strongswan.git
5 years agoconf: Fix sorting of options with Python 3
Tobias Brunner [Tue, 13 May 2014 09:10:11 +0000 (11:10 +0200)]
conf: Fix sorting of options with Python 3

__cmp__() is not supported anymore with Python 3 and cmp() is deprecated.
Instead rich comparisons should be used (only __lt__() is required for
sorting).

5 years agoconf: print is a function in Python 3
Tobias Brunner [Tue, 13 May 2014 09:06:51 +0000 (11:06 +0200)]
conf: print is a function in Python 3

5 years agobuild-database.sh finds all *.so files in /usr/lib
Andreas Steffen [Tue, 13 May 2014 08:08:04 +0000 (10:08 +0200)]
build-database.sh finds all *.so files in /usr/lib

5 years agoDefined BIOS and EFI event types and log event info
Andreas Steffen [Mon, 12 May 2014 13:24:55 +0000 (15:24 +0200)]
Defined BIOS and EFI event types and log event info

On debug level 2 log EV_ACTION and EV_EFI_ACTION strings
and on level 3 dump raw event information

5 years agolibpts: Updated Android.mk
Tobias Brunner [Mon, 12 May 2014 09:46:08 +0000 (11:46 +0200)]
libpts: Updated Android.mk

5 years agoVersion bump to 5.2.0dr3 5.2.0dr3
Andreas Steffen [Mon, 12 May 2014 05:39:33 +0000 (07:39 +0200)]
Version bump to 5.2.0dr3

5 years agoAdded implementation of RFC 7171 to NEWS
Andreas Steffen [Mon, 12 May 2014 04:52:36 +0000 (06:52 +0200)]
Added implementation of RFC 7171 to NEWS

5 years agoImplemented PT-EAP protocol (RFC 7171)
Andreas Steffen [Sun, 11 May 2014 18:49:21 +0000 (20:49 +0200)]
Implemented PT-EAP protocol (RFC 7171)

5 years agoExtended build-database.sh
Andreas Steffen [Sun, 11 May 2014 10:14:34 +0000 (12:14 +0200)]
Extended build-database.sh

5 years agoattest now maintains multiple versions of a file hash
Andreas Steffen [Sat, 10 May 2014 18:06:41 +0000 (20:06 +0200)]
attest now maintains multiple versions of a file hash

5 years agoChanged default value to libimcv.imc-attestation.pcr_info = no
Andreas Steffen [Mon, 5 May 2014 08:51:51 +0000 (10:51 +0200)]
Changed default value to libimcv.imc-attestation.pcr_info = no

5 years agochild-sa: Reclaim old state if SA updating is not supported
Martin Willi [Fri, 9 May 2014 06:39:55 +0000 (08:39 +0200)]
child-sa: Reclaim old state if SA updating is not supported

If the state stays at UPDATING, the fallback using IKEv1 rekeying fails as
the task manager refuses to rekey a CHILD_SA in non-INSTALLED state.

5 years agoNEWS: Add swanctl news
Martin Willi [Thu, 8 May 2014 07:35:59 +0000 (09:35 +0200)]
NEWS: Add swanctl news

5 years agoMerge branch 'swanctl'
Martin Willi [Wed, 7 May 2014 14:05:39 +0000 (16:05 +0200)]
Merge branch 'swanctl'

Adds a swanctl command line tool to manage the IKE daemon charon using the
VICI interface provided by the vici plugin.

5 years agoswanctl: By default print local swanctl version with --version
Martin Willi [Tue, 6 May 2014 08:56:07 +0000 (10:56 +0200)]
swanctl: By default print local swanctl version with --version

But add a --daemon option to query the IKE daemon for its version.

5 years agoswanctl: Install empty credential folders with appropriate permissions
Martin Willi [Tue, 29 Apr 2014 14:03:44 +0000 (16:03 +0200)]
swanctl: Install empty credential folders with appropriate permissions

5 years agoswanctl: Document most swanctl.conf options in manpage
Martin Willi [Mon, 28 Apr 2014 14:18:24 +0000 (16:18 +0200)]
swanctl: Document most swanctl.conf options in manpage

5 years agoswanctl: Keep swanctl.conf man/template section order as defined
Martin Willi [Tue, 29 Apr 2014 10:15:06 +0000 (12:15 +0200)]
swanctl: Keep swanctl.conf man/template section order as defined

5 years agoconf: Add a format-options --nosort option to keep order of sections as defined
Martin Willi [Tue, 29 Apr 2014 10:13:33 +0000 (12:13 +0200)]
conf: Add a format-options --nosort option to keep order of sections as defined

5 years agoswanctl: Add a swanctl command overview manpage
Martin Willi [Mon, 28 Apr 2014 14:57:22 +0000 (16:57 +0200)]
swanctl: Add a swanctl command overview manpage

5 years agoswanctl: Generate swanctl.conf(5) man page
Tobias Brunner [Thu, 17 Apr 2014 17:23:48 +0000 (19:23 +0200)]
swanctl: Generate swanctl.conf(5) man page

5 years agoswanctl: Generate man page snippet with config options
Tobias Brunner [Thu, 17 Apr 2014 17:15:10 +0000 (19:15 +0200)]
swanctl: Generate man page snippet with config options

5 years agoconf: Properly propagate whether a section is commented or not
Tobias Brunner [Thu, 17 Apr 2014 17:06:34 +0000 (19:06 +0200)]
conf: Properly propagate whether a section is commented or not

5 years agoswanctl: Convert swanctl.conf to an options file and generate config
Tobias Brunner [Thu, 17 Apr 2014 16:59:42 +0000 (18:59 +0200)]
swanctl: Convert swanctl.conf to an options file and generate config

5 years agoswanctl: Install swanctl.conf if it does not exist yet
Tobias Brunner [Thu, 17 Apr 2014 16:34:38 +0000 (18:34 +0200)]
swanctl: Install swanctl.conf if it does not exist yet

5 years agoswanctl: Change syntax of secrets to accept identities with special chars
Martin Willi [Fri, 25 Apr 2014 09:22:45 +0000 (11:22 +0200)]
swanctl: Change syntax of secrets to accept identities with special chars

Having identity strings in the settings key is problematic, as the parser can't
handle arbitrary characters in it. Further, the space separation makes it
impossible to define identities with spaces.

The new format uses key prefixes, similar to those used in local/remote auth
sections of connections. The secrets section takes subsections with type
prefixes, and each subsection uses "id" prefixes to define an arbitrary
number of identities.

5 years agoswanctl: List local and remote addresses in list-conns
Martin Willi [Wed, 16 Apr 2014 12:55:43 +0000 (14:55 +0200)]
swanctl: List local and remote addresses in list-conns

5 years agoswanctl: Add a list-pools command to summarize pool status
Martin Willi [Wed, 16 Apr 2014 10:07:14 +0000 (12:07 +0200)]
swanctl: Add a list-pools command to summarize pool status

5 years agoswanctl: Add a load-pools command to (re-)load pool configurations from file
Martin Willi [Wed, 16 Apr 2014 09:20:27 +0000 (11:20 +0200)]
swanctl: Add a load-pools command to (re-)load pool configurations from file

5 years agoswanctl: Encode connection "pools" as list items
Martin Willi [Tue, 15 Apr 2014 11:33:11 +0000 (13:33 +0200)]
swanctl: Encode connection "pools" as list items

5 years agoswanctl: Fix enumeration of registered commands if MAX_COMMANDS is hit
Martin Willi [Wed, 9 Apr 2014 11:25:13 +0000 (13:25 +0200)]
swanctl: Fix enumeration of registered commands if MAX_COMMANDS is hit

5 years agoswanctl: Implement a --log command to trace debugging log
Martin Willi [Thu, 6 Mar 2014 09:56:50 +0000 (10:56 +0100)]
swanctl: Implement a --log command to trace debugging log

5 years agoswanctl: Add a swanctl.conf template file
Martin Willi [Wed, 5 Mar 2014 11:15:24 +0000 (12:15 +0100)]
swanctl: Add a swanctl.conf template file

5 years agoswanctl: Implement a --list-certs command to print or export daemon certificates
Martin Willi [Mon, 24 Feb 2014 16:22:30 +0000 (17:22 +0100)]
swanctl: Implement a --list-certs command to print or export daemon certificates

5 years agoswanctl: Be more verbose while loading connections and credentials
Martin Willi [Mon, 24 Feb 2014 12:28:24 +0000 (13:28 +0100)]
swanctl: Be more verbose while loading connections and credentials

5 years agoswanctl: Add a list-conns command to query loaded connections
Martin Willi [Wed, 19 Feb 2014 15:48:04 +0000 (16:48 +0100)]
swanctl: Add a list-conns command to query loaded connections

5 years agoswanctl: Register --version as last command
Martin Willi [Wed, 19 Feb 2014 15:11:57 +0000 (16:11 +0100)]
swanctl: Register --version as last command

5 years agoswanctl: Support groups, certs and cacerts keywords
Martin Willi [Wed, 19 Feb 2014 14:49:21 +0000 (15:49 +0100)]
swanctl: Support groups, certs and cacerts keywords

5 years agoswanctl: Load shared secrets from the swanctl.conf secrets section
Martin Willi [Wed, 19 Feb 2014 14:08:39 +0000 (15:08 +0100)]
swanctl: Load shared secrets from the swanctl.conf secrets section

5 years agoswanctl: Load different private keys with load-creds
Martin Willi [Wed, 19 Feb 2014 13:14:15 +0000 (14:14 +0100)]
swanctl: Load different private keys with load-creds

5 years agoswanctl: Add a command to (re-)load credentials
Martin Willi [Wed, 19 Feb 2014 10:54:42 +0000 (11:54 +0100)]
swanctl: Add a command to (re-)load credentials

5 years agoswanctl: Use a ./configure-able swanctl base directory
Martin Willi [Wed, 19 Feb 2014 10:09:59 +0000 (11:09 +0100)]
swanctl: Use a ./configure-able swanctl base directory

5 years agoswanctl: After loading connections, unload those that are not in config anymore
Martin Willi [Tue, 18 Feb 2014 14:33:22 +0000 (15:33 +0100)]
swanctl: After loading connections, unload those that are not in config anymore

5 years agoswanctl: Implement a load-conn command to load connections from a file
Martin Willi [Mon, 17 Feb 2014 17:30:32 +0000 (18:30 +0100)]
swanctl: Implement a load-conn command to load connections from a file

5 years agoswanctl: Implement a list-pols command to query trap/shunt policies
Martin Willi [Thu, 13 Feb 2014 15:13:09 +0000 (16:13 +0100)]
swanctl: Implement a list-pols command to query trap/shunt policies

5 years agoswanctl: Implement install/uninstall commands to manage shunt/trap policies
Martin Willi [Thu, 13 Feb 2014 14:23:16 +0000 (15:23 +0100)]
swanctl: Implement install/uninstall commands to manage shunt/trap policies

5 years agoswanctl: Add a version command to query daemon and OS info
Martin Willi [Tue, 11 Feb 2014 16:41:56 +0000 (17:41 +0100)]
swanctl: Add a version command to query daemon and OS info

5 years agoswanctl: Add a terminate command
Martin Willi [Tue, 11 Feb 2014 16:14:51 +0000 (17:14 +0100)]
swanctl: Add a terminate command

5 years agoswanctl: Add a subcommand to initiate connections by name
Martin Willi [Mon, 10 Feb 2014 16:11:42 +0000 (17:11 +0100)]
swanctl: Add a subcommand to initiate connections by name

5 years agoswanctl: Add a list-sas command to query active IKE_SAs
Martin Willi [Wed, 29 Jan 2014 16:20:56 +0000 (17:20 +0100)]
swanctl: Add a list-sas command to query active IKE_SAs

5 years agoswanctl: Add a stub for a vici based configuration and control utility
Martin Willi [Wed, 29 Jan 2014 13:37:32 +0000 (14:37 +0100)]
swanctl: Add a stub for a vici based configuration and control utility

5 years agolibcharon: Execute scripts defined in strongswan.conf during startup/shutdown
Martin Willi [Wed, 19 Feb 2014 16:24:32 +0000 (17:24 +0100)]
libcharon: Execute scripts defined in strongswan.conf during startup/shutdown

5 years agoMerge branch 'vici'
Martin Willi [Wed, 7 May 2014 13:12:09 +0000 (15:12 +0200)]
Merge branch 'vici'

Introduces the vici plugin providing a Versatile IKE Configuration Interface
to configure, monitor and control the IKE daemon charon over a stable IPC
socket interface.

5 years agoNEWS: Add vici plugin news
Martin Willi [Wed, 7 May 2014 09:17:20 +0000 (11:17 +0200)]
NEWS: Add vici plugin news

5 years agovici: Check if header has been received before processing an empty message
Martin Willi [Wed, 7 May 2014 10:55:30 +0000 (12:55 +0200)]
vici: Check if header has been received before processing an empty message

If do_read() returns with EWOULDBLOCK, we must ensure that we actually have
processed the full length header before checking the zero-initialized buffer
length.

5 years agovici: Properly filter by CHILD_SA name while undoing start actions
Martin Willi [Tue, 6 May 2014 13:46:53 +0000 (15:46 +0200)]
vici: Properly filter by CHILD_SA name while undoing start actions

5 years agovici: Fallback to socket listening port if no explicit local port specified
Martin Willi [Tue, 6 May 2014 13:38:30 +0000 (15:38 +0200)]
vici: Fallback to socket listening port if no explicit local port specified

5 years agovici: Support a "mtu" value for the tfc_padding option
Martin Willi [Tue, 6 May 2014 13:36:14 +0000 (15:36 +0200)]
vici: Support a "mtu" value for the tfc_padding option

5 years agovici: Handle the "trap" action as an alias for "route"
Martin Willi [Tue, 6 May 2014 13:30:45 +0000 (15:30 +0200)]
vici: Handle the "trap" action as an alias for "route"

5 years agovici: Document errno values to expect from libvici API
Martin Willi [Tue, 6 May 2014 10:28:03 +0000 (12:28 +0200)]
vici: Document errno values to expect from libvici API

5 years agovici: Log owners of a just loaded shared-secret
Martin Willi [Tue, 6 May 2014 09:10:05 +0000 (11:10 +0200)]
vici: Log owners of a just loaded shared-secret

5 years agovici: Handle "xauth" as an alias for "eap" secrets
Martin Willi [Tue, 6 May 2014 08:59:55 +0000 (10:59 +0200)]
vici: Handle "xauth" as an alias for "eap" secrets

5 years agovici: Return number of matching and closed SAs in terminate command
Martin Willi [Thu, 1 May 2014 09:28:56 +0000 (11:28 +0200)]
vici: Return number of matching and closed SAs in terminate command

5 years agovici: Complete libvici doxygen comments
Martin Willi [Thu, 1 May 2014 09:07:10 +0000 (11:07 +0200)]
vici: Complete libvici doxygen comments

5 years agovici: Ensure we have no active users before mangling event client registrations
Martin Willi [Thu, 1 May 2014 08:57:38 +0000 (10:57 +0200)]
vici: Ensure we have no active users before mangling event client registrations

5 years agovici: Properly skip raise_event() for unknown event names
Martin Willi [Thu, 1 May 2014 08:26:49 +0000 (10:26 +0200)]
vici: Properly skip raise_event() for unknown event names

5 years agovici: Increase vici message length header from 16 to 32 bits
Martin Willi [Tue, 29 Apr 2014 15:08:50 +0000 (17:08 +0200)]
vici: Increase vici message length header from 16 to 32 bits

While we currently have no need for messages larger than 65KB, we should design
the protocol to be future-proof, as we plan to keep at least to lowest protocol
layer stable.

To avoid any allocation issues, we currently keep the message size limit at
512KB.

5 years agovici: Document strongswan.conf options
Martin Willi [Tue, 29 Apr 2014 14:15:01 +0000 (16:15 +0200)]
vici: Document strongswan.conf options

5 years agovici: Have an explicit "relaxed" keyword for the default revocation policy
Martin Willi [Tue, 29 Apr 2014 10:11:09 +0000 (12:11 +0200)]
vici: Have an explicit "relaxed" keyword for the default revocation policy

5 years agovici: Use a default child rekey time of 1 hour
Martin Willi [Tue, 29 Apr 2014 09:18:42 +0000 (11:18 +0200)]
vici: Use a default child rekey time of 1 hour

5 years agovici: Use a default IKE rekey time of 4 hours
Martin Willi [Tue, 29 Apr 2014 09:18:21 +0000 (11:18 +0200)]
vici: Use a default IKE rekey time of 4 hours

5 years agovici: Add low-level IPC protocol description
Martin Willi [Tue, 11 Mar 2014 17:36:22 +0000 (18:36 +0100)]
vici: Add low-level IPC protocol description

5 years agovici: Fix descending into non-matching sections during key find
Martin Willi [Wed, 16 Apr 2014 12:28:27 +0000 (14:28 +0200)]
vici: Fix descending into non-matching sections during key find

5 years agovici: Add an IKE virtual IP and attribute backend
Martin Willi [Wed, 16 Apr 2014 08:55:40 +0000 (10:55 +0200)]
vici: Add an IKE virtual IP and attribute backend

5 years agovici: Support referencing external named pools for peer configs
Martin Willi [Tue, 15 Apr 2014 11:29:06 +0000 (13:29 +0200)]
vici: Support referencing external named pools for peer configs

5 years agovici: Actually add configured virtual IPs to peer config
Martin Willi [Tue, 15 Apr 2014 11:21:11 +0000 (13:21 +0200)]
vici: Actually add configured virtual IPs to peer config

5 years agovici: Use a default rand_time of the difference between hard and soft lifetimes
Martin Willi [Tue, 15 Apr 2014 09:24:45 +0000 (11:24 +0200)]
vici: Use a default rand_time of the difference between hard and soft lifetimes

5 years agovici: Use a default hard lifetime of 110% of the soft lifetime
Martin Willi [Tue, 15 Apr 2014 08:54:47 +0000 (10:54 +0200)]
vici: Use a default hard lifetime of 110% of the soft lifetime

5 years agovici: Make unit-tests independent from libcharon and libhydra
Martin Willi [Thu, 3 Apr 2014 14:41:45 +0000 (16:41 +0200)]
vici: Make unit-tests independent from libcharon and libhydra

Fixes monolithic build, as we can't depend on the not yet built libcharon.

5 years agovici: Don't compare unsigned certificate_type_t to -1
Martin Willi [Thu, 3 Apr 2014 14:41:07 +0000 (16:41 +0200)]
vici: Don't compare unsigned certificate_type_t to -1

5 years agovici: Use non-blocking first read when receiving message during client on_read()
Martin Willi [Wed, 9 Apr 2014 12:01:45 +0000 (14:01 +0200)]
vici: Use non-blocking first read when receiving message during client on_read()

As select() and finally the watcher may signal an FD even if it does not
actually have data, we must make a non-block read to avoid hanging in the
read callback.

5 years agovici: Perform specified start_action on connection load, undo it on unload
Martin Willi [Mon, 10 Mar 2014 13:21:50 +0000 (14:21 +0100)]
vici: Perform specified start_action on connection load, undo it on unload

5 years agovici: Add a generic log event to raise events for log messages
Martin Willi [Thu, 6 Mar 2014 09:44:55 +0000 (10:44 +0100)]
vici: Add a generic log event to raise events for log messages

5 years agovici: Be less verbose about client connections
Martin Willi [Thu, 6 Mar 2014 09:27:11 +0000 (10:27 +0100)]
vici: Be less verbose about client connections

Instead, log the explicit commands at a higher level.

5 years agovici: Add a list-certs command to query different certificate types
Martin Willi [Mon, 24 Feb 2014 16:21:48 +0000 (17:21 +0100)]
vici: Add a list-certs command to query different certificate types

5 years agovici: Support pinning end entity and CA certificates to connections
Martin Willi [Wed, 19 Feb 2014 14:45:24 +0000 (15:45 +0100)]
vici: Support pinning end entity and CA certificates to connections

5 years agovici: Support missing groups option in auth config
Martin Willi [Wed, 19 Feb 2014 14:25:10 +0000 (15:25 +0100)]
vici: Support missing groups option in auth config

5 years agovici: Add a load-shared command to load shared IKE and EAP secrets
Martin Willi [Wed, 19 Feb 2014 14:08:11 +0000 (15:08 +0100)]
vici: Add a load-shared command to load shared IKE and EAP secrets

5 years agovici: Add a load-key command to load private keys
Martin Willi [Wed, 19 Feb 2014 12:08:10 +0000 (13:08 +0100)]
vici: Add a load-key command to load private keys

5 years agovici: Support loading of different certificate types
Martin Willi [Wed, 19 Feb 2014 09:51:09 +0000 (10:51 +0100)]
vici: Support loading of different certificate types

5 years agovici: Add a credential backend
Martin Willi [Wed, 19 Feb 2014 09:20:19 +0000 (10:20 +0100)]
vici: Add a credential backend

5 years agovici: Add a command listing all or specific loaded connections using events
Martin Willi [Tue, 18 Feb 2014 14:34:13 +0000 (15:34 +0100)]
vici: Add a command listing all or specific loaded connections using events

5 years agovici: Add unload-conn and get-conns commands to manage loaded connections
Martin Willi [Tue, 18 Feb 2014 14:32:43 +0000 (15:32 +0100)]
vici: Add unload-conn and get-conns commands to manage loaded connections

5 years agovici: Make dispatcher a little more verbose
Martin Willi [Tue, 18 Feb 2014 10:58:28 +0000 (11:58 +0100)]
vici: Make dispatcher a little more verbose

5 years agovici: Add backend providing in-memory connections
Martin Willi [Mon, 17 Feb 2014 17:28:53 +0000 (18:28 +0100)]
vici: Add backend providing in-memory connections

5 years agovici: Add generic callback based vici message parsing
Martin Willi [Mon, 17 Feb 2014 17:27:45 +0000 (18:27 +0100)]
vici: Add generic callback based vici message parsing

5 years agovici: Add a list-policy command to query trap and shunt policies
Martin Willi [Thu, 13 Feb 2014 15:12:21 +0000 (16:12 +0100)]
vici: Add a list-policy command to query trap and shunt policies

5 years agovici: Add install/uninstall commands to manage trap and shunt policies
Martin Willi [Thu, 13 Feb 2014 14:20:34 +0000 (15:20 +0100)]
vici: Add install/uninstall commands to manage trap and shunt policies

5 years agovici: Extract CHILD_SA config lookup method
Martin Willi [Thu, 13 Feb 2014 14:20:05 +0000 (15:20 +0100)]
vici: Extract CHILD_SA config lookup method

5 years agovici: Refactor socket to clean up locking
Martin Willi [Wed, 12 Feb 2014 16:55:38 +0000 (17:55 +0100)]
vici: Refactor socket to clean up locking

Uses separate locks for socket read and write operations. While holding the
socket reader lock, a different thread can still claim the socket write lock.
This allows to asynchronously send event messages while holding the read
lock.