strongswan.git
7 years agoAdd ike_reestablish() event that is triggered when an IKE_SA is reestablished
Tobias Brunner [Wed, 5 Sep 2012 09:34:50 +0000 (11:34 +0200)]
Add ike_reestablish() event that is triggered when an IKE_SA is reestablished

This is particularly useful during reauthentication to get the new
IKE_SA.

7 years agoAdd a new condition to mark IKE_SAs that are currently being reauthenticated
Tobias Brunner [Thu, 6 Sep 2012 09:23:11 +0000 (11:23 +0200)]
Add a new condition to mark IKE_SAs that are currently being reauthenticated

7 years agostarter: Load config again when restarting charon
Tobias Brunner [Wed, 5 Sep 2012 14:43:34 +0000 (16:43 +0200)]
starter: Load config again when restarting charon

This got lost in 041e763b.

7 years agoClear virtual IPs before storing assigned ones on the IKE_SA
Tobias Brunner [Wed, 5 Sep 2012 11:16:31 +0000 (13:16 +0200)]
Clear virtual IPs before storing assigned ones on the IKE_SA

Otherwise we'll end up with duplicate or invalid VIPs stored on the
IKE_SA.

7 years agoIn mode_config, destroy temporary pool list instead of the virtual IP list twice
Martin Willi [Wed, 5 Sep 2012 12:18:52 +0000 (14:18 +0200)]
In mode_config, destroy temporary pool list instead of the virtual IP list twice

7 years agoMerge branch 'android-client-cert'
Tobias Brunner [Tue, 4 Sep 2012 11:57:05 +0000 (13:57 +0200)]
Merge branch 'android-client-cert'

Introduces IKEv2 client certificate authentication for the Android App.

7 years agoandroid: Native parts handle ikev2-cert VPN type
Tobias Brunner [Tue, 28 Aug 2012 15:11:55 +0000 (17:11 +0200)]
android: Native parts handle ikev2-cert VPN type

7 years agoandroid: android_creds_t can provide a user's private key and certificate
Tobias Brunner [Tue, 28 Aug 2012 15:05:14 +0000 (17:05 +0200)]
android: android_creds_t can provide a user's private key and certificate

7 years agoandroid: Added JNI method to retrieve user certificate and private key
Tobias Brunner [Tue, 28 Aug 2012 15:02:53 +0000 (17:02 +0200)]
android: Added JNI method to retrieve user certificate and private key

To simplify things the private key, the user certificate and the CA
certificates are all put into the same list.

7 years agoandroid: Don't show the password dialog if not required
Tobias Brunner [Tue, 28 Aug 2012 15:01:37 +0000 (17:01 +0200)]
android: Don't show the password dialog if not required

7 years agoandroid: Enable pkcs8 plugin
Tobias Brunner [Tue, 28 Aug 2012 14:45:46 +0000 (16:45 +0200)]
android: Enable pkcs8 plugin

7 years agoandroid: Pass the type of VPN to the native parts
Tobias Brunner [Tue, 28 Aug 2012 13:32:14 +0000 (15:32 +0200)]
android: Pass the type of VPN to the native parts

7 years agoandroid: Make sure NULL jstrings are converted properly
Tobias Brunner [Tue, 28 Aug 2012 13:29:35 +0000 (15:29 +0200)]
android: Make sure NULL jstrings are converted properly

7 years agoandroid: Display the selected certificate alias in the profile list
Tobias Brunner [Tue, 28 Aug 2012 12:47:00 +0000 (14:47 +0200)]
android: Display the selected certificate alias in the profile list

7 years agoandroid: Allow configuration of a user certificate
Tobias Brunner [Tue, 28 Aug 2012 12:09:18 +0000 (14:09 +0200)]
android: Allow configuration of a user certificate

7 years agoandroid: Remove NOT NULL constraint from username column
Tobias Brunner [Tue, 28 Aug 2012 10:41:56 +0000 (12:41 +0200)]
android: Remove NOT NULL constraint from username column

7 years agoandroid: Separate view added to select certificates
Tobias Brunner [Mon, 27 Aug 2012 15:58:09 +0000 (17:58 +0200)]
android: Separate view added to select certificates

7 years agoandroid: Don't try to load the profile with ID 0
Tobias Brunner [Mon, 27 Aug 2012 14:53:07 +0000 (16:53 +0200)]
android: Don't try to load the profile with ID 0

7 years agoandroid: Spinner added to select the VPN type
Tobias Brunner [Mon, 27 Aug 2012 14:51:41 +0000 (16:51 +0200)]
android: Spinner added to select the VPN type

7 years agoMerge branch 'multi-vip'
Martin Willi [Fri, 31 Aug 2012 10:55:56 +0000 (12:55 +0200)]
Merge branch 'multi-vip'

Brings support for multiple virtual IPs and multiple pools in
left/rigthsourceip definitions. Also introduces the new left/rightdns
options to configure requested DNS server address family and respond
with multiple connection specific servers.

7 years agoMerge branch 'eap-client-select'
Tobias Brunner [Fri, 31 Aug 2012 10:23:38 +0000 (12:23 +0200)]
Merge branch 'eap-client-select'

This brings support for EAP-Nak payloads on the client (to select a
specific or supported method), and the server (via the eap-dynamic
plugin which selects a method supported/requested by the client).

7 years agoNEWS about eap-dynamic plugin added
Tobias Brunner [Fri, 31 Aug 2012 10:16:43 +0000 (12:16 +0200)]
NEWS about eap-dynamic plugin added

7 years agoDocumentation for eap-dynamic added
Tobias Brunner [Thu, 23 Aug 2012 14:21:22 +0000 (16:21 +0200)]
Documentation for eap-dynamic added

7 years agoLog the proper type for virtual EAP methods
Tobias Brunner [Thu, 23 Aug 2012 14:10:47 +0000 (16:10 +0200)]
Log the proper type for virtual EAP methods

7 years agoAdded an option to prefer types sent by peer in eap-dynamic plugin
Tobias Brunner [Thu, 23 Aug 2012 14:02:51 +0000 (16:02 +0200)]
Added an option to prefer types sent by peer in eap-dynamic plugin

7 years agoeap-dynamic plugin handles EAP-Nak messages and selects a method supported by the...
Tobias Brunner [Thu, 23 Aug 2012 13:00:20 +0000 (15:00 +0200)]
eap-dynamic plugin handles EAP-Nak messages and selects a method supported by the peer

7 years agoPreferred EAP methods for eap-dynamic can be configured
Tobias Brunner [Thu, 23 Aug 2012 12:55:33 +0000 (14:55 +0200)]
Preferred EAP methods for eap-dynamic can be configured

7 years agoThe eap-dynamic plugin uses the first supported method as default
Tobias Brunner [Thu, 23 Aug 2012 12:47:27 +0000 (14:47 +0200)]
The eap-dynamic plugin uses the first supported method as default

7 years agoAdded eap-dynamic plugin which can proxy any other EAP method
Tobias Brunner [Thu, 23 Aug 2012 12:42:23 +0000 (14:42 +0200)]
Added eap-dynamic plugin which can proxy any other EAP method

7 years agoUse eap_vendor_type_from_string() in stroke
Tobias Brunner [Thu, 23 Aug 2012 08:16:37 +0000 (10:16 +0200)]
Use eap_vendor_type_from_string() in stroke

7 years agoFunction added that parses EAP method strings ([eap-]type[-vendor])
Tobias Brunner [Thu, 23 Aug 2012 08:00:11 +0000 (10:00 +0200)]
Function added that parses EAP method strings ([eap-]type[-vendor])

7 years agoAdded method to enumerate EAP types contained in an EAP-Nak
Tobias Brunner [Thu, 23 Aug 2012 07:06:47 +0000 (09:06 +0200)]
Added method to enumerate EAP types contained in an EAP-Nak

7 years agoEncode EAP-Naks in expanded format if we got an expanded type request
Tobias Brunner [Thu, 23 Aug 2012 06:36:24 +0000 (08:36 +0200)]
Encode EAP-Naks in expanded format if we got an expanded type request

Since methods defined by the IETF (vendor ID 0) could also be encoded in
expanded type format the previous check was insufficient.

7 years agoAllow clients to request a configured EAP method via EAP-Nak
Tobias Brunner [Tue, 21 Aug 2012 15:11:14 +0000 (17:11 +0200)]
Allow clients to request a configured EAP method via EAP-Nak

7 years agoVirtual EAP methods handle EAP-Naks themselves
Tobias Brunner [Tue, 21 Aug 2012 14:57:34 +0000 (16:57 +0200)]
Virtual EAP methods handle EAP-Naks themselves

7 years agoSend EAP-Nak with supported types if requested type is unsupported
Tobias Brunner [Tue, 21 Aug 2012 14:54:21 +0000 (16:54 +0200)]
Send EAP-Nak with supported types if requested type is unsupported

7 years agoFilter invalid EAP authentication types when enumerating them
Tobias Brunner [Wed, 22 Aug 2012 15:01:13 +0000 (17:01 +0200)]
Filter invalid EAP authentication types when enumerating them

Valid authentication types defined by the IETF are 4-253 and 255.

7 years agoMove our pseudo EAP types out of the range of valid EAP methods
Tobias Brunner [Fri, 31 Aug 2012 09:31:48 +0000 (11:31 +0200)]
Move our pseudo EAP types out of the range of valid EAP methods

7 years agoversion bump to 5.0.1dr4
Andreas Steffen [Fri, 31 Aug 2012 00:47:19 +0000 (02:47 +0200)]
version bump to 5.0.1dr4

7 years agoAdded multiple left/rightsourceip NEWS
Martin Willi [Mon, 27 Aug 2012 14:52:22 +0000 (16:52 +0200)]
Added multiple left/rightsourceip NEWS

7 years agoAdded NEWS for left/rightdns options
Martin Willi [Mon, 27 Aug 2012 14:44:35 +0000 (16:44 +0200)]
Added NEWS for left/rightdns options

7 years agoUpdated ipsec.conf.5 with multiple left/rightsourceip support
Martin Willi [Mon, 27 Aug 2012 14:58:10 +0000 (16:58 +0200)]
Updated ipsec.conf.5 with multiple left/rightsourceip support

7 years agoAdded a note to _updown for the new PLUTO_MY_SOURCEIP* variables
Martin Willi [Mon, 27 Aug 2012 14:39:55 +0000 (16:39 +0200)]
Added a note to _updown for the new PLUTO_MY_SOURCEIP* variables

7 years agoBe less verbose if IP allocation for a single pool fails
Martin Willi [Mon, 27 Aug 2012 14:31:38 +0000 (16:31 +0200)]
Be less verbose if IP allocation for a single pool fails

7 years agoDHCP plugin returns virtual IPs for IPv4 requests only
Martin Willi [Mon, 27 Aug 2012 14:26:28 +0000 (16:26 +0200)]
DHCP plugin returns virtual IPs for IPv4 requests only

7 years agoCheck address family in HA virtual IP backend
Martin Willi [Mon, 27 Aug 2012 14:26:01 +0000 (16:26 +0200)]
Check address family in HA virtual IP backend

7 years agoStrictly enforce address family match while acquiring mem_pool IPs
Martin Willi [Mon, 27 Aug 2012 14:24:44 +0000 (16:24 +0200)]
Strictly enforce address family match while acquiring mem_pool IPs

7 years agoDon't parse comma separated pool names in attr-sql
Martin Willi [Mon, 27 Aug 2012 14:01:16 +0000 (16:01 +0200)]
Don't parse comma separated pool names in attr-sql

We now handle multiple pools at a deeper level, making that special
handling obsolete. Comma separated pools are parsed in stroke.

7 years agoHandle comma separated pools as multiple pool names in SQL plugin
Martin Willi [Mon, 27 Aug 2012 14:00:13 +0000 (16:00 +0200)]
Handle comma separated pools as multiple pool names in SQL plugin

7 years agoRequest and acquire multiple virtual IPs in IKEv1 Mode Config
Martin Willi [Mon, 27 Aug 2012 13:42:50 +0000 (15:42 +0200)]
Request and acquire multiple virtual IPs in IKEv1 Mode Config

7 years agoRequest and acquire multiple virtual IPs in IKEv2 configuration payload
Martin Willi [Mon, 27 Aug 2012 13:34:10 +0000 (15:34 +0200)]
Request and acquire multiple virtual IPs in IKEv2 configuration payload

7 years agoPass all configured pool names to attribute provider enumerator
Martin Willi [Mon, 27 Aug 2012 12:48:41 +0000 (14:48 +0200)]
Pass all configured pool names to attribute provider enumerator

7 years agoPass a list instead of a single virtual IP to attribute enumerators
Martin Willi [Mon, 27 Aug 2012 12:09:47 +0000 (14:09 +0200)]
Pass a list instead of a single virtual IP to attribute enumerators

7 years agoSupport multiple addresses/pools in left/rightsourceip
Martin Willi [Mon, 27 Aug 2012 09:19:46 +0000 (11:19 +0200)]
Support multiple addresses/pools in left/rightsourceip

7 years agoSupport multiple address pools configured on a peer_cfg
Martin Willi [Fri, 24 Aug 2012 12:31:24 +0000 (12:31 +0000)]
Support multiple address pools configured on a peer_cfg

7 years agoSupport multiple virtual IPs on peer_cfg and ike_sa classes
Martin Willi [Tue, 21 Aug 2012 11:50:32 +0000 (13:50 +0200)]
Support multiple virtual IPs on peer_cfg and ike_sa classes

7 years agoPorted tun_device de-/initialization to FreeBSD
Tobias Brunner [Wed, 29 Aug 2012 13:30:10 +0000 (15:30 +0200)]
Ported tun_device de-/initialization to FreeBSD

7 years agostruct iphdr is Linux specific use struct ip instead
Tobias Brunner [Wed, 29 Aug 2012 13:28:14 +0000 (15:28 +0200)]
struct iphdr is Linux specific use struct ip instead

7 years agoInclude stdint.h for UINT32_MAX on FreeBSD
Tobias Brunner [Wed, 29 Aug 2012 13:27:04 +0000 (15:27 +0200)]
Include stdint.h for UINT32_MAX on FreeBSD

7 years agoPorted tun_device initialization to OS X utun
Martin Willi [Tue, 28 Aug 2012 08:01:20 +0000 (10:01 +0200)]
Ported tun_device initialization to OS X utun

7 years agoandroid: Field added to store the type of a VPN profile
Tobias Brunner [Mon, 27 Aug 2012 13:34:53 +0000 (15:34 +0200)]
android: Field added to store the type of a VPN profile

7 years agoandroid: Enum added for VPN types
Tobias Brunner [Mon, 27 Aug 2012 13:33:58 +0000 (15:33 +0200)]
android: Enum added for VPN types

7 years agoandroid: Simplified handling of error dialog that is displayed if VpnService API...
Tobias Brunner [Fri, 24 Aug 2012 13:06:39 +0000 (15:06 +0200)]
android: Simplified handling of error dialog that is displayed if VpnService API is not supported

7 years agoandroid: LoginDialog refactored so it also works when the device is rotated
Tobias Brunner [Fri, 24 Aug 2012 12:55:31 +0000 (14:55 +0200)]
android: LoginDialog refactored so it also works when the device is rotated

7 years agoandroid: Added a field to store selected user certificate
Tobias Brunner [Mon, 20 Aug 2012 16:07:06 +0000 (18:07 +0200)]
android: Added a field to store selected user certificate

7 years agoEwa did the new Polish translation
Andreas Steffen [Fri, 24 Aug 2012 14:59:39 +0000 (16:59 +0200)]
Ewa did the new Polish translation

7 years agoLog configured IKE_SA proposals as initiator
Tobias Brunner [Wed, 8 Aug 2012 08:07:53 +0000 (10:07 +0200)]
Log configured IKE_SA proposals as initiator

7 years agoLog configured CHILD_SA proposals as initiator
Tobias Brunner [Wed, 8 Aug 2012 08:05:47 +0000 (10:05 +0200)]
Log configured CHILD_SA proposals as initiator

7 years agoFall back to local address as IKEv1 identity if nothing else is configured
Tobias Brunner [Fri, 24 Aug 2012 10:53:23 +0000 (12:53 +0200)]
Fall back to local address as IKEv1 identity if nothing else is configured

7 years agoRemoved deprecated options from ipsec.conf template
Tobias Brunner [Fri, 24 Aug 2012 09:52:01 +0000 (11:52 +0200)]
Removed deprecated options from ipsec.conf template

7 years agoApply send delay before adding non-ESP marker
Tobias Brunner [Fri, 24 Aug 2012 09:23:36 +0000 (11:23 +0200)]
Apply send delay before adding non-ESP marker

Otherwise the packet header could not be parsed correctly when NAT-T is
used.

7 years agoAdd a getter for the mem_pool_t base address
Martin Willi [Fri, 24 Aug 2012 09:07:50 +0000 (09:07 +0000)]
Add a getter for the mem_pool_t base address

7 years agouse pen_type_t for PA Message Subtype
Andreas Steffen [Thu, 23 Aug 2012 08:48:48 +0000 (10:48 +0200)]
use pen_type_t for PA Message Subtype

7 years agoAdded a method to enumerate registered EAP methods
Tobias Brunner [Tue, 21 Aug 2012 14:48:47 +0000 (16:48 +0200)]
Added a method to enumerate registered EAP methods

7 years agoRemove unused ipsec.conf left/rightnatip keyword
Martin Willi [Tue, 21 Aug 2012 07:32:33 +0000 (09:32 +0200)]
Remove unused ipsec.conf left/rightnatip keyword

7 years agoAdd description about DNS server variables to _updown
Martin Willi [Tue, 31 Jul 2012 13:38:57 +0000 (15:38 +0200)]
Add description about DNS server variables to _updown

7 years agoAdd a DNS attribute handler to updown, passing servers to updown script
Martin Willi [Tue, 31 Jul 2012 13:21:11 +0000 (15:21 +0200)]
Add a DNS attribute handler to updown, passing servers to updown script

7 years agoAdd a description of the leftdns option to ipsec.conf.5
Martin Willi [Tue, 31 Jul 2012 09:20:22 +0000 (11:20 +0200)]
Add a description of the leftdns option to ipsec.conf.5

7 years agoAdd a stroke attribute_handler requesting DNS servers given with leftdns
Martin Willi [Tue, 31 Jul 2012 09:09:19 +0000 (11:09 +0200)]
Add a stroke attribute_handler requesting DNS servers given with leftdns

7 years agoServe ipsec.conf rightdns servers through stroke attribute provider
Martin Willi [Tue, 31 Jul 2012 08:39:16 +0000 (10:39 +0200)]
Serve ipsec.conf rightdns servers through stroke attribute provider

7 years agoAdd a left/rightdns keyword to configure connection specific DNS attributes
Martin Willi [Tue, 31 Jul 2012 08:00:57 +0000 (10:00 +0200)]
Add a left/rightdns keyword to configure connection specific DNS attributes

7 years agoRemove unused src/dst variables in send_no_marker()
Martin Willi [Tue, 21 Aug 2012 07:34:12 +0000 (09:34 +0200)]
Remove unused src/dst variables in send_no_marker()

7 years agouse pen_type_t for attribute request entries
Andreas Steffen [Mon, 20 Aug 2012 22:22:02 +0000 (00:22 +0200)]
use pen_type_t for attribute request entries

7 years agodefine pen_type_t as a vendor-specific type
Andreas Steffen [Mon, 20 Aug 2012 20:37:08 +0000 (22:37 +0200)]
define pen_type_t as a vendor-specific type

7 years agoDon't use POSIX semaphores if a MONOTONIC clock is available
Martin Willi [Mon, 20 Aug 2012 15:58:58 +0000 (17:58 +0200)]
Don't use POSIX semaphores if a MONOTONIC clock is available

POSIX semaphores use CLOCK_REALTIME, but our semaphore_t abstraction
expects CLOCK_MONOTONIC based times. Use the mutex/condvar based
fallback if time_monotonic() actuall returns monotonic times.

7 years agoRemove the unused second IKE_SA entry match function argument
Martin Willi [Mon, 20 Aug 2012 15:39:26 +0000 (17:39 +0200)]
Remove the unused second IKE_SA entry match function argument

LLVMs clang complains about this parameter, so remove it.

7 years agoAdd a mutex/condvar based semaphore implementation if sem_timedwait is unavailable
Martin Willi [Mon, 20 Aug 2012 14:58:15 +0000 (16:58 +0200)]
Add a mutex/condvar based semaphore implementation if sem_timedwait is unavailable

Fixes #214.

7 years agoadded IBM and OpenPTS Private Enterprise Numbers
Andreas Steffen [Mon, 20 Aug 2012 13:02:25 +0000 (15:02 +0200)]
added IBM and OpenPTS Private Enterprise Numbers

7 years agoAdd keymat_t constructor registration function
Adrian-Ken Rueegsegger [Tue, 7 Aug 2012 12:00:28 +0000 (14:00 +0200)]
Add keymat_t constructor registration function

Using the register_constructor function enables custom keymat_t
implementations per IKE version. If no constructor is registered the
default behavior is preserved.

7 years agofixed caption
Andreas Steffen [Mon, 20 Aug 2012 10:56:13 +0000 (12:56 +0200)]
fixed caption

7 years agoimplemented IETF Attribute Request attribute
Andreas Steffen [Mon, 20 Aug 2012 10:27:14 +0000 (12:27 +0200)]
implemented IETF Attribute Request attribute

7 years agoversion bump to 5.0.1dr3
Andreas Steffen [Mon, 20 Aug 2012 10:25:53 +0000 (12:25 +0200)]
version bump to 5.0.1dr3

7 years agoopenssl: Fix registration of the PUBKEY builder
Tobias Brunner [Sat, 18 Aug 2012 15:49:57 +0000 (17:49 +0200)]
openssl: Fix registration of the PUBKEY builder

libtls drops support for RSA suites if it does not find an RSA backend
(final builder for RSA public keys).

7 years agoWithout the ties to PAM we can build eap-gtc on Android
Tobias Brunner [Fri, 17 Aug 2012 12:22:24 +0000 (14:22 +0200)]
Without the ties to PAM we can build eap-gtc on Android

7 years agoCAP_AUDIT_WRITE is now required by xauth-pam not eap-gtc plugin
Tobias Brunner [Fri, 17 Aug 2012 12:21:21 +0000 (14:21 +0200)]
CAP_AUDIT_WRITE is now required by xauth-pam not eap-gtc plugin

7 years agoRemoved manual EAP method registration in eap-gtc plugin
Tobias Brunner [Fri, 17 Aug 2012 12:19:37 +0000 (14:19 +0200)]
Removed manual EAP method registration in eap-gtc plugin

7 years agoEnable build of eap-tls, eap-ttls and eap-peap on Android
Tobias Brunner [Fri, 17 Aug 2012 11:55:44 +0000 (13:55 +0200)]
Enable build of eap-tls, eap-ttls and eap-peap on Android

7 years agoAdd a wrapper around vstr_add_fmt() to avoid having to link libcharon against libvstr
Tobias Brunner [Fri, 17 Aug 2012 09:47:52 +0000 (11:47 +0200)]
Add a wrapper around vstr_add_fmt() to avoid having to link libcharon against libvstr

At least on Android the latter would be required.

7 years agostarter: Restore original config in case also= is used (which reads the same values)
Tobias Brunner [Thu, 16 Aug 2012 14:45:11 +0000 (16:45 +0200)]
starter: Restore original config in case also= is used (which reads the same values)

7 years agoIncreased log level when listing interfaces and IP addresses during startup
Tobias Brunner [Tue, 14 Aug 2012 15:21:55 +0000 (17:21 +0200)]
Increased log level when listing interfaces and IP addresses during startup

This avoids confusing log messages in starter and ipsec statusall
already lists the available addresses anyway.