denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
13,285 Commits 1 Branch 0 Tags
78ec8c608588739aa0f8e3bd59ed791d7adbda9a
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Tobias Brunner fafed376e7 imv-swid: Use pkg-config to check for libjson-c 
The package/library is called libjson-c on recent distributions.
Some like Ubuntu 14.04 provide symlinks with the old name but these
will eventually disappear.  Using pkg-config allows us to easily check
for it (with a fallback) and configure the proper compiler flags.

Fixes #663.
 2014-07-30 16:57:00 +02:00
Tobias Brunner ffa9b67189 dns-proxy: Don't use proxy socket if we fail to bypass it 
This will result in an infinite loop as packets sent over that socket
will again pass through the TUN device and the DNS proxy.

Apparently, bypassing fails when airplane mode is enabled.

Fixes #662.
 2014-07-30 09:48:08 +02:00
Tobias Brunner d236db8701 swanctl: Fix documentation of options for send_cert setting 2014-07-28 10:38:34 +02:00
Tobias Brunner 8d31df9099 android: New release after adding certificate import, DNS proxy and GUI changes 2014-07-22 11:34:09 +02:00
Tobias Brunner 1ddc1ec0b3 Merge branch 'android-dns-proxy' 
Adds a DNS proxy feature that uses VPN-protected sockets to resolve the
VPN gateway's hostname while reestablishing the IKE_SA, which is
required because we keep the TUN device up to avoid leaking plaintext
traffic.

The TUN device is recreated without DNS servers before reestablishing in
case the VPN server pushed DNS servers to the client that are only
reachable via VPN.

Fixes #622.
 2014-07-22 11:14:00 +02:00
Tobias Brunner ffff7219ef android: For keyingtries > 0 notify the GUI if the limit is reached when reestablishing 
The IKE_SA is destroyed anyway, so letting the GUI remain in
"connecting" state would be incorrect.

We still use keyingtries=0 for now, though. And we still abort after the
first failed attempt initially, in case there is a configuration error.
 2014-07-22 11:10:36 +02:00
Tobias Brunner 5fd9e5fd00 android: Terminate IKE_SA if initial IKE_SA_INIT fails 
Since VpnStateService.disconnect() is now not called until the error
dialog is dismissed the daemon would continue to try connecting.
So while the error dialog is shown the connection might actually be
successfully established in the background, which is not intended.

This way the IKE_SA is destroyed right after sending the IKE_SA_INIT of
the second connection attempt (due to keyingtries=0).
 2014-07-22 11:10:36 +02:00
Tobias Brunner 945832c67d android: Only allow DNS queries for the configured hostname 2014-07-22 11:10:36 +02:00
Tobias Brunner e77f226a0f android: Add optional filter functionality to DNS proxy 
If specified only queries for a list of allowed host names will be
proxied.
 2014-07-22 11:10:36 +02:00
Tobias Brunner c66f5f844d android: Recreate the TUN device without DNS when reestablishing IKE_SAs 
This enables DNS resolution while reestablishing if the VPN gateway pushed
DNS servers to the client that are only reachable via VPN.
 2014-07-22 11:10:36 +02:00
Tobias Brunner 36aab70ab0 android: Add method to BuilderAdapter to re-establish without DNS-related data 
Non-DNS data is cached in the BuilderAdapter so the TUN device can be
recreated easily (since the CHILD_SA is gone we couldn't actually gather
that information).
 2014-07-22 11:10:36 +02:00
Tobias Brunner cc1712a8f4 android: Use DNS proxy when reestablishing IKE_SAs 2014-07-22 11:10:36 +02:00
Tobias Brunner 614359a7d5 bus: Add ike_reestablish_pre hook, called before DNS resolution 
The old hook is renamed to ike_reestablish_post and is now also called
when the initiation of the new IKE_SA failed.
 2014-07-22 11:10:36 +02:00
Tobias Brunner 2dc26c557e android: Add DNS proxy implementation 
This class proxies DNS requests over VPN-protected UDP sockets.
It is not really Android specific and might be useful for
kernel-libipsec or libipsec in general too, so we could maybe move it later
to libipsec (might need some portability work).
 2014-07-22 11:10:36 +02:00
Tobias Brunner 16e519d42c ip_packet: Add function to easily encode UDP packets 2014-07-22 11:10:35 +02:00
Tobias Brunner 108a67893f ip_packet: Apply transport protocol ports when encoding IP packet 2014-07-22 11:10:35 +02:00
Tobias Brunner 46bb36980b ip_packet: Add getter for IP payload 2014-07-22 11:10:35 +02:00
Tobias Brunner d56d9a45d4 ip_packet: Allow creation of IP packets from data 2014-07-22 11:10:35 +02:00
Tobias Brunner b557f4a7cd chunk: Add function to calculate Internet Checksums according to RFC 1071 2014-07-22 11:10:35 +02:00
Tobias Brunner a10eb93566 ip_packet: Parse ports from TCP and UDP headers 2014-07-22 11:10:35 +02:00
Tobias Brunner 32109a535f Merge branch 'android-state-updates' 
The GUI reflects the state of the IKE daemon more closely by switching
back to the "connecting" state when the IKE_SA or CHILD_SA is down and
is getting reestablished.

Fixes #616.
 2014-07-22 11:06:31 +02:00
Tobias Brunner 394be2d556 android: Delay disconnecting on errors until user dismisses them 
If e.g. reauthentication fails we don't want to close the TUN device
until the user acknowledged the error and is thus aware of the failure.
 2014-07-22 10:55:51 +02:00
Tobias Brunner 08d545e29a android: Set CHILD_STATE_DOWN when the IKE_SA gets reestablished 2014-07-22 10:55:51 +02:00
Tobias Brunner fb5d541503 android: Set CHILD_STATE_DOWN whenever the CHILD_SA goes down 
No matter what triggers it.  We also don't close the TUN device, but we
might handle that differently in the future to allow reestablishing the
IKE_SA if host names have to be re-resolved via DNS.
 2014-07-22 10:55:51 +02:00
Tobias Brunner 1435bd2e1b android: Change to CONNECTING state if CHILD_SA goes down 
Unless we are disconnecting.  This currently triggers the connecting
dialog, perhaps just updating the status text would do too (when switching
from CONNECTED to CONNECTING, not from DISCONNECTED to CONNECTING).
 2014-07-22 10:55:51 +02:00
Tobias Brunner 94124456f2 Merge branch 'android-cert-import' 
Adds support to import CA and server certificate directly in the app.
On Android 4.4 and newer the SAF allows users to easily browse for such
files, on older systems they have to open them from file manager or the
download app (only works if the MIME type is correctly detected).

Also adds support for ECDSA keys on recent Android systems.
 2014-07-22 10:51:32 +02:00
Tobias Brunner d4bf6bfb15 android: Do not use deprecated TwoLineListItem 2014-07-22 10:41:51 +02:00
Tobias Brunner 7073bfe4e9 android: Add support for ECDSA private keys 
With 4.4.4 these work fine now.
 2014-07-22 10:41:51 +02:00
Tobias Brunner 3dc92ff9cf android: Show a confirmation dialog before importing certificates 
Since the import activity can be triggered by any other app on the
system we shouldn't just import every certificate we get.

Also, in some situations (e.g. if no passphrase has been set yet for the
system-wide certificate store) we are the only application that can open
certificate files.  So if a user clicked on a certificate file she would
just get a confirmation Toast about a successful import, with no indication
whatsoever where the certificate was actually imported.  The new dialog
shows the app icon to indicate that strongSwan is involved.
 2014-07-22 10:41:51 +02:00
Tobias Brunner 1ed922c918 android: Use Storage Access Framework to import certificates 
Thanks to the SAF, introduced with Android 4.4, browsing and opening
files on the system is very easy to implement.

On older systems the menu option is removed.
 2014-07-22 10:41:51 +02:00
Tobias Brunner 94cc8f6a72 android: Add activity to import certificate files 
Such files can e.g. be opened from the Download view, if they are
associated with one of the supported mime-types.
 2014-07-22 10:41:50 +02:00
Tobias Brunner ac200bcda5 android: Imported certificates may be clicked to delete them 2014-07-22 10:41:50 +02:00
Tobias Brunner eb01649079 android: Reload CA certificates without AsyncTask 
We already use loaders in the GUI that can handle this asynchronously.
 2014-07-22 10:41:50 +02:00
Tobias Brunner 918200378d android: Change how CA certificate reloads are initiated 2014-07-22 10:41:50 +02:00
Tobias Brunner 08de6a08f0 android: Add option to reload CA certificates to TrustedCertificatesActivity 2014-07-22 10:41:50 +02:00
Tobias Brunner 2312985b2a android: Replace option to reload CA certificates with CA certificate view 
The reload option will be added there.
 2014-07-22 10:41:50 +02:00
Tobias Brunner 1353f08fbc android: Only close TrustedCertificatesActivity on click when selecting a certificate 2014-07-22 10:41:50 +02:00
Tobias Brunner 9c841b1f34 android: Set action when using TrustedCertificatesActivity to select a certificate 2014-07-22 10:41:50 +02:00
Tobias Brunner f21a69dbec android: Allow selection of local certificates 2014-07-22 10:41:49 +02:00
Tobias Brunner 3b2b536b70 android: Change how CA certificates from different sources are accessed 2014-07-22 10:41:49 +02:00
Tobias Brunner 8cdce00eb1 android: Cache certificates from multiple KeyStores 
Including the new local one.
 2014-07-22 10:41:49 +02:00
Tobias Brunner 8d3a058abc android: Register local certificate store provider when the app is initialized 2014-07-22 10:41:49 +02:00
Tobias Brunner 5eb4297046 android: Add Provider for the local certificate store 2014-07-22 10:41:49 +02:00
Tobias Brunner 544267889e android: Add KeyStoreSpi implementation that uses LocalCertificateStore 2014-07-22 10:41:49 +02:00
Tobias Brunner 275888d255 android: Add local certificate store 
The class manages certificates stored in files within the app's
private data directory.
 2014-07-22 10:41:49 +02:00
Tobias Brunner 463a6cd005 android: Move TrustedCertificateEntry to a new package 2014-07-22 10:41:49 +02:00
Tobias Brunner 6684195505 android: Subclass Application to provide static access to the application context 2014-07-22 10:41:49 +02:00
Tobias Brunner 7229bdd5c7 android: Target latest SDK version 2014-07-22 10:41:49 +02:00
Tobias Brunner 140ce41a39 android: Add utility method to convert a byte array to a hex string 2014-07-22 10:41:48 +02:00
Tobias Brunner 9d994ba5ea android: Remove unused hash argument from getTrustedCertificates() 2014-07-22 10:41:48 +02:00
Tobias Brunner b9fd95f476 android: Use correct tag to define category for CREATE_SHORTCUT intent-filter 2014-07-22 10:41:48 +02:00
Tobias Brunner d962b25bcb starter: Fix memory leaks and warn if conn/ca sections are ignored due to parse errors 2014-07-18 17:15:15 +02:00
Tobias Brunner b906d41214 man: Document where left|rightsigkey searches for public key files 2014-07-14 10:58:28 +02:00
Tobias Brunner 3d2b36b812 NEWS: Updated URL to swidGenerator 2014-07-07 17:54:02 +02:00
Tobias Brunner 44870e5313 xauth-pam: Add workaround for null-terminated passwords 
Fixes #631.
 2014-07-07 11:14:02 +02:00
Tobias Brunner 118b2879aa winhttp: Do not use countof() on pointer argument 2014-07-02 12:38:45 +02:00
Tobias Brunner 831045ef45 optionsfrom: Properly handle errors when determining file size 2014-07-02 12:38:45 +02:00
Tobias Brunner e44223dbcc windows: Fix off-by-one error in strerror_s_extended() 2014-07-02 12:38:45 +02:00
Tobias Brunner 0026600bfe windows: accept() socket handle could theoretically be 0 2014-07-02 12:38:45 +02:00
Tobias Brunner babe9e4f45 windows: Close correct socket when opening second socket fails in socketpair() 2014-07-02 12:38:44 +02:00
Tobias Brunner 0a26f39a71 windows: Make sure the string returned from ReadConsole() is null terminated 2014-07-02 12:38:44 +02:00
Tobias Brunner 32a262e7a1 windows: Remove useless assignment in put_thread() 2014-07-02 12:12:05 +02:00
Tobias Brunner 0e48f67562 backtrace: Remove name checks after SymFromAddr() calls 
The Name member is an array whose address is always defined.
 2014-07-02 12:11:59 +02:00
Tobias Brunner fbe462e1b0 pts: Avoid integer overflow when reading file names in the old IMA format 2014-07-01 17:58:36 +02:00
Tobias Brunner ecb55b4639 imv-attestation: Avoid memory leak when skipping unsupported work items 2014-07-01 17:58:36 +02:00
Tobias Brunner 530d87be1b pts: Use memchr(3) instead of strchr(3) to extract hash algorithm name 
The string read with read(2) might not be null terminated.
 2014-07-01 17:58:36 +02:00
Tobias Brunner f82d7aff85 swid: fgets(3) returns a pointer to the read string or NULL 2014-07-01 17:58:36 +02:00
Tobias Brunner 1be2b84124 parser-helper: Ensure file_next() does not remove the sentinel item 2014-07-01 17:58:36 +02:00
Tobias Brunner 8b123d2e4a man: Document replay_window ipsec.conf option 2014-06-30 14:50:32 +02:00
Tobias Brunner 28a79e4e0c stroke: Don't log unspecified options of conn and ca sections 2014-06-30 13:29:26 +02:00
Tobias Brunner e79dbda390 utils: Helper macros to define overloaded macros based on number of arguments 2014-06-30 13:29:26 +02:00
Tobias Brunner ba2805c106 pki: Document --online option for pki --verify and all exit codes 2014-06-30 13:25:13 +02:00
Tobias Brunner 33967467e2 conf: Document load-tester.crl option 2014-06-30 13:25:13 +02:00
Tobias Brunner da7cb76974 conf: Document charon.*-scripts options 2014-06-30 13:25:13 +02:00
Tobias Brunner 38f27e172c conf: Document swanctl options 2014-06-30 13:25:13 +02:00
Tobias Brunner 4d066ef7fc conf: Document aikgen options 2014-06-30 13:25:13 +02:00
Tobias Brunner 3986c1e3fd autoconf: Replace --disable-tools option with --disable-scepclient 
Since using a separate option for pki this was the only tool that was still
enabled by that option.
 2014-06-30 13:25:13 +02:00
Tobias Brunner 45f647c9cd checksum: Fix checksum generation for pki if tools are disabled 2014-06-30 13:25:13 +02:00
Tobias Brunner 01e48ddd59 doc: Remove obsolete architecture description and empty known bugs list 2014-06-30 13:16:17 +02:00
Tobias Brunner 0909bf6c0a apidoc: Include *.md and files from the complete source directory (not only src) 2014-06-30 13:16:17 +02:00
Tobias Brunner 891d332b15 Converted existing README to Markdown 2014-06-30 13:16:17 +02:00
Tobias Brunner a477d28017 Move README to README.md so it gets evaluated as Markdown 2014-06-30 13:16:17 +02:00
Tobias Brunner 2eef43f3ee swid: Fix parameter documentation in Doxygen comments 2014-06-30 13:16:17 +02:00
Tobias Brunner e351169900 windows: Fix parameter name in Doxygen comment 2014-06-30 13:16:17 +02:00
Tobias Brunner aad072d517 enum: Replace þ with p in Doxygen comments 2014-06-30 13:16:17 +02:00
Tobias Brunner 3b16c2b55d libvici: Add missing argument to Doxygen comment 2014-06-30 13:16:16 +02:00
Tobias Brunner cc7c4c3dbd starter: Add starter group and fix formatting of conf_parser_section_t enum 
Make use of the Markdown support in recent Doxygen versions.
 2014-06-30 13:16:16 +02:00
Tobias Brunner 1bd175a9ef swanctl: Fix Doxygen group assignment 2014-06-30 13:16:16 +02:00
Tobias Brunner 00729e16e7 apidoc: Updated Doxyfile.in 2014-06-30 13:16:16 +02:00
Tobias Brunner ed01c1afff Fixed some typos 2014-06-30 13:16:16 +02:00
Tobias Brunner be41910e19 testing: Add sql/shunt-policies-nat-rw scenario 2014-06-26 18:13:26 +02:00
Tobias Brunner 73211f9b74 testing: Add pfkey/shunt-policies-nat-rw scenario 2014-06-26 18:13:26 +02:00
Tobias Brunner f22add05f6 kernel-pfkey: Use address in TS to determine interface for shunt routes 2014-06-26 18:13:17 +02:00
Tobias Brunner 60f5fb2318 kernel-pfkey: Use subnet and prefix when determining nexthop for shunt policy routes 
This is basically the same as 88f125f560.
 2014-06-26 18:13:09 +02:00
Tobias Brunner b451303a6c kernel-pfkey: Install routes for shunt policies 2014-06-26 18:12:05 +02:00
Tobias Brunner 945e1df738 testing: Remove obsolete shunt-policies scenarios 2014-06-26 18:12:00 +02:00
Tobias Brunner 04ff5e58e3 starter: Ingore %default conn and ca sections 2014-06-26 12:23:05 +02:00
Tobias Brunner 4431e1e04d updown: Force subnet address to be numeric 2014-06-25 16:17:15 +02:00
Tobias Brunner cd6b2af33e kernel-netlink: Cast IPv6 address blobs to the proper type 
On Android these macros are defined as functions.
 2014-06-24 15:53:25 +02:00
Tobias Brunner 3e4ce88633 android: Define HAVE_DLADDR as plugin loader checks for it 2014-06-24 15:53:25 +02:00