aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* conf: Fix declaration of default values for imc-hcd optionsTobias Brunner2015-08-271-5/+5
|
* starter: Remove documentation for starter.load optionTobias Brunner2015-08-271-3/+0
|
* eap-ttls: Limit maximum length of tunneled EAP packet to EAP-TTLS packetTobias Brunner2015-08-271-1/+8
|
* trap-manager: Cleanup local address in error casesTobias Brunner2015-08-271-0/+2
|
* imv-os: Properly free strings for invalid input in pacmanTobias Brunner2015-08-271-0/+11
|
* ha: Close control FIFO if it is not validTobias Brunner2015-08-271-0/+4
|
* swanctl: Correctly build man page in out-of-tree builds from the repositoryTobias Brunner2015-08-271-1/+1
|
* Fixed some typos, courtesy of codespellTobias Brunner2015-08-273-3/+3
|
* Fix some Doxygen issuesTobias Brunner2015-08-277-8/+11
|
* unit-tests: Additional test cases to increase coverageTobias Brunner2015-08-272-9/+611
|
* traffic-selector: Use calc_netbits() in RFC 3779 constructorTobias Brunner2015-08-271-2/+1
| | | | This properly detects prefixes encoded as ranges.
* ike: Fix half-open count for initiating SAs when initially checked inTobias Brunner2015-08-271-0/+6
|
* ike: Only consider number of half-open SAs as responder when deciding ↵Tobias Brunner2015-08-276-19/+45
| | | | whether COOKIEs are sent
* Version bump to 5.3.3rc1Andreas Steffen2015-08-251-1/+1
|
* Added some spaces in swanctl.confAndreas Steffen2015-08-252-8/+8
|
* vici: Handle closed sockets in the Ruby gemEvan Broder2015-08-241-1/+5
| | | | | | | | | | | | | | | | From recvfrom(2) (which UDPSocket#recv backs into): The return value will be 0 when the peer has performed an orderly shutdown. (i.e. it will return an empty string) Previously in this scenario, Vici::Transport#recv_all would spin forever trying to pull more data off the socket. I'm not entirely clear what happened that caused strongSwan to shutdown the socket, but it probably should not cause vici Ruby apps to spin. Closes strongswan/strongswan#13.
* Merge branch 'starter-kernel-flush'Tobias Brunner2015-08-216-34/+71
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Removes flushing of the IPsec state in the kernel when starter terminates. We can't easily flush only the policies created for IPsec SAs (and if installpolicies=no is used we don't want to flush policies anyway). Also, since existing policies don't cause errors anymore these aren't really an issue anymore (I think this was one of the main reasons to flush the state). This behavior is also specific to starter, so nothing is flushed when charon is used via systemd/swanctl. This will also allow us to merge libhydra with libcharon in a future release. If the previous behavior is needed it can easily be replicated with some external tools (we could also write a simple utility that does this). Additional checks in the test environment make sure that the daemon cleans up the state properly.
| * testing: Let test scenarios fail if IPsec SAs or policies are not removedTobias Brunner2015-08-211-0/+18
| | | | | | | | | | The IKE daemon should delete all installed SAs and policies when everything works properly, so we fail the test if that's not the case.
| * testing: Flush state and policies before every scenarioTobias Brunner2015-08-211-0/+8
| | | | | | | | Similar to conntrack we make sure we are working on a clean slate.
| * starter: Don't flush SAs in the kernelTobias Brunner2015-08-213-14/+0
| | | | | | | | | | If starter is not used we don't do that either. And this allows us to move the stuff in libhydra back to libcharon.
| * starter: Don't flush policies in the kernelTobias Brunner2015-08-211-1/+0
| | | | | | | | | | | | | | | | | | | | | | We can't control which policies we flush, so if policies are installed and used outside of strongSwan for other protocols we'd flush them too. And if installpolicies=no is used we probably shouldn't flush policies either. Luckily already existing policies are not treated as fatal errors anymore, so not flushing policies should not be that much of an issue (in case of a crash in dynamic setups, e.g. with virtual IPs, policies could be left behind even after restarting the connections and properly terminating the daemon).
| * kernel-pfkey: Only flush SAs of types we actually manageTobias Brunner2015-08-211-13/+26
| |
| * kernel-netlink: Only flush SAs of types we actually manageTobias Brunner2015-08-211-6/+19
|/
* Merge branch 'init-limits'Tobias Brunner2015-08-2120-21/+171
|\ | | | | | | | | | | | | IKE_SAs that are initiated are now counted towards the half-open IKE_SAs limit. Optionally it is possible to enforce limits towards the number of half-open IKE_SAs and the job load also when initiating SAs. This is currently only possible via VICI.
| * vici: Optionally check limits when initiating connectionsTobias Brunner2015-08-212-1/+7
| | | | | | | | | | If the init-limits parameter is set (disabled by default) init limits will be checked and might prevent new SAs from getting initiated.
| * vici: Add get_bool() convenience getter for VICI messagesTobias Brunner2015-08-213-0/+94
| |
| * controller: Optionally adhere to init limits also when initiating IKE_SAsTobias Brunner2015-08-2115-20/+71
| |
| * ike: Also track initiating IKE_SAs as half-openTobias Brunner2015-08-211-1/+0
|/
* stroke: Allow %any as local addressTobias Brunner2015-08-211-3/+7
| | | | | Actually, resolving addresses in `left` might be overkill as we'll assume left=local anyway (the only difference is the log message).
* stroke: Add an option to disable side-swapping of configuration optionsTobias Brunner2015-08-212-33/+51
| | | | | In some scenarios it might be preferred to ensure left is always local and no unintended swaps occur.
* ikev1: Assign different job priorities for inbound IKEv1 messagesTobias Brunner2015-08-211-2/+12
|
* testing: Fix typo in p2pnat/behind-same-nat scenarioTobias Brunner2015-08-211-2/+2
|
* child-rekey: Don't add a REKEY_SA notify if the child-create task is ↵Tobias Brunner2015-08-211-6/+9
| | | | deleting the SA
* child-create: Cache proposed IPsec protocolTobias Brunner2015-08-211-10/+13
| | | | | This allows us to DELETE CHILD_SAs on failures that occur before we retrieved the selected proposal.
* child-create: Don't attempt to delete the SA if we don't have all the ↵Tobias Brunner2015-08-211-8/+10
| | | | | | | information Since we only support single protocols we could probably guess it and always send a DELETE.
* child-rekey: Remove redundant migrate() call for child-create sub-taskTobias Brunner2015-08-211-2/+1
| | | | | | | When retrying due to a DH group mismatch this is already done by the child-create task itself. And in other cases where the task returns NEED_MORE we actually will need access to a possible proposal to properly delete it.
* child-create: Fix crash when retrying CHILD_SA rekeying due to a DH group ↵Tobias Brunner2015-08-211-0/+1
| | | | | | | | | | mismatch If the responder declines our KE payload during a CHILD_SA rekeying migrate() is called to reuse the child-create task. But the child-rekey task then calls the same method again. Fixes: 32df0d81fb46 ("child-create: Destroy nonceg in migrate()")
* auth-cfg: Don't enforce EAP_RADIUSTobias Brunner2015-08-211-1/+2
| | | | | Basically the same as e79b0e07e4ab. EAP_RADIUS is also a virtual method that will identify itself as a different EAP method later.
* testing: Add missing sim_files file to ikev2/rw-eap-sim-radius scenarioTobias Brunner2015-08-211-0/+3
|
* testing: alice is RADIUS server in the ikev2/rw-eap-sim-radius scenarioTobias Brunner2015-08-211-0/+4
|
* testing: Print triplets.dat files of clients in EAP-SIM scenariosTobias Brunner2015-08-214-0/+7
| | | | References #1078.
* Merge branch 'stroke-ca-sections'Tobias Brunner2015-08-207-168/+446
|\ | | | | | | | | | | | | | | | | This resolves the duplicate CERTREQ issue when certificates in ipsec.d/cacerts were referenced in ca sections. It also ensures CA certificates are reloaded atomically, so there is never a time when an unchanged CA certificate is not available. References #842.
| * stroke: Change how CA certificates are storedTobias Brunner2015-08-205-58/+285
| | | | | | | | | | | | | | | | | | | | | | Since 11c14bd2f5 CA certificates referenced in ca sections were enumerated by two credential sets if they were also stored in ipsec.d/cacerts. This caused duplicate certificate requests to get sent. All CA certificates, whether loaded automatically or via a ca section, are now stored in stroke_ca_t. Certificates referenced in ca sections are now also reloaded when `ipsec rereadcacerts` is used.
| * stroke: Combine CA certificate load methodsTobias Brunner2015-08-201-82/+74
| | | | | | | | | | Also use the right credential set for CA cert references loaded from stroke_ca_t.
| * stroke: Atomically replace CA and AA certificates when reloading themTobias Brunner2015-08-201-34/+45
| | | | | | | | | | Previously it was possible that certificates were not found between the time the credential sets were cleared and the certificates got readded.
| * mem-cred: We don't need a write lock when looking for a certificateTobias Brunner2015-08-201-1/+1
| |
| * mem-cred: Add a method to atomically replace all certificatesTobias Brunner2015-08-202-10/+58
|/
* ikev1: Fix handling of overlapping Quick Mode exchangesTobias Brunner2015-08-203-2/+70
| | | | | | | | | | | | | In some cases the third message of a Quick Mode exchange might arrive after the first message of a subsequent Quick Mode exchange. Previously these messages were handled incorrectly and the second Quick Mode exchange failed. Some implementations might even try to establish multiple Quick Modes simultaneously, which is explicitly allowed in RFC 2409. We don't fully support that, though, in particular in case of retransmits. Fixes #1076.
* kernel-pfkey: Add support for AES-GCMTobias Brunner2015-08-201-3/+11
| | | | | | | | | | The next release of FreeBSD will support this. While Linux defines constants for AES-GCM in pfkeyv2.h since 2.6.25 it does not actually support it. When SAs are installed via PF_KEY only a lookup in XFRM's list of encryption algorithms is done, but AES-GCM is in a different table for AEAD algorithms (there is currently no lookup function to find algorithms in that table via PF_KEY identifier).
* auth-cfg: Don't enforce EAP_DYNAMICTobias Brunner2015-08-201-1/+2
| | | | | We now store the actual method on the auth config, which won't match anymore if rightauth=eap-dynamic is configured.
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-04 23:05:34 +0000