tteras/strongswan - tteras' strongSwan tree

	Commit message (Collapse)	Author	Age	Files	Lines
*	child-sa: Allow requesting different unique marks for in/out	Eyal Birger	2017-08-07	2	-2/+17
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	When requiring unique flags for CHILD_SAs, allow the configuration to request different marks for each direction by using the %unique-dir keyword. This is useful when different marks are desired for each direction but the number of peers is not predefined. An example use case is when implementing a site-to-site route-based VPN without VTI devices. A use of 0.0.0.0/0 - 0.0.0.0/0 traffic selectors with identical in/out marks results in outbound traffic being wrongfully matched against the 'fwd' policy - for which the underlay 'template' does not match - and dropped. Using different marks for each direction avoids this issue as the 'fwd' policy uses the 'in' mark will not match outbound traffic. Closes strongswan/strongswan#78.
*	ipsec: Add function to compare two ipsec_sa_cfg_t instances	Tobias Brunner	2016-06-08	2	-0/+25
\| \| \| \| \| \|	memeq() is currently used to compare these but if there is padding that is not initialized the same for two instances the comparison fails. Using this function ensures the objects are compared correctly.
*	Use standard unsigned integer types	Andreas Steffen	2016-03-24	1	-10/+10
\|
*	ipsec-types: Support the %unique mark value	Martin Willi	2015-02-20	1	-1/+9
\|
*	child-sa: Replace reqid based marks by "unique" marks	Martin Willi	2015-02-20	1	-2/+2
\| \| \| \| \| \| \| \| \| \| \|	As we now use the same reqid for multiple CHILD_SAs with the same selectors, having marks based on the reqid makes not that much sense anymore. Instead we use unique marks that use a custom identifier. This identifier is reused during rekeying, keeping the marks constant for any rule relying on it (for example installed by updown). This also simplifies handling of reqid allocation, as we do not have to query the marks that is not yet assigned for an unknown reqid.
*	ipsec: Add a fourth priority class for bypass policies	Tobias Brunner	2014-06-19	1	-1/+3
\|
*	child-sa: Pass the number of total policies tied to an SA to the kernel	Martin Willi	2014-06-04	1	-0/+2
\| \| \| \| \|	This will be useful if the kernel backend has to know how many policies follow an SA install, for example if it must install all policies concurrently.
*	Doxygen fixes	Tobias Brunner	2013-10-15	1	-1/+1
\|
*	ipsec_types: Add utility function to parse mark_t from strings	Tobias Brunner	2013-10-11	2	-2/+46
\|
*	Moved types used by kernel_ipsec_t interface (and libipsec) to libstrongswan	Tobias Brunner	2012-08-08	2	-0/+210
	This avoids a dependency of libipsec to libhydra.