| Commit message (Collapse) | Author | Age | Files | Lines | ||
|---|---|---|---|---|---|---|
| ... | ||||||
| * | | Act on RADIUS DAE Disconnect requests | Martin Willi | 2012-03-05 | 1 | -1/+56 | |
| | | | ||||||
| * | | Verify received RADIUS DAE requests | Martin Willi | 2012-03-05 | 1 | -9/+51 | |
| | | | ||||||
| * | | Support verification of RADIUS request messages | Martin Willi | 2012-03-05 | 2 | -3/+10 | |
| | | | ||||||
| * | | Rename RADIUS message constructors to handle both, requests and responses | Martin Willi | 2012-03-05 | 6 | -15/+15 | |
| | | | ||||||
| * | | Enable RADIUS DAE listening if configured | Martin Willi | 2012-03-05 | 1 | -0/+13 | |
| | | | ||||||
| * | | Added infrastructure to listen to RADIUS Dynamic Authorization Extension ↵ | Martin Willi | 2012-03-05 | 3 | -0/+228 | |
| | | | | | | | | | requests | |||||
| * | | Added Dynamic Authorization Extension RADIUS message codes | Martin Willi | 2012-03-05 | 2 | -1/+14 | |
| | | | ||||||
| * | | Set IKE_SA lifetime based on RADIUS Session-Timeout attribute | Martin Willi | 2012-03-05 | 1 | -0/+26 | |
| | | | ||||||
| * | | Set hard timeouts when setting a lifetime | Martin Willi | 2012-03-05 | 1 | -7/+14 | |
| | | | ||||||
| * | | Fix IKE_SA timeout debug output on 64bit platforms | Martin Willi | 2012-03-05 | 1 | -3/+4 | |
| | | | ||||||
| * | | Added support for untruncated MD5 and SHA1 HMACs in ESP as used in RFC 4595. | Tobias Brunner | 2012-02-27 | 1 | -0/+2 | |
| | | | | | | | | | This requires a Linux kernel >= 2.6.33. | |||||
| * | | Encode IPv6 virtual IPs in a Framed-IPv6-Prefix attribute | Martin Willi | 2012-02-24 | 1 | -1/+9 | |
| | | | ||||||
| * | | Refactored construction of RADIUS accounting messages | Martin Willi | 2012-02-24 | 1 | -23/+21 | |
| | | | ||||||
| * | | Include port numbers in Calling-Station-Id, too | Martin Willi | 2012-02-24 | 1 | -2/+2 | |
| | | | ||||||
| * | | Use large enough buffers for IPv6 addresses in Calling-Station-Id | Martin Willi | 2012-02-24 | 1 | -2/+2 | |
| | | | ||||||
| * | | Send client external address as Calling-Station-Id in RADIUS accounting | Martin Willi | 2012-02-24 | 1 | -6/+11 | |
| | | | ||||||
| * | | Some Doxygen fixes. | Tobias Brunner | 2012-02-07 | 2 | -2/+2 | |
| | | | ||||||
| * | | Update usage for all children in RADIUS accounting just before sending Stop | Martin Willi | 2012-02-06 | 1 | -1/+12 | |
| | | | ||||||
| * | | Check if ClusterIP directory could be opened before enumerating it | Martin Willi | 2012-02-06 | 1 | -17/+26 | |
| | | | ||||||
| * | | Trigger DPD not before IKE_SA state gets updated | Martin Willi | 2012-02-02 | 1 | -6/+8 | |
| | | | ||||||
| * | | Don't retransmit, rekey, reauth or DPD check SAs when in PASSIVE state | Martin Willi | 2012-02-02 | 1 | -0/+26 | |
| | | | ||||||
| * | | Added an option to load CA certificates without CA basic constraint. | Tobias Brunner | 2012-02-01 | 1 | -4/+34 | |
| | | | | | | | | | | | | | Enabling this option treats all certificates in ipsec.d/cacerts and ipsec.conf ca sections as CA certificates even if they do not contain a CA basic constraint. | |||||
| * | | Support RADIUS accounting messages containing Framed-IP and ↵ | Martin Willi | 2012-01-30 | 4 | -0/+376 | |
| | | | | | | | | | Inbound/Outbound-Octets | |||||
| * | | Open RADIUS accounting sockets to exchange accounting messages | Martin Willi | 2012-01-30 | 5 | -46/+91 | |
| | | | ||||||
| * | | Support signing of RADIUS accounting messages | Martin Willi | 2012-01-30 | 3 | -10/+26 | |
| | | | ||||||
| * | | RADIUS message constructor accepts a message code parameter | Martin Willi | 2012-01-30 | 3 | -7/+8 | |
| | | | ||||||
| * | | Cache list of plugin names to further simplify its usage. | Tobias Brunner | 2012-01-19 | 2 | -19/+5 | |
| | | | | | | | | | Also helpful for ipsec statusall to avoid having to enumerate plugins. | |||||
| * | | Simplified logging of list of loaded plugins. | Tobias Brunner | 2012-01-19 | 2 | -23/+9 | |
| | | | ||||||
| * | | Destroy active task list before queued tasks | Thomas Egerer | 2012-01-18 | 1 | -3/+3 | |
| | | | | | | | | | | | | | | | Since active task's destruction might result in adopting tasks from a rekeyed ike sa it seems better to first destroy the active task list and then destroy all queued tasks. This way adoption is possible at all, while otherwise the queued task list would be empty. | |||||
| * | | Android 4 requires LOCAL_MODULE_TAGS to be set for all modules. | Tobias Brunner | 2012-01-12 | 1 | -0/+2 | |
| | | | | | | | | | | | | | | | Because all packages are now marked as optional executables that are to be installed on the final system have to be added to PRODUCT_PACKAGES in build/target/product/core.mk. Dependencies (such as libraries) are installed automatically. | |||||
| * | | Fixed additional typos in comments and log messages. | Tobias Brunner | 2012-01-12 | 2 | -3/+3 | |
| | | | ||||||
| * | | Implemented TLS session resumption both as client and as server | Martin Willi | 2011-12-31 | 3 | -5/+7 | |
| | | | ||||||
| * | | Make number of concurrently handled stroke messages configurable. | Tobias Brunner | 2011-12-29 | 1 | -2/+9 | |
| | | | ||||||
| * | | Limit the number of concurrently handled stroke messages. | Tobias Brunner | 2011-12-29 | 1 | -18/+104 | |
| | | | | | | | | | This avoids clogging the thread pool with potentially blocking jobs. | |||||
| * | | Fix deadlock in trap_manager_t during acquire. | Tobias Brunner | 2011-12-23 | 1 | -28/+43 | |
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Also fixes a TOCTOU issue regarding the use of entry_t.pending. The deadlock was caused because the rwlock was being locked while waiting for an IKE_SA. Triggering the deadlock was a bit tricky, here is the description by Thomas Egerer (the reporter of this issue): " The deadlock occurs when the following happens (in the given order): a) an IKE_SA is built and a thread is processing the IKE_AUTH request, which can take a bit longer when a smartcard is involved. This causes the ike_sa_manager to lock a particular IKE_SA exclusively. b) an acquire is triggered which causes the rwlock in the trap_manager to be read-locked, the subsequent call to ike_sa_manager->checkout_by_config has to wait until a) unlocks it's ike_sa. c) a child_cfg contained in the peer_cfg belonging to the ike_sa a) has locked is routed causes the child_configs contained in the peer config to be locked by c) while the actual routing code within trap_manager tries to writelock it's rwlock. That's about it. As soon as a) finishes authentication of the peer and tries to find a matching child sa it will try to lock the child configs of the peer config which is not possible since it has been locked by c). Thread | Resource locked | Resource desired -------+--------------------------------+-------------------------------- (a) | ike_sa in ike_sa_manager | child_cfgs of peer_cfg | | (b) | rwlock in trap-manager (read) | ike_sa in ike_sa_manager | | (c) | child_cfgs of peer_cfg | rwlock in trap-manager (write) " With this patch thread (b) now does not hold the lock while waiting for the IKE_SA. Thus (c) can get the write lock, and (a) can subsequently lock the mutex in the peer_cfg which then finally allows (b) to checkout the IKE_SA. | |||||
| * | | Fixed flush() method of trap_manager_t. | Tobias Brunner | 2011-12-23 | 1 | -3/+9 | |
| | | | | | | | | | | | A segmentation fault could have happened during destruction of the trap manager after calling flush(). | |||||
| * | | Make sure the certificate cache is flushed when plugins are unloaded. | Tobias Brunner | 2011-12-15 | 1 | -0/+2 | |
| | | | | | | | | | | | This avoids segmentation faults when plugins implementing cert_t are already unloaded when the cache is flushed during destruction. | |||||
| * | | Added missing libsimaka files to Android.mk. | Tobias Brunner | 2011-12-14 | 1 | -0/+2 | |
| | | | ||||||
| * | | Destroy mediation managers before unloading plugins. | Tobias Brunner | 2011-12-14 | 1 | -4/+4 | |
| | | | ||||||
| * | | implemented IMC/IMV ReceiveMessageLong functions | Andreas Steffen | 2011-12-09 | 1 | -0/+2 | |
| | | | ||||||
| * | | added IMC/IMV support for send_message_long() and reserve_additional_id() ↵ | Andreas Steffen | 2011-12-09 | 3 | -10/+20 | |
| | | | | | | | | | functions | |||||
| * | | implemented IF-IMC/IMV 1.3 attributes | Andreas Steffen | 2011-12-08 | 3 | -20/+224 | |
| | | | ||||||
| * | | added TNC_TNCC_GetAttribute() and TNC_TNCC_SetAttribute() functions | Andreas Steffen | 2011-12-08 | 3 | -8/+59 | |
| | | | ||||||
| * | | added TNC_IMC_ReceiveMessageLong() and TNC_IMV_ReceiveMessageLong() support | Andreas Steffen | 2011-12-08 | 6 | -51/+100 | |
| | | | ||||||
| * | | fixed typo in function name | Andreas Steffen | 2011-12-08 | 1 | -1/+1 | |
| | | | ||||||
| * | | added TNC_TNCS_ReserveAdditionalIMVID() function | Andreas Steffen | 2011-12-07 | 3 | -4/+102 | |
| | | | ||||||
| * | | return with TNC_RESULT_SUCCESS | Andreas Steffen | 2011-12-07 | 1 | -4/+5 | |
| | | | ||||||
| * | | added TNC_TNCC_ReserveAdditionalIMCID() function | Andreas Steffen | 2011-12-07 | 3 | -3/+99 | |
| | | | ||||||
| * | | added TNC_TNCC_SendMessageLong() and TNC_TNCS_SendMessageLong() functions | Andreas Steffen | 2011-12-07 | 7 | -45/+102 | |
| | | | ||||||
| * | | corrected function name in error message | Andreas Steffen | 2011-12-07 | 2 | -2/+2 | |
| | | | ||||||
 |
index : tteras/strongswan | |
| tteras' strongSwan tree | gitolite |
| aboutsummaryrefslogtreecommitdiffstats |