aboutsummaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
...
* conftest: Don't load plugins incrementallyTobias Brunner2013-09-131-4/+6
| | | | | This is not supported by the plugin loader, so we simply combine the plugin lists and load them all at once.
* ikev1: Fix double free when searching for redundant CHILD_SAsTobias Brunner2013-09-131-1/+1
| | | | Fixes #411.
* Build all IMC/IMVs with -no-undefinedTobias Brunner2013-09-1210-10/+10
|
* pt-tls-client: Report loaded pluginsTobias Brunner2013-09-121-0/+1
|
* pt-tls-client: Abort if no tnccs-manager is availableTobias Brunner2013-09-121-0/+7
|
* Build all shared libraries with -no-undefined and link them properlyTobias Brunner2013-09-1212-9/+73
| | | | | | | | | | The flag is required to convince libtool on Cygwin to build DLLs. But on Windows these shared libraries can not have undefined symbols, so we have to link them explicitly to the libraries they reference. For plugins this is currently not done, so only the monolithic build is supported. The plugin loader wouldn't be able to load DLLs anyway, as it tries to load files that don't exist on Cygwin.
* tun_device: Add warning if TUN devices are not supported by platformTobias Brunner2013-09-121-2/+16
|
* Make sure libstrongswan is initialized first in IMCs and IMVsAndreas Steffen2013-09-114-24/+35
|
* sockets: Initialize the whole ancillary data buffer not only the actual structTobias Brunner2013-09-102-4/+4
| | | | | | This avoids uninitialized bytes that Valgrind seems to notice otherwise. Fixes #395.
* ikev1: For PFS prefer DH group from IKE_SA over first configuredThomas Egerer2013-09-101-18/+54
| | | | | | | | | | If PFS is configured for a CHILD_SA first try to create a list of proposals with using DH group negotiated during phase 1. If the resulting list is empty (i.e. the DH group(s) configured for PFS differ from the one(s) configured for the IKE_SA), fall back to the first configured DH group from the CHILD_SA. This modificiation is due to the fact that it is likely that the peer supports the same DH group for PFS it did already for the IKE_SA.
* kernel-netlink: increase buffer size for RT netlink messagesAnsis Atteka2013-09-101-1/+1
| | | | | | | | | | | | | | | | | | | | Commit 940e1b0f66dc04b0853414c1f4c45fa3f6e33bdd "Filter ignored interfaces in kernel interfaces (for events, address enumeration, etc.)" made charon to ignore routes with unusable interfaces. Unusable interface is one where charon has not seen RTM_NEWLINK message from the kernel. Sometime RTM_NEWLINK message can be 1048 bytes large. This is 24 bytes more than currently allocated buffer of 1024 bytes. If kernel sends such a large message, then it would be silently ignored by charon and corresponding interface would never become usable. Hence strongSwan might resolve invalid source IP address in get_route() function. This would prevent IPsec tunnel to be established. To reproduce create a VLAN interface with following command: vconfig add eth1 12
* Fixed double free causing swapped ends to crash5.1.1dr3Andreas Steffen2013-09-071-1/+0
|
* Minor performance tuningAndreas Steffen2013-09-071-4/+4
|
* Implemented targeted SWID requestAndreas Steffen2013-09-065-29/+86
|
* Make SWID directory where tags are stored configurableAndreas Steffen2013-09-054-7/+11
|
* Added tags table and some tag samplesAndreas Steffen2013-09-052-1/+91
|
* swid_inventory object has a get_count methodAndreas Steffen2013-09-042-16/+6
|
* Count collected SWID tags or tag IDsAndreas Steffen2013-09-041-3/+17
|
* Proceed with attestation only if Attestation IMC returns a discovery responseAndreas Steffen2013-09-044-7/+20
|
* libipsec: Properly initialize variables when creating AEAD wrapperTobias Brunner2013-09-041-2/+2
|
* android: Fix compilation after PTS header files were movedTobias Brunner2013-09-041-4/+4
|
* libpts: Android.mk updatedTobias Brunner2013-09-041-17/+24
|
* load-tester: support extended traffic selector syntax, as in leftsubnetMartin Willi2013-09-041-13/+168
| | | | | In addition the initiator may use %unique as port, using a distinct port for each connection, starting from 1025.
* load-tester: add an option to test transport/beet connectionsMartin Willi2013-09-041-1/+21
|
* ike: support multiple addresses, ranges and subnets in IKE address configMartin Willi2013-09-0416-110/+306
| | | | | | | Replace the allowany semantic by a more powerful subnet and IP range matching. Multiple addresses, DNS names, subnets and ranges can be specified in a comma separated list. Initiators ignore the ranges/subnets, responders match configurations against all addresses, ranges and subnets.
* ike-cfg: remove the to be obsoleted allow any parameter in get_my/other_addrMartin Willi2013-09-047-33/+18
|
* backends: use ike_cfg host matching functionsMartin Willi2013-09-041-38/+7
|
* ike-cfg: add methods to match a host against configured local/remote addressesMartin Willi2013-09-042-0/+62
|
* trap-manager: use ike_cfg resolver functionsMartin Willi2013-09-041-4/+2
|
* ike-sa: use ike_cfg resolver functionsMartin Willi2013-09-041-16/+12
|
* ike-cfg: add a method to resolve local/remote hosts with portMartin Willi2013-09-042-0/+30
|
* stroke: ignore a leftsourceip if a rightsourceip is given as wellMartin Willi2013-09-041-1/+7
| | | | | | As we always negotiate virtual IPs in charon, having both left- and rightsourceip is not allowed. Both in IKEv1 and IKEv2 we support a single configuration payload exchange only.
* ikev1: implement mode config push modeMartin Willi2013-09-045-76/+363
|
* stroke: re-enable modeconfig keywordMartin Willi2013-09-043-1/+3
|
* peer-cfg: add a pull/push mode option to use with mode configMartin Willi2013-09-0415-20/+43
|
* charon-cmd: support prompting for a PINMartin Willi2013-09-031-4/+8
| | | | | To support a Password and PIN XAuth combo, additionally support multiple prompts for different credential types.
* xauth-generic: honor requested XAuth credential types as a clientMartin Willi2013-09-031-16/+51
| | | | Support requesting of XAuth PINs and print XAuth messages.
* attributes: shorten some Unity and XAuth attribute short namesMartin Willi2013-09-031-15/+15
|
* message: print type of configuration payloadMartin Willi2013-09-031-1/+21
|
* message: print attributes for IKEv1 configuration payloads as wellMartin Willi2013-09-031-1/+2
|
* eap-radius: support XAuth configuration profiles, defining multiple XAuth roundsMartin Willi2013-09-031-22/+157
|
* xauth: add a configuration string option to be passed to XAuth instancesMartin Willi2013-09-0315-17/+52
| | | | | | The configuration string is appended to the XAuth backend name, separated by a colon. The configuration string is passed untouched to the backend, where it can change the behavior of the XAuth module.
* Use ipsec_DATA destination5.1.1dr2Andreas Steffen2013-09-021-7/+1
|
* Install SWID tag also in /share/Andreas Steffen2013-09-021-2/+3
|
* Generate strongSwan SWID tagAndreas Steffen2013-09-023-0/+55
|
* Added regids table and some sample reqid dataAndreas Steffen2013-09-022-0/+62
|
* Corrected debug class to DBG_IMCAndreas Steffen2013-09-021-9/+9
|
* conftest: Fix hook constructor resolution via dlsym()Tobias Brunner2013-08-301-1/+3
| | | | | | | | AM_CPPFLAGS only takes preprocessor flags like -I or -D, so it did not forward -rdynamic to the linker (--export-dynamic), which meant that the symbols defined in the executable itself were not resolvable via dlsym(). Fixes #394.
* SWID IMC implements recursive tag collection in /usr/shareAndreas Steffen2013-08-309-123/+385
|
* kernel-pfroute: Fix mixed up memset() call in get_route()Mathias Krause2013-08-291-1/+1
| | | | | | | | | | The retry code introduced in dc8b083 got the memset() arguments wrong. Fix this to ensure the buffer gets zeroed, for real. It probably doesn't matter as we do reset the message length on retry, so the stale data shouldn't be seen by anyone. Found-by: git grep 'memset\s*\([^,]*,\s*[^,]*,\s*0\s*\)'
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-04 06:07:08 +0000