| Commit message (Collapse) | Author | Age | Files | Lines | |
|---|---|---|---|---|---|
| * | kernel-interface: Add destination prefix to get_nexthop() | Tobias Brunner | 2014-06-19 | 1 | -1/+4 |
| | | | | | | This allows to determine the next hop to reach a subnet, for instance, when installing routes for shunt policies. | ||||
| * | kernel-interface: Add a replay_window parameter to add_sa() | Martin Willi | 2014-06-17 | 1 | -0/+2 |
| | | |||||
| * | kernel-interface: Add a flag to indicate no policy updates required | Martin Willi | 2014-06-04 | 1 | -0/+2 |
| | | |||||
| * | kernel: Use a time_t to report use time in query_policy() | Martin Willi | 2013-10-11 | 1 | -2/+2 |
| | | |||||
| * | kernel: Use a time_t to report use time in query_sa() | Martin Willi | 2013-10-11 | 1 | -2/+2 |
| | | |||||
| * | Fix various API doc issues and typos | Tobias Brunner | 2013-07-18 | 1 | -4/+4 |
| | | | | | Partially based on an old patch by Adrian-Ken Rueegsegger. | ||||
| * | kernel-libipsec: Add a feature to request UDP encapsulation of ESP packets | Tobias Brunner | 2013-06-21 | 1 | -0/+2 |
| | | |||||
| * | kernel: Add an event kernel interfaces can raise if they create/destroy a ↵ | Tobias Brunner | 2013-06-21 | 1 | -1/+9 |
| | | | | | TUN device | ||||
| * | kernel-interface: add an exchange initiator parameter to add_sa() | Martin Willi | 2013-06-11 | 1 | -1/+2 |
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This new flag gives the kernel-interface a hint how it should priorize the use of newly installed SAs during rekeying. Consider the following rekey procedure in IKEv2: Initiator --- Responder I1 -------CREATE-------> R1 I2 <------CREATE-------- -------DELETE-------> R2 I3 <------DELETE-------- SAs are always handled as pairs, the following happens at the SA level: * Initiator starts the exchange at I1 * Responder installs new SA pair at R1 * Initiator installs new SA pair at I2 * Responder removes old SA pair at R2 * Initiator removes old SA pair at I3 This makes sure SAs get installed/removed overlapping during rekeying. However, to avoid any packet loss, it is crucial that the new outbound SA gets activated at the correct position: * as exchange initiator, in I2 * as exchange responder, in R2 This should guarantee that we don't use the new outbound SA before the peer could install its corresponding inbound SA. The new parameter allows the kernel backend to install the new SA with appropriate priorities, i.e. it should: * as exchange inititator, have the new outbound SA installed with higher priority than the old SA * as exchange responder, have the new outbound SA installed with lower priority than the old SA While we could split up the SA installation at the responder, this approach has another advantage: it allows the kernel backend to switch SAs based on other criteria, for example when receiving traffic on the new inbound SA. | ||||
| * | kernel-interface: query SAD for last use time if SPD query didn't yield one | Martin Willi | 2013-05-06 | 1 | -1/+2 |
| | | |||||
| * | kernel-pfroute: add a feature flag requesting "exclude" routes | Martin Willi | 2013-05-06 | 1 | -0/+2 |
| | | | | | | | | | If routes installed along with policies covering the peer address affect local IKE/ESP packets, they won't get routed correctly. To work around this issue, the kernel interface can install "exclude" routes for the IKE peer. Not all networking backends require this workaround, hence we export a flag for it if it is required. | ||||
| * | kernel-interface: get_address_by_ts() can tell if a returned IP is virtual | Martin Willi | 2013-05-06 | 1 | -1/+2 |
| | | |||||
| * | kernel_ipsec_t.query_sa() additionally returns the number of processed packets | Martin Willi | 2013-03-14 | 1 | -1/+2 |
| | | |||||
| * | Introduce "features" for the kernel backends returning kernel capabilities | Martin Willi | 2013-03-01 | 1 | -0/+19 |
| | | |||||
| * | Don't wait while removing external IPs used for load testing | Martin Willi | 2012-11-29 | 1 | -1/+3 |
| | | |||||
| * | Install virtual IPs via interface name, and use an interface lookup where ↵ | Martin Willi | 2012-11-29 | 1 | -3/+2 |
| | | | | | required | ||||
| * | Add an optional kernel-interface parameter to install IPs with a custom prefix | Martin Willi | 2012-11-29 | 1 | -2/+4 |
| | | |||||
| * | Moved host_t and host_resolver_t to a new networking subfolder | Tobias Brunner | 2012-10-24 | 1 | -1/+1 |
| | | |||||
| * | Don't check interface of inbound message if interfaces are not filtered | Tobias Brunner | 2012-09-24 | 1 | -1/+8 |
| | | | | | | We don't have a proper kernel-net interface on Android yet, so the check for a usable interface does not work there. | ||||
| * | Made IP address enumeration more flexible | Tobias Brunner | 2012-09-21 | 1 | -6/+3 |
| | | | | | Also added an option to enumerate addresses on ignored interfaces. | ||||
| * | Filter ignored interfaces in kernel interfaces (for events, address ↵ | Tobias Brunner | 2012-09-21 | 1 | -1/+2 |
| | | | | | enumeration, etc.) | ||||
| * | Make it easy to check if an address is locally usable via changed ↵ | Tobias Brunner | 2012-09-21 | 1 | -2/+3 |
| | | | | | get_interface() method | ||||
| * | Don't ignore loopback devices and allow addresses on them being enumerated | Tobias Brunner | 2012-09-21 | 1 | -2/+4 |
| | | |||||
| * | Added options and a lookup function that will allow filtering of network ↵ | Tobias Brunner | 2012-09-21 | 1 | -2/+11 |
| | | | | | interfaces | ||||
| * | Use source address in get_nexthop() call | Tobias Brunner | 2012-09-21 | 1 | -2/+4 |
| | | | | | | Otherwise the nexthop returned might belong to a different route than the one actually used with the current source address. | ||||
| * | Added possibility to register custom kernel algorithms to kernel interface | Tobias Brunner | 2012-09-13 | 1 | -0/+48 |
| | | |||||
| * | Let kernel interfaces decide how to enable UDP decapsulation of ESP packets. | Tobias Brunner | 2012-08-08 | 1 | -2/+14 |
| | | |||||
| * | Defined functions in the kernel interface to flush SAD and SPD entries. | Tobias Brunner | 2011-10-21 | 1 | -0/+14 |
| | | |||||
| * | Remove policies in kernel interfaces based on their priority. | Tobias Brunner | 2011-07-27 | 1 | -4/+5 |
| | | | | | | | This allows to unroute a connection while the same connection is currently established. In this case both CHILD_SAs share the same reqid but the installed policies have different priorities. | ||||
| * | Add the reqid to kernel_ipsec_t.del_policy. | Tobias Brunner | 2011-07-06 | 1 | -3/+4 |
| | | |||||
| * | Added an esn parameter to the kernel interface add_sa functions | Martin Willi | 2011-04-20 | 1 | -1/+2 |
| | | |||||
| * | Implemented Traffic Flow Confidentiality padding in kernel_interface | Martin Willi | 2010-12-20 | 1 | -1/+2 |
| | | |||||
| * | Fixing installation of trap policies (SPI=0) in kernel interface. | Tobias Brunner | 2010-09-02 | 1 | -9/+2 |
| | | |||||
| * | Added an option to specify the type of a policy to kernel_ipsec.add_policy. | Tobias Brunner | 2010-09-02 | 1 | -2/+3 |
| | | | | | | This will later allow us to support pluto's passthrough and drop policies in charon. | ||||
| * | Replaced the protocol argument in add_policy with an optional SPI for an AH SA. | Tobias Brunner | 2010-09-02 | 1 | -3/+3 |
| | | |||||
| * | Moved kernel interface to libhydra. | Tobias Brunner | 2010-09-02 | 1 | -0/+482 |
 |
index : tteras/strongswan | |
| tteras' strongSwan tree | gitolite |
| aboutsummaryrefslogtreecommitdiffstats |