tteras/strongswan - tteras' strongSwan tree

	Commit message (Collapse)	Author	Age	Files	Lines
...
*	Add support for draft-ietf-ipsec-nat-t-ike-03 and earlier	Volker Rümelin	2012-12-19	6	-36/+211
\| \| \| \| \|	This adds support for early versions of the draft that eventually resulted in RFC 3947.
*	Raise an alert if allocating virtual IPs fails	Martin Willi	2012-12-19	1	-0/+2
\|
*	Raise an alert if kernel policy installation fails	Martin Willi	2012-12-19	1	-0/+2
\|
*	Raise an alert if kernel SA installation fails	Martin Willi	2012-12-19	1	-0/+2
\|
*	Raise an alert on traffic selector mismatch	Martin Willi	2012-12-19	1	-0/+2
\|
*	Raise alerts when enforcing IKE_SA unique policy	Martin Willi	2012-12-19	2	-0/+2
\|
*	Raise an alert if CHILD_SA proposals mismatch	Martin Willi	2012-12-19	1	-0/+2
\|
*	Raise an alert if IKE proposals mismatch	Martin Willi	2012-12-19	1	-0/+5
\|
*	Raise an alert of generating local authentication data fails	Martin Willi	2012-12-19	1	-6/+10
\|
*	Fix traffic selectors also as initiator in case of transport mode over NAT	Tobias Brunner	2012-12-13	1	-1/+1
\|
*	Fix debug output if responder selected invalid traffic selectors during QM	Tobias Brunner	2012-12-13	1	-2/+2
\|
*	Inherit virtual IP and attributes from old to new, not from new to old	Martin Willi	2012-12-10	1	-5/+5
\|
*	Fix GPL license header to properly "sed" it	Martin Willi	2012-11-30	1	-1/+1
\|
*	Don't wait while removing external IPs used for load testing	Martin Willi	2012-11-29	2	-3/+4
\|
*	Install virtual IPs via interface name, and use an interface lookup where ↵	Martin Willi	2012-11-29	2	-7/+25
\| \| \| \|	required
*	Add an optional kernel-interface parameter to install IPs with a custom prefix	Martin Willi	2012-11-29	2	-6/+6
\|
*	Add alerts for sent/received message retransmissions and timeout	Martin Willi	2012-11-29	2	-0/+8
\|
*	Add an ikesa_limit option to limit number of IKE_SAs as responder	Martin Willi	2012-11-16	1	-19/+39
\|
*	Log sent vendor IDs for IKEv1	Tobias Brunner	2012-11-02	1	-0/+1
\|
*	Fixed log message when no shared secret is found during IKEv1 Main Mode	Tobias Brunner	2012-10-29	1	-1/+1
\|
*	Remove all ESP proposals with non-matching DH group during Quick Mode	Tobias Brunner	2012-10-24	1	-10/+22
\| \| \| \| \| \|	According to RFC 2409, section 5.5, if PFS is used all proposals MUST include the selected DH group, so we remove proposals without the proposed group and remove other DH groups from the remaining proposals.
*	Moved data structures to new collections subfolder	Tobias Brunner	2012-10-24	12	-12/+12
\|
*	Moved packet_t and tun_device_t to networking folder	Tobias Brunner	2012-10-24	2	-2/+2
\|
*	Raise a bus alert when IKE message body parsing fails	Martin Willi	2012-10-24	2	-0/+4
\|
*	Raise a bus alert when a received message contains unknown SPIs	Martin Willi	2012-10-24	1	-0/+4
\|
*	Respect IKE version while selecting an ike_cfg as responder	Martin Willi	2012-10-24	2	-2/+4
\|
*	Update routed connections in trap manager	Tobias Brunner	2012-10-18	1	-37/+39
\| \| \| \| \| \|	Before this change, modified configs that have been updated with ipsec reload, could properly be started manually, but the old config would get used if triggered via trap policies.
*	Added a new alert that is raised if peer does not respond to initial IKE message	Tobias Brunner	2012-10-16	1	-0/+2
\|
*	Ensure UNSUPPORTED_CRITICAL_PAYLOAD notify contains correct payload type	Tobias Brunner	2012-09-28	1	-0/+1
\|
*	Missed one in 6c10cece	Tobias Brunner	2012-09-28	1	-0/+2
\|
*	Request is never NULL when responding with an INFORMATIONAL message	Tobias Brunner	2012-09-28	1	-1/+1
\|
*	Completed state handling in isakmp_cert_pre	Tobias Brunner	2012-09-28	1	-0/+4
\| \| \| \|	Should not be a problem, but makes static analyzers happy.
*	IKE_AUTH_LIFETIME task is not defined if IKEv2 is disabled	Tobias Brunner	2012-09-25	1	-1/+4
\| \| \| \|	Fixes #229.
*	Made IP address enumeration more flexible	Tobias Brunner	2012-09-21	3	-3/+3
\| \| \| \|	Also added an option to enumerate addresses on ignored interfaces.
*	Don't ignore loopback devices and allow addresses on them being enumerated	Tobias Brunner	2012-09-21	3	-3/+3
\|
*	Don't complain about multiple TS in IKEv1, as it supported with Unity	Martin Willi	2012-09-18	1	-5/+0
\|
*	Derive a dynamic TS to multiple virtual IPs	Martin Willi	2012-09-18	4	-70/+105
\|
*	Use the vararg list constructor in quick mode task	Martin Willi	2012-09-18	1	-16/+8
\|
*	Add AUTH_RULE_IDENTITY_LOOSE which allows to use IDr loosely as initiator	Tobias Brunner	2012-09-18	1	-1/+2
\| \| \| \| \| \|	If it is set on an auth config IDr will not be sent, and later the configured identity will not only be checked against the returned IDr, but also against other identities contained in the responder's certificate.
*	Change traffic selectors during Quick Mode in case of a NAT in transport mode	Tobias Brunner	2012-09-14	1	-9/+19
\| \| \| \| \| \| \| \| \|	Windows 7 sends its internal address as TSi. While we don't support the NAT-T drafts as used by Windows XP it is interesting to note that the client there omits the TSi payload which then would automatically get set to the public IP address of the client. Fixes #220.
*	Always send a configuration payload in IKEv1 TRANSACTIONs, even if it is empty	Martin Willi	2012-09-11	1	-29/+14
\|
*	Don't use host address for dynamic TS in IKEv1 if a virtual IP was expected	Martin Willi	2012-09-11	1	-40/+57
\|
*	Don't use host address for dynamic TS in IKEv2 if a virtual IP was expected	Martin Willi	2012-09-11	1	-1/+33
\|
*	Send FAILED_CP_REQUIRED if a configuration payload was expected, but not ↵	Martin Willi	2012-09-11	1	-0/+9
\| \| \| \|	received
*	Pass full pool list to release_address	Martin Willi	2012-09-11	1	-13/+8
\|
*	Pass the full list of pools to acquire_address, enumerate in providers	Martin Willi	2012-09-11	2	-40/+12
\| \| \| \| \| \| \| \|	If the provider has access to the full pool list, it can enumerate them twice, for example to search for existing leases first, and only search for new leases in a second step. Fixes lease enumeration in attr-sql using multiple pools.
*	Add a responder narrow() hook to change TS in the kernel, but not on the wire	Martin Willi	2012-09-11	2	-3/+46
\|
*	Add uniqueids=never to ignore INITIAL_CONTACT notifies	Tobias Brunner	2012-09-10	2	-2/+3
\| \| \| \| \| \|	With uniqueids=no the daemon still deletes any existing IKE_SA with the same peer if an INITIAL_CONTACT notify is received. With this new option it also ignores these notifies.
*	Only initiate an exchange from send_dpd() if a task was actually queued	Tobias Brunner	2012-09-07	1	-2/+8
\| \| \| \| \|	Otherwise, the initiator would prematurely initiate Quick Mode if it has DPD enabled and XAuth is used.
*	Trigger ike_updown event caused by retransmits only after reestablish() has ↵	Tobias Brunner	2012-09-06	3	-10/+5
\| \| \| \| \| \| \| \|	been called This allows listeners to migrate to the new IKE_SA with the ike_reestablish event without having to worry about an ike_updown event for the old IKE_SA.