denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
10,326 Commits 1 Branch 0 Tags
bb5037a5e5731f3cf5d4cc4e6f10ded8d4b09506
Commit Graph
8105 Commits
Author SHA1 Message Date
Martin Willi bb5037a5e5 Create pt_tls_dispatcher with separate server address and identity 2013-01-16 15:02:14 +01:00
Martin Willi 18d56a1891 Add a libpttls providing NEA PT-TLS / TNC IF-T for TLS transport layer 2013-01-16 13:53:32 +01:00
Martin Willi 435348f406 Send TLS close notify during tls_socket_t destruction 2013-01-15 17:43:05 +01:00
Martin Willi 7bbf7aa97a Send TLS close notify if application returns SUCCESS 2013-01-15 17:43:05 +01:00
Martin Willi c43e8fdec4 Block TLS read when sending data, but have to wait for the handshake data first 2013-01-15 17:43:05 +01:00
Martin Willi 9191e5e11a TNCCS plugins don't depend on EAP-TNC, but can be used by other transports, too 2013-01-15 17:43:05 +01:00
Martin Willi 7fb81886b9 Add a bio_reader_t constructor variant freeing passed data during destruction 2013-01-15 17:43:05 +01:00
Martin Willi ee90c78998 Use a more POSIXy tls_socket interface with more flexibility. 
If an unsufficient read buffer is provided, application data gets cached
for subsequent read() calls.
 2013-01-15 17:43:05 +01:00
Martin Willi 47af9848a2 Add a chunk_from_str() initializer that does not include 0-terminator 2013-01-15 17:43:05 +01:00
Martin Willi 1449e6dd55 Reseed rdrand after every 128bit sample only 2013-01-15 17:41:54 +01:00
Tobias Brunner 30abe1fd19 android: Properly escape apostrophes in Ukrainian translation 2013-01-14 17:23:52 +01:00
Tobias Brunner b9cda4f3e1 android: Implement kernel_net_t.get_interface via JNI 
This is now required to properly accept/install a virtual IP address.

Fixes #275.
 2013-01-14 17:22:56 +01:00
Tobias Brunner 53ce5c4c91 android: Moved chunk_from_byte_array and byte_array_from_chunk helper functions 2013-01-14 17:19:58 +01:00
Tobias Brunner ecff0e5685 android: Set OPENSSL_NO_CMS in Android.mk as it is not set in opensslconf.h on Android 2013-01-14 17:16:18 +01:00
Tobias Brunner 66bb4f63b2 Properly send IKEv1 packets if no ike_cfg is known yet 
This applies for error notifies.
 2013-01-14 12:14:16 +01:00
Martin Willi c4a49008e8 Don't handle right=%any6 as "loose" identity, but as %any 2013-01-14 10:33:14 +01:00
Martin Willi 426f34baf9 Respect given address family when resolving "%any" 2013-01-14 10:26:12 +01:00
Tobias Brunner 37fb404833 Android.mk of libstrongswan updated 2013-01-14 09:16:33 +01:00
Tobias Brunner 21235e1ec2 Merge branch 'ikev1-fragmentation' 
This adds support for the proprietary IKEv1 fragmentation extension.

Conflicts:
	NEWS
 2013-01-12 11:58:26 +01:00
Tobias Brunner ee6902ef7f Added an option to configure the maximum size of a fragment 2013-01-12 11:54:58 +01:00
Tobias Brunner 7ae245f685 Properly detect fragmentation capabilities 
Cisco sends 0xc0000000 so we check that part of the VID separately.
 2013-01-12 11:54:54 +01:00
Tobias Brunner 365d9a6f67 Added an option that allows to force IKEv1 fragmentation 2013-01-12 11:54:32 +01:00
Martin Willi 54a1a75b2f Don't use bio_writer_t.skip() to write length field when appending more data 
If the writer reallocates its buffer, the length pointer might not be valid
anymore, or even worse, point to an arbitrary allocation.
 2013-01-11 14:57:08 +01:00
Martin Willi 2cd6c5115b Use raw opcodes for rdrand to build with older binutils 2013-01-11 10:45:14 +01:00
Martin Willi 19ae23452a Provide RNG_TRUE quality in rdrand by mixing reseeded outputs using AES 2013-01-11 10:45:14 +01:00
Martin Willi b9148ea232 Provide RNG_STRONG quality in rdrand by forcing PRNG reseed after every sample 2013-01-11 10:45:14 +01:00
Martin Willi 9fe24b004d Provide RNG_WEAK quality random generator in rdrand 2013-01-11 10:45:14 +01:00
Martin Willi ed8dc6f132 Add a rdrand plugin stub detecting availability of RDRAND instructions 2013-01-11 10:45:14 +01:00
Martin Willi 1954cc7720 Streamline debug output when receiving intermediate CA certificates in IKEv1 2013-01-11 10:24:23 +01:00
Martin Willi cde6a9ec9f Refactored IKEv2 cert/certreq payload processing to multiple functions 2013-01-11 10:21:56 +01:00
Martin Willi bf10ee9495 Refactored IKEv1 cert payload processing to multiple functions 2013-01-11 10:21:56 +01:00
Volker Rümelin 6d3e7a64a0 IKEv1 support for PKCS#7 wrapped certificates 2013-01-11 10:21:56 +01:00
Volker Rümelin 10eee5fcba Fixed some typos in comments 2013-01-11 10:21:51 +01:00
Pavel Kopchyk 3365bddccf Fixed some typos in Ukrainian translation 2013-01-09 05:30:55 +01:00
Thomas Klute 13c177852f conftest: Add support for time_format and ike_name options in log sections 
Both options are well supported for normal operation but were completely
ignored by conftest, which used hard coded defaults. File options are
still missing but could be added in a similar way.
 2013-01-08 11:12:44 +01:00
Thomas Klute b78698f755 conftest: Fix log level settings for stdout 
This patch fixes bug #272 ("conftest ignores log settings for stdout").
http://wiki.strongswan.org/issues/272

According to the documentation of add_logger in src/libcharon/bus/bus.h,
the relevant log levels of a logger are registered with the logging
subsystem when adding the logger. If the log levels change later, the
logger must be re-added to propagate the new settings. In conftest.c,
the stdout logger is initialized and added before reading the logging
settings, but wasn't re-added after reading the settings.
 2013-01-08 11:12:10 +01:00
Thomas Klute 4e51cf895e conftest: Make outgoing sequence number set by reset_seq configurable 
This is useful for certain test cases. Passing the sequence number to
the callback requires a new struct that contains both the number and the
xfrm_usersa_id. The new configuration parameter is called oseq in
accordance with the kernel name, see the comment in the reset_cb
callback function for details.
 2013-01-08 11:10:13 +01:00
Martin Willi ff318ad3e1 Include opensslconf.h before checking its defines 2013-01-03 11:12:05 +01:00
Martin Willi 2b9e597b54 Don't build OpenSSL PKCS#7 code if OPENSSL_NO_CMS defined 2013-01-03 11:05:49 +01:00
Andreas Steffen 1c65b6c305 make pacman.sh run under cron 2012-12-26 09:28:17 +01:00
Tobias Brunner 97973f8609 Use a connection specific option to en-/disable IKEv1 fragmentation 2012-12-24 13:00:01 +01:00
Tobias Brunner e645c15b9c Include source port in init hash for fragmented messages 2012-12-24 12:29:31 +01:00
Tobias Brunner 2f62bb1549 Add an option to en-/disable IKE fragmentation 
Fragments are always accepted but will not be sent if disabled.  The
vendor ID is only sent if the option is enabled.
 2012-12-24 12:29:31 +01:00
Tobias Brunner 5cafefcd5d Split larger messages into fragments if IKE fragmentation is supported by peer 2012-12-24 12:29:31 +01:00
Tobias Brunner c849305ad7 Log message size for in- and outbound IKE messages 2012-12-24 12:29:30 +01:00
Tobias Brunner 07df944c9c Add support to create IKE fragments 
All fragments currently use the same fragment ID (1) as that's what
other implementations are doing.
 2012-12-24 12:29:30 +01:00
Tobias Brunner c4daac2c0b Log added NAT-T vendor IDs 2012-12-24 12:29:27 +01:00
Tobias Brunner 667720c801 Detect a peer's support for IKE fragmentation 
Fragments are accepted even if this vendor ID is not seen.
 2012-12-24 12:29:27 +01:00
Tobias Brunner fe26ddada9 Map fragmented initial initial Main or Aggressive Mode messages to the same IKE_SA 2012-12-24 12:29:27 +01:00
Tobias Brunner b816037739 Allow ID_PROT/AGGRESSIVE messages for established IKE_SAs if they contain fragments 
Other implementations send fragments always in an initial message type
even for transaction or quick mode exchanges.
 2012-12-24 12:29:27 +01:00