denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
11,900 Commits 1 Branch 0 Tags
ef4560121dd5590b53b52ad1a048766fba90e8e2
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Tobias Brunner 3e3db3743e xauth-pam: Make trimming of email addresses optional 
Fixes #430.
 2013-10-04 10:49:54 +02:00
Tobias Brunner e4b7b48c1e eap-radius: Increase buffer for attributes sent in RADIUS accounting messages 
64 bytes might be too short for user names/identities.
 2013-09-27 13:37:12 +02:00
Tobias Brunner c8f34ba7b6 openssl: Properly log FIPS mode when enabled via openssl.conf 
Enabling FIPS mode twice will fail, so if it is enabled in openssl.conf
it should be disabled in strongswan.conf (or the other way around).

Either way, we should log whether FIPS mode is enabled or not.

References #412.
 2013-09-27 09:24:03 +02:00
Tobias Brunner e4d63cfae7 android: New release after fixing remediation instructions regression 2013-09-26 13:53:39 +02:00
Tobias Brunner 00f7b29422 android: Change progress dialog handling 
With the previous code the dialog sometimes was hidden for a short while
before it got reopened.
 2013-09-26 13:53:25 +02:00
Tobias Brunner cfed5679b8 android: Clear remediation instructions when starting a new connection 2013-09-26 13:00:45 +02:00
Tobias Brunner a2cebbe674 starter: Don't ignore keyingtries with rekey=no 
Since keyingtries also affects the number of retries initially or when
reestablishing an SA it should not be affected by the rekey option.

Fixes #418.
 2013-09-26 10:17:48 +02:00
Tobias Brunner 90031b2fc7 load-tester: Fix crash if private key was not loaded successfully 
Fixes #417.
 2013-09-24 09:27:12 +02:00
Tobias Brunner ed72f2d65e printf-hook: Write to output stream instead of the FD directly when using Vstr 
This avoids problems when other stdio functions are used (fputs,
fwrite) as writes via Vstr/FD were always unbuffered.
 2013-09-24 08:44:00 +02:00
Tobias Brunner c17cbfdb72 android: New release after improving recovery after connectivity changes 2013-09-23 14:33:29 +02:00
Tobias Brunner 3817231333 android: Change state handling to display errors occurring while the app is hidden 
A new connection ID allows listeners to track which errors they have
already shown to the user or were already dismissed by the user.

This was necessary because the state fragment is now unregistered from
state changes when it is not shown.
 2013-09-23 12:01:43 +02:00
Tobias Brunner b4a5b185fc android: Don't update state fragments when they are not displayed 
Besides that updates don't make much sense when the fragments are not
displayed this fixes the following exception:
	java.lang.IllegalStateException: Can not perform this action after
		onSaveInstanceState
 2013-09-23 12:01:42 +02:00
Tobias Brunner 561f94ae58 ikev2: Force an update of the host addresses on the first response 
This is especially useful on Android where we are able to send messages
even if we don't know the correct local address (this is possible
because we don't set source addresses in outbound messages).  This way
we may learn the correct local address if it e.g. changed right before
reestablishing an SA.

Updating the local address later is tricky without MOBIKE as the
responder might not update the associated IPsec SAs properly.
 2013-09-23 11:50:12 +02:00
Tobias Brunner 9292357030 ike-sa: Resolve hosts before reestablishing an IKE_SA 2013-09-23 11:49:52 +02:00
Tobias Brunner e3f64a79c2 android: Several plugins were moved from libcharon to libtnccs 
These were moved in commits e8f65c5cde and 12b3db5006.
 2013-09-23 11:49:52 +02:00
Tobias Brunner c3ee829eee android: Properly handle failures while initializing charon 2013-09-23 11:49:52 +02:00
Tobias Brunner aadf2e01e7 Merge branch 'pubkeys' 
Adds support to pki --pub to convert public keys to other formats
including SSH keys and DNSKEYs.  SSH public keys can also be read
from files in the format used by OpenSSH.
 2013-09-13 15:30:40 +02:00
Tobias Brunner 075e80368b sshkey: Add support for parsing keys from files 2013-09-13 15:23:49 +02:00
Tobias Brunner b2a5317596 sshkey: Add encoding for ECDSA keys 2013-09-13 15:23:49 +02:00
Tobias Brunner d6b3cc87ca openssl: Add support for generic encoding of EC public keys 2013-09-13 15:23:49 +02:00
Tobias Brunner 90afd2c929 pki: --pub also accepts public keys (i.e. to convert them to a different format) 2013-09-13 15:23:49 +02:00
Tobias Brunner 21626bdf77 pki: Add support to encode public keys in SSH key format 2013-09-13 15:23:49 +02:00
Tobias Brunner f40e9f4d16 sshkey: Add encoder for RSA keys 2013-09-13 15:23:49 +02:00
Tobias Brunner 3b939e20a9 openssl: Add generic RSA public key encoding 2013-09-13 15:23:49 +02:00
Tobias Brunner b5cc7053c8 openssl: Add helper function to convert BIGNUMs to chunks 2013-09-13 15:23:49 +02:00
Tobias Brunner a3232fa802 pki: Load dnskey plugin to encode public keys in RFC 3110 format 2013-09-13 15:23:48 +02:00
Tobias Brunner d6c43847be Merge branch 'man-pki' 
This adds man pages for all pki sub-commands and promotes pki to a
regular program installed in $prefix/bin.

The usage output of several commands was fixed too.
 2013-09-13 15:17:04 +02:00
Tobias Brunner ed56c86ec1 pki: Don't print an error if no arguments are given 2013-09-13 15:14:00 +02:00
Tobias Brunner 0dc8ba8779 pki: Install pki(1) as utility directly in $prefix/bin 
ipsec pki is maintained as alias.
 2013-09-13 15:07:36 +02:00
Tobias Brunner 1a8ffea315 pki: Add example commands to setup a simple CA 2013-09-13 15:07:36 +02:00
Tobias Brunner b068c4ec9d pki: Add pki --verify man page 2013-09-13 15:07:36 +02:00
Tobias Brunner 4adeaa5eb9 pki: Add pki --pub man page 2013-09-13 15:07:36 +02:00
Tobias Brunner a319eff80d pki: Add pki --print man page 2013-09-13 15:07:35 +02:00
Tobias Brunner e69fd30538 pki: Add pki --keyid man page 2013-09-13 15:07:35 +02:00
Tobias Brunner 558771400e pki: Add pki --pkcs7 man page 2013-09-13 15:07:35 +02:00
Tobias Brunner bb8e2e1759 pki: Add pki --req man page 2013-09-13 15:07:35 +02:00
Tobias Brunner 96aa5a1ddd pki: Add pki --signcrl man page 2013-09-13 15:07:35 +02:00
Tobias Brunner 42e3a21e24 pki: Add pki --issue man page 2013-09-13 15:07:35 +02:00
Tobias Brunner 3a643b8901 pki: Add pki --self man page 
Can be opened with "man pki --self".
 2013-09-13 15:07:35 +02:00
Tobias Brunner a612f6e338 pki: Add pki --gen man page 
Can be opened with "man pki --gen".
 2013-09-13 15:07:29 +02:00
Tobias Brunner 34cff9349b pki: Add ipsec-pki(8) man page 
Can be opened either with "man ipsec pki" or "man ipsec-pki".

Since man(1) only supports one level of subpages, the forthcoming man
pages for each command will have to be opened with "man pki --<command>".
 2013-09-13 14:32:51 +02:00
Tobias Brunner b07aee496a strongswan.conf: Use configured piddir for UNIX sockets 2013-09-13 14:32:51 +02:00
Tobias Brunner 8250fc10e8 Build generated man pages via configure script 2013-09-13 14:32:51 +02:00
Tobias Brunner f5dcb38ead resolve: Remove comment when using resolvconf(8) 
Since comments in resolv.conf are only valid at the beginning of a line
resolvconf(8) seems to have started treating any text after
'nameserver <ip>' as additional IP addresses for name servers.

Since it ignores comments, and we can easily remove the added servers
again, there is no point to add any.

Fixes #410.
 2013-09-13 14:13:21 +02:00
Tobias Brunner 11ac36b016 conftest: Don't load plugins incrementally 
This is not supported by the plugin loader, so we simply combine the
plugin lists and load them all at once.
 2013-09-13 11:44:04 +02:00
Tobias Brunner fafa768478 ikev1: Fix double free when searching for redundant CHILD_SAs 
Fixes #411.
 2013-09-13 10:14:45 +02:00
Tobias Brunner be8179abd2 Build all IMC/IMVs with -no-undefined 2013-09-12 01:44:50 +02:00
Tobias Brunner 7d87b24634 pt-tls-client: Report loaded plugins 2013-09-12 01:44:49 +02:00
Tobias Brunner 5d45bcfc5f pt-tls-client: Abort if no tnccs-manager is available 2013-09-12 01:44:49 +02:00
Tobias Brunner 9af44ef5d9 Build all shared libraries with -no-undefined and link them properly 
The flag is required to convince libtool on Cygwin to build DLLs. But on
Windows these shared libraries can not have undefined symbols, so we have to
link them explicitly to the libraries they reference.

For plugins this is currently not done, so only the monolithic build is
supported.  The plugin loader wouldn't be able to load DLLs anyway, as
it tries to load files that don't exist on Cygwin.
 2013-09-12 01:44:49 +02:00
Tobias Brunner 3cb4552da6 configure: libtls and libtnccs etc. all require libstrongswan 2013-09-12 01:44:49 +02:00
Tobias Brunner bf32cdfbf6 tun_device: Add warning if TUN devices are not supported by platform 2013-09-12 01:44:49 +02:00
Tobias Brunner 4eb6149ae8 sockets: Initialize the whole ancillary data buffer not only the actual struct 
This avoids uninitialized bytes that Valgrind seems to notice otherwise.

Fixes #395.
 2013-09-10 13:42:59 +02:00
Tobias Brunner 70aefb9430 Store object files in the same directory as the source files 
Future automake releases will apparently do that implicitly, but current
releases spit out nasty warning messages.
 2013-09-05 14:24:26 +02:00
Tobias Brunner a4b996c0bc libipsec: Properly initialize variables when creating AEAD wrapper 2013-09-04 16:18:29 +02:00
Tobias Brunner c742905f50 android: Fix compilation after PTS header files were moved 2013-09-04 16:18:29 +02:00
Tobias Brunner cd764f42b9 libpts: Android.mk updated 2013-09-04 16:18:29 +02:00
Tobias Brunner 0b47bb5377 pubkey_speed: Add missing plugins 
The pkcs1 plugin is required to test the gmp/gcrypt plugins. Likewise,
the pem plugin is required when testing the openssl plugin.

Fixes #401.
 2013-09-04 10:01:46 +02:00
Tobias Brunner f17322dccb pubkey_speed: sudo is not required 
Also, refer to pubkey_speed properly when not being called from the same
directory.
 2013-09-04 09:53:36 +02:00
Tobias Brunner f1d5d87619 pubkey_speed: Add header and fix usage 2013-09-04 09:53:36 +02:00
Tobias Brunner 5ee0747cfd autoconf: Split PACKAGE_VERSION in four parts 
The parts can be accessed with the variables:

	PACKAGE_VERSION_MAJOR
	PACKAGE_VERSION_MINOR
	PACKAGE_VERSION_BUILD
	PACKAGE_VERSION_REVIEW

The last part will be empty for regular releases.
 2013-09-02 11:30:24 +02:00
Tobias Brunner 10a69c32c2 conftest: Fix hook constructor resolution via dlsym() 
AM_CPPFLAGS only takes preprocessor flags like -I or -D, so it did not
forward -rdynamic to the linker (--export-dynamic), which meant that the
symbols defined in the executable itself were not resolvable via dlsym().

Fixes #394.
 2013-08-30 19:45:51 +02:00
Tobias Brunner 2a7a9471dd aes-test: Rename crypt() as it conflicts with a library function on Mac OS X 
unistd.h on Linux defines this only if _XOPEN_SOURCE is defined.
 2013-08-30 08:51:09 +02:00
Tobias Brunner 9455f8b386 aes-test: Support test vectors at the end of a file 2013-08-24 16:22:51 +02:00
Tobias Brunner 8972c72237 aes-test: Add script to test AES implementations according to AESAVS/GCMVS 2013-08-24 16:22:51 +02:00
Tobias Brunner f0c54e8c15 chunk: Print chunks without separator if + modifier is used 2013-08-24 16:22:51 +02:00
Tobias Brunner 32a145fdbd utils: Add case-insensitive version of strpfx() 2013-08-24 16:22:51 +02:00
Tobias Brunner d7ae0b254d kernel: Restore enumeration of all addresses when searching for address in TS 
Since f52cf07532 addresses on ignored, down or loopback interfaces were
not considered as valid addresses anymore when searching for an address
contained in the local traffic selector.  This meant that route
installation failed, for instance, if charon.install_virtual_ip_on was
set to 'lo', or, on gateways, if internal interfaces were ignored with
the charon.interfaces_* options.
 2013-08-21 17:01:03 +02:00
Tobias Brunner 85ca2f7441 conftest: Disable reset_seq hook on systems other than Linux 
Fixes #386.
 2013-08-21 11:27:28 +02:00
Tobias Brunner e001cc2b07 kernel-netlink: Fix calculation of ESN bitmap length 
While bmp_len stores the number of u_int32_t the allocated bitmap
actually consists of those integers.
 2013-08-21 08:28:12 +02:00
Tobias Brunner f853e7bcc0 ikev1: Fix calculation of the number of fragments 
The old code resulted in too few fragments in some cases.
 2013-08-15 15:15:34 +02:00
Tobias Brunner c81a6ff907 ikev1: When sending fragments, use ports to decide if a non-ESP marker is added 
This is same same logic used by sender and might apply in some cases (e.g.
when initiating to port 4500).
 2013-08-15 15:12:00 +02:00
Tobias Brunner e42ab08a73 ikev2: Fix segfault when reestablishing CHILD_SAs due to closeaction=restart|hold 
This regression was introduced with c949a4d5.
 2013-08-13 10:08:08 +02:00
Tobias Brunner 3f29ff82c3 libipsec: Don't limit traditional algorithms to AES and SHA1/2 
Closes #377.
 2013-08-12 12:21:57 +02:00
Tobias Brunner 11f468533f kernel-netlink,pfroute: Properly update address flag within ROAM_DELAY 
77d4a02 and 55da01f only updated the address flag when a job was created,
which obviously had the same limitation as the old code.

Fixes #374.
 2013-08-12 12:08:23 +02:00
Tobias Brunner 55da01f348 kernel-pfroute: Implement roam event handling like in the kernel-netlink plugin 
There was no proper locking and the issue regarding the address
flag also existed.
 2013-08-12 12:03:48 +02:00
Tobias Brunner 77d4a0281a kernel-netlink: Ensure address changes are not missed in roam events 
If multiple roam events are triggered within ROAM_DELAY, only one job is
created.  The old code set the address flag to the value of the last
triggering call.  So if a route change followed an address change within
ROAM_DELAY the address change was missed by the upper layers, e.g. causing
it not to update the list of addresses via MOBIKE.

The new code now keeps the state of the address flag until the job is
actually executed, which still has some issues.  For instance, if an
address disappears and reappears within ROAM_RELAY, the flag would not
have to be set to TRUE.  So address updates might occasionally get
triggered where none would actually be required.

Fixes #374.
 2013-08-12 12:02:55 +02:00
Tobias Brunner e99cfe5f20 strongswan.conf: Add note about reserved threads 2013-08-07 09:06:01 +02:00
Tobias Brunner 58e32e4871 tnc-pdp: Initialize struct msghdr properly when reading RADIUS messages 
Before this e.g. msg_controllen was not initialized properly which could
cause invalid reads.
 2013-07-31 22:16:58 +02:00
Tobias Brunner 3a938a6f85 NEWS: Add info about CVE-2013-5018 2013-07-31 22:16:58 +02:00
Tobias Brunner d12fc14616 whitelist: Fix compilation on FreeBSD 2013-07-31 22:16:58 +02:00
Tobias Brunner ed0efaef4c host: Properly initialize struct sockaddr_in[6] when parsing strings 
Otherwise struct members like sin6_flowinfo or sin6_scope_id might be
set to bogus values.
 2013-07-31 22:16:58 +02:00
Tobias Brunner b3393c88c1 asn1: Fix handling of invalid ASN.1 length in is_asn1() 
Fixes CVE-2013-5018.
 2013-07-31 22:16:58 +02:00
Tobias Brunner a566c5f837 receiver: Avoid cloning packet data when verifying COOKIE payloads 
Besides being more efficient this removes a memory leak that occurred
when a COOKIE payload was successfully verified.

Fixes #369.
 2013-07-29 22:04:24 +02:00
Tobias Brunner 1cf8022839 unity: Handle multi-valued UNITY_SPLIT_INCLUDE/UNITY_LOCAL_LAN attributes 
Cisco devices seem to add 6 bytes of padding between each address/mask
pair.

Fixes #366.
 2013-07-29 21:44:27 +02:00
Tobias Brunner 4dc8978000 ikev2: Only schedule half-open-timeout delete job after successfully handling IKE_SA_INIT 
We want to avoid this allocation if the initial message is invalid (e.g.
if the message ID is != 0).
 2013-07-29 11:25:43 +02:00
Tobias Brunner 77ccff82cf ikev1: Always send ID payloads (traffic selectors) during Quick Mode 
Especially Windows 7 has problems if the peer does not send ID payloads
for host-to-host connections (tunnel and transport mode).

Fixes #319.
 2013-07-25 17:08:17 +02:00
Tobias Brunner 1f2d9c7688 watcher: Made notify array initialization compatible with older GCC versions 2013-07-25 16:57:42 +02:00
Tobias Brunner ebb4ad1baa unit-tests: Add additional tests for host_t 2013-07-25 11:28:26 +02:00
Tobias Brunner 7a192c57a3 imv-attestation: Properly measure complete directories 2013-07-25 11:28:26 +02:00
Tobias Brunner 116363e5c6 array: Number of items in get_size() is unsigned 
Otherwise, array->esize is promoted to int and if array->esize * num
results in a value > 0x7fffffff the return value would be incorrect due
the implicit sign extension when getting cast to size_t.
 2013-07-25 11:28:01 +02:00
Tobias Brunner d7dc4fedd1 stream: Ensure UNIX socket path is null terminated 2013-07-24 16:17:23 +02:00
Tobias Brunner e7d717cf01 kernel-pfkey: Add sanity check when deleting policies 2013-07-24 16:17:22 +02:00
Tobias Brunner e5455e9413 imv-os: check_packages() fails if product query fails 2013-07-24 16:17:22 +02:00
Tobias Brunner cfca183d55 pkcs5: Add missing break statements when checking crypto primitives 2013-07-24 16:17:22 +02:00
Tobias Brunner 346a4a1fc2 imv-scanner: Properly check snprintf() return value 2013-07-24 16:17:22 +02:00
Tobias Brunner 16748bdff7 socket-dynamic: Properly initialize IPv6 address 2013-07-24 16:17:22 +02:00
Tobias Brunner 5baec6448d unit-tests: Add test for host_create_netmask() 2013-07-24 16:17:21 +02:00
Tobias Brunner 6e2ec33f9d host: Prevent overflow in host_create_netmask() if mask is 0 or 32/128 2013-07-24 16:17:03 +02:00
Tobias Brunner a00ac1d9ee imv-attestation: Use proper cast for length when using %.*s 2013-07-24 10:54:47 +02:00