strongswan.git
6 years agoMerge branch 'tfc-notify'
Martin Willi [Fri, 1 Mar 2013 10:16:58 +0000 (11:16 +0100)]
Merge branch 'tfc-notify'

Introduces kernel backend features, sends ESP_TFC_PADDING_NOT_SUPPORTED if
kernel does not support it.

6 years agoSend ESP_TFC_PADDING_NOT_SUPPORTED if the used kernel doesn't support it
Martin Willi [Thu, 21 Feb 2013 09:09:39 +0000 (10:09 +0100)]
Send ESP_TFC_PADDING_NOT_SUPPORTED if the used kernel doesn't support it

6 years agoIndicate support for processing ESPv3 TFC padding in Netlink IPsec backend
Martin Willi [Thu, 21 Feb 2013 08:45:46 +0000 (09:45 +0100)]
Indicate support for processing ESPv3 TFC padding in Netlink IPsec backend

6 years agoIntroduce "features" for the kernel backends returning kernel capabilities
Martin Willi [Thu, 21 Feb 2013 08:39:23 +0000 (09:39 +0100)]
Introduce "features" for the kernel backends returning kernel capabilities

6 years agotesting: Add a script to easily connect to a host via SSH
Tobias Brunner [Tue, 19 Feb 2013 13:17:26 +0000 (14:17 +0100)]
testing: Add a script to easily connect to a host via SSH

This doesn't require any entries in /etc/hosts and the correct SSH
config is used to allow password-less access.

6 years agoopenssl: Provide AES-GCM implementation
Tobias Brunner [Tue, 12 Feb 2013 15:46:56 +0000 (16:46 +0100)]
openssl: Provide AES-GCM implementation

6 years agoFix cleanup in crypto_tester if AEAD implementation fails
Tobias Brunner [Tue, 12 Feb 2013 15:42:45 +0000 (16:42 +0100)]
Fix cleanup in crypto_tester if AEAD implementation fails

6 years agoOrder of arguments in Doxygen comment fixed
Tobias Brunner [Tue, 12 Feb 2013 15:40:54 +0000 (16:40 +0100)]
Order of arguments in Doxygen comment fixed

6 years agoFix auth_cfg_t.clone() for single-valued auth rules
Tobias Brunner [Mon, 18 Feb 2013 16:23:04 +0000 (17:23 +0100)]
Fix auth_cfg_t.clone() for single-valued auth rules

By using the default list enumerator and adding the rules with the public
add() method, clones of auth_cfg_t objects would return the values for
single-valued auth rules in the wrong order (i.e. the oldest instead of the
newest value was returned).  Using the internal enumerator (which the comment
already suggested) fixes this, but the clone will not be a full clone as
it does not contain any old values for single-valued auth rules.  Since
these will never be used anyway, this should be fine.

6 years agoTrigger an updown event when destroying an IKE_SA based on INITIAL_CONTACT
Tobias Brunner [Mon, 18 Feb 2013 11:05:58 +0000 (12:05 +0100)]
Trigger an updown event when destroying an IKE_SA based on INITIAL_CONTACT

In other cases (i.e. when functions return DESTROY_ME) the event should
already be triggered, but not in this forced situation.

6 years agoUse SIGUSR2 for SIG_CANCEL on Android
Tobias Brunner [Tue, 26 Feb 2013 10:07:28 +0000 (11:07 +0100)]
Use SIGUSR2 for SIG_CANCEL on Android

SIGRTMIN is defined as 32 while sigset_t is defined as
unsigned long (i.e. holds 32 signals).  Hence, the signal
could never be blocked.  Sending the signal still canceled
threads, but sometimes in situations where they shouldn't
have been canceled (e.g. while holding a lock).

Fixes #298.

6 years agoAndroid.mk updated to latest Makefiles
Tobias Brunner [Tue, 26 Feb 2013 09:11:36 +0000 (10:11 +0100)]
Android.mk updated to latest Makefiles

Fixes #300.

6 years agoCheck kvm command existence in start-testing
Reto Buerki [Fri, 22 Feb 2013 14:16:37 +0000 (15:16 +0100)]
Check kvm command existence in start-testing

6 years agoopenssl: Disable PKCS#7/CMS when building against OpenSSL < 0.9.8g
Tobias Brunner [Tue, 19 Feb 2013 13:12:57 +0000 (14:12 +0100)]
openssl: Disable PKCS#7/CMS when building against OpenSSL < 0.9.8g

Fixes #292.

6 years agoversion bump to 5.0.3dr2 5.0.3dr2
Andreas Steffen [Tue, 19 Feb 2013 19:25:13 +0000 (20:25 +0100)]
version bump to 5.0.3dr2

6 years agotreat IF-M and IF-TNCCS remediation instructions/parameters in an equal way
Andreas Steffen [Tue, 19 Feb 2013 19:00:48 +0000 (20:00 +0100)]
treat IF-M and IF-TNCCS remediation instructions/parameters in an equal way

6 years agoMerge branch 'dnssec'
Tobias Brunner [Tue, 19 Feb 2013 11:25:27 +0000 (12:25 +0100)]
Merge branch 'dnssec'

6 years agoNEWS about ipseckey and unbound plugins added
Tobias Brunner [Tue, 19 Feb 2013 11:23:27 +0000 (12:23 +0100)]
NEWS about ipseckey and unbound plugins added

6 years agoAdded ikev2/rw-dnssec scenario
Andreas Steffen [Sun, 17 Feb 2013 20:49:23 +0000 (21:49 +0100)]
Added ikev2/rw-dnssec scenario

6 years agoAdded ikev2/net2net-dnssec scenario
Andreas Steffen [Mon, 18 Feb 2013 17:06:19 +0000 (18:06 +0100)]
Added ikev2/net2net-dnssec scenario

6 years agoConfigure winnetou as a DNSSEC enabled nameserver for the strongswan.org, org, and...
Andreas Steffen [Thu, 14 Feb 2013 12:32:04 +0000 (13:32 +0100)]
Configure winnetou as a DNSSEC enabled nameserver for the strongswan.org, org, and root zones

6 years agoBuild unbound and ipseckey plugins on KVM image
Andreas Steffen [Wed, 13 Feb 2013 12:48:14 +0000 (13:48 +0100)]
Build unbound and ipseckey plugins on KVM image

6 years agoStreamlined log messages in ipseckey plugin
Andreas Steffen [Sun, 17 Feb 2013 18:31:56 +0000 (19:31 +0100)]
Streamlined log messages in ipseckey plugin

6 years agoEncode RSA public keys in RFC 3110 DNSKEY format
Andreas Steffen [Sun, 17 Feb 2013 16:37:45 +0000 (17:37 +0100)]
Encode RSA public keys in RFC 3110 DNSKEY format

6 years agoMoved configuration from resolver manager to unbound plugin
Andreas Steffen [Fri, 15 Feb 2013 14:12:29 +0000 (15:12 +0100)]
Moved configuration from resolver manager to unbound plugin

Also streamlined log messages in unbound plugin.

6 years agoipseckey: Report IPSECKEYs with invalid DNSSEC security state
Reto Guadagnini [Thu, 5 Jul 2012 10:17:49 +0000 (12:17 +0200)]
ipseckey: Report IPSECKEYs with invalid DNSSEC security state

6 years agoipseckey: Added "enable" option for the IPSECKEY plugin to strongswan.conf
Reto Guadagnini [Fri, 8 Jun 2012 15:15:09 +0000 (17:15 +0200)]
ipseckey: Added "enable" option for the IPSECKEY plugin to strongswan.conf

6 years agoAdded ipseckey plugin, which provides support for public keys in IPSECKEY RRs
Reto Guadagnini [Fri, 8 Jun 2012 09:26:50 +0000 (11:26 +0200)]
Added ipseckey plugin, which provides support for public keys in IPSECKEY RRs

6 years agoImplemented the resolver test script "dnssec"
Reto Guadagnini [Tue, 10 Apr 2012 15:06:29 +0000 (17:06 +0200)]
Implemented the resolver test script "dnssec"

6 years agounbound: Implementation of query method of unbound_resolver_t
Reto Guadagnini [Tue, 10 Apr 2012 15:05:06 +0000 (17:05 +0200)]
unbound: Implementation of query method of unbound_resolver_t

6 years agounbound: Implemented resolver_response_t as unbound_response_t
Reto Guadagnini [Tue, 10 Apr 2012 14:59:43 +0000 (16:59 +0200)]
unbound: Implemented resolver_response_t as unbound_response_t

6 years agoImplemented rr_set_t interface
Reto Guadagnini [Tue, 3 Apr 2012 20:15:00 +0000 (22:15 +0200)]
Implemented rr_set_t interface

6 years agounbound: Implemented rr_t as unbound_rr_t
Reto Guadagnini [Tue, 27 Mar 2012 16:37:24 +0000 (18:37 +0200)]
unbound: Implemented rr_t as unbound_rr_t

6 years agoAdded unbound plugin implementing the resolver interface using libunbound
Reto Guadagnini [Tue, 27 Mar 2012 07:22:14 +0000 (09:22 +0200)]
Added unbound plugin implementing the resolver interface using libunbound

6 years agoAdded manager for DNS resolvers
Reto Guadagnini [Fri, 23 Mar 2012 10:36:49 +0000 (11:36 +0100)]
Added manager for DNS resolvers

6 years agoAdded interface for DNS resolvers
Reto Guadagnini [Tue, 20 Mar 2012 17:49:54 +0000 (18:49 +0100)]
Added interface for DNS resolvers

6 years agoadded missing return statement
Andreas Steffen [Tue, 19 Feb 2013 09:21:36 +0000 (10:21 +0100)]
added missing return statement

6 years agoFix encoding of issuerAndSubject while handling SCEP pending state
Martin Willi [Tue, 19 Feb 2013 08:53:47 +0000 (09:53 +0100)]
Fix encoding of issuerAndSubject while handling SCEP pending state

6 years agoreject PB-Experimental messages with NOSKIP flag set
Andreas Steffen [Tue, 19 Feb 2013 08:31:34 +0000 (09:31 +0100)]
reject PB-Experimental messages with NOSKIP flag set

6 years agoadded parameter descriptions
Andreas Steffen [Tue, 19 Feb 2013 06:44:57 +0000 (07:44 +0100)]
added parameter descriptions

6 years agoremoved superfluous debug output
Andreas Steffen [Fri, 15 Feb 2013 14:19:16 +0000 (15:19 +0100)]
removed superfluous debug output

6 years agoAdd a timeout to clean up PDP RADIUS connections
Martin Willi [Wed, 19 Dec 2012 17:07:33 +0000 (18:07 +0100)]
Add a timeout to clean up PDP RADIUS connections

6 years agoKeep the PDP connections lock while accessing its objects
Martin Willi [Wed, 19 Dec 2012 16:55:47 +0000 (17:55 +0100)]
Keep the PDP connections lock while accessing its objects

When we introduce connection timeouts, the state may disappear at any time.
This change prevents that, but is not very clear. We probably have to refactor
connection handling.

6 years agoAdd locking to TNC-PDP connections
Martin Willi [Wed, 19 Dec 2012 16:39:25 +0000 (17:39 +0100)]
Add locking to TNC-PDP connections

6 years agoAdd IF-M message subtype getter to IMC/IMV messages
Martin Willi [Mon, 21 Jan 2013 16:01:53 +0000 (17:01 +0100)]
Add IF-M message subtype getter to IMC/IMV messages

6 years agoUse a generic constructor to create PA-TNC error attributes
Martin Willi [Mon, 28 Jan 2013 15:29:42 +0000 (16:29 +0100)]
Use a generic constructor to create PA-TNC error attributes

6 years agoAdd a global return_success() method implementation
Martin Willi [Tue, 29 Jan 2013 11:20:10 +0000 (12:20 +0100)]
Add a global return_success() method implementation

6 years agoAdd a convenience method to check pen_type_t for vendor and type
Martin Willi [Thu, 31 Jan 2013 14:43:45 +0000 (15:43 +0100)]
Add a convenience method to check pen_type_t for vendor and type

6 years agoAdd a comparison function for pen_type_t
Martin Willi [Thu, 31 Jan 2013 14:29:43 +0000 (15:29 +0100)]
Add a comparison function for pen_type_t

6 years agoWhitespace and comment cleanups in pen.[ch]
Martin Willi [Thu, 31 Jan 2013 14:23:25 +0000 (15:23 +0100)]
Whitespace and comment cleanups in pen.[ch]

6 years agoresolve dependency on libtls
Andreas Steffen [Sat, 2 Feb 2013 21:21:36 +0000 (22:21 +0100)]
resolve dependency on libtls

6 years agoMerge branch 'ike-dscp'
Martin Willi [Thu, 14 Feb 2013 16:11:35 +0000 (17:11 +0100)]
Merge branch 'ike-dscp'

6 years agoCheck if recommendations is set before applying language preference
Martin Willi [Thu, 14 Feb 2013 16:03:10 +0000 (17:03 +0100)]
Check if recommendations is set before applying language preference

6 years agoPT-TLS dispatcher TNCCS constructor takes peer identities to pass to factory
Martin Willi [Thu, 14 Feb 2013 13:48:54 +0000 (14:48 +0100)]
PT-TLS dispatcher TNCCS constructor takes peer identities to pass to factory

6 years agoMerge branch 'pt-tls'
Martin Willi [Thu, 14 Feb 2013 16:06:07 +0000 (17:06 +0100)]
Merge branch 'pt-tls'

6 years agoRemove leading zeros in SCEP certificate serialNumbers
Martin Willi [Wed, 13 Feb 2013 11:06:09 +0000 (12:06 +0100)]
Remove leading zeros in SCEP certificate serialNumbers

6 years agoFix 'stroke loglevel any'
Tobias Brunner [Wed, 13 Feb 2013 11:11:37 +0000 (12:11 +0100)]
Fix 'stroke loglevel any'

Before b46a5cd4 this worked if debug_t was unsigned.  In that case -1,
as returned by enum_from_name(), would result in a large positive number.
So any unknown debug group (including 'any') had the same effect that
was only intended for 'any'.

6 years agoadded ikev1/net2net-fragmentation scenario 5.0.3dr1
Andreas Steffen [Tue, 12 Feb 2013 22:01:48 +0000 (23:01 +0100)]
added ikev1/net2net-fragmentation scenario

6 years agotreat EAP identities as user IDs
Andreas Steffen [Tue, 12 Feb 2013 20:58:03 +0000 (21:58 +0100)]
treat EAP identities as user IDs

6 years agouse EAP identity in tnc/tnccs-20-pdp scenario
Andreas Steffen [Tue, 12 Feb 2013 19:41:37 +0000 (20:41 +0100)]
use EAP identity in tnc/tnccs-20-pdp scenario

6 years agomake TNC client authentication type available to IMVs
Andreas Steffen [Tue, 12 Feb 2013 19:38:05 +0000 (20:38 +0100)]
make TNC client authentication type available to IMVs

6 years agodetermine underlying IF-T transport protocol
Andreas Steffen [Tue, 12 Feb 2013 11:25:39 +0000 (12:25 +0100)]
determine underlying IF-T transport protocol

6 years agomake AR identities available to IMVs via IF-IMV 1.4 draft
Andreas Steffen [Sun, 20 Jan 2013 22:36:31 +0000 (23:36 +0100)]
make AR identities available to IMVs via IF-IMV 1.4 draft

6 years agoMake IKE/EAP IDs available to TNC server/client
Andreas Steffen [Thu, 17 Jan 2013 22:32:34 +0000 (23:32 +0100)]
Make IKE/EAP IDs available to TNC server/client

6 years agoDon't use a time_t variable with fscanf when parsing uptime
Tobias Brunner [Wed, 6 Feb 2013 15:35:44 +0000 (16:35 +0100)]
Don't use a time_t variable with fscanf when parsing uptime

Because "%u" is used as format string in the fscanf call that parses the
uptime and because the length of time_t varies on different platforms
and architectures the value was not written properly if time_t was longer
than an unsigned int and depending on how the target variable was aligned
on the stack.  Since there is no conversion specifier to properly parse a
time_t value we use the appropriate integer type instead.

6 years agoAllow more than one CERTREQ payload for IKEv2
Tobias Brunner [Fri, 8 Feb 2013 10:24:39 +0000 (11:24 +0100)]
Allow more than one CERTREQ payload for IKEv2

There is no reason not to do so (RFC 5996 explicitly mentions multiple
CERTREQ payloads) and some implementations seem to use the same behavior
as had to be used with IKEv1 (i.e. each CA in its own CERTREQ payload).

6 years agoAdd a --httptimeout option to scepclient
Martin Willi [Fri, 8 Feb 2013 09:57:25 +0000 (10:57 +0100)]
Add a --httptimeout option to scepclient

6 years agoUse CURL_TIMEOUT and not CURL_CONNECTTIMEOUT for FETCHER_TIMEOUT in curl
Martin Willi [Fri, 8 Feb 2013 09:12:10 +0000 (10:12 +0100)]
Use CURL_TIMEOUT and not CURL_CONNECTTIMEOUT for FETCHER_TIMEOUT in curl

This allows us to use this timeout beyond DNS resolution. For the initial
connect, we use a hardcoded timeout of 10s for now.

6 years agoAdd ikedscp documentation to ipsec.conf.5
Martin Willi [Wed, 6 Feb 2013 14:42:14 +0000 (15:42 +0100)]
Add ikedscp documentation to ipsec.conf.5

6 years agoAdd a ikedscp ipsec.conf option to set DSCP value on outgoing IKE packets
Martin Willi [Wed, 6 Feb 2013 14:19:32 +0000 (15:19 +0100)]
Add a ikedscp ipsec.conf option to set DSCP value on outgoing IKE packets

6 years agoSet configured DSCP value while generating IKE packets
Martin Willi [Wed, 6 Feb 2013 14:11:46 +0000 (15:11 +0100)]
Set configured DSCP value while generating IKE packets

6 years agoAdd a DSCP configuration value to IKE configs
Martin Willi [Wed, 6 Feb 2013 13:57:15 +0000 (14:57 +0100)]
Add a DSCP configuration value to IKE configs

6 years agoSet DSCP values when sending IP packets in socket-default
Martin Willi [Wed, 6 Feb 2013 12:17:55 +0000 (13:17 +0100)]
Set DSCP values when sending IP packets in socket-default

6 years agoDon't send a packet in default socket if family is not IPv4 nor IPv6
Martin Willi [Wed, 6 Feb 2013 12:12:51 +0000 (13:12 +0100)]
Don't send a packet in default socket if family is not IPv4 nor IPv6

6 years agoAdd a DSCP value with getter/setter on packet_t
Martin Willi [Wed, 6 Feb 2013 10:56:27 +0000 (11:56 +0100)]
Add a DSCP value with getter/setter on packet_t

6 years agoAvoid extensive casting of sockaddr types in socket-default by using a union
Martin Willi [Wed, 6 Feb 2013 10:45:51 +0000 (11:45 +0100)]
Avoid extensive casting of sockaddr types in socket-default by using a union

Additionally fixes a strict-aliasing rule compiler warning with older gcc.

6 years agoSet sockaddr family on ifreq instead of casted familiy specific sockaddr
Martin Willi [Mon, 4 Feb 2013 12:36:11 +0000 (13:36 +0100)]
Set sockaddr family on ifreq instead of casted familiy specific sockaddr

Fixes a strict-aliasing rule compiler warning with older gcc.

6 years agoReport enabled plugins at the end of configure
Tobias Brunner [Fri, 1 Feb 2013 10:57:46 +0000 (11:57 +0100)]
Report enabled plugins at the end of configure

6 years agoStreamlined comments in configure.in
Tobias Brunner [Fri, 1 Feb 2013 10:29:23 +0000 (11:29 +0100)]
Streamlined comments in configure.in

dnl should only be used in rare cases (like escaping newlines)

6 years agoUpdated configure.in to newer autoconf
Tobias Brunner [Fri, 1 Feb 2013 09:55:33 +0000 (10:55 +0100)]
Updated configure.in to newer autoconf

AC_TRY_COMPILE and AC_TRY_RUN are deprecated.  The new construct with
AC_*_IFELSE and AC_LANG_PROGRAM requires double quoting the source code
of these test programs.

6 years agoAdd a configure option to disable all default plugins
Tobias Brunner [Thu, 31 Jan 2013 17:22:25 +0000 (18:22 +0100)]
Add a configure option to disable all default plugins

The --disable-defaults option disables all plugins that would be
enabled by default.  This allows to selectively enable specific plugins
without issues when new default options get added in future releases.

6 years agotime is a time_t pointer
Andreas Steffen [Mon, 4 Feb 2013 12:05:29 +0000 (13:05 +0100)]
time is a time_t pointer

6 years agoversion bump to 5.0.3dr1
Andreas Steffen [Mon, 4 Feb 2013 06:51:07 +0000 (07:51 +0100)]
version bump to 5.0.3dr1

6 years agoimproved control when an attribute request is sent
Andreas Steffen [Sun, 3 Feb 2013 19:48:05 +0000 (20:48 +0100)]
improved control when an attribute request is sent

6 years agoprint PEN value 0xfffffe as Unassigned
Andreas Steffen [Sun, 3 Feb 2013 17:52:59 +0000 (18:52 +0100)]
print PEN value 0xfffffe as Unassigned

6 years agosend an error attribute if vendor ID or type of received attribute is reserved
Andreas Steffen [Sun, 3 Feb 2013 17:52:03 +0000 (18:52 +0100)]
send an error attribute if vendor ID or type of received attribute is reserved

6 years agoopenssl: Properly honor OPENSSL_NO_* defines
Tobias Brunner [Thu, 31 Jan 2013 16:33:23 +0000 (17:33 +0100)]
openssl: Properly honor OPENSSL_NO_* defines

6 years agoFix Doxygen comment for rdrand plugin
Tobias Brunner [Thu, 31 Jan 2013 11:11:37 +0000 (12:11 +0100)]
Fix Doxygen comment for rdrand plugin

6 years agoTypo in strongswan.conf(5) man page fixed
Tobias Brunner [Thu, 31 Jan 2013 10:52:11 +0000 (11:52 +0100)]
Typo in strongswan.conf(5) man page fixed

6 years agoversion bump to 5.0.2 5.0.2
Andreas Steffen [Wed, 30 Jan 2013 06:51:44 +0000 (07:51 +0100)]
version bump to 5.0.2

6 years agoDocumented new options in strongswan.conf(5) man page
Tobias Brunner [Fri, 25 Jan 2013 19:17:41 +0000 (20:17 +0100)]
Documented new options in strongswan.conf(5) man page

6 years agoDon't use pointer to a union member in host_create_from_string_and_family()
Tobias Brunner [Fri, 25 Jan 2013 12:18:50 +0000 (13:18 +0100)]
Don't use pointer to a union member in host_create_from_string_and_family()

6 years agoProperly check MSB in openssl plugin's PKCS#7 implementation
Tobias Brunner [Thu, 24 Jan 2013 18:42:40 +0000 (19:42 +0100)]
Properly check MSB in openssl plugin's PKCS#7 implementation

6 years agoUse proper buffer sizes for parse_smartcard()
Tobias Brunner [Thu, 24 Jan 2013 18:22:52 +0000 (19:22 +0100)]
Use proper buffer sizes for parse_smartcard()

6 years agoCast first argument for %.*s to int
Tobias Brunner [Thu, 24 Jan 2013 17:59:03 +0000 (18:59 +0100)]
Cast first argument for %.*s to int

6 years agoRemoved unused command name when printing usage info for lookip
Tobias Brunner [Thu, 24 Jan 2013 17:48:30 +0000 (18:48 +0100)]
Removed unused command name when printing usage info for lookip

6 years agoRemoved unused argument
Tobias Brunner [Thu, 24 Jan 2013 17:47:04 +0000 (18:47 +0100)]
Removed unused argument

6 years agoProperly read data from stream in pki --pkcs7
Tobias Brunner [Thu, 24 Jan 2013 17:43:10 +0000 (18:43 +0100)]
Properly read data from stream in pki --pkcs7

6 years agoProperly destroy mem_cred object on pki --pkcs7 --help
Tobias Brunner [Thu, 24 Jan 2013 17:38:29 +0000 (18:38 +0100)]
Properly destroy mem_cred object on pki --pkcs7 --help

6 years agoTry to determine OS type if name and version are configured
Tobias Brunner [Thu, 24 Jan 2013 17:36:22 +0000 (18:36 +0100)]
Try to determine OS type if name and version are configured