| Commit message (Collapse) | Author | Age | Files | Lines | |
|---|---|---|---|---|---|
| * | ike: Do not send initial contact only for UNIQUE_NEVER | Thomas Egerer | 2017-11-02 | 1 | -2/+1 |
| | | | | | Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com> | ||||
| * | ike: Add configuration option to switch to preferring supplied proposals ↵ | Tobias Brunner | 2016-06-17 | 1 | -3/+5 |
| | | | | | over local ones | ||||
| * | ike-cfg: Add option to prefer supplied proposals over locally configured ones | Tobias Brunner | 2016-06-17 | 1 | -2/+2 |
| | | |||||
| * | Use standard unsigned integer types | Andreas Steffen | 2016-03-24 | 1 | -6/+6 |
| | | |||||
| * | ikev1: Set protocol ID and SPIs in INITIAL-CONTACT notification payloads | Tobias Brunner | 2015-03-06 | 1 | -2/+13 |
| | | | | | | | | The payload we sent before is not compliant with RFC 2407 and thus some peers might abort negotiation (e.g. with an INVALID-PROTOCOL-ID error). Fixes #819. | ||||
| * | ikev1: Send INITIAL_CONTACT notify in Main Mode | Thomas Egerer | 2014-10-30 | 1 | -0/+28 |
| | | | | | | | | | | We currently send the notify in Main Mode only, as it is explicitly not allowed by RFC 2407 to send (unprotected) notifications in Aggressive Mode. To make that work, we'd need to handle that notify in Aggressive Mode, which could allow a MitM to inject such notifies and do some harm. Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com> | ||||
| * | ikev1: Defer Mode Config push after CHILD adoption when using XAuth | Martin Willi | 2014-08-25 | 1 | -2/+7 |
| | | |||||
| * | ikev1: Defer Mode Config push after CHILD adoption and reauth detection | Martin Willi | 2014-08-25 | 1 | -5/+17 |
| | | | | | | | | | When an initiator starts reauthentication on a connection that uses push mode to assign a virtual IP, we can't execute the Mode Config before releasing the virtual IP. Otherwise we would request a new and different lease, which the client probably can't handle. Defer Mode Config execution, so the same IP gets first released then reassigned during reauthentication. | ||||
| * | payload: Use common prefixes for all payload type identifiers | Martin Willi | 2014-06-04 | 1 | -8/+8 |
| | | | | | | The old identifiers did not use a proper namespace and often clashed with other defines. | ||||
| * | ikev1: implement mode config push mode | Martin Willi | 2013-09-04 | 1 | -15/+51 |
| | | |||||
| * | Delete IKE_SAs if responder does not initiate XAuth exchange within a ↵ | Tobias Brunner | 2013-03-19 | 1 | -1/+8 |
| | | | | | certain time frame | ||||
| * | Add support for draft-ietf-ipsec-nat-t-ike-03 and earlier | Volker Rümelin | 2012-12-19 | 1 | -2/+4 |
| | | | | | | This adds support for early versions of the draft that eventually resulted in RFC 3947. | ||||
| * | Support multiple address pools configured on a peer_cfg | Martin Willi | 2012-08-30 | 1 | -1/+1 |
| | | |||||
| * | Support multiple virtual IPs on peer_cfg and ike_sa classes | Martin Willi | 2012-08-30 | 1 | -2/+2 |
| | | |||||
| * | As a responder, don't start a TRANSACTION request if we expect one from the ↵ | Martin Willi | 2012-06-29 | 1 | -1/+2 |
| | | | | | initiator | ||||
| * | Queue a mode config task as responder if we need a virtual IP | Martin Willi | 2012-06-27 | 1 | -2/+8 |
| | | |||||
| * | Add basic support for XAuth responder authentication | Martin Willi | 2012-06-27 | 1 | -4/+5 |
| | | |||||
| * | Enforce uniqueids=keep only for non-XAuth Main/Agressive Modes | Martin Willi | 2012-06-25 | 1 | -12/+14 |
| | | |||||
| * | Enforce uniqueness policy in IKEv1 main and aggressive modes | Martin Willi | 2012-06-08 | 1 | -0/+13 |
| | | |||||
| * | Added support for IKEv1 IPComp proposals in SA payload. | Tobias Brunner | 2012-05-24 | 1 | -2/+2 |
| | | |||||
| * | Switch to alternative peer config in IKEv1 Main and Aggressive Mode. | Tobias Brunner | 2012-05-21 | 1 | -13/+17 |
| | | |||||
| * | Flush task queues explicitly, not implicitly if task returns ALREADY_DONE | Martin Willi | 2012-05-21 | 1 | -0/+4 |
| | | |||||
| * | Remove executable flag from source files. | Tobias Brunner | 2012-05-18 | 1 | -0/+0 |
| | | |||||
| * | allow private algorithms | Andreas Steffen | 2012-05-05 | 1 | -2/+8 |
| | | |||||
| * | Set selected proposal on IKEv1 SA, don't pass it separately to Phase 1 helper | Martin Willi | 2012-03-20 | 1 | -6/+6 |
| | | |||||
| * | Invoke authorization hooks for IKEv1 connections | Martin Willi | 2012-03-20 | 1 | -10/+37 |
| | | |||||
| * | Simplified DPD handling by using a task for a single message only | Martin Willi | 2012-03-20 | 1 | -1/+1 |
| | | |||||
| * | Isakmp_dpd task added. | Clavister OpenSource | 2012-03-20 | 1 | -1/+1 |
| | | |||||
| * | Streamlined debug output when initiating IKEv1 IKE_SAs | Martin Willi | 2012-03-20 | 1 | -1/+1 |
| | | |||||
| * | Select IKEv1 configurations by main/aggressive mode option | Martin Willi | 2012-03-20 | 1 | -1/+1 |
| | | |||||
| * | Make use of the new Phase 1 helper class in main mode | Martin Willi | 2012-03-20 | 1 | -579/+73 |
| | | |||||
| * | Fix error handling if no PSK found for main mode | Martin Willi | 2012-03-20 | 1 | -5/+9 |
| | | |||||
| * | Try to detect reauthentication as responder and adopt children to new SA | Martin Willi | 2012-03-20 | 1 | -0/+4 |
| | | |||||
| * | Include peer config overtime in negotiated ISAKMP SA lifetime | Martin Willi | 2012-03-20 | 1 | -2/+3 |
| | | |||||
| * | Queue Mode Config tasks after main mode as initiator, not as responder | Martin Willi | 2012-03-20 | 1 | -6/+6 |
| | | |||||
| * | Implemented migration of Main Mode task | Martin Willi | 2012-03-20 | 1 | -0/+13 |
| | | |||||
| * | Separated libcharon/sa directory with ikev1 and ikev2 subfolders | Martin Willi | 2012-03-20 | 1 | -0/+1155 |
 |
index : tteras/strongswan | |
| tteras' strongSwan tree | gitolite |
| aboutsummaryrefslogtreecommitdiffstats |