| Commit message (Collapse) | Author | Age | Files | Lines | ||
|---|---|---|---|---|---|---|
| ... | ||||||
| * | Update routed connections in trap manager | Tobias Brunner | 2012-10-18 | 1 | -37/+39 | |
| | | | | | | | Before this change, modified configs that have been updated with ipsec reload, could properly be started manually, but the old config would get used if triggered via trap policies. | |||||
| * | Added a new alert that is raised if peer does not respond to initial IKE message | Tobias Brunner | 2012-10-16 | 1 | -0/+2 | |
| | | ||||||
| * | Ensure UNSUPPORTED_CRITICAL_PAYLOAD notify contains correct payload type | Tobias Brunner | 2012-09-28 | 1 | -0/+1 | |
| | | ||||||
| * | Missed one in 6c10cece | Tobias Brunner | 2012-09-28 | 1 | -0/+2 | |
| | | ||||||
| * | Request is never NULL when responding with an INFORMATIONAL message | Tobias Brunner | 2012-09-28 | 1 | -1/+1 | |
| | | ||||||
| * | Completed state handling in isakmp_cert_pre | Tobias Brunner | 2012-09-28 | 1 | -0/+4 | |
| | | | | | Should not be a problem, but makes static analyzers happy. | |||||
| * | IKE_AUTH_LIFETIME task is not defined if IKEv2 is disabled | Tobias Brunner | 2012-09-25 | 1 | -1/+4 | |
| | | | | | Fixes #229. | |||||
| * | Made IP address enumeration more flexible | Tobias Brunner | 2012-09-21 | 3 | -3/+3 | |
| | | | | | Also added an option to enumerate addresses on ignored interfaces. | |||||
| * | Don't ignore loopback devices and allow addresses on them being enumerated | Tobias Brunner | 2012-09-21 | 3 | -3/+3 | |
| | | ||||||
| * | Don't complain about multiple TS in IKEv1, as it supported with Unity | Martin Willi | 2012-09-18 | 1 | -5/+0 | |
| | | ||||||
| * | Derive a dynamic TS to multiple virtual IPs | Martin Willi | 2012-09-18 | 4 | -70/+105 | |
| | | ||||||
| * | Use the vararg list constructor in quick mode task | Martin Willi | 2012-09-18 | 1 | -16/+8 | |
| | | ||||||
| * | Add AUTH_RULE_IDENTITY_LOOSE which allows to use IDr loosely as initiator | Tobias Brunner | 2012-09-18 | 1 | -1/+2 | |
| | | | | | | | If it is set on an auth config IDr will not be sent, and later the configured identity will not only be checked against the returned IDr, but also against other identities contained in the responder's certificate. | |||||
| * | Change traffic selectors during Quick Mode in case of a NAT in transport mode | Tobias Brunner | 2012-09-14 | 1 | -9/+19 | |
| | | | | | | | | | | Windows 7 sends its internal address as TSi. While we don't support the NAT-T drafts as used by Windows XP it is interesting to note that the client there omits the TSi payload which then would automatically get set to the public IP address of the client. Fixes #220. | |||||
| * | Always send a configuration payload in IKEv1 TRANSACTIONs, even if it is empty | Martin Willi | 2012-09-11 | 1 | -29/+14 | |
| | | ||||||
| * | Don't use host address for dynamic TS in IKEv1 if a virtual IP was expected | Martin Willi | 2012-09-11 | 1 | -40/+57 | |
| | | ||||||
| * | Don't use host address for dynamic TS in IKEv2 if a virtual IP was expected | Martin Willi | 2012-09-11 | 1 | -1/+33 | |
| | | ||||||
| * | Send FAILED_CP_REQUIRED if a configuration payload was expected, but not ↵ | Martin Willi | 2012-09-11 | 1 | -0/+9 | |
| | | | | | received | |||||
| * | Pass full pool list to release_address | Martin Willi | 2012-09-11 | 1 | -13/+8 | |
| | | ||||||
| * | Pass the full list of pools to acquire_address, enumerate in providers | Martin Willi | 2012-09-11 | 2 | -40/+12 | |
| | | | | | | | | | If the provider has access to the full pool list, it can enumerate them twice, for example to search for existing leases first, and only search for new leases in a second step. Fixes lease enumeration in attr-sql using multiple pools. | |||||
| * | Add a responder narrow() hook to change TS in the kernel, but not on the wire | Martin Willi | 2012-09-11 | 2 | -3/+46 | |
| | | ||||||
| * | Add uniqueids=never to ignore INITIAL_CONTACT notifies | Tobias Brunner | 2012-09-10 | 2 | -2/+3 | |
| | | | | | | | With uniqueids=no the daemon still deletes any existing IKE_SA with the same peer if an INITIAL_CONTACT notify is received. With this new option it also ignores these notifies. | |||||
| * | Only initiate an exchange from send_dpd() if a task was actually queued | Tobias Brunner | 2012-09-07 | 1 | -2/+8 | |
| | | | | | | Otherwise, the initiator would prematurely initiate Quick Mode if it has DPD enabled and XAuth is used. | |||||
| * | Trigger ike_updown event caused by retransmits only after reestablish() has ↵ | Tobias Brunner | 2012-09-06 | 3 | -10/+5 | |
| | | | | | | | | | been called This allows listeners to migrate to the new IKE_SA with the ike_reestablish event without having to worry about an ike_updown event for the old IKE_SA. | |||||
| * | Add ike_reestablish() event that is triggered when an IKE_SA is reestablished | Tobias Brunner | 2012-09-06 | 1 | -0/+1 | |
| | | | | | | This is particularly useful during reauthentication to get the new IKE_SA. | |||||
| * | Add a new condition to mark IKE_SAs that are currently being reauthenticated | Tobias Brunner | 2012-09-06 | 2 | -9/+9 | |
| | | ||||||
| * | Clear virtual IPs before storing assigned ones on the IKE_SA | Tobias Brunner | 2012-09-05 | 4 | -0/+33 | |
| | | | | | | Otherwise we'll end up with duplicate or invalid VIPs stored on the IKE_SA. | |||||
| * | In mode_config, destroy temporary pool list instead of the virtual IP list twice | Martin Willi | 2012-09-05 | 1 | -1/+1 | |
| | | ||||||
| * | Merge branch 'multi-vip' | Martin Willi | 2012-08-31 | 14 | -214/+429 | |
| |\ | | | | | | | | | | | | | Brings support for multiple virtual IPs and multiple pools in left/rigthsourceip definitions. Also introduces the new left/rightdns options to configure requested DNS server address family and respond with multiple connection specific servers. | |||||
| | * | Request and acquire multiple virtual IPs in IKEv1 Mode Config | Martin Willi | 2012-08-30 | 1 | -47/+61 | |
| | | | ||||||
| | * | Request and acquire multiple virtual IPs in IKEv2 configuration payload | Martin Willi | 2012-08-30 | 1 | -49/+67 | |
| | | | ||||||
| | * | Pass all configured pool names to attribute provider enumerator | Martin Willi | 2012-08-30 | 2 | -4/+18 | |
| | | | ||||||
| | * | Pass a list instead of a single virtual IP to attribute enumerators | Martin Willi | 2012-08-30 | 2 | -22/+71 | |
| | | | ||||||
| | * | Support multiple address pools configured on a peer_cfg | Martin Willi | 2012-08-30 | 8 | -13/+70 | |
| | | | ||||||
| | * | Support multiple virtual IPs on peer_cfg and ike_sa classes | Martin Willi | 2012-08-30 | 14 | -144/+207 | |
| | | | ||||||
| * | | Merge branch 'eap-client-select' | Tobias Brunner | 2012-08-31 | 3 | -10/+100 | |
| |\ \ | | | | | | | | | | | | | | | | This brings support for EAP-Nak payloads on the client (to select a specific or supported method), and the server (via the eap-dynamic plugin which selects a method supported/requested by the client). | |||||
| | * | | Log the proper type for virtual EAP methods | Tobias Brunner | 2012-08-31 | 1 | -1/+5 | |
| | | | | ||||||
| | * | | Encode EAP-Naks in expanded format if we got an expanded type request | Tobias Brunner | 2012-08-31 | 1 | -2/+2 | |
| | | | | | | | | | | | | | | | | Since methods defined by the IETF (vendor ID 0) could also be encoded in expanded type format the previous check was insufficient. | |||||
| | * | | Allow clients to request a configured EAP method via EAP-Nak | Tobias Brunner | 2012-08-31 | 1 | -4/+24 | |
| | | | | ||||||
| | * | | Virtual EAP methods handle EAP-Naks themselves | Tobias Brunner | 2012-08-31 | 1 | -5/+17 | |
| | | | | ||||||
| | * | | Send EAP-Nak with supported types if requested type is unsupported | Tobias Brunner | 2012-08-31 | 1 | -2/+4 | |
| | | | | ||||||
| | * | | Filter invalid EAP authentication types when enumerating them | Tobias Brunner | 2012-08-31 | 2 | -1/+10 | |
| | | | | | | | | | | | | | Valid authentication types defined by the IETF are 4-253 and 255. | |||||
| | * | | Added a method to enumerate registered EAP methods | Tobias Brunner | 2012-08-21 | 2 | -0/+43 | |
| | |/ | ||||||
| * / | Fall back to local address as IKEv1 identity if nothing else is configured | Tobias Brunner | 2012-08-24 | 1 | -2/+14 | |
| |/ | ||||||
| * | Remove the unused second IKE_SA entry match function argument | Martin Willi | 2012-08-20 | 1 | -4/+4 | |
| | | | | | LLVMs clang complains about this parameter, so remove it. | |||||
| * | Add keymat_t constructor registration function | Adrian-Ken Rueegsegger | 2012-08-20 | 2 | -3/+45 | |
| | | | | | | | Using the register_constructor function enables custom keymat_t implementations per IKE version. If no constructor is registered the default behavior is preserved. | |||||
| * | Merge branch 'android-app' | Tobias Brunner | 2012-08-13 | 3 | -2/+3 | |
| |\ | | | | | | | | | | | | | | | This branch introduces a userland IPsec implementation (libipsec) and an Android App which targets the VpnService API that is provided by Android 4+. The implementation is based on the bachelor thesis 'Userland IPsec for Android 4' by Giuliano Grassi and Ralf Sager. | |||||
| | * | Moved packet_t to libstrongswan | Tobias Brunner | 2012-08-08 | 2 | -1/+2 | |
| | | | ||||||
| | * | Increase log verbosity when sending NAT keep-alives | Tobias Brunner | 2012-08-08 | 1 | -1/+1 | |
| | | | ||||||
| * | | Merge branch 'android-ndk' | Tobias Brunner | 2012-08-13 | 3 | -10/+18 | |
| |\| | | | | | | | | | | | | | | | | | | | | | | | This branch comes with some preliminary changes for the user-land IPsec implementation and the Android App. One important change is that the UDP ports used by the socket-default plugin were made configurable (either via ./configure or strongswan.conf). Also, the plugin does randomly allocate a port if it is configured to 0, which is useful for client implementations. A consequence of these changes is that the local UDP port used when creating ike_cfg_t objects has to be fetched from the socket. | |||||
 |
index : tteras/strongswan | |
| tteras' strongSwan tree | gitolite |
| aboutsummaryrefslogtreecommitdiffstats |