strongswan.git
6 years agoswanctl: Add a stub for a vici based configuration and control utility
Martin Willi [Wed, 29 Jan 2014 13:37:32 +0000 (14:37 +0100)]
swanctl: Add a stub for a vici based configuration and control utility

6 years agolibcharon: Execute scripts defined in strongswan.conf during startup/shutdown
Martin Willi [Wed, 19 Feb 2014 16:24:32 +0000 (17:24 +0100)]
libcharon: Execute scripts defined in strongswan.conf during startup/shutdown

6 years agoMerge branch 'vici'
Martin Willi [Wed, 7 May 2014 13:12:09 +0000 (15:12 +0200)]
Merge branch 'vici'

Introduces the vici plugin providing a Versatile IKE Configuration Interface
to configure, monitor and control the IKE daemon charon over a stable IPC
socket interface.

6 years agoNEWS: Add vici plugin news
Martin Willi [Wed, 7 May 2014 09:17:20 +0000 (11:17 +0200)]
NEWS: Add vici plugin news

6 years agovici: Check if header has been received before processing an empty message
Martin Willi [Wed, 7 May 2014 10:55:30 +0000 (12:55 +0200)]
vici: Check if header has been received before processing an empty message

If do_read() returns with EWOULDBLOCK, we must ensure that we actually have
processed the full length header before checking the zero-initialized buffer
length.

6 years agovici: Properly filter by CHILD_SA name while undoing start actions
Martin Willi [Tue, 6 May 2014 13:46:53 +0000 (15:46 +0200)]
vici: Properly filter by CHILD_SA name while undoing start actions

6 years agovici: Fallback to socket listening port if no explicit local port specified
Martin Willi [Tue, 6 May 2014 13:38:30 +0000 (15:38 +0200)]
vici: Fallback to socket listening port if no explicit local port specified

6 years agovici: Support a "mtu" value for the tfc_padding option
Martin Willi [Tue, 6 May 2014 13:36:14 +0000 (15:36 +0200)]
vici: Support a "mtu" value for the tfc_padding option

6 years agovici: Handle the "trap" action as an alias for "route"
Martin Willi [Tue, 6 May 2014 13:30:45 +0000 (15:30 +0200)]
vici: Handle the "trap" action as an alias for "route"

6 years agovici: Document errno values to expect from libvici API
Martin Willi [Tue, 6 May 2014 10:28:03 +0000 (12:28 +0200)]
vici: Document errno values to expect from libvici API

6 years agovici: Log owners of a just loaded shared-secret
Martin Willi [Tue, 6 May 2014 09:10:05 +0000 (11:10 +0200)]
vici: Log owners of a just loaded shared-secret

6 years agovici: Handle "xauth" as an alias for "eap" secrets
Martin Willi [Tue, 6 May 2014 08:59:55 +0000 (10:59 +0200)]
vici: Handle "xauth" as an alias for "eap" secrets

6 years agovici: Return number of matching and closed SAs in terminate command
Martin Willi [Thu, 1 May 2014 09:28:56 +0000 (11:28 +0200)]
vici: Return number of matching and closed SAs in terminate command

6 years agovici: Complete libvici doxygen comments
Martin Willi [Thu, 1 May 2014 09:07:10 +0000 (11:07 +0200)]
vici: Complete libvici doxygen comments

6 years agovici: Ensure we have no active users before mangling event client registrations
Martin Willi [Thu, 1 May 2014 08:57:38 +0000 (10:57 +0200)]
vici: Ensure we have no active users before mangling event client registrations

6 years agovici: Properly skip raise_event() for unknown event names
Martin Willi [Thu, 1 May 2014 08:26:49 +0000 (10:26 +0200)]
vici: Properly skip raise_event() for unknown event names

6 years agovici: Increase vici message length header from 16 to 32 bits
Martin Willi [Tue, 29 Apr 2014 15:08:50 +0000 (17:08 +0200)]
vici: Increase vici message length header from 16 to 32 bits

While we currently have no need for messages larger than 65KB, we should design
the protocol to be future-proof, as we plan to keep at least to lowest protocol
layer stable.

To avoid any allocation issues, we currently keep the message size limit at
512KB.

6 years agovici: Document strongswan.conf options
Martin Willi [Tue, 29 Apr 2014 14:15:01 +0000 (16:15 +0200)]
vici: Document strongswan.conf options

6 years agovici: Have an explicit "relaxed" keyword for the default revocation policy
Martin Willi [Tue, 29 Apr 2014 10:11:09 +0000 (12:11 +0200)]
vici: Have an explicit "relaxed" keyword for the default revocation policy

6 years agovici: Use a default child rekey time of 1 hour
Martin Willi [Tue, 29 Apr 2014 09:18:42 +0000 (11:18 +0200)]
vici: Use a default child rekey time of 1 hour

6 years agovici: Use a default IKE rekey time of 4 hours
Martin Willi [Tue, 29 Apr 2014 09:18:21 +0000 (11:18 +0200)]
vici: Use a default IKE rekey time of 4 hours

6 years agovici: Add low-level IPC protocol description
Martin Willi [Tue, 11 Mar 2014 17:36:22 +0000 (18:36 +0100)]
vici: Add low-level IPC protocol description

6 years agovici: Fix descending into non-matching sections during key find
Martin Willi [Wed, 16 Apr 2014 12:28:27 +0000 (14:28 +0200)]
vici: Fix descending into non-matching sections during key find

6 years agovici: Add an IKE virtual IP and attribute backend
Martin Willi [Wed, 16 Apr 2014 08:55:40 +0000 (10:55 +0200)]
vici: Add an IKE virtual IP and attribute backend

6 years agovici: Support referencing external named pools for peer configs
Martin Willi [Tue, 15 Apr 2014 11:29:06 +0000 (13:29 +0200)]
vici: Support referencing external named pools for peer configs

6 years agovici: Actually add configured virtual IPs to peer config
Martin Willi [Tue, 15 Apr 2014 11:21:11 +0000 (13:21 +0200)]
vici: Actually add configured virtual IPs to peer config

6 years agovici: Use a default rand_time of the difference between hard and soft lifetimes
Martin Willi [Tue, 15 Apr 2014 09:24:45 +0000 (11:24 +0200)]
vici: Use a default rand_time of the difference between hard and soft lifetimes

6 years agovici: Use a default hard lifetime of 110% of the soft lifetime
Martin Willi [Tue, 15 Apr 2014 08:54:47 +0000 (10:54 +0200)]
vici: Use a default hard lifetime of 110% of the soft lifetime

6 years agovici: Make unit-tests independent from libcharon and libhydra
Martin Willi [Thu, 3 Apr 2014 14:41:45 +0000 (16:41 +0200)]
vici: Make unit-tests independent from libcharon and libhydra

Fixes monolithic build, as we can't depend on the not yet built libcharon.

6 years agovici: Don't compare unsigned certificate_type_t to -1
Martin Willi [Thu, 3 Apr 2014 14:41:07 +0000 (16:41 +0200)]
vici: Don't compare unsigned certificate_type_t to -1

6 years agovici: Use non-blocking first read when receiving message during client on_read()
Martin Willi [Wed, 9 Apr 2014 12:01:45 +0000 (14:01 +0200)]
vici: Use non-blocking first read when receiving message during client on_read()

As select() and finally the watcher may signal an FD even if it does not
actually have data, we must make a non-block read to avoid hanging in the
read callback.

6 years agovici: Perform specified start_action on connection load, undo it on unload
Martin Willi [Mon, 10 Mar 2014 13:21:50 +0000 (14:21 +0100)]
vici: Perform specified start_action on connection load, undo it on unload

6 years agovici: Add a generic log event to raise events for log messages
Martin Willi [Thu, 6 Mar 2014 09:44:55 +0000 (10:44 +0100)]
vici: Add a generic log event to raise events for log messages

6 years agovici: Be less verbose about client connections
Martin Willi [Thu, 6 Mar 2014 09:27:11 +0000 (10:27 +0100)]
vici: Be less verbose about client connections

Instead, log the explicit commands at a higher level.

6 years agovici: Add a list-certs command to query different certificate types
Martin Willi [Mon, 24 Feb 2014 16:21:48 +0000 (17:21 +0100)]
vici: Add a list-certs command to query different certificate types

6 years agovici: Support pinning end entity and CA certificates to connections
Martin Willi [Wed, 19 Feb 2014 14:45:24 +0000 (15:45 +0100)]
vici: Support pinning end entity and CA certificates to connections

6 years agovici: Support missing groups option in auth config
Martin Willi [Wed, 19 Feb 2014 14:25:10 +0000 (15:25 +0100)]
vici: Support missing groups option in auth config

6 years agovici: Add a load-shared command to load shared IKE and EAP secrets
Martin Willi [Wed, 19 Feb 2014 14:08:11 +0000 (15:08 +0100)]
vici: Add a load-shared command to load shared IKE and EAP secrets

6 years agovici: Add a load-key command to load private keys
Martin Willi [Wed, 19 Feb 2014 12:08:10 +0000 (13:08 +0100)]
vici: Add a load-key command to load private keys

6 years agovici: Support loading of different certificate types
Martin Willi [Wed, 19 Feb 2014 09:51:09 +0000 (10:51 +0100)]
vici: Support loading of different certificate types

6 years agovici: Add a credential backend
Martin Willi [Wed, 19 Feb 2014 09:20:19 +0000 (10:20 +0100)]
vici: Add a credential backend

6 years agovici: Add a command listing all or specific loaded connections using events
Martin Willi [Tue, 18 Feb 2014 14:34:13 +0000 (15:34 +0100)]
vici: Add a command listing all or specific loaded connections using events

6 years agovici: Add unload-conn and get-conns commands to manage loaded connections
Martin Willi [Tue, 18 Feb 2014 14:32:43 +0000 (15:32 +0100)]
vici: Add unload-conn and get-conns commands to manage loaded connections

6 years agovici: Make dispatcher a little more verbose
Martin Willi [Tue, 18 Feb 2014 10:58:28 +0000 (11:58 +0100)]
vici: Make dispatcher a little more verbose

6 years agovici: Add backend providing in-memory connections
Martin Willi [Mon, 17 Feb 2014 17:28:53 +0000 (18:28 +0100)]
vici: Add backend providing in-memory connections

6 years agovici: Add generic callback based vici message parsing
Martin Willi [Mon, 17 Feb 2014 17:27:45 +0000 (18:27 +0100)]
vici: Add generic callback based vici message parsing

6 years agovici: Add a list-policy command to query trap and shunt policies
Martin Willi [Thu, 13 Feb 2014 15:12:21 +0000 (16:12 +0100)]
vici: Add a list-policy command to query trap and shunt policies

6 years agovici: Add install/uninstall commands to manage trap and shunt policies
Martin Willi [Thu, 13 Feb 2014 14:20:34 +0000 (15:20 +0100)]
vici: Add install/uninstall commands to manage trap and shunt policies

6 years agovici: Extract CHILD_SA config lookup method
Martin Willi [Thu, 13 Feb 2014 14:20:05 +0000 (15:20 +0100)]
vici: Extract CHILD_SA config lookup method

6 years agovici: Refactor socket to clean up locking
Martin Willi [Wed, 12 Feb 2014 16:55:38 +0000 (17:55 +0100)]
vici: Refactor socket to clean up locking

Uses separate locks for socket read and write operations. While holding the
socket reader lock, a different thread can still claim the socket write lock.
This allows to asynchronously send event messages while holding the read
lock.

6 years agovici: Fix dispatcher leak when handling unknown request
Martin Willi [Thu, 13 Feb 2014 08:44:34 +0000 (09:44 +0100)]
vici: Fix dispatcher leak when handling unknown request

6 years agovici: Add a test case raising events during request, checks in-order delivery
Martin Willi [Thu, 13 Feb 2014 08:43:32 +0000 (09:43 +0100)]
vici: Add a test case raising events during request, checks in-order delivery

6 years agovici: Avoid recursive control log invocations
Martin Willi [Wed, 12 Feb 2014 16:55:05 +0000 (17:55 +0100)]
vici: Avoid recursive control log invocations

6 years agovici: Add a callback based recursive parser function
Martin Willi [Wed, 12 Feb 2014 14:37:06 +0000 (15:37 +0100)]
vici: Add a callback based recursive parser function

6 years agovici: Add a version command to print daemon and OS version info
Martin Willi [Tue, 11 Feb 2014 16:41:05 +0000 (17:41 +0100)]
vici: Add a version command to print daemon and OS version info

6 years agovici: Implement a terminate command to close IKE or CHILD_SAs
Martin Willi [Tue, 11 Feb 2014 16:14:22 +0000 (17:14 +0100)]
vici: Implement a terminate command to close IKE or CHILD_SAs

6 years agovici: Add a control backend, currently to initiate connections by name
Martin Willi [Mon, 10 Feb 2014 16:10:54 +0000 (17:10 +0100)]
vici: Add a control backend, currently to initiate connections by name

6 years agovici: Support thread cancellation in command callbacks
Martin Willi [Tue, 11 Feb 2014 14:09:08 +0000 (15:09 +0100)]
vici: Support thread cancellation in command callbacks

6 years agovici: Move dumping to core message class, use it in libvici
Martin Willi [Tue, 11 Feb 2014 13:36:42 +0000 (14:36 +0100)]
vici: Move dumping to core message class, use it in libvici

6 years agovici: Add convenience value/string/integer getter to libvici
Martin Willi [Tue, 11 Feb 2014 13:09:14 +0000 (14:09 +0100)]
vici: Add convenience value/string/integer getter to libvici

6 years agovici: Add some convenience getters on message
Martin Willi [Mon, 10 Feb 2014 16:09:52 +0000 (17:09 +0100)]
vici: Add some convenience getters on message

6 years agovici: Raise events with an optional identifier for specific connections
Martin Willi [Mon, 10 Feb 2014 16:09:01 +0000 (17:09 +0100)]
vici: Raise events with an optional identifier for specific connections

6 years agovici: Invoke dispatcher outside of connection log, allowing events from commands
Martin Willi [Mon, 10 Feb 2014 16:04:35 +0000 (17:04 +0100)]
vici: Invoke dispatcher outside of connection log, allowing events from commands

6 years agovici: Add a query class, currently implementing a list-sas command
Martin Willi [Fri, 24 Jan 2014 16:15:49 +0000 (17:15 +0100)]
vici: Add a query class, currently implementing a list-sas command

6 years agovici: Add a libvici low-level client library
Martin Willi [Wed, 29 Jan 2014 10:20:20 +0000 (11:20 +0100)]
vici: Add a libvici low-level client library

6 years agovici: Provide a command dispatcher handling request and event registration
Martin Willi [Thu, 23 Jan 2014 14:32:23 +0000 (15:32 +0100)]
vici: Provide a command dispatcher handling request and event registration

6 years agovici: Add a fully asynchronous IPC socket segmenting messages on/from stream
Martin Willi [Tue, 21 Jan 2014 16:53:15 +0000 (17:53 +0100)]
vici: Add a fully asynchronous IPC socket segmenting messages on/from stream

6 years agovici: Add a test runner for plugin
Martin Willi [Tue, 21 Jan 2014 13:39:35 +0000 (14:39 +0100)]
vici: Add a test runner for plugin

6 years agovici: Add a plugin stub for the "Versatile IKE Control Interface" plugin
Martin Willi [Mon, 20 Jan 2014 09:59:21 +0000 (10:59 +0100)]
vici: Add a plugin stub for the "Versatile IKE Control Interface" plugin

6 years agomem-cred: Replace existing equal shared keys during add_shared()
Martin Willi [Wed, 19 Feb 2014 13:29:42 +0000 (14:29 +0100)]
mem-cred: Replace existing equal shared keys during add_shared()

6 years agomem-cred: Replace existing equal private keys during add_key()
Martin Willi [Wed, 19 Feb 2014 13:21:10 +0000 (14:21 +0100)]
mem-cred: Replace existing equal private keys during add_key()

6 years agowatcher: Don't wait for running callback once watcher thread cancelled
Martin Willi [Mon, 10 Mar 2014 09:48:27 +0000 (10:48 +0100)]
watcher: Don't wait for running callback once watcher thread cancelled

During shutdown, waiting for callbacks might never complete, as queued
callbacks might not get executed under certain conditions. Not the clean fix,
but works good enough for now.

Seen on Windows in vici tests.

6 years agowatcher: Avoid queueing multiple watcher callbacks at the same time
Martin Willi [Tue, 18 Feb 2014 16:54:34 +0000 (17:54 +0100)]
watcher: Avoid queueing multiple watcher callbacks at the same time

While we don't add FDs with an active callback to the watched FDSET, we still
can get notifications for callbacks active due the asynchronous processing
of the same.

To avoid queue multiple callbacks, we check for queued callbacks before
activating new ones.

6 years agoprocessor: Flush pending jobs during cancel(), not destroy
Martin Willi [Tue, 11 Feb 2014 14:41:49 +0000 (15:41 +0100)]
processor: Flush pending jobs during cancel(), not destroy

During shutdown, cancel queued jobs earlier to avoid having cleanup functions
accessing infrastructure not available anymore, for example watcher.

6 years agoutils: Provide a CALLBACK macro, similar to METHOD, but for void* callbacks
Martin Willi [Wed, 22 Jan 2014 15:55:27 +0000 (16:55 +0100)]
utils: Provide a CALLBACK macro, similar to METHOD, but for void* callbacks

Using the same mechanism as the METHOD macro, the CALLBACK macro defines
a hybrid function signature. It strictly uses a weak void* for the first
function parameter, in contrast to the dynamic METHOD object "this" type.

6 years agotravis: --disable-aikgen in "all" tests
Martin Willi [Wed, 7 May 2014 12:11:35 +0000 (14:11 +0200)]
travis: --disable-aikgen in "all" tests

aikgen has a hard dependency on TrouSerS, which we currently don't have in the
travis build.

6 years agoUpdated NEWS for 5.2.0dr2 release 5.2.0dr2
Andreas Steffen [Sun, 4 May 2014 19:37:05 +0000 (21:37 +0200)]
Updated NEWS for 5.2.0dr2 release

6 years agoutils: Enable __atomic* built-ins based on the GCC version
Tobias Brunner [Fri, 2 May 2014 15:58:26 +0000 (17:58 +0200)]
utils: Enable __atomic* built-ins based on the GCC version

This solves a problem with GNAT when compiling charon-tkm as __atomic*
built-ins are only provided in GCC 4.7 and newer.

Currently GNAT 4.6 and GCC 4.7.2 is shipped with Debian wheezy (stable),
as used in the testing environment.  So while the configure script correctly
detected the __atomic* built-ins, and defined HAVE_GCC_ATOMIC_OPERATIONS,
this define turned out to be incorrect when charon-tkm was later built
with GNAT.

6 years agoaikgen generates AIK private/public key pairs
Andreas Steffen [Fri, 2 May 2014 18:10:53 +0000 (20:10 +0200)]
aikgen generates AIK private/public key pairs

aikgen outputs a binary AIK private key blob and the AIK public key.
Optionally the Identity Request encrypted with the public key of
the Privacy CA can be output.

6 years agoAdded PUBKEY_RSA_MODULUS encoding type
Andreas Steffen [Fri, 2 May 2014 17:50:43 +0000 (19:50 +0200)]
Added PUBKEY_RSA_MODULUS encoding type

6 years agoExtended Ubuntu 14.04 database build
Andreas Steffen [Thu, 1 May 2014 20:16:34 +0000 (22:16 +0200)]
Extended Ubuntu 14.04 database build

6 years agoMoved BIOS and IMA measurement lists into classes of their own
Andreas Steffen [Thu, 1 May 2014 20:13:06 +0000 (22:13 +0200)]
Moved BIOS and IMA measurement lists into classes of their own

6 years agoAdded NEWS for 5.2.0dr2
Andreas Steffen [Thu, 1 May 2014 15:00:42 +0000 (17:00 +0200)]
Added NEWS for 5.2.0dr2

6 years agoFixed typo
Andreas Steffen [Thu, 1 May 2014 15:00:04 +0000 (17:00 +0200)]
Fixed typo

6 years agoUse global status variable for IMA runtime
Andreas Steffen [Thu, 1 May 2014 14:58:59 +0000 (16:58 +0200)]
Use global status variable for IMA runtime

6 years agoSimilar statistics for packages and file measurements
Andreas Steffen [Wed, 30 Apr 2014 15:23:20 +0000 (17:23 +0200)]
Similar statistics for packages and file measurements

6 years agoUpdated build_database.sh to Ubuntu 14.04
Andreas Steffen [Wed, 30 Apr 2014 13:46:37 +0000 (15:46 +0200)]
Updated build_database.sh to Ubuntu 14.04

6 years agoUpdated ITA-IMA finalize messages
Andreas Steffen [Tue, 29 Apr 2014 16:57:55 +0000 (18:57 +0200)]
Updated ITA-IMA finalize messages

6 years agoImplemented IMA-NG support
Andreas Steffen [Mon, 28 Apr 2014 08:02:06 +0000 (10:02 +0200)]
Implemented IMA-NG support

6 years agoMerge branch 'unit-tests'
Martin Willi [Wed, 30 Apr 2014 15:23:07 +0000 (17:23 +0200)]
Merge branch 'unit-tests'

Bring some minor improvements to unit testing, including more flexible
configuration.

6 years agounit-tests: Document the supported env variables
Martin Willi [Thu, 13 Feb 2014 07:59:28 +0000 (08:59 +0100)]
unit-tests: Document the supported env variables

6 years agounit-tests: Support strongswan.conf defined plugin list and base directory
Thomas Egerer [Thu, 13 Feb 2014 07:55:13 +0000 (08:55 +0100)]
unit-tests: Support strongswan.conf defined plugin list and base directory

tests.load and tests.plugindir to allow the specification of the plugins
to be loaded and the directory to load them from.

Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
6 years agounit-tests: Allow configuration of libstrongswan via config
Thomas Egerer [Thu, 13 Feb 2014 07:54:08 +0000 (08:54 +0100)]
unit-tests: Allow configuration of libstrongswan via config

By setting the environment variable TESTS_STRONGSWAN_CONF, the unit tests can
be asked to load a configuration file, thus enabling the tester to make use of
the usual configuration settings.

Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
6 years agounit-tests: Add a ck_assert_chunk_eq() convenience macro
Martin Willi [Tue, 11 Feb 2014 12:55:56 +0000 (13:55 +0100)]
unit-tests: Add a ck_assert_chunk_eq() convenience macro

6 years agounit-tests: Silence a literal signedness warning raised by GCC 4.6.3
Martin Willi [Thu, 13 Feb 2014 10:41:16 +0000 (11:41 +0100)]
unit-tests: Silence a literal signedness warning raised by GCC 4.6.3

6 years agosqlite: Allow query arguments to be freed before starting the enumeration
Tobias Brunner [Wed, 30 Apr 2014 07:30:17 +0000 (09:30 +0200)]
sqlite: Allow query arguments to be freed before starting the enumeration

By marking the string/blob arguments as transient, SQLite will copy and
free them automatically.

6 years agoVersion bump to 5.2.0dr2
Andreas Steffen [Sun, 27 Apr 2014 17:15:11 +0000 (19:15 +0200)]
Version bump to 5.2.0dr2

6 years agoImproved finalize messages in ITA-IMA component
Andreas Steffen [Sun, 27 Apr 2014 17:13:15 +0000 (19:13 +0200)]
Improved finalize messages in ITA-IMA component

6 years agochild-cfg: Fix removal of redundant traffic selectors
Tobias Brunner [Fri, 25 Apr 2014 16:58:55 +0000 (18:58 +0200)]
child-cfg: Fix removal of redundant traffic selectors

We have to make sure we compare every selected traffic selector with every
other in the list.

Fixes #577.

6 years agoandroid: New release based on 5.1.3
Tobias Brunner [Fri, 25 Apr 2014 12:38:46 +0000 (14:38 +0200)]
android: New release based on 5.1.3

Also links OpenSSL statically and doesn't limit the number of packets
during EAP-TTLS.