denozord/strongswan-ext
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
16,769 Commits 3 Branches 0 Tags
020045f4162f2bc80ff2f5f4fdf0139ba2aea3f3
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Tobias Brunner 020045f416 asn1: Remove useless assignment 2018-09-17 18:51:41 +02:00
Tobias Brunner 3ea33d15a2 mode-config: Remove useless assignment 2018-09-17 18:51:41 +02:00
Tobias Brunner c503eec92e keymat_v1: Remove useless assignment 2018-09-17 18:51:41 +02:00
Tobias Brunner 0af96ad5e7 kernel-netlink: Check return value of both halfs when installing default route in main table 2018-09-17 18:51:41 +02:00
Tobias Brunner d51a28bd5c botan: Fix leak if hasher initialization fails 2018-09-17 18:51:41 +02:00
Tobias Brunner dc09570a12 botan: Share code to generate RSA EMSA PSS signature identifier strings 2018-09-17 18:51:40 +02:00
Tobias Brunner 2788529827 botan: Remove unnecessary nested blocks and simplify keyid allocation 2018-09-17 16:41:19 +02:00
Tobias Brunner 7855ad4c9e daemon: Remove redundant assignment to time_format 2018-09-17 16:41:18 +02:00
Tobias Brunner d2a1834d01 NEWS: Added some news for 5.7.0 2018-09-12 18:41:53 +02:00
Tobias Brunner bbe72f97f9 travis: Silence git checkout for Botan 2018-09-12 17:18:15 +02:00
Tobias Brunner c46a94e0cc Merge branch 'botan-plugin' 
Adds a wrapper plugin for the Botan crypto library.

Closes strongswan/strongswan#109.
 2018-09-12 16:25:07 +02:00
Tobias Brunner 1bbb736edc travis: Use a fix revision for Botan and speed up subsequent builds via ccache 2018-09-12 16:25:00 +02:00
Tobias Brunner 24af02b00d travis: Use amalgamation build for Botan and build outside our source tree 
This merges all source files into botan_all.cpp, which reduces the build
time by almost 50%. Building outside the strongSwan tree avoids analyzing
Botan with sonarqube.
 2018-09-12 16:25:00 +02:00
Tobias Brunner a80069e7bf gcrypt: Make generic DH constructor static 2018-09-12 16:25:00 +02:00
Tobias Brunner e5d5277467 travis: Build botan plugin also in the tests that build everything 2018-09-12 16:25:00 +02:00
Tobias Brunner 9c6bcb21f0 travis: Only add the sonarcloud addon for that build 2018-09-12 16:25:00 +02:00
Tobias Brunner a5c682e87d testing: Enable Botan and the plugin 
ldconfig is required, otherwise the library won't be found by
strongSwan in the same session.

Should later be changed to 2.8.0 or a newer stable release.
 2018-09-12 16:25:00 +02:00
Tobias Brunner b4062c4bb7 botan: Add support for X25519 2018-09-12 16:25:00 +02:00
Tobias Brunner 40b3bf6ba7 botan: Simplify DH/ECDH key derivation 2018-09-12 16:25:00 +02:00
Tobias Brunner 125222dca7 test-vectors: Add the actual test vector from RFC 8031 for x25519 
The existing test vector is from RFC 8037.
 2018-09-12 16:25:00 +02:00
Tobias Brunner e5e500c07e ike-init: Fix leak if KE payload creation fails 2018-09-12 16:25:00 +02:00
Tobias Brunner 472efd3809 leak-detective: Add an option to ignore frees of unknown memory blocks 
This also changes how unknown/corrupted memory is handled in the free()
and realloc() hooks in general.

Incorporates changes provided by Thomas Egerer who ran into a similar
issue.
 2018-09-12 16:25:00 +02:00
Tobias Brunner 9ee23d5efa travis: Add Botan build 
We build Botan directly from the master branch until 2.8.0 is released.
 2018-09-12 16:25:00 +02:00
Tobias Brunner c064a5288e leak-detective: Whitelist some Botan functions 
Due to the mangled C++ function names it's tricky to be more specific.  The
"leaked" allocations are from a static hashtable containing EC groups.

There is another leak caused by the locking allocator singleton
(triggered by the first function that uses it, usually initialization of
 a cipher, but could be a hasher in other test runners), but we can avoid
that with a Botan config option.
 2018-09-12 16:25:00 +02:00
Tobias Brunner 304d4ca57a botan: Adhere to configured DH exponent length 2018-09-12 16:25:00 +02:00
Tobias Brunner bd267c863f botan: Encode private keys as PKCS#8 
Since we can now parse that encoding directly we can simplify the private
key export and stick to PKCS#8.
 2018-09-12 16:25:00 +02:00
Tobias Brunner 607f10dca4 botan: Load public/private keys generically 
Simplifies public key loading and this way unencrypted PKCS#8-encoded
keys can be loaded directly without pkcs8 plugin (code for encrypted
keys could probably later be added, if necessary).

It also simplifies the implementation of private_key_t::get_public_key()
a lot.
 2018-09-12 16:25:00 +02:00
Tobias Brunner 72491b7843 botan: Encode curve OID and public key in EC private key 
Without OID we can't generate an algorithmIdentifier when loading the
key again. And older versions of OpenSSL insist on a public key when
e.g. converting a key to PKCS#8.

Simply unwrapping the ECPrivateKey structure avoids log messages when
parsing other keys in the KEY_ANY case.
 2018-09-12 16:25:00 +02:00
Tobias Brunner ba7e74291e pkcs1: Accept EC private keys without public key but make sure of an OID 2018-09-12 16:25:00 +02:00
Tobias Brunner de2a24310c botan: Fixes, code style changes plus some refactorings 
Some changes rely on newly added FFI functions in Botan's master
branch.
 2018-09-12 16:25:00 +02:00
Tobias Brunner 66c4735f99 dumm: Remove the Dynamic UML Mesh Modeler framework 
This has been pretty much defunct for several years (requires a
specially patched UML-enabled guest kernel).
 2018-09-12 15:53:55 +02:00
Tobias Brunner 948c42ab2e android: Properly set log file path 2018-09-12 11:44:57 +02:00
Tobias Brunner bd61236b4a conf: Document new filelog configuration 2018-09-12 11:42:38 +02:00
Tobias Brunner f6b4ba2a65 library: Return FALSE from library_init() if loaded settings are invalid 
This way daemons won't start with config files that contain errors.
 2018-09-11 18:30:18 +02:00
Tobias Brunner 71dca60c31 settings: Don't allow dots in section/key names anymore 
This requires config changes if filelog is used with a path that
contains dots. This path must now be defined in the `path` setting of an
arbitrarily named subsection of `filelog`.  Without that change the
whole strongswan.conf file will fail to load, which some users might
not notice immediately.
 2018-09-11 18:30:18 +02:00
Tobias Brunner 85afe81e1f ike-auth: Remove unnecessary case statement 2018-09-11 18:18:50 +02:00
Tobias Brunner a0c302f878 vici: Remove unreachable code 
If list is TRUE any type but VICI_LIST_END and VICI_LIST_ITEM (i.e.
including VICI_END) is already handled in the first block in this
function.
 2018-09-11 18:18:50 +02:00
Tobias Brunner 954e75effa vici: Lease enumerator is always defined 
mem_pool_t always returns an enumerator.
 2018-09-11 18:18:50 +02:00
Tobias Brunner 55fb268b51 stroke: Lease enumerator is always defined 
This function is only called for existing pools (under the protection of
a read lock).
 2018-09-11 18:18:50 +02:00
Tobias Brunner 648709b392 smp: Remove unreachable initializer 
Execution in this block will start with any of the case statements,
never with the initialization.
 2018-09-11 18:18:49 +02:00
Tobias Brunner 23d756e4f0 eap-sim-pcsc: Fix leak in error case 2018-09-11 18:18:49 +02:00
Tobias Brunner e2d8833f2b travis: Add sonarcloud build 2018-09-11 18:18:43 +02:00
Tobias Brunner f5481496d6 travis: Automatically retry install steps 
There occasionally are network issues when fetching from Ubuntu/PPA
repos.  Let's see if this is a possible fix.
 2018-09-11 18:17:28 +02:00
Tobias Brunner 80e8845d36 swanctl: Allow passing a custom config file for each --load* command 
Mainly for debugging, but could also be used to e.g. use a separate file
for connections and secrets.
 2018-09-11 18:14:45 +02:00
Tobias Brunner 7257ba3b44 Merge branch 'ikev2-ppk' 
Adds support for Postquantum Preshared Keys for IKEv2.

Fixes #2710.
 2018-09-10 18:05:12 +02:00
Tobias Brunner d1c5e6816d testing: Add some PPK scenarios 2018-09-10 18:04:23 +02:00
Tobias Brunner 755985867e swanctl: Report the use of a PPK in --list-sas 
If we later decide the PPK_ID would be helpful, printing this on a
separate line would probably make sense.
 2018-09-10 18:03:30 +02:00
Tobias Brunner c4d2fdd915 vici: Return PPK state of an IKE_SA 2018-09-10 18:03:27 +02:00
Tobias Brunner e4d85011e4 ikev2: Mark IKE_SAs that used PPK during authentication 2018-09-10 18:03:18 +02:00
Tobias Brunner 6627706786 eap-authenticator: Add support for authentication with PPK 2018-09-10 18:03:03 +02:00
Tobias Brunner 18f8249415 pubkey-authenticator: Add support for authentication with PPK 2018-09-10 18:03:03 +02:00
Tobias Brunner 46bdeaf359 psk-authenticator: Add support for authentication with PPK 2018-09-10 18:03:03 +02:00
Tobias Brunner a9e60c96dc ike-auth: Add basic PPK support 
Some of the work will have to be done in the authenticators.
 2018-09-10 18:03:02 +02:00
Tobias Brunner 94f9f421bc ike-auth: Replace == NULL with ! 2018-09-10 18:03:02 +02:00
Tobias Brunner 7150fa7065 authenticator: Add optional method to set PPK 2018-09-10 18:03:02 +02:00
Tobias Brunner 600b106852 ike-init: Send USE_PPK notify as appropriate 2018-09-10 18:03:02 +02:00
Tobias Brunner 1fb46f7119 swanctl: Report PPK configuration in --list-conns 2018-09-10 18:03:02 +02:00
Tobias Brunner 7f94528061 vici: Make PPK related options configurable 2018-09-10 18:03:02 +02:00
Tobias Brunner a2ff8b654d peer-cfg: Add properties for PPK ID and whether PPK is required 2018-09-10 18:03:01 +02:00
Tobias Brunner 83dcc1f4cf ike-sa: Add flag for PPK extension 2018-09-10 18:03:01 +02:00
Tobias Brunner 3fbc95cf54 keymat_v2: Add support for PPKs 2018-09-10 18:03:01 +02:00
Tobias Brunner 3703dff2aa swanctl: Add support for PPKs 2018-09-10 18:03:01 +02:00
Tobias Brunner 1ec9382880 vici: Add support for PPKs 2018-09-10 18:03:01 +02:00
Tobias Brunner bac3ca2324 shared-key: Add a new type for Postquantum Preshared Keys 
Using a separate type allows us to easily check if we have any PPKs
available at all.
 2018-09-10 18:03:01 +02:00
Tobias Brunner 0f423dda28 ikev2: Add notify types for Postquantum Preshared Keys 2018-09-10 18:03:00 +02:00
Tobias Brunner 5dff6de8eb unit-tests: Add tests for peer_cfg_t::replace_child_cfgs() 2018-09-10 17:45:23 +02:00
Tobias Brunner 40ed812442 peer-cfg: Replace equal child configs with newly added ones 
Otherwise, renamed child configs would still be known to the daemon
under their old name.

Fixes #2746.
 2018-09-10 17:45:07 +02:00
Tobias Brunner 53f8ac3d6a Normalize whitespace in boilerplate files 
Now all consistently use 2 or 4 (HACKING) spaces for indentation.
 2018-09-03 14:18:20 +02:00
Tobias Brunner aad9021fd3 README: Fix indentation 2018-09-03 14:14:18 +02:00
Tobias Brunner 8505c28289 swanctl: Add --reauth option to --rekey command 2018-08-31 12:39:46 +02:00
Tobias Brunner a20527438a vici: Add option to reauthenticae instead of rekey an IKEv2 SA 2018-08-31 12:39:46 +02:00
Tobias Brunner 720a8bedaa Merge branch 'xfrm-set-mark' 
This adds the ability to configure marks the in- and/or outbound SA
should apply to packets after processing on Linux.  Configuring such a mark
for outbound SAs requires at least a 4.14 kernel.  The ability to set a mask
and configuring a mark/mask for inbound SAs will be added with the upcoming
4.19 kernel.
 2018-08-31 12:32:31 +02:00
Tobias Brunner 60f7896923 vici: Make in-/outbound marks the SA should set configurable 2018-08-31 12:26:40 +02:00
Tobias Brunner f59450fde6 child-sa: Configure in-/outbound mark the SA should set 2018-08-31 12:26:40 +02:00
Tobias Brunner fa4d4012ae child-cfg: Add properties for in-/outbound mark the SA should set 2018-08-31 12:24:30 +02:00
Tobias Brunner 9cee688f78 kernel-netlink: Add support for setting mark/mask an SA should apply to processed traffic 2018-08-31 12:24:30 +02:00
Tobias Brunner c5b94b2483 kernel-netlink: Use larger buffer for event messages 2018-08-31 12:15:12 +02:00
Tobias Brunner 9de3140dbf ikev1: Increase DPD sequence number only after receiving a response 
We don't retransmit DPD requests like we do requests for proper exchanges,
so increasing the number with each sent DPD could result in the peer's state
getting out of sync if DPDs are lost.  Because according to RFC 3706, DPDs
with an unexpected sequence number SHOULD be rejected (it does mention the
possibility of maintaining a window of acceptable numbers, but we currently
don't implement that).  We partially ignore such messages (i.e. we don't
update the expected sequence number and the inbound message stats, so we
might send a DPD when none is required).  However, we always send a response,
so a peer won't really notice this (it also ensures a reply for "retransmits"
caused by this change, i.e. multiple DPDs with the same number - hopefully,
other implementations behave similarly when receiving such messages).

Fixes #2714.
 2018-08-31 11:31:35 +02:00
Tobias Brunner 5c38a5ea83 Remove ITA references 2018-08-31 11:11:12 +02:00
Tobias Brunner 85a6fe2306 ikev1: Signal IKE_SA connection failure via bus 
This is mainly for HA where a passive SA was already created when the
IKE keys were derived.  If e.g. an authentication error occurs later that
SA wouldn't get cleaned up.
 2018-08-31 11:05:39 +02:00
Tobias Brunner 4899a4c025 aggressive-mode: Trigger alerts for authentication failures 2018-08-31 11:02:43 +02:00
Tobias Brunner f32402f58e main-mode: Local identity is always defined 2018-08-31 11:02:43 +02:00
Tobias Brunner 78b3c9e2df main-mode: Also trigger a PEER_AUTH_FAILED alert if authorize() fails 2018-08-31 11:02:43 +02:00
Tobias Brunner c163a53a3a ike-sa-manager: Log message when scheduling delete for reauthenticated IKE_SA 2018-08-29 15:46:37 +02:00
Tobias Brunner d98df236a9 Merge branch 'ip-header-fields' 
Adds new options that allow configuring how/whether certain fields in
the IP headers are copied during IPsec processing. Currently only allows
configuration on Linux.

Closes strongswan/strongswan#104.
 2018-08-29 11:50:13 +02:00
Tobias Brunner c993eaf9d1 kernel: Add option to control DS field behavior 2018-08-29 11:36:04 +02:00
Tobias Brunner dc8b015d78 kernel: Add options to control DF and ECN header bits/fields via XFRM 
The options control whether the DF and ECN header bits/fields are copied
from the unencrypted packets to the encrypted packets in tunnel mode (DF only
for IPv4), and for ECN whether the same is done for inbound packets.

Note: This implementation only works with Linux/Netlink/XFRM.

Based on a patch by Markus Sattler.
 2018-08-29 11:36:04 +02:00
Tobias Brunner de4c3d2e76 vici: Add error handling to message parsing in Perl bindings 2018-08-29 11:32:21 +02:00
Tobias Brunner 2ff4983adc libimcv: Fix Android.mk 2018-08-10 10:10:00 +02:00
Tobias Brunner 6ccfeeb1d8 travis: Fix vici Python tests when using Clang 
For some reason the clang binary that's installed in an uncommon
directory could not be found anymore when installing packages via pip for
the last couple of builds. While the directory is obviously contained in PATH,
using `sudo -E` didn't help. So we now install the Python packages in the
user's home directory to avoid having to use sudo.
 2018-08-06 15:59:09 +02:00
Tobias Brunner 75214fabd8 testing: Optionally build/install strongSwan only on a specific guest 
This may be used to test different strongSwan versions against each
other.
 2018-07-11 18:38:09 +02:00
Tobias Brunner a4617539a2 conf: Fix bench_time documentation 2018-07-09 18:10:07 +02:00
Tobias Brunner 9403320fca message: Report the size of the complete reassembled IKE message 
This way we see the same size on both ends, namely that of the complete
IKE message as if it was sent in a single packet (excluding UDP/IP headers).
 2018-07-09 17:49:07 +02:00
Tobias Brunner 62721936b1 encrypted-payload: Change how the length for reassembled messages is calculated 
If we have an AEAD transform we add the overhead as if the data would have
been transported in a single encrypted payload.
 2018-07-09 17:25:02 +02:00
Tobias Brunner cc1f01e009 encrypted-payload: Add getter for the used AEAD transform 2018-07-09 17:15:07 +02:00
Tobias Brunner 47ec761674 testing: Fix checks after changing fragmentation log messages 2018-07-09 17:15:07 +02:00
Tobias Brunner c798b94a43 kernel-pfkey: Add support for native ChaCha20/Poly1305 on macOS 2018-07-06 10:25:56 +02:00
Tobias Brunner df411bfa30 testing: The dhcp plugin uses the DHCP client port again by default 
This reverts parts of commit becf027cd9.

Fixes: 707b70725a ("dhcp: Only use DHCP server port if explicitly configured")
 2018-07-05 18:14:54 +02:00
Tobias Brunner 4802a7477f android: New release after fixing EAP-PEAP issue and Autofill crash 2018-07-04 20:02:23 +02:00
Tobias Brunner ba9255b358 Revert "android: Enable the eap-ttls and eap-peap plugins" 
This reverts commit 064c97afae.

We have to make this optional and more configurable.  It seems some
commercial VPN providers use self-signed certificates for their AAA
servers.
 2018-07-04 19:36:50 +02:00