denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
15,415 Commits 1 Branch 0 Tags
a6dc7bf287c0d6bd792cc2fb2ca91d2fdc9448db
Commit Graph
15415 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Martin Willi 7394ad92ae thread: Remove unneeded thread startup synchronization 
sem_init() is deprecated on OS X, and it actually fails with ENOSYS. Using our
wrapped semaphore object is not an option, as it relies on the thread cleanup
that we can't rely on at this stage.

It is unclear why startup synchronization is required, as we can allocate the
thread ID just before creating the pthread. There is a chance that we allocate
a thread ID for a thread that fails to create, but the risk and consequences
are negligible.
 2015-04-13 14:50:45 +02:00
Martin Willi 101d67440f libsimaka: Link against Winsock2 on Windows 
The library makes use of htons/ntohs().
 2015-04-13 09:31:28 +02:00
Martin Willi 280f752c56 fips-prf: Remove superfluous <arpa/inet.h> include 
As we make no use of htonl() and friends, this is unneeded, but actually
prevents a Windows build.
 2015-04-13 09:31:28 +02:00
Martin Willi dad99b5eea kernel-netlink: Fix GCC error about uninitialized variable use 
get_replay_state() always returns a replay_state_len when returning a
replay state, but GCC doesn't know about that.
 2015-04-08 11:13:04 +02:00
Martin Willi 12def59617 asn1: Undefine TIME_UTC, which is used by C11 
When building with C11 support, TIME_UTC is used for timespec_get() and
defined in <time.h>. Undefine TIME_UTC for our own internal use in asn1.c.
 2015-04-08 08:47:31 +02:00
Andreas Steffen ff96400d13 Wipe auxiliary key store 2015-03-28 10:44:23 +01:00
Martin Willi 9310d4250a crypto-tester: Explicitly exclude FIPS-PRF from append mode tests 
This was implicitly done by the seed length check before 58dda5d6, but we
now require an explicit check to avoid that unsupported use.
 2015-03-28 08:38:52 +01:00
Martin Willi b234fdfce8 fips-prf: Fail when trying to use append mode on FIPS-PRF 
Append mode hardly makes sense for the special stateful FIPS-PRF, which is
different to other PRFs.
 2015-03-28 08:36:35 +01:00
Andreas Steffen b07fb365ef Added PB-TNC test options to strongswan.conf man page 2015-03-27 21:05:00 +01:00
Andreas Steffen 883c11caa0 Added tnc/tnccs-20-fail-init and tnc/tnccs-20-fail-resp scenarios 2015-03-27 20:56:44 +01:00
Andreas Steffen ef5f96366e Version bump to 5.3.0 2015-03-27 20:56:44 +01:00
Andreas Steffen 619e0b4235 Fixed PB-TNC error handling 2015-03-27 20:56:44 +01:00
Andreas Steffen 193e057509 Added configurations for 3.18 and 3.19 KMV guest kernels 2015-03-27 20:56:44 +01:00
Andreas Steffen 8b36323b8c Fixed strongswan.conf man page entry of imc-attestation 2015-03-27 20:56:44 +01:00
Andreas Steffen 85aa509e84 Added tnc/tnccs-20-pt-tls scenario 2015-03-27 20:56:43 +01:00
Martin Willi bc1876bc9a cmac: Reset state before doing set_key() 2015-03-27 16:07:53 +01:00
Martin Willi 4075e9d7a4 af-alg: Reset hmac/xcbc state before doing set_key() 2015-03-27 16:06:21 +01:00
Martin Willi eedd92b53b xcbc: Reset XCBC state in set_key() 
If some partial data has been appended, a truncated key gets invalid if it
is calculated from the pending state.
 2015-03-27 15:53:52 +01:00
Martin Willi bfb029c82a hmac: Reset the underlying hasher before doing set_key() with longer keys 
The user might have done a non-complete append, having some state in the
hasher.

Fixes #909.
 2015-03-27 15:53:50 +01:00
Martin Willi 58dda5d6ab crypto-tester: Test set_key() after a doing a partial append on prf/signers 
While that use is uncommon in real-world use, nonetheless should HMAC set a
correct key and reset any underlying hasher.
 2015-03-27 15:53:47 +01:00
Tobias Brunner c063b9cfe9 stroke: Properly parse bliss key strength in public key constraint 2015-03-25 13:27:15 +01:00
Tobias Brunner 328db935bb eap-tnc: Free eap-tnc object if IKE_SA not found to get IPs 2015-03-25 13:24:37 +01:00
Tobias Brunner 97c7dc6d14 tnccs-20: Fix error handling in build() 2015-03-25 13:23:14 +01:00
Tobias Brunner f4c37166f9 android: Add messages/ita directory to tnccs-20 plugin 2015-03-25 12:00:20 +01:00
Tobias Brunner 48bae7b2ba android: Sync libstrongswan Makefile.am and Android.mk 2015-03-25 12:00:20 +01:00
Tobias Brunner 4a5d958bc5 libtnccs: Set apidoc category to libtnccs and move plugins 2015-03-25 12:00:20 +01:00
Tobias Brunner 48087e0944 libtnccs: Fix apidoc category for split IF-TNCCS 2.0 header files 
Fixes 80322d2cee ("Split IF-TNCCS 2.0 protocol processing into
separate TNC client and server handlers").
 2015-03-25 12:00:20 +01:00
Tobias Brunner a2ec3b0546 Fixed some typos, courtesy of codespell 2015-03-25 12:00:20 +01:00
Tobias Brunner a3c2edb19c kernel-netlink: Copy current usage stats to new SA in update_sa() 
This is needed to fix usage stats sent via RADIUS Accounting if clients
use MOBIKE or e.g. the kernel notifies us about a changed NAT mapping.
The upper layers won't expect the stats to get reset if only the IPs have
changed (and some kernel interface might actually allow such updates
without reset).

It also fixes traffic based lifetimes in such situations.

Fixes #799.
 2015-03-25 12:00:20 +01:00
Tobias Brunner 70728eb1b6 child-sa: Add a new state to track rekeyed IKEv1 CHILD_SAs 
This is needed to handle DELETEs properly, which was previously done via
CHILD_REKEYING, which we don't use anymore since 5c6a62ceb6 as it prevents
reauthentication.
 2015-03-25 12:00:20 +01:00
Martin Willi 66147ef670 ikev1: Inverse check when applying received KE value during Quick Mode 
Fixes Quick Mode negotiation when PFS is in use.
 2015-03-24 09:37:38 +01:00
Andreas Steffen cf9befcba4 Version bump to 5.3.0rc1 2015-03-23 23:15:31 +01:00
Andreas Steffen be04f90815 testing: added tnc/tnccs-20-mutual scenario 2015-03-23 23:01:13 +01:00
Andreas Steffen 7b4a96b2f7 Implemented PB-TNC mutual half-duplex protocol 2015-03-23 22:25:43 +01:00
Andreas Steffen c6aed8aa21 Optionally announce PB-TNC mutual protocol capability 2015-03-23 22:25:43 +01:00
Andreas Steffen 80322d2cee Split IF-TNCCS 2.0 protocol processing into separate TNC client and server handlers 2015-03-23 22:25:42 +01:00
Martin Willi e64ddb5daf Merge branch 'dh-checks' 
Extend the diffie-hellman interface by success return values, and do some
basic length checks for DH public values.
 2015-03-23 18:24:39 +01:00
Martin Willi 41fc94c924 encoding: Remove DH public value verification from KE payload 
This commit reverts 84738b1a and 2ed5f569.

As we have no DH group available in the KE payload for IKEv1, the verification
can't work in that stage. Instead, we now verify DH groups in the DH backends,
which works for any IKE version or any other purpose.
 2015-03-23 17:54:03 +01:00
Martin Willi 0356089d0f diffie-hellman: Verify public DH values in backends 2015-03-23 17:54:03 +01:00
Martin Willi a777155ffe diffie-hellman: Add a bool return value to set_other_public_value() 2015-03-23 17:54:03 +01:00
Martin Willi 42431690e0 diffie-hellman: Add a bool return value to get_my_public_value() 2015-03-23 17:54:03 +01:00
Martin Willi 8a7dbf3c2a libimcv: Allow pts_t.set_peer_public_value() to fail 2015-03-23 17:54:02 +01:00
Martin Willi 83cda57e2d libimcv: Allow pts_t.get_my_public_value() to fail 2015-03-23 17:54:02 +01:00
Martin Willi 520d58e010 encoding: Allow ke_payload_create_from_diffie_hellman() to fail 2015-03-23 17:54:02 +01:00
Martin Willi bace1d6479 diffie-hellman: Use bool instead of status_t as get_shared_secret() return value 
While such a change is not unproblematic, keeping status_t makes the API
inconsistent once we introduce return values for the public value operations.
 2015-03-23 17:54:02 +01:00
Martin Willi 4909612c3b load-tester: Migrate NULL DH implementation to INIT/METHOD macros 2015-03-23 17:54:02 +01:00
Tobias Brunner a7172ddaff ikev1: Make sure SPIs in an IKEv1 DELETE payload match the current SA 
OpenBSD's isakmpd uses the latest ISAKMP SA to delete other expired SAs.
This caused strongSwan to delete e.g. a rekeyed SA even though isakmpd
meant to delete the old one.

What isakmpd does might not be standard compliant. As RFC 2408 puts
it:

  Deletion which is concerned with an ISAKMP SA will contain a
  Protocol-Id of ISAKMP and the SPIs are the initiator and responder
  cookies from the ISAKMP Header.

This could either be interpreted as "copy the SPIs from the ISAKMP
header of the current message to the DELETE payload" (which is what
strongSwan assumed, and the direction IKEv2 took it, by not sending SPIs
for IKE), or as clarification that ISAKMP "cookies" are actually the
SPIs meant to be put in the payload (but that any ISAKMP SA may be
deleted).
 2015-03-23 17:23:57 +01:00
Tobias Brunner 8a0cc3f362 encoding: Add getter for IKE SPIs in IKEv1 DELETE payloads 2015-03-23 17:23:57 +01:00
Tobias Brunner 2872f77829 pki: Choose default digest based on the signature key 2015-03-23 17:22:31 +01:00
Tobias Brunner ae0604f583 pki: Use SHA-256 as default for signatures 
Since the BLISS private key supports this we don't do any special
handling anymore (if the user choses a digest that is not supported,
signing will simply fail later because no signature scheme will be found).
 2015-03-23 17:22:31 +01:00