denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
9,736 Commits 1 Branch 0 Tags
4cb0783f3c828ec4b9cc158dd87162d249b2fb62
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Tobias Brunner f4cc7ea11b Add uniqueids=never to ignore INITIAL_CONTACT notifies 
With uniqueids=no the daemon still deletes any existing IKE_SA with the
same peer if an INITIAL_CONTACT notify is received.  With this new option
it also ignores these notifies.
 2012-09-10 17:37:18 +02:00
Tobias Brunner 4065e2504c Use the proper types for comma separated attributes read from strongswan.conf 
Attributes of different address families previously were mapped to
the same attribute type (the one derived from the address family of the
first address).
 2012-09-10 15:17:17 +02:00
Tobias Brunner 383c174a79 Print the name of mem pools instead of the confusing <base>/<size> 2012-09-10 12:42:09 +02:00
Tobias Brunner 747fd544a7 Properly remove broadcast address from mem pools 2012-09-10 11:44:18 +02:00
Tobias Brunner bcf8cdd556 Only initiate an exchange from send_dpd() if a task was actually queued 
Otherwise, the initiator would prematurely initiate Quick Mode if it has
DPD enabled and XAuth is used.
 2012-09-07 18:05:22 +02:00
Tobias Brunner ccba4f1533 android: New release after adding certificate authentication and reauth fix 2012-09-06 14:54:37 +02:00
Tobias Brunner 3babde90bb Trigger ike_updown event caused by retransmits only after reestablish() has been called 
This allows listeners to migrate to the new IKE_SA with the
ike_reestablish event without having to worry about an ike_updown event
for the old IKE_SA.
 2012-09-06 11:27:28 +02:00
Tobias Brunner d7d2a5ec38 android: Properly handle reauthentication initiated by the client 2012-09-06 11:27:07 +02:00
Tobias Brunner 0326ceda64 android: Create a new VpnService.Builder after VPN has been established 2012-09-06 11:25:24 +02:00
Tobias Brunner 4dbb193190 Add ike_reestablish() event that is triggered when an IKE_SA is reestablished 
This is particularly useful during reauthentication to get the new
IKE_SA.
 2012-09-06 11:25:14 +02:00
Tobias Brunner 873b63b771 Add a new condition to mark IKE_SAs that are currently being reauthenticated 2012-09-06 11:23:11 +02:00
Tobias Brunner 4c91845452 starter: Load config again when restarting charon 
This got lost in 041e763b.
 2012-09-05 16:43:34 +02:00
Tobias Brunner d2e8f20d94 Clear virtual IPs before storing assigned ones on the IKE_SA 
Otherwise we'll end up with duplicate or invalid VIPs stored on the
IKE_SA.
 2012-09-05 14:35:57 +02:00
Tobias Brunner d1604d0551 Merge branch 'android-client-cert' 
Introduces IKEv2 client certificate authentication for the Android App.
 2012-09-04 13:58:49 +02:00
Tobias Brunner c89cc22692 android: Native parts handle ikev2-cert VPN type 2012-08-31 18:24:46 +02:00
Tobias Brunner 094a059bcf android: android_creds_t can provide a user's private key and certificate 2012-08-31 18:24:46 +02:00
Tobias Brunner 3aba33868b android: Added JNI method to retrieve user certificate and private key 
To simplify things the private key, the user certificate and the CA
certificates are all put into the same list.
 2012-08-31 18:24:46 +02:00
Tobias Brunner 38e866c3dd android: Don't show the password dialog if not required 2012-08-31 18:24:46 +02:00
Tobias Brunner 69f731a9d8 android: Enable pkcs8 plugin 2012-08-31 18:24:46 +02:00
Tobias Brunner 5eb7ad3a38 android: Pass the type of VPN to the native parts 2012-08-31 18:24:46 +02:00
Tobias Brunner 655362464e android: Make sure NULL jstrings are converted properly 2012-08-31 18:24:45 +02:00
Tobias Brunner 6de38fe88a android: Display the selected certificate alias in the profile list 2012-08-31 18:24:45 +02:00
Tobias Brunner f46da851ab android: Allow configuration of a user certificate 2012-08-31 18:24:43 +02:00
Tobias Brunner 3f9e90f618 android: Remove NOT NULL constraint from username column 2012-08-31 18:24:23 +02:00
Tobias Brunner d0f6481eb0 android: Separate view added to select certificates 2012-08-31 18:24:23 +02:00
Tobias Brunner 7fedacb2e7 android: Don't try to load the profile with ID 0 2012-08-31 18:24:22 +02:00
Tobias Brunner 825c192d4f android: Spinner added to select the VPN type 2012-08-31 18:24:19 +02:00
Tobias Brunner 868409139b Merge branch 'eap-client-select' 
This brings support for EAP-Nak payloads on the client (to select a
specific or supported method), and the server (via the eap-dynamic
plugin which selects a method supported/requested by the client).
 2012-08-31 12:25:41 +02:00
Tobias Brunner cbe244a5fe NEWS about eap-dynamic plugin added 2012-08-31 12:16:43 +02:00
Tobias Brunner 5f6ef5d5ce Documentation for eap-dynamic added 2012-08-31 11:42:03 +02:00
Tobias Brunner 7f2e3091ee Log the proper type for virtual EAP methods 2012-08-31 11:42:03 +02:00
Tobias Brunner 333c3b6228 Added an option to prefer types sent by peer in eap-dynamic plugin 2012-08-31 11:42:03 +02:00
Tobias Brunner 3dde55e67b eap-dynamic plugin handles EAP-Nak messages and selects a method supported by the peer 2012-08-31 11:42:03 +02:00
Tobias Brunner a2f1d75eae Preferred EAP methods for eap-dynamic can be configured 2012-08-31 11:42:03 +02:00
Tobias Brunner a2a61ec2e2 The eap-dynamic plugin uses the first supported method as default 2012-08-31 11:42:03 +02:00
Tobias Brunner 700ff5def9 Added eap-dynamic plugin which can proxy any other EAP method 2012-08-31 11:42:01 +02:00
Tobias Brunner 7240914955 Use eap_vendor_type_from_string() in stroke 2012-08-31 11:40:28 +02:00
Tobias Brunner db409006e4 Function added that parses EAP method strings ([eap-]type[-vendor]) 2012-08-31 11:40:28 +02:00
Tobias Brunner 576490ab09 Added method to enumerate EAP types contained in an EAP-Nak 2012-08-31 11:40:28 +02:00
Tobias Brunner cc4eec56f7 Encode EAP-Naks in expanded format if we got an expanded type request 
Since methods defined by the IETF (vendor ID 0) could also be encoded in
expanded type format the previous check was insufficient.
 2012-08-31 11:40:27 +02:00
Tobias Brunner 78e8dca94f Allow clients to request a configured EAP method via EAP-Nak 2012-08-31 11:40:27 +02:00
Tobias Brunner 34742f1bf8 Virtual EAP methods handle EAP-Naks themselves 2012-08-31 11:40:27 +02:00
Tobias Brunner af04233e14 Send EAP-Nak with supported types if requested type is unsupported 2012-08-31 11:40:27 +02:00
Tobias Brunner 7cad171da8 Filter invalid EAP authentication types when enumerating them 
Valid authentication types defined by the IETF are 4-253 and 255.
 2012-08-31 11:37:45 +02:00
Tobias Brunner eae5616ae6 Move our pseudo EAP types out of the range of valid EAP methods 2012-08-31 11:31:48 +02:00
Tobias Brunner db275b1477 Ported tun_device de-/initialization to FreeBSD 2012-08-29 15:34:17 +02:00
Tobias Brunner 39e9af9666 struct iphdr is Linux specific use struct ip instead 2012-08-29 15:32:26 +02:00
Tobias Brunner 55e05aa226 Include stdint.h for UINT32_MAX on FreeBSD 2012-08-29 15:32:26 +02:00
Tobias Brunner 48f51d9454 android: Field added to store the type of a VPN profile 2012-08-27 15:36:36 +02:00
Tobias Brunner 1f6f501978 android: Enum added for VPN types 2012-08-27 15:33:58 +02:00
Tobias Brunner 8a9956762c android: Simplified handling of error dialog that is displayed if VpnService API is not supported 2012-08-27 10:48:13 +02:00
Tobias Brunner aa55040192 android: LoginDialog refactored so it also works when the device is rotated 2012-08-27 10:48:13 +02:00
Tobias Brunner e09f4120d4 android: Added a field to store selected user certificate 2012-08-27 10:48:13 +02:00
Tobias Brunner a21fac9a85 Log configured IKE_SA proposals as initiator 2012-08-24 13:43:14 +02:00
Tobias Brunner d2b4dff5dd Log configured CHILD_SA proposals as initiator 2012-08-24 13:43:14 +02:00
Tobias Brunner 1184493407 Fall back to local address as IKEv1 identity if nothing else is configured 2012-08-24 12:55:01 +02:00
Tobias Brunner 454fb91367 Removed deprecated options from ipsec.conf template 2012-08-24 11:52:01 +02:00
Tobias Brunner 20915d6fa7 Apply send delay before adding non-ESP marker 
Otherwise the packet header could not be parsed correctly when NAT-T is
used.
 2012-08-24 11:23:36 +02:00
Tobias Brunner 078755d099 Added a method to enumerate registered EAP methods 2012-08-21 16:48:47 +02:00
Tobias Brunner 3570c43968 openssl: Fix registration of the PUBKEY builder 
libtls drops support for RSA suites if it does not find an RSA backend
(final builder for RSA public keys).
 2012-08-18 17:49:57 +02:00
Tobias Brunner ef73bb52b1 Without the ties to PAM we can build eap-gtc on Android 2012-08-17 14:24:48 +02:00
Tobias Brunner ba27bf2af0 CAP_AUDIT_WRITE is now required by xauth-pam not eap-gtc plugin 2012-08-17 14:24:48 +02:00
Tobias Brunner 113d2a6b99 Removed manual EAP method registration in eap-gtc plugin 2012-08-17 14:24:37 +02:00
Tobias Brunner 91c0e0e3d9 Enable build of eap-tls, eap-ttls and eap-peap on Android 2012-08-17 13:55:44 +02:00
Tobias Brunner 7ab348370c Add a wrapper around vstr_add_fmt() to avoid having to link libcharon against libvstr 
At least on Android the latter would be required.
 2012-08-17 11:47:52 +02:00
Tobias Brunner 21d8392041 starter: Restore original config in case also= is used (which reads the same values) 2012-08-16 16:45:11 +02:00
Tobias Brunner 31a0e24b0f Increased log level when listing interfaces and IP addresses during startup 
This avoids confusing log messages in starter and ipsec statusall
already lists the available addresses anyway.
 2012-08-16 16:14:15 +02:00
Tobias Brunner 71b89d6722 Only load kernel plugins in starter when flushing SAD/SPD entries 
This avoids keeping the kernel sockets open when they are not actually
needed, which could lead to resource problems (in particular with PF_KEY
where all open sockets receive all messages).

Fixes #217.
 2012-08-16 16:14:15 +02:00
Tobias Brunner aaefeafb49 Enable UDP decapsulation for both address families 
Since the 3.5 Linux kernel both UDP implementations have a separate static
flag to indicate whether ANY sockets enabled UDP decapsulation.
As we only ever enabled it for one address family (in earlier versions IPv4
only, now for IPv6, if supported, and for IPv4 otherwise) UDP decapsulation
wouldn't work anymore (at least for one address family).
 2012-08-16 15:26:37 +02:00
Tobias Brunner 11b514bff6 Correctly transmit EAP-MSCHAPv2 user name if it contains a domain part 2012-08-16 10:03:49 +02:00
Tobias Brunner f0b8d8c2c4 New Android release after adding error dialog 
Skipped one version due to a rebasing mishap.
 2012-08-15 11:23:06 +02:00
Tobias Brunner 8df118f733 Show an error message if VPN is not supported 
Some devices have Android 4 installed but the system images still seem to
lack the components that are required for VPN support. One such
component is the dialog used to grant permission to create .
 2012-08-15 11:19:43 +02:00
Tobias Brunner c8d0c3b03d Enable search for certificate lists (via SearchView in ActionBar) 2012-08-14 12:01:41 +02:00
Tobias Brunner 4db2d6336e Added new UI to select a specific CA certificate 
With this change there is no need to wait for all certificates being loaded
anymore (this happens only when the user opens the selection activity).
 2012-08-14 12:01:41 +02:00
Tobias Brunner cb431e12da Don't try to save profile ID if there is none 2012-08-14 12:01:41 +02:00
Tobias Brunner 7546735fec List fragment for trusted certificates can notify listeners about clicks 2012-08-14 12:01:41 +02:00
Tobias Brunner b0b0eac6eb Added an activity that shows lists of CA certificates in two tabs 2012-08-14 12:01:41 +02:00
Tobias Brunner caf85c872f Added a ListFragment that lists trusted certificates (loaded via a custom Loader) 2012-08-14 12:01:41 +02:00
Tobias Brunner db8bea8311 Changed TrustedCertificateAdapter for use with ListViews and TrustedCertificateEntry 2012-08-14 12:01:41 +02:00
Tobias Brunner af46e950b1 Remove certificate spinner from edit view 2012-08-14 12:01:41 +02:00
Tobias Brunner f075536ebe Function to get only system-wide CA certificates added to TrustedCertificateManager 2012-08-14 12:01:40 +02:00
Tobias Brunner 2dc8998419 Added class to store trusted certificate entries for lists 2012-08-14 12:01:40 +02:00
Tobias Brunner 3a917ac77f Validate netmask in mem_pool_create 2012-08-13 13:54:28 +02:00
Tobias Brunner 305d98b780 Validate netmask in traffic_selector_create_from_subnet 
Fixes #216.
 2012-08-13 13:46:19 +02:00
Tobias Brunner 36a3981d47 Comment fixed 2012-08-13 13:17:53 +02:00
Tobias Brunner 09ae3d79ca Merge branch 'android-app' 
This branch introduces a userland IPsec implementation (libipsec) and an
Android App which targets the VpnService API that is provided by Android 4+.

The implementation is based on the bachelor thesis 'Userland IPsec for
Android 4' by Giuliano Grassi and Ralf Sager.
 2012-08-13 12:07:52 +02:00
Tobias Brunner efbb5e8c57 Ensure thread IDs always start with 1 even if the library is reused 
Within the Android App the library stays loaded in memory and is just
initialized/deinitialized with each connection, the static thread
counter would continuously increase without this patch.
 2012-08-13 11:28:08 +02:00
Tobias Brunner 1fcaa71291 Added a button to the error dialog that allows to view the log file 2012-08-13 11:28:08 +02:00
Tobias Brunner fbacc6506c Use major.minor.revision version numbers for Android application 2012-08-13 11:28:08 +02:00
Tobias Brunner 064f4f75c0 Only allow access to log file via explicitly created URIs 
Since ContentProviders are public and permissions don't seem to work any
other application could access the log file.  With this token system
only URIs we explicitly created can be accessed.
 2012-08-13 11:27:55 +02:00
Tobias Brunner 6c54c10838 Menu option added that allows users to send the log file 2012-08-13 11:22:21 +02:00
Tobias Brunner c3afe9d35b Add ContentProvider to access log file from other applications 2012-08-13 11:22:21 +02:00
Tobias Brunner ae10e8c458 Watch for changes to the log file so we can reopen it 
If the log fragment is shown while the daemon starts (which is not the
case at the moment, but maybe later on tablets) the file reader would not
notice that the file got truncated.  The same applies if the file is deleted
directly on the file system e.g. with adb shell.
 2012-08-13 11:22:21 +02:00
Tobias Brunner bad119c55a Add an Activity that shows the log fragment 2012-08-13 11:22:20 +02:00
Tobias Brunner f9a162a235 Add a fragment that can display charon's log file 
It continuously reads from the log file in a separate thread while displayed.
 2012-08-13 11:22:20 +02:00
Tobias Brunner 658ed96fce Added special ScrollView with auto-scrolling feature 
The ability to auto-scroll is disabled as soon as the user manually
scrolls around and re-enable when the user scrolls to the bottom.
 2012-08-13 11:22:20 +02:00
Tobias Brunner fe05f1f05c Charon logs to a file in the App's data directory 2012-08-13 11:22:20 +02:00
Tobias Brunner 4308ce1cf7 Moved Java to C string conversion function to android_jni header file 2012-08-13 11:22:20 +02:00
Tobias Brunner 6db742e7e5 Log charon version and uname() output, split libcharon and charon initialization 2012-08-13 11:22:20 +02:00
Tobias Brunner a7c8b166a1 Only call disconnect() from CharonVpnService if we are not already disconnecting 2012-08-13 11:22:20 +02:00