denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
14,345 Commits 1 Branch 0 Tags
6830cb1c1bf61b2319298cf4d9531f9de61a08fc
Commit Graph
367 Commits
Author SHA1 Message Date
Tobias Brunner 6830cb1c1b android: Set preferred language for remediation instructions 2015-07-28 13:27:32 +02:00
Tobias Brunner 79af70c66e android: Encode connection settings as single Java string argument 
This makes adding new configuration settings easier.
 2015-07-28 13:27:32 +02:00
Tobias Brunner fd16adb765 android: Add simple utility class to generate settings_t compatible config snippets 2015-07-28 13:27:32 +02:00
Tobias Brunner 41594a7bb7 android: Don't pass null as root view to inflate() 2015-07-28 13:27:31 +02:00
Tobias Brunner 16e9efc092 android: Fix a potential NullPointerException in the IMC state fragment 2015-07-28 13:27:31 +02:00
Tobias Brunner 4dc6275be5 android: EAP-TNC does not require a client certificate 
Was incorrectly changed with the refactoring in a64089738d ("android:
Change how features of VPN types are stored and checked").
 2015-07-28 13:27:31 +02:00
Tobias Brunner 9d957bacfc android: Enable charon.initiator_only option 2015-07-28 13:27:31 +02:00
Tobias Brunner 5f613590b0 android: Increase the minSdkVersion to 15 and targetSdkVersion to 22 
There are no devices anymore that use API level 14 (4.0-4.0.2) and 22 is
the most recent level.
 2015-07-28 13:27:31 +02:00
Martin Willi 607eebcfcf libipsec: Pass separate inbound/update flags to the IPsec SA manager 
Similar to other kernel interfaces, the libipsec backends uses the flag for
different purposes, and therefore should get separate flags.
 2015-03-09 18:18:20 +01:00
Martin Willi b9be25ea39 attribute-handler: Pass full IKE_SA to handler backends 2015-02-20 13:34:56 +01:00
Martin Willi 751363275f attributes: Move the configuration attributes framework to libcharon 2015-02-20 13:34:55 +01:00
Martin Willi 246c969d8b ike: Consistently log CHILD_SAs with their unique_id instead of their reqid 2015-02-20 13:34:52 +01:00
Martin Willi db80d0d2da ike-sa-manager: Remove IKE_SA checkout by CHILD_SA reqid 2015-02-20 13:34:51 +01:00
Martin Willi f81a949748 kernel-interface: Raise expires with a proto/SPI/dst tuple instead of reqid 2015-02-20 13:34:50 +01:00
Martin Willi d05d85fe65 kernel-interface: Pass full list of traffic selectors to add_sa() 
While we can handle the first selector only in BEET mode in kernel-netlink,
passing the full list gives the backend more flexibility how to handle this
information.
 2015-02-20 13:34:47 +01:00
Martin Willi fd9417607c libipsec: Remove unused src/dst_ts parameters from ipsec_sa_mgr_t.add_sa() 2015-02-20 13:34:47 +01:00
Martin Willi 2a1c9e20bd kernel-interface: Remove reqid parameter from get_spi/get_cpi() methods 
The reqid is not strictly required, as we set the reqid with the update
call when installing the negotiated SA.

If we don't need a reqid at this stage, we can later allocate the reqid in
the kernel backend once the SA parameters have been fully negotaited. This
allows us to assign the same reqid for the same selectors to avoid conflicts
on backends this is necessary.
 2015-02-20 13:34:32 +01:00
Martin Willi 3e779ff555 libipsec: Remove unused reqid parameter from ipsec_sa_mgr_t.get_spi() 2015-02-19 15:42:22 +01:00
Tobias Brunner fc02a9d4b9 android: New release based on 5.2.1 and after adding EAP-TLS 
Also enables support for IKEv2 fragmentation, provides improved MOBIKE
handling and optionally enables PFS for CHILD_SAs.
 2014-11-06 17:16:27 +01:00
Tobias Brunner baa4e774c1 android: Build binaries for MIPS 2014-11-06 17:11:55 +01:00
Tobias Brunner bdc4cea316 android: Increase fragment size 
We use the same value we use as MTU on TUN devices.
 2014-11-06 17:05:47 +01:00
Tobias Brunner 6fddf2af73 android: Enable IKEv2 fragmentation 2014-11-06 16:56:54 +01:00
Tobias Brunner 0e44999867 android: Use %any as AAA identity, but disable EAP-only authentication 
Without verification of the identity we can't prevent a malicious user
with a valid certificate from impersonating the AAA server and thus the
VPN gateway.  So unless we make the AAA identity configurable we have to
prevent EAP-only authentication.
 2014-11-06 16:28:40 +01:00
Tobias Brunner 4b39a4117a android: Add support for signature schemes used by EAP-TLS 2014-11-06 16:28:40 +01:00
Tobias Brunner 0ef74bec98 android: Allow enumeration of untrusted certificates 2014-11-06 16:28:40 +01:00
Tobias Brunner 34ca3795c8 android: Handle EAP-TLS in Android service 2014-11-06 16:28:40 +01:00
Tobias Brunner 93923149e4 android: Enable EAP-TLS plugin in the app 2014-11-06 16:28:40 +01:00
Tobias Brunner a1700c9903 android: Add EAP-TLS VPN type to the GUI 2014-11-06 16:28:40 +01:00
Tobias Brunner a64089738d android: Change how features of VPN types are stored and checked 2014-11-06 16:28:40 +01:00
Tobias Brunner fdeda63df0 android: Fix PA-TNC construction based on data passed via JNI 2014-10-15 13:55:13 +02:00
Tobias Brunner 3307de1f8d android: Implement get_contracts() method in IMC state object 2014-10-14 10:37:55 +02:00
Tobias Brunner f4e6f89aa9 android: libpts does not exist anymore, don't attempt to load it 2014-10-14 10:12:16 +02:00
Tobias Brunner bed09f2baf android: Update receive_message() to new imc_msg_t.receive() signature 2014-10-13 18:16:47 +02:00
Tobias Brunner f502e503fb android: Remove references to libpts 2014-10-13 17:18:06 +02:00
Martin Willi 5421092b75 plugin-loader: Support a reload() callback for static features 2014-09-22 13:55:12 +02:00
Tobias Brunner f9ceb5b543 android: Reduce CHILD_SA lifetime 2014-09-12 10:21:50 +02:00
Tobias Brunner 1fe3b02838 android: Add DH groups to ESP proposals 2014-09-12 10:21:49 +02:00
Tobias Brunner ac1b3a6ddd android: Reestablish IKE_SA if CHILD_SA rekeying failed 2014-09-12 10:18:13 +02:00
Tobias Brunner a39c28bb35 android: Report error if CHILD_SA rekeying fails 2014-09-12 10:18:13 +02:00
Tobias Brunner e58764ca0f android: Add support for querying use stats of a CHILD_SA 2014-09-09 10:57:51 +02:00
Tobias Brunner ffa9b67189 dns-proxy: Don't use proxy socket if we fail to bypass it 
This will result in an infinite loop as packets sent over that socket
will again pass through the TUN device and the DNS proxy.

Apparently, bypassing fails when airplane mode is enabled.

Fixes #662.
 2014-07-30 09:48:08 +02:00
Tobias Brunner 8d31df9099 android: New release after adding certificate import, DNS proxy and GUI changes 2014-07-22 11:34:09 +02:00
Tobias Brunner ffff7219ef android: For keyingtries > 0 notify the GUI if the limit is reached when reestablishing 
The IKE_SA is destroyed anyway, so letting the GUI remain in
"connecting" state would be incorrect.

We still use keyingtries=0 for now, though. And we still abort after the
first failed attempt initially, in case there is a configuration error.
 2014-07-22 11:10:36 +02:00
Tobias Brunner 5fd9e5fd00 android: Terminate IKE_SA if initial IKE_SA_INIT fails 
Since VpnStateService.disconnect() is now not called until the error
dialog is dismissed the daemon would continue to try connecting.
So while the error dialog is shown the connection might actually be
successfully established in the background, which is not intended.

This way the IKE_SA is destroyed right after sending the IKE_SA_INIT of
the second connection attempt (due to keyingtries=0).
 2014-07-22 11:10:36 +02:00
Tobias Brunner 945832c67d android: Only allow DNS queries for the configured hostname 2014-07-22 11:10:36 +02:00
Tobias Brunner e77f226a0f android: Add optional filter functionality to DNS proxy 
If specified only queries for a list of allowed host names will be
proxied.
 2014-07-22 11:10:36 +02:00
Tobias Brunner c66f5f844d android: Recreate the TUN device without DNS when reestablishing IKE_SAs 
This enables DNS resolution while reestablishing if the VPN gateway pushed
DNS servers to the client that are only reachable via VPN.
 2014-07-22 11:10:36 +02:00
Tobias Brunner 36aab70ab0 android: Add method to BuilderAdapter to re-establish without DNS-related data 
Non-DNS data is cached in the BuilderAdapter so the TUN device can be
recreated easily (since the CHILD_SA is gone we couldn't actually gather
that information).
 2014-07-22 11:10:36 +02:00
Tobias Brunner cc1712a8f4 android: Use DNS proxy when reestablishing IKE_SAs 2014-07-22 11:10:36 +02:00
Tobias Brunner 614359a7d5 bus: Add ike_reestablish_pre hook, called before DNS resolution 
The old hook is renamed to ike_reestablish_post and is now also called
when the initiation of the new IKE_SA failed.
 2014-07-22 11:10:36 +02:00