denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
10,428 Commits 1 Branch 0 Tags
cf3c72c4804cd7745172946243459eebfadc3b63
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Tobias Brunner ae82265a46 Add the ability to use a named pool for conftest configs 2013-01-21 11:46:20 +01:00
Tobias Brunner 0c006341f3 Merge branch 'debian-testing' 
These changes update the integration test system.  It previously was based
on a pretty much unmaintainable Gentoo root image and the dated UML
virtualization technology.  Among many other changes the test environment
is now based on KVM and uses reproducible Debian-based guest images.

Conflicts:
	NEWS
 2013-01-17 17:00:05 +01:00
Tobias Brunner 737912239f NEWS about updated integration tests added 2013-01-17 16:56:02 +01:00
Tobias Brunner 232af2fab5 Updated documentation for the integration tests 2013-01-17 16:56:02 +01:00
Tobias Brunner 812cd9c18a Removed UML from description of ikev2/default-keys test 2013-01-17 16:56:02 +01:00
Tobias Brunner b1169a880a Updated comments in test.conf of all tests 2013-01-17 16:56:02 +01:00
Tobias Brunner 7699a928f7 Renamed $UMLHOSTS to $VIRTHOSTS 2013-01-17 16:56:02 +01:00
Tobias Brunner 16cd6f63e2 Don't refer to recipes and images via $TESTDIR 
This way no symlink to the testing directory is required in $TESTDIR.
 2013-01-17 16:54:57 +01:00
Tobias Brunner ac8c96e51b Patch iptables for use with HA kernel patch (XFRM hooks) 2013-01-17 16:54:56 +01:00
Tobias Brunner 1a16b170ba start-testing requires virsh 2013-01-17 16:54:56 +01:00
Tobias Brunner 18bce26ea6 Use key(and password-)less SSH authentication 2013-01-17 15:22:09 +01:00
Tobias Brunner ffe710ae71 Patch AVP parsing in EAP-TTLS module in FreeRADIUS 2013-01-17 15:22:08 +01:00
Tobias Brunner d47b751850 Add recipes for libtnc and TNC@FHH 2013-01-17 15:22:08 +01:00
Tobias Brunner 669fc9f9ec Copy and display host specific tcpdump.log files 2013-01-17 15:22:08 +01:00
Tobias Brunner b460fb1dd2 Drop SHAREDTREE in favor of mounting the compile dir 2013-01-17 15:22:08 +01:00
Tobias Brunner 633bee03fc Patch EAP-SIM module in FreeRADIUS 2013-01-17 15:22:08 +01:00
Tobias Brunner d94f6a2ff6 Don't generate do-tests 2013-01-17 15:22:08 +01:00
Tobias Brunner 30abe1fd19 android: Properly escape apostrophes in Ukrainian translation 2013-01-14 17:23:52 +01:00
Tobias Brunner b9cda4f3e1 android: Implement kernel_net_t.get_interface via JNI 
This is now required to properly accept/install a virtual IP address.

Fixes #275.
 2013-01-14 17:22:56 +01:00
Tobias Brunner 53ce5c4c91 android: Moved chunk_from_byte_array and byte_array_from_chunk helper functions 2013-01-14 17:19:58 +01:00
Tobias Brunner ecff0e5685 android: Set OPENSSL_NO_CMS in Android.mk as it is not set in opensslconf.h on Android 2013-01-14 17:16:18 +01:00
Tobias Brunner 66bb4f63b2 Properly send IKEv1 packets if no ike_cfg is known yet 
This applies for error notifies.
 2013-01-14 12:14:16 +01:00
Tobias Brunner 37fb404833 Android.mk of libstrongswan updated 2013-01-14 09:16:33 +01:00
Tobias Brunner 21235e1ec2 Merge branch 'ikev1-fragmentation' 
This adds support for the proprietary IKEv1 fragmentation extension.

Conflicts:
	NEWS
 2013-01-12 11:58:26 +01:00
Tobias Brunner f31b418094 NEWS for fragmentation extension added 
Conflicts:
	NEWS
 2013-01-12 11:56:12 +01:00
Tobias Brunner ee6902ef7f Added an option to configure the maximum size of a fragment 2013-01-12 11:54:58 +01:00
Tobias Brunner 7ae245f685 Properly detect fragmentation capabilities 
Cisco sends 0xc0000000 so we check that part of the VID separately.
 2013-01-12 11:54:54 +01:00
Tobias Brunner 365d9a6f67 Added an option that allows to force IKEv1 fragmentation 2013-01-12 11:54:32 +01:00
Tobias Brunner 97973f8609 Use a connection specific option to en-/disable IKEv1 fragmentation 2012-12-24 13:00:01 +01:00
Tobias Brunner e645c15b9c Include source port in init hash for fragmented messages 2012-12-24 12:29:31 +01:00
Tobias Brunner 2f62bb1549 Add an option to en-/disable IKE fragmentation 
Fragments are always accepted but will not be sent if disabled.  The
vendor ID is only sent if the option is enabled.
 2012-12-24 12:29:31 +01:00
Tobias Brunner 5cafefcd5d Split larger messages into fragments if IKE fragmentation is supported by peer 2012-12-24 12:29:31 +01:00
Tobias Brunner c849305ad7 Log message size for in- and outbound IKE messages 2012-12-24 12:29:30 +01:00
Tobias Brunner 07df944c9c Add support to create IKE fragments 
All fragments currently use the same fragment ID (1) as that's what
other implementations are doing.
 2012-12-24 12:29:30 +01:00
Tobias Brunner c4daac2c0b Log added NAT-T vendor IDs 2012-12-24 12:29:27 +01:00
Tobias Brunner 667720c801 Detect a peer's support for IKE fragmentation 
Fragments are accepted even if this vendor ID is not seen.
 2012-12-24 12:29:27 +01:00
Tobias Brunner fe26ddada9 Map fragmented initial initial Main or Aggressive Mode messages to the same IKE_SA 2012-12-24 12:29:27 +01:00
Tobias Brunner b816037739 Allow ID_PROT/AGGRESSIVE messages for established IKE_SAs if they contain fragments 
Other implementations send fragments always in an initial message type
even for transaction or quick mode exchanges.
 2012-12-24 12:29:27 +01:00
Tobias Brunner 8fc8383439 Don't handle fragmented messages larger than charon.max_packet 2012-12-24 12:29:27 +01:00
Tobias Brunner 7d85f94165 Don't update an IKE_SA-entry's cached message ID when handling fragments 2012-12-24 12:29:26 +01:00
Tobias Brunner 30216000d3 Store inbound IKE fragments and reassemble the message when all fragments are received 2012-12-24 12:29:26 +01:00
Tobias Brunner 9b1659f52c Add message rules to properly handle IKE fragments 
These are sent in unencrypted messages and are the only payload
contained in such messages.
 2012-12-24 10:24:48 +01:00
Tobias Brunner ddfad8b67e Reset the encrypted flag when handling IKE messages that contain a fragment 
Racoon sets the encrypted bit for messages containing a fragment, but these
messages are not really encrypted (the fragmented message is though).
 2012-12-24 10:24:48 +01:00
Tobias Brunner 8f0ab6dd36 Payload added to handle IKE fragments 2012-12-24 10:24:48 +01:00
Tobias Brunner ef33a4ab82 Fixed some typos, courtesy of codespell 2012-12-20 09:35:26 +01:00
Tobias Brunner 0080daa787 Fix deadlock in IMC/IMV managers 
Since reserve_id() might be called from e.g. notify_connection_change()
using a write lock will not work as this can't be acquired while holding
the read lock.

Also, with the previous code it was possible that two IMCs/IMVs added by
two threads at the same time would get the same ID assigned.
 2012-12-18 15:59:29 +01:00
Tobias Brunner 6a8eeba540 Properly select IMC/IMV according to given primary ID in reserve_id() 2012-12-18 15:59:29 +01:00
Tobias Brunner 283898d6e0 Fix traffic selectors also as initiator in case of transport mode over NAT 2012-12-13 15:27:29 +01:00
Tobias Brunner 2990671748 Fix debug output if responder selected invalid traffic selectors during QM 2012-12-13 15:27:28 +01:00
Tobias Brunner 5cb00b3afb Fixed reading of configs in conftest utility 2012-12-13 11:08:32 +01:00
Tobias Brunner caccc0e8cc Avoid that ruby 1.9 redefines snprintf(3) etc. 
Otherwise our custom printf specifiers won't work.
 2012-12-10 11:41:37 +01:00
Tobias Brunner 12e70a7efc Properly initialize linked list when enumerating interface addresses 2012-12-10 09:47:46 +01:00
Tobias Brunner 6a25122bfc rb_cvar_set() takes three arguments in Ruby 1.9 2012-12-10 09:47:46 +01:00
Tobias Brunner d972975d87 Use rb_errinfo() instead of ruby_errinfo for Ruby 1.9 2012-12-10 09:47:46 +01:00
Tobias Brunner afabe7b0ef Use proper Ruby library depending on the available version 2012-12-10 09:47:46 +01:00
Tobias Brunner 5057df5b73 Fixed search for ruby.h in ./configure for newer Ruby releases 2012-12-10 09:47:46 +01:00
Tobias Brunner 07f826af67 Fixed encoding of TLS extensions (elliptic_curves and signature_algorithms) 2012-11-28 10:20:14 +01:00
Tobias Brunner 2cb9a014df New Android release after adding shortcuts and confirmation dialog 
Also fixed some Android 4.2 specific issues.
 2012-11-21 19:07:52 +01:00
Tobias Brunner df3e34fe86 android: Don't allow any backup for now 2012-11-21 19:05:18 +01:00
Tobias Brunner 37d42a76d3 android: Properly handle exceptions when loading keys/certificates 2012-11-21 18:57:41 +01:00
Tobias Brunner 73d0fb0a66 android: Use the same tag string for all dialogs in MainActivity 2012-11-21 18:57:41 +01:00
Tobias Brunner 8c0b32d892 android: Hide previous dialogs when handling a new connection attempt 2012-11-21 18:57:41 +01:00
Tobias Brunner 50b048983c android: Show confirmation dialog when starting a profile while already connected 2012-11-21 18:57:41 +01:00
Tobias Brunner ac3c6ff479 android: Add the ability to create shortcuts to specific VPN profiles 2012-11-21 18:57:41 +01:00
Tobias Brunner 127d83bb21 android: Start a specific VPN profile based on special Intents 2012-11-21 18:57:40 +01:00
Tobias Brunner 7241102ace android: Attribute added to display the list of VPN profiles in read-only mode 2012-11-21 18:57:40 +01:00
Tobias Brunner 35ba45916c Fixed two bugs in logging MSK during EAP-SIM/AKA 
msk is already a pointer to a chunk_t and it was actually not set yet.
 2012-11-21 11:55:55 +01:00
Tobias Brunner 2e50a8e751 android: Show an error if VPN fails due to lock down mode in Android 4.2 2012-11-19 11:43:32 +01:00
Tobias Brunner be2e7ecc2f android: Add error message as argument to "VPN not supported" dialog 2012-11-19 11:43:32 +01:00
Tobias Brunner 0c3b8028e7 android: Content providers are not exported by default in Android 4.2 2012-11-19 11:43:32 +01:00
Tobias Brunner 48e45153f5 android: Set target SDK to 17 (Android 4.2) 2012-11-19 11:43:31 +01:00
Tobias Brunner 277ff80a2e android: Private key bug has been fixed with Android 4.2 2012-11-19 11:43:31 +01:00
Tobias Brunner cbd52e7ddc Limit recursion when searching for source addresses 
This could be required if e.g. two default routes list gateways but the
corresponding outbound interfaces do not have any IP addresses on them.
 2012-11-13 09:06:02 +01:00
Tobias Brunner 5be88ca6bb Don't call get_route recursively if a route's gateway matches the destination 2012-11-13 09:06:02 +01:00
Tobias Brunner 7d41e90846 Fix destruction of tcg_pts_attr_file_meas_t when building from encoding 2012-11-12 12:13:11 +01:00
Tobias Brunner 6782bf3722 Properly define TSS_TROUSERS in configure script 2012-11-12 10:34:04 +01:00
Tobias Brunner 44566c2238 Made TSS implementation configurable and thereby optional 2012-11-08 19:32:41 +01:00
Tobias Brunner eba65182e4 Include 'aggressive' when comparing peer_cfg_t objects 2012-11-07 12:44:58 +01:00
Tobias Brunner bf0bcee9ec Fixed output of longer debug messages 
(v)snprintf(3) returns the length without terminating null byte but the
length given as parameter must include it.
 2012-11-07 12:44:58 +01:00
Tobias Brunner ed05a1a3b7 'signal' is a keyword in MySQL 5.5 
Fixes #251.
 2012-11-07 12:37:23 +01:00
Tobias Brunner acb300f920 android: Use proper intent-filter for our VpnService 2012-11-02 15:55:08 +01:00
Tobias Brunner 214c081dd6 Log sent vendor IDs for IKEv1 2012-11-02 15:52:19 +01:00
Tobias Brunner 531f32d62a Compiler warning fixed 2012-11-02 15:39:51 +01:00
Tobias Brunner 3689f0f6cc FQDNs are actually not resolved when loading secrets 2012-10-29 10:06:43 +01:00
Tobias Brunner f30962de74 Fixed log message when no shared secret is found during IKEv1 Main Mode 2012-10-29 10:04:37 +01:00
Tobias Brunner 2380f3a830 Added documentation for NTLM secrets 2012-10-25 09:51:47 +02:00
Tobias Brunner e34573dd48 Added missing noskip_flag setter/getter to some pa_tnc_attr_t constructors 2012-10-24 17:58:36 +02:00
Tobias Brunner f48e727232 Remove all ESP proposals with non-matching DH group during Quick Mode 
According to RFC 2409, section 5.5, if PFS is used all proposals MUST
include the selected DH group, so we remove proposals without the
proposed group and remove other DH groups from the remaining proposals.
 2012-10-24 16:09:42 +02:00
Tobias Brunner 4eba7269b8 proposal_t.strip_dh() takes a DH group to keep, using MODP_NONE will remove all 2012-10-24 16:09:42 +02:00
Tobias Brunner e74f184cb4 Remove MODP groups from default ESP proposal 
This now actually makes pfs=no the default and it equals the default
listed in ipsec.conf.5. efc69e9f preserved the default of pfs=yes.
 2012-10-24 16:09:42 +02:00
Tobias Brunner bca34c3717 Moved utils.[ch] to utils folder 2012-10-24 16:07:53 +02:00
Tobias Brunner f9625952ad Moved settings_t to utils folder 2012-10-24 16:00:51 +02:00
Tobias Brunner f05b427265 Moved debug.[ch] to utils folder 2012-10-24 16:00:51 +02:00
Tobias Brunner d5c143e5be Moved enum_name_t to utils folder 2012-10-24 16:00:50 +02:00
Tobias Brunner 125b37af6d Moved chunk_t to utils folder 2012-10-24 16:00:50 +02:00
Tobias Brunner 05e448c5cc Moved printf hooks to utils folder 2012-10-24 16:00:50 +02:00
Tobias Brunner 08944b68ac Moved integrity_checker_t to utils folder 2012-10-24 16:00:50 +02:00
Tobias Brunner 12642a6831 Moved data structures to new collections subfolder 2012-10-24 16:00:49 +02:00
Tobias Brunner fdee6b5f5a Moved packet_t and tun_device_t to networking folder 2012-10-24 15:06:18 +02:00
Tobias Brunner 2e7cc07ecd Moved host_t and host_resolver_t to a new networking subfolder 2012-10-24 15:06:18 +02:00