aboutsummaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
...
* android: Several plugins were moved from libcharon to libtnccsTobias Brunner2013-09-232-29/+25
| | | | These were moved in commits e8f65c5cde and 12b3db5006.
* android: Properly handle failures while initializing charonTobias Brunner2013-09-232-13/+23
|
* kernel-netlink: Allow to override xfrm_acq_expires valueAnsis Atteka2013-09-231-6/+10
| | | | | | | | | | | | | | | | When using auto=route, current xfrm_acq_expires default value implies that tunnel can be down for up to 165 seconds, if other peer rejected first IKE request with an AUTH_FAILED or NO_PROPOSAL_CHOSEN error message. These error messages are completely normal in setups where another application pushes configuration to both strongSwans without waiting for acknowledgment that they have updated their configurations. This patch allows strongswan to override xfrm_acq_expires default value by setting charon.plugins.kernel-netlink.xfrm_acq_expires in strongswan.conf. Signed-off-by: Ansis Atteka <aatteka@nicira.com>
* Implemented TCG/PB-PDP_Referral messageAndreas Steffen2013-09-175-13/+153
|
* Allow vendor-specific PB-TNC messagesAndreas Steffen2013-09-1723-138/+583
|
* ignore *.1 manpage filesAndreas Steffen2013-09-171-1/+1
|
* sshkey: Add support for parsing keys from filesTobias Brunner2013-09-131-1/+92
|
* sshkey: Add encoding for ECDSA keysTobias Brunner2013-09-131-0/+72
|
* openssl: Add support for generic encoding of EC public keysTobias Brunner2013-09-131-23/+13
|
* pki: --pub also accepts public keys (i.e. to convert them to a different format)Tobias Brunner2013-09-132-3/+18
|
* pki: Add support to encode public keys in SSH key formatTobias Brunner2013-09-133-4/+16
|
* sshkey: Add encoder for RSA keysTobias Brunner2013-09-136-2/+93
|
* openssl: Add generic RSA public key encodingTobias Brunner2013-09-131-3/+17
|
* openssl: Add helper function to convert BIGNUMs to chunksTobias Brunner2013-09-132-0/+27
|
* pki: Don't print an error if no arguments are givenTobias Brunner2013-09-131-1/+1
|
* pki: Install pki(1) as utility directly in $prefix/binTobias Brunner2013-09-1316-88/+94
| | | | ipsec pki is maintained as alias.
* pki: Add example commands to setup a simple CATobias Brunner2013-09-131-0/+75
|
* pki: Add pki --verify man pageTobias Brunner2013-09-134-4/+61
|
* pki: Add pki --pub man pageTobias Brunner2013-09-134-4/+81
|
* pki: Add pki --print man pageTobias Brunner2013-09-133-2/+57
|
* pki: Add pki --keyid man pageTobias Brunner2013-09-133-2/+76
|
* pki: Add pki --pkcs7 man pageTobias Brunner2013-09-134-6/+87
|
* pki: Add pki --req man pageTobias Brunner2013-09-134-5/+97
|
* pki: Add pki --signcrl man pageTobias Brunner2013-09-134-8/+134
|
* pki: Add pki --issue man pageTobias Brunner2013-09-134-8/+189
|
* pki: Add pki --self man pageTobias Brunner2013-09-134-4/+154
| | | | Can be opened with "man pki --self".
* pki: Add pki --gen man pageTobias Brunner2013-09-134-4/+118
| | | | Can be opened with "man pki --gen".
* pki: Add ipsec-pki(8) man pageTobias Brunner2013-09-134-0/+79
| | | | | | | Can be opened either with "man ipsec pki" or "man ipsec-pki". Since man(1) only supports one level of subpages, the forthcoming man pages for each command will have to be opened with "man pki --<command>".
* Build generated man pages via configure scriptTobias Brunner2013-09-132-10/+3
|
* resolve: Remove comment when using resolvconf(8)Tobias Brunner2013-09-131-2/+1
| | | | | | | | | | | Since comments in resolv.conf are only valid at the beginning of a line resolvconf(8) seems to have started treating any text after 'nameserver <ip>' as additional IP addresses for name servers. Since it ignores comments, and we can easily remove the added servers again, there is no point to add any. Fixes #410.
* libipsec: fix memory management when cloning ip_packetMartin Willi2013-09-131-1/+1
|
* libipsec: check for a policy with the reqid of the SA on decapsulationMartin Willi2013-09-133-7/+14
| | | | | To prevent a client from sending a packet with a source address of a different client, we require a policy bound via reqid to the decapsulating SA.
* stroke: don't remove a matching peer config if used by other child configsMartin Willi2013-09-131-4/+3
| | | | | When configurations get merged during add, we should not remove peer configs if other connection entries use the same peer config.
* conftest: Don't load plugins incrementallyTobias Brunner2013-09-131-4/+6
| | | | | This is not supported by the plugin loader, so we simply combine the plugin lists and load them all at once.
* ikev1: Fix double free when searching for redundant CHILD_SAsTobias Brunner2013-09-131-1/+1
| | | | Fixes #411.
* Build all IMC/IMVs with -no-undefinedTobias Brunner2013-09-1210-10/+10
|
* pt-tls-client: Report loaded pluginsTobias Brunner2013-09-121-0/+1
|
* pt-tls-client: Abort if no tnccs-manager is availableTobias Brunner2013-09-121-0/+7
|
* Build all shared libraries with -no-undefined and link them properlyTobias Brunner2013-09-1212-9/+73
| | | | | | | | | | The flag is required to convince libtool on Cygwin to build DLLs. But on Windows these shared libraries can not have undefined symbols, so we have to link them explicitly to the libraries they reference. For plugins this is currently not done, so only the monolithic build is supported. The plugin loader wouldn't be able to load DLLs anyway, as it tries to load files that don't exist on Cygwin.
* tun_device: Add warning if TUN devices are not supported by platformTobias Brunner2013-09-121-2/+16
|
* Make sure libstrongswan is initialized first in IMCs and IMVsAndreas Steffen2013-09-114-24/+35
|
* sockets: Initialize the whole ancillary data buffer not only the actual structTobias Brunner2013-09-102-4/+4
| | | | | | This avoids uninitialized bytes that Valgrind seems to notice otherwise. Fixes #395.
* ikev1: For PFS prefer DH group from IKE_SA over first configuredThomas Egerer2013-09-101-18/+54
| | | | | | | | | | If PFS is configured for a CHILD_SA first try to create a list of proposals with using DH group negotiated during phase 1. If the resulting list is empty (i.e. the DH group(s) configured for PFS differ from the one(s) configured for the IKE_SA), fall back to the first configured DH group from the CHILD_SA. This modificiation is due to the fact that it is likely that the peer supports the same DH group for PFS it did already for the IKE_SA.
* kernel-netlink: increase buffer size for RT netlink messagesAnsis Atteka2013-09-101-1/+1
| | | | | | | | | | | | | | | | | | | | Commit 940e1b0f66dc04b0853414c1f4c45fa3f6e33bdd "Filter ignored interfaces in kernel interfaces (for events, address enumeration, etc.)" made charon to ignore routes with unusable interfaces. Unusable interface is one where charon has not seen RTM_NEWLINK message from the kernel. Sometime RTM_NEWLINK message can be 1048 bytes large. This is 24 bytes more than currently allocated buffer of 1024 bytes. If kernel sends such a large message, then it would be silently ignored by charon and corresponding interface would never become usable. Hence strongSwan might resolve invalid source IP address in get_route() function. This would prevent IPsec tunnel to be established. To reproduce create a VLAN interface with following command: vconfig add eth1 12
* Fixed double free causing swapped ends to crash5.1.1dr3Andreas Steffen2013-09-071-1/+0
|
* Minor performance tuningAndreas Steffen2013-09-071-4/+4
|
* Implemented targeted SWID requestAndreas Steffen2013-09-065-29/+86
|
* Make SWID directory where tags are stored configurableAndreas Steffen2013-09-054-7/+11
|
* Added tags table and some tag samplesAndreas Steffen2013-09-052-1/+91
|
* swid_inventory object has a get_count methodAndreas Steffen2013-09-042-16/+6
|
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-04 14:57:36 +0000