strongswan.git
10 years agoMigrated sender_t to METHOD/INIT macros
Martin Willi [Wed, 3 Mar 2010 14:46:53 +0000 (15:46 +0100)]
Migrated sender_t to METHOD/INIT macros

10 years agoCheck if we are not using a vendor EAP method in EAP_IDENTITY comparison.
Martin Willi [Wed, 3 Mar 2010 11:25:27 +0000 (12:25 +0100)]
Check if we are not using a vendor EAP method in EAP_IDENTITY comparison.

Bug reported by Ingo Kubbilun with a patch from Reinhard Pfau, secunet AG.

10 years agoUse "static const", some GCCs don't like "const static"
Martin Willi [Wed, 3 Mar 2010 09:44:01 +0000 (10:44 +0100)]
Use "static const", some GCCs don't like "const static"

10 years agoAdding Android.mk files to build charon and libstrongswan with the Android build...
Tobias Brunner [Wed, 3 Mar 2010 09:18:46 +0000 (10:18 +0100)]
Adding Android.mk files to build charon and libstrongswan with the Android build system.

10 years agoReverting eba28948a584b9d02474cf5d256b04b8d2adbe6a which was only necessary when...
Tobias Brunner [Tue, 2 Mar 2010 11:03:44 +0000 (12:03 +0100)]
Reverting eba28948a584b9d02474cf5d256b04b8d2adbe6a which was only necessary when cross-compiling the plugins for Android 2.0.

With the coming monolithic build using Android.mk files this won't be
necessary anymore.

10 years agoStreamlined the source file list formatting in plugin makefiles.
Tobias Brunner [Tue, 2 Mar 2010 09:32:09 +0000 (10:32 +0100)]
Streamlined the source file list formatting in plugin makefiles.

10 years agoFixing some includes by replacing <> with "".
Tobias Brunner [Mon, 1 Mar 2010 15:03:18 +0000 (16:03 +0100)]
Fixing some includes by replacing <> with "".

I changed only the includes needed to fix the build on Android, which has an utils.h system header file, but we should probably change all the local includes in libstrongswan to "" and relative paths.

10 years agoLink all enabled libstrongswan plugins into the library, link all enabled charon...
Tobias Brunner [Mon, 1 Mar 2010 15:15:08 +0000 (16:15 +0100)]
Link all enabled libstrongswan plugins into the library, link all enabled charon plugins into libcharon.

10 years agoEnabling the plugin loader to be able to load plugins without explicitly loading...
Tobias Brunner [Mon, 1 Mar 2010 15:07:07 +0000 (16:07 +0100)]
Enabling the plugin loader to be able to load plugins without explicitly loading a shared object file first.

10 years agoAdding an option to build libstrongswan and charon monolithically.
Tobias Brunner [Mon, 1 Mar 2010 15:16:55 +0000 (16:16 +0100)]
Adding an option to build libstrongswan and charon monolithically.

10 years agoChanged plugin constructors from plugin_create to plugin_name_plugin_create.
Tobias Brunner [Tue, 23 Feb 2010 15:20:38 +0000 (16:20 +0100)]
Changed plugin constructors from plugin_create to plugin_name_plugin_create.

10 years agoRemoving the plugin constructor declarations from the header files.
Tobias Brunner [Tue, 23 Feb 2010 15:17:48 +0000 (16:17 +0100)]
Removing the plugin constructor declarations from the header files.

10 years agorenewed Authorization Authority certificate
Andreas Steffen [Sat, 27 Feb 2010 21:16:36 +0000 (22:16 +0100)]
renewed Authorization Authority certificate

10 years agoNEWS about the android plugin
Martin Willi [Fri, 26 Feb 2010 10:57:59 +0000 (11:57 +0100)]
NEWS about the android plugin

10 years agoNEWS about the dynamic socket implementation
Martin Willi [Fri, 26 Feb 2010 10:52:54 +0000 (11:52 +0100)]
NEWS about the dynamic socket implementation

10 years agoLink libstrongswan to the new plugins, too
Martin Willi [Fri, 26 Feb 2010 10:49:04 +0000 (11:49 +0100)]
Link libstrongswan to the new plugins, too

10 years agoAdd support for dynamic ports in load tester
Martin Willi [Fri, 26 Feb 2010 10:21:01 +0000 (10:21 +0000)]
Add support for dynamic ports in load tester

10 years agoProcess ike_vendor task before ike_init, fixes support for private algs in IKE
Martin Willi [Fri, 26 Feb 2010 10:07:56 +0000 (11:07 +0100)]
Process ike_vendor task before ike_init, fixes support for private algs in IKE

10 years agoUse message instead of attributes in hook
Martin Willi [Fri, 27 Nov 2009 10:14:40 +0000 (11:14 +0100)]
Use message instead of attributes in hook

10 years agoSet UDP encapsulation option on all sockets
Martin Willi [Wed, 24 Feb 2010 14:11:58 +0000 (14:11 +0000)]
Set UDP encapsulation option on all sockets

10 years agoFixed starter left-/rightikeport keyword
Martin Willi [Wed, 24 Feb 2010 13:49:55 +0000 (13:49 +0000)]
Fixed starter left-/rightikeport keyword

10 years agoAdded locking to dynamic socket list
Martin Willi [Wed, 24 Feb 2010 10:45:18 +0000 (11:45 +0100)]
Added locking to dynamic socket list

10 years agoInclude ports in ike_cfg equality check
Martin Willi [Wed, 24 Feb 2010 10:07:47 +0000 (10:07 +0000)]
Include ports in ike_cfg equality check

10 years agoAdded an initiator-only socket implementation which binds ports on demand
Martin Willi [Wed, 24 Feb 2010 09:58:23 +0000 (10:58 +0100)]
Added an initiator-only socket implementation which binds ports on demand

10 years agoRemoved obsolete daemon kill
Martin Willi [Tue, 23 Feb 2010 16:59:52 +0000 (17:59 +0100)]
Removed obsolete daemon kill

10 years agoDo not kill daemon, just not use pluggable kernel interface if initialization failed
Martin Willi [Tue, 23 Feb 2010 16:49:34 +0000 (16:49 +0000)]
Do not kill daemon, just not use pluggable kernel interface if initialization failed

10 years agoPass sockets to bypass to kernel interface, allowing us to register them dynamically
Martin Willi [Tue, 23 Feb 2010 16:28:23 +0000 (16:28 +0000)]
Pass sockets to bypass to kernel interface, allowing us to register them dynamically

10 years agoMigrated kernel_klips_ipsec to METHOD/INIT macros
Martin Willi [Tue, 23 Feb 2010 16:10:29 +0000 (16:10 +0000)]
Migrated kernel_klips_ipsec to METHOD/INIT macros

10 years agoMigrated kernel_pfkey_ipsec to METHOD/INIT macros
Martin Willi [Tue, 23 Feb 2010 16:04:46 +0000 (16:04 +0000)]
Migrated kernel_pfkey_ipsec to METHOD/INIT macros

10 years agoMigrated kernel_netlink_ipsec to METHOD/INIT macros
Martin Willi [Tue, 23 Feb 2010 15:59:25 +0000 (15:59 +0000)]
Migrated kernel_netlink_ipsec to METHOD/INIT macros

10 years agoMigrated kernel_interface wrapper to METHOD/INIT macros
Martin Willi [Tue, 23 Feb 2010 15:34:34 +0000 (16:34 +0100)]
Migrated kernel_interface wrapper to METHOD/INIT macros

10 years agoAdded left-/rightikeport ipsec.conf options to use custom IKE ports
Martin Willi [Mon, 22 Feb 2010 18:26:25 +0000 (19:26 +0100)]
Added left-/rightikeport ipsec.conf options to use custom IKE ports

10 years agoUse src/dst ports as configured in ike_cfg
Martin Willi [Mon, 22 Feb 2010 17:34:11 +0000 (18:34 +0100)]
Use src/dst ports as configured in ike_cfg

10 years agoStore custom IKE src/dst ports on ike_cfg
Martin Willi [Mon, 22 Feb 2010 17:11:42 +0000 (18:11 +0100)]
Store custom IKE src/dst ports on ike_cfg

10 years agoMigrated ike_cfg_t to METHOD/INIT macros
Martin Willi [Mon, 22 Feb 2010 17:01:22 +0000 (17:01 +0000)]
Migrated ike_cfg_t to METHOD/INIT macros

10 years agoMigrated packet_t to METHOD/INIT macros
Martin Willi [Mon, 22 Feb 2010 09:26:13 +0000 (10:26 +0100)]
Migrated packet_t to METHOD/INIT macros

10 years agoMoved socket and socket-raw implementations to plugins
Martin Willi [Mon, 22 Feb 2010 13:56:35 +0000 (14:56 +0100)]
Moved socket and socket-raw implementations to plugins

10 years agoForce libdl if the android plugin is enabled. AC_SEARCH_LIBS thinks it's not required...
Tobias Brunner [Thu, 25 Feb 2010 10:03:54 +0000 (11:03 +0100)]
Force libdl if the android plugin is enabled. AC_SEARCH_LIBS thinks it's not required, but on Android 2.0 it is.

10 years agoLink all plugins to libstrongswan.
Tobias Brunner [Wed, 24 Feb 2010 09:34:29 +0000 (10:34 +0100)]
Link all plugins to libstrongswan.

10 years agoAvoid a race condition that could lead to a segmentation fault.
Tobias Brunner [Thu, 25 Feb 2010 07:56:05 +0000 (08:56 +0100)]
Avoid a race condition that could lead to a segmentation fault.

Let's assume the callback function of a callback job returns
JOB_REQUEUE_FAIR in one call and JOB_REQUEUE_NONE in the next. Before
this fix, the thread executing the callback job would requeue the job
before unregistering itself. If there was a context switch right after
the job got requeued, and if the thread that requeued the job never got
resumed until a second thread executed the job and, due to the return
value of JOB_REQUEUE_NONE, destroyed it, then when the first thread
eventually got resumed and tried to lock the mutex to unregister itself
the pointer wouldn't be valid anymore, thus resulting in a segmentation fault.

10 years agoUse side-channel secured mpz_powm_sec of libgmp 5, if available
Martin Willi [Thu, 18 Feb 2010 16:38:59 +0000 (17:38 +0100)]
Use side-channel secured mpz_powm_sec of libgmp 5, if available

10 years agoUpdated debian package for NetworkManager-strongswan-1.1.2
Martin Willi [Thu, 18 Feb 2010 08:45:56 +0000 (09:45 +0100)]
Updated debian package for NetworkManager-strongswan-1.1.2

10 years agoVersion bump and NEWS for NetworkManager-strongswan-1.1.2 release
Martin Willi [Thu, 18 Feb 2010 08:45:29 +0000 (09:45 +0100)]
Version bump and NEWS for NetworkManager-strongswan-1.1.2 release

10 years agoUpdated german translation
Martin Willi [Thu, 18 Feb 2010 08:20:33 +0000 (09:20 +0100)]
Updated german translation

10 years agoTooltips are translatable
Martin Willi [Thu, 18 Feb 2010 08:20:13 +0000 (09:20 +0100)]
Tooltips are translatable

10 years agoNewer glade requires explicit vertical vboxes
Martin Willi [Thu, 18 Feb 2010 08:03:17 +0000 (09:03 +0100)]
Newer glade requires explicit vertical vboxes

10 years agoFixed lost renaimings in android plugin
Martin Willi [Thu, 18 Feb 2010 07:31:10 +0000 (08:31 +0100)]
Fixed lost renaimings in android plugin

10 years agoAdded Android plugin, currently provides DNS handling on Android
Martin Willi [Wed, 17 Feb 2010 09:41:55 +0000 (09:41 +0000)]
Added Android plugin, currently provides DNS handling on Android

10 years agoInvoke missing message() hook for incoming responses
Martin Willi [Wed, 17 Feb 2010 17:22:31 +0000 (18:22 +0100)]
Invoke missing message() hook for incoming responses

10 years agoversion bump to 4.4.0
Andreas Steffen [Mon, 15 Feb 2010 19:58:41 +0000 (20:58 +0100)]
version bump to 4.4.0

10 years agoDetect windows hosts to add specific workarounds.
Tobias Brunner [Tue, 1 Dec 2009 17:18:49 +0000 (18:18 +0100)]
Detect windows hosts to add specific workarounds.

10 years agoAdding support for AES GMAC (RFC4543).
Tobias Brunner [Tue, 1 Dec 2009 17:17:37 +0000 (18:17 +0100)]
Adding support for AES GMAC (RFC4543).

10 years agoDo not build own authentication data before we've verified others, we need the other... 4.3.6
Martin Willi [Tue, 9 Feb 2010 15:11:07 +0000 (16:11 +0100)]
Do not build own authentication data before we've verified others, we need the other identity in EAP

10 years agohash-and-url avoids IP fragementation, cert and crl fetch based on IPv6
Andreas Steffen [Sat, 6 Feb 2010 11:34:41 +0000 (12:34 +0100)]
hash-and-url avoids IP fragementation, cert and crl fetch based on IPv6

10 years agogenerated hash-and-url files for rfc3779 certs
Andreas Steffen [Sat, 6 Feb 2010 10:41:44 +0000 (11:41 +0100)]
generated hash-and-url files for rfc3779 certs

10 years agohash-and-url avoids IP fragementation, cert and crl fetch based on IPv6
Andreas Steffen [Sat, 6 Feb 2010 10:39:33 +0000 (11:39 +0100)]
hash-and-url avoids IP fragementation, cert and crl fetch based on IPv6

10 years agohash-and-url avoids IP fragmentation, cert and crl fetch based on IPv6
Andreas Steffen [Fri, 5 Feb 2010 19:39:13 +0000 (20:39 +0100)]
hash-and-url avoids IP fragmentation, cert and crl fetch based on IPv6

10 years agoIPv6 fragment and http access are not needed in PSK scenario
Andreas Steffen [Fri, 5 Feb 2010 19:27:03 +0000 (20:27 +0100)]
IPv6 fragment and http access are not needed in PSK scenario

10 years agohash-and-url avoids IP fragmentation, cert and crl fetch based on IPv6
Andreas Steffen [Fri, 5 Feb 2010 19:15:00 +0000 (20:15 +0100)]
hash-and-url avoids IP fragmentation, cert and crl fetch based on IPv6

10 years agoIncreased the buffer for netlink responses.
Tobias Brunner [Fri, 5 Feb 2010 19:02:39 +0000 (20:02 +0100)]
Increased the buffer for netlink responses.

If an error occurs while manipulating policies in the kernel, the
original netlink request gets attached to the response.

Prior to Linux 2.6.32 the size in the netlink header of the response was
wrong.

10 years agoIPv6 frag netfilter rule not needed anymore
Andreas Steffen [Fri, 5 Feb 2010 19:04:01 +0000 (20:04 +0100)]
IPv6 frag netfilter rule not needed anymore

10 years agohash-and-url avoids IP fragmentation, cert and crl fetch based on IPv6
Andreas Steffen [Fri, 5 Feb 2010 18:58:42 +0000 (19:58 +0100)]
hash-and-url avoids IP fragmentation, cert and crl fetch based on IPv6

10 years agoinitialize variables to avoid compiler warning
Andreas Steffen [Fri, 5 Feb 2010 11:34:37 +0000 (12:34 +0100)]
initialize variables to avoid compiler warning

10 years agoUse destination address of ppp interfaces as nexthop in starters default route lookup
Martin Willi [Fri, 5 Feb 2010 08:25:00 +0000 (08:25 +0000)]
Use destination address of ppp interfaces as nexthop in starters default route lookup

10 years agoinit_fetch() changed to fetch_initialize()
Andreas Steffen [Fri, 5 Feb 2010 05:17:02 +0000 (06:17 +0100)]
init_fetch() changed to fetch_initialize()

10 years agouse static IPsec policy netfilter rules in MOBIKE scenarios
Andreas Steffen [Thu, 4 Feb 2010 09:05:44 +0000 (10:05 +0100)]
use static IPsec policy netfilter rules in MOBIKE scenarios

10 years agoremove any charon.pid files remaining at the end of each scenario
Andreas Steffen [Thu, 4 Feb 2010 07:53:52 +0000 (08:53 +0100)]
remove any charon.pid files remaining at the end of each scenario

10 years agoIPSEC_ROUTING_TABLE is now called routing_table
Andreas Steffen [Wed, 3 Feb 2010 18:32:50 +0000 (19:32 +0100)]
IPSEC_ROUTING_TABLE is now called routing_table

10 years agodifferentiate between executed and displayed iptables commands
Andreas Steffen [Wed, 3 Feb 2010 18:21:55 +0000 (19:21 +0100)]
differentiate between executed and displayed iptables commands

10 years agoUse child_updown hook in updown plugin, fixes doubled invocation of down script
Martin Willi [Wed, 3 Feb 2010 10:04:18 +0000 (11:04 +0100)]
Use child_updown hook in updown plugin, fixes doubled invocation of down script

10 years agoadded ikev2/inactivity-timeout scenario
Andreas Steffen [Wed, 3 Feb 2010 09:28:30 +0000 (10:28 +0100)]
added ikev2/inactivity-timeout scenario

10 years agorenamed init_fetch() to fetch_initialize()
Andreas Steffen [Tue, 2 Feb 2010 18:44:34 +0000 (19:44 +0100)]
renamed init_fetch() to fetch_initialize()

10 years agoSome whitespace and code cleanups concerning the mediation extension.
Tobias Brunner [Tue, 15 Sep 2009 11:13:25 +0000 (13:13 +0200)]
Some whitespace and code cleanups concerning the mediation extension.

10 years agoJoin pluto's fetching thread instead of detaching it in order to avoid that the leak...
Tobias Brunner [Tue, 2 Feb 2010 14:17:09 +0000 (15:17 +0100)]
Join pluto's fetching thread instead of detaching it in order to avoid that the leak-detective reports a memleak.

10 years agocorrected captions
Andreas Steffen [Mon, 1 Feb 2010 11:44:44 +0000 (12:44 +0100)]
corrected captions

10 years agowarn if loaded local certificate is invalid
Andreas Steffen [Mon, 1 Feb 2010 11:29:32 +0000 (12:29 +0100)]
warn if loaded local certificate is invalid

10 years agoUpdated NEWS about per-connection inactivity timeout
Martin Willi [Wed, 27 Jan 2010 15:08:06 +0000 (16:08 +0100)]
Updated NEWS about per-connection inactivity timeout

10 years agoAdded a ipsec.conf "inactivity" option to configure inactivity timeout for CHILD_SAs
Martin Willi [Wed, 27 Jan 2010 15:05:11 +0000 (16:05 +0100)]
Added a ipsec.conf "inactivity" option to configure inactivity timeout for CHILD_SAs

10 years agoMade inactivity_timeout a per CHILD_SA config option
Martin Willi [Wed, 27 Jan 2010 14:47:08 +0000 (15:47 +0100)]
Made inactivity_timeout a per CHILD_SA config option

10 years agoRefactored EAP payload, avoid unaligned word access
Martin Willi [Thu, 21 Jan 2010 13:43:07 +0000 (14:43 +0100)]
Refactored EAP payload, avoid unaligned word access

10 years agoAdded a METHOD2() macro that implements a method for two different interfaces
Martin Willi [Thu, 21 Jan 2010 13:42:08 +0000 (14:42 +0100)]
Added a METHOD2() macro that implements a method for two different interfaces

10 years agoSupport RADIUS messages up to 4096 bytes, RADIUS EAP-Message fragmentation
Martin Willi [Tue, 19 Jan 2010 15:47:21 +0000 (16:47 +0100)]
Support RADIUS messages up to 4096 bytes, RADIUS EAP-Message fragmentation

10 years agoSupport TLS client authentication Extended Key Usage in x509 generation
Martin Willi [Thu, 14 Jan 2010 11:00:43 +0000 (12:00 +0100)]
Support TLS client authentication Extended Key Usage in x509 generation

10 years agoBlock the signals before the call to sigwait.
Tobias Brunner [Tue, 12 Jan 2010 10:52:03 +0000 (11:52 +0100)]
Block the signals before the call to sigwait.

10 years agoSupport for closing CHILD/IKE_SA if a CHILD_SA is inactive.
Martin Willi [Tue, 12 Jan 2010 09:16:34 +0000 (10:16 +0100)]
Support for closing CHILD/IKE_SA if a CHILD_SA is inactive.

10 years agoAdded strongswan.conf options to configure retransmission timeouts
Martin Willi [Mon, 11 Jan 2010 15:42:12 +0000 (16:42 +0100)]
Added strongswan.conf options to configure retransmission timeouts

10 years agoAdded a "double" getter to libstrongswan settings
Martin Willi [Mon, 11 Jan 2010 15:39:28 +0000 (16:39 +0100)]
Added a "double" getter to libstrongswan settings

10 years agoCast unaligned memcpy() args to char*, avoids over-optimization on ARM
Martin Willi [Mon, 11 Jan 2010 14:18:50 +0000 (15:18 +0100)]
Cast unaligned memcpy() args to char*, avoids over-optimization on ARM

See http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.faqs/ka3934.html

10 years agoadded ikev2/rw-eap-sim-only-radius scenario
Andreas Steffen [Mon, 11 Jan 2010 10:20:45 +0000 (11:20 +0100)]
added ikev2/rw-eap-sim-only-radius scenario

10 years agolog EAP-only authentication proposal
Andreas Steffen [Mon, 11 Jan 2010 10:17:40 +0000 (11:17 +0100)]
log EAP-only authentication proposal

10 years agosend strongSwan Vendor ID in ikev2/alg-sha256-96 scenario
Andreas Steffen [Sun, 10 Jan 2010 23:54:33 +0000 (00:54 +0100)]
send strongSwan Vendor ID in ikev2/alg-sha256-96 scenario

10 years agopluto and charon are using the same strongSwan Vendor ID
Andreas Steffen [Sun, 10 Jan 2010 23:43:46 +0000 (00:43 +0100)]
pluto and charon are using the same strongSwan Vendor ID

10 years agoAdded NEWS about mutual EAP-only authentication
Martin Willi [Thu, 7 Jan 2010 15:16:22 +0000 (16:16 +0100)]
Added NEWS about mutual EAP-only authentication

10 years agoEAP-MSCHAPv2 is indeed mutual, but is prone to MITM dictionary attacks
Martin Willi [Thu, 7 Jan 2010 14:56:11 +0000 (15:56 +0100)]
EAP-MSCHAPv2 is indeed mutual, but is prone to MITM dictionary attacks

10 years agoSupport EAP-only authentication for mutual and key deriving EAP methods
Martin Willi [Thu, 7 Jan 2010 14:51:30 +0000 (15:51 +0100)]
Support EAP-only authentication for mutual and key deriving EAP methods

10 years agoIndicate and dected support for EAP-only authentication
Martin Willi [Thu, 7 Jan 2010 13:30:28 +0000 (14:30 +0100)]
Indicate and dected support for EAP-only authentication

10 years agoAdded NEWS for the new Vendor ID requirement for private use allocations
Martin Willi [Thu, 7 Jan 2010 10:14:33 +0000 (11:14 +0100)]
Added NEWS for the new Vendor ID requirement for private use allocations

10 years agoMatch to private use algorithms only if we know we are talking to strongSwan
Martin Willi [Thu, 7 Jan 2010 10:07:53 +0000 (11:07 +0100)]
Match to private use algorithms only if we know we are talking to strongSwan

10 years agoInterpret private use BEET mode notify only if we know we are talking to strongSwan
Martin Willi [Thu, 7 Jan 2010 09:37:38 +0000 (09:37 +0000)]
Interpret private use BEET mode notify only if we know we are talking to strongSwan

10 years agoAdd an option to send a vendor ID, allows us to properly support private extensions
Martin Willi [Thu, 7 Jan 2010 09:26:58 +0000 (10:26 +0100)]
Add an option to send a vendor ID, allows us to properly support private extensions