strongswan.git
6 years agoReuse reqid for trap policies installed for dpd|closeaction=hold
Tobias Brunner [Sat, 29 Jun 2013 16:33:37 +0000 (18:33 +0200)]
Reuse reqid for trap policies installed for dpd|closeaction=hold

6 years agoAdded libipsec/net2net-cert scenario
Andreas Steffen [Sat, 29 Jun 2013 20:23:45 +0000 (22:23 +0200)]
Added libipsec/net2net-cert scenario

6 years agoAdd type=transport to tkm/host2host-* connections
Reto Buerki [Sat, 29 Jun 2013 12:17:32 +0000 (14:17 +0200)]
Add type=transport to tkm/host2host-* connections

Explicitly specify transport mode in connection configuration of the
responding host (sun).

6 years ago5.1.0 changes for test cases
Andreas Steffen [Fri, 28 Jun 2013 22:07:15 +0000 (00:07 +0200)]
5.1.0 changes for test cases

6 years agoprocessor: Simplified the main loop
Tobias Brunner [Fri, 28 Jun 2013 14:46:12 +0000 (16:46 +0200)]
processor: Simplified the main loop

6 years agoprocessor: Don't hold the lock while destroying jobs
Tobias Brunner [Thu, 27 Jun 2013 14:44:33 +0000 (16:44 +0200)]
processor: Don't hold the lock while destroying jobs

If a lock is held when queue_job() is called and the same lock is
required during the destruction of a job, holding the internal lock
in the processor while calling destroy() could result in a deadlock.

6 years agodhcp: Use chunk_hash_static() to calculate ID-based MAC addresses
Tobias Brunner [Fri, 28 Jun 2013 10:22:56 +0000 (12:22 +0200)]
dhcp: Use chunk_hash_static() to calculate ID-based MAC addresses

6 years agointegrity-checker: Use chunk_hash_static() to calculate checksums
Tobias Brunner [Fri, 28 Jun 2013 10:18:05 +0000 (12:18 +0200)]
integrity-checker: Use chunk_hash_static() to calculate checksums

6 years agochunk: Add predictable hash function
Tobias Brunner [Fri, 28 Jun 2013 10:12:41 +0000 (12:12 +0200)]
chunk: Add predictable hash function

Since chunk_hash() is randomized its output is not predictable, that is,
it is only within the same process.

6 years agostroke: Changed how proto/port are specified in left|rightsubnet
Tobias Brunner [Fri, 28 Jun 2013 08:29:42 +0000 (10:29 +0200)]
stroke: Changed how proto/port are specified in left|rightsubnet

Using a colon as separator conflicts with IPv6 addresses.

6 years agoplugin-loader: Removed unused path argument of load() method
Tobias Brunner [Fri, 28 Jun 2013 08:44:15 +0000 (10:44 +0200)]
plugin-loader: Removed unused path argument of load() method

Multiple additional search paths can be added with the add_path()
method.

6 years agotnc-pdp: Initialize TNC-PDP in plugin callback with proper dependencies
Tobias Brunner [Thu, 27 Jun 2013 16:01:10 +0000 (18:01 +0200)]
tnc-pdp: Initialize TNC-PDP in plugin callback with proper dependencies

6 years agoAttestation IMV requests platform info if not received
Andreas Steffen [Thu, 27 Jun 2013 15:30:14 +0000 (17:30 +0200)]
Attestation IMV requests platform info if not received

6 years agointegrity-checker: Fix checksum calculation after randomizing chunk_hash()
Tobias Brunner [Thu, 27 Jun 2013 13:34:08 +0000 (15:34 +0200)]
integrity-checker: Fix checksum calculation after randomizing chunk_hash()

6 years agounit-tests: Print loaded plugins
Tobias Brunner [Thu, 27 Jun 2013 09:27:13 +0000 (11:27 +0200)]
unit-tests: Print loaded plugins

6 years agounit-tests: RSA key generation might take longer than 4 seconds
Tobias Brunner [Thu, 27 Jun 2013 08:41:34 +0000 (10:41 +0200)]
unit-tests: RSA key generation might take longer than 4 seconds

Check uses a default timeout of 4 seconds for each test case, generating
keys of 6 different key sizes might take longer than that.

6 years agotests: Properly load plugins from build directory
Tobias Brunner [Tue, 25 Jun 2013 17:42:34 +0000 (19:42 +0200)]
tests: Properly load plugins from build directory

Calling load() incrementally does not really work as dependencies
wouldn't be resolved properly if a required feature was to be provided
by a plugin that is loaded later with a separate call to load().

6 years agoplugin-loader: Method added to provide additional search paths for plugins
Tobias Brunner [Tue, 25 Jun 2013 17:40:52 +0000 (19:40 +0200)]
plugin-loader: Method added to provide additional search paths for plugins

6 years agoSupport blacklist field in PTS database
Andreas Steffen [Wed, 26 Jun 2013 10:07:09 +0000 (12:07 +0200)]
Support blacklist field in PTS database

6 years agoUpdated PTS demo database
Andreas Steffen [Wed, 26 Jun 2013 08:14:25 +0000 (10:14 +0200)]
Updated PTS demo database

6 years agoDevice can be member of multiple groups
Andreas Steffen [Tue, 25 Jun 2013 16:42:57 +0000 (18:42 +0200)]
Device can be member of multiple groups

6 years agoAdding NEWS for 5.1.0
Tobias Brunner [Sat, 22 Jun 2013 10:11:48 +0000 (12:11 +0200)]
Adding NEWS for 5.1.0

6 years agoMerge branch 'check-caps'
Tobias Brunner [Tue, 25 Jun 2013 15:17:40 +0000 (17:17 +0200)]
Merge branch 'check-caps'

Plugins may now ensure the process has all the required capabilities.
Some minor changes to UID/GID handling are also included.

6 years agocapabilities: Return effective UID/GID if user did not configure anything
Tobias Brunner [Tue, 25 Jun 2013 13:03:51 +0000 (15:03 +0200)]
capabilities: Return effective UID/GID if user did not configure anything

6 years agocapabilities: Make the user and group charon(-nm) changes to configurable
Tobias Brunner [Tue, 5 Feb 2013 16:48:12 +0000 (17:48 +0100)]
capabilities: Make the user and group charon(-nm) changes to configurable

6 years agocapabilities: Report effective UID/GID after dropping capabilities
Tobias Brunner [Tue, 25 Jun 2013 08:41:03 +0000 (10:41 +0200)]
capabilities: Report effective UID/GID after dropping capabilities

6 years agocapabilities: CAP_CHOWN might be required by many plugins opening UNIX sockets
Tobias Brunner [Tue, 25 Jun 2013 07:03:00 +0000 (09:03 +0200)]
capabilities: CAP_CHOWN might be required by many plugins opening UNIX sockets

But as the sockets will be created with the user/group of the running
process this might not be required as no change may be needed.

6 years agocapabilities: Handle CAP_CHOWN specially as it might not be required
Tobias Brunner [Tue, 25 Jun 2013 08:39:03 +0000 (10:39 +0200)]
capabilities: Handle CAP_CHOWN specially as it might not be required

6 years agocapabilities: Check effective UID as fallback if capabilities are not supported
Tobias Brunner [Tue, 25 Jun 2013 08:09:38 +0000 (10:09 +0200)]
capabilities: Check effective UID as fallback if capabilities are not supported

6 years agokernel-netlink: Make CAP_NET_ADMIN capability optional
Tobias Brunner [Tue, 25 Jun 2013 06:49:55 +0000 (08:49 +0200)]
kernel-netlink: Make CAP_NET_ADMIN capability optional

It is not required to use the kernel-net part of the plugin.

6 years agofarp: Require CAP_NET_RAW capability to open AF_PACKET socket
Tobias Brunner [Tue, 25 Jun 2013 06:37:01 +0000 (08:37 +0200)]
farp: Require CAP_NET_RAW capability to open AF_PACKET socket

6 years agodhcp: Require CAP_NET_BIND_SERVICE and CAP_NET_RAW to open/bind sockets
Tobias Brunner [Tue, 25 Jun 2013 06:35:06 +0000 (08:35 +0200)]
dhcp: Require CAP_NET_BIND_SERVICE and CAP_NET_RAW to open/bind sockets

6 years agosocket-default: Require CAP_NET_BIND_SERVICE for ports < 1024
Tobias Brunner [Tue, 25 Jun 2013 06:23:35 +0000 (08:23 +0200)]
socket-default: Require CAP_NET_BIND_SERVICE for ports < 1024

Since we don't know which ports are used with socket-dynamic we can't
demand the capability there, but it might still be required.

6 years agocapabilities: Only plugins that require CAP_NET_ADMIN demand it
Tobias Brunner [Mon, 24 Jun 2013 16:22:31 +0000 (18:22 +0200)]
capabilities: Only plugins that require CAP_NET_ADMIN demand it

The daemon as such does not require this capability.

6 years agocapabilities: Move global capabilities_t instance to libstrongswan
Tobias Brunner [Tue, 25 Jun 2013 05:25:18 +0000 (07:25 +0200)]
capabilities: Move global capabilities_t instance to libstrongswan

6 years agocapabilities: Ensure required capabilities are actually held by the process/user
Tobias Brunner [Wed, 8 May 2013 15:14:29 +0000 (17:14 +0200)]
capabilities: Ensure required capabilities are actually held by the process/user

6 years agoikev2: keep the CHILD_SA we delete as initiator in the list to destroy
Martin Willi [Tue, 25 Jun 2013 12:03:51 +0000 (14:03 +0200)]
ikev2: keep the CHILD_SA we delete as initiator in the list to destroy

If the responder not correctly send the correct protocol or SPI in the delete
response, we should remove the CHILD_SA regardless.

6 years agoSome IMV policy managers expect a TEXT string
Andreas Steffen [Tue, 25 Jun 2013 10:47:07 +0000 (12:47 +0200)]
Some IMV policy managers expect a TEXT string

6 years agoAssign default group to newly created devices
Andreas Steffen [Tue, 25 Jun 2013 09:49:32 +0000 (11:49 +0200)]
Assign default group to newly created devices

6 years agoSet device creation date if it hasn't been set yet
Andreas Steffen [Mon, 24 Jun 2013 18:18:16 +0000 (20:18 +0200)]
Set device creation date if it hasn't been set yet

6 years agounit-tester: RSA test was removed
Tobias Brunner [Mon, 24 Jun 2013 14:01:23 +0000 (16:01 +0200)]
unit-tester: RSA test was removed

6 years agoAligned AR Identity types to IF-IMV 1.4 R5 draft
Andreas Steffen [Sun, 23 Jun 2013 22:23:50 +0000 (00:23 +0200)]
Aligned AR Identity types to IF-IMV 1.4 R5 draft

6 years agoSend PA-TNC assessment result even if no workitems are available
Andreas Steffen [Sun, 23 Jun 2013 22:22:38 +0000 (00:22 +0200)]
Send PA-TNC assessment result even if no workitems are available

6 years agoSome pacman fixes
Andreas Steffen [Sun, 23 Jun 2013 14:23:19 +0000 (16:23 +0200)]
Some pacman fixes

6 years agoversion bump to 5.1.0dr1
Andreas Steffen [Fri, 21 Jun 2013 21:54:13 +0000 (23:54 +0200)]
version bump to 5.1.0dr1

6 years agoSome PTS database fixes
Andreas Steffen [Fri, 21 Jun 2013 21:24:40 +0000 (23:24 +0200)]
Some PTS database fixes

6 years agoImplemented pacman in a more reliable way
Andreas Steffen [Fri, 21 Jun 2013 12:15:18 +0000 (14:15 +0200)]
Implemented pacman in a more reliable way

6 years agoDefine protocol string
Andreas Steffen [Wed, 19 Jun 2013 07:42:21 +0000 (09:42 +0200)]
Define protocol string

6 years agoGenerate result string for port scan workitems
Andreas Steffen [Wed, 19 Jun 2013 07:30:31 +0000 (09:30 +0200)]
Generate result string for port scan workitems

6 years agoIgnore non-matching protocols
Andreas Steffen [Tue, 18 Jun 2013 19:35:15 +0000 (21:35 +0200)]
Ignore non-matching protocols

6 years agoIntroduced workitems to Scanner IMV
Andreas Steffen [Tue, 18 Jun 2013 17:13:21 +0000 (19:13 +0200)]
Introduced workitems to Scanner IMV

6 years agoRemoved obsoleted strongswan.conf options
Andreas Steffen [Tue, 18 Jun 2013 16:59:31 +0000 (18:59 +0200)]
Removed obsoleted strongswan.conf options

6 years agoAdded ITA components to database
Andreas Steffen [Mon, 17 Jun 2013 09:47:39 +0000 (11:47 +0200)]
Added ITA components to database

6 years agoAdded soft dependency on database plugin
Andreas Steffen [Thu, 13 Jun 2013 12:18:15 +0000 (14:18 +0200)]
Added soft dependency on database plugin

6 years agofixed SQL query
Andreas Steffen [Thu, 13 Jun 2013 12:17:47 +0000 (14:17 +0200)]
fixed SQL query

6 years agoShortened names of default policy groups
Andreas Steffen [Wed, 12 Jun 2013 17:05:34 +0000 (19:05 +0200)]
Shortened names of default policy groups

6 years agoStore device with product ID
Andreas Steffen [Tue, 11 Jun 2013 20:15:27 +0000 (22:15 +0200)]
Store device with product ID

6 years agoDatabase changes needed to integrate Cygnet backend
Andreas Steffen [Tue, 11 Jun 2013 19:03:08 +0000 (21:03 +0200)]
Database changes needed to integrate Cygnet backend

6 years agoImplemented get|set_action_flag() methods
Andreas Steffen [Tue, 11 Jun 2013 19:01:57 +0000 (21:01 +0200)]
Implemented get|set_action_flag() methods

6 years agoImplemented hierarchical policy groups
Andreas Steffen [Mon, 10 Jun 2013 20:56:49 +0000 (22:56 +0200)]
Implemented hierarchical policy groups

6 years agoIntroduced workitems to Attestation IMV
Andreas Steffen [Mon, 10 Jun 2013 11:29:07 +0000 (13:29 +0200)]
Introduced workitems to Attestation IMV

6 years agopts_meas_algo_probe() and pts_dh_group_probe() got lost
Andreas Steffen [Thu, 30 May 2013 18:04:34 +0000 (20:04 +0200)]
pts_meas_algo_probe() and pts_dh_group_probe() got lost

6 years agoConverted all IMVs to use generic IF-IMV API
Andreas Steffen [Thu, 30 May 2013 16:02:00 +0000 (18:02 +0200)]
Converted all IMVs to use generic IF-IMV API

6 years agoRemove the constructor from the IMV agent interface
Andreas Steffen [Wed, 29 May 2013 22:08:38 +0000 (00:08 +0200)]
Remove the constructor from the IMV agent interface

6 years agoDefined a generic IMV agent interface
Andreas Steffen [Wed, 29 May 2013 22:06:12 +0000 (00:06 +0200)]
Defined a generic IMV agent interface

6 years agoMoved all functionality into imv_os_agent_t class turning imv_os_t into an IF-IMV...
Andreas Steffen [Wed, 29 May 2013 21:21:04 +0000 (23:21 +0200)]
Moved all functionality into imv_os_agent_t class turning imv_os_t into an IF-IMV skeleton

6 years agoMoved batch_ending into separate source file
Andreas Steffen [Mon, 27 May 2013 05:41:58 +0000 (07:41 +0200)]
Moved batch_ending into separate source file

6 years agodo not process workitems with NULL result
Andreas Steffen [Fri, 24 May 2013 14:56:42 +0000 (16:56 +0200)]
do not process workitems with NULL result

6 years agofixed enumeration of workitems for a given session
Andreas Steffen [Fri, 24 May 2013 10:51:56 +0000 (12:51 +0200)]
fixed enumeration of workitems for a given session

6 years agogenerate workitems based on group policy
Andreas Steffen [Thu, 23 May 2013 20:12:10 +0000 (22:12 +0200)]
generate workitems based on group policy

6 years agoAdded file and directory reference measurements to workitems
Andreas Steffen [Thu, 23 May 2013 13:30:55 +0000 (15:30 +0200)]
Added file and directory reference measurements to workitems

6 years agoadd overall recommendation to session database entry
Andreas Steffen [Sun, 19 May 2013 10:43:55 +0000 (12:43 +0200)]
add overall recommendation to session database entry

6 years agodon't define a default database URI
Andreas Steffen [Fri, 17 May 2013 20:32:04 +0000 (22:32 +0200)]
don't define a default database URI

6 years agocreated a simple IMV Policy Manager
Andreas Steffen [Fri, 17 May 2013 19:38:54 +0000 (21:38 +0200)]
created a simple IMV Policy Manager

6 years agoregister received scanner attributes
Andreas Steffen [Fri, 17 May 2013 19:38:21 +0000 (21:38 +0200)]
register received scanner attributes

6 years agoused tnc_policy_update functions for default policy
Andreas Steffen [Fri, 17 May 2013 19:36:11 +0000 (21:36 +0200)]
used tnc_policy_update functions for default policy

6 years agorefactored IMV policy management
Andreas Steffen [Thu, 16 May 2013 21:07:24 +0000 (23:07 +0200)]
refactored IMV policy management

6 years agoimplemented policy rules for OS IMV
Andreas Steffen [Mon, 13 May 2013 22:21:56 +0000 (00:21 +0200)]
implemented policy rules for OS IMV

6 years agocheck for zero-length device ID
Andreas Steffen [Sun, 5 May 2013 08:13:13 +0000 (10:13 +0200)]
check for zero-length device ID

6 years agoITA-HSR/Device ID attribute & IMV OS state machine
Andreas Steffen [Sat, 4 May 2013 19:06:36 +0000 (21:06 +0200)]
ITA-HSR/Device ID attribute & IMV OS state machine

6 years agoexecute an _imv_policy script
Andreas Steffen [Thu, 2 May 2013 20:15:12 +0000 (22:15 +0200)]
execute an _imv_policy script

6 years agoimplemented IMV session control
Andreas Steffen [Sun, 28 Apr 2013 20:47:09 +0000 (22:47 +0200)]
implemented IMV session control

6 years agoManage files and directories
Andreas Steffen [Mon, 22 Apr 2013 22:06:34 +0000 (00:06 +0200)]
Manage files and directories

6 years agoMerge branch 'kernel-libipsec'
Tobias Brunner [Fri, 21 Jun 2013 15:03:35 +0000 (17:03 +0200)]
Merge branch 'kernel-libipsec'

Adds a new kernel interface plugin that uses TUN devices and libipsec to
provide IPsec process in userland.

It works on Linux, FreeBSD and Mac OS X.  In particular the latter two
platforms may gain from this approach as their respective kernels don't
provide support for AES-GCM.

kernel-pfroute has been improved (source address lookup) and a second
plugin (osx-attr) installs configuration attributes (currently DNS
servers only) via SystemConfiguration on Mac OS X.

6 years agoosx-attr: add plugin installing config attributes using SystemConfiguration
Martin Willi [Wed, 15 May 2013 13:56:17 +0000 (15:56 +0200)]
osx-attr: add plugin installing config attributes using SystemConfiguration

Currently installs DNS servers only, by prepending IP addresses to the
DNS configuration of the primary networking service.

6 years agokernel-pfroute: Simplify route lookup after fixing sockaddr parsing
Tobias Brunner [Tue, 18 Jun 2013 16:06:46 +0000 (18:06 +0200)]
kernel-pfroute: Simplify route lookup after fixing sockaddr parsing

6 years agokernel-pfroute: Alignment of sockaddrs is not always the same
Tobias Brunner [Tue, 18 Jun 2013 15:50:51 +0000 (17:50 +0200)]
kernel-pfroute: Alignment of sockaddrs is not always the same

6 years agokernel-pfroute: struct sockaddr arguments are 4 byte aligned
Tobias Brunner [Tue, 18 Jun 2013 14:55:03 +0000 (16:55 +0200)]
kernel-pfroute: struct sockaddr arguments are 4 byte aligned

This was noticed on Mac OS X where, if the default route is returned,
RTA_NETMASK has sa_len set to 0, but skipping zero bytes to read the
next address makes no sense, of course.  Using 0 for sa_len seems
a bit strange, in particular, because struct sockaddr has by definition
a minimum length of 16 bytes.  But it seems FreeBSD actually does the
same.

6 years agokernel-libipsec: Ignore failures when installing routes for multicast or broadcast...
Tobias Brunner [Mon, 17 Jun 2013 19:51:23 +0000 (21:51 +0200)]
kernel-libipsec: Ignore failures when installing routes for multicast or broadcast policies

6 years agokernel-pfroute: Improve route lookup depending on information we get back
Tobias Brunner [Mon, 17 Jun 2013 13:56:44 +0000 (15:56 +0200)]
kernel-pfroute: Improve route lookup depending on information we get back

Kernels don't provide the same information for all routes.

6 years agokernel-pfroute: Try to ensure we get a source address or interface name
Tobias Brunner [Mon, 17 Jun 2013 13:38:35 +0000 (15:38 +0200)]
kernel-pfroute: Try to ensure we get a source address or interface name

6 years agoike: Force NAT-T/UDP encapsulation if kernel interface requires it
Tobias Brunner [Mon, 17 Jun 2013 08:23:04 +0000 (10:23 +0200)]
ike: Force NAT-T/UDP encapsulation if kernel interface requires it

6 years agokernel-libipsec: Add a feature to request UDP encapsulation of ESP packets
Tobias Brunner [Mon, 17 Jun 2013 08:13:56 +0000 (10:13 +0200)]
kernel-libipsec: Add a feature to request UDP encapsulation of ESP packets

6 years agotun-device: Packets sent over utun devices on Mac OS X have the protocol family prepended
Tobias Brunner [Sun, 16 Jun 2013 18:05:08 +0000 (20:05 +0200)]
tun-device: Packets sent over utun devices on Mac OS X have the protocol family prepended

6 years agokernel-pfroute: Use DST as nexthop for host routes
Tobias Brunner [Sun, 16 Jun 2013 16:59:13 +0000 (18:59 +0200)]
kernel-pfroute: Use DST as nexthop for host routes

These are created as cache/clone on Mac OS X.

6 years agokernel-pfroute: Implement get_source_addr()
Tobias Brunner [Sun, 16 Jun 2013 09:40:16 +0000 (11:40 +0200)]
kernel-pfroute: Implement get_source_addr()

6 years agokernel-pfroute: Properly install routes with interface and gateway
Tobias Brunner [Sun, 16 Jun 2013 08:49:25 +0000 (10:49 +0200)]
kernel-pfroute: Properly install routes with interface and gateway

6 years agokernel-libipsec: Install a gateway for routes on platforms other than Linux
Tobias Brunner [Sun, 16 Jun 2013 08:47:39 +0000 (10:47 +0200)]
kernel-libipsec: Install a gateway for routes on platforms other than Linux

This seems required e.g. on FreeBSD but doesn't work on Linux.

6 years agokernel-pfroute: Activate TUN device before setting address
Tobias Brunner [Sat, 15 Jun 2013 16:56:11 +0000 (18:56 +0200)]
kernel-pfroute: Activate TUN device before setting address

On FreeBSD, for some reason, we don't learn the interface is up
otherwise.  Even though ifconfig lists it as up at the same time.

6 years agotun-device: Avoid opening /dev/tunX multiple times (e.g. on FreeBSD)
Tobias Brunner [Sat, 15 Jun 2013 15:46:25 +0000 (17:46 +0200)]
tun-device: Avoid opening /dev/tunX multiple times (e.g. on FreeBSD)