Commit Graph
15343 Commits
Author SHA1 Message Date
Tobias Brunner 2b63883dba nm: Add minimum length constraint for PSK passwords in connection editor
We already have this restriction in the auth-dialog.
2016-09-05 15:41:15 +02:00
Lubomir Rintel a238f534e8 nm: Bump minor version to 1.4.0
This is probably a good idea to do to signal there's significant changes in
dependencies to the distro package maintainers with libnm port and associated
changes.
2016-09-05 15:41:15 +02:00
Lubomir Rintel 7714c631d8 nm: Bump to GTK+ 3.0
It's been released years ago; we depend on newer stuff than that now.
2016-09-05 15:39:44 +02:00
Lubomir Rintel 47bd094e53 nm: Replace libgnomeui with libnma for password dialog
libgnomeui is long deprecated.

There's one functional difference: the choice to save the passwords is gone.
The password flags and saved password should be set in the preferences dialog,
but this commit does not fix that.
2016-09-05 15:39:44 +02:00
Lubomir Rintel 456044189c nm: Grey out the unneeded authentication options
Hiding and showing the items is not ideal, since it leaves the spacing
in place and the layout gets really messy.
2016-09-05 15:39:44 +02:00
Lubomir Rintel 53fe8b1245 nm: Add a widget for setting a password
It was only possible to set the password from the authentication dialog,
which is not ideal; as it requires a connection attempt.

This adds an input entry along with a primary icon from libnma/libnm-gtk
which allows selecting the backend and flags for the password (system, session
agent, always ask or empty).
2016-09-05 15:39:44 +02:00
Lubomir Rintel ae8082daa8 nm: Port to libnm 2016-09-05 15:39:43 +02:00
Lubomir Rintel 0fa9863363 nm: Check for libnm
libnm replaces libnm-glib. This will make sense with port to libnm and is done
to reduce line noise in that commit.
2016-09-05 15:39:43 +02:00
Lubomir Rintel 05cac18485 nm: Build two plugin binaries from the single source
They're both the same now. We'll port the new one to libnm in follow-up commits.

NetworkManager 1.2 (which is currently versioned as 1.1.0) is going to bring
some new ABI while still supporting the old one. There's new VPN service and
UI plugin APIs in libnm.

There's one difficulty though -- the connection editor 1.2 will be linked
against libnm and a new libnma library it will provide (as opposed to
libnm-glib and libnm-gtk), thus will be incapable of loading of property
plugins that are linked with the old libraries (due to glib type system
limitations).

However, we must not break support for other connection editors (GNOME control
center, older versions of nm-connection-editor, etc.) therefore we need
to build two versions of the property plugin. NetworkManager 1.2's libnm will
provide a shim that makes it easy.
2016-09-05 15:39:43 +02:00
Tobias Brunner 42c562c27a Merge branch 'nm-updates'
Provides several fixes and cleanups for the NM build (does not include
fixes for recent NM versions).

Closes strongswan/strongswan#39.
2016-09-05 15:35:23 +02:00
Tobias Brunner 8504d31a86 nm: Version bumb to 1.3.2 2016-09-05 15:30:54 +02:00
Tobias Brunner ab01ae3cae nm: Remove incorrect top-level GtkWindow
Fixes #1013.
2016-09-05 15:30:54 +02:00
Lubomir Rintel a88831a018 nm: Replace libgnomekeyring with libsecret
The former is deprecated and the newer API is nicer anyway.
2016-09-05 15:30:54 +02:00
Lubomir Rintel b86b6b8282 nm: Drop useless calls to AC_SUBST
PKG_CHECK_MODULES does the substitutions.
2016-09-05 15:30:54 +02:00
Lubomir Rintel 7f45e70ba1 nm: Drop some unneeded dependencies 2016-09-05 15:30:54 +02:00
Lubomir Rintel 1cddc4da77 nm: Install the .name file into /usr/lib/NetworkManager/VPN
It's the preferred location for system-provided plugins.

A compatible file in /etc is still kept. Also, the compatibility /etc
file needs to use a full path due to a bug in GNOME Shell.

The full path to a arch-dependent file in a supposedly arch-independent
file is a sin and a multilib violation in some distributions. However.
some pre-release versions of NetworkManager-1.2 as shipped by
distributions require a full path. Let's keep a configure-time option
for that.
2016-09-05 15:30:54 +02:00
Tobias Brunner 49b3d818ea nm: Automatically determine NM plugin directory 2016-09-05 15:28:54 +02:00
Lubomir Rintel 97939530e0 nm: Automatically determine path to the auth dialog 2016-09-05 15:28:54 +02:00
Lubomir Rintel 1579779119 nm: Don't do <deny send_interface="..." /> in dbus service file
It does more than intended; apart from denying messages to that
particular interface it also denies all messages non-qualified with an
interface globally. This blocks messages completely unrelated to
strongSwan's VPN plugin, such as NetworkManager communication with the
VPN plugins.

From the dbus-daemon manual:

  Be careful with send_interface/receive_interface, because the
  interface field in messages is optional. In particular, do NOT
  specify <deny send_interface="org.foo.Bar"/>! This will cause
  no-interface messages to be blocked for all services, which is
  almost certainly not what you intended. Always use rules of the form:

  <deny send_interface="org.foo.Bar" send_destination="org.foo.Service"/>

We can just safely remove those rules, since we're sufficiently
protected by the send_destination matches and method calls are
disallowed by default anyway.

Closes strongswan/strongswan#42.
2016-09-05 15:28:54 +02:00
Lubomir Rintel 916cd5d7ca nm: Move the D-Bus policy to charon-nm
It's needed for useful use of charon-nm, unlike the GUI.
2016-09-05 15:28:53 +02:00
Lubomir Rintel 6a0382e1f2 nm: Add AppStream metadata
This will ensure the strongSwan NetworkManager plugin will be easily
installable from the app stores such as GNOME Software.

Closes strongswan/strongswan#41.
2016-09-05 15:26:04 +02:00
Andreas Steffen de44fd748a pt-tls-client: Added support of ECDSA keys 2016-08-31 17:06:47 +02:00
Andreas Steffen 288ee54875 libimcv: No need to load AIK pubkey if AIK certificate is available 2016-08-31 16:12:55 +02:00
Tobias Brunner f883cd6df6 swanctl: Document how DH groups in CHILD_SA proposals are applied
References #1039.
2016-08-31 11:47:25 +02:00
Tobias Brunner bbd4620777 man: Update description of the esp keyword
Clarifies how DH groups are applied, updates the proposal selection
description and ESN can now also be configured for IKEv1.

References #1039.
2016-08-31 11:47:14 +02:00
Tobias Brunner fe4ed4578f padlock: Use builtin bswap32() to fix compilation on FreeBSD
Fixes #591.
2016-08-31 10:52:55 +02:00
Tobias Brunner 379d94eb70 testing: Try to properly abort a test run after CTRL-C
The run is aborted after the current scenario.  Depending on which
command was interrupted it might be necessary to press CTRL-C multiple
times (e.g. if a later command depends on the interrupted one).

This should fix HTML files and get us some proper console output after
the run.
2016-08-30 16:16:42 +02:00
Tobias Brunner bdd7c42fc0 testing: Report number of tests per subdirectory in main index 2016-08-30 15:03:40 +02:00
Tobias Brunner dda06b0439 testing: Mount and serve testresults from the host
This avoids having to copy testresults, makes results of cancelled runs
browsable (runs may actually be followed live) and preserves old results
when rebuilding guest images (e.g. when using the build-strongswan script).
The number of consecutive test runs without any intermittent rebuild of the
guest images is also not limited by the image size anymore.
2016-08-29 18:11:42 +02:00
Tobias Brunner 7a8985b575 testing: Create a symlink to the testresults under a known path when starting the environment 2016-08-29 18:11:42 +02:00
Tobias Brunner cf6042453f testing: Serve images in testresults via mod_rewrite and not a symlink 2016-08-29 18:11:42 +02:00
Tobias Brunner 528c40017e conf: Extend description of charon.plugins.kernel-netlink.xfrm_acq_expires 2016-08-29 18:02:30 +02:00
Thomas Egerer c6b9a3a485 proposal: Use proper list to get function pointer when adding custom parser
Signed-off-by: Thomas Egerer <[email protected]>
2016-08-29 16:02:07 +02:00
Tobias Brunner dc5b05ea18 android: Add missing xof.c file
Fixes #2093.
2016-08-29 10:42:00 +02:00
Tobias Brunner 831425491c xof: Add header to dev headers 2016-08-29 10:40:59 +02:00
Andreas Steffen d2577aa3c5 Version bump to 5.5.1dr2 2016-08-26 22:55:41 +02:00
Tobias Brunner 6e19a1f5f2 configure: Improve check for built-in __atomic_* functions
With AC_SEARCH_LIBS() we don't succeed if the searched function is a
built-in as the check uses the wrong signature so the built-in will not
be applied (the warning issued by GCC is "conflicting types for built-in
function '...'").  So even if not required, libatomic will be linked if
it is found, which could be problematic if compiling on a separate host
and the target host does not have libatomic installed.

Also, some tests showed that it's more likely that __atomic_and_fetch()
requires linking libatomic than __atomic_load_n() does.

References #1533.
2016-08-26 09:59:01 +02:00
Tobias Brunner 1806ba0890 travis: Add a workaround for a bug regarding libtool installed via Homebrew 2016-08-25 17:21:02 +02:00
Thomas Egerer 8456d6f5a8 ikev1: Don't require AH mapping for integrity algorithm when generating proposal
Signed-off-by: Thomas Egerer <[email protected]>
2016-08-25 13:34:36 +02:00
Andreas Steffen d125941802 libtpmtss: TCTI finalization call changed 2016-08-25 13:22:51 +02:00
Andreas Steffen 36bf2b1bc5 conf: aikpub2.opt added to Makefile.am 2016-08-25 13:22:51 +02:00
Tobias Brunner 09d8215d3f pki: Allow to load CRLs from files in --verify 2016-08-25 11:07:35 +02:00
Tobias Brunner 17ecc104fb ikev1: Ignore the last two bytes of the Cisco Unity vendor ID
These seem to indicate the major and minor version of the protocol, like
e.g. for the DPD vendor ID.  Some implementations seem to send versions
other than 1.0 so we just ignore these for now when checking for known
vendor IDs.

Fixes #2088.
2016-08-24 17:46:05 +02:00
Tobias Brunner 603a1d3c8f utils: Fix definition of BYTE_ORDER with MinGW 2016-08-24 10:40:57 +02:00
Tobias Brunner 22b839e6e9 ikev1: Accept more than one certificate payload in aggressive mode
Fixes #2085.
2016-08-17 10:30:39 +02:00
Andreas Steffen ce20979ce2 testing: Virtual IPs went missing 2016-08-16 17:18:17 +02:00
Andreas Steffen 3bca51e430 unit-tests: Removed unused variable 2016-08-11 17:01:33 +02:00
Andreas Steffen 5afaf0dba2 Version bump to 5.5.1dr1 2016-08-10 18:11:53 +02:00
Andreas Steffen 53332c9390 Merge branch 'newhope' 2016-08-10 16:23:04 +02:00
Andreas Steffen c1a1f9f548 testing: Added swanctl/rw-newhope-bliss scenario 2016-08-10 15:14:26 +02:00