| Commit message (Collapse) | Author | Age | Files | Lines | |
|---|---|---|---|---|---|
| * | addrblock: Narrow selectors when rekeying a CHILD_SA as original responder | Martin Willi | 2017-03-24 | 1 | -0/+1 |
| | | | | | | | | | | | | | If a the original responder narrows the selectors of its peer in addrblock, the peer gets a subset of that selectors. However, once the original responder initiates rekeying of that CHILD_SA, it sends the full selectors to the peer, and then narrows the received selectors locally for the installation, only. This is insufficient, as the peer ends up with wider selectors, sending traffic that the original responder will reject to the stricter IPsec policy. So additionally narrow the selectors when rekeying CHILD_SAs before sending the TS list to the peer. | ||||
| * | addrblock: Use dynamic TS narrowing instead of rejecting the whole CHILD_SA | Martin Willi | 2017-03-02 | 1 | -43/+28 |
| | | | | | | | | | Previously, the client had to propose no wider selectors than the certificate permits, otherwise the complete CHILD_SA was rejected. However, with IKEv2 we can dynamically narrow the selectors to what the certificate allows. This makes client and gateway configurations very simple by just proposing 0.0.0.0/0, narrowed to selectors the client is permitted to route into the network. | ||||
| * | Moved X509 ipAddrBlock checking to the addrblock plugin | Martin Willi | 2010-07-13 | 1 | -0/+154 |
 |
index : tteras/strongswan | |
| tteras' strongSwan tree | gitolite |
| aboutsummaryrefslogtreecommitdiffstats |