7 years agopki: Add pki --pkcs7 man page
Tobias Brunner [Mon, 12 Aug 2013 15:04:28 +0000 (17:04 +0200)]
pki: Add pki --pkcs7 man page

7 years agopki: Add pki --req man page
Tobias Brunner [Mon, 12 Aug 2013 14:49:13 +0000 (16:49 +0200)]
pki: Add pki --req man page

7 years agopki: Add pki --signcrl man page
Tobias Brunner [Mon, 12 Aug 2013 14:39:21 +0000 (16:39 +0200)]
pki: Add pki --signcrl man page

7 years agopki: Add pki --issue man page
Tobias Brunner [Mon, 12 Aug 2013 14:06:42 +0000 (16:06 +0200)]
pki: Add pki --issue man page

7 years agopki: Add pki --self man page
Tobias Brunner [Wed, 31 Jul 2013 17:48:45 +0000 (19:48 +0200)]
pki: Add pki --self man page

Can be opened with "man pki --self".

7 years agopki: Add pki --gen man page
Tobias Brunner [Wed, 31 Jul 2013 17:19:08 +0000 (19:19 +0200)]
pki: Add pki --gen man page

Can be opened with "man pki --gen".

7 years agopki: Add ipsec-pki(8) man page
Tobias Brunner [Wed, 31 Jul 2013 16:05:10 +0000 (18:05 +0200)]
pki: Add ipsec-pki(8) man page

Can be opened either with "man ipsec pki" or "man ipsec-pki".

Since man(1) only supports one level of subpages, the forthcoming man
pages for each command will have to be opened with "man pki --<command>".

7 years agostrongswan.conf: Use configured piddir for UNIX sockets
Tobias Brunner [Mon, 12 Aug 2013 13:13:20 +0000 (15:13 +0200)]
strongswan.conf: Use configured piddir for UNIX sockets

7 years agoBuild generated man pages via configure script
Tobias Brunner [Wed, 31 Jul 2013 15:30:40 +0000 (17:30 +0200)]
Build generated man pages via configure script

7 years agoresolve: Remove comment when using resolvconf(8)
Tobias Brunner [Fri, 13 Sep 2013 08:34:03 +0000 (10:34 +0200)]
resolve: Remove comment when using resolvconf(8)

Since comments in resolv.conf are only valid at the beginning of a line
resolvconf(8) seems to have started treating any text after
'nameserver <ip>' as additional IP addresses for name servers.

Since it ignores comments, and we can easily remove the added servers
again, there is no point to add any.

Fixes #410.

7 years ago.gitignore: Add .dirstamp files touched by automake
Martin Willi [Fri, 13 Sep 2013 12:11:30 +0000 (14:11 +0200)]
.gitignore: Add .dirstamp files touched by automake

7 years agolibipsec: fix memory management when cloning ip_packet
Martin Willi [Fri, 6 Sep 2013 12:16:14 +0000 (14:16 +0200)]
libipsec: fix memory management when cloning ip_packet

7 years agolibipsec: check for a policy with the reqid of the SA on decapsulation
Martin Willi [Wed, 4 Sep 2013 15:12:23 +0000 (17:12 +0200)]
libipsec: check for a policy with the reqid of the SA on decapsulation

To prevent a client from sending a packet with a source address of a different
client, we require a policy bound via reqid to the decapsulating SA.

7 years agostroke: don't remove a matching peer config if used by other child configs
Martin Willi [Mon, 9 Sep 2013 08:43:44 +0000 (10:43 +0200)]
stroke: don't remove a matching peer config if used by other child configs

When configurations get merged during add, we should not remove peer configs
if other connection entries use the same peer config.

7 years agoconftest: Don't load plugins incrementally
Tobias Brunner [Tue, 3 Sep 2013 17:02:40 +0000 (19:02 +0200)]
conftest: Don't load plugins incrementally

This is not supported by the plugin loader, so we simply combine the
plugin lists and load them all at once.

7 years agoikev1: Fix double free when searching for redundant CHILD_SAs
Tobias Brunner [Fri, 13 Sep 2013 08:14:45 +0000 (10:14 +0200)]
ikev1: Fix double free when searching for redundant CHILD_SAs

Fixes #411.

7 years agoBuild all IMC/IMVs with -no-undefined
Tobias Brunner [Wed, 4 Sep 2013 14:26:27 +0000 (16:26 +0200)]
Build all IMC/IMVs with -no-undefined

7 years agopt-tls-client: Report loaded plugins
Tobias Brunner [Wed, 4 Sep 2013 12:34:02 +0000 (14:34 +0200)]
pt-tls-client: Report loaded plugins

7 years agopt-tls-client: Abort if no tnccs-manager is available
Tobias Brunner [Wed, 4 Sep 2013 12:31:46 +0000 (14:31 +0200)]
pt-tls-client: Abort if no tnccs-manager is available

7 years agoBuild all shared libraries with -no-undefined and link them properly
Tobias Brunner [Wed, 4 Sep 2013 12:25:22 +0000 (14:25 +0200)]
Build all shared libraries with -no-undefined and link them properly

The flag is required to convince libtool on Cygwin to build DLLs. But on
Windows these shared libraries can not have undefined symbols, so we have to
link them explicitly to the libraries they reference.

For plugins this is currently not done, so only the monolithic build is
supported.  The plugin loader wouldn't be able to load DLLs anyway, as
it tries to load files that don't exist on Cygwin.

7 years agoconfigure: libtls and libtnccs etc. all require libstrongswan
Tobias Brunner [Wed, 4 Sep 2013 11:51:37 +0000 (13:51 +0200)]
configure: libtls and libtnccs etc. all require libstrongswan

7 years agotun_device: Add warning if TUN devices are not supported by platform
Tobias Brunner [Wed, 4 Sep 2013 11:40:35 +0000 (13:40 +0200)]
tun_device: Add warning if TUN devices are not supported by platform

7 years agoMake sure libstrongswan is initialized first in IMCs and IMVs
Andreas Steffen [Wed, 11 Sep 2013 18:58:18 +0000 (20:58 +0200)]
Make sure libstrongswan is initialized first in IMCs and IMVs

7 years agosockets: Initialize the whole ancillary data buffer not only the actual struct
Tobias Brunner [Tue, 10 Sep 2013 11:40:16 +0000 (13:40 +0200)]
sockets: Initialize the whole ancillary data buffer not only the actual struct

This avoids uninitialized bytes that Valgrind seems to notice otherwise.

Fixes #395.

7 years agoikev1: For PFS prefer DH group from IKE_SA over first configured
Thomas Egerer [Fri, 23 Aug 2013 12:15:44 +0000 (14:15 +0200)]
ikev1: For PFS prefer DH group from IKE_SA over first configured

If PFS is configured for a CHILD_SA first try to create a list of
proposals with using DH group negotiated during phase 1. If the
resulting list is empty (i.e. the DH group(s) configured for PFS differ
from the one(s) configured for the IKE_SA), fall back to the first
configured DH group from the CHILD_SA.
This modificiation is due to the fact that it is likely that the peer
supports the same DH group for PFS it did already for the IKE_SA.

7 years agokernel-netlink: increase buffer size for RT netlink messages
Ansis Atteka [Mon, 9 Sep 2013 22:42:55 +0000 (15:42 -0700)]
kernel-netlink: increase buffer size for RT netlink messages

Commit 940e1b0f66dc04b0853414c1f4c45fa3f6e33bdd "Filter ignored
interfaces in kernel interfaces (for events, address enumeration,
etc.)" made charon to ignore routes with unusable interfaces.
Unusable interface is one where charon has not seen RTM_NEWLINK
message from the kernel.

Sometime RTM_NEWLINK message can be 1048 bytes large. This is
24 bytes more than currently allocated buffer of 1024 bytes.
If kernel sends such a large message, then it would be silently
ignored by charon and corresponding interface would never become
usable. Hence strongSwan might resolve invalid source IP address
in get_route() function. This would prevent IPsec tunnel to be

To reproduce create a VLAN interface with following command:

vconfig add eth1 12

7 years agoFixed double free causing swapped ends to crash 5.1.1dr3
Andreas Steffen [Sat, 7 Sep 2013 06:25:10 +0000 (08:25 +0200)]
Fixed double free causing swapped ends to crash

7 years agoAdded ikev1/config-payload-push scenario
Andreas Steffen [Sat, 7 Sep 2013 06:23:58 +0000 (08:23 +0200)]
Added ikev1/config-payload-push scenario

7 years agoMinor performance tuning
Andreas Steffen [Sat, 7 Sep 2013 05:39:03 +0000 (07:39 +0200)]
Minor performance tuning

7 years agoCompleted NEWS for 5.1.1dr3
Andreas Steffen [Fri, 6 Sep 2013 20:11:33 +0000 (22:11 +0200)]
Completed NEWS for 5.1.1dr3

7 years agoImplemented targeted SWID request
Andreas Steffen [Fri, 6 Sep 2013 20:06:39 +0000 (22:06 +0200)]
Implemented targeted SWID request

7 years agoStore object files in the same directory as the source files
Tobias Brunner [Thu, 5 Sep 2013 12:19:14 +0000 (14:19 +0200)]
Store object files in the same directory as the source files

Future automake releases will apparently do that implicitly, but current
releases spit out nasty warning messages.

7 years agoMake SWID directory where tags are stored configurable
Andreas Steffen [Thu, 5 Sep 2013 10:25:02 +0000 (12:25 +0200)]
Make SWID directory where tags are stored configurable

7 years agoAdded tags table and some tag samples
Andreas Steffen [Thu, 5 Sep 2013 09:29:23 +0000 (11:29 +0200)]
Added tags table and some tag samples

7 years agoswid_inventory object has a get_count method
Andreas Steffen [Wed, 4 Sep 2013 19:56:25 +0000 (21:56 +0200)]
swid_inventory object has a get_count method

7 years agoCount collected SWID tags or tag IDs
Andreas Steffen [Wed, 4 Sep 2013 19:30:28 +0000 (21:30 +0200)]
Count collected SWID tags or tag IDs

7 years agoProceed with attestation only if Attestation IMC returns a discovery response
Andreas Steffen [Wed, 4 Sep 2013 19:00:54 +0000 (21:00 +0200)]
Proceed with attestation only if Attestation IMC returns a discovery response

7 years agolibipsec: Properly initialize variables when creating AEAD wrapper
Tobias Brunner [Wed, 4 Sep 2013 14:17:17 +0000 (16:17 +0200)]
libipsec: Properly initialize variables when creating AEAD wrapper

7 years agoandroid: Fix compilation after PTS header files were moved
Tobias Brunner [Wed, 4 Sep 2013 14:13:52 +0000 (16:13 +0200)]
android: Fix compilation after PTS header files were moved

7 years agolibpts: updated
Tobias Brunner [Wed, 4 Sep 2013 14:13:12 +0000 (16:13 +0200)]
libpts: updated

7 years agoVersion bump to 5.1.1dr3
Andreas Steffen [Wed, 4 Sep 2013 14:15:52 +0000 (16:15 +0200)]
Version bump to 5.1.1dr3

7 years agoNEWS: 5.1.1 update for merged branches
Martin Willi [Wed, 4 Sep 2013 09:06:58 +0000 (11:06 +0200)]
NEWS: 5.1.1 update for merged branches

7 years agoload-tester: support extended traffic selector syntax, as in leftsubnet
Martin Willi [Wed, 7 Aug 2013 15:06:36 +0000 (17:06 +0200)]
load-tester: support extended traffic selector syntax, as in leftsubnet

In addition the initiator may use %unique as port, using a distinct port for
each connection, starting from 1025.

7 years agoload-tester: add an option to test transport/beet connections
Martin Willi [Wed, 7 Aug 2013 14:32:21 +0000 (16:32 +0200)]
load-tester: add an option to test transport/beet connections

7 years agoMerge branch 'ike-address-ranges'
Martin Willi [Wed, 4 Sep 2013 08:43:35 +0000 (10:43 +0200)]
Merge branch 'ike-address-ranges'

Adds support for multiple subnets and address ranges in left/right ipsec.conf
options. As responder the connection is acceptable if the address is in one of
the ranges/subnets. To initiate connections, at least one single IP or hostname
is required for the peer address.

7 years agoman: add support for multiple addresses/ranges/subnets in ipsec.conf left=
Martin Willi [Thu, 25 Jul 2013 14:43:19 +0000 (16:43 +0200)]
man: add support for multiple addresses/ranges/subnets in ipsec.conf left=

7 years agoike: support multiple addresses, ranges and subnets in IKE address config
Martin Willi [Thu, 25 Jul 2013 13:37:13 +0000 (15:37 +0200)]
ike: support multiple addresses, ranges and subnets in IKE address config

Replace the allowany semantic by a more powerful subnet and IP range matching.
Multiple addresses, DNS names, subnets and ranges can be specified in a comma
separated list. Initiators ignore the ranges/subnets, responders match
configurations against all addresses, ranges and subnets.

7 years agoike-cfg: remove the to be obsoleted allow any parameter in get_my/other_addr
Martin Willi [Thu, 25 Jul 2013 12:07:40 +0000 (14:07 +0200)]
ike-cfg: remove the to be obsoleted allow any parameter in get_my/other_addr

7 years agobackends: use ike_cfg host matching functions
Martin Willi [Thu, 25 Jul 2013 11:42:11 +0000 (13:42 +0200)]
backends: use ike_cfg host matching functions

7 years agoike-cfg: add methods to match a host against configured local/remote addresses
Martin Willi [Thu, 25 Jul 2013 11:41:33 +0000 (13:41 +0200)]
ike-cfg: add methods to match a host against configured local/remote addresses

7 years agotrap-manager: use ike_cfg resolver functions
Martin Willi [Thu, 25 Jul 2013 11:40:53 +0000 (13:40 +0200)]
trap-manager: use ike_cfg resolver functions

7 years agoike-sa: use ike_cfg resolver functions
Martin Willi [Thu, 25 Jul 2013 11:40:26 +0000 (13:40 +0200)]
ike-sa: use ike_cfg resolver functions

7 years agoike-cfg: add a method to resolve local/remote hosts with port
Martin Willi [Thu, 25 Jul 2013 11:39:15 +0000 (13:39 +0200)]
ike-cfg: add a method to resolve local/remote hosts with port

7 years agoMerge branch 'ikev1-pushmode'
Martin Willi [Wed, 4 Sep 2013 08:35:26 +0000 (10:35 +0200)]
Merge branch 'ikev1-pushmode'

Implements Mode Config Push mode in IKEv1 using the existing modeconfig=push
ipsec.conf option.

7 years agostroke: ignore a leftsourceip if a rightsourceip is given as well
Martin Willi [Tue, 3 Sep 2013 13:44:43 +0000 (15:44 +0200)]
stroke: ignore a leftsourceip if a rightsourceip is given as well

As we always negotiate virtual IPs in charon, having both left- and
rightsourceip is not allowed. Both in IKEv1 and IKEv2 we support a single
configuration payload exchange only.

7 years agoman: update ipsec.conf modeconfig keyword
Martin Willi [Fri, 19 Jul 2013 14:01:36 +0000 (16:01 +0200)]
man: update ipsec.conf modeconfig keyword

7 years agoikev1: implement mode config push mode
Martin Willi [Fri, 19 Jul 2013 13:58:15 +0000 (15:58 +0200)]
ikev1: implement mode config push mode

7 years agostroke: re-enable modeconfig keyword
Martin Willi [Fri, 19 Jul 2013 13:47:33 +0000 (15:47 +0200)]
stroke: re-enable modeconfig keyword

7 years agopeer-cfg: add a pull/push mode option to use with mode config
Martin Willi [Fri, 19 Jul 2013 12:24:04 +0000 (14:24 +0200)]
peer-cfg: add a pull/push mode option to use with mode config

7 years agopubkey_speed: Add missing plugins
Tobias Brunner [Wed, 4 Sep 2013 07:47:23 +0000 (09:47 +0200)]
pubkey_speed: Add missing plugins

The pkcs1 plugin is required to test the gmp/gcrypt plugins. Likewise,
the pem plugin is required when testing the openssl plugin.

Fixes #401.

7 years agopubkey_speed: sudo is not required
Tobias Brunner [Wed, 4 Sep 2013 07:28:49 +0000 (09:28 +0200)]
pubkey_speed: sudo is not required

Also, refer to pubkey_speed properly when not being called from the same

7 years agopubkey_speed: Add header and fix usage
Tobias Brunner [Wed, 4 Sep 2013 07:08:46 +0000 (09:08 +0200)]
pubkey_speed: Add header and fix usage

7 years agoMerge branch 'xauth-radius-multi'
Martin Willi [Tue, 3 Sep 2013 14:32:27 +0000 (16:32 +0200)]
Merge branch 'xauth-radius-multi'

Introduces multiple rounds in the eap-radius XAuth backend, concatenating
answers to a single password to verify using a RADIUS User-Password attribute.
This is known to work fine with iOS and OS X clients, allowing two-factor
authentication with proper dialogs.

Different XAuth "profiles" for each backend can be selected using a generic
colon sperated suffix for the XAuth string.

7 years agocharon-cmd: support prompting for a PIN
Martin Willi [Wed, 24 Jul 2013 11:19:57 +0000 (13:19 +0200)]
charon-cmd: support prompting for a PIN

To support a Password and PIN XAuth combo, additionally support multiple
prompts for different credential types.

7 years agoxauth-generic: honor requested XAuth credential types as a client
Martin Willi [Wed, 24 Jul 2013 11:18:26 +0000 (13:18 +0200)]
xauth-generic: honor requested XAuth credential types as a client

Support requesting of XAuth PINs and print XAuth messages.

7 years agoattributes: shorten some Unity and XAuth attribute short names
Martin Willi [Wed, 24 Jul 2013 11:44:22 +0000 (13:44 +0200)]
attributes: shorten some Unity and XAuth attribute short names

7 years agomessage: print type of configuration payload
Martin Willi [Fri, 19 Jul 2013 13:57:53 +0000 (15:57 +0200)]
message: print type of configuration payload

7 years agomessage: print attributes for IKEv1 configuration payloads as well
Martin Willi [Fri, 19 Jul 2013 13:48:06 +0000 (15:48 +0200)]
message: print attributes for IKEv1 configuration payloads as well

7 years agoeap-radius: support XAuth configuration profiles, defining multiple XAuth rounds
Martin Willi [Tue, 23 Jul 2013 12:46:51 +0000 (14:46 +0200)]
eap-radius: support XAuth configuration profiles, defining multiple XAuth rounds

7 years agoxauth: add a configuration string option to be passed to XAuth instances
Martin Willi [Tue, 23 Jul 2013 12:24:58 +0000 (14:24 +0200)]
xauth: add a configuration string option to be passed to XAuth instances

The configuration string is appended to the XAuth backend name, separated by
a colon. The configuration string is passed untouched to the backend, where
it can change the behavior of the XAuth module.

7 years agoUse ipsec_DATA destination 5.1.1dr2
Andreas Steffen [Mon, 2 Sep 2013 12:20:33 +0000 (14:20 +0200)]
Use ipsec_DATA destination

7 years agoInstall SWID tag also in /share/
Andreas Steffen [Mon, 2 Sep 2013 12:01:05 +0000 (14:01 +0200)]
Install SWID tag also in /share/

7 years agoGenerate strongSwan SWID tag
Andreas Steffen [Mon, 2 Sep 2013 11:08:41 +0000 (13:08 +0200)]
Generate strongSwan SWID tag

7 years agoAdded regids table and some sample reqid data
Andreas Steffen [Mon, 2 Sep 2013 09:59:42 +0000 (11:59 +0200)]
Added regids table and some sample reqid data

7 years agoPull dave for OS info
Andreas Steffen [Sun, 1 Sep 2013 20:32:13 +0000 (22:32 +0200)]
Pull dave for OS info

7 years agoCorrected debug class to DBG_IMC
Andreas Steffen [Sun, 1 Sep 2013 20:27:21 +0000 (22:27 +0200)]
Corrected debug class to DBG_IMC

7 years agoautoconf: Split PACKAGE_VERSION in four parts
Tobias Brunner [Mon, 2 Sep 2013 09:26:31 +0000 (11:26 +0200)]
autoconf: Split PACKAGE_VERSION in four parts

The parts can be accessed with the variables:


The last part will be empty for regular releases.

7 years agoconftest: Fix hook constructor resolution via dlsym()
Tobias Brunner [Fri, 30 Aug 2013 17:33:22 +0000 (19:33 +0200)]
conftest: Fix hook constructor resolution via dlsym()

AM_CPPFLAGS only takes preprocessor flags like -I or -D, so it did not
forward -rdynamic to the linker (--export-dynamic), which meant that the
symbols defined in the executable itself were not resolvable via dlsym().

Fixes #394.

7 years agoSWID IMC implements recursive tag collection in /usr/share
Andreas Steffen [Fri, 30 Aug 2013 14:25:44 +0000 (16:25 +0200)]
SWID IMC implements recursive tag collection in /usr/share

7 years agoaes-test: Rename crypt() as it conflicts with a library function on Mac OS X
Tobias Brunner [Fri, 30 Aug 2013 06:51:09 +0000 (08:51 +0200)]
aes-test: Rename crypt() as it conflicts with a library function on Mac OS X

unistd.h on Linux defines this only if _XOPEN_SOURCE is defined.

7 years agokernel-pfroute: Fix mixed up memset() call in get_route()
Mathias Krause [Thu, 29 Aug 2013 16:21:58 +0000 (18:21 +0200)]
kernel-pfroute: Fix mixed up memset() call in get_route()

The retry code introduced in dc8b083 got the memset() arguments wrong.
Fix this to ensure the buffer gets zeroed, for real.

It probably doesn't matter as we do reset the message length on retry, so
the stale data shouldn't be seen by anyone.

Found-by: git grep 'memset\s*\([^,]*,\s*[^,]*,\s*0\s*\)'
7 years agotesting: support a .gitignored testing.conf.local for site-local configurations
Martin Willi [Fri, 26 Jul 2013 09:43:18 +0000 (11:43 +0200)]
testing: support a .gitignored testing.conf.local for site-local configurations

7 years agocharon-xpc: add a note how to build the source tarball
Martin Willi [Thu, 29 Aug 2013 10:23:48 +0000 (12:23 +0200)]
charon-xpc: add a note how to build the source tarball

7 years agocharon-xpc: include and prefer AES-GCM algorithms in ESP proposal
Martin Willi [Wed, 28 Aug 2013 09:21:08 +0000 (11:21 +0200)]
charon-xpc: include and prefer AES-GCM algorithms in ESP proposal

7 years agoVersion bump to 5.1.1dr2
Andreas Steffen [Wed, 28 Aug 2013 21:00:47 +0000 (23:00 +0200)]
Version bump to 5.1.1dr2

7 years agoAdded TCG-SWID error handling
Andreas Steffen [Wed, 28 Aug 2013 20:53:57 +0000 (22:53 +0200)]
Added TCG-SWID error handling

7 years agoAdded scripts/aes-test to .gitignore
Andreas Steffen [Wed, 28 Aug 2013 20:52:30 +0000 (22:52 +0200)]
Added scripts/aes-test to .gitignore

7 years agoAdded tzset memory leak to whitelist
Andreas Steffen [Wed, 28 Aug 2013 20:51:17 +0000 (22:51 +0200)]
Added tzset memory leak to whitelist

7 years agoSelectively enable PT-TLS and/or RADIUS sockets in tnc-pdp plugin
Andreas Steffen [Mon, 26 Aug 2013 18:36:07 +0000 (20:36 +0200)]
Selectively enable PT-TLS and/or RADIUS sockets in tnc-pdp plugin

7 years agoaes-test: Support test vectors at the end of a file
Tobias Brunner [Mon, 19 Aug 2013 08:38:47 +0000 (10:38 +0200)]
aes-test: Support test vectors at the end of a file

7 years agoaes-test: Add script to test AES implementations according to AESAVS/GCMVS
Tobias Brunner [Mon, 5 Aug 2013 16:20:50 +0000 (18:20 +0200)]
aes-test: Add script to test AES implementations according to AESAVS/GCMVS

7 years agochunk: Print chunks without separator if + modifier is used
Tobias Brunner [Tue, 6 Aug 2013 15:27:35 +0000 (17:27 +0200)]
chunk: Print chunks without separator if + modifier is used

7 years agoutils: Add case-insensitive version of strpfx()
Tobias Brunner [Tue, 6 Aug 2013 15:27:15 +0000 (17:27 +0200)]
utils: Add case-insensitive version of strpfx()

7 years agostroke: stop enumerating IKE_SAs in statusall if output stream gets closed
Martin Willi [Fri, 23 Aug 2013 12:22:29 +0000 (14:22 +0200)]
stroke: stop enumerating IKE_SAs in statusall if output stream gets closed

If the output stream is not interested in more information, it can close the
the stream. Checking for stream errors avoids useless enumeration of IKE_SAs,
saving resources. This allows to use "ipsec statusall | head" to monitor the
daemon, or stop enumerating IKE_SAs after a specific entry has been found.

7 years agoCleaned configuration files in PT-TLS client scenario
Andreas Steffen [Thu, 22 Aug 2013 15:24:20 +0000 (17:24 +0200)]
Cleaned configuration files in PT-TLS client scenario

7 years agokernel: Restore enumeration of all addresses when searching for address in TS
Tobias Brunner [Wed, 21 Aug 2013 14:52:19 +0000 (16:52 +0200)]
kernel: Restore enumeration of all addresses when searching for address in TS

Since f52cf07532 addresses on ignored, down or loopback interfaces were
not considered as valid addresses anymore when searching for an address
contained in the local traffic selector.  This meant that route
installation failed, for instance, if charon.install_virtual_ip_on was
set to 'lo', or, on gateways, if internal interfaces were ignored with
the charon.interfaces_* options.

7 years agoconftest: Disable reset_seq hook on systems other than Linux
Tobias Brunner [Wed, 21 Aug 2013 09:27:28 +0000 (11:27 +0200)]
conftest: Disable reset_seq hook on systems other than Linux

Fixes #386.

7 years agokernel-netlink: Fix calculation of ESN bitmap length
Tobias Brunner [Wed, 21 Aug 2013 06:28:12 +0000 (08:28 +0200)]
kernel-netlink: Fix calculation of ESN bitmap length

While bmp_len stores the number of u_int32_t the allocated bitmap
actually consists of those integers.

7 years agoAdded stand-alone pt-tls-client to NEWS 5.1.1dr1
Andreas Steffen [Mon, 19 Aug 2013 10:28:12 +0000 (12:28 +0200)]
Added stand-alone pt-tls-client to NEWS

7 years agoFlush iptables rules on alice
Andreas Steffen [Mon, 19 Aug 2013 10:20:57 +0000 (12:20 +0200)]
Flush iptables rules on alice