denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
11,802 Commits 1 Branch 0 Tags
ae32172619a61a1c62b4b7638979bdbf81464e30
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Tobias Brunner a4b996c0bc libipsec: Properly initialize variables when creating AEAD wrapper 2013-09-04 16:18:29 +02:00
Tobias Brunner c742905f50 android: Fix compilation after PTS header files were moved 2013-09-04 16:18:29 +02:00
Tobias Brunner cd764f42b9 libpts: Android.mk updated 2013-09-04 16:18:29 +02:00
Tobias Brunner 0b47bb5377 pubkey_speed: Add missing plugins 
The pkcs1 plugin is required to test the gmp/gcrypt plugins. Likewise,
the pem plugin is required when testing the openssl plugin.

Fixes #401.
 2013-09-04 10:01:46 +02:00
Tobias Brunner f17322dccb pubkey_speed: sudo is not required 
Also, refer to pubkey_speed properly when not being called from the same
directory.
 2013-09-04 09:53:36 +02:00
Tobias Brunner f1d5d87619 pubkey_speed: Add header and fix usage 2013-09-04 09:53:36 +02:00
Tobias Brunner 5ee0747cfd autoconf: Split PACKAGE_VERSION in four parts 
The parts can be accessed with the variables:

	PACKAGE_VERSION_MAJOR
	PACKAGE_VERSION_MINOR
	PACKAGE_VERSION_BUILD
	PACKAGE_VERSION_REVIEW

The last part will be empty for regular releases.
 2013-09-02 11:30:24 +02:00
Tobias Brunner 10a69c32c2 conftest: Fix hook constructor resolution via dlsym() 
AM_CPPFLAGS only takes preprocessor flags like -I or -D, so it did not
forward -rdynamic to the linker (--export-dynamic), which meant that the
symbols defined in the executable itself were not resolvable via dlsym().

Fixes #394.
 2013-08-30 19:45:51 +02:00
Tobias Brunner 2a7a9471dd aes-test: Rename crypt() as it conflicts with a library function on Mac OS X 
unistd.h on Linux defines this only if _XOPEN_SOURCE is defined.
 2013-08-30 08:51:09 +02:00
Tobias Brunner 9455f8b386 aes-test: Support test vectors at the end of a file 2013-08-24 16:22:51 +02:00
Tobias Brunner 8972c72237 aes-test: Add script to test AES implementations according to AESAVS/GCMVS 2013-08-24 16:22:51 +02:00
Tobias Brunner f0c54e8c15 chunk: Print chunks without separator if + modifier is used 2013-08-24 16:22:51 +02:00
Tobias Brunner 32a145fdbd utils: Add case-insensitive version of strpfx() 2013-08-24 16:22:51 +02:00
Tobias Brunner d7ae0b254d kernel: Restore enumeration of all addresses when searching for address in TS 
Since f52cf07532 addresses on ignored, down or loopback interfaces were
not considered as valid addresses anymore when searching for an address
contained in the local traffic selector.  This meant that route
installation failed, for instance, if charon.install_virtual_ip_on was
set to 'lo', or, on gateways, if internal interfaces were ignored with
the charon.interfaces_* options.
 2013-08-21 17:01:03 +02:00
Tobias Brunner 85ca2f7441 conftest: Disable reset_seq hook on systems other than Linux 
Fixes #386.
 2013-08-21 11:27:28 +02:00
Tobias Brunner e001cc2b07 kernel-netlink: Fix calculation of ESN bitmap length 
While bmp_len stores the number of u_int32_t the allocated bitmap
actually consists of those integers.
 2013-08-21 08:28:12 +02:00
Tobias Brunner f853e7bcc0 ikev1: Fix calculation of the number of fragments 
The old code resulted in too few fragments in some cases.
 2013-08-15 15:15:34 +02:00
Tobias Brunner c81a6ff907 ikev1: When sending fragments, use ports to decide if a non-ESP marker is added 
This is same same logic used by sender and might apply in some cases (e.g.
when initiating to port 4500).
 2013-08-15 15:12:00 +02:00
Tobias Brunner e42ab08a73 ikev2: Fix segfault when reestablishing CHILD_SAs due to closeaction=restart|hold 
This regression was introduced with c949a4d5.
 2013-08-13 10:08:08 +02:00
Tobias Brunner 3f29ff82c3 libipsec: Don't limit traditional algorithms to AES and SHA1/2 
Closes #377.
 2013-08-12 12:21:57 +02:00
Tobias Brunner 11f468533f kernel-netlink,pfroute: Properly update address flag within ROAM_DELAY 
77d4a02 and 55da01f only updated the address flag when a job was created,
which obviously had the same limitation as the old code.

Fixes #374.
 2013-08-12 12:08:23 +02:00
Tobias Brunner 55da01f348 kernel-pfroute: Implement roam event handling like in the kernel-netlink plugin 
There was no proper locking and the issue regarding the address
flag also existed.
 2013-08-12 12:03:48 +02:00
Tobias Brunner 77d4a0281a kernel-netlink: Ensure address changes are not missed in roam events 
If multiple roam events are triggered within ROAM_DELAY, only one job is
created.  The old code set the address flag to the value of the last
triggering call.  So if a route change followed an address change within
ROAM_DELAY the address change was missed by the upper layers, e.g. causing
it not to update the list of addresses via MOBIKE.

The new code now keeps the state of the address flag until the job is
actually executed, which still has some issues.  For instance, if an
address disappears and reappears within ROAM_RELAY, the flag would not
have to be set to TRUE.  So address updates might occasionally get
triggered where none would actually be required.

Fixes #374.
 2013-08-12 12:02:55 +02:00
Tobias Brunner e99cfe5f20 strongswan.conf: Add note about reserved threads 2013-08-07 09:06:01 +02:00
Tobias Brunner 58e32e4871 tnc-pdp: Initialize struct msghdr properly when reading RADIUS messages 
Before this e.g. msg_controllen was not initialized properly which could
cause invalid reads.
 2013-07-31 22:16:58 +02:00
Tobias Brunner 3a938a6f85 NEWS: Add info about CVE-2013-5018 2013-07-31 22:16:58 +02:00
Tobias Brunner d12fc14616 whitelist: Fix compilation on FreeBSD 2013-07-31 22:16:58 +02:00
Tobias Brunner ed0efaef4c host: Properly initialize struct sockaddr_in[6] when parsing strings 
Otherwise struct members like sin6_flowinfo or sin6_scope_id might be
set to bogus values.
 2013-07-31 22:16:58 +02:00
Tobias Brunner b3393c88c1 asn1: Fix handling of invalid ASN.1 length in is_asn1() 
Fixes CVE-2013-5018.
 2013-07-31 22:16:58 +02:00
Tobias Brunner a566c5f837 receiver: Avoid cloning packet data when verifying COOKIE payloads 
Besides being more efficient this removes a memory leak that occurred
when a COOKIE payload was successfully verified.

Fixes #369.
 2013-07-29 22:04:24 +02:00
Tobias Brunner 1cf8022839 unity: Handle multi-valued UNITY_SPLIT_INCLUDE/UNITY_LOCAL_LAN attributes 
Cisco devices seem to add 6 bytes of padding between each address/mask
pair.

Fixes #366.
 2013-07-29 21:44:27 +02:00
Tobias Brunner 4dc8978000 ikev2: Only schedule half-open-timeout delete job after successfully handling IKE_SA_INIT 
We want to avoid this allocation if the initial message is invalid (e.g.
if the message ID is != 0).
 2013-07-29 11:25:43 +02:00
Tobias Brunner 77ccff82cf ikev1: Always send ID payloads (traffic selectors) during Quick Mode 
Especially Windows 7 has problems if the peer does not send ID payloads
for host-to-host connections (tunnel and transport mode).

Fixes #319.
 2013-07-25 17:08:17 +02:00
Tobias Brunner 1f2d9c7688 watcher: Made notify array initialization compatible with older GCC versions 2013-07-25 16:57:42 +02:00
Tobias Brunner ebb4ad1baa unit-tests: Add additional tests for host_t 2013-07-25 11:28:26 +02:00
Tobias Brunner 7a192c57a3 imv-attestation: Properly measure complete directories 2013-07-25 11:28:26 +02:00
Tobias Brunner 116363e5c6 array: Number of items in get_size() is unsigned 
Otherwise, array->esize is promoted to int and if array->esize * num
results in a value > 0x7fffffff the return value would be incorrect due
the implicit sign extension when getting cast to size_t.
 2013-07-25 11:28:01 +02:00
Tobias Brunner d7dc4fedd1 stream: Ensure UNIX socket path is null terminated 2013-07-24 16:17:23 +02:00
Tobias Brunner e7d717cf01 kernel-pfkey: Add sanity check when deleting policies 2013-07-24 16:17:22 +02:00
Tobias Brunner e5455e9413 imv-os: check_packages() fails if product query fails 2013-07-24 16:17:22 +02:00
Tobias Brunner cfca183d55 pkcs5: Add missing break statements when checking crypto primitives 2013-07-24 16:17:22 +02:00
Tobias Brunner 346a4a1fc2 imv-scanner: Properly check snprintf() return value 2013-07-24 16:17:22 +02:00
Tobias Brunner 16748bdff7 socket-dynamic: Properly initialize IPv6 address 2013-07-24 16:17:22 +02:00
Tobias Brunner 5baec6448d unit-tests: Add test for host_create_netmask() 2013-07-24 16:17:21 +02:00
Tobias Brunner 6e2ec33f9d host: Prevent overflow in host_create_netmask() if mask is 0 or 32/128 2013-07-24 16:17:03 +02:00
Tobias Brunner a00ac1d9ee imv-attestation: Use proper cast for length when using %.*s 2013-07-24 10:54:47 +02:00
Tobias Brunner 0c76d820dc tnc-ifmap: Use proper cast for length when using %.*s 2013-07-24 10:54:47 +02:00
Tobias Brunner cfdd23b967 capabilities: Proper error handling when reading groups 2013-07-24 10:54:26 +02:00
Tobias Brunner 3021139f6f strongswan.conf: Moved some stuff around 2013-07-23 12:23:05 +02:00
Tobias Brunner 5b1e3d3fdc ipsec: Add --piddir to retrieve the PID/socket directory 2013-07-22 18:12:04 +02:00
Tobias Brunner 517823b466 starter: Properly refer to the ipsec script if it was renamed 2013-07-22 18:00:19 +02:00
Tobias Brunner 62293ed271 coupling: Fix call to call_hook() 2013-07-22 17:53:56 +02:00
Tobias Brunner 2ed8b36a8a strongswan.conf: Add missing options 2013-07-22 17:46:41 +02:00
Tobias Brunner 146fa8b2d3 charon-xpc: Use correct namespace when setting default settings 2013-07-22 17:44:37 +02:00
Tobias Brunner a14d907e33 tnc-pdp: Fix reading port setting from strongswan.conf 2013-07-22 17:43:54 +02:00
Tobias Brunner 82b1a38601 tkm: Properly refer to includes now that AM_CPPFLAGS is used 2013-07-19 09:02:04 +02:00
Tobias Brunner 8f1b44b40c keychain: Use AM_CPPFLAGS instead of INCLUDES 2013-07-19 09:01:39 +02:00
Tobias Brunner 0ceb288815 Fix various API doc issues and typos 
Partially based on an old patch by Adrian-Ken Rueegsegger.
 2013-07-18 18:30:36 +02:00
Tobias Brunner e5b5a66712 kernel-pfkey: Fail route installation if remote TS matches peer 2013-07-18 15:41:36 +02:00
Tobias Brunner 29bdfb4086 kernel-libipsec: Fail route installation if remote TS matches peer 2013-07-18 15:41:13 +02:00
Tobias Brunner dfc9902013 capabilities: Some plugins don't actually require capabilities at runtime 2013-07-18 15:25:35 +02:00
Tobias Brunner 027676f750 capabilities: Add function to check if a capability is held, without keeping it 
This can be useful if capabilities are not required anymore after
dropping privileges.
 2013-07-18 15:25:35 +02:00
Tobias Brunner 07a9d5c91a ike: Fix reestablishing SAs if no child-creating tasks are queued 2013-07-18 10:40:08 +02:00
Tobias Brunner 79b6ead1e4 unity: Replicate default behavior if no UNITY_SPLIT_INCLUDE attributes were received 2013-07-17 18:23:57 +02:00
Tobias Brunner 56b0fac8c9 unity: Allow UNITY_LOCAL_LAN to be longer than 8 bytes 2013-07-17 18:23:57 +02:00
Tobias Brunner c7d0b80abb unity: Fix memory leak in provider 2013-07-17 18:23:57 +02:00
Tobias Brunner b2dfa0624d ipsec.conf.5: closeaction is now supported for IKEv1 2013-07-17 18:18:57 +02:00
Tobias Brunner a9ffb48f21 ikev1: Reestablish IKE_SA/CHILD_SAs if it gets deleted by the peer 
We call ike_sa_t.reestablish() so the IKE_SA is only recreated if any
CHILD_SA requires it.
 2013-07-17 18:16:59 +02:00
Tobias Brunner 68db844f99 ike: Migrate queued CHILD_SA-creating tasks when reestablishing an IKE_SA 2013-07-17 18:16:58 +02:00
Tobias Brunner 6b99e4b7e0 Merge branch 'kernel-pfroute-mobility' 
This improves the behavior of the kernel-pfroute plugin (and sometimes
the kernel-pfkey plugin) in case of mobility, mostly when used as as
client but also as gateway, if clients are mobile.
 2013-07-17 17:49:26 +02:00
Tobias Brunner fae4d67adc kernel-pfroute: Ignore IP address changes if address is %any 2013-07-17 17:45:18 +02:00
Tobias Brunner b308a97944 kernel-pfroute: Properly enumerate sockaddrs in interface messages 
The ifa_msghdr and rt_msghdr structs are not compatible (at least not on
FreeBSD).
 2013-07-17 17:45:18 +02:00
Tobias Brunner 5310f485d9 kernel-pfroute: Provide name of interfaces on which virtual IPs are installed 2013-07-17 17:45:18 +02:00
Tobias Brunner e9c1ca0278 kernel-pfroute: Ignore virtual IPs in address map 
As the virtual flag is set after the address has been added to the map,
we make sure we ignore virtual IPs when doing lookups.
 2013-07-17 17:45:18 +02:00
Tobias Brunner cb082d15ef kernel-pfroute: Make sure source addresses are not virtual and usable 
It seems we sometimes get the virtual IP as source (with
rightsubnet=0.0.0.0/0) even if the exclude route is already
installed.  Might be a timing issue because shortly afterwards the
lookup seems to succeed.
 2013-07-17 17:45:18 +02:00
Tobias Brunner 527663d6b6 kernel-pfroute: Don't report an error when trying to reinstall a route 2013-07-17 17:45:18 +02:00
Tobias Brunner 8afd0f05e3 kernel-pfkey: Provide interface name when installing exclude route 2013-07-17 17:45:18 +02:00
Tobias Brunner 0745f846d0 kernel-pfroute: Reinstall routes on interface/address changes 2013-07-17 17:45:17 +02:00
Tobias Brunner 7b9c3fb41f kernel-pfroute: Trigger a roam event if a new interface appears 2013-07-17 17:45:17 +02:00
Tobias Brunner e50b20539b kernel-pfroute: Use ref_get() to allocate sequence numbers 2013-07-17 17:45:17 +02:00
Tobias Brunner baa6419ec1 kernel-pfroute: Make time that is waited for VIPs to appear configurable 
One second might be too short for IPs to appear/disappear, especially on
virtualized hosts.
 2013-07-17 17:45:17 +02:00
Tobias Brunner dc8b083d9f kernel-pfroute: Retry route lookup without source address on failure 
The known source address might be gone resulting in an error, making
learning a new source address impossible.
 2013-07-17 17:45:17 +02:00
Tobias Brunner bbd9df25a9 kernel-pfkey: Remove latest IPsec SA mapping when deleting a policy 
If IPsec SAs are rekeyed due to an address change (e.g. because
update_sa is not supported) the exact same policy with the same reqid
will be installed, but with different addresses.  After the rekeying the
old SA and its policies are removed, using the first matching mapping
breaks the mapping between the policies and the new SA (at least on
FreeBSD, the Linux kernel might only use the reqid for this).  Using the
oldest matching SA is still an approximation but it solves the above
issue.
 2013-07-17 17:45:17 +02:00
Tobias Brunner a9f14ada34 kernel-pfkey: Correctly handle IPSEC_PROTO_ANY in an acquire 2013-07-17 17:45:17 +02:00
Tobias Brunner 84693a3d79 linked-list: Remove barely used has_more() method 
This required some refactoring when handling encrypted payloads.

Also changed log messages so that "encrypted payload" is logged instead
of "encryption payload" (even if we internally still call it that) as
that's the name used in RFC 5996.
 2013-07-17 17:42:53 +02:00
Tobias Brunner 1a9528f916 linked-list: Don't require an argument for the item when enumerating 2013-07-17 17:42:53 +02:00
Tobias Brunner cf4172637a linked-list: Remove unused clone_function() method 2013-07-17 17:42:53 +02:00
Tobias Brunner 0f3ddbd189 linked-list: Remove barely used find_last() method 2013-07-17 17:42:53 +02:00
Tobias Brunner be3c09d020 linked-list: Remove unused replace() method 
Its functionality can be replicated by calling insert_before() followed
by remove_at().  Not the other way around, though, because remove_at()
changes the enumerator position.
 2013-07-17 17:42:53 +02:00
Tobias Brunner f067348134 kernel-libipsec: Log error if no local address is found when installing routes 2013-07-15 14:37:31 +02:00
Tobias Brunner 1ee1163214 dumm: Sort templates by name 2013-07-15 14:37:05 +02:00
Tobias Brunner 9e7a45bec2 testing: Don't load certificates explicitly and delete CA certificates in PKCS#12 scenarios 
Certificates are now properly extracted from PKCS#12 files.
 2013-07-15 11:27:07 +02:00
Tobias Brunner 591f923134 stroke: Add certificates extracted from PKCS#12 files to correct credential set 
Only keys and shared secrets are moved from the temporary credential set after
loading all secrets.
 2013-07-15 10:59:13 +02:00
Tobias Brunner e0b868f79e pkcs12: Add plugin dependencies with soft dependencies on the most common algorithms 2013-07-15 10:48:19 +02:00
Tobias Brunner b23bd71466 android: New release after adding support for EAP-TNC 
Also disabled listening on IPv6 because the Linux kernel currently does
not support UDP encapsulation for IPv6.
 2013-07-08 18:51:07 +02:00
Tobias Brunner f32eb48e9a Merge branch 'android-byod' 
Adds support for EAP-TNC with a custom Android-specific IMC that
collects data such as installed packages, file hashes or system
settings.

Some parts of the implementation are based on the bachelor semester
project 'strongSwan Android 4 Client with Endpoint Assessment' by
Christoph Bühler and Patrick Lötscher.
 2013-07-08 18:50:09 +02:00
Tobias Brunner 7ccf02ee93 android: Properly handle dotted-quad notation of IPv6 addresses 
For nestat output like ::ffff:127.0.0.1:9876 we shall not treat 127 as
port but 9876 instead.
 2013-07-08 18:49:30 +02:00
Tobias Brunner 97f1dfb3ec android: Allow IMC state to be dismissed with a swipe gesture 2013-07-08 18:49:30 +02:00
Tobias Brunner a9f94d7efb android: Use explicit locale when converting settings names 
Apparently, these functions use the user's default locale which might not
yield the expected result (e.g. lowercase I is not i in the Turkish
locale but ı instead).
 2013-07-08 18:49:30 +02:00
Tobias Brunner e1a98e7956 android: Add information about transmitted data if EAP-TNC is selected 2013-07-08 18:49:30 +02:00