strongswan.git
7 years agoMerge branch 'multi-vip'
Martin Willi [Fri, 31 Aug 2012 10:55:56 +0000 (12:55 +0200)]
Merge branch 'multi-vip'

Brings support for multiple virtual IPs and multiple pools in
left/rigthsourceip definitions. Also introduces the new left/rightdns
options to configure requested DNS server address family and respond
with multiple connection specific servers.

7 years agoMerge branch 'eap-client-select'
Tobias Brunner [Fri, 31 Aug 2012 10:23:38 +0000 (12:23 +0200)]
Merge branch 'eap-client-select'

This brings support for EAP-Nak payloads on the client (to select a
specific or supported method), and the server (via the eap-dynamic
plugin which selects a method supported/requested by the client).

7 years agoNEWS about eap-dynamic plugin added
Tobias Brunner [Fri, 31 Aug 2012 10:16:43 +0000 (12:16 +0200)]
NEWS about eap-dynamic plugin added

7 years agoDocumentation for eap-dynamic added
Tobias Brunner [Thu, 23 Aug 2012 14:21:22 +0000 (16:21 +0200)]
Documentation for eap-dynamic added

7 years agoLog the proper type for virtual EAP methods
Tobias Brunner [Thu, 23 Aug 2012 14:10:47 +0000 (16:10 +0200)]
Log the proper type for virtual EAP methods

7 years agoAdded an option to prefer types sent by peer in eap-dynamic plugin
Tobias Brunner [Thu, 23 Aug 2012 14:02:51 +0000 (16:02 +0200)]
Added an option to prefer types sent by peer in eap-dynamic plugin

7 years agoeap-dynamic plugin handles EAP-Nak messages and selects a method supported by the...
Tobias Brunner [Thu, 23 Aug 2012 13:00:20 +0000 (15:00 +0200)]
eap-dynamic plugin handles EAP-Nak messages and selects a method supported by the peer

7 years agoPreferred EAP methods for eap-dynamic can be configured
Tobias Brunner [Thu, 23 Aug 2012 12:55:33 +0000 (14:55 +0200)]
Preferred EAP methods for eap-dynamic can be configured

7 years agoThe eap-dynamic plugin uses the first supported method as default
Tobias Brunner [Thu, 23 Aug 2012 12:47:27 +0000 (14:47 +0200)]
The eap-dynamic plugin uses the first supported method as default

7 years agoAdded eap-dynamic plugin which can proxy any other EAP method
Tobias Brunner [Thu, 23 Aug 2012 12:42:23 +0000 (14:42 +0200)]
Added eap-dynamic plugin which can proxy any other EAP method

7 years agoUse eap_vendor_type_from_string() in stroke
Tobias Brunner [Thu, 23 Aug 2012 08:16:37 +0000 (10:16 +0200)]
Use eap_vendor_type_from_string() in stroke

7 years agoFunction added that parses EAP method strings ([eap-]type[-vendor])
Tobias Brunner [Thu, 23 Aug 2012 08:00:11 +0000 (10:00 +0200)]
Function added that parses EAP method strings ([eap-]type[-vendor])

7 years agoAdded method to enumerate EAP types contained in an EAP-Nak
Tobias Brunner [Thu, 23 Aug 2012 07:06:47 +0000 (09:06 +0200)]
Added method to enumerate EAP types contained in an EAP-Nak

7 years agoEncode EAP-Naks in expanded format if we got an expanded type request
Tobias Brunner [Thu, 23 Aug 2012 06:36:24 +0000 (08:36 +0200)]
Encode EAP-Naks in expanded format if we got an expanded type request

Since methods defined by the IETF (vendor ID 0) could also be encoded in
expanded type format the previous check was insufficient.

7 years agoAllow clients to request a configured EAP method via EAP-Nak
Tobias Brunner [Tue, 21 Aug 2012 15:11:14 +0000 (17:11 +0200)]
Allow clients to request a configured EAP method via EAP-Nak

7 years agoVirtual EAP methods handle EAP-Naks themselves
Tobias Brunner [Tue, 21 Aug 2012 14:57:34 +0000 (16:57 +0200)]
Virtual EAP methods handle EAP-Naks themselves

7 years agoSend EAP-Nak with supported types if requested type is unsupported
Tobias Brunner [Tue, 21 Aug 2012 14:54:21 +0000 (16:54 +0200)]
Send EAP-Nak with supported types if requested type is unsupported

7 years agoFilter invalid EAP authentication types when enumerating them
Tobias Brunner [Wed, 22 Aug 2012 15:01:13 +0000 (17:01 +0200)]
Filter invalid EAP authentication types when enumerating them

Valid authentication types defined by the IETF are 4-253 and 255.

7 years agoMove our pseudo EAP types out of the range of valid EAP methods
Tobias Brunner [Fri, 31 Aug 2012 09:31:48 +0000 (11:31 +0200)]
Move our pseudo EAP types out of the range of valid EAP methods

7 years agoversion bump to 5.0.1dr4
Andreas Steffen [Fri, 31 Aug 2012 00:47:19 +0000 (02:47 +0200)]
version bump to 5.0.1dr4

7 years agoAdded multiple left/rightsourceip NEWS
Martin Willi [Mon, 27 Aug 2012 14:52:22 +0000 (16:52 +0200)]
Added multiple left/rightsourceip NEWS

7 years agoAdded NEWS for left/rightdns options
Martin Willi [Mon, 27 Aug 2012 14:44:35 +0000 (16:44 +0200)]
Added NEWS for left/rightdns options

7 years agoUpdated ipsec.conf.5 with multiple left/rightsourceip support
Martin Willi [Mon, 27 Aug 2012 14:58:10 +0000 (16:58 +0200)]
Updated ipsec.conf.5 with multiple left/rightsourceip support

7 years agoAdded a note to _updown for the new PLUTO_MY_SOURCEIP* variables
Martin Willi [Mon, 27 Aug 2012 14:39:55 +0000 (16:39 +0200)]
Added a note to _updown for the new PLUTO_MY_SOURCEIP* variables

7 years agoBe less verbose if IP allocation for a single pool fails
Martin Willi [Mon, 27 Aug 2012 14:31:38 +0000 (16:31 +0200)]
Be less verbose if IP allocation for a single pool fails

7 years agoDHCP plugin returns virtual IPs for IPv4 requests only
Martin Willi [Mon, 27 Aug 2012 14:26:28 +0000 (16:26 +0200)]
DHCP plugin returns virtual IPs for IPv4 requests only

7 years agoCheck address family in HA virtual IP backend
Martin Willi [Mon, 27 Aug 2012 14:26:01 +0000 (16:26 +0200)]
Check address family in HA virtual IP backend

7 years agoStrictly enforce address family match while acquiring mem_pool IPs
Martin Willi [Mon, 27 Aug 2012 14:24:44 +0000 (16:24 +0200)]
Strictly enforce address family match while acquiring mem_pool IPs

7 years agoDon't parse comma separated pool names in attr-sql
Martin Willi [Mon, 27 Aug 2012 14:01:16 +0000 (16:01 +0200)]
Don't parse comma separated pool names in attr-sql

We now handle multiple pools at a deeper level, making that special
handling obsolete. Comma separated pools are parsed in stroke.

7 years agoHandle comma separated pools as multiple pool names in SQL plugin
Martin Willi [Mon, 27 Aug 2012 14:00:13 +0000 (16:00 +0200)]
Handle comma separated pools as multiple pool names in SQL plugin

7 years agoRequest and acquire multiple virtual IPs in IKEv1 Mode Config
Martin Willi [Mon, 27 Aug 2012 13:42:50 +0000 (15:42 +0200)]
Request and acquire multiple virtual IPs in IKEv1 Mode Config

7 years agoRequest and acquire multiple virtual IPs in IKEv2 configuration payload
Martin Willi [Mon, 27 Aug 2012 13:34:10 +0000 (15:34 +0200)]
Request and acquire multiple virtual IPs in IKEv2 configuration payload

7 years agoPass all configured pool names to attribute provider enumerator
Martin Willi [Mon, 27 Aug 2012 12:48:41 +0000 (14:48 +0200)]
Pass all configured pool names to attribute provider enumerator

7 years agoPass a list instead of a single virtual IP to attribute enumerators
Martin Willi [Mon, 27 Aug 2012 12:09:47 +0000 (14:09 +0200)]
Pass a list instead of a single virtual IP to attribute enumerators

7 years agoSupport multiple addresses/pools in left/rightsourceip
Martin Willi [Mon, 27 Aug 2012 09:19:46 +0000 (11:19 +0200)]
Support multiple addresses/pools in left/rightsourceip

7 years agoSupport multiple address pools configured on a peer_cfg
Martin Willi [Fri, 24 Aug 2012 12:31:24 +0000 (12:31 +0000)]
Support multiple address pools configured on a peer_cfg

7 years agoSupport multiple virtual IPs on peer_cfg and ike_sa classes
Martin Willi [Tue, 21 Aug 2012 11:50:32 +0000 (13:50 +0200)]
Support multiple virtual IPs on peer_cfg and ike_sa classes

7 years agoPorted tun_device de-/initialization to FreeBSD
Tobias Brunner [Wed, 29 Aug 2012 13:30:10 +0000 (15:30 +0200)]
Ported tun_device de-/initialization to FreeBSD

7 years agostruct iphdr is Linux specific use struct ip instead
Tobias Brunner [Wed, 29 Aug 2012 13:28:14 +0000 (15:28 +0200)]
struct iphdr is Linux specific use struct ip instead

7 years agoInclude stdint.h for UINT32_MAX on FreeBSD
Tobias Brunner [Wed, 29 Aug 2012 13:27:04 +0000 (15:27 +0200)]
Include stdint.h for UINT32_MAX on FreeBSD

7 years agoPorted tun_device initialization to OS X utun
Martin Willi [Tue, 28 Aug 2012 08:01:20 +0000 (10:01 +0200)]
Ported tun_device initialization to OS X utun

7 years agoEwa did the new Polish translation
Andreas Steffen [Fri, 24 Aug 2012 14:59:39 +0000 (16:59 +0200)]
Ewa did the new Polish translation

7 years agoLog configured IKE_SA proposals as initiator
Tobias Brunner [Wed, 8 Aug 2012 08:07:53 +0000 (10:07 +0200)]
Log configured IKE_SA proposals as initiator

7 years agoLog configured CHILD_SA proposals as initiator
Tobias Brunner [Wed, 8 Aug 2012 08:05:47 +0000 (10:05 +0200)]
Log configured CHILD_SA proposals as initiator

7 years agoFall back to local address as IKEv1 identity if nothing else is configured
Tobias Brunner [Fri, 24 Aug 2012 10:53:23 +0000 (12:53 +0200)]
Fall back to local address as IKEv1 identity if nothing else is configured

7 years agoRemoved deprecated options from ipsec.conf template
Tobias Brunner [Fri, 24 Aug 2012 09:52:01 +0000 (11:52 +0200)]
Removed deprecated options from ipsec.conf template

7 years agoApply send delay before adding non-ESP marker
Tobias Brunner [Fri, 24 Aug 2012 09:23:36 +0000 (11:23 +0200)]
Apply send delay before adding non-ESP marker

Otherwise the packet header could not be parsed correctly when NAT-T is
used.

7 years agoAdd a getter for the mem_pool_t base address
Martin Willi [Fri, 24 Aug 2012 09:07:50 +0000 (09:07 +0000)]
Add a getter for the mem_pool_t base address

7 years agouse pen_type_t for PA Message Subtype
Andreas Steffen [Thu, 23 Aug 2012 08:48:48 +0000 (10:48 +0200)]
use pen_type_t for PA Message Subtype

7 years agoAdded a method to enumerate registered EAP methods
Tobias Brunner [Tue, 21 Aug 2012 14:48:47 +0000 (16:48 +0200)]
Added a method to enumerate registered EAP methods

7 years agoRemove unused ipsec.conf left/rightnatip keyword
Martin Willi [Tue, 21 Aug 2012 07:32:33 +0000 (09:32 +0200)]
Remove unused ipsec.conf left/rightnatip keyword

7 years agoAdd description about DNS server variables to _updown
Martin Willi [Tue, 31 Jul 2012 13:38:57 +0000 (15:38 +0200)]
Add description about DNS server variables to _updown

7 years agoAdd a DNS attribute handler to updown, passing servers to updown script
Martin Willi [Tue, 31 Jul 2012 13:21:11 +0000 (15:21 +0200)]
Add a DNS attribute handler to updown, passing servers to updown script

7 years agoAdd a description of the leftdns option to ipsec.conf.5
Martin Willi [Tue, 31 Jul 2012 09:20:22 +0000 (11:20 +0200)]
Add a description of the leftdns option to ipsec.conf.5

7 years agoAdd a stroke attribute_handler requesting DNS servers given with leftdns
Martin Willi [Tue, 31 Jul 2012 09:09:19 +0000 (11:09 +0200)]
Add a stroke attribute_handler requesting DNS servers given with leftdns

7 years agoServe ipsec.conf rightdns servers through stroke attribute provider
Martin Willi [Tue, 31 Jul 2012 08:39:16 +0000 (10:39 +0200)]
Serve ipsec.conf rightdns servers through stroke attribute provider

7 years agoAdd a left/rightdns keyword to configure connection specific DNS attributes
Martin Willi [Tue, 31 Jul 2012 08:00:57 +0000 (10:00 +0200)]
Add a left/rightdns keyword to configure connection specific DNS attributes

7 years agoRemove unused src/dst variables in send_no_marker()
Martin Willi [Tue, 21 Aug 2012 07:34:12 +0000 (09:34 +0200)]
Remove unused src/dst variables in send_no_marker()

7 years agouse pen_type_t for attribute request entries
Andreas Steffen [Mon, 20 Aug 2012 22:22:02 +0000 (00:22 +0200)]
use pen_type_t for attribute request entries

7 years agodefine pen_type_t as a vendor-specific type
Andreas Steffen [Mon, 20 Aug 2012 20:37:08 +0000 (22:37 +0200)]
define pen_type_t as a vendor-specific type

7 years agoDon't use POSIX semaphores if a MONOTONIC clock is available
Martin Willi [Mon, 20 Aug 2012 15:58:58 +0000 (17:58 +0200)]
Don't use POSIX semaphores if a MONOTONIC clock is available

POSIX semaphores use CLOCK_REALTIME, but our semaphore_t abstraction
expects CLOCK_MONOTONIC based times. Use the mutex/condvar based
fallback if time_monotonic() actuall returns monotonic times.

7 years agoRemove the unused second IKE_SA entry match function argument
Martin Willi [Mon, 20 Aug 2012 15:39:26 +0000 (17:39 +0200)]
Remove the unused second IKE_SA entry match function argument

LLVMs clang complains about this parameter, so remove it.

7 years agoAdd a mutex/condvar based semaphore implementation if sem_timedwait is unavailable
Martin Willi [Mon, 20 Aug 2012 14:58:15 +0000 (16:58 +0200)]
Add a mutex/condvar based semaphore implementation if sem_timedwait is unavailable

Fixes #214.

7 years agoadded IBM and OpenPTS Private Enterprise Numbers
Andreas Steffen [Mon, 20 Aug 2012 13:02:25 +0000 (15:02 +0200)]
added IBM and OpenPTS Private Enterprise Numbers

7 years agoAdd keymat_t constructor registration function
Adrian-Ken Rueegsegger [Tue, 7 Aug 2012 12:00:28 +0000 (14:00 +0200)]
Add keymat_t constructor registration function

Using the register_constructor function enables custom keymat_t
implementations per IKE version. If no constructor is registered the
default behavior is preserved.

7 years agofixed caption
Andreas Steffen [Mon, 20 Aug 2012 10:56:13 +0000 (12:56 +0200)]
fixed caption

7 years agoimplemented IETF Attribute Request attribute
Andreas Steffen [Mon, 20 Aug 2012 10:27:14 +0000 (12:27 +0200)]
implemented IETF Attribute Request attribute

7 years agoversion bump to 5.0.1dr3
Andreas Steffen [Mon, 20 Aug 2012 10:25:53 +0000 (12:25 +0200)]
version bump to 5.0.1dr3

7 years agoopenssl: Fix registration of the PUBKEY builder
Tobias Brunner [Sat, 18 Aug 2012 15:49:57 +0000 (17:49 +0200)]
openssl: Fix registration of the PUBKEY builder

libtls drops support for RSA suites if it does not find an RSA backend
(final builder for RSA public keys).

7 years agoWithout the ties to PAM we can build eap-gtc on Android
Tobias Brunner [Fri, 17 Aug 2012 12:22:24 +0000 (14:22 +0200)]
Without the ties to PAM we can build eap-gtc on Android

7 years agoCAP_AUDIT_WRITE is now required by xauth-pam not eap-gtc plugin
Tobias Brunner [Fri, 17 Aug 2012 12:21:21 +0000 (14:21 +0200)]
CAP_AUDIT_WRITE is now required by xauth-pam not eap-gtc plugin

7 years agoRemoved manual EAP method registration in eap-gtc plugin
Tobias Brunner [Fri, 17 Aug 2012 12:19:37 +0000 (14:19 +0200)]
Removed manual EAP method registration in eap-gtc plugin

7 years agoEnable build of eap-tls, eap-ttls and eap-peap on Android
Tobias Brunner [Fri, 17 Aug 2012 11:55:44 +0000 (13:55 +0200)]
Enable build of eap-tls, eap-ttls and eap-peap on Android

7 years agoAdd a wrapper around vstr_add_fmt() to avoid having to link libcharon against libvstr
Tobias Brunner [Fri, 17 Aug 2012 09:47:52 +0000 (11:47 +0200)]
Add a wrapper around vstr_add_fmt() to avoid having to link libcharon against libvstr

At least on Android the latter would be required.

7 years agostarter: Restore original config in case also= is used (which reads the same values)
Tobias Brunner [Thu, 16 Aug 2012 14:45:11 +0000 (16:45 +0200)]
starter: Restore original config in case also= is used (which reads the same values)

7 years agoIncreased log level when listing interfaces and IP addresses during startup
Tobias Brunner [Tue, 14 Aug 2012 15:21:55 +0000 (17:21 +0200)]
Increased log level when listing interfaces and IP addresses during startup

This avoids confusing log messages in starter and ipsec statusall
already lists the available addresses anyway.

7 years agoOnly load kernel plugins in starter when flushing SAD/SPD entries
Tobias Brunner [Tue, 14 Aug 2012 14:59:22 +0000 (16:59 +0200)]
Only load kernel plugins in starter when flushing SAD/SPD entries

This avoids keeping the kernel sockets open when they are not actually
needed, which could lead to resource problems (in particular with PF_KEY
where all open sockets receive all messages).

Fixes #217.

7 years agoEnable UDP decapsulation for both address families
Tobias Brunner [Thu, 16 Aug 2012 13:26:37 +0000 (15:26 +0200)]
Enable UDP decapsulation for both address families

Since the 3.5 Linux kernel both UDP implementations have a separate static
flag to indicate whether ANY sockets enabled UDP decapsulation.
As we only ever enabled it for one address family (in earlier versions IPv4
only, now for IPv6, if supported, and for IPv4 otherwise) UDP decapsulation
wouldn't work anymore (at least for one address family).

7 years agoCorrectly transmit EAP-MSCHAPv2 user name if it contains a domain part
Tobias Brunner [Thu, 16 Aug 2012 07:58:26 +0000 (09:58 +0200)]
Correctly transmit EAP-MSCHAPv2 user name if it contains a domain part

7 years agofall through to evidence measurements if no file measurements must be done
Andreas Steffen [Thu, 16 Aug 2012 07:15:36 +0000 (09:15 +0200)]
fall through to evidence measurements if no file measurements must be done

7 years agoupgraded to Ubuntu 12.04.1 LTS
Andreas Steffen [Thu, 16 Aug 2012 07:14:46 +0000 (09:14 +0200)]
upgraded to Ubuntu 12.04.1 LTS

7 years agoadded deletion of product/file entries to usage
Andreas Steffen [Thu, 16 Aug 2012 07:14:13 +0000 (09:14 +0200)]
added deletion of product/file entries to usage

7 years agoNew Android release after adding error dialog
Tobias Brunner [Wed, 15 Aug 2012 08:54:22 +0000 (10:54 +0200)]
New Android release after adding error dialog

Skipped one version due to a rebasing mishap.

7 years agoShow an error message if VPN is not supported
Tobias Brunner [Wed, 15 Aug 2012 08:51:30 +0000 (10:51 +0200)]
Show an error message if VPN is not supported

Some devices have Android 4 installed but the system images still seem to
lack the components that are required for VPN support. One such
component is the dialog used to grant permission to create .

7 years agoEnable search for certificate lists (via SearchView in ActionBar)
Tobias Brunner [Tue, 14 Aug 2012 09:50:03 +0000 (11:50 +0200)]
Enable search for certificate lists (via SearchView in ActionBar)

7 years agoAdded new UI to select a specific CA certificate
Tobias Brunner [Tue, 14 Aug 2012 09:47:32 +0000 (11:47 +0200)]
Added new UI to select a specific CA certificate

With this change there is no need to wait for all certificates being loaded
anymore (this happens only when the user opens the selection activity).

7 years agoDon't try to save profile ID if there is none
Tobias Brunner [Tue, 14 Aug 2012 09:31:37 +0000 (11:31 +0200)]
Don't try to save profile ID if there is none

7 years agoList fragment for trusted certificates can notify listeners about clicks
Tobias Brunner [Tue, 14 Aug 2012 08:43:03 +0000 (10:43 +0200)]
List fragment for trusted certificates can notify listeners about clicks

7 years agoAdded an activity that shows lists of CA certificates in two tabs
Tobias Brunner [Tue, 14 Aug 2012 08:10:52 +0000 (10:10 +0200)]
Added an activity that shows lists of CA certificates in two tabs

7 years agoAdded a ListFragment that lists trusted certificates (loaded via a custom Loader)
Tobias Brunner [Tue, 14 Aug 2012 07:36:56 +0000 (09:36 +0200)]
Added a ListFragment that lists trusted certificates (loaded via a custom Loader)

7 years agoChanged TrustedCertificateAdapter for use with ListViews and TrustedCertificateEntry
Tobias Brunner [Tue, 14 Aug 2012 07:15:02 +0000 (09:15 +0200)]
Changed TrustedCertificateAdapter for use with ListViews and TrustedCertificateEntry

7 years agoRemove certificate spinner from edit view
Tobias Brunner [Tue, 14 Aug 2012 07:12:29 +0000 (09:12 +0200)]
Remove certificate spinner from edit view

7 years agoFunction to get only system-wide CA certificates added to TrustedCertificateManager
Tobias Brunner [Mon, 13 Aug 2012 16:43:29 +0000 (18:43 +0200)]
Function to get only system-wide CA certificates added to TrustedCertificateManager

7 years agoAdded class to store trusted certificate entries for lists
Tobias Brunner [Mon, 13 Aug 2012 16:41:34 +0000 (18:41 +0200)]
Added class to store trusted certificate entries for lists

7 years agofixed Makefile for libstrongswan dev headers
Andreas Steffen [Tue, 14 Aug 2012 08:21:28 +0000 (10:21 +0200)]
fixed Makefile for libstrongswan dev headers

7 years agoversion bump to 5.0.1dr2
Andreas Steffen [Tue, 14 Aug 2012 08:00:46 +0000 (10:00 +0200)]
version bump to 5.0.1dr2

7 years agoskip boot aggregate check against database
Andreas Steffen [Tue, 14 Aug 2012 08:00:05 +0000 (10:00 +0200)]
skip boot aggregate check against database

7 years agoValidate netmask in mem_pool_create
Tobias Brunner [Mon, 13 Aug 2012 11:54:28 +0000 (13:54 +0200)]
Validate netmask in mem_pool_create

7 years agoValidate netmask in traffic_selector_create_from_subnet
Tobias Brunner [Mon, 13 Aug 2012 10:57:41 +0000 (12:57 +0200)]
Validate netmask in traffic_selector_create_from_subnet

Fixes #216.

7 years agoComment fixed
Tobias Brunner [Mon, 13 Aug 2012 11:16:45 +0000 (13:16 +0200)]
Comment fixed