aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* support gre key in ikev1tterasTimo Teräs2017-11-209-39/+171
| | | | | | | | | | | | | | this implements gre key negotiation in ikev1 similarly to the ipsec-tools patch in alpine. the from/to port pair is internally used as gre key for gre protocol traffic selectors. since from/to pairs 0/0xffff and 0xffff/0 have special meaning, the gre keys 0xffff and 0xffff0000 will not work. this is not standard compliant, and should probably not be upstreamed or used widely, but it is applied for interoperability with alpine racoon for the time being.
* vici: add (deprecated) async parameterTimo Teräs2017-11-201-2/+3
| | | | | | | This is obsoleted by the new "timeout=-1" option that achieves the same. Only for compatibility with old versions of quagga-nhrp. Signed-off-by: Timo Teräs <timo.teras@iki.fi>
* vici: add support for individual sa state changesTimo Teräs2017-11-201-0/+105
| | | | | | Useful for monitoring and tracking full SA. Signed-off-by: Timo Teräs <timo.teras@iki.fi>
* vici: send certificates for ike-sa eventsTimo Teräs2017-11-201-7/+41
| | | | Signed-off-by: Timo Teräs <timo.teras@iki.fi>
* charon: add optional source and remote overrides for initiateTimo Teräs2017-11-2012-48/+218
| | | | | | | | | | | This introduces support for specifying optional IKE SA specific source and remote address for child sa initiation. This allows to initiate wildcard connection for known address via vici. In addition this allows impler implementation of trap-any patches and is a prerequisite for dmvpn support. Signed-off-by: Timo Teräs <timo.teras@iki.fi>
* ike: Adhere to IKE_SA limit when checking out by configTobias Brunner2017-11-201-34/+37
| | | | | This prevents new SAs from getting created if we hit the global IKE_SA limit (we still allow checkout_new(), which is used for rekeying).
* Version bump to 5.6.1HEAD5.6.1masterAndreas Steffen2017-11-172-2/+2
|
* testing: Added swanctl/rw-cert-pss scenarioAndreas Steffen2017-11-1712-0/+239
|
* NEWS: Added some news for 5.6.1Tobias Brunner2017-11-171-1/+29
|
* hashers: Change names of SHA2 hash algorithmsTobias Brunner2017-11-171-8/+8
| | | | | Keep the lower case names as they are as we use them internally (parsing and e.g. in OpenSSL as identifier).
* ikev2: Add hash algorithm used for RSASSA-PSS signature to log messageTobias Brunner2017-11-171-11/+41
|
* hasher: Add uppercase short names for hash algorithmsTobias Brunner2017-11-172-0/+23
|
* testing: Configure logging via syslog in strongswan.confTobias Brunner2017-11-1598-167/+269
| | | | | Globally configure logging in strongswan.conf.testing and replace all charondebug statements with strongswan.conf settings.
* testing: Disable logging via journal in charon-systemdTobias Brunner2017-11-151-0/+3
| | | | | This avoids duplicate log messages as we already log via syslog to get daemon.log.
* testing: Globally define logging via syslog for charon-systemdTobias Brunner2017-11-15291-2196/+43
| | | | | | | We could make the same change for charon (actually setting it for charon in strongswan.conf.testing would work for charon-systemd too), however, there are dozens of test cases that currently set charondebug in ipsec.conf.
* x509: Initialize signature params when parsing attribute certificatesTobias Brunner2017-11-151-1/+1
|
* sw-collector: Unmap history file on failure to instantiate extractorTobias Brunner2017-11-151-0/+1
|
* charon: Explicitly check return value of fileno()Tobias Brunner2017-11-152-2/+12
| | | | | This is mainly for Coverity because fchown() can't take a negative value, which the -1 check implies is possible.
* pkcs8: Add explicit comment for RSASSA-PSS fall-throughTobias Brunner2017-11-151-0/+1
|
* The pacman tool got replaced by the sec-updater toolTobias Brunner2017-11-155-11/+2
|
* sec-updater: Fix typo in documentationTobias Brunner2017-11-151-1/+1
|
* Fixed some typos, courtesy of codespellTobias Brunner2017-11-1515-19/+19
|
* swanctl: Add check for conflicting short optionsTobias Brunner2017-11-131-0/+9
|
* swanctl: Properly register --counters commmandTobias Brunner2017-11-131-1/+1
| | | | Use C instead of c, which is already used for --load-conns.
* testing: Do not remove all swanctl subdirectoriesAndreas Steffen2017-11-111-3/+3
|
* Version bump to 5.6.1rc15.6.1rc1Andreas Steffen2017-11-113-2/+2615
|
* Merge branch 'swanctl-testing'Andreas Steffen2017-11-11889-4915/+6964
|\
| * libimcv: Updated imv databaseAndreas Steffen2017-11-111-4/+88
| |
| * testing: Converterd tnc to systemdAndreas Steffen2017-11-11124-558/+338
| |
| * testing: Converted sql to systemdAndreas Steffen2017-11-1185-101/+542
| |
| * testing: Converted swanctl to systemdAndreas Steffen2017-11-11181-849/+1170
| |
| * testing: Added legacy ipv6-stroke scenariosAndreas Steffen2017-11-11172-0/+2418
| |
| * testing: Converted ipv6/rw-ip6-in-ip4-ikev2 to swanctlAndreas Steffen2017-11-1014-96/+158
| |
| * testing: Converted ipv6/rw-ip6-in-ip4-ikev1 to swanctlAndreas Steffen2017-11-1014-96/+158
| |
| * testing: Converted ipv6/net2net-ip6-in-ip4-ikev2 to swanctlAndreas Steffen2017-11-1011-66/+113
| |
| * testing: Converted ipv6/net2net-ip6-in-ip4-ikev1 to swanctlAndreas Steffen2017-11-1011-63/+112
| |
| * testing: Converted ipv6/rw-rfc3779-ikev2 to swanctlAndreas Steffen2017-11-1022-103/+161
| |
| * testing: Converted ipv6/rw-compress-ikev2 to swanctlAndreas Steffen2017-11-1010-64/+109
| |
| * testing: Converted ipv6/rw-psk-ikev2 to swanctlAndreas Steffen2017-11-1017-96/+174
| |
| * testing: Converted ipv6/rw-psk-ikev1 to swanctlAndreas Steffen2017-11-1017-96/+175
| |
| * testing: Converted ipv6/rw-ikev2 to swanctlAndreas Steffen2017-11-1014-104/+163
| |
| * testing: Converted ipv6/rw-ikev1 to swanctlAndreas Steffen2017-11-1014-107/+160
| |
| * testing: Converted ipv6/net2net-rfc3779-ikev2 to swanctlAndreas Steffen2017-11-1017-88/+128
| |
| * testing: Converted ipv6/net2net-ip4-in-ip6-ikev2 to swanctlAndreas Steffen2017-11-1010-78/+117
| |
| * testing: Converted ipv6/net2net-ip4-in-ip6-ikev1 to swanctlAndreas Steffen2017-11-1010-78/+113
| |
| * testing: Converted ipv6/transport-ikev2 to swanctlAndreas Steffen2017-11-1011-76/+116
| |
| * testing: Converted ipv6/transport-ikev1 to swanctlAndreas Steffen2017-11-1011-75/+112
| |
| * testing: Converted ipv6/net2net-ikev2 to swanctlAndreas Steffen2017-11-1011-84/+119
| |
| * testing: Converted ipv6/net2net-ikev1 to swanctlAndreas Steffen2017-11-1011-82/+118
| |
| * testing: Converted ipv6/host2host-ikev2 to swanctlAndreas Steffen2017-11-1011-83/+115
| |