denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
9,430 Commits 1 Branch 0 Tags
4a2081430056cebc760638bd96eb685e184835cb
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Tobias Brunner 4a20814300 Added android.net.VpnService wrapper around charon (loaded via JNI). 2012-08-08 15:09:31 +02:00
Tobias Brunner da848ab894 Added Android shell app created with Android SDK. 2012-08-08 15:09:30 +02:00
Tobias Brunner 2f203aee0e Android.mk for NDK build added. 2012-08-08 15:09:30 +02:00
Tobias Brunner 3fa8d7738e Extracted some parts from Android.mk.in which can be used for NDK builds. 2012-08-08 15:07:43 +02:00
Tobias Brunner 80b267f9e3 Use filter instead of findstring to check for enabled plugins in Android.mk. 
findstring is not prefix-safe (i.e. android matches android-log). On
the other hand filter matches words separated by whitespace and if no
wildcard (%) is used the full word has to match.
 2012-08-08 15:07:43 +02:00
Tobias Brunner 162621ed57 Moved Android specific logger to separate plugin. 
This is mainly because the other parts of the existing android plugin
can not be built in the NDK (access to keystore and system properties are
not part of the stable NDK libraries).
 2012-08-08 15:07:43 +02:00
Tobias Brunner 657a3ba609 Link android plugin against liblog in the NDK. 
Doesn't seem to hurt the build within the source tree.
 2012-08-08 15:07:43 +02:00
Tobias Brunner e7ea057fd2 Make the UDP ports charon listens for packets on (and uses as source ports) configurable. 2012-08-08 15:07:43 +02:00
Tobias Brunner 73940eb712 Make path to Android OpenSSL headers configurable. 2012-08-08 15:07:43 +02:00
Tobias Brunner 4528e74a5c Don't require STRONGSWAN_CONF to be defined. 2012-08-08 15:07:42 +02:00
Tobias Brunner a9f169f699 Don't require PLUGINDIR to be defined. 
If it is not available, we just load monolithically built plugins.
 2012-08-08 15:07:42 +02:00
Tobias Brunner 6204c1182d Include src address in hash of initial message for Main Mode 
If two initiators use the same SPI and also use the same SA proposal the
hash for the initial message would be exactly the same.  For IKEv2 and
Aggressive Mode that's not a problem as these messages include random
data (Ni, KEi payloads).
 2012-08-08 14:47:36 +02:00
Tobias Brunner decc467a4f Implemented recursive mutex without thread-specific counter 2012-08-03 11:30:18 +02:00
Tobias Brunner 920f29e7d5 Use a single thread-specific value for our custom rwlock_t implementation 
The pthread implementation on Android currently only supports 64
different thread-specific values per process, which we hit easily when
every rwlock_t requires one.
 2012-08-03 11:30:18 +02:00
Tobias Brunner 63ac6d00b0 Proper fallback if capability dropping is not available 2012-07-27 14:46:42 +02:00
Tobias Brunner 8ff1094823 The use of $< in Makefiles is not portable 
It requires GNU make which is not what most people use on e.g. FreeBSD.

Fixes #205.
 2012-07-27 13:47:59 +02:00
Tobias Brunner d511a71daa Include stdint.h for UINTxx_MAX defines 
Fixes #205.
 2012-07-27 13:47:59 +02:00
Tobias Brunner 126eb2af59 Check rng return value when generating secrets and IVs in libtls 2012-07-16 14:53:37 +02:00
Tobias Brunner e59f983160 Check rng return value when generating identity in eap-simaka-reauth plugin 2012-07-16 14:53:36 +02:00
Tobias Brunner e37f9ac2c9 Check rng return value when generating pseudonym in eap-simaka-pseudonym plugin 2012-07-16 14:53:36 +02:00
Tobias Brunner 8beeb8e116 Check rng return value when generating nonces in eap-aka plugin 2012-07-16 14:53:36 +02:00
Tobias Brunner 18ce1bb721 Check rng return value when generating nonces in eap-sim plugin 2012-07-16 14:53:36 +02:00
Tobias Brunner cfd824ccde Check rng return value when generating nonces in libpts 2012-07-16 14:53:36 +02:00
Tobias Brunner 10b6ca5fb2 Check rng return value when generating RAND in eap-aka-3gpp2 plugin 2012-07-16 14:53:36 +02:00
Tobias Brunner 162f489a27 Check rng return value when generating challenges in eap-md5 and mschapv2 plugins 2012-07-16 14:53:36 +02:00
Tobias Brunner 7ae2671036 Check rng return value when generating Transaction IDs in DHCP plugin 2012-07-16 14:53:36 +02:00
Tobias Brunner 0159a54047 Check rng return value when generating SPIs in kernel-klips plugin 2012-07-16 14:53:36 +02:00
Tobias Brunner 99dc3d2c15 Check rng return value when seeding OpenSSL RNG 2012-07-16 14:53:36 +02:00
Tobias Brunner 1f5291b1ce Check rng return value when generating DH secret in gcrypt plugin 2012-07-16 14:53:36 +02:00
Tobias Brunner 5025135f70 Check rng return value when generating DH secrets and primes in gmp plugin 2012-07-16 14:53:35 +02:00
Tobias Brunner e93bb353d5 Check rng return value when generating serial numbers in pki utility 2012-07-16 14:53:35 +02:00
Tobias Brunner 5668a99a12 Wrapper functions added to generate non-zero random bytes 2012-07-16 14:53:35 +02:00
Tobias Brunner 392a9b1109 Check rng return value when generating SCEP sender nonce 2012-07-16 14:53:35 +02:00
Tobias Brunner ae56e1eb97 Check rng return value when generating OCSP nonces 2012-07-16 14:53:35 +02:00
Tobias Brunner 3c73911174 Check rng return value when generating key and IV in PKCS#7 wrapper 2012-07-16 14:53:35 +02:00
Tobias Brunner f1c78cfee7 Check rng return value when generating ME CONNECT_ID and KEY 2012-07-16 14:53:35 +02:00
Tobias Brunner 1bb9c51e87 Check rng return value when generating IKEv1 message IDs 2012-07-16 14:53:35 +02:00
Tobias Brunner 504918348d Check rng return value when generating COOKIE2 during MOBIKE 2012-07-16 14:53:35 +02:00
Tobias Brunner 0c096e9bb5 Check rng return value when generating COOKIE secret in receiver 2012-07-16 14:53:35 +02:00
Tobias Brunner 92f207477c Check rng return value when generating fake NAT detection payloads 2012-07-16 14:53:35 +02:00
Tobias Brunner ca9b68eb9e Check rng return value when encrypting encryption payload 2012-07-16 14:53:35 +02:00
Tobias Brunner 5d91d8c469 Check rng return value when generating SPIs in ike_sa_manager_t 2012-07-16 14:53:35 +02:00
Tobias Brunner 8a8364f26e Check rng return value in crypto tester 2012-07-16 14:53:34 +02:00
Tobias Brunner ce024c1662 Relay rng return value in nonce plugin 2012-07-16 14:53:34 +02:00
Tobias Brunner 39e807728e RNGs' get_bytes and allocate_bytes return boolean 2012-07-16 14:53:34 +02:00
Tobias Brunner d5962b874f Compilation error fixed if dladdr is not available 2012-07-14 11:43:40 +02:00
Tobias Brunner 893c3a4ead Simplify NAT-D payload creation if UDP encapsulation is forced 
We don't need any address lookups in that case as the content of the
payload is generated randomly anyway.
 2012-07-13 11:13:43 +02:00
Tobias Brunner 8d98f7fef6 Avoid that any % characters (e.g. in %any) are evaluated when logging via stroke 2012-07-12 16:58:00 +02:00
Tobias Brunner d15975c7f2 Added PLUGIN_NOOP to separate PLUGIN_PROVIDE from previous CALLBACK/REGISTER entries 2012-07-12 16:54:03 +02:00
Tobias Brunner c0b1fc7f8b Android.mk of libstrongswan adapted to config.h changes 2012-07-12 09:56:44 +02:00
Tobias Brunner 2b19dd3502 Properly cleanup thread-local values for the threads destroying thread_value_t objects 2012-07-12 09:43:27 +02:00
Tobias Brunner ee7b7de18f getpwnam_r and getgrnam_r are not supported by the Android NDK 2012-07-09 17:52:01 +02:00
Tobias Brunner 7399119e58 Android.mk of libstrongswan updated 2012-07-09 17:52:01 +02:00
Tobias Brunner 4f07a19d10 Fixed help text for --disable-xauth-generic plugin 2012-07-05 09:46:59 +02:00
Tobias Brunner 644c6c968d Use spin locks to update IKE_SAs in controller_t 
This ensures the listeners don't miss any events after the SAs have been
checked out in the asynchronously executed jobs.  This is a matter of
memory visibility and not primary a matter of exclusive access.
 2012-07-04 10:13:50 +02:00
Tobias Brunner 12fa85c664 Added wrapper for POSIX spin locks 2012-07-04 10:13:49 +02:00
Tobias Brunner c9355ea4a0 Fixed job handling in controller_t 
Also IKE_SAs are now checked out in the jobs and not before.
 2012-07-04 10:13:49 +02:00
Tobias Brunner 901dbc1077 openssl: Ensure the thread ID is never zero 
This might otherwise cause problems because OpenSSL tries to lock
mutexes recursively if it assumes the lock is held by a different
thread e.g. during FIPS initialization.
 2012-07-03 12:02:57 +02:00
Tobias Brunner a60e92a2c8 Added GPL header to AndroidConfigLocal.h 2012-06-29 16:51:29 +02:00
Tobias Brunner f3af4969a7 Added GPL header to scripts 2012-06-29 16:51:29 +02:00
Tobias Brunner 1a06ba1849 Added LICENSE file to the distribution 2012-06-29 16:51:29 +02:00
Tobias Brunner f59240e9ae Added OpenSSL/GPL exception to LICENSE file 
Also updated other parts of the license.
 2012-06-29 16:51:29 +02:00
Tobias Brunner e516068965 Removed superfluous remove_hasher() call in md5 plugin 2012-06-29 16:23:20 +02:00
Tobias Brunner bbbffac3ab Defined a macro to replace strerror(3) with calls to thread-safe wrapper 2012-06-28 13:14:52 +02:00
Tobias Brunner 2a59527659 Thread-safe wrapper around strerror(3)/strerror_r(3) added 2012-06-28 13:14:52 +02:00
Tobias Brunner bd858af851 libcharon also requires kernel interfaces and a socket implementation 2012-06-27 12:15:09 +02:00
Tobias Brunner 8122ae8cd8 gcrypt: Register SHA1 first as HASH_PREFERRED depends on it 2012-06-27 11:31:16 +02:00
Tobias Brunner aa54ecef44 Use static plugin features in libcharon to define essential dependencies 2012-06-27 11:31:16 +02:00
Tobias Brunner ec3b332bf8 Use static plugin features in charon-nm 2012-06-27 11:31:16 +02:00
Tobias Brunner f102c5f341 Mask the configured mark value to ensure it is in range 2012-06-26 12:50:58 +02:00
Tobias Brunner 66e12b926e Some updates in ipsec.conf(5) for 5.0.0 2012-06-26 12:39:53 +02:00
Tobias Brunner 92250a48a9 Added MAC wrappers to Android.mk 2012-06-26 07:58:04 +02:00
Tobias Brunner 9866c26c5b Also build charon's IKEv1 implementation on Android 2012-06-26 07:56:15 +02:00
Tobias Brunner 43d01ab2f6 Build nonce plugin on Android 2012-06-26 07:56:15 +02:00
Tobias Brunner 8497c5d147 Missing source file added to libcharon's Android.mk 2012-06-26 07:56:15 +02:00
Tobias Brunner 67307ad724 scepclient: Added support to build it on Android 2012-06-26 07:56:15 +02:00
Tobias Brunner 197dbf5f72 Added support for the curl plugin on Android 2012-06-26 07:56:14 +02:00
Tobias Brunner 63afd833b9 Avoid SIGSEGV during shutdown if charon is not started as root 2012-06-25 19:00:00 +02:00
Tobias Brunner f97c269e0c NEWS about thread pool updates added 2012-06-25 18:18:07 +02:00
Tobias Brunner e0efd7c121 Make rescheduling a job more predictable 
This avoids race conditions between calls to cancel() and jobs that like
to be rescheduled.  If jobs were able to reschedule themselves it would
theoretically be possible that two worker threads have the same job
assigned (the one currently executing the job and the one executing the
same but rescheduled job if it already is time to execute it), this means
that cancel() could be called twice for that job.

Creating a new job based on the current one and reschedule that is also
OK, but rescheduling itself is more efficient for jobs that need to be
executed often.
 2012-06-25 17:49:12 +02:00
Tobias Brunner 26d77eb3e6 Centralized thread cancellation in processor_t 
This ensures that no threads are active when plugins and the rest of the
daemon are unloaded.

callback_job_t was simplified a lot in the process as its main
functionality is now contained in processor_t.  The parent-child
relationships were abandoned as these were only needed to simplify job
cancellation.
 2012-06-25 17:38:59 +02:00
Tobias Brunner 7fec83af28 Give processor_t more control over the lifecycle of a job 
Jobs are now destroyed by the processor, but they are allowed to
reschedule themselves.  That is, parts of the reschedule functionality
already provided by callback_job_t is moved to the processor.  Not yet
fully supported is JOB_REQUEUE_DIRECT and canceling jobs.

Note: job_t.destroy() is now called not only for queued jobs but also
after execution or cancellation of jobs.  job_t.status can be used to
decide what to do in said method.
 2012-06-25 17:10:28 +02:00
Tobias Brunner 18d21a57df Added a method to plugin_loader_t to add 'static' plugin features 
This allows daemons and other components to register plugin features
like those provided by plugins (following the same lifecycle).

The added features are internally handled like they were added by a
plugin.
 2012-06-25 17:03:07 +02:00
Tobias Brunner e07122436c Make sure that all features of critical plugins are loaded 2012-06-25 17:03:07 +02:00
Tobias Brunner bc6d944705 Added an option to rename the ipsec script during installation 
Also rename the man page and adjust all references in the script, the
man page and other files.

Closes #194.
 2012-06-25 16:53:38 +02:00
Tobias Brunner d86cf32b4b Removed -o argument when creating .../ipsec.d with install 
This should have been removed with 2b52d5cb41.
 2012-06-25 16:37:34 +02:00
Tobias Brunner 34a80708e2 Updated ipsec script man page after removing pluto 2012-06-25 16:37:34 +02:00
Tobias Brunner 738b9121cb Use mac_t and PRF and signer wrappers in cmac plugin 2012-06-25 16:35:06 +02:00
Tobias Brunner 83cb52b044 Use mac_t and PRF and signer wrappers in xcbc plugin 2012-06-25 16:35:06 +02:00
Tobias Brunner c4a3c9672a Make the hmac_t interface a generic interface for message authentication codes 2012-06-25 16:35:06 +02:00
Tobias Brunner 228d096e42 Simplified creation of PRFs and signers in openssl and hmac plugins 2012-06-25 16:35:06 +02:00
Tobias Brunner 01850f5d55 Function to convert PRFs to hash algorithms added 2012-06-25 16:35:06 +02:00
Tobias Brunner 903093d439 hasher_algorithm_from_integrity() optionally returns truncation length 2012-06-25 16:35:06 +02:00
Tobias Brunner 73d032e412 Use simple wrappers for HMAC based PRF and signer in openssl plugin 2012-06-25 16:35:06 +02:00
Tobias Brunner 63420c6e13 Use simple wrappers for HMAC based PRF and signer in hmac plugin 2012-06-25 16:35:06 +02:00
Tobias Brunner 57ff4be874 Simple wrappers for HMAC based prf_t and signer_t implementations added 2012-06-25 16:35:06 +02:00
Tobias Brunner 8391c1d0b1 Refactored OpenSSL based HMAC implementation 2012-06-25 16:35:06 +02:00
Tobias Brunner 7beb31aae4 Fixed IPv6 source address lookup 
Because Linux kernels prior to 3.0 do not support RTA_PREFSRC for
IPv6 routes we didn't use NLM_F_DUMP to get all routes.
Still routes installed with policies are installed also for IPv6.
So since only one route is returned without DUMP, and we ignore
all routes from our own routing table, no source address was found
during roaming if DST of the installed route included the IKE peer.

With newer kernels we can now use DUMP as we did for IPv4 already,
for older kernels we do so if our own routes are installed in a
separate routing table, otherwise we still use GET.
 2012-06-25 16:29:59 +02:00
Tobias Brunner 720ba902c5 Enable xauth-generic by default but don't build it if IKEv1 is disabled 2012-06-25 11:07:49 +02:00
Tobias Brunner 2e4c807bf3 Remove CREDITS from distribution 2012-06-25 11:07:35 +02:00