denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
11,439 Commits 1 Branch 0 Tags
a05acd76294e4c4e4da7633632732858ae762d2a
Commit Graph
113 Commits
Author SHA1 Message Date
Tobias Brunner a05acd7629 android: Handle and store IETF remediation instructions 2013-07-08 18:49:28 +02:00
Tobias Brunner dc52cfab73 android: Add state of IMC to VpnStateService and update it via JNI 2013-07-08 18:49:28 +02:00
Tobias Brunner d087f080f0 android: Handle TCG file measurement related attributes using PTS 2013-07-08 18:49:28 +02:00
Tobias Brunner fd3aa004e4 android: Android IMC state provides a Platform Trust Service (PTS) instance 2013-07-08 18:49:28 +02:00
Tobias Brunner 0e53beda32 android: Provide a public interface for Android IMC state 2013-07-08 18:49:28 +02:00
Tobias Brunner 403165102c android: Define IMC functions static and with lower-case names 2013-07-08 18:49:28 +02:00
Tobias Brunner 44330a171f android: Add measurement collector for ITA Settings 2013-07-08 18:49:27 +02:00
Tobias Brunner c179a3f6f2 android: Handle ITA PA-TNC attributes 2013-07-08 18:49:27 +02:00
Tobias Brunner 036fa7a166 android: Overload for getMeasurement() that takes a String array as argument 2013-07-08 18:49:27 +02:00
Tobias Brunner ba59486fc8 android: Add measurement collector for Port Filter 
This collector reports all listening TCP and UDP sockets/ports.
 2013-07-08 18:49:27 +02:00
Tobias Brunner c53210f9b0 android: Add a generic handler for PA-TNC attribute requests 
The idea is that the Android IMC will return attributes in their binary
encoding.  This keeps the JNI interface to the IMC pretty simple.
 2013-07-08 18:49:26 +02:00
Tobias Brunner aa4ff3b211 android: Added a Java part to the Android IMC 2013-07-08 18:49:26 +02:00
Tobias Brunner 753035f6d7 android: Don't attempt loading IMCs from /etc/tnc_config 2013-07-08 18:49:26 +02:00
Tobias Brunner a6507df2ec android: Build libpts and init/deinit libpts in BYOD IMC 2013-07-08 18:49:26 +02:00
Tobias Brunner 96658d7264 android: Added a sample IMC that sends some dummy OS data 2013-07-08 18:49:26 +02:00
Tobias Brunner 0015727ebd android: Disable listening on IPv6 
As we have to use UDP encapsulation and the Linux kernel currently does
not support that this avoids issues with dual-stack gateways.
 2013-07-05 09:48:27 +02:00
Tobias Brunner 607f8e9906 plugin-loader: Add method to print loaded plugins on a given log level 2013-06-21 15:17:53 +02:00
Tobias Brunner 92f102c21b android: Forward initiator flag to libipsec when adding IPsec SA 2013-06-13 13:55:58 +02:00
Martin Willi a8c9454423 kernel-interface: add an exchange initiator parameter to add_sa() 
This new flag gives the kernel-interface a hint how it should priorize the
use of newly installed SAs during rekeying.

Consider the following rekey procedure in IKEv2:

Initiator  ---    Responder

I1 -------CREATE-------> R1
I2 <------CREATE--------
   -------DELETE-------> R2
I3 <------DELETE--------

SAs are always handled as pairs, the following happens at the SA level:

  * Initiator starts the exchange at I1
  * Responder installs new SA pair at R1
  * Initiator installs new SA pair at I2
  * Responder removes old SA pair at R2
  * Initiator removes old SA pair at I3

This makes sure SAs get installed/removed overlapping during rekeying. However,
to avoid any packet loss, it is crucial that the new outbound SA gets
activated at the correct position:

  * as exchange initiator, in I2
  * as exchange responder, in R2

This should guarantee that we don't use the new outbound SA before the peer
could install its corresponding inbound SA.

The new parameter allows the kernel backend to install the new SA with
appropriate priorities, i.e. it should:

  * as exchange inititator, have the new outbound SA installed with higher
    priority than the old SA
  * as exchange responder, have the new outbound SA installed with lower
    priority than the old SA

While we could split up the SA installation at the responder, this approach
has another advantage: it allows the kernel backend to switch SAs based on
other criteria, for example when receiving traffic on the new inbound SA.
 2013-06-11 15:58:48 +02:00
Martin Willi 5c12700f9a kernel-interface: query SAD for last use time if SPD query didn't yield one 2013-05-06 17:01:13 +02:00
Tobias Brunner 740aedfec1 android: Use stronger ESP proposal including AES-GCM 2013-05-03 16:02:39 +02:00
Tobias Brunner 61fb3267b2 android: Remove unused methods on NetworkManager/network_manager_t 2013-05-03 15:11:20 +02:00
Tobias Brunner 70dfac4459 android: Ignore interface 'lo' 
Android adds a default route via 'lo' if no connectivity is available
causing charon to send packets via lo and triggering DPD.
 2013-05-03 15:11:20 +02:00
Tobias Brunner 18dab76bfa android: Repurpose android-net to simply handle connectivity events 
Using the events by NetworkManager/ConnectivityManager to trigger roam events
instead of the events generated by the kernel-netlink plugin the noise level
is much lower.
 2013-05-03 15:11:20 +02:00
Tobias Brunner 3b7f25906e android: Replace android-net plugin with kernel-netlink 
Virtual IPs are not handled by the kernel-netlink plugin and tun devices are
ignored.
 2013-05-03 15:11:19 +02:00
Tobias Brunner 67332b4e22 android: Set strongswan.conf options before initializing other libraries 2013-05-03 15:11:19 +02:00
Tobias Brunner e5d819b617 android: Remove/filter header files from LOCAL_SRC_FILES 
This avoids huge warnings when building the native code.
 2013-03-20 15:24:26 +01:00
Tobias Brunner 8249f288f2 android: Request and install an IPv6 DNS server 2013-03-20 15:24:26 +01:00
Tobias Brunner ee66565d43 android: Also request a virtual IPv6 address and propose IPv6 TS 
This allows IPv6 over IPv4 but falls back nicely if we don't get a
virtual IPv6 (or IPv4) address.
 2013-03-20 15:24:26 +01:00
Martin Willi 7eeeb1c702 kernel_ipsec_t.query_sa() additionally returns the number of processed packets 2013-03-14 14:20:54 +01:00
Tobias Brunner 76de964617 android: Add support for combined certificate and EAP authentication 
This uses RFC 4739 multiple authentication rounds to first
authenticate the client with a certificate followed by an
EAP authentication round with username and password.
 2013-03-07 14:14:34 +01:00
Tobias Brunner 11adf114c1 Fixed Doxygen comments after scanning complete src directory 2013-03-02 18:31:53 +01:00
Tobias Brunner e88b529a30 android: Mitigate race condition on reauthentication 
If the TUN device gets recreated while another thread in handle_plain()
has not yet called select(2) but already stored the file descriptor of the
old TUN device in its FD set, select() will fail with EBADF.

Fixes #301.
 2013-03-01 17:06:01 +01:00
Martin Willi 306a269e34 Add a DSCP configuration value to IKE configs 2013-02-06 15:20:32 +01:00
Tobias Brunner b9cda4f3e1 android: Implement kernel_net_t.get_interface via JNI 
This is now required to properly accept/install a virtual IP address.

Fixes #275.
 2013-01-14 17:22:56 +01:00
Tobias Brunner 53ce5c4c91 android: Moved chunk_from_byte_array and byte_array_from_chunk helper functions 2013-01-14 17:19:58 +01:00
Tobias Brunner 365d9a6f67 Added an option that allows to force IKEv1 fragmentation 2013-01-12 11:54:32 +01:00
Tobias Brunner 97973f8609 Use a connection specific option to en-/disable IKEv1 fragmentation 2012-12-24 13:00:01 +01:00
Martin Willi b185cdd16d Install virtual IPs via interface name, and use an interface lookup where required 2012-11-29 10:22:51 +01:00
Martin Willi 50bd755871 Add an optional kernel-interface parameter to install IPs with a custom prefix 2012-11-29 10:22:51 +01:00
Tobias Brunner 37d42a76d3 android: Properly handle exceptions when loading keys/certificates 2012-11-21 18:57:41 +01:00
Tobias Brunner 277ff80a2e android: Private key bug has been fixed with Android 4.2 2012-11-19 11:43:31 +01:00
Tobias Brunner f05b427265 Moved debug.[ch] to utils folder 2012-10-24 16:00:51 +02:00
Tobias Brunner 12642a6831 Moved data structures to new collections subfolder 2012-10-24 16:00:49 +02:00
Tobias Brunner 2e7cc07ecd Moved host_t and host_resolver_t to a new networking subfolder 2012-10-24 15:06:18 +02:00
Martin Willi 1fdd62ffce Remove version argument on peer_cfg constructor, use ike_cfg version instead 2012-10-24 10:19:33 +02:00
Martin Willi 9fc7cc6f9b Add IKE version information to ike_cfg_t 2012-10-24 10:18:35 +02:00
Tobias Brunner 3555bacac7 Reload logger configuration on SIGHUP 
Besides changing the configuration this allows to easily rotate log files.

Also moved logger initialization back to daemon_t.
 2012-10-18 14:42:10 +02:00
Tobias Brunner d35d669180 Make syslog and file loggers configurable at runtime 2012-10-18 14:42:10 +02:00
Tobias Brunner eecd41e349 Use a helper function to add milliseconds to timeval structs 2012-10-18 12:25:59 +02:00