strongswan.git
8 years agoMemory leak fixed.
Tobias Brunner [Thu, 17 Nov 2011 16:06:14 +0000 (17:06 +0100)]
Memory leak fixed.

8 years agoAdded factory function to create task_manager_t implementations.
Tobias Brunner [Thu, 17 Nov 2011 15:54:25 +0000 (16:54 +0100)]
Added factory function to create task_manager_t implementations.

8 years agoAdded factory function to create keymat_t implementations.
Tobias Brunner [Thu, 17 Nov 2011 15:45:14 +0000 (16:45 +0100)]
Added factory function to create keymat_t implementations.

8 years agoStore IKE version of an SA on ike_sa_t.
Tobias Brunner [Thu, 17 Nov 2011 15:26:52 +0000 (16:26 +0100)]
Store IKE version of an SA on ike_sa_t.

8 years agoAdded stub for IKEv1 keymat_t implementation.
Tobias Brunner [Thu, 17 Nov 2011 15:22:34 +0000 (16:22 +0100)]
Added stub for IKEv1 keymat_t implementation.

8 years agoUse keymat_t as common interface, renamed current implementation to _v2.
Tobias Brunner [Thu, 17 Nov 2011 15:19:47 +0000 (16:19 +0100)]
Use keymat_t as common interface, renamed current implementation to _v2.

8 years agoUse a generic list encoding rule we can use to specify the wrapped payload type
Martin Willi [Thu, 17 Nov 2011 14:44:42 +0000 (15:44 +0100)]
Use a generic list encoding rule we can use to specify the wrapped payload type

8 years agoUse a generic encoding type for all variable length chunks
Martin Willi [Thu, 17 Nov 2011 14:20:16 +0000 (14:20 +0000)]
Use a generic encoding type for all variable length chunks

8 years agoImplemented IKEv1 hash payload
Martin Willi [Thu, 17 Nov 2011 14:00:04 +0000 (15:00 +0100)]
Implemented IKEv1 hash payload

8 years agoExtended ID payload for (non-TS) IKEv1 use
Martin Willi [Thu, 17 Nov 2011 13:46:02 +0000 (13:46 +0000)]
Extended ID payload for (non-TS) IKEv1 use

8 years agoImplement second exchange in IKEv1 main mode
Martin Willi [Thu, 17 Nov 2011 12:47:08 +0000 (13:47 +0100)]
Implement second exchange in IKEv1 main mode

8 years agoAdd a payload.get_header_length() method, remove header length definitions
Martin Willi [Thu, 17 Nov 2011 11:27:46 +0000 (11:27 +0000)]
Add a payload.get_header_length() method, remove header length definitions

8 years agoSimplify signature of get_encoding_rules(), make all rules static
Martin Willi [Thu, 17 Nov 2011 10:27:55 +0000 (11:27 +0100)]
Simplify signature of get_encoding_rules(), make all rules static

8 years agoExtended KE payload for IKEv1 support
Martin Willi [Thu, 17 Nov 2011 10:16:02 +0000 (11:16 +0100)]
Extended KE payload for IKEv1 support

8 years agoExtended nonce payload for IKEv1 support
Martin Willi [Thu, 17 Nov 2011 09:53:35 +0000 (10:53 +0100)]
Extended nonce payload for IKEv1 support

8 years agoAdd fixed PSK authentication method to IKEv1 proposal for now
Martin Willi [Thu, 17 Nov 2011 09:45:41 +0000 (10:45 +0100)]
Add fixed PSK authentication method to IKEv1 proposal for now

8 years agoHandle first exchange in IKEv1 main mode as responder
Martin Willi [Wed, 16 Nov 2011 17:24:47 +0000 (18:24 +0100)]
Handle first exchange in IKEv1 main mode as responder

8 years agoAdded limiting encoding of IKEv1 SA payloads
Martin Willi [Wed, 16 Nov 2011 17:24:14 +0000 (18:24 +0100)]
Added limiting encoding of IKEv1 SA payloads

8 years agoAdded SA payload IKEv1 encoding types to generator
Martin Willi [Wed, 16 Nov 2011 17:23:37 +0000 (18:23 +0100)]
Added SA payload IKEv1 encoding types to generator

8 years agoDon't set IKEv2 only header flags when using IKEv1
Martin Willi [Wed, 16 Nov 2011 17:23:00 +0000 (18:23 +0100)]
Don't set IKEv2 only header flags when using IKEv1

8 years agoSet default IKE header initiator flag in IKEv2 only
Martin Willi [Wed, 16 Nov 2011 15:09:02 +0000 (15:09 +0000)]
Set default IKE header initiator flag in IKEv2 only

8 years agoAdded an IKEv1 main mode task stub
Martin Willi [Wed, 16 Nov 2011 14:44:06 +0000 (14:44 +0000)]
Added an IKEv1 main mode task stub

8 years agoAdded a stub for a IKEv1 task manager
Martin Willi [Wed, 16 Nov 2011 14:27:04 +0000 (15:27 +0100)]
Added a stub for a IKEv1 task manager

8 years agoUse task manager as generic interface, renamed implementation to _v2.
Martin Willi [Wed, 16 Nov 2011 13:53:54 +0000 (13:53 +0000)]
Use task manager as generic interface, renamed implementation to _v2.

8 years agoFix unaligned aliasing warning in raw socket
Martin Willi [Wed, 16 Nov 2011 13:45:19 +0000 (13:45 +0000)]
Fix unaligned aliasing warning in raw socket

8 years agoUse enum to define IKE version on peer_cfg_t.
Tobias Brunner [Wed, 16 Nov 2011 16:28:06 +0000 (17:28 +0100)]
Use enum to define IKE version on peer_cfg_t.

Replaced all those magic numbers.

8 years agoFix init message arrival check.
Tobias Brunner [Wed, 16 Nov 2011 15:19:13 +0000 (16:19 +0100)]
Fix init message arrival check.

8 years agoCompile error fixed.
Tobias Brunner [Wed, 16 Nov 2011 14:05:08 +0000 (15:05 +0100)]
Compile error fixed.

8 years agoMessage parsing slightly refactored, allows parsing of unencrypted IKEv1 messages.
Tobias Brunner [Wed, 16 Nov 2011 13:23:50 +0000 (14:23 +0100)]
Message parsing slightly refactored, allows parsing of unencrypted IKEv1 messages.

8 years agoAllow creation of message_t objects for IKEv1 packets.
Tobias Brunner [Wed, 16 Nov 2011 11:06:55 +0000 (12:06 +0100)]
Allow creation of message_t objects for IKEv1 packets.

8 years agoCertificate request payloads can be sent in pretty much any IKEv1 message.
Tobias Brunner [Wed, 16 Nov 2011 09:31:53 +0000 (10:31 +0100)]
Certificate request payloads can be sent in pretty much any IKEv1 message.

8 years agoImplemented limited payload parsing for IKEv1 SA payloads
Martin Willi [Wed, 16 Nov 2011 12:46:54 +0000 (13:46 +0100)]
Implemented limited payload parsing for IKEv1 SA payloads

8 years agoAdded additional IKEv1 payload and encoding identifiers
Martin Willi [Wed, 16 Nov 2011 12:40:09 +0000 (12:40 +0000)]
Added additional IKEv1 payload and encoding identifiers

8 years agoExtend sa_payload for IKEv1 support
Martin Willi [Wed, 16 Nov 2011 08:29:38 +0000 (09:29 +0100)]
Extend sa_payload for IKEv1 support

8 years agoMessage rules for IKEv1 INFORMATIONAL exchange added.
Tobias Brunner [Tue, 15 Nov 2011 17:23:15 +0000 (18:23 +0100)]
Message rules for IKEv1 INFORMATIONAL exchange added.

Since INFORMATIONAL "exchanges" are actually unidirectionally sent
message we don't have any responder rules.

8 years agoMessage rules for IKEv1 AGGRESSIVE exchange added.
Tobias Brunner [Tue, 15 Nov 2011 17:21:28 +0000 (18:21 +0100)]
Message rules for IKEv1 AGGRESSIVE exchange added.

These are basically the same as for ID_PROT but no payloads are expected
to be encrypted (at least if using PSK or signatures for authentication).

8 years agoMessage rules for IKEv1 ID_PROT exchange added.
Tobias Brunner [Tue, 15 Nov 2011 15:13:50 +0000 (16:13 +0100)]
Message rules for IKEv1 ID_PROT exchange added.

These rules are quite broad and cover main mode with at least PSK and
signature based authentication.

8 years agoTypo fixed.
Tobias Brunner [Tue, 15 Nov 2011 13:27:19 +0000 (14:27 +0100)]
Typo fixed.

8 years agoUse vendor id payload for IKEv1 payloads, too
Martin Willi [Tue, 15 Nov 2011 14:58:47 +0000 (14:58 +0000)]
Use vendor id payload for IKEv1 payloads, too

8 years agoAdded IKEv1 payload identifiers to "known" payload list
Martin Willi [Tue, 15 Nov 2011 14:58:23 +0000 (14:58 +0000)]
Added IKEv1 payload identifiers to "known" payload list

8 years agoHandle IKEv1 messages in managers checkout_by_message
Martin Willi [Tue, 15 Nov 2011 14:30:39 +0000 (15:30 +0100)]
Handle IKEv1 messages in managers checkout_by_message

8 years agoAdded IKEv1 payload identifiers
Martin Willi [Tue, 15 Nov 2011 13:47:20 +0000 (14:47 +0100)]
Added IKEv1 payload identifiers

8 years agoAccept and process IKEv1 messages in receiver
Martin Willi [Tue, 15 Nov 2011 13:03:24 +0000 (14:03 +0100)]
Accept and process IKEv1 messages in receiver

8 years agoExtended IKE header for IKEv1 support
Martin Willi [Tue, 15 Nov 2011 12:53:56 +0000 (13:53 +0100)]
Extended IKE header for IKEv1 support

8 years agoAdded configure option for the IKEv1 implementation in charon.
Tobias Brunner [Wed, 9 Nov 2011 11:08:40 +0000 (12:08 +0100)]
Added configure option for the IKEv1 implementation in charon.

8 years agogcrypt does not support MD2
Andreas Steffen [Wed, 9 Nov 2011 05:48:55 +0000 (06:48 +0100)]
gcrypt does not support MD2

8 years agoadded dummy libsimaka_init() function needed for integrity testing
Andreas Steffen [Tue, 8 Nov 2011 20:18:40 +0000 (21:18 +0100)]
added dummy libsimaka_init() function needed for integrity testing

8 years agoversion bump to 4.6.1
Andreas Steffen [Tue, 8 Nov 2011 20:00:09 +0000 (21:00 +0100)]
version bump to 4.6.1

8 years agoadded dummy libtls_init() function needed for integrity testing
Andreas Steffen [Tue, 8 Nov 2011 19:27:17 +0000 (20:27 +0100)]
added dummy libtls_init() function needed for integrity testing

8 years agoFixed monolithic build of libcharon with libtnccs enabled.
Tobias Brunner [Tue, 8 Nov 2011 17:28:00 +0000 (18:28 +0100)]
Fixed monolithic build of libcharon with libtnccs enabled.

8 years agoCorrectly refer to tnc-tnccs plugin when building monolithically.
Tobias Brunner [Tue, 8 Nov 2011 17:27:44 +0000 (18:27 +0100)]
Correctly refer to tnc-tnccs plugin when building monolithically.

8 years agoCalculate checksums for libsimaka and libtls.
Tobias Brunner [Tue, 8 Nov 2011 17:15:55 +0000 (18:15 +0100)]
Calculate checksums for libsimaka and libtls.

These are currently not checked though. And because they don't define a
<libname>_init function an warning is reported when the checksum is
calculated.

8 years agoDefer calculation of checksums until installation.
Tobias Brunner [Tue, 8 Nov 2011 16:58:32 +0000 (17:58 +0100)]
Defer calculation of checksums until installation.

The checksum is now calculated from the installed libraries and plugins.
This allows to calculate checksums for plugins linking to libraries like
libtls as these are relinked during installation.

8 years agoFixed formatting for longer plugin names in checksum_builder output.
Tobias Brunner [Tue, 8 Nov 2011 16:55:39 +0000 (17:55 +0100)]
Fixed formatting for longer plugin names in checksum_builder output.

8 years agoDon't link libtnccs to checksum_builder.
Tobias Brunner [Tue, 8 Nov 2011 16:53:37 +0000 (17:53 +0100)]
Don't link libtnccs to checksum_builder.

Linking is only required for libraries defining global symbols used by
plugins to which the plugins do not link themselves.

8 years agoRevert "fixed integrity tests of plugins using libtls or libtnccs"
Tobias Brunner [Tue, 8 Nov 2011 11:08:00 +0000 (12:08 +0100)]
Revert "fixed integrity tests of plugins using libtls or libtnccs"

This reverts commit b597ac4a4cbcd9197b886d743c75d58293264580 (not
completely).

8 years agoRevert "fixed integrity tests of plugins using libsimaka"
Tobias Brunner [Tue, 8 Nov 2011 11:04:50 +0000 (12:04 +0100)]
Revert "fixed integrity tests of plugins using libsimaka"

This reverts commit 8c42f16deeeffa1ae305b18306b0796f49c9922c.

Conflicts:

src/charon/Makefile.am

8 years agomaemo: New upstream release.
Tobias Brunner [Mon, 7 Nov 2011 13:50:35 +0000 (14:50 +0100)]
maemo: New upstream release.

8 years agoassign get_features method
Andreas Steffen [Mon, 7 Nov 2011 18:15:41 +0000 (19:15 +0100)]
assign get_features method

8 years agomoved random plugin in front of openssl in order to prefer gmp
Andreas Steffen [Sat, 5 Nov 2011 06:24:17 +0000 (07:24 +0100)]
moved random plugin in front of openssl in order to prefer gmp

8 years agoAllow support for CA-certificate retrieval in scepclient 4.6.0
Thomas Egerer [Fri, 4 Nov 2011 11:29:59 +0000 (12:29 +0100)]
Allow support for CA-certificate retrieval in scepclient

I think somehow this functionality got lost in the way from
strongswan-2.7.0...

8 years agoFix 'ipsec pool --status' for empty pools.
Tobias Brunner [Fri, 4 Nov 2011 14:07:54 +0000 (15:07 +0100)]
Fix 'ipsec pool --status' for empty pools.

8 years agoSyntax error in sqlite.sql fixed.
Tobias Brunner [Fri, 4 Nov 2011 13:37:22 +0000 (14:37 +0100)]
Syntax error in sqlite.sql fixed.

8 years agoSome Android NEWS added.
Tobias Brunner [Fri, 4 Nov 2011 11:24:16 +0000 (12:24 +0100)]
Some Android NEWS added.

8 years agoDon't build pluto and starter by default on Android.
Tobias Brunner [Fri, 4 Nov 2011 11:20:21 +0000 (12:20 +0100)]
Don't build pluto and starter by default on Android.

8 years agoif available link libsimaka to checksum_builder
Andreas Steffen [Fri, 4 Nov 2011 10:27:05 +0000 (11:27 +0100)]
if available link libsimaka to checksum_builder

8 years agouse the correct USE_SIMAKA conditional
Andreas Steffen [Fri, 4 Nov 2011 07:38:09 +0000 (08:38 +0100)]
use the correct USE_SIMAKA conditional

8 years agoadded integrity test to rw-eap-sim-rsa and rw-eap-aka-rsa scenarios
Andreas Steffen [Fri, 4 Nov 2011 07:35:33 +0000 (08:35 +0100)]
added integrity test to rw-eap-sim-rsa and rw-eap-aka-rsa scenarios

8 years agofixed integrity tests of plugins using libsimaka
Andreas Steffen [Thu, 3 Nov 2011 21:04:36 +0000 (22:04 +0100)]
fixed integrity tests of plugins using libsimaka

8 years agoChange order of ocsp uris when parsing a cert
Thomas Egerer [Fri, 4 Nov 2011 08:25:07 +0000 (09:25 +0100)]
Change order of ocsp uris when parsing a cert

8 years agoHandle certificates being on hold in a CRL
Thomas Egerer [Fri, 4 Nov 2011 08:25:05 +0000 (09:25 +0100)]
Handle certificates being on hold in a CRL

Certificates which are set on hold in a CRL might be removed from any
subsequent CRL. Hence you cannot conclude that a certificate is revoked
for good in this case, you would try to retrieve an update CRL to see if
the certificate on hold is still on it or not.

8 years agoMemwipe request after sa update, too
Thomas Egerer [Fri, 4 Nov 2011 08:25:01 +0000 (09:25 +0100)]
Memwipe request after sa update, too

8 years agoUse chunk_clear to memwipe shared secret
Thomas Egerer [Fri, 4 Nov 2011 08:24:58 +0000 (09:24 +0100)]
Use chunk_clear to memwipe shared secret

8 years agoChange order of destroy/get_ref function calls
Thomas Egerer [Fri, 4 Nov 2011 08:24:51 +0000 (09:24 +0100)]
Change order of destroy/get_ref function calls

Since DESTROY_IF might destroy the peer_cfg, a get_ref on a freed object
is subject to fail.

8 years agoFix resource leak in x509_ocsp_response
Thomas Egerer [Fri, 4 Nov 2011 08:24:47 +0000 (09:24 +0100)]
Fix resource leak in x509_ocsp_response

8 years agoExtend xfrm_attr_type_names by newly added enum values
Thomas Egerer [Fri, 4 Nov 2011 08:24:38 +0000 (09:24 +0100)]
Extend xfrm_attr_type_names by newly added enum values

8 years agoSilently install route again, even if it did not change.
Tobias Brunner [Fri, 4 Nov 2011 09:03:48 +0000 (10:03 +0100)]
Silently install route again, even if it did not change.

Address/interface changes can cause the route to disappear. Afterwards
the route might look the same but that does not mean it is still installed.

8 years agoCompile warning fixed in kernel interfaces.
Tobias Brunner [Fri, 4 Nov 2011 08:58:58 +0000 (09:58 +0100)]
Compile warning fixed in kernel interfaces.

8 years agoCommon spelling errors fixed.
Tobias Brunner [Thu, 3 Nov 2011 18:30:17 +0000 (19:30 +0100)]
Common spelling errors fixed.

8 years agoNEWS about pkcs11 plugin added.
Tobias Brunner [Thu, 3 Nov 2011 17:39:42 +0000 (18:39 +0100)]
NEWS about pkcs11 plugin added.

8 years agopkcs11: Documented use_pubkey option in strongswan.conf(5).
Tobias Brunner [Thu, 3 Nov 2011 17:36:34 +0000 (18:36 +0100)]
pkcs11: Documented use_pubkey option in strongswan.conf(5).

8 years agopkcs11: Make public key operations on tokens optional.
Tobias Brunner [Thu, 3 Nov 2011 16:56:40 +0000 (17:56 +0100)]
pkcs11: Make public key operations on tokens optional.

8 years agopkcs11: Make sure a key can be used for a given signature scheme.
Tobias Brunner [Wed, 2 Nov 2011 19:25:39 +0000 (20:25 +0100)]
pkcs11: Make sure a key can be used for a given signature scheme.

8 years agopkcs11: Register ECDSA feature.
Tobias Brunner [Wed, 2 Nov 2011 18:24:57 +0000 (19:24 +0100)]
pkcs11: Register ECDSA feature.

8 years agopkcs11: We have to create our own hashes for some signature schemes.
Tobias Brunner [Wed, 2 Nov 2011 18:23:05 +0000 (19:23 +0100)]
pkcs11: We have to create our own hashes for some signature schemes.

8 years agopkcs11: Lookup the public key of a private key by CKA_ID.
Tobias Brunner [Wed, 2 Nov 2011 18:11:46 +0000 (19:11 +0100)]
pkcs11: Lookup the public key of a private key by CKA_ID.

Currently this only works if a public key object with the same ID is
available, if there isn't one we could search for a certificate with the
same ID and extract the key from there.

8 years agopkcs11: Search for private keys in a more generic way.
Tobias Brunner [Wed, 2 Nov 2011 18:07:23 +0000 (19:07 +0100)]
pkcs11: Search for private keys in a more generic way.

Also, don't extract the public key directly from the private key. Some
tokens actually do not return the public exponent (it's not required).
We have to find a different way to get the public key.

8 years agopkcs11: Added support to encode ECDSA public keys.
Tobias Brunner [Wed, 2 Nov 2011 18:04:43 +0000 (19:04 +0100)]
pkcs11: Added support to encode ECDSA public keys.

8 years agopkcs11: Parse ECDSA public keys and find/create them on tokens.
Tobias Brunner [Wed, 2 Nov 2011 17:59:48 +0000 (18:59 +0100)]
pkcs11: Parse ECDSA public keys and find/create them on tokens.

8 years agopkcs11: Added generic functions to find/create public keys on tokens.
Tobias Brunner [Wed, 2 Nov 2011 17:57:57 +0000 (18:57 +0100)]
pkcs11: Added generic functions to find/create public keys on tokens.

8 years agopkcs11: Store public key length in bits.
Tobias Brunner [Wed, 2 Nov 2011 17:48:51 +0000 (18:48 +0100)]
pkcs11: Store public key length in bits.

8 years agopkcs11: Fix encoding of RSA public keys.
Tobias Brunner [Wed, 2 Nov 2011 17:43:27 +0000 (18:43 +0100)]
pkcs11: Fix encoding of RSA public keys.

8 years agopkcs11: Use create_object_attr_enumerator to encode RSA public key.
Tobias Brunner [Wed, 2 Nov 2011 17:38:52 +0000 (18:38 +0100)]
pkcs11: Use create_object_attr_enumerator to encode RSA public key.

8 years agopkcs11: Instead of a mutex use a new session to do multipart operations.
Tobias Brunner [Wed, 2 Nov 2011 16:24:37 +0000 (17:24 +0100)]
pkcs11: Instead of a mutex use a new session to do multipart operations.

8 years agopkcs11: Function added to retrieve multiple attributes from a single object.
Tobias Brunner [Wed, 2 Nov 2011 16:09:43 +0000 (17:09 +0100)]
pkcs11: Function added to retrieve multiple attributes from a single object.

8 years agopkcs11: Memory leak fixed in DH/ECDH implementation.
Tobias Brunner [Wed, 2 Nov 2011 16:00:58 +0000 (17:00 +0100)]
pkcs11: Memory leak fixed in DH/ECDH implementation.

8 years agopkcs11: Invalid free fixed in DH/ECDH implementation.
Tobias Brunner [Wed, 2 Nov 2011 16:00:27 +0000 (17:00 +0100)]
pkcs11: Invalid free fixed in DH/ECDH implementation.

8 years agopkcs11: Changed how pkcs11-manager is initialized.
Tobias Brunner [Wed, 2 Nov 2011 10:24:25 +0000 (11:24 +0100)]
pkcs11: Changed how pkcs11-manager is initialized.

The manager is now created directly, but events and certificate loading
is deferred.

8 years agopkcs11: Add attributes to specify what we use the DH/ECDH keys for.
Tobias Brunner [Tue, 1 Nov 2011 10:05:49 +0000 (11:05 +0100)]
pkcs11: Add attributes to specify what we use the DH/ECDH keys for.

8 years agoversion bump to 4.6.0
Andreas Steffen [Wed, 2 Nov 2011 08:30:45 +0000 (09:30 +0100)]
version bump to 4.6.0