ChangeLog

   1  strongswan-4.0.5 / R:1447
   2 ===========================
   3
   4 fixed typos
   5 improved selection of ipsec status|statusall <name>
   6 fixed NEWS (runtime debug level options)
   7 fixed credits
   8 fixed very old bug in linked_list's remove_first and remove_last
   9 proper "ipsec up" signal handling when initiating to %any
  10 removed iterator hook for replace
  11 fixed output of proto/port selectors
  12 cosmetics
  13 due to console logging, no need for final sleep anymore
  14 adapted checks to changed ipsec status output
  15 due to narrowing no need for rightsubnetwithin
  16 no need to send certreq
  17 fixed ipsec status|statusall <name>
  18 log IKE SPIs on a separate line
  19 redesigned formatting of ipsec status|statusall
  20 cosmetics
  21 version bumps of strongSwan, Linux kernel and Gentoo root file system
  22 corrected description
  23 added dpd-hold scenario
  24 added new features
  25 fixed 64 bit issue
  26 solved 64 bit issue by changing long to int
  27 solved 64 bit issue in push/pop stroke interface
  28 fixed 64 bit issue
  29 some fixes for doxygen
  30 better split up of library files "types.h" & "definitions.h"
  31 centralized all printf specifier character definitions
  32 reuse of arginfo handlers
  33 more cleanups
  34 fixed more AMD64 issues
  35 added DEBUG_LEVEL compile flag to exclude DBGn() statements
  36 added nodebug configure script without any debug messages and without -g
  37 preparations to include certreqs in policy decisions
  38 do not sent certreq payloads when the peer is known to use PSK
  39 position of (myself) moved in log output
  40 do not sent certreq payloads when using self-signed certs
  41 moved (myself) in log output
  42 moved typedefs to beginning of files to solve some include problems
  43 splitted authenticator to have a separate implementation for each auth_method_t
  44 using va_copy to clone va_lists, should fix proplems on AMD64
  45 some other cleanups
  46 do not sanitize '*' character
  47 fixed SIGSEGV when setup of an additional CHILD_SA fails
  48 added IKEv2 clarifications RFC
  49 changed debug level of certreq log output
  50 cosmetics in debug output
  51 support of certreq payload in IKE_AUTH messages
  52 chunk_to_hex() function declaration deleted
  53 added function certreq_payload_create_from_x509()
  54 send a certreq as initiator if other_ca is set
  55 added method get_ca_certificate()
  56 added methods get_my_ca() and get_other_ca()
  57 added methods get_my_ca() and get_other_ca()
  58 added some missing 'AUD' entries
  59 cosmetics
  60 cosmetics
  61 change due to change debug output
  62 spaces should not be sanitized
  63 fixed due to new logging concept
  64 some improvements in signaling code
  65 include only source NATD payloads really needed
  66 updated for NAT team
  67 improved signal handling and emitting
  68 support of ModeCfg Push mode
  69 support of mixed RSA/PSK static connections
  70 support of ipsec statusall in state output
  71 output of 'DPD active' in ISAKMP SAs
  72 support of ipsec statusall in state output
  73 added natip support
  74 added has_natip flag
  75 added ModeCfg push policy and states
  76 added ModeCfg push policy and states
  77 fixed typo in debug statement
  78 redesigned list output format
  79 added 'modeconfig=pull|push' and 'left|rightnatip' keywords
  80 added has_natip flag
  81 added has_natip flag
  82 added 'exit' statement in listcerts,.. case
  83 fixed two bugs in the time_t and chunk_ct print functions
  84 redesigned format of print function
  85 replaced 'times' by 'dates'
  86 added private flag to asn1_init
  87 added private flag to asn1_ctx_t
  88 removed DES-EDE3-CBC only comment
  89 removed deprecated iterator methods (has_next & current)
  90 added iterator hook to manipulate iterator the clean way
  91 linked list cleanups
  92 added list methods invoke(), destroy_offset(), destroy_function()
  93 simplified list destruction when destroying its items
  94 added verbosity level to stroke
  95 upgrade to new Gentoo root file system and tcpdump command
  96 added
  97 deleted
  98 renamed ikev1 scenario and added ikev2 scenario
  99 added new scenarios
 100 Version bumps of UML kernel, Gentoo root file system and strongSwan release
 101 code cleanups in printf handlers
 102 added eap authentication draft for ikev2
 103 updated stroke to allow run-time manipulation of debug levels
 104 added charondebug config parameter to set debug level at startup
 105 introduced new logging subsystem using bus:
 106   passive listeners can register on the bus
 107   active listeners wait for signals actively
 108   multiplexing allows multiple listeners to receive debug signals
 109   a lot more...
 110 updated file filter for kdev project
 111 include CREDITS file in distribution
 112 moved various scripts in scripts/ dir
 113 add configure script wrappers
 114 removed txt files from doxygen
 115 removed module tests, outdated. We need something more system-test like
 116 added missing -DDEBUG compile option
 117 fixed auxillary message data parsing for IPV6 socket
 118 using SOL_* constants for socket level
 119 fixed IPV6_PKTINFO setsockopt() to work with most kernel headers
 120 replaced strerror(errno) with %m printf specifier
 121 added stronger certs for moon, carol, and dave
 122 added IPv6 hw and multicast addresses
 123 adapted to new tcpdump ipv6 output
 124 multi-level-ca scenarios use unencrypted private key
 125 added scenario
 126 fixed timing
 127 new gentoo root file system
 128 fixed bug with openldap 2.3
 129 removed ipsec.conf version information
 130 carolKey.pem is now protected by 3DES passphrase
 131 updated net runlevel scripts
 132 updated net init scripts
 133 new net configuration format
 134 HW addresses must be predefined
 135 cosmetics
 136 added USE_LIBCURL
 137 cosmetics
 138 found libraries are not appended to LIBS anymore
 139 version bump to 4.0.5
 140 fixed DPD to survive IKE_SA rekeying
 141 introduced printf() specifiers for:
 142   host_t (%H)
 143   identification_t (%D)
 144   chunk pointers (%B)
 145   memory pointer/length (%b)
 146 added a signaling bus:
 147   receives event and debug messages, sends them to its listeners
 148   stream_logger, sys_logger, file_logger added, listen to bus
 149 some other tweaks here and there
 150 added often used RFCs and drafts
 151 DES for private key encryption is not supported
 152 updated NEWS and ChangeLog for 4.0.4 release
 153 fixed retransmission policy for responder
 154 fixed dpd for responder
 155 added ID_ANY check to matches_binary()
 156 replaced 'missing value' warning by zero length chunk_t value
 157 defined maximum hash size
 158 support of AES-192-CBC private key encryption
 159 added hostaccess support
 160 added hostaccess support
 161 moved auth_method to policy
 162 added hostaccess support
 163 added hostaccess support
 164 more consistent authentication logging
 165 added hostaccess support
 166 moved auth_method to policy
 167 moved auth_method to policy
 168 added hostaccess support; moved auth_method to policy
 169 added hostaccess support
 170 added hostaccess support
 171 added new test scenarios
 172 fixed some compiler warnings
 173
 174
 175  strongswan-4.0.4 / R:1289
 176 ===========================
 177
 178 fixed some compiler warnings
 179 extended statusall output
 180   added job/event-queue statistics
 181   added allocation statistics when using LEAK_DETECTIVE
 182 fixed include typo
 183 public declaration of all HASH_SIZEs in hasher.h
 184 support of encrypted private key files
 185 added copyright notice to sha2_hasher
 186 included SHA2 in build process
 187 implemented sha2_hasher which supports SHA-256, SHA-384 and SHA-512
 188 added support for 3DES encryption algorithm in IKE
 189 fixed the ids parsing bug
 190 fixed the ids parsing bug
 191 updated TODOs
 192 fixed memleak
 193 fixed proper handling of id parsing errors
 194 proper return value when no PSK found
 195 added HOST_ACCESS for firewall script as default
 196 more debugging output for PSK authentication
 197 some cleanups here and there
 198 added auth_method field
 199 added auth_method field
 200 cosmetics
 201 verify_emsa_pkcs1_signature returns status_t
 202 cosmetics
 203 added PSK support
 204 enabled firewall support
 205 proper error handling for socket creation
 206 handle certificate parsing error more generous
 207 fixed certificate verification bug!
 208 fixed memleak when receiving invalid certificate
 209 version bump to 4.0.4
 210 version bump to 4.0.4
 211 two new test scenarios
 212 fixed path to images directory
 213 implemented updown script to handle firewalling
 214 add priority management for kernel policy
 215 let ROUTED policies installed, until manuall removed
 216 introduced new naming scheme to allow proper shutdown of IKE/CHILD_SAs
 217 ike_sa_manager cleanups
 218 implemented handling of dpdaction and dpddelay ipsec.conf parameters
 219 reuse reqid when a ROUTED child_sa gets INSTALLED
 220 fixed a bug in retransmission code
 221 added support for the "keyingtries" ipsec.conf parameter
 222 added support for the "dpddelay" ipsec.conf parameter
 223 done some work for "dpdaction" behavior
 224 some other cleanups and fixes
 225 fixed a at-least-one-year-old bug which caused crashed in the scheduler
 226 added raw socket filter for IPv6
 227 implemented NAT detection for IPv6
 228 removed unneeded constructor
 229 initial support for IPv6 (more testing needed)
 230   socket works (without v6 filter)
 231   traffic selector handle IPv4/v4 cleanly
 232     improvements in traffic selector code
 233   kernel interface accepts v6 traffic selectors and hosts
 234   host_t class has full IPv6 support
 235 added stddef.h include for compilers which do not support the offsetof() directive
 236 moved interface enumeration code to socket, where it belongs
 237 query interfaces every time we need it to respect changes in network config
 238 added address listing on startup and "ipsec statusall"
 239 version bump of UML kernel to 2.6.17.11
 240 fixed crash bug when doing "ipsec down" with an unknown connection
 241 added name property in CHILD_SA, allows proper status output
 242 fixed bug which prevented port float when nat is detected
 243 version bumps
 244 'sha' and 'sha1' are now treated as synonyms
 245 updated Changelog and other docs
 246
 247
 248  strongswan-4.0.3 / R:1235
 249 ===========================
 250
 251 fixed rekeying behavior when proposing an inacceptable DH group (INVALID_KE_PAYLOAD)
 252 implement proper handling of most simultaneous IKE_SA rekeying cases
 253 version bump to 4.0.3
 254 implemented proper refcounting using atomic operations
 255 implemented IKE_SA rekeying
 256         uses ikelifetime, rekeymargin and rekeyfuzz config settings
 257         no handling of simultaneus exchanges yet!
 258 added possibility to route CHILD_SAs, without to set them up
 259         support for auto=route parameter
 260         support for ipsec route and ipsec unroute
 261         initiating of CHILD and/or IKE_SAs based on kernel acquires
 262 reuse an existing IKE_SA to set up additional CHILD_SAs
 263 introduced refcounting on policy and connections
 264         aren't stored in the IKE_SA anymore, they are queried on the fly
 265         are immutable now, allows it to share them
 266 policy selection based on traffic selectors, leads to valid lookup results
 267         rekeying queries the policy based on its traffic selectors
 268 cleanups in kernel interface code
 269 added proper traffic selector to string conversion
 270 some cleanups here & there
 271 X.509 certificate trust path verification
 272 added
 273 fixed UDP decapsulation by adding inbound bypass policy for send socket
 274 updated mixed tests to new charon output
 275 corrected DPD entry
 276 reenabled module tests for charon
 277 fixed bug which erroneously detected KE payload when rekeying
 278 added IPsec bypass policy to receiving socket, allows incoming IKE traffic on host2host tunnels when using NAT
 279 improved logging on verify errors for some payloads
 280 enforcing IKE_SA shutdown, even when transactions are outstanding
 281 proper reject of CREATE_CHILD_SA message with KE payload
 282 added test cases from NAT team
 283 updated all IKEv2 tests to work with new status output
 284 added tcpdumpcount function from NATT guys
 285 added possibility to mount the strongswan tree into all UMLs
 286 added script for installing from shared tree in all UMLs
 287 added script to shut down all UMLs properly
 288 removed in favour of tests from NAT team
 289 fixed CREATE_CHILD_SA transaction dispatching
 290 added CHILD_SA states, which allows us to detect further simultaneous transactions
 291 reimplemented the buggy message id handling
 292 updated some inline docs
 293 fixed crypter/signer in/out to conform with standard
 294 fixed payload order
 295 added message id logging
 296 added all currently known notify payload types
 297 added policy cache to kernel interface
 298         allows refcounting of multiple installed policies
 299         finally brings us stable simultaneous rekeying
 300 leak detective blanks memory on free & alloc, allows further membug detection
 301 code cleanups
 302 identification_t.matches() supports multiple wildcard counts
 303 identification_t.matches() supports multiple wildcard counts
 304 further work done for simultaneous rekeying/delete
 305         still some cases which cause trouble
 306 fixed compiler warnings in parser when using -O2
 307 reenabled check_expiry
 308 updated copyright information
 309 reimplemented CHILD_SA rekeying & delete
 310         no simultanous transaction with CHILD_SAs yet!
 311 removed NAT_TRAVERSAL and VIRTUAL_IP compile options
 312 removed NAT_TRAVERSAL compile option
 313 removed NAT_TRAVERSAL and VIRTUAL_IP compile options
 314 added
 315 updated NEWS
 316 added support for leftprotoport and rightprotoport
 317 improved CHILD_SA output for "ipsec statusall"
 318 updated whitelist (getprotobynumber)
 319 redesigned IKE_SA using a transaction mechanism:
 320         removed old state machine
 321         reimplemented IKE_SA setup and delete
 322         implemented dead peer detection
 323         implemented keep-alives
 324         a lot of fixes
 325         no rekeying yet
 326 fixed compiler warnings
 327 made thread ids unsigned again, to avoid negative thread ids on some systems
 328 fixed memleak when initiating a connection already up
 329 updated leak detective whitelist
 330 applied latest NATT patch with some fixes and cleanups
 331 test currently without firewall
 332 added
 333 added
 334 added
 335 removed
 336 removed version information from ipsec.conf
 337 log entries start with lowcercase character
 338 restored lost IKEv2 packet suppression
 339 added USE_LEAK_DETECTIVE option
 340 fixed natd_hash memory leak
 341 tests with subdirectory structure
 342 removed tests
 343 introduced subdirectory structure
 344 support of cert payloads
 345 lowercase log entries
 346 distributed by ITA
 347 added support of updown parameter
 348 generation of default key
 349 cosmetics
 350 added support of updown parameter
 351 version bump to 4.0.2
 352 added X.509 trust chain verification
 353 version bump to 4.0.2
 354 ESP packet size changed
 355 fixed bad_proposal_syntax bug
 356 updated ingorelist for stroke_keywords.c
 357 applied new changes from NATT team
 358         DPD only done when no IPsec and IKE traffic processed
 359         minor changes here and there
 360 some message code cleanups
 361 fixed identification_t clone to apply function pointers
 362 cleaner error handling on UDP encapsultion sockopt failure
 363 added mysterious UDP encapsulation socket option to get encapsulation working
 364 fixed BAD_PROPOSAL_SYNTAX vulnerability
 365 first merge of NATT code
 366 fixed testing build
 367 updated for 4.0.1 release
 368 updated news for 4.0.1 release
 369 fixed whitelist detection
 370
 371
 372  strongswan-4.0.1 / R:1144
 373 ===========================
 374
 375 fixed whitelist detection
 376 reworked function ignore mechanism to not-report whitelist
 377   rather than overriding functions
 378 fixed execv call args to work when using strictcrl and syslog
 379 fixed bug: usage of already freed mem
 380 readded local_credential_store
 381 added sendcert policy to connection
 382 some other cleanups
 383 implemented rereadcrls rereadcacerts
 384 implemented rereadcrls rereadcacerts
 385 implemented rereadcrls rereadcacerts
 386 removed local_credential_store
 387 fixed SPI when acting as initiator of rekeying
 388 fixed SPI when rekeying and deleting CHILD_SAs
 389 change key derivation order to fullfill RFC
 390 added crl support
 391 added listcrls
 392 added chunk_equals_or_null()
 393 added crl support
 394 changed tabs from 8 to 4 spaces
 395 added crl support
 396 cosmetics
 397 cosmetics (space)
 398 fixed compilation error
 399 updated for release
 400 fixed aes code, we support now aes128, aes192, aes256 in IKE
 401 added support for "ike" and "esp" keywords
 402 fixed bugs in proposal code
 403 algorithm selection for charon works now with ipsec.conf
 404 a lot of other fixes
 405 implemented clean spi allocation behavior when using multiple proposals
 406 fixed logleve(l) keyword typo
 407 handling of "rekey=no" parameter added
 408 changed default algorithms to:
 409   ike: aes128-sha-modp2048
 410   esp: aes128-sha1, 3des-md5
 411 added default CRL directory path
 412 added strictcrlpolicy command line argument
 413 added option parsing
 414 added local CRLs
 415 added rekeying parameters
 416 corrected some descriptions
 417 moved RSA key size constraints to definitions.h
 418 fixed down keyword
 419 debug and logging improvements
 420 support for stroke listcerts|listcacerts|listcrls|listall
 421 support for stroke listcerts|listcacerts|listall and left|rightca=
 422 gperf creates optimum hash table for stroke keywords
 423 using same reqid if a child sa rekeys an existing one
 424 NULL string argument is treated as %any
 425 add_certificate() now returns pointer to added cert
 426 cosmetics
 427 single tests now start up faster
 428 workaround for peers rekeying at the same time
 429 loading lifetime policies from ipsec.conf
 430 old child_sa gets deleted after rekeying
 431 rekeying almost complete, but:
 432         IKE_SA get in an invalid state when both initiate rekeying at the same time,
 433 corrected type
 434 improved kernel interface logging
 435 fixed clone/destroy behavior when not using CAs
 436 specifying keysize in bits, as it is required in IKEv2
 437 added generic kernel SA algorithm handling, which brings us:
 438         aes-128, aes-256, blowfish, des, 3des and null encryption for CHILD_SAs
 439 added support for leftsendcert= and left|rightca= parameters
 440 discard cert if CA basic constraints flag is not set and warn if cert is not valide
 441 added public methods is_ca() and is_valid()
 442 changed ASN.1 CONTROL log output to LEVEL2
 443 cosmetics
 444 removed unused Makefile
 445 stroke.h requires libstrongswan/types.h
 446 fixed compile warnings when using -Wall
 447 further CHILD_SA rekeying work done:
 448         creation of a new CHILD_SA on a expire from a kernel works
 449         delete of old CHILD_SA still missing
 450         some issues when both initiate rekeing
 451 updated INSTALL to conform with autotools
 452 added a short HACKING introduction
 453 further work for rekeying:
 454   get liftimes from policy
 455   added new state
 456   initiation of rekeying done
 457 proposal redone:
 458   removed support for AH+ESP proposals
 459 proper leak detective hook for realloc
 460 excluded pthread_setspecific from leak detective
 461 fixed a memleak
 462 cosmetics
 463 ipv6-host2host scenario added
 464 created IPv6 environment
 465 job management:
 466   moved job code from thread_pool to job, jobs have an "execute" method now
 467   added two new jobs: delete_child_sa & rekey_child_sa
 468 kernel interface:
 469   listens now for ACQUIRE & EXPIRE
 470   supports hard and soft lifetimes
 471   fires jobs for delete and rekey child sa
 472 ike sa manager:
 473   can checkout IKE SAs by requid of owned CHILD SAs
 474 we have now the infrastructure to do the rekeying... :-)
 475 fixed some memleaks/freebugs
 476 leak detective works almost usable now (?!)
 477 added host2host test for ikev2
 478 fixed host-host tunnel traffic selection, host-host works now
 479 bug fixed circumventing an assertion in delete_connection when ikev1 is not set
 480 minimized prefixed on stroke logger output
 481 charon outputs strongSwan version
 482 tests with subjectAltNames now
 483 fixed event queue for events >36min
 484 included charons module tests to build & dist
 485 full support of ikev1 and ikev2 connection flags
 486 cosmetics in log_status output
 487 use of streq
 488 added testing files to dist
 489   required the use of the "ustar" format to support
 490   filenames longer than 99 chars
 491 lookup of private key based on keyid of public key
 492 new functions to add certificates and retrieve private and public keys
 493 changed log level
 494 list ca certificates
 495 computation of SHA-1 hash over publicKeyInfo object
 496 moved abbreviated thread_id in front of brackets
 497 added has_key parameter to log_certificates()
 498 log_certificates() now shows keyid and availability of matching private key
 499 indented loaded file log entry
 500 moved TIMETOA_BUF definition to types.h
 501 moved TIMETOA_BUF definition from asn1.h
 502 define default CA_CERTIFICATE_DIR
 503 load all ca certificates
 504 fixed daemon destruction order to prevent
 505   crashes on termination
 506 fixed memleak when deleting a connection
 507 updated todo list
 508 policies contain a connections name now
 509   used for initiate and delete
 510 connections won't get initiated twice anymore
 511 deleting of connections is now possible, which allows us to use
 512   ipsec update and ipsec reload
 513 changed iterator->remove behavior
 514 ipsec up|down|route|delete require a connection name
 515 stroke now uses constant size string buffer
 516 changed to standard connection log output
 517 reworked parsing and matching of subjectAltNames
 518 added memeq() macro
 519 moved timetoa() from asn1.c to types.c
 520 corrected type
 521 some logging improvements and cosmetics
 522 handle IKE_SA setup without a piggy-packed CHILD_SA
 523   more IKEv2 conform
 524 initiate IKE_SA deletion befor manager destruction
 525 improved code of chunk_equals
 526 added streq() macro and defined default BUF_LEN
 527 typo
 528 build gets perl and gperf from configure now
 529 moved built sources to maintainer-clean
 530 show connection templates in status & statusall
 531 don't complain on termination of IKEv1 connections
 532 updated ipsec.conf manual to reflect actual state of
 533   keyexchange-parameter
 534 using hubs instead of switches, which allows us
 535   to sniff the traffic from the host system.
 536 changed config load strategy:
 537   starter loads both connections in charon & pluto,
 538   charon ignores anything with keyexchange!=ikev2.
 539   pluto needs the same behavior.
 540  changed build order to fix build error after distclean
 541 load_end_certificate() now loads certificates
 542 cosmetics
 543 moved definition of generalNames_t to identification.h; initialized subjectKeyID, authKeyID and authKeySerialNumber
 544 moved definition of generalNames_t to identification.h
 545 corrrected description
 546 reimplemented proper IKE SA deletion using a seperate state,
 547   should conform now to IKEv2
 548 fixed build when using --enable-leak-detective
 549 added removed files to svn:ignore
 550 fixed bug in pluto/Makefile.am
 551 removed perl-generated oid.c/h from svn,
 552   added them to "dist" and "distclean"
 553 removed lex, yacc and gperf output from svn,
 554   added them to "dist" and "distclean"
 555 storing release revision in svn property "release-revision", because I forget it all the times
 556 fixed ignorelist, should work now
 557 added ingorelist for builded files
 558 re-added doxygen apidoc, buildable with "make apidoc"
 559 added missing ipsec.conf.5 to distribution :-/
 560 fixed another typo
 561 added missing ipsec.conf ipsec.conf.5
 562 existing ipsec.conf won't get overwritten anymore
 563 fixed typo in Makefile which corrupted the build
 564 applied patch from the NAT-T team fixing several typos
 565 applied patch from andreas, which allows certificate listing via stroke
 566 added ipsec.conf template and man page back
 567 removed old Makefiles
 568 added new strongswan KDevelop project & startup hack
 569 fixed Revision in changelog fo 4.0.0
 570 started ChangeLog
 571 simple script for ChangeLog update via "svn log"
 572 fixed compliation error using --enable-smartcard
 573 added test for ikev1-ikev2 mixed mode
 574 added test ikev2 roadwarrior scenario
 575 applied andreas's patch
 576   logger output improvements
 577   testin gupdates
 578   and a lot more
 579 updated testsuite to autotools
 580 added random source ./configure options
 581 fixed default-pkcs11 option
 582 testcommit
 583 fixed errors when --enable-pkcs11
 584 added autogen script
 585 introduced autotools
 586   first working version
 587   make dist should work
 588   things to do:
 589     UML testing!
 590     more cleanups
 591 fixed build
 592 started to rebuild source layout
 593 fixed stroke error output to starter
 594 using random SPIs now, but without collision checks
 595 applied some -W's from strongswan
 596 fixed that warnings
 597 removed IKEV2 ifdefs
 598 applied patch from andreas
 599   added charonstart option to config
 600   new ikev2 tests for UML
 601
 602  strongSwan-4.0.0 / R:967
 603 ==========================
 604
 605 removed IKEV2 ifdefs
 606 applied patch from andreas
 607   added charonstart option to config
 608   new ikev2 tests for UML
 609 applied patch from andreas
 610   pem loading
 611   secrets file parsing
 612   ikev2 testcase
 613   some other additions here and there
 614 connection termination is handled cleanly by name now
 615 fixed bad bug, certs load now cleanly again
 616 fixed make install (subdir order)
 617 fixed include path
 618 added missing script
 619 finished initial import of strongswan file tree
 620 removed a lot of old and unused stuff
 621 moved RFCs from ikev2 into doc dir
 622 added missing files for starter
 623 applied patch for charon (this time really)
 624 import of strongswan-2.7.0
 625 applied patch for charon
 626 renamed get_block_size of hasher
 627 reworked usage of IDs in various states
 628 using ID_ANY for any, not NULL as before
 629 initiator sends IDr payload in IKE_AUTH when ID unique
 630 fixed charon checks
 631 using status & statusall
 632 patch for 2.7.0
 633 add connection names to connections
 634 stroke status / ipsec status shows them
 635 added statusall for stroke
 636 added status by connection name
 637 some tests repaired, more to come
 638 fixed spi conversion
 639 improved "stroke status" output
 640 setup PID file after daemon initilization, to correctly inform
 641   starter about daemon startup
 642 added separate implementation for connection_store, credential_store, policy_store
 643 added folder structure to config
 644 credentials are fetched solely on IDs now
 645 identification_t supports now almost all id types
 646 x509 certificates work with identification_t now
 647 fixes here, fixes there
 648 fixed doxygen build
 649 seperates now in lib and charon
 650 library initialization done at a central point (library.c)
 651 some leak_detective fixes
 652 updated Todos
 653 fixed log-to-syslog behavior
 654 added patch against strongswan-2.6.4
 655 x509 certificate loading with pluto asn1 code
 656 x509 needs a lot more attention!
 657 renamed some files
 658 using asn1 pluto stuff now
 659 removed, since we use pluto asn1 stuff
 660 leak detective is usable, but does not show static function names
 661   a script which gets address via ldd and resolves address via addr2line would be nice
 662 fixed a leak in child_sa with new detective ;-)
 663 some improvements to new asn1 stuff
 664 to be continued
 665 fixed bad bugs in kernel interface
 666 added some logging info
 667 works now much more stable
 668 startet importing pluto ASN1 stuff
 669 der PKCS#1 key loading works (as it did with der_decoder)
 670 split up in libstrong, charon, stroke, testing done
 671 new leak detective with malloc hook in library
 672   useable, but needs improvements
 673 logger_manager has now a single instance per library
 674   allows use of loggers from any linking prog
 675 a LOT of other things
 676 ../svn-commit.tmp
 677 added misssing stroke.h
 678 improved strokeing
 679   down connection
 680   status
 681 some other tweaks
 682 rewrote a lot of RSA stuff
 683 done major work for ASN1/decoder
 684 allow loading of ASN1 der encoded private keys, public keys and certificates
 685 extracting public key from certificates
 686 passing certificates from stroke to charon
 687 => basic authentication with RSA certificates works!
 688 starter work on asn1 with der de/encoder
 689 RSA private and public key can load read key from ASN1 DER
 690 some other fixes here and there
 691 rewrite of logger_manager, uses now one instance per context
 692 cleanups for logger here and there
 693 removed critical flag check in payload verification (conformance to IKEv2)
 694 so thats and theres everywere... ;-)
 695 patch for strongswan-2.6.3
 696 added charon support for strongswan build process
 697 ipsec starter supports charon startup and control
 698 removed old diploma thesis scripts
 699 some cleanups
 700 compatibility to strongswan, Makefile can be called by "make programs"
 701   and "make install" (ikev2 patch must be applied to strongswan)
 702 first version of stroke control utility
 703 moved output to doc/api, since doc is used for other docs now
 704 some first documentation in english
 705 removed old eclipse project files
 706 works quite well now with ipsec.conf & ipsec starter
 707 belongs to previous commit ;-)
 708 reworked configuration framework completly
 709 configuration is now split up in: connections, policies, credentials and daemon config
 710 further alloc/free fixes needed!
 711 first attempt for connection loading and starting via "stroke"
 712 some improvements here and there
 713 configuration_manager replaced by configuration_t interface
 714 current configuration_manager is now static_configuration (testing)
 715 first draft of starter_configuration, which should once interact with ipsec starter (via whack?)
 716 some cleanups
 717 socket_t uses RAW socket, which allows parallel service of pluto/charon
 718 comments and cleanups
 719 working policy installation and removal
 720 fixed policy setup bug
 721 proposal setup implementation begun
 722 fixed socket code, so we know on which address we receive traffic
 723 AH/ESP setup in kernel is working now!!! :-)))
 724 installing of child sa works
 725 need correct IP adresses to actually use IPsec
 726 new RFCs of IKEv2, IKEv2 algs and IPSec arch added
 727 update of IKEv2 clarification document
 728 refactored ike proposal
 729 uses now proposal_t, wich is also used by child proposals
 730 ike key derivation refactored
 731 crypter_t api has get_key_size now
 732 some other improvements here and there
 733 config uses uml hosts alice and bob
 734 key derivation for child_sa works
 735 some fixes here and there
 736 fixed memleaks
 737 works with new proposal code
 738 still some(!) memleaks
 739 fixed alot of bugs in child_proposal
 740 near to working state ;-)
 741 dead end implementation
 742
 743 ... there is a lot more of it, but nothing of interest