denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
18,334 Commits 1 Branch 0 Tags
1ef8b922119abc4e22457f731afb0656a8c4ce69
Commit Graph
14261 Commits
Author SHA1 Message Date
Tobias Brunner 5ab59221d2 ikev2: Add task to handle IKEV2_MESSAGE_ID_SYNC notifies as responder 2017-02-08 15:03:25 +01:00
Tobias Brunner 347c403cf6 ike: Publish getter for the current message ID on IKE_SA 2017-02-08 15:03:25 +01:00
Tobias Brunner 05a2be82c2 ike: Add getter for the current message ID to task manager 2017-02-08 15:03:25 +01:00
Tobias Brunner 21df4cc1ed kernel-pfroute: Implement enumeration of local subnets 2017-02-08 10:38:28 +01:00
Tobias Brunner 0aabfe0780 bypass-lan: Allow ignoring or only considering subnets of specific interfaces 
The config can also be reloaded by sending a SIGHUP to charon.
 2017-02-08 10:38:28 +01:00
Tobias Brunner 62b58a40da bypass-lan: Configure interface on bypass policy 
Currently, only the kernel-netlink plugin supports this, the others will
just ignore it.
 2017-02-08 10:38:28 +01:00
Tobias Brunner 2406474158 kernel-netlink: Return interface name in local subnet enumerator 2017-02-08 10:38:28 +01:00
Tobias Brunner 46c21e3cc3 kernel-interface: Add interface name to local subnet enumerator 2017-02-08 10:38:28 +01:00
Tobias Brunner f8a362bfbc bypass-lan: Add plugin that installs bypass policies for locally attached subnets 2017-02-08 10:38:28 +01:00
Tobias Brunner eac584a37d kernel-netlink: Implement enumerator for local subnets 2017-02-08 10:38:28 +01:00
Tobias Brunner 324fc2cb52 kernel-interface: Add method to enumerate locally attached subnets 2017-02-08 10:38:28 +01:00
Tobias Brunner 3c46ce2834 kernel-pfkey: Use the same priority range for trap and regular policies 
Same as the change in the kernel-netlink plugin.
 2017-02-08 10:36:38 +01:00
Tobias Brunner 0e9d6c4605 kernel-netlink: Use the same priority range for trap and regular policies 
While trap and regular policies now often look the same (mainly because
reqids are kept constant) trap policies still need to have a lower priority
than regular policies to handle unroute/route correctly if e.g. IPComp
is used or the mode changes.  But if we use a completely different
priority range that's lower than that of regular policies it is not possible
to install overlapping trap policies.  By differentiating trap from
regular policies via the priority's LSB this issue is avoided while
still maintaining the proper ordering of trap and regular policies.

Fixes #1243.
 2017-02-08 10:36:38 +01:00
Tobias Brunner 6606393b8c kernel-netlink: Fix spacing in log message when policy is unchanged 2017-02-08 10:36:37 +01:00
Tobias Brunner aeaab528e8 ikev1: Factor out IV and QM management 
This simplifies implementing a custom keymat_v1_t.
 2017-02-08 10:33:07 +01:00
Thomas Egerer 267c1f7083 keymat: Allow keymat to modify signature scheme(s) 
Signed-off-by: Thomas Egerer <[email protected]>
 2017-02-08 10:32:17 +01:00
James Laird-Wah 094a4d15cf forecast: Mark correct port in UDP NAT-T rule 
Closes strongswan/strongswan#62.
 2017-02-08 09:54:02 +01:00
Tobias Brunner 2222af2932 android: New release after adding translation for Simplified Chinese 2017-02-07 16:01:25 +01:00
Tobias Brunner ad882e1a43 android: Add translation for Simplified Chinese 
Courtesy of Yick Xie.
 2017-02-07 15:59:07 +01:00
Tobias Brunner d6c6fb1332 settings: Fix purge if order differs from alphabetical order 2017-02-07 11:00:31 +01:00
Tobias Brunner 865fd804ee eap-dynamic: Publish the get_auth() method of the wrapped EAP method 
Fixes #2238.
 2017-02-07 10:52:24 +01:00
Tobias Brunner 2f95c55271 ike-auth: Don't send INITIAL_CONTACT if remote ID contains wildcards 
Such an identity won't equal an actual peer's identity resulting in
sending an INITIAL_CONTACT notify even if there might be an existing
IKE_SA.
 2017-02-06 11:16:53 +01:00
Tobias Brunner 22f13dcecd proposal: Copy SPI and proposal number from correct proposal in select() 
If charon.prefer_configured_proposals is disabled select() is called on
the received proposal. This incorrectly set the SPI to 0 as the
configured proposal has no SPI set.

Fixes #2190.
 2017-02-06 11:14:31 +01:00
Tobias Brunner b062d3cc44 kernel-netlink: Set NODAD flag for virtual IPv6 addresses 
The Optimistic Duplicate Address Detection (DAD) seems to fail in some
cases (`dadfailed` in `ip addr`) rendering the virtual IP address unusable.

Fixes #2183.
 2017-02-06 11:10:44 +01:00
Tobias Brunner 7a40162cb7 kernel-netlink: Prefer matching label when selecting IPv6 source addresses 
This implements rule 6 of RFC 6724 using the default priority table,
so that e.g. global addresses are preferred over ULAs (which also have
global scope) when the destination is a global address.

Fixes #2138.
 2017-02-06 11:06:22 +01:00
Tobias Brunner 965daa1df3 kernel-netlink: Use correct 4 byte alignment for AH with IPv4 
By default, the kernel incorrectly uses an 8 byte alignment, which is
mandatory for IPv6 but prohibited for IPv4.  For many algorithms this
doesn't matter but that's not the case for HMAC_SHA2_256_128.
Since 2.6.39 the kernel can be explicitly configured to use a 4 byte
alignment.
 2017-01-25 17:51:35 +01:00
Thomas Egerer 8a91729dfe kernel-netlink: Allow change of Netlink socket receive buffer size 
Signed-off-by: Thomas Egerer <[email protected]>
 2017-01-25 17:42:38 +01:00
Tobias Brunner 4ae2209e3d kernel-pfkey: Set state to SADB_SASTATE_MATURE when adding/updating SAs 
Picky kernels might otherwise reject our messages as RFC 2367 explicitly
mandates this.

Fixes #2212.
 2017-01-25 17:30:57 +01:00
Tobias Brunner da565d9832 kernel-pfroute: Don't set a gateway if it is of a different address family than the destination 2017-01-25 17:29:44 +01:00
Tobias Brunner 896d729a60 libipsec: Add support for AES and Camellia in CCM mode 
Fixes #2172.
 2017-01-25 17:26:45 +01:00
Tobias Brunner 1da567734f libipsec: Fix Windows build via MinGW 
Fixes #2118.
 2017-01-25 17:12:30 +01:00
Tobias Brunner 69b58e347e stroke: Default to %dynamic if no valid TS are specified in left|rightsubnet 
Otherwise, we'd end up with an empty TS list, which is not valid.

Because end->tohost is set to !end->subnets in starter the removed branch was
never used.
 2017-01-25 16:56:28 +01:00
Tobias Brunner 83bf6db303 vici: Reload loggers after reloading strongswan.conf via reload-setting command 2017-01-25 14:58:12 +01:00
Tobias Brunner 9665686bd8 daemon: Use separate method to set default loggers 
This way it is not necessary to pass the same values to reload the
loggers.
 2017-01-25 14:58:09 +01:00
Tobias Brunner ff22d53ba9 charon-systemd: Handle SIGHUP the same way charon does 
That is, reload strongswan.conf, the loggers and the plugins.
 2017-01-25 14:58:05 +01:00
Tobias Brunner 4e382f5ffc ha: Fix assignment of IP addresses if multiple pools are defined 
Fixes #2146.
 2017-01-25 12:28:34 +01:00
Tobias Brunner 0e3c8cc4a2 ha: Delete passive IKE_SA on other node after half-open timeout 
Fixes #1192.
 2017-01-25 12:27:21 +01:00
Thomas Egerer 7085ca68d6 kernel-netlink: Return const pointer from lookup_algorithm() 
Signed-off-by: Thomas Egerer <[email protected]>
 2017-01-23 18:53:58 +01:00
Tobias Brunner 7b73cf4aa9 android: New release after adding profile import functionality 2017-01-20 11:53:43 +01:00
Tobias Brunner 66bf2b788c android: Handle profile file names with dots in them 2017-01-20 11:44:17 +01:00
Tobias Brunner 9c79af8c38 android: Handle errors when fetching profile in more detail 2017-01-20 11:44:16 +01:00
Tobias Brunner 3107634e30 android: Add activity to import VPN profiles from JSON-encoded files 
The file format is documented on the wiki.

URLs to .sswan files may be intercepted and downloaded files with a media
type of application/vnd.strongswan.profile may also be opened (the file
extension doesn't matter in that case).  Whether downloaded files for which
the media type is not correct but the extension is .sswan can be opened
depends on the app that issues the Intent.  For instance, from the default
Downloads app it won't work due to the content:// URLs that do not contain
the file name but when opening the downloaded file from within Chrome's
Downloads view it works as these Intents use file:// URLs, which contain
the complete file name (the latter requires a new permission).
 2017-01-20 11:44:07 +01:00
Tobias Brunner cf6110f152 android: Use a local broadcast to notify about profile changes 
This allows other components to modify the profiles and notify about
changes.
 2017-01-20 11:01:32 +01:00
Tobias Brunner c4ab9af74e android: Add a UUID property to the VPN profiles 
All new or edited profiles get a random UUID.  We currently don't
enforce one, though.  Later we might change that and use the UUID as
primary key.
 2017-01-20 11:01:32 +01:00
Tobias Brunner 2ec6372f5a ipsec: Only allow specific commands to be executed via ipsec script 
The previous fallback allowed running any executable as root if executing
ipsec via sudo was allowed, by using e.g. `sudo ipsec ../../../bin/sh`.
 2017-01-18 16:15:48 +01:00
Tobias Brunner 1c27cf3bc8 bliss: Increase timeout for sampler unit test 
Fixes #2204.
 2017-01-16 11:28:10 +01:00
Tobias Brunner 410bdaf654 android: Include ref10 subdirectory for curve25519 plugin 
Fixes #2201.
 2017-01-16 11:19:35 +01:00
Andreas Steffen e3f63c6469 revocation: OCSP and/or CRL fetching can be disabled 2016-12-30 18:12:53 +01:00
Andreas Steffen bd2f2b11fc stroke: Load general PKCS#8 private keys 2016-12-17 18:06:11 +01:00
Andreas Steffen 9da89eeb4f Merge branch 'Ed25519' 2016-12-16 12:24:54 +01:00