aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* Updated build_database.sh to Ubuntu 14.04Andreas Steffen2014-05-011-215/+74
|
* Updated ITA-IMA finalize messagesAndreas Steffen2014-05-012-6/+6
|
* Implemented IMA-NG supportAndreas Steffen2014-05-014-119/+425
|
* Merge branch 'unit-tests'Martin Willi2014-04-305-15/+49
|\ | | | | | | | | Bring some minor improvements to unit testing, including more flexible configuration.
| * unit-tests: Document the supported env variablesMartin Willi2014-04-301-1/+7
| |
| * unit-tests: Support strongswan.conf defined plugin list and base directoryThomas Egerer2014-04-301-2/+8
| | | | | | | | | | | | | | tests.load and tests.plugindir to allow the specification of the plugins to be loaded and the directory to load them from. Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
| * unit-tests: Allow configuration of libstrongswan via configThomas Egerer2014-04-301-10/+14
| | | | | | | | | | | | | | | | By setting the environment variable TESTS_STRONGSWAN_CONF, the unit tests can be asked to load a configuration file, thus enabling the tester to make use of the usual configuration settings. Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
| * unit-tests: Add a ck_assert_chunk_eq() convenience macroMartin Willi2014-04-301-0/+18
| |
| * unit-tests: Silence a literal signedness warning raised by GCC 4.6.3Martin Willi2014-04-301-2/+2
|/
* sqlite: Allow query arguments to be freed before starting the enumerationTobias Brunner2014-04-301-2/+4
| | | | | By marking the string/blob arguments as transient, SQLite will copy and free them automatically.
* Version bump to 5.2.0dr2Andreas Steffen2014-04-271-1/+1
|
* Improved finalize messages in ITA-IMA componentAndreas Steffen2014-04-271-14/+21
|
* child-cfg: Fix removal of redundant traffic selectorsTobias Brunner2014-04-251-1/+1
| | | | | | | We have to make sure we compare every selected traffic selector with every other in the list. Fixes #577.
* android: New release based on 5.1.3Tobias Brunner2014-04-252-3/+3
| | | | | Also links OpenSSL statically and doesn't limit the number of packets during EAP-TTLS.
* libcharon: Added AEAD sources of libtls to Android.mkTobias Brunner2014-04-251-0/+1
|
* libimcv: Updated Android.mkTobias Brunner2014-04-251-0/+3
|
* android: Use static version of libcryptoTobias Brunner2014-04-252-2/+1
| | | | | System.loadLibrary() searches in system directories first (at least in recent releases), that is, our own build wouldn't actually get used.
* tun-device: Use SIOCAIFADDR to set IP address on FreeBSD 10Tobias Brunner2014-04-251-2/+90
| | | | | | | | FreeBSD 10 deprecated the SIOCSIFADDR etc. commands, so we use this newer command to set the address and netmask. A destination address is now also required. Fixes #566.
* Merge branch 'atomic-ref'Tobias Brunner2014-04-247-29/+134
|\ | | | | | | | | | | | | | | Adds support for GCC's __atomic* built-ins and improves the performance of logging (for ignored log levels) and half-open IKE_SA checking under high loads. Also fixes two potential race conditions in the load-tester plugin.
| * bus: Add a fast-path if log messages don't have to be loggedTobias Brunner2014-04-241-7/+53
| | | | | | | | | | | | | | For some rwlock_t implementations acquiring the read lock could be quite expensive even if there are no writers (e.g. because the implementation requires acquiring a mutex to check for writers) particularly if the lock is highly contended, like it is for the vlog() method.
| * load-tester: Fix race condition issuing same SPIChristophe Gouault2014-04-241-2/+2
| | | | | | | | | | | | | | | | | | | | Due to an unprotected incrementation, two load-tester initiators occasionally use the same SPI under high load, and hence generate 2 IPsec SAs with the same identifier. The responder IPsec stack will refuse to configure the second SA. Use an atomic incrementation to avoid this race condition. Signed-off-by: Christophe Gouault <christophe.gouault@6wind.com>
| * load-tester: Fix race condition issuing same identityChristophe Gouault2014-04-241-2/+2
| | | | | | | | | | | | | | | | | | | | Due to an unprotected incrementation, two load-tester initiators occasionally use the same identifier under high load. The responder typically drops one of the connections. Use an atomic incrementation to avoid this race condition. Signed-off-by: Christophe Gouault <christophe.gouault@6wind.com>
| * ike-sa-manager: Improve scalability of half-open IKE_SA checkingTobias Brunner2014-04-241-7/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch is based on one by Christoph Gouault. Currently, to count the total number of half_open IKE_SAs, get_half_open_count sums up the count of each segment in the SA hash table (acquiring a lock for each segment). This procedure does not scale well when the number of segments increases, as the method is called for each new negotiation. Instead, lets maintain a global atomic counter. This optimization allows the use of big values for charon.ikesa_table_size and charon.ikesa_table_segments.
| * utils: Use GCC's __atomic built-ins if availableTobias Brunner2014-04-243-8/+45
| | | | | | | | | | | | | | | | These are available since GCC 4.7 and will eventually replace the __sync operations. They support the memory model defined by C++11. For instance, by using __ATOMIC_RELAXED for some operations on the reference counters we can avoid memory barriers, which are required by __sync operations (whose memory model essentially is __ATOMIC_SEQ_CST).
| * utils: Add ref_cur() to retrieve the current value of a reference counterTobias Brunner2014-04-242-3/+24
|/ | | | | | | | | | On many architectures it is safe to read the value directly (those using cache coherency protocols, and with atomic loads for 32-bit values) but it is not if that's not the case or if we ever decide to make refcount_t 64-bit (load not atomic on x86). So make sure the operation is actually atomic and that users do not have to care about the size of refcount_t.
* testing: Added pfkey/compress test caseTobias Brunner2014-04-249-0/+100
|
* kernel-pfkey: Added IPComp supportFrancois ten Krooden2014-04-241-19/+138
| | | | | | - get_cpi function was implemented to retrieve a CPI from the kernel. - add_sa/update_sa/del_sa were updated to accommodate for IPComp SA. - Updated add_policy_internal to update the SPD to support IPComp.
* packages: New Debian network-manager-strongswan releaseMartin Willi2014-04-241-0/+8
|
* packages: Hand over network-manager-strongswan debian package maintenanceMartin Willi2014-04-241-1/+4
|
* packages: Use charon-nm in network-manager-strongswan debian packageMartin Willi2014-04-241-1/+1
|
* nm: Bump NetworkManager plugin version to 1.3.1Martin Willi2014-04-243-2/+8
|
* pacman.sh now fetches Ubuntu 14.04 security updatesAndreas Steffen2014-04-241-1/+22
|
* Merge branch 'reauth-collision'Martin Willi2014-04-172-2/+53
|\ | | | | | | Fixes two collisions between IKE_SA re-authentication and CHILD_SA rekeying.
| * ike: Delay actively initiated reauthentication when other exchanges in progressMartin Willi2014-04-171-2/+47
| | | | | | | | | | If any other IKE or CHILD_SA operation takes places, we should not start initiating reauthentication to avoid any potential races.
| * ikev2: Reject CHILD_SA creation/rekeying while deleting an IKE_SAMartin Willi2014-04-171-0/+6
|/ | | | | | | | | | | If one peer starts reauthentication by deleting the IKE_SA, while the other starts CHILD_SA rekeying, we run in a race condition. To avoid it, temporarily reject the rekey attempt while we are in the IKE_SA deleting state. RFC 4306/5996 is not exactly clear about this collision, but it should be safe to reject CHILD_SA rekeying during this stage, as the reauth will re-trigger the CHILD_SA. For non-rekeying CHILD_SA creations, it's up to the peer to retry establishing the CHILD_SA on the reauthenticated IKE_SA.
* ikev2: Apply extensions and conditions before starting rekeyingMartin Willi2014-04-171-0/+6
| | | | | | The extensions and conditions apply to the rekeyed IKE_SA as well, so we should migrate them. Especially when using algorithms from private space, we need EXT_STRONGSWAN to properly select these algorithms during IKE rekeying.
* ikev2: Add inherit_pre() to apply config and hosts before IKE_SA rekeyingMartin Willi2014-04-174-22/+30
|
* ikev1: Add an option to accept unencrypted ID/HASH payloadsMartin Willi2014-04-172-1/+35
| | | | | | | | | Even in Main Mode, some Sonicwall boxes seem to send ID/HASH payloads in unencrypted form, probably to allow PSK lookup based on the ID payloads. We by default reject that, but accept it if the charon.accept_unencrypted_mainmode_messages option is set in strongswan.conf. Initial patch courtesy of Paul Stewart.
* ikev2: Fix reauthentication if peer assigns a different virtual IPTobias Brunner2014-04-151-1/+1
| | | | | | | | | | | | | | | | | Before this change a reqid set on the create_child_t task was used as indicator of the CHILD_SA being rekeyed. Only if that was not the case would the local traffic selector be changed to 0.0.0.0/0|::/0 (as we don't know which virtual IP the gateway will eventually assign). On the other hand, in case of a rekeying the VIP is expected to remain the same, so the local TS would simply equal the VIP. Since c949a4d5016e33c5 reauthenticated CHILD_SAs also have the reqid set. Which meant that the local TS would contain the previously assigned VIP, basically rendering the gateway unable to assign a different VIP to the client as the resulting TS would not match the client's proposal anymore. Fixes #553.
* Added NEWS for 5.2.0dr15.2.0dr1Andreas Steffen2014-04-151-0/+12
|
* Handle tag separatorsAndreas Steffen2014-04-152-13/+16
|
* Renewed expired user certificateAndreas Steffen2014-04-157-49/+75
|
* Updated SWID scenariosAndreas Steffen2014-04-156-4/+18
|
* swid_generator software-id does not generate empty lines any moreAndreas Steffen2014-04-151-5/+0
|
* Added result information to TPMRA workitemsAndreas Steffen2014-04-158-62/+94
| | | | On the occasion got rid of complicated functional component stuff
* Indicate IMV in assessment log statementAndreas Steffen2014-04-151-4/+14
|
* Implemented segmented SWID tag attributes on IMV sideAndreas Steffen2014-04-1558-71/+178
|
* Use python-based swidGenerator to generated SWID tagsAndreas Steffen2014-04-1538-232/+717
|
* Updated imv database templatesAndreas Steffen2014-04-152-14/+15
|
* Optimized PTS measurementsAndreas Steffen2014-04-1512-294/+132
|
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-06 02:31:49 +0000