denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
9,630 Commits 1 Branch 0 Tags
eae5616ae69a3c289bc20d1e50ad90a2789a348b
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Martin Willi f26796deb5 Remove unused src/dst variables in send_no_marker() 2012-08-21 09:34:32 +02:00
Martin Willi 88a5abf5e2 Don't use POSIX semaphores if a MONOTONIC clock is available 
POSIX semaphores use CLOCK_REALTIME, but our semaphore_t abstraction
expects CLOCK_MONOTONIC based times. Use the mutex/condvar based
fallback if time_monotonic() actuall returns monotonic times.
 2012-08-20 18:01:20 +02:00
Martin Willi 10bdc7a968 Remove the unused second IKE_SA entry match function argument 
LLVMs clang complains about this parameter, so remove it.
 2012-08-20 17:42:14 +02:00
Martin Willi 907d3d0f1d Add a mutex/condvar based semaphore implementation if sem_timedwait is unavailable 
Fixes #214.
 2012-08-20 17:20:26 +02:00
Martin Willi a63192479d If _POSIX_SPIN_LOCKS is defined as -1, it is not available 2012-08-10 17:02:46 +02:00
Martin Willi 922fb29f89 If vstr printf functions are #defined, undef them before redefinition 
At least Mountain Lion seems to have them #defined to secure _chk
variants.
 2012-08-10 17:02:05 +02:00
Martin Willi cd55a3cb77 Use actual daemon name to enable XAuth/PSK with aggressive mode 2012-08-10 11:53:18 +02:00
Martin Willi 3423b3a88a Add xauth-pam/eap-gtc NEWS 2012-08-10 11:50:44 +02:00
Martin Willi 27128c1e32 EAP-GTC can use any XAuth backend, including xauth-pam 
This makes EAP-GTC a generic plain password authentication method,
as it is used with XAuth. Instead of verifying credentials with
PAM, any backend can be configured. The default is xauth-pam,
providing the same functionality as EAP-GTC in strongSwan 4.x.
 2012-08-10 10:43:44 +02:00
Martin Willi b9e4916321 Add xauth-pam, an XAuth backend verifying credentials with PAM 2012-08-10 10:43:44 +02:00
Martin Willi 0bac49b0a9 Add getspnam_r() to leak detective whitelist 2012-08-10 10:43:44 +02:00
Martin Willi 02cabd0f26 Check if TLS handshake received Finished before processing application data 2012-08-09 12:10:41 +02:00
Martin Willi 4e98ca1800 Remove queued IKEv1 message before processing it 
Avoids destruction or processing of a queued message in
recursive process_message() call.
 2012-08-08 14:54:03 +02:00
Martin Willi 7c6d6b0d89 PEM loading soft-depends on MD5 only, as unencrypted files don't need MD5 
Fixes #211.
 2012-08-03 15:25:17 +02:00
Martin Willi bd28543512 Rebuild charon after running ./configure to reflect plugin changes 2012-08-03 13:11:45 +02:00
Martin Willi 764035d515 Block XAuth transaction on established IKE_SAs, but allow Mode Config 2012-08-03 13:07:57 +02:00
Martin Willi f02a305569 Fix linking of addrblock plugin when building monolithic 
Fixes #212.
 2012-08-03 10:50:21 +02:00
Martin Willi 394b9f6b65 Reject initial exchange messages early once IKE_SA is established 2012-08-02 13:04:54 +02:00
Martin Willi 804d702b0a Add some more NEWS about 5.0.1 2012-08-02 12:23:59 +02:00
Martin Willi 11d6bc3eb0 Move MODP_CUSTOM va_arg fetching out of loop 
It seems problematic at least on PPC with gcc 4.3, fixes #208.
 2012-08-02 12:08:27 +02:00
Martin Willi f701ba8389 Lookup IKEv1 PSK even if the peer identity is not known 2012-07-31 15:39:33 +02:00
Martin Willi 777bcdc0d5 Don't include acquiring packet traffic selectors in IKEv1 
As we only can negotiate a single TS in IKEv1, don't prepend the
triggering packet TS, as we do in IKEv2. Otherwise we don't establish
the TS of the configuration, but only that of the triggering packet.

Fixes #207.
 2012-07-26 15:45:49 +02:00
Martin Willi 8b560a4565 Implement late peer config switching after XAuth authentication 
If additional authentication constraints, such as group membership,
is not fulfilled by an XAuth backend, we search for another
peer configuration that fulfills all constraints, including those
from phase1.
 2012-07-26 15:17:36 +02:00
Martin Willi 40ca05cff8 Check if XAuth round complies to configured authentication round 2012-07-26 12:40:27 +02:00
Martin Willi 6a8786b55f Show which group would be required when failing in constraint check 2012-07-26 12:39:53 +02:00
Martin Willi 874f7c7e2c Don't add ANY identity constraint to auth config, as XAuth rounds don't use one 2012-07-26 12:38:34 +02:00
Martin Willi 9191946a63 Merge auth config items added from XAuth backends to IKE_SA 2012-07-26 12:07:48 +02:00
Martin Willi 46df61dff7 Add an ipsec.conf leftgroups2 parameter for the second authentication round 2012-07-26 11:51:58 +02:00
Martin Willi 81419807f5 Release leaking child config after uninstalling shunt policy 2012-07-23 17:15:40 +02:00
Martin Willi 3b7468b245 Support Unity split-include/exclude options in attr plugin 2012-07-20 17:36:27 +02:00
Martin Willi 73514b3217 Don't print hexdumps on loglevel 1 if hash verification fails 2012-07-20 17:36:27 +02:00
Martin Willi eb1b380a1c Add a libstrongswan-dev debian package with development headers 2012-07-19 13:55:02 +02:00
Martin Willi 328447acd5 Pass CC/CFLAGS to ./configure, not to make, adding -include config.h 2012-07-19 13:55:02 +02:00
Martin Willi 5084c13f6d Upgraded our Debian package to 5.0 2012-07-19 13:55:02 +02:00
Martin Willi 09e3717525 Fix EAP-MSCHAPv2 master key derivation, broken with 87dd205b 2012-07-18 16:46:05 +02:00
Martin Willi e7600ca696 Remove debugging leftovers 2012-07-18 15:35:40 +02:00
Martin Willi 5d2698dd62 Add a SHA1 test vector forcing padding over block boundary 2012-07-18 15:10:29 +02:00
Martin Willi 8217c099ce Add a tool to burn hashers 2012-07-17 17:32:08 +02:00
Martin Willi c63fb853e8 Use centralized hasher names in pki utility 2012-07-17 17:32:05 +02:00
Martin Willi 6719889e0a Use centralized hasher names in coupling plugin 2012-07-17 17:32:03 +02:00
Martin Willi 610f90a8b9 Use centralized hasher names in openssl plugin 2012-07-17 17:32:00 +02:00
Martin Willi 4b96000833 Add short names for hasher algorithms 2012-07-17 17:31:55 +02:00
Martin Willi 2df12b4c57 Fix tls_prf bug introduced with bc474883 2012-07-17 11:33:05 +02:00
Martin Willi 082b0d7249 Support void return values in OpenSSL 0.9.8 HMAC functions 2012-07-17 10:58:53 +02:00
Martin Willi ff9e46772f Handle PRF failures in eap-aka-3gpp2 2012-07-16 14:55:08 +02:00
Martin Willi a564e4ca77 Refactored error handling in keymat_v1_t 2012-07-16 14:55:07 +02:00
Martin Willi 4decfae6c2 Clean up error handling in keymat_v2_t 2012-07-16 14:55:07 +02:00
Martin Willi 511f0b18b9 Cleaned up memory management and return values for encryption payload 2012-07-16 14:55:07 +02:00
Martin Willi 0d6183f0a9 Fix memory management in SIM/AKA crypto functions 2012-07-16 14:55:07 +02:00
Martin Willi 44fc169579 Test reset() of hasher in crypto tester 2012-07-16 14:55:07 +02:00
Martin Willi 67ea663d7c Refactored error handling in crypto tester 2012-07-16 14:55:07 +02:00
Martin Willi 73264a81b8 Set a key before benching PRFs 2012-07-16 14:55:07 +02:00
Martin Willi 3aca89c8e6 Resetting OpenSSL HMAC with NULL key reuses existing key 2012-07-16 14:55:07 +02:00
Martin Willi 9138f49e6a Make sure HMAC_Init is called before HMAC_Update, fixes crash 2012-07-16 14:55:07 +02:00
Martin Willi ae4411547a Check and forward syscall errors in AF_ALG 2012-07-16 14:55:07 +02:00
Martin Willi e3b2e900e6 Add a return value to hasher_t.reset() 2012-07-16 14:55:06 +02:00
Martin Willi 87dd205b61 Add a return value to hasher_t.allocate_hash() 2012-07-16 14:55:06 +02:00
Martin Willi e185612dd8 Add a return value to keymat_v1_t.{get,update,confirm}_iv 2012-07-16 14:55:06 +02:00
Martin Willi 8bd6a30af1 Add a return value to hasher_t.get_hash() 2012-07-16 14:55:06 +02:00
Martin Willi ce73fc19db Add a return value to crypter_t.set_key() 2012-07-16 14:53:38 +02:00
Martin Willi 3b96189a2a Add a return value to crypter_t.decrypt() 2012-07-16 14:53:38 +02:00
Martin Willi e35abbe588 Add a return value to crypter_t.encrypt 2012-07-16 14:53:37 +02:00
Martin Willi c3858662d2 Identation fixes, warn about unused nonce_gen return values 2012-07-16 14:53:37 +02:00
Martin Willi 6ac8d861d9 Add a return value to mac_t.set_key() 2012-07-16 14:53:37 +02:00
Martin Willi 27e1eabbb5 Add a return value to mac_t.get_bytes() 2012-07-16 14:53:37 +02:00
Martin Willi 76a98ee2a1 Check rng return value when generating libfast session COOKIEs 2012-07-16 14:53:37 +02:00
Martin Willi 71c41410fc Initialize conftest with the same plugins as charon 2012-07-16 14:53:37 +02:00
Martin Willi a6733d8e85 Remove unused replay variable in conftests seq number reset hook 2012-07-16 14:53:37 +02:00
Martin Willi 172fdf8bd1 Update conftest to use splitted listener/logger interfaces 2012-07-16 14:53:37 +02:00
Martin Willi bb5eb15ccc Check rng return value when generating TLS session identifiers 2012-07-16 14:53:37 +02:00
Martin Willi 6a3e4ed916 Check rng return value when generating SIM/AKA message IVs 2012-07-16 14:53:37 +02:00
Martin Willi 3629740c7f Check rng return value when generating radius message authenticator 2012-07-16 14:53:37 +02:00
Martin Willi f3ca96b2bf Add a return value to prf_t.set_key() 2012-07-16 14:53:34 +02:00
Martin Willi ecc080b393 Add a return value to prf_t.allocate_bytes() 2012-07-16 14:53:34 +02:00
Martin Willi a7e6539135 Use a bool return value in keymat_v1_t.get_hash_phase2() 2012-07-16 14:53:34 +02:00
Martin Willi e4c5c1d03e Add a return value to keymat_v1_t.get_hash() 2012-07-16 14:53:34 +02:00
Martin Willi bb1e0c59e1 Add a return value to keymat_v2_t.get_auth_octets() 2012-07-16 14:53:34 +02:00
Martin Willi 2baae8e3ea Add a return value to keymat_v2_t.get_psk_sig() 2012-07-16 14:53:34 +02:00
Martin Willi bc47488323 Add a return value to prf_t.get_bytes() 2012-07-16 14:53:33 +02:00
Martin Willi e7d98b8c99 Add a return value to tls_prf_t.set_key() 2012-07-16 14:53:33 +02:00
Martin Willi 97b30b93b0 Add a return value to tls_prf_t.get_bytes() 2012-07-16 14:53:33 +02:00
Martin Willi edd54734c8 prf_plus_create() can return NULL on failure 2012-07-16 14:53:33 +02:00
Martin Willi 8207fe3eb3 Add a return value to prf_plus_t.get_bytes() 2012-07-16 14:53:33 +02:00
Martin Willi 5d79e6c6b4 Add a return value to prf_plus_t.allocate_bytes() 2012-07-16 14:53:33 +02:00
Martin Willi 2d56575d52 Add a return value to signer_t.set_key() 2012-07-16 14:53:33 +02:00
Martin Willi 9020f7d0b9 Add a return value to tls_crypto_t.derive_secrets() 2012-07-16 14:53:33 +02:00
Martin Willi 86d2cdc1ed Add a return value to simaka_crypto_t.derive_keys_*() 2012-07-16 14:53:33 +02:00
Martin Willi 2e96de60a8 Add a return value to signer_t.get_signature() 2012-07-16 14:53:33 +02:00
Martin Willi 5fb719e0de Add a return value to radius_message_t.sign() 2012-07-16 14:53:33 +02:00
Martin Willi 264e702109 Add a return value to simaka_message_t.generate() 2012-07-16 14:53:33 +02:00
Martin Willi cbfbba7d86 Add a return value to signer_t.allocate_signature() 2012-07-16 14:53:32 +02:00
Martin Willi ad08730a4b Add a return value to aead_t.set_key() 2012-07-16 14:53:32 +02:00
Martin Willi e2ed7bfd22 Add a return value to aead_t.encrypt() 2012-07-16 14:53:32 +02:00
Martin Willi d19f0ae3e0 Don't modify the message string passed to logger, as it gets reused 2012-07-13 15:43:04 +02:00
Martin Willi d35e45b939 Invoke autoheader after libtool/aclocal to work on up-to-date data 2012-07-13 13:43:38 +02:00
Martin Willi 40ae0feeb1 Silence cast warning on 32-bit platforms 2012-07-13 13:43:16 +02:00
Martin Willi 0e3c697c05 Don't set BFD_DECOMPRESS when building against older binutils 2012-07-13 13:42:31 +02:00
Martin Willi c6343cf0ad Log to a malloc()ed buffer if the on-stack buffer is not large enough 2012-07-13 13:23:29 +02:00
Martin Willi 060555f082 Append directly to base string in vstr printf hooks 2012-07-13 13:23:29 +02:00
Martin Willi 4addc415a5 Write directly to FILE stream in glibc printf hooks 2012-07-13 13:23:29 +02:00