| Commit message (Collapse) | Author | Age | Files | Lines | ||
|---|---|---|---|---|---|---|
| ... | ||||||
| * | configure: Use pkg-config to detect libiptc used by connmark/forecast | Tobias Brunner | 2015-02-23 | 2 | -4/+4 | |
| | | | | | | This ensures the library is available. On Debian/Ubuntu it is a dynamic library provided by the iptables-dev package. | |||||
| * | openssl: Return the proper IV length for OpenSSL crypters | Tobias Brunner | 2015-02-23 | 1 | -1/+1 | |
| | | | | | | | | For instance, the NULL cipher has a block size of 1 but an IV length of 0. Fixes #854. | |||||
| * | forecast: Add the broadcast/multicast forwarding plugin called forecast | Martin Willi | 2015-02-20 | 8 | -0/+1479 | |
| | | ||||||
| * | ipsec-types: Support the %unique mark value | Martin Willi | 2015-02-20 | 2 | -5/+15 | |
| | | ||||||
| * | connmark: Add CONNMARK rules to select correct output SA based on conntrack | Martin Willi | 2015-02-20 | 4 | -0/+611 | |
| | | | | | | | | | | | | | | | Currently supports transport mode connections using IPv4 only, and requires a unique mark configured on the connection. To select the correct outbound SA when multiple connections match (i.e. multiple peers connected from the same IP address / NAT router) marks must be configured. This mark should usually be unique, which can be configured in ipsec.conf using mark=0xffffffff. The plugin inserts CONNMARK netfilter target rules: Any peer-initiated flow is tagged with the assigned mark as connmark. On the return path, the mark gets restored from the conntrack entry to select the correct outbound SA. | |||||
| * | bus: Add an ike_update() hook invoked when peer endpoints change | Martin Willi | 2015-02-20 | 4 | -0/+50 | |
| | | ||||||
| * | connmark: Add a plugin stub | Martin Willi | 2015-02-20 | 4 | -0/+150 | |
| | | ||||||
| * | load-tester: Support initiating XAuth authentication | Martin Willi | 2015-02-20 | 1 | -0/+22 | |
| | | | | | | | | | As with other configuration backends, XAuth is activated with a two round client authentication using pubkey and xauth. In load-tester, this is configured with initiator_auth=pubkey|xauth. Fixes #835. | |||||
| * | mem-pool: Pass the remote IKE address, to re-acquire() an address during reauth | Martin Willi | 2015-02-20 | 6 | -51/+87 | |
| | | | | | | | | | | | | With make-before-break IKEv2 re-authentication, virtual IP addresses must be assigned overlapping to the same peer. With the remote IKE address, the backend can detect re-authentication attempts by comparing the remote host address and port. This allows proper reassignment of the virtual IP if it is re-requested. This change removes the mem-pool.reassign_online option, as it is obsolete now. IPs get automatically reassigned if a peer re-requests the same address, and additionally connects from the same address and port. | |||||
| * | ikev2: Schedule a make-before-break completion task to delete old IKE_SA | Martin Willi | 2015-02-20 | 8 | -1/+174 | |
| | | ||||||
| * | ikev2: Allow task to skip exchange by setting undefined exchange type | Martin Willi | 2015-02-20 | 1 | -0/+5 | |
| | | ||||||
| * | ikev2: Trigger make-before-break reauthentication instead of reauth task | Martin Willi | 2015-02-20 | 2 | -2/+79 | |
| | | ||||||
| * | ike-sa-manager: Use IKEv1 uniqueness reauthentication detection for IKEv2, too | Martin Willi | 2015-02-20 | 1 | -12/+8 | |
| | | ||||||
| * | attribute-handler: Pass full IKE_SA to handler backends | Martin Willi | 2015-02-20 | 10 | -79/+61 | |
| | | ||||||
| * | attribute-provider: Pass full IKE_SA to provider backends | Martin Willi | 2015-02-20 | 10 | -65/+55 | |
| | | ||||||
| * | attribute-manager: Pass full IKE_SA to handler methods | Martin Willi | 2015-02-20 | 5 | -23/+28 | |
| | | ||||||
| * | attribute-manager: Pass the full IKE_SA to provider methods | Martin Willi | 2015-02-20 | 5 | -23/+32 | |
| | | ||||||
| * | unit-tester: Drop the old unit-tester libcharon plugin | Martin Willi | 2015-02-20 | 13 | -953/+0 | |
| | | | | | | | While it has some tests that we don't directly cover with the new unit tests, most of them require special infrastructure and therefore have not been used for a long time. | |||||
| * | attributes: Move the configuration attributes framework to libcharon | Martin Willi | 2015-02-20 | 40 | -129/+119 | |
| | | ||||||
| * | libcharon: Add a test runner | Martin Willi | 2015-02-20 | 5 | -0/+96 | |
| | | ||||||
| * | attr-sql: Move plugin to libcharon | Martin Willi | 2015-02-20 | 8 | -10/+13 | |
| | | ||||||
| * | attr: Move plugin to libcharon | Martin Willi | 2015-02-20 | 8 | -12/+10 | |
| | | ||||||
| * | resolve: Move plugin back to libcharon | Martin Willi | 2015-02-20 | 7 | -9/+8 | |
| | | | | | Since pluto is gone, all existing users build upon libcharon. | |||||
| * | charon-tkm: Use get_dst_host getter in EES callback | Reto Buerki | 2015-02-20 | 1 | -4/+14 | |
| | | | | | | | Use the new get_dst_host getter to retrieve the destination host from the SAD using the reqid, spi and protocol values received from the xfrm-proxy. | |||||
| * | charon-tkm: Add get_dst_host getter to SAD | Reto Buerki | 2015-02-20 | 3 | -0/+79 | |
| | | | | | | This function returns the destination host of an SAD entry for given reqid, spi and protocol arguments or NULL if not found. | |||||
| * | charon-tkm: Improve SAD get_esa_id log messages | Reto Buerki | 2015-02-20 | 1 | -4/+4 | |
| | | ||||||
| * | charon-tkm: Store reqid in SAD | Reto Buerki | 2015-02-20 | 4 | -15/+26 | |
| | | ||||||
| * | charon-tkm: Store remote SPI in SAD | Reto Buerki | 2015-02-20 | 1 | -1/+1 | |
| | | | | | | | | | | Store the remote instead of the local SPI in the SAD when adding a new entry in the kernel plugin's add_sa() function. Since only one ESA context must be destroyed for an inbound/outbound CHILD SA pair, it does not matter which SPI is used to retrieve it in the del_sa function. | |||||
| * | charon-tkm: Make CHILD/ESP SA database public | Reto Buerki | 2015-02-20 | 3 | -22/+15 | |
| | | | | | | Make the CHILD/ESP SA database a public member of the global tkm_t struct. | |||||
| * | charon-tkm: Fix logger entity name in tests.c | Reto Buerki | 2015-02-20 | 1 | -2/+2 | |
| | | | | | Change 'test_runner' to 'test-runner'. | |||||
| * | ike: Consistently log CHILD_SAs with their unique_id instead of their reqid | Martin Willi | 2015-02-20 | 8 | -11/+13 | |
| | | ||||||
| * | unity: Reference IKE_SAs by the IKEv1 COOKIEs, improving lookup performance | Martin Willi | 2015-02-20 | 3 | -14/+17 | |
| | | | | | | When handling thousands of IKE_SAs, the unique ID based lookup is rather slow, as we have no indexing. | |||||
| * | ike-sa-manager: Remove IKE_SA checkout by CHILD_SA reqid | Martin Willi | 2015-02-20 | 5 | -40/+16 | |
| | | ||||||
| * | migrate-job: Do CHILD_SA reqid lookup locally | Martin Willi | 2015-02-20 | 2 | -26/+21 | |
| | | ||||||
| * | kernel-interface: Raise mapping event with a proto/SPI/dst tuple | Martin Willi | 2015-02-20 | 8 | -41/+75 | |
| | | ||||||
| * | inactivity-job: Schedule job by CHILD_SA unique ID instead of reqid | Martin Willi | 2015-02-20 | 4 | -23/+17 | |
| | | ||||||
| * | charon-tkm: Fix compilation of ees_callback.c | Reto Buerki | 2015-02-20 | 1 | -3/+5 | |
| | | | | | | | Update the call to hydra->kernel_interface->expire to make ees_callback.c compile again. The required destination host argument is set to NULL for now. | |||||
| * | kernel-interface: Raise expires with a proto/SPI/dst tuple instead of reqid | Martin Willi | 2015-02-20 | 20 | -118/+124 | |
| | | ||||||
| * | controller: Use the CHILD_SA unique_id to terminate CHILD_SAs | Martin Willi | 2015-02-20 | 6 | -38/+24 | |
| | | ||||||
| * | swanctl: List CHILD_SA unique ID as the primary identifier, but print reqid, too | Martin Willi | 2015-02-20 | 1 | -2/+2 | |
| | | ||||||
| * | stroke: List CHILD_SA unique ID as the primary identifier, but print reqid, too | Martin Willi | 2015-02-20 | 1 | -5/+6 | |
| | | ||||||
| * | vici: Include the CHILD_SA unique ID in list-sa event | Martin Willi | 2015-02-20 | 2 | -0/+2 | |
| | | ||||||
| * | ike: Maintain per-IKE_SA CHILD_SAs in the global CHILD_SA manager | Martin Willi | 2015-02-20 | 3 | -19/+92 | |
| | | ||||||
| * | child-sa-manager: Add a global manager storing CHILD_SA relations | Martin Willi | 2015-02-20 | 6 | -1/+432 | |
| | | | | | | | To quickly check out IKE_SAs and find associated CHILD_SAs, the child_sa_manager stores relations between CHILD_SAs and IKE_SAs. It provides CHILD_SA specific IKE_SA checkout functions wrapping the ike_sa_manager. | |||||
| * | child-sa: Replace reqid based marks by "unique" marks | Martin Willi | 2015-02-20 | 13 | -74/+126 | |
| | | | | | | | | | | | | As we now use the same reqid for multiple CHILD_SAs with the same selectors, having marks based on the reqid makes not that much sense anymore. Instead we use unique marks that use a custom identifier. This identifier is reused during rekeying, keeping the marks constant for any rule relying on it (for example installed by updown). This also simplifies handling of reqid allocation, as we do not have to query the marks that is not yet assigned for an unknown reqid. | |||||
| * | child-sa: Introduce a unique CHILD_SA identifier | Martin Willi | 2015-02-20 | 2 | -0/+24 | |
| | | | | | | As the reqid is not that unique even among multiple IKE_SAs anymore, we need an identifier to uniquely identify a specific CHILD_SA instance. | |||||
| * | child-sa: Delegate reqid allocation to the kernel interface | Martin Willi | 2015-02-20 | 1 | -15/+46 | |
| | | ||||||
| * | kernel-interface: Add reqid allocation and release functions | Martin Willi | 2015-02-20 | 2 | -1/+329 | |
| | | | | | | | | | | To reassign reqids where appropriate, we explicitly allocate or confirm them centrally on the kernel-interface. Currently the state is stored in the kernel-interface wrapper for all backends, but we may add appropriate methods to each backend to implement a custom reqid allocation logic, if required. | |||||
| * | traffic-selector: Add a hash() method | Martin Willi | 2015-02-20 | 2 | -0/+20 | |
| | | ||||||
| * | child-sa: Sort traffic selectors after adding CHILD_SA policies | Martin Willi | 2015-02-20 | 1 | -0/+3 | |
| | | | | | Having traffic selectors sorted properly makes comparing them much simpler. | |||||
 |
index : tteras/strongswan | |
| tteras' strongSwan tree | gitolite |
| aboutsummaryrefslogtreecommitdiffstats |