denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
10,308 Commits 1 Branch 0 Tags
37fb404833e6cac479e512055c9645f73071185f
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Tobias Brunner 37fb404833 Android.mk of libstrongswan updated 2013-01-14 09:16:33 +01:00
Tobias Brunner 21235e1ec2 Merge branch 'ikev1-fragmentation' 
This adds support for the proprietary IKEv1 fragmentation extension.

Conflicts:
	NEWS
 2013-01-12 11:58:26 +01:00
Tobias Brunner f31b418094 NEWS for fragmentation extension added 
Conflicts:
	NEWS
 2013-01-12 11:56:12 +01:00
Tobias Brunner ee6902ef7f Added an option to configure the maximum size of a fragment 2013-01-12 11:54:58 +01:00
Tobias Brunner 7ae245f685 Properly detect fragmentation capabilities 
Cisco sends 0xc0000000 so we check that part of the VID separately.
 2013-01-12 11:54:54 +01:00
Tobias Brunner 365d9a6f67 Added an option that allows to force IKEv1 fragmentation 2013-01-12 11:54:32 +01:00
Tobias Brunner 97973f8609 Use a connection specific option to en-/disable IKEv1 fragmentation 2012-12-24 13:00:01 +01:00
Tobias Brunner e645c15b9c Include source port in init hash for fragmented messages 2012-12-24 12:29:31 +01:00
Tobias Brunner 2f62bb1549 Add an option to en-/disable IKE fragmentation 
Fragments are always accepted but will not be sent if disabled.  The
vendor ID is only sent if the option is enabled.
 2012-12-24 12:29:31 +01:00
Tobias Brunner 5cafefcd5d Split larger messages into fragments if IKE fragmentation is supported by peer 2012-12-24 12:29:31 +01:00
Tobias Brunner c849305ad7 Log message size for in- and outbound IKE messages 2012-12-24 12:29:30 +01:00
Tobias Brunner 07df944c9c Add support to create IKE fragments 
All fragments currently use the same fragment ID (1) as that's what
other implementations are doing.
 2012-12-24 12:29:30 +01:00
Tobias Brunner c4daac2c0b Log added NAT-T vendor IDs 2012-12-24 12:29:27 +01:00
Tobias Brunner 667720c801 Detect a peer's support for IKE fragmentation 
Fragments are accepted even if this vendor ID is not seen.
 2012-12-24 12:29:27 +01:00
Tobias Brunner fe26ddada9 Map fragmented initial initial Main or Aggressive Mode messages to the same IKE_SA 2012-12-24 12:29:27 +01:00
Tobias Brunner b816037739 Allow ID_PROT/AGGRESSIVE messages for established IKE_SAs if they contain fragments 
Other implementations send fragments always in an initial message type
even for transaction or quick mode exchanges.
 2012-12-24 12:29:27 +01:00
Tobias Brunner 8fc8383439 Don't handle fragmented messages larger than charon.max_packet 2012-12-24 12:29:27 +01:00
Tobias Brunner 7d85f94165 Don't update an IKE_SA-entry's cached message ID when handling fragments 2012-12-24 12:29:26 +01:00
Tobias Brunner 30216000d3 Store inbound IKE fragments and reassemble the message when all fragments are received 2012-12-24 12:29:26 +01:00
Tobias Brunner 9b1659f52c Add message rules to properly handle IKE fragments 
These are sent in unencrypted messages and are the only payload
contained in such messages.
 2012-12-24 10:24:48 +01:00
Tobias Brunner ddfad8b67e Reset the encrypted flag when handling IKE messages that contain a fragment 
Racoon sets the encrypted bit for messages containing a fragment, but these
messages are not really encrypted (the fragmented message is though).
 2012-12-24 10:24:48 +01:00
Tobias Brunner 8f0ab6dd36 Payload added to handle IKE fragments 2012-12-24 10:24:48 +01:00
Tobias Brunner ef33a4ab82 Fixed some typos, courtesy of codespell 2012-12-20 09:35:26 +01:00
Tobias Brunner 0080daa787 Fix deadlock in IMC/IMV managers 
Since reserve_id() might be called from e.g. notify_connection_change()
using a write lock will not work as this can't be acquired while holding
the read lock.

Also, with the previous code it was possible that two IMCs/IMVs added by
two threads at the same time would get the same ID assigned.
 2012-12-18 15:59:29 +01:00
Tobias Brunner 6a8eeba540 Properly select IMC/IMV according to given primary ID in reserve_id() 2012-12-18 15:59:29 +01:00
Tobias Brunner 283898d6e0 Fix traffic selectors also as initiator in case of transport mode over NAT 2012-12-13 15:27:29 +01:00
Tobias Brunner 2990671748 Fix debug output if responder selected invalid traffic selectors during QM 2012-12-13 15:27:28 +01:00
Tobias Brunner 5cb00b3afb Fixed reading of configs in conftest utility 2012-12-13 11:08:32 +01:00
Tobias Brunner caccc0e8cc Avoid that ruby 1.9 redefines snprintf(3) etc. 
Otherwise our custom printf specifiers won't work.
 2012-12-10 11:41:37 +01:00
Tobias Brunner 12e70a7efc Properly initialize linked list when enumerating interface addresses 2012-12-10 09:47:46 +01:00
Tobias Brunner 6a25122bfc rb_cvar_set() takes three arguments in Ruby 1.9 2012-12-10 09:47:46 +01:00
Tobias Brunner d972975d87 Use rb_errinfo() instead of ruby_errinfo for Ruby 1.9 2012-12-10 09:47:46 +01:00
Tobias Brunner afabe7b0ef Use proper Ruby library depending on the available version 2012-12-10 09:47:46 +01:00
Tobias Brunner 5057df5b73 Fixed search for ruby.h in ./configure for newer Ruby releases 2012-12-10 09:47:46 +01:00
Tobias Brunner 07f826af67 Fixed encoding of TLS extensions (elliptic_curves and signature_algorithms) 2012-11-28 10:20:14 +01:00
Tobias Brunner 2cb9a014df New Android release after adding shortcuts and confirmation dialog 
Also fixed some Android 4.2 specific issues.
 2012-11-21 19:07:52 +01:00
Tobias Brunner df3e34fe86 android: Don't allow any backup for now 2012-11-21 19:05:18 +01:00
Tobias Brunner 37d42a76d3 android: Properly handle exceptions when loading keys/certificates 2012-11-21 18:57:41 +01:00
Tobias Brunner 73d0fb0a66 android: Use the same tag string for all dialogs in MainActivity 2012-11-21 18:57:41 +01:00
Tobias Brunner 8c0b32d892 android: Hide previous dialogs when handling a new connection attempt 2012-11-21 18:57:41 +01:00
Tobias Brunner 50b048983c android: Show confirmation dialog when starting a profile while already connected 2012-11-21 18:57:41 +01:00
Tobias Brunner ac3c6ff479 android: Add the ability to create shortcuts to specific VPN profiles 2012-11-21 18:57:41 +01:00
Tobias Brunner 127d83bb21 android: Start a specific VPN profile based on special Intents 2012-11-21 18:57:40 +01:00
Tobias Brunner 7241102ace android: Attribute added to display the list of VPN profiles in read-only mode 2012-11-21 18:57:40 +01:00
Tobias Brunner 35ba45916c Fixed two bugs in logging MSK during EAP-SIM/AKA 
msk is already a pointer to a chunk_t and it was actually not set yet.
 2012-11-21 11:55:55 +01:00
Tobias Brunner 2e50a8e751 android: Show an error if VPN fails due to lock down mode in Android 4.2 2012-11-19 11:43:32 +01:00
Tobias Brunner be2e7ecc2f android: Add error message as argument to "VPN not supported" dialog 2012-11-19 11:43:32 +01:00
Tobias Brunner 0c3b8028e7 android: Content providers are not exported by default in Android 4.2 2012-11-19 11:43:32 +01:00
Tobias Brunner 48e45153f5 android: Set target SDK to 17 (Android 4.2) 2012-11-19 11:43:31 +01:00
Tobias Brunner 277ff80a2e android: Private key bug has been fixed with Android 4.2 2012-11-19 11:43:31 +01:00
Tobias Brunner cbd52e7ddc Limit recursion when searching for source addresses 
This could be required if e.g. two default routes list gateways but the
corresponding outbound interfaces do not have any IP addresses on them.
 2012-11-13 09:06:02 +01:00
Tobias Brunner 5be88ca6bb Don't call get_route recursively if a route's gateway matches the destination 2012-11-13 09:06:02 +01:00
Tobias Brunner 7d41e90846 Fix destruction of tcg_pts_attr_file_meas_t when building from encoding 2012-11-12 12:13:11 +01:00
Tobias Brunner 6782bf3722 Properly define TSS_TROUSERS in configure script 2012-11-12 10:34:04 +01:00
Tobias Brunner 44566c2238 Made TSS implementation configurable and thereby optional 2012-11-08 19:32:41 +01:00
Tobias Brunner eba65182e4 Include 'aggressive' when comparing peer_cfg_t objects 2012-11-07 12:44:58 +01:00
Tobias Brunner bf0bcee9ec Fixed output of longer debug messages 
(v)snprintf(3) returns the length without terminating null byte but the
length given as parameter must include it.
 2012-11-07 12:44:58 +01:00
Tobias Brunner ed05a1a3b7 'signal' is a keyword in MySQL 5.5 
Fixes #251.
 2012-11-07 12:37:23 +01:00
Tobias Brunner acb300f920 android: Use proper intent-filter for our VpnService 2012-11-02 15:55:08 +01:00
Tobias Brunner 214c081dd6 Log sent vendor IDs for IKEv1 2012-11-02 15:52:19 +01:00
Tobias Brunner 531f32d62a Compiler warning fixed 2012-11-02 15:39:51 +01:00
Tobias Brunner 3689f0f6cc FQDNs are actually not resolved when loading secrets 2012-10-29 10:06:43 +01:00
Tobias Brunner f30962de74 Fixed log message when no shared secret is found during IKEv1 Main Mode 2012-10-29 10:04:37 +01:00
Tobias Brunner 2380f3a830 Added documentation for NTLM secrets 2012-10-25 09:51:47 +02:00
Tobias Brunner e34573dd48 Added missing noskip_flag setter/getter to some pa_tnc_attr_t constructors 2012-10-24 17:58:36 +02:00
Tobias Brunner f48e727232 Remove all ESP proposals with non-matching DH group during Quick Mode 
According to RFC 2409, section 5.5, if PFS is used all proposals MUST
include the selected DH group, so we remove proposals without the
proposed group and remove other DH groups from the remaining proposals.
 2012-10-24 16:09:42 +02:00
Tobias Brunner 4eba7269b8 proposal_t.strip_dh() takes a DH group to keep, using MODP_NONE will remove all 2012-10-24 16:09:42 +02:00
Tobias Brunner e74f184cb4 Remove MODP groups from default ESP proposal 
This now actually makes pfs=no the default and it equals the default
listed in ipsec.conf.5. efc69e9f preserved the default of pfs=yes.
 2012-10-24 16:09:42 +02:00
Tobias Brunner bca34c3717 Moved utils.[ch] to utils folder 2012-10-24 16:07:53 +02:00
Tobias Brunner f9625952ad Moved settings_t to utils folder 2012-10-24 16:00:51 +02:00
Tobias Brunner f05b427265 Moved debug.[ch] to utils folder 2012-10-24 16:00:51 +02:00
Tobias Brunner d5c143e5be Moved enum_name_t to utils folder 2012-10-24 16:00:50 +02:00
Tobias Brunner 125b37af6d Moved chunk_t to utils folder 2012-10-24 16:00:50 +02:00
Tobias Brunner 05e448c5cc Moved printf hooks to utils folder 2012-10-24 16:00:50 +02:00
Tobias Brunner 08944b68ac Moved integrity_checker_t to utils folder 2012-10-24 16:00:50 +02:00
Tobias Brunner 12642a6831 Moved data structures to new collections subfolder 2012-10-24 16:00:49 +02:00
Tobias Brunner fdee6b5f5a Moved packet_t and tun_device_t to networking folder 2012-10-24 15:06:18 +02:00
Tobias Brunner 2e7cc07ecd Moved host_t and host_resolver_t to a new networking subfolder 2012-10-24 15:06:18 +02:00
Tobias Brunner 23ca39010e android: Enable ECC in the app as our custom built libcrypto supports it 2012-10-23 18:13:58 +02:00
Tobias Brunner d2c8bc4df0 Handle type of first EAP-RADIUS response more sophisticated 2012-10-18 14:48:11 +02:00
Tobias Brunner a5436657e9 Starter ignores non-fatal errors when reloading config 2012-10-18 14:42:11 +02:00
Tobias Brunner 9e730ef9df Starter unroutes removed or changed connections before loading and routing new ones 2012-10-18 14:42:11 +02:00
Tobias Brunner 21037942e8 Update routed connections in trap manager 
Before this change, modified configs that have been updated with ipsec reload,
could properly be started manually, but the old config would get used if
triggered via trap policies.
 2012-10-18 14:42:10 +02:00
Tobias Brunner 3555bacac7 Reload logger configuration on SIGHUP 
Besides changing the configuration this allows to easily rotate log files.

Also moved logger initialization back to daemon_t.
 2012-10-18 14:42:10 +02:00
Tobias Brunner d35d669180 Make syslog and file loggers configurable at runtime 2012-10-18 14:42:10 +02:00
Tobias Brunner 18a8893e8e Store loggers in conftest separately, not on charon 2012-10-18 14:42:10 +02:00
Tobias Brunner 3c4d383443 Added an option to reload certificates from PKCS#11 tokens on SIGHUP 2012-10-18 14:42:09 +02:00
Tobias Brunner ca1c2ee281 Copy the name of pkcs11_library_t objects 
Strings returned by settings_t.create_section_enumerator will be freed
when the config is reloaded.
 2012-10-18 14:42:09 +02:00
Tobias Brunner c30573467b New Android release after adding MOBIKE support 2012-10-18 14:03:38 +02:00
Tobias Brunner 8bd00205f4 Merge branch 'android-mobility' 
This brings support for MOBIKE to the Android app.  The app also tries
to keep the connection up as long as possible.

DNS queries are now handled by a new class that uses independent threads to
resolve them, this allows to cancel them e.g. if no network connectivity is
available (otherwise the app would block until the DNS query returns).
 2012-10-18 12:28:14 +02:00
Tobias Brunner 25a413cb96 Use a shortcut to resolve numeric IP addresses (no need for separate threads) 2012-10-18 12:27:32 +02:00
Tobias Brunner d377556863 Use native threads in host resolver so that it works even if processor has no threads 2012-10-18 12:26:49 +02:00
Tobias Brunner b4f6c39e55 Terminate unused resolver threads after a timeout 2012-10-18 12:26:00 +02:00
Tobias Brunner 49e2d109a3 Only create more threads if needed in host_resolver_t 2012-10-18 12:26:00 +02:00
Tobias Brunner eecd41e349 Use a helper function to add milliseconds to timeval structs 2012-10-18 12:25:59 +02:00
Tobias Brunner 2b6088c718 android: Ignore if peer is unreachable when reestablishing an SA 2012-10-18 12:25:59 +02:00
Tobias Brunner 901f6ac403 android: Use a shorter timeout for retransmits 2012-10-18 10:57:55 +02:00
Tobias Brunner 8658e87b35 android: Use keyingtries=%forever and dpd|closeaction=restart 
We also ignore the CHILD_SA_DOWN event.

This should allow us to keep the connection up as long as the user does
not manually disconnect.
 2012-10-18 10:57:55 +02:00
Tobias Brunner 292d8f41c3 Resolve hosts by DNS name in separate threads so we can cancel them 
getaddrinfo(3) may block a long time so proper termination of the daemon may
block if DNS servers are not reachable.

getaddrinfo(3) is an optional cancellation point in posix threads so it
might still block a shutdown but at least on Android (with the signal based
pthread_cancel implementation) it works, on Linux starter will kill charon
anyway after a while.
 2012-10-18 10:57:55 +02:00
Tobias Brunner 272ce5b580 android: Handle unreachable peers via alert 2012-10-16 14:16:17 +02:00