denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
15,987 Commits 1 Branch 0 Tags
a146b4c9efa46c537d04b5089a54f10dc106e14a
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Tobias Brunner a146b4c9ef child-sa: Install outbound SA immediately if kernel supports SPIs on policies 2017-08-07 10:44:05 +02:00
Tobias Brunner 2c116ef589 child-sa: Use flags to track installation of outbound SA and policies separately 2017-08-07 10:44:05 +02:00
Tobias Brunner 2699c8387a kernel-netlink: Set SPI on outbound policy 
This should cause the right SA to get used if there are multiple outbound
SAs and the policies are installed properly.
 2017-08-07 10:44:05 +02:00
Tobias Brunner a46d233c0e kernel-interface: Not all kernel interfaces support SPIs on policies 2017-08-07 10:44:05 +02:00
Tobias Brunner 8f63a36b34 Merge branch 'appveyor' 
Build and run unit tests on AppVeyor Windows containers.
 2017-08-02 16:51:40 +02:00
Tobias Brunner 096626286a appveyor: Build against OpenSSL 
This is mainly for the RNG needed for the exchange tests.
 2017-07-28 11:23:23 +02:00
Tobias Brunner 95ecc11774 unit-tests: Double escape backslashes in Windows paths in settings test 
That's required when these are used as include paths in settings file
strings.
 2017-07-28 11:22:40 +02:00
Tobias Brunner 67ad553a2c unit-tests: Stringify direction in message asserts early 
x86_64-w64-mingw32-gcc on Windows requires this.
 2017-07-28 11:18:59 +02:00
Tobias Brunner 65064cc33b unit-tests: iv_gen_seq has a dependency on RNG_STRONG 
We currently don't have an RNG in Windows builds.
 2017-07-28 11:18:59 +02:00
Tobias Brunner 6eb7dd11ec appveyor: Run tests on AppVeyor Windows containers 
We can't enable leak detective as it is so slow then that we run into a
timeout (60 minutes).
 2017-07-28 11:18:17 +02:00
Tobias Brunner 8d4ebb3ac4 peer-cfg: Use an rwlock instead of a mutex to safely access child-cfgs 
If multiple threads want to enumerate child-cfgs and potentially lock
other locks (e.g. check out IKE_SAs) while doing so a deadlock could
be caused (as was the case with VICI configs with start_action=start).
It should also improve performance for roadwarrior connections and lots
of clients connecting concurrently.

Fixes #2374.
 2017-07-27 13:34:40 +02:00
Tobias Brunner 578d893b4a credential-manager: Log issuer identity if not found 2017-07-27 13:28:13 +02:00
Tobias Brunner 0b756fbe95 auth-cfg: Don't limit subjectAltName check to received certificates 
Otherwise this won't work if the certificate is only locally available.
 2017-07-27 13:27:19 +02:00
Tobias Brunner 4272a3e9d7 swanctl: Read default socket from swanctl.socket option 
Also read from swanctl.plugins.vici.socket so we get
libstrongswan.plugins.vici.socket if it is defined.

Fixes #2372.
 2017-07-27 13:22:57 +02:00
Tobias Brunner ae48325a59 swanctl: Include config snippets from conf.d subdirectory 
Fixes #2371.
 2017-07-27 13:20:24 +02:00
Tobias Brunner fb8c9b3d08 conf: Add support to generate include statements in .conf files 2017-07-27 13:19:38 +02:00
Tobias Brunner 67402ec77b curl: Enable following redirects 
The maximum number of redirects can be limited. The functionality can also
be disabled.

Fixes #2366.
 2017-07-27 13:15:43 +02:00
Tobias Brunner 791cfe82a1 ikev2: AES-CMAC-PRF-128 only uses the first 64 bits of each nonce 
References #2377.
 2017-07-27 13:09:26 +02:00
Tobias Brunner ed926a73df error-notify: Don't stop sending notifies after removing a disconnected listener 
This prevented new listeners from receiving notifies if they joined
after another listener disconnected previously, and if they themselves
disconnected their old connection would prevent them again from getting
notifies.
 2017-07-27 13:07:24 +02:00
Tobias Brunner 6138b8d629 farp: Only remove one tracked entry 
Multiple CHILD_SAs sharing the same traffic selectors (e.g. during
make-before-break reauthentication) also have the same reqid assigned.
If all matching entries are removed we could end up without entry even
though an SA exists that still uses these traffic selectors.

Fixes #2373.
 2017-07-27 13:07:23 +02:00
Tobias Brunner a0cde76958 ike: Trigger CHILD_INSTALLED state change after corresponding log message 
This way we get the log message in stroke and swanctl as last message
when establishing a connection. It's already like this for the IKE_SA
where IKE_ESTABLISHED is set after the corresponding log message.

Fixes #2364.
 2017-07-27 13:07:23 +02:00
Tobias Brunner 6b69a66379 swima-collector: Fix compile error if SWID_DIRECTORY is not defined 2017-07-24 11:34:39 +02:00
Tobias Brunner bf565b650c libimcv: Add missing files to Android.mk 2017-07-24 11:31:19 +02:00
Tobias Brunner 49917f0028 testing: Support running multiple tests with * as wildcard (e.g. ikev2/ocsp-*) 2017-07-07 09:23:14 +02:00
Tobias Brunner d7dc677ee5 x509: Correctly encode nonce in OCSP request 
The nonce value is encoded as OCTET STRING, however, the extension
values themselves must also be encoded as OCTET STRING.
 2017-07-07 08:57:14 +02:00
Tobias Brunner 93e0898f60 swanctl: Document eap_id in remote sections 2017-07-05 18:08:04 +02:00
Tobias Brunner fd0a7b4795 kernel-pfroute: Make sure there is a netmask when enumerating subnets 2017-07-05 10:21:25 +02:00
Tobias Brunner ef6b710f19 pki: Load pubkey plugin to print public keys 
Since 3317d0e77b the public keys are printed via certificate printer,
but that only works if the public key is actually wrapped, which
requires the pubkey plugin.

Fixes: 3317d0e77b ("Standardized printing of certificate information")
 2017-07-05 10:15:45 +02:00
Tobias Brunner 609457e4c8 pki: Fix typo in --print man page 2017-07-05 10:15:45 +02:00
Tobias Brunner 7aa30575d5 sql: Use qualified names in SQL query statements 
VIRTUAL is a new reserved keyword in MySQL 5.7.6 that caused some of these
queries to fail.

Fixes #2359.
 2017-07-05 10:13:39 +02:00
Tobias Brunner a3bcbb4c64 stroke: Don't load configs with invalid proposals 
References #2347.
 2017-07-05 10:08:36 +02:00
Tobias Brunner 5d580ae063 ikev1: Determine transform ID before mapping integrity algorithm ID 
Due to the lookup based on the mapped algorithm ID the resulting AH
proposals were invalid.

Fixes #2347.

Fixes: 8456d6f5a8 ("ikev1: Don't require AH mapping for integrity algorithm when generating proposal")
 2017-07-05 10:08:20 +02:00
Tobias Brunner 1aba82bfd7 eap-aka-3gpp: Add plugin that implements 3GPP MILENAGE algorithm in software 
This is similar to the eap-aka-3gpp2 plugin. K (optionally concatenated
with OPc) may be configured as binary EAP secret in ipsec.secrets or
swanctl.conf.

Based on a patch by Thomas Strangert.

Fixes #2326.
 2017-07-05 10:03:38 +02:00
Tobias Brunner 7004a59a4c utils: Make second argument to memxor() const 2017-07-05 10:02:05 +02:00
Tobias Brunner 909d7dca17 android: New release after fixing issues with older Android versions and DB upgrade 2017-07-04 11:55:04 +02:00
Tobias Brunner ccb6e9f1b0 android: Fix database update from older versions 2017-07-04 11:55:04 +02:00
Tobias Brunner a63b0f9982 android: Fix version string on older Android releases 
SECURITY_PATCH is apparently only available since Android 6.
 2017-07-04 11:54:57 +02:00
Tobias Brunner 480d56da5f android: New release after fixing crash with existing profiles 2017-07-03 13:44:49 +02:00
Tobias Brunner ebf369c483 android: Fix null pointer dereference with existing profiles 2017-07-03 13:43:53 +02:00
Tobias Brunner 64c2d3ca3e android: Only show disconnect button if actually connected 2017-07-03 12:11:30 +02:00
Tobias Brunner 1b1060821e android: New release after adding lots of new stuff 2017-07-03 10:47:43 +02:00
Tobias Brunner c0990c187b Merge branch '2309-android-disconnect-button' 
Adds a disconnect button to the permanent notification.

Fixes #2309.
 2017-07-03 10:40:37 +02:00
Tobias Brunner 6333a756ee android: Close activity when dialog is canceled if it was not visible before 
onPause/onResume() won't work because onPause() is called right before
onNewIntent().
 2017-07-03 10:39:26 +02:00
Tobias Brunner 1265b353d4 android: Allow disconnecting via MainActivity but display a confirmation dialog 2017-07-03 10:39:26 +02:00
Tobias Brunner d0ed8ee89e android: Add disconnect button to notification 2017-07-03 10:39:23 +02:00
Tobias Brunner aea901bbbe Merge branch 'android-certreq' 
This adds an option that allows disabling certificate requests during
IKE_AUTH.
 2017-07-03 10:37:21 +02:00
Tobias Brunner 8ae7f8b7a2 android: Make sending certificate requests configurable in the GUI 2017-07-03 10:37:09 +02:00
Tobias Brunner 11eb7e0898 android: Import the flag to suppress certificate requests 2017-07-03 10:37:09 +02:00
Tobias Brunner 3f0592d0fd android: Add flag to suppress sending certificate requests 2017-07-03 10:37:09 +02:00
Tobias Brunner 0204374e21 android: Add property for simple flags 2017-07-03 10:37:09 +02:00
Tobias Brunner 6f0888c872 Merge branch '2365-android-nat-keepalive' 
This makes the NAT-T keepalive interval configurable per connection.

Fixes #2365.
 2017-07-03 10:33:52 +02:00
Tobias Brunner aa4b6eda59 android: Import NAT-T keepalive interval 2017-07-03 10:33:29 +02:00
Tobias Brunner a2aa0ca0e4 android: Make NAT-T keepalive interval configurable in the GUI 2017-07-03 10:33:29 +02:00
Tobias Brunner db599d6b28 android: Use configured NAT-T keepalive interval 2017-07-03 10:33:29 +02:00
Tobias Brunner a28302317f android: Add property for NAT-T keepalive interval 2017-07-03 10:33:29 +02:00
Tobias Brunner 209a611530 Merge branch 'android-updates' 
This adds support for configuring split-tunneling and per-app VPN, adds
a simple HTTP/S fetcher and enables the revocation plugin, makes the log
view more efficient, imports profiles via SAF and changes multiple other
things.
 2017-07-03 10:32:35 +02:00
Tobias Brunner 0b075420df android: Use arrays as primary config option for subnets in profile files 2017-07-03 10:27:55 +02:00
Tobias Brunner 646260f464 android: Change format of address ranges and print sets 2017-07-03 10:27:55 +02:00
Tobias Brunner 291ef58c69 android: Make app handling and selection of apps configurable in profile editor 2017-07-03 10:27:54 +02:00
Tobias Brunner 3cc6a03fa0 android: Add simple activity for the selection of apps 2017-07-03 10:27:54 +02:00
Tobias Brunner eb59c6a38a android: Add list fragment for the selection of apps 2017-07-03 10:27:54 +02:00
Tobias Brunner 208e15c0ba android: Add filterable adapter for list of installed/selected apps 2017-07-03 10:27:54 +02:00
Tobias Brunner 238c3061b7 android: Add list item layout for installed/selected apps 2017-07-03 10:27:54 +02:00
Tobias Brunner 5561633fcd android: Add class that wraps ApplicationInfo for selected apps 2017-07-03 10:27:54 +02:00
Tobias Brunner cea8213f1b android: Handle checked state in activated background 2017-07-03 10:27:54 +02:00
Tobias Brunner 34496b787d android: Add text color for checkable list entries 2017-07-03 10:27:53 +02:00
Tobias Brunner 0974addf93 android: Add a linear layout that is checkable 2017-07-03 10:27:53 +02:00
Tobias Brunner 800f881ad0 android: Add convenience methods to get/set selected apps to/from a sorted set 2017-07-03 10:27:53 +02:00
Tobias Brunner d134ae21c2 android: Import selected/excluded apps from profile file 2017-07-03 10:27:53 +02:00
Tobias Brunner f2e7156d91 android: Apply selected apps according to config 
Either only the selected apps are able to access the VPN or they are
excluded from access to the VPN.
 2017-07-03 10:27:53 +02:00
Tobias Brunner 43b33f075a android: Add property for selected apps to VPN profiles 
A second property will control if only the selected apps have access to
the VPN or if the selected apps are excluded from the VPN, or if the
functionality is disabled.
 2017-07-03 10:27:53 +02:00
Tobias Brunner 05c5e894a9 android: Make custom subnets configurable in the GUI 2017-07-03 10:27:53 +02:00
Tobias Brunner 4a04bd3da5 android: Import custom subnets from profile file 2017-07-03 10:27:53 +02:00
Tobias Brunner 4471a93481 android: Use configured included subnets instead of negotiated TS 2017-07-03 10:27:52 +02:00
Tobias Brunner abf02a2176 android: Add ability to add a range set to another 2017-07-03 10:27:52 +02:00
Tobias Brunner a9875259e8 android: Add property for included subnets to VPN profiles 2017-07-03 10:27:52 +02:00
Tobias Brunner 1a63e8e44e android: Make excluded subnets configurable in the GUI 2017-07-03 10:27:52 +02:00
Tobias Brunner 70f7eb76d9 android: Import excluded subnets from profile file 2017-07-03 10:27:52 +02:00
Tobias Brunner 72b7c289ad android: Exclude configured subnets from the VPN 2017-07-03 10:27:52 +02:00
Tobias Brunner 1e26483167 android: Implement Iterable interface and addAll() for range set 2017-07-03 10:27:52 +02:00
Tobias Brunner 54714331e4 android: Add ability to remove a range set from another 2017-07-03 10:27:51 +02:00
Tobias Brunner 78b20efb29 android: Parse two addresses separated by - as range 2017-07-03 10:27:51 +02:00
Tobias Brunner 13ead876ad android: Add property for excluded subnets to VPN profiles 2017-07-03 10:27:51 +02:00
Tobias Brunner d852a02717 android: Add class to manage a set of IP address ranges/subnets 2017-07-03 10:27:51 +02:00
Tobias Brunner bcba14504a android: Add class to handle IP ranges and subnets 2017-07-03 10:27:51 +02:00
Tobias Brunner c5ba381757 android: Log some information about the Android version and the device 2017-07-03 10:27:51 +02:00
Tobias Brunner e5ec18009f android: Escape backslashes in settings values 
For usernames that use domain specifiers.
 2017-07-03 10:27:51 +02:00
Tobias Brunner 59693d6c56 android: Use a specific action to disconnect from the VPN 2017-07-03 10:27:50 +02:00
Tobias Brunner bef8bc3aac android: Try to load existing user cert when importing VPN profile 2017-07-03 10:27:50 +02:00
Tobias Brunner 36e8f43617 android: Enable revocation plugin 2017-07-03 10:27:50 +02:00
Tobias Brunner 7b4177578b android: Add a simple HTTP(S) fetcher for CRLs 2017-07-03 10:27:50 +02:00
Tobias Brunner ddd4d8b427 android: Use LOCAL_LDLIBS to link libdl 
Newer NDKs fail otherwise as there is no actual module anymore.
 2017-07-03 10:27:50 +02:00
Tobias Brunner 74d44e15dc android: Make log view more efficient 
This bunches several log messages together before posting Runnables.

Fixes #2148.
 2017-07-03 10:27:45 +02:00
Tobias Brunner 9c4607b454 android: Don't update state fragment if not attached to an Activity 
When the bound state service finally connects we might not actually be
attached to an Activity.
 2017-06-30 09:32:27 +02:00
Tobias Brunner b14507dd90 android: Make sure every listener at the VPN state service is only registered once 
We register when the service connects but also in onStart() (as we
unregister in onStop() to avoid updates when not shown).  So this could
theoretically cause the listener to get registered twice if the service
is connected before onStart() is called (it seems it usually isn't).
 2017-06-30 09:32:27 +02:00
Tobias Brunner 6766c85231 android: Add menu item to import VPN profile via Storage Access Framework 
This is useful in case the proper MIME type was not set for a downloaded
profile.
 2017-06-30 09:32:27 +02:00
Tobias Brunner edad60ea77 android: Add translation for Traditional Chinese 
Courtesy of Chris Chiang.
 2017-06-30 09:32:27 +02:00
Tobias Brunner 61098dd6a3 android: Move Simplified Chinese translation to values-zg-rCN folder 2017-06-30 09:32:26 +02:00
Tobias Brunner 451498b470 android: Update Gradle plugin and wrapper 2017-06-30 09:32:26 +02:00
Tobias Brunner 45f45fed1e configure: Install charon-systemd.conf 
Fixes #2370.
 2017-06-29 08:43:00 +02:00