strongswan.git
11 years agoPass the CREATE_CHILD_SA initiator flag to the child_keys parameter
Martin Willi [Mon, 26 Jul 2010 10:05:04 +0000 (12:05 +0200)]
Pass the CREATE_CHILD_SA initiator flag to the child_keys parameter

11 years agoUse a sync message cache to resynchronize IKE_SAs without rekeying
Martin Willi [Thu, 22 Jul 2010 16:54:35 +0000 (18:54 +0200)]
Use a sync message cache to resynchronize IKE_SAs without rekeying

11 years agoLog received HA message types
Martin Willi [Thu, 22 Jul 2010 13:56:11 +0000 (15:56 +0200)]
Log received HA message types

11 years agoAdd enum names for HA message types
Martin Willi [Thu, 22 Jul 2010 13:55:08 +0000 (15:55 +0200)]
Add enum names for HA message types

11 years agoDelay resynchronization request until starter has loaded the configurations
Martin Willi [Thu, 22 Jul 2010 13:52:18 +0000 (13:52 +0000)]
Delay resynchronization request until starter has loaded the configurations

11 years agoReplaces in_segment() by a more generic get_segment() function
Martin Willi [Thu, 22 Jul 2010 12:38:05 +0000 (14:38 +0200)]
Replaces in_segment() by a more generic get_segment() function

11 years agoUse distinct message types for HA message ID updates
Martin Willi [Thu, 22 Jul 2010 11:20:18 +0000 (13:20 +0200)]
Use distinct message types for HA message ID updates

11 years agoMigrated ha plugin to INIT/METHOD macros
Martin Willi [Thu, 22 Jul 2010 09:42:22 +0000 (11:42 +0200)]
Migrated ha plugin to INIT/METHOD macros

11 years agoadded net2net-same-nets
Andreas Steffen [Sun, 25 Jul 2010 09:56:33 +0000 (11:56 +0200)]
added net2net-same-nets

11 years agoAdded NEWS for the eap-simaka-sql plugin
Martin Willi [Fri, 23 Jul 2010 14:02:28 +0000 (16:02 +0200)]
Added NEWS for the eap-simaka-sql plugin

11 years agoNEWS cosmetics
Andreas Steffen [Wed, 21 Jul 2010 19:43:43 +0000 (21:43 +0200)]
NEWS cosmetics

11 years agoMultiple RADIUS server NEWS
Martin Willi [Wed, 21 Jul 2010 15:27:06 +0000 (17:27 +0200)]
Multiple RADIUS server NEWS

11 years agoImplemented support for multiple RADIUS servers
Martin Willi [Wed, 21 Jul 2010 15:06:00 +0000 (17:06 +0200)]
Implemented support for multiple RADIUS servers

11 years agoMigrated eap-radius plugin to INIT/METHOD macros
Martin Willi [Wed, 21 Jul 2010 07:15:32 +0000 (09:15 +0200)]
Migrated eap-radius plugin to INIT/METHOD macros

11 years agoAdded log statement if peer requests EAP, but current config does not allow it
Martin Willi [Wed, 21 Jul 2010 12:55:51 +0000 (14:55 +0200)]
Added log statement if peer requests EAP, but current config does not allow it

11 years agoremove the private updown scripts after use
Andreas Steffen [Sat, 17 Jul 2010 21:25:15 +0000 (23:25 +0200)]
remove the private updown scripts after use

11 years agominor fixes in the ikev2/rw-mark-in-out scenarios
Andreas Steffen [Sat, 17 Jul 2010 15:36:04 +0000 (17:36 +0200)]
minor fixes in the ikev2/rw-mark-in-out scenarios

11 years agoupdated NEWS
Andreas Steffen [Sat, 17 Jul 2010 15:25:01 +0000 (17:25 +0200)]
updated NEWS

11 years agosome reformulations
Andreas Steffen [Sat, 17 Jul 2010 15:19:26 +0000 (17:19 +0200)]
some reformulations

11 years agothe ikev2/nat-two-rw-mark and ikev2/rw-mark-in-out scenarios use the PLUTO_MARK_IN...
Andreas Steffen [Sat, 17 Jul 2010 14:32:47 +0000 (16:32 +0200)]
the ikev2/nat-two-rw-mark and ikev2/rw-mark-in-out scenarios use the PLUTO_MARK_IN and PLUTO_ESP_ENC variables in the mark_update script

11 years agodocumented the new PLUTO environment variables available in the updown script
Andreas Steffen [Sat, 17 Jul 2010 11:41:40 +0000 (13:41 +0200)]
documented the new PLUTO environment variables available in the updown script

11 years agoin a ESP_IN_UDP situation make UDP port available in the updown script
Andreas Steffen [Sat, 17 Jul 2010 11:27:19 +0000 (13:27 +0200)]
in a ESP_IN_UDP situation make UDP port available in the updown script

11 years agofix html error in scenario description
Andreas Steffen [Sat, 17 Jul 2010 11:09:28 +0000 (13:09 +0200)]
fix html error in scenario description

11 years agomake xfrm marks available in the updown scripts
Andreas Steffen [Sat, 17 Jul 2010 11:08:50 +0000 (13:08 +0200)]
make xfrm marks available in the updown scripts

11 years agocheck for mark changes in ipsec update
Andreas Steffen [Sat, 17 Jul 2010 07:13:48 +0000 (09:13 +0200)]
check for mark changes in ipsec update

11 years agoall x509 based sql scenarios require the revocation plugin
Andreas Steffen [Thu, 15 Jul 2010 21:19:52 +0000 (23:19 +0200)]
all x509 based sql scenarios require the revocation plugin

11 years agoall x509 based pfkey scenarios require the revocation plugin
Andreas Steffen [Thu, 15 Jul 2010 21:17:37 +0000 (23:17 +0200)]
all x509 based pfkey scenarios require the revocation plugin

11 years agoall x509 based p2pnat scenarios require the revocation plugin
Andreas Steffen [Thu, 15 Jul 2010 21:07:12 +0000 (23:07 +0200)]
all x509 based p2pnat scenarios require the revocation plugin

11 years agoall x509 based ipv6/*-ikev2 scenarios require the revocation plugin
Andreas Steffen [Thu, 15 Jul 2010 21:02:17 +0000 (23:02 +0200)]
all x509 based ipv6/*-ikev2 scenarios require the revocation plugin

11 years agoall x509 based ike scenarios require the revocation plugin
Andreas Steffen [Thu, 15 Jul 2010 20:40:20 +0000 (22:40 +0200)]
all x509 based ike scenarios require the revocation plugin

11 years agoall x509 based openssl-ikev2 scenarios require the revocation plugin
Andreas Steffen [Thu, 15 Jul 2010 20:33:05 +0000 (22:33 +0200)]
all x509 based openssl-ikev2 scenarios require the revocation plugin

11 years agoall x509 based gcrypt-ikev2 scenarios require the revocation plugin
Andreas Steffen [Thu, 15 Jul 2010 20:03:16 +0000 (22:03 +0200)]
all x509 based gcrypt-ikev2 scenarios require the revocation plugin

11 years agoall x509 based ikev2 scenarios require the revocation plugin
Andreas Steffen [Thu, 15 Jul 2010 19:39:01 +0000 (21:39 +0200)]
all x509 based ikev2 scenarios require the revocation plugin

11 years agoikev2/net2net-psk-dscp does not need certificate support
Andreas Steffen [Thu, 15 Jul 2010 19:37:45 +0000 (21:37 +0200)]
ikev2/net2net-psk-dscp does not need certificate support

11 years agoadd revocation plugin to ikev2/rw-cert scenario
Andreas Steffen [Thu, 15 Jul 2010 18:03:04 +0000 (20:03 +0200)]
add revocation plugin to ikev2/rw-cert scenario

11 years agoWarn about manual plugin load directives for pluto/charon with --disable-load-warning...
Andreas Steffen [Thu, 15 Jul 2010 04:29:26 +0000 (06:29 +0200)]
Warn about manual plugin load directives for pluto/charon with --disable-load-warning compile option

11 years agoRevert "Warn about manual plugin load directives for pluto/charon"
Martin Willi [Wed, 14 Jul 2010 05:15:56 +0000 (07:15 +0200)]
Revert "Warn about manual plugin load directives for pluto/charon"

This reverts commit 5c46726d0d91db5b1fc4ea53326e73443133f22d.

11 years agoactivate --enable-addrblock configure option in UML scenarios
Andreas Steffen [Tue, 13 Jul 2010 19:04:20 +0000 (21:04 +0200)]
activate --enable-addrblock configure option in UML scenarios

11 years agoWarn about manual plugin load directives for pluto/charon
Martin Willi [Tue, 13 Jul 2010 12:43:45 +0000 (14:43 +0200)]
Warn about manual plugin load directives for pluto/charon

11 years agoRemove plugin load directives from default strongswan.conf
Martin Willi [Tue, 13 Jul 2010 12:28:11 +0000 (14:28 +0200)]
Remove plugin load directives from default strongswan.conf

11 years agoAdded NEWS about --signcrl and PEM support in pki utility
Martin Willi [Tue, 13 Jul 2010 12:18:19 +0000 (14:18 +0200)]
Added NEWS about --signcrl and PEM support in pki utility

11 years agoAdded pki PEM encoding support for certificates, CRLs and PKCS10 requests
Martin Willi [Tue, 13 Jul 2010 12:14:39 +0000 (14:14 +0200)]
Added pki PEM encoding support for certificates, CRLs and PKCS10 requests

11 years agoAdded support for Certificate, CRL and PKCS10 encoding to PEM plugin
Martin Willi [Tue, 13 Jul 2010 11:53:33 +0000 (13:53 +0200)]
Added support for Certificate, CRL and PKCS10 encoding to PEM plugin

11 years agoSupport different encoding types in certificate.get_encoding()
Martin Willi [Tue, 13 Jul 2010 11:34:04 +0000 (13:34 +0200)]
Support different encoding types in certificate.get_encoding()

11 years agoRenamed key_encod{ing,der}_t and constants, prepare for generic credential encoding
Martin Willi [Tue, 13 Jul 2010 09:28:04 +0000 (11:28 +0200)]
Renamed key_encod{ing,der}_t and constants, prepare for generic credential encoding

11 years agoMoved keys/key_encoding.[ch] to cred_encoding.[ch]
Martin Willi [Tue, 13 Jul 2010 09:01:08 +0000 (11:01 +0200)]
Moved keys/key_encoding.[ch] to cred_encoding.[ch]

11 years agoFixed doxygen group of cert_validator interface
Martin Willi [Tue, 13 Jul 2010 08:42:02 +0000 (10:42 +0200)]
Fixed doxygen group of cert_validator interface

11 years agoAdded NEWS for revocation/addrblock plugin
Martin Willi [Tue, 13 Jul 2010 07:34:57 +0000 (09:34 +0200)]
Added NEWS for revocation/addrblock plugin

11 years agoAdded addrblock plugin to RFC3779 test cases
Martin Willi [Tue, 13 Jul 2010 07:29:57 +0000 (09:29 +0200)]
Added addrblock plugin to RFC3779 test cases

11 years agoAdded revocation plugin to ikev2 crl/ocsp test cases
Martin Willi [Tue, 13 Jul 2010 07:28:44 +0000 (09:28 +0200)]
Added revocation plugin to ikev2 crl/ocsp test cases

11 years agoMoved X509 ipAddrBlock checking to the addrblock plugin
Martin Willi [Tue, 13 Jul 2010 07:19:39 +0000 (09:19 +0200)]
Moved X509 ipAddrBlock checking to the addrblock plugin

11 years agoAdded a hook to narrow traffic selectors for CHILD_SAs
Martin Willi [Tue, 13 Jul 2010 06:39:19 +0000 (08:39 +0200)]
Added a hook to narrow traffic selectors for CHILD_SAs

11 years agoMoved bus_t to METHOD/INIT macros
Martin Willi [Mon, 12 Jul 2010 14:25:56 +0000 (16:25 +0200)]
Moved bus_t to METHOD/INIT macros

11 years agoMoved addrblock plugin to libcharon
Martin Willi [Mon, 12 Jul 2010 13:57:25 +0000 (15:57 +0200)]
Moved addrblock plugin to libcharon

11 years agoMoved CRL/OCSP checking to a dedicated plugin called revocation
Martin Willi [Mon, 5 Jul 2010 13:26:35 +0000 (15:26 +0200)]
Moved CRL/OCSP checking to a dedicated plugin called revocation

11 years agoMade some useful methods in the credential manager public
Martin Willi [Mon, 5 Jul 2010 13:24:19 +0000 (15:24 +0200)]
Made some useful methods in the credential manager public

11 years agoMoved X509 addrBlock validation to a separate addrblock plugin
Martin Willi [Mon, 5 Jul 2010 12:36:05 +0000 (14:36 +0200)]
Moved X509 addrBlock validation to a separate addrblock plugin

11 years agoAdded a certificate validation hook to the credential manager
Martin Willi [Mon, 5 Jul 2010 12:21:09 +0000 (14:21 +0200)]
Added a certificate validation hook to the credential manager

11 years agoMigrated credential manager to INIT/METHOD macros
Martin Willi [Mon, 5 Jul 2010 10:51:17 +0000 (12:51 +0200)]
Migrated credential manager to INIT/METHOD macros

11 years agoMoved credential manager to libstrongswan
Martin Willi [Mon, 5 Jul 2010 09:54:25 +0000 (11:54 +0200)]
Moved credential manager to libstrongswan

11 years agoMove pathlen constraint checking to X509 specific checks
Martin Willi [Mon, 5 Jul 2010 07:36:30 +0000 (09:36 +0200)]
Move pathlen constraint checking to X509 specific checks

11 years agoCharon uses a generic trunstchain length limit, not only for X509 certificates
Martin Willi [Fri, 2 Jul 2010 08:29:36 +0000 (10:29 +0200)]
Charon uses a generic trunstchain length limit, not only for X509 certificates

11 years agoCombined the OCSP/CRL options to a signle Online check option
Martin Willi [Fri, 2 Jul 2010 07:58:59 +0000 (09:58 +0200)]
Combined the OCSP/CRL options to a signle Online check option

11 years agoadded mark, mark_in, and mark_out to the ipsec.conf.5 man page
Andreas Steffen [Tue, 13 Jul 2010 07:15:53 +0000 (09:15 +0200)]
added mark, mark_in, and mark_out to the ipsec.conf.5 man page

11 years agowe need some ordering
Andreas Steffen [Mon, 12 Jul 2010 20:44:27 +0000 (22:44 +0200)]
we need some ordering

11 years agochanged ordering of statusattr output
Andreas Steffen [Mon, 12 Jul 2010 20:38:18 +0000 (22:38 +0200)]
changed ordering of statusattr output

11 years agoupdated ikev2/ip-two-pools-db scenario to support pool and identity based dns attributes
Andreas Steffen [Mon, 12 Jul 2010 18:54:40 +0000 (20:54 +0200)]
updated ikev2/ip-two-pools-db scenario to support pool and identity based dns attributes

11 years agofixed alignment of caption
Andreas Steffen [Mon, 12 Jul 2010 18:48:14 +0000 (20:48 +0200)]
fixed alignment of caption

11 years agoupdated SQL templates to support attribute pool and identity parameters
Andreas Steffen [Mon, 12 Jul 2010 18:28:24 +0000 (20:28 +0200)]
updated SQL templates to support attribute pool and identity parameters

11 years agooutput identities correctly
Andreas Steffen [Mon, 12 Jul 2010 18:26:17 +0000 (20:26 +0200)]
output identities correctly

11 years agoadded second example scenario
Andreas Steffen [Mon, 12 Jul 2010 12:22:32 +0000 (14:22 +0200)]
added second example scenario

11 years agoapidoc is actually a directory not a file.
Tobias Brunner [Mon, 12 Jul 2010 13:28:55 +0000 (15:28 +0200)]
apidoc is actually a directory not a file.

11 years agoAdded missing pool parameter in DHCP attribute provider.
Tobias Brunner [Mon, 12 Jul 2010 10:27:49 +0000 (12:27 +0200)]
Added missing pool parameter in DHCP attribute provider.

11 years agoDo not interpret long class attributes (such as from NPS) as group
Martin Willi [Fri, 9 Jul 2010 11:53:43 +0000 (13:53 +0200)]
Do not interpret long class attributes (such as from NPS) as group

11 years agoGroup membership constraint is fulfilled if subject is member in one of the groups
Martin Willi [Fri, 9 Jul 2010 11:51:58 +0000 (13:51 +0200)]
Group membership constraint is fulfilled if subject is member in one of the groups

11 years agoAdded support for named attribute groups
Heiko Hund [Wed, 7 Jul 2010 14:45:36 +0000 (16:45 +0200)]
Added support for named attribute groups

Add the possibility to group attributes by a name and assign these
groups to connections. This allows a more granular configuration of
which client will receive what atrributes.

11 years agotransport reqid, mark_in and mark_out in whack message
Andreas Steffen [Fri, 9 Jul 2010 10:19:39 +0000 (12:19 +0200)]
transport reqid, mark_in and mark_out in whack message

11 years agoadded ikev2/net2net-psk-dscp2 DiffServ scenario
Andreas Steffen [Fri, 9 Jul 2010 09:55:01 +0000 (11:55 +0200)]
added ikev2/net2net-psk-dscp2 DiffServ scenario

11 years agoadded ikev2/nat-two-rw-mark-in-out scenario
Andreas Steffen [Fri, 9 Jul 2010 07:36:03 +0000 (09:36 +0200)]
added ikev2/nat-two-rw-mark-in-out scenario

11 years agosome changes to the ikev2/nat-two-rw-mark scenario
Andreas Steffen [Fri, 9 Jul 2010 07:35:02 +0000 (09:35 +0200)]
some changes to the ikev2/nat-two-rw-mark scenario

11 years agoconfiguration of different marks for inbound and outbound direction
Andreas Steffen [Fri, 9 Jul 2010 07:06:02 +0000 (09:06 +0200)]
configuration of different marks for inbound and outbound direction

11 years agoThe file logger supports a time prefix using a strftime() format specifier
Martin Willi [Thu, 8 Jul 2010 14:11:55 +0000 (16:11 +0200)]
The file logger supports a time prefix using a strftime() format specifier

11 years agoPrint identity to a lease address on the same line for simpler greping
Martin Willi [Thu, 8 Jul 2010 13:46:44 +0000 (15:46 +0200)]
Print identity to a lease address on the same line for simpler greping

11 years agoImplemented missing bypass_socket() method in load-testers faked kernel interface
Martin Willi [Wed, 7 Jul 2010 08:00:39 +0000 (10:00 +0200)]
Implemented missing bypass_socket() method in load-testers faked kernel interface

11 years agoadded req parameter to ipsec.conf man page
Andreas Steffen [Tue, 6 Jul 2010 18:32:15 +0000 (20:32 +0200)]
added req parameter to ipsec.conf man page

11 years agoShow mallinfo() data in statusall, if available
Martin Willi [Tue, 6 Jul 2010 14:26:59 +0000 (16:26 +0200)]
Show mallinfo() data in statusall, if available

11 years agoAvoid relocking while enumerator is alive
Martin Willi [Tue, 6 Jul 2010 13:44:37 +0000 (15:44 +0200)]
Avoid relocking while enumerator is alive

11 years agoAdded missing markt_t in load tester, also migrated to INIT/METHOD macros.
Tobias Brunner [Tue, 6 Jul 2010 07:29:18 +0000 (09:29 +0200)]
Added missing markt_t in load tester, also migrated to INIT/METHOD macros.

11 years agoSome Doxygen fixes.
Tobias Brunner [Mon, 5 Jul 2010 13:04:30 +0000 (15:04 +0200)]
Some Doxygen fixes.

11 years agoFixed typo.
Tobias Brunner [Mon, 5 Jul 2010 12:53:56 +0000 (14:53 +0200)]
Fixed typo.

11 years agoAdded support for group membership information containted in the RADIUS class attribute
Martin Willi [Mon, 28 Jun 2010 14:12:06 +0000 (16:12 +0200)]
Added support for group membership information containted in the RADIUS class attribute

11 years agoUse the group constraint in a more generic fashion, not only for attribute certificates
Martin Willi [Mon, 28 Jun 2010 13:46:13 +0000 (15:46 +0200)]
Use the group constraint in a more generic fashion, not only for attribute certificates

11 years agoUse the responder side configured EAP-Identity directly, if given
Martin Willi [Mon, 28 Jun 2010 13:45:07 +0000 (15:45 +0200)]
Use the responder side configured EAP-Identity directly, if given

11 years agoCopy EAP specific attributes to auth config only
Martin Willi [Mon, 28 Jun 2010 13:41:48 +0000 (15:41 +0200)]
Copy EAP specific attributes to auth config only

11 years agoDisable EAP-GTC on Android.
Tobias Brunner [Mon, 5 Jul 2010 07:37:49 +0000 (09:37 +0200)]
Disable EAP-GTC on Android.

The EAP-GTC plugin does not compile due to its dependency on PAM.

11 years agoadded IKEv2 xfrm marks support to NEWS
Andreas Steffen [Sat, 3 Jul 2010 20:14:45 +0000 (22:14 +0200)]
added IKEv2 xfrm marks support to NEWS

11 years agoregenerated loop intermediate CA certificates
Andreas Steffen [Sat, 3 Jul 2010 16:18:30 +0000 (18:18 +0200)]
regenerated loop intermediate CA certificates

11 years agoadded ikev2/nat-two-rw-mark scenario
Andreas Steffen [Sat, 3 Jul 2010 11:25:09 +0000 (13:25 +0200)]
added ikev2/nat-two-rw-mark scenario

11 years agosupport of xfrm marks for IKEv2
Andreas Steffen [Fri, 2 Jul 2010 21:45:57 +0000 (23:45 +0200)]
support of xfrm marks for IKEv2

11 years agoRecreate IKE_SA_INIT related tasks only if they have completed
Martin Willi [Wed, 30 Jun 2010 11:48:47 +0000 (13:48 +0200)]
Recreate IKE_SA_INIT related tasks only if they have completed