| Commit message (Collapse) | Author | Age | Files | Lines | ||
|---|---|---|---|---|---|---|
| ... | ||||||
| * | capabilities: Some plugins don't actually require capabilities at runtime | Tobias Brunner | 2013-07-18 | 1 | -1/+1 | |
| | | ||||||
| * | automake: replace INCLUDES by AM_CPPFLAGS | Martin Willi | 2013-07-18 | 1 | -6/+8 | |
| | | | | | | | INCLUDES are now deprecated and throw warnings when using automake 1.13. We now also differentiate AM_CPPFLAGS and AM_CFLAGS, where includes and defines are passed to AM_CPPFLAGS only. | |||||
| * | child-sa: replace get_traffic_selectors() with create_ts_enumerator() | Martin Willi | 2013-07-17 | 1 | -3/+10 | |
| | | | | | | Not directly returning a linked list allows us to change the internals of the CHILD_SA transparently. | |||||
| * | stroke: Add certificates extracted from PKCS#12 files to correct credential set | Tobias Brunner | 2013-07-15 | 1 | -4/+4 | |
| | | | | | | Only keys and shared secrets are moved from the temporary credential set after loading all secrets. | |||||
| * | Use strpfx() helper where appropriate | Tobias Brunner | 2013-07-08 | 2 | -12/+11 | |
| | | ||||||
| * | Reuse reqid for trap policies installed for dpd|closeaction=hold | Tobias Brunner | 2013-07-01 | 1 | -1/+1 | |
| | | ||||||
| * | stroke: Changed how proto/port are specified in left|rightsubnet | Tobias Brunner | 2013-06-28 | 1 | -1/+8 | |
| | | | | | Using a colon as separator conflicts with IPv6 addresses. | |||||
| * | capabilities: CAP_CHOWN might be required by many plugins opening UNIX sockets | Tobias Brunner | 2013-06-25 | 1 | -0/+6 | |
| | | | | | | But as the sockets will be created with the user/group of the running process this might not be required as no change may be needed. | |||||
| * | capabilities: Move global capabilities_t instance to libstrongswan | Tobias Brunner | 2013-06-25 | 1 | -2/+2 | |
| | | ||||||
| * | stroke: support %dynamic in left/rightsubnet for dynamic selectors | Martin Willi | 2013-06-19 | 1 | -2/+10 | |
| | | | | | | | | This has the same meaning as omitting left/rightsubnet, i.e. replace it by the IKE address. Supporting %dynamic allows configurations with multiple dynamic selectors in a left/rightsubnet, each with potentially different proto/port selectors. | |||||
| * | stroke: support a specific proto/port for each net defined in left/rightsubnet | Martin Willi | 2013-06-19 | 1 | -3/+105 | |
| | | ||||||
| * | stroke: add exportconn{cert,chain} commands in addition to exportx509 | Martin Willi | 2013-06-19 | 1 | -6/+65 | |
| | | | | | | The new commands either export a single end entity certificate or the full trust chain for a specific connection name. | |||||
| * | Refactored plugin-loader with improved dependency resolution | Tobias Brunner | 2013-06-11 | 1 | -0/+1 | |
| | | | | | | | With the new implementation the plugins don't have to be listed in any special order, dependencies are properly resolved. The order only matters if two plugins provide the same feature. | |||||
| * | stroke: Add second password if provided | Tobias Brunner | 2013-05-08 | 1 | -0/+13 | |
| | | ||||||
| * | stroke: Fail silently if another builder calls PW callback after giving up | Tobias Brunner | 2013-05-08 | 1 | -9/+14 | |
| | | | | | Also reduced the number of tries to 3. | |||||
| * | stroke: Cache passwords so the user is not prompted multiple times for the ↵ | Tobias Brunner | 2013-05-08 | 1 | -1/+13 | |
| | | | | | | | | | | | same password To verify/decrypt a PKCS#12 container a password might be needed multiple times. If it was entered correctly we don't want to bother the user again with another password prompt. The passwords for MAC creation and encryption could be different so the user might be prompted multiple times after all. | |||||
| * | stroke: Fix prompt and error messages in passphrase callback | Tobias Brunner | 2013-05-08 | 1 | -11/+13 | |
| | | ||||||
| * | stroke: Load credentials from PKCS#12 files (P12 token) | Tobias Brunner | 2013-05-08 | 1 | -15/+92 | |
| | | ||||||
| * | Load any type (RSA/ECDSA) of public key via left|rightsigkey | Tobias Brunner | 2013-05-07 | 3 | -17/+17 | |
| | | ||||||
| * | left|rightrsasigkey accepts SSH keys but the key format has to be specified ↵ | Tobias Brunner | 2013-05-07 | 1 | -12/+22 | |
| | | | | | | | | explicitly The default is now PKCS#1. With the dns: and ssh: prefixes other formats can be selected. | |||||
| * | Try to load raw keys from ipsec.conf as PKCS#1 blob first | Tobias Brunner | 2013-05-07 | 1 | -5/+12 | |
| | | | | | | The DNSKEY builder is quite eager and parses pretty much anything as RSA key, so this has to be done before. | |||||
| * | List all stroke counters when "all" is given, and report if connection not known | Martin Willi | 2013-04-03 | 1 | -30/+88 | |
| | | ||||||
| * | Load raw keys before possibly destroying the identity | Tobias Brunner | 2013-04-01 | 1 | -12/+11 | |
| | | | | | | | | | If no identity (or %any) is configured the identification_t object is destroyed and an invalid object was associated with the created pubkey certificate. Actually using %any does not work as the certificate would not match when the client later provides an identity. | |||||
| * | enforce singular of packets | Andreas Steffen | 2013-03-22 | 1 | -4/+6 | |
| | | ||||||
| * | Avoid a race condition when reloading secrets from ipsec.secrets | Tobias Brunner | 2013-03-20 | 1 | -18/+25 | |
| | | | | | | | | With the previous implementation that cleared the secrets in the active credential set and then loaded the secrets, IKE SA establishment would fail (as initiator or responder) if secrets are concurrently reloaded and the required secret was not yet loaded. | |||||
| * | Don't try to mmap() empty ipsec.secret files | Martin Willi | 2013-03-19 | 1 | -1/+5 | |
| | | ||||||
| * | In stroke counters, check if we have an IKE_SA before getting the name from it | Martin Willi | 2013-03-19 | 1 | -3/+6 | |
| | | | | | | Fixes a segfault when receiving an invalid IKE SPI, where we don't have an IKE_SA for the raised alert. | |||||
| * | Algorithms are not really specific to an IKE version | Tobias Brunner | 2013-03-18 | 1 | -1/+1 | |
| | | | | | | | But not all of them can be used with IKEv1. Fixes #314. | |||||
| * | Merge branch 'radius-ext' | Martin Willi | 2013-03-18 | 1 | -6/+9 | |
| |\ | | | | | | | | | | | Bring some extensions to eap-radius, namely a virtual IP address provider based on received Framed-IPs, forwarding of Cisco Unity banners, Interim Accounting updates and the reporting of sent/received packets. | |||||
| | * | Report the number of processed packets in "ipsec statusall" | Martin Willi | 2013-03-14 | 1 | -5/+9 | |
| | | | ||||||
| | * | child_sa_t.get_usestats() can additionally return the number of processed ↵ | Martin Willi | 2013-03-14 | 1 | -3/+2 | |
| | | | | | | | | | packets | |||||
| * | | Merge branch 'stroke-counters' | Martin Willi | 2013-03-18 | 3 | -11/+185 | |
| |\ \ | | | | | | | | | | | | | Extend stroke counters functionality by connection specific counters, and a resetcounters command to reset the global or connection counters. | |||||
| | * | | Add a "resetcounters" command to ipsec, clearing global or connection counters | Martin Willi | 2013-03-15 | 3 | -1/+38 | |
| | | | | ||||||
| | * | | Add connection name specific stroke counters | Martin Willi | 2013-03-15 | 3 | -11/+148 | |
| | | | | ||||||
| * | | | Merge branch 'stroke-timeout' | Martin Willi | 2013-03-18 | 1 | -18/+82 | |
| |\ \ \ | |_|/ |/| | | | | | Add a strongswan.conf timeout option for stroke control commands. | |||||
| | * | | Add a stroke command timeout option, and report status of completed command | Martin Willi | 2013-03-07 | 1 | -18/+82 | |
| | |/ | ||||||
| * | | Merge branch 'multi-cert' | Martin Willi | 2013-03-01 | 1 | -15/+32 | |
| |\ \ | | | | | | | | | | | | | Allows the configuration of multiple certificates in leftcert, and select the correct certificate to use based on the received certificate requests. | |||||
| | * | | Load multiple comma seperarated certificates in the leftcert option | Martin Willi | 2013-01-18 | 1 | -15/+32 | |
| | | | | ||||||
| * | | | Merge branch 'opaque-ports' | Martin Willi | 2013-03-01 | 1 | -4/+4 | |
| |\ \ \ | | | | | | | | | | | | | | | | | Adds a %opaque port option and support for port ranges in left/rightprotoport. Currently not supported by any of our kernel backends. | |||||
| | * | | | Pass complete port range over stroke interface for more flexibility | Martin Willi | 2013-02-21 | 1 | -14/+4 | |
| | | | | | ||||||
| | * | | | Use a complete port range in traffic_selector_create_from_{subnet,cidr} | Martin Willi | 2013-02-21 | 1 | -5/+15 | |
| | | |/ | |/| | ||||||
| * | | | Merge branch 'ike-dscp' | Martin Willi | 2013-02-14 | 1 | -1/+2 | |
| |\ \ \ | ||||||
| | * | | | Add a ikedscp ipsec.conf option to set DSCP value on outgoing IKE packets | Martin Willi | 2013-02-06 | 1 | -1/+1 | |
| | | | | | ||||||
| | * | | | Add a DSCP configuration value to IKE configs | Martin Willi | 2013-02-06 | 1 | -1/+2 | |
| | |/ / | ||||||
| * / / | Fix 'stroke loglevel any' | Tobias Brunner | 2013-02-13 | 1 | -4/+11 | |
| |/ / | | | | | | | | | | | | | Before b46a5cd4 this worked if debug_t was unsigned. In that case -1, as returned by enum_from_name(), would result in a large positive number. So any unknown debug group (including 'any') had the same effect that was only intended for 'any'. | |||||
| * / | Use proper buffer sizes for parse_smartcard() | Tobias Brunner | 2013-01-24 | 1 | -7/+10 | |
| |/ | ||||||
| * | Don't handle right=%any6 as "loose" identity, but as %any | Martin Willi | 2013-01-14 | 1 | -2/+1 | |
| | | ||||||
| * | Merge branch 'ikev1-fragmentation' | Tobias Brunner | 2013-01-12 | 1 | -1/+2 | |
| |\ | | | | | | | | | | | | | This adds support for the proprietary IKEv1 fragmentation extension. Conflicts: NEWS | |||||
| | * | Use a connection specific option to en-/disable IKEv1 fragmentation | Tobias Brunner | 2012-12-24 | 1 | -1/+2 | |
| | | | ||||||
| * | | Fixed some typos in comments | Volker Rümelin | 2013-01-11 | 1 | -1/+1 | |
| |/ | ||||||
 |
index : tteras/strongswan | |
| tteras' strongSwan tree | gitolite |
| aboutsummaryrefslogtreecommitdiffstats |