| Commit message (Collapse) | Author | Age | Files | Lines | ||
|---|---|---|---|---|---|---|
| ... | ||||||
| | | * | Implement second exchange in IKEv1 main mode | Martin Willi | 2012-03-20 | 1 | -25/+143 | |
| | | | | ||||||
| | | * | Extended KE payload for IKEv1 support | Martin Willi | 2012-03-20 | 2 | -2/+3 | |
| | | | | ||||||
| | | * | Extended nonce payload for IKEv1 support | Martin Willi | 2012-03-20 | 2 | -2/+2 | |
| | | | | ||||||
| | | * | Handle first exchange in IKEv1 main mode as responder | Martin Willi | 2012-03-20 | 1 | -4/+33 | |
| | | | | ||||||
| | | * | Added an IKEv1 main mode task stub | Martin Willi | 2012-03-20 | 4 | -24/+190 | |
| | | | | ||||||
| | | * | Added a stub for a IKEv1 task manager | Martin Willi | 2012-03-20 | 2 | -0/+516 | |
| | | | | ||||||
| | | * | Use task manager as generic interface, renamed implementation to _v2. | Martin Willi | 2012-03-20 | 4 | -23/+63 | |
| | | | | ||||||
| | | * | Fix init message arrival check. | Tobias Brunner | 2012-03-20 | 1 | -21/+14 | |
| | | | | ||||||
| | | * | Allow creation of message_t objects for IKEv1 packets. | Tobias Brunner | 2012-03-20 | 3 | -4/+4 | |
| | | | | ||||||
| | | * | Extend sa_payload for IKEv1 support | Martin Willi | 2012-03-20 | 2 | -4/+8 | |
| | | | | ||||||
| | | * | Use vendor id payload for IKEv1 payloads, too | Martin Willi | 2012-03-20 | 1 | -1/+2 | |
| | | | | ||||||
| | | * | Handle IKEv1 messages in managers checkout_by_message | Martin Willi | 2012-03-20 | 1 | -9/+30 | |
| | | | | ||||||
| * | | | Removed auth_cfg_t.replace_value() and replaced usages with add(). | Tobias Brunner | 2012-04-18 | 2 | -12/+3 | |
| | | | | | | | | | | | | | | | | replace_value() was used to replace identities. Since for these the latest is now returned by get(), adding the new identity with add() is sufficient. | |||||
| * | | | Added a note about DH/keymat lifecycle for custom implementations | Martin Willi | 2012-04-17 | 1 | -1/+6 | |
| | | | | ||||||
| * | | | Reuse existing DH value when retrying IKE_SA_INIT with a COOKIE | Martin Willi | 2012-04-17 | 1 | -2/+5 | |
| | | | | ||||||
| * | | | Use IP address as ID as responder if not configured or no IDr received. | Tobias Brunner | 2012-04-16 | 1 | -3/+11 | |
| | | | | ||||||
| * | | | Fall back on IP address as IDi if none is configured at all. | Tobias Brunner | 2012-04-16 | 1 | -7/+7 | |
| | | | | ||||||
| * | | | Use auth_cfg_t.replace_value where appropriate. | Tobias Brunner | 2012-04-16 | 2 | -26/+5 | |
| | | | | ||||||
| * | | | Fixed IDi in case neither left nor leftid is configured. | Tobias Brunner | 2012-04-16 | 1 | -0/+21 | |
| | | | | ||||||
| * | | | Don't invoke child_updown hook twice as responder | Martin Willi | 2012-04-11 | 1 | -3/+8 | |
| | | | | ||||||
| * | | | Properly initialize src in ike_sa_t.is_any_path_valid(). | Tobias Brunner | 2012-04-06 | 1 | -1/+1 | |
| | | | | ||||||
| * | | | added IKEv2 Generic Secure Password Authentication Method | Andreas Steffen | 2012-04-03 | 2 | -3/+10 | |
| |/ / | ||||||
| * | | Simplified some route lookups now that we store all peer addresses in a list. | Tobias Brunner | 2012-03-09 | 2 | -25/+9 | |
| | | | ||||||
| * | | Renamed list of additional peer addresses as it now stores all known addresses. | Tobias Brunner | 2012-03-09 | 3 | -34/+34 | |
| | | | ||||||
| * | | Store the peer's current address as additional known address on the IKE_SA. | Tobias Brunner | 2012-03-09 | 1 | -0/+8 | |
| | | | | | | | | | | | This allows to switch back to the original address after switching to any of the additional addresses. | |||||
| * | | Re-resolve hosts on additional keyingtries | Martin Willi | 2012-03-06 | 1 | -0/+1 | |
| | | | ||||||
| * | | Invoke ike_updown hook on authentication failure not before response sent | Martin Willi | 2012-03-05 | 1 | -3/+2 | |
| | | | ||||||
| * | | Be a little more verbose before starting IKE_SA reauthentication | Martin Willi | 2012-03-05 | 1 | -2/+9 | |
| | | | ||||||
| * | | Send an AUTH_LIFETIME update after updating the lifetime, but can not reauth ↵ | Martin Willi | 2012-03-05 | 3 | -9/+43 | |
| | | | | | | | | | actively | |||||
| * | | Set hard timeouts when setting a lifetime | Martin Willi | 2012-03-05 | 1 | -7/+14 | |
| | | | ||||||
| * | | Fix IKE_SA timeout debug output on 64bit platforms | Martin Willi | 2012-03-05 | 1 | -3/+4 | |
| | | | ||||||
| * | | Added support for untruncated MD5 and SHA1 HMACs in ESP as used in RFC 4595. | Tobias Brunner | 2012-02-27 | 1 | -0/+2 | |
| | | | | | | | | | This requires a Linux kernel >= 2.6.33. | |||||
| * | | Trigger DPD not before IKE_SA state gets updated | Martin Willi | 2012-02-02 | 1 | -6/+8 | |
| | | | ||||||
| * | | Don't retransmit, rekey, reauth or DPD check SAs when in PASSIVE state | Martin Willi | 2012-02-02 | 1 | -0/+26 | |
| | | | ||||||
| * | | Destroy active task list before queued tasks | Thomas Egerer | 2012-01-18 | 1 | -3/+3 | |
| | | | | | | | | | | | | | | | Since active task's destruction might result in adopting tasks from a rekeyed ike sa it seems better to first destroy the active task list and then destroy all queued tasks. This way adoption is possible at all, while otherwise the queued task list would be empty. | |||||
| * | | Fixed additional typos in comments and log messages. | Tobias Brunner | 2012-01-12 | 1 | -1/+1 | |
| | | | ||||||
| * | | Fix deadlock in trap_manager_t during acquire. | Tobias Brunner | 2011-12-23 | 1 | -28/+43 | |
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Also fixes a TOCTOU issue regarding the use of entry_t.pending. The deadlock was caused because the rwlock was being locked while waiting for an IKE_SA. Triggering the deadlock was a bit tricky, here is the description by Thomas Egerer (the reporter of this issue): " The deadlock occurs when the following happens (in the given order): a) an IKE_SA is built and a thread is processing the IKE_AUTH request, which can take a bit longer when a smartcard is involved. This causes the ike_sa_manager to lock a particular IKE_SA exclusively. b) an acquire is triggered which causes the rwlock in the trap_manager to be read-locked, the subsequent call to ike_sa_manager->checkout_by_config has to wait until a) unlocks it's ike_sa. c) a child_cfg contained in the peer_cfg belonging to the ike_sa a) has locked is routed causes the child_configs contained in the peer config to be locked by c) while the actual routing code within trap_manager tries to writelock it's rwlock. That's about it. As soon as a) finishes authentication of the peer and tries to find a matching child sa it will try to lock the child configs of the peer config which is not possible since it has been locked by c). Thread | Resource locked | Resource desired -------+--------------------------------+-------------------------------- (a) | ike_sa in ike_sa_manager | child_cfgs of peer_cfg | | (b) | rwlock in trap-manager (read) | ike_sa in ike_sa_manager | | (c) | child_cfgs of peer_cfg | rwlock in trap-manager (write) " With this patch thread (b) now does not hold the lock while waiting for the IKE_SA. Thus (c) can get the write lock, and (a) can subsequently lock the mutex in the peer_cfg which then finally allows (b) to checkout the IKE_SA. | |||||
| * | | Fixed flush() method of trap_manager_t. | Tobias Brunner | 2011-12-23 | 1 | -3/+9 | |
| |/ | | | | | A segmentation fault could have happened during destruction of the trap manager after calling flush(). | |||||
| * | Change order of destroy/get_ref function calls | Thomas Egerer | 2011-11-04 | 1 | -1/+1 | |
| | | | | | | Since DESTROY_IF might destroy the peer_cfg, a get_ref on a freed object is subject to fail. | |||||
| * | Log if charon failed to establish a CHILD_SA but keeps the IKE_SA up. | Tobias Brunner | 2011-10-21 | 1 | -0/+4 | |
| | | ||||||
| * | Don't use union members directly in plugin_feature_t. | Tobias Brunner | 2011-10-14 | 1 | -1/+1 | |
| | | ||||||
| * | Added a generic callback to register EAP methods using plugin features | Martin Willi | 2011-10-14 | 2 | -0/+35 | |
| | | ||||||
| * | Fixed unintentional fall-through in task_manager. | Tobias Brunner | 2011-10-06 | 1 | -0/+1 | |
| | | | | | Reported by Howard Windsor. | |||||
| * | Fixed compilation of ike_me_t. | Tobias Brunner | 2011-10-04 | 1 | -2/+2 | |
| | | ||||||
| * | Migrated child_delete to INIT/METHOD macros | Andreas Steffen | 2011-10-04 | 1 | -49/+36 | |
| | | ||||||
| * | Migrated child_rekey to INIT/METHOD macros | Andreas Steffen | 2011-10-04 | 1 | -50/+36 | |
| | | ||||||
| * | Migrated ike_auth_lifetime to INIT/METHOD macros | Andreas Steffen | 2011-10-04 | 1 | -39/+30 | |
| | | ||||||
| * | Migrated ike_cert_post to INIT/METHOD macros | Andreas Steffen | 2011-10-04 | 1 | -40/+31 | |
| | | ||||||
| * | Migrated ike_cert_pre to INIT/METHOD macros | Andreas Steffen | 2011-10-04 | 1 | -42/+31 | |
| | | ||||||
| * | Migrated ike_config to INIT/METHOD macros | Andreas Steffen | 2011-10-03 | 1 | -42/+32 | |
| | | ||||||
 |
index : tteras/strongswan | |
| tteras' strongSwan tree | gitolite |
| aboutsummaryrefslogtreecommitdiffstats |