summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* lib: Move hashtable from lib to unicastDimitri Staessens2020-02-169-24/+25
| | | | | | | | | | The hashtable is only used for forwarding tables in the unicast IPCP. This moves the generic hashtable out of the library into the unicast IPCP to prepare a more tailored implementation specific to routing tables containing address lists. Signed-off-by: Dimitri Staessens <[email protected]> Signed-off-by: Sander Vrijders <[email protected]>
* ipcpd: Refactor graph to self-contain LFADimitri Staessens2020-02-161-72/+86
| | | | | | | | | | The LFA algorithm modifies the output of the simple routing algorithm, but the output was mixed in the general call. This moves the LFA subroutine to be self-contained. This makes for a cleaner entry point when adding more routing algorithms. Signed-off-by: Dimitri Staessens <[email protected]> Signed-off-by: Sander Vrijders <[email protected]>
* ipcpd: Filter fqueue events in packet handlersDimitri Staessens2020-01-254-5/+15
| | | | | | | | | | The eth, udp and local IPCPs were not filtering out the event types from the flow, causing some reads when there are no packets in the queue. The types are now also organized as flags so they can be filtered more quickly if needed. Signed-off-by: Dimitri Staessens <[email protected]> Signed-off-by: Sander Vrijders <[email protected]>
* doc: Update manpage for bindingDimitri Staessens2020-01-181-1/+2
| | | | | | | | The manpage mentions that bind works for programs, but not specify that these must be Ouroboros native programs. This is now added. Signed-off-by: Dimitri Staessens <[email protected]> Signed-off-by: Sander Vrijders <[email protected]>
* build: Update copyright to 20200.16.0Dimitri Staessens2020-01-02194-195/+195
| | | | | Signed-off-by: Dimitri Staessens <[email protected]> Signed-off-by: Sander Vrijders <[email protected]>
* build: Add BSD license to the main directoryDimitri Staessens2020-01-022-1/+40
| | | | | | | | The BSD license is used for the tools, but not mentioned in the main directory. The README is updated to reflect where the licenses apply. Signed-off-by: Dimitri Staessens <[email protected]> Signed-off-by: Sander Vrijders <[email protected]>
* build: Fix systemd service installationDimitri Staessens2020-01-021-6/+18
| | | | | | | | | The systemd service installer failed on some systems because the LIBDIR is not always where systemd is installed. This adds a more robust way of finding the systemd service directory. Signed-off-by: Dimitri Staessens <[email protected]> Signed-off-by: Sander Vrijders <[email protected]>
* build: Remove support for SWIGDimitri Staessens2019-12-083-126/+0
| | | | | | | | | This removes support for SWIG since it wasn't correctly generating all bindings. Since our API is lean, we will write the bindings for different languages from scratch. Signed-off-by: Dimitri Staessens <[email protected]> Signed-off-by: Sander Vrijders <[email protected]>
* lib: Clean up fail path in constructorsDimitri Staessens2019-10-281-15/+17
| | | | | | | The node construction path is revised using gotos to avoid repetition. Signed-off-by: Dimitri Staessens <[email protected]> Signed-off-by: Sander Vrijders <[email protected]>
* irmd: Check if entry actually existsSander Vrijders2019-10-061-0/+5
| | | | | | | | | The prog table was consulted for a name of a program, which may not exist, thus prog_entry_del_name potentially got a NULL reference passed. Signed-off-by: Sander Vrijders <[email protected]> Signed-off-by: Dimitri Staessens <[email protected]>
* lib: Add check that flow_id is validSander Vrijders2019-10-061-0/+5
| | | | | | | | In fset_add, the flow_id was passed to the shm_flow_set without checking if it was actually valid. Signed-off-by: Sander Vrijders <[email protected]> Signed-off-by: Dimitri Staessens <[email protected]>
* build: Allow older OpenSSL versions for randomDimitri Staessens2019-10-053-4/+6
| | | | | | | | | Ubuntu 16 comes with older versions of OpenSSL, glibc and libgcrypt. Ouroboros will now fall back to OpenSSL even if the version is <= 1.1.0. Signed-off-by: Dimitri Staessens <[email protected]> Signed-off-by: Sander Vrijders <[email protected]>
* Add support for appveyor CISander Vrijders2019-09-291-0/+34
| | | | | | | | | | A yml file is included in the repository, which is parsed by the appveyor CI when a build is triggered upon pushing. It allows checking the build on Ubuntu 16.04 and 18.04, on x86 and x64, and in release and debug configuration. Signed-off-by: Sander Vrijders <[email protected]> Signed-off-by: Dimitri Staessens <[email protected]>
* Disable SWIG support by defaultSander Vrijders2019-09-291-2/+2
| | | | | | | | The current build fails on older Ubuntu versions. Moreover, the generated code does not wrap flow_write and flow_read correctly. Signed-off-by: Sander Vrijders <[email protected]> Signed-off-by: Dimitri Staessens <[email protected]>
* build: Check OpenSSL version >= 1.1.0Dimitri Staessens2019-09-291-10/+15
| | | | | | | | | The cryptographic functions require at least OpenSSL 1.1.0. The build will now check for this version and disable OpenSSL support when this requirement is not met. Signed-off-by: Dimitri Staessens <[email protected]> Signed-off-by: Sander Vrijders <[email protected]>
* tools: Fix name option in ovpnDimitri Staessens2019-09-151-1/+1
| | | | | | | The --name option is not of optional_argument type. Signed-off-by: Dimitri Staessens <[email protected]> Signed-off-by: Sander Vrijders <[email protected]>
* ipcpd: Remove duplicate ip address in udp dataDimitri Staessens2019-08-311-3/+1
| | | | | | | | | The ip address was stored twice, which is not needed. Only keeping the ip address in the sockaddr struct will make IPv6 support more homogeneous. Signed-off-by: Dimitri Staessens <[email protected]> Signed-off-by: Sander Vrijders <[email protected]>
* tools: Add encryption option to ovpnDimitri Staessens2019-08-311-7/+15
| | | | | | | | This adds a -C, --crypt option to the ovpn tool to easily create AES encrypted IP tunnels. Signed-off-by: Dimitri Staessens <[email protected]> Signed-off-by: Sander Vrijders <[email protected]>
* tools: Use time_utils from toolsDimitri Staessens2019-08-314-2/+7
| | | | | | | | The ocbr tool was still using the non-public time_utils from the library instead of the version in tools. Signed-off-by: Dimitri Staessens <[email protected]> Signed-off-by: Sander Vrijders <[email protected]>
* lib: Fix swapped ECDH crypt callsDimitri Staessens2019-08-091-2/+2
| | | | | | | | | | The client and server side were swapped. This wasn't a big issue, but now we are sure that the flow allocation response for the server has arrived at the client (packet reordering could cause the server key to arrive before the flow is allocated at the client). Signed-off-by: Dimitri Staessens <[email protected]> Signed-off-by: Sander Vrijders <[email protected]>
* lib: Fix free in key derivationDimitri Staessens2019-08-091-1/+1
| | | | | | | The wrong pointer was being free'd in case of a derivation error. Signed-off-by: Dimitri Staessens <[email protected]> Signed-off-by: Sander Vrijders <[email protected]>
* ipcpd: Fix length mismatch of encryption cypherDimitri Staessens2019-08-093-4/+4
| | | | | | | | The cypher_s field in QoS was sometimes 32 and sometimes 16 bits. This is now corrected to be 16 bits. Signed-off-by: Dimitri Staessens <[email protected]> Signed-off-by: Sander Vrijders <[email protected]>
* lib: Add per-message encryption with OpenSSLDimitri Staessens2019-08-0312-29/+693
| | | | | | | | | | | | | | | | | | | This adds a per-message symmetric encryption using the OpenSSL library. At flow allocation, an Elliptic Curve Diffie-Hellman exchange is performed to derive a shared secret, which is then hashed using SHA3-256 to be used as a key for symmetric AES-256 encryption. Each message on an encrypted flow adds a small crypto header that includes a random 128-bit Initialization Vector (IV). If the server does not have OpenSSL enabled, the flow allocation will fail with an -ECRYPT error. Future optimizations are to piggyback the public keys on the flow allocation message, and to enable per-flow encryption that maintains the context of the encryption over multiple packets and doesn't require sending IVs. Signed-off-by: Dimitri Staessens <[email protected]> Signed-off-by: Sander Vrijders <[email protected]>
* irmd, lib: Improve libgcrypt initDimitri Staessens2019-07-292-6/+20
| | | | | | | | | | The proper initialization of libgrypt requires a call to gcry_check_version. The library initialization should first run a check if the application (or some other library) hasn't already initialized libgcrypt before attempting to initialize libgcrypt. Signed-off-by: Dimitri Staessens <[email protected]> Signed-off-by: Sander Vrijders <[email protected]>
* build: Refactor normal to unicastDimitri Staessens2019-07-2956-117/+117
| | | | | | | | This completes the renaming of the normal IPCP to the unicast IPCP in the sources, to get everything consistent with the documentation. Signed-off-by: Dimitri Staessens <[email protected]> Signed-off-by: Sander Vrijders <[email protected]>
* ipcpd: Fix use after free and uninitalized valueSander Vrijders2019-06-212-3/+3
| | | | | | | | | | This fixes a use after free in an error condition, and makes sure that pid is set in the flow_set early on, so flow_set_destroy won't create a prefix with an uninitialized pid in case of an error in shm_flow_set_create. Signed-off-by: Sander Vrijders <[email protected]> Signed-off-by: Dimitri Staessens <[email protected]>
* lib: Add tests for the shm_rbuffDimitri Staessens2019-06-212-0/+106
| | | | | | | | | This adds some tests for the shm_rbuff after some reports that the queue length would be erroneously reported as 0 when the rbuff was full. The test passes for the reported case. Signed-off-by: Dimitri Staessens <[email protected]> Signed-off-by: Sander Vrijders <[email protected]>
* lib: Fix blocking writes to smaller rbuffDimitri Staessens2019-04-171-5/+4
| | | | | | | | | This fixes writing at high speeds when the rbuff is smaller than the rdrbuff. The pthread_cond_wait calls were blocking on the wrong condition variable. Signed-off-by: Dimitri Staessens <[email protected]> Signed-off-by: Sander Vrijders <[email protected]>
* build: Fix CMake 3.0 syntax in wrapperDimitri Staessens2019-04-081-2/+1
| | | | | | | | | The wrapper contained a string that was split using a backslash. This is only supported in CMake > 3.0. Removed the split so compilation resumes with older versions of CMake. Signed-off-by: Dimitri Staessens <[email protected]> Signed-off-by: Sander Vrijders <[email protected]>
* lib: Set independent size for rbuffDimitri Staessens2019-04-067-15/+141
| | | | | | | | | | This allows setting the size of the rbuffs in a system independently of the main packet buffer using SHM_RBUFF_SIZE. The benefit of setting a smaller rbuff size is that a single process can't fully occupy the main packet buffer. Signed-off-by: Dimitri Staessens <[email protected]> Signed-off-by: Sander Vrijders <[email protected]>
* ipcpd: Give max priority to flow allocatorDimitri Staessens2019-03-281-2/+31
| | | | | | | | | | | The flow allocator thread was running on a low priority, causing some delay when handling packets. Usually this isn't a problem, but for congestion control updates, the delay may become problematic. The priority is now set to the maximum allowed by the scheduler policy to improve responsiveness. Signed-off-by: Dimitri Staessens <[email protected]> Signed-off-by: Sander Vrijders <[email protected]>
* ipcpd: Handle local IPCP case when parsing configDimitri Staessens2019-03-281-1/+3
| | | | | | | | | The default case in the configuration parsing prints an erroneous "Unknown IPCP type" message when a local IPCP is bootstrapped. The IPCP_LOCAL type is now handled separately (no action needed). Signed-off-by: Dimitri Staessens <[email protected]> Signed-off-by: Sander Vrijders <[email protected]>
* build: Set specific compiler flags for SWIG target0.15.2Dimitri Staessens2019-03-215-14/+19
| | | | | | | | | | The compiler flags for the SWIG target were added to the global CMAKE_C_FLAGS used for the entire project. This sets the flags uniquely for the SWIG target. The eth has a similar case for the c99 flag. There was a lingering include in dev.c that was removed. Signed-off-by: Dimitri Staessens <[email protected]> Signed-off-by: Sander Vrijders <[email protected]>
* ipcpd: Don't reuse fqueue between threadsDimitri Staessens2019-03-211-10/+17
| | | | | | | | The UDP IPCP was reusing fqueues between threads. This is not supported and lead to bad reads and buffer overflows. Signed-off-by: Dimitri Staessens <[email protected]> Signed-off-by: Sander Vrijders <[email protected]>
* ipcpd: Restrict MTU for Ethernet over loopbackDimitri Staessens2019-03-213-0/+8
| | | | | | | | | | | This restricts the MTU for the Ethernet IPCP over loopback adapters (devices named "lo*") to avoid it allocating 65K buffers per packet and quickly filling the default RDRBUFF space. The restriction is set using the build option IPCP_ETH_LO_MTU, with a default value of 1500 bytes. Signed-off-by: Dimitri Staessens <[email protected]> Signed-off-by: Sander Vrijders <[email protected]>
* ipcpd: Fix strict aliasing warning0.15.1Dimitri Staessens2019-03-182-7/+9
| | | | | | | | | | | | | Some versions of gcc seem to give a positive on the strict aliasing rule. It's absent from newer gcc versions or clang. However, rather than disabling the check for older version, this small rewrite seems to temporarily fix the false positive. Apparently, it's undefined behaviour to simply cast a char/uint8_t buffer to a variable type pointer and then dereference the type. A more elaborate patch to fix the undefined behaviour is needed. Signed-off-by: Dimitri Staessens <[email protected]> Signed-off-by: Sander Vrijders <[email protected]>
* build: Fix CMake policy settingDimitri Staessens2019-03-181-1/+1
| | | | | | | | | The CMake policy setting was set to 3.13, which doesn't work on older CMake versions. The setting is now set to use the default policy of the installed version. Signed-off-by: Dimitri Staessens <[email protected]> Signed-off-by: Sander Vrijders <[email protected]>
* version: Ouroboros 0.15.00.15.0Sander Vrijders2019-03-181-1/+1
| | | | Signed-off-by: Sander Vrijders <[email protected]>
* doc: Update documentation to new website URLDimitri Staessens2019-03-1810-13/+13
| | | | | | | | The documentation and package point to the imec site, which is now moved to ouroboros.rocks Signed-off-by: Dimitri Staessens <[email protected]> Signed-off-by: Sander Vrijders <[email protected]>
* build: Fix build error with swigDimitri Staessens2019-03-182-3/+5
| | | | | | | | | | There is an unsafe strncpy() in the swig compilation process, which has been fixed a while back but is still not in the release version. This disables the compiler warning. It also fixes an unspecified option. Signed-off-by: Dimitri Staessens <[email protected]> Signed-off-by: Sander Vrijders <[email protected]>
* ipcpd: Revise UDP IPCPDimitri Staessens2019-03-189-446/+435
| | | | | | | | | | | The UDP IPCP now uses a fixed server UDP port (default 3435) for all communications. This allows passing firewalls more easily since only a single port needs to be opened. The client port can be fixed as well if needed (default random). It uses an internal eid, so the MTU of the UDP layer is reduced by 4 bytes, similar to the Ethernet IPCPs. Signed-off-by: Dimitri Staessens <[email protected]> Signed-off-by: Sander Vrijders <[email protected]>
* irmd: Don't destroy shm_flow_set from IRMdDimitri Staessens2019-03-121-5/+0
| | | | | | | | | The shm_flow_set for the processes are now created and destroyed together with the irm_flow objects. This old code causes stack overflows in some (rare) conditions and must be removed. Signed-off-by: Dimitri Staessens <[email protected]> Signed-off-by: Sander Vrijders <[email protected]>
* build: Set default number of threads in eth to 1Dimitri Staessens2019-03-051-2/+2
| | | | | | | | | This makes the eth packet handler single-threaded by default, at least until stability issues that seem to be related to multi-threading are fixed. Signed-off-by: Dimitri Staessens <[email protected]> Signed-off-by: Sander Vrijders <[email protected]>
* ipcpd: Refactor create_r and flow_req_arrDimitri Staessens2019-03-048-55/+48
| | | | | | | | | | | The API calls for the IPCP to inform the IRMd of IPCP creation and incoming flow request had the pid_t in the call. This pid_t is removed and the getpid() call is now placed inside the function. Also refactors the cleanup for the main() functions of some of the lower IPCPs. Signed-off-by: Dimitri Staessens <[email protected]> Signed-off-by: Sander Vrijders <[email protected]>
* lib: Add initial rtt estimator to FRCTDimitri Staessens2019-02-083-18/+90
| | | | | | | | | | | | This adds a simple round-trip time estimator to FRCT. The estimate is a weighted average with deviation. The retransmission is scheduled after rtt + 2 times the deviation. A retransmit doubles the rtt estimate to avoid the no-update case when rtt suddenly increases. The rtt is estimated in microseconds and the granularity for retransmits is 256 microseconds. Signed-off-by: Dimitri Staessens <[email protected]> Signed-off-by: Sander Vrijders <[email protected]>
* build: Update copyright to 2019Dimitri Staessens2019-02-05192-192/+192
| | | | | | | Updates the copyright notice in all sources to 2019. Signed-off-by: Dimitri Staessens <[email protected]> Signed-off-by: Sander Vrijders <[email protected]>
* doc: Update man page for broadcast IPCPsDimitri Staessens2019-01-162-22/+57
| | | | | | | | The Ouroboros man page will now include broadcast IPCPs and are updated to reflect the latest API. Signed-off-by: Dimitri Staessens <[email protected]> Signed-off-by: Sander Vrijders <[email protected]>
* tools: Allow enrollment with destination IPCPDimitri Staessens2019-01-161-11/+52
| | | | | | | | | | | | | | | | | | The irm enroll tool had a semantic to enroll with a layer name, but this is not checked. Now the enroll command will retrieve the correct layer name that the IPCP got from the actual enrollment procedure. The irm enroll now has two string parameters, a dst and a layer, which cannot be both NULL. If only dst is specified, the IPCP will enroll with that name; autobind will bind with the layer name. If only layer is specified, the IPCP will enroll with the layer name, and perform a check that the layer name retrieved from enrollment is indeed the layer name before possibly autobinding. If both dst and layer are specified, the IPCP will enroll with dst and perform a check that the enrollment was in the expected layer. Basically only specifying the layer name is a shorthand for dst == layer. Signed-off-by: Dimitri Staessens <[email protected]> Signed-off-by: Sander Vrijders <[email protected]>
* tools: Rename "normal" to "unicast"Dimitri Staessens2019-01-023-9/+9
| | | | | | | This renames the normal IPCP to unicast in the irm toolkit. Signed-off-by: Dimitri Staessens <[email protected]> Signed-off-by: Sander Vrijders <[email protected]>
* lib: Fix deallocating non-initialized np1 flowsDimitri Staessens2018-12-294-6/+16
| | | | | | | | This fixes the deallocation of non-initialized IPCP flows. These can occur when some operations are not implemented. Signed-off-by: Dimitri Staessens <[email protected]> Signed-off-by: Sander Vrijders <[email protected]>
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-29 15:51:18 +0000