strongswan.git
10 years agoImplemented a callback based credential set, currently for shared keys only
Martin Willi [Fri, 16 Jul 2010 14:55:29 +0000 (16:55 +0200)]
Implemented a callback based credential set, currently for shared keys only

10 years agoImplemented a generic in-memory credential set, currently for shared keys only
Martin Willi [Fri, 16 Jul 2010 14:53:03 +0000 (16:53 +0200)]
Implemented a generic in-memory credential set, currently for shared keys only

10 years agommap() ipsec.secrets instead malloc(), proper error checking
Martin Willi [Fri, 16 Jul 2010 12:40:02 +0000 (14:40 +0200)]
mmap() ipsec.secrets instead malloc(), proper error checking

10 years agoSplitted up the load_secrets() function
Martin Willi [Fri, 16 Jul 2010 12:31:50 +0000 (14:31 +0200)]
Splitted up the load_secrets() function

10 years agoUpdated ipsec.secrets.5 regarding IKEv2 smartcard support
Martin Willi [Fri, 16 Jul 2010 10:18:20 +0000 (12:18 +0200)]
Updated ipsec.secrets.5 regarding IKEv2 smartcard support

10 years ago%prompt support for smartcard PIN via "ipsec secrets"
Martin Willi [Fri, 16 Jul 2010 10:17:21 +0000 (12:17 +0200)]
%prompt support for smartcard PIN via "ipsec secrets"

10 years agoImplemented callback PIN invocation for PKCS#11 login
Martin Willi [Fri, 16 Jul 2010 10:16:32 +0000 (12:16 +0200)]
Implemented callback PIN invocation for PKCS#11 login

10 years agoImplemented keyid discovery on all modules/slots
Martin Willi [Fri, 16 Jul 2010 09:17:06 +0000 (11:17 +0200)]
Implemented keyid discovery on all modules/slots

10 years agoPass the PKCS11 keyid as chunk, not as string
Martin Willi [Fri, 16 Jul 2010 08:48:29 +0000 (10:48 +0200)]
Pass the PKCS11 keyid as chunk, not as string

10 years agoReuse generic passphrase build part, not a dedicated PIN part
Martin Willi [Fri, 16 Jul 2010 08:12:22 +0000 (10:12 +0200)]
Reuse generic passphrase build part, not a dedicated PIN part

10 years agoImplemented private key on top of a PKCS#11 token
Martin Willi [Thu, 15 Jul 2010 15:54:26 +0000 (17:54 +0200)]
Implemented private key on top of a PKCS#11 token

10 years agoExtended the PKCS#11 object enumerator by attribute retrieval
Martin Willi [Thu, 15 Jul 2010 14:25:30 +0000 (16:25 +0200)]
Extended the PKCS#11 object enumerator by attribute retrieval

10 years agoUse the PKCS#11 object enumerator
Martin Willi [Thu, 15 Jul 2010 13:44:17 +0000 (15:44 +0200)]
Use the PKCS#11 object enumerator

10 years agoImplemented a generic PKCS#11 object enumerator
Martin Willi [Thu, 15 Jul 2010 13:43:30 +0000 (15:43 +0200)]
Implemented a generic PKCS#11 object enumerator

10 years agoUnload plugins in reverse order
Martin Willi [Thu, 15 Jul 2010 12:05:02 +0000 (14:05 +0200)]
Unload plugins in reverse order

10 years agoSupport module names in %smartcard specifier, streamlined smartcard building
Martin Willi [Thu, 15 Jul 2010 10:23:50 +0000 (12:23 +0200)]
Support module names in %smartcard specifier, streamlined smartcard building

10 years agoAdded enumerator for PKCS#11 tokens
Martin Willi [Thu, 15 Jul 2010 10:22:36 +0000 (12:22 +0200)]
Added enumerator for PKCS#11 tokens

10 years agoHandle NOT_SUPPORT return value from WaitForSlot
Martin Willi [Thu, 15 Jul 2010 08:10:14 +0000 (10:10 +0200)]
Handle NOT_SUPPORT return value from WaitForSlot

10 years agoReenabled dlclose
Martin Willi [Thu, 15 Jul 2010 06:26:46 +0000 (08:26 +0200)]
Reenabled dlclose

10 years agoImplemented a credential set on top of a PKCS#11 token
Martin Willi [Wed, 14 Jul 2010 15:44:27 +0000 (17:44 +0200)]
Implemented a credential set on top of a PKCS#11 token

10 years agoAdded NSPR PR_CallOnce to leak detective whitelist
Martin Willi [Wed, 14 Jul 2010 15:42:18 +0000 (17:42 +0200)]
Added NSPR PR_CallOnce to leak detective whitelist

10 years agoAdded buffer checking variants of syslog functions to leak detective
Martin Willi [Wed, 14 Jul 2010 15:40:06 +0000 (17:40 +0200)]
Added buffer checking variants of syslog functions to leak detective

10 years agoMoved gmp plugin before users of it
Martin Willi [Wed, 14 Jul 2010 15:34:48 +0000 (17:34 +0200)]
Moved gmp plugin before users of it

10 years agoAdded a token add/remove callback function to the manager
Martin Willi [Wed, 14 Jul 2010 13:09:12 +0000 (15:09 +0200)]
Added a token add/remove callback function to the manager

10 years agoEnumerate tokens and their mechanisms, wait for slot events
Martin Willi [Wed, 14 Jul 2010 12:44:08 +0000 (14:44 +0200)]
Enumerate tokens and their mechanisms, wait for slot events

10 years agoDepend on libcharon until we have a thread pool to use
Martin Willi [Wed, 14 Jul 2010 12:13:24 +0000 (14:13 +0200)]
Depend on libcharon until we have a thread pool to use

10 years agoAdd enum names for CK_MECHANISM_TYPE constants
Martin Willi [Wed, 14 Jul 2010 12:13:02 +0000 (14:13 +0200)]
Add enum names for CK_MECHANISM_TYPE constants

10 years agoMake the PKCS#11 padding string trimming public, add null terminator
Martin Willi [Wed, 14 Jul 2010 10:43:42 +0000 (12:43 +0200)]
Make the PKCS#11 padding string trimming public, add null terminator

10 years agoAdded a getter for the library alias
Martin Willi [Wed, 14 Jul 2010 10:32:40 +0000 (12:32 +0200)]
Added a getter for the library alias

10 years agoMoved PKCS#11 library loading to dedicated manager
Martin Willi [Wed, 14 Jul 2010 09:15:22 +0000 (11:15 +0200)]
Moved PKCS#11 library loading to dedicated manager

10 years agoUse locking, prefer our mutex abstraction layer
Martin Willi [Wed, 14 Jul 2010 08:39:28 +0000 (10:39 +0200)]
Use locking, prefer our mutex abstraction layer

10 years agoAdded enum names for PKCS#11 return values
Martin Willi [Wed, 14 Jul 2010 08:22:42 +0000 (10:22 +0200)]
Added enum names for PKCS#11 return values

10 years agoLoad PKCS#11 modules defined in strongswan.conf
Martin Willi [Wed, 14 Jul 2010 07:48:29 +0000 (09:48 +0200)]
Load PKCS#11 modules defined in strongswan.conf

10 years agoImplemented an abstraction layer for PKCS#11 module loading
Martin Willi [Wed, 14 Jul 2010 07:47:37 +0000 (09:47 +0200)]
Implemented an abstraction layer for PKCS#11 module loading

10 years agoImported the free pkcs11.h header form the Scute project
Martin Willi [Wed, 14 Jul 2010 07:46:24 +0000 (09:46 +0200)]
Imported the free pkcs11.h header form the Scute project

10 years agoAdded PKCS#11 token plugin stub
Martin Willi [Tue, 13 Jul 2010 15:34:34 +0000 (17:34 +0200)]
Added PKCS#11 token plugin stub

10 years agoadded ikev2/rw-eap-tls-only scenario
Andreas Steffen [Wed, 4 Aug 2010 06:36:27 +0000 (08:36 +0200)]
added ikev2/rw-eap-tls-only scenario

10 years ago--enable eap-tls and --disable-load-warning in uml build
Andreas Steffen [Wed, 4 Aug 2010 05:47:08 +0000 (07:47 +0200)]
--enable eap-tls and --disable-load-warning in uml build

10 years agotest_cert adapted to extended signature of get_encoding().
Tobias Brunner [Tue, 3 Aug 2010 16:59:27 +0000 (18:59 +0200)]
test_cert adapted to extended signature of get_encoding().

10 years agoFixed compiler warnings.
Tobias Brunner [Tue, 3 Aug 2010 16:59:12 +0000 (18:59 +0200)]
Fixed compiler warnings.

10 years agoMoved TLS stack to its own library
Martin Willi [Tue, 3 Aug 2010 13:17:40 +0000 (15:17 +0200)]
Moved TLS stack to its own library

10 years agoMoved eap-tls plugin to libcharon, updated to 4.4.1 APIs
Martin Willi [Fri, 19 Mar 2010 17:55:23 +0000 (18:55 +0100)]
Moved eap-tls plugin to libcharon, updated to 4.4.1 APIs

10 years agoImplemented EAP-TLS server functionality
Martin Willi [Tue, 9 Feb 2010 17:19:25 +0000 (18:19 +0100)]
Implemented EAP-TLS server functionality

10 years agoTLS stack keeps a copy of server/peer identities
Martin Willi [Tue, 9 Feb 2010 13:57:50 +0000 (14:57 +0100)]
TLS stack keeps a copy of server/peer identities

10 years agoLimit the number of EAP-TLS packets allowed
Martin Willi [Tue, 9 Feb 2010 11:53:42 +0000 (12:53 +0100)]
Limit the number of EAP-TLS packets allowed

10 years agoUse stricter state handling while processing TLS messages
Martin Willi [Tue, 9 Feb 2010 11:37:29 +0000 (12:37 +0100)]
Use stricter state handling while processing TLS messages

10 years agoCleaned up the public TLS interface
Martin Willi [Fri, 5 Feb 2010 13:39:19 +0000 (13:39 +0000)]
Cleaned up the public TLS interface

10 years agoRefactored common used operations into TLS crypto helper
Martin Willi [Fri, 5 Feb 2010 13:25:38 +0000 (14:25 +0100)]
Refactored common used operations into TLS crypto helper

10 years agoProperly send empty EAP-TLS messages
Martin Willi [Fri, 5 Feb 2010 11:30:01 +0000 (11:30 +0000)]
Properly send empty EAP-TLS messages

10 years agoDerive MSK for EAP-TLS authentication
Martin Willi [Fri, 5 Feb 2010 11:28:48 +0000 (11:28 +0000)]
Derive MSK for EAP-TLS authentication

10 years agoVerify Server Finished message
Martin Willi [Fri, 5 Feb 2010 11:27:52 +0000 (11:27 +0000)]
Verify Server Finished message

10 years agoImplemented input record decryption and verification
Martin Willi [Fri, 5 Feb 2010 10:50:29 +0000 (10:50 +0000)]
Implemented input record decryption and verification

10 years agoImplemented key derivation, output record signing and encryption
Martin Willi [Thu, 4 Feb 2010 17:18:10 +0000 (18:18 +0100)]
Implemented key derivation, output record signing and encryption

10 years agoDerive master secret, create Finished message
Martin Willi [Thu, 4 Feb 2010 10:17:48 +0000 (11:17 +0100)]
Derive master secret, create Finished message

10 years agoImplemented the TLS specific PRF in its TLSv1.0 and TLSv1.2 variants
Martin Willi [Thu, 4 Feb 2010 09:08:07 +0000 (10:08 +0100)]
Implemented the TLS specific PRF in its TLSv1.0 and TLSv1.2 variants

10 years agoImplemented sending of Certificate, ClientKeyExchange, CertificateVerify and ChangeCi...
Martin Willi [Wed, 3 Feb 2010 18:53:40 +0000 (19:53 +0100)]
Implemented sending of Certificate, ClientKeyExchange, CertificateVerify and ChangeCipherSpec as peer

10 years agoImplemented a tls_writer class to simplify TLS data generation
Martin Willi [Mon, 1 Feb 2010 14:12:18 +0000 (15:12 +0100)]
Implemented a tls_writer class to simplify TLS data generation

10 years agoImplemented a tls_reader class to simplify TLS data parsing
Martin Willi [Mon, 1 Feb 2010 10:25:44 +0000 (10:25 +0000)]
Implemented a tls_reader class to simplify TLS data parsing

10 years agoProcess ServerHello(Done), Certificate(Request) messages
Martin Willi [Mon, 25 Jan 2010 16:31:55 +0000 (17:31 +0100)]
Process ServerHello(Done), Certificate(Request) messages

10 years agoSend a ClientHello to start TLS negotiation
Martin Willi [Mon, 25 Jan 2010 11:23:59 +0000 (11:23 +0000)]
Send a ClientHello to start TLS negotiation

10 years agoAdded TLS crypto helper, currently supports cipher suite selection
Martin Willi [Mon, 25 Jan 2010 11:21:57 +0000 (11:21 +0000)]
Added TLS crypto helper, currently supports cipher suite selection

10 years agoAdded support for AUTH_HMAC_SHA2_256_256, used in TLS
Martin Willi [Mon, 25 Jan 2010 11:15:05 +0000 (11:15 +0000)]
Added support for AUTH_HMAC_SHA2_256_256, used in TLS

10 years agoAdded stubs for handshake handling, server and peer variants
Martin Willi [Mon, 25 Jan 2010 09:44:35 +0000 (10:44 +0100)]
Added stubs for handshake handling, server and peer variants

10 years agoAccept follow-up fragments with a TLS message length
Martin Willi [Mon, 25 Jan 2010 09:42:44 +0000 (10:42 +0100)]
Accept follow-up fragments with a TLS message length

10 years agoAdded dummy/identity implementations of the different TLS record layers
Martin Willi [Fri, 22 Jan 2010 16:24:17 +0000 (17:24 +0100)]
Added dummy/identity implementations of the different TLS record layers

10 years agoPass TLS records to newly introduced TLS stack
Martin Willi [Fri, 22 Jan 2010 14:35:29 +0000 (15:35 +0100)]
Pass TLS records to newly introduced TLS stack

10 years agoAdded some TLS constants
Martin Willi [Thu, 21 Jan 2010 14:11:38 +0000 (15:11 +0100)]
Added some TLS constants

10 years ago(De-)fragment EAP-TLS packets, pass TLS records to upper layer
Martin Willi [Thu, 21 Jan 2010 13:39:39 +0000 (14:39 +0100)]
(De-)fragment EAP-TLS packets, pass TLS records to upper layer

10 years agoAdded EAP-TLS plugin stub
Martin Willi [Mon, 11 Jan 2010 13:21:58 +0000 (14:21 +0100)]
Added EAP-TLS plugin stub

10 years agoDo not touch child from collision if peer deleted it
Thomas Egerer [Mon, 2 Aug 2010 14:46:29 +0000 (16:46 +0200)]
Do not touch child from collision if peer deleted it

10 years agosubstitute obsolete function calls(bzero/index)
Waldemar Brodkorb [Sun, 1 Aug 2010 19:20:15 +0000 (21:20 +0200)]
substitute obsolete function calls(bzero/index)

10 years agodelete tarball files
Andreas Steffen [Fri, 30 Jul 2010 20:27:41 +0000 (22:27 +0200)]
delete tarball files

10 years agoversion bump to 4.4.2
Andreas Steffen [Fri, 30 Jul 2010 20:26:14 +0000 (22:26 +0200)]
version bump to 4.4.2

10 years agoThe va_list trick does not seem to be portable, revert dots-in-section fix 4.4.1
Martin Willi [Fri, 30 Jul 2010 08:57:59 +0000 (10:57 +0200)]
The va_list trick does not seem to be portable, revert dots-in-section fix

This reverts commit 8f50d06c354cd31fc295afc5598afff4096b5e77.

10 years agoFix segfault on 'ipsec stroke up ]' command
Thomas Egerer [Thu, 29 Jul 2010 11:03:01 +0000 (13:03 +0200)]
Fix segfault on 'ipsec stroke up ]' command

10 years agoFixed settings lookup if the section/key contains dots
Martin Willi [Thu, 29 Jul 2010 10:00:21 +0000 (12:00 +0200)]
Fixed settings lookup if the section/key contains dots

10 years agoAdded NEWS for snprintf() fixes
Martin Willi [Wed, 28 Jul 2010 09:06:49 +0000 (11:06 +0200)]
Added NEWS for snprintf() fixes

10 years agoFix use of snprintf() in pluto subjectAltName enumeration
Martin Willi [Fri, 18 Jun 2010 07:15:45 +0000 (09:15 +0200)]
Fix use of snprintf() in pluto subjectAltName enumeration

10 years agoFix use of snprintf() in IETF attributes to string conversion
Martin Willi [Fri, 18 Jun 2010 07:18:49 +0000 (09:18 +0200)]
Fix use of snprintf() in IETF attributes to string conversion

10 years agoFix use of snprintf() in identification DN to ASCII conversion
Martin Willi [Fri, 18 Jun 2010 07:18:27 +0000 (09:18 +0200)]
Fix use of snprintf() in identification DN to ASCII conversion

10 years agoMore NEWS for HA functionality
Martin Willi [Wed, 28 Jul 2010 08:49:58 +0000 (10:49 +0200)]
More NEWS for HA functionality

10 years agoImplemented a HA enabled in-memory address pool
Martin Willi [Wed, 28 Jul 2010 07:51:41 +0000 (09:51 +0200)]
Implemented a HA enabled in-memory address pool

10 years agoAdded a function to segmentate a generic integer
Martin Willi [Wed, 28 Jul 2010 07:43:53 +0000 (09:43 +0200)]
Added a function to segmentate a generic integer

10 years agoadded NETMAP rules for the reverse direction
Andreas Steffen [Tue, 27 Jul 2010 19:16:44 +0000 (21:16 +0200)]
added NETMAP rules for the reverse direction

10 years agofixed description of ikev2/net2net-same-nets scenario
Andreas Steffen [Tue, 27 Jul 2010 18:49:48 +0000 (20:49 +0200)]
fixed description of ikev2/net2net-same-nets scenario

10 years agoReserving does not work, as our pools do not support acquiring arbitrary addresses
Martin Willi [Tue, 27 Jul 2010 10:05:39 +0000 (12:05 +0200)]
Reserving does not work, as our pools do not support acquiring arbitrary addresses

This reverts commit d1384080b3ba74f366eaf8b5f027babca3f5d607.

10 years agoMem pool does not support multiple leases for an identity
Martin Willi [Tue, 27 Jul 2010 07:54:27 +0000 (09:54 +0200)]
Mem pool does not support multiple leases for an identity

10 years agoFlush any remaining cache state if an IKE_SA goes down
Martin Willi [Tue, 27 Jul 2010 07:18:06 +0000 (09:18 +0200)]
Flush any remaining cache state if an IKE_SA goes down

10 years agoAdded NEWS related to HA functionality
Martin Willi [Mon, 26 Jul 2010 13:17:19 +0000 (15:17 +0200)]
Added NEWS related to HA functionality

10 years agoSynchronize EAP-Identity of remote peer
Martin Willi [Mon, 26 Jul 2010 13:10:54 +0000 (15:10 +0200)]
Synchronize EAP-Identity of remote peer

10 years agoReserve virtual IP of passive IKE_SAs in the local pool
Martin Willi [Mon, 26 Jul 2010 13:01:24 +0000 (15:01 +0200)]
Reserve virtual IP of passive IKE_SAs in the local pool

10 years agoAdded strongswan.conf options for HA heartbeat
Martin Willi [Mon, 26 Jul 2010 12:30:19 +0000 (14:30 +0200)]
Added strongswan.conf options for HA heartbeat

10 years agoLog CHILD_SA segment responsibility
Martin Willi [Mon, 26 Jul 2010 11:49:35 +0000 (13:49 +0200)]
Log CHILD_SA segment responsibility

10 years agoPass initiator parameter to distinguish between original and exchange initiator
Martin Willi [Mon, 26 Jul 2010 10:07:38 +0000 (12:07 +0200)]
Pass initiator parameter to distinguish between original and exchange initiator

10 years agoPass the CREATE_CHILD_SA initiator flag to the child_keys parameter
Martin Willi [Mon, 26 Jul 2010 10:05:04 +0000 (12:05 +0200)]
Pass the CREATE_CHILD_SA initiator flag to the child_keys parameter

10 years agoUse a sync message cache to resynchronize IKE_SAs without rekeying
Martin Willi [Thu, 22 Jul 2010 16:54:35 +0000 (18:54 +0200)]
Use a sync message cache to resynchronize IKE_SAs without rekeying

10 years agoLog received HA message types
Martin Willi [Thu, 22 Jul 2010 13:56:11 +0000 (15:56 +0200)]
Log received HA message types

10 years agoAdd enum names for HA message types
Martin Willi [Thu, 22 Jul 2010 13:55:08 +0000 (15:55 +0200)]
Add enum names for HA message types

10 years agoDelay resynchronization request until starter has loaded the configurations
Martin Willi [Thu, 22 Jul 2010 13:52:18 +0000 (13:52 +0000)]
Delay resynchronization request until starter has loaded the configurations

10 years agoReplaces in_segment() by a more generic get_segment() function
Martin Willi [Thu, 22 Jul 2010 12:38:05 +0000 (14:38 +0200)]
Replaces in_segment() by a more generic get_segment() function