tteras/strongswan - tteras' strongSwan tree

	Commit message (Collapse)	Author	Age	Files	Lines
*	libipsec: Pass separate inbound/update flags to the IPsec SA manager	Martin Willi	2015-03-09	1	-2/+3
\| \| \| \| \|	Similar to other kernel interfaces, the libipsec backends uses the flag for different purposes, and therefore should get separate flags.
*	kernel-interface: Raise expires with a proto/SPI/dst tuple instead of reqid	Martin Willi	2015-02-20	1	-3/+3
\|
*	kernel-interface: Pass full list of traffic selectors to add_sa()	Martin Willi	2015-02-20	1	-1/+1
\| \| \| \| \| \|	While we can handle the first selector only in BEET mode in kernel-netlink, passing the full list gives the backend more flexibility how to handle this information.
*	libipsec: Remove unused src/dst_ts parameters from ipsec_sa_mgr_t.add_sa()	Martin Willi	2015-02-20	1	-2/+1
\|
*	kernel-interface: Remove reqid parameter from get_spi/get_cpi() methods	Martin Willi	2015-02-20	1	-2/+2
\| \| \| \| \| \| \| \| \| \|	The reqid is not strictly required, as we set the reqid with the update call when installing the negotiated SA. If we don't need a reqid at this stage, we can later allocate the reqid in the kernel backend once the SA parameters have been fully negotaited. This allows us to assign the same reqid for the same selectors to avoid conflicts on backends this is necessary.
*	libipsec: Remove unused reqid parameter from ipsec_sa_mgr_t.get_spi()	Martin Willi	2015-02-19	1	-1/+1
\|
*	android: Add support for querying use stats of a CHILD_SA	Tobias Brunner	2014-09-09	1	-1/+2
\|
*	kernel-interface: Add a replay_window parameter to add_sa()	Martin Willi	2014-06-17	1	-2/+3
\|
*	kernel: Use a time_t to report use time in query_policy()	Martin Willi	2013-10-11	1	-1/+1
\|
*	kernel: Use a time_t to report use time in query_sa()	Martin Willi	2013-10-11	1	-1/+1
\|
*	android: Forward initiator flag to libipsec when adding IPsec SA	Tobias Brunner	2013-06-13	1	-2/+2
\|
*	kernel-interface: add an exchange initiator parameter to add_sa()	Martin Willi	2013-06-11	1	-1/+1
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	This new flag gives the kernel-interface a hint how it should priorize the use of newly installed SAs during rekeying. Consider the following rekey procedure in IKEv2: Initiator --- Responder I1 -------CREATE-------> R1 I2 <------CREATE-------- -------DELETE-------> R2 I3 <------DELETE-------- SAs are always handled as pairs, the following happens at the SA level: * Initiator starts the exchange at I1 * Responder installs new SA pair at R1 * Initiator installs new SA pair at I2 * Responder removes old SA pair at R2 * Initiator removes old SA pair at I3 This makes sure SAs get installed/removed overlapping during rekeying. However, to avoid any packet loss, it is crucial that the new outbound SA gets activated at the correct position: * as exchange initiator, in I2 * as exchange responder, in R2 This should guarantee that we don't use the new outbound SA before the peer could install its corresponding inbound SA. The new parameter allows the kernel backend to install the new SA with appropriate priorities, i.e. it should: * as exchange inititator, have the new outbound SA installed with higher priority than the old SA * as exchange responder, have the new outbound SA installed with lower priority than the old SA While we could split up the SA installation at the responder, this approach has another advantage: it allows the kernel backend to switch SAs based on other criteria, for example when receiving traffic on the new inbound SA.
*	kernel-interface: query SAD for last use time if SPD query didn't yield one	Martin Willi	2013-05-06	1	-1/+1
\|
*	android: Remove unused methods on NetworkManager/network_manager_t	Tobias Brunner	2013-05-03	2	-94/+1
\|
*	android: Repurpose android-net to simply handle connectivity events	Tobias Brunner	2013-05-03	2	-58/+22
\| \| \| \| \| \|	Using the events by NetworkManager/ConnectivityManager to trigger roam events instead of the events generated by the kernel-netlink plugin the noise level is much lower.
*	kernel_ipsec_t.query_sa() additionally returns the number of processed packets	Martin Willi	2013-03-14	1	-1/+2
\|
*	Fixed Doxygen comments after scanning complete src directory	Tobias Brunner	2013-03-02	3	-3/+3
\|
*	android: Implement kernel_net_t.get_interface via JNI	Tobias Brunner	2013-01-14	3	-5/+62
\| \| \| \| \| \|	This is now required to properly accept/install a virtual IP address. Fixes #275.
*	Install virtual IPs via interface name, and use an interface lookup where ↵	Martin Willi	2012-11-29	1	-1/+1
\| \| \| \|	required
*	Add an optional kernel-interface parameter to install IPs with a custom prefix	Martin Willi	2012-11-29	1	-1/+2
\|
*	Moved debug.[ch] to utils folder	Tobias Brunner	2012-10-24	3	-3/+3
\|
*	Moved host_t and host_resolver_t to a new networking subfolder	Tobias Brunner	2012-10-24	1	-1/+1
\|
*	Use a helper function to add milliseconds to timeval structs	Tobias Brunner	2012-10-18	1	-6/+1
\|
*	android: Bypass/protect previously bypassed sockets if connectivity changes	Tobias Brunner	2012-10-16	1	-0/+2
\|
*	android: Support for IPsec SA update added	Tobias Brunner	2012-10-16	1	-1/+2
\|
*	android: Trigger roam events in case connectivity changes	Tobias Brunner	2012-10-16	1	-0/+63
\|
*	android: Register NetworkManager as BroadcastReceiver and relay events via JNI	Tobias Brunner	2012-10-16	2	-5/+144
\|
*	android: Determine source address dynamically	Tobias Brunner	2012-10-16	1	-1/+16
\|
*	android: Added NetworkManager class which allows to retrieve a local IP address	Tobias Brunner	2012-10-16	2	-0/+196
\|
*	Implement kernel_ipsec_t.bypass_socket() via JNI and VpnService.protect()	Tobias Brunner	2012-08-13	1	-1/+2
\|
*	Add an Android specific kernel_ipsec_t implementation	Tobias Brunner	2012-08-13	2	-0/+240
\| \| \| \| \|	This is pretty much a proxy class that delegates everything (that is currently supported) to libipsec.
*	Add an Android specific kernel_net_t implementation	Tobias Brunner	2012-08-13	2	-0/+113
	This currently provides only no-ops and is just added because a kernel-net implementation is required and kernel-netlink can't be used at the moment.