strongswan.git
6 years agoandroid: Add measurement collector for ITA Device ID
Tobias Brunner [Mon, 24 Jun 2013 13:50:48 +0000 (15:50 +0200)]
android: Add measurement collector for ITA Device ID

6 years agoandroid: Add measurement collector for ITA Settings
Tobias Brunner [Fri, 26 Apr 2013 16:17:32 +0000 (18:17 +0200)]
android: Add measurement collector for ITA Settings

6 years agoandroid: Handle ITA PA-TNC attributes
Tobias Brunner [Fri, 26 Apr 2013 16:17:07 +0000 (18:17 +0200)]
android: Handle ITA PA-TNC attributes

6 years agoandroid: Overload for getMeasurement() that takes a String array as argument
Tobias Brunner [Fri, 26 Apr 2013 16:12:21 +0000 (18:12 +0200)]
android: Overload for getMeasurement() that takes a String array as argument

6 years agoandroid: Add measurement collector for Port Filter
Tobias Brunner [Fri, 26 Apr 2013 15:11:15 +0000 (17:11 +0200)]
android: Add measurement collector for Port Filter

This collector reports all listening TCP and UDP sockets/ports.

6 years agoandroid: Enum type for transport protocols added
Tobias Brunner [Fri, 26 Apr 2013 15:10:20 +0000 (17:10 +0200)]
android: Enum type for transport protocols added

6 years agoandroid: Add measurement collector for Installed Packages
Tobias Brunner [Fri, 26 Apr 2013 13:36:03 +0000 (15:36 +0200)]
android: Add measurement collector for Installed Packages

6 years agoandroid: Add measurement collector for Product Information
Tobias Brunner [Fri, 26 Apr 2013 12:29:00 +0000 (14:29 +0200)]
android: Add measurement collector for Product Information

6 years agoandroid: Also support writing of 24-bit values
Tobias Brunner [Fri, 26 Apr 2013 12:27:52 +0000 (14:27 +0200)]
android: Also support writing of 24-bit values

6 years agoandroid: Add measurement collector for String Version
Tobias Brunner [Thu, 25 Apr 2013 17:43:56 +0000 (19:43 +0200)]
android: Add measurement collector for String Version

6 years agoandroid: Interfaces for measurement collectors and attributes added
Tobias Brunner [Thu, 25 Apr 2013 17:07:34 +0000 (19:07 +0200)]
android: Interfaces for measurement collectors and attributes added

6 years agoandroid: Add a Java utility class similar to bio_writer_t
Tobias Brunner [Thu, 25 Apr 2013 16:54:40 +0000 (18:54 +0200)]
android: Add a Java utility class similar to bio_writer_t

6 years agoandroid: Add enum types for PENs and attribute types
Tobias Brunner [Thu, 25 Apr 2013 15:31:54 +0000 (17:31 +0200)]
android: Add enum types for PENs and attribute types

6 years agoandroid: Add a generic handler for PA-TNC attribute requests
Tobias Brunner [Thu, 25 Apr 2013 15:20:15 +0000 (17:20 +0200)]
android: Add a generic handler for PA-TNC attribute requests

The idea is that the Android IMC will return attributes in their binary
encoding.  This keeps the JNI interface to the IMC pretty simple.

6 years agoimv-scanner: Only add a reason string if there is something to report
Tobias Brunner [Thu, 25 Apr 2013 10:43:23 +0000 (12:43 +0200)]
imv-scanner: Only add a reason string if there is something to report

6 years agoandroid: Added a Java part to the Android IMC
Tobias Brunner [Wed, 24 Apr 2013 14:24:14 +0000 (16:24 +0200)]
android: Added a Java part to the Android IMC

6 years agoandroid: Don't attempt loading IMCs from /etc/tnc_config
Tobias Brunner [Wed, 24 Apr 2013 13:28:13 +0000 (15:28 +0200)]
android: Don't attempt loading IMCs from /etc/tnc_config

6 years agolibtnccs: Don't try to load IMCs/IMVs from a file if there is no filename
Tobias Brunner [Wed, 24 Apr 2013 13:27:31 +0000 (15:27 +0200)]
libtnccs: Don't try to load IMCs/IMVs from a file if there is no filename

6 years agoIgnore Eclipse project/workspace files
Tobias Brunner [Tue, 23 Apr 2013 16:19:34 +0000 (18:19 +0200)]
Ignore Eclipse project/workspace files

Students seem to like Eclipse to work on strongSwan.

6 years agoandroid: Build libpts and init/deinit libpts in BYOD IMC
Tobias Brunner [Wed, 24 Apr 2013 16:36:59 +0000 (18:36 +0200)]
android: Build libpts and init/deinit libpts in BYOD IMC

6 years agolibpts: Android.mk added
Tobias Brunner [Wed, 24 Apr 2013 16:36:23 +0000 (18:36 +0200)]
libpts: Android.mk added

6 years agoandroid: Added a sample IMC that sends some dummy OS data
Tobias Brunner [Thu, 11 Oct 2012 13:26:19 +0000 (15:26 +0200)]
android: Added a sample IMC that sends some dummy OS data

6 years agoandroid: Build option added to load BYOD related plugins and libraries in the Android app
Tobias Brunner [Thu, 11 Oct 2012 11:50:18 +0000 (13:50 +0200)]
android: Build option added to load BYOD related plugins and libraries in the Android app

6 years agoandroid: Added support to build tnc-imc plugin
Tobias Brunner [Thu, 11 Oct 2012 09:28:45 +0000 (11:28 +0200)]
android: Added support to build tnc-imc plugin

6 years agoandroid: Added support to build eap-tnc, tnc-tnccs and tnccs-20 plugins
Tobias Brunner [Thu, 11 Oct 2012 09:10:19 +0000 (11:10 +0200)]
android: Added support to build eap-tnc, tnc-tnccs and tnccs-20 plugins

6 years agoandroid: Added function to include source files from plugin subdirectories
Tobias Brunner [Thu, 11 Oct 2012 09:06:35 +0000 (11:06 +0200)]
android: Added function to include source files from plugin subdirectories

6 years agolibimcv: Android.mk added
Tobias Brunner [Thu, 11 Oct 2012 07:35:45 +0000 (09:35 +0200)]
libimcv: Android.mk added

6 years agoCosmetics
Andreas Steffen [Mon, 8 Jul 2013 15:58:14 +0000 (17:58 +0200)]
Cosmetics

6 years agoScanner IMV without workitems provides immediate recommendation, too
Andreas Steffen [Mon, 8 Jul 2013 15:52:30 +0000 (17:52 +0200)]
Scanner IMV without workitems provides immediate recommendation, too

6 years agoattr-sql: Add unity_split_exclude as alias for unity_local_lan
Tobias Brunner [Mon, 8 Jul 2013 15:19:56 +0000 (17:19 +0200)]
attr-sql: Add unity_split_exclude as alias for unity_local_lan

6 years agoattr-sql: Fix double free when adding subnets for unknown attribute types
Tobias Brunner [Mon, 8 Jul 2013 15:17:24 +0000 (17:17 +0200)]
attr-sql: Fix double free when adding subnets for unknown attribute types

6 years agoAttestion IMV provides recommendation only once
Andreas Steffen [Mon, 8 Jul 2013 15:06:51 +0000 (17:06 +0200)]
Attestion IMV provides recommendation only once

6 years agoskip enforcement if a recent measurement was successful
Andreas Steffen [Mon, 8 Jul 2013 14:08:05 +0000 (16:08 +0200)]
skip enforcement if a recent measurement was successful

6 years agolibtncif: Android.mk updated
Tobias Brunner [Fri, 5 Jul 2013 11:57:44 +0000 (13:57 +0200)]
libtncif: Android.mk updated

6 years agoandroid: Disable listening on IPv6
Tobias Brunner [Wed, 3 Jul 2013 15:59:44 +0000 (17:59 +0200)]
android: Disable listening on IPv6

As we have to use UDP encapsulation and the Linux kernel currently does
not support that this avoids issues with dual-stack gateways.

6 years agosocket-default: Add options to disable address families
Tobias Brunner [Wed, 3 Jul 2013 15:57:24 +0000 (17:57 +0200)]
socket-default: Add options to disable address families

6 years agoike: Resolve hosts only for address families currently supported
Tobias Brunner [Wed, 3 Jul 2013 15:39:58 +0000 (17:39 +0200)]
ike: Resolve hosts only for address families currently supported

6 years agonet: Socket implementations report the address families they support
Tobias Brunner [Wed, 3 Jul 2013 15:32:40 +0000 (17:32 +0200)]
net: Socket implementations report the address families they support

6 years agoAdded config-3.10
Andreas Steffen [Thu, 4 Jul 2013 21:17:10 +0000 (23:17 +0200)]
Added config-3.10

6 years agoVersion bump to 5.1.0dr2
Andreas Steffen [Thu, 4 Jul 2013 20:56:19 +0000 (22:56 +0200)]
Version bump to 5.1.0dr2

6 years agoAlways return a result string for a processed workitem
Andreas Steffen [Thu, 4 Jul 2013 20:55:58 +0000 (22:55 +0200)]
Always return a result string for a processed workitem

6 years agoMake Block stronger than Isolate in default policy
Andreas Steffen [Thu, 4 Jul 2013 20:54:47 +0000 (22:54 +0200)]
Make Block stronger than Isolate in default policy

6 years agoRegister packages under Debian 7.0 x86_64
Andreas Steffen [Thu, 4 Jul 2013 20:53:41 +0000 (22:53 +0200)]
Register packages under Debian 7.0 x86_64

6 years agoopenssl: RAND_pseudo_bytes() returns 0 if bytes are not cryptographically strong
Martin Willi [Thu, 4 Jul 2013 09:09:54 +0000 (11:09 +0200)]
openssl: RAND_pseudo_bytes() returns 0 if bytes are not cryptographically strong

For our purposes with RNG_WEAK this is fine, so accept a zero return value.

6 years agoPing from dave before shutting down tcpdump in libipsec/rw-suite-b test case 5.1.0dr1
Tobias Brunner [Mon, 1 Jul 2013 11:48:21 +0000 (13:48 +0200)]
Ping from dave before shutting down tcpdump in libipsec/rw-suite-b test case

6 years agolibipsec: Properly handle expiration if no lifetime is set
Tobias Brunner [Mon, 1 Jul 2013 11:47:11 +0000 (13:47 +0200)]
libipsec: Properly handle expiration if no lifetime is set

6 years agocharon-cmd: Ignore generated man page
Tobias Brunner [Mon, 1 Jul 2013 10:33:02 +0000 (12:33 +0200)]
charon-cmd: Ignore generated man page

6 years agoEnable libipsec and charon-cmd in strongSwan recipe
Andreas Steffen [Mon, 1 Jul 2013 10:32:33 +0000 (12:32 +0200)]
Enable libipsec and charon-cmd in strongSwan recipe

6 years agoFixed libipsec/rw-suite-b scenario
Andreas Steffen [Mon, 1 Jul 2013 10:31:50 +0000 (12:31 +0200)]
Fixed libipsec/rw-suite-b scenario

6 years agoeap-radius: fix add_attribute/framed_ip method signatures
Martin Willi [Mon, 1 Jul 2013 09:52:04 +0000 (11:52 +0200)]
eap-radius: fix add_attribute/framed_ip method signatures

6 years agoAdded libipsec/rw-suite-b scenario
Andreas Steffen [Mon, 1 Jul 2013 09:04:14 +0000 (11:04 +0200)]
Added libipsec/rw-suite-b scenario

6 years agoFixed index.txt for strongSwan EC CA
Andreas Steffen [Mon, 1 Jul 2013 09:01:11 +0000 (11:01 +0200)]
Fixed index.txt for strongSwan EC CA

6 years agoDon't backup old package lists
Andreas Steffen [Mon, 1 Jul 2013 08:00:43 +0000 (10:00 +0200)]
Don't backup old package lists

6 years agoReuse reqid when restarting CHILD_SAs for dpd|closeaction=restart
Tobias Brunner [Sat, 29 Jun 2013 16:47:02 +0000 (18:47 +0200)]
Reuse reqid when restarting CHILD_SAs for dpd|closeaction=restart

6 years agoReuse reqid for trap policies installed for dpd|closeaction=hold
Tobias Brunner [Sat, 29 Jun 2013 16:33:37 +0000 (18:33 +0200)]
Reuse reqid for trap policies installed for dpd|closeaction=hold

6 years agoAdded libipsec/net2net-cert scenario
Andreas Steffen [Sat, 29 Jun 2013 20:23:45 +0000 (22:23 +0200)]
Added libipsec/net2net-cert scenario

6 years agoAdd type=transport to tkm/host2host-* connections
Reto Buerki [Sat, 29 Jun 2013 12:17:32 +0000 (14:17 +0200)]
Add type=transport to tkm/host2host-* connections

Explicitly specify transport mode in connection configuration of the
responding host (sun).

6 years ago5.1.0 changes for test cases
Andreas Steffen [Fri, 28 Jun 2013 22:07:15 +0000 (00:07 +0200)]
5.1.0 changes for test cases

6 years agoprocessor: Simplified the main loop
Tobias Brunner [Fri, 28 Jun 2013 14:46:12 +0000 (16:46 +0200)]
processor: Simplified the main loop

6 years agoprocessor: Don't hold the lock while destroying jobs
Tobias Brunner [Thu, 27 Jun 2013 14:44:33 +0000 (16:44 +0200)]
processor: Don't hold the lock while destroying jobs

If a lock is held when queue_job() is called and the same lock is
required during the destruction of a job, holding the internal lock
in the processor while calling destroy() could result in a deadlock.

6 years agodhcp: Use chunk_hash_static() to calculate ID-based MAC addresses
Tobias Brunner [Fri, 28 Jun 2013 10:22:56 +0000 (12:22 +0200)]
dhcp: Use chunk_hash_static() to calculate ID-based MAC addresses

6 years agointegrity-checker: Use chunk_hash_static() to calculate checksums
Tobias Brunner [Fri, 28 Jun 2013 10:18:05 +0000 (12:18 +0200)]
integrity-checker: Use chunk_hash_static() to calculate checksums

6 years agochunk: Add predictable hash function
Tobias Brunner [Fri, 28 Jun 2013 10:12:41 +0000 (12:12 +0200)]
chunk: Add predictable hash function

Since chunk_hash() is randomized its output is not predictable, that is,
it is only within the same process.

6 years agostroke: Changed how proto/port are specified in left|rightsubnet
Tobias Brunner [Fri, 28 Jun 2013 08:29:42 +0000 (10:29 +0200)]
stroke: Changed how proto/port are specified in left|rightsubnet

Using a colon as separator conflicts with IPv6 addresses.

6 years agoplugin-loader: Removed unused path argument of load() method
Tobias Brunner [Fri, 28 Jun 2013 08:44:15 +0000 (10:44 +0200)]
plugin-loader: Removed unused path argument of load() method

Multiple additional search paths can be added with the add_path()
method.

6 years agotnc-pdp: Initialize TNC-PDP in plugin callback with proper dependencies
Tobias Brunner [Thu, 27 Jun 2013 16:01:10 +0000 (18:01 +0200)]
tnc-pdp: Initialize TNC-PDP in plugin callback with proper dependencies

6 years agoAttestation IMV requests platform info if not received
Andreas Steffen [Thu, 27 Jun 2013 15:30:14 +0000 (17:30 +0200)]
Attestation IMV requests platform info if not received

6 years agointegrity-checker: Fix checksum calculation after randomizing chunk_hash()
Tobias Brunner [Thu, 27 Jun 2013 13:34:08 +0000 (15:34 +0200)]
integrity-checker: Fix checksum calculation after randomizing chunk_hash()

6 years agounit-tests: Print loaded plugins
Tobias Brunner [Thu, 27 Jun 2013 09:27:13 +0000 (11:27 +0200)]
unit-tests: Print loaded plugins

6 years agounit-tests: RSA key generation might take longer than 4 seconds
Tobias Brunner [Thu, 27 Jun 2013 08:41:34 +0000 (10:41 +0200)]
unit-tests: RSA key generation might take longer than 4 seconds

Check uses a default timeout of 4 seconds for each test case, generating
keys of 6 different key sizes might take longer than that.

6 years agotests: Properly load plugins from build directory
Tobias Brunner [Tue, 25 Jun 2013 17:42:34 +0000 (19:42 +0200)]
tests: Properly load plugins from build directory

Calling load() incrementally does not really work as dependencies
wouldn't be resolved properly if a required feature was to be provided
by a plugin that is loaded later with a separate call to load().

6 years agoplugin-loader: Method added to provide additional search paths for plugins
Tobias Brunner [Tue, 25 Jun 2013 17:40:52 +0000 (19:40 +0200)]
plugin-loader: Method added to provide additional search paths for plugins

6 years agoSupport blacklist field in PTS database
Andreas Steffen [Wed, 26 Jun 2013 10:07:09 +0000 (12:07 +0200)]
Support blacklist field in PTS database

6 years agoUpdated PTS demo database
Andreas Steffen [Wed, 26 Jun 2013 08:14:25 +0000 (10:14 +0200)]
Updated PTS demo database

6 years agoDevice can be member of multiple groups
Andreas Steffen [Tue, 25 Jun 2013 16:42:57 +0000 (18:42 +0200)]
Device can be member of multiple groups

6 years agoAdding NEWS for 5.1.0
Tobias Brunner [Sat, 22 Jun 2013 10:11:48 +0000 (12:11 +0200)]
Adding NEWS for 5.1.0

6 years agoMerge branch 'check-caps'
Tobias Brunner [Tue, 25 Jun 2013 15:17:40 +0000 (17:17 +0200)]
Merge branch 'check-caps'

Plugins may now ensure the process has all the required capabilities.
Some minor changes to UID/GID handling are also included.

6 years agocapabilities: Return effective UID/GID if user did not configure anything
Tobias Brunner [Tue, 25 Jun 2013 13:03:51 +0000 (15:03 +0200)]
capabilities: Return effective UID/GID if user did not configure anything

6 years agocapabilities: Make the user and group charon(-nm) changes to configurable
Tobias Brunner [Tue, 5 Feb 2013 16:48:12 +0000 (17:48 +0100)]
capabilities: Make the user and group charon(-nm) changes to configurable

6 years agocapabilities: Report effective UID/GID after dropping capabilities
Tobias Brunner [Tue, 25 Jun 2013 08:41:03 +0000 (10:41 +0200)]
capabilities: Report effective UID/GID after dropping capabilities

6 years agocapabilities: CAP_CHOWN might be required by many plugins opening UNIX sockets
Tobias Brunner [Tue, 25 Jun 2013 07:03:00 +0000 (09:03 +0200)]
capabilities: CAP_CHOWN might be required by many plugins opening UNIX sockets

But as the sockets will be created with the user/group of the running
process this might not be required as no change may be needed.

6 years agocapabilities: Handle CAP_CHOWN specially as it might not be required
Tobias Brunner [Tue, 25 Jun 2013 08:39:03 +0000 (10:39 +0200)]
capabilities: Handle CAP_CHOWN specially as it might not be required

6 years agocapabilities: Check effective UID as fallback if capabilities are not supported
Tobias Brunner [Tue, 25 Jun 2013 08:09:38 +0000 (10:09 +0200)]
capabilities: Check effective UID as fallback if capabilities are not supported

6 years agokernel-netlink: Make CAP_NET_ADMIN capability optional
Tobias Brunner [Tue, 25 Jun 2013 06:49:55 +0000 (08:49 +0200)]
kernel-netlink: Make CAP_NET_ADMIN capability optional

It is not required to use the kernel-net part of the plugin.

6 years agofarp: Require CAP_NET_RAW capability to open AF_PACKET socket
Tobias Brunner [Tue, 25 Jun 2013 06:37:01 +0000 (08:37 +0200)]
farp: Require CAP_NET_RAW capability to open AF_PACKET socket

6 years agodhcp: Require CAP_NET_BIND_SERVICE and CAP_NET_RAW to open/bind sockets
Tobias Brunner [Tue, 25 Jun 2013 06:35:06 +0000 (08:35 +0200)]
dhcp: Require CAP_NET_BIND_SERVICE and CAP_NET_RAW to open/bind sockets

6 years agosocket-default: Require CAP_NET_BIND_SERVICE for ports < 1024
Tobias Brunner [Tue, 25 Jun 2013 06:23:35 +0000 (08:23 +0200)]
socket-default: Require CAP_NET_BIND_SERVICE for ports < 1024

Since we don't know which ports are used with socket-dynamic we can't
demand the capability there, but it might still be required.

6 years agocapabilities: Only plugins that require CAP_NET_ADMIN demand it
Tobias Brunner [Mon, 24 Jun 2013 16:22:31 +0000 (18:22 +0200)]
capabilities: Only plugins that require CAP_NET_ADMIN demand it

The daemon as such does not require this capability.

6 years agocapabilities: Move global capabilities_t instance to libstrongswan
Tobias Brunner [Tue, 25 Jun 2013 05:25:18 +0000 (07:25 +0200)]
capabilities: Move global capabilities_t instance to libstrongswan

6 years agocapabilities: Ensure required capabilities are actually held by the process/user
Tobias Brunner [Wed, 8 May 2013 15:14:29 +0000 (17:14 +0200)]
capabilities: Ensure required capabilities are actually held by the process/user

6 years agoikev2: keep the CHILD_SA we delete as initiator in the list to destroy
Martin Willi [Tue, 25 Jun 2013 12:03:51 +0000 (14:03 +0200)]
ikev2: keep the CHILD_SA we delete as initiator in the list to destroy

If the responder not correctly send the correct protocol or SPI in the delete
response, we should remove the CHILD_SA regardless.

6 years agoSome IMV policy managers expect a TEXT string
Andreas Steffen [Tue, 25 Jun 2013 10:47:07 +0000 (12:47 +0200)]
Some IMV policy managers expect a TEXT string

6 years agoAssign default group to newly created devices
Andreas Steffen [Tue, 25 Jun 2013 09:49:32 +0000 (11:49 +0200)]
Assign default group to newly created devices

6 years agoSet device creation date if it hasn't been set yet
Andreas Steffen [Mon, 24 Jun 2013 18:18:16 +0000 (20:18 +0200)]
Set device creation date if it hasn't been set yet

6 years agounit-tester: RSA test was removed
Tobias Brunner [Mon, 24 Jun 2013 14:01:23 +0000 (16:01 +0200)]
unit-tester: RSA test was removed

6 years agoAligned AR Identity types to IF-IMV 1.4 R5 draft
Andreas Steffen [Sun, 23 Jun 2013 22:23:50 +0000 (00:23 +0200)]
Aligned AR Identity types to IF-IMV 1.4 R5 draft

6 years agoSend PA-TNC assessment result even if no workitems are available
Andreas Steffen [Sun, 23 Jun 2013 22:22:38 +0000 (00:22 +0200)]
Send PA-TNC assessment result even if no workitems are available

6 years agoSome pacman fixes
Andreas Steffen [Sun, 23 Jun 2013 14:23:19 +0000 (16:23 +0200)]
Some pacman fixes

6 years agoversion bump to 5.1.0dr1
Andreas Steffen [Fri, 21 Jun 2013 21:54:13 +0000 (23:54 +0200)]
version bump to 5.1.0dr1

6 years agoSome PTS database fixes
Andreas Steffen [Fri, 21 Jun 2013 21:24:40 +0000 (23:24 +0200)]
Some PTS database fixes