Martin Willi [Wed, 25 Jun 2014 14:06:59 +0000 (16:06 +0200)]
windows: Include <sys/stat.h> explicitly before overloading memset()/memcpy()
fstat() in newer MinGWs is defined as non-static inline. With our new static
inline memset()/memcpy() overloads, this raises a warning. To avoid it,
explicitly include <sys/stat.h> once before defining these overloads.
Martin Willi [Tue, 24 Jun 2014 12:43:38 +0000 (14:43 +0200)]
charon: Set CLOEXEC flag on daemon PID file and /dev/(u)random source FDs
On Fedora, SELinux complains about these open file descriptors when the
updown script invokes iptables. While it seems difficult to set the flag
on all file descriptors, this at least fixes those covered by the SELinux
policy.
As these two cases are in code executed while the daemon is still single
threaded, we avoid the use of atomic but not fully portable fdopen("e") or
open(O_CLOEXEC) calls.
Tobias Brunner [Tue, 24 Jun 2014 12:52:42 +0000 (14:52 +0200)]
utils: Add wrappers for memcpy(3), memmove(3) and memset(3)
These wrappers guarantee that calls to these functions are noops if the
number of bytes is 0, as calling them with NULL pointers is undefined
according to the C standard, even if the number of bytes is 0 (most
implementations probably ignore the pointers anyway in this case, but
lets make sure).
Tobias Brunner [Fri, 20 Jun 2014 14:22:15 +0000 (16:22 +0200)]
Merge branch 'algorithm-order'
Restores the behavior we had before 2e22333fb (except for RNGs), that is,
algorithms are stored in the registration order again. Which is not optimal
as we must rely on plugins to register them in a sensible order, but ordering
them by identifier definitely caused weaker algorithms to be proposed first
in the default proposal, which was even worse.
Tobias Brunner [Fri, 20 Jun 2014 06:51:07 +0000 (08:51 +0200)]
kernel-netlink: Install virtual IPv6 addresses as deprecated
This should prevent the kernel's IPv6 source address selection algorithm
from using this address unless it is forced to by our source route.
This is helpful if split tunneling is used.
Tobias Brunner [Thu, 19 Jun 2014 12:24:48 +0000 (14:24 +0200)]
Merge branch 'passthrough-policies-priority'
Introduces a new priority class for policies, which allows us to install
passthrough policies with a strictly higher priority than IPsec
policies, which was not the case previously depending on the traffic
selectors.
Tobias Brunner [Thu, 19 Jun 2014 12:04:33 +0000 (14:04 +0200)]
Merge branch 'ipsec.conf-parser'
Replaces the ipsec.conf parser in starter. The new parser is also based
on flex/bison but it simply returns key/value collections of all sections.
It already resolves also= and allows overriding options in all included
sections (not only %default), options set in included section can also
be cleared again (key=). It provides other improvements too, like quoted
strings (with escape sequences), unlimited includes and better
whitespace/comment handling.
Tobias Brunner [Tue, 20 May 2014 16:15:13 +0000 (18:15 +0200)]
starter: Add new bison/flex based parser for ipsec.conf
The parser simply returns key/value pairs of all sections, it already
resolves also= and allows overriding options in all included sections
(not only %default), options set in included section can also be cleared
again (key=).
It provides other improvements too, like quoted strings (with escape
sequences), unlimited includes and better whitespace/comment handling.
Martin Willi [Thu, 19 Jun 2014 08:10:54 +0000 (10:10 +0200)]
bus: Properly va_copy() argument list before passing it to printf() functions
As we later potentially use args again, we can't consume it with printf
functions without copying it first. Clone list before passing it to any
consuming function.
Martin Willi [Wed, 18 Jun 2014 14:50:18 +0000 (16:50 +0200)]
child-sa: Set replay window on both inbound and outbound SA
While the outbound SA actually does not need a replay window, the kernel rejects
zero replay windows on SAs using ESN. The ESN flag is required to use the full
sequence number in ICV calculation, hence we set the replay window.
This restores the behavior we had before 30c009c2.
Martin Willi [Wed, 18 Jun 2014 12:57:21 +0000 (14:57 +0200)]
kernel-netlink: Never use XFRMA_REPLAY_ESN_VAL to configure zero replay windows
Trying to disable replay windows using the ESN attribute fails with EINVAL.
Use non-ESN legacy format to disable replay windows, even if ESN has been
negotiated over IKE.
Martin Willi [Wed, 4 Jun 2014 08:37:59 +0000 (10:37 +0200)]
swanctl: Support private key decryption passhprases in swanctl.conf
While there is no real security benefit of storing private keys encrypted if
the passphrase is stored along with it, there still seems to be demand for this
functionality. We add it for compatibility with ipsec.secrets, even if it is
not really recommended.
Martin Willi [Tue, 17 Jun 2014 14:50:14 +0000 (16:50 +0200)]
Merge branch 'conn-specific-replay'
Introduces a connection specific replay_window option, overriding the global
charon.replay_window strongswan.conf option. Original patch courtesy of
Zheng Zhong and Christophe Gouault from 6Wind.