23 months agochild-sa: Install drop policies while updating IPsec SAs and policies
Tobias Brunner [Tue, 6 Feb 2018 17:07:34 +0000 (18:07 +0100)]
child-sa: Install drop policies while updating IPsec SAs and policies

If we have to remove and reinstall SAs for address updates (as with the
Linux kernel) there is a short time where there is no SA installed.  If
we keep the policies installed they (or any traps) might cause acquires
and temporary kernel states that could prevent the updated SA from
getting installed again.

This replaces the previous workaround to avoid plaintext traffic leaks
during policy updates, which used low-priority drop policies.

23 months agokernel-netlink: Optionally trigger roam events on routing rule changes
Tobias Brunner [Mon, 29 Jan 2018 14:26:17 +0000 (15:26 +0100)]
kernel-netlink: Optionally trigger roam events on routing rule changes

This can be useful if routing rules (instead of e.g. route metrics) are used
to switch from one to another interface (i.e. from one to another
routing table).  Since we currently don't evaluate routing rules when
doing the route lookup this is only useful if the kernel-based route
lookup is used.

Resolves strongswan/strongswan#88.

23 months agoike-sa: Remove unused counter for pending MOBIKE updates
Tobias Brunner [Mon, 29 Jan 2018 13:30:35 +0000 (14:30 +0100)]
ike-sa: Remove unused counter for pending MOBIKE updates

23 months agoike-mobike: Only ignore MOBIKE responses if an actual update is queued
Tobias Brunner [Mon, 29 Jan 2018 11:34:33 +0000 (12:34 +0100)]
ike-mobike: Only ignore MOBIKE responses if an actual update is queued

The counter does not tell us what task is actually queued, so we might
ignore the response to an update (with NAT-D payloads) if only an address
update is queued.

23 months agoikev2: Update currently queued MOBIKE task
Tobias Brunner [Mon, 29 Jan 2018 10:49:50 +0000 (11:49 +0100)]
ikev2: Update currently queued MOBIKE task

Instead of destroying the new task and keeping the existing one we
update any already queued task, so we don't loose any work (e.g. if a
DPD task is active and address update is queued and we'd actually like
to queue a roam task).

23 months agoike-mobike: Don't reset address update flag if set previously
Tobias Brunner [Mon, 29 Jan 2018 10:44:36 +0000 (11:44 +0100)]
ike-mobike: Don't reset address update flag if set previously

If we update a queued job we don't want to reset previously set task

23 months agoike: Add log message if host moves out of NAT
Tobias Brunner [Fri, 26 Jan 2018 13:03:33 +0000 (14:03 +0100)]
ike: Add log message if host moves out of NAT

23 months agotesting: Add ikev2/mobike-virtual-ip-nat scenario
Tobias Brunner [Fri, 26 Jan 2018 12:50:04 +0000 (13:50 +0100)]
testing: Add ikev2/mobike-virtual-ip-nat scenario

This tests moving from a public IP behind a NAT and back (with proper
changes of the UDP encapsulation).

23 months agoikev1: Properly handle fragmented Quick Mode messages
Tobias Brunner [Tue, 30 Jan 2018 10:33:15 +0000 (11:33 +0100)]
ikev1: Properly handle fragmented Quick Mode messages

23 months agolibradius: Pad received MSK to at least 64 bytes
Tobias Brunner [Fri, 26 Jan 2018 08:51:07 +0000 (09:51 +0100)]
libradius: Pad received MSK to at least 64 bytes

According to RFC 3748 MSKs must be at least 64 bytes, however, that's
not the case for the MSK derived via EAP-MSCHAPv2.  The two key parts
received are only 16 bytes each (derived according to RFC 3079,
section 3.3), so we end up with an MSK of only 32 bytes. The eap-mschapv2
plugin, on the other hand, pads these two parts with 32 zeros.

Interestingly, this is not a problem in many cases as the SHA1/2 based
PRFs used later use a block size that's >= 64 bytes, so the shorter MSK
is just padded with zeros then.  However, with AES-XCBC-PRF-128, for
instance, which uses a block size of 16 bytes, the different MSKs are an
issue as XCBC is applied to both to shorten them, with different results.
This eventually causes the authentication to fail if the client uses a
zero-padded MSK produced by the eap-mschapv2 plugin and the server the 32
byte MSK received via RADIUS.

23 months agoman: Fix documentation of pubkey constraints
Tobias Brunner [Tue, 23 Jan 2018 10:35:03 +0000 (11:35 +0100)]
man: Fix documentation of pubkey constraints

Hash algorithms have to be repeated for multiple key types.

References #2514.

23 months agoMerge branch 'dh-group-rekey'
Tobias Brunner [Fri, 9 Feb 2018 09:28:44 +0000 (10:28 +0100)]
Merge branch 'dh-group-rekey'

These changes improve rekeying after the peer initially selected a
different DH group than we proposed.  Instead of using the configured DH
group again, and causing another INVALID_KE_PAYLOAD notify, we now reuse
the previously negotiated group.  We also send the selected DH group
first in the proposals (and move proposals that don't contain the group
to the back) so that implementations that select the proposal first and
without consulting the KE payload (e.g. strongSwan when preferring the
client's proposals) will see the preferred group first.

Fixes #2526.

23 months agochild-create: Promote selected DH group, demote proposals that don't contain it
Tobias Brunner [Fri, 2 Feb 2018 11:04:18 +0000 (12:04 +0100)]
child-create: Promote selected DH group, demote proposals that don't contain it

23 months agoike-init: Promote selected DH group and demote proposals that don't contain it
Tobias Brunner [Fri, 2 Feb 2018 10:49:18 +0000 (11:49 +0100)]
ike-init: Promote selected DH group and demote proposals that don't contain it

23 months agoproposal: Add method to move a given DH group to the front
Tobias Brunner [Fri, 2 Feb 2018 10:32:39 +0000 (11:32 +0100)]
proposal: Add method to move a given DH group to the front

This way a responder (like strongSwan) selecting a proposal first and
then checking if the KE payload matches sees the peer's preferred group

23 months agounit-tests: Make sure we reuse the DH group during CHILD_SA rekeying
Tobias Brunner [Fri, 2 Feb 2018 10:11:38 +0000 (11:11 +0100)]
unit-tests: Make sure we reuse the DH group during CHILD_SA rekeying

23 months agoike-init: Make DH group reuse optional to test INVALID_KE_PAYLOAD handling
Tobias Brunner [Fri, 2 Feb 2018 09:59:25 +0000 (10:59 +0100)]
ike-init: Make DH group reuse optional to test INVALID_KE_PAYLOAD handling

This is currently not an issue for CHILD_SA rekeying tests as these only
check rekeyings of the CHILD_SA created with the IKE_SA, i.e. there is
no previous DH group to reuse.

23 months agochild-rekey: Use previously negotiated DH group when rekeying CHILD_SAs
Tobias Brunner [Fri, 2 Feb 2018 09:48:21 +0000 (10:48 +0100)]
child-rekey: Use previously negotiated DH group when rekeying CHILD_SAs

For the CHILD_SA created with the IKE_SA the group won't be set in the
proposal, so we will use the first one configure just as if the SA was
created new with a CREATE_CHILD_SA exchange.  I guess we could
theoretically try to use the DH group negotiated for IKE but then this
would get a lot more complicated as we'd have to check if that group is
actually contained in any of the CHILD_SA's configured proposals.

23 months agochild-create: Add an option to set the DH group to be used
Tobias Brunner [Fri, 2 Feb 2018 09:43:17 +0000 (10:43 +0100)]
child-create: Add an option to set the DH group to be used

23 months agoike-init: Reuse the DH group of the previous IKE_SA when rekeying
Tobias Brunner [Fri, 2 Feb 2018 09:29:35 +0000 (10:29 +0100)]
ike-init: Reuse the DH group of the previous IKE_SA when rekeying

23 months agoike-init: Move creation of DH instance after INVALID_KE_PAYLOAD to build_i()
Tobias Brunner [Fri, 2 Feb 2018 09:26:36 +0000 (10:26 +0100)]
ike-init: Move creation of DH instance after INVALID_KE_PAYLOAD to build_i()

This way we get proper error handling if the DH group the peer requested
is not actually supported for some reason (otherwise we'd just retry to
initiate with the configured group and get back another notify).

23 months agochild-cfg: Strip DH groups from both compared proposals
Tobias Brunner [Mon, 22 Jan 2018 13:33:40 +0000 (14:33 +0100)]
child-cfg: Strip DH groups from both compared proposals

This fixes two issues, one is a bug if a DH group is configured for the
local ESP proposals and charon.prefer_configured_proposals is disabled.
This would cause the DH groups to get stripped not from the configured but
from the supplied proposal, which usually already has them stripped.  So
the proposals wouldn't match.  We'd have to always strip them from the local
proposal.  Since there are apparently implementations that, incorrectly, don't
remove the DH groups in the IKE_AUTH exchange (e.g. WatchGuard XTM25
appliances) we just strip them from both proposals.  It's a bit more lenient
that way and we don't have to complicate the code to only clone and strip the
local proposal, which would depend on a flag.

References #2503.

23 months agoike: Don't handle roam events if no IKE config is available
Tobias Brunner [Wed, 20 Dec 2017 11:32:52 +0000 (12:32 +0100)]
ike: Don't handle roam events if no IKE config is available

IKE_SAs newly created via HA_IKE_ADD message don't have any IKE or peer
config assigned yet (this happens later with an HA_IKE_UPDATE message).
And because the state is initially set to IKE_CONNECTING the roam() method
does not immediately return, as it later would for passive HA SAs. This
might cause the check for explicitly configured local addresses to crash
the daemon with a segmentation fault.

Fixes #2500.

23 months agocharon-tkm: Update to latest Anet version
Adrian-Ken Rueegsegger [Tue, 6 Feb 2018 17:46:27 +0000 (18:46 +0100)]
charon-tkm: Update to latest Anet version

23 months agoandroid: New release after changing cert sending policy
Tobias Brunner [Thu, 8 Feb 2018 11:26:11 +0000 (12:26 +0100)]
android: New release after changing cert sending policy

23 months agoandroid: Always send the client certificate
Tobias Brunner [Thu, 8 Feb 2018 11:15:36 +0000 (12:15 +0100)]
android: Always send the client certificate

In scenarios where the server accepts client certificates from dozens or
even hundreds of CAs it might be necessary to omit certificate request
payloads from the IKE_SA_INIT response to avoid fragmentation.

As it is rarely the case in road-warrior scenarios that the server
already has the client certificate installed it should not be a problem
to always send it.

23 months agoauth-cfg: Classify key strengths as multi value rules
Tobias Brunner [Tue, 23 Jan 2018 11:01:02 +0000 (12:01 +0100)]
auth-cfg: Classify key strengths as multi value rules

If that's not the case only the last value added would be considered
not all the keys of a trust chain.

Fixes #2515.

23 months agocharon-nm: Remove unused variable
Tobias Brunner [Mon, 5 Feb 2018 14:11:03 +0000 (15:11 +0100)]
charon-nm: Remove unused variable

23 months agoVersion bump to 5.6.2dr4 5.6.2dr4
Andreas Steffen [Sat, 3 Feb 2018 10:05:21 +0000 (11:05 +0100)]
Version bump to 5.6.2dr4

23 months agotesting: Ignore IP-in-IP SAs created with IPComp SAs that remain in the kernel
Tobias Brunner [Thu, 1 Feb 2018 16:10:19 +0000 (17:10 +0100)]
testing: Ignore IP-in-IP SAs created with IPComp SAs that remain in the kernel

The kernel creates such SAs to handle uncompressed small packets.  They
are implicitly created and deleted with IPComp SAs.  The problem is that
when we delete an IPComp SA only that state is deleted and removed from
the SA lists immediately, the IP-in-IP state is not removed until the IPComp
state is eventually destroyed.  This could take a while if there are still
references to it around.  So the IP-in-IP states will keep getting reported
by ip xfrm state until that happens (we also can't flush or explicitly delete
such kernel-created states).

In kernels before 4.14 this wasn't really a problem but since
ec30d78c14a8 ("xfrm: add xdst pcpu cache") the kernel seems to keep the
references to the last used SAs around a lot longer.

Also, usually a test scenario following an IPComp scenario will create
and use new SAs and thus the cached SAs will disappear before the kernel
state is checked again.  However, if a following scenario uses different
hosts the states might remain, which caused some unrelated scenarios to
fail before adding this fix.

23 months agotesting: Added Linux 4.14 and 4.15 config files
Andreas Steffen [Wed, 31 Jan 2018 20:32:45 +0000 (21:32 +0100)]
testing: Added Linux 4.14 and 4.15 config files

23 months agogmp: Fix compatibility with older libgmp releases
Tobias Brunner [Tue, 23 Jan 2018 08:51:52 +0000 (09:51 +0100)]
gmp: Fix compatibility with older libgmp releases

Older releases don't have mpz_powm_sec() and mpz_inits() yet.

Fixes #2505.

23 months agorevocation: Skip any zero bytes when comparing serials in CRLs
Tobias Brunner [Wed, 24 Jan 2018 13:42:28 +0000 (14:42 +0100)]
revocation: Skip any zero bytes when comparing serials in CRLs

Depending on the plugins that eventually parse the certificate and CRL,
serials with MSB set (i.e. negative numbers that have a zero byte prefixed
when encoded as ASN.1 INTEGER) might have (x509 plugin) or not have
(openssl plugin) a zero byte prefix when returned by get_serial() or
enumerated from the CRL.  Strip them before doing the comparison or
revocation checking might fail if not both credentials are parsed by the
same plugin (which should be rare and only happen if parsing of either
cert or CRL fails with one of the plugins and there is a fallback to the
implementation provided by the other plugin).

Fixes #2509.

23 months agoeap: Reset errno before calling strtoul() to parse EAP type
Reinhard Pfau [Tue, 23 Jan 2018 09:09:14 +0000 (10:09 +0100)]
eap: Reset errno before calling strtoul() to parse EAP type

Reset errno to 0 before calling strtoul() since it sets errno only on
error cases. So the following test fails even on correct conversions if
errno had a value != 0.

Fixes #2506.

2 years agolibtpmtss: Return after failure
Andreas Steffen [Tue, 9 Jan 2018 15:12:40 +0000 (16:12 +0100)]
libtpmtss: Return after failure

2 years agotravis: Disable NM build until we run on a newer image that provides libnm
Tobias Brunner [Fri, 22 Dec 2017 09:41:12 +0000 (10:41 +0100)]
travis: Disable NM build until we run on a newer image that provides libnm

Ubuntu 16.04 (xenial) might soon be available but it's not yet supported

2 years agoikev1: Default remote identity to %any for PSK lookup if not configured
Tobias Brunner [Wed, 20 Dec 2017 09:28:31 +0000 (10:28 +0100)]
ikev1: Default remote identity to %any for PSK lookup if not configured

Otherwise, the remote identity is ignored when matching owner identities
of PSKs and this way matching PSKs that explicitly have %any assigned is

Fixes #2497.

2 years agostroke: Don't ignore %any as owner of shared secrets
Tobias Brunner [Wed, 20 Dec 2017 09:13:39 +0000 (10:13 +0100)]
stroke: Don't ignore %any as owner of shared secrets

If users want to associate secrets with any identity, let 'em. This is
also possible with vici and might help if e.g. the remote identity is
actually %any as that would match a PSK with local IP and %any better
than one with local and different remote IP.

Fixes #2497.

2 years agokernel-netlink: Fix compilation on old kernels not defining IFA_F_NODAD
Tobias Brunner [Mon, 11 Dec 2017 09:35:30 +0000 (10:35 +0100)]
kernel-netlink: Fix compilation on old kernels not defining IFA_F_NODAD

Fixes #2490.

2 years agoMerge branch 'testing-route-based'
Tobias Brunner [Fri, 22 Dec 2017 09:23:46 +0000 (10:23 +0100)]
Merge branch 'testing-route-based'

This adds several route-based VPN scenarios (using VTI or GRE interfaces).

It also fixes several swanctl --list-sas checks in other scenarios.

Closes strongswan/strongswan#84.

2 years agotesting: Fix swanctl --list-sas checks in some scenarios
Tobias Brunner [Wed, 6 Dec 2017 11:57:06 +0000 (12:57 +0100)]
testing: Fix swanctl --list-sas checks in some scenarios

::YES was missing (or written as ::YES]) rendering those checks void.
Turns out some of them actually were wrong.

2 years agotesting: Add route-based/net2net-gre scenario
Tobias Brunner [Wed, 6 Dec 2017 11:54:35 +0000 (12:54 +0100)]
testing: Add route-based/net2net-gre scenario

2 years agotesting: Enable GRE support in 4.13 config
Tobias Brunner [Wed, 6 Dec 2017 11:14:11 +0000 (12:14 +0100)]
testing: Enable GRE support in 4.13 config

Also enables IPv6 support for VTI devices.

2 years agotesting: Add route-based/net2net-vti scenario
Robin McCorkell [Sun, 3 Dec 2017 13:42:57 +0000 (13:42 +0000)]
testing: Add route-based/net2net-vti scenario

2 years agotesting: Added route-based/rw-shared-vti-ip6-in-ip4 scenario
Robin McCorkell [Wed, 29 Nov 2017 12:39:24 +0000 (12:39 +0000)]
testing: Added route-based/rw-shared-vti-ip6-in-ip4 scenario

2 years agotesting: Added route-based/rw-shared-vti scenario
Robin McCorkell [Wed, 29 Nov 2017 11:55:49 +0000 (11:55 +0000)]
testing: Added route-based/rw-shared-vti scenario

2 years agotesting: Enable VTI module in kernel config
Robin McCorkell [Wed, 29 Nov 2017 11:31:13 +0000 (11:31 +0000)]
testing: Enable VTI module in kernel config

2 years agotesting: Override user environment PATH in chroot
Robin McCorkell [Mon, 27 Nov 2017 16:46:22 +0000 (16:46 +0000)]
testing: Override user environment PATH in chroot

chroot will capture the user environment's PATH variable, which may be
wrong (e.g. not include /bin:/sbin, as it is on Arch). We should set a
known-working PATH variable in the chroot.

2 years agokernel-pfkey: Fix extended replay configuration on FreeBSD 11.1
Tobias Brunner [Mon, 4 Dec 2017 09:01:14 +0000 (10:01 +0100)]
kernel-pfkey: Fix extended replay configuration on FreeBSD 11.1

Fixes: 88a8fba1c76e ("kernel-pfkey: Support anti-replay windows > 2k")
Fixes #2501.

2 years agoswanctl: Allow dots in authority/shared secret/pool names
Tobias Brunner [Thu, 30 Nov 2017 08:09:39 +0000 (09:09 +0100)]
swanctl: Allow dots in authority/shared secret/pool names

Use argument evaluation provided by settings_t instead of using strings
to enumerate key/values.

If section names contain dots the latter causes the names to get split
and interpreted as non-existing sections and subsections.

This currently doesn't work for connections and their subsections due to
the recursion.

2 years agovici: Document NTLM secrets in
Tobias Brunner [Wed, 29 Nov 2017 13:33:21 +0000 (14:33 +0100)]
vici: Document NTLM secrets in

Fixes #2481.

2 years agovici: Accept XAUTH as shared key type too
Tobias Brunner [Wed, 29 Nov 2017 13:21:56 +0000 (14:21 +0100)]
vici: Accept XAUTH as shared key type too

Fixes #2481.

2 years agocharon-nm: Port to libnm
Lubomir Rintel [Thu, 30 Nov 2017 12:02:02 +0000 (13:02 +0100)]
charon-nm: Port to libnm

libnm-glib is deprecated for several years and reaching the end of its
life. Let's switch to the more up-to-date library.

Closes strongswan/strongswan#85.

2 years agotravis: Disable warning that causes a false positive in Xcode 8.3+
Tobias Brunner [Fri, 8 Dec 2017 08:59:13 +0000 (09:59 +0100)]
travis: Disable warning that causes a false positive in Xcode 8.3+

Xcode 8.3, to which there recently was a switch, spits out a warning for
the potentially unaligned access to ip6_plen in ip-packet.c, which we
explicitly read via untoh16() hence the access to that pointer is not
actually unaligned.  It seems the compiler is not able to determine that
there is no unaligned access even though the function is defined in the
header and marked inline.

2 years agoVersion bump to 5.6.2dr3 5.6.2dr3
Andreas Steffen [Wed, 13 Dec 2017 07:54:54 +0000 (08:54 +0100)]
Version bump to 5.6.2dr3

2 years agotpm_extendpcr: Extend digests into a TPM PCR
Andreas Steffen [Tue, 12 Dec 2017 16:42:08 +0000 (17:42 +0100)]
tpm_extendpcr: Extend digests into a TPM PCR

2 years agoVersion bump to 5.6.2dr2 5.6.2dr2
Andreas Steffen [Sun, 10 Dec 2017 20:42:02 +0000 (21:42 +0100)]
Version bump to 5.6.2dr2

2 years agoasn1: Added tlsfeature OID
Andreas Steffen [Mon, 4 Dec 2017 09:23:57 +0000 (10:23 +0100)]
asn1: Added tlsfeature OID

2 years agopki: Extend pki --print with --keyid parameter
Andreas Steffen [Sun, 10 Dec 2017 18:31:10 +0000 (19:31 +0100)]
pki: Extend pki --print with --keyid parameter

2 years agoimc-os: Derive device ID from private key bound to smartcard or TPM
Andreas Steffen [Sun, 10 Dec 2017 10:51:03 +0000 (11:51 +0100)]
imc-os: Derive device ID from private key bound to smartcard or TPM

2 years agoipsec-types: Don't mask the mark value if it is one of the 'unique' values
Eyal Birger [Thu, 30 Nov 2017 08:47:01 +0000 (10:47 +0200)]
ipsec-types: Don't mask the mark value if it is one of the 'unique' values

Support for mark=%unique/%unique-dir is implemented by using designated
magic mark values.

Use of masks is orthogonal to the 'unique' feature, as it is useful to be
able to designate portions of the packet mark for other purposes, while
still using different marks for different connections.

When these magic values are masked, their magic meaning is lost.

Perform masking only on explicit mark values.

Closes strongswan/strongswan#87.

2 years agonm: Allow disabling libnm-glib
Lubomir Rintel [Thu, 30 Nov 2017 12:24:37 +0000 (13:24 +0100)]
nm: Allow disabling libnm-glib

The distros are eventually going to drop it, allow omitting it.

Closes strongswan/strongswan#86.

2 years agoVersion bump to 5.6.2dr1 5.6.2dr1
Andreas Steffen [Tue, 5 Dec 2017 21:23:43 +0000 (22:23 +0100)]
Version bump to 5.6.2dr1

2 years agopt-tls-client: Load certificates via handle from smartcard or TPM
Andreas Steffen [Tue, 5 Dec 2017 19:41:43 +0000 (20:41 +0100)]
pt-tls-client: Load certificates via handle from smartcard or TPM

2 years agolibtpmtss: Load X.509 certificates from TPM 2.0 NV RAM
Andreas Steffen [Tue, 5 Dec 2017 16:08:55 +0000 (17:08 +0100)]
libtpmtss: Load X.509 certificates from TPM 2.0 NV RAM

2 years agolibtpmtss: Extend TPM 2.0 capability info
Andreas Steffen [Mon, 4 Dec 2017 16:46:23 +0000 (17:46 +0100)]
libtpmtss: Extend TPM 2.0 capability info

2 years agoMerge branch 'android-proposals'
Tobias Brunner [Tue, 28 Nov 2017 15:23:41 +0000 (16:23 +0100)]
Merge branch 'android-proposals'

Makes IKE and ESP proposals configurable.

2 years agoandroid: Remove modp1024 from the ESP proposals
Tobias Brunner [Tue, 28 Nov 2017 15:19:08 +0000 (16:19 +0100)]
android: Remove modp1024 from the ESP proposals

2 years agotesting: Explicitly deliver all test results as text/plain
Tobias Brunner [Tue, 28 Nov 2017 15:16:18 +0000 (16:16 +0100)]
testing: Explicitly deliver all test results as text/plain

2 years agoVersion bump to 5.6.1 5.6.1
Andreas Steffen [Fri, 17 Nov 2017 21:42:28 +0000 (22:42 +0100)]
Version bump to 5.6.1

2 years agotesting: Added swanctl/rw-cert-pss scenario
Andreas Steffen [Fri, 17 Nov 2017 21:42:07 +0000 (22:42 +0100)]
testing: Added swanctl/rw-cert-pss scenario

2 years agoandroid: New release after adding configurable proposals
Tobias Brunner [Fri, 17 Nov 2017 17:07:09 +0000 (18:07 +0100)]
android: New release after adding configurable proposals

2 years agoandroid: Validate proposal strings when importing profiles
Tobias Brunner [Fri, 17 Nov 2017 16:45:52 +0000 (17:45 +0100)]
android: Validate proposal strings when importing profiles

2 years agoandroid: Validate proposal strings in the GUI
Tobias Brunner [Fri, 17 Nov 2017 16:40:52 +0000 (17:40 +0100)]
android: Validate proposal strings in the GUI

2 years agoandroid: Add utility JNI function to validate proposal strings
Tobias Brunner [Fri, 17 Nov 2017 16:26:51 +0000 (17:26 +0100)]
android: Add utility JNI function to validate proposal strings

2 years agoproposal: Move proposal_t from libcharon to libstrongswan
Tobias Brunner [Fri, 17 Nov 2017 16:15:14 +0000 (17:15 +0100)]
proposal: Move proposal_t from libcharon to libstrongswan

This allows us to use it without having to initialize libcharon, which
was required for the logging (we probably could have included debug.h
instead of daemon.h to workaround that but this seems more correct).

2 years agoandroid: Load JNI libraries in Application class
Tobias Brunner [Fri, 17 Nov 2017 15:41:52 +0000 (16:41 +0100)]
android: Load JNI libraries in Application class

This way they are also loaded when we don't use CharonVpnService.

2 years agoandroid: Make IKE/ESP proposals configurable in the GUI
Tobias Brunner [Tue, 14 Nov 2017 10:18:13 +0000 (11:18 +0100)]
android: Make IKE/ESP proposals configurable in the GUI

2 years agoandroid: Import IKE/ESP proposals
Tobias Brunner [Tue, 14 Nov 2017 09:23:09 +0000 (10:23 +0100)]
android: Import IKE/ESP proposals

We currently don't validate them here, only when used later will they
get parsed (which includes some checks).

2 years agoandroid: Use optional custom proposals for IKE and ESP
Tobias Brunner [Tue, 14 Nov 2017 08:49:24 +0000 (09:49 +0100)]
android: Use optional custom proposals for IKE and ESP

If the proposal is invalid we fall back to the defaults.

2 years agoandroid: Add properties for IKE and ESP proposals
Tobias Brunner [Tue, 14 Nov 2017 09:18:59 +0000 (10:18 +0100)]
android: Add properties for IKE and ESP proposals

2 years agoandroid: Free settings string passed via JNI
Tobias Brunner [Fri, 10 Nov 2017 17:14:26 +0000 (18:14 +0100)]
android: Free settings string passed via JNI

2 years agoNEWS: Added some news for 5.6.1
Tobias Brunner [Fri, 17 Nov 2017 08:30:02 +0000 (09:30 +0100)]
NEWS: Added some news for 5.6.1

2 years agohashers: Change names of SHA2 hash algorithms
Tobias Brunner [Fri, 17 Nov 2017 08:31:19 +0000 (09:31 +0100)]
hashers: Change names of SHA2 hash algorithms

Keep the lower case names as they are as we use them internally (parsing
and e.g. in OpenSSL as identifier).

2 years agoikev2: Add hash algorithm used for RSASSA-PSS signature to log message
Tobias Brunner [Wed, 8 Nov 2017 17:08:08 +0000 (18:08 +0100)]
ikev2: Add hash algorithm used for RSASSA-PSS signature to log message

2 years agohasher: Add uppercase short names for hash algorithms
Tobias Brunner [Thu, 16 Nov 2017 16:13:36 +0000 (17:13 +0100)]
hasher: Add uppercase short names for hash algorithms

2 years agotesting: Configure logging via syslog in strongswan.conf
Tobias Brunner [Fri, 10 Nov 2017 15:12:29 +0000 (16:12 +0100)]
testing: Configure logging via syslog in strongswan.conf

Globally configure logging in strongswan.conf.testing and replace all
charondebug statements with strongswan.conf settings.

2 years agotesting: Disable logging via journal in charon-systemd
Tobias Brunner [Wed, 15 Nov 2017 16:11:34 +0000 (17:11 +0100)]
testing: Disable logging via journal in charon-systemd

This avoids duplicate log messages as we already log via syslog to get

2 years agotesting: Globally define logging via syslog for charon-systemd
Tobias Brunner [Fri, 10 Nov 2017 14:53:52 +0000 (15:53 +0100)]
testing: Globally define logging via syslog for charon-systemd

We could make the same change for charon (actually setting it for charon
in strongswan.conf.testing would work for charon-systemd too), however,
there are dozens of test cases that currently set charondebug in

2 years agox509: Initialize signature params when parsing attribute certificates
Tobias Brunner [Wed, 15 Nov 2017 13:41:56 +0000 (14:41 +0100)]
x509: Initialize signature params when parsing attribute certificates

2 years agosw-collector: Unmap history file on failure to instantiate extractor
Tobias Brunner [Wed, 15 Nov 2017 13:40:10 +0000 (14:40 +0100)]
sw-collector: Unmap history file on failure to instantiate extractor

2 years agocharon: Explicitly check return value of fileno()
Tobias Brunner [Wed, 15 Nov 2017 13:35:42 +0000 (14:35 +0100)]
charon: Explicitly check return value of fileno()

This is mainly for Coverity because fchown() can't take a negative
value, which the -1 check implies is possible.

2 years agopkcs8: Add explicit comment for RSASSA-PSS fall-through
Tobias Brunner [Wed, 15 Nov 2017 13:33:05 +0000 (14:33 +0100)]
pkcs8: Add explicit comment for RSASSA-PSS fall-through

2 years agoThe pacman tool got replaced by the sec-updater tool
Tobias Brunner [Wed, 15 Nov 2017 11:18:17 +0000 (12:18 +0100)]
The pacman tool got replaced by the sec-updater tool

2 years agosec-updater: Fix typo in documentation
Tobias Brunner [Wed, 15 Nov 2017 11:10:33 +0000 (12:10 +0100)]
sec-updater: Fix typo in documentation

2 years agoFixed some typos, courtesy of codespell
Tobias Brunner [Wed, 15 Nov 2017 09:21:13 +0000 (10:21 +0100)]
Fixed some typos, courtesy of codespell

2 years agoswanctl: Add check for conflicting short options
Tobias Brunner [Mon, 13 Nov 2017 09:09:05 +0000 (10:09 +0100)]
swanctl: Add check for conflicting short options

2 years agoswanctl: Properly register --counters commmand
Tobias Brunner [Mon, 13 Nov 2017 08:45:14 +0000 (09:45 +0100)]
swanctl: Properly register --counters commmand

Use C instead of c, which is already used for --load-conns.

2 years agotesting: Do not remove all swanctl subdirectories
Andreas Steffen [Sat, 11 Nov 2017 18:23:01 +0000 (19:23 +0100)]
testing: Do not remove all swanctl subdirectories

2 years agoVersion bump to 5.6.1rc1 5.6.1rc1
Andreas Steffen [Sat, 11 Nov 2017 17:25:17 +0000 (18:25 +0100)]
Version bump to 5.6.1rc1