Commit Graph
14261 Commits
Author SHA1 Message Date
Lubomir Rintel a88831a018 nm: Replace libgnomekeyring with libsecret
The former is deprecated and the newer API is nicer anyway.
2016-09-05 15:30:54 +02:00
Lubomir Rintel b86b6b8282 nm: Drop useless calls to AC_SUBST
PKG_CHECK_MODULES does the substitutions.
2016-09-05 15:30:54 +02:00
Lubomir Rintel 7f45e70ba1 nm: Drop some unneeded dependencies 2016-09-05 15:30:54 +02:00
Lubomir Rintel 1cddc4da77 nm: Install the .name file into /usr/lib/NetworkManager/VPN
It's the preferred location for system-provided plugins.

A compatible file in /etc is still kept. Also, the compatibility /etc
file needs to use a full path due to a bug in GNOME Shell.

The full path to a arch-dependent file in a supposedly arch-independent
file is a sin and a multilib violation in some distributions. However.
some pre-release versions of NetworkManager-1.2 as shipped by
distributions require a full path. Let's keep a configure-time option
for that.
2016-09-05 15:30:54 +02:00
Tobias Brunner 49b3d818ea nm: Automatically determine NM plugin directory 2016-09-05 15:28:54 +02:00
Lubomir Rintel 97939530e0 nm: Automatically determine path to the auth dialog 2016-09-05 15:28:54 +02:00
Lubomir Rintel 1579779119 nm: Don't do <deny send_interface="..." /> in dbus service file
It does more than intended; apart from denying messages to that
particular interface it also denies all messages non-qualified with an
interface globally. This blocks messages completely unrelated to
strongSwan's VPN plugin, such as NetworkManager communication with the
VPN plugins.

From the dbus-daemon manual:

  Be careful with send_interface/receive_interface, because the
  interface field in messages is optional. In particular, do NOT
  specify <deny send_interface="org.foo.Bar"/>! This will cause
  no-interface messages to be blocked for all services, which is
  almost certainly not what you intended. Always use rules of the form:

  <deny send_interface="org.foo.Bar" send_destination="org.foo.Service"/>

We can just safely remove those rules, since we're sufficiently
protected by the send_destination matches and method calls are
disallowed by default anyway.

Closes strongswan/strongswan#42.
2016-09-05 15:28:54 +02:00
Lubomir Rintel 916cd5d7ca nm: Move the D-Bus policy to charon-nm
It's needed for useful use of charon-nm, unlike the GUI.
2016-09-05 15:28:53 +02:00
Lubomir Rintel 6a0382e1f2 nm: Add AppStream metadata
This will ensure the strongSwan NetworkManager plugin will be easily
installable from the app stores such as GNOME Software.

Closes strongswan/strongswan#41.
2016-09-05 15:26:04 +02:00
Andreas Steffen de44fd748a pt-tls-client: Added support of ECDSA keys 2016-08-31 17:06:47 +02:00
Andreas Steffen 288ee54875 libimcv: No need to load AIK pubkey if AIK certificate is available 2016-08-31 16:12:55 +02:00
Tobias Brunner f883cd6df6 swanctl: Document how DH groups in CHILD_SA proposals are applied
References #1039.
2016-08-31 11:47:25 +02:00
Tobias Brunner fe4ed4578f padlock: Use builtin bswap32() to fix compilation on FreeBSD
Fixes #591.
2016-08-31 10:52:55 +02:00
Thomas Egerer c6b9a3a485 proposal: Use proper list to get function pointer when adding custom parser
Signed-off-by: Thomas Egerer <[email protected]>
2016-08-29 16:02:07 +02:00
Tobias Brunner dc5b05ea18 android: Add missing xof.c file
Fixes #2093.
2016-08-29 10:42:00 +02:00
Tobias Brunner 831425491c xof: Add header to dev headers 2016-08-29 10:40:59 +02:00
Thomas Egerer 8456d6f5a8 ikev1: Don't require AH mapping for integrity algorithm when generating proposal
Signed-off-by: Thomas Egerer <[email protected]>
2016-08-25 13:34:36 +02:00
Andreas Steffen d125941802 libtpmtss: TCTI finalization call changed 2016-08-25 13:22:51 +02:00
Tobias Brunner 09d8215d3f pki: Allow to load CRLs from files in --verify 2016-08-25 11:07:35 +02:00
Tobias Brunner 17ecc104fb ikev1: Ignore the last two bytes of the Cisco Unity vendor ID
These seem to indicate the major and minor version of the protocol, like
e.g. for the DPD vendor ID.  Some implementations seem to send versions
other than 1.0 so we just ignore these for now when checking for known
vendor IDs.

Fixes #2088.
2016-08-24 17:46:05 +02:00
Tobias Brunner 603a1d3c8f utils: Fix definition of BYTE_ORDER with MinGW 2016-08-24 10:40:57 +02:00
Tobias Brunner 22b839e6e9 ikev1: Accept more than one certificate payload in aggressive mode
Fixes #2085.
2016-08-17 10:30:39 +02:00
Andreas Steffen 3bca51e430 unit-tests: Removed unused variable 2016-08-11 17:01:33 +02:00
Andreas Steffen 1342bd3386 unit-tests: Created newhope unit-tests 2016-08-10 14:22:00 +02:00
Andreas Steffen 393688aea0 Created newhope plugin implementing the New Hope key exchange algorithm 2016-08-10 14:22:00 +02:00
Andreas Steffen 1fddb0b92e xof: Added ChaCha20 stream as XOF 2016-08-06 12:09:05 +02:00
Andreas Steffen 8993cb556e utils: Defined uletoh16() and htole16() 2016-08-06 12:09:05 +02:00
Andreas Steffen b8070e2c85 integrity-test: Added ntru_param_sets to read-only segment 2016-07-29 12:36:15 +02:00
Andreas Steffen 17e4ca6ac9 integrity-test: Added bliss_param_sets to read-only segment 2016-07-29 12:36:15 +02:00
Andreas Steffen 7256c68da0 integrity-test: check code and ro segments of libnttfft 2016-07-29 12:36:15 +02:00
Andreas Steffen d305f251a5 Created libnttfft
This makes Number Theoretic Transforms (NTT) based on the efficient
Fast-Fourier-Transform (FFT) available to multiple plugins.
2016-07-29 12:36:15 +02:00
Andreas Steffen 65f2ecb86d Share twiddle factors table between 512 and 1024 point FFT 2016-07-29 12:36:14 +02:00
Andreas Steffen 68075fb7a7 Implemented FFT with n = 1024 and q = 11289 using Montgomery arithmetic 2016-07-29 12:36:14 +02:00
Andreas Steffen a7d626118f bliss: Implemented FFT with fast Montgomery arithmetic 2016-07-29 12:36:14 +02:00
Andreas Steffen 5ff88c9622 xof: Implemented SHAKE128 and SHAKE256 Extended Output Functions 2016-07-29 12:36:14 +02:00
Andreas Steffen 04208ac5d4 xof: Defined Extended Output Functions 2016-07-29 12:36:14 +02:00
Andreas Steffen 7f65a8c271 vici: Increased various string buffers to BUF_LEN (512 bytes) 2016-07-29 12:34:40 +02:00
Andreas Steffen fa1865094d integrity-test: Added charon-systemd 2016-07-29 12:33:32 +02:00
Andreas Steffen eda8907b90 Added SHA-3 signature OIDs 2016-07-26 13:34:45 +02:00
Tobias Brunner a6d7aed78a libcharon: Add exchange_tests to .gitignore 2016-07-25 14:01:26 +02:00
Andreas Steffen 5ce749bcfc unit-tests: Decreased loop count of FFT speed test to 10'000 2016-07-22 21:27:42 +02:00
Andreas Steffen 10ebb3c914 unit-tests: Added bliss_fft_speed test 2016-07-22 11:58:10 +02:00
Andreas Steffen 0274163674 libtpmtss: Use pkconfig to configure TSS 2.0 includes and libraries 2016-07-20 11:26:07 +02:00
Tobias Brunner 60d0f52fd6 ike1: Flush active queue when queueing a delete of the IKE_SA
By aborting the active task we don't have to wait for potential
retransmits if the other peer does not respond to the current task.
Since IKEv1 has no sequential message IDs and INFORMATIONALs are no real
exchanges this should not be a problem.

Fixes #1537
References #429, #1410
Closes strongswan/strongswan#48
2016-07-19 11:48:17 +02:00
Tobias Brunner 1fafc56b95 Fixed some typos, courtesy of codespell 2016-07-04 12:18:51 +02:00
Andreas Steffen 37ffa99cf2 imcv: Added EFI HCRTM event 2016-06-30 16:20:10 +02:00
Tobias Brunner a8d6501036 aikgen: Fix computation of key ID of the AIK public key
We don't have direct access to the modulus and exponent of the key anymore.
2016-06-30 12:56:41 +02:00
Tobias Brunner c05d49632f libtpmtss: Define missing Doxygen group and fix some comments 2016-06-30 12:12:31 +02:00
Tobias Brunner a23bde26bd libimcv: Fix Doxygen comment 2016-06-30 12:12:26 +02:00
Thomas Egerer 40bb4677f7 ikev1: Add support for extended sequence numbers
Signed-off-by: Thomas Egerer <[email protected]>
2016-06-29 11:16:48 +02:00