aboutsummaryrefslogtreecommitdiffstats
path: root/src/frontends
Commit message (Collapse)AuthorAgeFilesLines
...
* kernel-interface: Pass full list of traffic selectors to add_sa()Martin Willi2015-02-201-1/+1
| | | | | | While we can handle the first selector only in BEET mode in kernel-netlink, passing the full list gives the backend more flexibility how to handle this information.
* libipsec: Remove unused src/dst_ts parameters from ipsec_sa_mgr_t.add_sa()Martin Willi2015-02-201-2/+1
|
* kernel-interface: Remove reqid parameter from get_spi/get_cpi() methodsMartin Willi2015-02-201-2/+2
| | | | | | | | | | The reqid is not strictly required, as we set the reqid with the update call when installing the negotiated SA. If we don't need a reqid at this stage, we can later allocate the reqid in the kernel backend once the SA parameters have been fully negotaited. This allows us to assign the same reqid for the same selectors to avoid conflicts on backends this is necessary.
* libipsec: Remove unused reqid parameter from ipsec_sa_mgr_t.get_spi()Martin Willi2015-02-191-1/+1
|
* osx: Update the README with App related bitsMartin Willi2014-12-171-9/+15
|
* osx: Initial import of the Objective-C App graphical user interfaceMartin Willi2014-12-1727-9/+4681
|
* charon-xpc: Add a work-around to trigger IP address add events after bootMartin Willi2014-12-161-0/+24
|
* android: New release based on 5.2.1 and after adding EAP-TLSTobias Brunner2014-11-061-3/+3
| | | | | Also enables support for IKEv2 fragmentation, provides improved MOBIKE handling and optionally enables PFS for CHILD_SAs.
* android: Build binaries for MIPSTobias Brunner2014-11-061-1/+1
|
* android: Increase fragment sizeTobias Brunner2014-11-061-0/+3
| | | | We use the same value we use as MTU on TUN devices.
* android: Enable IKEv2 fragmentationTobias Brunner2014-11-061-1/+1
|
* android: Use %any as AAA identity, but disable EAP-only authenticationTobias Brunner2014-11-061-5/+3
| | | | | | | Without verification of the identity we can't prevent a malicious user with a valid certificate from impersonating the AAA server and thus the VPN gateway. So unless we make the AAA identity configurable we have to prevent EAP-only authentication.
* android: Add support for signature schemes used by EAP-TLSTobias Brunner2014-11-061-19/+34
|
* android: Allow enumeration of untrusted certificatesTobias Brunner2014-11-061-1/+1
|
* android: Handle EAP-TLS in Android serviceTobias Brunner2014-11-061-6/+19
|
* android: Enable EAP-TLS plugin in the appTobias Brunner2014-11-061-1/+1
|
* android: Add EAP-TLS VPN type to the GUITobias Brunner2014-11-066-1/+7
|
* android: Change how features of VPN types are stored and checkedTobias Brunner2014-11-065-59/+41
|
* android: Fix PA-TNC construction based on data passed via JNITobias Brunner2014-10-151-3/+2
|
* android: Implement get_contracts() method in IMC state objectTobias Brunner2014-10-141-0/+14
|
* android: libpts does not exist anymore, don't attempt to load itTobias Brunner2014-10-141-1/+0
|
* android: Update receive_message() to new imc_msg_t.receive() signatureTobias Brunner2014-10-131-2/+4
|
* android: Remove references to libptsTobias Brunner2014-10-133-8/+2
|
* plugin-loader: Support a reload() callback for static featuresMartin Willi2014-09-221-2/+2
|
* android: Reduce CHILD_SA lifetimeTobias Brunner2014-09-121-2/+2
|
* android: Add DH groups to ESP proposalsTobias Brunner2014-09-121-2/+12
|
* android: Reestablish IKE_SA if CHILD_SA rekeying failedTobias Brunner2014-09-121-3/+36
|
* android: Report error if CHILD_SA rekeying failsTobias Brunner2014-09-121-0/+6
|
* android: Add support for querying use stats of a CHILD_SATobias Brunner2014-09-091-1/+2
|
* dns-proxy: Don't use proxy socket if we fail to bypass itTobias Brunner2014-07-301-0/+2
| | | | | | | | | This will result in an infinite loop as packets sent over that socket will again pass through the TUN device and the DNS proxy. Apparently, bypassing fails when airplane mode is enabled. Fixes #662.
* android: New release after adding certificate import, DNS proxy and GUI changesTobias Brunner2014-07-221-2/+2
|
* android: For keyingtries > 0 notify the GUI if the limit is reached when ↵Tobias Brunner2014-07-221-0/+17
| | | | | | | | | | reestablishing The IKE_SA is destroyed anyway, so letting the GUI remain in "connecting" state would be incorrect. We still use keyingtries=0 for now, though. And we still abort after the first failed attempt initially, in case there is a configuration error.
* android: Terminate IKE_SA if initial IKE_SA_INIT failsTobias Brunner2014-07-221-1/+23
| | | | | | | | | | Since VpnStateService.disconnect() is now not called until the error dialog is dismissed the daemon would continue to try connecting. So while the error dialog is shown the connection might actually be successfully established in the background, which is not intended. This way the IKE_SA is destroyed right after sending the IKE_SA_INIT of the second connection attempt (due to keyingtries=0).
* android: Only allow DNS queries for the configured hostnameTobias Brunner2014-07-221-0/+2
|
* android: Add optional filter functionality to DNS proxyTobias Brunner2014-07-222-3/+119
| | | | | If specified only queries for a list of allowed host names will be proxied.
* android: Recreate the TUN device without DNS when reestablishing IKE_SAsTobias Brunner2014-07-221-0/+38
| | | | | This enables DNS resolution while reestablishing if the VPN gateway pushed DNS servers to the client that are only reachable via VPN.
* android: Add method to BuilderAdapter to re-establish without DNS-related dataTobias Brunner2014-07-223-5/+113
| | | | | | Non-DNS data is cached in the BuilderAdapter so the TUN device can be recreated easily (since the CHILD_SA is gone we couldn't actually gather that information).
* android: Use DNS proxy when reestablishing IKE_SAsTobias Brunner2014-07-221-4/+44
|
* bus: Add ike_reestablish_pre hook, called before DNS resolutionTobias Brunner2014-07-221-4/+5
| | | | | The old hook is renamed to ike_reestablish_post and is now also called when the initiation of the new IKE_SA failed.
* android: Add DNS proxy implementationTobias Brunner2014-07-223-0/+388
| | | | | | | This class proxies DNS requests over VPN-protected UDP sockets. It is not really Android specific and might be useful for kernel-libipsec or libipsec in general too, so we could maybe move it later to libipsec (might need some portability work).
* android: Delay disconnecting on errors until user dismisses themTobias Brunner2014-07-222-4/+6
| | | | | If e.g. reauthentication fails we don't want to close the TUN device until the user acknowledged the error and is thus aware of the failure.
* android: Set CHILD_STATE_DOWN when the IKE_SA gets reestablishedTobias Brunner2014-07-221-1/+7
|
* android: Set CHILD_STATE_DOWN whenever the CHILD_SA goes downTobias Brunner2014-07-221-6/+0
| | | | | | No matter what triggers it. We also don't close the TUN device, but we might handle that differently in the future to allow reestablishing the IKE_SA if host names have to be re-resolved via DNS.
* android: Change to CONNECTING state if CHILD_SA goes downTobias Brunner2014-07-221-1/+4
| | | | | | Unless we are disconnecting. This currently triggers the connecting dialog, perhaps just updating the status text would do too (when switching from CONNECTED to CONNECTING, not from DISCONNECTED to CONNECTING).
* android: Do not use deprecated TwoLineListItemTobias Brunner2014-07-223-27/+28
|
* android: Add support for ECDSA private keysTobias Brunner2014-07-221-24/+99
| | | | With 4.4.4 these work fine now.
* android: Show a confirmation dialog before importing certificatesTobias Brunner2014-07-222-14/+123
| | | | | | | | | | | | Since the import activity can be triggered by any other app on the system we shouldn't just import every certificate we get. Also, in some situations (e.g. if no passphrase has been set yet for the system-wide certificate store) we are the only application that can open certificate files. So if a user clicked on a certificate file she would just get a confirmation Toast about a successful import, with no indication whatsoever where the certificate was actually imported. The new dialog shows the app icon to indicate that strongSwan is involved.
* android: Use Storage Access Framework to import certificatesTobias Brunner2014-07-223-17/+106
| | | | | | | Thanks to the SAF, introduced with Android 4.4, browsing and opening files on the system is very easy to implement. On older systems the menu option is removed.
* android: Add activity to import certificate filesTobias Brunner2014-07-227-0/+89
| | | | | Such files can e.g. be opened from the Download view, if they are associated with one of the supported mime-types.
* android: Imported certificates may be clicked to delete themTobias Brunner2014-07-227-1/+124
|
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-03 16:08:10 +0000