| Commit message (Collapse) | Author | Age | Files | Lines | ||
|---|---|---|---|---|---|---|
| ... | ||||||
| * | nm: Remove dummy TUN device | Tobias Brunner | 2016-10-04 | 1 | -36/+0 | |
| | | | | | | Recent NM releases don't insist on getting a device back from VPN plugins. | |||||
| * | nm: Fix comment in service file in /etc/NetworkManager/VPN | Tobias Brunner | 2016-10-04 | 1 | -1/+1 | |
| | | ||||||
| * | nm: Remove generated service file in `make clean` | Tobias Brunner | 2016-10-04 | 1 | -1/+1 | |
| | | ||||||
| * | nm: Don't add generated AppStream metadata to tarball | Tobias Brunner | 2016-10-04 | 1 | -1/+0 | |
| | | ||||||
| * | bus: Fix maximum log levels when mixing log/vlog implementing loggers | Tobias Brunner | 2016-09-30 | 1 | -12/+20 | |
| | | | | | | | | | | | | The maximum would not get set correctly when a logger is removed and the first remaining logger in the list (the one with the highest log level) does e.g. only implement vlog() while there are other loggers that implement log(). This would result in only max_vlevel getting set correctly while max_level would incorrectly get set to -1 so that log() would not get called for any of the loggers anymore. References #574. | |||||
| * | kernel-netlink: Pass zero mark to kernel if mask is set | Tobias Brunner | 2016-09-30 | 1 | -2/+2 | |
| | | | | | | | The kernel will apply the mask to the mark on the packet and then compare it to the configured mark. So to match only unmarked packets we have to be able to set 0/0xffffffff. | |||||
| * | kernel-netlink: Support configuring XFRM policy hashing thresholds | Tobias Brunner | 2016-09-30 | 2 | -0/+136 | |
| | | | | | | | | | | | | | | | | | | | | | | | | | If the number of flows over a gateway exceeds the flow cache size of the Linux kernel, policy lookup gets very expensive. Policies covering more than a single address don't get hash-indexed by default, which results in wasting most of the cycles in xfrm_policy_lookup_bytype() and its xfrm_policy_match() use. Starting with several hundred policies the overhead gets inacceptable. Starting with Linux 3.18, Linux can hash the first n-bit of a policy subnet to perform indexed lookup. With correctly chosen netbits, this can completely eliminate the performance impact of policy lookups, freeing the resources for ESP crypto. WARNING: Due to a bug in kernels 3.19 through 4.7, the kernel crashes with a NULL pointer dereference if a socket policy is installed while hash thresholds are changed. And because the hashtable rebuild triggered by the threshold change that causes this is scheduled it might also happen if the socket policies are seemingly installed after setting the thresholds. The fix for this bug - 6916fb3b10b3 ("xfrm: Ignore socket policies when rebuilding hash tables") - is included since 4.8 (and might get backported). As a workaround `charon.plugins.kernel-netlink.port_bypass` may be enabled to replace the socket policies that allow IKE traffic with port specific bypass policies. | |||||
| * | include: Update xfrm.h to Linux v4.3 | Martin Willi | 2016-09-30 | 1 | -0/+22 | |
| | | | | | | We strip the newly introduced <linux/in6.h> include, as this clashes with the <netinet/in6.h> include. | |||||
| * | Merge branch 'fwd-out-policies-optional' | Tobias Brunner | 2016-09-28 | 6 | -44/+93 | |
| |\ | | | | | | | | | | | This makes the FWD policies in the out direction optional (disabled by default). They may be enabled (e.g. if conflicting drop policies are used) via the policies_fwd_out swanctl.conf option. | |||||
| | * | child-sa: Only install outbound FWD policies if explicitly configured | Tobias Brunner | 2016-09-28 | 1 | -14/+27 | |
| | | | | | | | | | | | | | They are only required if drop policies would otherwise prevent forwarding traffic. This reduces the number of policies and avoids conflicts e.g. with SPD hash thresholds. | |||||
| | * | testing: Enable outbound FWD policies in swanctl/manual-prio scenario | Tobias Brunner | 2016-09-28 | 1 | -5/+6 | |
| | | | ||||||
| | * | vici: Make installation of outbound FWD policies configurable | Tobias Brunner | 2016-09-28 | 2 | -25/+36 | |
| | | | ||||||
| | * | child-cfg: Add setting that controls whether outbound FWD policies are installed | Tobias Brunner | 2016-09-28 | 2 | -0/+24 | |
| |/ | ||||||
| * | kernel-netlink: Update cached reqid when updating policies | Tobias Brunner | 2016-09-28 | 1 | -0/+2 | |
| | | ||||||
| * | testing: Added swanctl/net2net-multicast scenario | Andreas Steffen | 2016-09-27 | 9 | -0/+166 | |
| | | ||||||
| * | testing: Added ikev2/net2net-multicast scenario | Andreas Steffen | 2016-09-27 | 9 | -0/+125 | |
| | | ||||||
| * | travis: Use a more recent OS X image | Tobias Brunner | 2016-09-27 | 2 | -2/+3 | |
| | | | | | Using the xcode8 image does not work currently (libcurl is not found). | |||||
| * | Version bump to 5.5.1dr55.5.1dr5 | Andreas Steffen | 2016-09-22 | 3 | -2/+5 | |
| | | ||||||
| * | testing: Added swanctl/net2net-sha3-rsa-cert and swanctl/rw-eap-tls-sha3-rsa ↵ | Andreas Steffen | 2016-09-22 | 46 | -0/+1139 | |
| | | | | | scenarios | |||||
| * | gmp: Support of SHA-3 RSA signatures | Andreas Steffen | 2016-09-22 | 24 | -167/+274 | |
| | | ||||||
| * | bliss sampler unit-test: Fixed enumeration type | Andreas Steffen | 2016-09-22 | 1 | -2/+2 | |
| | | ||||||
| * | bliss: bliss_sampler expects XOF type | Andreas Steffen | 2016-09-22 | 1 | -4/+3 | |
| | | ||||||
| * | unit-tests: MGF1 tests depend on an XOF implementation not just a hash function | Tobias Brunner | 2016-09-21 | 1 | -2/+2 | |
| | | | | | | If the mgf1 plugin was not enabled (e.g. with the default configure options) the tests failed. | |||||
| * | Version bump to 5.5.1dr45.5.1dr4 | Andreas Steffen | 2016-09-21 | 3 | -4/+10 | |
| | | ||||||
| * | mgf1: Refactored MGF1 as an XOF | Andreas Steffen | 2016-09-21 | 60 | -644/+966 | |
| | | ||||||
| * | leak-detective: Fix compile warning due to unused variable if LD is disabled | Tobias Brunner | 2016-09-20 | 1 | -1/+1 | |
| | | ||||||
| * | Merge branch 'testing-leak-detective' | Tobias Brunner | 2016-09-20 | 16 | -75/+179 | |
| |\ | | | | | | | | | Test scenarios now fail if any leaks are detected by the leak detective. Several leaks found this way have been fixed. | |||||
| | * | leak-detective: Whitelist thread ID getter | Tobias Brunner | 2016-09-20 | 1 | -1/+3 | |
| | | | | | | | | | | | | | | | | | In case an external thread calls into our code and logs messages, a thread object is allocated that will never be released. Even if we try to clean up the object via thread value destructor there is no guarantee that the thread actually terminates before we check for leaks, which seems to be the case for the Ada Tasking threads. | |||||
| | * | charon-tkm: Build C code with debug information | Tobias Brunner | 2016-09-20 | 1 | -1/+2 | |
| | | | ||||||
| | * | leak-detective: Whitelist functions of the Ada runtime related to Tasking | Tobias Brunner | 2016-09-20 | 1 | -0/+4 | |
| | | | ||||||
| | * | charon-tkm: Free name of the PID file | Tobias Brunner | 2016-09-20 | 1 | -0/+1 | |
| | | | ||||||
| | * | charon-tkm: Deinitialize tkm before libstrongswan | Tobias Brunner | 2016-09-20 | 1 | -1/+1 | |
| | | | | | | | | | In particular because of leak-detective. | |||||
| | * | leak-detective: Whitelist some glib/libsoup functions | Tobias Brunner | 2016-09-20 | 1 | -1/+13 | |
| | | | | | | | | | | | | | Some of these are pretty broad, so maybe an alternative option is to not use the soup plugin in the openssl-ikev2/rw-suite-b* scenarios. But the plugin is not tested anywhere else so lets go with this for now. | |||||
| | * | testing: Use curl instead of soup plugin in libipsec/rw-suite-b scenario | Tobias Brunner | 2016-09-20 | 3 | -3/+3 | |
| | | | | | | | | | | | The soup plugin is already used in the openssl-ikev2/rw-suite-b* scenarios. | |||||
| | * | eap-peap: Fix memory leaks when handling tunneled methods | Tobias Brunner | 2016-09-20 | 1 | -1/+3 | |
| | | | ||||||
| | * | ipseckey: Properly free enumerated certificates | Tobias Brunner | 2016-09-20 | 1 | -12/+14 | |
| | | | ||||||
| | * | ipseckey: Properly free public key after creating certificate | Tobias Brunner | 2016-09-20 | 1 | -1/+1 | |
| | | | ||||||
| | * | dnscert: Properly free enumerated certificates | Tobias Brunner | 2016-09-20 | 1 | -8/+11 | |
| | | | ||||||
| | * | unbound: Avoid unnecessary cloning of RR list that caused a memory leak | Tobias Brunner | 2016-09-20 | 1 | -2/+1 | |
| | | | ||||||
| | * | unbound: Fix memory leak | Tobias Brunner | 2016-09-20 | 1 | -0/+2 | |
| | | | ||||||
| | * | pool: Fix (known) memory leak when querying leases | Tobias Brunner | 2016-09-20 | 1 | -21/+38 | |
| | | | ||||||
| | * | leak-detective: Whitelist leak in libldap | Tobias Brunner | 2016-09-20 | 1 | -0/+2 | |
| | | | ||||||
| | * | testing: Fix totals if post test checks fail | Tobias Brunner | 2016-09-20 | 1 | -12/+12 | |
| | | | ||||||
| | * | testing: Log leaks and fail tests if any are detected | Tobias Brunner | 2016-09-20 | 3 | -1/+32 | |
| | | | ||||||
| | * | leak-detective: Optionally write report to a log file | Tobias Brunner | 2016-09-20 | 1 | -10/+36 | |
| |/ | ||||||
| * | vici: Fix indention of flush_certs() method in Python bindings | Tobias Brunner | 2016-09-20 | 1 | -1/+1 | |
| | | ||||||
| * | travis: Run 32-bit Windows build on precise (12.04) image | Tobias Brunner | 2016-09-20 | 2 | -1/+5 | |
| | | | | | That's required due to a bug in MinGW 3.1.0 that's shipped with trusty. | |||||
| * | travis: Properly pass back result of make | Tobias Brunner | 2016-09-20 | 1 | -1/+1 | |
| | | | | | Fixes: 4e8f5a189cce ("travis: Add apidoc check") | |||||
| * | travis: Don't disable connmark and forecast plugins anymore | Tobias Brunner | 2016-09-20 | 1 | -5/+1 | |
| | | | | | They build fine on Ubuntu 14.04. | |||||
| * | Merge branch 'maemo-bye-bye' | Tobias Brunner | 2016-09-15 | 55 | -3375/+1 | |
| |\ | | | | | | | | | Removes the code and helper files related to the unused and unmaintained Maemo port. | |||||
 |
index : tteras/strongswan | |
| tteras' strongSwan tree | gitolite |
| aboutsummaryrefslogtreecommitdiffstats |