| Commit message (Collapse) | Author | Age | Files | Lines | ||
|---|---|---|---|---|---|---|
| ... | ||||||
| * | Moved packet_t and tun_device_t to networking folder | Tobias Brunner | 2012-10-24 | 1 | -1/+1 | |
| | | ||||||
| * | Raise a bus alert when IKE message body parsing fails | Martin Willi | 2012-10-24 | 1 | -0/+2 | |
| | | ||||||
| * | Respect IKE version while selecting an ike_cfg as responder | Martin Willi | 2012-10-24 | 1 | -1/+2 | |
| | | ||||||
| * | Ensure UNSUPPORTED_CRITICAL_PAYLOAD notify contains correct payload type | Tobias Brunner | 2012-09-28 | 1 | -0/+1 | |
| | | ||||||
| * | Made IP address enumeration more flexible | Tobias Brunner | 2012-09-21 | 3 | -3/+3 | |
| | | | | | Also added an option to enumerate addresses on ignored interfaces. | |||||
| * | Don't ignore loopback devices and allow addresses on them being enumerated | Tobias Brunner | 2012-09-21 | 3 | -3/+3 | |
| | | ||||||
| * | Derive a dynamic TS to multiple virtual IPs | Martin Willi | 2012-09-18 | 1 | -39/+61 | |
| | | ||||||
| * | Add AUTH_RULE_IDENTITY_LOOSE which allows to use IDr loosely as initiator | Tobias Brunner | 2012-09-18 | 1 | -1/+2 | |
| | | | | | | | If it is set on an auth config IDr will not be sent, and later the configured identity will not only be checked against the returned IDr, but also against other identities contained in the responder's certificate. | |||||
| * | Don't use host address for dynamic TS in IKEv2 if a virtual IP was expected | Martin Willi | 2012-09-11 | 1 | -1/+33 | |
| | | ||||||
| * | Send FAILED_CP_REQUIRED if a configuration payload was expected, but not ↵ | Martin Willi | 2012-09-11 | 1 | -0/+9 | |
| | | | | | received | |||||
| * | Pass the full list of pools to acquire_address, enumerate in providers | Martin Willi | 2012-09-11 | 1 | -20/+6 | |
| | | | | | | | | | If the provider has access to the full pool list, it can enumerate them twice, for example to search for existing leases first, and only search for new leases in a second step. Fixes lease enumeration in attr-sql using multiple pools. | |||||
| * | Add a responder narrow() hook to change TS in the kernel, but not on the wire | Martin Willi | 2012-09-11 | 1 | -1/+26 | |
| | | ||||||
| * | Add uniqueids=never to ignore INITIAL_CONTACT notifies | Tobias Brunner | 2012-09-10 | 1 | -1/+2 | |
| | | | | | | | With uniqueids=no the daemon still deletes any existing IKE_SA with the same peer if an INITIAL_CONTACT notify is received. With this new option it also ignores these notifies. | |||||
| * | Trigger ike_updown event caused by retransmits only after reestablish() has ↵ | Tobias Brunner | 2012-09-06 | 1 | -5/+0 | |
| | | | | | | | | | been called This allows listeners to migrate to the new IKE_SA with the ike_reestablish event without having to worry about an ike_updown event for the old IKE_SA. | |||||
| * | Clear virtual IPs before storing assigned ones on the IKE_SA | Tobias Brunner | 2012-09-05 | 1 | -0/+4 | |
| | | | | | | Otherwise we'll end up with duplicate or invalid VIPs stored on the IKE_SA. | |||||
| * | Merge branch 'multi-vip' | Martin Willi | 2012-08-31 | 3 | -88/+159 | |
| |\ | | | | | | | | | | | | | Brings support for multiple virtual IPs and multiple pools in left/rigthsourceip definitions. Also introduces the new left/rightdns options to configure requested DNS server address family and respond with multiple connection specific servers. | |||||
| | * | Request and acquire multiple virtual IPs in IKEv2 configuration payload | Martin Willi | 2012-08-30 | 1 | -49/+67 | |
| | | | ||||||
| | * | Pass all configured pool names to attribute provider enumerator | Martin Willi | 2012-08-30 | 1 | -2/+9 | |
| | | | ||||||
| | * | Pass a list instead of a single virtual IP to attribute enumerators | Martin Willi | 2012-08-30 | 1 | -11/+36 | |
| | | | ||||||
| | * | Support multiple address pools configured on a peer_cfg | Martin Willi | 2012-08-30 | 1 | -3/+11 | |
| | | | ||||||
| | * | Support multiple virtual IPs on peer_cfg and ike_sa classes | Martin Willi | 2012-08-30 | 3 | -55/+68 | |
| | | | ||||||
| * | | Log the proper type for virtual EAP methods | Tobias Brunner | 2012-08-31 | 1 | -1/+5 | |
| | | | ||||||
| * | | Encode EAP-Naks in expanded format if we got an expanded type request | Tobias Brunner | 2012-08-31 | 1 | -2/+2 | |
| | | | | | | | | | | | Since methods defined by the IETF (vendor ID 0) could also be encoded in expanded type format the previous check was insufficient. | |||||
| * | | Allow clients to request a configured EAP method via EAP-Nak | Tobias Brunner | 2012-08-31 | 1 | -4/+24 | |
| | | | ||||||
| * | | Virtual EAP methods handle EAP-Naks themselves | Tobias Brunner | 2012-08-31 | 1 | -5/+17 | |
| | | | ||||||
| * | | Send EAP-Nak with supported types if requested type is unsupported | Tobias Brunner | 2012-08-31 | 1 | -2/+4 | |
| |/ | ||||||
| * | Moved packet_t to libstrongswan | Tobias Brunner | 2012-08-08 | 1 | -1/+1 | |
| | | ||||||
| * | Replaced usages of CHARON_*_PORT with calls to get_port(). | Tobias Brunner | 2012-08-08 | 1 | -2/+6 | |
| | | ||||||
| * | Make the UDP ports charon listens for packets on (and uses as source ports) ↵ | Tobias Brunner | 2012-08-08 | 1 | -5/+5 | |
| | | | | | configurable. | |||||
| * | Clean up error handling in keymat_v2_t | Martin Willi | 2012-07-16 | 1 | -87/+65 | |
| | | ||||||
| * | Add a return value to hasher_t.allocate_hash() | Martin Willi | 2012-07-16 | 3 | -10/+42 | |
| | | ||||||
| * | Add a return value to crypter_t.set_key() | Martin Willi | 2012-07-16 | 1 | -2/+16 | |
| | | ||||||
| * | Check rng return value when generating ME CONNECT_ID and KEY | Tobias Brunner | 2012-07-16 | 1 | -2/+14 | |
| | | ||||||
| * | Check rng return value when generating COOKIE2 during MOBIKE | Tobias Brunner | 2012-07-16 | 1 | -6/+11 | |
| | | ||||||
| * | Check rng return value when generating fake NAT detection payloads | Tobias Brunner | 2012-07-16 | 1 | -2/+2 | |
| | | ||||||
| * | Nonce: Let get_nonce, allocate_nonce return boolean | Reto Buerki | 2012-07-16 | 2 | -3/+19 | |
| | | ||||||
| * | Add a return value to prf_t.set_key() | Martin Willi | 2012-07-16 | 1 | -13/+16 | |
| | | ||||||
| * | Add a return value to prf_t.allocate_bytes() | Martin Willi | 2012-07-16 | 1 | -11/+26 | |
| | | ||||||
| * | Add a return value to keymat_v2_t.get_auth_octets() | Martin Willi | 2012-07-16 | 3 | -17/+24 | |
| | | ||||||
| * | Add a return value to keymat_v2_t.get_psk_sig() | Martin Willi | 2012-07-16 | 4 | -24/+39 | |
| | | ||||||
| * | prf_plus_create() can return NULL on failure | Martin Willi | 2012-07-16 | 1 | -0/+10 | |
| | | ||||||
| * | Add a return value to prf_plus_t.allocate_bytes() | Martin Willi | 2012-07-16 | 1 | -13/+62 | |
| | | ||||||
| * | Add a return value to signer_t.set_key() | Martin Willi | 2012-07-16 | 1 | -2/+14 | |
| | | ||||||
| * | Add a return value to aead_t.set_key() | Martin Willi | 2012-07-16 | 1 | -2/+10 | |
| | | ||||||
| * | Simplify NAT-D payload creation if UDP encapsulation is forced | Tobias Brunner | 2012-07-13 | 1 | -2/+2 | |
| | | | | | | We don't need any address lookups in that case as the content of the payload is generated randomly anyway. | |||||
| * | Ignore a received %any virtual IP for installation | Martin Willi | 2012-06-26 | 1 | -1/+2 | |
| | | ||||||
| * | Centralized thread cancellation in processor_t | Tobias Brunner | 2012-06-25 | 1 | -8/+19 | |
| | | | | | | | | | | | This ensures that no threads are active when plugins and the rest of the daemon are unloaded. callback_job_t was simplified a lot in the process as its main functionality is now contained in processor_t. The parent-child relationships were abandoned as these were only needed to simplify job cancellation. | |||||
| * | Try to rekey without KE exchange if peer returns INVALID_KE_PAYLOAD(NONE) | Martin Willi | 2012-06-08 | 1 | -1/+8 | |
| | | | | | | | According to RFC5996, implementations should just ignore the KE payload if they select a non-PFS proposals. Some implementations don't, but return MODP_NONE in INVALID_KE_PAYLOAD, hence we accept that, too. | |||||
| * | As responder, enforce the same configuration while rekeying CHILD_SAs | Martin Willi | 2012-06-06 | 3 | -1/+19 | |
| | | ||||||
| * | Fix MOBIKE address update if responder address changed. | Tobias Brunner | 2012-05-25 | 1 | -2/+2 | |
| | | | | | | Use the source address of the current MOBIKE message as peer address instead of assuming the address cached on the IKE_SA is still valid. | |||||
 |
index : tteras/strongswan | |
| tteras' strongSwan tree | gitolite |
| aboutsummaryrefslogtreecommitdiffstats |