Martin Willi [Mon, 6 Oct 2014 16:31:14 +0000 (18:31 +0200)]
Merge branch 'ext-auth'
Integrates the ext-auth plugin by Vyronas Tsingaras. The new child process
abstraction simplifies implementation in both the new ext-auth and the existing
updown plugin, and makes them available on the Windows platform.
Andreas Steffen [Sun, 5 Oct 2014 16:40:24 +0000 (18:40 +0200)]
OS IMV proposes IF-M segmentation contract
The OS IMV sends a TCG IF-M Segmentation contract request.
All IETF standard attributes support segmentation. Additionally
the IETF Installed Packages standard attributes supports
incremental processing while segments are received.
Martin Willi [Fri, 3 Oct 2014 10:26:56 +0000 (12:26 +0200)]
testing: Reissue attribute certificates for the new holder certificates
Due to the expired and reissued holder certificates of carol and dave, new
attribute certificates are required to match the holder certificates serial in
the ikev2/acert-{cached,fallback,inline} tests.
The position of tasks in the queue does not actually determine the order
in which they are activated. Instead this is determined by the
statements in task_manager_v2_t.initiate().
Martin Willi [Wed, 24 Sep 2014 13:53:46 +0000 (15:53 +0200)]
travis: Disable soup in "all" test
On Ubuntu 12.04, there seems to be a resource leak related to pthread keys
when initializing glib or related libraries more than once. With our repeated
initialization for libstrongswan tests, we hit the following error:
Lib (gthread-posix.c): Unexpected error from C library during
'pthread_key_create': Resource temporarily unavailable.
The problem is not reproducible on a newer Gnome stack, hence we disable the
glib based soup plugin until we have a more recent Ubuntu on Travis.
Martin Willi [Wed, 24 Sep 2014 11:13:19 +0000 (13:13 +0200)]
curl: For SSL features, depend on thread-safety provided by our crypto plugins
To use SSL in curl, we need to initialize the SSL library in a thread-safe
manner and provide the appropriate callbacks. As we already do that in our
crypto plugins using these libraries, we depend on these features.
This implies that we need the same plugin enabled (openssl, gcrypt) as the
curl backend is configured to use to fetch from HTTPS URIs.
Martin Willi [Wed, 24 Sep 2014 10:24:13 +0000 (12:24 +0200)]
configure: Load fetcher plugins after crypto base plugins
Some fetcher plugins (such as curl) might build upon OpenSSL to implement
HTTPS fetching. As we set (and can't unset) threading callbacks in our
openssl plugin, we must ensure that OpenSSL functions don't get called after
openssl plugin unloading.
We achieve that by loading curl and all other fetcher plugins after the base
crypto plugins, including openssl.
Martin Willi [Wed, 24 Sep 2014 09:17:29 +0000 (11:17 +0200)]
Merge branch 'systemd'
Introduces a systemd specific charon-systemd IKE daemon based on libcharon.
Uses systemd APIs for startup control and journal logging and a new systemd
service unit using swanctl as configuration backend.
Martin Willi [Fri, 12 Sep 2014 08:35:23 +0000 (10:35 +0200)]
travis: Disable build of native systemd IKE daemon
Travis still uses Ubuntu 12.04, where no systemd libraries are available. Skip
systemd support on Travis until we have a more recent Ubuntu distribution.
Martin Willi [Thu, 17 Jul 2014 16:07:05 +0000 (18:07 +0200)]
settings: Use strongswan.conf used during library initialization for reload
Since 4b670a20 we require an explicit strongswan.conf to re-load configurations.
However, the define was missing in the build, breaking SIGHUP based config
reloading.
Tobias Brunner [Fri, 29 Aug 2014 10:13:49 +0000 (12:13 +0200)]
testing: Add a script to build the current (or an arbitrary) source tree
This allows to (relatively) quickly (re-)build and install the current
or an arbitrary strongSwan source tree within the root image.
bindfs is used to bind mount the source directory using the regular user
and group (only works if sudo is used to run the script) so that newly
created files are not owned by root.
As with building the root image in general the guests must not be
running while executing this script. The guest images are automatically
rebuilt after the root image has been updated so configuration files and
other modifications in guests will be lost.
Tobias Brunner [Fri, 15 Aug 2014 15:52:15 +0000 (17:52 +0200)]
ikev1: Don't cache last block of INFORMATIONAL messages as IV
We don't expect a response with the same MID, but apparently some
devices (e.g. FRITZ!Box) do that for DPDs, while still treating the
response as a new exchange. By storing the last message block as IV
we can't decrypt the first block of such a response.
Tobias Brunner [Fri, 15 Aug 2014 13:57:22 +0000 (15:57 +0200)]
ikev1: Properly handle different proposal numbering schemes
While the examples in RFC 2408 show proposal numbers starting at 1 and
increasing by one for each subsequent proposal this is not mandatory.
Actually, IKEv1 proposals may start at any number, the only requirement
is that the proposal numbers increase monotonically they don't have to
do so consecutively.
Most implementations follow the examples and start numbering at 1 (charon,
racoon, Shrew, Cisco, Windows XP, FRITZ!Box) but pluto was one of the
implementations that started with 0 and there might be others out there.
The previous assumption that implementations always start numbering proposals
at 0 caused problems with clients that start numbering with 1 and whose first
proposal consists of multiple protocols (e.g. ESP+IPComp).