strongswan.git
10 years agoremove virtual interfaces after scenario
Andreas Steffen [Sun, 11 Apr 2010 14:05:04 +0000 (16:05 +0200)]
remove virtual interfaces after scenario

10 years agoadded ikev1/ip-pool scenario
Andreas Steffen [Sun, 11 Apr 2010 12:40:04 +0000 (14:40 +0200)]
added ikev1/ip-pool scenario

10 years agoshow in-memory pools in ipsec statusall
Andreas Steffen [Sun, 11 Apr 2010 09:46:47 +0000 (11:46 +0200)]
show in-memory pools in ipsec statusall

10 years agoadded missing curly brackets
Andreas Steffen [Sat, 10 Apr 2010 22:49:04 +0000 (00:49 +0200)]
added missing curly brackets

10 years agosupport in-memory pools in swapped connection definitions
Andreas Steffen [Sat, 10 Apr 2010 22:26:49 +0000 (00:26 +0200)]
support in-memory pools in swapped connection definitions

10 years agoFixed OpenSSL engine_id setting, i.e. do not use 'library.' prefix for settings in...
Tobias Brunner [Sat, 10 Apr 2010 10:10:04 +0000 (12:10 +0200)]
Fixed OpenSSL engine_id setting, i.e. do not use 'library.' prefix for settings in libstrongswan.

10 years agopluto now requires attr plugin for dns and nbns server loading from strongswan.conf
Andreas Steffen [Fri, 9 Apr 2010 19:03:32 +0000 (21:03 +0200)]
pluto now requires attr plugin for dns and nbns server loading from strongswan.conf

10 years agoStore DH generator in a chunk, hide non-public data in a private struct
Martin Willi [Thu, 8 Apr 2010 13:08:35 +0000 (15:08 +0200)]
Store DH generator in a chunk, hide non-public data in a private struct

10 years agorecovered private keys of no CDP certificates
Andreas Steffen [Wed, 7 Apr 2010 17:37:53 +0000 (19:37 +0200)]
recovered private keys of no CDP certificates

10 years agorecovered lost Duck CA certificates
Andreas Steffen [Wed, 7 Apr 2010 17:30:33 +0000 (19:30 +0200)]
recovered lost Duck CA certificates

10 years agoMigrated scepclient/openac logging hooks to new signature
Martin Willi [Wed, 7 Apr 2010 13:51:55 +0000 (15:51 +0200)]
Migrated scepclient/openac logging hooks to new signature

10 years agoRemove to_referer() method, as it fails if no referer was given
Martin Willi [Wed, 7 Apr 2010 13:36:22 +0000 (15:36 +0200)]
Remove to_referer() method, as it fails if no referer was given

10 years agoRenamed clone function to avoid name clash with uclibc
Martin Willi [Wed, 7 Apr 2010 12:54:22 +0000 (14:54 +0200)]
Renamed clone function to avoid name clash with uclibc

10 years agoNEWS about HA plugin
Martin Willi [Wed, 7 Apr 2010 12:16:52 +0000 (14:16 +0200)]
NEWS about HA plugin

10 years agoUpdated HA plugin to new APIs
Martin Willi [Mon, 22 Mar 2010 10:25:27 +0000 (10:25 +0000)]
Updated HA plugin to new APIs

10 years agoUpdated location of traffic selector header
Martin Willi [Fri, 19 Mar 2010 18:06:53 +0000 (19:06 +0100)]
Updated location of traffic selector header

10 years agoMoved ha plugin to libcharon
Martin Willi [Fri, 19 Mar 2010 18:03:46 +0000 (19:03 +0100)]
Moved ha plugin to libcharon

10 years agoMake resync/monitoring functionality optional
Martin Willi [Wed, 30 Sep 2009 14:23:58 +0000 (16:23 +0200)]
Make resync/monitoring functionality optional

10 years agoListen to ike_updown/rekey hook instead of ike_state_change
Martin Willi [Wed, 30 Sep 2009 09:48:15 +0000 (11:48 +0200)]
Listen to ike_updown/rekey hook instead of ike_state_change

10 years agoRequest a complete resync after daemon startup
Martin Willi [Wed, 30 Sep 2009 09:04:22 +0000 (11:04 +0200)]
Request a complete resync after daemon startup

10 years agoDo not automatically take over segments, as we need to resync first
Martin Willi [Wed, 30 Sep 2009 08:36:27 +0000 (10:36 +0200)]
Do not automatically take over segments, as we need to resync first

10 years agoDrop overlapping segments only if we have no active SAs on it
Martin Willi [Tue, 29 Sep 2009 14:40:58 +0000 (16:40 +0200)]
Drop overlapping segments only if we have no active SAs on it

10 years agoDo not install iptables rules, they should stay active after shutdown
Martin Willi [Tue, 29 Sep 2009 14:05:46 +0000 (16:05 +0200)]
Do not install iptables rules, they should stay active after shutdown

10 years agoTake over all segments if heartbeat becomes silent
Martin Willi [Tue, 29 Sep 2009 14:04:51 +0000 (16:04 +0200)]
Take over all segments if heartbeat becomes silent

10 years agoRenamed ha-sync plugin to ha
Martin Willi [Tue, 29 Sep 2009 10:56:10 +0000 (12:56 +0200)]
Renamed ha-sync plugin to ha

10 years agoTry to send HA sync messages synchronously
Martin Willi [Tue, 29 Sep 2009 09:31:24 +0000 (11:31 +0200)]
Try to send HA sync messages synchronously

10 years agoDo not sync a delete for a child in a destroying IKE_SA
Martin Willi [Tue, 29 Sep 2009 09:30:44 +0000 (11:30 +0200)]
Do not sync a delete for a child in a destroying IKE_SA

10 years agoInclude ICMP traffic in sync tunnel
Martin Willi [Tue, 29 Sep 2009 08:43:47 +0000 (10:43 +0200)]
Include ICMP traffic in sync tunnel

10 years agoRefactored segment enabling/disabling
Martin Willi [Tue, 29 Sep 2009 08:34:04 +0000 (10:34 +0200)]
Refactored segment enabling/disabling

10 years agoUse a connected UDP socket
Martin Willi [Tue, 29 Sep 2009 06:53:58 +0000 (08:53 +0200)]
Use a connected UDP socket

10 years agoRemoved obsolete socket subclasses
Martin Willi [Mon, 28 Sep 2009 12:49:16 +0000 (14:49 +0200)]
Removed obsolete socket subclasses

10 years agoAutomatically segment cluster using periodically sent status messages
Martin Willi [Mon, 28 Sep 2009 12:31:39 +0000 (14:31 +0200)]
Automatically segment cluster using periodically sent status messages

10 years agoDo not enable/disable our own sync tunnel
Martin Willi [Wed, 23 Sep 2009 12:04:32 +0000 (14:04 +0200)]
Do not enable/disable our own sync tunnel

10 years agoEnable/disable inactive/active segments only
Martin Willi [Wed, 23 Sep 2009 08:42:05 +0000 (10:42 +0200)]
Enable/disable inactive/active segments only

10 years agoDeactivate all active segments before shutting down
Martin Willi [Tue, 22 Sep 2009 15:10:25 +0000 (17:10 +0200)]
Deactivate all active segments before shutting down

10 years agoHA kernel interface can mangle netfilter rules, currently with iptables invocation
Martin Willi [Tue, 22 Sep 2009 14:51:47 +0000 (16:51 +0200)]
HA kernel interface can mangle netfilter rules, currently with iptables invocation

10 years agoAdded support for kernel segment manipulation
Martin Willi [Tue, 22 Sep 2009 13:19:43 +0000 (15:19 +0200)]
Added support for kernel segment manipulation

10 years agoMoved segment configuration parsing to ha_sync_plugin
Martin Willi [Tue, 22 Sep 2009 12:53:03 +0000 (14:53 +0200)]
Moved segment configuration parsing to ha_sync_plugin

10 years agoPropagate segment manipulation to cluster node
Martin Willi [Tue, 22 Sep 2009 12:33:38 +0000 (14:33 +0200)]
Propagate segment manipulation to cluster node

10 years agoSegment manipulation in HA sync is thread save
Martin Willi [Tue, 22 Sep 2009 12:32:52 +0000 (14:32 +0200)]
Segment manipulation in HA sync is thread save

10 years agoPassing 0 to segments->(de-)activate enables/disables all segments
Martin Willi [Tue, 15 Sep 2009 14:19:39 +0000 (16:19 +0200)]
Passing 0 to segments->(de-)activate enables/disables all segments

10 years agoseparated auto-tunnel functionality from socket
Martin Willi [Tue, 15 Sep 2009 12:52:56 +0000 (14:52 +0200)]
separated auto-tunnel functionality from socket

10 years agocreate external fifo socket only if "fifo_interface" option is set
Martin Willi [Tue, 15 Sep 2009 11:53:06 +0000 (13:53 +0200)]
create external fifo socket only if "fifo_interface" option is set

10 years agoupdated linuxdir include variable
Martin Willi [Thu, 10 Sep 2009 12:51:12 +0000 (14:51 +0200)]
updated linuxdir include variable

10 years agoupdated HA sync plugin to new lifetime config
Martin Willi [Thu, 10 Sep 2009 12:42:17 +0000 (14:42 +0200)]
updated HA sync plugin to new lifetime config

10 years agoprint "none" if not serving any segments
Martin Willi [Thu, 25 Jun 2009 09:24:18 +0000 (11:24 +0200)]
print "none" if not serving any segments

10 years agoautomatically establish a PSK authenticated SA between cluster nodes
Martin Willi [Wed, 3 Jun 2009 15:06:33 +0000 (17:06 +0200)]
automatically establish a PSK authenticated SA between cluster nodes

10 years agofixed memleak when installing synced virtual IPs
Martin Willi [Fri, 29 May 2009 09:02:47 +0000 (11:02 +0200)]
fixed memleak when installing synced virtual IPs

10 years agodo not sync CHILD_SAs without an IKE_SA
Martin Willi [Tue, 26 May 2009 18:36:39 +0000 (20:36 +0200)]
do not sync CHILD_SAs without an IKE_SA

10 years agoremoved $Id$ from ha plugin
Martin Willi [Thu, 30 Apr 2009 15:00:08 +0000 (17:00 +0200)]
removed $Id$ from ha plugin

10 years agofixed ike_sa condition/extension parsing
Martin Willi [Fri, 17 Apr 2009 07:43:43 +0000 (07:43 +0000)]
fixed ike_sa condition/extension parsing

10 years agoadded a copy of the linux jenkins hash to dist
Martin Willi [Tue, 2 Dec 2008 15:35:11 +0000 (15:35 +0000)]
added a copy of the linux jenkins hash to dist

10 years agofixed sync of CHILD_SA delete
Martin Willi [Tue, 2 Dec 2008 15:33:01 +0000 (15:33 +0000)]
fixed sync of CHILD_SA delete

10 years agoadded HA resync option to (re-)integrate nodes to a cluster
Martin Willi [Mon, 1 Dec 2008 18:38:40 +0000 (18:38 +0000)]
added HA resync option to (re-)integrate nodes to a cluster

10 years agoapply peer config during rekeying
Martin Willi [Fri, 28 Nov 2008 16:40:16 +0000 (16:40 +0000)]
apply peer config during rekeying

10 years agomanage synced SAs in IKE_SA Manager, tag them with IKE_PASSIVE state
Martin Willi [Fri, 28 Nov 2008 15:45:17 +0000 (15:45 +0000)]
manage synced SAs in IKE_SA Manager, tag them with IKE_PASSIVE state

10 years agosupport for IKE_SA rekeying sync
Martin Willi [Fri, 28 Nov 2008 10:32:09 +0000 (10:32 +0000)]
support for IKE_SA rekeying sync

10 years agoIKE_SA activation/deactivation magic using a fifo socket
Martin Willi [Thu, 27 Nov 2008 09:57:31 +0000 (09:57 +0000)]
IKE_SA activation/deactivation magic using a fifo socket

10 years agosyncing of complete IKE/CHILD_SAs works
Martin Willi [Thu, 20 Nov 2008 08:51:54 +0000 (08:51 +0000)]
syncing of complete IKE/CHILD_SAs works

10 years agopushing basic CHILD_SA sync data to backup node
Martin Willi [Tue, 18 Nov 2008 15:21:10 +0000 (15:21 +0000)]
pushing basic CHILD_SA sync data to backup node

10 years agobasic syncing of IKE_SAs
Martin Willi [Mon, 17 Nov 2008 15:58:39 +0000 (15:58 +0000)]
basic syncing of IKE_SAs
recreating SAs with keymat derivation

10 years agoadded a dispatcher class to receive HA sync messages
Martin Willi [Thu, 13 Nov 2008 16:01:06 +0000 (16:01 +0000)]
added a dispatcher class to receive HA sync messages
simple attribute parser enumerator (probably needs a cleaner implementation)

10 years agogenerating basic IKE_SA sync messages
Martin Willi [Thu, 13 Nov 2008 12:46:01 +0000 (12:46 +0000)]
generating basic IKE_SA sync messages
pushing to statically configured failover node

10 years agoset up basic infrastructure ha_sync plugin
Martin Willi [Wed, 12 Nov 2008 13:28:18 +0000 (13:28 +0000)]
set up basic infrastructure ha_sync plugin

10 years agoadded child_sa serialization to ha_sync plugin
Martin Willi [Fri, 24 Oct 2008 12:42:06 +0000 (12:42 +0000)]
added child_sa serialization to ha_sync plugin

10 years agoHA sync plugin stub
Martin Willi [Fri, 24 Oct 2008 08:06:22 +0000 (08:06 +0000)]
HA sync plugin stub

10 years agofixed ikev1/protoport-route timing
Andreas Steffen [Wed, 7 Apr 2010 11:24:58 +0000 (13:24 +0200)]
fixed ikev1/protoport-route timing

10 years agoremoved whitespace
Andreas Steffen [Wed, 7 Apr 2010 11:07:11 +0000 (13:07 +0200)]
removed whitespace

10 years agogenerated new research and sales CA certs for carol and dave, respectively
Andreas Steffen [Wed, 7 Apr 2010 11:04:56 +0000 (13:04 +0200)]
generated new research and sales CA certs for carol and dave, respectively

10 years agoSome whitespace fixes.
Tobias Brunner [Tue, 6 Apr 2010 10:56:06 +0000 (12:56 +0200)]
Some whitespace fixes.

10 years agoExplicitly unload plugins before deinitializing libhydra and libstrongswan in pluto.
Tobias Brunner [Tue, 6 Apr 2010 10:44:15 +0000 (12:44 +0200)]
Explicitly unload plugins before deinitializing libhydra and libstrongswan in pluto.

10 years agoReplaced some DBG_LIB with more specific groups.
Tobias Brunner [Wed, 31 Mar 2010 15:39:02 +0000 (17:39 +0200)]
Replaced some DBG_LIB with more specific groups.

10 years agoAdding DBG_LIB to all calls of libstrongswan's version of DBG*.
Tobias Brunner [Wed, 31 Mar 2010 15:28:46 +0000 (17:28 +0200)]
Adding DBG_LIB to all calls of libstrongswan's version of DBG*.

10 years agoAdding support for debug groups in libstrongswan's logger.
Tobias Brunner [Wed, 31 Mar 2010 15:26:39 +0000 (17:26 +0200)]
Adding support for debug groups in libstrongswan's logger.

10 years agoMove debug groups from charon's bus.h to libstrongswan's debug.h.
Tobias Brunner [Wed, 31 Mar 2010 15:17:02 +0000 (17:17 +0200)]
Move debug groups from charon's bus.h to libstrongswan's debug.h.

10 years agoManually loading the pluto.(n)dns* settings is not needed anymore.
Tobias Brunner [Wed, 31 Mar 2010 12:10:53 +0000 (14:10 +0200)]
Manually loading the pluto.(n)dns* settings is not needed anymore.

10 years agoUse daemon-specific config for the attr plugin.
Tobias Brunner [Wed, 31 Mar 2010 12:10:19 +0000 (14:10 +0200)]
Use daemon-specific config for the attr plugin.

10 years agoMoved attr plugin from libcharon to libhydra.
Tobias Brunner [Wed, 31 Mar 2010 11:55:12 +0000 (13:55 +0200)]
Moved attr plugin from libcharon to libhydra.

10 years agoStore the name of the daemon that initialized libhydra to load daemon-specific settings.
Tobias Brunner [Wed, 31 Mar 2010 11:45:05 +0000 (13:45 +0200)]
Store the name of the daemon that initialized libhydra to load daemon-specific settings.

10 years agoAdded pluto/whack output to 'ipsec leases'.
Tobias Brunner [Wed, 31 Mar 2010 11:20:22 +0000 (13:20 +0200)]
Added pluto/whack output to 'ipsec leases'.

10 years agoAdded options to whack to query in-memory leases.
Tobias Brunner [Wed, 31 Mar 2010 11:10:11 +0000 (13:10 +0200)]
Added options to whack to query in-memory leases.

10 years agoAdded function to list the leases of the in-memory pools.
Tobias Brunner [Wed, 31 Mar 2010 11:09:07 +0000 (13:09 +0200)]
Added function to list the leases of the in-memory pools.

10 years agoDelete the in-memory IP address pools if a connection gets deleted.
Tobias Brunner [Wed, 31 Mar 2010 08:17:51 +0000 (10:17 +0200)]
Delete the in-memory IP address pools if a connection gets deleted.

This fixes ipsec reload.

10 years agoUse whack_attribute in pluto to provide in-memory IP address pools.
Tobias Brunner [Tue, 30 Mar 2010 17:10:05 +0000 (19:10 +0200)]
Use whack_attribute in pluto to provide in-memory IP address pools.

The pools are configured by setting rightsourceip in ipsec.conf to a
network in CIDR notation.

10 years agoAdding a whack_attribute class which manages in-memory pools in pluto and is very...
Tobias Brunner [Tue, 30 Mar 2010 17:13:45 +0000 (19:13 +0200)]
Adding a whack_attribute class which manages in-memory pools in pluto and is very similar to stroke_attribute.

10 years agoUse a read-write lock in stroke_attribute to increase concurrency.
Tobias Brunner [Fri, 26 Mar 2010 16:08:14 +0000 (17:08 +0100)]
Use a read-write lock in stroke_attribute to increase concurrency.

10 years agoMake in-memory pool thread-safe.
Tobias Brunner [Fri, 26 Mar 2010 15:59:33 +0000 (16:59 +0100)]
Make in-memory pool thread-safe.

10 years agoMigrated stroke_attribute_t to METHOD/INIT macros.
Tobias Brunner [Fri, 26 Mar 2010 15:02:24 +0000 (16:02 +0100)]
Migrated stroke_attribute_t to METHOD/INIT macros.

10 years agoExtracted in-memory IP address pool from stroke plugin to libhydra.
Tobias Brunner [Fri, 26 Mar 2010 14:49:34 +0000 (15:49 +0100)]
Extracted in-memory IP address pool from stroke plugin to libhydra.

10 years agoInvoke updown hook if IKE_SA delete is enforced in deleting state
Martin Willi [Tue, 6 Apr 2010 09:58:29 +0000 (09:58 +0000)]
Invoke updown hook if IKE_SA delete is enforced in deleting state

10 years agoprolonged Research and Sales CA certs
Andreas Steffen [Tue, 6 Apr 2010 10:05:39 +0000 (12:05 +0200)]
prolonged Research and Sales CA certs

10 years agowait one second before running evaluations
Andreas Steffen [Tue, 6 Apr 2010 08:55:59 +0000 (10:55 +0200)]
wait one second before running evaluations

10 years agoincrease UML root file system to 700 MB
Andreas Steffen [Mon, 5 Apr 2010 18:23:20 +0000 (20:23 +0200)]
increase UML root file system to 700 MB

10 years agoadded support of PEM output by ipsec pki --gen|pub commands to NEWS
Andreas Steffen [Mon, 5 Apr 2010 12:08:06 +0000 (14:08 +0200)]
added support of PEM output by ipsec pki --gen|pub commands to NEWS

10 years agoadded ikev2/nat-virtual-ip scenario
Andreas Steffen [Mon, 5 Apr 2010 12:03:38 +0000 (14:03 +0200)]
added ikev2/nat-virtual-ip scenario

10 years agofarp scenario requires logging of arp packets
Andreas Steffen [Mon, 5 Apr 2010 12:01:29 +0000 (14:01 +0200)]
farp scenario requires logging of arp packets

10 years agoadded ikev2/farp scenario
Andreas Steffen [Mon, 5 Apr 2010 10:50:32 +0000 (12:50 +0200)]
added ikev2/farp scenario

10 years agoadded dave2 and carol2 entries to /etc/hosts
Andreas Steffen [Mon, 5 Apr 2010 10:50:07 +0000 (12:50 +0200)]
added dave2 and carol2 entries to /etc/hosts

10 years agoPEM encoding for OpenSSL RSA and EC public and private keys
Andreas Steffen [Sun, 4 Apr 2010 21:59:24 +0000 (23:59 +0200)]
PEM encoding for OpenSSL RSA and EC public and private keys

10 years agoPEM encoding for GMP RSA public and private keys
Andreas Steffen [Sun, 4 Apr 2010 17:11:18 +0000 (19:11 +0200)]
PEM encoding for GMP RSA public and private keys