denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
12,084 Commits 1 Branch 0 Tags
b942528419a36280f7172e60ea3183b418a41aa5
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Tobias Brunner c49c3f3208 ikev2: Properly free DH secret in case of errors during IKE key derivation 
Fixes #437.
 2013-11-06 10:24:19 +01:00
Tobias Brunner 19046552b6 ipsec: Updated ipsec(8) 2013-10-29 17:22:45 +01:00
Tobias Brunner 71687f4fad ipsec: Remove unused distro.txt 2013-10-29 16:34:10 +01:00
Tobias Brunner 5ac29360fc utils: Include stdio.h for fmemopen() replacement 
This might now be required because Vstr is not necessarily required
anymore, which means stdio.h might not be pulled in by prinf_hook.h.
 2013-10-29 16:18:35 +01:00
Tobias Brunner 60ddf6284f Use exact mask when calling umask(2) 
Due to the previous negation the high bits of the mask were set, which
at least some versions of the Android build system prevent with a compile-time
check.
 2013-10-29 16:01:55 +01:00
Tobias Brunner 348b9d82b4 libtnccs: Add dummy entry to pb_tnc_tcg_msg_infos 
That's required because the first message type in pb_tnc_tcg_msg_type_t
is 1 not 0.
 2013-10-29 13:36:15 +01:00
Tobias Brunner 751670a93b swid: Properly clean up after reading SWID tag 2013-10-29 13:18:05 +01:00
Tobias Brunner bb49dfb02e man: strongswan.conf(5) updated 2013-10-29 11:45:25 +01:00
Tobias Brunner 1dd58b0e21 Fixed some typos 2013-10-29 11:44:23 +01:00
Tobias Brunner 71c9565a3a pki: Replace BUILD_FROM_FD with passing a chunk via BUILD_BLOB 
This allows more than one builder to try parsing the data read from STDIN.
 2013-10-23 17:20:39 +02:00
Tobias Brunner 46cded2627 chunk: Add helper function to create a chunk from data read from a file descriptor 2013-10-23 17:20:39 +02:00
Tobias Brunner 8e8e97d10d kernel-netlink: Check existence of linux/fib_rules.h, don't include it in distribution 
This reverts commit b0761f1f0a.
 2013-10-18 09:52:54 +02:00
Tobias Brunner 3ea7165a27 Merge branch 'icmp' 
Improves handling of ICMP[v6] traffic selectors that specify message type and
code.

Fixes #421.
 2013-10-17 16:59:07 +02:00
Tobias Brunner 6956061197 ipsec.conf.5: Note about ICMP[v6] message type/code added 2013-10-17 16:57:39 +02:00
Tobias Brunner 4c185d11ad updown: Properly configure ICMP[v6] message type and code in firewall rules 2013-10-17 16:57:39 +02:00
Tobias Brunner 9739a0bf67 updown: Pass ICMP[v6] message type and code to updown script 
The type is passed in $PLUTO_MY_PORT and the code in $PLUTO_PEER_PORT.
 2013-10-17 16:57:39 +02:00
Tobias Brunner 59213396fa kernel-pfkey: Install ICMP[v6] type/code as expected by the Linux kernel 2013-10-17 16:57:39 +02:00
Tobias Brunner 406a504ca7 kernel-netlink: Convert ports in acquires to ICMP[v6] type and code 2013-10-17 16:57:39 +02:00
Tobias Brunner ddc2d3c8e4 kernel-netlink: Properly install policies with ICMP[v6] types and codes 2013-10-17 16:57:39 +02:00
Tobias Brunner 000235f1c5 traffic-selector: Print ICMP[v6] message type and code in a more readable way 2013-10-17 16:57:39 +02:00
Tobias Brunner 4bebe45abb traffic-selector: Store ICMP[v6] message type and code properly 
We now store them as defined in RFC 4301, section 4.4.1.1.
 2013-10-17 16:57:39 +02:00
Tobias Brunner d6a1960d34 traffic-selector: Move class to its own Doxygen group 2013-10-17 16:57:38 +02:00
Tobias Brunner 5eb802ab18 Merge branch 'ecc-brainpool' 
Adds support for ECC Brainpool curves for DH exchanges.
 2013-10-17 16:56:31 +02:00
Tobias Brunner 7313499914 proposal: Add ECC Brainpool DH groups to the default proposal 2013-10-17 13:36:09 +02:00
Tobias Brunner 606aae3aa1 openssl: Add workaround if ECC Brainpool curves are not defined 2013-10-17 13:36:08 +02:00
Tobias Brunner 3c29d2822f openssl: Add support for ECC Brainpool curves for DH, if defined by OpenSSL 
OpenSSL does not include them in releases before 1.0.2.
 2013-10-17 13:36:08 +02:00
Tobias Brunner be97277bdb unit-tests: Make test for bio_writer_t more portable 2013-10-17 11:44:03 +02:00
Tobias Brunner f6cadb7f54 libipsec: Don't print ciphertext with ICV in log message 2013-10-17 11:43:58 +02:00
Tobias Brunner f5c5fd6f74 libipsec: Properly calculate padding length especially for AES-GCM 2013-10-17 11:42:45 +02:00
Tobias Brunner 812ae898bf utils: Add utility function to calculate padding length 2013-10-17 10:25:34 +02:00
Tobias Brunner 32fef0c6e9 stroke: Reuse reqids of established CHILD_SAs when routing connections 2013-10-17 10:23:32 +02:00
Tobias Brunner 6278e64230 trap-manager: Make sure a config is not trapped twice 2013-10-17 10:23:32 +02:00
Tobias Brunner dd438ee22c Doxygen fixes 2013-10-15 11:25:55 +02:00
Tobias Brunner d14ba7e7fd testing: Add libipsec/host2host-cert scenario 2013-10-11 18:04:48 +02:00
Tobias Brunner d9020264f4 checksum: The pool utility was moved to its own directory 2013-10-11 17:42:29 +02:00
Tobias Brunner 0f6f7ba22c ccm: Add missing comma in get_iv_gen method signature 2013-10-11 17:42:25 +02:00
Tobias Brunner bfeb8b5c47 iv-gen: Add missing header files to Makefile.am 2013-10-11 17:42:05 +02:00
Tobias Brunner 1c1ba803ac NEWS: Updates for the recent merges 2013-10-11 16:20:41 +02:00
Tobias Brunner 5ef630189a Merge branch 'iv-gen' 
Modularizes the generation of initialization vectors, which allows to use
different methods depending on the algorithms.  For instance for AES-GCM
sequential IVs are now used instead of the earlier random IVs, which are
still used for other algorithms e.g. AES-CBC.
 2013-10-11 15:55:49 +02:00
Tobias Brunner 0c6f6c4e34 iv_gen: Mask sequential IVs with a random salt 
This makes it harder to attack a HA setup, even if the sequence numbers were
not fully in sync.
 2013-10-11 15:55:40 +02:00
Tobias Brunner e8229ad558 iv_gen: Provide external sequence number (IKE, ESP) 
This prevents duplicate sequential IVs in case of a HA failover.
 2013-10-11 15:55:40 +02:00
Tobias Brunner d74c254dfd ipsec: Use IV generator to encrypt ESP messages 2013-10-11 15:55:40 +02:00
Tobias Brunner b5010707a0 ikev2: Use IV generator to encrypt encrypted payload 2013-10-11 15:55:40 +02:00
Tobias Brunner 50bd28d549 iv_gen: aead_t implementations provide an IV generator 2013-10-11 15:55:40 +02:00
Tobias Brunner b3e1eb2afe iv_gen: Add IV generator that allocates IVs sequentially 2013-10-11 15:55:40 +02:00
Tobias Brunner 53d1f2dbfd iv_gen: Add IV generator that allocates IVs randomly 
Uses RNG_WEAK as the code currently does elsewhere to allocate IVs.
 2013-10-11 15:55:40 +02:00
Tobias Brunner 403057aa5a crypto: Add generic interface for IV generators 2013-10-11 15:55:40 +02:00
Tobias Brunner b38f7f703b apidoc: Move mac_prf to prf Doxygen group 2013-10-11 15:55:40 +02:00
Tobias Brunner af22622a9d Merge branch 'radius-unity' 
Adds support for Cisco Unity specific RADIUS attributes.

References #383.
 2013-10-11 15:52:36 +02:00
Tobias Brunner feb3c4ff22 eap-radius: Forward RAT_FRAMED_IP_NETMASK as INTERNAL_IP4_NETMASK 2013-10-11 15:52:22 +02:00
Tobias Brunner 1a809e46f8 eap-radius: Forward UNITY_SPLIT_INCLUDE or UNITY_LOCAL_LAN attributes 
Depending on the value of the CVPN3000-IPSec-Split-Tunneling-Policy(55)
radius attribute, the subnets in the CVPN3000-IPSec-Split-Tunnel-List(27)
attribute are sent in either a UNITY_SPLIT_INCLUDE (if the value is 1)
or a UNITY_LOCAL_LAN (if the value is 2).

So if the following attributes would be configured for a RADIUS user

  CVPN3000-IPSec-Split-Tunnel-List := "10.0.1.0/255.255.255.0,10.0.2.0/255.255.255.0"
  CVPN3000-IPSec-Split-Tunneling-Policy := 1

A UNITY_SPLIT_INCLUDE configuration payload containing these two subnets
would be sent to the client during the ModeCfg exchange.
 2013-10-11 15:52:22 +02:00
Tobias Brunner 66229619cf eap-radius: Forward UNITY_DEF_DOMAIN and UNITY_SPLITDNS_NAME attributes 
The contents of the CVPN3000-IPSec-Default-Domain(28) and
CVPN3000-IPSec-Split-DNS-Names(29) radius attributes are forwarded in
the corresponding Unity configuration attributes.
 2013-10-11 15:52:22 +02:00
Tobias Brunner 121c64f0d5 Merge branch 'dnscert' 
The new dnscert plugin adds support for authentication via CERT resource
records that are protected with DNSSEC.
 2013-10-11 15:49:24 +02:00
Tobias Brunner ca28e13fe8 testing: Add ikev2/net2net-dnscert scenario 2013-10-11 15:45:42 +02:00
Tobias Brunner a4d6a5a359 testing: Provide moon's and sun's certificate as CERT RR 2013-10-11 15:45:42 +02:00
Tobias Brunner 99a89ea7f4 testing: Enable dnscert plugin 2013-10-11 15:45:42 +02:00
Tobias Brunner 42525d1142 testing: Load testing.conf.local from the same directory as testing.conf 2013-10-11 15:45:42 +02:00
Tobias Brunner 8ac54970f5 ipseckey: Properly handle failure to create a certificate 
Also, try the next key (if available) if parsing an IPSECKEY failed.
 2013-10-11 15:45:41 +02:00
Tobias Brunner e8130a9498 ipseckey: Refactor creation of certificate enumerator 
Reduces nesting and fixes a memory leak (rrsig_enum).
 2013-10-11 15:45:41 +02:00
Tobias Brunner de5ea570f1 ipseckey: Depend on plugin features to create public key and certificate objects 2013-10-11 15:45:41 +02:00
Tobias Brunner 6ecf1aab35 unbound: Add support for DLV (DNSSEC Lookaside Validation) 
Fixes #392.
 2013-10-11 15:45:25 +02:00
Tobias Brunner 1ff63f153e Merge branch 'fwmarks' 
Allows setting a mark on outbound packets and the routing rule
installed by charon.  With those settings it is possible to setup
tunnels with kernel-libipsec where the remote peer is part of the remote
traffic selector.

The following example settings in strongswan.conf show how this can be
configured:

charon {
    plugins {
        kernel-netlink {
            fwmark = !0x42
        }
        socket-default {
            fwmark = 0x42
        }
        kernel-libipsec {
            allow_peer_ts = yes
        }
    }
}

To make it work it is necessary to set

  net.ipv4.conf.all.rp_filter

appropriately, otherwise the kernel drops the packets.

References #380.
 2013-10-11 15:33:06 +02:00
Tobias Brunner cd25d291f7 kernel-libipsec: Don't ignore policies of type != POLICY_IPSEC 
This actually broke rekeying due to the DROP policies that are
temporarily added, which broke the refcount as the ignored policies
were not ignored in del_policy() (the type is not known there).
 2013-10-11 15:32:44 +02:00
Tobias Brunner eeb34af069 kernel-libipsec: Add an option to allow remote TS to match the IKE peer 
Setting the fwmark options for the kernel-netlink and socket-default
plugins allow this kind of setup.

It is probably required to set net.ipv4.conf.all.rp_filter to 2 to make
it work.
 2013-10-11 15:32:44 +02:00
Tobias Brunner 80f8b3a6d8 socket-default: Allow setting firewall mark on outbound packets 2013-10-11 15:32:44 +02:00
Tobias Brunner 51fefe4606 kernel-netlink: Allow setting firewall marks on routing rule 2013-10-11 15:32:44 +02:00
Tobias Brunner 434e530f75 ipsec_types: Add utility function to parse mark_t from strings 2013-10-11 15:32:44 +02:00
Tobias Brunner 6d7710a744 Merge branch 'database-transactions' 
This adds support for transactions to the database_t interface and the two
current implementations.

The pool utility is also moved to its own directory in src/.
 2013-10-11 15:29:30 +02:00
Tobias Brunner bd085dd978 attr-sql: Use a serializable transaction when inserting identities 2013-10-11 15:29:10 +02:00
Tobias Brunner b283a6e9ef database: Add support for serializable transactions 2013-10-11 15:29:10 +02:00
Tobias Brunner e745f5f69f sql: Don't use MyISAM engine and set collation/charset for all tables 
The MyISAM engine doesn't support transactions.
 2013-10-11 15:16:05 +02:00
Tobias Brunner 03c801cb2b pool: Change transaction handling 2013-10-11 15:16:05 +02:00
Tobias Brunner ec6ad6b086 pool: Move the pool utility to its own directory in src 2013-10-11 15:16:05 +02:00
Tobias Brunner 5abe3c52d3 attr-sql: Handle concurrent insertion of identities 
If the same identity is added concurrently by two threads (or by the
pool utility) INSERT might fail even though the SELECT was unsuccessful
before.

We are currently not able to lock the identities table in a portable way
(something like SELECT ... FOR UPDATE on MySQL).
 2013-10-11 15:16:05 +02:00
Tobias Brunner 4b8b1354ce attr-sql: Don't use database transactions in create_attribute_enumerator 
There could, of course, be race conditions when enumerating the attributes,
but those probably don't matter (e.g. missing an attribute that was
concurrently added).

Transactions are more intended to revert multiple changes if anything
fails in the process.
 2013-10-11 15:16:05 +02:00
Tobias Brunner fad11d602d sqlite: Implement transaction handling 2013-10-11 15:16:05 +02:00
Tobias Brunner f3cb889c9b mysql: Implement transaction handling 2013-10-11 15:16:04 +02:00
Tobias Brunner 947b76cda8 database: Add interface to handle transactions 2013-10-11 15:16:04 +02:00
Tobias Brunner 5f6a40827e mysql: Ensure connections are properly released in multi-threaded environments 2013-10-11 15:16:04 +02:00
Tobias Brunner ec91f15e3b crypto-factory: Try next available RNG implementation if constructor fails 2013-10-11 15:13:25 +02:00
Tobias Brunner 2e22333fbc crypto-factory: Order entries by algorithm identifier and (optionally) speed 2013-10-11 15:13:25 +02:00
Tobias Brunner e2c9a03d15 Remove HASH_PREFERRED, usages are replaced with HASH_SHA1, which is required for IKEv2 anyway 2013-10-11 15:13:25 +02:00
Tobias Brunner 3473cbab9c vstr: Forward actual field width 
fmt_field_width is a flag that indicates if a field width
is defined in obj_field_width.
 2013-10-11 15:12:16 +02:00
Tobias Brunner 3e3db3743e xauth-pam: Make trimming of email addresses optional 
Fixes #430.
 2013-10-04 10:49:54 +02:00
Tobias Brunner e4b7b48c1e eap-radius: Increase buffer for attributes sent in RADIUS accounting messages 
64 bytes might be too short for user names/identities.
 2013-09-27 13:37:12 +02:00
Tobias Brunner c8f34ba7b6 openssl: Properly log FIPS mode when enabled via openssl.conf 
Enabling FIPS mode twice will fail, so if it is enabled in openssl.conf
it should be disabled in strongswan.conf (or the other way around).

Either way, we should log whether FIPS mode is enabled or not.

References #412.
 2013-09-27 09:24:03 +02:00
Tobias Brunner e4d63cfae7 android: New release after fixing remediation instructions regression 2013-09-26 13:53:39 +02:00
Tobias Brunner 00f7b29422 android: Change progress dialog handling 
With the previous code the dialog sometimes was hidden for a short while
before it got reopened.
 2013-09-26 13:53:25 +02:00
Tobias Brunner cfed5679b8 android: Clear remediation instructions when starting a new connection 2013-09-26 13:00:45 +02:00
Tobias Brunner a2cebbe674 starter: Don't ignore keyingtries with rekey=no 
Since keyingtries also affects the number of retries initially or when
reestablishing an SA it should not be affected by the rekey option.

Fixes #418.
 2013-09-26 10:17:48 +02:00
Tobias Brunner 90031b2fc7 load-tester: Fix crash if private key was not loaded successfully 
Fixes #417.
 2013-09-24 09:27:12 +02:00
Tobias Brunner ed72f2d65e printf-hook: Write to output stream instead of the FD directly when using Vstr 
This avoids problems when other stdio functions are used (fputs,
fwrite) as writes via Vstr/FD were always unbuffered.
 2013-09-24 08:44:00 +02:00
Tobias Brunner c17cbfdb72 android: New release after improving recovery after connectivity changes 2013-09-23 14:33:29 +02:00
Tobias Brunner 3817231333 android: Change state handling to display errors occurring while the app is hidden 
A new connection ID allows listeners to track which errors they have
already shown to the user or were already dismissed by the user.

This was necessary because the state fragment is now unregistered from
state changes when it is not shown.
 2013-09-23 12:01:43 +02:00
Tobias Brunner b4a5b185fc android: Don't update state fragments when they are not displayed 
Besides that updates don't make much sense when the fragments are not
displayed this fixes the following exception:
	java.lang.IllegalStateException: Can not perform this action after
		onSaveInstanceState
 2013-09-23 12:01:42 +02:00
Tobias Brunner 561f94ae58 ikev2: Force an update of the host addresses on the first response 
This is especially useful on Android where we are able to send messages
even if we don't know the correct local address (this is possible
because we don't set source addresses in outbound messages).  This way
we may learn the correct local address if it e.g. changed right before
reestablishing an SA.

Updating the local address later is tricky without MOBIKE as the
responder might not update the associated IPsec SAs properly.
 2013-09-23 11:50:12 +02:00
Tobias Brunner 9292357030 ike-sa: Resolve hosts before reestablishing an IKE_SA 2013-09-23 11:49:52 +02:00
Tobias Brunner e3f64a79c2 android: Several plugins were moved from libcharon to libtnccs 
These were moved in commits e8f65c5cde and 12b3db5006.
 2013-09-23 11:49:52 +02:00
Tobias Brunner c3ee829eee android: Properly handle failures while initializing charon 2013-09-23 11:49:52 +02:00
Tobias Brunner aadf2e01e7 Merge branch 'pubkeys' 
Adds support to pki --pub to convert public keys to other formats
including SSH keys and DNSKEYs.  SSH public keys can also be read
from files in the format used by OpenSSH.
 2013-09-13 15:30:40 +02:00