denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
17,558 Commits 1 Branch 0 Tags
56de4dc596b80dd00fc77378a7b65f1904109a63
Commit Graph
13685 Commits
Author SHA1 Message Date
Tobias Brunner 1e26483167 android: Implement Iterable interface and addAll() for range set 2017-07-03 10:27:52 +02:00
Tobias Brunner 54714331e4 android: Add ability to remove a range set from another 2017-07-03 10:27:51 +02:00
Tobias Brunner 78b20efb29 android: Parse two addresses separated by - as range 2017-07-03 10:27:51 +02:00
Tobias Brunner 13ead876ad android: Add property for excluded subnets to VPN profiles 2017-07-03 10:27:51 +02:00
Tobias Brunner d852a02717 android: Add class to manage a set of IP address ranges/subnets 2017-07-03 10:27:51 +02:00
Tobias Brunner bcba14504a android: Add class to handle IP ranges and subnets 2017-07-03 10:27:51 +02:00
Tobias Brunner c5ba381757 android: Log some information about the Android version and the device 2017-07-03 10:27:51 +02:00
Tobias Brunner e5ec18009f android: Escape backslashes in settings values 
For usernames that use domain specifiers.
 2017-07-03 10:27:51 +02:00
Tobias Brunner 59693d6c56 android: Use a specific action to disconnect from the VPN 2017-07-03 10:27:50 +02:00
Tobias Brunner bef8bc3aac android: Try to load existing user cert when importing VPN profile 2017-07-03 10:27:50 +02:00
Tobias Brunner 36e8f43617 android: Enable revocation plugin 2017-07-03 10:27:50 +02:00
Tobias Brunner 7b4177578b android: Add a simple HTTP(S) fetcher for CRLs 2017-07-03 10:27:50 +02:00
Tobias Brunner ddd4d8b427 android: Use LOCAL_LDLIBS to link libdl 
Newer NDKs fail otherwise as there is no actual module anymore.
 2017-07-03 10:27:50 +02:00
Tobias Brunner 74d44e15dc android: Make log view more efficient 
This bunches several log messages together before posting Runnables.

Fixes #2148.
 2017-07-03 10:27:45 +02:00
Tobias Brunner 9c4607b454 android: Don't update state fragment if not attached to an Activity 
When the bound state service finally connects we might not actually be
attached to an Activity.
 2017-06-30 09:32:27 +02:00
Tobias Brunner b14507dd90 android: Make sure every listener at the VPN state service is only registered once 
We register when the service connects but also in onStart() (as we
unregister in onStop() to avoid updates when not shown).  So this could
theoretically cause the listener to get registered twice if the service
is connected before onStart() is called (it seems it usually isn't).
 2017-06-30 09:32:27 +02:00
Tobias Brunner 6766c85231 android: Add menu item to import VPN profile via Storage Access Framework 
This is useful in case the proper MIME type was not set for a downloaded
profile.
 2017-06-30 09:32:27 +02:00
Tobias Brunner edad60ea77 android: Add translation for Traditional Chinese 
Courtesy of Chris Chiang.
 2017-06-30 09:32:27 +02:00
Tobias Brunner 61098dd6a3 android: Move Simplified Chinese translation to values-zg-rCN folder 2017-06-30 09:32:26 +02:00
Tobias Brunner 451498b470 android: Update Gradle plugin and wrapper 2017-06-30 09:32:26 +02:00
Tobias Brunner 083208e805 ikev1: Only delete redundant CHILD_SAs if configured 
If we find a redundant CHILD_SA (the peer probably rekeyed the SA before
us) we might not want to delete the old SA because the peer might still
use it (same applies to old CHILD_SAs after rekeyings).  So only delete
them if configured to do so.

Fixes #2358.
 2017-06-26 10:33:16 +02:00
Tobias Brunner 56ffcdb166 configure: Enable coverage for all plugins via PLUGIN_CFLAGS 2017-06-20 13:52:16 +02:00
Tobias Brunner ee41367188 ipsec: Remove starter as valid command in --help 
`start` is basically the same thing.

Fixes #2362.
 2017-06-20 11:52:41 +02:00
Tobias Brunner e793d65acd openssl: Properly handle flags in key usage extension 2017-06-14 10:03:13 +02:00
Tobias Brunner dad4f6a178 charon-tkm: Return cloned host from tkm_kernel_sad_t::get_dst_host() 
When an expire is triggered while rekeying, the CHILD_SA might be deleted
while the returned host is still used to queue a rekey job for the CHILD_SA.
 2017-06-14 09:57:09 +02:00
Tobias Brunner d29531c226 configure: Use pkg-config to determine Ruby CFLAGS/LIBS 2017-06-07 16:48:02 +02:00
Tobias Brunner aa66e2b704 nm: Version bump to 1.4.2 2017-05-30 14:36:17 +02:00
Andreas Steffen 38a8ecadb7 x509: nameConstraints sequence does not require a loop 
Fixes: CVE-2017-9023
 2017-05-29 11:05:04 +02:00
Andreas Steffen f2f9edbbc0 unit-tests: Updated asn1-parser tests 2017-05-29 11:05:04 +02:00
Andreas Steffen 407fcca200 asn1-parser: Fix CHOICE parsing 
Fixes: CVE-2017-9023
 2017-05-29 11:05:04 +02:00
Tobias Brunner 6681d98d18 gmp: Make sure the modulus is odd and the exponent not zero 
Unlike mpz_powm() its secure replacement mpz_powm_sec() has the additional
requirement that the exponent must be > 0 and the modulus has to be odd.
Otherwise, it will crash with a floating-point exception.

Fixes: CVE-2017-9022
Fixes: 3e35a6e7a1 ("Use side-channel secured mpz_powm_sec of libgmp 5, if available")
 2017-05-29 11:05:04 +02:00
Andreas Steffen 89f05ed5a9 imv-swid: Fixed memory leak in http REST interface 2017-05-29 10:59:22 +02:00
Andreas Steffen 29e1c58643 leak-detective: Whitelisted memory leaks in FHH IMCs and IMVs 2017-05-29 10:59:04 +02:00
Andreas Steffen c82be739bc imv-test: Fixed memory leak in server retry use case 2017-05-29 10:58:33 +02:00
Andreas Steffen fca4e70bd3 libtnccs: Fixed memory leak of global variables in libxml2 2017-05-29 10:57:34 +02:00
Tobias Brunner a09e79ed5d ike-cfg: Fix memory leak when matching against ranges 
traffic_selector_t::to_subnet() always sets the net/host (unless the
address family was invalid).

Fixes: 3070697f9f ("ike: support multiple addresses, ranges and subnets in IKE address config")
 2017-05-29 10:50:58 +02:00
Tobias Brunner 00d547119e ike: Apply retransmission_limit before applying the jitter 2017-05-26 18:16:40 +02:00
Tobias Brunner 8ed3168406 eap-sim-file: Remove redundant enumerator allocation 2017-05-26 16:42:59 +02:00
Tobias Brunner bb494cde03 sql: Remove redundant enumerator allocation 
Interestingly, this doesn't show up in the regression tests because the
compiler removes the first assignment (and thus the allocation) due to
-O2 that's included in our default CFLAGS.
 2017-05-26 16:39:33 +02:00
Tobias Brunner b2473e94a2 Fixed some typos, courtesy of codespell 2017-05-26 14:44:06 +02:00
Tobias Brunner 2e4d110d1e linked-list: Change return value of find_first() and signature of its callback 
This avoids the unportable five pointer hack.
 2017-05-26 13:56:44 +02:00
Tobias Brunner 8a2e4d4a8b linked-list: Change interface of callback for invoke_function() 
This avoids the unportable five pointer hack.
 2017-05-26 13:56:44 +02:00
Tobias Brunner 5cafea6edd linked-list: invoke_offset() doesn't take any additional arguments anymore 2017-05-26 13:56:44 +02:00
Tobias Brunner 525cc46cab Change interface for enumerator_create_filter() callback 
This avoids the unportable 5 pointer hack, but requires enumerating in
the callback.
 2017-05-26 13:56:44 +02:00
Tobias Brunner 95a63bf281 Migrate all enumerators to venumerate() interface change 2017-05-26 13:56:44 +02:00
Tobias Brunner 16bffa8b55 enumerator: Add venumerate() method to enumerator_t that takes a va_list 
This will allow us to implement e.g. enumerator_cleaner without having to
use that unportable 5 pointer forwarding or having to define a callback for
each instance.

A generic implementation for enumerate() is provided so only venumerate()
has to be implemented, which may be simplified by using the VA_ARGS_VGET()
macro.
 2017-05-26 13:56:44 +02:00
Tobias Brunner 5297c65398 utils: Add helper macros to read variadic arguments into local variables 2017-05-26 13:56:44 +02:00
Tobias Brunner 0afe0eca67 vici: Make 96-bit truncation for SHA-256 configurable 2017-05-26 11:22:28 +02:00
Tobias Brunner 4270c8fcb0 stroke: Make 96-bit truncation for SHA-256 configurable 2017-05-26 11:22:28 +02:00
Tobias Brunner 7637633bb9 child-cfg: Optionally use 96-bit truncation for HMAC-SHA-256 
The correct truncation is 128-bit but some implementations insist on
using 96-bit truncation.  With strongSwan this can be negotiated using
an algorithm identifier from a private range.  But this doesn't work
with third-party implementations.  This adds an option to use 96-bit
truncation even if the official identifier is used.
 2017-05-26 11:22:27 +02:00