strongswan.git
6 years agotesting: Set terminal title when logging in via SSH
Tobias Brunner [Wed, 15 May 2013 08:32:41 +0000 (10:32 +0200)]
testing: Set terminal title when logging in via SSH

Since we always log in as root use a simpler command prompt. And don't
store duplicate commands in the bash command history.

6 years agoopenssl: Only warn about unavailable FIPS mode if the user requested it
Tobias Brunner [Wed, 8 May 2013 13:23:14 +0000 (15:23 +0200)]
openssl: Only warn about unavailable FIPS mode if the user requested it

6 years agoMerge branch 'charon-cmd-pkcs12'
Tobias Brunner [Wed, 8 May 2013 13:19:38 +0000 (15:19 +0200)]
Merge branch 'charon-cmd-pkcs12'

Adds support for PKCS#12 files in charon-cmd and ipsec.secrets.

Also fixes the cleanup of the OpenSSL library in the openssl plugin.

6 years agostroke: Add second password if provided
Tobias Brunner [Wed, 17 Apr 2013 15:32:37 +0000 (17:32 +0200)]
stroke: Add second password if provided

6 years agoLoad pkcs7 plugin in charon (and while we are at it in nm)
Tobias Brunner [Wed, 17 Apr 2013 15:13:28 +0000 (17:13 +0200)]
Load pkcs7 plugin in charon (and while we are at it in nm)

6 years agostroke: Fail silently if another builder calls PW callback after giving up
Tobias Brunner [Wed, 17 Apr 2013 14:03:05 +0000 (16:03 +0200)]
stroke: Fail silently if another builder calls PW callback after giving up

Also reduced the number of tries to 3.

6 years agostroke: Cache passwords so the user is not prompted multiple times for the same password
Tobias Brunner [Wed, 17 Apr 2013 13:54:23 +0000 (15:54 +0200)]
stroke: Cache passwords so the user is not prompted multiple times for the same password

To verify/decrypt a PKCS#12 container a password might be needed
multiple times.  If it was entered correctly we don't want to bother the
user again with another password prompt.
The passwords for MAC creation and encryption could be different so the
user might be prompted multiple times after all.

6 years agostroke: Fix prompt and error messages in passphrase callback
Tobias Brunner [Wed, 17 Apr 2013 13:51:11 +0000 (15:51 +0200)]
stroke: Fix prompt and error messages in passphrase callback

6 years agostroke: Load credentials from PKCS#12 files (P12 token)
Tobias Brunner [Wed, 17 Apr 2013 11:49:13 +0000 (13:49 +0200)]
stroke: Load credentials from PKCS#12 files (P12 token)

6 years agoopenssl: Cleanup thread specific error buffer
Tobias Brunner [Wed, 17 Apr 2013 11:16:20 +0000 (13:16 +0200)]
openssl: Cleanup thread specific error buffer

6 years agoopenssl: Don't use deprecated CRYPTO_set_id_callback() with OpenSSL >= 1.0.0
Tobias Brunner [Wed, 17 Apr 2013 11:00:51 +0000 (13:00 +0200)]
openssl: Don't use deprecated CRYPTO_set_id_callback() with OpenSSL >= 1.0.0

6 years agoopenssl: Add PKCS#12 parsing via OpenSSL
Tobias Brunner [Wed, 17 Apr 2013 09:43:06 +0000 (11:43 +0200)]
openssl: Add PKCS#12 parsing via OpenSSL

6 years agoopenssl: Properly cleanup OpenSSL library
Tobias Brunner [Wed, 17 Apr 2013 09:35:18 +0000 (11:35 +0200)]
openssl: Properly cleanup OpenSSL library

6 years agocharon-cmd: Add support for PKCS#12 files
Tobias Brunner [Fri, 12 Apr 2013 17:30:03 +0000 (19:30 +0200)]
charon-cmd: Add support for PKCS#12 files

6 years agoPEM plugin loads PKCS#12 containers from (DER-encoded) files
Tobias Brunner [Fri, 12 Apr 2013 17:00:15 +0000 (19:00 +0200)]
PEM plugin loads PKCS#12 containers from (DER-encoded) files

It is not actually able to handle PEM encoded PKCS#12 files produced
by OpenSSL.

6 years agoRemove pluto specific certificate types
Tobias Brunner [Fri, 12 Apr 2013 16:41:26 +0000 (18:41 +0200)]
Remove pluto specific certificate types

6 years agocharon-cmd: match_me/match_other are optional in callback credentials
Tobias Brunner [Fri, 12 Apr 2013 17:32:01 +0000 (19:32 +0200)]
charon-cmd: match_me/match_other are optional in callback credentials

6 years agocharon-cmd: Request password for private keys
Tobias Brunner [Fri, 12 Apr 2013 16:28:17 +0000 (18:28 +0200)]
charon-cmd: Request password for private keys

6 years agoAdd support for untruncated HMAC-SHA-512
Tobias Brunner [Fri, 12 Apr 2013 10:48:04 +0000 (12:48 +0200)]
Add support for untruncated HMAC-SHA-512

6 years agoAlso support 128-bit RC2
Tobias Brunner [Fri, 12 Apr 2013 10:10:22 +0000 (12:10 +0200)]
Also support 128-bit RC2

6 years agoAdd pkcs12 plugin which adds support for decoding PKCS#12 containers
Tobias Brunner [Fri, 12 Apr 2013 09:59:01 +0000 (11:59 +0200)]
Add pkcs12 plugin which adds support for decoding PKCS#12 containers

6 years agoFunction added to convert a hash algorithm to an HMAC integrity algorithm
Tobias Brunner [Thu, 11 Apr 2013 17:41:48 +0000 (19:41 +0200)]
Function added to convert a hash algorithm to an HMAC integrity algorithm

6 years agoSupport the PKCS#5/PKCS#12 encryption scheme used by OpenSSL for private keys
Tobias Brunner [Thu, 11 Apr 2013 17:39:32 +0000 (19:39 +0200)]
Support the PKCS#5/PKCS#12 encryption scheme used by OpenSSL for private keys

6 years agoRegister PKCS#8 builder for KEY_ANY
Tobias Brunner [Thu, 11 Apr 2013 15:54:45 +0000 (17:54 +0200)]
Register PKCS#8 builder for KEY_ANY

6 years agoAdd support for PKCS#7/CMS encrypted-data
Tobias Brunner [Thu, 11 Apr 2013 14:19:16 +0000 (16:19 +0200)]
Add support for PKCS#7/CMS encrypted-data

6 years agoMove PKCS#12 key derivation to a separate file
Tobias Brunner [Thu, 11 Apr 2013 13:02:28 +0000 (15:02 +0200)]
Move PKCS#12 key derivation to a separate file

6 years agoPKCS#5 wrapper can decrypt PKCS#12-like schemes
Tobias Brunner [Thu, 11 Apr 2013 11:27:02 +0000 (13:27 +0200)]
PKCS#5 wrapper can decrypt PKCS#12-like schemes

6 years agoAdd test vectors for RC2
Tobias Brunner [Wed, 10 Apr 2013 17:26:05 +0000 (19:26 +0200)]
Add test vectors for RC2

6 years agoFix cleanup in crypto_tester if a crypter fails
Tobias Brunner [Wed, 10 Apr 2013 17:25:26 +0000 (19:25 +0200)]
Fix cleanup in crypto_tester if a crypter fails

6 years agoAdd implementation of the RC2 block cipher (RFC 2268)
Tobias Brunner [Wed, 10 Apr 2013 17:24:09 +0000 (19:24 +0200)]
Add implementation of the RC2 block cipher (RFC 2268)

6 years agoExtract function to convert ASN.1 INTEGER object to u_int64_t
Tobias Brunner [Mon, 8 Apr 2013 16:31:34 +0000 (18:31 +0200)]
Extract function to convert ASN.1 INTEGER object to u_int64_t

6 years agoExtract PKCS#5 handling from pkcs8 plugin to separate helper class
Tobias Brunner [Mon, 8 Apr 2013 16:13:03 +0000 (18:13 +0200)]
Extract PKCS#5 handling from pkcs8 plugin to separate helper class

6 years agoMerge branch 'charon-cmd-agent'
Tobias Brunner [Wed, 8 May 2013 12:35:05 +0000 (14:35 +0200)]
Merge branch 'charon-cmd-agent'

Adds support for authentication via ssh-agent to charon-cmd (RSA and ECDSA keys
are currently supported).

The new sshkey plugin parses SSH public keys in RFC 4253 format.

SSH public keys can be configured with the left|rightsigkey ipsec.conf option,
which replaces left|rightrsasigkey and takes a public key in one of three
formats: SSH (RFC 4253, ssh: prefix), DNSKEY (RFC 3110, dns: prefix, not the
full RR, only the actual RSA key), or PKCS#1 (the default, no prefix).
As before the keys are either encoded in hex (0x) or base64 (0s).
left|rightsigkey also accepts the path to a file containing a PEM or DER
encoded public key.

6 years agocharon-cmd: Changed formatting of optional arguments in usage information
Tobias Brunner [Tue, 7 May 2013 13:05:12 +0000 (15:05 +0200)]
charon-cmd: Changed formatting of optional arguments in usage information

Optional arguments have to be specified with = after the option.

6 years agocharon-cmd: --agent optionally takes the path to an ssh-agent socket
Tobias Brunner [Tue, 7 May 2013 13:04:02 +0000 (15:04 +0200)]
charon-cmd: --agent optionally takes the path to an ssh-agent socket

If not given it is read from the SSH_AUTH_SOCK environment variable.

6 years agocharon-cmd: Stop processing options if an argument is missing or an option not recognized
Tobias Brunner [Tue, 7 May 2013 12:53:27 +0000 (14:53 +0200)]
charon-cmd: Stop processing options if an argument is missing or an option not recognized

6 years agocharon-cmd: Properly initialize options with no additional lines
Tobias Brunner [Tue, 7 May 2013 12:08:20 +0000 (14:08 +0200)]
charon-cmd: Properly initialize options with no additional lines

6 years agoagent: Use sshkey plugin to parse keys, adds support for ECDSA
Tobias Brunner [Mon, 1 Apr 2013 17:47:23 +0000 (19:47 +0200)]
agent: Use sshkey plugin to parse keys, adds support for ECDSA

6 years agosshkey: Add support for ECDSA keys
Tobias Brunner [Mon, 1 Apr 2013 16:16:17 +0000 (18:16 +0200)]
sshkey: Add support for ECDSA keys

6 years agoLoad any type (RSA/ECDSA) of public key via left|rightsigkey
Tobias Brunner [Mon, 1 Apr 2013 14:42:53 +0000 (16:42 +0200)]
Load any type (RSA/ECDSA) of public key via left|rightsigkey

6 years agoleft|rightrsasigkey accepts SSH keys but the key format has to be specified explicitly
Tobias Brunner [Mon, 1 Apr 2013 14:28:28 +0000 (16:28 +0200)]
left|rightrsasigkey accepts SSH keys but the key format has to be specified explicitly

The default is now PKCS#1. With the dns: and ssh: prefixes other formats
can be selected.

6 years agosshkey: Added builder for SSHKEY RSA keys
Tobias Brunner [Mon, 1 Apr 2013 14:02:00 +0000 (16:02 +0200)]
sshkey: Added builder for SSHKEY RSA keys

6 years agoAdd sshkey plugin stub that will parse RFC 4253 public keys
Tobias Brunner [Mon, 1 Apr 2013 13:20:39 +0000 (15:20 +0200)]
Add sshkey plugin stub that will parse RFC 4253 public keys

6 years agoTry to load raw keys from ipsec.conf as PKCS#1 blob first
Tobias Brunner [Mon, 1 Apr 2013 11:51:37 +0000 (13:51 +0200)]
Try to load raw keys from ipsec.conf as PKCS#1 blob first

The DNSKEY builder is quite eager and parses pretty much anything
as RSA key, so this has to be done before.

6 years agocharon-cmd: Add --agent option to authenticate using ssh-agent(1)
Tobias Brunner [Mon, 1 Apr 2013 12:51:09 +0000 (14:51 +0200)]
charon-cmd: Add --agent option to authenticate using ssh-agent(1)

The socket path is read from the SSH_AUTH_SOCK environment variable.
So using this with sudo might require the -E command line (or an appropriate
sudoers config) to preserve the environment.

6 years agocharon-cmd: Use loose matching of gateway identity
Tobias Brunner [Mon, 1 Apr 2013 12:48:02 +0000 (14:48 +0200)]
charon-cmd: Use loose matching of gateway identity

6 years agocharon-cmd: Load pubkey plugin to load raw keys
Tobias Brunner [Mon, 1 Apr 2013 12:47:09 +0000 (14:47 +0200)]
charon-cmd: Load pubkey plugin to load raw keys

6 years agotesting: Don't run tests when building tkm
Tobias Brunner [Tue, 7 May 2013 08:19:37 +0000 (10:19 +0200)]
testing: Don't run tests when building tkm

The problem with XML/Ada described in 9c2aba27 actually occurs when
running the tests here.

Really fixes #336.

6 years agotesting: Don't run tests when building tkm-rpc
Tobias Brunner [Mon, 6 May 2013 15:21:30 +0000 (17:21 +0200)]
testing: Don't run tests when building tkm-rpc

There are issues with some versions of the XML/Ada library on i386,
blocking the build of the testing environment when these tests are run.
TKM tests won't work in such a case but at least make-testing does not
block with this patch.

Fixes #336.

6 years agoMerge branch 'tun-vip'
Martin Willi [Mon, 6 May 2013 15:04:36 +0000 (17:04 +0200)]
Merge branch 'tun-vip'

Beside some OS X love, this merge introduces virtual IP and route installation
support on the pfkey/pfroute kernel interfaces.

Each virtual IP gets installed on a dedicated TUN device. As Linux-like source
routes are not supported, routes for the negotiated traffic selectors get
installed using the TUN device.

To prevent IKE packets from using those routes, special exclude routes get
installed to the IKE gateway. This works for most road-warrior deployments, but
certainly does not for some more exotic configurations, such as those using
virtual-IP-to-host. Mobility is not yet supported, either.

6 years agokernel-pfroute: allow only one thread to do a route look up simultaneously
Martin Willi [Mon, 6 May 2013 14:40:19 +0000 (16:40 +0200)]
kernel-pfroute: allow only one thread to do a route look up simultaneously

Otherwise we mess up the sequence number another thread is waiting for.

6 years agokernel-interface: query SAD for last use time if SPD query didn't yield one
Martin Willi [Sun, 21 Apr 2013 15:05:08 +0000 (17:05 +0200)]
kernel-interface: query SAD for last use time if SPD query didn't yield one

6 years agochild-sa: query SAD/SPD just for what we actually need to update statistics
Martin Willi [Sun, 21 Apr 2013 14:50:17 +0000 (16:50 +0200)]
child-sa: query SAD/SPD just for what we actually need to update statistics

6 years agokernel-pfkey: be less verbose about unexpected sequence numbers
Martin Willi [Sat, 20 Apr 2013 18:54:03 +0000 (20:54 +0200)]
kernel-pfkey: be less verbose about unexpected sequence numbers

6 years agokernel-pfkey: install exclude routes if kernel-net requires them
Martin Willi [Sat, 20 Apr 2013 11:29:20 +0000 (13:29 +0200)]
kernel-pfkey: install exclude routes if kernel-net requires them

6 years agokernel-pfroute: add a feature flag requesting "exclude" routes
Martin Willi [Sat, 20 Apr 2013 10:28:05 +0000 (12:28 +0200)]
kernel-pfroute: add a feature flag requesting "exclude" routes

If routes installed along with policies covering the peer address affect local
IKE/ESP packets, they won't get routed correctly. To work around this issue,
the kernel interface can install "exclude" routes for the IKE peer. Not all
networking backends require this workaround, hence we export a flag for it
if it is required.

6 years agokernel-pfroute: remove unused interface address refcounting
Martin Willi [Fri, 19 Apr 2013 14:58:06 +0000 (16:58 +0200)]
kernel-pfroute: remove unused interface address refcounting

6 years agokernel-pfroute: mark IPs installed on tun device as virtual
Martin Willi [Fri, 19 Apr 2013 14:55:38 +0000 (16:55 +0200)]
kernel-pfroute: mark IPs installed on tun device as virtual

6 years agokernel-pfroute: install virtual IPs using dedicated tun devices
Martin Willi [Fri, 19 Apr 2013 13:53:45 +0000 (15:53 +0200)]
kernel-pfroute: install virtual IPs using dedicated tun devices

6 years agokernel-pfkey: when installing a route for a virtual IP, use its interface
Martin Willi [Fri, 19 Apr 2013 12:27:31 +0000 (14:27 +0200)]
kernel-pfkey: when installing a route for a virtual IP, use its interface

When installing a route over a tun device for a virtual IP, the route must
be set over the tun, not the IKE interface.

6 years agokernel-interface: get_address_by_ts() can tell if a returned IP is virtual
Martin Willi [Fri, 19 Apr 2013 12:22:45 +0000 (14:22 +0200)]
kernel-interface: get_address_by_ts() can tell if a returned IP is virtual

6 years agokernel-interface: support enumeration of virtual-only IPs
Martin Willi [Fri, 19 Apr 2013 12:52:29 +0000 (14:52 +0200)]
kernel-interface: support enumeration of virtual-only IPs

6 years agokernel-pfkey: refactor route installation to a dedicate function
Martin Willi [Fri, 19 Apr 2013 12:17:22 +0000 (14:17 +0200)]
kernel-pfkey: refactor route installation to a dedicate function

6 years agokernel-pfroute: split /0 routes to avoid conflict with default route
Martin Willi [Fri, 19 Apr 2013 10:17:25 +0000 (12:17 +0200)]
kernel-pfroute: split /0 routes to avoid conflict with default route

6 years agokernel-pfkey: check if we have a gateway before comparing them
Martin Willi [Fri, 19 Apr 2013 10:16:12 +0000 (12:16 +0200)]
kernel-pfkey: check if we have a gateway before comparing them

6 years agokernel-pfkey: install route along with input, not forward policies
Martin Willi [Fri, 19 Apr 2013 08:42:23 +0000 (10:42 +0200)]
kernel-pfkey: install route along with input, not forward policies

As forwarding policies are not available on all systems (OS X), using the
forward policy to attach the route is a bad pick. Using input policies allows
OS X to install routes.

6 years agokernel-pfroute: rescan address list for an interface if its state changes
Martin Willi [Fri, 19 Apr 2013 08:47:34 +0000 (10:47 +0200)]
kernel-pfroute: rescan address list for an interface if its state changes

It seems that we don't get address notifications if the interface is down
on OS X.

6 years agokernel-pfroute: add newly appearing interfaces to the interface cache
Martin Willi [Fri, 19 Apr 2013 08:46:04 +0000 (10:46 +0200)]
kernel-pfroute: add newly appearing interfaces to the interface cache

6 years agokernel-pfroute: implement get_nexthop()
Martin Willi [Thu, 18 Apr 2013 16:26:49 +0000 (18:26 +0200)]
kernel-pfroute: implement get_nexthop()

6 years agokernel-pfroute: install and uninstall routes
Martin Willi [Thu, 18 Apr 2013 16:19:24 +0000 (18:19 +0200)]
kernel-pfroute: install and uninstall routes

6 years agokernel-pfroute: collect replies received for our own queries
Martin Willi [Thu, 18 Apr 2013 16:15:25 +0000 (18:15 +0200)]
kernel-pfroute: collect replies received for our own queries

6 years agokernel-pfroute: refactor PF_ROUTE message processing, use an enumerator
Martin Willi [Thu, 18 Apr 2013 15:58:48 +0000 (17:58 +0200)]
kernel-pfroute: refactor PF_ROUTE message processing, use an enumerator

6 years agokernel-pfkey: use an int to set esp_port with a sysctl on OS X
Martin Willi [Thu, 18 Apr 2013 14:53:35 +0000 (16:53 +0200)]
kernel-pfkey: use an int to set esp_port with a sysctl on OS X

6 years agokernel-pfroute: use INIT() macro for allocations
Martin Willi [Thu, 18 Apr 2013 14:20:11 +0000 (16:20 +0200)]
kernel-pfroute: use INIT() macro for allocations

6 years agokernel-pfroute: use only a single PF_ROUTE socket for both events and queries
Martin Willi [Thu, 18 Apr 2013 14:08:12 +0000 (16:08 +0200)]
kernel-pfroute: use only a single PF_ROUTE socket for both events and queries

6 years agokernel-pfroute: fix length check when receiving PF_ROUTE messages
Martin Willi [Wed, 17 Apr 2013 12:48:58 +0000 (14:48 +0200)]
kernel-pfroute: fix length check when receiving PF_ROUTE messages

6 years agokernel-pfkey: remove obsolete pluto specific behavior
Martin Willi [Mon, 6 May 2013 13:30:07 +0000 (15:30 +0200)]
kernel-pfkey: remove obsolete pluto specific behavior

6 years agokernel-netlink: remove obsolete pluto specific behavior
Martin Willi [Fri, 12 Apr 2013 09:32:05 +0000 (11:32 +0200)]
kernel-netlink: remove obsolete pluto specific behavior

6 years agotun_device: add a getter for the address previously passed to set_address()
Martin Willi [Fri, 12 Apr 2013 11:03:21 +0000 (13:03 +0200)]
tun_device: add a getter for the address previously passed to set_address()

6 years agotun_device: add a getter for the underlying file descriptor
Martin Willi [Fri, 12 Apr 2013 10:42:14 +0000 (12:42 +0200)]
tun_device: add a getter for the underlying file descriptor

6 years agotun-device: use host_create_netmask() to calculate interface netmask
Martin Willi [Tue, 16 Apr 2013 10:09:18 +0000 (12:09 +0200)]
tun-device: use host_create_netmask() to calculate interface netmask

6 years agohost: add a netmask constructor taking the number of network bits
Martin Willi [Tue, 16 Apr 2013 10:08:38 +0000 (12:08 +0200)]
host: add a netmask constructor taking the number of network bits

6 years agohost: remove unused host_t.get_differences() method
Martin Willi [Mon, 15 Apr 2013 14:27:31 +0000 (16:27 +0200)]
host: remove unused host_t.get_differences() method

6 years agohost: print %#H format specifiers not as %any, but with the port
Martin Willi [Thu, 11 Apr 2013 17:51:45 +0000 (19:51 +0200)]
host: print %#H format specifiers not as %any, but with the port

6 years agohost: initialize sockaddr->sa_len if it is available
Martin Willi [Wed, 20 Mar 2013 17:15:26 +0000 (18:15 +0100)]
host: initialize sockaddr->sa_len if it is available

6 years agochild-sa: pass traffic selector to add_sa() regardless of IPsec mode
Martin Willi [Fri, 12 Apr 2013 11:19:59 +0000 (13:19 +0200)]
child-sa: pass traffic selector to add_sa() regardless of IPsec mode

This lets the kernel backend decide what to do with it, and in fact all kernel
interfaces already handle this correctly.

6 years agosocket-default: to bind to one dynamic port on OS X, create v4 socket before v6
Martin Willi [Thu, 11 Apr 2013 18:22:06 +0000 (20:22 +0200)]
socket-default: to bind to one dynamic port on OS X, create v4 socket before v6

It seems that the order of binding sockets of different address families to the
same dynamic port must be v6-before-v4 on Linux, but v4-before-v6 on OS X.

6 years agosocket-default: refactor socket pair opening to a function
Martin Willi [Thu, 11 Apr 2013 18:19:57 +0000 (20:19 +0200)]
socket-default: refactor socket pair opening to a function

6 years agosocket-default: Don't try to send packet if we haven't a socket for given family
Martin Willi [Thu, 11 Apr 2013 17:47:28 +0000 (19:47 +0200)]
socket-default: Don't try to send packet if we haven't a socket for given family

6 years agosocket-default: Use -1 if socket is not available, as 0 is actually a valid fd
Martin Willi [Thu, 11 Apr 2013 17:40:31 +0000 (19:40 +0200)]
socket-default: Use -1 if socket is not available, as 0 is actually a valid fd

6 years agosemaphore: similar to thread_create(), semaphore_create() is used by Mach
Martin Willi [Thu, 11 Apr 2013 17:20:33 +0000 (19:20 +0200)]
semaphore: similar to thread_create(), semaphore_create() is used by Mach

The compiler spits no warning, but the wrong symbol is used when calling
semaphore_create() from strongSwan. Override the name with a #define to force
the use of our semaphore_create().

6 years ago.gitignore: add OS X .DS_Store files
Martin Willi [Thu, 11 Apr 2013 15:34:44 +0000 (17:34 +0200)]
.gitignore: add OS X .DS_Store files

6 years agoMerge branch 'charon-cmd'
Martin Willi [Mon, 6 May 2013 14:01:25 +0000 (16:01 +0200)]
Merge branch 'charon-cmd'

Introduce a simple IKEv1/IKEv2 command line client, charon-cmd. It does
not need any configuration files at all, but takes a few command line arguments
to establish connections as a road warrior.

6 years agocharon-cmd: add an option to set a different server identity
Martin Willi [Mon, 22 Apr 2013 10:42:01 +0000 (12:42 +0200)]
charon-cmd: add an option to set a different server identity

6 years agoproposals: try next if IKEv2 algorithm could not be mapped to IKEv1
Martin Willi [Mon, 22 Apr 2013 10:33:52 +0000 (12:33 +0200)]
proposals: try next if IKEv2 algorithm could not be mapped to IKEv1

6 years agocharon-cmd: add support for different IKEv1/IKEv2 authentication profiles
Martin Willi [Mon, 22 Apr 2013 10:33:10 +0000 (12:33 +0200)]
charon-cmd: add support for different IKEv1/IKEv2 authentication profiles

6 years agocharon-cmd: support multi-line help text for each option in usage
Martin Willi [Mon, 22 Apr 2013 09:20:58 +0000 (11:20 +0200)]
charon-cmd: support multi-line help text for each option in usage

6 years agocharon-cmd: add --local/remote-ts options to set traffic selectors
Martin Willi [Mon, 22 Apr 2013 08:52:17 +0000 (10:52 +0200)]
charon-cmd: add --local/remote-ts options to set traffic selectors

6 years agocharon-cmd: Use dynamic ports with the socket-default plugin
Martin Willi [Thu, 11 Apr 2013 17:27:27 +0000 (19:27 +0200)]
charon-cmd: Use dynamic ports with the socket-default plugin

6 years agosettings: Add a set_default_str() to set a different default for a key
Martin Willi [Thu, 11 Apr 2013 17:23:29 +0000 (19:23 +0200)]
settings: Add a set_default_str() to set a different default for a key

The value is set only if it is not configured in strongswan.conf or has
not been set() otherwise.