| Commit message (Collapse) | Author | Age | Files | Lines | ||
|---|---|---|---|---|---|---|
| ... | ||||||
| * | stroke: add exportconn{cert,chain} commands in addition to exportx509 | Martin Willi | 2013-06-19 | 1 | -6/+65 | |
| | | | | | | The new commands either export a single end entity certificate or the full trust chain for a specific connection name. | |||||
| * | Refactored plugin-loader with improved dependency resolution | Tobias Brunner | 2013-06-11 | 1 | -0/+1 | |
| | | | | | | | With the new implementation the plugins don't have to be listed in any special order, dependencies are properly resolved. The order only matters if two plugins provide the same feature. | |||||
| * | stroke: Add second password if provided | Tobias Brunner | 2013-05-08 | 1 | -0/+13 | |
| | | ||||||
| * | stroke: Fail silently if another builder calls PW callback after giving up | Tobias Brunner | 2013-05-08 | 1 | -9/+14 | |
| | | | | | Also reduced the number of tries to 3. | |||||
| * | stroke: Cache passwords so the user is not prompted multiple times for the ↵ | Tobias Brunner | 2013-05-08 | 1 | -1/+13 | |
| | | | | | | | | | | | same password To verify/decrypt a PKCS#12 container a password might be needed multiple times. If it was entered correctly we don't want to bother the user again with another password prompt. The passwords for MAC creation and encryption could be different so the user might be prompted multiple times after all. | |||||
| * | stroke: Fix prompt and error messages in passphrase callback | Tobias Brunner | 2013-05-08 | 1 | -11/+13 | |
| | | ||||||
| * | stroke: Load credentials from PKCS#12 files (P12 token) | Tobias Brunner | 2013-05-08 | 1 | -15/+92 | |
| | | ||||||
| * | Load any type (RSA/ECDSA) of public key via left|rightsigkey | Tobias Brunner | 2013-05-07 | 3 | -17/+17 | |
| | | ||||||
| * | left|rightrsasigkey accepts SSH keys but the key format has to be specified ↵ | Tobias Brunner | 2013-05-07 | 1 | -12/+22 | |
| | | | | | | | | explicitly The default is now PKCS#1. With the dns: and ssh: prefixes other formats can be selected. | |||||
| * | Try to load raw keys from ipsec.conf as PKCS#1 blob first | Tobias Brunner | 2013-05-07 | 1 | -5/+12 | |
| | | | | | | The DNSKEY builder is quite eager and parses pretty much anything as RSA key, so this has to be done before. | |||||
| * | List all stroke counters when "all" is given, and report if connection not known | Martin Willi | 2013-04-03 | 1 | -30/+88 | |
| | | ||||||
| * | Load raw keys before possibly destroying the identity | Tobias Brunner | 2013-04-01 | 1 | -12/+11 | |
| | | | | | | | | | If no identity (or %any) is configured the identification_t object is destroyed and an invalid object was associated with the created pubkey certificate. Actually using %any does not work as the certificate would not match when the client later provides an identity. | |||||
| * | enforce singular of packets | Andreas Steffen | 2013-03-22 | 1 | -4/+6 | |
| | | ||||||
| * | Avoid a race condition when reloading secrets from ipsec.secrets | Tobias Brunner | 2013-03-20 | 1 | -18/+25 | |
| | | | | | | | | With the previous implementation that cleared the secrets in the active credential set and then loaded the secrets, IKE SA establishment would fail (as initiator or responder) if secrets are concurrently reloaded and the required secret was not yet loaded. | |||||
| * | Don't try to mmap() empty ipsec.secret files | Martin Willi | 2013-03-19 | 1 | -1/+5 | |
| | | ||||||
| * | In stroke counters, check if we have an IKE_SA before getting the name from it | Martin Willi | 2013-03-19 | 1 | -3/+6 | |
| | | | | | | Fixes a segfault when receiving an invalid IKE SPI, where we don't have an IKE_SA for the raised alert. | |||||
| * | Algorithms are not really specific to an IKE version | Tobias Brunner | 2013-03-18 | 1 | -1/+1 | |
| | | | | | | | But not all of them can be used with IKEv1. Fixes #314. | |||||
| * | Merge branch 'radius-ext' | Martin Willi | 2013-03-18 | 1 | -6/+9 | |
| |\ | | | | | | | | | | | Bring some extensions to eap-radius, namely a virtual IP address provider based on received Framed-IPs, forwarding of Cisco Unity banners, Interim Accounting updates and the reporting of sent/received packets. | |||||
| | * | Report the number of processed packets in "ipsec statusall" | Martin Willi | 2013-03-14 | 1 | -5/+9 | |
| | | | ||||||
| | * | child_sa_t.get_usestats() can additionally return the number of processed ↵ | Martin Willi | 2013-03-14 | 1 | -3/+2 | |
| | | | | | | | | | packets | |||||
| * | | Merge branch 'stroke-counters' | Martin Willi | 2013-03-18 | 3 | -11/+185 | |
| |\ \ | | | | | | | | | | | | | Extend stroke counters functionality by connection specific counters, and a resetcounters command to reset the global or connection counters. | |||||
| | * | | Add a "resetcounters" command to ipsec, clearing global or connection counters | Martin Willi | 2013-03-15 | 3 | -1/+38 | |
| | | | | ||||||
| | * | | Add connection name specific stroke counters | Martin Willi | 2013-03-15 | 3 | -11/+148 | |
| | | | | ||||||
| * | | | Merge branch 'stroke-timeout' | Martin Willi | 2013-03-18 | 1 | -18/+82 | |
| |\ \ \ | |_|/ |/| | | | | | Add a strongswan.conf timeout option for stroke control commands. | |||||
| | * | | Add a stroke command timeout option, and report status of completed command | Martin Willi | 2013-03-07 | 1 | -18/+82 | |
| | |/ | ||||||
| * | | Merge branch 'multi-cert' | Martin Willi | 2013-03-01 | 1 | -15/+32 | |
| |\ \ | | | | | | | | | | | | | Allows the configuration of multiple certificates in leftcert, and select the correct certificate to use based on the received certificate requests. | |||||
| | * | | Load multiple comma seperarated certificates in the leftcert option | Martin Willi | 2013-01-18 | 1 | -15/+32 | |
| | | | | ||||||
| * | | | Merge branch 'opaque-ports' | Martin Willi | 2013-03-01 | 1 | -4/+4 | |
| |\ \ \ | | | | | | | | | | | | | | | | | Adds a %opaque port option and support for port ranges in left/rightprotoport. Currently not supported by any of our kernel backends. | |||||
| | * | | | Pass complete port range over stroke interface for more flexibility | Martin Willi | 2013-02-21 | 1 | -14/+4 | |
| | | | | | ||||||
| | * | | | Use a complete port range in traffic_selector_create_from_{subnet,cidr} | Martin Willi | 2013-02-21 | 1 | -5/+15 | |
| | | |/ | |/| | ||||||
| * | | | Merge branch 'ike-dscp' | Martin Willi | 2013-02-14 | 1 | -1/+2 | |
| |\ \ \ | ||||||
| | * | | | Add a ikedscp ipsec.conf option to set DSCP value on outgoing IKE packets | Martin Willi | 2013-02-06 | 1 | -1/+1 | |
| | | | | | ||||||
| | * | | | Add a DSCP configuration value to IKE configs | Martin Willi | 2013-02-06 | 1 | -1/+2 | |
| | |/ / | ||||||
| * / / | Fix 'stroke loglevel any' | Tobias Brunner | 2013-02-13 | 1 | -4/+11 | |
| |/ / | | | | | | | | | | | | | Before b46a5cd4 this worked if debug_t was unsigned. In that case -1, as returned by enum_from_name(), would result in a large positive number. So any unknown debug group (including 'any') had the same effect that was only intended for 'any'. | |||||
| * / | Use proper buffer sizes for parse_smartcard() | Tobias Brunner | 2013-01-24 | 1 | -7/+10 | |
| |/ | ||||||
| * | Don't handle right=%any6 as "loose" identity, but as %any | Martin Willi | 2013-01-14 | 1 | -2/+1 | |
| | | ||||||
| * | Merge branch 'ikev1-fragmentation' | Tobias Brunner | 2013-01-12 | 1 | -1/+2 | |
| |\ | | | | | | | | | | | | | This adds support for the proprietary IKEv1 fragmentation extension. Conflicts: NEWS | |||||
| | * | Use a connection specific option to en-/disable IKEv1 fragmentation | Tobias Brunner | 2012-12-24 | 1 | -1/+2 | |
| | | | ||||||
| * | | Fixed some typos in comments | Volker Rümelin | 2013-01-11 | 1 | -1/+1 | |
| |/ | ||||||
| * | Moved data structures to new collections subfolder | Tobias Brunner | 2012-10-24 | 7 | -7/+7 | |
| | | ||||||
| * | Make use of new CIDR string ts constructor where appropriate | Martin Willi | 2012-10-24 | 1 | -26/+11 | |
| | | ||||||
| * | Use explicit, larger buffer sizes for smartcard keyids and modules | Martin Willi | 2012-10-24 | 1 | -8/+8 | |
| | | ||||||
| * | Support loading cacert certificates in ipsec.conf ca sections from smartcard | Martin Willi | 2012-10-24 | 1 | -19/+37 | |
| | | ||||||
| * | Refactored stroke smartcard token parsing, support module and slot in ↵ | Martin Willi | 2012-10-24 | 1 | -62/+101 | |
| | | | | | leftcert option | |||||
| * | Load ipsec.conf %smartcard leftcerts with pkcs11 builder | Martin Willi | 2012-10-24 | 1 | -8/+20 | |
| | | ||||||
| * | Add a "ipsec listcounters" command to stroke | Martin Willi | 2012-10-24 | 2 | -0/+6 | |
| | | ||||||
| * | Add a print method for stroke counters | Martin Willi | 2012-10-24 | 2 | -0/+29 | |
| | | ||||||
| * | Add stroke message type counters | Martin Willi | 2012-10-24 | 1 | -0/+75 | |
| | | ||||||
| * | Add stroke counters for invalid IKE messages | Martin Willi | 2012-10-24 | 1 | -0/+27 | |
| | | ||||||
| * | Add stroke CHILD_SA rekeying counter | Martin Willi | 2012-10-24 | 1 | -0/+12 | |
| | | ||||||
 |
index : tteras/strongswan | |
| tteras' strongSwan tree | gitolite |
| aboutsummaryrefslogtreecommitdiffstats |