| Commit message (Collapse) | Author | Age | Files | Lines | ||
|---|---|---|---|---|---|---|
| ... | ||||||
| * | Added xauth-noauth plugin | Tobias Brunner | 2013-03-19 | 7 | -29/+305 | |
| | | | | | | | | | This XAuth backend does not do any authentication of client credentials but simply sends a successful XAuth status to the client, thereby concluding the XAuth exchange. This can be useful to fallback to basic RSA authentication with clients that can not be configured without XAuth authentication. | |||||
| * | In stroke counters, check if we have an IKE_SA before getting the name from it | Martin Willi | 2013-03-19 | 1 | -3/+6 | |
| | | | | | | Fixes a segfault when receiving an invalid IKE SPI, where we don't have an IKE_SA for the raised alert. | |||||
| * | Add an "esp" load-tester option to configure custom CHILD_SA ESP proposal | Martin Willi | 2013-03-18 | 1 | -3/+16 | |
| | | ||||||
| * | Algorithms are not really specific to an IKE version | Tobias Brunner | 2013-03-18 | 1 | -1/+1 | |
| | | | | | | | But not all of them can be used with IKEv1. Fixes #314. | |||||
| * | Merge branch 'radius-ext' | Martin Willi | 2013-03-18 | 19 | -98/+1203 | |
| |\ | | | | | | | | | | | Bring some extensions to eap-radius, namely a virtual IP address provider based on received Framed-IPs, forwarding of Cisco Unity banners, Interim Accounting updates and the reporting of sent/received packets. | |||||
| | * | Don't create interim update entries if RADIUS accounting is disabled | Martin Willi | 2013-03-14 | 2 | -7/+7 | |
| | | | ||||||
| | * | Add support for RADIUS Interim accounting updates | Martin Willi | 2013-03-14 | 3 | -39/+269 | |
| | | | ||||||
| | * | Add an option to delete any established IKE_SA if RADIUS server is not ↵ | Martin Willi | 2013-03-14 | 4 | -7/+67 | |
| | | | | | | | | | responding | |||||
| | * | Make check whether to use IKEv1 fragmentation more readable | Martin Willi | 2013-03-14 | 1 | -5/+14 | |
| | | | ||||||
| | * | Send Acct-Terminate-Cause based on some alerts catched on the bus | Martin Willi | 2013-03-14 | 1 | -0/+62 | |
| | | | | | | | | | | | Currently supported are user disconnects, session timeouts and if the peer does not respond on IKE packets or DPDs. | |||||
| | * | When IKEv1 DPD times out, raise missing SEND_RETRANSMIT_TIMOUT alert | Martin Willi | 2013-03-14 | 2 | -1/+2 | |
| | | | ||||||
| | * | Raise an alert if an IKE_SA could not have been reauthenticated and expires | Martin Willi | 2013-03-14 | 2 | -0/+6 | |
| | | | ||||||
| | * | Send NAS-Port, NAS-IP and Calling/Called-Station-ID in Accounting-Requests | Martin Willi | 2013-03-14 | 1 | -4/+33 | |
| | | | ||||||
| | * | Support RADIUS accounting of sent/received packets | Martin Willi | 2013-03-14 | 1 | -13/+23 | |
| | | | ||||||
| | * | Report the number of processed packets in "ipsec statusall" | Martin Willi | 2013-03-14 | 1 | -5/+9 | |
| | | | ||||||
| | * | child_sa_t.get_usestats() can additionally return the number of processed ↵ | Martin Willi | 2013-03-14 | 9 | -16/+20 | |
| | | | | | | | | | packets | |||||
| | * | kernel_ipsec_t.query_sa() additionally returns the number of processed packets | Martin Willi | 2013-03-14 | 2 | -5/+17 | |
| | | | ||||||
| | * | Send NAS-Port, NAS-IP and Calling/Called-Station-ID in Access-Request | Martin Willi | 2013-03-13 | 1 | -7/+56 | |
| | | | ||||||
| | * | Forward Cisco Banner received from RADIUS to Unity capable clients | Martin Willi | 2013-03-12 | 3 | -5/+176 | |
| | | | ||||||
| | * | In eap-radius, hand out received Framed-IP-Address attributes as virtual IP | Martin Willi | 2013-03-12 | 5 | -2/+460 | |
| | | | ||||||
| * | | Merge branch 'stroke-counters' | Martin Willi | 2013-03-18 | 3 | -11/+185 | |
| |\ \ | | | | | | | | | | | | | Extend stroke counters functionality by connection specific counters, and a resetcounters command to reset the global or connection counters. | |||||
| | * | | Add a "resetcounters" command to ipsec, clearing global or connection counters | Martin Willi | 2013-03-15 | 3 | -1/+38 | |
| | | | | ||||||
| | * | | Add connection name specific stroke counters | Martin Willi | 2013-03-15 | 3 | -11/+148 | |
| | | | | ||||||
| * | | | Merge branch 'stroke-timeout' | Martin Willi | 2013-03-18 | 2 | -22/+94 | |
| |\ \ \ | |_|/ |/| | | | | | Add a strongswan.conf timeout option for stroke control commands. | |||||
| | * | | If controller operations have a callback, don't succeed before hook gets called | Martin Willi | 2013-03-07 | 1 | -4/+12 | |
| | | | | ||||||
| | * | | Add a stroke command timeout option, and report status of completed command | Martin Willi | 2013-03-07 | 1 | -18/+82 | |
| | |/ | ||||||
| * | | Add missing XAuthRespPSK switch case to IKEv1 key derivation | Martin Willi | 2013-03-12 | 1 | -0/+1 | |
| | | | ||||||
| * | | Support mutliple subnets and ranges as external load-tester addresses | Martin Willi | 2013-03-11 | 1 | -15/+59 | |
| | | | ||||||
| * | | Clean up IKE_SA state if IKE_SA_INIT request does not have message ID 0 | Martin Willi | 2013-03-11 | 1 | -0/+4 | |
| | | | ||||||
| * | | Ignore fourth Qick Mode message sent by Windows servers. | Martin Willi | 2013-03-11 | 1 | -0/+9 | |
| | | | | | | | | | Initial patch by Paul Stewart, fixes #289. | |||||
| * | | As Quick Mode initiator, select a subset of the proposed and the returned TS | Martin Willi | 2013-03-07 | 1 | -4/+11 | |
| | | | | | | | | | | | | | | | | | Cisco 5505 firewalls don't return the port if we send a specific one, letting the is_contained_in() checks fail. Using get_subset() selection builds the Quick Mode correctly with the common subset of selectors. Based on an initial patch from Paul Stewart. | |||||
| * | | instead of cloning use extract_buf() method | Andreas Steffen | 2013-03-04 | 1 | -1/+1 | |
| | | | ||||||
| * | | Fixed Doxygen comments after scanning complete src directory | Tobias Brunner | 2013-03-02 | 4 | -5/+5 | |
| | | | ||||||
| * | | Removed backend for old Android frontend patch | Tobias Brunner | 2013-03-02 | 12 | -923/+82 | |
| | | | | | | | | | Moved the remaining DNS handler to a new plugin. | |||||
| * | | added ERX_SUPPORTED IKEv2 Notify | Andreas Steffen | 2013-03-02 | 2 | -7/+11 | |
| | | | ||||||
| * | | Merge branch 'multi-eap' | Martin Willi | 2013-03-01 | 2 | -28/+50 | |
| |\ \ | | | | | | | | | | | | | | | | Fixes the use of EAP methods in the non-first authentication round if the initiator demands mutual EAP. Also mutual EAP can now be enforced when the initiator sets rightauth=eap, not only with rightauth=any. | |||||
| | * | | Apply a mutual EAP auth_cfg not before the EAP method completes | Martin Willi | 2013-02-26 | 2 | -1/+18 | |
| | | | | ||||||
| | * | | Be a little more verbose why a peer_cfg is inacceptable | Martin Willi | 2013-02-26 | 1 | -8/+16 | |
| | | | | ||||||
| | * | | Refactor auth_cfg applying to a common function | Martin Willi | 2013-02-26 | 1 | -20/+17 | |
| | | | | ||||||
| * | | | Merge branch 'multi-cert' | Martin Willi | 2013-03-01 | 1 | -15/+32 | |
| |\ \ \ | | | | | | | | | | | | | | | | | Allows the configuration of multiple certificates in leftcert, and select the correct certificate to use based on the received certificate requests. | |||||
| | * | | | Load multiple comma seperarated certificates in the leftcert option | Martin Willi | 2013-01-18 | 1 | -15/+32 | |
| | | | | | ||||||
| * | | | | Merge branch 'systime' | Martin Willi | 2013-03-01 | 6 | -0/+452 | |
| |\ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | Add a systime-fix plugin allowing an embedded system to validate certificates if the system time has not been synchronized after boot. Certificates of established tunnels can be re-validated after the system time gets valid. | |||||
| | * | | | | systime-fix disables certificate lifetime validation if system time not synced | Martin Willi | 2013-02-19 | 4 | -0/+326 | |
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The system time can be periodically checked. If it gets valid, certificates get rechecked with the current lifetime. If certificates are invalid, associated IKE_SAs can be closed or reauthenticated. | |||||
| | * | | | | Add a stub for systime-fix, a plugin handling certificate lifetimes gracefully | Martin Willi | 2013-02-19 | 4 | -0/+126 | |
| | | |_|/ | |/| | | ||||||
| * | | | | Merge branch 'ikev1-rekeying' | Martin Willi | 2013-03-01 | 1 | -0/+21 | |
| |\ \ \ \ | | | | | | | | | | | | | | | | | | | | | Migrates Quick Modes to the new Main Mode if an IKEv1 reauthentication replaces the old Main Mode having a uniqueids=replace policy. | |||||
| | * | | | | When detecting a duplicate IKEv1 SA, adopt children, as it might be a rekeying | Martin Willi | 2013-02-20 | 1 | -0/+21 | |
| | | | | | | ||||||
| * | | | | | Merge branch 'vip-shunts' | Martin Willi | 2013-03-01 | 1 | -11/+6 | |
| |\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Installs bypass policies for the physical address if a virtual address is assigned, and installs a proper source route to actually use the physical address for bypassed destinations. Conflicts: src/libcharon/plugins/unity/unity_handler.c | |||||
| | * | | | | | Include local address for Unity Split-Exclude shunt policies | Martin Willi | 2013-02-20 | 1 | -10/+5 | |
| | |/ / / / | | | | | | | | | | | | | | | | | | | | | If we use a virtual IP, having a shunt policy for just that wouldn't work, as we want a shunt bypass using the local address. | |||||
| * | | | | | Merge branch 'opaque-ports' | Martin Willi | 2013-03-01 | 7 | -12/+18 | |
| |\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | Adds a %opaque port option and support for port ranges in left/rightprotoport. Currently not supported by any of our kernel backends. | |||||
| | * | | | | | Don't reject OPAQUE ports while verifying traffic selector substructure | Martin Willi | 2013-02-21 | 1 | -1/+5 | |
| | | | | | | | ||||||
 |
index : tteras/strongswan | |
| tteras' strongSwan tree | gitolite |
| aboutsummaryrefslogtreecommitdiffstats |