denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,079 Commits 1 Branch 0 Tags
3364ef1d56c7947bb23b0a4db9bdb8bf4b329d2e
Commit Graph
60 Commits
Author SHA1 Message Date
Andreas Steffen 66a09e1d6e redesigned list output format 2006-10-25 08:41:27 +00:00
Martin Willi 191a26a6a7 removed deprecated iterator methods (has_next & current) 
added iterator hook to manipulate iterator the clean way
 2006-10-24 14:20:45 +00:00
Martin Willi 5c4cc9a4e3 added verbosity level to stroke 2006-10-24 08:44:47 +00:00
Martin Willi 60356f3375 introduced new logging subsystem using bus: 
passive listeners can register on the bus
  active listeners wait for signals actively
  multiplexing allows multiple listeners to receive debug signals
  a lot more...
 2006-10-18 11:46:13 +00:00
Martin Willi 47f5027807 introduced printf() specifiers for: 
host_t (%H)
  identification_t (%D)
  chunk pointers (%B)
  memory pointer/length (%b)
added a signaling bus:
  receives event and debug messages, sends them to its listeners
  stream_logger, sys_logger, file_logger added, listen to bus
some other tweaks here and there
 2006-09-27 14:14:44 +00:00
Andreas Steffen 380d91b9be added hostaccess support 2006-09-25 05:49:36 +00:00
Martin Willi 73760ca5ff extended statusall output 
added job/event-queue statistics
  added allocation statistics when using LEAK_DETECTIVE
 2006-09-21 07:03:21 +00:00
Andreas Steffen e2de376c74 added PSK support 2006-09-18 07:42:57 +00:00
Martin Willi d7934d0cfc implemented updown script to handle firewalling 2006-09-12 13:50:14 +00:00
Martin Willi a095243f60 add priority management for kernel policy 
let ROUTED policies installed, until manuall removed
introduced new naming scheme to allow proper shutdown of IKE/CHILD_SAs
ike_sa_manager cleanups
 2006-09-08 13:10:52 +00:00
Martin Willi 1239c6f40b implemented handling of dpdaction and dpddelay ipsec.conf parameters 2006-09-08 06:12:02 +00:00
Martin Willi a655f5c09c reuse reqid when a ROUTED child_sa gets INSTALLED 
fixed a bug in retransmission code
added support for the "keyingtries" ipsec.conf parameter
added support for the "dpddelay" ipsec.conf parameter
done some work for "dpdaction" behavior
some other cleanups and fixes
 2006-09-05 14:07:25 +00:00
Martin Willi da8ab11e91 fixed a at-least-one-year-old bug which caused crashed in the scheduler 2006-08-31 06:48:10 +00:00
Martin Willi 48d9883a3e initial support for IPv6 (more testing needed) 
socket works (without v6 filter)
  traffic selector handle IPv4/v4 cleanly
    improvements in traffic selector code
  kernel interface accepts v6 traffic selectors and hosts
  host_t class has full IPv6 support
 2006-08-30 17:12:56 +00:00
Martin Willi 4c23a8c9ec moved interface enumeration code to socket, where it belongs 
query interfaces every time we need it to respect changes in network config
added address listing on startup and "ipsec statusall"
 2006-08-28 08:45:22 +00:00
Martin Willi fe04e93a8b implemented IKE_SA rekeying 
uses ikelifetime, rekeymargin and rekeyfuzz config settings
	no handling of simultaneus exchanges yet!
 2006-07-27 12:18:40 +00:00
Martin Willi 45f76a7ddd added possibility to route CHILD_SAs, without to set them up 
support for auto=route parameter
	support for ipsec route and ipsec unroute
	initiating of CHILD and/or IKE_SAs based on kernel acquires
 2006-07-21 13:31:53 +00:00
Martin Willi c0593835f4 reuse an existing IKE_SA to set up additional CHILD_SAs 2006-07-20 14:57:49 +00:00
Martin Willi 8dfbe71b34 introduced refcounting on policy and connections 
aren't stored in the IKE_SA anymore, they are queried on the fly
	are immutable now, allows it to share them
policy selection based on traffic selectors, leads to valid lookup results
	rekeying queries the policy based on its traffic selectors
 2006-07-20 10:09:32 +00:00
Martin Willi 92ee45a0ee cleanups in kernel interface code 
added proper traffic selector to string conversion
some cleanups here & there
 2006-07-18 12:53:54 +00:00
Martin Willi aeeb4f4f97 added policy cache to kernel interface 
allows refcounting of multiple installed policies
	finally brings us stable simultaneous rekeying
 2006-07-12 11:42:36 +00:00
Martin Willi abba7ecb9d further work done for simultaneous rekeying/delete 
still some cases which cause trouble
 2006-07-10 14:24:04 +00:00
Martin Willi c71d53ba4e updated copyright information 2006-07-07 08:49:06 +00:00
Martin Willi 698d774918 reimplemented CHILD_SA rekeying & delete 
no simultanous transaction with CHILD_SAs yet!
 2006-07-07 07:04:07 +00:00
Martin Willi d109b48968 added support for leftprotoport and rightprotoport 2006-07-05 13:13:07 +00:00
Martin Willi 3dd3c5f39e redesigned IKE_SA using a transaction mechanism: 
removed old state machine
  reimplemented IKE_SA setup and delete
  implemented dead peer detection
  implemented keep-alives
  a lot of fixes
  no rekeying yet
 2006-07-05 10:53:20 +00:00
Martin Willi 57d02978cf made thread ids unsigned again, to avoid negative thread ids on some systems 2006-07-04 13:30:49 +00:00
Martin Willi 1135f79898 fixed memleak when initiating a connection already up 2006-07-04 13:29:16 +00:00
Martin Willi f141214e64 applied latest NATT patch with some fixes and cleanups 2006-07-04 13:25:00 +00:00
Andreas Steffen 971218c3ae support of cert payloads 2006-07-03 06:27:45 +00:00
Andreas Steffen 6f74bfd6ac added X.509 trust chain verification 2006-06-27 08:48:28 +00:00
Martin Willi 2f89902d07 applied new changes from NATT team 
DPD only done when no IPsec and IKE traffic processed
	minor changes here and there
 2006-06-23 14:02:30 +00:00
Martin Willi 1396815afb first merge of NATT code 2006-06-22 06:36:28 +00:00
Martin Willi aed58dcc93 readded local_credential_store 
added sendcert policy to connection
some other cleanups
 2006-06-20 08:43:57 +00:00
Andreas Steffen 21b433c641 implemented rereadcrls rereadcacerts 2006-06-20 06:05:01 +00:00
Andreas Steffen d92cca4a72 added listcrls 2006-06-16 05:55:02 +00:00
Martin Willi c095388f7f added support for "ike" and "esp" keywords 
fixed bugs in proposal code
algorithm selection for charon works now with ipsec.conf
a lot of other fixes
 2006-06-15 11:09:11 +00:00
Andreas Steffen 5347233204 support for stroke listcerts|listcacerts|listall and left|rightca= 2006-06-12 08:43:46 +00:00
Martin Willi a2a3fb3e25 workaround for peers rekeying at the same time 
loading lifetime policies from ipsec.conf
 2006-06-12 07:33:20 +00:00
Martin Willi b543bef50c improved kernel interface logging 2006-06-09 08:41:41 +00:00
Martin Willi 5c131a016b specifying keysize in bits, as it is required in IKEv2 
added generic kernel SA algorithm handling, which brings us:
        aes-128, aes-256, blowfish, des, 3des and null encryption for CHILD_SAs
 2006-06-09 07:31:30 +00:00
Andreas Steffen b7f9ca5837 added support for leftsendcert= and left|rightca= parameters 2006-06-09 05:50:41 +00:00
Martin Willi 5238c9afef fixed compile warnings when using -Wall 
further CHILD_SA rekeying work done:
	creation of a new CHILD_SA on a expire from a kernel works
	delete of old CHILD_SA still missing
	some issues when both initiate rekeing
 2006-06-08 14:20:05 +00:00
Martin Willi 8d77eddec2 further work for rekeying: 
get liftimes from policy
  added new state
  initiation of rekeying done
proposal redone:
  removed support for AH+ESP proposals
 2006-06-07 13:26:23 +00:00
Martin Willi 32b6500fbf job management: 
moved job code from thread_pool to job, jobs have an "execute" method now
  added two new jobs: delete_child_sa & rekey_child_sa
kernel interface:
  listens now for ACQUIRE & EXPIRE
  supports hard and soft lifetimes
  fires jobs for delete and rekey child sa
ike sa manager:
  can checkout IKE SAs by requid of owned CHILD SAs
we have now the infrastructure to do the rekeying... :-)
 2006-05-31 14:23:15 +00:00
Andreas Steffen 6848dac603 minimized prefixed on stroke logger output 2006-05-31 05:50:04 +00:00
Andreas Steffen e1c00b96a6 list ca certificates 2006-05-30 07:48:29 +00:00
Martin Willi 139ce7871f - fixed memleak when deleting a connection 2006-05-29 11:29:23 +00:00
Martin Willi 9fe14f4b8a - policies contain a connections name now 
- used for initiate and delete
- connections won't get initiated twice anymore
- deleting of connections is now possible, which allows us to use
  ipsec update and ipsec reload
 2006-05-29 11:09:45 +00:00
Andreas Steffen ecadab2ba7 stroke now uses constant size string buffer 2006-05-29 07:14:57 +00:00