| Commit message (Collapse) | Author | Age | Files | Lines | ||
|---|---|---|---|---|---|---|
| ... | ||||||
| * | bus: Add an ike_update() hook invoked when peer endpoints change | Martin Willi | 2015-02-20 | 1 | -0/+2 | |
| | | ||||||
| * | ikev2: Schedule a make-before-break completion task to delete old IKE_SA | Martin Willi | 2015-02-20 | 6 | -1/+172 | |
| | | ||||||
| * | ikev2: Allow task to skip exchange by setting undefined exchange type | Martin Willi | 2015-02-20 | 1 | -0/+5 | |
| | | ||||||
| * | ikev2: Trigger make-before-break reauthentication instead of reauth task | Martin Willi | 2015-02-20 | 2 | -2/+79 | |
| | | ||||||
| * | ike-sa-manager: Use IKEv1 uniqueness reauthentication detection for IKEv2, too | Martin Willi | 2015-02-20 | 1 | -12/+8 | |
| | | ||||||
| * | attribute-manager: Pass full IKE_SA to handler methods | Martin Willi | 2015-02-20 | 3 | -9/+5 | |
| | | ||||||
| * | attribute-manager: Pass the full IKE_SA to provider methods | Martin Willi | 2015-02-20 | 3 | -10/+8 | |
| | | ||||||
| * | attributes: Move the configuration attributes framework to libcharon | Martin Willi | 2015-02-20 | 3 | -25/+24 | |
| | | ||||||
| * | ike: Consistently log CHILD_SAs with their unique_id instead of their reqid | Martin Willi | 2015-02-20 | 5 | -8/+10 | |
| | | ||||||
| * | ike-sa-manager: Remove IKE_SA checkout by CHILD_SA reqid | Martin Willi | 2015-02-20 | 2 | -36/+13 | |
| | | ||||||
| * | inactivity-job: Schedule job by CHILD_SA unique ID instead of reqid | Martin Willi | 2015-02-20 | 2 | -13/+7 | |
| | | ||||||
| * | kernel-interface: Raise expires with a proto/SPI/dst tuple instead of reqid | Martin Willi | 2015-02-20 | 1 | -2/+2 | |
| | | ||||||
| * | ike: Maintain per-IKE_SA CHILD_SAs in the global CHILD_SA manager | Martin Willi | 2015-02-20 | 2 | -15/+77 | |
| | | ||||||
| * | child-sa-manager: Add a global manager storing CHILD_SA relations | Martin Willi | 2015-02-20 | 2 | -0/+422 | |
| | | | | | | | To quickly check out IKE_SAs and find associated CHILD_SAs, the child_sa_manager stores relations between CHILD_SAs and IKE_SAs. It provides CHILD_SA specific IKE_SA checkout functions wrapping the ike_sa_manager. | |||||
| * | child-sa: Replace reqid based marks by "unique" marks | Martin Willi | 2015-02-20 | 9 | -10/+108 | |
| | | | | | | | | | | | | As we now use the same reqid for multiple CHILD_SAs with the same selectors, having marks based on the reqid makes not that much sense anymore. Instead we use unique marks that use a custom identifier. This identifier is reused during rekeying, keeping the marks constant for any rule relying on it (for example installed by updown). This also simplifies handling of reqid allocation, as we do not have to query the marks that is not yet assigned for an unknown reqid. | |||||
| * | child-sa: Introduce a unique CHILD_SA identifier | Martin Willi | 2015-02-20 | 2 | -0/+24 | |
| | | | | | | As the reqid is not that unique even among multiple IKE_SAs anymore, we need an identifier to uniquely identify a specific CHILD_SA instance. | |||||
| * | child-sa: Delegate reqid allocation to the kernel interface | Martin Willi | 2015-02-20 | 1 | -15/+46 | |
| | | ||||||
| * | child-sa: Sort traffic selectors after adding CHILD_SA policies | Martin Willi | 2015-02-20 | 1 | -0/+3 | |
| | | | | | Having traffic selectors sorted properly makes comparing them much simpler. | |||||
| * | child-sa: Remove the obsolete update logic | Martin Willi | 2015-02-20 | 1 | -6/+1 | |
| | | | | | | | The kernel backend uses an inbound parameter these days, where it makes no sense to pass the update flag. The kernel backend decides itself how it handles SA installation based on the inbound flag. | |||||
| * | kernel-interface: Pass full list of traffic selectors to add_sa() | Martin Willi | 2015-02-20 | 1 | -8/+6 | |
| | | | | | | | While we can handle the first selector only in BEET mode in kernel-netlink, passing the full list gives the backend more flexibility how to handle this information. | |||||
| * | kernel-interface: Remove reqid parameter from get_spi/get_cpi() methods | Martin Willi | 2015-02-20 | 1 | -2/+2 | |
| | | | | | | | | | | | The reqid is not strictly required, as we set the reqid with the update call when installing the negotiated SA. If we don't need a reqid at this stage, we can later allocate the reqid in the kernel backend once the SA parameters have been fully negotaited. This allows us to assign the same reqid for the same selectors to avoid conflicts on backends this is necessary. | |||||
| * | ikev2: Only touch the DH object if we have a matching proposal | Tobias Brunner | 2014-12-23 | 1 | -11/+17 | |
| | | ||||||
| * | apple: Redefine some additional clashing Mach types | Martin Willi | 2014-12-16 | 1 | -0/+2 | |
| | | | | | | | While they usually are not included in a normal strongSwan build, the XPC header indirectly defines these Mach types. To build charon-xpc, which uses both XPC and strongSwan includes, we have to redefine these types. | |||||
| * | ike: Make check for known payloads depend on IKE version | Tobias Brunner | 2014-12-05 | 1 | -1/+1 | |
| | | ||||||
| * | ikev2: Fix handling of more than one hash-and-URL certificate payloads | Tobias Brunner | 2014-12-04 | 1 | -2/+2 | |
| | | ||||||
| * | Implemented full BLISS support for IKEv2 public key authentication and the ↵ | Andreas Steffen | 2014-11-29 | 3 | -3/+26 | |
| | | | | | pki tool | |||||
| * | ikev2: Fix ike_rekey switch statement broken with last commit | Martin Willi | 2014-11-24 | 1 | -1/+1 | |
| | | ||||||
| * | ikev2: Prevent IKE_SA rekeying if we are currently retrying a CHILD_SA rekey | Martin Willi | 2014-11-21 | 1 | -0/+1 | |
| | | ||||||
| * | child-sa: Introduce a CHILD_RETRYING state to detect DH group retries | Martin Willi | 2014-11-21 | 3 | -0/+7 | |
| | | ||||||
| * | ikev1: Don't inherit children if INITITAL_CONTACT was seen | Thomas Egerer | 2014-10-30 | 1 | -1/+4 | |
| | | | | | Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com> | |||||
| * | ikev1: Send INITIAL_CONTACT notify in Main Mode | Thomas Egerer | 2014-10-30 | 1 | -0/+28 | |
| | | | | | | | | | | We currently send the notify in Main Mode only, as it is explicitly not allowed by RFC 2407 to send (unprotected) notifications in Aggressive Mode. To make that work, we'd need to handle that notify in Aggressive Mode, which could allow a MitM to inject such notifies and do some harm. Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com> | |||||
| * | ike: Do remote address updates also when behind static NATs | Tobias Brunner | 2014-10-13 | 1 | -4/+7 | |
| | | | | | | | | | We assume that a responder is behind a static NAT (e.g. port forwarding) and allow remote address updates in such situations. The problem described in RFC 5996 is only an issue if the NAT mapping can expire. | |||||
| * | ikev1: Add fragmentation support for Windows peers | Volker Rümelin | 2014-10-10 | 3 | -13/+58 | |
| | | | | | | | | | I still think ipsec/l2tp with fragmentation support is a useful fallback option in case the Windows IKEv2 connection fails because of fragmentation problems. Tested with Windows XP, 7 and 8.1. | |||||
| * | ikev2: Send retransmits using the latest known addresses | Tobias Brunner | 2014-10-10 | 1 | -1/+3 | |
| | | | | | | | | For instance, if a DPD exchange is initiated by the gateway when a mobile client is roaming and it then gets a new IP address and sends an address update via MOBIKE, the DPD retransmits would still be sent to the old address and the SA would eventually get closed. | |||||
| * | ikev2: Send and receive fragmented IKE messages | Tobias Brunner | 2014-10-10 | 1 | -44/+169 | |
| | | | | | | If a fragmented message is retransmitted only the first packet is passed to the alert() hook. | |||||
| * | ike: IKE_SA may fragment IKEv2 messages | Tobias Brunner | 2014-10-10 | 1 | -1/+1 | |
| | | ||||||
| * | ike: Do not cache MID of IKEv2 fragments | Tobias Brunner | 2014-10-10 | 1 | -2/+3 | |
| | | | | | | This fails if there are unencrypted payloads before an encrypted fragment payload in the first fragment. | |||||
| * | ikev2: Negotiate support for IKEv2 fragmentation | Tobias Brunner | 2014-10-10 | 2 | -1/+24 | |
| | | ||||||
| * | ikev1: Move defragmentation to message_t | Tobias Brunner | 2014-10-10 | 1 | -167/+16 | |
| | | ||||||
| * | ike: Move fragmentation to ike_sa_t | Tobias Brunner | 2014-10-10 | 3 | -62/+94 | |
| | | | | | | | | | | The message() hook on bus_t is now called exactly once before (plain) and once after fragmenting (!plain), not twice for the complete message and again for each individual fragment, as was the case in earlier iterations. For inbound messages the hook is called once for each fragment (!plain) and twice for the reassembled message. | |||||
| * | message: fragment() generates message and fragments and caches them | Tobias Brunner | 2014-10-10 | 1 | -31/+11 | |
| | | ||||||
| * | ikev1: Move fragment generation to message_t | Tobias Brunner | 2014-10-10 | 1 | -132/+118 | |
| | | ||||||
| * | ikev1: Fix handling of UNITY_LOAD_BALANCE | Tobias Brunner | 2014-10-07 | 1 | -3/+3 | |
| | | | | | | The re-authentication is now handled within the original IKE_SA if it has not yet been established, so we don't want to destroy it. | |||||
| * | ikev1: Don't queue more than one mode config or XAuth task | Tobias Brunner | 2014-10-07 | 1 | -7/+22 | |
| | | | | | | | | | At the time we reset an IKE_SA (e.g. when re-authenticating a not yet established SA due to a roaming event) such tasks might already be queued by one of the phase 1 tasks. If the SA is initiated again another task will get queued by the phase 1 task. This results in e.g. multiple mode config requests, which most gateways will have problems with. | |||||
| * | ikev1: Be more verbose if a peer config would match, but is unusable for Mode | Martin Willi | 2014-09-25 | 1 | -0/+12 | |
| | | ||||||
| * | ikev2: Reorder task activation for established IKE SAs | Tobias Brunner | 2014-09-25 | 1 | -11/+11 | |
| | | | | | We now prefer MOBIKE tasks over delete tasks then the rest. | |||||
| * | Revert "ikev2: Insert MOBIKE tasks at the front of the queue" | Tobias Brunner | 2014-09-25 | 1 | -6/+1 | |
| | | | | | | | | | This reverts commit 3293d146289d7c05e6c6089ae1f7cdbcea378e63. The position of tasks in the queue does not actually determine the order in which they are activated. Instead this is determined by the statements in task_manager_v2_t.initiate(). | |||||
| * | ikev2: Don't treat initial messages as MOBIKE exchanges | Tobias Brunner | 2014-09-16 | 1 | -6/+9 | |
| | | | | | | The MOBIKE task is active during the initial exchanges but we don't want to treat them as actual MOBIKE exchanges (i.e. there is no path probing). | |||||
| * | ikev2: Reduce timeout if path probing was enabled | Tobias Brunner | 2014-09-12 | 1 | -6/+13 | |
| | | ||||||
| * | ikev2: Defer MOBIKE updates if no path is available | Tobias Brunner | 2014-09-12 | 1 | -7/+14 | |
| | | ||||||
 |
index : tteras/strongswan | |
| tteras' strongSwan tree | gitolite |
| aboutsummaryrefslogtreecommitdiffstats |