interface and gateway

6 years agokernel-libipsec: Install a gateway for routes on platforms other than Linux
Tobias Brunner [Sun, 16 Jun 2013 08:47:39 +0000 (10:47 +0200)]
kernel-libipsec: Install a gateway for routes on platforms other than Linux

This seems required e.g. on FreeBSD but doesn't work on Linux.

6 years agokernel-pfroute: Activate TUN device before setting address
Tobias Brunner [Sat, 15 Jun 2013 16:56:11 +0000 (18:56 +0200)]
kernel-pfroute: Activate TUN device before setting address

On FreeBSD, for some reason, we don't learn the interface is up
otherwise.  Even though ifconfig lists it as up at the same time.

6 years agotun-device: Avoid opening /dev/tunX multiple times (e.g. on FreeBSD)
Tobias Brunner [Sat, 15 Jun 2013 15:46:25 +0000 (17:46 +0200)]
tun-device: Avoid opening /dev/tunX multiple times (e.g. on FreeBSD)

6 years agokernel-libipsec: Router reads packets from multiple TUN devices
Tobias Brunner [Sat, 15 Jun 2013 14:21:08 +0000 (16:21 +0200)]
kernel-libipsec: Router reads packets from multiple TUN devices

These devices are collected via kernel_listener_t interface.

6 years agokernel-libipsec: Use separate class to route packets between charon, libipsec and...
Tobias Brunner [Sat, 15 Jun 2013 12:21:34 +0000 (14:21 +0200)]
kernel-libipsec: Use separate class to route packets between charon, libipsec and TUN device

6 years agokernel-pfroute: Raise tun event when creating/destroying TUN devices for virtual IPs
Tobias Brunner [Thu, 13 Jun 2013 15:51:16 +0000 (17:51 +0200)]
kernel-pfroute: Raise tun event when creating/destroying TUN devices for virtual IPs

6 years agokernel: Add an event kernel interfaces can raise if they create/destroy a TUN device
Tobias Brunner [Thu, 13 Jun 2013 15:03:17 +0000 (17:03 +0200)]
kernel: Add an event kernel interfaces can raise if they create/destroy a TUN device

6 years agoprintf-hook: Avoid double-free when freeing Vstr config
Tobias Brunner [Wed, 12 Jun 2013 14:13:32 +0000 (16:13 +0200)]
printf-hook: Avoid double-free when freeing Vstr config

Thread-specific objects get freed when the thread value object is
destroyed (wasn't the case earlier, i.e. before 2b19dd35), which
may cause the second call to vstr_free_conf() to fail in an assert
in Vstr (depending on how it was built).

6 years agokernel-libipsec: Track policies and automatically install routes
Tobias Brunner [Tue, 11 Jun 2013 16:53:28 +0000 (18:53 +0200)]
kernel-libipsec: Track policies and automatically install routes

The routes direct traffic matching the remote traffic selector to the
TUN device.

If the remote traffic selector includes the IKE peer a very specific route
is installed to allow IKE traffic.

6 years agokernel-libipsec: Handle packets between charon socket, libipsec and TUN device
Tobias Brunner [Tue, 11 Jun 2013 16:52:23 +0000 (18:52 +0200)]
kernel-libipsec: Handle packets between charon socket, libipsec and TUN device

6 years agokernel-libipsec: Create a TUN device and use it to install virtual IPs
Tobias Brunner [Tue, 11 Jun 2013 16:47:55 +0000 (18:47 +0200)]
kernel-libipsec: Create a TUN device and use it to install virtual IPs

6 years agokernel-libipsec: Add plugin that implements kernel_ipsec_t using libipsec
Tobias Brunner [Tue, 11 Jun 2013 16:43:01 +0000 (18:43 +0200)]
kernel-libipsec: Add plugin that implements kernel_ipsec_t using libipsec

6 years agokernel-netlink: Routes don't require a gateway/nexthop
Tobias Brunner [Tue, 11 Jun 2013 14:05:40 +0000 (16:05 +0200)]
kernel-netlink: Routes don't require a gateway/nexthop

6 years agocharon-cmd: Document auxiliary options
Tobias Brunner [Fri, 21 Jun 2013 14:58:16 +0000 (16:58 +0200)]
charon-cmd: Document auxiliary options

6 years agocharon-cmd: Link strongswan.conf(5) and charon-cmd(8) man pages
Tobias Brunner [Fri, 21 Jun 2013 14:35:19 +0000 (16:35 +0200)]
charon-cmd: Link strongswan.conf(5) and charon-cmd(8) man pages

6 years agocharon-cmd: Use fixed number of character to align command descriptions
Tobias Brunner [Thu, 20 Jun 2013 20:01:42 +0000 (22:01 +0200)]
charon-cmd: Use fixed number of character to align command descriptions

If the command and argument is longer than that write the first line of
description to the following line.

6 years agocharon-cmd: Shortened and fixed command descriptions
Tobias Brunner [Thu, 20 Jun 2013 19:54:11 +0000 (21:54 +0200)]
charon-cmd: Shortened and fixed command descriptions

6 years agocharon-cmd: Simplify usage output for authentication profiles
Tobias Brunner [Thu, 20 Jun 2013 19:35:34 +0000 (21:35 +0200)]
charon-cmd: Simplify usage output for authentication profiles

The man page describes the min full.

6 years agocharon-cmd: Add Aggressive Mode profiles to man page
Tobias Brunner [Thu, 20 Jun 2013 19:15:56 +0000 (21:15 +0200)]
charon-cmd: Add Aggressive Mode profiles to man page

6 years agocharon-cmd: Add man page for charon-cmd(8)
Tobias Brunner [Sun, 16 Jun 2013 17:06:40 +0000 (19:06 +0200)]
charon-cmd: Add man page for charon-cmd(8)

6 years agocharon-cmd: Add --debug argument to set the default log level
Tobias Brunner [Fri, 21 Jun 2013 13:55:52 +0000 (15:55 +0200)]
charon-cmd: Add --debug argument to set the default log level

6 years agocharon-cmd: Handle simple command line arguments like --help before the others
Tobias Brunner [Fri, 21 Jun 2013 13:41:12 +0000 (15:41 +0200)]
charon-cmd: Handle simple command line arguments like --help before the others

6 years agoplugin-loader: Move logging of failed features to status()
Tobias Brunner [Fri, 21 Jun 2013 12:46:17 +0000 (14:46 +0200)]
plugin-loader: Move logging of failed features to status()

Still log an error message if critical features fail, as loaded
plugins/features are not logged in that case.

This way loaded plugins are printed before failed features and
the relation is easier to make for users.  It also allows programs
to log this message on a different level.

6 years agoplugin-loader: Add method to print loaded plugins on a given log level
Tobias Brunner [Fri, 21 Jun 2013 12:45:38 +0000 (14:45 +0200)]
plugin-loader: Add method to print loaded plugins on a given log level

6 years agoplugin-loader: Collect statistics while loading features, print them in case features...
Tobias Brunner [Thu, 20 Jun 2013 18:49:42 +0000 (20:49 +0200)]
plugin-loader: Collect statistics while loading features, print them in case features failed to load

There is no need to explicitly search for failed features in critical
plugins as this is now detected while loading the features.

6 years agoplugin-loader: Use different log level if failed feature is in critical plugin
Tobias Brunner [Thu, 20 Jun 2013 18:36:15 +0000 (20:36 +0200)]
plugin-loader: Use different log level if failed feature is in critical plugin

6 years agoplugin-loader: Log message when failing to load plugin
Tobias Brunner [Thu, 20 Jun 2013 18:33:53 +0000 (20:33 +0200)]
plugin-loader: Log message when failing to load plugin

6 years agoplugin-loader: Reduce verbosity while loading plugins
Tobias Brunner [Thu, 20 Jun 2013 18:27:45 +0000 (20:27 +0200)]
plugin-loader: Reduce verbosity while loading plugins

6 years agoFix crash if the initiator has no suitable proposal available
Tobias Brunner [Fri, 26 Apr 2013 13:36:42 +0000 (15:36 +0200)]
Fix crash if the initiator has no suitable proposal available

Could be triggered with a typo in the ike or esp options when ! is used.

6 years agoMerge branch 'unit-tests-ecdsa'
Martin Willi [Fri, 21 Jun 2013 08:39:16 +0000 (10:39 +0200)]
Merge branch 'unit-tests-ecdsa'

Adds support for testing plugin functionality to test-runner. Introduces some
good/bad tests for ECDSA/RSA which would have caught those RSA/ECDSA signature
vulnerabilities.

6 years agoleak-detective: (re-)whitelist some OpenSSL functions
Martin Willi [Thu, 20 Jun 2013 08:06:07 +0000 (10:06 +0200)]
leak-detective: (re-)whitelist some OpenSSL functions

Some static allocations in plugins won't get freed, because in the test case
process the plugins are not destroyed. If a plugin would clean up allocations
done while just using the plugin, these show up as leak in the child process,
letting tests fail.

6 years agounit-tests: load plugins in test-runner from build directory
Martin Willi [Thu, 20 Jun 2013 07:34:18 +0000 (09:34 +0200)]
unit-tests: load plugins in test-runner from build directory

6 years agounit-tests: link test-runner against -lpthread
Martin Willi [Wed, 19 Jun 2013 13:37:49 +0000 (15:37 +0200)]
unit-tests: link test-runner against -lpthread

6 years agounit-tester: remove obsolete rsa_gen test, now covered in unit-tests
Martin Willi [Wed, 19 Jun 2013 13:50:04 +0000 (15:50 +0200)]
unit-tester: remove obsolete rsa_gen test, now covered in unit-tests

6 years agounit-tests: add RSA test cases, very similar to ECDSA
Martin Willi [Wed, 19 Jun 2013 13:33:47 +0000 (15:33 +0200)]
unit-tests: add RSA test cases, very similar to ECDSA

6 years agounit-tests: test with /dev/urandom if random plugin is in use
Martin Willi [Wed, 19 Jun 2013 13:32:19 +0000 (15:32 +0200)]
unit-tests: test with /dev/urandom if random plugin is in use

6 years agounit-tests: test supported ECDSA schemes only
Martin Willi [Wed, 19 Jun 2013 13:31:25 +0000 (15:31 +0200)]
unit-tests: test supported ECDSA schemes only

6 years agoMove test-runners has_feature() function to plugin loader
Martin Willi [Wed, 19 Jun 2013 12:52:52 +0000 (14:52 +0200)]
Move test-runners has_feature() function to plugin loader

6 years agounit-tests: enforce CET/CEST timezone to properly test non-UTC time formatting
Martin Willi [Tue, 11 Jun 2013 16:31:35 +0000 (18:31 +0200)]
unit-tests: enforce CET/CEST timezone to properly test non-UTC time formatting

6 years agounit-tests: don't use ck_assert() to test a cleared chunk, as it allocates data
Martin Willi [Tue, 11 Jun 2013 16:29:49 +0000 (18:29 +0200)]
unit-tests: don't use ck_assert() to test a cleared chunk, as it allocates data

The new allocation might be in the freed area, affecting the test result.

6 years agounit-tests: define 64-bit constats with ULL, fixing compiler warning on 32-bit
Martin Willi [Tue, 11 Jun 2013 15:45:45 +0000 (17:45 +0200)]
unit-tests: define 64-bit constats with ULL, fixing compiler warning on 32-bit

6 years agoLimit cleanup of .gc{no,da} files to src and scripts subfolders
Martin Willi [Tue, 11 Jun 2013 15:27:40 +0000 (17:27 +0200)]
Limit cleanup of .gc{no,da} files to src and scripts subfolders

Other folders in the build tree might not be related to the strongSwan tree,
or are not even accessible.

6 years agounit-tests: test some zeroed ECDSA signatures that never should succeed
Martin Willi [Tue, 9 Apr 2013 14:00:19 +0000 (16:00 +0200)]
unit-tests: test some zeroed ECDSA signatures that never should succeed

6 years agounit-tests: perform signing/validation with keys ECDSA keys generated or loaded
Martin Willi [Tue, 9 Apr 2013 13:49:09 +0000 (15:49 +0200)]
unit-tests: perform signing/validation with keys ECDSA keys generated or loaded

6 years agounit-tests: add an ECDSA test case loading keys
Martin Willi [Tue, 9 Apr 2013 13:31:43 +0000 (15:31 +0200)]
unit-tests: add an ECDSA test case loading keys

6 years agounit-tests: perform a first ECDSA test case if ECDSA is supported
Martin Willi [Tue, 9 Apr 2013 13:06:28 +0000 (15:06 +0200)]
unit-tests: perform a first ECDSA test case if ECDSA is supported

6 years agounit-tests: add a helper function checking if a plugin feature is available
Martin Willi [Tue, 9 Apr 2013 13:05:24 +0000 (15:05 +0200)]
unit-tests: add a helper function checking if a plugin feature is available

6 years agounit-tests: add a test case checking if all test vectors have been passed
Martin Willi [Tue, 9 Apr 2013 12:35:38 +0000 (14:35 +0200)]
unit-tests: add a test case checking if all test vectors have been passed

6 years agocrypto-factory: count the number of test vector failures during registration
Martin Willi [Tue, 9 Apr 2013 12:30:13 +0000 (14:30 +0200)]
crypto-factory: count the number of test vector failures during registration

6 years agounit-tests: load all libstrongswan plugins in test-runner
Martin Willi [Tue, 9 Apr 2013 12:05:12 +0000 (14:05 +0200)]
unit-tests: load all libstrongswan plugins in test-runner

6 years agostroke: Add statusall-nb as alias for statusallnb
Tobias Brunner [Fri, 21 Jun 2013 08:43:46 +0000 (10:43 +0200)]
stroke: Add statusall-nb as alias for statusallnb

6 years agostroke: Add non-blocking versions of up and down
Tobias Brunner [Sun, 16 Jun 2013 14:30:21 +0000 (16:30 +0200)]
stroke: Add non-blocking versions of up and down

stroke up-nb and stroke down-nb do not block until the command has
finished.  Instead, they return right after initiating the respective
operation.

6 years agostarter: Make ipsec.conf path configurable via command line
Tobias Brunner [Thu, 13 Jun 2013 17:07:55 +0000 (19:07 +0200)]
starter: Make ipsec.conf path configurable via command line

6 years agopubkey: Improve comparison of raw public key certificate objects
Tobias Brunner [Wed, 5 Jun 2013 09:30:05 +0000 (11:30 +0200)]
pubkey: Improve comparison of raw public key certificate objects

6 years agoikev2: use protocol of selected proposal to delete a failed CHILD_SA
Martin Willi [Thu, 20 Jun 2013 10:05:13 +0000 (12:05 +0200)]
ikev2: use protocol of selected proposal to delete a failed CHILD_SA

Depending on the failure, the protocol might not yet be set on the CHILD_SA.

6 years agocharon-cmd: use a copy of pid in initiate callback
Martin Willi [Thu, 20 Jun 2013 09:02:28 +0000 (11:02 +0200)]
charon-cmd: use a copy of pid in initiate callback

When cancelling a connection that gets established, cmd_connection_t gets
freed before terminate() is called. This results in kill()ing invalid PID.

6 years agocharon-cmd: add IKEv1 aggressive mode profiles
Martin Willi [Thu, 20 Jun 2013 09:01:37 +0000 (11:01 +0200)]
charon-cmd: add IKEv1 aggressive mode profiles

6 years agoNEWS: Add first bunch of 5.1.0 highlights
Martin Willi [Thu, 20 Jun 2013 08:29:25 +0000 (10:29 +0200)]
NEWS: Add first bunch of 5.1.0 highlights

6 years agoMerge branch 'nat-transport'
Martin Willi [Wed, 19 Jun 2013 14:36:27 +0000 (16:36 +0200)]
Merge branch 'nat-transport'

Enable transport mode in NAT situations when using IKEv2. Additionally brings
an extended leftsubnet format, where each subnet can take a separate protocol
and port.

6 years agoman: update ipsec.conf.5, describing new proto/port definition within leftsubnet
Martin Willi [Wed, 5 Jun 2013 10:03:22 +0000 (12:03 +0200)]
man: update ipsec.conf.5, describing new proto/port definition within leftsubnet

6 years agostroke: support %dynamic in left/rightsubnet for dynamic selectors
Martin Willi [Wed, 5 Jun 2013 09:43:19 +0000 (11:43 +0200)]
stroke: support %dynamic in left/rightsubnet for dynamic selectors

This has the same meaning as omitting left/rightsubnet, i.e. replace it
by the IKE address. Supporting %dynamic allows configurations with multiple
dynamic selectors in a left/rightsubnet, each with potentially different
proto/port selectors.

6 years agokernel-netlink: install selectors on SA for transport/BEET mode without proto/port
Martin Willi [Wed, 5 Jun 2013 09:39:35 +0000 (11:39 +0200)]
kernel-netlink: install selectors on SA for transport/BEET mode without proto/port

If a transport/BEET SA has different selectors for different proto/ports,
installing just the proto/port of the first SA would break any additional
selector.

6 years agostroke: support a specific proto/port for each net defined in left/rightsubnet
Martin Willi [Wed, 5 Jun 2013 09:38:51 +0000 (11:38 +0200)]
stroke: support a specific proto/port for each net defined in left/rightsubnet

6 years agoikev2: properly fall back to tunnel mode if transport/BEET mode not configured
Martin Willi [Wed, 5 Jun 2013 08:48:57 +0000 (10:48 +0200)]
ikev2: properly fall back to tunnel mode if transport/BEET mode not configured

6 years agoikev2: support transport mode over NAT
Martin Willi [Wed, 5 Jun 2013 07:46:02 +0000 (09:46 +0200)]
ikev2: support transport mode over NAT

6 years agoMerge branch 'consistent-reqid'
Martin Willi [Wed, 19 Jun 2013 14:31:06 +0000 (16:31 +0200)]
Merge branch 'consistent-reqid'

Checks if a trap policy exists when installing a CHILD_SA as responder,
reuse that reqid and keeping the trap untouched. This makes auto=route on
both sides more reliable.

In addition, we no prevent to refcount an existing policy if the reqid differs;
this should not happen anymore. We now can properly reject new CHILD_SAs in
such conflicts, instead of silently breaking an existing policy.

6 years agoike: reuse the reqid of an installed trap having the same config
Martin Willi [Tue, 11 Jun 2013 14:11:14 +0000 (16:11 +0200)]
ike: reuse the reqid of an installed trap having the same config

When we have a trap installed, but a CHILD_SA gets established for the same
config from the peer, we should reuse the same reqid. Otherwise we would have
two identical policies using different reqids, what we can't handle in our
kernel backend.

6 years agotrap-manager: add a method to find reqid for installed traps by config
Martin Willi [Wed, 5 Jun 2013 12:20:44 +0000 (14:20 +0200)]
trap-manager: add a method to find reqid for installed traps by config

6 years agotrap-manager: don't check-in nonexisting IKE_SA if acquire fails
Martin Willi [Thu, 6 Jun 2013 08:54:06 +0000 (10:54 +0200)]
trap-manager: don't check-in nonexisting IKE_SA if acquire fails

6 years agotrap-manager: fix a memleak when installing a trap to %any
Martin Willi [Wed, 5 Jun 2013 12:36:44 +0000 (14:36 +0200)]
trap-manager: fix a memleak when installing a trap to %any

6 years agokernel-netlink: reject policy refcount if the reqid differs
Martin Willi [Mon, 3 Jun 2013 16:13:27 +0000 (18:13 +0200)]
kernel-netlink: reject policy refcount if the reqid differs

Previously we silently replaced an existing policy with a new one if the
reqid changed for the same selectors. This will break an old policy in the
favour of the new one (for example if two clients behind the same NAT use
transport mode).

With this change any new policy gets rejected if the reqid differs. This will
make sure we break no existing policy. For rekeying and acquires we still can
have overlapping policies (as we use the same reqid), but for unrelated
connections this is not true anymore (it wasn't actually before, we just
silently broke the existing policy).

6 years agostroke: add exportconn{cert,chain} commands in addition to exportx509
Martin Willi [Fri, 14 Jun 2013 09:22:14 +0000 (11:22 +0200)]
stroke: add exportconn{cert,chain} commands in addition to exportx509

The new commands either export a single end entity certificate or the
full trust chain for a specific connection name.

6 years agoRaise an alert if the responding peer narrowed traffic selectors
Martin Willi [Thu, 13 Jun 2013 13:03:17 +0000 (15:03 +0200)]
Raise an alert if the responding peer narrowed traffic selectors

6 years agobacktrace: use backtrace_symbols() only if we have backtrace() and dladdr() fails
Martin Willi [Wed, 19 Jun 2013 14:00:14 +0000 (16:00 +0200)]
backtrace: use backtrace_symbols() only if we have backtrace() and dladdr() fails

6 years agoutils: Remove volatile qualifier from refcount_t typedef
Tobias Brunner [Wed, 19 Jun 2013 07:20:35 +0000 (09:20 +0200)]
utils: Remove volatile qualifier from refcount_t typedef

It's not really required anymore (if it ever was) and may cause compiler
warnings when using the non atomic versions of ref_get/ref_put.

6 years agodhcp: search for transactions only for connections having a poolname "dhcp"
Martin Willi [Tue, 18 Jun 2013 07:50:29 +0000 (09:50 +0200)]
dhcp: search for transactions only for connections having a poolname "dhcp"

When a connection has a single pool that queries recursively the DHCP backend,
we shouldn't return any attributes directly from DHCP when queried for that
pool.

6 years agostarter: ignore return value of sete[gu]id(), now having warn_unused_result
Martin Willi [Tue, 18 Jun 2013 06:54:10 +0000 (08:54 +0200)]
starter: ignore return value of sete[gu]id(), now having warn_unused_result

6 years agosocket-default: Make sure sockets are open when checking with FD_ISSET
Tobias Brunner [Fri, 14 Jun 2013 15:25:16 +0000 (17:25 +0200)]
socket-default: Make sure sockets are open when checking with FD_ISSET

6 years agosocket-default: Properly initialize NAT-T port if opening regular socket failed
Tobias Brunner [Fri, 14 Jun 2013 14:41:33 +0000 (16:41 +0200)]
socket-default: Properly initialize NAT-T port if opening regular socket failed

6 years agoandroid: Forward initiator flag to libipsec when adding IPsec SA
Tobias Brunner [Thu, 13 Jun 2013 11:55:58 +0000 (13:55 +0200)]
android: Forward initiator flag to libipsec when adding IPsec SA

6 years agolibipsec: Add initiator flag to definition of ipsec_sa_mgr_t.add_sa()
Tobias Brunner [Thu, 13 Jun 2013 11:53:16 +0000 (13:53 +0200)]
libipsec: Add initiator flag to definition of ipsec_sa_mgr_t.add_sa()

6 years agoUse subset matching instead of is_contained_in() to select a child_cfg
Martin Willi [Thu, 13 Jun 2013 11:34:12 +0000 (13:34 +0200)]
Use subset matching instead of is_contained_in() to select a child_cfg

If one selector has a wider IP range than the other, but the other has a
wider port/protocol selector than the first one, none is completely contained
in the other. The check for a match using is_contained_in() therefore would
fail. Using get_subset() can handle such cases, fixing configuration selection.

6 years agoha: Fix CHILD_SA installation in ha_dispatcher after adding initiator flag
Tobias Brunner [Thu, 13 Jun 2013 11:17:55 +0000 (13:17 +0200)]
ha: Fix CHILD_SA installation in ha_dispatcher after adding initiator flag

6 years agokernel-interface: add an exchange initiator parameter to add_sa()
Martin Willi [Wed, 8 May 2013 08:31:06 +0000 (10:31 +0200)]
kernel-interface: add an exchange initiator parameter to add_sa()

This new flag gives the kernel-interface a hint how it should priorize the
use of newly installed SAs during rekeying.

Consider the following rekey procedure in IKEv2:

Initiator  ---    Responder

I1 -------CREATE-------> R1
I2 <------CREATE--------
   -------DELETE-------> R2
I3 <------DELETE--------

SAs are always handled as pairs, the following happens at the SA level:

  * Initiator starts the exchange at I1
  * Responder installs new SA pair at R1
  * Initiator installs new SA pair at I2
  * Responder removes old SA pair at R2
  * Initiator removes old SA pair at I3

This makes sure SAs get installed/removed overlapping during rekeying. However,
to avoid any packet loss, it is crucial that the new outbound SA gets
activated at the correct position:

  * as exchange initiator, in I2
  * as exchange responder, in R2

This should guarantee that we don't use the new outbound SA before the peer
could install its corresponding inbound SA.

The new parameter allows the kernel backend to install the new SA with
appropriate priorities, i.e. it should:

  * as exchange inititator, have the new outbound SA installed with higher
    priority than the old SA
  * as exchange responder, have the new outbound SA installed with lower
    priority than the old SA

While we could split up the SA installation at the responder, this approach
has another advantage: it allows the kernel backend to switch SAs based on
other criteria, for example when receiving traffic on the new inbound SA.

6 years agoMerge branch 'unique-sas'
Martin Willi [Tue, 11 Jun 2013 13:51:50 +0000 (15:51 +0200)]
Merge branch 'unique-sas'

Makes IKE_SA unique ID and CHILD_SA reqid counters atomic.

6 years agoikev1: keep vendor ID task alive during full Main/Aggressive Mode
Martin Willi [Thu, 6 Jun 2013 13:38:38 +0000 (15:38 +0200)]
ikev1: keep vendor ID task alive during full Main/Aggressive Mode

Fixes DPD with Cisco IOS sending the DPD vendor ID not in the first message.

6 years agoUse ref_get() to make sure IKE_SA unique IDs are unique
Martin Willi [Wed, 8 May 2013 13:19:52 +0000 (15:19 +0200)]
Use ref_get() to make sure IKE_SA unique IDs are unique