aboutsummaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
...
* kernel-netlink: Allow IPsec policies to replace shunt policiesTobias Brunner2015-11-101-3/+3
| | | | | Shunt policies don't have a reqid set, so we allow unequal reqids in this particular case (i.e. if one of the reqids is 0).
* kernel-pfkey: Make absolutely sure we always delete the right policy cache entryTobias Brunner2015-11-101-3/+8
|
* kernel-netlink: Make absolutely sure we always delete the right policy cache ↵Tobias Brunner2015-11-101-2/+9
| | | | entry
* kernel-interface: Pass the same data to del_policy() that was passed to ↵Tobias Brunner2015-11-1012-150/+162
| | | | | | | add_policy() The additional data can be helpful to identify the exact policy to delete.
* kernel-netlink: Remove the unused policy_history flagTobias Brunner2015-11-101-41/+20
| | | | This was used with pluto, which had its own policy tracking.
* kernel-interface: Return bool for kernel interface registrationThomas Egerer2015-11-104-20/+40
| | | | | | | | If the (un)registering of a kernel interface (net or ipsec) fails, the plugin loader will never know, since the appropriate functions always returns TRUE. By making the (un)register functions return a boolean value, the loader can detect a failure during initializing the kernel interface and abort charon startup if desired.
* trap-manager: Also clean up remote address in error casesTobias Brunner2015-11-101-0/+2
| | | | Fixes #1201.
* traffic-selector: Don't end printf'ed list of traffic selectors with a spaceTobias Brunner2015-11-1011-22/+21
|
* swanctl: Add option to query leases with --get-poolsTobias Brunner2015-11-101-3/+29
|
* vici: Add option to query leases of poolsTobias Brunner2015-11-102-3/+36
| | | | | We could later perhaps add filter parameters similar to those of the `ipsec leases` command (pool name/virtual IP).
* swanctl: List virtual IPs in --list-sasTobias Brunner2015-11-101-1/+11
|
* vici: Return local and remote virtual IPs when listing SAsTobias Brunner2015-11-102-0/+36
|
* socket-dynamic: Refactor setting source address when sending messagesTobias Brunner2015-11-091-32/+62
| | | | Basically the same change as the one for the socket-default plugin.
* socket-default: Refactor setting source address when sending messagesTobias Brunner2015-11-091-46/+107
| | | | | | | | | | | This ensures we don't pass data (via msg_control) defined in a different scope to sendmsg(). Actually, some compilers (e.g. GCC 5.2.1) might optimize the memcpy() call away causing the packets not to get sent from the intended source address. It also makes the code clearer than with all these ifdefs. Fixes #1171.
* socket-default: Refactor retrieval of destination address of received packetsTobias Brunner2015-11-091-39/+89
| | | | This makes the code a bit clearer than with the interleaved ifdefs.
* medsrv: Replace remaining JavaScript code with CSSTobias Brunner2015-11-094-371/+14
|
* medsrv: Replace the JavaScript focus() calls with HTML5's autofocusTobias Brunner2015-11-095-5/+4
|
* conftest: Add configuration option to report milliseconds in file loggerTobias Brunner2015-11-091-2/+4
|
* file-logger: Add option to print milliseconds within the current second ↵Tobias Brunner2015-11-094-13/+36
| | | | | | | | after timestamp For this to look right time_format should end with %S or %T. Closes strongswan/strongswan#18.
* ike-natd: Create fake NAT-D payloads in a more static wayTobias Brunner2015-11-091-20/+8
| | | | | | | | | | | | | | | In some scenarios an IKE_SA might get restarted multiple times (e.g. due to retransmits and delayed INVALID_KE_PAYLOAD notifies) so that two IKE_SA_INIT messages might be sent that only differ in the previously randomly generated NAT_DETECTION_SOURCE_IP payload. This could cause an authentication failure on the responder if the two peers don't use the same IKE_SA_INIT message in their InitiatorSignedOctets. While the payload is generated in a reproducible way it will still change when the daemon is restarted, which should make detecting the payloads as fake a bit harder (compared to e.g. just using 0.0.0.0:0 as address). Fixes #1131.
* testing: Added Debian 7.9 to IMV database5.3.4dr2Andreas Steffen2015-11-091-0/+48
|
* mediation: Reschedule initiate mediation job if SA is not yet foundTobias Brunner2015-11-091-0/+4
| | | | | | | | | If the job gets queued for a newly created IKE_SA it might not yet be checked in when the job is running, reschedule the job in that case. This should fix the two p2pnat test scenarios, which occasionally failed because one of the peers did not initiate the connection to the mediation server.
* ike-sa-manager: Signal entries that we don't actually check outTobias Brunner2015-11-091-1/+8
| | | | | | | | | In some cases we call wait_for_entry() but don't actually check out the entry afterwards (e.g. because it doesn't match certain criteria). So there won't be a call to checkin() for such entries causing waiting threads to get signaled. Instead, such threads would be blocked until another thread properly checks out/in the entry (or does a blocking enumeration).
* ike-sa-manager: Signal waiting threads after check out/in for uniqueness checkTobias Brunner2015-11-091-0/+3
| | | | Fixes 758b1caa0e75 ("ikev1: Prevent deadlock when checking for duplicate IKEv1 SAs")
* ikev1: Fix calculation of DPD timeoutTobias Brunner2015-11-091-0/+2
| | | | | A DPD timeout job is queued whenever a DPD is sent, i.e. after the DPD delay already has elapsed, so we have to compensate for that.
* ipsec: Quit script quicker for ipsec stopTobias Brunner2015-11-091-2/+2
| | | | | | | It rarely takes 1 second or longer to terminate the daemon. This decreases the runtime of the post test step a lot where `ipsec stop` is called for multiple hosts in each test case (10-15 minutes over all test cases).
* xauth: Call authorize() hook also when xauth-noauth is usedTobias Brunner2015-11-091-2/+8
| | | | Fixes #1138.
* libtnccs: Optionally use RTLD_NOW to load IMC/IMVs with dlopen()Tobias Brunner2015-11-092-2/+14
|
* plugin-loader: Optionally use RTLD_NOW with dlopen()Tobias Brunner2015-11-091-6/+11
| | | | | | | | | This can be useful when writing custom plugins as typos or missing linker flags that result in unresolved symbols in the shared object could otherwise cause late crashes. In particular, if such a symbol is used in a code path that is rarely executed. During development and testing using RTLD_NOW instead of RTLD_LAZY will prevent the plugin from getting loaded and makes the error visible immediately.
* windows: Define RTLD_NOW, even if it is not usedTobias Brunner2015-11-091-0/+5
|
* kernel-pfkey: Enable ENCR_AES_CTR when it's availableRenato Botelho2015-11-091-1/+3
| | | | | | Obtained-from: pfSense Sponsored-by: Rubicon Communications (Netgate) Closes strongswan/strongswan#17.
* vici: Add NAT information when listing IKE_SAsTobias Brunner2015-11-092-0/+21
| | | | | | | | | | The `nat-local` and `nat-remote` keys contain information on the NAT status of the local and remote IKE endpoints, respectively. If a responder did not detect a NAT but is configured to fake a NAT situation this is indicated by `nat-fake` (if an initiator fakes a NAT situation `nat-local` is set). If any NAT is detected or faked `nat-any` is set. Closes strongswan/strongswan#16.
* iv-gen: Use NULL IV generator for NULL encryptionTobias Brunner2015-11-091-0/+5
| | | | | | | | | | | | We don't need an IV for NULL encryption, so we wouldn't technically need an IV generator. But some of the code currently relies on an IV generator to be present. So we don't have to change that code and handle IV size == 0 specially we use the new NULL IV generator, which handles this transparently to the existing code. Before 3c81cb6fc322 ("aead: Create AEAD using traditional transforms with an explicit IV generator") iv_gen_rand_t was used for NULL encryption, which would work too but this way it's clearer.
* crypto: Add NULL IV generatorTobias Brunner2015-11-094-1/+98
| | | | | This does not actually allocate an IV and only accepts requests for size == 0.
* stroke: Make down-nb actually non-blockingTobias Brunner2015-11-091-31/+40
| | | | Fixes #1191.
* testing: Updated hasher testsAndreas Steffen2015-11-062-4/+83
|
* Explicitly mention SHA2 algorithm in BLISS OIDs and signature schemesAndreas Steffen2015-11-0612-89/+109
|
* Use word-aligned XOR in sha3_absorb()Andreas Steffen2015-11-031-4/+47
|
* Support BLISS signatures with SHA-3 hashAndreas Steffen2015-11-0310-9/+52
|
* Implemented SHA-3 hash algorithm including test vectorsAndreas Steffen2015-11-039-0/+1029
|
* Defined SHA-3 hashersAndreas Steffen2015-11-033-10/+59
|
* libipsec: Properly support CAMELLIA in CTR modeTobias Brunner2015-10-301-0/+1
|
* ikev2: Fix size of key material for CAMELLIA-CTRTobias Brunner2015-10-301-0/+1
| | | | Like AES in CTR mode it includes a 4 byte nonce.
* libipsec: Fix crypter lookup for AES-CTRTobias Brunner2015-10-301-1/+12
| | | | | | | | | | | | Due to the nonce, the ESP key material is four bytes longer than needed for the actual AES key. The crypto plugins, however, register their AES-CTR implementations with the AES key length, so the lookup here failed. For IKEv2 the key material is allocated after creating a crypter instance with the negotiated AES key size. The length of the actual key material is retrieved via get_key_size(), which adds the four bytes to the AES key length. Fixes #1124.
* ike-mobike: Send retransmits to the current local and remote addressesTobias Brunner2015-10-301-1/+5
| | | | | | These might have changed by a peer-initiated MOBIKE address update. Fixes #1125.
* ikev1: Handle queued INFORMATIONAL message after receiving the last AM requestTobias Brunner2015-10-301-0/+16
|
* ikev1: Queue INFORMATIONAL request if AM is not complete yetTobias Brunner2015-10-301-6/+13
|
* ikev1: Handle queued TRANSACTION messages only after processing repliesTobias Brunner2015-10-301-1/+2
|
* ikev1: Extract queueing of TRANSACTIONAL requests when MM is not complete yetTobias Brunner2015-10-301-17/+27
|
* ikev1: Drop TRANSACTION/QUICK_MODE requests until we received the last AM ↵Tobias Brunner2015-10-301-0/+32
| | | | message
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-06 17:07:43 +0000