denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
13,270 Commits 1 Branch 0 Tags
2dc26c557e6c8da38b60f8154acf0b007747253c
Commit Graph
10466 Commits
Author SHA1 Message Date
Tobias Brunner 2dc26c557e android: Add DNS proxy implementation 
This class proxies DNS requests over VPN-protected UDP sockets.
It is not really Android specific and might be useful for
kernel-libipsec or libipsec in general too, so we could maybe move it later
to libipsec (might need some portability work).
 2014-07-22 11:10:36 +02:00
Tobias Brunner 16e519d42c ip_packet: Add function to easily encode UDP packets 2014-07-22 11:10:35 +02:00
Tobias Brunner 108a67893f ip_packet: Apply transport protocol ports when encoding IP packet 2014-07-22 11:10:35 +02:00
Tobias Brunner 46bb36980b ip_packet: Add getter for IP payload 2014-07-22 11:10:35 +02:00
Tobias Brunner d56d9a45d4 ip_packet: Allow creation of IP packets from data 2014-07-22 11:10:35 +02:00
Tobias Brunner b557f4a7cd chunk: Add function to calculate Internet Checksums according to RFC 1071 2014-07-22 11:10:35 +02:00
Tobias Brunner a10eb93566 ip_packet: Parse ports from TCP and UDP headers 2014-07-22 11:10:35 +02:00
Tobias Brunner 394be2d556 android: Delay disconnecting on errors until user dismisses them 
If e.g. reauthentication fails we don't want to close the TUN device
until the user acknowledged the error and is thus aware of the failure.
 2014-07-22 10:55:51 +02:00
Tobias Brunner 08d545e29a android: Set CHILD_STATE_DOWN when the IKE_SA gets reestablished 2014-07-22 10:55:51 +02:00
Tobias Brunner fb5d541503 android: Set CHILD_STATE_DOWN whenever the CHILD_SA goes down 
No matter what triggers it.  We also don't close the TUN device, but we
might handle that differently in the future to allow reestablishing the
IKE_SA if host names have to be re-resolved via DNS.
 2014-07-22 10:55:51 +02:00
Tobias Brunner 1435bd2e1b android: Change to CONNECTING state if CHILD_SA goes down 
Unless we are disconnecting.  This currently triggers the connecting
dialog, perhaps just updating the status text would do too (when switching
from CONNECTED to CONNECTING, not from DISCONNECTED to CONNECTING).
 2014-07-22 10:55:51 +02:00
Tobias Brunner d4bf6bfb15 android: Do not use deprecated TwoLineListItem 2014-07-22 10:41:51 +02:00
Tobias Brunner 7073bfe4e9 android: Add support for ECDSA private keys 
With 4.4.4 these work fine now.
 2014-07-22 10:41:51 +02:00
Tobias Brunner 3dc92ff9cf android: Show a confirmation dialog before importing certificates 
Since the import activity can be triggered by any other app on the
system we shouldn't just import every certificate we get.

Also, in some situations (e.g. if no passphrase has been set yet for the
system-wide certificate store) we are the only application that can open
certificate files.  So if a user clicked on a certificate file she would
just get a confirmation Toast about a successful import, with no indication
whatsoever where the certificate was actually imported.  The new dialog
shows the app icon to indicate that strongSwan is involved.
 2014-07-22 10:41:51 +02:00
Tobias Brunner 1ed922c918 android: Use Storage Access Framework to import certificates 
Thanks to the SAF, introduced with Android 4.4, browsing and opening
files on the system is very easy to implement.

On older systems the menu option is removed.
 2014-07-22 10:41:51 +02:00
Tobias Brunner 94cc8f6a72 android: Add activity to import certificate files 
Such files can e.g. be opened from the Download view, if they are
associated with one of the supported mime-types.
 2014-07-22 10:41:50 +02:00
Tobias Brunner ac200bcda5 android: Imported certificates may be clicked to delete them 2014-07-22 10:41:50 +02:00
Tobias Brunner eb01649079 android: Reload CA certificates without AsyncTask 
We already use loaders in the GUI that can handle this asynchronously.
 2014-07-22 10:41:50 +02:00
Tobias Brunner 918200378d android: Change how CA certificate reloads are initiated 2014-07-22 10:41:50 +02:00
Tobias Brunner 08de6a08f0 android: Add option to reload CA certificates to TrustedCertificatesActivity 2014-07-22 10:41:50 +02:00
Tobias Brunner 2312985b2a android: Replace option to reload CA certificates with CA certificate view 
The reload option will be added there.
 2014-07-22 10:41:50 +02:00
Tobias Brunner 1353f08fbc android: Only close TrustedCertificatesActivity on click when selecting a certificate 2014-07-22 10:41:50 +02:00
Tobias Brunner 9c841b1f34 android: Set action when using TrustedCertificatesActivity to select a certificate 2014-07-22 10:41:50 +02:00
Tobias Brunner f21a69dbec android: Allow selection of local certificates 2014-07-22 10:41:49 +02:00
Tobias Brunner 3b2b536b70 android: Change how CA certificates from different sources are accessed 2014-07-22 10:41:49 +02:00
Tobias Brunner 8cdce00eb1 android: Cache certificates from multiple KeyStores 
Including the new local one.
 2014-07-22 10:41:49 +02:00
Tobias Brunner 8d3a058abc android: Register local certificate store provider when the app is initialized 2014-07-22 10:41:49 +02:00
Tobias Brunner 5eb4297046 android: Add Provider for the local certificate store 2014-07-22 10:41:49 +02:00
Tobias Brunner 544267889e android: Add KeyStoreSpi implementation that uses LocalCertificateStore 2014-07-22 10:41:49 +02:00
Tobias Brunner 275888d255 android: Add local certificate store 
The class manages certificates stored in files within the app's
private data directory.
 2014-07-22 10:41:49 +02:00
Tobias Brunner 463a6cd005 android: Move TrustedCertificateEntry to a new package 2014-07-22 10:41:49 +02:00
Tobias Brunner 6684195505 android: Subclass Application to provide static access to the application context 2014-07-22 10:41:49 +02:00
Tobias Brunner 7229bdd5c7 android: Target latest SDK version 2014-07-22 10:41:49 +02:00
Tobias Brunner 140ce41a39 android: Add utility method to convert a byte array to a hex string 2014-07-22 10:41:48 +02:00
Tobias Brunner 9d994ba5ea android: Remove unused hash argument from getTrustedCertificates() 2014-07-22 10:41:48 +02:00
Tobias Brunner b9fd95f476 android: Use correct tag to define category for CREATE_SHORTCUT intent-filter 2014-07-22 10:41:48 +02:00
Tobias Brunner d962b25bcb starter: Fix memory leaks and warn if conn/ca sections are ignored due to parse errors 2014-07-18 17:15:15 +02:00
Martin Willi 75122b90bb receiver: Send a single INVALID_MAJOR_VERSION notify for IKE version > 2 
We sent both a notify using IKEv1 and IKEv2. This is a little more aggressive
than required, RFC 5996 says we "SHOULD send an unauthenticated Notify
message of type INVALID_MAJOR_VERSION containing the highest (closest) version
number it supports".

Fixes #657.
 2014-07-17 09:35:49 +02:00
Andreas Steffen 3b96147353 Determine type of unsupported PA-TNC attribute in error message 2014-07-16 15:57:15 +02:00
Andreas Steffen 924ed795af Replaced Tag File Path by Instance ID field 
This update reflects the latest changes in the TCG TNC
SWID Messages and Attributes for IF-M specification
 2014-07-16 15:57:15 +02:00
Martin Willi 88a33f8aa7 swanctl: Fix the swanctl.conf cacerts option name in the manpage and template 2014-07-14 09:18:47 +02:00
Martin Willi 9128666812 dumm: Undefine _GNU_SOURCE before including <ruby.h>, as it usually redefines it 2014-07-09 10:53:36 +02:00
Martin Willi a51c48eeaa settings: Allow spaces in time settings before the optional unit 2014-07-07 16:58:05 +02:00
Martin Willi 0058e26cb0 settings: Be more strict in converting settings to specific data types 
As the behavior was inconsistent for empty strings or strings with characters
appended to a number, testing the code failed on some platforms. The new rules
are more strict, returning the default if additional characters or an empty
string was found for a setting.
 2014-07-07 16:57:38 +02:00
Martin Willi 920d466f05 utils: Undefine mem{cpy,move,set} if set before defining them 
Some platforms, such as OS X, use macros for these functions. Undefine them
to avoid compiler warnings.
 2014-07-07 16:14:26 +02:00
Martin Willi c1490c649a enumerator: Enumerate glob(3) matches using gl_pathc 
While glob should return a NULL terminated gl_pathv when having no matches,
at least on OS X this is not true when using GLOB_DOOFFS. Rely on the
number of matches returned in gl_pathc, which seems to be more reliable in
error cases.
 2014-07-07 16:14:17 +02:00
Tobias Brunner 44870e5313 xauth-pam: Add workaround for null-terminated passwords 
Fixes #631.
 2014-07-07 11:14:02 +02:00
Martin Willi 839951097c kernel-netlink: Rename algorithm identifier from cast128 to cast5 
Even if the XFRM identifier was named cast128 in the kernel before 2.6.31, it
actually never worked, because there is no such crypto algorithm.

The identifier has been changed to cast5 in
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=245acb87
to make it work, so we should use that.

Fixes #633.
 2014-07-04 10:18:12 +02:00
Tobias Brunner 118b2879aa winhttp: Do not use countof() on pointer argument 2014-07-02 12:38:45 +02:00
Tobias Brunner 831045ef45 optionsfrom: Properly handle errors when determining file size 2014-07-02 12:38:45 +02:00