]>
git.ipfire.org Git - thirdparty/strongswan.git/log
Tobias Brunner [Mon, 11 Dec 2017 09:35:30 +0000 (10:35 +0100)]
kernel-netlink: Fix compilation on old kernels not defining IFA_F_NODAD
Fixes #2490.
Tobias Brunner [Fri, 22 Dec 2017 09:23:46 +0000 (10:23 +0100)]
Merge branch 'testing-route-based'
This adds several route-based VPN scenarios (using VTI or GRE interfaces).
It also fixes several swanctl --list-sas checks in other scenarios.
Closes strongswan/strongswan#84.
Tobias Brunner [Wed, 6 Dec 2017 11:57:06 +0000 (12:57 +0100)]
testing: Fix swanctl --list-sas checks in some scenarios
::YES was missing (or written as ::YES]) rendering those checks void.
Turns out some of them actually were wrong.
Tobias Brunner [Wed, 6 Dec 2017 11:54:35 +0000 (12:54 +0100)]
testing: Add route-based/net2net-gre scenario
Tobias Brunner [Wed, 6 Dec 2017 11:14:11 +0000 (12:14 +0100)]
testing: Enable GRE support in 4.13 config
Also enables IPv6 support for VTI devices.
Robin McCorkell [Sun, 3 Dec 2017 13:42:57 +0000 (13:42 +0000)]
testing: Add route-based/net2net-vti scenario
Robin McCorkell [Wed, 29 Nov 2017 12:39:24 +0000 (12:39 +0000)]
testing: Added route-based/rw-shared-vti-ip6-in-ip4 scenario
Robin McCorkell [Wed, 29 Nov 2017 11:55:49 +0000 (11:55 +0000)]
testing: Added route-based/rw-shared-vti scenario
Robin McCorkell [Wed, 29 Nov 2017 11:31:13 +0000 (11:31 +0000)]
testing: Enable VTI module in kernel config
Robin McCorkell [Mon, 27 Nov 2017 16:46:22 +0000 (16:46 +0000)]
testing: Override user environment PATH in chroot
chroot will capture the user environment's PATH variable, which may be
wrong (e.g. not include /bin:/sbin, as it is on Arch). We should set a
known-working PATH variable in the chroot.
Tobias Brunner [Mon, 4 Dec 2017 09:01:14 +0000 (10:01 +0100)]
kernel-pfkey: Fix extended replay configuration on FreeBSD 11.1
Fixes: 88a8fba1c76e ("kernel-pfkey: Support anti-replay windows > 2k")
Fixes #2501.
Tobias Brunner [Thu, 30 Nov 2017 08:09:39 +0000 (09:09 +0100)]
swanctl: Allow dots in authority/shared secret/pool names
Use argument evaluation provided by settings_t instead of using strings
to enumerate key/values.
If section names contain dots the latter causes the names to get split
and interpreted as non-existing sections and subsections.
This currently doesn't work for connections and their subsections due to
the recursion.
Tobias Brunner [Wed, 29 Nov 2017 13:33:21 +0000 (14:33 +0100)]
vici: Document NTLM secrets in README.md
Fixes #2481.
Tobias Brunner [Wed, 29 Nov 2017 13:21:56 +0000 (14:21 +0100)]
vici: Accept XAUTH as shared key type too
Fixes #2481.
Lubomir Rintel [Thu, 30 Nov 2017 12:02:02 +0000 (13:02 +0100)]
charon-nm: Port to libnm
libnm-glib is deprecated for several years and reaching the end of its
life. Let's switch to the more up-to-date library.
Closes strongswan/strongswan#85.
Tobias Brunner [Fri, 8 Dec 2017 08:59:13 +0000 (09:59 +0100)]
travis: Disable warning that causes a false positive in Xcode 8.3+
Xcode 8.3, to which there recently was a switch, spits out a warning for
the potentially unaligned access to ip6_plen in ip-packet.c, which we
explicitly read via untoh16() hence the access to that pointer is not
actually unaligned. It seems the compiler is not able to determine that
there is no unaligned access even though the function is defined in the
header and marked inline.
Andreas Steffen [Wed, 13 Dec 2017 07:54:54 +0000 (08:54 +0100)]
Version bump to 5.6.2dr3
Andreas Steffen [Tue, 12 Dec 2017 16:42:08 +0000 (17:42 +0100)]
tpm_extendpcr: Extend digests into a TPM PCR
Andreas Steffen [Sun, 10 Dec 2017 20:42:02 +0000 (21:42 +0100)]
Version bump to 5.6.2dr2
Andreas Steffen [Mon, 4 Dec 2017 09:23:57 +0000 (10:23 +0100)]
asn1: Added tlsfeature OID
Andreas Steffen [Sun, 10 Dec 2017 18:31:10 +0000 (19:31 +0100)]
pki: Extend pki --print with --keyid parameter
Andreas Steffen [Sun, 10 Dec 2017 10:51:03 +0000 (11:51 +0100)]
imc-os: Derive device ID from private key bound to smartcard or TPM
Eyal Birger [Thu, 30 Nov 2017 08:47:01 +0000 (10:47 +0200)]
ipsec-types: Don't mask the mark value if it is one of the 'unique' values
Support for mark=%unique/%unique-dir is implemented by using designated
magic mark values.
Use of masks is orthogonal to the 'unique' feature, as it is useful to be
able to designate portions of the packet mark for other purposes, while
still using different marks for different connections.
When these magic values are masked, their magic meaning is lost.
Perform masking only on explicit mark values.
Closes strongswan/strongswan#87.
Lubomir Rintel [Thu, 30 Nov 2017 12:24:37 +0000 (13:24 +0100)]
nm: Allow disabling libnm-glib
The distros are eventually going to drop it, allow omitting it.
Closes strongswan/strongswan#86.
Andreas Steffen [Tue, 5 Dec 2017 21:23:43 +0000 (22:23 +0100)]
Version bump to 5.6.2dr1
Andreas Steffen [Tue, 5 Dec 2017 19:41:43 +0000 (20:41 +0100)]
pt-tls-client: Load certificates via handle from smartcard or TPM
Andreas Steffen [Tue, 5 Dec 2017 16:08:55 +0000 (17:08 +0100)]
libtpmtss: Load X.509 certificates from TPM 2.0 NV RAM
Andreas Steffen [Mon, 4 Dec 2017 16:46:23 +0000 (17:46 +0100)]
libtpmtss: Extend TPM 2.0 capability info
Tobias Brunner [Tue, 28 Nov 2017 15:23:41 +0000 (16:23 +0100)]
Merge branch 'android-proposals'
Makes IKE and ESP proposals configurable.
Tobias Brunner [Tue, 28 Nov 2017 15:19:08 +0000 (16:19 +0100)]
android: Remove modp1024 from the ESP proposals
Tobias Brunner [Tue, 28 Nov 2017 15:16:18 +0000 (16:16 +0100)]
testing: Explicitly deliver all test results as text/plain
Andreas Steffen [Fri, 17 Nov 2017 21:42:28 +0000 (22:42 +0100)]
Version bump to 5.6.1
Andreas Steffen [Fri, 17 Nov 2017 21:42:07 +0000 (22:42 +0100)]
testing: Added swanctl/rw-cert-pss scenario
Tobias Brunner [Fri, 17 Nov 2017 17:07:09 +0000 (18:07 +0100)]
android: New release after adding configurable proposals
Tobias Brunner [Fri, 17 Nov 2017 16:45:52 +0000 (17:45 +0100)]
android: Validate proposal strings when importing profiles
Tobias Brunner [Fri, 17 Nov 2017 16:40:52 +0000 (17:40 +0100)]
android: Validate proposal strings in the GUI
Tobias Brunner [Fri, 17 Nov 2017 16:26:51 +0000 (17:26 +0100)]
android: Add utility JNI function to validate proposal strings
Tobias Brunner [Fri, 17 Nov 2017 16:15:14 +0000 (17:15 +0100)]
proposal: Move proposal_t from libcharon to libstrongswan
This allows us to use it without having to initialize libcharon, which
was required for the logging (we probably could have included debug.h
instead of daemon.h to workaround that but this seems more correct).
Tobias Brunner [Fri, 17 Nov 2017 15:41:52 +0000 (16:41 +0100)]
android: Load JNI libraries in Application class
This way they are also loaded when we don't use CharonVpnService.
Tobias Brunner [Tue, 14 Nov 2017 10:18:13 +0000 (11:18 +0100)]
android: Make IKE/ESP proposals configurable in the GUI
Tobias Brunner [Tue, 14 Nov 2017 09:23:09 +0000 (10:23 +0100)]
android: Import IKE/ESP proposals
We currently don't validate them here, only when used later will they
get parsed (which includes some checks).
Tobias Brunner [Tue, 14 Nov 2017 08:49:24 +0000 (09:49 +0100)]
android: Use optional custom proposals for IKE and ESP
If the proposal is invalid we fall back to the defaults.
Tobias Brunner [Tue, 14 Nov 2017 09:18:59 +0000 (10:18 +0100)]
android: Add properties for IKE and ESP proposals
Tobias Brunner [Fri, 10 Nov 2017 17:14:26 +0000 (18:14 +0100)]
android: Free settings string passed via JNI
Tobias Brunner [Fri, 17 Nov 2017 08:30:02 +0000 (09:30 +0100)]
NEWS: Added some news for 5.6.1
Tobias Brunner [Fri, 17 Nov 2017 08:31:19 +0000 (09:31 +0100)]
hashers: Change names of SHA2 hash algorithms
Keep the lower case names as they are as we use them internally (parsing
and e.g. in OpenSSL as identifier).
Tobias Brunner [Wed, 8 Nov 2017 17:08:08 +0000 (18:08 +0100)]
ikev2: Add hash algorithm used for RSASSA-PSS signature to log message
Tobias Brunner [Thu, 16 Nov 2017 16:13:36 +0000 (17:13 +0100)]
hasher: Add uppercase short names for hash algorithms
Tobias Brunner [Fri, 10 Nov 2017 15:12:29 +0000 (16:12 +0100)]
testing: Configure logging via syslog in strongswan.conf
Globally configure logging in strongswan.conf.testing and replace all
charondebug statements with strongswan.conf settings.
Tobias Brunner [Wed, 15 Nov 2017 16:11:34 +0000 (17:11 +0100)]
testing: Disable logging via journal in charon-systemd
This avoids duplicate log messages as we already log via syslog to get
daemon.log.
Tobias Brunner [Fri, 10 Nov 2017 14:53:52 +0000 (15:53 +0100)]
testing: Globally define logging via syslog for charon-systemd
We could make the same change for charon (actually setting it for charon
in strongswan.conf.testing would work for charon-systemd too), however,
there are dozens of test cases that currently set charondebug in
ipsec.conf.
Tobias Brunner [Wed, 15 Nov 2017 13:41:56 +0000 (14:41 +0100)]
x509: Initialize signature params when parsing attribute certificates
Tobias Brunner [Wed, 15 Nov 2017 13:40:10 +0000 (14:40 +0100)]
sw-collector: Unmap history file on failure to instantiate extractor
Tobias Brunner [Wed, 15 Nov 2017 13:35:42 +0000 (14:35 +0100)]
charon: Explicitly check return value of fileno()
This is mainly for Coverity because fchown() can't take a negative
value, which the -1 check implies is possible.
Tobias Brunner [Wed, 15 Nov 2017 13:33:05 +0000 (14:33 +0100)]
pkcs8: Add explicit comment for RSASSA-PSS fall-through
Tobias Brunner [Wed, 15 Nov 2017 11:18:17 +0000 (12:18 +0100)]
The pacman tool got replaced by the sec-updater tool
Tobias Brunner [Wed, 15 Nov 2017 11:10:33 +0000 (12:10 +0100)]
sec-updater: Fix typo in documentation
Tobias Brunner [Wed, 15 Nov 2017 09:21:13 +0000 (10:21 +0100)]
Fixed some typos, courtesy of codespell
Tobias Brunner [Mon, 13 Nov 2017 09:09:05 +0000 (10:09 +0100)]
swanctl: Add check for conflicting short options
Tobias Brunner [Mon, 13 Nov 2017 08:45:14 +0000 (09:45 +0100)]
swanctl: Properly register --counters commmand
Use C instead of c, which is already used for --load-conns.
Andreas Steffen [Sat, 11 Nov 2017 18:23:01 +0000 (19:23 +0100)]
testing: Do not remove all swanctl subdirectories
Andreas Steffen [Sat, 11 Nov 2017 17:25:17 +0000 (18:25 +0100)]
Version bump to 5.6.1rc1
Andreas Steffen [Sat, 11 Nov 2017 15:42:38 +0000 (16:42 +0100)]
Merge branch 'swanctl-testing'
Andreas Steffen [Sat, 11 Nov 2017 15:39:30 +0000 (16:39 +0100)]
libimcv: Updated imv database
Andreas Steffen [Sat, 11 Nov 2017 15:36:43 +0000 (16:36 +0100)]
testing: Converterd tnc to systemd
Andreas Steffen [Sat, 11 Nov 2017 06:18:51 +0000 (07:18 +0100)]
testing: Converted sql to systemd
Andreas Steffen [Fri, 10 Nov 2017 16:21:40 +0000 (17:21 +0100)]
testing: Converted swanctl to systemd
Andreas Steffen [Sun, 29 Oct 2017 19:39:10 +0000 (20:39 +0100)]
testing: Added legacy ipv6-stroke scenarios
Andreas Steffen [Fri, 10 Nov 2017 12:50:24 +0000 (13:50 +0100)]
testing: Converted ipv6/rw-ip6-in-ip4-ikev2 to swanctl
Andreas Steffen [Fri, 10 Nov 2017 12:42:29 +0000 (13:42 +0100)]
testing: Converted ipv6/rw-ip6-in-ip4-ikev1 to swanctl
Andreas Steffen [Fri, 10 Nov 2017 11:39:36 +0000 (12:39 +0100)]
testing: Converted ipv6/net2net-ip6-in-ip4-ikev2 to swanctl
Andreas Steffen [Fri, 10 Nov 2017 11:28:24 +0000 (12:28 +0100)]
testing: Converted ipv6/net2net-ip6-in-ip4-ikev1 to swanctl
Andreas Steffen [Fri, 10 Nov 2017 10:28:28 +0000 (11:28 +0100)]
testing: Converted ipv6/rw-rfc3779-ikev2 to swanctl
Andreas Steffen [Thu, 9 Nov 2017 16:49:03 +0000 (17:49 +0100)]
testing: Converted ipv6/rw-compress-ikev2 to swanctl
Andreas Steffen [Sun, 29 Oct 2017 19:23:03 +0000 (20:23 +0100)]
testing: Converted ipv6/rw-psk-ikev2 to swanctl
Andreas Steffen [Sun, 29 Oct 2017 18:53:45 +0000 (19:53 +0100)]
testing: Converted ipv6/rw-psk-ikev1 to swanctl
Andreas Steffen [Sun, 29 Oct 2017 15:52:51 +0000 (16:52 +0100)]
testing: Converted ipv6/rw-ikev2 to swanctl
Andreas Steffen [Sun, 29 Oct 2017 15:48:19 +0000 (16:48 +0100)]
testing: Converted ipv6/rw-ikev1 to swanctl
Andreas Steffen [Sun, 29 Oct 2017 14:38:45 +0000 (15:38 +0100)]
testing: Converted ipv6/net2net-rfc3779-ikev2 to swanctl
Andreas Steffen [Sun, 29 Oct 2017 11:17:29 +0000 (12:17 +0100)]
testing: Converted ipv6/net2net-ip4-in-ip6-ikev2 to swanctl
Andreas Steffen [Sun, 29 Oct 2017 10:29:09 +0000 (11:29 +0100)]
testing: Converted ipv6/net2net-ip4-in-ip6-ikev1 to swanctl
Andreas Steffen [Thu, 19 Oct 2017 19:27:37 +0000 (21:27 +0200)]
testing: Converted ipv6/transport-ikev2 to swanctl
Andreas Steffen [Thu, 19 Oct 2017 19:20:01 +0000 (21:20 +0200)]
testing: Converted ipv6/transport-ikev1 to swanctl
Andreas Steffen [Thu, 19 Oct 2017 19:03:53 +0000 (21:03 +0200)]
testing: Converted ipv6/net2net-ikev2 to swanctl
Andreas Steffen [Thu, 19 Oct 2017 18:46:00 +0000 (20:46 +0200)]
testing: Converted ipv6/net2net-ikev1 to swanctl
Andreas Steffen [Thu, 19 Oct 2017 15:46:39 +0000 (17:46 +0200)]
testing: Converted ipv6/host2host-ikev2 to swanctl
Andreas Steffen [Tue, 17 Oct 2017 09:44:17 +0000 (11:44 +0200)]
testing: Converted ipv6/host2host-ikev1 to swanctl
Andreas Steffen [Tue, 10 Oct 2017 19:14:50 +0000 (21:14 +0200)]
testing: Removed libipsec/rw-suite-b
Andreas Steffen [Tue, 10 Oct 2017 18:51:27 +0000 (20:51 +0200)]
testing: Converted libipsec/net2net-null to swanctl
Andreas Steffen [Sun, 8 Oct 2017 17:16:55 +0000 (19:16 +0200)]
testing: Converted libipsec/net2net-cert-ipv6 to swanctl
Andreas Steffen [Thu, 5 Oct 2017 07:35:59 +0000 (09:35 +0200)]
testing: Converted libipsec/net2net-cert to swanctl
Andreas Steffen [Thu, 5 Oct 2017 12:05:15 +0000 (14:05 +0200)]
testing: Converted libipsec/net2net-3des to swanctl
Andreas Steffen [Wed, 4 Oct 2017 18:34:51 +0000 (20:34 +0200)]
testing: Converted libipsec/host2host-cert to swanctl
Andreas Steffen [Fri, 1 Sep 2017 19:10:00 +0000 (21:10 +0200)]
testing: Converted gcrypt-ikev2 to swanctl
Andreas Steffen [Thu, 19 Oct 2017 14:36:46 +0000 (16:36 +0200)]
testing: Converted gcrypt-ikev1 to systemd
Andreas Steffen [Wed, 18 Oct 2017 09:45:14 +0000 (11:45 +0200)]
testing: Converted af-alg to systemd
Andreas Steffen [Tue, 17 Oct 2017 09:52:08 +0000 (11:52 +0200)]
testing: Enable systemd
Andreas Steffen [Fri, 1 Sep 2017 16:14:04 +0000 (18:14 +0200)]
testing: Updated some descriptions
Andreas Steffen [Fri, 10 Nov 2017 10:47:27 +0000 (11:47 +0100)]
libtpmtss: Added missing argument in hasher_from_signature_scheme()
Tobias Brunner [Tue, 7 Nov 2017 09:44:22 +0000 (10:44 +0100)]
charon-tkm: Unlink PID file after deinit
Same change as for charon in the previous commit.
References #2460.