strongswan.git
9 years agoUse a 301 permanent redirect if no controller given
Martin Willi [Mon, 26 Apr 2010 07:41:10 +0000 (09:41 +0200)]
Use a 301 permanent redirect if no controller given

9 years agoadded ikev1/alg-esp-aes-gmac scenario
Andreas Steffen [Tue, 27 Apr 2010 11:48:37 +0000 (13:48 +0200)]
added ikev1/alg-esp-aes-gmac scenario

9 years agoadded AES_GMAC output string
Andreas Steffen [Tue, 27 Apr 2010 11:47:11 +0000 (13:47 +0200)]
added AES_GMAC output string

9 years agoadded ikev2/alg-esp-aes-gmac scenario
Andreas Steffen [Tue, 27 Apr 2010 11:13:10 +0000 (13:13 +0200)]
added ikev2/alg-esp-aes-gmac scenario

9 years agoadded ikev1/alg-modp-subgroup scenario
Andreas Steffen [Fri, 23 Apr 2010 13:23:54 +0000 (15:23 +0200)]
added ikev1/alg-modp-subgroup scenario

9 years agoadded ikev2/alg-modp-subgroup scenario
Andreas Steffen [Fri, 23 Apr 2010 13:03:16 +0000 (15:03 +0200)]
added ikev2/alg-modp-subgroup scenario

9 years agoinclude dhcp-client-identifier in the DHCP request
Andreas Steffen [Fri, 23 Apr 2010 10:57:43 +0000 (12:57 +0200)]
include dhcp-client-identifier in the DHCP request

9 years agoadded ikev2/dhcp-static-client-id scenario
Andreas Steffen [Fri, 23 Apr 2010 10:56:59 +0000 (12:56 +0200)]
added ikev2/dhcp-static-client-id scenario

9 years agofixed optional dnsmasq.conf in the ikev2/dhcp-static-mac scenario
Andreas Steffen [Fri, 23 Apr 2010 10:38:30 +0000 (12:38 +0200)]
fixed optional dnsmasq.conf in the ikev2/dhcp-static-mac scenario

9 years agoadded ikev2/dhcp-static-mac scenario
Andreas Steffen [Fri, 23 Apr 2010 10:33:11 +0000 (12:33 +0200)]
added ikev2/dhcp-static-mac scenario

9 years agoadded ikev2/dhcp-dynamic scenario
Andreas Steffen [Fri, 23 Apr 2010 09:52:37 +0000 (11:52 +0200)]
added ikev2/dhcp-dynamic scenario

9 years agomake DHCP debug messages consistent
Andreas Steffen [Fri, 23 Apr 2010 05:37:16 +0000 (07:37 +0200)]
make DHCP debug messages consistent

9 years agofixed typo
Andreas Steffen [Thu, 22 Apr 2010 22:02:13 +0000 (00:02 +0200)]
fixed typo

9 years agoIgnore DH exchange in CHILD_SA rekeying if the selected proposal contains no DH group
Martin Willi [Wed, 21 Apr 2010 06:40:55 +0000 (08:40 +0200)]
Ignore DH exchange in CHILD_SA rekeying if the selected proposal contains no DH group

9 years agofixed segfault in pluto with multiple ISAKMP SAs in delete payload
Heiko Hund [Tue, 20 Apr 2010 19:22:50 +0000 (21:22 +0200)]
fixed segfault in pluto with multiple ISAKMP SAs in delete payload

9 years agoAdded support for DH groups 22, 23 and 24, patch contributed by Joy Latten
Martin Willi [Mon, 19 Apr 2010 12:41:20 +0000 (14:41 +0200)]
Added support for DH groups 22, 23 and 24, patch contributed by Joy Latten

9 years agoAccept DHCP replies on bootps port, as we act as a relay agent if server address...
Martin Willi [Mon, 19 Apr 2010 09:16:36 +0000 (11:16 +0200)]
Accept DHCP replies on bootps port, as we act as a relay agent if server address configured

9 years agoIntegrating libhydra into the Android build system.
Tobias Brunner [Mon, 12 Apr 2010 14:47:47 +0000 (16:47 +0200)]
Integrating libhydra into the Android build system.

9 years agoUse openssl in Android by default.
Tobias Brunner [Mon, 12 Apr 2010 13:54:48 +0000 (15:54 +0200)]
Use openssl in Android by default.

9 years agoWhen logging to the database, the IDs of an IKE SA are initially NULL.
Tobias Brunner [Mon, 12 Apr 2010 11:51:10 +0000 (13:51 +0200)]
When logging to the database, the IDs of an IKE SA are initially NULL.

9 years agofixed silly bug
Andreas Steffen [Mon, 12 Apr 2010 09:25:46 +0000 (11:25 +0200)]
fixed silly bug

9 years agoupdated DER versions of research and sales CAs
Andreas Steffen [Sun, 11 Apr 2010 20:00:01 +0000 (22:00 +0200)]
updated DER versions of research and sales CAs

9 years agoimplemented inheritance of virtual IP assigned by Mode Config on the responder side
Andreas Steffen [Sun, 11 Apr 2010 17:19:20 +0000 (19:19 +0200)]
implemented inheritance of virtual IP assigned by Mode Config on the responder side

9 years agoadded ikev1/ip-two-pools-mixed scenario
Andreas Steffen [Sun, 11 Apr 2010 15:05:42 +0000 (17:05 +0200)]
added ikev1/ip-two-pools-mixed scenario

9 years agoadded support of RAM-based pools to NEWS
Andreas Steffen [Sun, 11 Apr 2010 14:29:39 +0000 (16:29 +0200)]
added support of RAM-based pools to NEWS

9 years agoIKEv1 uses Mode Config payload
Andreas Steffen [Sun, 11 Apr 2010 14:09:09 +0000 (16:09 +0200)]
IKEv1 uses Mode Config payload

9 years agoadded ikev1/ip-two-pools scenario
Andreas Steffen [Sun, 11 Apr 2010 14:05:54 +0000 (16:05 +0200)]
added ikev1/ip-two-pools scenario

9 years agoremove virtual interfaces after scenario
Andreas Steffen [Sun, 11 Apr 2010 14:05:04 +0000 (16:05 +0200)]
remove virtual interfaces after scenario

9 years agoadded ikev1/ip-pool scenario
Andreas Steffen [Sun, 11 Apr 2010 12:40:04 +0000 (14:40 +0200)]
added ikev1/ip-pool scenario

9 years agoshow in-memory pools in ipsec statusall
Andreas Steffen [Sun, 11 Apr 2010 09:46:47 +0000 (11:46 +0200)]
show in-memory pools in ipsec statusall

9 years agoadded missing curly brackets
Andreas Steffen [Sat, 10 Apr 2010 22:49:04 +0000 (00:49 +0200)]
added missing curly brackets

9 years agosupport in-memory pools in swapped connection definitions
Andreas Steffen [Sat, 10 Apr 2010 22:26:49 +0000 (00:26 +0200)]
support in-memory pools in swapped connection definitions

9 years agoFixed OpenSSL engine_id setting, i.e. do not use 'library.' prefix for settings in...
Tobias Brunner [Sat, 10 Apr 2010 10:10:04 +0000 (12:10 +0200)]
Fixed OpenSSL engine_id setting, i.e. do not use 'library.' prefix for settings in libstrongswan.

9 years agopluto now requires attr plugin for dns and nbns server loading from strongswan.conf
Andreas Steffen [Fri, 9 Apr 2010 19:03:32 +0000 (21:03 +0200)]
pluto now requires attr plugin for dns and nbns server loading from strongswan.conf

9 years agoStore DH generator in a chunk, hide non-public data in a private struct
Martin Willi [Thu, 8 Apr 2010 13:08:35 +0000 (15:08 +0200)]
Store DH generator in a chunk, hide non-public data in a private struct

9 years agorecovered private keys of no CDP certificates
Andreas Steffen [Wed, 7 Apr 2010 17:37:53 +0000 (19:37 +0200)]
recovered private keys of no CDP certificates

9 years agorecovered lost Duck CA certificates
Andreas Steffen [Wed, 7 Apr 2010 17:30:33 +0000 (19:30 +0200)]
recovered lost Duck CA certificates

9 years agoMigrated scepclient/openac logging hooks to new signature
Martin Willi [Wed, 7 Apr 2010 13:51:55 +0000 (15:51 +0200)]
Migrated scepclient/openac logging hooks to new signature

9 years agoRemove to_referer() method, as it fails if no referer was given
Martin Willi [Wed, 7 Apr 2010 13:36:22 +0000 (15:36 +0200)]
Remove to_referer() method, as it fails if no referer was given

9 years agoRenamed clone function to avoid name clash with uclibc
Martin Willi [Wed, 7 Apr 2010 12:54:22 +0000 (14:54 +0200)]
Renamed clone function to avoid name clash with uclibc

9 years agoNEWS about HA plugin
Martin Willi [Wed, 7 Apr 2010 12:16:52 +0000 (14:16 +0200)]
NEWS about HA plugin

9 years agoUpdated HA plugin to new APIs
Martin Willi [Mon, 22 Mar 2010 10:25:27 +0000 (10:25 +0000)]
Updated HA plugin to new APIs

9 years agoUpdated location of traffic selector header
Martin Willi [Fri, 19 Mar 2010 18:06:53 +0000 (19:06 +0100)]
Updated location of traffic selector header

9 years agoMoved ha plugin to libcharon
Martin Willi [Fri, 19 Mar 2010 18:03:46 +0000 (19:03 +0100)]
Moved ha plugin to libcharon

9 years agoMake resync/monitoring functionality optional
Martin Willi [Wed, 30 Sep 2009 14:23:58 +0000 (16:23 +0200)]
Make resync/monitoring functionality optional

9 years agoListen to ike_updown/rekey hook instead of ike_state_change
Martin Willi [Wed, 30 Sep 2009 09:48:15 +0000 (11:48 +0200)]
Listen to ike_updown/rekey hook instead of ike_state_change

9 years agoRequest a complete resync after daemon startup
Martin Willi [Wed, 30 Sep 2009 09:04:22 +0000 (11:04 +0200)]
Request a complete resync after daemon startup

9 years agoDo not automatically take over segments, as we need to resync first
Martin Willi [Wed, 30 Sep 2009 08:36:27 +0000 (10:36 +0200)]
Do not automatically take over segments, as we need to resync first

9 years agoDrop overlapping segments only if we have no active SAs on it
Martin Willi [Tue, 29 Sep 2009 14:40:58 +0000 (16:40 +0200)]
Drop overlapping segments only if we have no active SAs on it

9 years agoDo not install iptables rules, they should stay active after shutdown
Martin Willi [Tue, 29 Sep 2009 14:05:46 +0000 (16:05 +0200)]
Do not install iptables rules, they should stay active after shutdown

9 years agoTake over all segments if heartbeat becomes silent
Martin Willi [Tue, 29 Sep 2009 14:04:51 +0000 (16:04 +0200)]
Take over all segments if heartbeat becomes silent

9 years agoRenamed ha-sync plugin to ha
Martin Willi [Tue, 29 Sep 2009 10:56:10 +0000 (12:56 +0200)]
Renamed ha-sync plugin to ha

9 years agoTry to send HA sync messages synchronously
Martin Willi [Tue, 29 Sep 2009 09:31:24 +0000 (11:31 +0200)]
Try to send HA sync messages synchronously

9 years agoDo not sync a delete for a child in a destroying IKE_SA
Martin Willi [Tue, 29 Sep 2009 09:30:44 +0000 (11:30 +0200)]
Do not sync a delete for a child in a destroying IKE_SA

9 years agoInclude ICMP traffic in sync tunnel
Martin Willi [Tue, 29 Sep 2009 08:43:47 +0000 (10:43 +0200)]
Include ICMP traffic in sync tunnel

9 years agoRefactored segment enabling/disabling
Martin Willi [Tue, 29 Sep 2009 08:34:04 +0000 (10:34 +0200)]
Refactored segment enabling/disabling

9 years agoUse a connected UDP socket
Martin Willi [Tue, 29 Sep 2009 06:53:58 +0000 (08:53 +0200)]
Use a connected UDP socket

9 years agoRemoved obsolete socket subclasses
Martin Willi [Mon, 28 Sep 2009 12:49:16 +0000 (14:49 +0200)]
Removed obsolete socket subclasses

9 years agoAutomatically segment cluster using periodically sent status messages
Martin Willi [Mon, 28 Sep 2009 12:31:39 +0000 (14:31 +0200)]
Automatically segment cluster using periodically sent status messages

9 years agoDo not enable/disable our own sync tunnel
Martin Willi [Wed, 23 Sep 2009 12:04:32 +0000 (14:04 +0200)]
Do not enable/disable our own sync tunnel

9 years agoEnable/disable inactive/active segments only
Martin Willi [Wed, 23 Sep 2009 08:42:05 +0000 (10:42 +0200)]
Enable/disable inactive/active segments only

9 years agoDeactivate all active segments before shutting down
Martin Willi [Tue, 22 Sep 2009 15:10:25 +0000 (17:10 +0200)]
Deactivate all active segments before shutting down

9 years agoHA kernel interface can mangle netfilter rules, currently with iptables invocation
Martin Willi [Tue, 22 Sep 2009 14:51:47 +0000 (16:51 +0200)]
HA kernel interface can mangle netfilter rules, currently with iptables invocation

9 years agoAdded support for kernel segment manipulation
Martin Willi [Tue, 22 Sep 2009 13:19:43 +0000 (15:19 +0200)]
Added support for kernel segment manipulation

9 years agoMoved segment configuration parsing to ha_sync_plugin
Martin Willi [Tue, 22 Sep 2009 12:53:03 +0000 (14:53 +0200)]
Moved segment configuration parsing to ha_sync_plugin

9 years agoPropagate segment manipulation to cluster node
Martin Willi [Tue, 22 Sep 2009 12:33:38 +0000 (14:33 +0200)]
Propagate segment manipulation to cluster node

9 years agoSegment manipulation in HA sync is thread save
Martin Willi [Tue, 22 Sep 2009 12:32:52 +0000 (14:32 +0200)]
Segment manipulation in HA sync is thread save

9 years agoPassing 0 to segments->(de-)activate enables/disables all segments
Martin Willi [Tue, 15 Sep 2009 14:19:39 +0000 (16:19 +0200)]
Passing 0 to segments->(de-)activate enables/disables all segments

9 years agoseparated auto-tunnel functionality from socket
Martin Willi [Tue, 15 Sep 2009 12:52:56 +0000 (14:52 +0200)]
separated auto-tunnel functionality from socket

9 years agocreate external fifo socket only if "fifo_interface" option is set
Martin Willi [Tue, 15 Sep 2009 11:53:06 +0000 (13:53 +0200)]
create external fifo socket only if "fifo_interface" option is set

9 years agoupdated linuxdir include variable
Martin Willi [Thu, 10 Sep 2009 12:51:12 +0000 (14:51 +0200)]
updated linuxdir include variable

9 years agoupdated HA sync plugin to new lifetime config
Martin Willi [Thu, 10 Sep 2009 12:42:17 +0000 (14:42 +0200)]
updated HA sync plugin to new lifetime config

9 years agoprint "none" if not serving any segments
Martin Willi [Thu, 25 Jun 2009 09:24:18 +0000 (11:24 +0200)]
print "none" if not serving any segments

9 years agoautomatically establish a PSK authenticated SA between cluster nodes
Martin Willi [Wed, 3 Jun 2009 15:06:33 +0000 (17:06 +0200)]
automatically establish a PSK authenticated SA between cluster nodes

9 years agofixed memleak when installing synced virtual IPs
Martin Willi [Fri, 29 May 2009 09:02:47 +0000 (11:02 +0200)]
fixed memleak when installing synced virtual IPs

9 years agodo not sync CHILD_SAs without an IKE_SA
Martin Willi [Tue, 26 May 2009 18:36:39 +0000 (20:36 +0200)]
do not sync CHILD_SAs without an IKE_SA

9 years agoremoved $Id$ from ha plugin
Martin Willi [Thu, 30 Apr 2009 15:00:08 +0000 (17:00 +0200)]
removed $Id$ from ha plugin

9 years agofixed ike_sa condition/extension parsing
Martin Willi [Fri, 17 Apr 2009 07:43:43 +0000 (07:43 +0000)]
fixed ike_sa condition/extension parsing

9 years agoadded a copy of the linux jenkins hash to dist
Martin Willi [Tue, 2 Dec 2008 15:35:11 +0000 (15:35 +0000)]
added a copy of the linux jenkins hash to dist

9 years agofixed sync of CHILD_SA delete
Martin Willi [Tue, 2 Dec 2008 15:33:01 +0000 (15:33 +0000)]
fixed sync of CHILD_SA delete

9 years agoadded HA resync option to (re-)integrate nodes to a cluster
Martin Willi [Mon, 1 Dec 2008 18:38:40 +0000 (18:38 +0000)]
added HA resync option to (re-)integrate nodes to a cluster

9 years agoapply peer config during rekeying
Martin Willi [Fri, 28 Nov 2008 16:40:16 +0000 (16:40 +0000)]
apply peer config during rekeying

9 years agomanage synced SAs in IKE_SA Manager, tag them with IKE_PASSIVE state
Martin Willi [Fri, 28 Nov 2008 15:45:17 +0000 (15:45 +0000)]
manage synced SAs in IKE_SA Manager, tag them with IKE_PASSIVE state

9 years agosupport for IKE_SA rekeying sync
Martin Willi [Fri, 28 Nov 2008 10:32:09 +0000 (10:32 +0000)]
support for IKE_SA rekeying sync

9 years agoIKE_SA activation/deactivation magic using a fifo socket
Martin Willi [Thu, 27 Nov 2008 09:57:31 +0000 (09:57 +0000)]
IKE_SA activation/deactivation magic using a fifo socket

9 years agosyncing of complete IKE/CHILD_SAs works
Martin Willi [Thu, 20 Nov 2008 08:51:54 +0000 (08:51 +0000)]
syncing of complete IKE/CHILD_SAs works

9 years agopushing basic CHILD_SA sync data to backup node
Martin Willi [Tue, 18 Nov 2008 15:21:10 +0000 (15:21 +0000)]
pushing basic CHILD_SA sync data to backup node

9 years agobasic syncing of IKE_SAs
Martin Willi [Mon, 17 Nov 2008 15:58:39 +0000 (15:58 +0000)]
basic syncing of IKE_SAs
recreating SAs with keymat derivation

9 years agoadded a dispatcher class to receive HA sync messages
Martin Willi [Thu, 13 Nov 2008 16:01:06 +0000 (16:01 +0000)]
added a dispatcher class to receive HA sync messages
simple attribute parser enumerator (probably needs a cleaner implementation)

9 years agogenerating basic IKE_SA sync messages
Martin Willi [Thu, 13 Nov 2008 12:46:01 +0000 (12:46 +0000)]
generating basic IKE_SA sync messages
pushing to statically configured failover node

9 years agoset up basic infrastructure ha_sync plugin
Martin Willi [Wed, 12 Nov 2008 13:28:18 +0000 (13:28 +0000)]
set up basic infrastructure ha_sync plugin

9 years agoadded child_sa serialization to ha_sync plugin
Martin Willi [Fri, 24 Oct 2008 12:42:06 +0000 (12:42 +0000)]
added child_sa serialization to ha_sync plugin

9 years agoHA sync plugin stub
Martin Willi [Fri, 24 Oct 2008 08:06:22 +0000 (08:06 +0000)]
HA sync plugin stub

9 years agofixed ikev1/protoport-route timing
Andreas Steffen [Wed, 7 Apr 2010 11:24:58 +0000 (13:24 +0200)]
fixed ikev1/protoport-route timing

9 years agoremoved whitespace
Andreas Steffen [Wed, 7 Apr 2010 11:07:11 +0000 (13:07 +0200)]
removed whitespace

9 years agogenerated new research and sales CA certs for carol and dave, respectively
Andreas Steffen [Wed, 7 Apr 2010 11:04:56 +0000 (13:04 +0200)]
generated new research and sales CA certs for carol and dave, respectively

9 years agoSome whitespace fixes.
Tobias Brunner [Tue, 6 Apr 2010 10:56:06 +0000 (12:56 +0200)]
Some whitespace fixes.

9 years agoExplicitly unload plugins before deinitializing libhydra and libstrongswan in pluto.
Tobias Brunner [Tue, 6 Apr 2010 10:44:15 +0000 (12:44 +0200)]
Explicitly unload plugins before deinitializing libhydra and libstrongswan in pluto.

9 years agoReplaced some DBG_LIB with more specific groups.
Tobias Brunner [Wed, 31 Mar 2010 15:39:02 +0000 (17:39 +0200)]
Replaced some DBG_LIB with more specific groups.

9 years agoAdding DBG_LIB to all calls of libstrongswan's version of DBG*.
Tobias Brunner [Wed, 31 Mar 2010 15:28:46 +0000 (17:28 +0200)]
Adding DBG_LIB to all calls of libstrongswan's version of DBG*.