| Commit message (Collapse) | Author | Age | Files | Lines | ||
|---|---|---|---|---|---|---|
| ... | ||||||
| * | Destroy existing IKE_SAs with same identities when receiving INITIAL_CONTACT | Martin Willi | 2011-01-05 | 3 | -4/+33 | |
| | | ||||||
| * | Send INITIAL_CONTACT for the first IKE_SA if it has a unique policy | Martin Willi | 2011-01-05 | 3 | -16/+66 | |
| | | ||||||
| * | Migrated ike_sa_manager_t to INIT/METHOD macros, some cleanups | Martin Willi | 2011-01-05 | 1 | -189/+180 | |
| | | ||||||
| * | Provide CRLs received in CERT payloads to trustchain verification | Martin Willi | 2011-01-05 | 1 | -1/+9 | |
| | | ||||||
| * | Include the used reserved bytes from ID payloads in AUTH calculation | Martin Willi | 2011-01-05 | 11 | -39/+126 | |
| | | ||||||
| * | Migrated psk/pubkey_authenticators to INIT/METHOD macros | Martin Willi | 2011-01-05 | 2 | -84/+70 | |
| | | ||||||
| * | Moved check if packet already encoded to ike_sa, avoids message() hook ↵ | Martin Willi | 2011-01-05 | 1 | -0/+5 | |
| | | | | | invocation twice | |||||
| * | Move critical bit checking to ike_sa, notify payload includes unsupported ↵ | Martin Willi | 2011-01-05 | 3 | -11/+61 | |
| | | | | | payload type | |||||
| * | Handle all error notifies in CREATE_CHILD_SA exchanges | Martin Willi | 2011-01-05 | 1 | -0/+14 | |
| | | ||||||
| * | Ingore messages with exchange type altered to UNDEFINED in message() hook | Martin Willi | 2011-01-05 | 1 | -0/+8 | |
| | | ||||||
| * | Moved message()-hook invocation to generate_message(), catch pre-generated ↵ | Martin Willi | 2011-01-05 | 2 | -2/+1 | |
| | | | | | IKE_SA_INITs, too | |||||
| * | Support manually triggerd DPD check, even if DPD disabled in config | Martin Willi | 2011-01-05 | 1 | -11/+10 | |
| | | ||||||
| * | eliminated whitespace | Andreas Steffen | 2010-12-21 | 1 | -1/+1 | |
| | | ||||||
| * | Migrated child_create_t to INIT/METHOD macros | Andreas Steffen | 2010-12-21 | 1 | -83/+55 | |
| | | ||||||
| * | Do not use TFC padding if peer does not support ESPv3 | Martin Willi | 2010-12-20 | 3 | -11/+31 | |
| | | ||||||
| * | Added a TFC padding option to child_cfg | Martin Willi | 2010-12-20 | 1 | -0/+2 | |
| | | ||||||
| * | Implemented Traffic Flow Confidentiality padding in kernel_interface | Martin Willi | 2010-12-20 | 1 | -1/+2 | |
| | | ||||||
| * | Install selectors on transport mode IPsec SAs. | Jiri Bohac | 2010-12-13 | 1 | -1/+1 | |
| | | | | | | | | | | | | | | | | | This fixes several test cases in IKEv2_Self_Test (part of the IPv6 Ready Logo Program) which is required for USGv6 certification, namely: - IKEv2.EN.I.1.1.7.1, IKEv2.EN.I.1.1.7.1: Narrowing the range of members of the set of traffic selectors - IKEv2.EN.R.1.1.7.3: Narrowing multiple traffic selector When traffic selectors of a triggered SA are narrowed by the responder, the installed policy and the broader trap policy share the same reqid. Without selectors on the IPsec SA packets matching the trap policy, but not the narrowed policy, would incorrectly be handled by that IPsec SA. Since only one selector can be specified per IPsec SA, there is currently no solution for tunnel mode SAs. | |||||
| * | Never register IKE_SA during checkout_new, as rekeying keeps it checked out | Martin Willi | 2010-12-07 | 2 | -18/+2 | |
| | | ||||||
| * | Guarantee entry->other is set when calling put_connected_peers | Thomas Egerer | 2010-12-06 | 1 | -1/+7 | |
| | | | | | | | | | | | | Given the original intent of entry->host, the check for DoS attacks, it can happen that this value remains NULL when an entry is created. This is particularly awkward if put_connected_peers is called to check if a connection to a given peer already exists, since it takes the address family into consideration (git commit b74219d0) which is gleaned from entry->host. This patch guarantees that entry->other is a clone of host before put_connected_peers is called. | |||||
| * | Do not checkin a previously destroyed SA | Thomas Egerer | 2010-11-16 | 1 | -1/+4 | |
| | | ||||||
| * | Extend connected peers by peer family | Thomas Egerer | 2010-11-12 | 1 | -5/+16 | |
| | | | | | | This allows for simultanious IPv4 and IPv6 tunnel for same peers with matching identities. | |||||
| * | Do not add additional addresses to MOBIKE path probing messages. | Tobias Brunner | 2010-10-12 | 1 | -10/+12 | |
| | | ||||||
| * | Change behavior of responder during roaming. | Tobias Brunner | 2010-10-12 | 1 | -16/+17 | |
| | | | | | | | If the current source address is not available anymore, the responder uses ike_mobike_t.roam, thus, uses multiple address combinations when trying to notify the initiator. | |||||
| * | Allow responder to use ike_mobike_t.roam. | Tobias Brunner | 2010-10-12 | 1 | -1/+7 | |
| | | | | | After getting a response the responder updates the IPsec SAs. | |||||
| * | Send list of additional addresses even if current path is still valid. | Tobias Brunner | 2010-10-12 | 1 | -0/+11 | |
| | | ||||||
| * | Extracted path checking in ike_sa_t.roam into separate functions. | Tobias Brunner | 2010-10-12 | 1 | -46/+68 | |
| | | ||||||
| * | Added support for responders to change their address via MOBIKE. | Tobias Brunner | 2010-10-12 | 1 | -0/+20 | |
| | | | | | | | | If the original responder updates its list of additional addresses we check if the remote endpoint changed and update the IPsec SAs if it did, as we assume the original address became unavailable and the responder already updated the SAs on its side. | |||||
| * | Explicitly configure MOBIKE tasks to update the list of additional addresses. | Tobias Brunner | 2010-10-12 | 3 | -2/+15 | |
| | | ||||||
| * | Improved check for first IKE_AUTH message in ike_mobike task. | Tobias Brunner | 2010-10-12 | 1 | -3/+6 | |
| | | | | | | If the original responder initiated a MOBIKE exchange, the previous check was not always correct. | |||||
| * | Migrated ike_mobike task to INIT/METHOD macros. | Tobias Brunner | 2010-10-12 | 1 | -67/+46 | |
| | | ||||||
| * | Simplified apply_port function in mobike task. | Tobias Brunner | 2010-10-12 | 1 | -16/+9 | |
| | | ||||||
| * | Do not update hosts based on retransmitted messages. | Tobias Brunner | 2010-10-12 | 2 | -15/+23 | |
| | | ||||||
| * | Do not update remote host if we are behind a NAT. | Tobias Brunner | 2010-10-12 | 1 | -4/+2 | |
| | | ||||||
| * | NOTIFY error message types include 16383 | Andreas Steffen | 2010-09-29 | 1 | -1/+1 | |
| | | ||||||
| * | Adapted child_sa_t to changed kernel interface. | Tobias Brunner | 2010-09-02 | 1 | -25/+49 | |
| | | ||||||
| * | Added an option to specify the type of a policy to kernel_ipsec.add_policy. | Tobias Brunner | 2010-09-02 | 1 | -18/+18 | |
| | | | | | | This will later allow us to support pluto's passthrough and drop policies in charon. | |||||
| * | Replaced the protocol argument in add_policy with an optional SPI for an AH SA. | Tobias Brunner | 2010-09-02 | 1 | -18/+37 | |
| | | ||||||
| * | Refer to scheduler and processor via lib and not hydra. | Tobias Brunner | 2010-09-02 | 8 | -36/+30 | |
| | | ||||||
| * | Refer to kernel interface via hydra and not charon. | Tobias Brunner | 2010-09-02 | 6 | -58/+62 | |
| | | ||||||
| * | Removed references to protocol_id_t from kernel interface. | Tobias Brunner | 2010-09-02 | 1 | -37/+65 | |
| | | | | | | Instead we use the actual IP protocol identifier (the conversion now happens in child_sa_t and kernel_handler_t). | |||||
| * | Migrated child_sa_t to INIT/METHOD macros. | Tobias Brunner | 2010-09-02 | 1 | -202/+132 | |
| | | ||||||
| * | Refer to scheduler via hydra and not charon. | Tobias Brunner | 2010-09-02 | 6 | -21/+23 | |
| | | ||||||
| * | Refer to processor via hydra and not charon. | Tobias Brunner | 2010-09-02 | 6 | -9/+14 | |
| | | ||||||
| * | Use the AAA Identity for EAP authentication, if given | Martin Willi | 2010-08-31 | 2 | -1/+14 | |
| | | ||||||
| * | Moved EAP type/code definitions to a seprate header file in libstrongswan | Martin Willi | 2010-08-31 | 2 | -35/+1 | |
| | | ||||||
| * | Port floating patch partially reversed. | Tobias Brunner | 2010-08-30 | 2 | -12/+8 | |
| | | | | | | | If MOBIKE is enabled, we do have to switch to port 4500 with the IKE_AUTH request, that is, before we know whether the other peer actually supports MOBIKE or not. | |||||
| * | Slightly refactored port floating. | Tobias Brunner | 2010-08-30 | 5 | -35/+39 | |
| | | | | | In case of MOBIKE, only float to port 4500 if the other peer actually supports MOBIKE. | |||||
| * | Fixed ME after introduction of AEAD wrapper. | Tobias Brunner | 2010-08-30 | 1 | -1/+1 | |
| | | ||||||
| * | Migrated delete_payload to INIT/METHOD macros, replaced iterator | Martin Willi | 2010-08-25 | 1 | -9/+8 | |
| | | ||||||
 |
index : tteras/strongswan | |
| tteras' strongSwan tree | gitolite |
| aboutsummaryrefslogtreecommitdiffstats |