79ebdc0788
starter: Merge quoted strings that span multiple lines
2015-03-20 18:37:22 +01:00
2ed5f5693d
encoding: Don't verify length of IKEv1 KE payloads
...
The verification introduced with 84738b1aed
2015-03-20 16:37:59 +01:00
d2f4345b03
charon-systemd: Optionally load plugin list from charon-systemd.load
2015-03-19 18:37:24 +01:00
945fdeb918
apidoc: Limit INPUT to src subdirectory and README.md
...
While 0909bf6c
2015-03-19 12:17:03 +01:00
b546a98e0a
utils: Fix enum_flags_to_string parameter name to match Doxygen description
2015-03-19 12:14:30 +01:00
fd6cc7f243
attr-sql: Rename sql_attribute_t to attr_sql_provider_t
...
As the plugin has its origins in the sql plugin, it still uses the naming
scheme for the attribute provider implementation. Rename the class to better
match the naming scheme we use in any other plugin
2015-03-19 11:24:31 +01:00
31be582399
ikev1: Adopt virtual IPs on new IKE_SA during re-authentication
...
Some clients like iOS/Mac OS X don't do a mode config exchange on the
new SA during re-authentication. If we don't adopt the previous virtual
IP Quick Mode rekeying will later fail.
If a client does do Mode Config we directly reassign the VIPs we migrated
from the old SA, without querying the attributes framework.
Fixes #807 , #810 .
2015-03-19 10:32:06 +01:00
5c6a62ceb6
ikev1: Mark rekeyed CHILD_SAs as INSTALLED
...
Since we keep them around until they finally expire they otherwise would block
IKE_SA rekeying/reauthentication.
2015-03-19 10:24:15 +01:00
7d02f8dbf4
mem-pool: Remove entries without online or offline leases
...
This avoids filling up the hash table with unused/old identities.
References #841 .
2015-03-19 09:55:56 +01:00
f30be6a92f
kernel-handler: Log new endpoint if NAT mapping changed
2015-03-19 09:54:10 +01:00
46188b0eb0
child-sa: Remove policies before states to avoid acquire events for untrapped policies
2015-03-19 09:54:03 +01:00
c5f4e7c69e
Merge branch 'vici-python'
...
Introduce a Python Egg for the vici plugin, contributed by Björn Schuberg.
2015-03-18 15:03:28 +01:00
2185c29b65
NEWS: Introduce vici Python Egg
2015-03-18 14:29:46 +01:00
75a8457922
travis: Install pip to install pytest in "all" tests
...
This allows ./configure to detect py.test, and execute python unit tests we
provide in the vici python egg.
2015-03-18 14:29:45 +01:00
2e74aa0a91
vici: Add support for python 3
2015-03-18 13:59:15 +01:00
c7e3c5943f
vici: Execute python tests during "check" if py.test is available
2015-03-18 13:59:15 +01:00
07302b2f7c
configure: Check optional py.test availability when building with python eggs
2015-03-18 13:59:15 +01:00
c193b5947a
vici: Add test of Packet layer in python library
2015-03-18 13:59:15 +01:00
9b97029a5f
vici: Add test of Message (de)serialization in python library
2015-03-18 13:59:15 +01:00
b5d17e55d7
vici: Evaluate Python streamed command results, and raise CommandException
2015-03-18 13:59:14 +01:00
90c5b48c96
vici: Catch Python GeneratorExit to properly cancel streamed event iteration
2015-03-18 13:59:14 +01:00
288b654173
vici: Fall back to heap buffer when vararg printing on stack fails
...
This avoids failures when building log event messages including larger hexdumps.
2015-03-18 13:59:14 +01:00
a47e431ba9
vici: Return a Python generator instead of a list for streamed responses
...
In addition that it may reduce memory usage and improve performance for large
responses, it returns immediate results. This is important for longer lasting
commands, such as initiate/terminate, where immediate log feedback is preferable
when interactively calling such commands.
2015-03-18 13:59:14 +01:00
90e16837ba
vici: Raise a Python CommandException instead of returning a CommandResult
2015-03-18 13:59:14 +01:00
871cffa141
vici: Add initial Python egg documentation to README
2015-03-18 13:59:14 +01:00
305023a27d
vici: Use OrderedDict to handle vici responses in Python library
...
The default Python dictionaries are unordered, but order is important for some
vici trees (for example the order of authentication rounds).
2015-03-18 13:59:14 +01:00
94bb26fae3
vici: Return authentication rounds with unique names
...
To simplify handling of authentication rounds in dictionaries/hashtables on the
client side, we assign unique names to each authentication round when listing
connection.
2015-03-18 13:59:14 +01:00
d1ad65f7b2
vici: Rebuild ruby gem on source file changes
2015-03-18 13:59:14 +01:00
fb8b119cfa
vici: Use default Unix vici socket if none passed to ruby constructor
...
While we currently have a static path instead of one generated with Autotools,
this at least is congruent to what we have in the Python library.
2015-03-18 13:59:14 +01:00
61fb10c8cf
vici: Support non-Unix sockets for vici connections using Python
2015-03-18 13:59:14 +01:00
358793389a
vici: Add python egg setuptools building and installation using easy_install
...
An uninstall target is currently not supported, as there is no trivial way with
either plain setuptools or with easy_install. pip would probably be the best
choice, but we currently don't depend on it.
2015-03-18 13:59:14 +01:00
1e2ec9f96a
vici: Generate a version specific setup.py for setuptools installation
2015-03-18 13:59:14 +01:00
2c8c52c4e2
vici: Include python package in distribution
2015-03-18 13:59:14 +01:00
374b3db191
configure: Add --enable-python-eggs and --with-pythoneggdir options
...
Detect easy_install for Python egg installation to install any egg we provide
in strongSwan.
2015-03-18 13:59:13 +01:00
163e15a571
vici: Add python package MIT license
2015-03-18 13:59:13 +01:00
b269c1a89a
vici: Expose Session as a top-level symbol in python package
2015-03-18 13:59:13 +01:00
6a31a0f60c
vici: Introduce main API Session class in python package
2015-03-18 13:59:13 +01:00
8c089cddef
vici: Add a python vici command execution handler
2015-03-18 13:59:13 +01:00
b26e142863
vici: Add vici python protocol handler
2015-03-18 13:59:13 +01:00
c7bb1dc3d9
Merge branch 'swanctl-pkcs12'
...
Add support for loading PKCS#12 containers from a swanctl/pkcs12 directory.
Fixes #815 .
2015-03-18 13:36:50 +01:00
1e366429fd
swanctl: Cache entered PKCS#12 decryption secret
...
It is usually used more than once, but most likely the same for decryption and
MAC verification.
2015-03-18 13:34:22 +01:00
54cdf847cc
swanctl: Support loading PKCS#12 containers from a pkcs12 swanctl directory
2015-03-18 13:34:22 +01:00
a1fb5251e0
swanctl: Generalize private key decryption to support other credential types
2015-03-18 13:34:22 +01:00
84738b1aed
encoding: Verify the length of KE payload data for known groups
...
IKE is very strict in the length of KE payloads, and it should be safe to
strictly verify their length. Not doing so is no direct threat, but allows DDoS
amplification by sending short KE payloads for large groups using the target
as the source address.
2015-03-18 13:33:25 +01:00
b8ecdfd895
ikev2: Migrate MOBIKE additional peer addresses to new SA after IKE_SA rekeying
2015-03-18 13:32:27 +01:00
80a1ebb1d9
ikev2: Immediately initiate queued tasks after establishing rekeyed IKE_SA
...
If additional tasks get queued before/while rekeying an IKE_SA, these get
migrated to the new IKE_SA. We previously did not trigger initiation of these
tasks, though, leaving the task unexecuted until a new task gets queued.
2015-03-18 13:28:34 +01:00
afc1b67344
Version bump to 5.3.0dr2
2015-03-16 17:15:58 +01:00
08feb4548a
Replace kid by aik_id in ITA TBOOT functional component
2015-03-16 17:15:28 +01:00
d35143bb8d
Fixed two BLISS key type identifier strings
2015-03-16 17:08:14 +01:00
9c3c41f29b
charon-systemd: Add missing semicolon
...
References #887 , fixes f3c83322
2015-03-16 09:31:17 +01:00
Tobias Brunner