Martin Willi
d634109f1d
Merge branch 'tfc-notify'
...
Introduces kernel backend features, sends ESP_TFC_PADDING_NOT_SUPPORTED if
kernel does not support it.
2013-03-01 11:16:58 +01:00
Martin Willi
5c55be4915
Send ESP_TFC_PADDING_NOT_SUPPORTED if the used kernel doesn't support it
2013-03-01 11:12:17 +01:00
Martin Willi
53e62f5d0c
Indicate support for processing ESPv3 TFC padding in Netlink IPsec backend
2013-03-01 11:11:51 +01:00
Martin Willi
76f7d80e80
Introduce "features" for the kernel backends returning kernel capabilities
2013-03-01 11:11:24 +01:00
Tobias Brunner
9a70fe8412
testing: Add a script to easily connect to a host via SSH
...
This doesn't require any entries in /etc/hosts and the correct SSH
config is used to allow password-less access.
2013-02-28 18:21:14 +01:00
Tobias Brunner
81f9cd39fd
openssl: Provide AES-GCM implementation
2013-02-28 18:17:42 +01:00
Tobias Brunner
a89ebab62e
Fix cleanup in crypto_tester if AEAD implementation fails
2013-02-28 18:17:42 +01:00
Tobias Brunner
5f7f4fa398
Order of arguments in Doxygen comment fixed
2013-02-28 18:17:42 +01:00
Tobias Brunner
8656f35ae1
Fix auth_cfg_t.clone() for single-valued auth rules
...
By using the default list enumerator and adding the rules with the public
add() method, clones of auth_cfg_t objects would return the values for
single-valued auth rules in the wrong order (i.e. the oldest instead of the
newest value was returned). Using the internal enumerator (which the comment
already suggested) fixes this, but the clone will not be a full clone as
it does not contain any old values for single-valued auth rules. Since
these will never be used anyway, this should be fine.
2013-02-28 18:11:38 +01:00
Tobias Brunner
6e935c6fe0
Trigger an updown event when destroying an IKE_SA based on INITIAL_CONTACT
...
In other cases (i.e. when functions return DESTROY_ME) the event should
already be triggered, but not in this forced situation.
2013-02-28 18:07:29 +01:00
Martin Willi
61f1693df1
Support different authentication schemes for PT-TLS
2013-02-28 16:46:08 +01:00
Martin Willi
807f2facd0
Request a TLS client certificate even if no peer identity is given
...
This allows a peer to perform client authentication if it wants, but skip
it if not.
2013-02-28 16:46:08 +01:00
Martin Willi
257c80cb5b
Wrap tls_t.get_{server,peer}_id methods in tls_socket_t
2013-02-28 16:46:08 +01:00
Martin Willi
2de481e32b
Delegate tls_t.get_{peer,server}_id to handshake layer
...
This allows to get updated peer identities if the peer can't authenticate,
or does when it is optional.
2013-02-28 16:46:08 +01:00
Martin Willi
2ae0c9e618
Implement a SASL PLAIN mechanism using shared secrets
2013-02-28 16:46:07 +01:00
Martin Willi
66d8fd690c
Implement SASL authentication in PT-TLS client
2013-02-28 16:46:07 +01:00
Martin Willi
3542c4f18a
Implement SASL authentication in PT-TLS server
2013-02-28 16:46:07 +01:00
Martin Willi
5b1a10836c
Define PT-TLS SASL result codes
2013-02-28 16:46:07 +01:00
Martin Willi
4a801beb3e
Define an interface for SASL mechanisms and provide a static factory
2013-02-28 16:46:07 +01:00
Martin Willi
806126eab2
Pass a client identity to pt_tls_client, usable for TLS or SASL authentication
2013-02-28 16:46:07 +01:00
Martin Willi
55854ecc25
Don't close underlying file descriptor before destroying a tls_socket
...
tls_socket cleanup usually sends a TLS close notify, for which it uses a valid
socket.
2013-02-28 16:46:07 +01:00
Martin Willi
d8a94c18c6
Apply a mutual EAP auth_cfg not before the EAP method completes
2013-02-26 13:15:27 +01:00
Martin Willi
cc787697b8
Be a little more verbose why a peer_cfg is inacceptable
2013-02-26 13:15:27 +01:00
Martin Willi
289b9b7b31
Refactor auth_cfg applying to a common function
2013-02-26 13:15:27 +01:00
Tobias Brunner
bc07fef09c
Use SIGUSR2 for SIG_CANCEL on Android
...
SIGRTMIN is defined as 32 while sigset_t is defined as
unsigned long (i.e. holds 32 signals). Hence, the signal
could never be blocked. Sending the signal still canceled
threads, but sometimes in situations where they shouldn't
have been canceled (e.g. while holding a lock).
Fixes #298 .
2013-02-26 11:40:34 +01:00
Tobias Brunner
0ac34e9e6a
Android.mk updated to latest Makefiles
...
Fixes #300 .
2013-02-26 10:11:36 +01:00
Martin Willi
e2857be823
For IKEv1 Main Mode, use message hash to detect early retransmissions
...
As the message ID is zero in all Main Mode messages, it can't be used to detect
if we are already processing a given message.
2013-02-25 12:12:38 +01:00
Martin Willi
cdf75a39e3
Move initial message dropping to task manager
...
When the last request message of the initial tunnel setup is retransmitted,
we must retransmit the response instead of ignoring the request.
Fixes #295 .
2013-02-25 12:12:19 +01:00
Martin Willi
9eaed7a5bb
Use INIT macro to initialize IKE_SA manager entries
2013-02-25 12:10:02 +01:00
Reto Buerki
b32e732b2f
Check kvm command existence in start-testing
2013-02-22 19:22:08 +01:00
Martin Willi
b443fa6123
Don't reject OPAQUE ports while verifying traffic selector substructure
2013-02-21 11:52:33 +01:00
Martin Willi
0abeac3a0b
Document ipsec.conf leftprotoport extensions in manpage
2013-02-21 11:52:33 +01:00
Martin Willi
0e7ef7f522
Optionally support port ranges in leftprotoport
2013-02-21 11:52:33 +01:00
Martin Willi
fd658bce28
Support %opaque keyword in leftprotoport for "opaque" ports
2013-02-21 11:52:33 +01:00
Martin Willi
cd41b951ee
Pass complete port range over stroke interface for more flexibility
2013-02-21 11:52:33 +01:00
Martin Willi
a1db77de7c
Use a complete port range in traffic_selector_create_from_{subnet,cidr}
2013-02-21 11:52:33 +01:00
Martin Willi
c572b5c8c1
Print OPAQUE traffic selectors as what they are, not as port range
2013-02-21 11:52:33 +01:00
Martin Willi
7b368af61a
Support "opaque" ports in traffic selector subset calculation
2013-02-21 10:51:19 +01:00
Martin Willi
7dbe1feef1
Slightly refactor traffic_selector_t.get_subset()
2013-02-21 10:48:48 +01:00
Martin Willi
de5d569b24
Migrate remaining traffic selector methods to METHOD macro
2013-02-21 10:28:21 +01:00
Tobias Brunner
0d237763dc
openssl: Disable PKCS#7/CMS when building against OpenSSL < 0.9.8g
...
Fixes #292 .
2013-02-20 18:34:54 +01:00
Martin Willi
a2fd08dd26
Install a route for shunt policies
...
If we install a virtual IP, its source route would render the shunt policy
useless, as locally generated traffic wouldn't match. Having a route for each
shunt policy with higher priority chooses the correct source address for
bypassed destinations.
2013-02-20 16:32:24 +01:00
Martin Willi
122b4b6e6d
Include local address for Unity Split-Exclude shunt policies
...
If we use a virtual IP, having a shunt policy for just that wouldn't work, as
we want a shunt bypass using the local address.
2013-02-20 16:15:39 +01:00
Martin Willi
3dc9d427c9
After IKEv1 reauthentication, reinstall VIP routes after migrating CHILD_SAs
...
During IKEv1 reauthentication, the virtual IP gets removed, then reinstalled.
The CHILD_SAs get migrated, but any associated route gets removed from the
kernel. Reinstall routes after adding the virtual IP again.
2013-02-20 09:16:00 +01:00
Martin Willi
f836d433a9
When detecting a duplicate IKEv1 SA, adopt children, as it might be a rekeying
2013-02-20 08:57:17 +01:00
Andreas Steffen
7a93844f21
version bump to 5.0.3dr2
2013-02-19 20:25:13 +01:00
Andreas Steffen
371b752f00
treat IF-M and IF-TNCCS remediation instructions/parameters in an equal way
2013-02-19 20:00:57 +01:00
Martin Willi
295e42a47f
systime-fix disables certificate lifetime validation if system time not synced
...
The system time can be periodically checked. If it gets valid, certificates get
rechecked with the current lifetime. If certificates are invalid, associated
IKE_SAs can be closed or reauthenticated.
2013-02-19 17:11:14 +01:00
Martin Willi
0ed31e7284
Add a stub for systime-fix, a plugin handling certificate lifetimes gracefully
2013-02-19 14:49:38 +01:00
Martin Willi
de399f550d
Add a cert_validator hook allowing plugins to provide custom lifetime checking
2013-02-19 14:31:18 +01:00
Martin Willi