Commit Graph

Select branches

Hide Pull Requests

main

Mono Color

• 5e37f7e550 x509: Fix leak if a certificate contains multiple authorityKeyIdentifiers Tobias Brunner 2017-03-15 11:16:35 +01:00
• 157742be7d fuzz: Add fuzzing boilerplate Tobias Brunner 2017-03-08 11:00:22 +01:00
• 4d0795bcef testing: Avoid expiration of allocated SPIs due to low retransmission settings Tobias Brunner 2017-03-14 17:02:26 +01:00
• 70855696ad kernel-netlink: Use total retransmit timeout as acquire timeout Tobias Brunner 2017-03-13 12:15:25 +01:00
• bfbd3af850 task-manager: Add helper function to calculate the total retransmit timeout Tobias Brunner 2017-03-13 12:00:40 +01:00
• 389e4b8e67 ike: Use optional jitter to calculate retransmission timeouts Tobias Brunner 2017-05-19 16:14:40 +02:00
• d140b3bd3f kernel-netlink: Try to add new inbound SA if update fails Thomas Egerer 2017-03-09 18:26:35 +01:00
• bf08e39441 kernel-pfkey: Update SA addresses if supported by the kernel Tobias Brunner 2017-02-07 09:57:09 +01:00
• a080cfece0 kernel-pfkey: Use new encap flag on Mac OS X when updating SAs Tobias Brunner 2017-02-07 09:55:50 +01:00
• 3a67df3b10 receiver: Restrict init limit to half-open SAs as responder Thomas Egerer 2017-03-10 10:45:48 +01:00
• 6b9361f714 Merge branch 'hw-offload' Tobias Brunner 2017-05-23 17:00:04 +02:00
• 48ea655016 kernel-netlink: Update hardware offload attribute when SAs are updated Tobias Brunner 2016-11-30 10:46:21 +01:00
• 0b5dfaeb5c kernel-netlink: Base SA update on correct message in multi-message response Tobias Brunner 2016-11-30 10:27:10 +01:00
• 7c4f88d4be vici: Make hardware offload configurable Tobias Brunner 2016-06-20 15:29:47 +02:00
• aeee0bcc30 child-sa: Optionally enable hardware offload for CHILD_SAs Tobias Brunner 2016-06-20 15:27:22 +02:00
• 4a17583051 child-cfg: Add flag to enable hardware offload Tobias Brunner 2016-06-20 15:24:49 +02:00
• 749ac175fa child-cfg: Use flags for boolean options Tobias Brunner 2017-05-10 19:04:25 +02:00
• d42948fc05 kernel-netlink: Enable hardware offloading if configured for an SA Tobias Brunner 2016-06-20 15:14:40 +02:00
• 35a53d6491 kernel-ipsec: Add flag to enable hardware offloading for an IPsec SA Tobias Brunner 2016-06-20 14:59:38 +02:00
• 5bfae68670 include: Update xfrm.h to include hardware offloading extensions Tobias Brunner 2016-06-20 14:55:53 +02:00
• 7caec9e4a4 kernel-netlink: Directly handle Netlink messages if thread pool is empty Tobias Brunner 2017-04-12 15:18:45 +02:00
• 9b29003cd9 socket-default: Add an option to force the sending interface via IP_PKTINFO Martin Willi 2016-09-16 14:50:07 +02:00
• 46a3f92a76 Add an option to announce support for IKE fragmentation but not sending fragments Tobias Brunner 2017-05-05 15:48:14 +02:00
• cbbd34f507 swanctl: Use returned key ID to track loaded private keys Tobias Brunner 2017-05-12 09:15:24 +02:00
• 605a98c7ce vici: Return key ID from load-key command Tobias Brunner 2017-05-12 09:10:15 +02:00
• 6a8a44be88 credential-manager: Prefer local over global sets Adrian-Ken Rueegsegger 2017-04-26 13:46:26 +02:00
• 08b19dd02a ikev1: Send NAT-D payloads after HASH payloads in Aggressive Mode requests Tobias Brunner 2017-05-04 11:29:50 +02:00
• 746e88406c ike-sa-manager: Improve scalability of IKE_SA count checking Thomas Egerer 2017-03-23 09:43:06 +01:00
• 59e6e93323 tun-device: Use next free TUN device on FreeBSD Tobias Brunner 2017-05-03 10:01:12 +02:00
• fa959c0732 tun-device: TUN devices are not supported on iOS Tobias Brunner 2017-04-18 11:06:13 +02:00
• a1aede8065 attr-sql: Make release of online leases during startup optional Tobias Brunner 2017-03-21 08:53:02 +01:00
• f6d0965a4c charon-nm: Fix typo to actually use random NAT-T port Tobias Brunner 2017-05-03 09:54:52 +02:00
• 0727c8a533 af-alg: Fix crypt() definition conflict Baruch Siach 2017-05-11 14:04:47 +03:00
• a5f7a4c790 Version bump to 5.3.3dr2 Andreas Steffen 2017-05-08 22:38:12 +02:00
• b0dcf33f0f x509: Evaluate return codes of parsing functions Andreas Steffen 2017-05-05 09:04:19 +02:00
• a4b3f1454b nm: Explicitly prevent the smartcard PIN from being stored Raphael Geissert 2016-11-03 17:00:21 +01:00
• 8e1b986c10 nm: IKE/ESP proposal customization support Defunct 2017-04-29 19:02:36 +00:00
• 4ac68f02f2 charon-nm: IKE/ESP proposal customization support Defunct 2017-04-29 16:32:02 +00:00
• d38d1fcd68 Version bump to 5.5.3dr1 Andreas Steffen 2017-04-26 21:29:42 +02:00
• e419b010aa configure: Include curve25519 in the pki default plugin list Martin Willi 2017-03-29 17:04:03 +02:00
• 25217488d2 testing: Created swanctl/rw-eap-aka-sql-rsa scenario Andreas Steffen 2017-04-26 12:43:40 +02:00
• 64f9fa9e9f testing: Created ikev2/rw-eap-aka-sql-rsa scenario Andreas Steffen 2017-04-23 09:19:22 +02:00
• 2fad3460fa eap-simaka-sql: Fixed database column from use to used Andreas Steffen 2017-04-26 10:37:45 +02:00
• 069bf10d3f pki: Reset variable so error handling works properly Tobias Brunner 2017-04-19 18:56:43 +02:00
• 0d66b01a81 vici: Fix type error exception in Python bindings odi79 2017-04-14 16:40:57 +02:00
• bb2ba9f15d Version bump to 5.5.2 Andreas Steffen 2017-03-27 16:57:03 +02:00
• c5ccf933ec testing: List BLIS certs in swanctl/rw-newhope-bliss scenario Andreas Steffen 2017-03-27 16:56:50 +02:00
• 6fe1d78a0d kernel-netlink: Avoid O(n^2) copy operations when concatenating Netlink responses Jiri Horky 2017-03-23 22:59:45 +01:00
• 67849f4972 libtls: Replace expired certificates for unit tests Tobias Brunner 2017-03-24 10:18:32 +01:00
• 3207193cbf pki: Actually make the default key type KEY_ANY for --self Tobias Brunner 2017-03-24 10:10:13 +01:00
• 3610d7607e addrblock: Narrow selectors when rekeying a CHILD_SA as original responder Martin Willi 2017-03-23 08:48:46 +01:00
• db12675ec4 conf: Document recommended lower limit for SPIs Tobias Brunner 2017-03-23 17:29:47 +01:00
• 93700d93fa travis: aikpub2 was removed, no need to disable it anymore Tobias Brunner 2017-03-23 10:48:04 +01:00
• 967e13bfb5 conf: Remove snippet for aikpub2 Tobias Brunner 2017-03-23 10:47:25 +01:00
• 23c05d86de travis: Build Windows-specific plugins Tobias Brunner 2017-03-22 18:04:05 +01:00
• 9d240b0761 kernel-wfp: Don't redefine IPPROTO_IP* if already defined Tobias Brunner 2017-03-22 17:59:20 +01:00
• 4c9418ac4d pki: Cast length derived from pointer arithmetic to int Tobias Brunner 2017-03-22 17:30:10 +01:00
• 550bd654a7 vici: Don't fall back to uninstalling traps if a matching shunt was found Tobias Brunner 2017-03-22 17:19:31 +01:00
• 5e8e71d405 configure: Fix test for libunwind Tobias Brunner 2017-03-22 16:33:27 +01:00
• 1003cf2330 Fixed some typos, courtesy of codespell Tobias Brunner 2017-03-22 13:13:56 +01:00
• 693107f6ae swanctl: Reformulate IKEv1 selector restriction, describe problems with TS narrowing Noel Kuntze 2017-03-13 16:26:10 +01:00
• a7cd424206 swanctl: Mention including files when referring to strongswan.conf(5) Tobias Brunner 2017-03-21 09:52:44 +01:00
• 11ebba0042 man: Describe the tunneling of several subnets with IKEv1 in more detail Noel Kuntze 2017-03-13 16:20:39 +01:00
• c055c7013e man: Add note about modeconfig having to match Noel Kuntze 2017-03-13 17:18:48 +01:00
• 7c672e6118 Version bump to 5.2.2rc1 Andreas Steffen 2017-03-21 09:09:43 +01:00
• 1732ca7b5b testing: Updated OCSP certificate for carol Andreas Steffen 2017-03-21 09:09:06 +01:00
• efc1b98461 Allow x25519 as an alias of the curve25519 KE algorithm Andreas Steffen 2017-03-20 07:24:29 +01:00
• db1ab1cd99 Reference Edwards-curve signature RFCs Andreas Steffen 2017-02-10 09:05:54 +01:00
• 2b233c8a64 The tpm plugin offers random number generation Andreas Steffen 2017-03-18 14:51:30 +01:00
• 46d4d2a71e vici: Document how we pronounce the vici protocol and plugin Martin Willi 2017-02-17 10:47:44 +01:00
• d5a19a17dc swanctl: Describe what happens when a FQDN is specified in local|remote_addrs Tobias Brunner 2017-03-10 16:03:14 +01:00
• 31456d1f85 man: Describe what happens when a FQDN is specified in left or right Noel Kuntze 2017-03-09 17:47:49 +01:00
• e92d8a56b3 ikev1: First do PSK lookups based on identities then fallback to IPs Tobias Brunner 2017-03-13 16:37:12 +01:00
• ac9063dae2 testing: Fix URL for kernel sources Tobias Brunner 2017-03-20 10:13:33 +01:00
• 11c40012a3 ike-sa-manager: Remove superfluous assignment Thomas Egerer 2017-03-15 16:24:49 +01:00
• 1e0040ec45 ike: Log remote IP when deleting half-open IKE_SAs Tobias Brunner 2017-03-15 15:56:39 +01:00
• 3bc8a4a581 coverage: Exclude test suites and /usr from coverage report Tobias Brunner 2017-03-15 15:54:38 +01:00
• 42f7c98980 travis: Create coverage report via codecov.io Tobias Brunner 2017-03-15 10:19:02 +01:00
• 25bfb338a2 Version bump to 5.5.2dr7 Andreas Steffen 2017-03-06 20:21:40 +01:00
• 4a620a97a0 aikpub2: Removed aikpub2 tool Andreas Steffen 2017-03-06 06:16:10 +01:00
• ab94f76df6 pki: Add key object handle of smartcard or TPM private key as an argument to pki --keyid Andreas Steffen 2017-03-06 12:53:48 +01:00
• cfdccc93f5 utils: chunk_from_hex() skips optional 0x prefix Andreas Steffen 2017-03-06 11:51:10 +01:00
• 2d41e1c51c pki: Edited keyid parameter use in various pki man pages and usage outputs Andreas Steffen 2017-03-05 11:19:39 +01:00
• d8f0d9c284 quick-mode: Correctly prepare NAT-OA payloads as responder Tobias Brunner 2017-03-03 17:11:04 +01:00
• 6885375e66 Version bump to 5.5.2dr6 Andreas Steffen 2017-03-03 09:34:50 +01:00
• 2da6a5f541 Add keyid of smartcard or TPM private key as an argument to pki --req Andreas Steffen 2017-03-02 20:30:24 +01:00
• 3fb68ac211 testing: load-testconfig script loads config from source dir Tobias Brunner 2017-03-02 09:50:34 +01:00
• 9d8192bfcd libipsec: Enforce a minimum of 256 for SPIs Tobias Brunner 2017-03-02 11:51:27 +01:00
• bb05b251b2 libipsec: Fix min/max SPI Tobias Brunner 2017-03-02 10:11:32 +01:00
• df9e512523 controller: Don't listen for CHILD_SA state changes when terminating IKE_SAs Tobias Brunner 2017-03-02 08:58:07 +01:00
• 6d86d0f516 kernel: Make range of SPIs for IPsec SAs configurable Tobias Brunner 2017-02-21 19:21:01 +01:00
• 4b5cbb3db1 settings: Add support for hex integers (0x prefix) via get_int() Tobias Brunner 2017-02-21 19:12:32 +01:00
• 6a8f1b8f2c libipsec: Log a packet's ports and protocol in case of a policy mismatch Tobias Brunner 2017-02-17 12:40:36 +01:00
• 2283c8148a host: Don't log port if it is zero Tobias Brunner 2017-02-17 12:32:04 +01:00
• d8e12fdb13 libipsec: Match IPsec policies against ports of processed packets Tobias Brunner 2017-02-15 15:33:38 +01:00
• 7ae9546811 NEWS: Mention the new addrblock features Martin Willi 2017-03-02 08:23:01 +01:00
• d536b94e0d addrblock: Use dynamic TS narrowing instead of rejecting the whole CHILD_SA Martin Willi 2017-02-22 10:01:19 +01:00
• d1317adb9a addrblock: Support an optional non-strict mode accepting certs without addrblock Martin Willi 2017-02-22 09:43:31 +01:00
• da82786b2d child-cfg: Always apply hosts to traffic selectors if proposing transport mode Tobias Brunner 2017-02-20 11:36:30 +01:00
• 2e52bbb4b2 traffic-selector: Allow calling set_address() for any traffic selector Tobias Brunner 2017-02-20 11:28:17 +01:00