| Commit message (Collapse) | Author | Age | Files | Lines | ||
|---|---|---|---|---|---|---|
| ... | ||||||
| * | | Merge branch 'stroke-counters' | Martin Willi | 2013-03-18 | 3 | -11/+185 | |
| |\ \ | | | | | | | | | | | | | Extend stroke counters functionality by connection specific counters, and a resetcounters command to reset the global or connection counters. | |||||
| | * | | Add a "resetcounters" command to ipsec, clearing global or connection counters | Martin Willi | 2013-03-15 | 3 | -1/+38 | |
| | | | | ||||||
| | * | | Add connection name specific stroke counters | Martin Willi | 2013-03-15 | 3 | -11/+148 | |
| | | | | ||||||
| * | | | Merge branch 'stroke-timeout' | Martin Willi | 2013-03-18 | 2 | -22/+94 | |
| |\ \ \ | |_|/ |/| | | | | | Add a strongswan.conf timeout option for stroke control commands. | |||||
| | * | | If controller operations have a callback, don't succeed before hook gets called | Martin Willi | 2013-03-07 | 1 | -4/+12 | |
| | | | | ||||||
| | * | | Add a stroke command timeout option, and report status of completed command | Martin Willi | 2013-03-07 | 1 | -18/+82 | |
| | |/ | ||||||
| * | | Add missing XAuthRespPSK switch case to IKEv1 key derivation | Martin Willi | 2013-03-12 | 1 | -0/+1 | |
| | | | ||||||
| * | | Support mutliple subnets and ranges as external load-tester addresses | Martin Willi | 2013-03-11 | 1 | -15/+59 | |
| | | | ||||||
| * | | Clean up IKE_SA state if IKE_SA_INIT request does not have message ID 0 | Martin Willi | 2013-03-11 | 1 | -0/+4 | |
| | | | ||||||
| * | | Ignore fourth Qick Mode message sent by Windows servers. | Martin Willi | 2013-03-11 | 1 | -0/+9 | |
| | | | | | | | | | Initial patch by Paul Stewart, fixes #289. | |||||
| * | | As Quick Mode initiator, select a subset of the proposed and the returned TS | Martin Willi | 2013-03-07 | 1 | -4/+11 | |
| | | | | | | | | | | | | | | | | | Cisco 5505 firewalls don't return the port if we send a specific one, letting the is_contained_in() checks fail. Using get_subset() selection builds the Quick Mode correctly with the common subset of selectors. Based on an initial patch from Paul Stewart. | |||||
| * | | instead of cloning use extract_buf() method | Andreas Steffen | 2013-03-04 | 1 | -1/+1 | |
| | | | ||||||
| * | | Fixed Doxygen comments after scanning complete src directory | Tobias Brunner | 2013-03-02 | 4 | -5/+5 | |
| | | | ||||||
| * | | Removed backend for old Android frontend patch | Tobias Brunner | 2013-03-02 | 12 | -923/+82 | |
| | | | | | | | | | Moved the remaining DNS handler to a new plugin. | |||||
| * | | added ERX_SUPPORTED IKEv2 Notify | Andreas Steffen | 2013-03-02 | 2 | -7/+11 | |
| | | | ||||||
| * | | Merge branch 'multi-eap' | Martin Willi | 2013-03-01 | 2 | -28/+50 | |
| |\ \ | | | | | | | | | | | | | | | | Fixes the use of EAP methods in the non-first authentication round if the initiator demands mutual EAP. Also mutual EAP can now be enforced when the initiator sets rightauth=eap, not only with rightauth=any. | |||||
| | * | | Apply a mutual EAP auth_cfg not before the EAP method completes | Martin Willi | 2013-02-26 | 2 | -1/+18 | |
| | | | | ||||||
| | * | | Be a little more verbose why a peer_cfg is inacceptable | Martin Willi | 2013-02-26 | 1 | -8/+16 | |
| | | | | ||||||
| | * | | Refactor auth_cfg applying to a common function | Martin Willi | 2013-02-26 | 1 | -20/+17 | |
| | | | | ||||||
| * | | | Merge branch 'multi-cert' | Martin Willi | 2013-03-01 | 1 | -15/+32 | |
| |\ \ \ | | | | | | | | | | | | | | | | | Allows the configuration of multiple certificates in leftcert, and select the correct certificate to use based on the received certificate requests. | |||||
| | * | | | Load multiple comma seperarated certificates in the leftcert option | Martin Willi | 2013-01-18 | 1 | -15/+32 | |
| | | | | | ||||||
| * | | | | Merge branch 'systime' | Martin Willi | 2013-03-01 | 6 | -0/+452 | |
| |\ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | Add a systime-fix plugin allowing an embedded system to validate certificates if the system time has not been synchronized after boot. Certificates of established tunnels can be re-validated after the system time gets valid. | |||||
| | * | | | | systime-fix disables certificate lifetime validation if system time not synced | Martin Willi | 2013-02-19 | 4 | -0/+326 | |
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The system time can be periodically checked. If it gets valid, certificates get rechecked with the current lifetime. If certificates are invalid, associated IKE_SAs can be closed or reauthenticated. | |||||
| | * | | | | Add a stub for systime-fix, a plugin handling certificate lifetimes gracefully | Martin Willi | 2013-02-19 | 4 | -0/+126 | |
| | | |_|/ | |/| | | ||||||
| * | | | | Merge branch 'ikev1-rekeying' | Martin Willi | 2013-03-01 | 1 | -0/+21 | |
| |\ \ \ \ | | | | | | | | | | | | | | | | | | | | | Migrates Quick Modes to the new Main Mode if an IKEv1 reauthentication replaces the old Main Mode having a uniqueids=replace policy. | |||||
| | * | | | | When detecting a duplicate IKEv1 SA, adopt children, as it might be a rekeying | Martin Willi | 2013-02-20 | 1 | -0/+21 | |
| | | | | | | ||||||
| * | | | | | Merge branch 'vip-shunts' | Martin Willi | 2013-03-01 | 1 | -11/+6 | |
| |\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Installs bypass policies for the physical address if a virtual address is assigned, and installs a proper source route to actually use the physical address for bypassed destinations. Conflicts: src/libcharon/plugins/unity/unity_handler.c | |||||
| | * | | | | | Include local address for Unity Split-Exclude shunt policies | Martin Willi | 2013-02-20 | 1 | -10/+5 | |
| | |/ / / / | | | | | | | | | | | | | | | | | | | | | If we use a virtual IP, having a shunt policy for just that wouldn't work, as we want a shunt bypass using the local address. | |||||
| * | | | | | Merge branch 'opaque-ports' | Martin Willi | 2013-03-01 | 7 | -12/+18 | |
| |\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | Adds a %opaque port option and support for port ranges in left/rightprotoport. Currently not supported by any of our kernel backends. | |||||
| | * | | | | | Don't reject OPAQUE ports while verifying traffic selector substructure | Martin Willi | 2013-02-21 | 1 | -1/+5 | |
| | | | | | | | ||||||
| | * | | | | | Pass complete port range over stroke interface for more flexibility | Martin Willi | 2013-02-21 | 1 | -14/+4 | |
| | | | | | | | ||||||
| | * | | | | | Use a complete port range in traffic_selector_create_from_{subnet,cidr} | Martin Willi | 2013-02-21 | 6 | -14/+24 | |
| | | |/ / / | |/| | | | ||||||
| * | | | | | Without MOBIKE, update remote host only if it is behind NAT | Martin Willi | 2013-03-01 | 1 | -2/+3 | |
| | | | | | | ||||||
| * | | | | | Merge branch 'ikev1-mm-retransmits' | Martin Willi | 2013-03-01 | 4 | -45/+55 | |
| |\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes retransmit of the last Main Mode or IKE_AUTH message, and correctly queues Main Mode messages when processing of the last message is still in progress. | |||||
| | * | | | | | For IKEv1 Main Mode, use message hash to detect early retransmissions | Martin Willi | 2013-02-25 | 1 | -10/+23 | |
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As the message ID is zero in all Main Mode messages, it can't be used to detect if we are already processing a given message. | |||||
| | * | | | | | Move initial message dropping to task manager | Martin Willi | 2013-02-25 | 3 | -19/+27 | |
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When the last request message of the initial tunnel setup is retransmitted, we must retransmit the response instead of ignoring the request. Fixes #295. | |||||
| | * | | | | | Use INIT macro to initialize IKE_SA manager entries | Martin Willi | 2013-02-25 | 1 | -17/+6 | |
| | | |/ / / | |/| | | | ||||||
| * | | | | | Merge branch 'tfc-notify' | Martin Willi | 2013-03-01 | 1 | -0/+9 | |
| |\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | Introduces kernel backend features, sends ESP_TFC_PADDING_NOT_SUPPORTED if kernel does not support it. | |||||
| | * | | | | | Send ESP_TFC_PADDING_NOT_SUPPORTED if the used kernel doesn't support it | Martin Willi | 2013-03-01 | 1 | -0/+9 | |
| | | |/ / / | |/| | | | ||||||
| * | | | | | Trigger an updown event when destroying an IKE_SA based on INITIAL_CONTACT | Tobias Brunner | 2013-02-28 | 1 | -0/+1 | |
| | |_|_|/ |/| | | | | | | | | | | | | | | | In other cases (i.e. when functions return DESTROY_ME) the event should already be triggered, but not in this forced situation. | |||||
| * | | | | Android.mk updated to latest Makefiles | Tobias Brunner | 2013-02-26 | 1 | -1/+1 | |
| | |/ / |/| | | | | | | | | Fixes #300. | |||||
| * | | | treat IF-M and IF-TNCCS remediation instructions/parameters in an equal way | Andreas Steffen | 2013-02-19 | 3 | -97/+198 | |
| | | | | ||||||
| * | | | Streamlined log messages in ipseckey plugin | Andreas Steffen | 2013-02-19 | 2 | -58/+30 | |
| | | | | ||||||
| * | | | ipseckey: Report IPSECKEYs with invalid DNSSEC security state | Reto Guadagnini | 2013-02-19 | 1 | -2/+12 | |
| | | | | ||||||
| * | | | ipseckey: Added "enable" option for the IPSECKEY plugin to strongswan.conf | Reto Guadagnini | 2013-02-19 | 1 | -3/+16 | |
| | | | | ||||||
| * | | | Added ipseckey plugin, which provides support for public keys in IPSECKEY RRs | Reto Guadagnini | 2013-02-19 | 8 | -0/+859 | |
| | | | | ||||||
| * | | | added missing return statement | Andreas Steffen | 2013-02-19 | 1 | -0/+1 | |
| | | | | ||||||
| * | | | reject PB-Experimental messages with NOSKIP flag set | Andreas Steffen | 2013-02-19 | 1 | -0/+7 | |
| | | | | ||||||
| * | | | Add a timeout to clean up PDP RADIUS connections | Martin Willi | 2013-02-14 | 1 | -0/+51 | |
| | | | | ||||||
| * | | | Keep the PDP connections lock while accessing its objects | Martin Willi | 2013-02-14 | 3 | -7/+34 | |
| | | | | | | | | | | | | | | | | | | | When we introduce connection timeouts, the state may disappear at any time. This change prevents that, but is not very clear. We probably have to refactor connection handling. | |||||
 |
index : tteras/strongswan | |
| tteras' strongSwan tree | gitolite |
| aboutsummaryrefslogtreecommitdiffstats |