denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
10,055 Commits 1 Branch 0 Tags
60e26e0f6334b79f35dfb2891651fd8f9c77393c
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Tobias Brunner acb300f920 android: Use proper intent-filter for our VpnService 2012-11-02 15:55:08 +01:00
Tobias Brunner 214c081dd6 Log sent vendor IDs for IKEv1 2012-11-02 15:52:19 +01:00
Tobias Brunner 531f32d62a Compiler warning fixed 2012-11-02 15:39:51 +01:00
Tobias Brunner 3689f0f6cc FQDNs are actually not resolved when loading secrets 2012-10-29 10:06:43 +01:00
Tobias Brunner f30962de74 Fixed log message when no shared secret is found during IKEv1 Main Mode 2012-10-29 10:04:37 +01:00
Tobias Brunner 2380f3a830 Added documentation for NTLM secrets 2012-10-25 09:51:47 +02:00
Tobias Brunner e34573dd48 Added missing noskip_flag setter/getter to some pa_tnc_attr_t constructors 2012-10-24 17:58:36 +02:00
Tobias Brunner f48e727232 Remove all ESP proposals with non-matching DH group during Quick Mode 
According to RFC 2409, section 5.5, if PFS is used all proposals MUST
include the selected DH group, so we remove proposals without the
proposed group and remove other DH groups from the remaining proposals.
 2012-10-24 16:09:42 +02:00
Tobias Brunner 4eba7269b8 proposal_t.strip_dh() takes a DH group to keep, using MODP_NONE will remove all 2012-10-24 16:09:42 +02:00
Tobias Brunner e74f184cb4 Remove MODP groups from default ESP proposal 
This now actually makes pfs=no the default and it equals the default
listed in ipsec.conf.5. efc69e9f preserved the default of pfs=yes.
 2012-10-24 16:09:42 +02:00
Tobias Brunner bca34c3717 Moved utils.[ch] to utils folder 2012-10-24 16:07:53 +02:00
Tobias Brunner f9625952ad Moved settings_t to utils folder 2012-10-24 16:00:51 +02:00
Tobias Brunner f05b427265 Moved debug.[ch] to utils folder 2012-10-24 16:00:51 +02:00
Tobias Brunner d5c143e5be Moved enum_name_t to utils folder 2012-10-24 16:00:50 +02:00
Tobias Brunner 125b37af6d Moved chunk_t to utils folder 2012-10-24 16:00:50 +02:00
Tobias Brunner 05e448c5cc Moved printf hooks to utils folder 2012-10-24 16:00:50 +02:00
Tobias Brunner 08944b68ac Moved integrity_checker_t to utils folder 2012-10-24 16:00:50 +02:00
Tobias Brunner 12642a6831 Moved data structures to new collections subfolder 2012-10-24 16:00:49 +02:00
Tobias Brunner fdee6b5f5a Moved packet_t and tun_device_t to networking folder 2012-10-24 15:06:18 +02:00
Tobias Brunner 2e7cc07ecd Moved host_t and host_resolver_t to a new networking subfolder 2012-10-24 15:06:18 +02:00
Tobias Brunner 23ca39010e android: Enable ECC in the app as our custom built libcrypto supports it 2012-10-23 18:13:58 +02:00
Tobias Brunner d2c8bc4df0 Handle type of first EAP-RADIUS response more sophisticated 2012-10-18 14:48:11 +02:00
Tobias Brunner a5436657e9 Starter ignores non-fatal errors when reloading config 2012-10-18 14:42:11 +02:00
Tobias Brunner 9e730ef9df Starter unroutes removed or changed connections before loading and routing new ones 2012-10-18 14:42:11 +02:00
Tobias Brunner 21037942e8 Update routed connections in trap manager 
Before this change, modified configs that have been updated with ipsec reload,
could properly be started manually, but the old config would get used if
triggered via trap policies.
 2012-10-18 14:42:10 +02:00
Tobias Brunner 3555bacac7 Reload logger configuration on SIGHUP 
Besides changing the configuration this allows to easily rotate log files.

Also moved logger initialization back to daemon_t.
 2012-10-18 14:42:10 +02:00
Tobias Brunner d35d669180 Make syslog and file loggers configurable at runtime 2012-10-18 14:42:10 +02:00
Tobias Brunner 18a8893e8e Store loggers in conftest separately, not on charon 2012-10-18 14:42:10 +02:00
Tobias Brunner 3c4d383443 Added an option to reload certificates from PKCS#11 tokens on SIGHUP 2012-10-18 14:42:09 +02:00
Tobias Brunner ca1c2ee281 Copy the name of pkcs11_library_t objects 
Strings returned by settings_t.create_section_enumerator will be freed
when the config is reloaded.
 2012-10-18 14:42:09 +02:00
Tobias Brunner c30573467b New Android release after adding MOBIKE support 2012-10-18 14:03:38 +02:00
Tobias Brunner 8bd00205f4 Merge branch 'android-mobility' 
This brings support for MOBIKE to the Android app.  The app also tries
to keep the connection up as long as possible.

DNS queries are now handled by a new class that uses independent threads to
resolve them, this allows to cancel them e.g. if no network connectivity is
available (otherwise the app would block until the DNS query returns).
 2012-10-18 12:28:14 +02:00
Tobias Brunner 25a413cb96 Use a shortcut to resolve numeric IP addresses (no need for separate threads) 2012-10-18 12:27:32 +02:00
Tobias Brunner d377556863 Use native threads in host resolver so that it works even if processor has no threads 2012-10-18 12:26:49 +02:00
Tobias Brunner b4f6c39e55 Terminate unused resolver threads after a timeout 2012-10-18 12:26:00 +02:00
Tobias Brunner 49e2d109a3 Only create more threads if needed in host_resolver_t 2012-10-18 12:26:00 +02:00
Tobias Brunner eecd41e349 Use a helper function to add milliseconds to timeval structs 2012-10-18 12:25:59 +02:00
Tobias Brunner 2b6088c718 android: Ignore if peer is unreachable when reestablishing an SA 2012-10-18 12:25:59 +02:00
Tobias Brunner 901f6ac403 android: Use a shorter timeout for retransmits 2012-10-18 10:57:55 +02:00
Tobias Brunner 8658e87b35 android: Use keyingtries=%forever and dpd|closeaction=restart 
We also ignore the CHILD_SA_DOWN event.

This should allow us to keep the connection up as long as the user does
not manually disconnect.
 2012-10-18 10:57:55 +02:00
Tobias Brunner 292d8f41c3 Resolve hosts by DNS name in separate threads so we can cancel them 
getaddrinfo(3) may block a long time so proper termination of the daemon may
block if DNS servers are not reachable.

getaddrinfo(3) is an optional cancellation point in posix threads so it
might still block a shutdown but at least on Android (with the signal based
pthread_cancel implementation) it works, on Linux starter will kill charon
anyway after a while.
 2012-10-18 10:57:55 +02:00
Tobias Brunner 272ce5b580 android: Handle unreachable peers via alert 2012-10-16 14:16:17 +02:00
Tobias Brunner 1d6dc62727 Added a new alert that is raised if peer does not respond to initial IKE message 2012-10-16 14:16:17 +02:00
Tobias Brunner b00806cf85 android: Use 0.0.0.0/0 as local traffic selector 
This is helpful if the responder also wants to tunnel e.g. multicast
packages.
 2012-10-16 14:16:17 +02:00
Tobias Brunner 488b1cad13 Log IP addresses for discarded inbound IPsec packets 2012-10-16 14:16:17 +02:00
Tobias Brunner 45885ca613 android: Bypass/protect previously bypassed sockets if connectivity changes 2012-10-16 14:16:17 +02:00
Tobias Brunner 9167ca8b2b android: Support for IPsec SA update added 2012-10-16 14:16:17 +02:00
Tobias Brunner 51823c1f31 Use pointers for lookups in IPsec SA manager 2012-10-16 14:16:17 +02:00
Tobias Brunner 4785fbbc9c IPsec SA manager implements update_sa() 2012-10-16 14:16:17 +02:00
Tobias Brunner 7622c5e97e Setter for src and destination address of ipsec_sa_t added 2012-10-16 14:16:17 +02:00
Tobias Brunner 5b88d80f22 android: Trigger roam events in case connectivity changes 2012-10-16 14:16:17 +02:00
Tobias Brunner ef3d1a1ba9 android: Register NetworkManager as BroadcastReceiver and relay events via JNI 2012-10-16 14:16:17 +02:00
Tobias Brunner 38bbca587f android: Determine source address dynamically 2012-10-16 14:16:17 +02:00
Tobias Brunner 8f092a2221 android: Added NetworkManager class which allows to retrieve a local IP address 2012-10-16 14:16:17 +02:00
Tobias Brunner b0e0932538 android: Increase compile warnings 2012-10-16 14:16:16 +02:00
Tobias Brunner c3bce1aa3d android: Fixed "Configure" button in Android VPN dialog 2012-10-16 14:16:16 +02:00
Tobias Brunner e3d98f2c4c android: Don't use the default ESP proposal as it includes unsupported algorithms 2012-10-16 14:16:16 +02:00
Tobias Brunner 8e2d3075aa Use proper offset when adding mark attribute in kernel-netlink plugin 2012-10-15 11:11:29 +02:00
Tobias Brunner ac24c4d323 Also add mark when querying current replay state in kernel-netlink plugin 2012-10-15 10:15:53 +02:00
Tobias Brunner 2925aa725e Fixed update_sa in kernel-netlink plugin if marks are used 2012-10-11 19:08:47 +02:00
Tobias Brunner 418dcf3aae Fixed compilation of android_handler_t 2012-10-11 11:12:52 +02:00
Tobias Brunner 48651d8d02 Ensure UNSUPPORTED_CRITICAL_PAYLOAD notify contains correct payload type 2012-09-28 22:31:06 +02:00
Tobias Brunner 31cc325fce Make sure hasher exists before trying to destroy it 2012-09-28 20:57:12 +02:00
Tobias Brunner 2a43350334 Missed one in 6c10cece 2012-09-28 20:55:40 +02:00
Tobias Brunner 6da1ada3b3 Missed one in 3dcffed6 2012-09-28 20:50:09 +02:00
Tobias Brunner 91a8dc2dec Fixed RNG crypto tester 2012-09-28 19:13:40 +02:00
Tobias Brunner 3973ffa4f6 Request is never NULL when responding with an INFORMATIONAL message 2012-09-28 19:10:03 +02:00
Tobias Brunner 9181784fb1 Fixed check for rng in session ID creation of libfast 2012-09-28 19:07:53 +02:00
Tobias Brunner 6c10cecebf Completed state handling in isakmp_cert_pre 
Should not be a problem, but makes static analyzers happy.
 2012-09-28 19:01:09 +02:00
Tobias Brunner 9ff9c3d11b Added missing break statements in NAT-T mapping handling in PF_KEY plugin 2012-09-28 18:57:56 +02:00
Tobias Brunner 1407a0026f Added missing break when building TLS cipher suites 2012-09-28 18:55:40 +02:00
Tobias Brunner a37ac3a47a Make sure we successfully opened xfrm_acq_expires 2012-09-28 18:54:28 +02:00
Tobias Brunner a13c6a900e Added missing continue statement in ha socket error handling 2012-09-28 18:52:43 +02:00
Tobias Brunner 0273245877 Fixed snprintf check in tnc-ifmap plugin 2012-09-28 18:49:16 +02:00
Tobias Brunner 1b1d1d938f Make static analyzers happy when parsing hosts from sockaddr_t 2012-09-28 18:36:13 +02:00
Tobias Brunner 6ffb8f8634 Clarified code when hashing/comparing cached policies in kernel-netlink 2012-09-28 18:30:16 +02:00
Tobias Brunner 8b0dce08f2 Avoid overrunning array when registering pki command line options 2012-09-28 18:22:54 +02:00
Tobias Brunner 911e3156a0 Use %x to print uint32 as long ints are 64-bit long on x64 Linux 2012-09-28 18:09:08 +02:00
Tobias Brunner a05f3b2021 Make sure first argument is an int when using %.*s to print e.g. chunks 2012-09-28 18:01:49 +02:00
Tobias Brunner 4bc24ba794 Avoid memory leak when sending RADIUS accounting start message failed 2012-09-28 17:43:02 +02:00
Tobias Brunner 53ab3c27cd Ensure that pipe is closed when calling resolvconf(8) 2012-09-28 17:33:24 +02:00
Tobias Brunner a067dfbb2c Avoid memory leak when failing to read file metadata 2012-09-28 17:10:19 +02:00
Tobias Brunner 3dcffed682 The this->data member is never NULL 2012-09-28 17:09:16 +02:00
Tobias Brunner 9a1ba213f4 Use proper argument for sizeof when copying replay state 2012-09-28 17:00:20 +02:00
Tobias Brunner bef21bd330 Algorithm names are not always static anymore, avoid string overflows 2012-09-28 16:49:05 +02:00
Tobias Brunner f3d98a6b78 Correctly initialize payload length of encrypted payload 2012-09-28 16:30:26 +02:00
Tobias Brunner 9f22002706 The eap argument of send_response is never NULL 2012-09-28 16:28:54 +02:00
Tobias Brunner 9d5b688a11 Properly initialize sockaddr_in struct in fast and dhcp plugins 2012-09-28 16:28:46 +02:00
Tobias Brunner 0031bf3eaf Properly initialize ima flag when adding file measurements 2012-09-28 15:51:39 +02:00
Tobias Brunner 3f0eb04a04 Properly initialize chunk for PCR value in case of errors 2012-09-28 15:49:19 +02:00
Tobias Brunner 24aa55867e Initialize g and p in create_dh factory method 2012-09-28 15:48:09 +02:00
Tobias Brunner 10b116aa13 Properly initialize chunk for extension OID when parsing CRLs 2012-09-28 15:41:32 +02:00
Tobias Brunner 43e0cb6519 Fix parsing of IPv6 headers in ip_packet_t 2012-09-28 15:15:07 +02:00
Tobias Brunner 9fa335cb1b Properly cleanup varargs in LDAP fetcher's set_option() 2012-09-28 15:13:17 +02:00
Tobias Brunner b5835ee530 Properly cleanup varargs in enumerators of both SQL backends 2012-09-28 15:10:29 +02:00
Tobias Brunner a79af394a0 Allow replay windows smaller than the default of 32 2012-09-27 12:43:39 +02:00
Tobias Brunner 9845391a95 Properly initialize cached address map in kernel-pfroute plugin 2012-09-27 12:43:36 +02:00
Tobias Brunner 45178362c8 Clarified error message if enabling UDP decapsulation fails 2012-09-27 10:49:17 +02:00
Tobias Brunner bfd2cc1cd7 Fixed compilation of kernel-pfroute plugin 2012-09-27 09:23:58 +02:00
Tobias Brunner 358104a47f Added description for flush_auth_cfg and acct_port plus some minor editorial changes 2012-09-25 12:22:05 +02:00