tteras/strongswan - tteras' strongSwan tree

	Commit message (Collapse)	Author	Age	Files	Lines
*	Use standard unsigned integer types	Andreas Steffen	2016-03-24	1	-31/+31
\|
*	libipsec: Insert SAs first, so latest SA with the same reqid gets used	Tobias Brunner	2015-05-21	1	-1/+1
\| \| \| \| \|	This was useful for testing purposes of RADIUS accounting, but OS kernels generally will use the latest SA, so we do the same.
*	libipsec: Pass separate inbound/update flags to the IPsec SA manager	Martin Willi	2015-03-09	1	-2/+3
\| \| \| \| \|	Similar to other kernel interfaces, the libipsec backends uses the flag for different purposes, and therefore should get separate flags.
*	libipsec: Remove unused src/dst_ts parameters from ipsec_sa_mgr_t.add_sa()	Martin Willi	2015-02-20	1	-3/+2
\|
*	libipsec: Remove unused reqid parameter from ipsec_sa_mgr_t.get_spi()	Martin Willi	2015-02-19	1	-5/+3
\|
*	libipsec: Enforce byte/packet lifetimes on SAs	Martin Willi	2013-10-11	1	-5/+3
\|
*	libipsec: Support usage statistics and query_sa() on IPsec SAs	Martin Willi	2013-10-11	1	-0/+23
\|
*	libipsec: Properly handle expiration if no lifetime is set	Tobias Brunner	2013-07-01	1	-0/+5
\|
*	kernel-interface: add an exchange initiator parameter to add_sa()	Martin Willi	2013-06-11	1	-1/+1
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	This new flag gives the kernel-interface a hint how it should priorize the use of newly installed SAs during rekeying. Consider the following rekey procedure in IKEv2: Initiator --- Responder I1 -------CREATE-------> R1 I2 <------CREATE-------- -------DELETE-------> R2 I3 <------DELETE-------- SAs are always handled as pairs, the following happens at the SA level: * Initiator starts the exchange at I1 * Responder installs new SA pair at R1 * Initiator installs new SA pair at I2 * Responder removes old SA pair at R2 * Initiator removes old SA pair at I3 This makes sure SAs get installed/removed overlapping during rekeying. However, to avoid any packet loss, it is crucial that the new outbound SA gets activated at the correct position: * as exchange initiator, in I2 * as exchange responder, in R2 This should guarantee that we don't use the new outbound SA before the peer could install its corresponding inbound SA. The new parameter allows the kernel backend to install the new SA with appropriate priorities, i.e. it should: * as exchange inititator, have the new outbound SA installed with higher priority than the old SA * as exchange responder, have the new outbound SA installed with lower priority than the old SA While we could split up the SA installation at the responder, this approach has another advantage: it allows the kernel backend to switch SAs based on other criteria, for example when receiving traffic on the new inbound SA.
*	Moved debug.[ch] to utils folder	Tobias Brunner	2012-10-24	1	-1/+1
\|
*	Moved data structures to new collections subfolder	Tobias Brunner	2012-10-24	1	-2/+2
\|
*	Use pointers for lookups in IPsec SA manager	Tobias Brunner	2012-10-16	1	-16/+16
\|
*	IPsec SA manager implements update_sa()	Tobias Brunner	2012-10-16	1	-0/+39
\|
*	Implemented a checkout/checkin mechanism for IPsec SAs	Tobias Brunner	2012-08-08	1	-25/+242
\| \| \| \| \|	SAs can only be checked out by a single thread and all other threads block until the SA is checked in again.
*	Schedule and relay expiration events for created IPsec SAs	Tobias Brunner	2012-08-08	1	-0/+95
\|
*	Added IPsec SA manager	Tobias Brunner	2012-08-08	1	-0/+314