aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
| * windows: Move the compatibility header to the compat subfolderMartin Willi2014-11-214-6/+6
| |
| * apple: Wrap accept() and recvfrom() with poll(2) instead of selectMartin Willi2014-11-211-5/+11
| |
| * apple: Introduce a central compatibility header with all __APPLE__ quirksMartin Willi2014-11-216-87/+113
| |
| * watcher: Use Windows read/write(2) wrappers instead of compile-conditionsMartin Willi2014-11-211-8/+0
| |
| * windows: Provide a write(2) wrapper that uses send(2) on socketsMartin Willi2014-11-212-0/+22
| |
| * windows: Provide a read(2) wrapper that uses recv(2) on socketsMartin Willi2014-11-212-0/+25
| |
| * unit-tests: Test cancellability of some cancellation points we rely onMartin Willi2014-11-211-0/+192
| |
| * thread: Test for pending cancellation requests before poll()ing on OS XMartin Willi2014-11-211-0/+20
| | | | | | | | | | As we are now using poll(2) instead of select(2), we need the work-around from 76dc329e for poll() as well.
| * kernel-libipsec: Use poll(2) instead of selectMartin Willi2014-11-211-54/+56
| |
| * watcher: Use poll(2) instead of selectMartin Willi2014-11-211-24/+38
| |
| * libtls: Use poll(2) instead of select() in tls_socketMartin Willi2014-11-211-8/+7
| |
| * socket-default: Use round-robin selection of sockets to read fromMartin Willi2014-11-211-5/+13
| | | | | | | | | | If multiple sockets are ready, we previously preferred the IPv4 non-NAT socket over others. To handle all with equal priority, use a round-robin selection.
| * socket-default: Use poll(2) instead of selectMartin Willi2014-11-211-46/+20
| | | | | | | | | | It is not only simpler, but also allows the use of arbitrary high fd numbers, which silently fails with select().
| * tun-device: Read from tun to buffer on stack to avoid over-allocation of packetsMartin Willi2014-11-211-8/+6
| | | | | | | | | | | | | | Instead of allocating MTU-sized buffers for each packet, read to a stack buffer and copy to an allocation of the actual packet size. While it requires an additional copy on non-Apple platforms, this should make allocation more efficient for small packets.
| * tun-device: Remove the superfluous use of select() before read()Martin Willi2014-11-212-19/+6
| |
| * libradius: Use poll(2) to wait for RADIUS responsesMartin Willi2014-11-211-46/+41
| |
| * windows: Provide a poll(2) wrapper calling WSAPoll()Martin Willi2014-11-213-0/+40
|/
* Merge branch 'netlink-extensions'Martin Willi2014-11-2110-86/+1022
|\ | | | | | | | | | | | | | | | | Introduces options to enable concurrent Netlink queries. While this does not make much sense on vanilla Linux, this can help on third party stacks to increase throughput if longer latencies are to expect. Netlink message retransmission can be optionally enabled if transmission is unreliable. Non-socket based IKE bypass policies and other tweaks bring better compatibility to third party stacks using Netlink.
| * kernel-netlink: Optionally ignore errors resulting from response message lossMartin Willi2014-11-211-0/+82
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As some backends over unreliable transport do not cache response messages, retransmissions due the loss of responses perform the operation again. Add an option to ignore some errors arising from such duplicate operations. Note: This approach can't distinguish between real EXIST/NOTFOUND errors and packet failures, and therefore is a source of race conditions and can't detect any of these errors actually happening. Therefore that behavior is disabled by default, and can be enabled with the ignore_retransmit_errors strongswan.conf option. To properly distinguish between real and retransmission errors, a Netlink backend should implement retransmission detection using sequence numbers.
| * kernel-netlink: Add an option to enforce using XFRM_MSG_UPDPOLICYMartin Willi2014-11-211-0/+12
| |
| * kernel-netlink: Fallback to UDP if detecting socket protocol failsMartin Willi2014-11-211-2/+4
| | | | | | | | | | getsockopt(SO_PROTOCOL) is not supported before 2.6.32. Default to UDP if either the SO_PROTOCOL define is missing or the syscall fails.
| * kernel-netlink: Alternatively support global port based IKE bypass policiesMartin Willi2014-11-212-3/+169
| | | | | | | | | | | | The socket based IKE bypass policies are usually superior, but not supported on all networking stacks. The port based variant uses global policies for the UDP ports we have IKE sockets for.
| * conf: Document kernel-netlink retransmission and parallelization optionsMartin Willi2014-11-211-0/+17
| |
| * kernel-netlink: Add options to enable parallel Netlink queries explicitlyMartin Willi2014-11-215-20/+39
| | | | | | | | | | | | As under vanilla Linux the kernel can't handle parallel dump queries and returns EBUSY, it makes not much sense to use them. Disable parallel queries by default to basically restore original behavior, improving performance.
| * kernel-netlink: Release lock while doing Netlink NEW/DELADDR operationsMartin Willi2014-11-211-8/+17
| | | | | | | | | | | | | | | | Besides that it can improve throughput, it avoids a deadlock situation. If all threads are busy, watcher will invoke the FD notification for NEWADDR events itself. If the lock is held, it gets locked up. As watcher is not dispatching anymore, it can't signal Netlink socket send() completion, and the send() operation does not return and keeps the lock.
| * kernel-netlink: Add non-dumping variants of echo and stress testsMartin Willi2014-11-211-0/+84
| |
| * kernel-netlink: Add test cases for successful and timing out retransmissionsMartin Willi2014-11-212-0/+90
| |
| * kernel-netlink: Add a compile-time hook to simulate request message lossMartin Willi2014-11-211-0/+15
| |
| * kernel-netlink: Implement configurable Netlink request retransmissionMartin Willi2014-11-211-15/+86
| |
| * kernel-netlink: Add a stress test with several threads doing Netlink exchangesMartin Willi2014-11-211-0/+62
| |
| * kernel-netlink: Retry netlink query while kernel returns EBUSYMartin Willi2014-11-211-3/+37
| | | | | | | | | | | | If the kernel can't execute a Netlink query because a different query is already active, it returns EBUSY. As this can happen now as we support parallel queries, retry on this error condition.
| * kernel-netlink: Support parallel Netlink queriesMartin Willi2014-11-211-74/+192
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Instead of locking the socket exclusively to wait for replies, use watcher to wait for and read in responses asynchronously. This allows multiple parallel Netlink queries, which can significantly improve performance if the kernel Netlink layer has longer latencies and supports parallel queries. For vanilla Linux, parallel queries don't make much sense, as it usually returns EBUSY for the relevant dump requests. This requires a retry, and in the end makes queries more expensive under high load. Instead of checking the Netlink message sequence number to detect multi-part messages, this code now relies on the NLM_F_MULTI flag to detect them. This has previously been avoided (by 1d51abb7). It is unclear if the flag did not work correctly on very old Linux kernels, or if the flag was not used appropriately by strongSwan. The flag seems to work just fine back to 2.6.18, which is a kernel still in use by RedHat/CentOS 5.
| * kernel-netlink: Add a simple send message test querying available linksMartin Willi2014-11-213-0/+70
| |
| * kernel-netlink: Add a stub for a test-runnerMartin Willi2014-11-214-0/+85
|/
* mem-pool: Fix potential memory leak and lost leases when reassigning leasesTobias Brunner2014-11-111-2/+6
| | | | | | | | | | | | | | | | If no offline leases are available for the current client and assigning online leases is disabled, and if all IPs of the pool have already been assigned to clients we look for offline leases that previously were assigned to other clients. In case the current client has online leases the previous code would replace the existing mapping entry and besides resulting in a memory leak the online leases would be lost forever (even if the client later releases the addresses). If this happens repeatedly the number of available addresses would decrease even though the total number of online and offline leases seen in `ipsec leases` would indicate that there are free addresses available. Fixes #764.
* android: New release based on 5.2.1 and after adding EAP-TLSTobias Brunner2014-11-061-3/+3
| | | | | Also enables support for IKEv2 fragmentation, provides improved MOBIKE handling and optionally enables PFS for CHILD_SAs.
* android: Build binaries for MIPSTobias Brunner2014-11-061-1/+1
|
* android: Increase fragment sizeTobias Brunner2014-11-061-0/+3
| | | | We use the same value we use as MTU on TUN devices.
* android: Enable IKEv2 fragmentationTobias Brunner2014-11-061-1/+1
|
* Merge branch 'android-eap-tls'Tobias Brunner2014-11-0614-87/+101
|\ | | | | | | | | | | | | | | | | | | | | | | | | This adds support for EAP-TLS authentication on Android. EAP-only authentication is currently not allowed because the AAA identity is not configurable, so to prevent anyone with a valid certificate from impersonating the AAA server and thus the gateway, we authenticate the gateway (like we do with other authentication methods). Also, it's currently not possible to select a specific CA certificate to authenticate the AAA server certificate, so it either must be issued by the same CA as that of the gateway or automatic CA certificate selection must be used.
| * android: Use %any as AAA identity, but disable EAP-only authenticationTobias Brunner2014-11-061-5/+3
| | | | | | | | | | | | | | Without verification of the identity we can't prevent a malicious user with a valid certificate from impersonating the AAA server and thus the VPN gateway. So unless we make the AAA identity configurable we have to prevent EAP-only authentication.
| * android: Add support for signature schemes used by EAP-TLSTobias Brunner2014-11-061-19/+34
| |
| * android: Allow enumeration of untrusted certificatesTobias Brunner2014-11-061-1/+1
| |
| * android: Handle EAP-TLS in Android serviceTobias Brunner2014-11-061-6/+19
| |
| * android: Enable EAP-TLS plugin in the appTobias Brunner2014-11-061-1/+1
| |
| * android: Add EAP-TLS VPN type to the GUITobias Brunner2014-11-066-1/+7
| |
| * android: Change how features of VPN types are stored and checkedTobias Brunner2014-11-065-59/+41
|/
* testing: Update tkm/multiple-clients/evaltest.datReto Buerki2014-10-311-2/+1
| | | | | | Since the CC context is now properly reset in the bus listener plugin, the second connection from host dave re-uses the first CC ID. Adjust the expect string on gateway sun accordingly.
* charon-tkm: Properly reset CC context in listenerReto Buerki2014-10-311-7/+13
| | | | | | Make sure that the acquired CC context is correctly reset and the associated ID released in the authorize() function of the TKM bus listener.
* charon-tkm: Add missing comma to enumReto Buerki2014-10-311-1/+1
| | | | Add missing comma to tkm_context_kind_names enum definition.
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-04 23:03:34 +0000