denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
9,635 Commits 1 Branch 0 Tags
cc4eec56f73ef54386badc8732b1867cbe05b47f
Commit Graph
684 Commits
Author SHA1 Message Date
Tobias Brunner cc4eec56f7 Encode EAP-Naks in expanded format if we got an expanded type request 
Since methods defined by the IETF (vendor ID 0) could also be encoded in
expanded type format the previous check was insufficient.
 2012-08-31 11:40:27 +02:00
Tobias Brunner 78e8dca94f Allow clients to request a configured EAP method via EAP-Nak 2012-08-31 11:40:27 +02:00
Tobias Brunner 34742f1bf8 Virtual EAP methods handle EAP-Naks themselves 2012-08-31 11:40:27 +02:00
Tobias Brunner af04233e14 Send EAP-Nak with supported types if requested type is unsupported 2012-08-31 11:40:27 +02:00
Tobias Brunner 7cad171da8 Filter invalid EAP authentication types when enumerating them 
Valid authentication types defined by the IETF are 4-253 and 255.
 2012-08-31 11:37:45 +02:00
Tobias Brunner 078755d099 Added a method to enumerate registered EAP methods 2012-08-21 16:48:47 +02:00
Martin Willi 10bdc7a968 Remove the unused second IKE_SA entry match function argument 
LLVMs clang complains about this parameter, so remove it.
 2012-08-20 17:42:14 +02:00
Adrian-Ken Rueegsegger acf27437cd Add keymat_t constructor registration function 
Using the register_constructor function enables custom keymat_t
implementations per IKE version. If no constructor is registered the
default behavior is preserved.
 2012-08-20 13:02:47 +02:00
Tobias Brunner 09ae3d79ca Merge branch 'android-app' 
This branch introduces a userland IPsec implementation (libipsec) and an
Android App which targets the VpnService API that is provided by Android 4+.

The implementation is based on the bachelor thesis 'Userland IPsec for
Android 4' by Giuliano Grassi and Ralf Sager.
 2012-08-13 12:07:52 +02:00
Tobias Brunner e4ef4c9877 Merge branch 'android-ndk' 
This branch comes with some preliminary changes for the user-land IPsec
implementation and the Android App.

One important change is that the UDP ports used by the socket-default plugin
were made configurable (either via ./configure or strongswan.conf).
Also, the plugin does randomly allocate a port if it is configured to 0,
which is useful for client implementations.  A consequence of these
changes is that the local UDP port used when creating ike_cfg_t objects has
to be fetched from the socket.
 2012-08-13 10:45:39 +02:00
Martin Willi cd55a3cb77 Use actual daemon name to enable XAuth/PSK with aggressive mode 2012-08-10 11:53:18 +02:00
Tobias Brunner 5764a9b355 Moved packet_t to libstrongswan 2012-08-08 15:41:02 +02:00
Tobias Brunner f3fefb1847 Increase log verbosity when sending NAT keep-alives 2012-08-08 15:41:02 +02:00
Tobias Brunner b223d517c8 Replaced usages of CHARON_*_PORT with calls to get_port(). 2012-08-08 15:12:25 +02:00
Tobias Brunner 75f8316332 Use send_no_marker to send NAT keepalives. 2012-08-08 15:12:25 +02:00
Tobias Brunner e7ea057fd2 Make the UDP ports charon listens for packets on (and uses as source ports) configurable. 2012-08-08 15:07:43 +02:00
Martin Willi 4e98ca1800 Remove queued IKEv1 message before processing it 
Avoids destruction or processing of a queued message in
recursive process_message() call.
 2012-08-08 14:54:03 +02:00
Tobias Brunner 6204c1182d Include src address in hash of initial message for Main Mode 
If two initiators use the same SPI and also use the same SA proposal the
hash for the initial message would be exactly the same.  For IKEv2 and
Aggressive Mode that's not a problem as these messages include random
data (Ni, KEi payloads).
 2012-08-08 14:47:36 +02:00
Martin Willi 764035d515 Block XAuth transaction on established IKE_SAs, but allow Mode Config 2012-08-03 13:07:57 +02:00
Martin Willi 394b9f6b65 Reject initial exchange messages early once IKE_SA is established 2012-08-02 13:04:54 +02:00
Martin Willi f701ba8389 Lookup IKEv1 PSK even if the peer identity is not known 2012-07-31 15:39:33 +02:00
Martin Willi 777bcdc0d5 Don't include acquiring packet traffic selectors in IKEv1 
As we only can negotiate a single TS in IKEv1, don't prepend the
triggering packet TS, as we do in IKEv2. Otherwise we don't establish
the TS of the configuration, but only that of the triggering packet.

Fixes #207.
 2012-07-26 15:45:49 +02:00
Martin Willi 8b560a4565 Implement late peer config switching after XAuth authentication 
If additional authentication constraints, such as group membership,
is not fulfilled by an XAuth backend, we search for another
peer configuration that fulfills all constraints, including those
from phase1.
 2012-07-26 15:17:36 +02:00
Martin Willi 40ca05cff8 Check if XAuth round complies to configured authentication round 2012-07-26 12:40:27 +02:00
Martin Willi 9191946a63 Merge auth config items added from XAuth backends to IKE_SA 2012-07-26 12:07:48 +02:00
Martin Willi 81419807f5 Release leaking child config after uninstalling shunt policy 2012-07-23 17:15:40 +02:00
Martin Willi a564e4ca77 Refactored error handling in keymat_v1_t 2012-07-16 14:55:07 +02:00
Martin Willi 4decfae6c2 Clean up error handling in keymat_v2_t 2012-07-16 14:55:07 +02:00
Martin Willi 511f0b18b9 Cleaned up memory management and return values for encryption payload 2012-07-16 14:55:07 +02:00
Martin Willi 87dd205b61 Add a return value to hasher_t.allocate_hash() 2012-07-16 14:55:06 +02:00
Martin Willi e185612dd8 Add a return value to keymat_v1_t.{get,update,confirm}_iv 2012-07-16 14:55:06 +02:00
Martin Willi ce73fc19db Add a return value to crypter_t.set_key() 2012-07-16 14:53:38 +02:00
Martin Willi 3b96189a2a Add a return value to crypter_t.decrypt() 2012-07-16 14:53:38 +02:00
Martin Willi e35abbe588 Add a return value to crypter_t.encrypt 2012-07-16 14:53:37 +02:00
Tobias Brunner f1c78cfee7 Check rng return value when generating ME CONNECT_ID and KEY 2012-07-16 14:53:35 +02:00
Tobias Brunner 1bb9c51e87 Check rng return value when generating IKEv1 message IDs 2012-07-16 14:53:35 +02:00
Tobias Brunner 504918348d Check rng return value when generating COOKIE2 during MOBIKE 2012-07-16 14:53:35 +02:00
Tobias Brunner 92f207477c Check rng return value when generating fake NAT detection payloads 2012-07-16 14:53:35 +02:00
Tobias Brunner 5d91d8c469 Check rng return value when generating SPIs in ike_sa_manager_t 2012-07-16 14:53:35 +02:00
Reto Buerki 605985d122 Nonce: Let get_nonce, allocate_nonce return boolean 2012-07-16 14:53:34 +02:00
Martin Willi f3ca96b2bf Add a return value to prf_t.set_key() 2012-07-16 14:53:34 +02:00
Martin Willi ecc080b393 Add a return value to prf_t.allocate_bytes() 2012-07-16 14:53:34 +02:00
Martin Willi a7e6539135 Use a bool return value in keymat_v1_t.get_hash_phase2() 2012-07-16 14:53:34 +02:00
Martin Willi e4c5c1d03e Add a return value to keymat_v1_t.get_hash() 2012-07-16 14:53:34 +02:00
Martin Willi bb1e0c59e1 Add a return value to keymat_v2_t.get_auth_octets() 2012-07-16 14:53:34 +02:00
Martin Willi 2baae8e3ea Add a return value to keymat_v2_t.get_psk_sig() 2012-07-16 14:53:34 +02:00
Martin Willi bc47488323 Add a return value to prf_t.get_bytes() 2012-07-16 14:53:33 +02:00
Martin Willi edd54734c8 prf_plus_create() can return NULL on failure 2012-07-16 14:53:33 +02:00
Martin Willi 5d79e6c6b4 Add a return value to prf_plus_t.allocate_bytes() 2012-07-16 14:53:33 +02:00
Martin Willi 2d56575d52 Add a return value to signer_t.set_key() 2012-07-16 14:53:33 +02:00