Commit Graph

Select branches

Hide Pull Requests

main

Mono Color

• 8b8a2ee43a Merge branch 'labeled-ipsec' Tobias Brunner 2022-04-14 18:43:16 +02:00
• 6910347d1a testing: Add DSCP scenario that uses simple labels Tobias Brunner 2022-04-14 14:13:07 +02:00
• 955b526be8 swanctl: Add options to filter CHILD_SAs in --list-sas Tobias Brunner 2021-06-02 14:46:03 +02:00
• b1c7fac768 vici: Add options to only return specific CHILD_SAs in list-sas() Tobias Brunner 2021-06-02 14:37:39 +02:00
• 994d9d37d4 testing: Copy comments to test log Tobias Brunner 2021-06-02 14:29:55 +02:00
• b67f7fb861 swanctl: Report labels in --list-* commands Tobias Brunner 2021-12-21 12:18:21 +01:00
• 2994347d18 vici: Report security label on CHILD_SA, policies and configs Tobias Brunner 2021-12-21 12:10:34 +01:00
• 7cf6f29ac5 vici: Make security labels and mode configurable Tobias Brunner 2021-12-21 11:56:32 +01:00
• f52e565ad3 kernel-netlink: Forward labels from acquires Tobias Brunner 2021-12-21 11:33:06 +01:00
• 0a673794d8 trap-manager: Add support to handle acquires with security labels Tobias Brunner 2021-12-21 11:26:50 +01:00
• 81c362829e kernel-handler: Log security label received with acquire Tobias Brunner 2021-12-21 11:26:12 +01:00
• 52a05d7f6c kernel-interface: Optionally pass security label with an acquire Tobias Brunner 2021-12-21 11:22:36 +01:00
• 3f3838d1f9 ike-sa: Accept optional security label when initiating CHILD_SAs Tobias Brunner 2021-12-20 16:16:00 +01:00
• 92f54e55e9 child-rekey: Maintain security label during rekeying Tobias Brunner 2021-12-20 16:10:19 +01:00
• b00a4e778f selinux: Add plugin to install trap policies with generic labels Tobias Brunner 2022-02-02 15:51:06 +01:00
• 065685dde7 ike-sa: Add helper to determine an IKE_SA's dynamic hosts Tobias Brunner 2022-02-02 15:45:57 +01:00
• 3c65cf6456 trap-manager: Add facility to install externally managed trap policies Tobias Brunner 2022-02-01 20:17:50 +01:00
• 8f4cfe9669 child-sa: Allocate a new reqid if dynamic traffic selectors are updated Tobias Brunner 2022-02-03 17:10:46 +01:00
• 96ecc39cd0 kernel-netlink: Allow reqid updates for policies again Tobias Brunner 2022-02-04 09:37:37 +01:00
• 1b3af3e37d kernel-interface: Add support to change the reqid in update_sa() Tobias Brunner 2022-02-03 17:10:12 +01:00
• 1f060357f4 kernel-wfp: Use new UDP ports in update_sa() Tobias Brunner 2022-02-03 17:08:58 +01:00
• 9619b1e757 child-sa: Support dynamically updating trap policies Tobias Brunner 2022-02-03 14:46:59 +01:00
• f9b895b49f child-create: Add support to handle security labels Tobias Brunner 2022-02-02 10:40:16 +01:00
• 7a8d110863 child-create: Consider security label when comparing CHILD_SAs Tobias Brunner 2021-12-20 15:58:46 +01:00
• 139d655817 child-sa: Add support for security labels Tobias Brunner 2021-12-20 15:28:07 +01:00
• 6cb83c305e kernel-interface: Optionally consider security label when allocating reqids Tobias Brunner 2021-12-20 15:11:37 +01:00
• 03729958db peer-cfg: Consider security labels when selecting child configs Tobias Brunner 2022-01-10 18:31:34 +01:00
• 63d4bd071f child-cfg: Add method to select a security label Tobias Brunner 2022-01-11 10:15:53 +01:00
• ef72ac88c3 child-cfg: Add optional security label and mode Tobias Brunner 2021-12-20 13:49:56 +01:00
• bf0542c4e1 kernel-netlink: Add support for optional security label on SAs and policies Tobias Brunner 2021-12-20 15:02:42 +01:00
• c4e2b7617f encoding: Remove unused TS_TYPE and ADDRESS encodings Tobias Brunner 2022-01-13 14:26:06 +01:00
• f4c0ec0b71 ts-payload: Add support for TS of type TS_SECLABEL Tobias Brunner 2022-01-10 17:39:56 +01:00
• a44de0b957 traffic-selector-substructure: Add support for TS_SECLABEL Tobias Brunner 2022-01-10 17:34:22 +01:00
• d71d181d28 traffic-selector: Add TS_SECLABEL type Tobias Brunner 2022-01-10 16:35:38 +01:00
• ebb99484e3 leak-detective: Whitelist selinux_check_access() Tobias Brunner 2022-02-04 08:17:54 +01:00
• 2dd60e4946 sec-label: Add enum for security label mode Tobias Brunner 2022-01-27 14:49:39 +01:00
• decfe44433 sec-label: Add class to represent security labels Tobias Brunner 2021-12-20 11:23:37 +01:00
• fe5f27336d configure: Add option to link against libselinux Tobias Brunner 2021-12-17 17:13:27 +01:00
• c00c5e5a35 vici: Make combination of 'trap' and 'start' configurable Tobias Brunner 2021-12-16 16:51:04 +01:00
• 7137fd96c2 enum: Add helper to parse enum flags from strings Tobias Brunner 2021-12-17 15:19:02 +01:00
• 4f4d4021b4 ike: Treat action_t as flags so 'start' and 'trap' can be combined Tobias Brunner 2021-12-16 16:34:37 +01:00
• 927103ece4 enum: Allow specifying the name used when none of the flags are set Tobias Brunner 2021-12-17 14:25:44 +01:00
• a5430e1601 child-create: Abort initiating a duplicate CHILD_SA Tobias Brunner 2021-05-20 18:11:58 +02:00
• 511033b3da child-create: Just abort CREATE_CHILD_SA request if nonce creation fails Tobias Brunner 2021-05-20 17:55:54 +02:00
• 3b699c720f kernel-listener: Use a struct to pass data from acquires Tobias Brunner 2021-12-16 13:50:38 +01:00
• 9983326b20 kernel-netlink: Read protocol of acquire not from template Tobias Brunner 2021-05-28 13:36:04 +02:00
• 7f30e1aea2 ike-sa: Use a struct to pass optional arguments when initiating CHILD_SAs Tobias Brunner 2021-05-19 14:16:20 +02:00
• 366ac36a1f ike: Don't reset optional CHILD_SA properties when migrating child-creating tasks Tobias Brunner 2021-05-20 11:43:39 +02:00
• 93d8177674 cirrus: Use FreeBSD 12.3 Tobias Brunner 2022-04-14 18:38:43 +02:00
• b866ee88bf ike: Track unprocessed initial IKE messages like half-open IKE_SAs Tobias Brunner 2021-06-04 18:11:46 +02:00
• d8104b7c69 receiver: Add per-IP cookie threshold Tobias Brunner 2022-03-18 15:13:06 +01:00
• 902fbd16e8 receiver: Use a time based limit to switch COOKIE secrets Tobias Brunner 2021-06-04 13:41:31 +02:00
• 63260a11ca lgtm: Fix query for chunk_from_chars() Tobias Brunner 2022-04-14 15:16:38 +02:00
• 3c028686de traffic-selector: Avoid out-of-bound array access when calculating range Tobias Brunner 2022-03-16 11:45:49 +01:00
• 8100f2f255 Merge branch 'pfkey-exclude-routes' Tobias Brunner 2022-03-15 14:04:19 +01:00
• 8a76c5af8a kernel-pfkey: Don't install exclude routes for locally connected peers Tobias Brunner 2022-02-16 14:47:40 +01:00
• 5de6ab82a6 kernel-pfkey: Only install exclude route if not routing via outbound interface Tobias Brunner 2022-02-11 17:23:15 +01:00
• 012e4cd902 kernel-netlink: Remove unimplemented XFRM_OFFLOAD_IPV6 flag Leon Romanovsky 2022-02-21 15:35:30 +02:00
• b2cf5af192 README: Added link to docs.strongswan.org Andreas Steffen 2022-03-02 21:55:43 +01:00
• c8045f86a3 testing: Increase memory on winnetou even more Tobias Brunner 2022-03-01 10:10:37 +01:00
• 2ade4311bc tls-server: Use correct error alerts if client doesn't send a certificate Tobias Brunner 2022-03-01 10:05:26 +01:00
• 3eecd40cec openssl: Don't unload providers Tobias Brunner 2022-02-23 17:29:02 +01:00
• e69438450f Use wolfSSL 5.2.0 for tests Tobias Brunner 2022-02-22 09:35:01 +01:00
• 9e3978259e mgf1: Fix Doxygen group for XOF implementation Tobias Brunner 2022-02-11 14:19:35 +01:00
• 963adc7637 xof: Fix typo in documentation for set_seed() Tobias Brunner 2022-02-09 11:36:43 +01:00
• eccfd27f03 tls-peer: Simplify identity check for server certificate Tobias Brunner 2022-02-04 11:16:14 +01:00
• 42704f6a61 tls-test: Add option to specify a specific remote identity Tobias Brunner 2022-02-02 18:54:41 +01:00
• e4b4aabc49 libtls: Enforce client/server identity when looking for public key Tobias Brunner 2022-02-02 18:39:20 +01:00
• 3f7d40d3b5 Merge branch 'natd-fixes' Tobias Brunner 2022-02-15 16:38:31 +01:00
• 011de0fe0d ike-natd: Queue DPD after faking local NAT to check if UDP-encap can be disabled Tobias Brunner 2022-01-31 14:17:40 +01:00
• 90b1d09e42 ike-mobike: Make task a no-op if MOBIKE is not supported Tobias Brunner 2022-01-31 14:13:02 +01:00
• aaa505dbf0 ike-natd: Fake NAT situation or disable NAT-D if source IP is undetermined Tobias Brunner 2021-06-29 16:11:51 +02:00
• d6879ef984 ha: Streamline handling of conditions and extensions Thomas Egerer 2022-02-08 17:52:02 +01:00
• 801bb8536a error-notify: Handle missing alerts Tobias Brunner 2022-02-11 18:11:57 +01:00
• b47e9919f5 testing: Print the actual start time of a command for do-tests -t Tobias Brunner 2022-02-09 18:54:23 +01:00
• 7314e09171 appveyor: Install autotools package on 2019 image Tobias Brunner 2022-02-04 12:05:53 +01:00
• 34a6cb858d openssl: Return correct number of plugin features if ECDH groups are omitted Tobias Brunner 2022-02-04 16:30:51 +01:00
• 956b25a4cc proposal: Add ESN transform to default ESP AEAD proposal Martin Willi 2022-01-31 14:01:42 +01:00
• 912d0520b9 SECURITY: Fix link to PGP key Tobias Brunner 2022-01-25 10:54:10 +01:00
• 9877ce6c56 sys-logger: Optionally support mapping strongSwan loglevels to syslog levels Martin Willi 2022-01-20 14:48:48 +01:00
• e3d1766aff addrblock: Allow limiting validation depth of issuer addrblock extensions Martin Willi 2022-01-12 11:00:20 +01:00
• 1bb05006d3 Use Botan 2.19.1 for tests Tobias Brunner 2022-01-20 10:04:30 +01:00
• 57d6e96943 Version bump to 5.9.5 Andreas Steffen 2022-01-24 12:01:10 +01:00
• 4f560557b0 NEWS: Add info about CVE-2021-45079 Tobias Brunner 2022-01-20 17:24:02 +01:00
• 64cc9acbf0 eap-authenticator: Enforce failure if MSK generation fails Tobias Brunner 2021-12-14 10:51:35 +01:00
• de15386d94 NEWS: Add news for 5.9.5 Tobias Brunner 2022-01-20 17:22:37 +01:00
• 627eaa22ff Fixed some typos, courtesy of codespell Tobias Brunner 2022-01-20 10:44:42 +01:00
• 21b2b124a1 agent: Log socket path if connecting to it failed Tobias Brunner 2021-12-14 10:58:28 +01:00
• 1321fdb8aa Version bump to 5.9.5rc1 Andreas Steffen 2022-01-16 07:48:06 +01:00
• 6867050d47 message: Add getter/setter for metadata handling Tobias Brunner 2021-12-02 16:12:31 +01:00
• e3d84bc6f6 packet: Add helper function to create a clone without data Tobias Brunner 2021-12-02 16:10:46 +01:00
• 93583d23d6 packet: Add getter/setter for metadata handling Tobias Brunner 2021-12-02 15:34:18 +01:00
• 269ca19f13 metadata-set: Add implementation for a collection of metadata objects Tobias Brunner 2021-12-02 11:25:34 +01:00
• 531335ad20 metadata: Add metadata factory and implementation for integer types Tobias BrunnerandThomas Egerer 2021-12-01 17:13:35 +01:00
• 85d626e9ae testing: Modified ikev2/net2net-rfc3779 scenario Andreas Steffen 2022-01-10 21:14:05 +01:00
• cd0c9919d9 Use wolfSSL 5.1.1 for tests Tobias Brunner 2022-01-04 15:44:29 +01:00
• a20daaa336 conf: Fix typo for ha plugin's buffer size option Noel Kuntze 2021-12-30 10:30:55 +01:00
• 36c64589d8 Version bump to 5.9.5dr4 Andreas Steffen 2021-12-31 14:46:31 +01:00
• 903c68e069 sw-collector: Iterate through history logs Andreas Steffen 2021-10-17 15:53:42 +02:00
• 0b76ca13ab libtpmtss: Some minor improvements Andreas Steffen 2021-12-17 13:20:56 +01:00