strongswan.git
10 years agoAdded a new FETCH_CALLBACK option to fetch data without allocation
Martin Willi [Fri, 1 Apr 2011 08:30:42 +0000 (10:30 +0200)]
Added a new FETCH_CALLBACK option to fetch data without allocation

10 years agoMigrated fetcher_manager to INIT/METHOD macros
Martin Willi [Fri, 1 Apr 2011 08:26:24 +0000 (10:26 +0200)]
Migrated fetcher_manager to INIT/METHOD macros

10 years agoversion bump to 4.5.2dr4
Andreas Steffen [Sat, 2 Apr 2011 05:46:16 +0000 (07:46 +0200)]
version bump to 4.5.2dr4

10 years agoupdated ikev2/rw-eap-tnc scenarios
Andreas Steffen [Fri, 1 Apr 2011 17:44:25 +0000 (19:44 +0200)]
updated ikev2/rw-eap-tnc scenarios

10 years agoInstall systemd service file if systemd is available
Miklos Vajna [Mon, 28 Mar 2011 18:04:00 +0000 (20:04 +0200)]
Install systemd service file if systemd is available

10 years agolog TNC PEP decision with level 0
Andreas Steffen [Fri, 25 Mar 2011 11:48:45 +0000 (12:48 +0100)]
log TNC PEP decision with level 0

10 years agoIncrease whitelist message identity buffer to 128 bytes
Martin Willi [Wed, 23 Mar 2011 13:16:13 +0000 (14:16 +0100)]
Increase whitelist message identity buffer to 128 bytes

10 years agoFix order of PURGE_* flags to be compatible with STROKE_PURGE_* keywords
Martin Willi [Wed, 23 Mar 2011 08:28:40 +0000 (09:28 +0100)]
Fix order of PURGE_* flags to be compatible with STROKE_PURGE_* keywords

10 years agoMake availability of glob(3) optional in settings_t.
Tobias Brunner [Tue, 22 Mar 2011 18:17:51 +0000 (19:17 +0100)]
Make availability of glob(3) optional in settings_t.

If glob(3) is not available just try to open the pattern as regular
file. The reason for this change is that glob(3) is not available on Android.

10 years agoMake sure that files included in settings_t are regular files.
Tobias Brunner [Tue, 22 Mar 2011 18:16:19 +0000 (19:16 +0100)]
Make sure that files included in settings_t are regular files.

10 years agoDefine PLUGINDIR in Android.mk even though it is currently not used.
Tobias Brunner [Tue, 22 Mar 2011 16:37:19 +0000 (17:37 +0100)]
Define PLUGINDIR in Android.mk even though it is currently not used.

The combined plugin loader requires PLUGINDIR to be defined.

10 years agoFile lists in Android.mk files updated to those in the Makefiles.
Tobias Brunner [Tue, 22 Mar 2011 16:36:23 +0000 (17:36 +0100)]
File lists in Android.mk files updated to those in the Makefiles.

10 years agoFall back to _LINUX_CAPABILITY_VERSION if no explicit version is defined.
Tobias Brunner [Tue, 22 Mar 2011 16:33:29 +0000 (17:33 +0100)]
Fall back to _LINUX_CAPABILITY_VERSION if no explicit version is defined.

This is the case on Android.

10 years agoredirect debug output of imc/imv pairs to syslog
Andreas Steffen [Sat, 19 Mar 2011 22:23:52 +0000 (23:23 +0100)]
redirect debug output of imc/imv pairs to syslog

10 years agosome changes to the ikev2/rw-eap-tnc-11|20 scenarios
Andreas Steffen [Sat, 19 Mar 2011 15:48:06 +0000 (16:48 +0100)]
some changes to the ikev2/rw-eap-tnc-11|20 scenarios

10 years agoTNC server did not issue a TNC_CONNECTION_STATE_HANDSHAKE NotifyConnection message
Andreas Steffen [Sat, 19 Mar 2011 15:43:22 +0000 (16:43 +0100)]
TNC server did not issue a TNC_CONNECTION_STATE_HANDSHAKE NotifyConnection message

10 years agoaf-alg plugin does not require hmac and xcbc plugins
Andreas Steffen [Fri, 18 Mar 2011 08:54:59 +0000 (09:54 +0100)]
af-alg plugin does not require hmac and xcbc plugins

10 years agoadded duplicheck.enable and whitelist.enable options to strongswan.conf man page
Andreas Steffen [Fri, 18 Mar 2011 07:01:09 +0000 (08:01 +0100)]
added duplicheck.enable and whitelist.enable options to strongswan.conf man page

10 years agoadded af-alg-ikev1/alg-camellia scenario
Andreas Steffen [Fri, 18 Mar 2011 06:39:21 +0000 (07:39 +0100)]
added af-alg-ikev1/alg-camellia scenario

10 years agoadded af-alg-ikev2/alg-camellia scenario
Andreas Steffen [Fri, 18 Mar 2011 06:34:48 +0000 (07:34 +0100)]
added af-alg-ikev2/alg-camellia scenario

10 years agoadded the af-alg-ikev1/rw-cert scenario
Andreas Steffen [Thu, 17 Mar 2011 22:16:41 +0000 (23:16 +0100)]
added the af-alg-ikev1/rw-cert scenario

10 years agoadded the af-alg-ikev2/rw-cert scenario
Andreas Steffen [Thu, 17 Mar 2011 21:55:26 +0000 (22:55 +0100)]
added the af-alg-ikev2/rw-cert scenario

10 years agobuild the af-alg plugin in the UML test environment
Andreas Steffen [Thu, 17 Mar 2011 21:53:09 +0000 (22:53 +0100)]
build the af-alg plugin in the UML test environment

10 years agoinclude linux/if_alg.h in the strongSwan distribution
Andreas Steffen [Thu, 17 Mar 2011 21:52:04 +0000 (22:52 +0100)]
include linux/if_alg.h in the strongSwan distribution

10 years agoversion bump to 4.5.2dr3
Andreas Steffen [Thu, 17 Mar 2011 19:24:44 +0000 (20:24 +0100)]
version bump to 4.5.2dr3

10 years agoadded NEWS for 4.5.2dr2 release
Andreas Steffen [Thu, 17 Mar 2011 19:24:00 +0000 (20:24 +0100)]
added NEWS for 4.5.2dr2 release

10 years agoAdded a strongswan.conf "enabled" option for duplicheck plugin
Martin Willi [Thu, 17 Mar 2011 16:34:11 +0000 (17:34 +0100)]
Added a strongswan.conf "enabled" option for duplicheck plugin

10 years agoAdded strongswan.conf and runtime option to enable/disable whitelist plugin
Martin Willi [Thu, 17 Mar 2011 16:15:16 +0000 (17:15 +0100)]
Added strongswan.conf and runtime option to enable/disable whitelist plugin

10 years agoMove establish/inherit of rekeyed IKE_SAs to delete messages
Martin Willi [Tue, 15 Mar 2011 14:20:09 +0000 (15:20 +0100)]
Move establish/inherit of rekeyed IKE_SAs to delete messages

Having the inherit() function delayed to the IKE_SA establish procedure
was problematic. The task destroy function was never a good place and
results in locking/cleanup problems. After establishing the SA, it
should be really checked in ASAP to avoid any triggered DPD checks
to get lost.

10 years agoWrap IKE delete after rekey into rekey task for responder, too
Martin Willi [Tue, 15 Mar 2011 10:51:53 +0000 (11:51 +0100)]
Wrap IKE delete after rekey into rekey task for responder, too

10 years agoDo not invoke processor restart() if not required
Martin Willi [Tue, 15 Mar 2011 10:48:19 +0000 (11:48 +0100)]
Do not invoke processor restart() if not required

Doing so might result in a deadlock during shutdown if a delayed
restart is locked on the bus during the debug statement.

10 years agoMigrated ike_rekey task to INIT/METHOD macros
Martin Willi [Tue, 15 Mar 2011 10:30:02 +0000 (11:30 +0100)]
Migrated ike_rekey task to INIT/METHOD macros

10 years agofixed asn1_oid_from_string(), allowing it to handle up to 32 bit node numbers
Andreas Steffen [Sat, 12 Mar 2011 12:46:14 +0000 (13:46 +0100)]
fixed asn1_oid_from_string(), allowing it to handle up to 32 bit node numbers

10 years agofixed parsing of X.509 certificatePolicies
Andreas Steffen [Fri, 11 Mar 2011 11:38:00 +0000 (12:38 +0100)]
fixed parsing of X.509 certificatePolicies

10 years agoadded tcg-at-tpmIdLabel OID
Andreas Steffen [Fri, 11 Mar 2011 10:48:46 +0000 (11:48 +0100)]
added tcg-at-tpmIdLabel OID

10 years agooutput unknown OIDs in dot string notation
Andreas Steffen [Fri, 11 Mar 2011 10:48:22 +0000 (11:48 +0100)]
output unknown OIDs in dot string notation

10 years agoversion bump to 4.5.2dr2
Andreas Steffen [Fri, 11 Mar 2011 08:12:13 +0000 (09:12 +0100)]
version bump to 4.5.2dr2

10 years agoadded NEWS for the 4.5.2dr1 release
Andreas Steffen [Fri, 11 Mar 2011 08:11:37 +0000 (09:11 +0100)]
added NEWS for the 4.5.2dr1 release

10 years agofixed asn1_oid_to_string() conversion
Andreas Steffen [Wed, 9 Mar 2011 14:35:35 +0000 (15:35 +0100)]
fixed asn1_oid_to_string() conversion

10 years agoUse a boolean expression for refcount check, fixes refcounting if bool is a signed...
Martin Willi [Wed, 9 Mar 2011 06:52:13 +0000 (07:52 +0100)]
Use a boolean expression for refcount check, fixes refcounting if bool is a signed char

10 years agoMigrated sim_manager to INIT/METHOD macros
Martin Willi [Tue, 8 Mar 2011 14:02:42 +0000 (15:02 +0100)]
Migrated sim_manager to INIT/METHOD macros

10 years agoProtect sim card/provider/hook (un-)registration with a rwlock
Martin Willi [Tue, 8 Mar 2011 13:52:47 +0000 (14:52 +0100)]
Protect sim card/provider/hook (un-)registration with a rwlock

10 years agoSplitted sim_manager.h header to sim_{card,provider,hooks}.h
Martin Willi [Tue, 8 Mar 2011 13:17:53 +0000 (14:17 +0100)]
Splitted sim_manager.h header to sim_{card,provider,hooks}.h

10 years agodefined some TCG attribute OIDs
Andreas Steffen [Tue, 8 Mar 2011 06:27:00 +0000 (07:27 +0100)]
defined some TCG attribute OIDs

10 years agosupport of RSAES-OAEP public keys
Andreas Steffen [Tue, 8 Mar 2011 06:03:22 +0000 (07:03 +0100)]
support of RSAES-OAEP public keys

10 years agoadded id-RSAES-OAEP and id-pSpecified OIDs
Andreas Steffen [Mon, 7 Mar 2011 21:46:28 +0000 (22:46 +0100)]
added id-RSAES-OAEP and id-pSpecified OIDs

10 years agoinitiate or route all child configs if they have different names from their parent...
Andreas Steffen [Fri, 4 Mar 2011 06:02:03 +0000 (07:02 +0100)]
initiate or route all child configs if they have different names from their parent peer config

10 years agoAlign netlink attributes properly if rta_len not a multiple of RTA_ALIGNTO
Martin Willi [Wed, 2 Mar 2011 15:06:13 +0000 (16:06 +0100)]
Align netlink attributes properly if rta_len not a multiple of RTA_ALIGNTO

10 years agoinitiate or route child configs which don't have a peer config of the same name
Andreas Steffen [Tue, 1 Mar 2011 21:24:19 +0000 (22:24 +0100)]
initiate or route child configs which don't have a peer config of the same name

10 years agoput DN in double quotes
Andreas Steffen [Fri, 18 Feb 2011 16:36:18 +0000 (17:36 +0100)]
put DN in double quotes

10 years agocorrected pkcs11 error message
Andreas Steffen [Fri, 18 Feb 2011 16:32:48 +0000 (17:32 +0100)]
corrected pkcs11 error message

10 years agoImplemented permanent certificate coupling plugin
Martin Willi [Mon, 21 Feb 2011 13:05:21 +0000 (13:05 +0000)]
Implemented permanent certificate coupling plugin

10 years agoUpdate duplicheck entry during IKE rekeying
Martin Willi [Mon, 28 Feb 2011 14:49:50 +0000 (14:49 +0000)]
Update duplicheck entry during IKE rekeying

10 years agoRemove entry from active duplicate list only if it was not in checking
Martin Willi [Tue, 22 Feb 2011 10:16:13 +0000 (11:16 +0100)]
Remove entry from active duplicate list only if it was not in checking

10 years agoAdded an example application listening to duplicheck notifications
Martin Willi [Wed, 9 Feb 2011 15:28:31 +0000 (16:28 +0100)]
Added an example application listening to duplicheck notifications

10 years agoNotify duplicate detections over a UNIX sockets to listening applications
Martin Willi [Wed, 9 Feb 2011 15:15:21 +0000 (16:15 +0100)]
Notify duplicate detections over a UNIX sockets to listening applications

10 years agoAdded an advanced duplicate checking plugin with liveness check of old SA
Martin Willi [Wed, 9 Feb 2011 14:04:21 +0000 (15:04 +0100)]
Added an advanced duplicate checking plugin with liveness check of old SA

10 years agoInvert check to delete unestablished IKE_SAs to not delete them once established
Martin Willi [Wed, 9 Feb 2011 14:03:08 +0000 (15:03 +0100)]
Invert check to delete unestablished IKE_SAs to not delete them once established

10 years agoAdded whitelist plugin NEWS
Martin Willi [Tue, 8 Feb 2011 08:40:14 +0000 (09:40 +0100)]
Added whitelist plugin NEWS

10 years agoAdded a whitelist command line utility to control whitelist plugin
Martin Willi [Thu, 3 Feb 2011 16:06:40 +0000 (17:06 +0100)]
Added a whitelist command line utility to control whitelist plugin

10 years agoAdded a UNIX socket based control backend to whitelist plugin
Martin Willi [Thu, 3 Feb 2011 13:37:45 +0000 (14:37 +0100)]
Added a UNIX socket based control backend to whitelist plugin

10 years agoImplemented a in-memory peer identity whitelist plugin
Martin Willi [Thu, 3 Feb 2011 12:38:13 +0000 (13:38 +0100)]
Implemented a in-memory peer identity whitelist plugin

10 years agoFixed a possible segfault after termination of IKE and child SAs.
Tobias Brunner [Mon, 28 Feb 2011 12:19:39 +0000 (13:19 +0100)]
Fixed a possible segfault after termination of IKE and child SAs.

Because the thread that is actually terminating the SA and thus checking
it in again is not be the same thread that previously checked it out and
queued the termination job, the thread local SA on the bus has to be reset
manually, similar to how it is set in the job which is executing the job.

10 years agoSlightly change IKE_SA destruction order to inherit properly during ike_rekey task...
Martin Willi [Mon, 28 Feb 2011 10:31:36 +0000 (10:31 +0000)]
Slightly change IKE_SA destruction order to inherit properly during ike_rekey task destruction

10 years agoAdded a pseudo EAP type to allow an implementation to select the real type dynamically
Martin Willi [Tue, 22 Feb 2011 15:09:45 +0000 (16:09 +0100)]
Added a pseudo EAP type to allow an implementation to select the real type dynamically

10 years agoprevent multiple debug outputs in case of non-monolithic plugins
Andreas Steffen [Sun, 20 Feb 2011 14:18:36 +0000 (15:18 +0100)]
prevent multiple debug outputs in case of non-monolithic plugins

10 years agoWhitelisted another tzset variant and dlsym
Martin Willi [Fri, 18 Feb 2011 15:07:16 +0000 (16:07 +0100)]
Whitelisted another tzset variant and dlsym

10 years agoMigrated kernel_pfroute_net to INIT/METHOD macros
Martin Willi [Thu, 17 Feb 2011 09:39:25 +0000 (09:39 +0000)]
Migrated kernel_pfroute_net to INIT/METHOD macros

10 years agoMigrated kernel_netlink_net to INIT/METHOD macros
Martin Willi [Thu, 17 Feb 2011 09:31:15 +0000 (09:31 +0000)]
Migrated kernel_netlink_net to INIT/METHOD macros

10 years agomaemo: New upstream release.
Tobias Brunner [Tue, 15 Feb 2011 09:43:19 +0000 (10:43 +0100)]
maemo: New upstream release.

10 years agoversion bump to 4.5.2dr1
Andreas Steffen [Fri, 11 Feb 2011 06:46:23 +0000 (07:46 +0100)]
version bump to 4.5.2dr1

10 years agomaemo: Disabled some unneeded plugins. 4.5.1
Tobias Brunner [Thu, 10 Feb 2011 15:07:16 +0000 (16:07 +0100)]
maemo: Disabled some unneeded plugins.

10 years agoMerged the monolithic and non-monolithic plugin loaders into one.
Tobias Brunner [Thu, 10 Feb 2011 15:46:06 +0000 (16:46 +0100)]
Merged the monolithic and non-monolithic plugin loaders into one.

This allows to add additional plugins even when the original build was
monolithic. Also fixes the pluto/xauth bug with the monolithic build.

10 years agopluto: Properly free secrets in error cases.
Tobias Brunner [Thu, 10 Feb 2011 14:50:58 +0000 (15:50 +0100)]
pluto: Properly free secrets in error cases.

10 years agoKernel interface updated for KLIPS plugin (TFC padding).
Tobias Brunner [Thu, 10 Feb 2011 10:01:15 +0000 (11:01 +0100)]
Kernel interface updated for KLIPS plugin (TFC padding).

10 years agoCompiler warning fixed.
Tobias Brunner [Thu, 10 Feb 2011 10:00:31 +0000 (11:00 +0100)]
Compiler warning fixed.

10 years ago[hopefully] fixed pathlen problem on ARM platforms
Andreas Steffen [Thu, 10 Feb 2011 14:51:18 +0000 (15:51 +0100)]
[hopefully] fixed pathlen problem on ARM platforms

10 years agomaemo: Typos in description fixed.
Tobias Brunner [Tue, 8 Feb 2011 17:10:13 +0000 (18:10 +0100)]
maemo: Typos in description fixed.

10 years agomaemo: Homepage added to debian/control files.
Tobias Brunner [Tue, 8 Feb 2011 16:41:57 +0000 (17:41 +0100)]
maemo: Homepage added to debian/control files.

10 years agoremoved ipsec up %startall from scenario descriptions
Andreas Steffen [Thu, 10 Feb 2011 09:03:59 +0000 (10:03 +0100)]
removed ipsec up %startall from scenario descriptions

10 years agoMigrated update_sa_job_t to INIT/METHOD macros
Andreas Steffen [Thu, 10 Feb 2011 07:31:46 +0000 (08:31 +0100)]
Migrated update_sa_job_t to INIT/METHOD macros

10 years agoMigrated send_keepalive_job_t to INIT/METHOD macros
Andreas Steffen [Thu, 10 Feb 2011 07:28:19 +0000 (08:28 +0100)]
Migrated send_keepalive_job_t to INIT/METHOD macros

10 years agoMigrated send_dpd_job_t to INIT/METHOD macros
Andreas Steffen [Thu, 10 Feb 2011 07:25:41 +0000 (08:25 +0100)]
Migrated send_dpd_job_t to INIT/METHOD macros

10 years agoMigrated roam_job_t to INIT/METHOD macros
Andreas Steffen [Thu, 10 Feb 2011 07:22:57 +0000 (08:22 +0100)]
Migrated roam_job_t to INIT/METHOD macros

10 years agoMigrated retransmit_job_t to INIT/METHOD macros
Andreas Steffen [Thu, 10 Feb 2011 07:19:47 +0000 (08:19 +0100)]
Migrated retransmit_job_t to INIT/METHOD macros

10 years agoMigrated rekey_ike_sa_job_t to INIT/METHOD macros
Andreas Steffen [Thu, 10 Feb 2011 07:16:23 +0000 (08:16 +0100)]
Migrated rekey_ike_sa_job_t to INIT/METHOD macros

10 years agoMigrated rekey_child_sa_job_t to INIT/METHOD macros
Andreas Steffen [Thu, 10 Feb 2011 07:13:01 +0000 (08:13 +0100)]
Migrated rekey_child_sa_job_t to INIT/METHOD macros

10 years agoMigrated process_message_job_t to INIT/METHOD macros
Andreas Steffen [Thu, 10 Feb 2011 07:09:36 +0000 (08:09 +0100)]
Migrated process_message_job_t to INIT/METHOD macros

10 years agoMigrated migrate_job_t to INIT/METHOD macros
Andreas Steffen [Thu, 10 Feb 2011 07:06:06 +0000 (08:06 +0100)]
Migrated migrate_job_t to INIT/METHOD macros

10 years ago_ prefix not required
Andreas Steffen [Thu, 10 Feb 2011 06:59:43 +0000 (07:59 +0100)]
_ prefix not required

10 years agoMigrated delete_ike_sa_job_t to INIT/METHOD macros
Andreas Steffen [Thu, 10 Feb 2011 06:56:53 +0000 (07:56 +0100)]
Migrated delete_ike_sa_job_t to INIT/METHOD macros

10 years agoMigrated delete_child_sa_job_t to INIT/METHOD macros
Andreas Steffen [Thu, 10 Feb 2011 06:53:34 +0000 (07:53 +0100)]
Migrated delete_child_sa_job_t to INIT/METHOD macros

10 years agoMigrated acquire_job_t to INIT/METHOD macros
Andreas Steffen [Thu, 10 Feb 2011 06:49:05 +0000 (07:49 +0100)]
Migrated acquire_job_t to INIT/METHOD macros

10 years agoreplaced ipsec up %startall command by start_action job
Andreas Steffen [Wed, 9 Feb 2011 21:27:04 +0000 (22:27 +0100)]
replaced ipsec up %startall command by start_action job

10 years agoversion bump to 4.5.1
Andreas Steffen [Wed, 9 Feb 2011 19:40:02 +0000 (20:40 +0100)]
version bump to 4.5.1

10 years agoadded openssl-ikev2/critical-extension scenario
Andreas Steffen [Tue, 8 Feb 2011 21:58:31 +0000 (22:58 +0100)]
added openssl-ikev2/critical-extension scenario

10 years agomaemo: Exclude static libraries from strongswan-applet package.
Tobias Brunner [Tue, 8 Feb 2011 15:18:50 +0000 (16:18 +0100)]
maemo: Exclude static libraries from strongswan-applet package.

10 years agomaemo: Use automatic optification.
Tobias Brunner [Tue, 8 Feb 2011 14:19:15 +0000 (15:19 +0100)]
maemo: Use automatic optification.

10 years agomaemo: Explicitly list the installed files.
Tobias Brunner [Tue, 8 Feb 2011 14:15:36 +0000 (15:15 +0100)]
maemo: Explicitly list the installed files.

This avoids packaging static libraries and .la files plus excludes man3
pages of libfreeswan.

10 years agomaemo: Use /usr/lib instead of /usr/libexec.
Tobias Brunner [Tue, 8 Feb 2011 14:14:48 +0000 (15:14 +0100)]
maemo: Use /usr/lib instead of /usr/libexec.