| Commit message (Collapse) | Author | Age | Files | Lines | ||
|---|---|---|---|---|---|---|
| ... | ||||||
| * | Fix crash if the initiator has no suitable proposal available | Tobias Brunner | 2013-06-21 | 1 | -0/+5 | |
| | | | | | Could be triggered with a typo in the ike or esp options when ! is used. | |||||
| * | leak-detective: (re-)whitelist some OpenSSL functions | Martin Willi | 2013-06-21 | 1 | -0/+5 | |
| | | | | | | | | Some static allocations in plugins won't get freed, because in the test case process the plugins are not destroyed. If a plugin would clean up allocations done while just using the plugin, these show up as leak in the child process, letting tests fail. | |||||
| * | unit-tests: load plugins in test-runner from build directory | Martin Willi | 2013-06-21 | 2 | -1/+30 | |
| | | ||||||
| * | unit-tests: link test-runner against -lpthread | Martin Willi | 2013-06-21 | 1 | -0/+1 | |
| | | ||||||
| * | unit-tester: remove obsolete rsa_gen test, now covered in unit-tests | Martin Willi | 2013-06-21 | 3 | -122/+0 | |
| | | ||||||
| * | unit-tests: add RSA test cases, very similar to ECDSA | Martin Willi | 2013-06-21 | 4 | -1/+400 | |
| | | ||||||
| * | unit-tests: test with /dev/urandom if random plugin is in use | Martin Willi | 2013-06-21 | 1 | -0/+6 | |
| | | ||||||
| * | unit-tests: test supported ECDSA schemes only | Martin Willi | 2013-06-21 | 1 | -0/+14 | |
| | | ||||||
| * | Move test-runners has_feature() function to plugin loader | Martin Willi | 2013-06-21 | 3 | -32/+40 | |
| | | ||||||
| * | unit-tests: enforce CET/CEST timezone to properly test non-UTC time formatting | Martin Willi | 2013-06-21 | 1 | -0/+6 | |
| | | ||||||
| * | unit-tests: don't use ck_assert() to test a cleared chunk, as it allocates data | Martin Willi | 2013-06-21 | 1 | -3/+10 | |
| | | | | | The new allocation might be in the freed area, affecting the test result. | |||||
| * | unit-tests: define 64-bit constats with ULL, fixing compiler warning on 32-bit | Martin Willi | 2013-06-21 | 1 | -2/+2 | |
| | | ||||||
| * | unit-tests: test some zeroed ECDSA signatures that never should succeed | Martin Willi | 2013-06-21 | 1 | -0/+63 | |
| | | ||||||
| * | unit-tests: perform signing/validation with keys ECDSA keys generated or loaded | Martin Willi | 2013-06-21 | 1 | -0/+47 | |
| | | ||||||
| * | unit-tests: add an ECDSA test case loading keys | Martin Willi | 2013-06-21 | 1 | -0/+61 | |
| | | ||||||
| * | unit-tests: perform a first ECDSA test case if ECDSA is supported | Martin Willi | 2013-06-21 | 4 | -1/+58 | |
| | | ||||||
| * | unit-tests: add a helper function checking if a plugin feature is available | Martin Willi | 2013-06-21 | 1 | -0/+32 | |
| | | ||||||
| * | unit-tests: add a test case checking if all test vectors have been passed | Martin Willi | 2013-06-21 | 4 | -1/+44 | |
| | | ||||||
| * | crypto-factory: count the number of test vector failures during registration | Martin Willi | 2013-06-21 | 2 | -30/+73 | |
| | | ||||||
| * | unit-tests: load all libstrongswan plugins in test-runner | Martin Willi | 2013-06-21 | 2 | -0/+7 | |
| | | ||||||
| * | stroke: Add statusall-nb as alias for statusallnb | Tobias Brunner | 2013-06-21 | 2 | -1/+2 | |
| | | ||||||
| * | stroke: Add non-blocking versions of up and down | Tobias Brunner | 2013-06-21 | 3 | -5/+23 | |
| | | | | | | | stroke up-nb and stroke down-nb do not block until the command has finished. Instead, they return right after initiating the respective operation. | |||||
| * | starter: Make ipsec.conf path configurable via command line | Tobias Brunner | 2013-06-21 | 1 | -3/+14 | |
| | | ||||||
| * | pubkey: Improve comparison of raw public key certificate objects | Tobias Brunner | 2013-06-21 | 1 | -1/+11 | |
| | | ||||||
| * | ikev2: use protocol of selected proposal to delete a failed CHILD_SA | Martin Willi | 2013-06-20 | 1 | -2/+2 | |
| | | | | | Depending on the failure, the protocol might not yet be set on the CHILD_SA. | |||||
| * | charon-cmd: use a copy of pid in initiate callback | Martin Willi | 2013-06-20 | 1 | -6/+7 | |
| | | | | | | When cancelling a connection that gets established, cmd_connection_t gets freed before terminate() is called. This results in kill()ing invalid PID. | |||||
| * | charon-cmd: add IKEv1 aggressive mode profiles | Martin Willi | 2013-06-20 | 3 | -10/+35 | |
| | | ||||||
| * | stroke: support %dynamic in left/rightsubnet for dynamic selectors | Martin Willi | 2013-06-19 | 1 | -2/+10 | |
| | | | | | | | | This has the same meaning as omitting left/rightsubnet, i.e. replace it by the IKE address. Supporting %dynamic allows configurations with multiple dynamic selectors in a left/rightsubnet, each with potentially different proto/port selectors. | |||||
| * | kernel-netlink: install selectors on SA for transport/BEET mode without ↵ | Martin Willi | 2013-06-19 | 1 | -0/+6 | |
| | | | | | | | | | proto/port If a transport/BEET SA has different selectors for different proto/ports, installing just the proto/port of the first SA would break any additional selector. | |||||
| * | stroke: support a specific proto/port for each net defined in left/rightsubnet | Martin Willi | 2013-06-19 | 1 | -3/+105 | |
| | | ||||||
| * | ikev2: properly fall back to tunnel mode if transport/BEET mode not configured | Martin Willi | 2013-06-19 | 1 | -2/+8 | |
| | | ||||||
| * | ikev2: support transport mode over NAT | Martin Willi | 2013-06-19 | 1 | -36/+150 | |
| | | ||||||
| * | ike: reuse the reqid of an installed trap having the same config | Martin Willi | 2013-06-19 | 1 | -1/+5 | |
| | | | | | | | | When we have a trap installed, but a CHILD_SA gets established for the same config from the peer, we should reuse the same reqid. Otherwise we would have two identical policies using different reqids, what we can't handle in our kernel backend. | |||||
| * | trap-manager: add a method to find reqid for installed traps by config | Martin Willi | 2013-06-19 | 2 | -2/+38 | |
| | | ||||||
| * | trap-manager: don't check-in nonexisting IKE_SA if acquire fails | Martin Willi | 2013-06-19 | 1 | -2/+1 | |
| | | ||||||
| * | trap-manager: fix a memleak when installing a trap to %any | Martin Willi | 2013-06-19 | 1 | -0/+1 | |
| | | ||||||
| * | kernel-netlink: reject policy refcount if the reqid differs | Martin Willi | 2013-06-19 | 1 | -4/+17 | |
| | | | | | | | | | | | | | | Previously we silently replaced an existing policy with a new one if the reqid changed for the same selectors. This will break an old policy in the favour of the new one (for example if two clients behind the same NAT use transport mode). With this change any new policy gets rejected if the reqid differs. This will make sure we break no existing policy. For rekeying and acquires we still can have overlapping policies (as we use the same reqid), but for unrelated connections this is not true anymore (it wasn't actually before, we just silently broke the existing policy). | |||||
| * | stroke: add exportconn{cert,chain} commands in addition to exportx509 | Martin Willi | 2013-06-19 | 5 | -7/+80 | |
| | | | | | | The new commands either export a single end entity certificate or the full trust chain for a specific connection name. | |||||
| * | Raise an alert if the responding peer narrowed traffic selectors | Martin Willi | 2013-06-19 | 2 | -7/+28 | |
| | | ||||||
| * | backtrace: use backtrace_symbols() only if we have backtrace() and dladdr() ↵ | Martin Willi | 2013-06-19 | 1 | -5/+16 | |
| | | | | | fails | |||||
| * | utils: Remove volatile qualifier from refcount_t typedef | Tobias Brunner | 2013-06-19 | 1 | -2/+1 | |
| | | | | | | It's not really required anymore (if it ever was) and may cause compiler warnings when using the non atomic versions of ref_get/ref_put. | |||||
| * | dhcp: search for transactions only for connections having a poolname "dhcp" | Martin Willi | 2013-06-18 | 1 | -1/+6 | |
| | | | | | | | When a connection has a single pool that queries recursively the DHCP backend, we shouldn't return any attributes directly from DHCP when queried for that pool. | |||||
| * | starter: ignore return value of sete[gu]id(), now having warn_unused_result | Martin Willi | 2013-06-18 | 1 | -5/+4 | |
| | | ||||||
| * | socket-default: Make sure sockets are open when checking with FD_ISSET | Tobias Brunner | 2013-06-14 | 1 | -4/+4 | |
| | | ||||||
| * | socket-default: Properly initialize NAT-T port if opening regular socket failed | Tobias Brunner | 2013-06-14 | 1 | -1/+2 | |
| | | ||||||
| * | android: Forward initiator flag to libipsec when adding IPsec SA | Tobias Brunner | 2013-06-13 | 1 | -2/+2 | |
| | | ||||||
| * | libipsec: Add initiator flag to definition of ipsec_sa_mgr_t.add_sa() | Tobias Brunner | 2013-06-13 | 1 | -2/+4 | |
| | | ||||||
| * | Use subset matching instead of is_contained_in() to select a child_cfg | Martin Willi | 2013-06-13 | 1 | -4/+8 | |
| | | | | | | | | If one selector has a wider IP range than the other, but the other has a wider port/protocol selector than the first one, none is completely contained in the other. The check for a match using is_contained_in() therefore would fail. Using get_subset() can handle such cases, fixing configuration selection. | |||||
| * | ha: Fix CHILD_SA installation in ha_dispatcher after adding initiator flag | Tobias Brunner | 2013-06-13 | 1 | -4/+8 | |
| | | ||||||
| * | kernel-interface: add an exchange initiator parameter to add_sa() | Martin Willi | 2013-06-11 | 14 | -35/+46 | |
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This new flag gives the kernel-interface a hint how it should priorize the use of newly installed SAs during rekeying. Consider the following rekey procedure in IKEv2: Initiator --- Responder I1 -------CREATE-------> R1 I2 <------CREATE-------- -------DELETE-------> R2 I3 <------DELETE-------- SAs are always handled as pairs, the following happens at the SA level: * Initiator starts the exchange at I1 * Responder installs new SA pair at R1 * Initiator installs new SA pair at I2 * Responder removes old SA pair at R2 * Initiator removes old SA pair at I3 This makes sure SAs get installed/removed overlapping during rekeying. However, to avoid any packet loss, it is crucial that the new outbound SA gets activated at the correct position: * as exchange initiator, in I2 * as exchange responder, in R2 This should guarantee that we don't use the new outbound SA before the peer could install its corresponding inbound SA. The new parameter allows the kernel backend to install the new SA with appropriate priorities, i.e. it should: * as exchange inititator, have the new outbound SA installed with higher priority than the old SA * as exchange responder, have the new outbound SA installed with lower priority than the old SA While we could split up the SA installation at the responder, this approach has another advantage: it allows the kernel backend to switch SAs based on other criteria, for example when receiving traffic on the new inbound SA. | |||||
 |
index : tteras/strongswan | |
| tteras' strongSwan tree | gitolite |
| aboutsummaryrefslogtreecommitdiffstats |