strongswan.git
6 years agoMerge branch 'tun-vip'
Martin Willi [Mon, 6 May 2013 15:04:36 +0000 (17:04 +0200)]
Merge branch 'tun-vip'

Beside some OS X love, this merge introduces virtual IP and route installation
support on the pfkey/pfroute kernel interfaces.

Each virtual IP gets installed on a dedicated TUN device. As Linux-like source
routes are not supported, routes for the negotiated traffic selectors get
installed using the TUN device.

To prevent IKE packets from using those routes, special exclude routes get
installed to the IKE gateway. This works for most road-warrior deployments, but
certainly does not for some more exotic configurations, such as those using
virtual-IP-to-host. Mobility is not yet supported, either.

6 years agokernel-pfroute: allow only one thread to do a route look up simultaneously
Martin Willi [Mon, 6 May 2013 14:40:19 +0000 (16:40 +0200)]
kernel-pfroute: allow only one thread to do a route look up simultaneously

Otherwise we mess up the sequence number another thread is waiting for.

6 years agokernel-interface: query SAD for last use time if SPD query didn't yield one
Martin Willi [Sun, 21 Apr 2013 15:05:08 +0000 (17:05 +0200)]
kernel-interface: query SAD for last use time if SPD query didn't yield one

6 years agochild-sa: query SAD/SPD just for what we actually need to update statistics
Martin Willi [Sun, 21 Apr 2013 14:50:17 +0000 (16:50 +0200)]
child-sa: query SAD/SPD just for what we actually need to update statistics

6 years agokernel-pfkey: be less verbose about unexpected sequence numbers
Martin Willi [Sat, 20 Apr 2013 18:54:03 +0000 (20:54 +0200)]
kernel-pfkey: be less verbose about unexpected sequence numbers

6 years agokernel-pfkey: install exclude routes if kernel-net requires them
Martin Willi [Sat, 20 Apr 2013 11:29:20 +0000 (13:29 +0200)]
kernel-pfkey: install exclude routes if kernel-net requires them

6 years agokernel-pfroute: add a feature flag requesting "exclude" routes
Martin Willi [Sat, 20 Apr 2013 10:28:05 +0000 (12:28 +0200)]
kernel-pfroute: add a feature flag requesting "exclude" routes

If routes installed along with policies covering the peer address affect local
IKE/ESP packets, they won't get routed correctly. To work around this issue,
the kernel interface can install "exclude" routes for the IKE peer. Not all
networking backends require this workaround, hence we export a flag for it
if it is required.

6 years agokernel-pfroute: remove unused interface address refcounting
Martin Willi [Fri, 19 Apr 2013 14:58:06 +0000 (16:58 +0200)]
kernel-pfroute: remove unused interface address refcounting

6 years agokernel-pfroute: mark IPs installed on tun device as virtual
Martin Willi [Fri, 19 Apr 2013 14:55:38 +0000 (16:55 +0200)]
kernel-pfroute: mark IPs installed on tun device as virtual

6 years agokernel-pfroute: install virtual IPs using dedicated tun devices
Martin Willi [Fri, 19 Apr 2013 13:53:45 +0000 (15:53 +0200)]
kernel-pfroute: install virtual IPs using dedicated tun devices

6 years agokernel-pfkey: when installing a route for a virtual IP, use its interface
Martin Willi [Fri, 19 Apr 2013 12:27:31 +0000 (14:27 +0200)]
kernel-pfkey: when installing a route for a virtual IP, use its interface

When installing a route over a tun device for a virtual IP, the route must
be set over the tun, not the IKE interface.

6 years agokernel-interface: get_address_by_ts() can tell if a returned IP is virtual
Martin Willi [Fri, 19 Apr 2013 12:22:45 +0000 (14:22 +0200)]
kernel-interface: get_address_by_ts() can tell if a returned IP is virtual

6 years agokernel-interface: support enumeration of virtual-only IPs
Martin Willi [Fri, 19 Apr 2013 12:52:29 +0000 (14:52 +0200)]
kernel-interface: support enumeration of virtual-only IPs

6 years agokernel-pfkey: refactor route installation to a dedicate function
Martin Willi [Fri, 19 Apr 2013 12:17:22 +0000 (14:17 +0200)]
kernel-pfkey: refactor route installation to a dedicate function

6 years agokernel-pfroute: split /0 routes to avoid conflict with default route
Martin Willi [Fri, 19 Apr 2013 10:17:25 +0000 (12:17 +0200)]
kernel-pfroute: split /0 routes to avoid conflict with default route

6 years agokernel-pfkey: check if we have a gateway before comparing them
Martin Willi [Fri, 19 Apr 2013 10:16:12 +0000 (12:16 +0200)]
kernel-pfkey: check if we have a gateway before comparing them

6 years agokernel-pfkey: install route along with input, not forward policies
Martin Willi [Fri, 19 Apr 2013 08:42:23 +0000 (10:42 +0200)]
kernel-pfkey: install route along with input, not forward policies

As forwarding policies are not available on all systems (OS X), using the
forward policy to attach the route is a bad pick. Using input policies allows
OS X to install routes.

6 years agokernel-pfroute: rescan address list for an interface if its state changes
Martin Willi [Fri, 19 Apr 2013 08:47:34 +0000 (10:47 +0200)]
kernel-pfroute: rescan address list for an interface if its state changes

It seems that we don't get address notifications if the interface is down
on OS X.

6 years agokernel-pfroute: add newly appearing interfaces to the interface cache
Martin Willi [Fri, 19 Apr 2013 08:46:04 +0000 (10:46 +0200)]
kernel-pfroute: add newly appearing interfaces to the interface cache

6 years agokernel-pfroute: implement get_nexthop()
Martin Willi [Thu, 18 Apr 2013 16:26:49 +0000 (18:26 +0200)]
kernel-pfroute: implement get_nexthop()

6 years agokernel-pfroute: install and uninstall routes
Martin Willi [Thu, 18 Apr 2013 16:19:24 +0000 (18:19 +0200)]
kernel-pfroute: install and uninstall routes

6 years agokernel-pfroute: collect replies received for our own queries
Martin Willi [Thu, 18 Apr 2013 16:15:25 +0000 (18:15 +0200)]
kernel-pfroute: collect replies received for our own queries

6 years agokernel-pfroute: refactor PF_ROUTE message processing, use an enumerator
Martin Willi [Thu, 18 Apr 2013 15:58:48 +0000 (17:58 +0200)]
kernel-pfroute: refactor PF_ROUTE message processing, use an enumerator

6 years agokernel-pfkey: use an int to set esp_port with a sysctl on OS X
Martin Willi [Thu, 18 Apr 2013 14:53:35 +0000 (16:53 +0200)]
kernel-pfkey: use an int to set esp_port with a sysctl on OS X

6 years agokernel-pfroute: use INIT() macro for allocations
Martin Willi [Thu, 18 Apr 2013 14:20:11 +0000 (16:20 +0200)]
kernel-pfroute: use INIT() macro for allocations

6 years agokernel-pfroute: use only a single PF_ROUTE socket for both events and queries
Martin Willi [Thu, 18 Apr 2013 14:08:12 +0000 (16:08 +0200)]
kernel-pfroute: use only a single PF_ROUTE socket for both events and queries

6 years agokernel-pfroute: fix length check when receiving PF_ROUTE messages
Martin Willi [Wed, 17 Apr 2013 12:48:58 +0000 (14:48 +0200)]
kernel-pfroute: fix length check when receiving PF_ROUTE messages

6 years agokernel-pfkey: remove obsolete pluto specific behavior
Martin Willi [Mon, 6 May 2013 13:30:07 +0000 (15:30 +0200)]
kernel-pfkey: remove obsolete pluto specific behavior

6 years agokernel-netlink: remove obsolete pluto specific behavior
Martin Willi [Fri, 12 Apr 2013 09:32:05 +0000 (11:32 +0200)]
kernel-netlink: remove obsolete pluto specific behavior

6 years agotun_device: add a getter for the address previously passed to set_address()
Martin Willi [Fri, 12 Apr 2013 11:03:21 +0000 (13:03 +0200)]
tun_device: add a getter for the address previously passed to set_address()

6 years agotun_device: add a getter for the underlying file descriptor
Martin Willi [Fri, 12 Apr 2013 10:42:14 +0000 (12:42 +0200)]
tun_device: add a getter for the underlying file descriptor

6 years agotun-device: use host_create_netmask() to calculate interface netmask
Martin Willi [Tue, 16 Apr 2013 10:09:18 +0000 (12:09 +0200)]
tun-device: use host_create_netmask() to calculate interface netmask

6 years agohost: add a netmask constructor taking the number of network bits
Martin Willi [Tue, 16 Apr 2013 10:08:38 +0000 (12:08 +0200)]
host: add a netmask constructor taking the number of network bits

6 years agohost: remove unused host_t.get_differences() method
Martin Willi [Mon, 15 Apr 2013 14:27:31 +0000 (16:27 +0200)]
host: remove unused host_t.get_differences() method

6 years agohost: print %#H format specifiers not as %any, but with the port
Martin Willi [Thu, 11 Apr 2013 17:51:45 +0000 (19:51 +0200)]
host: print %#H format specifiers not as %any, but with the port

6 years agohost: initialize sockaddr->sa_len if it is available
Martin Willi [Wed, 20 Mar 2013 17:15:26 +0000 (18:15 +0100)]
host: initialize sockaddr->sa_len if it is available

6 years agochild-sa: pass traffic selector to add_sa() regardless of IPsec mode
Martin Willi [Fri, 12 Apr 2013 11:19:59 +0000 (13:19 +0200)]
child-sa: pass traffic selector to add_sa() regardless of IPsec mode

This lets the kernel backend decide what to do with it, and in fact all kernel
interfaces already handle this correctly.

6 years agosocket-default: to bind to one dynamic port on OS X, create v4 socket before v6
Martin Willi [Thu, 11 Apr 2013 18:22:06 +0000 (20:22 +0200)]
socket-default: to bind to one dynamic port on OS X, create v4 socket before v6

It seems that the order of binding sockets of different address families to the
same dynamic port must be v6-before-v4 on Linux, but v4-before-v6 on OS X.

6 years agosocket-default: refactor socket pair opening to a function
Martin Willi [Thu, 11 Apr 2013 18:19:57 +0000 (20:19 +0200)]
socket-default: refactor socket pair opening to a function

6 years agosocket-default: Don't try to send packet if we haven't a socket for given family
Martin Willi [Thu, 11 Apr 2013 17:47:28 +0000 (19:47 +0200)]
socket-default: Don't try to send packet if we haven't a socket for given family

6 years agosocket-default: Use -1 if socket is not available, as 0 is actually a valid fd
Martin Willi [Thu, 11 Apr 2013 17:40:31 +0000 (19:40 +0200)]
socket-default: Use -1 if socket is not available, as 0 is actually a valid fd

6 years agosemaphore: similar to thread_create(), semaphore_create() is used by Mach
Martin Willi [Thu, 11 Apr 2013 17:20:33 +0000 (19:20 +0200)]
semaphore: similar to thread_create(), semaphore_create() is used by Mach

The compiler spits no warning, but the wrong symbol is used when calling
semaphore_create() from strongSwan. Override the name with a #define to force
the use of our semaphore_create().

6 years ago.gitignore: add OS X .DS_Store files
Martin Willi [Thu, 11 Apr 2013 15:34:44 +0000 (17:34 +0200)]
.gitignore: add OS X .DS_Store files

6 years agoMerge branch 'charon-cmd'
Martin Willi [Mon, 6 May 2013 14:01:25 +0000 (16:01 +0200)]
Merge branch 'charon-cmd'

Introduce a simple IKEv1/IKEv2 command line client, charon-cmd. It does
not need any configuration files at all, but takes a few command line arguments
to establish connections as a road warrior.

6 years agocharon-cmd: add an option to set a different server identity
Martin Willi [Mon, 22 Apr 2013 10:42:01 +0000 (12:42 +0200)]
charon-cmd: add an option to set a different server identity

6 years agoproposals: try next if IKEv2 algorithm could not be mapped to IKEv1
Martin Willi [Mon, 22 Apr 2013 10:33:52 +0000 (12:33 +0200)]
proposals: try next if IKEv2 algorithm could not be mapped to IKEv1

6 years agocharon-cmd: add support for different IKEv1/IKEv2 authentication profiles
Martin Willi [Mon, 22 Apr 2013 10:33:10 +0000 (12:33 +0200)]
charon-cmd: add support for different IKEv1/IKEv2 authentication profiles

6 years agocharon-cmd: support multi-line help text for each option in usage
Martin Willi [Mon, 22 Apr 2013 09:20:58 +0000 (11:20 +0200)]
charon-cmd: support multi-line help text for each option in usage

6 years agocharon-cmd: add --local/remote-ts options to set traffic selectors
Martin Willi [Mon, 22 Apr 2013 08:52:17 +0000 (10:52 +0200)]
charon-cmd: add --local/remote-ts options to set traffic selectors

6 years agocharon-cmd: Use dynamic ports with the socket-default plugin
Martin Willi [Thu, 11 Apr 2013 17:27:27 +0000 (19:27 +0200)]
charon-cmd: Use dynamic ports with the socket-default plugin

6 years agosettings: Add a set_default_str() to set a different default for a key
Martin Willi [Thu, 11 Apr 2013 17:23:29 +0000 (19:23 +0200)]
settings: Add a set_default_str() to set a different default for a key

The value is set only if it is not configured in strongswan.conf or has
not been set() otherwise.

6 years agocharon-cmd: prompt for EAP passwords on-demand using a callback credential set
Martin Willi [Tue, 26 Mar 2013 17:04:27 +0000 (18:04 +0100)]
charon-cmd: prompt for EAP passwords on-demand using a callback credential set

6 years agocharon-cmd: authenticate with EAP if no private key is given
Martin Willi [Tue, 26 Mar 2013 16:47:28 +0000 (17:47 +0100)]
charon-cmd: authenticate with EAP if no private key is given

6 years agocharon-cmd: pass arguments to all handlers, even if already handled
Martin Willi [Tue, 26 Mar 2013 16:38:02 +0000 (17:38 +0100)]
charon-cmd: pass arguments to all handlers, even if already handled

6 years agocharon-cmd: build long_opts only once when reading arguments in charon-cmd
Martin Willi [Tue, 26 Mar 2013 16:36:31 +0000 (17:36 +0100)]
charon-cmd: build long_opts only once when reading arguments in charon-cmd

6 years agocharon-cmd: add support for using dynamic ports in charon-cmd
Martin Willi [Tue, 26 Mar 2013 16:28:40 +0000 (17:28 +0100)]
charon-cmd: add support for using dynamic ports in charon-cmd

6 years agosocket-dynamic: when sending from port zero, allocate a free port dynamically
Martin Willi [Tue, 26 Mar 2013 16:23:38 +0000 (17:23 +0100)]
socket-dynamic: when sending from port zero, allocate a free port dynamically

6 years agocontroller: clean up job data if a thread gets cancelled waiting in a function
Martin Willi [Tue, 26 Mar 2013 15:19:00 +0000 (16:19 +0100)]
controller: clean up job data if a thread gets cancelled waiting in a function

Controller functions are thread cancellation points, so register a cancellation
handler cleaning up job data.

6 years agocharon-cmd: load certificates and RSA private keys
Martin Willi [Tue, 26 Mar 2013 14:42:06 +0000 (15:42 +0100)]
charon-cmd: load certificates and RSA private keys

6 years agocharon-cmd: add a connection object and its initiation to charon-cmd
Martin Willi [Tue, 26 Mar 2013 14:07:15 +0000 (15:07 +0100)]
charon-cmd: add a connection object and its initiation to charon-cmd

6 years agocharon-cmd: move command line options to separate file, obsolete short options
Martin Willi [Tue, 26 Mar 2013 13:10:00 +0000 (14:10 +0100)]
charon-cmd: move command line options to separate file, obsolete short options

6 years agocharon-cmd: add a stub for charon-cmd, a simple command line IKE client
Martin Willi [Tue, 26 Mar 2013 10:26:22 +0000 (11:26 +0100)]
charon-cmd: add a stub for charon-cmd, a simple command line IKE client

6 years agoMerge branch 'leak-detective-dlsym'
Martin Willi [Mon, 6 May 2013 13:15:58 +0000 (15:15 +0200)]
Merge branch 'leak-detective-dlsym'

Replaces the use of deprecated glibc malloc hooks by overloading malloc calls
and find the originals using dlsym(RTLD_NEXT).

On OS X, we now support the use of leak detective by changing the default
malloc zone functions, backtraces get resolved using atos.

It seems that the performance bottleneck now is stack unwinding. Unfortunately
a new libunwind based backtrace() is not much faster than the libc variant; we
keep that option nonetheless for platforms without backtrace().

6 years agoscripts: add a simple test utility to do some malloc() benchmarking/profiling
Martin Willi [Fri, 5 Apr 2013 14:24:38 +0000 (16:24 +0200)]
scripts: add a simple test utility to do some malloc() benchmarking/profiling

6 years agobacktrace: use atos instead of addr2line on OS X to resolve source lines
Martin Willi [Wed, 17 Apr 2013 15:45:25 +0000 (17:45 +0200)]
backtrace: use atos instead of addr2line on OS X to resolve source lines

6 years agobacktrace: add an alternative stack unwinding implementation using libunwind
Martin Willi [Fri, 5 Apr 2013 14:26:27 +0000 (16:26 +0200)]
backtrace: add an alternative stack unwinding implementation using libunwind

6 years agoleak-detective: add support for OS X by hooking default malloc zone
Martin Willi [Thu, 18 Apr 2013 11:07:27 +0000 (13:07 +0200)]
leak-detective: add support for OS X by hooking default malloc zone

6 years agoleak-detective: remove unused malloc call counters
Martin Willi [Tue, 2 Apr 2013 16:27:12 +0000 (18:27 +0200)]
leak-detective: remove unused malloc call counters

6 years agoleak-detective: align allocations on both 32 and 64-bit systems to 32 bytes
Martin Willi [Tue, 2 Apr 2013 15:41:04 +0000 (17:41 +0200)]
leak-detective: align allocations on both 32 and 64-bit systems to 32 bytes

6 years agoleak-detective: call tzset() explicitly before enabling leak detective
Martin Willi [Tue, 2 Apr 2013 13:47:55 +0000 (15:47 +0200)]
leak-detective: call tzset() explicitly before enabling leak detective

tzset() is hard to whitelist on some systems, as there is no symbol involved.
Call tzset() explicitly before initialization to avoid false positives.

6 years agoleak-detective: override malloc functions instead of using deprecated hooks
Martin Willi [Tue, 2 Apr 2013 11:37:06 +0000 (13:37 +0200)]
leak-detective: override malloc functions instead of using deprecated hooks

malloc hooks have become deprecated, and their use has always been problematic,
especially in multi-threaded applications. Replace the functionality by
overriding all malloc functions and query the system allocator functions
using dlsym() with RTLD_NEXT.

6 years agoMerge branch 'silent-automake'
Martin Willi [Mon, 6 May 2013 13:05:40 +0000 (15:05 +0200)]
Merge branch 'silent-automake'

Adds support for --enable/disable-silent-rules when building with Automake
1.11 or 1.12. make V=0 or V=1 can be used to build with a different verbosity
than ./configured.

6 years agoAdd -s to make if --enable-silent-rules is ./configured
Martin Willi [Wed, 10 Apr 2013 13:36:14 +0000 (15:36 +0200)]
Add -s to make if --enable-silent-rules is ./configured

6 years agoUse the GEN silent rule when generating files with sed
Martin Willi [Wed, 10 Apr 2013 13:35:55 +0000 (15:35 +0200)]
Use the GEN silent rule when generating files with sed

6 years agoUse the GEN silent rule when generating oid database with perl
Martin Willi [Wed, 10 Apr 2013 12:49:29 +0000 (14:49 +0200)]
Use the GEN silent rule when generating oid database with perl

6 years agoUse the GEN silent rule when generating gperf files
Martin Willi [Wed, 10 Apr 2013 12:02:53 +0000 (14:02 +0200)]
Use the GEN silent rule when generating gperf files

6 years agoProvide the --enable-silent-rules ./configure option with automake 1.11 and 1.12
Martin Willi [Wed, 10 Apr 2013 12:01:41 +0000 (14:01 +0200)]
Provide the --enable-silent-rules ./configure option with automake 1.11 and 1.12

6 years agoIntroduce an optional logger_t.vlog() method with format string and arguments
Martin Willi [Fri, 5 Apr 2013 12:10:00 +0000 (14:10 +0200)]
Introduce an optional logger_t.vlog() method with format string and arguments

To have more flexibility in the logging backend, receiving the original format
string and do printf() substitution in the logger may be preferable. An
additional but optional logger method does not touch the behavior of existing
loggers.

6 years agoRaise an ALERT_PROPOSAL_MISMATCH_CHILD also when receiving NO_PROPOSAL_CHOSEN
Martin Willi [Wed, 17 Apr 2013 09:55:24 +0000 (11:55 +0200)]
Raise an ALERT_PROPOSAL_MISMATCH_CHILD also when receiving NO_PROPOSAL_CHOSEN

6 years agoRaise an ALERT_PROPOSAL_MISMATCH_IKE also when receiving NO_PROPOSAL_CHOSEN
Martin Willi [Wed, 17 Apr 2013 09:46:12 +0000 (11:46 +0200)]
Raise an ALERT_PROPOSAL_MISMATCH_IKE also when receiving NO_PROPOSAL_CHOSEN

6 years agoeap-radius: add an option to disable accounting for tunnels without virtual IP
Martin Willi [Wed, 17 Apr 2013 09:34:33 +0000 (11:34 +0200)]
eap-radius: add an option to disable accounting for tunnels without virtual IP

6 years agoeap-radius: use IKE_SA unique id instead of peer identity to manage virtual IPs
Martin Willi [Wed, 17 Apr 2013 09:11:52 +0000 (11:11 +0200)]
eap-radius: use IKE_SA unique id instead of peer identity to manage virtual IPs

Fixes some corner cases if multiple tunnels use the same peer identity.

6 years agoDon't unset IKE_SA on bus before we released virtual IPs and attributes
Martin Willi [Wed, 17 Apr 2013 09:09:23 +0000 (11:09 +0200)]
Don't unset IKE_SA on bus before we released virtual IPs and attributes

6 years agoNew Android release after adding AES-GCM, IPv6-in-IPv4 and using kernel-netlink
Tobias Brunner [Fri, 3 May 2013 13:16:14 +0000 (15:16 +0200)]
New Android release after adding AES-GCM, IPv6-in-IPv4 and using kernel-netlink

libipsec now supports AES-GCM, IPv6 tunnels over IPv4 are supported,
native x86 libraries are built (requires a new Vstr build script).
Also, the existing kernel-netlink plugin now provides the kernel-net
implementation, which should be more stable in case multiple interfaces
are up and have IP addresses installed on them.

6 years agolibipsec: Fix memory leak in event relay
Tobias Brunner [Mon, 22 Apr 2013 13:41:22 +0000 (15:41 +0200)]
libipsec: Fix memory leak in event relay

6 years agoandroid: Use stronger ESP proposal including AES-GCM
Tobias Brunner [Mon, 22 Apr 2013 13:39:41 +0000 (15:39 +0200)]
android: Use stronger ESP proposal including AES-GCM

6 years agolibipsec: Add support for AES-GCM
Tobias Brunner [Mon, 22 Apr 2013 12:57:11 +0000 (14:57 +0200)]
libipsec: Add support for AES-GCM

6 years agolibipsec: Wrap traditional algorithms in AEAD wrapper
Tobias Brunner [Thu, 18 Apr 2013 15:02:41 +0000 (17:02 +0200)]
libipsec: Wrap traditional algorithms in AEAD wrapper

6 years agoandroid: Remove unused methods on NetworkManager/network_manager_t
Tobias Brunner [Tue, 16 Apr 2013 13:01:47 +0000 (15:01 +0200)]
android: Remove unused methods on NetworkManager/network_manager_t

6 years agoandroid: Ignore interface 'lo'
Tobias Brunner [Tue, 16 Apr 2013 12:54:48 +0000 (14:54 +0200)]
android: Ignore interface 'lo'

Android adds a default route via 'lo' if no connectivity is available
causing charon to send packets via lo and triggering DPD.

6 years agoandroid: Repurpose android-net to simply handle connectivity events
Tobias Brunner [Tue, 16 Apr 2013 12:40:19 +0000 (14:40 +0200)]
android: Repurpose android-net to simply handle connectivity events

Using the events by NetworkManager/ConnectivityManager to trigger roam events
instead of the events generated by the kernel-netlink plugin the noise level
is much lower.

6 years agokernel-netlink: Add an option to disable roam events
Tobias Brunner [Tue, 16 Apr 2013 11:54:25 +0000 (13:54 +0200)]
kernel-netlink: Add an option to disable roam events

6 years agoandroid: Replace android-net plugin with kernel-netlink
Tobias Brunner [Tue, 16 Apr 2013 12:31:09 +0000 (14:31 +0200)]
android: Replace android-net plugin with kernel-netlink

Virtual IPs are not handled by the kernel-netlink plugin and tun devices are
ignored.

6 years agoandroid: Set strongswan.conf options before initializing other libraries
Tobias Brunner [Tue, 16 Apr 2013 12:23:07 +0000 (14:23 +0200)]
android: Set strongswan.conf options before initializing other libraries

6 years agokernel-netlink: Define defaults for routing table and prio
Tobias Brunner [Tue, 16 Apr 2013 11:46:32 +0000 (13:46 +0200)]
kernel-netlink: Define defaults for routing table and prio

6 years agoopenssl: Define a default for FIPS_MODE
Tobias Brunner [Fri, 3 May 2013 13:00:54 +0000 (15:00 +0200)]
openssl: Define a default for FIPS_MODE

6 years agoIn memwipe_check(), don't put magic on stack when calling do_magic()
Martin Willi [Fri, 3 May 2013 12:17:37 +0000 (14:17 +0200)]
In memwipe_check(), don't put magic on stack when calling do_magic()

Otherwise the magic might be on the stack while checking it.

6 years agoDump stack if memwipe() check fails
Martin Willi [Fri, 3 May 2013 09:41:51 +0000 (11:41 +0200)]
Dump stack if memwipe() check fails

6 years agoUse attest database in tnc/tnccs-20-os scenario 5.0.4
Andreas Steffen [Sun, 21 Apr 2013 14:31:23 +0000 (16:31 +0200)]
Use attest database in tnc/tnccs-20-os scenario

6 years agofixed a 64bit time_t issue
Andreas Steffen [Sun, 21 Apr 2013 14:07:13 +0000 (16:07 +0200)]
fixed a 64bit time_t issue