denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
10,530 Commits 1 Branch 0 Tags
39db06f1551b7d688c7523ea33b8766f17e21970
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Tobias Brunner 39db06f155 Merge branch 'dnssec' 2013-02-19 12:25:27 +01:00
Tobias Brunner d69eb0375f NEWS about ipseckey and unbound plugins added 2013-02-19 12:25:01 +01:00
Tobias Brunner 96a2d2077b Fix 'stroke loglevel any' 
Before b46a5cd4 this worked if debug_t was unsigned.  In that case -1,
as returned by enum_from_name(), would result in a large positive number.
So any unknown debug group (including 'any') had the same effect that
was only intended for 'any'.
 2013-02-13 12:18:20 +01:00
Tobias Brunner 98063d8187 Don't use a time_t variable with fscanf when parsing uptime 
Because "%u" is used as format string in the fscanf call that parses the
uptime and because the length of time_t varies on different platforms
and architectures the value was not written properly if time_t was longer
than an unsigned int and depending on how the target variable was aligned
on the stack.  Since there is no conversion specifier to properly parse a
time_t value we use the appropriate integer type instead.
 2013-02-08 11:33:13 +01:00
Tobias Brunner af5452ba76 Allow more than one CERTREQ payload for IKEv2 
There is no reason not to do so (RFC 5996 explicitly mentions multiple
CERTREQ payloads) and some implementations seem to use the same behavior
as had to be used with IKEv1 (i.e. each CA in its own CERTREQ payload).
 2013-02-08 11:28:56 +01:00
Tobias Brunner 2ccdc19ed9 Report enabled plugins at the end of configure 2013-02-04 16:24:58 +01:00
Tobias Brunner f2b508c1ab Streamlined comments in configure.in 
dnl should only be used in rare cases (like escaping newlines)
 2013-02-04 16:24:58 +01:00
Tobias Brunner 39a6c39519 Updated configure.in to newer autoconf 
AC_TRY_COMPILE and AC_TRY_RUN are deprecated.  The new construct with
AC_*_IFELSE and AC_LANG_PROGRAM requires double quoting the source code
of these test programs.
 2013-02-04 16:24:58 +01:00
Tobias Brunner eaf752d203 Add a configure option to disable all default plugins 
The --disable-defaults option disables all plugins that would be
enabled by default.  This allows to selectively enable specific plugins
without issues when new default options get added in future releases.
 2013-02-04 16:24:58 +01:00
Tobias Brunner a3a190b7bd openssl: Properly honor OPENSSL_NO_* defines 2013-01-31 17:33:23 +01:00
Tobias Brunner 25637aa5d8 Fix Doxygen comment for rdrand plugin 2013-01-31 12:11:37 +01:00
Tobias Brunner 9d9410e7b9 Typo in strongswan.conf(5) man page fixed 2013-01-31 11:52:11 +01:00
Tobias Brunner c186b3940a Documented new options in strongswan.conf(5) man page 2013-01-25 20:22:20 +01:00
Tobias Brunner 58fd1f3eef Don't use pointer to a union member in host_create_from_string_and_family() 2013-01-25 13:18:50 +01:00
Tobias Brunner 572a707765 Properly check MSB in openssl plugin's PKCS#7 implementation 2013-01-24 23:36:02 +01:00
Tobias Brunner 9ccfeb8ca1 Use proper buffer sizes for parse_smartcard() 2013-01-24 23:35:42 +01:00
Tobias Brunner 677812dc66 Cast first argument for %.*s to int 2013-01-24 23:35:42 +01:00
Tobias Brunner bacbf91c5c Removed unused command name when printing usage info for lookip 2013-01-24 23:35:41 +01:00
Tobias Brunner d7bd0ad7df Removed unused argument 2013-01-24 23:35:34 +01:00
Tobias Brunner 4cd3fb788d Properly read data from stream in pki --pkcs7 2013-01-24 19:13:41 +01:00
Tobias Brunner 27a814b527 Properly destroy mem_cred object on pki --pkcs7 --help 2013-01-24 19:13:41 +01:00
Tobias Brunner 39896d92ed Try to determine OS type if name and version are configured 2013-01-24 19:13:41 +01:00
Tobias Brunner 24cdf5340e Add missing va_end() call 2013-01-24 19:13:41 +01:00
Tobias Brunner 69c6a60176 g_thread_init() is deprecated since Glib 2.23 2013-01-24 19:13:40 +01:00
Tobias Brunner 2ec3552fce Fix check-in of IKE_SA when IKE_SA_INIT fails and hash table is enabled 
Setting the responder SPI to 0 can only be done while generating the
response, otherwise we'd fail to check in the IKE_SA again in case the
hash table is enabled.  That's because we use the responder SPI as hash
value since 5.0.0.
 2013-01-24 19:13:40 +01:00
Tobias Brunner 4eb09d14e2 Avoid a deadlock when installing a trap policy failed 2013-01-23 15:51:47 +01:00
Tobias Brunner ae82265a46 Add the ability to use a named pool for conftest configs 2013-01-21 11:46:20 +01:00
Tobias Brunner 0c006341f3 Merge branch 'debian-testing' 
These changes update the integration test system.  It previously was based
on a pretty much unmaintainable Gentoo root image and the dated UML
virtualization technology.  Among many other changes the test environment
is now based on KVM and uses reproducible Debian-based guest images.

Conflicts:
	NEWS
 2013-01-17 17:00:05 +01:00
Tobias Brunner 737912239f NEWS about updated integration tests added 2013-01-17 16:56:02 +01:00
Tobias Brunner 232af2fab5 Updated documentation for the integration tests 2013-01-17 16:56:02 +01:00
Tobias Brunner 812cd9c18a Removed UML from description of ikev2/default-keys test 2013-01-17 16:56:02 +01:00
Tobias Brunner b1169a880a Updated comments in test.conf of all tests 2013-01-17 16:56:02 +01:00
Tobias Brunner 7699a928f7 Renamed $UMLHOSTS to $VIRTHOSTS 2013-01-17 16:56:02 +01:00
Tobias Brunner 16cd6f63e2 Don't refer to recipes and images via $TESTDIR 
This way no symlink to the testing directory is required in $TESTDIR.
 2013-01-17 16:54:57 +01:00
Tobias Brunner ac8c96e51b Patch iptables for use with HA kernel patch (XFRM hooks) 2013-01-17 16:54:56 +01:00
Tobias Brunner 1a16b170ba start-testing requires virsh 2013-01-17 16:54:56 +01:00
Tobias Brunner 18bce26ea6 Use key(and password-)less SSH authentication 2013-01-17 15:22:09 +01:00
Tobias Brunner ffe710ae71 Patch AVP parsing in EAP-TTLS module in FreeRADIUS 2013-01-17 15:22:08 +01:00
Tobias Brunner d47b751850 Add recipes for libtnc and TNC@FHH 2013-01-17 15:22:08 +01:00
Tobias Brunner 669fc9f9ec Copy and display host specific tcpdump.log files 2013-01-17 15:22:08 +01:00
Tobias Brunner b460fb1dd2 Drop SHAREDTREE in favor of mounting the compile dir 2013-01-17 15:22:08 +01:00
Tobias Brunner 633bee03fc Patch EAP-SIM module in FreeRADIUS 2013-01-17 15:22:08 +01:00
Tobias Brunner d94f6a2ff6 Don't generate do-tests 2013-01-17 15:22:08 +01:00
Tobias Brunner 30abe1fd19 android: Properly escape apostrophes in Ukrainian translation 2013-01-14 17:23:52 +01:00
Tobias Brunner b9cda4f3e1 android: Implement kernel_net_t.get_interface via JNI 
This is now required to properly accept/install a virtual IP address.

Fixes #275.
 2013-01-14 17:22:56 +01:00
Tobias Brunner 53ce5c4c91 android: Moved chunk_from_byte_array and byte_array_from_chunk helper functions 2013-01-14 17:19:58 +01:00
Tobias Brunner ecff0e5685 android: Set OPENSSL_NO_CMS in Android.mk as it is not set in opensslconf.h on Android 2013-01-14 17:16:18 +01:00
Tobias Brunner 66bb4f63b2 Properly send IKEv1 packets if no ike_cfg is known yet 
This applies for error notifies.
 2013-01-14 12:14:16 +01:00
Tobias Brunner 37fb404833 Android.mk of libstrongswan updated 2013-01-14 09:16:33 +01:00
Tobias Brunner 21235e1ec2 Merge branch 'ikev1-fragmentation' 
This adds support for the proprietary IKEv1 fragmentation extension.

Conflicts:
	NEWS
 2013-01-12 11:58:26 +01:00
Tobias Brunner f31b418094 NEWS for fragmentation extension added 
Conflicts:
	NEWS
 2013-01-12 11:56:12 +01:00
Tobias Brunner ee6902ef7f Added an option to configure the maximum size of a fragment 2013-01-12 11:54:58 +01:00
Tobias Brunner 7ae245f685 Properly detect fragmentation capabilities 
Cisco sends 0xc0000000 so we check that part of the VID separately.
 2013-01-12 11:54:54 +01:00
Tobias Brunner 365d9a6f67 Added an option that allows to force IKEv1 fragmentation 2013-01-12 11:54:32 +01:00
Tobias Brunner 97973f8609 Use a connection specific option to en-/disable IKEv1 fragmentation 2012-12-24 13:00:01 +01:00
Tobias Brunner e645c15b9c Include source port in init hash for fragmented messages 2012-12-24 12:29:31 +01:00
Tobias Brunner 2f62bb1549 Add an option to en-/disable IKE fragmentation 
Fragments are always accepted but will not be sent if disabled.  The
vendor ID is only sent if the option is enabled.
 2012-12-24 12:29:31 +01:00
Tobias Brunner 5cafefcd5d Split larger messages into fragments if IKE fragmentation is supported by peer 2012-12-24 12:29:31 +01:00
Tobias Brunner c849305ad7 Log message size for in- and outbound IKE messages 2012-12-24 12:29:30 +01:00
Tobias Brunner 07df944c9c Add support to create IKE fragments 
All fragments currently use the same fragment ID (1) as that's what
other implementations are doing.
 2012-12-24 12:29:30 +01:00
Tobias Brunner c4daac2c0b Log added NAT-T vendor IDs 2012-12-24 12:29:27 +01:00
Tobias Brunner 667720c801 Detect a peer's support for IKE fragmentation 
Fragments are accepted even if this vendor ID is not seen.
 2012-12-24 12:29:27 +01:00
Tobias Brunner fe26ddada9 Map fragmented initial initial Main or Aggressive Mode messages to the same IKE_SA 2012-12-24 12:29:27 +01:00
Tobias Brunner b816037739 Allow ID_PROT/AGGRESSIVE messages for established IKE_SAs if they contain fragments 
Other implementations send fragments always in an initial message type
even for transaction or quick mode exchanges.
 2012-12-24 12:29:27 +01:00
Tobias Brunner 8fc8383439 Don't handle fragmented messages larger than charon.max_packet 2012-12-24 12:29:27 +01:00
Tobias Brunner 7d85f94165 Don't update an IKE_SA-entry's cached message ID when handling fragments 2012-12-24 12:29:26 +01:00
Tobias Brunner 30216000d3 Store inbound IKE fragments and reassemble the message when all fragments are received 2012-12-24 12:29:26 +01:00
Tobias Brunner 9b1659f52c Add message rules to properly handle IKE fragments 
These are sent in unencrypted messages and are the only payload
contained in such messages.
 2012-12-24 10:24:48 +01:00
Tobias Brunner ddfad8b67e Reset the encrypted flag when handling IKE messages that contain a fragment 
Racoon sets the encrypted bit for messages containing a fragment, but these
messages are not really encrypted (the fragmented message is though).
 2012-12-24 10:24:48 +01:00
Tobias Brunner 8f0ab6dd36 Payload added to handle IKE fragments 2012-12-24 10:24:48 +01:00
Tobias Brunner ef33a4ab82 Fixed some typos, courtesy of codespell 2012-12-20 09:35:26 +01:00
Tobias Brunner 0080daa787 Fix deadlock in IMC/IMV managers 
Since reserve_id() might be called from e.g. notify_connection_change()
using a write lock will not work as this can't be acquired while holding
the read lock.

Also, with the previous code it was possible that two IMCs/IMVs added by
two threads at the same time would get the same ID assigned.
 2012-12-18 15:59:29 +01:00
Tobias Brunner 6a8eeba540 Properly select IMC/IMV according to given primary ID in reserve_id() 2012-12-18 15:59:29 +01:00
Tobias Brunner 283898d6e0 Fix traffic selectors also as initiator in case of transport mode over NAT 2012-12-13 15:27:29 +01:00
Tobias Brunner 2990671748 Fix debug output if responder selected invalid traffic selectors during QM 2012-12-13 15:27:28 +01:00
Tobias Brunner 5cb00b3afb Fixed reading of configs in conftest utility 2012-12-13 11:08:32 +01:00
Tobias Brunner caccc0e8cc Avoid that ruby 1.9 redefines snprintf(3) etc. 
Otherwise our custom printf specifiers won't work.
 2012-12-10 11:41:37 +01:00
Tobias Brunner 12e70a7efc Properly initialize linked list when enumerating interface addresses 2012-12-10 09:47:46 +01:00
Tobias Brunner 6a25122bfc rb_cvar_set() takes three arguments in Ruby 1.9 2012-12-10 09:47:46 +01:00
Tobias Brunner d972975d87 Use rb_errinfo() instead of ruby_errinfo for Ruby 1.9 2012-12-10 09:47:46 +01:00
Tobias Brunner afabe7b0ef Use proper Ruby library depending on the available version 2012-12-10 09:47:46 +01:00
Tobias Brunner 5057df5b73 Fixed search for ruby.h in ./configure for newer Ruby releases 2012-12-10 09:47:46 +01:00
Tobias Brunner 07f826af67 Fixed encoding of TLS extensions (elliptic_curves and signature_algorithms) 2012-11-28 10:20:14 +01:00
Tobias Brunner 2cb9a014df New Android release after adding shortcuts and confirmation dialog 
Also fixed some Android 4.2 specific issues.
 2012-11-21 19:07:52 +01:00
Tobias Brunner df3e34fe86 android: Don't allow any backup for now 2012-11-21 19:05:18 +01:00
Tobias Brunner 37d42a76d3 android: Properly handle exceptions when loading keys/certificates 2012-11-21 18:57:41 +01:00
Tobias Brunner 73d0fb0a66 android: Use the same tag string for all dialogs in MainActivity 2012-11-21 18:57:41 +01:00
Tobias Brunner 8c0b32d892 android: Hide previous dialogs when handling a new connection attempt 2012-11-21 18:57:41 +01:00
Tobias Brunner 50b048983c android: Show confirmation dialog when starting a profile while already connected 2012-11-21 18:57:41 +01:00
Tobias Brunner ac3c6ff479 android: Add the ability to create shortcuts to specific VPN profiles 2012-11-21 18:57:41 +01:00
Tobias Brunner 127d83bb21 android: Start a specific VPN profile based on special Intents 2012-11-21 18:57:40 +01:00
Tobias Brunner 7241102ace android: Attribute added to display the list of VPN profiles in read-only mode 2012-11-21 18:57:40 +01:00
Tobias Brunner 35ba45916c Fixed two bugs in logging MSK during EAP-SIM/AKA 
msk is already a pointer to a chunk_t and it was actually not set yet.
 2012-11-21 11:55:55 +01:00
Tobias Brunner 2e50a8e751 android: Show an error if VPN fails due to lock down mode in Android 4.2 2012-11-19 11:43:32 +01:00
Tobias Brunner be2e7ecc2f android: Add error message as argument to "VPN not supported" dialog 2012-11-19 11:43:32 +01:00
Tobias Brunner 0c3b8028e7 android: Content providers are not exported by default in Android 4.2 2012-11-19 11:43:32 +01:00
Tobias Brunner 48e45153f5 android: Set target SDK to 17 (Android 4.2) 2012-11-19 11:43:31 +01:00
Tobias Brunner 277ff80a2e android: Private key bug has been fixed with Android 4.2 2012-11-19 11:43:31 +01:00
Tobias Brunner cbd52e7ddc Limit recursion when searching for source addresses 
This could be required if e.g. two default routes list gateways but the
corresponding outbound interfaces do not have any IP addresses on them.
 2012-11-13 09:06:02 +01:00
Tobias Brunner 5be88ca6bb Don't call get_route recursively if a route's gateway matches the destination 2012-11-13 09:06:02 +01:00