denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
11,047 Commits 1 Branch 0 Tags
d8be7d38bf9a0b4cf62e7713aa5b354144938620
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Tobias Brunner d8be7d38bf Also support 128-bit RC2 2013-05-08 15:02:39 +02:00
Tobias Brunner feef637368 Add pkcs12 plugin which adds support for decoding PKCS#12 containers 2013-05-08 15:02:39 +02:00
Tobias Brunner 199fdcadae Function added to convert a hash algorithm to an HMAC integrity algorithm 2013-05-08 15:02:39 +02:00
Tobias Brunner 047fca1169 Support the PKCS#5/PKCS#12 encryption scheme used by OpenSSL for private keys 2013-05-08 15:02:39 +02:00
Tobias Brunner 0d0929fa0c Register PKCS#8 builder for KEY_ANY 2013-05-08 15:02:39 +02:00
Tobias Brunner 8e48e0009a Add support for PKCS#7/CMS encrypted-data 2013-05-08 15:02:39 +02:00
Tobias Brunner d41e54c68d Move PKCS#12 key derivation to a separate file 2013-05-08 15:02:39 +02:00
Tobias Brunner 594d847f79 PKCS#5 wrapper can decrypt PKCS#12-like schemes 2013-05-08 15:02:38 +02:00
Tobias Brunner cb38e2f30a Add test vectors for RC2 2013-05-08 15:02:38 +02:00
Tobias Brunner 162c06f2f5 Fix cleanup in crypto_tester if a crypter fails 2013-05-08 15:02:38 +02:00
Tobias Brunner 9d4fc8677f Add implementation of the RC2 block cipher (RFC 2268) 2013-05-08 15:02:34 +02:00
Tobias Brunner c734c2d875 Extract function to convert ASN.1 INTEGER object to u_int64_t 2013-05-08 14:53:08 +02:00
Tobias Brunner 4076e3ee91 Extract PKCS#5 handling from pkcs8 plugin to separate helper class 2013-05-08 14:53:08 +02:00
Tobias Brunner b715176ec4 Merge branch 'charon-cmd-agent' 
Adds support for authentication via ssh-agent to charon-cmd (RSA and ECDSA keys
are currently supported).

The new sshkey plugin parses SSH public keys in RFC 4253 format.

SSH public keys can be configured with the left|rightsigkey ipsec.conf option,
which replaces left|rightrsasigkey and takes a public key in one of three
formats: SSH (RFC 4253, ssh: prefix), DNSKEY (RFC 3110, dns: prefix, not the
full RR, only the actual RSA key), or PKCS#1 (the default, no prefix).
As before the keys are either encoded in hex (0x) or base64 (0s).
left|rightsigkey also accepts the path to a file containing a PEM or DER
encoded public key.
 2013-05-08 14:35:05 +02:00
Tobias Brunner 4d38a698b8 charon-cmd: Changed formatting of optional arguments in usage information 
Optional arguments have to be specified with = after the option.
 2013-05-08 12:30:36 +02:00
Tobias Brunner 6a6d0ea7cd charon-cmd: --agent optionally takes the path to an ssh-agent socket 
If not given it is read from the SSH_AUTH_SOCK environment variable.
 2013-05-08 12:30:36 +02:00
Tobias Brunner efb4cb0bf9 charon-cmd: Stop processing options if an argument is missing or an option not recognized 2013-05-08 12:30:33 +02:00
Tobias Brunner 410abbd35f charon-cmd: Properly initialize options with no additional lines 2013-05-07 17:08:31 +02:00
Tobias Brunner e07e489d5f agent: Use sshkey plugin to parse keys, adds support for ECDSA 2013-05-07 17:08:31 +02:00
Tobias Brunner dd9e366814 sshkey: Add support for ECDSA keys 2013-05-07 17:08:31 +02:00
Tobias Brunner 87692be215 Load any type (RSA/ECDSA) of public key via left|rightsigkey 2013-05-07 17:08:31 +02:00
Tobias Brunner fa1d3d39dc left|rightrsasigkey accepts SSH keys but the key format has to be specified explicitly 
The default is now PKCS#1. With the dns: and ssh: prefixes other formats
can be selected.
 2013-05-07 15:38:28 +02:00
Tobias Brunner cc4408abcb sshkey: Added builder for SSHKEY RSA keys 2013-05-07 15:38:28 +02:00
Tobias Brunner 584d656b77 Add sshkey plugin stub that will parse RFC 4253 public keys 2013-05-07 14:08:51 +02:00
Tobias Brunner c0bbddfa42 Try to load raw keys from ipsec.conf as PKCS#1 blob first 
The DNSKEY builder is quite eager and parses pretty much anything
as RSA key, so this has to be done before.
 2013-05-07 14:08:51 +02:00
Tobias Brunner ee7b73832c charon-cmd: Add --agent option to authenticate using ssh-agent(1) 
The socket path is read from the SSH_AUTH_SOCK environment variable.
So using this with sudo might require the -E command line (or an appropriate
sudoers config) to preserve the environment.
 2013-05-07 14:08:51 +02:00
Tobias Brunner 4dc50bf9de charon-cmd: Use loose matching of gateway identity 2013-05-07 13:53:48 +02:00
Tobias Brunner 8372b8fc54 charon-cmd: Load pubkey plugin to load raw keys 2013-05-07 13:46:02 +02:00
Tobias Brunner e74bca9e19 testing: Don't run tests when building tkm 
The problem with XML/Ada described in 9c2aba27 actually occurs when
running the tests here.

Really fixes #336.
 2013-05-07 10:19:37 +02:00
Tobias Brunner 9c2aba2735 testing: Don't run tests when building tkm-rpc 
There are issues with some versions of the XML/Ada library on i386,
blocking the build of the testing environment when these tests are run.
TKM tests won't work in such a case but at least make-testing does not
block with this patch.

Fixes #336.
 2013-05-06 18:17:58 +02:00
Tobias Brunner 55321dcfb6 New Android release after adding AES-GCM, IPv6-in-IPv4 and using kernel-netlink 
libipsec now supports AES-GCM, IPv6 tunnels over IPv4 are supported,
native x86 libraries are built (requires a new Vstr build script).
Also, the existing kernel-netlink plugin now provides the kernel-net
implementation, which should be more stable in case multiple interfaces
are up and have IP addresses installed on them.
 2013-05-03 16:02:39 +02:00
Tobias Brunner 79f42ded50 libipsec: Fix memory leak in event relay 2013-05-03 16:02:39 +02:00
Tobias Brunner 740aedfec1 android: Use stronger ESP proposal including AES-GCM 2013-05-03 16:02:39 +02:00
Tobias Brunner 051fc25d92 libipsec: Add support for AES-GCM 2013-05-03 15:13:57 +02:00
Tobias Brunner 24a8d1253f libipsec: Wrap traditional algorithms in AEAD wrapper 2013-05-03 15:13:57 +02:00
Tobias Brunner 61fb3267b2 android: Remove unused methods on NetworkManager/network_manager_t 2013-05-03 15:11:20 +02:00
Tobias Brunner 70dfac4459 android: Ignore interface 'lo' 
Android adds a default route via 'lo' if no connectivity is available
causing charon to send packets via lo and triggering DPD.
 2013-05-03 15:11:20 +02:00
Tobias Brunner 18dab76bfa android: Repurpose android-net to simply handle connectivity events 
Using the events by NetworkManager/ConnectivityManager to trigger roam events
instead of the events generated by the kernel-netlink plugin the noise level
is much lower.
 2013-05-03 15:11:20 +02:00
Tobias Brunner 37873f9994 kernel-netlink: Add an option to disable roam events 2013-05-03 15:11:19 +02:00
Tobias Brunner 3b7f25906e android: Replace android-net plugin with kernel-netlink 
Virtual IPs are not handled by the kernel-netlink plugin and tun devices are
ignored.
 2013-05-03 15:11:19 +02:00
Tobias Brunner 67332b4e22 android: Set strongswan.conf options before initializing other libraries 2013-05-03 15:11:19 +02:00
Tobias Brunner 0b9ce21b5e kernel-netlink: Define defaults for routing table and prio 2013-05-03 15:11:19 +02:00
Tobias Brunner 2d7b55bf9b openssl: Define a default for FIPS_MODE 2013-05-03 15:11:19 +02:00
Tobias Brunner 73da6c88a4 Fix checksum calculation with DESTDIR installations 2013-04-15 16:48:46 +02:00
Tobias Brunner 5cb4f5519b Added missing sasl Doxygen group 2013-04-05 16:03:39 +02:00
Tobias Brunner 14edee56bf unity: Check IKE_SA in only after enumerating virtual IPs 2013-04-05 16:03:10 +02:00
Tobias Brunner 96ad2b17b0 Updated strongswan.conf(5) man page 2013-04-01 16:56:47 +02:00
Tobias Brunner eca499f3d9 Load raw keys before possibly destroying the identity 
If no identity (or %any) is configured the identification_t object is
destroyed and an invalid object was associated with the created pubkey
certificate.
Actually using %any does not work as the certificate would not match
when the client later provides an identity.
 2013-04-01 13:48:34 +02:00
Tobias Brunner a009aedb0b ipseckey: Use proper daemon name for enable option 2013-04-01 13:46:09 +02:00
Tobias Brunner 53ac177cde Properly handle situation if no resolver plugins are loaded 2013-04-01 13:44:04 +02:00
Tobias Brunner 54781f5f34 Fixed Doxygen comment in eap_radius plugin 2013-03-27 11:08:55 +01:00
Tobias Brunner ae8ac58c45 Fix detection and use of netinet/ip6.h on FreeBSD 2013-03-27 09:56:48 +01:00
Tobias Brunner 613fb0b494 Don't set USE_ATTR_SQL when the sql plugin is enabled only 2013-03-27 07:47:53 +01:00
Tobias Brunner 419a9a4fcd Make some private functions in plugins static 
Fixes monolithic build.
 2013-03-27 07:32:55 +01:00
Tobias Brunner 51caeeb161 crypt_burn: Proper cleanup 2013-03-25 18:40:32 +01:00
Tobias Brunner d4f2f3dd7f crypt_burn: Fix loop condition for regular crypters 2013-03-25 18:40:31 +01:00
Tobias Brunner f2e6a67ed9 libpts: Cast first argument for %.*s to int 2013-03-25 18:40:27 +01:00
Tobias Brunner 237bb5d467 error-notify: Close file descriptors in case clients are still connected 2013-03-25 18:34:54 +01:00
Tobias Brunner 2467c46856 libpttls: Destroy reader when handling errors during SASL 2013-03-25 18:33:57 +01:00
Tobias Brunner acbe87787b pacman: Define gen_time out of the loop 
It gets assigned if count==3 but only used later when count >= 7.
 2013-03-25 17:13:49 +01:00
Tobias Brunner 38c410b1aa ipseckey: NULL pointer dereference fixed in error case 2013-03-25 17:02:45 +01:00
Tobias Brunner cf95d2926c Fixed some typos, courtesy of codespell 2013-03-25 10:59:37 +01:00
Tobias Brunner 48d82a7dc7 asprintf(3) requires _GNU_SOURCE to be defined 2013-03-22 19:42:15 +01:00
Tobias Brunner 79306b7e6e Use proper integer types when handling TLS exchanges 
tls_t.build takes a size_t argument not a ssize_t.
 2013-03-22 11:40:57 +01:00
Tobias Brunner 03237238b8 Check return value of asprintf(3) when converting AR identity 
Using chunk_t.ptr as target was also not optimal as it resulted in
a compiler warning.
 2013-03-22 11:34:16 +01:00
Tobias Brunner 24b5e71522 android: No need to disable CMS explicitly 
The version check introduced with 0d237763 should take care of it.
 2013-03-20 17:02:37 +01:00
Tobias Brunner 665fac2433 Allow up to 10 NAT-D payloads in IKEv1 messages 2013-03-20 16:20:39 +01:00
Tobias Brunner 1a71178940 Avoid a race condition when reloading secrets from ipsec.secrets 
With the previous implementation that cleared the secrets in the active
credential set and then loaded the secrets, IKE SA establishment would
fail (as initiator or responder) if secrets are concurrently reloaded
and the required secret was not yet loaded.
 2013-03-20 15:27:34 +01:00
Tobias Brunner d307be7f6c Add a method to replace all secrets in a mem_cred_t object 2013-03-20 15:27:34 +01:00
Tobias Brunner 29d93e2470 android: Build native libraries also for x86 
Requires an updated build script for Vstr.
 2013-03-20 15:24:27 +01:00
Tobias Brunner 51f2905d9b android: libtnccs requires headers from libtls 2013-03-20 15:24:27 +01:00
Tobias Brunner 9a4d06df44 android: Fix Android.mk for ipsec script 2013-03-20 15:24:27 +01:00
Tobias Brunner e5d819b617 android: Remove/filter header files from LOCAL_SRC_FILES 
This avoids huge warnings when building the native code.
 2013-03-20 15:24:26 +01:00
Tobias Brunner 8249f288f2 android: Request and install an IPv6 DNS server 2013-03-20 15:24:26 +01:00
Tobias Brunner ee66565d43 android: Also request a virtual IPv6 address and propose IPv6 TS 
This allows IPv6 over IPv4 but falls back nicely if we don't get a
virtual IPv6 (or IPv4) address.
 2013-03-20 15:24:26 +01:00
Tobias Brunner c994ec3b70 ipsec: Increased log level for message in case no outbound policy is found 
This might happen on Android if sockets are bound to the physical IP
address but packets are still routed via TUN device.  Since it seems to
happen quite often (or for stuff that requires regular traffic) this
hides these messages from the default log.
 2013-03-20 15:24:26 +01:00
Tobias Brunner e8526ae991 Removed unused variable 'id' 2013-03-19 16:37:40 +01:00
Tobias Brunner 5e551da16b Properly cleanup libmysql 
Seems to work correctly with recent MySQL versions.
 2013-03-19 16:33:07 +01:00
Tobias Brunner 2ac772a5d0 Use proper address family when adding multiple addresses to SQL pool 2013-03-19 16:33:07 +01:00
Tobias Brunner fe62707209 Ignore SQL-based IP address pools if their address family does not match 2013-03-19 16:33:07 +01:00
Tobias Brunner 1b33e6c4ca charon-nm: Add dependencies to CERT_DECODE and PRIVKEY plugin features 
This ensures the NM-specific credential set is unloaded before any
implementation of certificate/key objects, which causes a segmentation
fault during shutdown.
 2013-03-19 16:25:26 +01:00
Tobias Brunner 3651c8dcd5 charon-nm: Prevent NM from changing the default route 
This is not required as we install our own (narrow) route(s) in our own
routing table. This should allow split tunneling if configured on the
gateway.
 2013-03-19 16:25:26 +01:00
Tobias Brunner 9cf09ecad7 charon-nm: Use VIP (if any) as local address 
NM will install this address on the provided device.
 2013-03-19 16:25:26 +01:00
Tobias Brunner c15eea7306 charon-nm: Pass a dummy TUN device to NetworkManager 
NetworkManager modifies the addresses etc. on this interface so using
"lo" is not optimal. With the dummy interface NM is free to do its
thing.
 2013-03-19 16:25:26 +01:00
Tobias Brunner b7645a5d30 charon-nm: Fix NM plugin utility macros 2013-03-19 16:25:26 +01:00
Tobias Brunner e7017a6bb9 Ignore 'compile' script which is generated by AM_PROG_CC_C_O 2013-03-19 16:19:11 +01:00
Tobias Brunner 68bfee4bc4 Avoid returning COOKIEs right after system boot 
When the monotonic timer is initialized to 0 right after the system is
booted the daemon responded with COOKIES for COOKIE_CALMDOWN_DELAY (10s).

Since the COOKIE verification code actually produces an overflow for
COOKIE_LIFETIME (10s) it wouldn't even accept properly returned COOKIEs.

Checking for last_cookie makes sense anyway as that condition must only
apply if we actually sent a COOKIE before.
 2013-03-19 16:19:11 +01:00
Tobias Brunner 7f0f185bed Merge branch 'tkm' 
This adds charon-tkm a special build of the charon IKEv2 daemon that delegates
security critical operations to a separate process (TKM = Trusted Key Manager).
 2013-03-19 15:25:38 +01:00
Tobias Brunner deafaf51f1 Load arbitrary (non-host) attributes from strongswan.conf 
This allows to e.g. load Cisco-specific attributes that contain FQDNs.
 2013-03-19 15:21:30 +01:00
Tobias Brunner 8a0a1ae857 Delete IKE_SAs if responder does not initiate XAuth exchange within a certain time frame 2013-03-19 12:00:00 +01:00
Tobias Brunner 7a87381840 testing: Rename interfaces and bridges so they are easier to identify 
This simplifies capturing traffic with Wireshark on the host as each of
the guest's interfaces is clearly identified.
The three bridges were previously numbered starting from 0, this scheme
is restored here.
 2013-03-19 11:50:39 +01:00
Tobias Brunner 9525e9c506 testing: Don't use a specific version for the QEMU machine type 
The previously used pc-1.1 is not yet available on e.g. Ubuntu 12.04.
With 'pc' the most current supported version of that type is used.
 2013-03-19 11:50:39 +01:00
Tobias Brunner e34666a4ed NEWS about xauth-noauth added 2013-03-19 11:23:03 +01:00
Tobias Brunner 3c34e15ee4 Make sure that xauth-noauth is not used accidentally 
It has to be selected explicitly with rightauth2=xauth-noauth.
 2013-03-19 11:23:03 +01:00
Tobias Brunner e4013bb904 Added xauth-noauth plugin 
This XAuth backend does not do any authentication of client credentials
but simply sends a successful XAuth status to the client, thereby
concluding the XAuth exchange.  This can be useful to fallback to basic
RSA authentication with clients that can not be configured without XAuth
authentication.
 2013-03-19 11:23:03 +01:00
Tobias Brunner 6cf79c1e9d Algorithms are not really specific to an IKE version 
But not all of them can be used with IKEv1.

Fixes #314.
 2013-03-18 12:20:47 +01:00
Tobias Brunner 2b1e2434e4 esc() is only used if dladdr(3) is available 2013-03-08 16:45:09 +01:00
Tobias Brunner 292ee515db Fix maximum size of a mem_pool_t 2013-03-07 18:21:02 +01:00
Tobias Brunner d6da0a367a New Android release after adding translations and Cert/EAP authentication 
Also fixed a race condition during reauthentication and a freeze that
might happen while disconnecting.
 2013-03-07 14:14:34 +01:00
Tobias Brunner 76de964617 android: Add support for combined certificate and EAP authentication 
This uses RFC 4739 multiple authentication rounds to first
authenticate the client with a certificate followed by an
EAP authentication round with username and password.
 2013-03-07 14:14:34 +01:00