denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
15,841 Commits 1 Branch 0 Tags
38a8ecadb7d9e183d1c869ad0b8f60a12f9d34d4
Commit Graph
12458 Commits
Author SHA1 Message Date
Andreas Steffen f2eb367adc Implemented EdDSA for IKEv2 using a pro forma Identity hash function 2016-12-14 11:15:48 +01:00
Andreas Steffen d47ad3d67e Added Ed25519 ref10 implementation from libsodium 2016-12-14 11:15:47 +01:00
Andreas Steffen 35bc60cc68 Added support of EdDSA signatures 2016-12-14 11:15:47 +01:00
Tobias Brunner 564a199674 kernel-netlink: Add support for AES-CMAC-96 (RFC 4494) 
The kernel apparently supports this since 3.10.
 2016-12-12 11:43:06 +01:00
Tobias Brunner 8c859e86d6 android: New release after re-adding support for ECC Brainpool curves 2016-12-10 12:28:09 +01:00
Tobias Brunner f20b3f7b2c openssl: BoringSSL doesn't provide curve data for ECC Brainpool curves 2016-12-10 12:27:47 +01:00
Tobias Brunner aae9a9e678 android: New release after fixing libtpmtss issue 2016-12-09 11:18:17 +01:00
Tobias Brunner 9920824e70 android: Make sure libtpmtss is loaded on older systems 
On newer Android systems this seems to happen automatically (or does at
least not cause crashes if the library is not loaded).
 2016-12-09 11:16:42 +01:00
Tobias Brunner 708f9c7f65 android: New release after adding notification 2016-12-08 17:37:21 +01:00
Tobias Brunner 3e85b5a492 android: Ensure that the certificates are loaded when accessing them via JNI 2016-12-08 17:14:49 +01:00
Tobias Brunner 85059424a7 android: Add a public notification 2016-12-08 17:14:49 +01:00
Tobias Brunner d5070425a0 android: Display a permanent notification while connected 
This forces the service to run in the foreground, meaning the system
won't kill it when low on memory.
 2016-12-08 17:14:49 +01:00
Tobias Brunner e03c936982 android: Log any installed DNS servers 2016-12-08 17:14:49 +01:00
Tobias Brunner d6d12bab14 android: Unregister listener in case of error alerts 
This avoids triggering additional errors via e.g. ike_updown() that
might cause the error message displayed in the GUI to change if the
status fragment is recreated.

References #2134.
 2016-12-08 17:13:16 +01:00
Tobias Brunner ef2ad9db1c android: Report an error for invalid integer values 
Previously we'd just ignore the invalid values without notifying the
user.
 2016-12-08 16:43:51 +01:00
Tobias Brunner cefbf2bf9b android: Propose curve25519 in the ESP proposals 2016-12-08 16:43:51 +01:00
Tobias Brunner fec47b6146 android: Enable curve25519 plugin in the app 2016-12-08 16:43:51 +01:00
Tobias Brunner b077a2a71a android: Optionally build the curve25519 plugin 2016-12-08 16:43:51 +01:00
Tobias Brunner 5f0913fc1e android: Propose ChaCha20/Poly1305 in the ESP AEAD proposals 2016-12-08 16:43:50 +01:00
Tobias Brunner 8c0b38e9df android: Enable chapoly plugin in the app 2016-12-08 16:43:50 +01:00
Tobias Brunner 4d47adb639 android: Optionally build the chapoly plugin 2016-12-08 16:43:50 +01:00
Tobias Brunner 03472aea1f android: Update Gradle plugin and wrapper 2016-12-08 16:43:50 +01:00
Thomas Egerer 8c50bb6c36 ikev1: Minor code optimization in task manager 
Signed-off-by: Thomas Egerer <[email protected]>
 2016-12-07 10:37:46 +01:00
Tobias Brunner 5078f87a52 plugin-loader: Strip '!' from critical plugin names when setting paths 2016-11-18 12:21:49 +01:00
Thomas Egerer 1042b9194f child-sa: Use single return statement in update_usebytes() 
Signed-off-by: Thomas Egerer <[email protected]>
 2016-11-18 11:58:14 +01:00
Martin Willi 649537ee8d proposal: Remove RFC 5114 MODP DH groups from default proposal 
Recent research demonstrates that at least for 1024-bit DH groups, it is
possible to create specially crafted primes having a backdoor. From the
prime itself this is not detectable, creating a perfect NOBUS attack.

http://eprint.iacr.org/2016/961

For the primes defined in RFC 5114 no information is provided on how these
have been selected. In the default proposal we included one of the 2048-bit
primes only, where it is questionable if constructing a backdoored prime is
feasible. Nevertheless, this patch removes the group from the set of default
proposals as well.
 2016-11-15 17:20:40 +01:00
Andreas Steffen 99c03e9a11 testing: make curve25519 the default DH group 2016-11-14 16:20:51 +01:00
Tobias Brunner 549b325d9d proposal: Add curve25519 and curve448 to default proposal 2016-11-14 16:20:51 +01:00
Martin Willi bd0aa66e45 curve22519: Add a portable backend implemented in plain C 2016-11-14 16:20:51 +01:00
Martin Willi 7f9bfacd5a curve25519: Add a plugin providing Curve25519 DH using backend drivers 2016-11-14 16:20:51 +01:00
Martin Willi 1c26835a0a test-vectors: Add a Curve25519 DH test vector 2016-11-14 16:20:51 +01:00
Martin Willi 8935842c2e proposal: Add a curve25519 proposal keyword 2016-11-14 16:20:51 +01:00
Martin Willi a4195d3841 diffie-hellman: Add DH group identifiers for Curve25519 and Curve448 2016-11-14 16:20:51 +01:00
Tobias Brunner ee5da1633a bus: Re-add ampersand that got lost in refactoring 
Fixes: 4af02c6c61 ("bus: Fix maximum log level for different groups
after removal of a logger")
 2016-11-14 15:15:11 +01:00
Tobias Brunner da1d5cd2e6 peer-cfg: Fix memory leak when replacing child configs 
Fixes: 622c2b2c33 ("peer-cfg: Add method to atomically replace child
configs")
 2016-11-11 15:34:33 +01:00
Tobias Brunner 4af02c6c61 bus: Fix maximum log level for different groups after removal of a logger 
The log level was incorrectly set to the same value for all groups.

Fixes: dac15e03c8 ("bus: Fix maximum log levels when mixing log/vlog
implementing loggers")
 2016-11-11 15:33:44 +01:00
Volker Rümelin d17b780eaa farp: Fix BPF jump false offset 
Jump to BPF_STMT(BPF_RET+BPF_K, 0) if protocol_size != 4
 2016-10-31 14:46:14 +01:00
Andreas Steffen 880c312458 Fixed in-place update of cached base and delta CRLs 2016-10-30 16:37:24 +01:00
Andreas Steffen 2271ebb325 Newer CRLs replace older versions of the CRL in the cache 2016-10-26 12:48:54 +02:00
Tim Kent 87875086d0 connmark: Add CAP_NET_RAW to capabilities keep list 
Fix for "Permission denied (you must be root)" error when calling
iptc_init(), which opens a RAW socket to communicate with the kernel,
when built with "--with-capabilities=libcap".

Closes strongswan/strongswan#53.
Fixes #2157.
 2016-10-25 09:46:23 +02:00
Tobias Brunner 07bbd2f642 nm: Enable IKE fragmentation 2016-10-20 08:03:26 +02:00
Andreas Steffen cb8f436112 added XOF dependencies of bliss and ntru plugins 2016-10-18 16:28:43 +02:00
Tobias Brunner 8564535c23 newhope: Fix Doxygen group name 2016-10-14 18:41:25 +02:00
Tobias Brunner ad71db18f1 libnttfft: Fix Doxygen group 2016-10-14 18:37:14 +02:00
Tobias Brunner 955ce91652 Fixed some typos, courtesy of codespell 2016-10-14 18:09:09 +02:00
Tobias Brunner d3beae1311 newhope: Properly release allocated arrays if RNG can't be created 2016-10-14 15:24:04 +02:00
Tobias Brunner b9c4b15a53 nm: Add D-Bus policy to the distribution 2016-10-14 14:11:23 +02:00
Tobias Brunner 542b464e25 nm: Version bump to 1.4.1 2016-10-14 09:52:11 +02:00
Christophe Gouault a63a7af197 kernel-netlink: Fix get_route() interface determination 
A wrong variable is used (route instead of best), so much that the
returned interface belongs to the last seen route instead of the best
choice route.

get_route() may therefore return mismatching interface and gateway.

Fixes: 66e9165bc6 ("kernel-netlink: Return outbound interface in get_nexthop()")

Signed-off-by: Christophe Gouault <[email protected]>
 2016-10-12 19:25:31 +02:00
Andreas Steffen 85b5a6ace2 Save both base and delta CRLs to disk 2016-10-11 17:18:22 +02:00