Commit Graph

160 Commits

Author SHA1 Message Date
Tobias Brunner 7b72909774 controller: Add option to force destruction of an IKE_SA
It's optionally possible to wait for a timeout to destroy the SA.
2018-05-22 10:06:07 +02:00
Tobias Brunner 2307bffe56 proposal: Move proposal_t from libcharon to libstrongswan
This allows us to use it without having to initialize libcharon, which
was required for the logging (we probably could have included debug.h
instead of daemon.h to workaround that but this seems more correct).
2017-11-17 18:09:54 +01:00
Tobias Brunner de280c2e03 private-key: Add optional parameters argument to sign() method 2017-11-08 16:48:10 +01:00
Tobias Brunner 525cc46cab Change interface for enumerator_create_filter() callback
This avoids the unportable 5 pointer hack, but requires enumerating in
the callback.
2017-05-26 13:56:44 +02:00
Thomas Egerer 267c1f7083 keymat: Allow keymat to modify signature scheme(s)
Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
2017-02-08 10:32:17 +01:00
Martin Willi 518a5b2ece configure: Check for and explicitly link against -latomic
Some C libraries, such as uClibc, require an explicit link for some atomic
functions. Check for any libatomic, and explcily link it.
2016-06-14 14:27:20 +02:00
Tobias Brunner 2ba5dadb12 peer-cfg: Use struct to pass data to constructor 2016-04-09 16:51:01 +02:00
Tobias Brunner 8a00a8452d child-cfg: Use struct to pass data to constructor 2016-04-09 16:51:01 +02:00
Andreas Steffen b12c53ce77 Use standard unsigned integer types 2016-03-24 18:52:48 +01:00
Tobias Brunner 28649f6d91 libhydra: Remove empty unused library 2016-03-03 17:36:11 +01:00
Tobias Brunner 8394ea2a42 libhydra: Move kernel interface to libcharon
This moves hydra->kernel_interface to charon->kernel.
2016-03-03 17:36:11 +01:00
Tobias Brunner 88b85e022a sigwaitinfo() may fail with EINTR if interrupted by an unblocked signal not in the set
Fixes #1213.
2015-11-23 11:37:19 +01:00
Tobias Brunner c9401f9ca3 conftest: Add configuration option to report milliseconds in file logger 2015-11-09 16:31:14 +01:00
Tobias Brunner 548b993488 file-logger: Add option to print milliseconds within the current second after timestamp
For this to look right time_format should end with %S or %T.

Closes strongswan/strongswan#18.
2015-11-09 16:30:00 +01:00
Tobias Brunner 858148092d Replace usages of sigwait(3) with sigwaitinfo(2)
This is basically the same call, but it has the advantage of being
supported by FreeBSD's valgrind, which sigwait() is not.

References #1106.
2015-10-29 15:38:37 +01:00
Tobias Brunner ff0abde9ed controller: Optionally adhere to init limits also when initiating IKE_SAs 2015-08-21 18:21:13 +02:00
Martin Willi f81a949748 kernel-interface: Raise expires with a proto/SPI/dst tuple instead of reqid 2015-02-20 13:34:50 +01:00
Martin Willi 971a91685d controller: Use the CHILD_SA unique_id to terminate CHILD_SAs 2015-02-20 13:34:50 +01:00
Tobias Brunner 147fe503af ike: Rename encryption_payload to encrypted_payload 2014-10-10 09:30:25 +02:00
Martin Willi 0404a29bfe kernel-netlink: Define netlink buffer as an union having a netlink header
This allows us to streamline the netlink buffers, and avoid extensive
casting.
2014-09-24 11:19:58 +02:00
Tobias Brunner 3986c1e3fd autoconf: Replace --disable-tools option with --disable-scepclient
Since using a separate option for pki this was the only tool that was still
enabled by that option.
2014-06-30 13:25:13 +02:00
Martin Willi 3ecfc83c6b payload: Use common prefixes for all payload type identifiers
The old identifiers did not use a proper namespace and often clashed with
other defines.
2014-06-04 15:53:03 +02:00
Martin Willi 4163421f91 plugins: Don't link with -rdynamic on Windows 2014-06-04 15:53:02 +02:00
Martin Willi 8d74ec9e80 ike: Add an additional but separate AEAD proposal to CHILD config
This currently has no effect: We don't include AEAD algorithms in the default
ESP proposal, as we don't know if it is supported by the backend. But as we
hopefully get an algorithm query mechanism on kernel interfaces some day, we
add the appropriate functionality nonetheless.
2014-05-16 16:51:19 +02:00
Martin Willi 879e3d12ca ike: Add an additional but separate AEAD proposal to IKE config, if supported 2014-05-16 16:51:19 +02:00
Martin Willi 064fe9c963 enum: Return boolean result for enum_from_name() lookup
Handling the result for enum_from_name() is difficult, as checking for
negative return values requires a cast if the enum type is unsigned. The new
signature clearly differentiates lookup result from lookup value.

Further, this actually allows to convert real -1 enum values, which could not
be distinguished from "not-found" and the -1 return value.

This also fixes several clang warnings where enums are unsigned.
2014-05-16 15:42:07 +02:00
Tobias Brunner 9222d58634 conftest: Use path_dirname() 2014-02-24 12:04:11 +01:00
Tobias Brunner 1c306c0ee9 libcharon: Remove unused charon->name 2014-02-12 14:34:33 +01:00
Tobias Brunner 10c4f4e1fd libhydra: Remove unused hydra->daemon 2014-02-12 14:34:32 +01:00
Tobias Brunner 34d3bfcf14 lib: Add global config namespace 2014-02-12 14:34:31 +01:00
Tobias Brunner 11ac36b016 conftest: Don't load plugins incrementally
This is not supported by the plugin loader, so we simply combine the
plugin lists and load them all at once.
2013-09-13 11:44:04 +02:00
Martin Willi 3070697f9f ike: support multiple addresses, ranges and subnets in IKE address config
Replace the allowany semantic by a more powerful subnet and IP range matching.
Multiple addresses, DNS names, subnets and ranges can be specified in a comma
separated list. Initiators ignore the ranges/subnets, responders match
configurations against all addresses, ranges and subnets.
2013-09-04 10:38:37 +02:00
Martin Willi 9aeaa7396e peer-cfg: add a pull/push mode option to use with mode config 2013-09-04 10:33:37 +02:00
Tobias Brunner 10a69c32c2 conftest: Fix hook constructor resolution via dlsym()
AM_CPPFLAGS only takes preprocessor flags like -I or -D, so it did not
forward -rdynamic to the linker (--export-dynamic), which meant that the
symbols defined in the executable itself were not resolvable via dlsym().

Fixes #394.
2013-08-30 19:45:51 +02:00
Tobias Brunner 85ca2f7441 conftest: Disable reset_seq hook on systems other than Linux
Fixes #386.
2013-08-21 11:27:28 +02:00
Martin Willi 19cb07b890 automake: replace INCLUDES by AM_CPPFLAGS
INCLUDES are now deprecated and throw warnings when using automake 1.13.
We now also differentiate AM_CPPFLAGS and AM_CFLAGS, where includes and
defines are passed to AM_CPPFLAGS only.
2013-07-18 14:59:19 +02:00
Tobias Brunner b18a531715 plugin-loader: Removed unused path argument of load() method
Multiple additional search paths can be added with the add_path()
method.
2013-06-28 10:44:15 +02:00
Tobias Brunner 607f8e9906 plugin-loader: Add method to print loaded plugins on a given log level 2013-06-21 15:17:53 +02:00
Tobias Brunner 11adf114c1 Fixed Doxygen comments after scanning complete src directory 2013-03-02 18:31:53 +01:00
Martin Willi a36b49f3cb Merge branch 'opaque-ports'
Adds a %opaque port option and support for port ranges in left/rightprotoport.
Currently not supported by any of our kernel backends.
2013-03-01 11:27:12 +01:00
Martin Willi a1db77de7c Use a complete port range in traffic_selector_create_from_{subnet,cidr} 2013-02-21 11:52:33 +01:00
Martin Willi 306a269e34 Add a DSCP configuration value to IKE configs 2013-02-06 15:20:32 +01:00
Tobias Brunner ae82265a46 Add the ability to use a named pool for conftest configs 2013-01-21 11:46:20 +01:00
Tobias Brunner 21235e1ec2 Merge branch 'ikev1-fragmentation'
This adds support for the proprietary IKEv1 fragmentation extension.

Conflicts:
	NEWS
2013-01-12 11:58:26 +01:00
Tobias Brunner 365d9a6f67 Added an option that allows to force IKEv1 fragmentation 2013-01-12 11:54:32 +01:00
Thomas Klute 13c177852f conftest: Add support for time_format and ike_name options in log sections
Both options are well supported for normal operation but were completely
ignored by conftest, which used hard coded defaults. File options are
still missing but could be added in a similar way.
2013-01-08 11:12:44 +01:00
Thomas Klute b78698f755 conftest: Fix log level settings for stdout
This patch fixes bug #272 ("conftest ignores log settings for stdout").
http://wiki.strongswan.org/issues/272

According to the documentation of add_logger in src/libcharon/bus/bus.h,
the relevant log levels of a logger are registered with the logging
subsystem when adding the logger. If the log levels change later, the
logger must be re-added to propagate the new settings. In conftest.c,
the stdout logger is initialized and added before reading the logging
settings, but wasn't re-added after reading the settings.
2013-01-08 11:12:10 +01:00
Thomas Klute 4e51cf895e conftest: Make outgoing sequence number set by reset_seq configurable
This is useful for certain test cases. Passing the sequence number to
the callback requires a new struct that contains both the number and the
xfrm_usersa_id. The new configuration parameter is called oseq in
accordance with the kernel name, see the comment in the reset_cb
callback function for details.
2013-01-08 11:10:13 +01:00
Tobias Brunner 97973f8609 Use a connection specific option to en-/disable IKEv1 fragmentation 2012-12-24 13:00:01 +01:00
Martin Willi fe3060f5d0 Add missing CHILD_SA specific proposal keyword in conftest README 2012-12-17 10:58:47 +01:00