denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
18,640 Commits 1 Branch 0 Tags
53208b0ba4c17f6efc9df3007ecf9626471fd78d
Commit Graph
14473 Commits
Author SHA1 Message Date
Tobias Brunner 27a814b527 Properly destroy mem_cred object on pki --pkcs7 --help 2013-01-24 19:13:41 +01:00
Tobias Brunner 39896d92ed Try to determine OS type if name and version are configured 2013-01-24 19:13:41 +01:00
Tobias Brunner 24cdf5340e Add missing va_end() call 2013-01-24 19:13:41 +01:00
Tobias Brunner 69c6a60176 g_thread_init() is deprecated since Glib 2.23 2013-01-24 19:13:40 +01:00
Tobias Brunner 2ec3552fce Fix check-in of IKE_SA when IKE_SA_INIT fails and hash table is enabled 
Setting the responder SPI to 0 can only be done while generating the
response, otherwise we'd fail to check in the IKE_SA again in case the
hash table is enabled.  That's because we use the responder SPI as hash
value since 5.0.0.
 2013-01-24 19:13:40 +01:00
Adrian-Ken Rueegsegger a25047e412 Return SS_RC_INITIALIZATION_FAILED if pid file exists 
Let charon return SS_RC_INITIALIZATION_FAILED if an existing pid file is found.
Starter only terminates itself if the result code of the daemon is a valid
SS_RC_* value.
 2013-01-23 15:59:21 +01:00
Tobias Brunner 4eb09d14e2 Avoid a deadlock when installing a trap policy failed 2013-01-23 15:51:47 +01:00
Martin Willi 8d631ebabd Encode IETF Numeric Version Service Pack Version with two byte words 2013-01-22 14:45:56 +01:00
Adrian-Ken Rueegsegger 113ff13322 starter: Add --attach-gdb option to usage text 2013-01-22 11:03:19 +01:00
Adrian-Ken Rueegsegger cf3c72c480 Fix IKE SA inherit API doc 2013-01-22 11:02:20 +01:00
Martin Willi 325efdaca8 Filter TS list for Split-Includes before printing them to debug log 2013-01-21 12:15:51 +01:00
Tobias Brunner ae82265a46 Add the ability to use a named pool for conftest configs 2013-01-21 11:46:20 +01:00
Martin Willi 51dbcf6497 After merging the used trustchain with config, move used certificate to front 2013-01-18 11:59:27 +01:00
Martin Willi 9a06a93ce7 Try to build a trustchain for all configured certificates before enforcing one 
This enables the daemon to select from multiple configured certificates
by building trustchains against the received certificate requests.
 2013-01-18 09:33:15 +01:00
Martin Willi 78af36db50 Load multiple comma seperarated certificates in the leftcert option 2013-01-18 09:33:15 +01:00
Martin Willi f29783af8c Make AUTH_RULE_SUBJECT cert multi-valued 
Constraints having multiple subject certs defined are fulfilled if
authentication used one of the listed certificates.
 2013-01-18 09:33:15 +01:00
Martin Willi 16ef69d70a Pass a constructor callback to create TNCCS server instances while dispatching 2013-01-17 16:34:34 +01:00
Martin Willi 04a9a99bc1 Create pt_tls_client with separate server address and identity 2013-01-16 16:36:57 +01:00
Martin Willi bb5037a5e5 Create pt_tls_dispatcher with separate server address and identity 2013-01-16 15:02:14 +01:00
Martin Willi 18d56a1891 Add a libpttls providing NEA PT-TLS / TNC IF-T for TLS transport layer 2013-01-16 13:53:32 +01:00
Martin Willi 435348f406 Send TLS close notify during tls_socket_t destruction 2013-01-15 17:43:05 +01:00
Martin Willi 7bbf7aa97a Send TLS close notify if application returns SUCCESS 2013-01-15 17:43:05 +01:00
Martin Willi c43e8fdec4 Block TLS read when sending data, but have to wait for the handshake data first 2013-01-15 17:43:05 +01:00
Martin Willi 9191e5e11a TNCCS plugins don't depend on EAP-TNC, but can be used by other transports, too 2013-01-15 17:43:05 +01:00
Martin Willi 7fb81886b9 Add a bio_reader_t constructor variant freeing passed data during destruction 2013-01-15 17:43:05 +01:00
Martin Willi ee90c78998 Use a more POSIXy tls_socket interface with more flexibility. 
If an unsufficient read buffer is provided, application data gets cached
for subsequent read() calls.
 2013-01-15 17:43:05 +01:00
Martin Willi 47af9848a2 Add a chunk_from_str() initializer that does not include 0-terminator 2013-01-15 17:43:05 +01:00
Martin Willi 1449e6dd55 Reseed rdrand after every 128bit sample only 2013-01-15 17:41:54 +01:00
Tobias Brunner 30abe1fd19 android: Properly escape apostrophes in Ukrainian translation 2013-01-14 17:23:52 +01:00
Tobias Brunner b9cda4f3e1 android: Implement kernel_net_t.get_interface via JNI 
This is now required to properly accept/install a virtual IP address.

Fixes #275.
 2013-01-14 17:22:56 +01:00
Tobias Brunner 53ce5c4c91 android: Moved chunk_from_byte_array and byte_array_from_chunk helper functions 2013-01-14 17:19:58 +01:00
Tobias Brunner ecff0e5685 android: Set OPENSSL_NO_CMS in Android.mk as it is not set in opensslconf.h on Android 2013-01-14 17:16:18 +01:00
Tobias Brunner 66bb4f63b2 Properly send IKEv1 packets if no ike_cfg is known yet 
This applies for error notifies.
 2013-01-14 12:14:16 +01:00
Martin Willi c4a49008e8 Don't handle right=%any6 as "loose" identity, but as %any 2013-01-14 10:33:14 +01:00
Martin Willi 426f34baf9 Respect given address family when resolving "%any" 2013-01-14 10:26:12 +01:00
Tobias Brunner 37fb404833 Android.mk of libstrongswan updated 2013-01-14 09:16:33 +01:00
Tobias Brunner 21235e1ec2 Merge branch 'ikev1-fragmentation' 
This adds support for the proprietary IKEv1 fragmentation extension.

Conflicts:
	NEWS
 2013-01-12 11:58:26 +01:00
Tobias Brunner ee6902ef7f Added an option to configure the maximum size of a fragment 2013-01-12 11:54:58 +01:00
Tobias Brunner 7ae245f685 Properly detect fragmentation capabilities 
Cisco sends 0xc0000000 so we check that part of the VID separately.
 2013-01-12 11:54:54 +01:00
Tobias Brunner 365d9a6f67 Added an option that allows to force IKEv1 fragmentation 2013-01-12 11:54:32 +01:00
Martin Willi 54a1a75b2f Don't use bio_writer_t.skip() to write length field when appending more data 
If the writer reallocates its buffer, the length pointer might not be valid
anymore, or even worse, point to an arbitrary allocation.
 2013-01-11 14:57:08 +01:00
Martin Willi 2cd6c5115b Use raw opcodes for rdrand to build with older binutils 2013-01-11 10:45:14 +01:00
Martin Willi 19ae23452a Provide RNG_TRUE quality in rdrand by mixing reseeded outputs using AES 2013-01-11 10:45:14 +01:00
Martin Willi b9148ea232 Provide RNG_STRONG quality in rdrand by forcing PRNG reseed after every sample 2013-01-11 10:45:14 +01:00
Martin Willi 9fe24b004d Provide RNG_WEAK quality random generator in rdrand 2013-01-11 10:45:14 +01:00
Martin Willi ed8dc6f132 Add a rdrand plugin stub detecting availability of RDRAND instructions 2013-01-11 10:45:14 +01:00
Martin Willi 1954cc7720 Streamline debug output when receiving intermediate CA certificates in IKEv1 2013-01-11 10:24:23 +01:00
Martin Willi cde6a9ec9f Refactored IKEv2 cert/certreq payload processing to multiple functions 2013-01-11 10:21:56 +01:00
Martin Willi bf10ee9495 Refactored IKEv1 cert payload processing to multiple functions 2013-01-11 10:21:56 +01:00
Volker Rümelin 6d3e7a64a0 IKEv1 support for PKCS#7 wrapped certificates 2013-01-11 10:21:56 +01:00