aboutsummaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* openssl: Use proper EVP macro to determine size of a hashTobias Brunner2016-04-152-2/+2
|
* android: OPENSSL_NO_ENGINE is now properly defined in the headersTobias Brunner2016-04-151-1/+0
|
* curl: Handle LibreSSL like OpenSSL in regards to multi-threadingTobias Brunner2016-04-151-1/+1
| | | | | LibreSSL is API compatible so our openssl plugin does not need any changes and it works fine with the curl plugin.
* thread: Don't hold mutex when calling cleanup handlers while terminatingTobias Brunner2016-04-131-12/+14
| | | | | | | | | | This could interfere with cleanup handlers that try to acquire mutexes while other threads holding these try to e.g. cancel the threads. As cleanup handlers are only queued by the threads themselves we don't need any synchronization to access the list. Fixes #1401.
* Extended IPsec kernel policy schemeAndreas Steffen2016-04-091-18/+53
| | | | | | | | The kernel policy now considers src and dst port masks as well as restictions to a given network interface. The base priority is 100'000 for passthrough shunts, 200'000 for IPsec policies, 300'000 for IPsec policy traps and 400'000 for fallback drop shunts. The values 1..30'000 can be used for manually set priorities.
* Include manual policy priorities and restriction to interfaces in vici ↵Andreas Steffen2016-04-092-1/+27
| | | | list-conn command
* Implemented IPsec policies restricted to given network interfaceAndreas Steffen2016-04-098-14/+66
|
* Support manually-set IPsec policy prioritiesAndreas Steffen2016-04-098-22/+84
|
* peer-cfg: Use struct to pass data to constructorTobias Brunner2016-04-0916-200/+266
|
* child-cfg: Use struct to pass data to constructorTobias Brunner2016-04-0916-366/+362
|
* kernel-pfkey: Prefer policies with reqid over those withoutTobias Brunner2016-04-091-1/+7
|
* kernel-pfkey: Only install templates for regular IPsec policies with reqidTobias Brunner2016-04-091-32/+35
|
* shunt-manager: Install "outbound" FWD policyTobias Brunner2016-04-091-2/+8
| | | | | | If there is a default drop policy forwarded traffic might otherwise not be allowed by a specific passthrough policy (while local traffic is allowed).
* kernel-netlink: Prefer policies with reqid over those withoutTobias Brunner2016-04-091-1/+7
| | | | | | | This allows two CHILD_SAs with reversed subnets to install two FWD policies each. Since the outbound policy won't have a reqid set we will end up with the two inbound FWD policies installed in the kernel, with the correct templates to allow decrypted traffic.
* kernel-netlink: Only associate templates with inbound FWD policiesTobias Brunner2016-04-091-1/+1
| | | | | | We can't set a template on the outbound FWD policy (or we'd have to make it optional). Because if the traffic does not come from another (matching) IPsec tunnel it would get dropped due to the template mismatch.
* child-sa: Install "outbound" FWD policyTobias Brunner2016-04-091-0/+16
| | | | | | | If there is a DROP shunt that matches outbound forwarded traffic it would get dropped as the FWD policy we install only matches decrypted inbound traffic. That's because the Linux kernel first checks the FWD policies before looking up the OUT policy and SA to encrypt the packets.
* kernel-netlink: Associate routes with IN policies instead of FWD policiesTobias Brunner2016-04-091-21/+21
| | | | | | This allows us to install more than one FWD policy. We already do this in the kernel-pfkey plugin (there the original reason was that not all kernels support FWD policies).
* kernel: Use structs to pass information to the kernel-ipsec interfaceTobias Brunner2016-04-0912-983/+1140
|
* pkcs11: Skip zero-padding of r and s when preparing EC signatureTobias Brunner2016-04-051-3/+9
| | | | | | They are zero padded to fill the buffer. Fixes #1377.
* chunk: Skip all leading zero bytes in chunk_skip_zero() not just the firstTobias Brunner2016-04-042-14/+18
|
* string: Gracefully handle NULL in str*eq() macrosTobias Brunner2016-04-042-4/+82
|
* byteorder: Explicitly check for htoXeXX macrosTobias Brunner2016-03-311-3/+18
| | | | | Some platforms have XetohXX macros instead of XeXXtoh macros, in which case we'd redefine the htoXeXX macros.
* vici: Fix documentation of some dictionary keys of two request messagesCameron McCord2016-03-311-3/+3
| | | | Closes strongswan/strongswan#40.
* proposal: Use standard integer types for static keywordsTobias Brunner2016-03-311-2/+2
|
* utils: Remove nonsensical typedefs for standard uint typesTobias Brunner2016-03-311-13/+0
|
* Use u_int32_t legacy type in blowfish header fileAndreas Steffen2016-03-241-1/+1
|
* Use standard unsigned integer typesAndreas Steffen2016-03-24583-3425/+3425
|
* updown: Get value for PLUTO_MARK_{IN,OUT} from CHILD_SAShota Fukumori2016-03-231-2/+2
| | | | | | | Or the invoked script will get a broken value when `mark=%unique` is used in a configuration. Closes strongswan/strongswan#37.
* connmark: Explicitly include xt_mark.h for older kernelsTobias Brunner2016-03-231-0/+1
| | | | Fixes #1365.
* android: Enable 64-bit ABIsTobias Brunner2016-03-231-1/+1
|
* android: Enable build against API level 21Tobias Brunner2016-03-232-1/+17
| | | | | | | While building against this level in general would break our app on older systems, the NDK will automatically use this level for 64-bit ABI builds (which are not supported in older levels). So to build against 64-bit ABIs we have to support this API level.
* libcharon: Add missing header file to Android.mkTobias Brunner2016-03-231-0/+1
| | | | Not really relevant, just to make sure both file lists are the same.
* ike-sa-manager: Avoid memory leak if IKE_SAs get checked in after flush() ↵Tobias Brunner2016-03-231-23/+38
| | | | | | | | | | | | | was called A thread might check out a new IKE_SA via checkout_new() or checkout_by_config() and start initiating it while the daemon is terminating and the IKE_SA manager is flushed by the main thread. That SA is not tracked yet so the main thread is not waiting for it and the other thread is able to check it in and creating an entry after flush() already terminated causing a memory leak. Fixes #1348.
* ha: Delete cache entry inside the locked mutexThomas Egerer2016-03-231-0/+2
| | | | Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
* swanctl: Fix documented directory name for remote pubkeysTobias Brunner2016-03-221-1/+1
|
* kernel-netlink: Fix lookup of next hops for destinations with prefixTobias Brunner2016-03-211-1/+2
| | | | References #1347.
* imc-os: Terminate buffer after fread(3) call to make Coverity happyTobias Brunner2016-03-111-1/+1
|
* imc-os: Correctly check return value of ftell(2)Tobias Brunner2016-03-111-1/+9
|
* Fix some Doxygen issuesTobias Brunner2016-03-113-9/+9
|
* identification: Make `written` signed to fix error checking when printing rangesTobias Brunner2016-03-111-3/+3
|
* vici: Don't hold write lock while running or undoing start actionsTobias Brunner2016-03-111-27/+63
| | | | | | | | | | | | | | Running or undoing start actions might require enumerating IKE_SAs, which in turn might have to enumerate peer configs concurrently, which requires acquiring a read lock. So if we keep holding the write lock while enumerating the SAs we provoke a deadlock. By preventing other threads from acquiring the write lock while handling actions, and thus preventing the modification of the configs, we largely maintain the current synchronous behavior. This way we also don't need to acquire additional refs for config objects as they won't get modified/removed. Fixes #1185.
* Initialize ts variableAndreas Steffen2016-03-111-1/+1
|
* forecast: Compare the complete rules when deleting themTobias Brunner2016-03-101-1/+4
| | | | | | Same as the change in the connmark plugin. References #1229.
* connmark: Don't restore CONNMARK for packets that already have a mark setTobias Brunner2016-03-101-2/+17
| | | | | | | | | This allows e.g. modified versions of xl2tpd to set the mark in situations where two clients are using the same source port behind the same NAT, which CONNMARK can't restore properly as only one conntrack entry will exist with the mark set to that of the client that sent the last packet. Fixes #1230.
* connmark: Compare the complete rules when deleting themTobias Brunner2016-03-101-1/+4
| | | | | | | | | | | | By settings a matchmask that covers the complete rule we ensure that the correct rule is deleted (i.e. matches and targets with potentially different marks are also compared). Since data after the passed pointer is actually dereferenced when comparing we definitely have to pass an array that is at least as long as the ipt_entry. Fixes #1229.
* Support of IP address ranges in traffic selectorsAndreas Steffen2016-03-102-7/+27
|
* Implemented IPv4/IPv6 subnet and range identitiesAndreas Steffen2016-03-102-79/+563
| | | | | | The IKEv1 IPV4_ADDR_SUBNET, IPV6_ADDR_SUBNET, IPV4_ADDR_RANGE and IPV6_ADDR_RANGE identities have been fully implemented and can be used as owners of shared secrets (PSKs).
* attr: Only enumerate attributes matching the IKE version of the current IKE_SATobias Brunner2016-03-101-19/+49
| | | | Numerically configured attributes are currently sent for both versions.
* attr: Add p-cscf keyword for P-CSCF server addressesTobias Brunner2016-03-101-0/+1
|
* p-cscf: Make sending requests configurable and disable it by defaultTobias Brunner2016-03-101-2/+6
|
generated by cgit v1.2.3 (git 2.25.1) at 2025-07-21 21:17:12 +0000