strongswan.git
3 years agoMerge branch 'bypass-lan'
Tobias Brunner [Wed, 8 Feb 2017 09:47:33 +0000 (10:47 +0100)]
Merge branch 'bypass-lan'

Adds a new plugin that automatically installs and updates bypass policies
for locally attached subnets.  This is useful for laptops etc. that are
used in different networks and prefer maintaining access to local hosts
(e.g. network printers or NAS) while connected to a VPN.

3 years agokernel-pfroute: Implement enumeration of local subnets
Tobias Brunner [Wed, 12 Oct 2016 16:32:14 +0000 (18:32 +0200)]
kernel-pfroute: Implement enumeration of local subnets

3 years agobypass-lan: Allow ignoring or only considering subnets of specific interfaces
Tobias Brunner [Wed, 12 Oct 2016 13:56:12 +0000 (15:56 +0200)]
bypass-lan: Allow ignoring or only considering subnets of specific interfaces

The config can also be reloaded by sending a SIGHUP to charon.

3 years agobypass-lan: Configure interface on bypass policy
Tobias Brunner [Wed, 12 Oct 2016 10:28:18 +0000 (12:28 +0200)]
bypass-lan: Configure interface on bypass policy

Currently, only the kernel-netlink plugin supports this, the others will
just ignore it.

3 years agokernel-netlink: Return interface name in local subnet enumerator
Tobias Brunner [Wed, 12 Oct 2016 10:22:42 +0000 (12:22 +0200)]
kernel-netlink: Return interface name in local subnet enumerator

3 years agokernel-interface: Add interface name to local subnet enumerator
Tobias Brunner [Wed, 12 Oct 2016 10:11:24 +0000 (12:11 +0200)]
kernel-interface: Add interface name to local subnet enumerator

3 years agobypass-lan: Add plugin that installs bypass policies for locally attached subnets
Tobias Brunner [Wed, 12 Oct 2016 08:05:10 +0000 (10:05 +0200)]
bypass-lan: Add plugin that installs bypass policies for locally attached subnets

3 years agokernel-netlink: Implement enumerator for local subnets
Tobias Brunner [Wed, 12 Oct 2016 07:52:45 +0000 (09:52 +0200)]
kernel-netlink: Implement enumerator for local subnets

3 years agokernel-interface: Add method to enumerate locally attached subnets
Tobias Brunner [Wed, 12 Oct 2016 07:24:49 +0000 (09:24 +0200)]
kernel-interface: Add method to enumerate locally attached subnets

3 years agokernel-pfkey: Use the same priority range for trap and regular policies
Tobias Brunner [Tue, 11 Oct 2016 13:14:27 +0000 (15:14 +0200)]
kernel-pfkey: Use the same priority range for trap and regular policies

Same as the change in the kernel-netlink plugin.

3 years agokernel-netlink: Use the same priority range for trap and regular policies
Tobias Brunner [Tue, 11 Oct 2016 12:30:21 +0000 (14:30 +0200)]
kernel-netlink: Use the same priority range for trap and regular policies

While trap and regular policies now often look the same (mainly because
reqids are kept constant) trap policies still need to have a lower priority
than regular policies to handle unroute/route correctly if e.g. IPComp
is used or the mode changes.  But if we use a completely different
priority range that's lower than that of regular policies it is not possible
to install overlapping trap policies.  By differentiating trap from
regular policies via the priority's LSB this issue is avoided while
still maintaining the proper ordering of trap and regular policies.

Fixes #1243.

3 years agokernel-netlink: Fix spacing in log message when policy is unchanged
Tobias Brunner [Tue, 11 Oct 2016 13:10:16 +0000 (15:10 +0200)]
kernel-netlink: Fix spacing in log message when policy is unchanged

3 years agoikev1: Factor out IV and QM management
Tobias Brunner [Wed, 14 Dec 2016 14:54:39 +0000 (15:54 +0100)]
ikev1: Factor out IV and QM management

This simplifies implementing a custom keymat_v1_t.

3 years agokeymat: Allow keymat to modify signature scheme(s)
Thomas Egerer [Thu, 1 Dec 2016 13:40:25 +0000 (14:40 +0100)]
keymat: Allow keymat to modify signature scheme(s)

Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
3 years agoforecast: Mark correct port in UDP NAT-T rule
James Laird-Wah [Wed, 8 Feb 2017 08:20:52 +0000 (19:20 +1100)]
forecast: Mark correct port in UDP NAT-T rule

Closes strongswan/strongswan#62.

3 years agoandroid: New release after adding translation for Simplified Chinese
Tobias Brunner [Tue, 7 Feb 2017 15:01:25 +0000 (16:01 +0100)]
android: New release after adding translation for Simplified Chinese

3 years agoandroid: Add translation for Simplified Chinese
Tobias Brunner [Mon, 23 Jan 2017 17:39:47 +0000 (18:39 +0100)]
android: Add translation for Simplified Chinese

Courtesy of Yick Xie.

3 years agosettings: Fix purge if order differs from alphabetical order
Tobias Brunner [Tue, 25 Oct 2016 08:46:36 +0000 (10:46 +0200)]
settings: Fix purge if order differs from alphabetical order

3 years agoeap-dynamic: Publish the get_auth() method of the wrapped EAP method
Tobias Brunner [Wed, 1 Feb 2017 10:16:42 +0000 (11:16 +0100)]
eap-dynamic: Publish the get_auth() method of the wrapped EAP method

Fixes #2238.

3 years agopkcs11: Fix documentation of load_certs option
Tobias Brunner [Mon, 5 Dec 2016 14:34:48 +0000 (15:34 +0100)]
pkcs11: Fix documentation of load_certs option

This option is actually module-specific.

3 years agoike-auth: Don't send INITIAL_CONTACT if remote ID contains wildcards
Tobias Brunner [Mon, 14 Nov 2016 14:39:17 +0000 (15:39 +0100)]
ike-auth: Don't send INITIAL_CONTACT if remote ID contains wildcards

Such an identity won't equal an actual peer's identity resulting in
sending an INITIAL_CONTACT notify even if there might be an existing
IKE_SA.

3 years agoproposal: Copy SPI and proposal number from correct proposal in select()
Tobias Brunner [Thu, 15 Dec 2016 17:22:11 +0000 (18:22 +0100)]
proposal: Copy SPI and proposal number from correct proposal in select()

If charon.prefer_configured_proposals is disabled select() is called on
the received proposal. This incorrectly set the SPI to 0 as the
configured proposal has no SPI set.

Fixes #2190.

3 years agokernel-netlink: Set NODAD flag for virtual IPv6 addresses
Tobias Brunner [Tue, 13 Dec 2016 16:27:26 +0000 (17:27 +0100)]
kernel-netlink: Set NODAD flag for virtual IPv6 addresses

The Optimistic Duplicate Address Detection (DAD) seems to fail in some
cases (`dadfailed` in `ip addr`) rendering the virtual IP address unusable.

Fixes #2183.

3 years agokernel-netlink: Prefer matching label when selecting IPv6 source addresses
Tobias Brunner [Mon, 10 Oct 2016 08:00:19 +0000 (10:00 +0200)]
kernel-netlink: Prefer matching label when selecting IPv6 source addresses

This implements rule 6 of RFC 6724 using the default priority table,
so that e.g. global addresses are preferred over ULAs (which also have
global scope) when the destination is a global address.

Fixes #2138.

3 years agokernel-netlink: Use correct 4 byte alignment for AH with IPv4
Tobias Brunner [Fri, 4 Nov 2016 09:14:30 +0000 (10:14 +0100)]
kernel-netlink: Use correct 4 byte alignment for AH with IPv4

By default, the kernel incorrectly uses an 8 byte alignment, which is
mandatory for IPv6 but prohibited for IPv4.  For many algorithms this
doesn't matter but that's not the case for HMAC_SHA2_256_128.
Since 2.6.39 the kernel can be explicitly configured to use a 4 byte
alignment.

3 years agokernel-netlink: Allow change of Netlink socket receive buffer size
Thomas Egerer [Thu, 17 Nov 2016 16:00:37 +0000 (17:00 +0100)]
kernel-netlink: Allow change of Netlink socket receive buffer size

Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
3 years agokernel-pfkey: Set state to SADB_SASTATE_MATURE when adding/updating SAs
Tobias Brunner [Mon, 16 Jan 2017 16:01:33 +0000 (17:01 +0100)]
kernel-pfkey: Set state to SADB_SASTATE_MATURE when adding/updating SAs

Picky kernels might otherwise reject our messages as RFC 2367 explicitly
mandates this.

Fixes #2212.

3 years agokernel-pfroute: Don't set a gateway if it is of a different address family than the...
Tobias Brunner [Fri, 7 Oct 2016 10:12:15 +0000 (12:12 +0200)]
kernel-pfroute: Don't set a gateway if it is of a different address family than the destination

3 years agolibipsec: Add support for AES and Camellia in CCM mode
Tobias Brunner [Wed, 16 Nov 2016 14:11:41 +0000 (15:11 +0100)]
libipsec: Add support for AES and Camellia in CCM mode

Fixes #2172.

3 years agolibipsec: Fix Windows build via MinGW
Tobias Brunner [Fri, 23 Sep 2016 06:52:17 +0000 (08:52 +0200)]
libipsec: Fix Windows build via MinGW

Fixes #2118.

3 years agostroke: Default to %dynamic if no valid TS are specified in left|rightsubnet
Tobias Brunner [Wed, 18 Jan 2017 13:51:57 +0000 (14:51 +0100)]
stroke: Default to %dynamic if no valid TS are specified in left|rightsubnet

Otherwise, we'd end up with an empty TS list, which is not valid.

Because end->tohost is set to !end->subnets in starter the removed branch was
never used.

3 years agoinit: Let systemd restart daemons if they get terminated unexpectedly
Tobias Brunner [Wed, 18 Jan 2017 12:54:56 +0000 (13:54 +0100)]
init: Let systemd restart daemons if they get terminated unexpectedly

Fixes #2205.

3 years agoinit: Depend on network-online.target instead of network.target in systemd units
Tobias Brunner [Wed, 18 Jan 2017 12:52:59 +0000 (13:52 +0100)]
init: Depend on network-online.target instead of network.target in systemd units

This makes sure the network is "up" before connections are
loaded/initiated.

Fixes #2205.

3 years agoMerge branch 'charon-systemd-reload-loggers'
Tobias Brunner [Wed, 25 Jan 2017 13:58:24 +0000 (14:58 +0100)]
Merge branch 'charon-systemd-reload-loggers'

Allows reloading strongswan.conf, the loggers, and the plugins in
charon-systemd by sending a SIGHUP (as already supported by charon).

Loggers are now also reloaded by VICI's `reload-settings` command (works
with both daemons).

Fixes #2222.

3 years agovici: Reload loggers after reloading strongswan.conf via reload-setting command
Tobias Brunner [Mon, 23 Jan 2017 16:25:28 +0000 (17:25 +0100)]
vici: Reload loggers after reloading strongswan.conf via reload-setting command

3 years agodaemon: Use separate method to set default loggers
Tobias Brunner [Mon, 23 Jan 2017 16:14:01 +0000 (17:14 +0100)]
daemon: Use separate method to set default loggers

This way it is not necessary to pass the same values to reload the
loggers.

3 years agocharon-systemd: Handle SIGHUP the same way charon does
Tobias Brunner [Mon, 16 Jan 2017 16:20:10 +0000 (17:20 +0100)]
charon-systemd: Handle SIGHUP the same way charon does

That is, reload strongswan.conf, the loggers and the plugins.

3 years agoha: Fix assignment of IP addresses if multiple pools are defined
Tobias Brunner [Thu, 13 Oct 2016 16:39:09 +0000 (18:39 +0200)]
ha: Fix assignment of IP addresses if multiple pools are defined

Fixes #2146.

3 years agoha: Delete passive IKE_SA on other node after half-open timeout
Tobias Brunner [Tue, 30 Aug 2016 12:30:19 +0000 (14:30 +0200)]
ha: Delete passive IKE_SA on other node after half-open timeout

Fixes #1192.

3 years agokernel-netlink: Return const pointer from lookup_algorithm()
Thomas Egerer [Mon, 23 Jan 2017 15:04:38 +0000 (16:04 +0100)]
kernel-netlink: Return const pointer from lookup_algorithm()

Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
3 years agoMerge branch 'android-import'
Tobias Brunner [Fri, 20 Jan 2017 10:55:48 +0000 (11:55 +0100)]
Merge branch 'android-import'

Adds a VPN profile import feature.

3 years agoandroid: New release after adding profile import functionality
Tobias Brunner [Fri, 20 Jan 2017 10:53:43 +0000 (11:53 +0100)]
android: New release after adding profile import functionality

3 years agoandroid: Handle profile file names with dots in them
Tobias Brunner [Tue, 17 Jan 2017 13:43:57 +0000 (14:43 +0100)]
android: Handle profile file names with dots in them

3 years agoandroid: Handle errors when fetching profile in more detail
Tobias Brunner [Tue, 17 Jan 2017 10:14:33 +0000 (11:14 +0100)]
android: Handle errors when fetching profile in more detail

3 years agoandroid: Add activity to import VPN profiles from JSON-encoded files
Tobias Brunner [Thu, 29 Dec 2016 16:35:57 +0000 (17:35 +0100)]
android: Add activity to import VPN profiles from JSON-encoded files

The file format is documented on the wiki.

URLs to .sswan files may be intercepted and downloaded files with a media
type of application/vnd.strongswan.profile may also be opened (the file
extension doesn't matter in that case).  Whether downloaded files for which
the media type is not correct but the extension is .sswan can be opened
depends on the app that issues the Intent.  For instance, from the default
Downloads app it won't work due to the content:// URLs that do not contain
the file name but when opening the downloaded file from within Chrome's
Downloads view it works as these Intents use file:// URLs, which contain
the complete file name (the latter requires a new permission).

3 years agoandroid: Use a local broadcast to notify about profile changes
Tobias Brunner [Thu, 29 Dec 2016 16:02:22 +0000 (17:02 +0100)]
android: Use a local broadcast to notify about profile changes

This allows other components to modify the profiles and notify about
changes.

3 years agoandroid: Add a UUID property to the VPN profiles
Tobias Brunner [Tue, 27 Dec 2016 14:17:49 +0000 (15:17 +0100)]
android: Add a UUID property to the VPN profiles

All new or edited profiles get a random UUID.  We currently don't
enforce one, though.  Later we might change that and use the UUID as
primary key.

3 years agoMerge branch 'ipsec-commands'
Tobias Brunner [Thu, 19 Jan 2017 17:40:00 +0000 (18:40 +0100)]
Merge branch 'ipsec-commands'

Fixes an issue with the ipsec script when used with sudo.

I'd usually rebase this but the commit ID was already referenced
elsewhere.

3 years agoipsec: Only allow specific commands to be executed via ipsec script
Tobias Brunner [Wed, 18 Jan 2017 14:44:06 +0000 (15:44 +0100)]
ipsec: Only allow specific commands to be executed via ipsec script

The previous fallback allowed running any executable as root if executing
ipsec via sudo was allowed, by using e.g. `sudo ipsec ../../../bin/sh`.

3 years agobliss: Increase timeout for sampler unit test
Tobias Brunner [Mon, 16 Jan 2017 10:28:10 +0000 (11:28 +0100)]
bliss: Increase timeout for sampler unit test

Fixes #2204.

3 years agoandroid: Include ref10 subdirectory for curve25519 plugin
Tobias Brunner [Tue, 27 Dec 2016 13:43:44 +0000 (14:43 +0100)]
android: Include ref10 subdirectory for curve25519 plugin

Fixes #2201.

3 years agoVersion bump to 5.5.2dr4 5.5.2dr4
Andreas Steffen [Mon, 2 Jan 2017 14:46:27 +0000 (15:46 +0100)]
Version bump to 5.5.2dr4

3 years agoMerge branch 'disable_ocsp'
Andreas Steffen [Mon, 2 Jan 2017 13:35:39 +0000 (14:35 +0100)]
Merge branch 'disable_ocsp'

3 years agotesting: Added swanctl/ocsp-disabled scenario
Andreas Steffen [Mon, 2 Jan 2017 13:32:46 +0000 (14:32 +0100)]
testing: Added swanctl/ocsp-disabled scenario

3 years agotesting: Added swanctl/ocsp-signer-cert scenario
Andreas Steffen [Mon, 2 Jan 2017 13:08:21 +0000 (14:08 +0100)]
testing: Added swanctl/ocsp-signer-cert scenario

3 years agorevocation: OCSP and/or CRL fetching can be disabled
Andreas Steffen [Fri, 30 Dec 2016 17:12:53 +0000 (18:12 +0100)]
revocation: OCSP and/or CRL fetching can be disabled

3 years agotesting: Convert swanctl scenarios to curve-25519
Andreas Steffen [Thu, 29 Dec 2016 10:48:42 +0000 (11:48 +0100)]
testing: Convert swanctl scenarios to curve-25519

3 years agoVersion bump to 5.5.2dr3 and Linux kernel 4.9 5.5.2dr3
Andreas Steffen [Sat, 17 Dec 2016 17:10:13 +0000 (18:10 +0100)]
Version bump to 5.5.2dr3 and Linux kernel 4.9

3 years agotesting: strongTNC does not come with django.db any more
Andreas Steffen [Sat, 17 Dec 2016 17:09:20 +0000 (18:09 +0100)]
testing: strongTNC does not come with django.db any more

3 years agotesting: Added ikev2/net2net-ed25519 scenario
Andreas Steffen [Sat, 17 Dec 2016 17:07:29 +0000 (18:07 +0100)]
testing: Added ikev2/net2net-ed25519 scenario

3 years agostroke: Load general PKCS#8 private keys
Andreas Steffen [Sat, 17 Dec 2016 17:06:11 +0000 (18:06 +0100)]
stroke: Load general PKCS#8 private keys

3 years agoMerge branch 'Ed25519'
Andreas Steffen [Fri, 16 Dec 2016 11:24:54 +0000 (12:24 +0100)]
Merge branch 'Ed25519'

3 years agoMoved Ed25519 tests to libstrongswan
Andreas Steffen [Tue, 13 Dec 2016 21:47:36 +0000 (22:47 +0100)]
Moved Ed25519 tests to libstrongswan

3 years agovici: Check for closed connection in Python bindings
Weilu Jia [Tue, 13 Dec 2016 02:17:10 +0000 (18:17 -0800)]
vici: Check for closed connection in Python bindings

The Python VICI library does not check if the socket is closed.
If the daemon closes the connection, _recvall() spins forever.

Closes strongswan/strongswan#56.

3 years agounit-tests: Completed coverage of hasher, crypter and libnttfft
Andreas Steffen [Fri, 9 Dec 2016 11:56:15 +0000 (12:56 +0100)]
unit-tests: Completed coverage of hasher, crypter and libnttfft

3 years agoAdded swanctl/net2net-ed2559 scenario and needed Ed25519 certificates
Andreas Steffen [Fri, 9 Dec 2016 09:14:42 +0000 (10:14 +0100)]
Added swanctl/net2net-ed2559 scenario and needed Ed25519 certificates

3 years agoImplemented EdDSA for IKEv2 using a pro forma Identity hash function
Andreas Steffen [Fri, 9 Dec 2016 08:38:15 +0000 (09:38 +0100)]
Implemented EdDSA for IKEv2 using a pro forma Identity hash function

3 years agoAdded Ed25519 ref10 implementation from libsodium
Andreas Steffen [Fri, 2 Dec 2016 12:00:24 +0000 (13:00 +0100)]
Added Ed25519 ref10 implementation from libsodium

3 years agoAdded support of EdDSA signatures
Andreas Steffen [Mon, 14 Nov 2016 11:37:23 +0000 (12:37 +0100)]
Added support of EdDSA signatures

3 years agokernel-netlink: Add support for AES-CMAC-96 (RFC 4494)
Tobias Brunner [Mon, 5 Dec 2016 14:07:59 +0000 (15:07 +0100)]
kernel-netlink: Add support for AES-CMAC-96 (RFC 4494)

The kernel apparently supports this since 3.10.

3 years agoandroid: New release after re-adding support for ECC Brainpool curves
Tobias Brunner [Sat, 10 Dec 2016 11:28:09 +0000 (12:28 +0100)]
android: New release after re-adding support for ECC Brainpool curves

3 years agoopenssl: BoringSSL doesn't provide curve data for ECC Brainpool curves
Tobias Brunner [Sat, 10 Dec 2016 11:26:31 +0000 (12:26 +0100)]
openssl: BoringSSL doesn't provide curve data for ECC Brainpool curves

3 years agoandroid: New release after fixing libtpmtss issue
Tobias Brunner [Fri, 9 Dec 2016 10:18:17 +0000 (11:18 +0100)]
android: New release after fixing libtpmtss issue

3 years agoandroid: Make sure libtpmtss is loaded on older systems
Tobias Brunner [Fri, 9 Dec 2016 10:16:42 +0000 (11:16 +0100)]
android: Make sure libtpmtss is loaded on older systems

On newer Android systems this seems to happen automatically (or does at
least not cause crashes if the library is not loaded).

3 years agoandroid: New release after adding notification
Tobias Brunner [Thu, 8 Dec 2016 16:37:21 +0000 (17:37 +0100)]
android: New release after adding notification

3 years agoMerge branch 'android-updates'
Tobias Brunner [Thu, 8 Dec 2016 16:33:11 +0000 (17:33 +0100)]
Merge branch 'android-updates'

Adds a permanent notification while connected (or connecting), which
allows running as a foreground service, which in turn should prevent
Android from terminating the service when low on memory.

Also adds support for ChaCha20/Poly1305 AEAD and Curve25519 DH.

3 years agoandroid: Ensure that the certificates are loaded when accessing them via JNI
Tobias Brunner [Wed, 7 Dec 2016 16:52:33 +0000 (17:52 +0100)]
android: Ensure that the certificates are loaded when accessing them via JNI

3 years agoandroid: Add a public notification
Tobias Brunner [Wed, 7 Dec 2016 16:51:42 +0000 (17:51 +0100)]
android: Add a public notification

3 years agoandroid: Display a permanent notification while connected
Tobias Brunner [Wed, 2 Nov 2016 17:26:43 +0000 (18:26 +0100)]
android: Display a permanent notification while connected

This forces the service to run in the foreground, meaning the system
won't kill it when low on memory.

3 years agoandroid: Log any installed DNS servers
Tobias Brunner [Wed, 2 Nov 2016 15:40:36 +0000 (16:40 +0100)]
android: Log any installed DNS servers

3 years agoandroid: Unregister listener in case of error alerts
Tobias Brunner [Wed, 2 Nov 2016 15:35:50 +0000 (16:35 +0100)]
android: Unregister listener in case of error alerts

This avoids triggering additional errors via e.g. ike_updown() that
might cause the error message displayed in the GUI to change if the
status fragment is recreated.

References #2134.

3 years agoandroid: Report an error for invalid integer values
Tobias Brunner [Wed, 2 Nov 2016 15:33:29 +0000 (16:33 +0100)]
android: Report an error for invalid integer values

Previously we'd just ignore the invalid values without notifying the
user.

3 years agoandroid: Propose curve25519 in the ESP proposals
Tobias Brunner [Tue, 6 Dec 2016 10:51:33 +0000 (11:51 +0100)]
android: Propose curve25519 in the ESP proposals

3 years agoandroid: Enable curve25519 plugin in the app
Tobias Brunner [Tue, 6 Dec 2016 10:51:19 +0000 (11:51 +0100)]
android: Enable curve25519 plugin in the app

3 years agoandroid: Optionally build the curve25519 plugin
Tobias Brunner [Tue, 6 Dec 2016 10:50:25 +0000 (11:50 +0100)]
android: Optionally build the curve25519 plugin

3 years agoandroid: Propose ChaCha20/Poly1305 in the ESP AEAD proposals
Tobias Brunner [Wed, 18 Nov 2015 10:31:14 +0000 (11:31 +0100)]
android: Propose ChaCha20/Poly1305 in the ESP AEAD proposals

3 years agoandroid: Enable chapoly plugin in the app
Tobias Brunner [Wed, 18 Nov 2015 10:31:03 +0000 (11:31 +0100)]
android: Enable chapoly plugin in the app

3 years agoandroid: Optionally build the chapoly plugin
Tobias Brunner [Wed, 18 Nov 2015 10:25:29 +0000 (11:25 +0100)]
android: Optionally build the chapoly plugin

3 years agoandroid: Update Gradle plugin and wrapper
Tobias Brunner [Tue, 20 Sep 2016 17:20:22 +0000 (19:20 +0200)]
android: Update Gradle plugin and wrapper

3 years agoikev1: Minor code optimization in task manager
Thomas Egerer [Tue, 6 Dec 2016 12:24:59 +0000 (13:24 +0100)]
ikev1: Minor code optimization in task manager

Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
3 years agotravis: The xcode7.3 image is now the default
Tobias Brunner [Fri, 2 Dec 2016 10:06:08 +0000 (11:06 +0100)]
travis: The xcode7.3 image is now the default

3 years agotravis: Output config.log on failure
Tobias Brunner [Fri, 2 Dec 2016 10:05:30 +0000 (11:05 +0100)]
travis: Output config.log on failure

3 years agoconfigure: Check for actual functions in libraries with AC_CHECK_LIB
Tobias Brunner [Fri, 2 Dec 2016 09:55:13 +0000 (10:55 +0100)]
configure: Check for actual functions in libraries with AC_CHECK_LIB

Checking for `main` produces code like this in the test program:

  int
  main ()
  {
  return main ();
    ;
    return 0;
  }

This recursive call results in a warning message with some compilers (e.g.
Clang in newer Xcode versions: "all paths through this function will call
itself [-Winfinite-recursion]"), which lets the tests fail when compiling
with -Werror.

3 years agoplugin-loader: Strip '!' from critical plugin names when setting paths
Tobias Brunner [Fri, 18 Nov 2016 11:16:34 +0000 (12:16 +0100)]
plugin-loader: Strip '!' from critical plugin names when setting paths

3 years agochild-sa: Use single return statement in update_usebytes()
Thomas Egerer [Tue, 15 Nov 2016 17:27:55 +0000 (18:27 +0100)]
child-sa: Use single return statement in update_usebytes()

Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
3 years agoproposal: Remove RFC 5114 MODP DH groups from default proposal
Martin Willi [Thu, 20 Oct 2016 05:12:32 +0000 (07:12 +0200)]
proposal: Remove RFC 5114 MODP DH groups from default proposal

Recent research demonstrates that at least for 1024-bit DH groups, it is
possible to create specially crafted primes having a backdoor. From the
prime itself this is not detectable, creating a perfect NOBUS attack.

http://eprint.iacr.org/2016/961

For the primes defined in RFC 5114 no information is provided on how these
have been selected. In the default proposal we included one of the 2048-bit
primes only, where it is questionable if constructing a backdoored prime is
feasible. Nevertheless, this patch removes the group from the set of default
proposals as well.

3 years agoVersion bump to 5.5.2dr2 5.5.2dr2
Andreas Steffen [Mon, 14 Nov 2016 15:20:10 +0000 (16:20 +0100)]
Version bump to 5.5.2dr2

3 years agotesting: make curve25519 the default DH group
Andreas Steffen [Tue, 8 Nov 2016 12:50:14 +0000 (13:50 +0100)]
testing: make curve25519 the default DH group

3 years agoproposal: Add curve25519 and curve448 to default proposal
Tobias Brunner [Fri, 30 Sep 2016 12:40:48 +0000 (14:40 +0200)]
proposal: Add curve25519 and curve448 to default proposal

3 years agoconfigure: Enable curve25519 plugin by default
Tobias Brunner [Fri, 30 Sep 2016 12:39:18 +0000 (14:39 +0200)]
configure: Enable curve25519 plugin by default