Commit Graph

197 Commits

Author SHA1 Message Date
Tobias Brunner bef4518de7 vici: Match identity with wildcards against remote ID in redirect command 2016-03-04 16:02:59 +01:00
Tobias Brunner 43b46b26ea vici: Add redirect command
This allows redirecting IKE_SAs by multiple different selectors, if none
are given all SAs are redirected.
2016-03-04 16:02:59 +01:00
Tobias Brunner 28649f6d91 libhydra: Remove empty unused library 2016-03-03 17:36:11 +01:00
Tobias Brunner 8394ea2a42 libhydra: Move kernel interface to libcharon
This moves hydra->kernel_interface to charon->kernel.
2016-03-03 17:36:11 +01:00
Tobias Brunner 35d0b8b152 vici: Provide ports of local and remote IKE endpoints 2016-03-03 17:13:35 +01:00
Tobias Brunner fedb16236c vici: Correctly document 'up' key for updown events
Instead of sending 'no' it is omitted when an SA goes down.
2016-03-01 11:05:34 +01:00
Andreas Steffen ffd29ab30a vici: Support multiple named raw ublic keys 2016-01-10 00:12:57 +01:00
Andreas Steffen abe6d07463 swanctl: Load pubkeys with load-creds 2016-01-09 07:23:30 +01:00
Andreas Steffen 4c38c79452 vici: list-cert sends subject, not-before and not-after attributes for pubkeys 2016-01-09 07:23:30 +01:00
Andreas Steffen 87371460f6 vici: Support of raw public keys 2016-01-09 07:23:29 +01:00
Andreas Steffen 9121f6cce1 vici: Enable transport encoding of CERT_TRUSTED_PUBKEY objects 2016-01-03 06:28:49 +01:00
Tobias Brunner a1dfbb7557 vici: Use correct constant when checking for integrity algorithm
Currently both have the value 1024 so no real harm done.
2015-12-21 12:14:12 +01:00
Tobias Brunner ade20d06c6 vici: CHILD_SA proposals never contain a PRF 2015-12-21 12:14:12 +01:00
Andreas Steffen 92b051bd4a vici: allow legacy shortcuts in cert queries 2015-12-19 10:30:17 +01:00
Andreas Steffen f553aea2c2 Use 128 bit security in README.pod examples 2015-12-18 15:08:33 +01:00
Andreas Hofmeister a073e4c95e Improvements to the VICI Perl bindings by Andreas Hofmeister
- Switch.pm, which was implemented as a source filter, has been deprecated in
  Perl 5.10 and was later removed from the core modules in Perl 5.14 or so.

  Unfortunately, its replacement, the given/when/default construct, has since
  been downgraded to "experimental" status because of problems with the underlying
  "smart-match" operator.

  Thus, as of Perl 5.22, Perl still has no actually usable "switch"-like construct.

  So just use boring, old and ugly "if/elsif/else" constructs instead, which are
  compatible with almost any Perl version.

- None of the Perl modules here does anything that would require "AutoLoader".

- "Exporter" can be used to export plain functions into another modules name
  space. But the things that were exported here are meant to be called as
  methods.  In this case, it is neither necessary nor advisable to export those
  symbols.

  Just export nothing (the POD documentation already said so).

- It is usually the calling script that enables (or does not enable) warnings
  globally. When a module says "use warnings;" however, the caller looses control
  over what warnings should be enabled in that module.
2015-12-18 14:25:59 +01:00
Andreas Steffen cc874350b8 Apply pubkey and signature constraints in vici plugin 2015-12-17 17:49:48 +01:00
Andreas Steffen 02d431022c Refactored certificate management for the vici and stroke interfaces 2015-12-12 00:19:24 +01:00
Andreas Steffen 4df09fe563 Modified vici_cert_info class for use with load_creds and vici_cred 2015-12-11 22:14:38 +01:00
Andreas Steffen 44d3b02b57 Removed VICI protocol versioning 2015-12-11 18:26:55 +01:00
Andreas Steffen 334119b843 Share vici_cert_info.c with vici_cred.c 2015-12-11 18:26:55 +01:00
Andreas Steffen fad851e2d3 Use VICI 2.0 protocol version for certificate queries 2015-12-11 18:26:54 +01:00
Andreas Steffen 5d909303d8 Sort certificate types during enumeration 2015-12-11 18:26:54 +01:00
Andreas Steffen 75749971e1 Define VICI protocol versions 2015-12-11 18:26:54 +01:00
Tobias Brunner 74270c8c86 vici: Don't report memory usage via leak-detective
This slowed down the `swanctl --stats` calls in the test scenarios
significantly, with not much added value.
2015-12-11 18:26:53 +01:00
Martin Willi 1a8a420c1c vici: Fix documentation about the initiate/terminate timeout 2015-12-07 10:28:45 +01:00
Martin Willi eaca77d03e vici: Honor an optionally passed IKE configuration name in initiate/install
If two IKE configurations have CHILD configurations with the same name,
we have no control about the CHILD_SA that actually gets controlled. The
new "ike" parameter specifies the peer config name to find the "child" config
under.
2015-12-07 10:28:45 +01:00
Martin Willi 5e79ae2d65 vici: Support completely asynchronous initiating and termination
In some situations the vici client is not interested in waiting for a
timeout at all, so don't register a logging callback if the timeout argument
is negative.
2015-12-07 10:28:45 +01:00
Martin Willi 1db918c4f8 vici: Use an empty local auth round if none given
While it hardly makes sense to use none for negotiated SAs, it actually does
when installing shunt policies.
2015-12-07 10:05:07 +01:00
Martin Willi b26ba1b4a4 vici: Limit start action undoing to IKE_SAs using the base peer config name
If two peer configs use the same child config names, potentailly delete
the wrong CHILD_SA. Check the peer config name as well to avoid that.
2015-12-07 10:05:07 +01:00
Martin Willi 23b1f71372 vici: Close empty IKE_SAs after undoing CHILD_SA start actions 2015-12-07 10:05:07 +01:00
Martin Willi 2facf18833 vici: Use value based array to store CHILD_SA ids during restart
The previous approach stored a pointer to a volatile stack variable, which
works for a single ID, but not for multiple.
2015-12-07 10:05:07 +01:00
Martin Willi f3b2d4a9d8 vici: Undo start actions when unloading configs 2015-12-07 10:05:07 +01:00
Tobias Brunner 63a778a25d vici: Fix clean-local target for Perl bindings if they were not built
This is called when running `make distclean` (or indirectly via `make
distcheck`).
2015-12-04 12:10:57 +01:00
Andreas Steffen 7d24aa0624 Extended and refactored vici perl implementation 2015-12-01 14:52:43 +01:00
Andreas Steffen a17b6d469c Built the CPAN file structure for the Vici::Session perl module 2015-12-01 14:52:43 +01:00
Andreas Steffen a101bce862 Implement vici Perl binding 2015-12-01 14:52:43 +01:00
Tobias Brunner de34defcd0 vici: Add get-algorithms command to query loaded algorithms and implementations 2015-11-30 10:55:55 +01:00
Tobias Brunner 176c24b8e1 vici: Attribute certificates are not trusted 2015-11-12 14:45:43 +01:00
Tobias Brunner e5e352e631 vici: Properly add CRLs to the credential set
add_crl() ensures that old CLRs are not stored in the credential set.
2015-11-12 14:45:42 +01:00
Tobias Brunner f4641f9e45 vici: Add option to query leases of pools
We could later perhaps add filter parameters similar to those of the
`ipsec leases` command (pool name/virtual IP).
2015-11-10 10:43:25 +01:00
Tobias Brunner bdb8b76515 vici: Return local and remote virtual IPs when listing SAs 2015-11-10 10:43:24 +01:00
Tobias Brunner 04f22cdabc vici: Add NAT information when listing IKE_SAs
The `nat-local` and `nat-remote` keys contain information on the NAT
status of the local and remote IKE endpoints, respectively.  If a
responder did not detect a NAT but is configured to fake a NAT situation
this is indicated by `nat-fake` (if an initiator fakes a NAT situation
`nat-local` is set).  If any NAT is detected or faked `nat-any` is set.

Closes strongswan/strongswan#16.
2015-11-09 11:55:51 +01:00
Tobias Brunner c605a96d7f Fix some Doxygen issues 2015-08-27 12:03:11 +02:00
Tobias Brunner 735f929ca7 ike: Only consider number of half-open SAs as responder when deciding whether COOKIEs are sent 2015-08-27 11:18:51 +02:00
Evan Broder 78ed330099 vici: Handle closed sockets in the Ruby gem
From recvfrom(2) (which UDPSocket#recv backs into):

  The return value will be 0 when the peer has performed an orderly
  shutdown.

(i.e. it will return an empty string)

Previously in this scenario, Vici::Transport#recv_all would spin
forever trying to pull more data off the socket. I'm not entirely
clear what happened that caused strongSwan to shutdown the socket, but
it probably should not cause vici Ruby apps to spin.

Closes strongswan/strongswan#13.
2015-08-24 11:24:05 +02:00
Tobias Brunner 256e666d22 vici: Optionally check limits when initiating connections
If the init-limits parameter is set (disabled by default) init limits
will be checked and might prevent new SAs from getting initiated.
2015-08-21 18:21:13 +02:00
Tobias Brunner b9d7319fb3 vici: Add get_bool() convenience getter for VICI messages 2015-08-21 18:21:13 +02:00
Tobias Brunner ff0abde9ed controller: Optionally adhere to init limits also when initiating IKE_SAs 2015-08-21 18:21:13 +02:00
Tobias Brunner 9322e5b398 vici: Add option to disable policy installation for CHILD_SAs 2015-08-17 12:01:36 +02:00