tteras/strongswan - tteras' strongSwan tree

	Commit message (Collapse)	Author	Age	Files	Lines
...
*	Implemented SWID prototype IMC/IMV pair	Andreas Steffen	2013-08-15	60	-76/+8562
\|
*	Updated the SWID attributes	Andreas Steffen	2013-08-15	2	-11/+15
\|
*	Optimized PT-TLS data transfer	Andreas Steffen	2013-08-15	4	-127/+107
\|
*	Show host address of peer connecting to PT-TLS socket	Andreas Steffen	2013-08-15	1	-1/+7
\|
*	Set client identity with TLS certificate authentication	Andreas Steffen	2013-08-15	1	-7/+18
\|
*	Fixed memory leak in SASL PLAIN	Andreas Steffen	2013-08-15	1	-0/+3
\|
*	added --optionsfrom capability	Andreas Steffen	2013-08-15	1	-3/+20
\|
*	Use client identities from successful authentications, only	Andreas Steffen	2013-08-15	1	-18/+12
\|
*	Add pt-tls-client to .gitignore	Andreas Steffen	2013-08-15	2	-228/+1
\|
*	Extract client identity and authentication type from SASL authentication	Andreas Steffen	2013-08-15	7	-9/+76
\|
*	Added some debug statements	Andreas Steffen	2013-08-15	4	-4/+47
\|
*	enabled SASL PLAIN authentication	Andreas Steffen	2013-08-15	1	-2/+2
\|
*	PT-TLS connection is properly terminated	Andreas Steffen	2013-08-15	1	-3/+2
\|
*	moved tnc_imv plugin to libtnccs thanks to recommendation callback function	Andreas Steffen	2013-08-15	26	-120/+154
\|
*	Moved tnc-tnccs, tnc-imc, tnccs-11, tnccs-20 and tnccs-dynamic libcharon ↵	Andreas Steffen	2013-08-15	72	-52/+78
\| \| \| \|	plugins to libtnccs
*	rapid PT-TLS AR/PDP prototype	Andreas Steffen	2013-08-15	13	-65/+768
\|
*	Add PT-TLS interface to strongSwan PDP	Andreas Steffen	2013-08-15	4	-39/+68
\|
*	ikev1: Fix calculation of the number of fragments	Tobias Brunner	2013-08-15	1	-1/+1
\| \| \| \|	The old code resulted in too few fragments in some cases.
*	ikev1: When sending fragments, use ports to decide if a non-ESP marker is added	Tobias Brunner	2013-08-15	1	-6/+8
\| \| \| \| \|	This is same same logic used by sender and might apply in some cases (e.g. when initiating to port 4500).
*	ikev2: Fix segfault when reestablishing CHILD_SAs due to ↵	Tobias Brunner	2013-08-13	1	-3/+4
\| \| \| \| \| \|	closeaction=restart\|hold This regression was introduced with c949a4d5.
*	libipsec: Don't limit traditional algorithms to AES and SHA1/2	Tobias Brunner	2013-08-12	1	-25/+7
\| \| \| \|	Closes #377.
*	kernel-netlink,pfroute: Properly update address flag within ROAM_DELAY	Tobias Brunner	2013-08-12	2	-2/+2
\| \| \| \| \| \| \|	77d4a02 and 55da01f only updated the address flag when a job was created, which obviously had the same limitation as the old code. Fixes #374.
*	kernel-pfroute: Implement roam event handling like in the kernel-netlink plugin	Tobias Brunner	2013-08-12	1	-13/+36
\| \| \| \| \|	There was no proper locking and the issue regarding the address flag also existed.
*	kernel-netlink: Ensure address changes are not missed in roam events	Tobias Brunner	2013-08-12	1	-4/+15
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	If multiple roam events are triggered within ROAM_DELAY, only one job is created. The old code set the address flag to the value of the last triggering call. So if a route change followed an address change within ROAM_DELAY the address change was missed by the upper layers, e.g. causing it not to update the list of addresses via MOBIKE. The new code now keeps the state of the address flag until the job is actually executed, which still has some issues. For instance, if an address disappears and reappears within ROAM_RELAY, the flag would not have to be set to TRUE. So address updates might occasionally get triggered where none would actually be required. Fixes #374.
*	backtrace: rename clone() method clashing with system call	Martin Willi	2013-08-09	1	-2/+2
\| \| \| \|	Fixes #376.
*	updown: remove description of unsupported PLUTO_ variables	Martin Willi	2013-08-08	3	-59/+6
\| \| \| \|	These have been set by pluto, but are not by charons updown plugin.
*	tnc-pdp: Initialize struct msghdr properly when reading RADIUS messages5.1.0	Tobias Brunner	2013-07-31	1	-10/+10
\| \| \| \| \|	Before this e.g. msg_controllen was not initialized properly which could cause invalid reads.
*	whitelist: Fix compilation on FreeBSD	Tobias Brunner	2013-07-31	1	-0/+2
\|
*	host: Properly initialize struct sockaddr_in[6] when parsing strings	Tobias Brunner	2013-07-31	1	-0/+2
\| \| \| \| \|	Otherwise struct members like sin6_flowinfo or sin6_scope_id might be set to bogus values.
*	asn1: Fix handling of invalid ASN.1 length in is_asn1()	Tobias Brunner	2013-07-31	1	-0/+5
\| \| \| \|	Fixes CVE-2013-5018.
*	Callback job is not needed any more	Andreas Steffen	2013-07-31	1	-4/+0
\|
*	charon-xpc: load missing ctr/ccm/gcm plugins	Martin Willi	2013-07-31	1	-2/+3
\|
*	charon-xpc: use kernel-libipsec instead of kernel-pfkey	Martin Willi	2013-07-31	3	-4/+9
\|
*	charon-xpc: fix TS getting after changing CHILD_SA API	Martin Willi	2013-07-31	1	-2/+6
\|
*	keychain: be less verbose when loading certificates	Martin Willi	2013-07-31	1	-2/+5
\|
*	receiver: Avoid cloning packet data when verifying COOKIE payloads	Tobias Brunner	2013-07-29	1	-5/+1
\| \| \| \| \| \| \|	Besides being more efficient this removes a memory leak that occurred when a COOKIE payload was successfully verified. Fixes #369.
*	unity: Handle multi-valued UNITY_SPLIT_INCLUDE/UNITY_LOCAL_LAN attributes	Tobias Brunner	2013-07-29	1	-50/+97
\| \| \| \| \| \| \|	Cisco devices seem to add 6 bytes of padding between each address/mask pair. Fixes #366.
*	tnc-pdp now uses watcher_t	Andreas Steffen	2013-07-29	1	-92/+63
\|
*	ikev2: Only schedule half-open-timeout delete job after successfully ↵	Tobias Brunner	2013-07-29	1	-8/+16
\| \| \| \| \| \| \|	handling IKE_SA_INIT We want to avoid this allocation if the initial message is invalid (e.g. if the message ID is != 0).
*	charon-cmd: add --eap-identity and --xauth-username options	Martin Willi	2013-07-29	4	-0/+37
\|
*	eap-radius: do RADIUS/IKE attribute forwarding in XAuth backend	Martin Willi	2013-07-29	2	-1/+5
\|
*	eap-radius: support plain XAuth RADIUS authentication using User-Password	Martin Willi	2013-07-29	4	-0/+253
\|
*	libradius: support encryption of User-Password attributes	Martin Willi	2013-07-29	1	-0/+27
\|
*	utils: add round_up/down() helper functions	Martin Willi	2013-07-29	2	-0/+49
\|
*	libradius: refactor generic RADIUS en-/decryption function to a message method	Martin Willi	2013-07-29	3	-44/+85
\|
*	eap-radius: export function to build common attributes of Access-Request	Martin Willi	2013-07-29	2	-24/+39
\|
*	eap-radius: export function to process common attributes of Access-Accept	Martin Willi	2013-07-29	2	-31/+36
\|
*	mem-pool: add option for reusing online leases, and disable it by default	Martin Willi	2013-07-29	1	-1/+13
\| \| \| \| \| \| \| \| \| \| \|	Mainly for reauthentication with third party implementations, we allowed to reuse an online lease, but only for the same peer identity and when it explicitly requested the same address. This has always been problematic, because it changes the reqid of the CHILD_SA with the same traffic selectors, breaking the old tunnel. As we now reject such policy overwrites, this usually lets the installation of the new policies fail. We therefore disable reassignment of online leases by default.
*	mem-pool: replace per-identity online/offline lists by more efficient arrays	Martin Willi	2013-07-29	1	-48/+52
\| \| \| \|	This saves two lists per connected peer identity, up to 0.4KB.
*	mem-pool: refcount online lease when reassigning it to another tunnel	Martin Willi	2013-07-26	1	-5/+28
\| \| \| \| \| \| \|	When we reassign an online lease for the same peer, we have to refcount it. Otherwise we would set it offline if one of the tunnels goes down, but it is actually still in use by a the second tunnel. This can finally lead in assigning the same virtual IP to different peers.