denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
15,564 Commits 1 Branch 0 Tags
1da567734ffdeccbde737df9044b8027adb0bdb9
Commit Graph
12231 Commits
Author SHA1 Message Date
Tobias Brunner 1da567734f libipsec: Fix Windows build via MinGW 
Fixes #2118.
 2017-01-25 17:12:30 +01:00
Tobias Brunner 69b58e347e stroke: Default to %dynamic if no valid TS are specified in left|rightsubnet 
Otherwise, we'd end up with an empty TS list, which is not valid.

Because end->tohost is set to !end->subnets in starter the removed branch was
never used.
 2017-01-25 16:56:28 +01:00
Tobias Brunner 83bf6db303 vici: Reload loggers after reloading strongswan.conf via reload-setting command 2017-01-25 14:58:12 +01:00
Tobias Brunner 9665686bd8 daemon: Use separate method to set default loggers 
This way it is not necessary to pass the same values to reload the
loggers.
 2017-01-25 14:58:09 +01:00
Tobias Brunner ff22d53ba9 charon-systemd: Handle SIGHUP the same way charon does 
That is, reload strongswan.conf, the loggers and the plugins.
 2017-01-25 14:58:05 +01:00
Tobias Brunner 4e382f5ffc ha: Fix assignment of IP addresses if multiple pools are defined 
Fixes #2146.
 2017-01-25 12:28:34 +01:00
Tobias Brunner 0e3c8cc4a2 ha: Delete passive IKE_SA on other node after half-open timeout 
Fixes #1192.
 2017-01-25 12:27:21 +01:00
Thomas Egerer 7085ca68d6 kernel-netlink: Return const pointer from lookup_algorithm() 
Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
 2017-01-23 18:53:58 +01:00
Tobias Brunner 7b73cf4aa9 android: New release after adding profile import functionality 2017-01-20 11:53:43 +01:00
Tobias Brunner 66bf2b788c android: Handle profile file names with dots in them 2017-01-20 11:44:17 +01:00
Tobias Brunner 9c79af8c38 android: Handle errors when fetching profile in more detail 2017-01-20 11:44:16 +01:00
Tobias Brunner 3107634e30 android: Add activity to import VPN profiles from JSON-encoded files 
The file format is documented on the wiki.

URLs to .sswan files may be intercepted and downloaded files with a media
type of application/vnd.strongswan.profile may also be opened (the file
extension doesn't matter in that case).  Whether downloaded files for which
the media type is not correct but the extension is .sswan can be opened
depends on the app that issues the Intent.  For instance, from the default
Downloads app it won't work due to the content:// URLs that do not contain
the file name but when opening the downloaded file from within Chrome's
Downloads view it works as these Intents use file:// URLs, which contain
the complete file name (the latter requires a new permission).
 2017-01-20 11:44:07 +01:00
Tobias Brunner cf6110f152 android: Use a local broadcast to notify about profile changes 
This allows other components to modify the profiles and notify about
changes.
 2017-01-20 11:01:32 +01:00
Tobias Brunner c4ab9af74e android: Add a UUID property to the VPN profiles 
All new or edited profiles get a random UUID.  We currently don't
enforce one, though.  Later we might change that and use the UUID as
primary key.
 2017-01-20 11:01:32 +01:00
Tobias Brunner 2ec6372f5a ipsec: Only allow specific commands to be executed via ipsec script 
The previous fallback allowed running any executable as root if executing
ipsec via sudo was allowed, by using e.g. `sudo ipsec ../../../bin/sh`.
 2017-01-18 16:15:48 +01:00
Tobias Brunner 1c27cf3bc8 bliss: Increase timeout for sampler unit test 
Fixes #2204.
 2017-01-16 11:28:10 +01:00
Tobias Brunner 410bdaf654 android: Include ref10 subdirectory for curve25519 plugin 
Fixes #2201.
 2017-01-16 11:19:35 +01:00
Andreas Steffen e3f63c6469 revocation: OCSP and/or CRL fetching can be disabled 2016-12-30 18:12:53 +01:00
Andreas Steffen bd2f2b11fc stroke: Load general PKCS#8 private keys 2016-12-17 18:06:11 +01:00
Andreas Steffen 9da89eeb4f Merge branch 'Ed25519' 2016-12-16 12:24:54 +01:00
Andreas Steffen 4f19112b1f Moved Ed25519 tests to libstrongswan 2016-12-14 11:57:36 +01:00
Weilu Jia 351179d4dc vici: Check for closed connection in Python bindings 
The Python VICI library does not check if the socket is closed.
If the daemon closes the connection, _recvall() spins forever.

Closes strongswan/strongswan#56.
 2016-12-14 11:35:31 +01:00
Andreas Steffen e9c2b6658b unit-tests: Completed coverage of hasher, crypter and libnttfft 2016-12-14 11:15:48 +01:00
Andreas Steffen f2eb367adc Implemented EdDSA for IKEv2 using a pro forma Identity hash function 2016-12-14 11:15:48 +01:00
Andreas Steffen d47ad3d67e Added Ed25519 ref10 implementation from libsodium 2016-12-14 11:15:47 +01:00
Andreas Steffen 35bc60cc68 Added support of EdDSA signatures 2016-12-14 11:15:47 +01:00
Tobias Brunner 564a199674 kernel-netlink: Add support for AES-CMAC-96 (RFC 4494) 
The kernel apparently supports this since 3.10.
 2016-12-12 11:43:06 +01:00
Tobias Brunner 8c859e86d6 android: New release after re-adding support for ECC Brainpool curves 2016-12-10 12:28:09 +01:00
Tobias Brunner f20b3f7b2c openssl: BoringSSL doesn't provide curve data for ECC Brainpool curves 2016-12-10 12:27:47 +01:00
Tobias Brunner aae9a9e678 android: New release after fixing libtpmtss issue 2016-12-09 11:18:17 +01:00
Tobias Brunner 9920824e70 android: Make sure libtpmtss is loaded on older systems 
On newer Android systems this seems to happen automatically (or does at
least not cause crashes if the library is not loaded).
 2016-12-09 11:16:42 +01:00
Tobias Brunner 708f9c7f65 android: New release after adding notification 2016-12-08 17:37:21 +01:00
Tobias Brunner 3e85b5a492 android: Ensure that the certificates are loaded when accessing them via JNI 2016-12-08 17:14:49 +01:00
Tobias Brunner 85059424a7 android: Add a public notification 2016-12-08 17:14:49 +01:00
Tobias Brunner d5070425a0 android: Display a permanent notification while connected 
This forces the service to run in the foreground, meaning the system
won't kill it when low on memory.
 2016-12-08 17:14:49 +01:00
Tobias Brunner e03c936982 android: Log any installed DNS servers 2016-12-08 17:14:49 +01:00
Tobias Brunner d6d12bab14 android: Unregister listener in case of error alerts 
This avoids triggering additional errors via e.g. ike_updown() that
might cause the error message displayed in the GUI to change if the
status fragment is recreated.

References #2134.
 2016-12-08 17:13:16 +01:00
Tobias Brunner ef2ad9db1c android: Report an error for invalid integer values 
Previously we'd just ignore the invalid values without notifying the
user.
 2016-12-08 16:43:51 +01:00
Tobias Brunner cefbf2bf9b android: Propose curve25519 in the ESP proposals 2016-12-08 16:43:51 +01:00
Tobias Brunner fec47b6146 android: Enable curve25519 plugin in the app 2016-12-08 16:43:51 +01:00
Tobias Brunner b077a2a71a android: Optionally build the curve25519 plugin 2016-12-08 16:43:51 +01:00
Tobias Brunner 5f0913fc1e android: Propose ChaCha20/Poly1305 in the ESP AEAD proposals 2016-12-08 16:43:50 +01:00
Tobias Brunner 8c0b38e9df android: Enable chapoly plugin in the app 2016-12-08 16:43:50 +01:00
Tobias Brunner 4d47adb639 android: Optionally build the chapoly plugin 2016-12-08 16:43:50 +01:00
Tobias Brunner 03472aea1f android: Update Gradle plugin and wrapper 2016-12-08 16:43:50 +01:00
Thomas Egerer 8c50bb6c36 ikev1: Minor code optimization in task manager 
Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
 2016-12-07 10:37:46 +01:00
Tobias Brunner 5078f87a52 plugin-loader: Strip '!' from critical plugin names when setting paths 2016-11-18 12:21:49 +01:00
Thomas Egerer 1042b9194f child-sa: Use single return statement in update_usebytes() 
Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
 2016-11-18 11:58:14 +01:00
Martin Willi 649537ee8d proposal: Remove RFC 5114 MODP DH groups from default proposal 
Recent research demonstrates that at least for 1024-bit DH groups, it is
possible to create specially crafted primes having a backdoor. From the
prime itself this is not detectable, creating a perfect NOBUS attack.

http://eprint.iacr.org/2016/961

For the primes defined in RFC 5114 no information is provided on how these
have been selected. In the default proposal we included one of the 2048-bit
primes only, where it is questionable if constructing a backdoored prime is
feasible. Nevertheless, this patch removes the group from the set of default
proposals as well.
 2016-11-15 17:20:40 +01:00
Andreas Steffen 99c03e9a11 testing: make curve25519 the default DH group 2016-11-14 16:20:51 +01:00