19cb07b890
automake: replace INCLUDES by AM_CPPFLAGS
...
INCLUDES are now deprecated and throw warnings when using automake 1.13.
We now also differentiate AM_CPPFLAGS and AM_CFLAGS, where includes and
defines are passed to AM_CPPFLAGS only.
2013-07-18 14:59:19 +02:00
2e9e2fa848
eap-sim-pcsc: fix compiler warning
2013-07-18 14:59:19 +02:00
61177388bd
syslog: setlogmask() to include LOG_INFO
...
LOG_INFO seems to be excluded by default on some systems (OS X).
2013-07-18 12:17:54 +02:00
07a9d5c91a
ike: Fix reestablishing SAs if no child-creating tasks are queued
2013-07-18 10:40:08 +02:00
2b0c8ee37d
ike-sa: uninstall CHILD_SAs before removing virtual IPs
...
a3854d83
2013-07-18 10:35:38 +02:00
79b6ead1e4
unity: Replicate default behavior if no UNITY_SPLIT_INCLUDE attributes were received
2013-07-17 18:23:57 +02:00
56b0fac8c9
unity: Allow UNITY_LOCAL_LAN to be longer than 8 bytes
2013-07-17 18:23:57 +02:00
c7d0b80abb
unity: Fix memory leak in provider
2013-07-17 18:23:57 +02:00
a9ffb48f21
ikev1: Reestablish IKE_SA/CHILD_SAs if it gets deleted by the peer
...
We call ike_sa_t.reestablish() so the IKE_SA is only recreated if any
CHILD_SA requires it.
2013-07-17 18:16:59 +02:00
68db844f99
ike: Migrate queued CHILD_SA-creating tasks when reestablishing an IKE_SA
2013-07-17 18:16:58 +02:00
b79fdab878
ikev1: Support closeaction of CHILD_SA.
...
When a CHILD_SA is closed in IKEv1, if it is not being rekeyed and
closeaction has been set, we can now perform a restart or hold as is
currently done for IKEv2.
2013-07-17 18:16:58 +02:00
84693a3d79
linked-list: Remove barely used has_more() method
...
This required some refactoring when handling encrypted payloads.
Also changed log messages so that "encrypted payload" is logged instead
of "encryption payload" (even if we internally still call it that) as
that's the name used in RFC 5996.
2013-07-17 17:42:53 +02:00
c6f1d0de94
child-sa: refactor proxy transport mode address lookup
2013-07-17 17:20:18 +02:00
2745ae264a
child-sa: replace traffic selector lists by arrays
...
Saves up to another 0.5KB of memory per CHILD_SA.
2013-07-17 17:20:18 +02:00
553bb78730
child-sa: replace get_traffic_selectors() with create_ts_enumerator()
...
Not directly returning a linked list allows us to change the internals of
the CHILD_SA transparently.
2013-07-17 17:20:18 +02:00
6207fadb6c
ikev2: replace linked lists by arrays in task manager
...
Eliminates another three lists, 0.5KB per IKE_SA.
2013-07-17 17:20:18 +02:00
c907b57f56
proposal: use array to store proposal list
...
Removes another two linked lists (0.5KB) of memory per IKE/CHILD_SA pair.
2013-07-17 17:20:18 +02:00
5cd64f979c
proposal: use a single list to store all transforms
...
Beside that it makes the code actually simpler, it reduces the number of lists
stored by each IKE_SA and each CHILD_SA by 4, which can be up to 1KB per SA.
2013-07-17 17:20:17 +02:00
893da0411f
ike-sa: use arrays instead of linked lists in long lived collections
...
This saves about 1.5KB of memory per IKE_SA.
2013-07-17 17:20:17 +02:00
f067348134
kernel-libipsec: Log error if no local address is found when installing routes
2013-07-15 14:37:31 +02:00
591f923134
stroke: Add certificates extracted from PKCS#12 files to correct credential set
...
Only keys and shared secrets are moved from the temporary credential set after
loading all secrets.
2013-07-15 10:59:13 +02:00
d27f225d9a
Use strpfx() helper where appropriate
2013-07-08 18:49:30 +02:00
c9df0f989d
android: Added support to build tnc-imc plugin
2013-07-08 18:49:25 +02:00
4672078190
android: Added support to build eap-tnc, tnc-tnccs and tnccs-20 plugins
2013-07-08 18:49:25 +02:00
598bec78fa
socket-default: Add options to disable address families
2013-07-05 09:48:27 +02:00
bf92887af1
ike: Resolve hosts only for address families currently supported
2013-07-05 09:48:26 +02:00
eafd7ee7e1
net: Socket implementations report the address families they support
2013-07-05 09:48:01 +02:00
282e4d2c7c
eap-radius: fix add_attribute/framed_ip method signatures
2013-07-01 11:53:52 +02:00
c949a4d501
Reuse reqid when restarting CHILD_SAs for dpd|closeaction=restart
2013-07-01 09:58:34 +02:00
4c74fa664b
Reuse reqid for trap policies installed for dpd|closeaction=hold
2013-07-01 09:58:25 +02:00
50daffb784
dhcp: Use chunk_hash_static() to calculate ID-based MAC addresses
2013-06-28 17:00:29 +02:00
b7b5432ff8
stroke: Changed how proto/port are specified in left|rightsubnet
...
Using a colon as separator conflicts with IPv6 addresses.
2013-06-28 15:10:09 +02:00
b18a531715
plugin-loader: Removed unused path argument of load() method
...
Multiple additional search paths can be added with the add_path()
method.
2013-06-28 10:44:15 +02:00
9da142b4dc
tnc-pdp: Initialize TNC-PDP in plugin callback with proper dependencies
2013-06-27 18:02:53 +02:00
1091edede8
capabilities: CAP_CHOWN might be required by many plugins opening UNIX sockets
...
But as the sockets will be created with the user/group of the running
process this might not be required as no change may be needed.
2013-06-25 17:16:33 +02:00
405f5ab9e9
farp: Require CAP_NET_RAW capability to open AF_PACKET socket
2013-06-25 17:16:32 +02:00
6f15f5e632
dhcp: Require CAP_NET_BIND_SERVICE and CAP_NET_RAW to open/bind sockets
2013-06-25 17:16:32 +02:00
1dd61bf13d
socket-default: Require CAP_NET_BIND_SERVICE for ports < 1024
...
Since we don't know which ports are used with socket-dynamic we can't
demand the capability there, but it might still be required.
2013-06-25 17:16:32 +02:00
41b8546ac0
capabilities: Only plugins that require CAP_NET_ADMIN demand it
...
The daemon as such does not require this capability.
2013-06-25 17:16:32 +02:00
a2eb581781
capabilities: Move global capabilities_t instance to libstrongswan
2013-06-25 17:16:32 +02:00
2e21bac19a
capabilities: Ensure required capabilities are actually held by the process/user
2013-06-25 17:16:32 +02:00
a650242643
ikev2: keep the CHILD_SA we delete as initiator in the list to destroy
...
If the responder not correctly send the correct protocol or SPI in the delete
response, we should remove the CHILD_SA regardless.
2013-06-25 14:03:51 +02:00
e8db483f41
unit-tester: RSA test was removed
2013-06-24 16:01:23 +02:00
7867c1a315
Aligned AR Identity types to IF-IMV 1.4 R5 draft
2013-06-24 00:23:50 +02:00
10bb71261c
Added soft dependency on database plugin
2013-06-21 23:25:24 +02:00
2964562199
add overall recommendation to session database entry
2013-06-21 23:25:22 +02:00
9d63ad17d4
used tnc_policy_update functions for default policy
2013-06-21 23:25:22 +02:00
45dcf4df57
osx-attr: add plugin installing config attributes using SystemConfiguration
...
Currently installs DNS servers only, by prepending IP addresses to the
DNS configuration of the primary networking service.
2013-06-21 17:03:22 +02:00
23ea59a95c
kernel-libipsec: Ignore failures when installing routes for multicast or broadcast policies
2013-06-21 17:03:22 +02:00
01955eec71
ike: Force NAT-T/UDP encapsulation if kernel interface requires it
2013-06-21 17:03:21 +02:00
Martin Willi