denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
11,583 Commits 1 Branch 0 Tags
7a23588195443f6b70ba47fc068835c268432fbb
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Tobias Brunner e5b5a66712 kernel-pfkey: Fail route installation if remote TS matches peer 2013-07-18 15:41:36 +02:00
Tobias Brunner 29bdfb4086 kernel-libipsec: Fail route installation if remote TS matches peer 2013-07-18 15:41:13 +02:00
Tobias Brunner dfc9902013 capabilities: Some plugins don't actually require capabilities at runtime 2013-07-18 15:25:35 +02:00
Tobias Brunner 027676f750 capabilities: Add function to check if a capability is held, without keeping it 
This can be useful if capabilities are not required anymore after
dropping privileges.
 2013-07-18 15:25:35 +02:00
Tobias Brunner 07a9d5c91a ike: Fix reestablishing SAs if no child-creating tasks are queued 2013-07-18 10:40:08 +02:00
Tobias Brunner 79b6ead1e4 unity: Replicate default behavior if no UNITY_SPLIT_INCLUDE attributes were received 2013-07-17 18:23:57 +02:00
Tobias Brunner 56b0fac8c9 unity: Allow UNITY_LOCAL_LAN to be longer than 8 bytes 2013-07-17 18:23:57 +02:00
Tobias Brunner c7d0b80abb unity: Fix memory leak in provider 2013-07-17 18:23:57 +02:00
Tobias Brunner b2dfa0624d ipsec.conf.5: closeaction is now supported for IKEv1 2013-07-17 18:18:57 +02:00
Tobias Brunner a9ffb48f21 ikev1: Reestablish IKE_SA/CHILD_SAs if it gets deleted by the peer 
We call ike_sa_t.reestablish() so the IKE_SA is only recreated if any
CHILD_SA requires it.
 2013-07-17 18:16:59 +02:00
Tobias Brunner 68db844f99 ike: Migrate queued CHILD_SA-creating tasks when reestablishing an IKE_SA 2013-07-17 18:16:58 +02:00
Tobias Brunner 6b99e4b7e0 Merge branch 'kernel-pfroute-mobility' 
This improves the behavior of the kernel-pfroute plugin (and sometimes
the kernel-pfkey plugin) in case of mobility, mostly when used as as
client but also as gateway, if clients are mobile.
 2013-07-17 17:49:26 +02:00
Tobias Brunner fae4d67adc kernel-pfroute: Ignore IP address changes if address is %any 2013-07-17 17:45:18 +02:00
Tobias Brunner b308a97944 kernel-pfroute: Properly enumerate sockaddrs in interface messages 
The ifa_msghdr and rt_msghdr structs are not compatible (at least not on
FreeBSD).
 2013-07-17 17:45:18 +02:00
Tobias Brunner 5310f485d9 kernel-pfroute: Provide name of interfaces on which virtual IPs are installed 2013-07-17 17:45:18 +02:00
Tobias Brunner e9c1ca0278 kernel-pfroute: Ignore virtual IPs in address map 
As the virtual flag is set after the address has been added to the map,
we make sure we ignore virtual IPs when doing lookups.
 2013-07-17 17:45:18 +02:00
Tobias Brunner cb082d15ef kernel-pfroute: Make sure source addresses are not virtual and usable 
It seems we sometimes get the virtual IP as source (with
rightsubnet=0.0.0.0/0) even if the exclude route is already
installed.  Might be a timing issue because shortly afterwards the
lookup seems to succeed.
 2013-07-17 17:45:18 +02:00
Tobias Brunner 527663d6b6 kernel-pfroute: Don't report an error when trying to reinstall a route 2013-07-17 17:45:18 +02:00
Tobias Brunner 8afd0f05e3 kernel-pfkey: Provide interface name when installing exclude route 2013-07-17 17:45:18 +02:00
Tobias Brunner 0745f846d0 kernel-pfroute: Reinstall routes on interface/address changes 2013-07-17 17:45:17 +02:00
Tobias Brunner 7b9c3fb41f kernel-pfroute: Trigger a roam event if a new interface appears 2013-07-17 17:45:17 +02:00
Tobias Brunner e50b20539b kernel-pfroute: Use ref_get() to allocate sequence numbers 2013-07-17 17:45:17 +02:00
Tobias Brunner baa6419ec1 kernel-pfroute: Make time that is waited for VIPs to appear configurable 
One second might be too short for IPs to appear/disappear, especially on
virtualized hosts.
 2013-07-17 17:45:17 +02:00
Tobias Brunner dc8b083d9f kernel-pfroute: Retry route lookup without source address on failure 
The known source address might be gone resulting in an error, making
learning a new source address impossible.
 2013-07-17 17:45:17 +02:00
Tobias Brunner bbd9df25a9 kernel-pfkey: Remove latest IPsec SA mapping when deleting a policy 
If IPsec SAs are rekeyed due to an address change (e.g. because
update_sa is not supported) the exact same policy with the same reqid
will be installed, but with different addresses.  After the rekeying the
old SA and its policies are removed, using the first matching mapping
breaks the mapping between the policies and the new SA (at least on
FreeBSD, the Linux kernel might only use the reqid for this).  Using the
oldest matching SA is still an approximation but it solves the above
issue.
 2013-07-17 17:45:17 +02:00
Tobias Brunner a9f14ada34 kernel-pfkey: Correctly handle IPSEC_PROTO_ANY in an acquire 2013-07-17 17:45:17 +02:00
Tobias Brunner 84693a3d79 linked-list: Remove barely used has_more() method 
This required some refactoring when handling encrypted payloads.

Also changed log messages so that "encrypted payload" is logged instead
of "encryption payload" (even if we internally still call it that) as
that's the name used in RFC 5996.
 2013-07-17 17:42:53 +02:00
Tobias Brunner 1a9528f916 linked-list: Don't require an argument for the item when enumerating 2013-07-17 17:42:53 +02:00
Tobias Brunner cf4172637a linked-list: Remove unused clone_function() method 2013-07-17 17:42:53 +02:00
Tobias Brunner 0f3ddbd189 linked-list: Remove barely used find_last() method 2013-07-17 17:42:53 +02:00
Tobias Brunner be3c09d020 linked-list: Remove unused replace() method 
Its functionality can be replicated by calling insert_before() followed
by remove_at().  Not the other way around, though, because remove_at()
changes the enumerator position.
 2013-07-17 17:42:53 +02:00
Tobias Brunner f067348134 kernel-libipsec: Log error if no local address is found when installing routes 2013-07-15 14:37:31 +02:00
Tobias Brunner 1ee1163214 dumm: Sort templates by name 2013-07-15 14:37:05 +02:00
Tobias Brunner 9e7a45bec2 testing: Don't load certificates explicitly and delete CA certificates in PKCS#12 scenarios 
Certificates are now properly extracted from PKCS#12 files.
 2013-07-15 11:27:07 +02:00
Tobias Brunner 591f923134 stroke: Add certificates extracted from PKCS#12 files to correct credential set 
Only keys and shared secrets are moved from the temporary credential set after
loading all secrets.
 2013-07-15 10:59:13 +02:00
Tobias Brunner e0b868f79e pkcs12: Add plugin dependencies with soft dependencies on the most common algorithms 2013-07-15 10:48:19 +02:00
Tobias Brunner b23bd71466 android: New release after adding support for EAP-TNC 
Also disabled listening on IPv6 because the Linux kernel currently does
not support UDP encapsulation for IPv6.
 2013-07-08 18:51:07 +02:00
Tobias Brunner f32eb48e9a Merge branch 'android-byod' 
Adds support for EAP-TNC with a custom Android-specific IMC that
collects data such as installed packages, file hashes or system
settings.

Some parts of the implementation are based on the bachelor semester
project 'strongSwan Android 4 Client with Endpoint Assessment' by
Christoph Bühler and Patrick Lötscher.
 2013-07-08 18:50:09 +02:00
Tobias Brunner 7ccf02ee93 android: Properly handle dotted-quad notation of IPv6 addresses 
For nestat output like ::ffff:127.0.0.1:9876 we shall not treat 127 as
port but 9876 instead.
 2013-07-08 18:49:30 +02:00
Tobias Brunner 97f1dfb3ec android: Allow IMC state to be dismissed with a swipe gesture 2013-07-08 18:49:30 +02:00
Tobias Brunner a9f94d7efb android: Use explicit locale when converting settings names 
Apparently, these functions use the user's default locale which might not
yield the expected result (e.g. lowercase I is not i in the Turkish
locale but ı instead).
 2013-07-08 18:49:30 +02:00
Tobias Brunner e1a98e7956 android: Add information about transmitted data if EAP-TNC is selected 2013-07-08 18:49:30 +02:00
Tobias Brunner 9390499584 android: Reuse certificate selector as generic two line button 2013-07-08 18:49:30 +02:00
Tobias Brunner 671614d229 android: Add device ID in BeginHandshake 2013-07-08 18:49:30 +02:00
Tobias Brunner 8a5bffb0fe android: Add new VpnType to enable BYOD features 2013-07-08 18:49:30 +02:00
Tobias Brunner d27f225d9a Use strpfx() helper where appropriate 2013-07-08 18:49:30 +02:00
Tobias Brunner f460facdca utils: Add helper function to check a string for a given prefix 2013-07-08 18:49:30 +02:00
Tobias Brunner 985dcab1c2 utils: Convert string helper macros to static inline functions 2013-07-08 18:49:29 +02:00
Tobias Brunner 2ecda3421a android: Use a different set of plugins if BYOD features are enabled 2013-07-08 18:49:29 +02:00
Tobias Brunner 6e872fea7a android: IMC state fragment is a button that shows remediation instructions or log 2013-07-08 18:49:29 +02:00
Tobias Brunner 254d8679c6 android: Show remediation instructions instead of log on failure 2013-07-08 18:49:29 +02:00
Tobias Brunner 873f389b37 android: Properly hide the IMC state fragment initially 2013-07-08 18:49:29 +02:00
Tobias Brunner 0ef98957a7 android: Add activity that displays a list of remediation instructions 
On large displays a two-pane layout is used that displays the list next
to the actual instructions.
 2013-07-08 18:49:29 +02:00
Tobias Brunner 611d35e8e8 android: Add fragment for a list of remediation instructions 
This fragment can later be used in one- or two-pane layouts.
 2013-07-08 18:49:29 +02:00
Tobias Brunner b6e05f6518 android: Add adapter for remediation instructions 2013-07-08 18:49:29 +02:00
Tobias Brunner ea022bb194 android: Add fragment that displays a single remediation instruction 2013-07-08 18:49:29 +02:00
Tobias Brunner c469cd2a66 android: RemediationInstruction implements Parcelable interface 2013-07-08 18:49:29 +02:00
Tobias Brunner 2b91085701 android: Background for state panels provides separator 2013-07-08 18:49:29 +02:00
Tobias Brunner e5bf6dcddc android: Add fragment that displays the IMC state 
The fragment hides itself if the state is unknown or the assessment
succeeded.
 2013-07-08 18:49:29 +02:00
Tobias Brunner a05acd7629 android: Handle and store IETF remediation instructions 2013-07-08 18:49:28 +02:00
Tobias Brunner 0484989dbd android: Add a parser for XML remediation instructions 2013-07-08 18:49:28 +02:00
Tobias Brunner a8dc42b295 android: Show different error message depending on IMC state 2013-07-08 18:49:28 +02:00
Tobias Brunner 5e7a4193e5 android: Clear error only when the user explicitly dismisses the dialog 
The previous code worked fine on rotation changes as the fragment is
destroyed and recreated causing onCreate to be called, which restores the
saved error state.  But if the user switches to a different application
and then back this is not the case.  The dialog still gets dismissed (as
we have to do so to avoid nasty exceptions on rotation changes) but since
that implicitly cleared the error state the UI was never fully restored.
 2013-07-08 18:49:28 +02:00
Tobias Brunner dc52cfab73 android: Add state of IMC to VpnStateService and update it via JNI 2013-07-08 18:49:28 +02:00
Tobias Brunner d087f080f0 android: Handle TCG file measurement related attributes using PTS 2013-07-08 18:49:28 +02:00
Tobias Brunner fd3aa004e4 android: Android IMC state provides a Platform Trust Service (PTS) instance 2013-07-08 18:49:28 +02:00
Tobias Brunner 0e53beda32 android: Provide a public interface for Android IMC state 2013-07-08 18:49:28 +02:00
Tobias Brunner 6bce8e1cfb libimcv: Properly deinitialize libimcv 
Other users of imcv_pa_tnc_attributes (libpts) check if it is NULL before
removing vendor IDs.
 2013-07-08 18:49:28 +02:00
Tobias Brunner 403165102c android: Define IMC functions static and with lower-case names 2013-07-08 18:49:28 +02:00
Tobias Brunner 17044a753a libpts: Skip unreadable files when measuring directories 2013-07-08 18:49:28 +02:00
Tobias Brunner 583fe0ccb6 android: Add measurement collector for ITA Device ID 2013-07-08 18:49:28 +02:00
Tobias Brunner 44330a171f android: Add measurement collector for ITA Settings 2013-07-08 18:49:27 +02:00
Tobias Brunner c179a3f6f2 android: Handle ITA PA-TNC attributes 2013-07-08 18:49:27 +02:00
Tobias Brunner 036fa7a166 android: Overload for getMeasurement() that takes a String array as argument 2013-07-08 18:49:27 +02:00
Tobias Brunner ba59486fc8 android: Add measurement collector for Port Filter 
This collector reports all listening TCP and UDP sockets/ports.
 2013-07-08 18:49:27 +02:00
Tobias Brunner 6500727d6a android: Enum type for transport protocols added 2013-07-08 18:49:27 +02:00
Tobias Brunner 7cb8f570ed android: Add measurement collector for Installed Packages 2013-07-08 18:49:27 +02:00
Tobias Brunner 2d61172314 android: Add measurement collector for Product Information 2013-07-08 18:49:27 +02:00
Tobias Brunner 75d710ec63 android: Also support writing of 24-bit values 2013-07-08 18:49:27 +02:00
Tobias Brunner 5c9706f30b android: Add measurement collector for String Version 2013-07-08 18:49:27 +02:00
Tobias Brunner 4eec7912a1 android: Interfaces for measurement collectors and attributes added 2013-07-08 18:49:27 +02:00
Tobias Brunner 2d378d8a74 android: Add a Java utility class similar to bio_writer_t 2013-07-08 18:49:27 +02:00
Tobias Brunner 28c268d707 android: Add enum types for PENs and attribute types 2013-07-08 18:49:26 +02:00
Tobias Brunner c53210f9b0 android: Add a generic handler for PA-TNC attribute requests 
The idea is that the Android IMC will return attributes in their binary
encoding.  This keeps the JNI interface to the IMC pretty simple.
 2013-07-08 18:49:26 +02:00
Tobias Brunner 2c693364a8 imv-scanner: Only add a reason string if there is something to report 2013-07-08 18:49:26 +02:00
Tobias Brunner aa4ff3b211 android: Added a Java part to the Android IMC 2013-07-08 18:49:26 +02:00
Tobias Brunner 753035f6d7 android: Don't attempt loading IMCs from /etc/tnc_config 2013-07-08 18:49:26 +02:00
Tobias Brunner 82aceeb151 libtnccs: Don't try to load IMCs/IMVs from a file if there is no filename 2013-07-08 18:49:26 +02:00
Tobias Brunner ad39ce314b Ignore Eclipse project/workspace files 
Students seem to like Eclipse to work on strongSwan.
 2013-07-08 18:49:26 +02:00
Tobias Brunner a6507df2ec android: Build libpts and init/deinit libpts in BYOD IMC 2013-07-08 18:49:26 +02:00
Tobias Brunner f0e0101a1f libpts: Android.mk added 2013-07-08 18:49:26 +02:00
Tobias Brunner 96658d7264 android: Added a sample IMC that sends some dummy OS data 2013-07-08 18:49:26 +02:00
Tobias Brunner 933155fae6 android: Build option added to load BYOD related plugins and libraries in the Android app 2013-07-08 18:49:26 +02:00
Tobias Brunner c9df0f989d android: Added support to build tnc-imc plugin 2013-07-08 18:49:25 +02:00
Tobias Brunner 4672078190 android: Added support to build eap-tnc, tnc-tnccs and tnccs-20 plugins 2013-07-08 18:49:25 +02:00
Tobias Brunner 71b23661d4 android: Added function to include source files from plugin subdirectories 2013-07-08 18:49:25 +02:00
Tobias Brunner 1973743443 libimcv: Android.mk added 2013-07-08 18:49:25 +02:00
Tobias Brunner 43c912dc27 attr-sql: Add unity_split_exclude as alias for unity_local_lan 2013-07-08 17:20:54 +02:00
Tobias Brunner 4fdf1306eb attr-sql: Fix double free when adding subnets for unknown attribute types 2013-07-08 17:20:53 +02:00
Tobias Brunner a9750698cf libtncif: Android.mk updated 2013-07-05 13:57:44 +02:00