denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
10,675 Commits 1 Branch 0 Tags
d29246cabe581f4937e740e251a935e629556f86
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Tobias Brunner 2b1e2434e4 esc() is only used if dladdr(3) is available 2013-03-08 16:45:09 +01:00
Tobias Brunner 292ee515db Fix maximum size of a mem_pool_t 2013-03-07 18:21:02 +01:00
Tobias Brunner d6da0a367a New Android release after adding translations and Cert/EAP authentication 
Also fixed a race condition during reauthentication and a freeze that
might happen while disconnecting.
 2013-03-07 14:14:34 +01:00
Tobias Brunner 76de964617 android: Add support for combined certificate and EAP authentication 
This uses RFC 4739 multiple authentication rounds to first
authenticate the client with a certificate followed by an
EAP authentication round with username and password.
 2013-03-07 14:14:34 +01:00
Tobias Brunner d62f043f01 testing: Add screen package to base image 
Makes working in a single SSH session easier.
 2013-03-05 17:40:13 +01:00
Tobias Brunner eeb029360a testing: Enable ssh connection to second IP by name (e.g. moon1) 2013-03-05 17:40:13 +01:00
Tobias Brunner 45ee7c9429 testing: ssh script accepts IP addresses instead of host names 2013-03-05 17:40:13 +01:00
Tobias Brunner 5057455674 testing: ssh script forwards arguments to ssh command 
This allows to execute commands on a virtual host.
 2013-03-05 17:40:12 +01:00
Tobias Brunner 11adf114c1 Fixed Doxygen comments after scanning complete src directory 2013-03-02 18:31:53 +01:00
Tobias Brunner b42f2cacac Include the whole src directory in apidoc and make source files browsable 
But still only scan header files as Doxygen can't figure out how they
are related to source files (at least not for class methods).
 2013-03-02 18:31:53 +01:00
Tobias Brunner cd612784e4 Prevent Doxygen from processing __attribute__(...) 
Doxygen produces additional members/classes from these attributes.
 2013-03-02 18:31:52 +01:00
Tobias Brunner b6a387f7b0 Updated Doxyfile.in with a recent version of Doxygen 2013-03-02 18:28:18 +01:00
Tobias Brunner 9804fccea3 Removed backend for old Android frontend patch 
Moved the remaining DNS handler to a new plugin.
 2013-03-02 18:27:23 +01:00
Tobias Brunner e88b529a30 android: Mitigate race condition on reauthentication 
If the TUN device gets recreated while another thread in handle_plain()
has not yet called select(2) but already stored the file descriptor of the
old TUN device in its FD set, select() will fail with EBADF.

Fixes #301.
 2013-03-01 17:06:01 +01:00
Tobias Brunner 4c969f7906 openssl: The EVP GCM interface requires at least OpenSSL 1.0.1 2013-03-01 16:57:45 +01:00
Tobias Brunner 9a70fe8412 testing: Add a script to easily connect to a host via SSH 
This doesn't require any entries in /etc/hosts and the correct SSH
config is used to allow password-less access.
 2013-02-28 18:21:14 +01:00
Tobias Brunner 81f9cd39fd openssl: Provide AES-GCM implementation 2013-02-28 18:17:42 +01:00
Tobias Brunner a89ebab62e Fix cleanup in crypto_tester if AEAD implementation fails 2013-02-28 18:17:42 +01:00
Tobias Brunner 5f7f4fa398 Order of arguments in Doxygen comment fixed 2013-02-28 18:17:42 +01:00
Tobias Brunner 8656f35ae1 Fix auth_cfg_t.clone() for single-valued auth rules 
By using the default list enumerator and adding the rules with the public
add() method, clones of auth_cfg_t objects would return the values for
single-valued auth rules in the wrong order (i.e. the oldest instead of the
newest value was returned).  Using the internal enumerator (which the comment
already suggested) fixes this, but the clone will not be a full clone as
it does not contain any old values for single-valued auth rules.  Since
these will never be used anyway, this should be fine.
 2013-02-28 18:11:38 +01:00
Tobias Brunner 6e935c6fe0 Trigger an updown event when destroying an IKE_SA based on INITIAL_CONTACT 
In other cases (i.e. when functions return DESTROY_ME) the event should
already be triggered, but not in this forced situation.
 2013-02-28 18:07:29 +01:00
Tobias Brunner bc07fef09c Use SIGUSR2 for SIG_CANCEL on Android 
SIGRTMIN is defined as 32 while sigset_t is defined as
unsigned long (i.e. holds 32 signals).  Hence, the signal
could never be blocked.  Sending the signal still canceled
threads, but sometimes in situations where they shouldn't
have been canceled (e.g. while holding a lock).

Fixes #298.
 2013-02-26 11:40:34 +01:00
Tobias Brunner 0ac34e9e6a Android.mk updated to latest Makefiles 
Fixes #300.
 2013-02-26 10:11:36 +01:00
Tobias Brunner 0d237763dc openssl: Disable PKCS#7/CMS when building against OpenSSL < 0.9.8g 
Fixes #292.
 2013-02-20 18:34:54 +01:00
Tobias Brunner 39db06f155 Merge branch 'dnssec' 2013-02-19 12:25:27 +01:00
Tobias Brunner d69eb0375f NEWS about ipseckey and unbound plugins added 2013-02-19 12:25:01 +01:00
Tobias Brunner 96a2d2077b Fix 'stroke loglevel any' 
Before b46a5cd4 this worked if debug_t was unsigned.  In that case -1,
as returned by enum_from_name(), would result in a large positive number.
So any unknown debug group (including 'any') had the same effect that
was only intended for 'any'.
 2013-02-13 12:18:20 +01:00
Tobias Brunner 98063d8187 Don't use a time_t variable with fscanf when parsing uptime 
Because "%u" is used as format string in the fscanf call that parses the
uptime and because the length of time_t varies on different platforms
and architectures the value was not written properly if time_t was longer
than an unsigned int and depending on how the target variable was aligned
on the stack.  Since there is no conversion specifier to properly parse a
time_t value we use the appropriate integer type instead.
 2013-02-08 11:33:13 +01:00
Tobias Brunner af5452ba76 Allow more than one CERTREQ payload for IKEv2 
There is no reason not to do so (RFC 5996 explicitly mentions multiple
CERTREQ payloads) and some implementations seem to use the same behavior
as had to be used with IKEv1 (i.e. each CA in its own CERTREQ payload).
 2013-02-08 11:28:56 +01:00
Tobias Brunner 2ccdc19ed9 Report enabled plugins at the end of configure 2013-02-04 16:24:58 +01:00
Tobias Brunner f2b508c1ab Streamlined comments in configure.in 
dnl should only be used in rare cases (like escaping newlines)
 2013-02-04 16:24:58 +01:00
Tobias Brunner 39a6c39519 Updated configure.in to newer autoconf 
AC_TRY_COMPILE and AC_TRY_RUN are deprecated.  The new construct with
AC_*_IFELSE and AC_LANG_PROGRAM requires double quoting the source code
of these test programs.
 2013-02-04 16:24:58 +01:00
Tobias Brunner eaf752d203 Add a configure option to disable all default plugins 
The --disable-defaults option disables all plugins that would be
enabled by default.  This allows to selectively enable specific plugins
without issues when new default options get added in future releases.
 2013-02-04 16:24:58 +01:00
Tobias Brunner a3a190b7bd openssl: Properly honor OPENSSL_NO_* defines 2013-01-31 17:33:23 +01:00
Tobias Brunner 25637aa5d8 Fix Doxygen comment for rdrand plugin 2013-01-31 12:11:37 +01:00
Tobias Brunner 9d9410e7b9 Typo in strongswan.conf(5) man page fixed 2013-01-31 11:52:11 +01:00
Tobias Brunner c186b3940a Documented new options in strongswan.conf(5) man page 2013-01-25 20:22:20 +01:00
Tobias Brunner 58fd1f3eef Don't use pointer to a union member in host_create_from_string_and_family() 2013-01-25 13:18:50 +01:00
Tobias Brunner 572a707765 Properly check MSB in openssl plugin's PKCS#7 implementation 2013-01-24 23:36:02 +01:00
Tobias Brunner 9ccfeb8ca1 Use proper buffer sizes for parse_smartcard() 2013-01-24 23:35:42 +01:00
Tobias Brunner 677812dc66 Cast first argument for %.*s to int 2013-01-24 23:35:42 +01:00
Tobias Brunner bacbf91c5c Removed unused command name when printing usage info for lookip 2013-01-24 23:35:41 +01:00
Tobias Brunner d7bd0ad7df Removed unused argument 2013-01-24 23:35:34 +01:00
Tobias Brunner 4cd3fb788d Properly read data from stream in pki --pkcs7 2013-01-24 19:13:41 +01:00
Tobias Brunner 27a814b527 Properly destroy mem_cred object on pki --pkcs7 --help 2013-01-24 19:13:41 +01:00
Tobias Brunner 39896d92ed Try to determine OS type if name and version are configured 2013-01-24 19:13:41 +01:00
Tobias Brunner 24cdf5340e Add missing va_end() call 2013-01-24 19:13:41 +01:00
Tobias Brunner 69c6a60176 g_thread_init() is deprecated since Glib 2.23 2013-01-24 19:13:40 +01:00
Tobias Brunner 2ec3552fce Fix check-in of IKE_SA when IKE_SA_INIT fails and hash table is enabled 
Setting the responder SPI to 0 can only be done while generating the
response, otherwise we'd fail to check in the IKE_SA again in case the
hash table is enabled.  That's because we use the responder SPI as hash
value since 5.0.0.
 2013-01-24 19:13:40 +01:00
Tobias Brunner 4eb09d14e2 Avoid a deadlock when installing a trap policy failed 2013-01-23 15:51:47 +01:00
Tobias Brunner ae82265a46 Add the ability to use a named pool for conftest configs 2013-01-21 11:46:20 +01:00
Tobias Brunner 0c006341f3 Merge branch 'debian-testing' 
These changes update the integration test system.  It previously was based
on a pretty much unmaintainable Gentoo root image and the dated UML
virtualization technology.  Among many other changes the test environment
is now based on KVM and uses reproducible Debian-based guest images.

Conflicts:
	NEWS
 2013-01-17 17:00:05 +01:00
Tobias Brunner 737912239f NEWS about updated integration tests added 2013-01-17 16:56:02 +01:00
Tobias Brunner 232af2fab5 Updated documentation for the integration tests 2013-01-17 16:56:02 +01:00
Tobias Brunner 812cd9c18a Removed UML from description of ikev2/default-keys test 2013-01-17 16:56:02 +01:00
Tobias Brunner b1169a880a Updated comments in test.conf of all tests 2013-01-17 16:56:02 +01:00
Tobias Brunner 7699a928f7 Renamed $UMLHOSTS to $VIRTHOSTS 2013-01-17 16:56:02 +01:00
Tobias Brunner 16cd6f63e2 Don't refer to recipes and images via $TESTDIR 
This way no symlink to the testing directory is required in $TESTDIR.
 2013-01-17 16:54:57 +01:00
Tobias Brunner ac8c96e51b Patch iptables for use with HA kernel patch (XFRM hooks) 2013-01-17 16:54:56 +01:00
Tobias Brunner 1a16b170ba start-testing requires virsh 2013-01-17 16:54:56 +01:00
Tobias Brunner 18bce26ea6 Use key(and password-)less SSH authentication 2013-01-17 15:22:09 +01:00
Tobias Brunner ffe710ae71 Patch AVP parsing in EAP-TTLS module in FreeRADIUS 2013-01-17 15:22:08 +01:00
Tobias Brunner d47b751850 Add recipes for libtnc and TNC@FHH 2013-01-17 15:22:08 +01:00
Tobias Brunner 669fc9f9ec Copy and display host specific tcpdump.log files 2013-01-17 15:22:08 +01:00
Tobias Brunner b460fb1dd2 Drop SHAREDTREE in favor of mounting the compile dir 2013-01-17 15:22:08 +01:00
Tobias Brunner 633bee03fc Patch EAP-SIM module in FreeRADIUS 2013-01-17 15:22:08 +01:00
Tobias Brunner d94f6a2ff6 Don't generate do-tests 2013-01-17 15:22:08 +01:00
Tobias Brunner 30abe1fd19 android: Properly escape apostrophes in Ukrainian translation 2013-01-14 17:23:52 +01:00
Tobias Brunner b9cda4f3e1 android: Implement kernel_net_t.get_interface via JNI 
This is now required to properly accept/install a virtual IP address.

Fixes #275.
 2013-01-14 17:22:56 +01:00
Tobias Brunner 53ce5c4c91 android: Moved chunk_from_byte_array and byte_array_from_chunk helper functions 2013-01-14 17:19:58 +01:00
Tobias Brunner ecff0e5685 android: Set OPENSSL_NO_CMS in Android.mk as it is not set in opensslconf.h on Android 2013-01-14 17:16:18 +01:00
Tobias Brunner 66bb4f63b2 Properly send IKEv1 packets if no ike_cfg is known yet 
This applies for error notifies.
 2013-01-14 12:14:16 +01:00
Tobias Brunner 37fb404833 Android.mk of libstrongswan updated 2013-01-14 09:16:33 +01:00
Tobias Brunner 21235e1ec2 Merge branch 'ikev1-fragmentation' 
This adds support for the proprietary IKEv1 fragmentation extension.

Conflicts:
	NEWS
 2013-01-12 11:58:26 +01:00
Tobias Brunner f31b418094 NEWS for fragmentation extension added 
Conflicts:
	NEWS
 2013-01-12 11:56:12 +01:00
Tobias Brunner ee6902ef7f Added an option to configure the maximum size of a fragment 2013-01-12 11:54:58 +01:00
Tobias Brunner 7ae245f685 Properly detect fragmentation capabilities 
Cisco sends 0xc0000000 so we check that part of the VID separately.
 2013-01-12 11:54:54 +01:00
Tobias Brunner 365d9a6f67 Added an option that allows to force IKEv1 fragmentation 2013-01-12 11:54:32 +01:00
Tobias Brunner 97973f8609 Use a connection specific option to en-/disable IKEv1 fragmentation 2012-12-24 13:00:01 +01:00
Tobias Brunner e645c15b9c Include source port in init hash for fragmented messages 2012-12-24 12:29:31 +01:00
Tobias Brunner 2f62bb1549 Add an option to en-/disable IKE fragmentation 
Fragments are always accepted but will not be sent if disabled.  The
vendor ID is only sent if the option is enabled.
 2012-12-24 12:29:31 +01:00
Tobias Brunner 5cafefcd5d Split larger messages into fragments if IKE fragmentation is supported by peer 2012-12-24 12:29:31 +01:00
Tobias Brunner c849305ad7 Log message size for in- and outbound IKE messages 2012-12-24 12:29:30 +01:00
Tobias Brunner 07df944c9c Add support to create IKE fragments 
All fragments currently use the same fragment ID (1) as that's what
other implementations are doing.
 2012-12-24 12:29:30 +01:00
Tobias Brunner c4daac2c0b Log added NAT-T vendor IDs 2012-12-24 12:29:27 +01:00
Tobias Brunner 667720c801 Detect a peer's support for IKE fragmentation 
Fragments are accepted even if this vendor ID is not seen.
 2012-12-24 12:29:27 +01:00
Tobias Brunner fe26ddada9 Map fragmented initial initial Main or Aggressive Mode messages to the same IKE_SA 2012-12-24 12:29:27 +01:00
Tobias Brunner b816037739 Allow ID_PROT/AGGRESSIVE messages for established IKE_SAs if they contain fragments 
Other implementations send fragments always in an initial message type
even for transaction or quick mode exchanges.
 2012-12-24 12:29:27 +01:00
Tobias Brunner 8fc8383439 Don't handle fragmented messages larger than charon.max_packet 2012-12-24 12:29:27 +01:00
Tobias Brunner 7d85f94165 Don't update an IKE_SA-entry's cached message ID when handling fragments 2012-12-24 12:29:26 +01:00
Tobias Brunner 30216000d3 Store inbound IKE fragments and reassemble the message when all fragments are received 2012-12-24 12:29:26 +01:00
Tobias Brunner 9b1659f52c Add message rules to properly handle IKE fragments 
These are sent in unencrypted messages and are the only payload
contained in such messages.
 2012-12-24 10:24:48 +01:00
Tobias Brunner ddfad8b67e Reset the encrypted flag when handling IKE messages that contain a fragment 
Racoon sets the encrypted bit for messages containing a fragment, but these
messages are not really encrypted (the fragmented message is though).
 2012-12-24 10:24:48 +01:00
Tobias Brunner 8f0ab6dd36 Payload added to handle IKE fragments 2012-12-24 10:24:48 +01:00
Tobias Brunner ef33a4ab82 Fixed some typos, courtesy of codespell 2012-12-20 09:35:26 +01:00
Tobias Brunner 0080daa787 Fix deadlock in IMC/IMV managers 
Since reserve_id() might be called from e.g. notify_connection_change()
using a write lock will not work as this can't be acquired while holding
the read lock.

Also, with the previous code it was possible that two IMCs/IMVs added by
two threads at the same time would get the same ID assigned.
 2012-12-18 15:59:29 +01:00
Tobias Brunner 6a8eeba540 Properly select IMC/IMV according to given primary ID in reserve_id() 2012-12-18 15:59:29 +01:00
Tobias Brunner 283898d6e0 Fix traffic selectors also as initiator in case of transport mode over NAT 2012-12-13 15:27:29 +01:00
Tobias Brunner 2990671748 Fix debug output if responder selected invalid traffic selectors during QM 2012-12-13 15:27:28 +01:00
Tobias Brunner 5cb00b3afb Fixed reading of configs in conftest utility 2012-12-13 11:08:32 +01:00