| Commit message (Collapse) | Author | Age | Files | Lines | |
|---|---|---|---|---|---|
| * | Remove kernel-klips plugin | Tobias Brunner | 2014-06-19 | 6 | -3157/+0 |
| | | |||||
| * | kernel-interface: Add a replay_window parameter to add_sa() | Martin Willi | 2014-06-17 | 1 | -2/+3 |
| | | |||||
| * | plugins: Don't link with -rdynamic on Windows | Martin Willi | 2014-06-04 | 1 | -1/+1 |
| | | |||||
| * | kernel-klips: Pass a pointer to a properly sized integer for algorithm lookup | Martin Willi | 2014-05-16 | 1 | -1/+1 |
| | | |||||
| * | libhydra: Use lib->ns instead of hydra->daemon | Tobias Brunner | 2014-02-12 | 1 | -5/+5 |
| | | |||||
| * | kernel: Use a time_t to report use time in query_policy() | Martin Willi | 2013-10-11 | 1 | -1/+1 |
| | | |||||
| * | kernel: Use a time_t to report use time in query_sa() | Martin Willi | 2013-10-11 | 1 | -1/+1 |
| | | |||||
| * | automake: replace INCLUDES by AM_CPPFLAGS | Martin Willi | 2013-07-18 | 1 | -3/+5 |
| | | | | | | | INCLUDES are now deprecated and throw warnings when using automake 1.13. We now also differentiate AM_CPPFLAGS and AM_CFLAGS, where includes and defines are passed to AM_CPPFLAGS only. | ||||
| * | linked-list: Remove barely used find_last() method | Tobias Brunner | 2013-07-17 | 1 | -2/+3 |
| | | |||||
| * | Use strpfx() helper where appropriate | Tobias Brunner | 2013-07-08 | 1 | -2/+2 |
| | | |||||
| * | kernel-interface: add an exchange initiator parameter to add_sa() | Martin Willi | 2013-06-11 | 1 | -2/+2 |
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This new flag gives the kernel-interface a hint how it should priorize the use of newly installed SAs during rekeying. Consider the following rekey procedure in IKEv2: Initiator --- Responder I1 -------CREATE-------> R1 I2 <------CREATE-------- -------DELETE-------> R2 I3 <------DELETE-------- SAs are always handled as pairs, the following happens at the SA level: * Initiator starts the exchange at I1 * Responder installs new SA pair at R1 * Initiator installs new SA pair at I2 * Responder removes old SA pair at R2 * Initiator removes old SA pair at I3 This makes sure SAs get installed/removed overlapping during rekeying. However, to avoid any packet loss, it is crucial that the new outbound SA gets activated at the correct position: * as exchange initiator, in I2 * as exchange responder, in R2 This should guarantee that we don't use the new outbound SA before the peer could install its corresponding inbound SA. The new parameter allows the kernel backend to install the new SA with appropriate priorities, i.e. it should: * as exchange inititator, have the new outbound SA installed with higher priority than the old SA * as exchange responder, have the new outbound SA installed with lower priority than the old SA While we could split up the SA installation at the responder, this approach has another advantage: it allows the kernel backend to switch SAs based on other criteria, for example when receiving traffic on the new inbound SA. | ||||
| * | kernel-interface: query SAD for last use time if SPD query didn't yield one | Martin Willi | 2013-05-06 | 1 | -1/+1 |
| | | |||||
| * | kernel-interface: get_address_by_ts() can tell if a returned IP is virtual | Martin Willi | 2013-05-06 | 1 | -1/+1 |
| | | |||||
| * | kernel_ipsec_t.query_sa() additionally returns the number of processed packets | Martin Willi | 2013-03-14 | 1 | -2/+2 |
| | | |||||
| * | Moved debug.[ch] to utils folder | Tobias Brunner | 2012-10-24 | 1 | -1/+1 |
| | | |||||
| * | Moved data structures to new collections subfolder | Tobias Brunner | 2012-10-24 | 1 | -1/+1 |
| | | |||||
| * | Make it easy to check if an address is locally usable via changed ↵ | Tobias Brunner | 2012-09-21 | 1 | -3/+3 |
| | | | | | get_interface() method | ||||
| * | Use source address in get_nexthop() call | Tobias Brunner | 2012-09-21 | 1 | -1/+1 |
| | | | | | | Otherwise the nexthop returned might belong to a different route than the one actually used with the current source address. | ||||
| * | Added algorithm lookup via kernel_interface_t to the various kernel interfaces | Tobias Brunner | 2012-09-13 | 1 | -4/+20 |
| | | |||||
| * | Let kernel interfaces decide how to enable UDP decapsulation of ESP packets. | Tobias Brunner | 2012-08-08 | 1 | -8/+4 |
| | | |||||
| * | Check rng return value when generating SPIs in kernel-klips plugin | Tobias Brunner | 2012-07-16 | 1 | -3/+3 |
| | | |||||
| * | Centralized thread cancellation in processor_t | Tobias Brunner | 2012-06-25 | 1 | -12/+3 |
| | | | | | | | | | | | This ensures that no threads are active when plugins and the rest of the daemon are unloaded. callback_job_t was simplified a lot in the process as its main functionality is now contained in processor_t. The parent-child relationships were abandoned as these were only needed to simplify job cancellation. | ||||
| * | The kernel-klips plugin does currently not support SAD/SPD flushing. | Tobias Brunner | 2011-10-21 | 1 | -0/+2 |
| | | |||||
| * | Add features support to kernel-klips plugin | Martin Willi | 2011-10-14 | 1 | -5/+12 |
| | | |||||
| * | Remove policies in kernel interfaces based on their priority. | Tobias Brunner | 2011-07-27 | 1 | -7/+10 |
| | | | | | | | This allows to unroute a connection while the same connection is currently established. In this case both CHILD_SAs share the same reqid but the installed policies have different priorities. | ||||
| * | Fixed common misspellings. | Tobias Brunner | 2011-07-20 | 1 | -1/+1 |
| | | | | | Mostly found by 'codespell'. | ||||
| * | Add the reqid to kernel_ipsec_t.del_policy. | Tobias Brunner | 2011-07-06 | 1 | -2/+2 |
| | | |||||
| * | Use CRITICAL job priority class for long running dispatcher jobs | Martin Willi | 2011-05-16 | 1 | -2/+2 |
| | | |||||
| * | Added an esn parameter to the kernel interface add_sa functions | Martin Willi | 2011-04-20 | 1 | -1/+1 |
| | | |||||
| * | Added a (not yet implemented) plugin_t method to reload plugin configuration | Martin Willi | 2011-04-15 | 1 | -0/+1 |
| | | |||||
| * | Added a get_name() function to plugin_t, create_plugin_enumerator enumerates ↵ | Martin Willi | 2011-04-15 | 1 | -0/+7 |
| | | | | | over plugin_t | ||||
| * | Kernel interface updated for KLIPS plugin (TFC padding). | Tobias Brunner | 2011-02-10 | 1 | -1/+1 |
| | | |||||
| * | commas, commas, .. | Andreas Steffen | 2010-11-25 | 1 | -2/+2 |
| | | |||||
| * | INIT allocates memory | Andreas Steffen | 2010-11-25 | 1 | -1/+1 |
| | | |||||
| * | Migrated kernel_klips_plugin_t to INIT/METHOD macros | Andreas Steffen | 2010-11-25 | 1 | -6/+9 |
| | | |||||
| * | Charon specific strongswan.conf options generalized. | Tobias Brunner | 2010-09-02 | 1 | -6/+8 |
| | | |||||
| * | Fixing installation of trap policies (SPI=0) in kernel interface. | Tobias Brunner | 2010-09-02 | 1 | -7/+9 |
| | | |||||
| * | Added an option to specify the type of a policy to kernel_ipsec.add_policy. | Tobias Brunner | 2010-09-02 | 1 | -1/+1 |
| | | | | | | This will later allow us to support pluto's passthrough and drop policies in charon. | ||||
| * | Replaced the protocol argument in add_policy with an optional SPI for an AH SA. | Tobias Brunner | 2010-09-02 | 1 | -2/+2 |
| | | |||||
| * | Refer to scheduler and processor via lib and not hydra. | Tobias Brunner | 2010-09-02 | 1 | -2/+2 |
| | | |||||
| * | Moved all kernel plugins to libhydra. | Tobias Brunner | 2010-09-02 | 6 | -0/+3123 |
 |
index : tteras/strongswan | |
| tteras' strongSwan tree | gitolite |
| aboutsummaryrefslogtreecommitdiffstats |