| Commit message (Collapse) | Author | Age | Files | Lines | ||
|---|---|---|---|---|---|---|
| ... | ||||||
| * | Avoid a race condition when reloading secrets from ipsec.secrets | Tobias Brunner | 2013-03-20 | 1 | -18/+25 | |
| | | | | | | | | With the previous implementation that cleared the secrets in the active credential set and then loaded the secrets, IKE SA establishment would fail (as initiator or responder) if secrets are concurrently reloaded and the required secret was not yet loaded. | |||||
| * | Add an option to autobalance a HA cluster automatically | Martin Willi | 2013-03-19 | 1 | -0/+59 | |
| | | ||||||
| * | Check if for some reason we handle a HA segment on both nodes | Martin Willi | 2013-03-19 | 1 | -1/+15 | |
| | | ||||||
| * | Acquire HA segment lock while sending heartbeat | Martin Willi | 2013-03-19 | 1 | -0/+2 | |
| | | ||||||
| * | Removed unused variable 'id' | Tobias Brunner | 2013-03-19 | 1 | -2/+1 | |
| | | ||||||
| * | Fix scheduling of heartbeat sending in HA plugin | Martin Willi | 2013-03-19 | 1 | -2/+11 | |
| | | | | | | | e0efd7c1 switches to automated job rescheduling for HA heartbeat. However, send_status() is initially called directly, which will not reschedule the job as required. | |||||
| * | Fix compiler warning in HA plugin | Martin Willi | 2013-03-19 | 1 | -1/+1 | |
| | | ||||||
| * | Don't try to mmap() empty ipsec.secret files | Martin Willi | 2013-03-19 | 1 | -1/+5 | |
| | | ||||||
| * | Added xauth-noauth plugin | Tobias Brunner | 2013-03-19 | 5 | -0/+261 | |
| | | | | | | | | | This XAuth backend does not do any authentication of client credentials but simply sends a successful XAuth status to the client, thereby concluding the XAuth exchange. This can be useful to fallback to basic RSA authentication with clients that can not be configured without XAuth authentication. | |||||
| * | In stroke counters, check if we have an IKE_SA before getting the name from it | Martin Willi | 2013-03-19 | 1 | -3/+6 | |
| | | | | | | Fixes a segfault when receiving an invalid IKE SPI, where we don't have an IKE_SA for the raised alert. | |||||
| * | Add an "esp" load-tester option to configure custom CHILD_SA ESP proposal | Martin Willi | 2013-03-18 | 1 | -3/+16 | |
| | | ||||||
| * | Algorithms are not really specific to an IKE version | Tobias Brunner | 2013-03-18 | 1 | -1/+1 | |
| | | | | | | | But not all of them can be used with IKEv1. Fixes #314. | |||||
| * | Merge branch 'radius-ext' | Martin Willi | 2013-03-18 | 10 | -78/+1150 | |
| |\ | | | | | | | | | | | Bring some extensions to eap-radius, namely a virtual IP address provider based on received Framed-IPs, forwarding of Cisco Unity banners, Interim Accounting updates and the reporting of sent/received packets. | |||||
| | * | Don't create interim update entries if RADIUS accounting is disabled | Martin Willi | 2013-03-14 | 2 | -7/+7 | |
| | | | ||||||
| | * | Add support for RADIUS Interim accounting updates | Martin Willi | 2013-03-14 | 3 | -39/+269 | |
| | | | ||||||
| | * | Add an option to delete any established IKE_SA if RADIUS server is not ↵ | Martin Willi | 2013-03-14 | 4 | -7/+67 | |
| | | | | | | | | | responding | |||||
| | * | Send Acct-Terminate-Cause based on some alerts catched on the bus | Martin Willi | 2013-03-14 | 1 | -0/+62 | |
| | | | | | | | | | | | Currently supported are user disconnects, session timeouts and if the peer does not respond on IKE packets or DPDs. | |||||
| | * | Send NAS-Port, NAS-IP and Calling/Called-Station-ID in Accounting-Requests | Martin Willi | 2013-03-14 | 1 | -4/+33 | |
| | | | ||||||
| | * | Support RADIUS accounting of sent/received packets | Martin Willi | 2013-03-14 | 1 | -13/+23 | |
| | | | ||||||
| | * | Report the number of processed packets in "ipsec statusall" | Martin Willi | 2013-03-14 | 1 | -5/+9 | |
| | | | ||||||
| | * | child_sa_t.get_usestats() can additionally return the number of processed ↵ | Martin Willi | 2013-03-14 | 2 | -5/+4 | |
| | | | | | | | | | packets | |||||
| | * | kernel_ipsec_t.query_sa() additionally returns the number of processed packets | Martin Willi | 2013-03-14 | 1 | -2/+2 | |
| | | | ||||||
| | * | Send NAS-Port, NAS-IP and Calling/Called-Station-ID in Access-Request | Martin Willi | 2013-03-13 | 1 | -7/+56 | |
| | | | ||||||
| | * | Forward Cisco Banner received from RADIUS to Unity capable clients | Martin Willi | 2013-03-12 | 3 | -5/+176 | |
| | | | ||||||
| | * | In eap-radius, hand out received Framed-IP-Address attributes as virtual IP | Martin Willi | 2013-03-12 | 5 | -2/+460 | |
| | | | ||||||
| * | | Merge branch 'stroke-counters' | Martin Willi | 2013-03-18 | 3 | -11/+185 | |
| |\ \ | | | | | | | | | | | | | Extend stroke counters functionality by connection specific counters, and a resetcounters command to reset the global or connection counters. | |||||
| | * | | Add a "resetcounters" command to ipsec, clearing global or connection counters | Martin Willi | 2013-03-15 | 3 | -1/+38 | |
| | | | | ||||||
| | * | | Add connection name specific stroke counters | Martin Willi | 2013-03-15 | 3 | -11/+148 | |
| | | | | ||||||
| * | | | Merge branch 'stroke-timeout' | Martin Willi | 2013-03-18 | 1 | -18/+82 | |
| |\ \ \ | |_|/ |/| | | | | | Add a strongswan.conf timeout option for stroke control commands. | |||||
| | * | | Add a stroke command timeout option, and report status of completed command | Martin Willi | 2013-03-07 | 1 | -18/+82 | |
| | |/ | ||||||
| * | | Support mutliple subnets and ranges as external load-tester addresses | Martin Willi | 2013-03-11 | 1 | -15/+59 | |
| | | | ||||||
| * | | instead of cloning use extract_buf() method | Andreas Steffen | 2013-03-04 | 1 | -1/+1 | |
| | | | ||||||
| * | | Fixed Doxygen comments after scanning complete src directory | Tobias Brunner | 2013-03-02 | 4 | -5/+5 | |
| | | | ||||||
| * | | Removed backend for old Android frontend patch | Tobias Brunner | 2013-03-02 | 10 | -917/+77 | |
| | | | | | | | | | Moved the remaining DNS handler to a new plugin. | |||||
| * | | Merge branch 'multi-cert' | Martin Willi | 2013-03-01 | 1 | -15/+32 | |
| |\ \ | | | | | | | | | | | | | Allows the configuration of multiple certificates in leftcert, and select the correct certificate to use based on the received certificate requests. | |||||
| | * | | Load multiple comma seperarated certificates in the leftcert option | Martin Willi | 2013-01-18 | 1 | -15/+32 | |
| | | | | ||||||
| * | | | Merge branch 'systime' | Martin Willi | 2013-03-01 | 5 | -0/+445 | |
| |\ \ \ | | | | | | | | | | | | | | | | | | | | | Add a systime-fix plugin allowing an embedded system to validate certificates if the system time has not been synchronized after boot. Certificates of established tunnels can be re-validated after the system time gets valid. | |||||
| | * | | | systime-fix disables certificate lifetime validation if system time not synced | Martin Willi | 2013-02-19 | 4 | -0/+326 | |
| | | | | | | | | | | | | | | | | | | | | | | | | | The system time can be periodically checked. If it gets valid, certificates get rechecked with the current lifetime. If certificates are invalid, associated IKE_SAs can be closed or reauthenticated. | |||||
| | * | | | Add a stub for systime-fix, a plugin handling certificate lifetimes gracefully | Martin Willi | 2013-02-19 | 3 | -0/+119 | |
| | | |/ | |/| | ||||||
| * | | | Merge branch 'vip-shunts' | Martin Willi | 2013-03-01 | 1 | -11/+6 | |
| |\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Installs bypass policies for the physical address if a virtual address is assigned, and installs a proper source route to actually use the physical address for bypassed destinations. Conflicts: src/libcharon/plugins/unity/unity_handler.c | |||||
| | * | | | Include local address for Unity Split-Exclude shunt policies | Martin Willi | 2013-02-20 | 1 | -10/+5 | |
| | | | | | | | | | | | | | | | | | | | | | If we use a virtual IP, having a shunt policy for just that wouldn't work, as we want a shunt bypass using the local address. | |||||
| * | | | | Merge branch 'opaque-ports' | Martin Willi | 2013-03-01 | 5 | -9/+11 | |
| |\ \ \ \ | |/ / / |/| | | | | | | | | | | | Adds a %opaque port option and support for port ranges in left/rightprotoport. Currently not supported by any of our kernel backends. | |||||
| | * | | | Pass complete port range over stroke interface for more flexibility | Martin Willi | 2013-02-21 | 1 | -14/+4 | |
| | | | | | ||||||
| | * | | | Use a complete port range in traffic_selector_create_from_{subnet,cidr} | Martin Willi | 2013-02-21 | 5 | -12/+22 | |
| | |/ / | ||||||
| * | | | treat IF-M and IF-TNCCS remediation instructions/parameters in an equal way | Andreas Steffen | 2013-02-19 | 3 | -97/+198 | |
| | | | | ||||||
| * | | | Streamlined log messages in ipseckey plugin | Andreas Steffen | 2013-02-19 | 2 | -58/+30 | |
| | | | | ||||||
| * | | | ipseckey: Report IPSECKEYs with invalid DNSSEC security state | Reto Guadagnini | 2013-02-19 | 1 | -2/+12 | |
| | | | | ||||||
| * | | | ipseckey: Added "enable" option for the IPSECKEY plugin to strongswan.conf | Reto Guadagnini | 2013-02-19 | 1 | -3/+16 | |
| | | | | ||||||
| * | | | Added ipseckey plugin, which provides support for public keys in IPSECKEY RRs | Reto Guadagnini | 2013-02-19 | 7 | -0/+852 | |
| | | | | ||||||
| * | | | added missing return statement | Andreas Steffen | 2013-02-19 | 1 | -0/+1 | |
| | | | | ||||||
 |
index : tteras/strongswan | |
| tteras' strongSwan tree | gitolite |
| aboutsummaryrefslogtreecommitdiffstats |