Martin Willi [Thu, 18 Apr 2013 10:37:39 +0000 (12:37 +0200)]
During libstrongswan initialization, check if memwipe() works as expected
Andreas Steffen [Tue, 16 Apr 2013 11:44:06 +0000 (13:44 +0200)]
added libstrongswan.plugins.openssl.fips_mode to man page
Andreas Steffen [Tue, 16 Apr 2013 10:37:04 +0000 (12:37 +0200)]
support of OpenSSL FIPS-140-2 library
Andreas Steffen [Mon, 15 Apr 2013 18:23:41 +0000 (20:23 +0200)]
build soup plugin in KVM test environment
Andreas Steffen [Mon, 15 Apr 2013 18:21:19 +0000 (20:21 +0200)]
disable reauth, too
Tobias Brunner [Mon, 15 Apr 2013 14:48:46 +0000 (16:48 +0200)]
Fix checksum calculation with DESTDIR installations
Andreas Steffen [Sun, 14 Apr 2013 17:58:17 +0000 (19:58 +0200)]
version bump to 5.0.4
Andreas Steffen [Sun, 14 Apr 2013 17:57:49 +0000 (19:57 +0200)]
Added charon.initiator_only option which causes charon to ignore IKE initiation requests by peers
Martin Willi [Tue, 9 Apr 2013 09:48:47 +0000 (11:48 +0200)]
Allow SHA1_Init()/SHA1_Update() to fail if OpenSSL version >= 1.0
Martin Willi [Tue, 9 Apr 2013 09:38:51 +0000 (11:38 +0200)]
Check RSA_public_decrypt() length before constructing and comparing a chunk
If decryption fails, it returns -1. chunk_equals() should catch that error,
but be more explicit in error checking.
Martin Willi [Tue, 9 Apr 2013 09:37:15 +0000 (11:37 +0200)]
RSA_check_key() may return -1 if it fails
Martin Willi [Tue, 9 Apr 2013 09:12:16 +0000 (11:12 +0200)]
RAND_bytes/RAND_pseudo_bytes returns -1 if it is not supported by RAND method
Martin Willi [Tue, 9 Apr 2013 08:56:09 +0000 (10:56 +0200)]
Check return value of ECDSA_Verify() correctly
Martin Willi [Thu, 4 Apr 2013 14:05:05 +0000 (16:05 +0200)]
eap-radius: Add an option to exclude ports from Called/Calling-Station-Id
Andreas Steffen [Tue, 9 Apr 2013 13:20:49 +0000 (15:20 +0200)]
version bump to 5.0.4dr1
Andreas Steffen [Tue, 9 Apr 2013 13:16:49 +0000 (15:16 +0200)]
fixed another printf statement
Andreas Steffen [Mon, 8 Apr 2013 20:21:14 +0000 (22:21 +0200)]
fixed printf statements
Andreas Steffen [Sat, 6 Apr 2013 12:16:30 +0000 (14:16 +0200)]
emit a single assig_vips bus message for all VIPs
Andreas Steffen [Thu, 4 Apr 2013 11:40:57 +0000 (13:40 +0200)]
ifmap plugin subscribes to assing_vip bus signal
Tobias Brunner [Fri, 5 Apr 2013 12:54:29 +0000 (14:54 +0200)]
Added missing sasl Doxygen group
Tobias Brunner [Fri, 5 Apr 2013 11:45:04 +0000 (13:45 +0200)]
unity: Check IKE_SA in only after enumerating virtual IPs
Andreas Steffen [Thu, 4 Apr 2013 19:09:07 +0000 (21:09 +0200)]
fixed configure options
Andreas Steffen [Thu, 4 Apr 2013 15:12:00 +0000 (17:12 +0200)]
cleaned up XML code in tnccs-11 plugin
Martin Willi [Thu, 4 Apr 2013 13:43:37 +0000 (15:43 +0200)]
duplicheck: track multiple IKE_SAs in checking state to avoid any races
When two consequent duplicates have been detected, track state of each checking
IKE_SA separately, avoiding potential race conditions between the active SA
and the different SAs in checking state.
Andreas Steffen [Wed, 3 Apr 2013 19:29:04 +0000 (21:29 +0200)]
fixed memory leak
Andreas Steffen [Wed, 3 Apr 2013 14:44:44 +0000 (16:44 +0200)]
properly handle orphaned renewSession jobs
Andreas Steffen [Wed, 3 Apr 2013 10:08:52 +0000 (12:08 +0200)]
support chunked HTTP responses
Andreas Steffen [Tue, 2 Apr 2013 14:49:53 +0000 (16:49 +0200)]
implemented periodic IF-MAP RenewSession request
Martin Willi [Wed, 3 Apr 2013 15:08:00 +0000 (17:08 +0200)]
Refactor check_for_rekeyed_child() in quick_mode task
Martin Willi [Wed, 3 Apr 2013 13:56:26 +0000 (15:56 +0200)]
Reuse reqid of an existing Quick Mode, even if it has been rekeyed
If two peers rekey Quick Modes at the same time, the original Quick Mode is
in REKEYING state and hence the requid is not reused. This is required though,
as two identical policies won't work if they have different requids.
Martin Willi [Wed, 3 Apr 2013 12:58:08 +0000 (14:58 +0200)]
List all stroke counters when "all" is given, and report if connection not known
Martin Willi [Wed, 3 Apr 2013 10:16:27 +0000 (12:16 +0200)]
Defer CHILD_SA rekeying if allocating an SPI fails
Martin Willi [Tue, 2 Apr 2013 14:09:17 +0000 (16:09 +0200)]
Accept a certificate/key pair to use client authentication in tls_test
Andreas Steffen [Tue, 2 Apr 2013 06:55:33 +0000 (08:55 +0200)]
version bump to 5.0.3
Andreas Steffen [Mon, 1 Apr 2013 20:32:20 +0000 (22:32 +0200)]
allow retrieval of private keys from other credential sets
Andreas Steffen [Mon, 1 Apr 2013 20:31:44 +0000 (22:31 +0200)]
improve checking of sent and received http messages
Tobias Brunner [Mon, 1 Apr 2013 12:35:39 +0000 (14:35 +0200)]
Updated strongswan.conf(5) man page
Tobias Brunner [Mon, 1 Apr 2013 11:46:23 +0000 (13:46 +0200)]
Load raw keys before possibly destroying the identity
If no identity (or %any) is configured the identification_t object is
destroyed and an invalid object was associated with the created pubkey
certificate.
Actually using %any does not work as the certificate would not match
when the client later provides an identity.
Tobias Brunner [Mon, 1 Apr 2013 11:45:11 +0000 (13:45 +0200)]
ipseckey: Use proper daemon name for enable option
Tobias Brunner [Mon, 1 Apr 2013 11:44:04 +0000 (13:44 +0200)]
Properly handle situation if no resolver plugins are loaded
Andreas Steffen [Sun, 31 Mar 2013 20:15:42 +0000 (22:15 +0200)]
fixed capability metadata
Andreas Steffen [Sun, 31 Mar 2013 17:48:00 +0000 (19:48 +0200)]
fix start of wpa_supplicant
Andreas Steffen [Sun, 31 Mar 2013 17:05:53 +0000 (19:05 +0200)]
updated strongswan.conf man page for tn_ifmap plugin
Andreas Steffen [Sun, 31 Mar 2013 14:37:30 +0000 (16:37 +0200)]
renamed tnc_ifmap2 plugin to tnc_ifmap
Andreas Steffen [Sun, 31 Mar 2013 14:07:08 +0000 (16:07 +0200)]
removed obsoleted tnc_ifmap plugin
Andreas Steffen [Sun, 31 Mar 2013 13:59:32 +0000 (15:59 +0200)]
implemented http basic authentication
Andreas Steffen [Sun, 31 Mar 2013 09:39:06 +0000 (11:39 +0200)]
parse IF-MAP server URI
Andreas Steffen [Sat, 30 Mar 2013 12:19:27 +0000 (13:19 +0100)]
implemented publish_enforcement_report and endSession methods
Andreas Steffen [Sat, 30 Mar 2013 08:15:16 +0000 (09:15 +0100)]
implemented publish_ike_sa method
Andreas Steffen [Sat, 30 Mar 2013 07:22:33 +0000 (08:22 +0100)]
ifmap message type is known
Andreas Steffen [Sat, 30 Mar 2013 07:11:10 +0000 (08:11 +0100)]
implemented publish_device_ip method
Andreas Steffen [Sat, 30 Mar 2013 07:10:39 +0000 (08:10 +0100)]
added IF-MAP SOAP error handling
Andreas Steffen [Fri, 29 Mar 2013 22:09:11 +0000 (23:09 +0100)]
created tnc_ifmap2_soap_msg class
Andreas Steffen [Fri, 29 Mar 2013 21:29:12 +0000 (22:29 +0100)]
implement NewSession and PurgePublisher messages using the libxml2 library
Andreas Steffen [Fri, 29 Mar 2013 08:42:06 +0000 (09:42 +0100)]
set up a new IF-MAP session
Andreas Steffen [Wed, 27 Mar 2013 21:56:37 +0000 (22:56 +0100)]
fixed typo
Tobias Brunner [Wed, 27 Mar 2013 10:07:06 +0000 (11:07 +0100)]
Fixed Doxygen comment in eap_radius plugin
Tobias Brunner [Wed, 27 Mar 2013 08:56:48 +0000 (09:56 +0100)]
Fix detection and use of netinet/ip6.h on FreeBSD
Tobias Brunner [Wed, 27 Mar 2013 06:47:53 +0000 (07:47 +0100)]
Don't set USE_ATTR_SQL when the sql plugin is enabled only
Tobias Brunner [Wed, 27 Mar 2013 06:31:57 +0000 (07:31 +0100)]
Make some private functions in plugins static
Fixes monolithic build.
Martin Willi [Fri, 22 Mar 2013 10:33:51 +0000 (11:33 +0100)]
Use new strongSwan HA kernel patchset keeping iptables ABI
Allows us to install stock debian iptables without the need for patching and
compiling our own.
Martin Willi [Fri, 22 Mar 2013 10:30:59 +0000 (11:30 +0100)]
Define SSHCONF from strongswan testing directory, not TESTDIR
This fixes the use of SSHCONF in the ssh wrapper script before ./do-tests
had a chance to create the required symlinks.
Martin Willi [Fri, 22 Mar 2013 10:27:37 +0000 (11:27 +0100)]
Lazy unmount guest filesystem after building image, as it still might be busy
Tobias Brunner [Mon, 25 Mar 2013 17:04:38 +0000 (18:04 +0100)]
crypt_burn: Proper cleanup
Tobias Brunner [Mon, 25 Mar 2013 17:02:07 +0000 (18:02 +0100)]
crypt_burn: Fix loop condition for regular crypters
Tobias Brunner [Mon, 25 Mar 2013 16:37:52 +0000 (17:37 +0100)]
libpts: Cast first argument for %.*s to int
Tobias Brunner [Mon, 25 Mar 2013 16:33:45 +0000 (17:33 +0100)]
error-notify: Close file descriptors in case clients are still connected
Tobias Brunner [Mon, 25 Mar 2013 16:19:51 +0000 (17:19 +0100)]
libpttls: Destroy reader when handling errors during SASL
Tobias Brunner [Mon, 25 Mar 2013 16:13:49 +0000 (17:13 +0100)]
pacman: Define gen_time out of the loop
It gets assigned if count==3 but only used later when count >= 7.
Tobias Brunner [Mon, 25 Mar 2013 16:02:45 +0000 (17:02 +0100)]
ipseckey: NULL pointer dereference fixed in error case
Reto Buerki [Mon, 25 Mar 2013 15:24:29 +0000 (16:24 +0100)]
Recipes: Disable Anet unit tests
Some Anet unit tests may fail because of the network configuration on
the testing host. These failures do not indicate a problem in Anet but
are a result of unpredictable events.
Tobias Brunner [Mon, 25 Mar 2013 09:59:37 +0000 (10:59 +0100)]
Fixed some typos, courtesy of codespell
Andreas Steffen [Fri, 22 Mar 2013 22:53:39 +0000 (23:53 +0100)]
Added hostapd package to base image
Andreas Steffen [Fri, 22 Mar 2013 22:52:01 +0000 (23:52 +0100)]
Added Framed-IP-Address information to RADIUS accounting records
Andreas Steffen [Fri, 22 Mar 2013 20:13:59 +0000 (21:13 +0100)]
enforce singular of packets
Tobias Brunner [Fri, 22 Mar 2013 18:41:01 +0000 (19:41 +0100)]
asprintf(3) requires _GNU_SOURCE to be defined
Andreas Steffen [Fri, 22 Mar 2013 18:08:42 +0000 (19:08 +0100)]
Added ikev2/rw-eap-framed-ip-radius scenario
Andreas Steffen [Fri, 22 Mar 2013 15:45:24 +0000 (16:45 +0100)]
Store debug output from standalone IMC/IMVs
Andreas Steffen [Fri, 22 Mar 2013 11:18:43 +0000 (12:18 +0100)]
Added ikev2/ip-two-pools-v4v6-db scenario
Tobias Brunner [Fri, 22 Mar 2013 10:36:48 +0000 (11:36 +0100)]
Use proper integer types when handling TLS exchanges
tls_t.build takes a size_t argument not a ssize_t.
Tobias Brunner [Fri, 22 Mar 2013 10:34:16 +0000 (11:34 +0100)]
Check return value of asprintf(3) when converting AR identity
Using chunk_t.ptr as target was also not optimal as it resulted in
a compiler warning.
Andreas Steffen [Fri, 22 Mar 2013 09:38:25 +0000 (10:38 +0100)]
version bump to 5.0.3rc1
Andreas Steffen [Fri, 22 Mar 2013 09:37:49 +0000 (10:37 +0100)]
Switch encoding of AR Identity Value from binary to UTF-8
Reto Buerki [Fri, 22 Mar 2013 09:35:48 +0000 (10:35 +0100)]
Fixed TKM build
Andreas Steffen [Fri, 22 Mar 2013 09:33:39 +0000 (10:33 +0100)]
Build TNC-enabled wpa_supplicant
Andreas Steffen [Thu, 21 Mar 2013 17:04:24 +0000 (18:04 +0100)]
activate logging before loading plugins
Martin Willi [Thu, 21 Mar 2013 09:29:23 +0000 (10:29 +0100)]
Add a load-tester option to keep allocated external address until shutdown
Tobias Brunner [Wed, 20 Mar 2013 15:59:45 +0000 (16:59 +0100)]
android: No need to disable CMS explicitly
The version check introduced with
0d237763 should take care of it.
Tobias Brunner [Wed, 20 Mar 2013 15:20:39 +0000 (16:20 +0100)]
Allow up to 10 NAT-D payloads in IKEv1 messages
Tobias Brunner [Fri, 1 Mar 2013 13:36:02 +0000 (14:36 +0100)]
Avoid a race condition when reloading secrets from ipsec.secrets
With the previous implementation that cleared the secrets in the active
credential set and then loaded the secrets, IKE SA establishment would
fail (as initiator or responder) if secrets are concurrently reloaded
and the required secret was not yet loaded.
Tobias Brunner [Fri, 1 Mar 2013 13:34:31 +0000 (14:34 +0100)]
Add a method to replace all secrets in a mem_cred_t object
Tobias Brunner [Wed, 20 Mar 2013 13:50:41 +0000 (14:50 +0100)]
android: Build native libraries also for x86
Requires an updated build script for Vstr.
Tobias Brunner [Fri, 8 Mar 2013 16:26:04 +0000 (17:26 +0100)]
android: libtnccs requires headers from libtls
Tobias Brunner [Fri, 8 Mar 2013 16:05:55 +0000 (17:05 +0100)]
android: Fix Android.mk for ipsec script
Tobias Brunner [Fri, 8 Mar 2013 15:48:11 +0000 (16:48 +0100)]
android: Remove/filter header files from LOCAL_SRC_FILES
This avoids huge warnings when building the native code.
Tobias Brunner [Thu, 7 Mar 2013 17:20:10 +0000 (18:20 +0100)]
android: Request and install an IPv6 DNS server
Tobias Brunner [Thu, 7 Mar 2013 17:16:56 +0000 (18:16 +0100)]
android: Also request a virtual IPv6 address and propose IPv6 TS
This allows IPv6 over IPv4 but falls back nicely if we don't get a
virtual IPv6 (or IPv4) address.
Tobias Brunner [Thu, 7 Mar 2013 15:21:11 +0000 (16:21 +0100)]
ipsec: Increased log level for message in case no outbound policy is found
This might happen on Android if sockets are bound to the physical IP
address but packets are still routed via TUN device. Since it seems to
happen quite often (or for stuff that requires regular traffic) this
hides these messages from the default log.
Martin Willi [Tue, 19 Mar 2013 15:49:07 +0000 (16:49 +0100)]
Add an option to autobalance a HA cluster automatically
Martin Willi [Tue, 19 Mar 2013 15:48:53 +0000 (16:48 +0100)]
Check if for some reason we handle a HA segment on both nodes