| Commit message (Collapse) | Author | Age | Files | Lines | ||
|---|---|---|---|---|---|---|
| ... | ||||||
| * | Clean up IKE_SA state if IKE_SA_INIT request does not have message ID 0 | Martin Willi | 2013-03-11 | 1 | -0/+4 | |
| | | ||||||
| * | Ignore fourth Qick Mode message sent by Windows servers. | Martin Willi | 2013-03-11 | 1 | -0/+9 | |
| | | | | | Initial patch by Paul Stewart, fixes #289. | |||||
| * | As Quick Mode initiator, select a subset of the proposed and the returned TS | Martin Willi | 2013-03-07 | 1 | -4/+11 | |
| | | | | | | | | | Cisco 5505 firewalls don't return the port if we send a specific one, letting the is_contained_in() checks fail. Using get_subset() selection builds the Quick Mode correctly with the common subset of selectors. Based on an initial patch from Paul Stewart. | |||||
| * | Merge branch 'multi-eap' | Martin Willi | 2013-03-01 | 2 | -28/+50 | |
| |\ | | | | | | | | | | | Fixes the use of EAP methods in the non-first authentication round if the initiator demands mutual EAP. Also mutual EAP can now be enforced when the initiator sets rightauth=eap, not only with rightauth=any. | |||||
| | * | Apply a mutual EAP auth_cfg not before the EAP method completes | Martin Willi | 2013-02-26 | 2 | -1/+18 | |
| | | | ||||||
| | * | Be a little more verbose why a peer_cfg is inacceptable | Martin Willi | 2013-02-26 | 1 | -8/+16 | |
| | | | ||||||
| | * | Refactor auth_cfg applying to a common function | Martin Willi | 2013-02-26 | 1 | -20/+17 | |
| | | | ||||||
| * | | Merge branch 'ikev1-rekeying' | Martin Willi | 2013-03-01 | 1 | -0/+21 | |
| |\ \ | | | | | | | | | | | | | Migrates Quick Modes to the new Main Mode if an IKEv1 reauthentication replaces the old Main Mode having a uniqueids=replace policy. | |||||
| | * | | When detecting a duplicate IKEv1 SA, adopt children, as it might be a rekeying | Martin Willi | 2013-02-20 | 1 | -0/+21 | |
| | |/ | ||||||
| * | | Merge branch 'opaque-ports' | Martin Willi | 2013-03-01 | 1 | -2/+2 | |
| |\ \ | | | | | | | | | | | | | Adds a %opaque port option and support for port ranges in left/rightprotoport. Currently not supported by any of our kernel backends. | |||||
| | * | | Use a complete port range in traffic_selector_create_from_{subnet,cidr} | Martin Willi | 2013-02-21 | 1 | -2/+2 | |
| | | | | ||||||
| * | | | Without MOBIKE, update remote host only if it is behind NAT | Martin Willi | 2013-03-01 | 1 | -2/+3 | |
| | | | | ||||||
| * | | | Merge branch 'ikev1-mm-retransmits' | Martin Willi | 2013-03-01 | 4 | -45/+55 | |
| |\ \ \ | | | | | | | | | | | | | | | | | | | | | Fixes retransmit of the last Main Mode or IKE_AUTH message, and correctly queues Main Mode messages when processing of the last message is still in progress. | |||||
| | * | | | For IKEv1 Main Mode, use message hash to detect early retransmissions | Martin Willi | 2013-02-25 | 1 | -10/+23 | |
| | | | | | | | | | | | | | | | | | | | | | As the message ID is zero in all Main Mode messages, it can't be used to detect if we are already processing a given message. | |||||
| | * | | | Move initial message dropping to task manager | Martin Willi | 2013-02-25 | 3 | -19/+27 | |
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When the last request message of the initial tunnel setup is retransmitted, we must retransmit the response instead of ignoring the request. Fixes #295. | |||||
| | * | | | Use INIT macro to initialize IKE_SA manager entries | Martin Willi | 2013-02-25 | 1 | -17/+6 | |
| | | |/ | |/| | ||||||
| * | | | Merge branch 'tfc-notify' | Martin Willi | 2013-03-01 | 1 | -0/+9 | |
| |\ \ \ | | | | | | | | | | | | | | | | | Introduces kernel backend features, sends ESP_TFC_PADDING_NOT_SUPPORTED if kernel does not support it. | |||||
| | * | | | Send ESP_TFC_PADDING_NOT_SUPPORTED if the used kernel doesn't support it | Martin Willi | 2013-03-01 | 1 | -0/+9 | |
| | | |/ | |/| | ||||||
| * | | | Trigger an updown event when destroying an IKE_SA based on INITIAL_CONTACT | Tobias Brunner | 2013-02-28 | 1 | -0/+1 | |
| | |/ |/| | | | | | | | In other cases (i.e. when functions return DESTROY_ME) the event should already be triggered, but not in this forced situation. | |||||
| * | | Add a global return_success() method implementation | Martin Willi | 2013-02-14 | 1 | -8/+2 | |
| | | | ||||||
| * | | Merge branch 'ike-dscp' | Martin Willi | 2013-02-14 | 1 | -1/+26 | |
| |\ \ | ||||||
| | * | | Set configured DSCP value while generating IKE packets | Martin Willi | 2013-02-06 | 1 | -1/+26 | |
| | |/ | ||||||
| * / | make TNC client authentication type available to IMVs | Andreas Steffen | 2013-02-12 | 1 | -0/+57 | |
| |/ | ||||||
| * | Fix check-in of IKE_SA when IKE_SA_INIT fails and hash table is enabled | Tobias Brunner | 2013-01-24 | 1 | -2/+13 | |
| | | | | | | | | Setting the responder SPI to 0 can only be done while generating the response, otherwise we'd fail to check in the IKE_SA again in case the hash table is enabled. That's because we use the responder SPI as hash value since 5.0.0. | |||||
| * | Avoid a deadlock when installing a trap policy failed | Tobias Brunner | 2013-01-23 | 1 | -1/+5 | |
| | | ||||||
| * | Fix IKE SA inherit API doc | Adrian-Ken Rueegsegger | 2013-01-22 | 1 | -2/+1 | |
| | | ||||||
| * | Properly send IKEv1 packets if no ike_cfg is known yet | Tobias Brunner | 2013-01-14 | 1 | -2/+5 | |
| | | | | | This applies for error notifies. | |||||
| * | Merge branch 'ikev1-fragmentation' | Tobias Brunner | 2013-01-12 | 5 | -25/+406 | |
| |\ | | | | | | | | | | | | | This adds support for the proprietary IKEv1 fragmentation extension. Conflicts: NEWS | |||||
| | * | Added an option to configure the maximum size of a fragment | Tobias Brunner | 2013-01-12 | 1 | -3/+10 | |
| | | | ||||||
| | * | Properly detect fragmentation capabilities | Tobias Brunner | 2013-01-12 | 1 | -3/+27 | |
| | | | | | | | | | Cisco sends 0xc0000000 so we check that part of the VID separately. | |||||
| | * | Added an option that allows to force IKEv1 fragmentation | Tobias Brunner | 2013-01-12 | 2 | -3/+6 | |
| | | | ||||||
| | * | Use a connection specific option to en-/disable IKEv1 fragmentation | Tobias Brunner | 2012-12-24 | 2 | -10/+7 | |
| | | | ||||||
| | * | Include source port in init hash for fragmented messages | Tobias Brunner | 2012-12-24 | 1 | -1/+8 | |
| | | | ||||||
| | * | Add an option to en-/disable IKE fragmentation | Tobias Brunner | 2012-12-24 | 2 | -5/+20 | |
| | | | | | | | | | | | Fragments are always accepted but will not be sent if disabled. The vendor ID is only sent if the option is enabled. | |||||
| | * | Split larger messages into fragments if IKE fragmentation is supported by peer | Tobias Brunner | 2012-12-24 | 1 | -14/+114 | |
| | | | ||||||
| | * | Log added NAT-T vendor IDs | Tobias Brunner | 2012-12-24 | 1 | -0/+1 | |
| | | | ||||||
| | * | Detect a peer's support for IKE fragmentation | Tobias Brunner | 2012-12-24 | 2 | -0/+9 | |
| | | | | | | | | | Fragments are accepted even if this vendor ID is not seen. | |||||
| | * | Map fragmented initial initial Main or Aggressive Mode messages to the same ↵ | Tobias Brunner | 2012-12-24 | 1 | -1/+17 | |
| | | | | | | | | | IKE_SA | |||||
| | * | Allow ID_PROT/AGGRESSIVE messages for established IKE_SAs if they contain ↵ | Tobias Brunner | 2012-12-24 | 1 | -1/+2 | |
| | | | | | | | | | | | | | | | fragments Other implementations send fragments always in an initial message type even for transaction or quick mode exchanges. | |||||
| | * | Don't handle fragmented messages larger than charon.max_packet | Tobias Brunner | 2012-12-24 | 1 | -4/+39 | |
| | | | ||||||
| | * | Don't update an IKE_SA-entry's cached message ID when handling fragments | Tobias Brunner | 2012-12-24 | 1 | -1/+4 | |
| | | | ||||||
| | * | Store inbound IKE fragments and reassemble the message when all fragments ↵ | Tobias Brunner | 2012-12-24 | 1 | -3/+166 | |
| | | | | | | | | | are received | |||||
| * | | Streamline debug output when receiving intermediate CA certificates in IKEv1 | Martin Willi | 2013-01-11 | 1 | -1/+1 | |
| | | | ||||||
| * | | Refactored IKEv2 cert/certreq payload processing to multiple functions | Martin Willi | 2013-01-11 | 1 | -112/+141 | |
| | | | ||||||
| * | | Refactored IKEv1 cert payload processing to multiple functions | Martin Willi | 2013-01-11 | 1 | -73/+102 | |
| | | | ||||||
| * | | IKEv1 support for PKCS#7 wrapped certificates | Volker Rümelin | 2013-01-11 | 1 | -0/+70 | |
| | | | ||||||
| * | | Fixed some typos in comments | Volker Rümelin | 2013-01-11 | 1 | -1/+1 | |
| |/ | ||||||
| * | Add parantheses to avoid compiler warning | Martin Willi | 2012-12-24 | 1 | -1/+1 | |
| | | ||||||
| * | Fixed some typos, courtesy of codespell | Tobias Brunner | 2012-12-20 | 3 | -3/+3 | |
| | | ||||||
| * | Raise an alert if IKE SA is kept | Adrian-Ken Rueegsegger | 2012-12-20 | 1 | -0/+1 | |
| | | | | | | This alert is raised when the establishment of a child SA fails but the IKE SA is kept. | |||||
 |
index : tteras/strongswan | |
| tteras' strongSwan tree | gitolite |
| aboutsummaryrefslogtreecommitdiffstats |