denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
9,465 Commits 1 Branch 0 Tags
e4ef4c9877d5ccb773ace0edf655351428c39572
Commit Graph
7306 Commits
Author SHA1 Message Date
Tobias Brunner e4ef4c9877 Merge branch 'android-ndk' 
This branch comes with some preliminary changes for the user-land IPsec
implementation and the Android App.

One important change is that the UDP ports used by the socket-default plugin
were made configurable (either via ./configure or strongswan.conf).
Also, the plugin does randomly allocate a port if it is configured to 0,
which is useful for client implementations.  A consequence of these
changes is that the local UDP port used when creating ike_cfg_t objects has
to be fetched from the socket.
 2012-08-13 10:45:39 +02:00
Tobias Brunner 000668d308 Doxygen fix 2012-08-11 16:50:22 +02:00
Tobias Brunner 3b891b9e5b Avoid problems with Doxygen by adding warn_unused_result attribute at the end of method signatures 2012-08-11 16:48:09 +02:00
Tobias Brunner 2c93a214aa Add warn_unused_result attributes to rng_(get|allocate)_bytes_not_zero 
Also fixed Doxygen comments.
 2012-08-11 16:30:27 +02:00
Martin Willi a63192479d If _POSIX_SPIN_LOCKS is defined as -1, it is not available 2012-08-10 17:02:46 +02:00
Martin Willi 922fb29f89 If vstr printf functions are #defined, undef them before redefinition 
At least Mountain Lion seems to have them #defined to secure _chk
variants.
 2012-08-10 17:02:05 +02:00
Martin Willi cd55a3cb77 Use actual daemon name to enable XAuth/PSK with aggressive mode 2012-08-10 11:53:18 +02:00
Martin Willi 27128c1e32 EAP-GTC can use any XAuth backend, including xauth-pam 
This makes EAP-GTC a generic plain password authentication method,
as it is used with XAuth. Instead of verifying credentials with
PAM, any backend can be configured. The default is xauth-pam,
providing the same functionality as EAP-GTC in strongSwan 4.x.
 2012-08-10 10:43:44 +02:00
Martin Willi b9e4916321 Add xauth-pam, an XAuth backend verifying credentials with PAM 2012-08-10 10:43:44 +02:00
Martin Willi 0bac49b0a9 Add getspnam_r() to leak detective whitelist 2012-08-10 10:43:44 +02:00
Andreas Steffen da21793679 make max_message_size parameter consistent with similar options 2012-08-09 14:11:08 +02:00
Martin Willi 02cabd0f26 Check if TLS handshake received Finished before processing application data 2012-08-09 12:10:41 +02:00
Tobias Brunner 6fbf4472ea Added option to prevent socket-default from setting the source address on outbound packets 2012-08-08 15:39:07 +02:00
Tobias Brunner 95dacbbc70 Allocate UDP ports randomly in Android NDK build. 2012-08-08 15:30:28 +02:00
Tobias Brunner 224ab4c59b socket-default plugin allocates random ports if configured to 0. 
Also added strongswan.conf options to change the ports.
 2012-08-08 15:30:27 +02:00
Tobias Brunner b223d517c8 Replaced usages of CHARON_*_PORT with calls to get_port(). 2012-08-08 15:12:25 +02:00
Tobias Brunner a7babe25ee Added get_port() method to socket_t to learn the listening port. 2012-08-08 15:12:25 +02:00
Tobias Brunner 56d07af3be Added ESP log group for libipsec log messages. 2012-08-08 15:12:25 +02:00
Tobias Brunner 75f8316332 Use send_no_marker to send NAT keepalives. 2012-08-08 15:12:25 +02:00
Tobias Brunner 30dc7dff4d Avoid double-free when prepending Non-ESP marker. 2012-08-08 15:12:25 +02:00
Tobias Brunner fb6c52adcd Function added to send packets without Non-ESP marker. 2012-08-08 15:12:25 +02:00
Tobias Brunner fe4a152b85 Avoid unnecessary copy of packet data when removing Non-ESP marker. 2012-08-08 15:12:25 +02:00
Tobias Brunner 73470cfe57 Added packet_t.skip_bytes method to skip bytes at the start of a packet. 2012-08-08 15:12:25 +02:00
Tobias Brunner 896941d365 Improved how NAT-T keepalives are handled in sockets/receiver. 2012-08-08 15:12:24 +02:00
Tobias Brunner e49abcede0 Let kernel interfaces decide how to enable UDP decapsulation of ESP packets. 2012-08-08 15:12:24 +02:00
Tobias Brunner 08b2ce7aa7 Callback for ESP packets added to receiver. 2012-08-08 15:12:24 +02:00
Tobias Brunner 064da8b96b Add Non-ESP marker in sender and not individual socket plugins. 2012-08-08 15:12:24 +02:00
Tobias Brunner 65da43e2fc Handle Non-ESP marker in receiver and not individual socket plugins. 2012-08-08 15:12:24 +02:00
Tobias Brunner a405760395 Java code style fixed (analogous to C code). 2012-08-08 15:12:24 +02:00
Tobias Brunner 06ed785e5a Load libipsec in Android app. 2012-08-08 15:12:24 +02:00
Tobias Brunner b70139fbfd Stub library for user space IPsec implementation added. 2012-08-08 15:09:31 +02:00
Tobias Brunner 48f2c4b69b Some NDK build info updated. 2012-08-08 15:09:31 +02:00
Tobias Brunner 9ddc7cbfff Changed minimal SDK/API level to 14. 2012-08-08 15:09:31 +02:00
Tobias Brunner 4a20814300 Added android.net.VpnService wrapper around charon (loaded via JNI). 2012-08-08 15:09:31 +02:00
Tobias Brunner da848ab894 Added Android shell app created with Android SDK. 2012-08-08 15:09:30 +02:00
Tobias Brunner 2f203aee0e Android.mk for NDK build added. 2012-08-08 15:09:30 +02:00
Tobias Brunner 162621ed57 Moved Android specific logger to separate plugin. 
This is mainly because the other parts of the existing android plugin
can not be built in the NDK (access to keystore and system properties are
not part of the stable NDK libraries).
 2012-08-08 15:07:43 +02:00
Tobias Brunner 657a3ba609 Link android plugin against liblog in the NDK. 
Doesn't seem to hurt the build within the source tree.
 2012-08-08 15:07:43 +02:00
Tobias Brunner e7ea057fd2 Make the UDP ports charon listens for packets on (and uses as source ports) configurable. 2012-08-08 15:07:43 +02:00
Tobias Brunner 73940eb712 Make path to Android OpenSSL headers configurable. 2012-08-08 15:07:43 +02:00
Tobias Brunner 4528e74a5c Don't require STRONGSWAN_CONF to be defined. 2012-08-08 15:07:42 +02:00
Tobias Brunner a9f169f699 Don't require PLUGINDIR to be defined. 
If it is not available, we just load monolithically built plugins.
 2012-08-08 15:07:42 +02:00
Martin Willi 4e98ca1800 Remove queued IKEv1 message before processing it 
Avoids destruction or processing of a queued message in
recursive process_message() call.
 2012-08-08 14:54:03 +02:00
Tobias Brunner 6204c1182d Include src address in hash of initial message for Main Mode 
If two initiators use the same SPI and also use the same SA proposal the
hash for the initial message would be exactly the same.  For IKEv2 and
Aggressive Mode that's not a problem as these messages include random
data (Ni, KEi payloads).
 2012-08-08 14:47:36 +02:00
Andreas Steffen fa1baac315 implemented deletion of product_file database entries 2012-08-07 15:06:12 +02:00
Adrian-Ken Rueegsegger 9c2f08860d Add DH group 15 (MODP-3072) to IKE proposal 2012-08-06 11:22:33 +02:00
Martin Willi 7c6d6b0d89 PEM loading soft-depends on MD5 only, as unencrypted files don't need MD5 
Fixes #211.
 2012-08-03 15:25:17 +02:00
Martin Willi bd28543512 Rebuild charon after running ./configure to reflect plugin changes 2012-08-03 13:11:45 +02:00
Martin Willi 764035d515 Block XAuth transaction on established IKE_SAs, but allow Mode Config 2012-08-03 13:07:57 +02:00
Tobias Brunner decc467a4f Implemented recursive mutex without thread-specific counter 2012-08-03 11:30:18 +02:00