denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
17,377 Commits 1 Branch 0 Tags
ff8f6b15aa5405d627179f9d653103bc6364d69a
Commit Graph
98 Commits
Author SHA1 Message Date
Tobias Brunner ff8f6b15aa charon-nm: Add support for custom local IKE identities 2020-02-14 14:35:44 +01:00
Tobias Brunner 5575aaf5c8 charon-nm: Keep listener registered even on failures 
NM doesn't seem to terminate the daemon on failures, so we might not get
further events for later retries.
 2020-02-14 13:55:42 +01:00
Tobias Brunner 3d2f5ae003 charon-nm: Support reauthentication and redirection 2020-02-14 13:55:42 +01:00
Tobias Brunner bc3eda99ba charon-nm: Add support for EAP-TLS 
The code is structured similar to that in the Android client, but two-round
authentication (cert+EAP) is not supported as that might require multiple
secrets ("password" is currently the only secret field used for every
method) and other details are currently missing too (like configurable
client identities).
 2020-02-14 13:44:39 +01:00
Tobias Brunner 60777574c1 charon-nm: Add support for custom server ports 2020-02-14 13:36:16 +01:00
Tobias Brunner 19e64e101d charon-nm: Add support for a specific remote identity 2020-02-14 11:19:49 +01:00
Josh Soref b3ab7a48cc Spelling fixes 
* accumulating
* acquire
* alignment
* appropriate
* argument
* assign
* attribute
* authenticate
* authentication
* authenticator
* authority
* auxiliary
* brackets
* callback
* camellia
* can't
* cancelability
* certificate
* choinyambuu
* chunk
* collector
* collision
* communicating
* compares
* compatibility
* compressed
* confidentiality
* configuration
* connection
* consistency
* constraint
* construction
* constructor
* database
* decapsulated
* declaration
* decrypt
* derivative
* destination
* destroyed
* details
* devised
* dynamic
* ecapsulation
* encoded
* encoding
* encrypted
* enforcing
* enumerator
* establishment
* excluded
* exclusively
* exited
* expecting
* expire
* extension
* filter
* firewall
* foundation
* fulfillment
* gateways
* hashing
* hashtable
* heartbeats
* identifier
* identifiers
* identities
* identity
* implementers
* indicating
* initialize
* initiate
* initiation
* initiator
* inner
* instantiate
* legitimate
* libraries
* libstrongswan
* logger
* malloc
* manager
* manually
* measurement
* mechanism
* message
* network
* nonexistent
* object
* occurrence
* optional
* outgoing
* packages
* packets
* padding
* particular
* passphrase
* payload
* periodically
* policies
* possible
* previously
* priority
* proposal
* protocol
* provide
* provider
* pseudo
* pseudonym
* public
* qualifier
* quantum
* quintuplets
* reached
* reading
* recommendation to
* recommendation
* recursive
* reestablish
* referencing
* registered
* rekeying
* reliable
* replacing
* representing
* represents
* request
* request
* resolver
* result
* resulting
* resynchronization
* retriable
* revocation
* right
* rollback
* rule
* rules
* runtime
* scenario
* scheduled
* security
* segment
* service
* setting
* signature
* specific
* specified
* speed
* started
* steffen
* strongswan
* subjectaltname
* supported
* threadsafe
* traffic
* tremendously
* treshold
* unique
* uniqueness
* unknown
* until
* upper
* using
* validator
* verification
* version
* version
* warrior

Closes strongswan/strongswan#164.
 2020-02-11 18:23:07 +01:00
Tobias Brunner 18bee9306a nm: Replace deprecated g_type_class_add_private() 
Fixes #2765, #3197.
 2020-02-05 10:54:37 +01:00
worldofpeace 9b0cc5c5cb charon-nm: Move D-Bus conf file to $(datadir)/dbus-1/system.d 
Since D-Bus 1.9.18 configuration files installed by third-party should
go in share/dbus-1/system.d. The old location is for sysadmin overrides.

Closes strongswan/strongswan#150.
 2019-09-17 10:33:01 +02:00
Sheena Mira-ato fe3ae5be5d Add compile option to disable internal handling of fatal signals 
By default, charon and its derivatives internally handle the SIGSEGV,
SIGILL, and SIGBUS signals raised by threads (segv_handler).  Add a compile
option so that the signal handling can optionally be done externally.

Closes strongswan/strongswan#132.
 2019-05-28 10:44:48 +02:00
Tobias Brunner 9486a2e5b0 ike-cfg: Pass arguments as struct 2019-04-25 14:31:33 +02:00
Tobias Brunner 05b7f1cbfe charon-nm: Add IPv6 support 2019-03-14 13:42:08 +01:00
Tobias Brunner 0af3a4f103 charon-nm: Handle IPv6 DNS server attributes 2019-03-14 13:42:08 +01:00
Tobias Brunner 0b117dc960 charon-nm: Set local address to %any so IPv6 may be used as outer address 2019-03-14 13:42:08 +01:00
Tobias Brunner 5538e29071 charon-nm: Request virtual IPv6 address and appropriate TS 2019-03-14 13:42:08 +01:00
SC Lee 3a41febb1c charon-nm: Parse any type of private key in need_secrets 
Previously, when the user supplied an ECDSA key for public key authentication,
the user was always asked to provide a password, even if the key was not
encrypted.

Related: 954f73ea6e ("charon-nm: Parse any type of private key not only RSA")
Closes strongswan/strongswan#108.
 2018-07-09 12:21:43 +02:00
Tobias Brunner 1b67166921 Unify format of HSR copyright statements 2018-05-23 16:32:53 +02:00
Tobias Brunner 7b72909774 controller: Add option to force destruction of an IKE_SA 
It's optionally possible to wait for a timeout to destroy the SA.
 2018-05-22 10:06:07 +02:00
Tobias Brunner 954f73ea6e charon-nm: Parse any type of private key not only RSA 2018-03-07 15:23:03 +01:00
Tobias Brunner ee8c25516a charon-nm: Fix building list of DNS/MDNS servers with libnm 
g_variant_builder_add() creates a new GVariant using g_variant_new() and
then adds it to the builder.  Passing a GVariant probably adds the
pointer to the array, not the value.  I think an alternative fix would
be to use "@u" as type string for the g_variant_builder_add() call, then
the already allocated GVariant is adopted.

Fixes: 9a71b7219c ("charon-nm: Port to libnm")
 2018-02-22 09:05:48 +01:00
Tobias Brunner 268a1bfa34 charon-nm: Remove unused variable 2018-02-05 15:11:03 +01:00
Lubomir Rintel 9a71b7219c charon-nm: Port to libnm 
libnm-glib is deprecated for several years and reaching the end of its
life. Let's switch to the more up-to-date library.

Closes strongswan/strongswan#85.
 2017-12-22 10:05:10 +01:00
Tobias Brunner 525cc46cab Change interface for enumerator_create_filter() callback 
This avoids the unportable 5 pointer hack, but requires enumerating in
the callback.
 2017-05-26 13:56:44 +02:00
Tobias Brunner 95a63bf281 Migrate all enumerators to venumerate() interface change 2017-05-26 13:56:44 +02:00
Tobias Brunner 749ac175fa child-cfg: Use flags for boolean options 
Makes it potentially easier to add new flags.
 2017-05-23 16:51:15 +02:00
Tobias Brunner f6d0965a4c charon-nm: Fix typo to actually use random NAT-T port 
Fixes: af16b5afb0 ("Use random ports in NetworkManager backend")
 2017-05-19 15:22:51 +02:00
Defunct 4ac68f02f2 charon-nm: IKE/ESP proposal customization support 
Closes strongswan/strongswan#69.
 2017-05-08 14:33:58 +02:00
Tobias Brunner 9665686bd8 daemon: Use separate method to set default loggers 
This way it is not necessary to pass the same values to reload the
loggers.
 2017-01-25 14:58:09 +01:00
Tobias Brunner 07bbd2f642 nm: Enable IKE fragmentation 2016-10-20 08:03:26 +02:00
Tobias Brunner b9c4b15a53 nm: Add D-Bus policy to the distribution 2016-10-14 14:11:23 +02:00
Tobias Brunner 97c74b565b nm: Make global CA directory configurable 2016-10-04 10:27:35 +02:00
Tobias Brunner a28c6269a4 nm: Remove dummy TUN device 
Recent NM releases don't insist on getting a device back from VPN
plugins.
 2016-10-04 09:57:14 +02:00
Tobias Brunner f201d86deb nm: Pass external gateway to NM 
This seems to be required by newer versions.
 2016-09-05 15:41:16 +02:00
Tobias Brunner 9e74a0952e nm: Enforce min. length for PSKs in backend 2016-09-05 15:41:15 +02:00
Lubomir Rintel 1579779119 nm: Don't do <deny send_interface="..." /> in dbus service file 
It does more than intended; apart from denying messages to that
particular interface it also denies all messages non-qualified with an
interface globally. This blocks messages completely unrelated to
strongSwan's VPN plugin, such as NetworkManager communication with the
VPN plugins.

From the dbus-daemon manual:

  Be careful with send_interface/receive_interface, because the
  interface field in messages is optional. In particular, do NOT
  specify <deny send_interface="org.foo.Bar"/>! This will cause
  no-interface messages to be blocked for all services, which is
  almost certainly not what you intended. Always use rules of the form:

  <deny send_interface="org.foo.Bar" send_destination="org.foo.Service"/>

We can just safely remove those rules, since we're sufficiently
protected by the send_destination matches and method calls are
disallowed by default anyway.

Closes strongswan/strongswan#42.
 2016-09-05 15:28:54 +02:00
Lubomir Rintel 916cd5d7ca nm: Move the D-Bus policy to charon-nm 
It's needed for useful use of charon-nm, unlike the GUI.
 2016-09-05 15:28:53 +02:00
Martin Willi 518a5b2ece configure: Check for and explicitly link against -latomic 
Some C libraries, such as uClibc, require an explicit link for some atomic
functions. Check for any libatomic, and explcily link it.
 2016-06-14 14:27:20 +02:00
Tobias Brunner 2ba5dadb12 peer-cfg: Use struct to pass data to constructor 2016-04-09 16:51:01 +02:00
Tobias Brunner 8a00a8452d child-cfg: Use struct to pass data to constructor 2016-04-09 16:51:01 +02:00
Andreas Steffen b12c53ce77 Use standard unsigned integer types 2016-03-24 18:52:48 +01:00
Tobias Brunner 28649f6d91 libhydra: Remove empty unused library 2016-03-03 17:36:11 +01:00
Tobias Brunner 88b85e022a sigwaitinfo() may fail with EINTR if interrupted by an unblocked signal not in the set 
Fixes #1213.
 2015-11-23 11:37:19 +01:00
Tobias Brunner 858148092d Replace usages of sigwait(3) with sigwaitinfo(2) 
This is basically the same call, but it has the advantage of being
supported by FreeBSD's valgrind, which sigwait() is not.

References #1106.
 2015-10-29 15:38:37 +01:00
Tobias Brunner 9b4f6cfa23 charon-nm: Disable leak-detective in charon-nm 
It segfaults immediately if it is enabled, at least on Ubuntu 14.04.
 2015-05-05 17:53:47 +02:00
Martin Willi b9be25ea39 attribute-handler: Pass full IKE_SA to handler backends 2015-02-20 13:34:56 +01:00
Martin Willi 751363275f attributes: Move the configuration attributes framework to libcharon 2015-02-20 13:34:55 +01:00
Martin Willi 5421092b75 plugin-loader: Support a reload() callback for static features 2014-09-22 13:55:12 +02:00
Martin Willi 8d74ec9e80 ike: Add an additional but separate AEAD proposal to CHILD config 
This currently has no effect: We don't include AEAD algorithms in the default
ESP proposal, as we don't know if it is supported by the backend. But as we
hopefully get an algorithm query mechanism on kernel interfaces some day, we
add the appropriate functionality nonetheless.
 2014-05-16 16:51:19 +02:00
Martin Willi 879e3d12ca ike: Add an additional but separate AEAD proposal to IKE config, if supported 2014-05-16 16:51:19 +02:00
Tobias Brunner f738753abc nm: Fix NULL-pointer dereference when handling TUN device failure 2014-04-09 16:35:46 +02:00