[Swan-commit] Changes to ref refs/heads/addresspool
Paul Wouters
paul at vault.libreswan.fi
Fri Feb 15 02:45:32 EET 2013
New commits:
commit f8f8708bf39ffa867225cc50e2fc27c9233a1798
Merge: fb08fac 7adaad5
Author: Paul Wouters <pwouters at redhat.com>
Date: Thu Feb 14 19:45:08 2013 -0500
Merge branch 'fragmentation' into addresspool
Conflicts:
testing/x509/dist_certs
commit fb08fac1b7ee2678911df1991bf414d6bf0a89ee
Merge: 5b4b887 b67dbad
Author: Paul Wouters <pwouters at redhat.com>
Date: Thu Feb 14 19:44:36 2013 -0500
Merge branch 'master' into addresspool
commit 7adaad527de3a005a7bf989a6a6e8fee4a79ab25
Author: Paul Wouters <pwouters at redhat.com>
Date: Thu Feb 14 19:42:02 2013 -0500
* IKEv1: fragmenting comment out stripping non-ESP marker
The code states "Strip non-ESP marker from first fragment", but
it was only stripped out 1 byte, not 4 bytes. We expect this code
is never triggered, so commented out for now.
commit d402bd16fb0c85f441dbaf2e0023d1dcf7665cba
Author: Paul Wouters <pwouters at redhat.com>
Date: Thu Feb 14 19:39:14 2013 -0500
* IKEv1: fragmentation non-ESP marker is 4x 0x00, not 0xFF
commit b67dbad175df9009a4bd4fb7c567a05956c4e9ab
Author: Paul Wouters <pwouters at redhat.com>
Date: Thu Feb 14 15:37:47 2013 -0500
* xauth: fix indentation of CISCO_SPLIT_DNS and }
commit 5ac0162adc886f713f600671029c66c57567cf09
Author: Paul Wouters <pwouters at redhat.com>
Date: Thu Feb 14 15:12:44 2013 -0500
* XAUTH: Added missing return code checks for out_struct/out_raw
We were not always checking the return code of out_struct() and
out_raw() in the xauth processing states. So we could have failed
to construct a part of the packet, and continued without returning
STF_INTERNAL_ERROR
commit 3782879b074c88dd1ea0dbae8de41ece28a5108f
Merge: 0df29df 02c3afc
Author: Paul Wouters <pwouters at redhat.com>
Date: Thu Feb 14 14:32:55 2013 -0500
Merge branch 'fragmentation' of vault.libreswan.fi:/srv/src/libreswan into fragmentation
commit 5b5576f6299de8f0b2e3c7099942c4c6bf9d6a18
Merge: f1c2510 158a418
Author: Paul Wouters <pwouters at redhat.com>
Date: Thu Feb 14 13:39:01 2013 -0500
Merge branch 'master' of vault.libreswan.fi:/srv/src/libreswan
commit f1c25101e80783cf1625f47c5c8724e626a3770d
Author: Paul Wouters <pwouters at redhat.com>
Date: Thu Feb 14 13:38:06 2013 -0500
* document the retransmits=yes|no option for the ipsec.conf man page
commit 158a418b7606b45f449c45df0815443d3668528d
Author: Paul Wouters <pwouters at redhat.com>
Date: Thu Feb 14 12:57:52 2013 -0500
* IANA: Added note about our PEN number 41286
commit 02c3afcca6ac4bf5cb61ba179c3ef703826a3976
Merge: 1ddb6c8 e749530
Author: Paul Wouters <pwouters at redhat.com>
Date: Thu Feb 14 12:38:47 2013 -0500
Merge branch 'fragmentation' of vault.foobar.fi:/srv/src/libreswan into fragmentation
commit 1ddb6c8d500d8d6a2a1faf34392e2e3dd5939d41
Author: Paul Wouters <pwouters at redhat.com>
Date: Thu Feb 14 12:24:02 2013 -0500
* IKEv1: if receiving fragments, immediately respond with fragments too
commit 0df29dfd10401ec39e59d00310d17d8af29b9e4d
Author: Paul Wouters <pwouters at redhat.com>
Date: Wed Feb 13 22:02:18 2013 -0500
* testing: import glob for swan-prep
commit e7495301464ef1aebb50691aab77a033bbc8a9a6
Author: Paul Wouters <pwouters at redhat.com>
Date: Wed Feb 13 21:53:43 2013 -0500
* testing: add python expect to the guest package list (for swan-prep)
commit 2e388ba3fa4bf9a81029ea984cd3679e6a612c42
Author: Paul Wouters <pwouters at redhat.com>
Date: Wed Feb 13 21:47:25 2013 -0500
* testing: pexepect -> pexpect
commit cf47612b6417e782daa1059b797d70759079ea4a
Merge: dafcba8 55f1d3f
Author: Paul Wouters <pwouters at redhat.com>
Date: Wed Feb 13 21:46:22 2013 -0500
Merge branch 'fragmentation' of vault.libreswan.fi:/srv/src/libreswan into fragmentation
commit dafcba8527cca0c78be1c8c799ab37abc68ffd55
Author: Paul Wouters <pwouters at redhat.com>
Date: Wed Feb 13 21:43:57 2013 -0500
* testing: swan-prep was importing p12 files without starting fresh
It also caused it to prompt for a password when initiating the nss
db files. It now runs it through pexpect to create it, then fills
it in with the right p12 file.
Currently it then imports the public certs of east, west and road.
This is needed for rightcert=XXXX when there is no CA and certs
don't come in over IKE. Test cases that want to use the CA should
delete these public certs.
commit 55f1d3fb9225b823c38dcf6ae6dd2fd1e3f2277d
Author: Paul Wouters <pwouters at redhat.com>
Date: Wed Feb 13 21:16:02 2013 -0500
* testing: not all filse were git add'ed for x509-pluto-frag tests
commit 972f233ebd348c3c128417646d382dda88ebb448
Author: Paul Wouters <pwouters at redhat.com>
Date: Wed Feb 13 21:07:18 2013 -0500
* testing: fix typo for "can't idenity INITIATOR"
commit 6ea2584c5886cca5d3ac6c14ccb6e26d3b245652
Author: Paul Wouters <pwouters at redhat.com>
Date: Wed Feb 13 14:16:36 2013 -0500
* remove temporary debug line
commit a27ab0914536f760e7207566d53dd6fcaf5bde02
Author: D. Hugh Redelmeier <hugh at mimosa.com>
Date: Wed Feb 13 12:15:47 2013 -0500
* fix send_packet's packet length reporting
commit 6967f4e1aa1499d5499be5bfd047644342ec1118
Author: Paul Wouters <pwouters at redhat.com>
Date: Wed Feb 13 00:37:48 2013 -0500
* testing: add road to dist_certs
commit 6af094e7c1c50288a23d99e9fdd8f5e05f155eed
Author: Paul Wouters <pwouters at redhat.com>
Date: Wed Feb 13 00:37:07 2013 -0500
* testing: updates testcases for fragmentation support
commit 65b49c0f7852f3ea463727c61e5d3a4470d1f34a
Merge: d0099d5 94669a3
Author: Paul Wouters <pwouters at redhat.com>
Date: Tue Feb 12 16:49:18 2013 -0500
Merge branch 'master' into fragmentation
commit d0099d52f2bfe4538bdcc50ad272d5f83a8cfc5a
Author: Paul Wouters <pwouters at redhat.com>
Date: Tue Feb 12 16:28:38 2013 -0500
* added comment with xauth draft name
commit 30da6123acd345efcbfe4fdd76fe3ff5ea6a6108
Author: Paul Wouters <pwouters at redhat.com>
Date: Tue Feb 12 11:48:31 2013 -0500
* testing: swan-prep did not handle multiple daemons matching for kill
commit 2999cad7acd808bfb02b7872bb69f81133ba94d6
Author: Paul Wouters <pwouters at redhat.com>
Date: Sun Feb 10 22:30:08 2013 -0500
* added iphone5 success log for reference in the future
commit a04aae69304b86579ac47f555402194629118229
Author: Paul Wouters <pwouters at redhat.com>
Date: Sun Feb 10 17:52:59 2013 -0500
* fragmentation: store seen_fragvid in md first, fix force policy
When reading vendorids on the first packet, we don't have a state
yet, so apparently we store things in the message digest (md) first,
then copy it into the state for persistence.
Hugh's reformatting/refactoring missed the check for checking for
having seen the fragmentation vendorid at the peer, and used the
wrong policy flag to check for the "forced" scenario (where we send
fragments despite not having seen the vendorid)
commit 9cca3bfb55674a1eea8f77d0e822701c42e4d68c
Merge: 2ad979a 3a61bbf
Author: Paul Wouters <pwouters at redhat.com>
Date: Sun Feb 10 16:53:55 2013 -0500
Merge branch 'master' into fragmentation
commit 2ad979a67da4fdfe597eb78c3293e461440c51d5
Merge: 07bec55 a6a380d
Author: Paul Wouters <pwouters at redhat.com>
Date: Sun Feb 10 16:51:13 2013 -0500
Merge branch 'fragmentation' of vault.libreswan.fi:/srv/src/libreswan into fragmentation
Conflicts:
programs/pluto/server.c
commit a6a380dd257d296bd10ec25c22a565cbec194618
Author: D. Hugh Redelmeier <hugh at mimosa.com>
Date: Sun Feb 10 11:15:53 2013 -0500
* improve send_ike_msg logic
Simplify handling of keepalive.
Make fragmentation logic only work for IKE V1.
Clarify that resend_ike_msg is only for V1.
commit fff9986fb2c187c2323050a0abd75dedea6aec8e
Author: D. Hugh Redelmeier <hugh at mimosa.com>
Date: Sun Feb 10 01:26:46 2013 -0500
* refactor send_packet
Renamed send_ike_msg since that is what it actually does.
Variants resend_ike_msg and send_keepalive created to capture relevant distictions.
Broken down into layers, simplifying complex and buggy logic and reducing duplication.
Touched up source formatting, again.
(Added a couple of consts missed due to bad makefile dependencies.)
commit a023b4cba4b06f3a1e8b08de0ac72dc16dc11953
Author: D. Hugh Redelmeier <hugh at mimosa.com>
Date: Sat Feb 9 21:52:01 2013 -0500
* improve vendor.c
Eliminate leading _ from _vid_tab and _hexdig.
Make out_vendorid and out_vid return bool, as they are declared to do.
Clarify and simplify out_vendorid and out_vid.
Shrink the scopes of i and j in handle_known_vendorid.
Replace two memsets with two simple assignments.
Add const to pgp_vendorid's type.
commit 75269b8de30ae6368c41d5c53e25631ed2e20cc8
Author: D. Hugh Redelmeier <hugh at mimosa.com>
Date: Sat Feb 9 21:01:25 2013 -0500
* tidy vendor.c
Rename vid_usefull as vid_useful.
Change code to reflect that vid_useful is a bool.
Make initial value of vid_useful TRUE to reduce code.
Eliminate confusing early returns from handle_known_vendorid.
Regularize some formatting.
Narrow the scopes of some variables.
commit 511a02ebd2992baf7bd5b9e84c3e96495b4389f5
Author: root <pwouters at redhat.com>
Date: Sat Feb 9 16:14:39 2013 -0500
* WIP: Store FRAGMENTATION vendorid and fixup resending logic
commit 071a8c6de9ff03e2163cfa1e5965f2044ba5ce61
Author: D. Hugh Redelmeier <hugh at mimosa.com>
Date: Sat Feb 9 14:07:44 2013 -0500
* improve frag code
Detect when marshalling cheat will fail.
Simplify and clean up code.
commit 07bec55dc7fde0a60ec990471432174235c05ac2
Merge: 298724d 3789f66
Author: Paul Wouters <pwouters at redhat.com>
Date: Sat Feb 9 13:53:39 2013 -0500
Merge branch 'fragmentation' of vault.libreswan.fi:/srv/src/libreswan into fragmentation
commit 298724d671abb2492764c9dcef7372a56e1e478a
Author: Paul Wouters <pwouters at redhat.com>
Date: Fri Feb 8 13:35:37 2013 -0500
* remove dead code in kernel_mast that used to configure mast0
It was triggering a checking script for "ifconfig" usage despite
it being ifdef'ed out.
commit 90d774516467ed15e74d74161b528110d181ba70
Author: Paul Wouters <pwouters at redhat.com>
Date: Thu Feb 7 23:35:23 2013 -0500
* ike frag: document ISAKMP_FRAG_MAXLEN and ISAKMP_FRAG_FLAGS
commit 251296bba18fd33964246f34782762fc8785e214
Author: Paul Wouters <pwouters at redhat.com>
Date: Thu Feb 7 23:33:31 2013 -0500
* ike frag: fixup logging calls and add pointers to online documentation
commit 3789f664446e6be4d48099a5b1e380d32be2dc9b
Merge: dc05619 eaeb0a7
Author: Paul Wouters <pwouters at redhat.com>
Date: Thu Feb 7 23:14:11 2013 -0500
Merge branch 'master' into fragmentation
commit dc0561989f4d031af6907d2b6cf69095550aaa18
Author: Paul Wouters <pwouters at redhat.com>
Date: Thu Feb 7 14:21:05 2013 -0500
* XAUTH: Example file to authenticate against PAM over HTTPS (eg FAS)
commit 4cd596ffa85ada225328725747567f837d34f2d5
Merge: 0413b15 6bee4c2
Author: Paul Wouters <pwouters at redhat.com>
Date: Thu Feb 7 09:56:20 2013 -0500
Merge branch 'master' into fragmentation
commit 0413b15545c06d4dd555298189390f7c1d7a263f
Author: Wolfgang Nothdurft <wolfgang at linogate.de>
Date: Thu Feb 7 14:17:19 2013 +0100
* fragmentation: revert the changes at the state_microcode_table
Revert the first change from commit
f0dce92c26df14561bac81ab0e530fb6794fa5d9.
It is no longer needed with the latest changes.
commit dd2ef476a663954d59ba75bf299d7956985fcba5
Author: Wolfgang Nothdurft <wolfgang at linogate.de>
Date: Thu Feb 7 14:12:57 2013 +0100
* fragmentation: changed behaviour when fragments are sent
The query in ikev1.c is no longer necessary, the decision is
completely made in send_packet (server.c).
Maybe an additional state check is necessary.
commit aa6b33a32261da156ea158d05574848d61b4ebfb
Author: D. Hugh Redelmeier <hugh at mimosa.com>
Date: Thu Feb 7 02:12:43 2013 -0500
* IKEv1: ike fragmentation should not use st->st_suspended_md
This code is based on racoon code, which strongswan also uses, and they
all make the mistake of using sizeof(struct ) and offsets for wire format.
Simplify the handling of the non-ESP Marker using NON_ESP_MARKER_SIZE
Rename and moved variables to reduce their scope
Don't rebuild the ISAKMP header for the IKE fragment from scratch, but
use the existing IKE header, with small changes.
Retrieve the stored unfragmented IKE packet from st->st_tpacket not from
st->st_suspended_md.
Signed-off-by: Paul Wouters <pwouters at redhat.com>
commit f70a8b95a38208a5056842212d95198bbc745302
Author: Paul Wouters <pwouters at redhat.com>
Date: Thu Feb 7 00:21:06 2013 -0500
* pluto: send_packet/send_frags mixed architecture/wire formats
It was using size(u_int32_t) instead of 4 octets for the RFC-3948
Non-ESP Marker. So instead, define NON_ESP_MARKER_SIZE and use that.
commit b109e580725f4e1f8b8fe070b80e12d2a529dab1
Merge: f350553 a4e9e16
Author: Paul Wouters <pwouters at redhat.com>
Date: Wed Feb 6 23:12:23 2013 -0500
Merge branch 'fragmentation' of vault.libreswan.fi:/srv/src/libreswan into fragmentation
commit a4e9e16e8a2d3fdf6fa6a4b1e2ad674447fe042e
Author: D. Hugh Redelmeier <hugh at redsquare.mimosa.com>
Date: Wed Feb 6 23:10:04 2013 -0500
* check for impossible buffer overflow
commit 562df17d161c4d27bce75b2bbb898daffac8e2c2
Author: D. Hugh Redelmeier <hugh at redsquare.mimosa.com>
Date: Wed Feb 6 23:06:58 2013 -0500
* remove unused variable "env" from lsw_conf_setdefault()
commit c0b6f35116123c66b58b07bfaf3d90da74a121ab
Merge: 3b03abe 076839a
Author: D. Hugh Redelmeier <hugh at redsquare.mimosa.com>
Date: Wed Feb 6 22:26:14 2013 -0500
Merge branch 'master' into fragmentation
commit f3505532c6bb6eb7242b451d4086966785714785
Merge: 3b03abe 076839a
Author: Paul Wouters <pwouters at redhat.com>
Date: Wed Feb 6 22:24:12 2013 -0500
Merge branch 'master' into fragmentation
commit 3b03abe786296f30d8e81128aac249a926d6be5f
Author: Paul Wouters <pwouters at redhat.com>
Date: Tue Feb 5 13:35:40 2013 -0500
* describe IKE fragments better now we know the fields
commit 0042cc156e14712fa0da00d8ee716357765ee22e
Author: Paul Wouters <pwouters at redhat.com>
Date: Tue Feb 5 10:39:03 2013 -0500
* send_frags can be static, fill in a little more of packet format.
commit 976ef3b1ee9430a107509a0a4f42f02596d1aa53
Merge: 3eeb304 f0dce92
Author: Paul Wouters <pwouters at redhat.com>
Date: Tue Feb 5 10:31:10 2013 -0500
Merge branch 'fragmentation' of vault.libreswan.fi:/srv/src/libreswan into fragmentation
commit f0dce92c26df14561bac81ab0e530fb6794fa5d9
Author: Wolfgang Nothdurft <wolfgang at linogate.de>
Date: Tue Feb 5 15:11:32 2013 +0100
* fragmentation: fix for libreswan <-> libreswan interoperability
When libreswan communicates with libreswan the ike fragmentation will
not start, because SMF_RETRANSMIT_ON_DUPLICATE is not set in case of
retransmission MAIN_I3.
Only call send_frags when send_packet is called for ike fragmentation.
commit 3eeb3047634c586c8ca69e46c7676dc6382c679f
Author: Paul Wouters <pwouters at redhat.com>
Date: Mon Feb 4 22:44:05 2013 -0500
* mtustr was capped at 8 chars, not 16
As the compiler wisely told us:
In function ‘snprintf’,
inlined from ‘show_one_connection’ at /source/programs/pluto/connections.c:3458:10:
/usr/include/bits/stdio2.h:65:3: warning: call to __builtin___snprintf_chk will always overflow destination buffer [enabled by default]
This cannot be exploited other than by whomever can edit the local ipsec
config, at which point you can already set leftupdown=/some/script that
runs as root. Still, not good :/
commit 7cf0ba6ab21d858145de298490bc298f78464767
Merge: e65eafa 8cae519
Author: Paul Wouters <pwouters at redhat.com>
Date: Mon Feb 4 20:21:28 2013 -0500
Merge branch 'master' into fragmentation
commit e65eafa3634d3bf8815390d712a919c2d65d27cf
Author: Wolfgang Nothdurft <wolfgang at linogate.de>
Date: Mon Feb 4 16:41:02 2013 +0100
* XAUTH: remove modecfg* from sa_policy_bit_names
They were only removed from pluto_policy in commit c015d1a038546a5c32d9a36d16462d490108e254.
commit 8f1839f315211eb24fda3d6e86ae23082367b49c
Merge: 829065e b6f2854
Author: Paul Wouters <pwouters at redhat.com>
Date: Sat Feb 2 15:59:06 2013 -0500
Merge branch 'master' into fragmentation
commit 829065e85e857f6d87c76e724ab2b8211ffe3b7c
Merge: bcaf1b7 c78e93e
Author: Paul Wouters <pwouters at redhat.com>
Date: Sat Feb 2 15:44:54 2013 -0500
Merge branch 'master' into fragmentation
commit bcaf1b74b984ab831c1c47e102b8269925afd522
Author: Paul Wouters <pwouters at redhat.com>
Date: Thu Jan 31 14:48:03 2013 -0500
* testing: updated testcase psk-pluto-01
commit 916d033154971eec2774913b70c5cf6b443e0bf7
Author: Paul Wouters <pwouters at redhat.com>
Date: Wed Jan 30 22:39:03 2013 -0500
* fragmentation: when we cannot access the md, pretend we sent it.
That way, on the next retry we have access to st->st_suspended_md
commit f301123d377c3eb0252b31498466349d40c8dd87
Author: Paul Wouters <pwouters at redhat.com>
Date: Wed Jan 30 22:33:50 2013 -0500
* testing: added more x509-pluto-frag-0* tests
x509-pluto-frag-00 is used to confirm filtering UDP fragments
will cause problems. Both ends have ike_frag=no
x509-pluto-frag-01 is using the default policy of ike_frag=yes that
should send/receive ike fragments by both west and east.
x509-pluto-frag-02 uses ike_frag=force on west and ike_frag=yes on
east, so it should send out MAIN_I3 in fragments on the first go.
x509-pluto-frag-04 has ike_frag=yes on west, and ike_frag=no on
east, so west will not see the VID and should not send fragments.
commit c959ed4f730d22d6f05d15682c6e2315391eeba8
Author: Paul Wouters <pwouters at redhat.com>
Date: Wed Jan 30 22:30:33 2013 -0500
* testing: added more x509-pluto-frag-0* tests
x509-pluto-frag-00 is used to confirm filtering UDP fragments
will cause problems.
x509-pluto-frag-01 is the default policy that should send/receive
ike fragments
x509-pluto-frag-02 uses ike_frag=force
commit 2cb636012906a02133e487d7456f7ff8b8b71675
Merge: d53aaa1 4dd3f22
Author: Paul Wouters <pwouters at redhat.com>
Date: Wed Jan 30 10:50:01 2013 -0500
Merge branch 'master' into fragmentation
commit d53aaa18c97c8284983d3502abc35ec5ac6c8bfe
Author: Paul Wouters <pwouters at redhat.com>
Date: Wed Jan 30 10:48:32 2013 -0500
* nat-t: add DBG_NATT debug line before send_packet()
because send_packet is called with verbose FALSE
commit 9ca9fabee9101d9650338ed71d057683e320b44f
Author: Paul Wouters <pwouters at redhat.com>
Date: Wed Jan 30 10:46:21 2013 -0500
* pluto: log ikev2-responder-retransmit in send_packet like IKEv1
commit 148db9aeaa77d6b4b06b1593faa7756847adf677
Author: Wolfgang Nothdurft <wolfgang at linogate.de>
Date: Wed Jan 30 13:59:04 2013 +0100
removed unneeded debug log entry
commit db441734c920eb0fb2fd1d728abb4dc2a1a181f7
Author: Wolfgang Nothdurft <wolfgang at linogate.de>
Date: Wed Jan 30 13:55:03 2013 +0100
- also send VID_IKE_FRAGMENTATION when we are the responder
- increasing numvitosend must be done before adding the first vendorid, otherwise it never adds the rest
(alternative put the always sent dpd vendorid at the end and set next=ISAKMP_NEXT_VID on all vendorids before)
commit a6950dc2f22b8db605514ddab40251eab0205acc
Author: Wolfgang Nothdurft <wolfgang at linogate.de>
Date: Wed Jan 30 13:49:16 2013 +0100
removed duplicate ike fragmentation vendor id, racoon called it broken Microsoft ID: FRAGMENTATION
commit fc4d8a23d3e604b9804d5ffd24423e19611b8cab
Author: Paul Wouters <pwouters at redhat.com>
Date: Tue Jan 29 23:53:58 2013 -0500
* testing: x509-pluto-frag-01 test case
commit ef813c5bf39f2e778b105e0ce8923a009af56036
Merge: 19c89df 347eb50
Author: Paul Wouters <pwouters at redhat.com>
Date: Tue Jan 29 23:49:14 2013 -0500
Merge branch 'master' into fragmentation
commit 19c89dfcd2ae43f0f88b649ca5576afbd19f7ca0
Author: Copyright (C) 2013 Wolfgang Nothdurft <wolfgang at linogate.de>
Date: Tue Jan 29 13:40:09 2013 -0500
* IKEv1: Support for sending IKE fragments
Signed-off-by: Paul Wouters <pwouters at redhat.com>
More information about the Swan-commit
mailing list