aboutsummaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
...
* ikev1: Send derived CHILD_SA keys to the busTobias Brunner2016-10-041-14/+26
|
* ikev1: Send derived IKE_SA keys to busTobias Brunner2016-10-041-14/+11
|
* bus: Add new hooks for derived IKE_SA and CHILD_SA keysTobias Brunner2016-10-043-11/+131
|
* nm: Remove dummy TUN deviceTobias Brunner2016-10-041-36/+0
| | | | | Recent NM releases don't insist on getting a device back from VPN plugins.
* nm: Fix comment in service file in /etc/NetworkManager/VPNTobias Brunner2016-10-041-1/+1
|
* nm: Remove generated service file in `make clean`Tobias Brunner2016-10-041-1/+1
|
* nm: Don't add generated AppStream metadata to tarballTobias Brunner2016-10-041-1/+0
|
* bus: Fix maximum log levels when mixing log/vlog implementing loggersTobias Brunner2016-09-301-12/+20
| | | | | | | | | | | The maximum would not get set correctly when a logger is removed and the first remaining logger in the list (the one with the highest log level) does e.g. only implement vlog() while there are other loggers that implement log(). This would result in only max_vlevel getting set correctly while max_level would incorrectly get set to -1 so that log() would not get called for any of the loggers anymore. References #574.
* kernel-netlink: Pass zero mark to kernel if mask is setTobias Brunner2016-09-301-2/+2
| | | | | | The kernel will apply the mask to the mark on the packet and then compare it to the configured mark. So to match only unmarked packets we have to be able to set 0/0xffffffff.
* kernel-netlink: Support configuring XFRM policy hashing thresholdsTobias Brunner2016-09-301-0/+107
| | | | | | | | | | | | | | | | | | | | | | | | If the number of flows over a gateway exceeds the flow cache size of the Linux kernel, policy lookup gets very expensive. Policies covering more than a single address don't get hash-indexed by default, which results in wasting most of the cycles in xfrm_policy_lookup_bytype() and its xfrm_policy_match() use. Starting with several hundred policies the overhead gets inacceptable. Starting with Linux 3.18, Linux can hash the first n-bit of a policy subnet to perform indexed lookup. With correctly chosen netbits, this can completely eliminate the performance impact of policy lookups, freeing the resources for ESP crypto. WARNING: Due to a bug in kernels 3.19 through 4.7, the kernel crashes with a NULL pointer dereference if a socket policy is installed while hash thresholds are changed. And because the hashtable rebuild triggered by the threshold change that causes this is scheduled it might also happen if the socket policies are seemingly installed after setting the thresholds. The fix for this bug - 6916fb3b10b3 ("xfrm: Ignore socket policies when rebuilding hash tables") - is included since 4.8 (and might get backported). As a workaround `charon.plugins.kernel-netlink.port_bypass` may be enabled to replace the socket policies that allow IKE traffic with port specific bypass policies.
* include: Update xfrm.h to Linux v4.3Martin Willi2016-09-301-0/+22
| | | | | We strip the newly introduced <linux/in6.h> include, as this clashes with the <netinet/in6.h> include.
* child-sa: Only install outbound FWD policies if explicitly configuredTobias Brunner2016-09-281-14/+27
| | | | | | They are only required if drop policies would otherwise prevent forwarding traffic. This reduces the number of policies and avoids conflicts e.g. with SPD hash thresholds.
* vici: Make installation of outbound FWD policies configurableTobias Brunner2016-09-282-25/+36
|
* child-cfg: Add setting that controls whether outbound FWD policies are installedTobias Brunner2016-09-282-0/+24
|
* kernel-netlink: Update cached reqid when updating policiesTobias Brunner2016-09-281-0/+2
|
* gmp: Support of SHA-3 RSA signaturesAndreas Steffen2016-09-2221-163/+265
|
* bliss sampler unit-test: Fixed enumeration typeAndreas Steffen2016-09-221-2/+2
|
* bliss: bliss_sampler expects XOF typeAndreas Steffen2016-09-221-4/+3
|
* unit-tests: MGF1 tests depend on an XOF implementation not just a hash functionTobias Brunner2016-09-211-2/+2
| | | | | If the mgf1 plugin was not enabled (e.g. with the default configure options) the tests failed.
* mgf1: Refactored MGF1 as an XOFAndreas Steffen2016-09-2130-615/+928
|
* leak-detective: Fix compile warning due to unused variable if LD is disabledTobias Brunner2016-09-201-1/+1
|
* leak-detective: Whitelist thread ID getterTobias Brunner2016-09-201-1/+3
| | | | | | | | In case an external thread calls into our code and logs messages, a thread object is allocated that will never be released. Even if we try to clean up the object via thread value destructor there is no guarantee that the thread actually terminates before we check for leaks, which seems to be the case for the Ada Tasking threads.
* charon-tkm: Build C code with debug informationTobias Brunner2016-09-201-1/+2
|
* leak-detective: Whitelist functions of the Ada runtime related to TaskingTobias Brunner2016-09-201-0/+4
|
* charon-tkm: Free name of the PID fileTobias Brunner2016-09-201-0/+1
|
* charon-tkm: Deinitialize tkm before libstrongswanTobias Brunner2016-09-201-1/+1
| | | | In particular because of leak-detective.
* leak-detective: Whitelist some glib/libsoup functionsTobias Brunner2016-09-201-1/+13
| | | | | | Some of these are pretty broad, so maybe an alternative option is to not use the soup plugin in the openssl-ikev2/rw-suite-b* scenarios. But the plugin is not tested anywhere else so lets go with this for now.
* eap-peap: Fix memory leaks when handling tunneled methodsTobias Brunner2016-09-201-1/+3
|
* ipseckey: Properly free enumerated certificatesTobias Brunner2016-09-201-12/+14
|
* ipseckey: Properly free public key after creating certificateTobias Brunner2016-09-201-1/+1
|
* dnscert: Properly free enumerated certificatesTobias Brunner2016-09-201-8/+11
|
* unbound: Avoid unnecessary cloning of RR list that caused a memory leakTobias Brunner2016-09-201-2/+1
|
* unbound: Fix memory leakTobias Brunner2016-09-201-0/+2
|
* pool: Fix (known) memory leak when querying leasesTobias Brunner2016-09-201-21/+38
|
* leak-detective: Whitelist leak in libldapTobias Brunner2016-09-201-0/+2
|
* leak-detective: Optionally write report to a log fileTobias Brunner2016-09-201-10/+36
|
* vici: Fix indention of flush_certs() method in Python bindingsTobias Brunner2016-09-201-1/+1
|
* maemo: Remove unused pluginTobias Brunner2016-09-157-748/+0
|
* maemo: Remove obsolete status/settings appletTobias Brunner2016-09-1523-1850/+0
|
* swanctl: Add man page entry for flush-certs command5.5.1dr3Tobias Brunner2016-09-151-3/+4
|
* vici: flush-certs command flushes certificate cacheAndreas Steffen2016-09-139-1/+160
| | | | | | | | | | When fresh CRLs are released with a high update frequency (e.g. every 24 hours) or OCSP is used then the certificate cache gets quickly filled with stale CRLs or OCSP responses. The new VICI flush-certs command allows to flush e.g. cached CRLs or OCSP responses only. Without the type argument all kind of certificates (e.g. also received end entity and intermediate CA certificates) are purged.
* auth-cfg-wrapper: Fix memory leak with hash-and-URL certificatesTobias Brunner2016-09-121-1/+1
| | | | | | | We wrap the auth-cfg object and its contents, so there is no need to get an additional reference for the enumerated certificate. Fixes a44bb9345f04 ("merged multi-auth branch back into trunk")
* ikev2: (Re-)Queue tasks used to establish an IKE_SA in reset()Tobias Brunner2016-09-061-2/+1
| | | | | | | | | Some tasks might get removed immediately once the IKE_SA_INIT response has been handled even if there were notifies that require a restart of the IKE_SA (e.g. COOKIE or INVALID_KE_PAYLOAD). Such a task is ike_vendor, which caused vendor IDs not to get sent in a retry. This change ensures all required tasks are queued after the reset, which some callers did already anyway.
* ikev2: Store proposal on IKE_SA before creating DH objectTobias Brunner2016-09-061-2/+5
| | | | This might be useful for custom implementations of keymat_t.
* nm: Updated NEWSTobias Brunner2016-09-051-1/+15
|
* nm: Pass external gateway to NMTobias Brunner2016-09-051-1/+8
| | | | This seems to be required by newer versions.
* nm: Update auth-dialogTobias Brunner2016-09-052-106/+251
| | | | | | This updates the auth dialog so that passwords are properly retrieved (e.g. for the nm-applet). It also adds support for external UI mode and properly handles secret flags.
* nm: Enforce min. length for PSKs in backendTobias Brunner2016-09-051-0/+10
|
* nm: Add minimum length constraint for PSK passwords in connection editorTobias Brunner2016-09-051-0/+16
| | | | We already have this restriction in the auth-dialog.
* nm: Bump minor version to 1.4.0Lubomir Rintel2016-09-051-1/+1
| | | | | | This is probably a good idea to do to signal there's significant changes in dependencies to the distro package maintainers with libnm port and associated changes.
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-04 09:13:49 +0000