| Commit message (Collapse) | Author | Age | Files | Lines | ||
|---|---|---|---|---|---|---|
| ... | ||||||
| | * | Replaced usages of CHARON_*_PORT with calls to get_port(). | Tobias Brunner | 2012-08-08 | 1 | -1/+2 | |
| | | | ||||||
| | * | Make the UDP ports charon listens for packets on (and uses as source ports) ↵ | Tobias Brunner | 2012-08-08 | 1 | -1/+1 | |
| | | | | | | | | | configurable. | |||||
| * | | Use actual daemon name to enable XAuth/PSK with aggressive mode | Martin Willi | 2012-08-10 | 1 | -2/+3 | |
| |/ | ||||||
| * | Remove queued IKEv1 message before processing it | Martin Willi | 2012-08-08 | 1 | -3/+5 | |
| | | | | | | Avoids destruction or processing of a queued message in recursive process_message() call. | |||||
| * | Block XAuth transaction on established IKE_SAs, but allow Mode Config | Martin Willi | 2012-08-03 | 1 | -1/+1 | |
| | | ||||||
| * | Lookup IKEv1 PSK even if the peer identity is not known | Martin Willi | 2012-07-31 | 1 | -1/+1 | |
| | | ||||||
| * | Implement late peer config switching after XAuth authentication | Martin Willi | 2012-07-26 | 1 | -15/+80 | |
| | | | | | | | | If additional authentication constraints, such as group membership, is not fulfilled by an XAuth backend, we search for another peer configuration that fulfills all constraints, including those from phase1. | |||||
| * | Check if XAuth round complies to configured authentication round | Martin Willi | 2012-07-26 | 1 | -7/+18 | |
| | | ||||||
| * | Merge auth config items added from XAuth backends to IKE_SA | Martin Willi | 2012-07-26 | 1 | -0/+1 | |
| | | ||||||
| * | Refactored error handling in keymat_v1_t | Martin Willi | 2012-07-16 | 1 | -25/+27 | |
| | | ||||||
| * | Cleaned up memory management and return values for encryption payload | Martin Willi | 2012-07-16 | 1 | -1/+4 | |
| | | ||||||
| * | Add a return value to hasher_t.allocate_hash() | Martin Willi | 2012-07-16 | 2 | -8/+31 | |
| | | ||||||
| * | Add a return value to keymat_v1_t.{get,update,confirm}_iv | Martin Willi | 2012-07-16 | 2 | -13/+31 | |
| | | ||||||
| * | Add a return value to crypter_t.set_key() | Martin Willi | 2012-07-16 | 1 | -3/+6 | |
| | | ||||||
| * | Add a return value to crypter_t.decrypt() | Martin Willi | 2012-07-16 | 1 | -2/+1 | |
| | | ||||||
| * | Add a return value to crypter_t.encrypt | Martin Willi | 2012-07-16 | 1 | -2/+1 | |
| | | ||||||
| * | Check rng return value when generating IKEv1 message IDs | Tobias Brunner | 2012-07-16 | 1 | -8/+20 | |
| | | ||||||
| * | Check rng return value when generating fake NAT detection payloads | Tobias Brunner | 2012-07-16 | 1 | -2/+3 | |
| | | ||||||
| * | Nonce: Let get_nonce, allocate_nonce return boolean | Reto Buerki | 2012-07-16 | 2 | -2/+12 | |
| | | ||||||
| * | Add a return value to prf_t.set_key() | Martin Willi | 2012-07-16 | 1 | -10/+25 | |
| | | ||||||
| * | Add a return value to prf_t.allocate_bytes() | Martin Willi | 2012-07-16 | 1 | -11/+45 | |
| | | ||||||
| * | Use a bool return value in keymat_v1_t.get_hash_phase2() | Martin Willi | 2012-07-16 | 2 | -27/+27 | |
| | | ||||||
| * | Add a return value to keymat_v1_t.get_hash() | Martin Willi | 2012-07-16 | 4 | -17/+35 | |
| | | ||||||
| * | Add a return value to prf_t.get_bytes() | Martin Willi | 2012-07-16 | 1 | -9/+19 | |
| | | ||||||
| * | prf_plus_create() can return NULL on failure | Martin Willi | 2012-07-16 | 1 | -0/+10 | |
| | | ||||||
| * | Add a return value to prf_plus_t.allocate_bytes() | Martin Willi | 2012-07-16 | 1 | -4/+14 | |
| | | ||||||
| * | Add a return value to aead_t.set_key() | Martin Willi | 2012-07-16 | 1 | -1/+2 | |
| | | ||||||
| * | Add a return value to aead_t.encrypt() | Martin Willi | 2012-07-16 | 1 | -1/+2 | |
| | | ||||||
| * | Send cert request based on peers configured authentication class | Martin Willi | 2012-07-10 | 1 | -3/+30 | |
| | | ||||||
| * | Don't send CERTREQs when initiating aggressive mode PSK | Martin Willi | 2012-07-09 | 1 | -0/+4 | |
| | | ||||||
| * | As a responder, don't start a TRANSACTION request if we expect one from the ↵ | Martin Willi | 2012-06-29 | 2 | -2/+4 | |
| | | | | | initiator | |||||
| * | Defer quick mode initiation if we expect a mode config request | Martin Willi | 2012-06-27 | 1 | -1/+20 | |
| | | ||||||
| * | Queue a mode config task as responder if we need a virtual IP | Martin Willi | 2012-06-27 | 2 | -4/+16 | |
| | | ||||||
| * | Add basic support for XAuth responder authentication | Martin Willi | 2012-06-27 | 2 | -8/+10 | |
| | | ||||||
| * | support Cisco Unity VID | Andreas Steffen | 2012-06-25 | 1 | -3/+6 | |
| | | ||||||
| * | Enforce uniqueids=keep based on XAuth identity | Martin Willi | 2012-06-25 | 1 | -0/+6 | |
| | | ||||||
| * | Don't send XAUTH_OK if a hook prevents SA to establish | Martin Willi | 2012-06-25 | 1 | -4/+14 | |
| | | ||||||
| * | Enforce uniqueids=keep only for non-XAuth Main/Agressive Modes | Martin Willi | 2012-06-25 | 2 | -28/+28 | |
| | | ||||||
| * | Add missing XAuth name variable when complaining about missing XAuth backend | Martin Willi | 2012-06-25 | 1 | -1/+1 | |
| | | ||||||
| * | Fix SIGSEGV if kernel install fails during Quick Mode as responder. | Tobias Brunner | 2012-06-22 | 1 | -4/+8 | |
| | | ||||||
| * | Adopt children as XAuth initiator (which is IKE responder) | Martin Willi | 2012-06-14 | 1 | -2/+2 | |
| | | ||||||
| * | Require a scary option to respond to Aggressive Mode PSK requests | Martin Willi | 2012-06-14 | 1 | -0/+17 | |
| | | | | | | | | | While Aggressive Mode PSK is widely used, it is known to be subject to dictionary attacks by passive attackers. We don't complain as initiator to be compatible with existing (insecure) setups, but require a scary strongswan.conf option if someone wants to use it as responder. | |||||
| * | Enforce uniqueness policy in IKEv1 main and aggressive modes | Martin Willi | 2012-06-08 | 2 | -0/+29 | |
| | | ||||||
| * | While checking for redundant quick modes, compare traffic selectors | Martin Willi | 2012-06-08 | 1 | -0/+22 | |
| | | | | | | If a configuration is instanced more than once using narrowing, we should keep all unique quick modes up during rekeying. | |||||
| * | Initiate quick mode rekeying with narrowed traffic selectors | Martin Willi | 2012-06-08 | 1 | -1/+18 | |
| | | ||||||
| * | Use traffic selectors passed to quick mode constructor as initiator | Martin Willi | 2012-06-08 | 1 | -2/+10 | |
| | | ||||||
| * | Instead of rekeying, delete a quick mode if we have a fresher instance | Martin Willi | 2012-06-08 | 1 | -6/+42 | |
| | | | | | | | | | If both peers initiate quick mode rekeying simultaneously, we end up with duplicate SAs for a configuration. This can't be avoided, nor do the standards provide an appropriate solution. Instead of closing one SA immediately, we keep both. But once rekeying triggers, we don't refresh the SA with the shorter soft lifetime, but delete it. | |||||
| * | Added log message if peer does not accept/provide IPComp proposal. | Tobias Brunner | 2012-05-24 | 1 | -2/+12 | |
| | | ||||||
| * | Added support to negotiate IPComp during Quick Mode. | Tobias Brunner | 2012-05-24 | 1 | -11/+91 | |
| | | ||||||
| * | Added support for IKEv1 IPComp proposals in SA payload. | Tobias Brunner | 2012-05-24 | 3 | -6/+6 | |
| | | ||||||
 |
index : tteras/strongswan | |
| tteras' strongSwan tree | gitolite |
| aboutsummaryrefslogtreecommitdiffstats |