denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
9,295 Commits 1 Branch 0 Tags
92f207477cf17d324e5ac6900e7e3ae868fb2951
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Martin Willi f3ca96b2bf Add a return value to prf_t.set_key() 2012-07-16 14:53:34 +02:00
Martin Willi ecc080b393 Add a return value to prf_t.allocate_bytes() 2012-07-16 14:53:34 +02:00
Martin Willi a7e6539135 Use a bool return value in keymat_v1_t.get_hash_phase2() 2012-07-16 14:53:34 +02:00
Martin Willi e4c5c1d03e Add a return value to keymat_v1_t.get_hash() 2012-07-16 14:53:34 +02:00
Martin Willi bb1e0c59e1 Add a return value to keymat_v2_t.get_auth_octets() 2012-07-16 14:53:34 +02:00
Martin Willi 2baae8e3ea Add a return value to keymat_v2_t.get_psk_sig() 2012-07-16 14:53:34 +02:00
Martin Willi bc47488323 Add a return value to prf_t.get_bytes() 2012-07-16 14:53:33 +02:00
Martin Willi e7d98b8c99 Add a return value to tls_prf_t.set_key() 2012-07-16 14:53:33 +02:00
Martin Willi 97b30b93b0 Add a return value to tls_prf_t.get_bytes() 2012-07-16 14:53:33 +02:00
Martin Willi edd54734c8 prf_plus_create() can return NULL on failure 2012-07-16 14:53:33 +02:00
Martin Willi 8207fe3eb3 Add a return value to prf_plus_t.get_bytes() 2012-07-16 14:53:33 +02:00
Martin Willi 5d79e6c6b4 Add a return value to prf_plus_t.allocate_bytes() 2012-07-16 14:53:33 +02:00
Martin Willi 2d56575d52 Add a return value to signer_t.set_key() 2012-07-16 14:53:33 +02:00
Martin Willi 9020f7d0b9 Add a return value to tls_crypto_t.derive_secrets() 2012-07-16 14:53:33 +02:00
Martin Willi 86d2cdc1ed Add a return value to simaka_crypto_t.derive_keys_*() 2012-07-16 14:53:33 +02:00
Martin Willi 2e96de60a8 Add a return value to signer_t.get_signature() 2012-07-16 14:53:33 +02:00
Martin Willi 5fb719e0de Add a return value to radius_message_t.sign() 2012-07-16 14:53:33 +02:00
Martin Willi 264e702109 Add a return value to simaka_message_t.generate() 2012-07-16 14:53:33 +02:00
Martin Willi cbfbba7d86 Add a return value to signer_t.allocate_signature() 2012-07-16 14:53:32 +02:00
Martin Willi ad08730a4b Add a return value to aead_t.set_key() 2012-07-16 14:53:32 +02:00
Martin Willi e2ed7bfd22 Add a return value to aead_t.encrypt() 2012-07-16 14:53:32 +02:00
Martin Willi d19f0ae3e0 Don't modify the message string passed to logger, as it gets reused 2012-07-13 15:43:04 +02:00
Martin Willi d35e45b939 Invoke autoheader after libtool/aclocal to work on up-to-date data 2012-07-13 13:43:38 +02:00
Martin Willi 40ae0feeb1 Silence cast warning on 32-bit platforms 2012-07-13 13:43:16 +02:00
Martin Willi 0e3c697c05 Don't set BFD_DECOMPRESS when building against older binutils 2012-07-13 13:42:31 +02:00
Martin Willi c6343cf0ad Log to a malloc()ed buffer if the on-stack buffer is not large enough 2012-07-13 13:23:29 +02:00
Martin Willi 060555f082 Append directly to base string in vstr printf hooks 2012-07-13 13:23:29 +02:00
Martin Willi 4addc415a5 Write directly to FILE stream in glibc printf hooks 2012-07-13 13:23:29 +02:00
Martin Willi 1b40b74de0 Pass opaque data to printf hooks and print_in_hook() 2012-07-13 13:23:29 +02:00
Martin Willi 549eba30ab Increase leak detective backtrace depth by a frame 2012-07-13 13:23:29 +02:00
Martin Willi 6499354e4a Don't access tail magic when reallocating invalid memory, as it would crash 2012-07-13 13:23:29 +02:00
Martin Willi 4c6c934635 With --enable-bfd-backtraces, use binutils libbfd to resolve backtraces 
The invocation of addr2line to resolve backtrace source locations
is slow and cumbersome. When using libbfd directly, we can eliminate
the overhead of the process invocation. Even better, we can cache
library symbol names, bringing wicked fast lookups. As a neat bonus,
we can resolve static function names.
 2012-07-13 13:23:29 +02:00
Martin Willi b46776aea1 Add an external method to disable leak detective temporarly 2012-07-13 13:23:29 +02:00
Martin Willi bbe5b50567 Set a sane default if --with-dev-headers is given without path 2012-07-12 08:39:54 +02:00
Martin Willi a24f83e97a Use "-include config.h" when building ruby dumm extension 2012-07-11 18:07:19 +02:00
Martin Willi b188f23199 Install dev headers only if --with-dev-headers= option is set 2012-07-11 11:16:31 +02:00
Martin Willi 2a6bcbbdee Install libtls development headers 2012-07-11 10:51:01 +02:00
Martin Willi f1292d9d24 Install libfast development headers 2012-07-11 10:43:33 +02:00
Martin Willi 980ca1f773 Define CONFIG_H_INCLUDED in Android build 2012-07-11 10:00:27 +02:00
Martin Willi 4c311ffb1f Check if config.h passed correctly via gcc -include 2012-07-11 09:57:07 +02:00
Martin Willi 7115448529 Install libstrongswan development headers 2012-07-11 09:57:07 +02:00
Martin Willi 7300eb29d1 Use and install a config.h AC_CONFIG_HEADER that contains all AC_DEFINE results 2012-07-11 09:57:07 +02:00
Martin Willi a4037686c7 Added a description to all AC_DEFINE macros, as required by autoheader 2012-07-11 09:57:07 +02:00
Martin Willi 7c8b9fcbf6 Add safe_strerror() to leak detective whitelist 
While the thread specific strerror buffer gets cleaned up for
worker threads during their termination, the main thread itself,
and so its strerror buffer, is still alive during leak reports.
 2012-07-11 08:45:15 +02:00
Martin Willi 07836f559d Send cert request based on peers configured authentication class 2012-07-10 17:15:59 +02:00
Martin Willi dfd34c5a77 Add an option to disable libstrongswan certificate caching 2012-07-09 19:03:10 +02:00
Martin Willi 3128e7fa7c Don't send CERTREQs when initiating aggressive mode PSK 2012-07-09 12:05:23 +02:00
Martin Willi 0619ddfaa4 Refactored heavily #ifdefd capability code to its own libstrongswan class 2012-07-04 11:01:40 +02:00
Martin Willi ce938e5cfa Add charon-nm to .gitignore 2012-07-03 17:41:14 +02:00
Martin Willi 3e0fe9f13e Default to register_printf_specifier() if no printf hooking #defined 
This allows us to build (non-./configured) external tools against
libstrongswan without explicitly specifiying the most commonly used
printf hooking function.
 2012-07-03 13:09:14 +02:00
Martin Willi 997fdd1f02 Accept non-"/0" subnet sizes for traffic selectors starting at 0.0.0.0 2012-07-02 17:25:26 +02:00
Martin Willi b8d4cd294b Update our network-manager-strongswan/debian to what is actually used downstream 2012-07-02 10:20:03 +02:00
Martin Willi d12635c77d Pass "lo" as faked tundev to NM, as it now needs a valid interface since 0.9 2012-06-29 15:21:57 +02:00
Martin Willi 9d2968e272 As a responder, don't start a TRANSACTION request if we expect one from the initiator 2012-06-29 13:40:31 +02:00
Martin Willi 0f018a7324 Show some uname() info in "ipsec statusall" 2012-06-28 11:56:40 +02:00
Martin Willi b8e17eb36f Show some uname() info during charon startup 2012-06-28 11:56:15 +02:00
Martin Willi 271377905d Defer quick mode initiation if we expect a mode config request 2012-06-27 11:42:56 +02:00
Martin Willi 8ff45cfd99 Queue a mode config task as responder if we need a virtual IP 2012-06-27 11:42:56 +02:00
Martin Willi c2a391746c Add basic support for XAuth responder authentication 2012-06-27 11:42:56 +02:00
Martin Willi a9aa75b90e Map XAuth responder authentication methods between IKEv1 and IKEv2 2012-06-27 11:42:56 +02:00
Martin Willi dc6d259635 Show remote EAP/XAuth identity in "statusall" on a separate line 2012-06-27 11:42:00 +02:00
Martin Willi 5def45b890 Ignore a received %any virtual IP for installation 2012-06-26 18:00:40 +02:00
Martin Willi 0ba1ddaa24 Enforce uniqueids=keep based on XAuth identity 2012-06-25 10:18:35 +02:00
Martin Willi f145ea29e0 Don't send XAUTH_OK if a hook prevents SA to establish 2012-06-25 10:18:35 +02:00
Martin Willi 0c32b9c62f Enforce uniqueids=keep only for non-XAuth Main/Agressive Modes 2012-06-25 10:18:35 +02:00
Martin Willi dd1381e7d3 Show EAP/XAuth identity in "ipsec status", if available 2012-06-25 10:18:35 +02:00
Martin Willi 0fbfcf2a3a Use XAuth/EAP remote identity for uniqueness check 2012-06-25 10:18:34 +02:00
Martin Willi de5e8fb4e0 Add missing XAuth name variable when complaining about missing XAuth backend 2012-06-25 10:09:27 +02:00
Martin Willi e2dd114f37 Select requested virtual IP family based on remote TS, if no local TS available 2012-06-20 10:02:01 +02:00
Martin Willi af518b450e Adopt children as XAuth initiator (which is IKE responder) 2012-06-14 14:49:19 +02:00
Martin Willi 794cdbc53f Added 5.0 NEWS about IKEv1 in charon 2012-06-14 10:57:29 +02:00
Martin Willi e36497700c Print the kind of *Swan during starter startup 2012-06-14 10:25:48 +02:00
Martin Willi 137035cc78 Show what kind of *Swan we run in "ipsec status" 2012-06-14 10:25:48 +02:00
Martin Willi b31a56f128 Require a scary option to respond to Aggressive Mode PSK requests 
While Aggressive Mode PSK is widely used, it is known to be subject
to dictionary attacks by passive attackers. We don't complain as
initiator to be compatible with existing (insecure) setups, but
require a scary strongswan.conf option if someone wants to use it
as responder.
 2012-06-14 10:25:48 +02:00
Martin Willi 5a6e5e0d2d NEWS about specifying trustchain HASH algorithm requirements 2012-06-12 15:01:39 +02:00
Martin Willi 7c4214bd38 Add documentation for signature hash algorithm enforcing to man ipsec.conf 2012-06-12 15:01:39 +02:00
Martin Willi e35bbb9740 Added signature scheme options left/rightauth 2012-06-12 15:01:39 +02:00
Martin Willi 918e92c4c9 Support multiple different public key strength types in constraints 2012-06-12 14:24:49 +02:00
Martin Willi fd4ff11858 Add signature schemes to auth_cfg during trustchain validation 2012-06-12 14:24:49 +02:00
Martin Willi a37f2d2006 certificate_t->issued_by takes an argument to receive signature scheme 2012-06-12 14:24:49 +02:00
Martin Willi 439d0742e9 Define auth_cfg rules for signature schemes 2012-06-12 14:24:49 +02:00
Martin Willi e5f0f9ff96 Enforce uniqueness policy in IKEv1 main and aggressive modes 2012-06-08 16:15:22 +02:00
Martin Willi 82ad53b776 Try to rekey without KE exchange if peer returns INVALID_KE_PAYLOAD(NONE) 
According to RFC5996, implementations should just ignore the KE payload
if they select a non-PFS proposals. Some implementations don't, but
return MODP_NONE in INVALID_KE_PAYLOAD, hence we accept that, too.
 2012-06-08 10:35:02 +02:00
Martin Willi 2d4c347af9 While checking for redundant quick modes, compare traffic selectors 
If a configuration is instanced more than once using narrowing,
we should keep all unique quick modes up during rekeying.
 2012-06-08 10:22:03 +02:00
Martin Willi 106b938b6b Store shorter soft lifetime of in- and outbound SAs only 2012-06-08 10:22:03 +02:00
Martin Willi 7a5f372c57 Initiate quick mode rekeying with narrowed traffic selectors 2012-06-08 10:22:03 +02:00
Martin Willi d61f2906d4 Use traffic selectors passed to quick mode constructor as initiator 2012-06-08 10:22:03 +02:00
Martin Willi 1e24fa4614 Instead of rekeying, delete a quick mode if we have a fresher instance 
If both peers initiate quick mode rekeying simultaneously, we end up
with duplicate SAs for a configuration. This can't be avoided, nor do
the standards provide an appropriate solution. Instead of closing one
SA immediately, we keep both. But once rekeying triggers, we don't
refresh the SA with the shorter soft lifetime, but delete it.
 2012-06-08 10:22:03 +02:00
Martin Willi ab24a32edf As responder, enforce the same configuration while rekeying CHILD_SAs 2012-06-06 16:06:49 +02:00
Martin Willi 21043198ff Show expiration time of rekeyed CHILD_SAs in statusall 2012-06-05 10:29:43 +02:00
Martin Willi 060b508e0e Fix boolean return value if an empty RSA signature is detected in gmp plugin 
Fixes CVE-2012-2388.
 2012-05-31 17:38:59 +02:00
Martin Willi 3c475660c5 Apply IDir before deriving keys as aggressive initiator 2012-05-23 12:27:47 +02:00
Martin Willi 523ce7c20c Use received identity to look up PSK as aggressive responder 2012-05-23 12:18:45 +02:00
Martin Willi 51754f6654 Check if we actually have an initiating packet to free while processing responses 2012-05-23 11:50:12 +02:00
Martin Willi 17949695bf Cancel pending retransmits when flushing active task queue 2012-05-21 14:57:33 +02:00
Martin Willi 4ce92ef350 Cancel active quick mode task when receiving INFORMATIONAL error 2012-05-21 14:57:33 +02:00
Martin Willi 7ce504e182 Flush task queues explicitly, not implicitly if task returns ALREADY_DONE 2012-05-21 14:17:09 +02:00
Martin Willi cbc1a20ffe Wrap task managers flush_queue() in IKE_SA 2012-05-21 14:05:01 +02:00
Martin Willi a5c799602f Make task managers flush_queue() method public 2012-05-21 14:02:35 +02:00
Martin Willi 75d4e01c4a Enumerate correct list while removing nonce_gens, fix deregistration 2012-05-21 12:28:01 +02:00