tteras/strongswan - tteras' strongSwan tree

	Commit message (Collapse)	Author	Age	Files	Lines
*	linked-list: Change return value of find_first() and signature of its callback	Tobias Brunner	2017-05-26	1	-19/+16
\| \| \| \|	This avoids the unportable five pointer hack.
*	kernel-net: Let get_nexthop() return an optional interface name	Tobias Brunner	2016-06-10	1	-2/+3
\| \| \| \| \|	The returned name should be the interface over which the destination address/net is reachable.
*	kernel: Use structs to pass information to the kernel-ipsec interface	Tobias Brunner	2016-04-09	1	-42/+38
\|
*	Use standard unsigned integer types	Andreas Steffen	2016-03-24	1	-17/+17
\|
*	libhydra: Move kernel interface to libcharon	Tobias Brunner	2016-03-03	1	-33/+26
\| \| \| \|	This moves hydra->kernel_interface to charon->kernel.
*	libipsec: Pass the same data to del_policy() as to add_policy()	Tobias Brunner	2016-02-04	1	-2/+2
\| \| \| \| \| \|	We already do this for the other kernel interfaces. Fixes e1e88d5adde0 ("libipsec: Don't attempt deletion of any non-IPsec policies")
*	kernel-interface: Pass the same data to del_policy() that was passed to ↵	Tobias Brunner	2015-11-10	1	-3/+4
\| \| \| \| \| \| \|	add_policy() The additional data can be helpful to identify the exact policy to delete.
*	libipsec: Pass separate inbound/update flags to the IPsec SA manager	Martin Willi	2015-03-09	1	-1/+2
\| \| \| \| \|	Similar to other kernel interfaces, the libipsec backends uses the flag for different purposes, and therefore should get separate flags.
*	kernel-interface: Add a separate "update" flag to add_sa()	Martin Willi	2015-03-09	1	-1/+1
\| \| \| \| \| \| \| \| \| \| \|	The current "inbound" flag is used for two purposes: To define the actual direction of the SA, but also to determine the operation used for SA installation. If an SPI has been allocated, an update operation is required instead of an add. While the inbound flag normally defines the kind of operation required, this is not necessarily true in all cases. On the HA passive node, we install inbound SAs without prior SPI allocation.
*	kernel-interface: Raise expires with a proto/SPI/dst tuple instead of reqid	Martin Willi	2015-02-20	1	-3/+3
\|
*	kernel-interface: Pass full list of traffic selectors to add_sa()	Martin Willi	2015-02-20	1	-1/+1
\| \| \| \| \| \|	While we can handle the first selector only in BEET mode in kernel-netlink, passing the full list gives the backend more flexibility how to handle this information.
*	libipsec: Remove unused src/dst_ts parameters from ipsec_sa_mgr_t.add_sa()	Martin Willi	2015-02-20	1	-2/+1
\|
*	kernel-interface: Remove reqid parameter from get_spi/get_cpi() methods	Martin Willi	2015-02-20	1	-2/+2
\| \| \| \| \| \| \| \| \| \|	The reqid is not strictly required, as we set the reqid with the update call when installing the negotiated SA. If we don't need a reqid at this stage, we can later allocate the reqid in the kernel backend once the SA parameters have been fully negotaited. This allows us to assign the same reqid for the same selectors to avoid conflicts on backends this is necessary.
*	libipsec: Remove unused reqid parameter from ipsec_sa_mgr_t.get_spi()	Martin Willi	2015-02-19	1	-1/+1
\|
*	kernel-interface: Add destination prefix to get_nexthop()	Tobias Brunner	2014-06-19	1	-2/+2
\| \| \| \| \|	This allows to determine the next hop to reach a subnet, for instance, when installing routes for shunt policies.
*	kernel-interface: Add a replay_window parameter to add_sa()	Martin Willi	2014-06-17	1	-2/+3
\|
*	libhydra: Use lib->ns instead of hydra->daemon	Tobias Brunner	2014-02-12	1	-1/+1
\|
*	kernel-libipsec: Don't ignore policies of type != POLICY_IPSEC	Tobias Brunner	2013-10-11	1	-5/+0
\| \| \| \| \| \|	This actually broke rekeying due to the DROP policies that are temporarily added, which broke the refcount as the ignored policies were not ignored in del_policy() (the type is not known there).
*	kernel-libipsec: Add an option to allow remote TS to match the IKE peer	Tobias Brunner	2013-10-11	1	-2/+9
\| \| \| \| \| \| \| \|	Setting the fwmark options for the kernel-netlink and socket-default plugins allow this kind of setup. It is probably required to set net.ipv4.conf.all.rp_filter to 2 to make it work.
*	kernel-libipsec: Support ESPv3 TFC padding	Martin Willi	2013-10-11	1	-1/+1
\|
*	kernel-libipsec: Support query_sa() to report usage statistics	Martin Willi	2013-10-11	1	-1/+2
\|
*	kernel: Use a time_t to report use time in query_policy()	Martin Willi	2013-10-11	1	-1/+1
\|
*	kernel: Use a time_t to report use time in query_sa()	Martin Willi	2013-10-11	1	-1/+1
\|
*	kernel-libipsec: Fail route installation if remote TS matches peer	Tobias Brunner	2013-07-18	1	-0/+9
\|
*	kernel-libipsec: Log error if no local address is found when installing routes	Tobias Brunner	2013-07-15	1	-0/+5
\|
*	kernel-libipsec: Ignore failures when installing routes for multicast or ↵	Tobias Brunner	2013-06-21	1	-1/+23
\| \| \| \|	broadcast policies
*	kernel-libipsec: Add a feature to request UDP encapsulation of ESP packets	Tobias Brunner	2013-06-21	1	-0/+7
\|
*	kernel-libipsec: Install a gateway for routes on platforms other than Linux	Tobias Brunner	2013-06-21	1	-9/+26
\| \| \| \|	This seems required e.g. on FreeBSD but doesn't work on Linux.
*	kernel-libipsec: Router reads packets from multiple TUN devices	Tobias Brunner	2013-06-21	1	-7/+2
\| \| \| \|	These devices are collected via kernel_listener_t interface.
*	kernel-libipsec: Track policies and automatically install routes	Tobias Brunner	2013-06-21	1	-5/+455
\| \| \| \| \| \| \| \|	The routes direct traffic matching the remote traffic selector to the TUN device. If the remote traffic selector includes the IKE peer a very specific route is installed to allow IKE traffic.
*	kernel-libipsec: Create a TUN device and use it to install virtual IPs	Tobias Brunner	2013-06-21	1	-0/+7
\|
*	kernel-libipsec: Add plugin that implements kernel_ipsec_t using libipsec	Tobias Brunner	2013-06-21	1	-0/+189