Commit Graph

16695 Commits

Author SHA1 Message Date
Tobias Brunner 53f8ac3d6a Normalize whitespace in boilerplate files
Now all consistently use 2 or 4 (HACKING) spaces for indentation.
2018-09-03 14:18:20 +02:00
Tobias Brunner aad9021fd3 README: Fix indentation 2018-09-03 14:14:18 +02:00
Martin Willi 39bc437771 init: Reload configurations/credentials as well during systemctl reload 2018-08-31 16:57:48 +02:00
Tobias Brunner 8505c28289 swanctl: Add --reauth option to --rekey command 2018-08-31 12:39:46 +02:00
Tobias Brunner a20527438a vici: Add option to reauthenticae instead of rekey an IKEv2 SA 2018-08-31 12:39:46 +02:00
Tobias Brunner 720a8bedaa Merge branch 'xfrm-set-mark'
This adds the ability to configure marks the in- and/or outbound SA
should apply to packets after processing on Linux.  Configuring such a mark
for outbound SAs requires at least a 4.14 kernel.  The ability to set a mask
and configuring a mark/mask for inbound SAs will be added with the upcoming
4.19 kernel.
2018-08-31 12:32:31 +02:00
Martin Willi 902dc29f7a child-sa: Use SA matching mark as SA set mark if the latter is %same
For inbound processing, it can be rather useful to apply the mark to the
packet in the SA, so the associated policy with that mark implicitly matches.
When using %unique as match mark, we don't know the mark beforehand, so
we most likely want to set the mark we match against.
2018-08-31 12:26:40 +02:00
Martin Willi ebd2d3877e ipsec-types: Restrict the use of %unique and other keywords when parsing marks
%unique (and the upcoming %same key) are usable in specific contexts only.
To restrict the user from using it in other places where it does not get the
expected results, reject such keywords unless explicitly allowed.
2018-08-31 12:26:40 +02:00
Martin Willi b9aacf9adc vici: Document kernel requirements for set_mark_in/set_mark_out options 2018-08-31 12:26:40 +02:00
Tobias Brunner 60f7896923 vici: Make in-/outbound marks the SA should set configurable 2018-08-31 12:26:40 +02:00
Tobias Brunner f59450fde6 child-sa: Configure in-/outbound mark the SA should set 2018-08-31 12:26:40 +02:00
Tobias Brunner fa4d4012ae child-cfg: Add properties for in-/outbound mark the SA should set 2018-08-31 12:24:30 +02:00
Tobias Brunner 9cee688f78 kernel-netlink: Add support for setting mark/mask an SA should apply to processed traffic 2018-08-31 12:24:30 +02:00
Tobias Brunner c5b94b2483 kernel-netlink: Use larger buffer for event messages 2018-08-31 12:15:12 +02:00
Tobias Brunner 9de3140dbf ikev1: Increase DPD sequence number only after receiving a response
We don't retransmit DPD requests like we do requests for proper exchanges,
so increasing the number with each sent DPD could result in the peer's state
getting out of sync if DPDs are lost.  Because according to RFC 3706, DPDs
with an unexpected sequence number SHOULD be rejected (it does mention the
possibility of maintaining a window of acceptable numbers, but we currently
don't implement that).  We partially ignore such messages (i.e. we don't
update the expected sequence number and the inbound message stats, so we
might send a DPD when none is required).  However, we always send a response,
so a peer won't really notice this (it also ensures a reply for "retransmits"
caused by this change, i.e. multiple DPDs with the same number - hopefully,
other implementations behave similarly when receiving such messages).

Fixes #2714.
2018-08-31 11:31:35 +02:00
Tobias Brunner 5c38a5ea83 Remove ITA references 2018-08-31 11:11:12 +02:00
Tobias Brunner 85a6fe2306 ikev1: Signal IKE_SA connection failure via bus
This is mainly for HA where a passive SA was already created when the
IKE keys were derived.  If e.g. an authentication error occurs later that
SA wouldn't get cleaned up.
2018-08-31 11:05:39 +02:00
Tobias Brunner 4899a4c025 aggressive-mode: Trigger alerts for authentication failures 2018-08-31 11:02:43 +02:00
Tobias Brunner f32402f58e main-mode: Local identity is always defined 2018-08-31 11:02:43 +02:00
Tobias Brunner 78b3c9e2df main-mode: Also trigger a PEER_AUTH_FAILED alert if authorize() fails 2018-08-31 11:02:43 +02:00
Thomas Egerer 095db2ed91 main-mode: Signal local/peer auth failure via bus
Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
2018-08-31 11:02:43 +02:00
Thomas Egerer 32c190634c custom-logger: Add optional reload method
The reload of the configuration of the loggers so far only included
the log levels. In order to support the reload of all other options,
a reload function may be implemented.

Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
2018-08-29 15:55:33 +02:00
Tobias Brunner c163a53a3a ike-sa-manager: Log message when scheduling delete for reauthenticated IKE_SA 2018-08-29 15:46:37 +02:00
Tobias Brunner d98df236a9 Merge branch 'ip-header-fields'
Adds new options that allow configuring how/whether certain fields in
the IP headers are copied during IPsec processing. Currently only allows
configuration on Linux.

Closes strongswan/strongswan#104.
2018-08-29 11:50:13 +02:00
Tobias Brunner c993eaf9d1 kernel: Add option to control DS field behavior 2018-08-29 11:36:04 +02:00
Tobias Brunner dc8b015d78 kernel: Add options to control DF and ECN header bits/fields via XFRM
The options control whether the DF and ECN header bits/fields are copied
from the unencrypted packets to the encrypted packets in tunnel mode (DF only
for IPv4), and for ECN whether the same is done for inbound packets.

Note: This implementation only works with Linux/Netlink/XFRM.

Based on a patch by Markus Sattler.
2018-08-29 11:36:04 +02:00
Tobias Brunner de4c3d2e76 vici: Add error handling to message parsing in Perl bindings 2018-08-29 11:32:21 +02:00
Afschin Hormozdiary d6aa6537e7 vici: Improve message parsing performance in Perl bindings
During a test with ~12000 established SAs it was noted that vici
related operations hung.
The operations took over 16 minutes to finish. The time was spent in
the vici message parser, which was assigning the message over and over
again, to get rid of the already parsed portions.

First fixed by cutting the consumed parts off without copying the message.
Runtime for ~12000 SAs is now around 20 seconds.

Further optimization brought the runtime down to roughly 1-2 seconds
by using an fd to read through the message variable.

Closes strongswan/strongswan#103.
2018-08-29 11:31:38 +02:00
Thomas Egerer 5100a3ed7d kernel-netlink: Align concatenated Netlink responses
The code to support parallel Netlink queries (commit 3c7193f) made use
of nlmsg_len member from struct nlmsghdr to allocate and copy the
responses. Since NLMSG_NEXT is later used to parse these responses, they
must be aligned, or the results are undefined.

Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
2018-08-23 16:34:25 +02:00
Tobias Brunner 2ff4983adc libimcv: Fix Android.mk 2018-08-10 10:10:00 +02:00
Vishal Rana 41fed536e8 libtpmtss: Fixed Android.mk
Closes strongswan/strongswan#111

Signed-off-by: Vishal Rana <vr@labstack.com>
2018-08-10 10:09:43 +02:00
Tom Schlenkhoff 46f482ca54 README: Fix typos
Closes strongswan/strongswan#110.
2018-08-06 16:57:04 +02:00
Tobias Brunner 6ccfeeb1d8 travis: Fix vici Python tests when using Clang
For some reason the clang binary that's installed in an uncommon
directory could not be found anymore when installing packages via pip for
the last couple of builds. While the directory is obviously contained in PATH,
using `sudo -E` didn't help. So we now install the Python packages in the
user's home directory to avoid having to use sudo.
2018-08-06 15:59:09 +02:00
Andreas Steffen a019c95b72 Version bump to 5.7.0dr8 2018-08-02 07:30:05 +02:00
Andreas Steffen 840971e253 Merge branch 'swima-subscriptions' 2018-08-02 07:28:52 +02:00
Andreas Steffen 6a59e1fa9e tnccs-20: Defer handshake retry when sending SRETRY batch
Set a retry_handshake flag on a TNC server when sending a SRETRY
batch and do the retry only after receiving the next CDATA batch
from the TNC client.
2018-08-01 15:44:49 +02:00
Andreas Steffen 731e043c8e libimcv: Reset of IMC state for new measurement cycle 2018-08-01 15:44:49 +02:00
Andreas Steffen 25973c0350 libimcv: Reset of IMV state for new measurement cycle 2018-08-01 15:44:49 +02:00
Andreas Steffen 37c12f98b0 imv-swima: Support subscriptions 2018-07-30 12:06:34 +02:00
Andreas Steffen f649a13cc6 imc-swima: Support subscriptions 2018-07-29 10:37:36 +02:00
Andreas Steffen ff9bac6ab8 libimcv: Missing comma in pa_tnc_error_code_names 2018-07-24 22:49:45 +02:00
Andreas Steffen 041efa6ed3 Version bump to 5.7.0dr6 2018-07-21 09:30:53 +02:00
Andreas Steffen b9d6b3c3e2 libtpmss: Configure TCTI device options 2018-07-20 19:19:24 +02:00
Andreas Steffen 9a7a962348 Version bump to 5.7.0dr5 2018-07-19 14:57:18 +02:00
Andreas Steffen 5fbb8b6a4a libimcv: Added Debian 8.11 and Ubunut 18.04 to IMV database 2018-07-19 14:11:44 +02:00
Andreas Steffen fd21c40b6c libtpmtss: Support of RSAPSS signature scheme 2018-07-19 12:40:42 +02:00
Andreas Steffen e74e920bbc libtpmtss: Support for TSS2 v2 libraries 2018-07-19 12:40:42 +02:00
Tobias Brunner 75214fabd8 testing: Optionally build/install strongSwan only on a specific guest
This may be used to test different strongSwan versions against each
other.
2018-07-11 18:38:09 +02:00
Tobias Brunner a4617539a2 conf: Fix bench_time documentation 2018-07-09 18:10:07 +02:00
Tobias Brunner 9403320fca message: Report the size of the complete reassembled IKE message
This way we see the same size on both ends, namely that of the complete
IKE message as if it was sent in a single packet (excluding UDP/IP headers).
2018-07-09 17:49:07 +02:00