denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
16,308 Commits 1 Branch 0 Tags
d8eb1049d781a8e5ec8a484914aa6e3cf00d8d5d
Commit Graph
12800 Commits
Author SHA1 Message Date
Tobias Brunner 419ae9a20a ikev1: Default remote identity to %any for PSK lookup if not configured 
Otherwise, the remote identity is ignored when matching owner identities
of PSKs and this way matching PSKs that explicitly have %any assigned is
improved.

Fixes #2497.
 2017-12-22 10:37:32 +01:00
Tobias Brunner a9f3016ef3 stroke: Don't ignore %any as owner of shared secrets 
If users want to associate secrets with any identity, let 'em. This is
also possible with vici and might help if e.g. the remote identity is
actually %any as that would match a PSK with local IP and %any better
than one with local and different remote IP.

Fixes #2497.
 2017-12-22 10:33:27 +01:00
Tobias Brunner 3c36c95539 kernel-netlink: Fix compilation on old kernels not defining IFA_F_NODAD 
Fixes #2490.
 2017-12-22 10:28:05 +01:00
Tobias Brunner 381f6d982c kernel-pfkey: Fix extended replay configuration on FreeBSD 11.1 
Fixes: 88a8fba1c7 ("kernel-pfkey: Support anti-replay windows > 2k")
Fixes #2501.
 2017-12-22 10:19:49 +01:00
Tobias Brunner 6d98bb926e swanctl: Allow dots in authority/shared secret/pool names 
Use argument evaluation provided by settings_t instead of using strings
to enumerate key/values.

If section names contain dots the latter causes the names to get split
and interpreted as non-existing sections and subsections.

This currently doesn't work for connections and their subsections due to
the recursion.
 2017-12-22 10:11:21 +01:00
Tobias Brunner a7f613ca2e vici: Document NTLM secrets in README.md 
Fixes #2481.
 2017-12-22 10:09:26 +01:00
Tobias Brunner 859d645c44 vici: Accept XAUTH as shared key type too 
Fixes #2481.
 2017-12-22 10:09:22 +01:00
Lubomir Rintel 9a71b7219c charon-nm: Port to libnm 
libnm-glib is deprecated for several years and reaching the end of its
life. Let's switch to the more up-to-date library.

Closes strongswan/strongswan#85.
 2017-12-22 10:05:10 +01:00
Andreas Steffen 0fb293fc91 tpm_extendpcr: Extend digests into a TPM PCR 2017-12-13 07:10:28 +01:00
Andreas Steffen ee402a22a3 asn1: Added tlsfeature OID 2017-12-10 19:56:14 +01:00
Andreas Steffen 3e7a19bfa9 pki: Extend pki --print with --keyid parameter 2017-12-10 19:31:10 +01:00
Andreas Steffen acfd590ab6 imc-os: Derive device ID from private key bound to smartcard or TPM 2017-12-10 11:51:50 +01:00
Eyal Birger 2389168388 ipsec-types: Don't mask the mark value if it is one of the 'unique' values 
Support for mark=%unique/%unique-dir is implemented by using designated
magic mark values.

Use of masks is orthogonal to the 'unique' feature, as it is useful to be
able to designate portions of the packet mark for other purposes, while
still using different marks for different connections.

When these magic values are masked, their magic meaning is lost.

Perform masking only on explicit mark values.

Closes strongswan/strongswan#87.
 2017-12-07 09:36:53 +01:00
Lubomir Rintel ee22e8080f nm: Allow disabling libnm-glib 
The distros are eventually going to drop it, allow omitting it.

Closes strongswan/strongswan#86.
 2017-12-06 11:13:03 +01:00
Andreas Steffen 71cf3d709a pt-tls-client: Load certificates via handle from smartcard or TPM 2017-12-05 21:31:31 +01:00
Andreas Steffen e850d000b8 libtpmtss: Load X.509 certificates from TPM 2.0 NV RAM 2017-12-05 21:31:31 +01:00
Andreas Steffen fb1cf320a2 libtpmtss: Extend TPM 2.0 capability info 2017-12-05 21:31:31 +01:00
Tobias Brunner 0729be1bfe Merge branch 'android-proposals' 
Makes IKE and ESP proposals configurable.
 2017-11-28 16:23:41 +01:00
Tobias Brunner 4a79434b11 android: Remove modp1024 from the ESP proposals 2017-11-28 16:19:08 +01:00
Tobias Brunner 5a6f687bdf android: New release after adding configurable proposals 2017-11-17 18:11:43 +01:00
Tobias Brunner b03713add4 android: Validate proposal strings when importing profiles 2017-11-17 18:11:43 +01:00
Tobias Brunner 9f962f6c19 android: Validate proposal strings in the GUI 2017-11-17 18:11:43 +01:00
Tobias Brunner 836a943804 android: Add utility JNI function to validate proposal strings 2017-11-17 18:11:39 +01:00
Tobias Brunner 2307bffe56 proposal: Move proposal_t from libcharon to libstrongswan 
This allows us to use it without having to initialize libcharon, which
was required for the logging (we probably could have included debug.h
instead of daemon.h to workaround that but this seems more correct).
 2017-11-17 18:09:54 +01:00
Tobias Brunner 92c1b52487 android: Load JNI libraries in Application class 
This way they are also loaded when we don't use CharonVpnService.
 2017-11-17 18:05:35 +01:00
Tobias Brunner 2d1f65feb3 android: Make IKE/ESP proposals configurable in the GUI 2017-11-17 18:05:35 +01:00
Tobias Brunner 6403ad5457 android: Import IKE/ESP proposals 
We currently don't validate them here, only when used later will they
get parsed (which includes some checks).
 2017-11-17 14:31:06 +01:00
Tobias Brunner a7c43544dd android: Use optional custom proposals for IKE and ESP 
If the proposal is invalid we fall back to the defaults.
 2017-11-17 14:31:06 +01:00
Tobias Brunner 24c22a3fa8 android: Add properties for IKE and ESP proposals 2017-11-17 14:31:06 +01:00
Tobias Brunner 8b6c23342c android: Free settings string passed via JNI 2017-11-17 14:31:06 +01:00
Tobias Brunner f7a73fe0f7 hashers: Change names of SHA2 hash algorithms 
Keep the lower case names as they are as we use them internally (parsing
and e.g. in OpenSSL as identifier).
 2017-11-17 09:32:47 +01:00
Tobias Brunner 36ae037b81 ikev2: Add hash algorithm used for RSASSA-PSS signature to log message 2017-11-17 09:30:53 +01:00
Tobias Brunner dfd5f090fb hasher: Add uppercase short names for hash algorithms 2017-11-17 09:30:53 +01:00
Tobias Brunner 7a659c0f99 x509: Initialize signature params when parsing attribute certificates 2017-11-15 14:41:56 +01:00
Tobias Brunner 26d18f4efb sw-collector: Unmap history file on failure to instantiate extractor 2017-11-15 14:40:10 +01:00
Tobias Brunner 42353849cb charon: Explicitly check return value of fileno() 
This is mainly for Coverity because fchown() can't take a negative
value, which the -1 check implies is possible.
 2017-11-15 14:37:43 +01:00
Tobias Brunner be79839ea7 pkcs8: Add explicit comment for RSASSA-PSS fall-through 2017-11-15 14:33:05 +01:00
Tobias Brunner 7f1d944bc9 The pacman tool got replaced by the sec-updater tool 2017-11-15 12:18:17 +01:00
Tobias Brunner 527b3f0ca5 Fixed some typos, courtesy of codespell 2017-11-15 10:21:13 +01:00
Tobias Brunner c87b16d256 swanctl: Add check for conflicting short options 2017-11-13 10:09:41 +01:00
Tobias Brunner f0c7cbd1d7 swanctl: Properly register --counters commmand 
Use C instead of c, which is already used for --load-conns.
 2017-11-13 09:45:14 +01:00
Andreas Steffen 7df35af7cc libimcv: Updated imv database 2017-11-11 16:41:16 +01:00
Andreas Steffen 0d63255513 libtpmtss: Added missing argument in hasher_from_signature_scheme() 2017-11-10 11:47:27 +01:00
Tobias Brunner 291b02262d charon-tkm: Unlink PID file after deinit 
Same change as for charon in the previous commit.

References #2460.
 2017-11-10 10:56:13 +01:00
Tobias Brunner 1b4d97dbb7 charon: Unlink PID file after daemon deinit (i.e. after unloading plugins etc.) 
Make sure, though, that we only remove the file if we actually
created it (e.g. not for --help or --version).  And do so before
deinitializing libstrongswan due to leak detective.

Fixes #2460.
 2017-11-10 10:55:43 +01:00
Thomas Egerer 9cc61baaf5 unit-tests: Rename targets for libstrongswan and kernel-netlink 
libstrongswan and kernel-netlink are the only two components which do
not adhere to the naming scheme used for all other tests. If the tests
are run by an external application this imposes problems due to clashing
names.

Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
 2017-11-09 09:11:42 +01:00
Tobias Brunner fde0c763b6 auth-cfg: Add RSA/PSS schemes for pubkey and rsa if enabled in strongswan.conf 
Also document the rsa/pss prefix.
 2017-11-08 16:48:10 +01:00
Tobias Brunner 27a79326c7 pki: Enable PSS padding if enabled in strongswan.conf 2017-11-08 16:48:10 +01:00
Tobias Brunner d57af8dde0 pki: Optionally generate RSA/PSS signatures 2017-11-08 16:48:10 +01:00
Tobias Brunner 9b828ee85f pki: Indent usage lines properly automatically 2017-11-08 16:48:10 +01:00