| Commit message (Collapse) | Author | Age | Files | Lines | ||
|---|---|---|---|---|---|---|
| ... | ||||||
| * | kernel-netlink: Order policies with equal priorities by their automatic priority | Tobias Brunner | 2016-04-15 | 1 | -11/+24 | |
| | | | | | | | | | | | | | This allows using manual priorities for traps, which have a lower base priority than the resulting IPsec policies. This could otherwise be problematic if, for example, swanctl --install/uninstall is used while an SA is established combined with e.g. IPComp, where the trap policy does not look the same as the IPsec policy (which is now otherwise often the case as the reqids stay the same). It also orders policies by selector size if manual priorities are configured and narrowing occurs. | |||||
| * | Extended IPsec kernel policy scheme | Andreas Steffen | 2016-04-09 | 1 | -18/+53 | |
| | | | | | | | | | The kernel policy now considers src and dst port masks as well as restictions to a given network interface. The base priority is 100'000 for passthrough shunts, 200'000 for IPsec policies, 300'000 for IPsec policy traps and 400'000 for fallback drop shunts. The values 1..30'000 can be used for manually set priorities. | |||||
| * | Implemented IPsec policies restricted to given network interface | Andreas Steffen | 2016-04-09 | 1 | -6/+9 | |
| | | ||||||
| * | Support manually-set IPsec policy priorities | Andreas Steffen | 2016-04-09 | 1 | -2/+4 | |
| | | ||||||
| * | kernel-netlink: Prefer policies with reqid over those without | Tobias Brunner | 2016-04-09 | 1 | -1/+7 | |
| | | | | | | | | This allows two CHILD_SAs with reversed subnets to install two FWD policies each. Since the outbound policy won't have a reqid set we will end up with the two inbound FWD policies installed in the kernel, with the correct templates to allow decrypted traffic. | |||||
| * | kernel-netlink: Only associate templates with inbound FWD policies | Tobias Brunner | 2016-04-09 | 1 | -1/+1 | |
| | | | | | | | We can't set a template on the outbound FWD policy (or we'd have to make it optional). Because if the traffic does not come from another (matching) IPsec tunnel it would get dropped due to the template mismatch. | |||||
| * | kernel-netlink: Associate routes with IN policies instead of FWD policies | Tobias Brunner | 2016-04-09 | 1 | -21/+21 | |
| | | | | | | | This allows us to install more than one FWD policy. We already do this in the kernel-pfkey plugin (there the original reason was that not all kernels support FWD policies). | |||||
| * | kernel: Use structs to pass information to the kernel-ipsec interface | Tobias Brunner | 2016-04-09 | 1 | -215/+255 | |
| | | ||||||
| * | Use standard unsigned integer types | Andreas Steffen | 2016-03-24 | 2 | -71/+71 | |
| | | ||||||
| * | kernel-netlink: Fix lookup of next hops for destinations with prefix | Tobias Brunner | 2016-03-21 | 1 | -1/+2 | |
| | | | | | References #1347. | |||||
| * | Implemented port ranges in kernel_netlink interface | Andreas Steffen | 2016-03-04 | 1 | -7/+19 | |
| | | ||||||
| * | libhydra: Move kernel interface to libcharon | Tobias Brunner | 2016-03-03 | 5 | -40/+33 | |
| | | | | | This moves hydra->kernel_interface to charon->kernel. | |||||
| * | libhydra: Move all kernel plugins to libcharon | Tobias Brunner | 2016-03-03 | 13 | -0/+7043 | |
| | | ||||||
| * | Moved all kernel plugins to libhydra. | Tobias Brunner | 2010-09-02 | 9 | -4327/+0 | |
| | | ||||||
| * | Refer to kernel interface via hydra and not charon. | Tobias Brunner | 2010-09-02 | 3 | -22/+26 | |
| | | ||||||
| * | Removed references to protocol_id_t from kernel interface. | Tobias Brunner | 2010-09-02 | 1 | -57/+22 | |
| | | | | | | Instead we use the actual IP protocol identifier (the conversion now happens in child_sa_t and kernel_handler_t). | |||||
| * | Moved roam job creation to kernel event handler. | Tobias Brunner | 2010-09-02 | 1 | -11/+23 | |
| | | ||||||
| * | Refer to scheduler via hydra and not charon. | Tobias Brunner | 2010-09-02 | 1 | -1/+1 | |
| | | ||||||
| * | Moved migrate job creation to kernel event handler. | Tobias Brunner | 2010-09-02 | 1 | -7/+2 | |
| | | ||||||
| * | Moved update SA job creation to kernel event handler. | Tobias Brunner | 2010-09-02 | 1 | -6/+2 | |
| | | ||||||
| * | Moved delete/rekey CHILD_SA job creation to kernel event handler. | Tobias Brunner | 2010-09-02 | 1 | -17/+4 | |
| | | ||||||
| * | Moved acquire job creation to kernel event handler. | Tobias Brunner | 2010-09-02 | 1 | -6/+3 | |
| | | ||||||
| * | Some whitespace and code style fixes. | Tobias Brunner | 2010-09-02 | 1 | -1/+1 | |
| | | ||||||
| * | Refer to processor via hydra and not charon. | Tobias Brunner | 2010-09-02 | 2 | -8/+10 | |
| | | ||||||
| * | Use a seperate section for each nested struct member in INIT macro | Martin Willi | 2010-08-18 | 1 | -14/+16 | |
| | | ||||||
| * | support of xfrm marks for IKEv2 | Andreas Steffen | 2010-07-02 | 1 | -45/+278 | |
| | | ||||||
| * | Respect line with in Makefile.am's, other cosmetics | Martin Willi | 2010-03-25 | 1 | -1/+2 | |
| | | ||||||
| * | Changed all usages of lib->attributes to hydra->attributes. | Tobias Brunner | 2010-03-24 | 1 | -1/+1 | |
| | | ||||||
| * | Convert charon into libcharon. | Tobias Brunner | 2010-03-19 | 1 | -1/+1 | |
| | | ||||||
| * | Moving charon to libcharon. | Tobias Brunner | 2010-03-19 | 9 | -0/+4133 | |
 |
index : tteras/strongswan | |
| tteras' strongSwan tree | gitolite |
| aboutsummaryrefslogtreecommitdiffstats |