strongswan.git
15 years agomoved interface enumeration code to socket, where it belongs
Martin Willi [Mon, 28 Aug 2006 08:45:22 +0000 (08:45 -0000)]
moved interface enumeration code to socket, where it belongs
query interfaces every time we need it to respect changes in network config
added address listing on startup and "ipsec statusall"

15 years agoversion bump of UML kernel to 2.6.17.11
Andreas Steffen [Fri, 25 Aug 2006 09:25:12 +0000 (09:25 -0000)]
version bump of UML kernel to 2.6.17.11

15 years agofixed crash bug when doing "ipsec down" with an unknown connection
Martin Willi [Fri, 25 Aug 2006 09:19:42 +0000 (09:19 -0000)]
fixed crash bug when doing "ipsec down" with an unknown connection

15 years agoadded name property in CHILD_SA, allows proper status output
Martin Willi [Fri, 25 Aug 2006 09:07:37 +0000 (09:07 -0000)]
added name property in CHILD_SA, allows proper status output

15 years ago(no commit message)
Martin Willi [Fri, 25 Aug 2006 07:42:48 +0000 (07:42 -0000)]

15 years agofixed bug which prevented port float when nat is detected
Martin Willi [Fri, 25 Aug 2006 07:37:22 +0000 (07:37 -0000)]
fixed bug which prevented port float when nat is detected

15 years agoversion bumps
Andreas Steffen [Fri, 25 Aug 2006 07:30:29 +0000 (07:30 -0000)]
version bumps

15 years ago'sha' and 'sha1' are now treated as synonyms
Andreas Steffen [Wed, 23 Aug 2006 12:07:15 +0000 (12:07 -0000)]
'sha' and 'sha1' are now treated as synonyms

15 years ago'sha' and 'sha1' are now treated as synonyms
Andreas Steffen [Wed, 23 Aug 2006 12:07:07 +0000 (12:07 -0000)]
'sha' and 'sha1' are now treated as synonyms

15 years agoupdated Changelog and other docs
Martin Willi [Wed, 23 Aug 2006 11:48:33 +0000 (11:48 -0000)]
updated Changelog and other docs

15 years agofixed rekeying behavior when proposing an inacceptable DH group (INVALID_KE_PAYLOAD) 4.0.3
Martin Willi [Wed, 23 Aug 2006 09:25:41 +0000 (09:25 -0000)]
fixed rekeying behavior when proposing an inacceptable DH group (INVALID_KE_PAYLOAD)

15 years agoimplement proper handling of most simultaneous IKE_SA rekeying cases
Martin Willi [Wed, 23 Aug 2006 07:30:43 +0000 (07:30 -0000)]
implement proper handling of most simultaneous IKE_SA rekeying cases

15 years agoversion bump to 4.0.3
Andreas Steffen [Wed, 2 Aug 2006 12:33:26 +0000 (12:33 -0000)]
version bump to 4.0.3

15 years agoimplemented proper refcounting using atomic operations
Martin Willi [Fri, 28 Jul 2006 09:45:18 +0000 (09:45 -0000)]
implemented proper refcounting using atomic operations

15 years agoimplemented IKE_SA rekeying
Martin Willi [Thu, 27 Jul 2006 12:18:40 +0000 (12:18 -0000)]
implemented IKE_SA rekeying
uses ikelifetime, rekeymargin and rekeyfuzz config settings
no handling of simultaneus exchanges yet!

15 years agoadded possibility to route CHILD_SAs, without to set them up
Martin Willi [Fri, 21 Jul 2006 13:31:53 +0000 (13:31 -0000)]
added possibility to route CHILD_SAs, without to set them up
support for auto=route parameter
support for ipsec route and ipsec unroute
initiating of CHILD and/or IKE_SAs based on kernel acquires

15 years agoreuse an existing IKE_SA to set up additional CHILD_SAs
Martin Willi [Thu, 20 Jul 2006 14:57:49 +0000 (14:57 -0000)]
reuse an existing IKE_SA to set up additional CHILD_SAs

15 years agointroduced refcounting on policy and connections
Martin Willi [Thu, 20 Jul 2006 10:09:32 +0000 (10:09 -0000)]
introduced refcounting on policy and connections
aren't stored in the IKE_SA anymore, they are queried on the fly
are immutable now, allows it to share them
policy selection based on traffic selectors, leads to valid lookup results
rekeying queries the policy based on its traffic selectors

15 years agocleanups in kernel interface code
Martin Willi [Tue, 18 Jul 2006 12:53:54 +0000 (12:53 -0000)]
cleanups in kernel interface code
added proper traffic selector to string conversion
some cleanups here & there

15 years agoX.509 certificate trust path verification 4.0.2
Andreas Steffen [Fri, 14 Jul 2006 13:21:19 +0000 (13:21 -0000)]
X.509 certificate trust path verification

15 years agoadded
Andreas Steffen [Fri, 14 Jul 2006 12:58:47 +0000 (12:58 -0000)]
added

15 years agofixed UDP decapsulation by adding inbound bypass policy for send socket
Martin Willi [Fri, 14 Jul 2006 12:53:06 +0000 (12:53 -0000)]
fixed UDP decapsulation by adding inbound bypass policy for send socket

15 years agoupdated mixed tests to new charon output
Martin Willi [Fri, 14 Jul 2006 12:29:26 +0000 (12:29 -0000)]
updated mixed tests to new charon output

15 years agocorrected DPD entry
Andreas Steffen [Fri, 14 Jul 2006 11:51:45 +0000 (11:51 -0000)]
corrected DPD entry

15 years agoreenabled module tests for charon
Martin Willi [Fri, 14 Jul 2006 11:16:49 +0000 (11:16 -0000)]
reenabled module tests for charon

15 years agofixed bug which erroneously detected KE payload when rekeying
Martin Willi [Fri, 14 Jul 2006 08:18:48 +0000 (08:18 -0000)]
fixed bug which erroneously detected KE payload when rekeying

15 years agoadded IPsec bypass policy to receiving socket, allows incoming IKE traffic on host2ho...
Martin Willi [Fri, 14 Jul 2006 08:08:55 +0000 (08:08 -0000)]
added IPsec bypass policy to receiving socket, allows incoming IKE traffic on host2host tunnels when using NAT

15 years agoimproved logging on verify errors for some payloads
Martin Willi [Thu, 13 Jul 2006 12:49:35 +0000 (12:49 -0000)]
improved logging on verify errors for some payloads
enforcing IKE_SA shutdown, even when transactions are outstanding
proper reject of CREATE_CHILD_SA message with KE payload

15 years agoadded test cases from NAT team
Martin Willi [Thu, 13 Jul 2006 12:45:18 +0000 (12:45 -0000)]
added test cases from NAT team
updated all IKEv2 tests to work with new status output

15 years agoadded tcpdumpcount function from NATT guys
Martin Willi [Thu, 13 Jul 2006 12:43:52 +0000 (12:43 -0000)]
added tcpdumpcount function from NATT guys
added possibility to mount the strongswan tree into all UMLs
added script for installing from shared tree in all UMLs
added script to shut down all UMLs properly

15 years agoremoved in favour of tests from NAT team
Martin Willi [Thu, 13 Jul 2006 12:00:36 +0000 (12:00 -0000)]
removed in favour of tests from NAT team

15 years agofixed CREATE_CHILD_SA transaction dispatching
Martin Willi [Thu, 13 Jul 2006 08:51:24 +0000 (08:51 -0000)]
fixed CREATE_CHILD_SA transaction dispatching

15 years agoadded CHILD_SA states, which allows us to detect further simultaneous transactions
Martin Willi [Thu, 13 Jul 2006 08:26:54 +0000 (08:26 -0000)]
added CHILD_SA states, which allows us to detect further simultaneous transactions
reimplemented the buggy message id handling

15 years agoupdated some inline docs
Martin Willi [Wed, 12 Jul 2006 14:08:52 +0000 (14:08 -0000)]
updated some inline docs

15 years agofixed crypter/signer in/out to conform with standard
Martin Willi [Wed, 12 Jul 2006 14:08:13 +0000 (14:08 -0000)]
fixed crypter/signer in/out to conform with standard

15 years agofixed payload order
Martin Willi [Wed, 12 Jul 2006 14:07:30 +0000 (14:07 -0000)]
fixed payload order

15 years agoadded message id logging
Martin Willi [Wed, 12 Jul 2006 14:06:25 +0000 (14:06 -0000)]
added message id logging

15 years agoadded all currently known notify payload types
Martin Willi [Wed, 12 Jul 2006 14:05:57 +0000 (14:05 -0000)]
added all currently known notify payload types

15 years agoadded policy cache to kernel interface
Martin Willi [Wed, 12 Jul 2006 11:42:36 +0000 (11:42 -0000)]
added policy cache to kernel interface
allows refcounting of multiple installed policies
finally brings us stable simultaneous rekeying

15 years agoleak detective blanks memory on free & alloc, allows further membug detection
Martin Willi [Wed, 12 Jul 2006 11:15:31 +0000 (11:15 -0000)]
leak detective blanks memory on free & alloc, allows further membug detection

15 years agocode cleanups
Martin Willi [Wed, 12 Jul 2006 11:13:48 +0000 (11:13 -0000)]
code cleanups

15 years agoidentification_t.matches() supports multiple wildcard counts
Andreas Steffen [Tue, 11 Jul 2006 06:12:45 +0000 (06:12 -0000)]
identification_t.matches() supports multiple wildcard counts

15 years agoidentification_t.matches() supports multiple wildcard counts
Andreas Steffen [Tue, 11 Jul 2006 06:11:59 +0000 (06:11 -0000)]
identification_t.matches() supports multiple wildcard counts

15 years agofurther work done for simultaneous rekeying/delete
Martin Willi [Mon, 10 Jul 2006 14:24:04 +0000 (14:24 -0000)]
further work done for simultaneous rekeying/delete
still some cases which cause trouble

15 years agofixed compiler warnings in parser when using -O2
Martin Willi [Fri, 7 Jul 2006 12:48:27 +0000 (12:48 -0000)]
fixed compiler warnings in parser when using -O2

15 years agoreenabled check_expiry
Martin Willi [Fri, 7 Jul 2006 12:25:25 +0000 (12:25 -0000)]
reenabled check_expiry

15 years agoupdated copyright information
Martin Willi [Fri, 7 Jul 2006 08:49:06 +0000 (08:49 -0000)]
updated copyright information

15 years agoreimplemented CHILD_SA rekeying & delete
Martin Willi [Fri, 7 Jul 2006 07:04:07 +0000 (07:04 -0000)]
reimplemented CHILD_SA rekeying & delete
no simultanous transaction with CHILD_SAs yet!

15 years agoremoved NAT_TRAVERSAL and VIRTUAL_IP compile options
Andreas Steffen [Fri, 7 Jul 2006 05:51:54 +0000 (05:51 -0000)]
removed NAT_TRAVERSAL and VIRTUAL_IP compile options

15 years agoremoved NAT_TRAVERSAL compile option
Andreas Steffen [Fri, 7 Jul 2006 05:51:20 +0000 (05:51 -0000)]
removed NAT_TRAVERSAL compile option

15 years agoremoved NAT_TRAVERSAL and VIRTUAL_IP compile options
Andreas Steffen [Fri, 7 Jul 2006 05:50:02 +0000 (05:50 -0000)]
removed NAT_TRAVERSAL and VIRTUAL_IP compile options

15 years agoadded
Andreas Steffen [Fri, 7 Jul 2006 05:44:45 +0000 (05:44 -0000)]
added

15 years agoupdated NEWS
Martin Willi [Wed, 5 Jul 2006 14:13:45 +0000 (14:13 -0000)]
updated NEWS

15 years agoadded support for leftprotoport and rightprotoport
Martin Willi [Wed, 5 Jul 2006 13:13:07 +0000 (13:13 -0000)]
added support for leftprotoport and rightprotoport

15 years agoimproved CHILD_SA output for "ipsec statusall"
Martin Willi [Wed, 5 Jul 2006 13:11:55 +0000 (13:11 -0000)]
improved CHILD_SA output for "ipsec statusall"

15 years agoupdated whitelist (getprotobynumber)
Martin Willi [Wed, 5 Jul 2006 13:10:47 +0000 (13:10 -0000)]
updated whitelist (getprotobynumber)

15 years agoredesigned IKE_SA using a transaction mechanism:
Martin Willi [Wed, 5 Jul 2006 10:53:20 +0000 (10:53 -0000)]
redesigned IKE_SA using a transaction mechanism:
  removed old state machine
  reimplemented IKE_SA setup and delete
  implemented dead peer detection
  implemented keep-alives
  a lot of fixes
  no rekeying yet

15 years agofixed compiler warnings
Martin Willi [Wed, 5 Jul 2006 10:09:42 +0000 (10:09 -0000)]
fixed compiler warnings

15 years agomade thread ids unsigned again, to avoid negative thread ids on some systems
Martin Willi [Tue, 4 Jul 2006 13:30:49 +0000 (13:30 -0000)]
made thread ids unsigned again, to avoid negative thread ids on some systems

15 years agofixed memleak when initiating a connection already up
Martin Willi [Tue, 4 Jul 2006 13:29:16 +0000 (13:29 -0000)]
fixed memleak when initiating a connection already up

15 years agoupdated leak detective whitelist
Martin Willi [Tue, 4 Jul 2006 13:26:20 +0000 (13:26 -0000)]
updated leak detective whitelist

15 years agoapplied latest NATT patch with some fixes and cleanups
Martin Willi [Tue, 4 Jul 2006 13:25:00 +0000 (13:25 -0000)]
applied latest NATT patch with some fixes and cleanups

15 years agotest currently without firewall
Andreas Steffen [Tue, 4 Jul 2006 06:54:53 +0000 (06:54 -0000)]
test currently without firewall

15 years agoadded
Andreas Steffen [Tue, 4 Jul 2006 06:51:58 +0000 (06:51 -0000)]
added

15 years agoadded
Andreas Steffen [Tue, 4 Jul 2006 06:13:54 +0000 (06:13 -0000)]
added

15 years agoadded
Andreas Steffen [Tue, 4 Jul 2006 06:13:33 +0000 (06:13 -0000)]
added

15 years agoremoved
Andreas Steffen [Tue, 4 Jul 2006 06:13:07 +0000 (06:13 -0000)]
removed

15 years agoremoved version information from ipsec.conf
Andreas Steffen [Tue, 4 Jul 2006 06:12:10 +0000 (06:12 -0000)]
removed version information from ipsec.conf

15 years agolog entries start with lowcercase character
Andreas Steffen [Tue, 4 Jul 2006 06:11:35 +0000 (06:11 -0000)]
log entries start with lowcercase character

15 years agorestored lost IKEv2 packet suppression
Andreas Steffen [Mon, 3 Jul 2006 14:39:57 +0000 (14:39 -0000)]
restored lost IKEv2 packet suppression

15 years agoadded USE_LEAK_DETECTIVE option
Andreas Steffen [Mon, 3 Jul 2006 08:36:47 +0000 (08:36 -0000)]
added USE_LEAK_DETECTIVE option

15 years agofixed natd_hash memory leak
Andreas Steffen [Mon, 3 Jul 2006 08:34:34 +0000 (08:34 -0000)]
fixed natd_hash memory leak

15 years agotests with subdirectory structure
Andreas Steffen [Mon, 3 Jul 2006 07:11:30 +0000 (07:11 -0000)]
tests with subdirectory structure

15 years agoremoved tests
Andreas Steffen [Mon, 3 Jul 2006 07:10:25 +0000 (07:10 -0000)]
removed tests

15 years agointroduced subdirectory structure
Andreas Steffen [Mon, 3 Jul 2006 07:10:17 +0000 (07:10 -0000)]
introduced subdirectory structure

15 years agosupport of cert payloads
Andreas Steffen [Mon, 3 Jul 2006 06:27:45 +0000 (06:27 -0000)]
support of cert payloads

15 years agolowercase log entries
Andreas Steffen [Mon, 3 Jul 2006 06:26:06 +0000 (06:26 -0000)]
lowercase log entries

15 years agodistributed by ITA
Andreas Steffen [Mon, 3 Jul 2006 06:24:54 +0000 (06:24 -0000)]
distributed by ITA

15 years agoadded support of updown parameter
Andreas Steffen [Mon, 3 Jul 2006 06:22:43 +0000 (06:22 -0000)]
added support of updown parameter

15 years agogeneration of default key
Andreas Steffen [Mon, 3 Jul 2006 06:21:56 +0000 (06:21 -0000)]
generation of default key

15 years agocosmetics
Andreas Steffen [Mon, 3 Jul 2006 06:21:40 +0000 (06:21 -0000)]
cosmetics

15 years agoadded support of updown parameter
Andreas Steffen [Mon, 3 Jul 2006 06:21:14 +0000 (06:21 -0000)]
added support of updown parameter

15 years agoversion bump to 4.0.2
Andreas Steffen [Wed, 28 Jun 2006 11:09:14 +0000 (11:09 -0000)]
version bump to 4.0.2

15 years agoadded X.509 trust chain verification
Andreas Steffen [Tue, 27 Jun 2006 08:48:28 +0000 (08:48 -0000)]
added X.509 trust chain verification

15 years agoversion bump to 4.0.2
Andreas Steffen [Tue, 27 Jun 2006 08:47:03 +0000 (08:47 -0000)]
version bump to 4.0.2

15 years agoESP packet size changed
Andreas Steffen [Tue, 27 Jun 2006 07:08:37 +0000 (07:08 -0000)]
ESP packet size changed

15 years agofixed bad_proposal_syntax bug
Andreas Steffen [Tue, 27 Jun 2006 07:07:44 +0000 (07:07 -0000)]
fixed bad_proposal_syntax bug

15 years agoapplied new changes from NATT team
Martin Willi [Fri, 23 Jun 2006 14:02:30 +0000 (14:02 -0000)]
applied new changes from NATT team
DPD only done when no IPsec and IKE traffic processed
minor changes here and there

15 years agosome message code cleanups
Martin Willi [Fri, 23 Jun 2006 14:00:15 +0000 (14:00 -0000)]
some message code cleanups

15 years agofixed identification_t clone to apply function pointers
Martin Willi [Fri, 23 Jun 2006 13:20:17 +0000 (13:20 -0000)]
fixed identification_t clone to apply function pointers

15 years agocleaner error handling on UDP encapsultion sockopt failure
Martin Willi [Thu, 22 Jun 2006 13:05:15 +0000 (13:05 -0000)]
cleaner error handling on UDP encapsultion sockopt failure

15 years agoadded mysterious UDP encapsulation socket option to get encapsulation working
Martin Willi [Thu, 22 Jun 2006 12:57:49 +0000 (12:57 -0000)]
added mysterious UDP encapsulation socket option to get encapsulation working

15 years agofixed BAD_PROPOSAL_SYNTAX vulnerability
Andreas Steffen [Thu, 22 Jun 2006 12:16:12 +0000 (12:16 -0000)]
fixed BAD_PROPOSAL_SYNTAX vulnerability

15 years agofirst merge of NATT code
Martin Willi [Thu, 22 Jun 2006 06:36:28 +0000 (06:36 -0000)]
first merge of NATT code

15 years agofixed testing build 4.0.1
Martin Willi [Wed, 21 Jun 2006 12:58:02 +0000 (12:58 -0000)]
fixed testing build

15 years agoupdated for 4.0.1 release
Martin Willi [Wed, 21 Jun 2006 12:14:40 +0000 (12:14 -0000)]
updated for 4.0.1 release

15 years agoupdated news for 4.0.1 release
Martin Willi [Wed, 21 Jun 2006 12:11:29 +0000 (12:11 -0000)]
updated news for 4.0.1 release

15 years agofixed whitelist detection
Martin Willi [Tue, 20 Jun 2006 11:03:47 +0000 (11:03 -0000)]
fixed whitelist detection

15 years agoreworked function ignore mechanism to not-report whitelist
Martin Willi [Tue, 20 Jun 2006 10:05:56 +0000 (10:05 -0000)]
reworked function ignore mechanism to not-report whitelist
  rather than overriding functions

15 years agofixed execv call args to work when using strictcrl and syslog
Martin Willi [Tue, 20 Jun 2006 10:04:35 +0000 (10:04 -0000)]
fixed execv call args to work when using strictcrl and syslog