strongswan.git
10 years agoUse actual daemon name to enable XAuth/PSK with aggressive mode
Martin Willi [Fri, 10 Aug 2012 09:53:18 +0000 (11:53 +0200)]
Use actual daemon name to enable XAuth/PSK with aggressive mode

10 years agoAdd xauth-pam/eap-gtc NEWS
Martin Willi [Fri, 10 Aug 2012 09:50:44 +0000 (11:50 +0200)]
Add xauth-pam/eap-gtc NEWS

10 years agoEAP-GTC can use any XAuth backend, including xauth-pam
Martin Willi [Thu, 9 Aug 2012 13:16:59 +0000 (15:16 +0200)]
EAP-GTC can use any XAuth backend, including xauth-pam

This makes EAP-GTC a generic plain password authentication method,
as it is used with XAuth. Instead of verifying credentials with
PAM, any backend can be configured. The default is xauth-pam,
providing the same functionality as EAP-GTC in strongSwan 4.x.

10 years agoAdd xauth-pam, an XAuth backend verifying credentials with PAM
Martin Willi [Thu, 9 Aug 2012 12:39:31 +0000 (14:39 +0200)]
Add xauth-pam, an XAuth backend verifying credentials with PAM

10 years agoAdd getspnam_r() to leak detective whitelist
Martin Willi [Thu, 9 Aug 2012 12:38:29 +0000 (14:38 +0200)]
Add getspnam_r() to leak detective whitelist

10 years agomake max_message_size parameter consistent with similar options
Andreas Steffen [Thu, 9 Aug 2012 12:11:08 +0000 (14:11 +0200)]
make max_message_size parameter consistent with similar options

10 years agoCheck if TLS handshake received Finished before processing application data
Martin Willi [Thu, 9 Aug 2012 10:10:41 +0000 (12:10 +0200)]
Check if TLS handshake received Finished before processing application data

10 years agoRemove queued IKEv1 message before processing it
Martin Willi [Wed, 8 Aug 2012 12:54:03 +0000 (14:54 +0200)]
Remove queued IKEv1 message before processing it

Avoids destruction or processing of a queued message in
recursive process_message() call.

10 years agoInclude src address in hash of initial message for Main Mode
Tobias Brunner [Thu, 2 Aug 2012 14:16:58 +0000 (16:16 +0200)]
Include src address in hash of initial message for Main Mode

If two initiators use the same SPI and also use the same SA proposal the
hash for the initial message would be exactly the same.  For IKEv2 and
Aggressive Mode that's not a problem as these messages include random
data (Ni, KEi payloads).

10 years agoimplemented deletion of product_file database entries
Andreas Steffen [Tue, 7 Aug 2012 13:05:59 +0000 (15:05 +0200)]
implemented deletion of product_file database entries

10 years agoAdd DH group 15 (MODP-3072) to IKE proposal
Adrian-Ken Rueegsegger [Mon, 6 Aug 2012 09:12:25 +0000 (11:12 +0200)]
Add DH group 15 (MODP-3072) to IKE proposal

10 years agoPEM loading soft-depends on MD5 only, as unencrypted files don't need MD5
Martin Willi [Fri, 3 Aug 2012 13:25:17 +0000 (15:25 +0200)]
PEM loading soft-depends on MD5 only, as unencrypted files don't need MD5

Fixes #211.

10 years agoRebuild charon after running ./configure to reflect plugin changes
Martin Willi [Fri, 3 Aug 2012 11:11:45 +0000 (13:11 +0200)]
Rebuild charon after running ./configure to reflect plugin changes

10 years agoBlock XAuth transaction on established IKE_SAs, but allow Mode Config
Martin Willi [Fri, 3 Aug 2012 11:07:19 +0000 (13:07 +0200)]
Block XAuth transaction on established IKE_SAs, but allow Mode Config

10 years agoImplemented recursive mutex without thread-specific counter
Tobias Brunner [Fri, 3 Aug 2012 09:23:17 +0000 (11:23 +0200)]
Implemented recursive mutex without thread-specific counter

10 years agoUse a single thread-specific value for our custom rwlock_t implementation
Tobias Brunner [Fri, 3 Aug 2012 08:47:33 +0000 (10:47 +0200)]
Use a single thread-specific value for our custom rwlock_t implementation

The pthread implementation on Android currently only supports 64
different thread-specific values per process, which we hit easily when
every rwlock_t requires one.

10 years agoFix linking of addrblock plugin when building monolithic
Martin Willi [Fri, 3 Aug 2012 08:50:21 +0000 (10:50 +0200)]
Fix linking of addrblock plugin when building monolithic

Fixes #212.

10 years agoReject initial exchange messages early once IKE_SA is established
Martin Willi [Thu, 2 Aug 2012 10:50:31 +0000 (12:50 +0200)]
Reject initial exchange messages early once IKE_SA is established

10 years agoAdd some more NEWS about 5.0.1
Martin Willi [Thu, 2 Aug 2012 10:23:59 +0000 (12:23 +0200)]
Add some more NEWS about 5.0.1

10 years agoMove MODP_CUSTOM va_arg fetching out of loop
Martin Willi [Thu, 2 Aug 2012 10:06:51 +0000 (12:06 +0200)]
Move MODP_CUSTOM va_arg fetching out of loop

It seems problematic at least on PPC with gcc 4.3, fixes #208.

10 years agoupdated NEWS
Andreas Steffen [Tue, 31 Jul 2012 15:25:07 +0000 (17:25 +0200)]
updated NEWS

10 years agolibimcv requires nonce plugin
Andreas Steffen [Tue, 31 Jul 2012 14:46:40 +0000 (16:46 +0200)]
libimcv requires nonce plugin

10 years agoLookup IKEv1 PSK even if the peer identity is not known
Martin Willi [Tue, 31 Jul 2012 11:41:59 +0000 (13:41 +0200)]
Lookup IKEv1 PSK even if the peer identity is not known

10 years agoupdate state before handling status
Andreas Steffen [Mon, 30 Jul 2012 21:19:25 +0000 (23:19 +0200)]
update state before handling status

10 years agoimplemented support if functional sub-components
Andreas Steffen [Mon, 30 Jul 2012 18:48:05 +0000 (20:48 +0200)]
implemented support if functional sub-components

10 years agoextended and documented ipsec attest
Andreas Steffen [Mon, 30 Jul 2012 18:44:15 +0000 (20:44 +0200)]
extended and documented ipsec attest

10 years agoProper fallback if capability dropping is not available
Tobias Brunner [Fri, 27 Jul 2012 12:45:15 +0000 (14:45 +0200)]
Proper fallback if capability dropping is not available

10 years agoThe use of $< in Makefiles is not portable
Tobias Brunner [Fri, 27 Jul 2012 11:39:18 +0000 (13:39 +0200)]
The use of $< in Makefiles is not portable

It requires GNU make which is not what most people use on e.g. FreeBSD.

Fixes #205.

10 years agoInclude stdint.h for UINTxx_MAX defines
Tobias Brunner [Fri, 27 Jul 2012 09:36:59 +0000 (11:36 +0200)]
Include stdint.h for UINTxx_MAX defines

Fixes #205.

10 years agomeasure all kernel modules and optimize firefox and thunderbird measurements
Andreas Steffen [Fri, 27 Jul 2012 09:47:09 +0000 (11:47 +0200)]
measure all kernel modules and optimize firefox and thunderbird measurements

10 years agowith --relative --file do not insert absolute filenames into database
Andreas Steffen [Fri, 27 Jul 2012 09:45:56 +0000 (11:45 +0200)]
with --relative --file do not insert absolute filenames into database

10 years agoDon't include acquiring packet traffic selectors in IKEv1
Martin Willi [Thu, 26 Jul 2012 13:45:49 +0000 (15:45 +0200)]
Don't include acquiring packet traffic selectors in IKEv1

As we only can negotiate a single TS in IKEv1, don't prepend the
triggering packet TS, as we do in IKEv2. Otherwise we don't establish
the TS of the configuration, but only that of the triggering packet.

Fixes #207.

10 years agoImplement late peer config switching after XAuth authentication
Martin Willi [Thu, 26 Jul 2012 13:02:37 +0000 (15:02 +0200)]
Implement late peer config switching after XAuth authentication

If additional authentication constraints, such as group membership,
is not fulfilled by an XAuth backend, we search for another
peer configuration that fulfills all constraints, including those
from phase1.

10 years agoCheck if XAuth round complies to configured authentication round
Martin Willi [Thu, 26 Jul 2012 10:40:27 +0000 (12:40 +0200)]
Check if XAuth round complies to configured authentication round

10 years agoShow which group would be required when failing in constraint check
Martin Willi [Thu, 26 Jul 2012 10:39:53 +0000 (12:39 +0200)]
Show which group would be required when failing in constraint check

10 years agoDon't add ANY identity constraint to auth config, as XAuth rounds don't use one
Martin Willi [Thu, 26 Jul 2012 10:38:34 +0000 (12:38 +0200)]
Don't add ANY identity constraint to auth config, as XAuth rounds don't use one

10 years agoMerge auth config items added from XAuth backends to IKE_SA
Martin Willi [Thu, 26 Jul 2012 10:07:48 +0000 (12:07 +0200)]
Merge auth config items added from XAuth backends to IKE_SA

10 years agoAdd an ipsec.conf leftgroups2 parameter for the second authentication round
Martin Willi [Thu, 26 Jul 2012 09:49:46 +0000 (11:49 +0200)]
Add an ipsec.conf leftgroups2 parameter for the second authentication round

10 years agoIMA SHA1 file measurement is not needed any more
Andreas Steffen [Mon, 23 Jul 2012 20:19:20 +0000 (22:19 +0200)]
IMA SHA1 file measurement is not needed any more

10 years agofixed typo
Andreas Steffen [Mon, 23 Jul 2012 20:17:53 +0000 (22:17 +0200)]
fixed typo

10 years agoRelease leaking child config after uninstalling shunt policy
Martin Willi [Mon, 23 Jul 2012 15:13:20 +0000 (17:13 +0200)]
Release leaking child config after uninstalling shunt policy

10 years agomoved PA-TNC message logging to level 1
Andreas Steffen [Mon, 23 Jul 2012 11:04:28 +0000 (13:04 +0200)]
moved PA-TNC message logging to level 1

10 years agotransport IMA file info via PTS Component Evidence Policy URI
Andreas Steffen [Mon, 23 Jul 2012 10:51:37 +0000 (12:51 +0200)]
transport IMA file info via PTS Component Evidence Policy URI

10 years agoipsec attest now deletes file hashes
Andreas Steffen [Sun, 22 Jul 2012 07:29:39 +0000 (09:29 +0200)]
ipsec attest now deletes file hashes

10 years agobuffer PA-TNC attributes until Generate Attestation Evidence attribute is received
Andreas Steffen [Sat, 21 Jul 2012 14:43:24 +0000 (16:43 +0200)]
buffer PA-TNC attributes until Generate Attestation Evidence attribute is received

10 years agoallow --rel as an abbreviation for --relative
Andreas Steffen [Sat, 21 Jul 2012 13:58:08 +0000 (15:58 +0200)]
allow --rel as an abbreviation for --relative

10 years agomoved all shadow PCR stuff to the pts_pcr class
Andreas Steffen [Sat, 21 Jul 2012 13:56:39 +0000 (15:56 +0200)]
moved all shadow PCR stuff to the pts_pcr class

10 years agoSupport Unity split-include/exclude options in attr plugin
Martin Willi [Fri, 20 Jul 2012 14:14:29 +0000 (16:14 +0200)]
Support Unity split-include/exclude options in attr plugin

10 years agoDon't print hexdumps on loglevel 1 if hash verification fails
Martin Willi [Thu, 19 Jul 2012 12:48:37 +0000 (14:48 +0200)]
Don't print hexdumps on loglevel 1 if hash verification fails

10 years agocreated a pts_pcr class for PCR computations
Andreas Steffen [Fri, 20 Jul 2012 12:57:28 +0000 (14:57 +0200)]
created a pts_pcr class for PCR computations

10 years agorenamed build_database.sh to build-database.sh
Andreas Steffen [Fri, 20 Jul 2012 12:04:16 +0000 (14:04 +0200)]
renamed build_database.sh to build-database.sh

10 years agowhy the hell do firefox, thunderbird and acroread their own Linux libraries?
Andreas Steffen [Thu, 19 Jul 2012 16:27:08 +0000 (18:27 +0200)]
why the hell do firefox, thunderbird and acroread their own Linux libraries?

10 years agoAdd a libstrongswan-dev debian package with development headers
Martin Willi [Thu, 19 Jul 2012 06:28:07 +0000 (08:28 +0200)]
Add a libstrongswan-dev debian package with development headers

10 years agoPass CC/CFLAGS to ./configure, not to make, adding -include config.h
Martin Willi [Thu, 19 Jul 2012 06:44:55 +0000 (08:44 +0200)]
Pass CC/CFLAGS to ./configure, not to make, adding -include config.h

10 years agoUpgraded our Debian package to 5.0
Martin Willi [Tue, 3 Jul 2012 08:59:05 +0000 (10:59 +0200)]
Upgraded our Debian package to 5.0

10 years agoadded some multiply defined libraries
Andreas Steffen [Thu, 19 Jul 2012 11:49:20 +0000 (13:49 +0200)]
added some multiply defined libraries

10 years agoqueries with relative filenames might return multiple results
Andreas Steffen [Thu, 19 Jul 2012 11:48:32 +0000 (13:48 +0200)]
queries with relative filenames might return multiple results

10 years agoupdated build_database.sh
Andreas Steffen [Wed, 18 Jul 2012 20:00:58 +0000 (22:00 +0200)]
updated build_database.sh

10 years agoadded index to files table
Andreas Steffen [Wed, 18 Jul 2012 20:00:35 +0000 (22:00 +0200)]
added index to files table

10 years agoupdated build_database.sh
Andreas Steffen [Wed, 18 Jul 2012 11:55:08 +0000 (13:55 +0200)]
updated build_database.sh

10 years agoFix EAP-MSCHAPv2 master key derivation, broken with 87dd205b
Martin Willi [Wed, 18 Jul 2012 14:46:05 +0000 (16:46 +0200)]
Fix EAP-MSCHAPv2 master key derivation, broken with 87dd205b

10 years agoRemove debugging leftovers
Martin Willi [Wed, 18 Jul 2012 13:35:40 +0000 (15:35 +0200)]
Remove debugging leftovers

10 years agoAdd a SHA1 test vector forcing padding over block boundary
Martin Willi [Wed, 18 Jul 2012 10:28:16 +0000 (12:28 +0200)]
Add a SHA1 test vector forcing padding over block boundary

10 years agobuilds an Ubuntu 12.04 LTS measurement database
Andreas Steffen [Wed, 18 Jul 2012 09:33:39 +0000 (11:33 +0200)]
builds an Ubuntu 12.04 LTS measurement database

10 years agominor fixes in attest
Andreas Steffen [Wed, 18 Jul 2012 09:32:24 +0000 (11:32 +0200)]
minor fixes in attest

10 years agoAdd a tool to burn hashers
Martin Willi [Tue, 17 Jul 2012 15:11:01 +0000 (17:11 +0200)]
Add a tool to burn hashers

10 years agoUse centralized hasher names in pki utility
Martin Willi [Tue, 17 Jul 2012 15:31:02 +0000 (17:31 +0200)]
Use centralized hasher names in pki utility

10 years agoUse centralized hasher names in coupling plugin
Martin Willi [Tue, 17 Jul 2012 15:30:47 +0000 (17:30 +0200)]
Use centralized hasher names in coupling plugin

10 years agoUse centralized hasher names in openssl plugin
Martin Willi [Tue, 17 Jul 2012 15:30:23 +0000 (17:30 +0200)]
Use centralized hasher names in openssl plugin

10 years agoAdd short names for hasher algorithms
Martin Willi [Tue, 17 Jul 2012 13:35:02 +0000 (15:35 +0200)]
Add short names for hasher algorithms

10 years agovarious PTS fixes
Andreas Steffen [Tue, 17 Jul 2012 14:38:55 +0000 (16:38 +0200)]
various PTS fixes

10 years agoparcel IMA file measurements into batches
Andreas Steffen [Tue, 17 Jul 2012 11:44:02 +0000 (13:44 +0200)]
parcel IMA file measurements into batches

10 years agoregister _check_file_measurement() method
Andreas Steffen [Tue, 17 Jul 2012 11:42:58 +0000 (13:42 +0200)]
register _check_file_measurement() method

10 years agoFix tls_prf bug introduced with bc474883
Martin Willi [Tue, 17 Jul 2012 09:32:13 +0000 (11:32 +0200)]
Fix tls_prf bug introduced with bc474883

10 years agocheck IMA file measurements against database reference
Andreas Steffen [Tue, 17 Jul 2012 09:16:11 +0000 (11:16 +0200)]
check IMA file measurements against database reference

10 years agoSupport void return values in OpenSSL 0.9.8 HMAC functions
Martin Willi [Tue, 17 Jul 2012 08:58:53 +0000 (10:58 +0200)]
Support void return values in OpenSSL 0.9.8 HMAC functions

10 years agohandled return values in tnc-pdp
Andreas Steffen [Mon, 16 Jul 2012 20:54:38 +0000 (22:54 +0200)]
handled return values in tnc-pdp

10 years agofixed potential hasher problem in IMA template hash
Andreas Steffen [Mon, 16 Jul 2012 20:44:45 +0000 (22:44 +0200)]
fixed potential hasher problem in IMA template hash

10 years agofixed potential hasher problems
Andreas Steffen [Mon, 16 Jul 2012 20:39:34 +0000 (22:39 +0200)]
fixed potential hasher problems

10 years agouse a nonce for a PA-TNC message identifier
Andreas Steffen [Mon, 16 Jul 2012 16:08:49 +0000 (18:08 +0200)]
use a nonce for a PA-TNC message identifier

10 years agoipsec attest supports ima template hashes
Andreas Steffen [Mon, 16 Jul 2012 15:14:27 +0000 (17:14 +0200)]
ipsec attest supports ima template hashes

10 years agoHandle PRF failures in eap-aka-3gpp2
Martin Willi [Tue, 10 Jul 2012 13:11:25 +0000 (15:11 +0200)]
Handle PRF failures in eap-aka-3gpp2

10 years agoRefactored error handling in keymat_v1_t
Martin Willi [Tue, 10 Jul 2012 12:51:17 +0000 (14:51 +0200)]
Refactored error handling in keymat_v1_t

10 years agoClean up error handling in keymat_v2_t
Martin Willi [Tue, 10 Jul 2012 12:28:08 +0000 (14:28 +0200)]
Clean up error handling in keymat_v2_t

10 years agoCleaned up memory management and return values for encryption payload
Martin Willi [Tue, 10 Jul 2012 12:24:46 +0000 (14:24 +0200)]
Cleaned up memory management and return values for encryption payload

10 years agoFix memory management in SIM/AKA crypto functions
Martin Willi [Tue, 10 Jul 2012 11:37:59 +0000 (13:37 +0200)]
Fix memory management in SIM/AKA crypto functions

10 years agoTest reset() of hasher in crypto tester
Martin Willi [Tue, 10 Jul 2012 11:19:36 +0000 (13:19 +0200)]
Test reset() of hasher in crypto tester

10 years agoRefactored error handling in crypto tester
Martin Willi [Tue, 10 Jul 2012 07:49:38 +0000 (09:49 +0200)]
Refactored error handling in crypto tester

10 years agoSet a key before benching PRFs
Martin Willi [Tue, 10 Jul 2012 07:07:13 +0000 (09:07 +0200)]
Set a key before benching PRFs

10 years agoResetting OpenSSL HMAC with NULL key reuses existing key
Martin Willi [Tue, 10 Jul 2012 07:06:15 +0000 (09:06 +0200)]
Resetting OpenSSL HMAC with NULL key reuses existing key

10 years agoMake sure HMAC_Init is called before HMAC_Update, fixes crash
Martin Willi [Tue, 10 Jul 2012 07:03:38 +0000 (09:03 +0200)]
Make sure HMAC_Init is called before HMAC_Update, fixes crash

10 years agoCheck and forward syscall errors in AF_ALG
Martin Willi [Mon, 9 Jul 2012 15:55:52 +0000 (17:55 +0200)]
Check and forward syscall errors in AF_ALG

10 years agoAdd a return value to hasher_t.reset()
Martin Willi [Mon, 9 Jul 2012 15:26:14 +0000 (17:26 +0200)]
Add a return value to hasher_t.reset()

10 years agoAdd a return value to hasher_t.allocate_hash()
Martin Willi [Mon, 9 Jul 2012 15:15:52 +0000 (17:15 +0200)]
Add a return value to hasher_t.allocate_hash()

10 years agoAdd a return value to keymat_v1_t.{get,update,confirm}_iv
Martin Willi [Mon, 9 Jul 2012 14:27:09 +0000 (16:27 +0200)]
Add a return value to keymat_v1_t.{get,update,confirm}_iv

10 years agoAdd a return value to hasher_t.get_hash()
Martin Willi [Mon, 9 Jul 2012 13:33:41 +0000 (15:33 +0200)]
Add a return value to hasher_t.get_hash()

10 years agoAdd a return value to crypter_t.set_key()
Martin Willi [Fri, 6 Jul 2012 14:57:17 +0000 (16:57 +0200)]
Add a return value to crypter_t.set_key()

10 years agoAdd a return value to crypter_t.decrypt()
Martin Willi [Fri, 6 Jul 2012 14:11:15 +0000 (16:11 +0200)]
Add a return value to crypter_t.decrypt()

10 years agoAdd a return value to crypter_t.encrypt
Martin Willi [Fri, 6 Jul 2012 13:54:03 +0000 (15:54 +0200)]
Add a return value to crypter_t.encrypt

10 years agoIdentation fixes, warn about unused nonce_gen return values
Martin Willi [Fri, 6 Jul 2012 12:45:17 +0000 (14:45 +0200)]
Identation fixes, warn about unused nonce_gen return values