 Martin Willi
|
b34b93dbf7
|
Store DH generator in a chunk, hide non-public data in a private struct
|
2010-04-08 15:08:35 +02:00 |
|
|
Andreas Steffen
|
6c1dc87551
|
recovered private keys of no CDP certificates
|
2010-04-07 19:38:10 +02:00 |
|
|
Andreas Steffen
|
589d175a05
|
recovered lost Duck CA certificates
|
2010-04-07 19:38:10 +02:00 |
|
|
Martin Willi
|
613ceca96c
|
Migrated scepclient/openac logging hooks to new signature
|
2010-04-07 15:51:55 +02:00 |
|
|
Martin Willi
|
54e354f2d6
|
Remove to_referer() method, as it fails if no referer was given
|
2010-04-07 15:36:22 +02:00 |
|
|
Martin Willi
|
f7c32feec0
|
Renamed clone function to avoid name clash with uclibc
|
2010-04-07 14:54:22 +02:00 |
|
|
Martin Willi
|
d101a61f87
|
NEWS about HA plugin
|
2010-04-07 14:16:52 +02:00 |
|
|
Martin Willi
|
140418453a
|
Updated HA plugin to new APIs
|
2010-04-07 13:55:16 +02:00 |
|
|
Martin Willi
|
647008c8a7
|
Updated location of traffic selector header
|
2010-04-07 13:55:16 +02:00 |
|
|
Martin Willi
|
29a46aacad
|
Moved ha plugin to libcharon
|
2010-04-07 13:55:16 +02:00 |
|
|
Martin Willi
|
3e8caf6af6
|
Make resync/monitoring functionality optional
|
2010-04-07 13:55:16 +02:00 |
|
|
Martin Willi
|
f24ca1dd55
|
Listen to ike_updown/rekey hook instead of ike_state_change
|
2010-04-07 13:55:16 +02:00 |
|
|
Martin Willi
|
c866a42737
|
Request a complete resync after daemon startup
|
2010-04-07 13:55:16 +02:00 |
|
|
Martin Willi
|
1466af8556
|
Do not automatically take over segments, as we need to resync first
|
2010-04-07 13:55:16 +02:00 |
|
|
Martin Willi
|
ea249cc6f0
|
Drop overlapping segments only if we have no active SAs on it
|
2010-04-07 13:55:16 +02:00 |
|
|
Martin Willi
|
a05e388540
|
Do not install iptables rules, they should stay active after shutdown
|
2010-04-07 13:55:16 +02:00 |
|
|
Martin Willi
|
e262f4e543
|
Take over all segments if heartbeat becomes silent
|
2010-04-07 13:55:15 +02:00 |
|
|
Martin Willi
|
d87489661c
|
Renamed ha-sync plugin to ha
|
2010-04-07 13:55:15 +02:00 |
|
|
Martin Willi
|
3c82381296
|
Try to send HA sync messages synchronously
|
2010-04-07 13:55:15 +02:00 |
|
|
Martin Willi
|
f4f394e67c
|
Do not sync a delete for a child in a destroying IKE_SA
|
2010-04-07 13:55:15 +02:00 |
|
|
Martin Willi
|
5a0a359b88
|
Include ICMP traffic in sync tunnel
|
2010-04-07 13:55:15 +02:00 |
|
|
Martin Willi
|
874c0bd8b8
|
Refactored segment enabling/disabling
|
2010-04-07 13:55:15 +02:00 |
|
|
Martin Willi
|
5d67259042
|
Use a connected UDP socket
|
2010-04-07 13:55:15 +02:00 |
|
|
Martin Willi
|
06308d9ede
|
Removed obsolete socket subclasses
|
2010-04-07 13:55:15 +02:00 |
|
|
Martin Willi
|
3912fdb1ec
|
Automatically segment cluster using periodically sent status messages
|
2010-04-07 13:55:14 +02:00 |
|
|
Martin Willi
|
b7f15be136
|
Do not enable/disable our own sync tunnel
|
2010-04-07 13:55:14 +02:00 |
|
|
Martin Willi
|
9fdf5f712e
|
Enable/disable inactive/active segments only
|
2010-04-07 13:55:14 +02:00 |
|
|
Martin Willi
|
310498f3de
|
Deactivate all active segments before shutting down
|
2010-04-07 13:55:14 +02:00 |
|
|
Martin Willi
|
4e248733a8
|
HA kernel interface can mangle netfilter rules, currently with iptables invocation
|
2010-04-07 13:55:14 +02:00 |
|
|
Martin Willi
|
dbc91f7c84
|
Added support for kernel segment manipulation
|
2010-04-07 13:55:14 +02:00 |
|
|
Martin Willi
|
6921e8d5a9
|
Moved segment configuration parsing to ha_sync_plugin
|
2010-04-07 13:55:14 +02:00 |
|
|
Martin Willi
|
37459ea928
|
Propagate segment manipulation to cluster node
|
2010-04-07 13:55:14 +02:00 |
|
|
Martin Willi
|
3d672d4b0a
|
Segment manipulation in HA sync is thread save
|
2010-04-07 13:55:14 +02:00 |
|
|
Martin Willi
|
c573b11c55
|
Passing 0 to segments->(de-)activate enables/disables all segments
|
2010-04-07 13:55:14 +02:00 |
|
|
Martin Willi
|
7ceaf50b05
|
separated auto-tunnel functionality from socket
|
2010-04-07 13:55:13 +02:00 |
|
|
Martin Willi
|
f5632db953
|
create external fifo socket only if "fifo_interface" option is set
|
2010-04-07 13:55:13 +02:00 |
|
|
Martin Willi
|
47d365deef
|
updated linuxdir include variable
|
2010-04-07 13:55:13 +02:00 |
|
|
Martin Willi
|
724736ff1c
|
updated HA sync plugin to new lifetime config
|
2010-04-07 13:55:13 +02:00 |
|
|
Martin Willi
|
f825238594
|
print "none" if not serving any segments
|
2010-04-07 13:55:13 +02:00 |
|
|
Martin Willi
|
a33eb8631c
|
automatically establish a PSK authenticated SA between cluster nodes
|
2010-04-07 13:55:13 +02:00 |
|
|
Martin Willi
|
80624c79d5
|
fixed memleak when installing synced virtual IPs
|
2010-04-07 13:55:13 +02:00 |
|
|
Martin Willi
|
b1d495f469
|
do not sync CHILD_SAs without an IKE_SA
|
2010-04-07 13:55:13 +02:00 |
|
|
Martin Willi
|
5b7c0f4409
|
removed $Id$ from ha plugin
|
2010-04-07 13:55:13 +02:00 |
|
|
Martin Willi
|
26d08a241a
|
fixed ike_sa condition/extension parsing
|
2010-04-07 13:55:12 +02:00 |
|
|
Martin Willi
|
1f32f61c87
|
added a copy of the linux jenkins hash to dist
|
2010-04-07 13:55:12 +02:00 |
|
|
Martin Willi
|
1e977438af
|
fixed sync of CHILD_SA delete
|
2010-04-07 13:55:12 +02:00 |
|
|
Martin Willi
|
9ffcbea6f1
|
added HA resync option to (re-)integrate nodes to a cluster
|
2010-04-07 13:55:12 +02:00 |
|
|
Martin Willi
|
c81f4fa29d
|
apply peer config during rekeying
|
2010-04-07 13:55:12 +02:00 |
|
|
Martin Willi
|
34d240a6e3
|
manage synced SAs in IKE_SA Manager, tag them with IKE_PASSIVE state
|
2010-04-07 13:55:12 +02:00 |
|
|
Martin Willi
|
d4113a42e9
|
support for IKE_SA rekeying sync
|
2010-04-07 13:55:12 +02:00 |
|