tteras/strongswan/src/libcharon/plugins/kernel_pfkey, branch master tteras' strongSwan tree https://git-old.alpinelinux.org/user/tteras/strongswan/atom?h=master 2017-11-08T15:35:38Z kernel-pfkey: Support anti-replay windows > 2k 2017-11-08T15:35:38Z Tobias Brunner tobias@strongswan.org 2017-11-07T13:26:14Z urn:sha1:88a8fba1c76eda1c39dce4d0b2038c760f6d6140 FreeBSD 11.1 supports a new extension to configure larger anti-replay windows, now configured as number of packets. Fixes #2461. kernel-pfkey: Don't include keys in SADB_UPDATE message to update IPs on FreeBSD 2017-11-08T15:34:12Z Tobias Brunner tobias@strongswan.org 2017-11-03T08:37:44Z urn:sha1:21a500a092e4a2a0f91118846fede5f445d59d31 The FreeBSD kernel explicitly rejects messages containing keys for mature SAs. Fixes #2457. linked-list: Change return value of find_first() and signature of its callback 2017-05-26T11:56:44Z Tobias Brunner tobias@strongswan.org 2017-05-16T10:11:24Z urn:sha1:2e4d110d1e94a3be9da06894832492ff469eec37 This avoids the unportable five pointer hack. linked-list: Change interface of callback for invoke_function() 2017-05-26T11:56:44Z Tobias Brunner tobias@strongswan.org 2017-05-15T15:51:19Z urn:sha1:8a2e4d4a8b87f5e8a5e5f663ee8eddd47988fa2c This avoids the unportable five pointer hack. kernel-pfkey: Update SA addresses if supported by the kernel 2017-05-23T15:58:50Z Tobias Brunner tobias@strongswan.org 2017-02-07T08:57:09Z urn:sha1:bf08e39441f54466078ca81802a7482b3e8f91a2 Upcoming FreeBSD kernels will support updating the addresses of existing SAs with new SADB_X_EXT_NEW_ADDRESS_SRC|DST extensions for the SADB_UPDATE message. kernel-pfkey: Use new encap flag on Mac OS X when updating SAs 2017-05-23T15:58:50Z Tobias Brunner tobias@strongswan.org 2017-02-07T08:55:50Z urn:sha1:a080cfece0c19cd73ce731b124d68a601b34867e kernel: Make range of SPIs for IPsec SAs configurable 2017-03-02T07:52:56Z Tobias Brunner tobias@strongswan.org 2017-02-21T18:21:01Z urn:sha1:6d86d0f51699612ad886b3f1b8773e81324e3b2a kernel-pfkey: Use the same priority range for trap and regular policies 2017-02-08T09:36:38Z Tobias Brunner tobias@strongswan.org 2016-10-11T13:14:27Z urn:sha1:3c46ce283404c6336f36a69a4842ab837db23d66 Same as the change in the kernel-netlink plugin. kernel-pfkey: Set state to SADB_SASTATE_MATURE when adding/updating SAs 2017-01-25T16:30:57Z Tobias Brunner tobias@strongswan.org 2017-01-16T16:01:33Z urn:sha1:4ae2209e3d26c48932760ef048f7078c0e2edb1e Picky kernels might otherwise reject our messages as RFC 2367 explicitly mandates this. Fixes #2212. kernel-pfkey: Only set the replay window for inbound SAs 2016-06-17T16:46:33Z Tobias Brunner tobias@strongswan.org 2016-06-17T12:52:11Z urn:sha1:21aa924233b5e0d53ce454d63e98f92714a2081e It is not necessary for outbound SAs and might waste memory when large window sizes are used.