Commit Graph

Select branches

Hide Pull Requests

claude/energy-consumption-optimization-0040a6

main

Mono Color

• 2da6a5f541 Add keyid of smartcard or TPM private key as an argument to pki --req Andreas Steffen 2017-03-02 20:30:24 +01:00
• 3fb68ac211 testing: load-testconfig script loads config from source dir Tobias Brunner 2017-03-02 09:50:34 +01:00
• 9d8192bfcd libipsec: Enforce a minimum of 256 for SPIs Tobias Brunner 2017-03-02 11:51:27 +01:00
• bb05b251b2 libipsec: Fix min/max SPI Tobias Brunner 2017-03-02 10:11:32 +01:00
• df9e512523 controller: Don't listen for CHILD_SA state changes when terminating IKE_SAs Tobias Brunner 2017-03-02 08:58:07 +01:00
• 6d86d0f516 kernel: Make range of SPIs for IPsec SAs configurable Tobias Brunner 2017-02-21 19:21:01 +01:00
• 4b5cbb3db1 settings: Add support for hex integers (0x prefix) via get_int() Tobias Brunner 2017-02-21 19:12:32 +01:00
• 6a8f1b8f2c libipsec: Log a packet's ports and protocol in case of a policy mismatch Tobias Brunner 2017-02-17 12:40:36 +01:00
• 2283c8148a host: Don't log port if it is zero Tobias Brunner 2017-02-17 12:32:04 +01:00
• d8e12fdb13 libipsec: Match IPsec policies against ports of processed packets Tobias Brunner 2017-02-15 15:33:38 +01:00
• 7ae9546811 NEWS: Mention the new addrblock features Martin Willi 2017-03-02 08:23:01 +01:00
• d536b94e0d addrblock: Use dynamic TS narrowing instead of rejecting the whole CHILD_SA Martin Willi 2017-02-22 10:01:19 +01:00
• d1317adb9a addrblock: Support an optional non-strict mode accepting certs without addrblock Martin Willi 2017-02-22 09:43:31 +01:00
• da82786b2d child-cfg: Always apply hosts to traffic selectors if proposing transport mode Tobias Brunner 2017-02-20 11:36:30 +01:00
• 2e52bbb4b2 traffic-selector: Allow calling set_address() for any traffic selector Tobias Brunner 2017-02-20 11:28:17 +01:00
• ae69863d4e Merge branch 'pki-addrblock' Martin Willi 2017-02-27 09:37:51 +01:00
• 2d7f940f11 pki: Add a note about constructing RFC 3779 compliant certificates to manpage Martin Willi 2017-02-22 08:52:00 +01:00
• ead1dd3bcb pki: Support an --addrblock option for issued certificates Martin Willi 2017-02-21 15:07:42 +01:00
• b6c371fbf1 pki: Support an --addrblock option for self-signed certificates Martin Willi 2017-02-21 15:07:03 +01:00
• 48a5b29fd3 pki: Add a helper function parse traffic selectors from CIDR subnets or ranges Martin Willi 2017-02-21 15:06:15 +01:00
• a115f48428 x509: Do not mark generated addrblock extension as critical Martin Willi 2017-02-21 16:54:57 +01:00
• 6734d7a51a x509: Support encoding the RFC 3779 addrblock extension Martin Willi 2017-02-21 15:05:17 +01:00
• 6c2465b446 builder: Define a builder part for X.509 RFC 3779 address blocks Martin Willi 2017-02-21 15:04:18 +01:00
• ac4942c3c3 plugin-loader: Fix hashing of registered plugin features Tobias Brunner 2017-02-24 18:22:23 +01:00
• f43850b3b9 Version bump to 5.5.2dr5 Andreas Steffen 2017-02-23 17:31:11 +01:00
• af9341c2c0 Use of TPM 2.0 private keys for signatures via tpm plugin Andreas Steffen 2017-02-16 08:39:47 +01:00
• e8736028e6 Implement signatures with private keys bound to TPM 2.0 Andreas Steffen 2017-02-13 19:06:18 +01:00
• 72fcce92d7 android: New release after fixing potential ANR issue Tobias Brunner 2017-02-20 16:34:43 +01:00
• 94375d46dc android: Send network change events from a separate thread via JNI Tobias Brunner 2017-02-15 16:08:35 +01:00
• f15c85a487 ikev1: Respond to DPDs for rekeyed IKE_SAs Tobias Brunner 2017-02-13 11:54:53 +01:00
• 597e8c9e00 ike-sa: Optionally try to migrate to the best path on routing priority changes Martin Willi 2016-10-10 15:59:52 +02:00
• be27e76869 ikev2: Ignore roam events without MOBIKE but static local address Tobias Brunner 2016-11-15 15:42:33 +01:00
• 5a7a17b777 ike-cfg: Add helper function to determine if a given IP address was configured Tobias Brunner 2017-02-01 18:00:57 +01:00
• 2bb314c17b Merge branch 'vici-updates' Tobias Brunner 2017-02-16 19:24:17 +01:00
• e16d1005f7 NEWS: VICI updates Tobias Brunner 2017-02-15 17:49:06 +01:00
• 8bd8dcd522 vici: Only log messages if there actually is a listener Tobias Brunner 2017-02-13 17:38:49 +01:00
• fa5f6ba26c vici: Let has_event_listeners() actually check if clients are registered Tobias Brunner 2017-02-08 15:20:58 +01:00
• f927ba975b vici: Add support for mediation extension Tobias Brunner 2017-02-07 12:04:30 +01:00
• ed96fe72cf peer-cfg: Store mediated_by as name and not peer-cfg reference Tobias Brunner 2017-02-07 11:30:49 +01:00
• ec5f127a45 vici: Include uniqueness policy in list-conns Tobias Brunner 2017-02-01 11:02:22 +01:00
• e2d9971215 swanctl: Add --rekey command Tobias Brunner 2017-01-24 16:34:32 +01:00
• 808472c9f9 vici: Add command to initiate SA rekeying Tobias Brunner 2017-01-24 16:26:48 +01:00
• 04c0219e55 vici: Use unique names for CHILD_SAs in the list-sas command Tobias Brunner 2016-12-09 14:45:41 +01:00
• 75665375b7 swanctl: Allow specifying pubkeys directly via 0x/0s prefix Tobias Brunner 2017-01-18 17:46:27 +01:00
• bd6ef6be7e vici: Add support to load CA certificates from tokens and paths in authority sections Tobias Brunner 2016-11-30 15:41:18 +01:00
• 2f8354ca6c vici: Add support to load certificates from file paths Tobias Brunner 2016-11-30 15:09:04 +01:00
• 00bf6a2a49 vici: Add support to load certificates from tokens Tobias Brunner 2016-11-30 12:44:51 +01:00
• d2e3ff8e0c swanctl: Add token secrets for keys on tokens/smartcards Tobias Brunner 2016-11-18 16:40:34 +01:00
• 2ceeb96db5 vici: Add command to load a private key from a token Tobias Brunner 2016-11-18 15:01:18 +01:00
• b657740e16 vici: List namespace/peer-cfg name with policies and allow filtering Tobias Brunner 2017-02-13 18:18:58 +01:00
• ebb517581f swanctl: Pass optional connection name to --initiate/install/uninstall Tobias Brunner 2016-10-11 18:27:29 +02:00
• 7627f5f9c7 vici: Explicitly use peer name when uninstalling trap and shunt policies Tobias Brunner 2016-11-16 18:13:59 +01:00
• 02767e4309 stroke: Use peer name as namespace for shunt policies Tobias Brunner 2017-02-08 16:13:32 +01:00
• 7a0fdbab42 shunt-manager: Add an optional namespace for each shunt Tobias Brunner 2016-11-16 17:59:22 +01:00
• ed105f45af vici: Add support for NT Hash secrets Tobias Brunner 2016-11-16 17:12:33 +01:00
• 3bedf10b25 vici: Add support for IPv6 Transport Proxy Mode Tobias Brunner 2016-11-16 15:58:34 +01:00
• e00bc9f6b2 vici: Add support for certificate policies Tobias Brunner 2016-11-16 15:37:23 +01:00
• 44fcc83310 vici: Add missing dscp setting for IKE_SAs Tobias Brunner 2016-11-11 10:40:53 +01:00
• d460ab2bff swanctl: Automatically unload removed shared keys Tobias Brunner 2016-11-09 16:49:35 +01:00
• cf57d9a98f vici: Add possibility to remove shared keys by a unique identifier Tobias Brunner 2016-11-09 16:27:01 +01:00
• bafd851896 mem-cred: Add methods to add/remove shared keys with unique identifiers Tobias Brunner 2016-11-09 16:20:03 +01:00
• 04180409ad swanctl: Automatically unload removed private keys Tobias Brunner 2016-11-09 12:25:00 +01:00
• 2a56acf501 vici: Add commands to enumerate and remove private keys Tobias Brunner 2016-11-09 11:49:32 +01:00
• dd5ee9d415 mem-cred: Add method to remove a private key with a specific fingerprint Tobias Brunner 2016-11-09 11:22:11 +01:00
• 257f6cb8e7 swanctl: Add possibility to query a specific pool by name Tobias Brunner 2016-11-09 10:37:56 +01:00
• d20bf50e04 vici: Update get_pools() in Python and Ruby bindings Tobias Brunner 2016-12-08 18:14:40 +01:00
• 71fa1224ec vici: Add option to query a specific pool Tobias Brunner 2016-11-09 10:18:01 +01:00
• c2129d1cbe bypass-lan: Don't use interfaces in policies Tobias Brunner 2017-02-13 19:06:24 +01:00
• 0c549169c4 testing: Fix ALLOWED_HOSTS in strongTNC settings.ini Tobias Brunner 2017-02-16 18:24:25 +01:00
• 150a902b83 testing: Fix swanctl/ocsp-disabled scenario after changing the log messages Tobias Brunner 2017-02-16 17:51:16 +01:00
• 2de9bb30fe revocation: More accurately describe the flags to disable OCSP/CRL validation Tobias Brunner 2017-01-25 16:17:38 +01:00
• 067fd2c69c child-sa: Do not install mark on inbound kernel SA Eyal Birger 2017-01-25 12:26:42 +02:00
• 8a0bbb9355 unit-tests: Allow default test timeout to be configured via compile option Thomas Egerer 2017-02-10 15:27:11 +01:00
• 3ff5de05b3 tkm: Fix get_auth_octets() signature Tobias Brunner 2017-02-13 18:36:01 +01:00
• 395500b8c1 kernel-netlink: Use RTA_SRC to specify route source in kernel-based lookups Martin Willi 2017-01-19 11:23:45 +01:00
• 558691b3b0 kernel-netlink: Use kernel-based route lookup if we do not install routes Martin Willi 2017-01-19 11:03:55 +01:00
• 72547830fb swanctl: List CHILD_SA marks, if set Martin Willi 2017-01-06 13:01:34 +01:00
• 0b4e539cb3 vici: Include the Netfilter marks in listed CHILD_SAs Martin Willi 2017-01-06 12:42:04 +01:00
• 22f08609f1 vici: Explicitly set the Python encoding type Martin Willi 2015-12-08 17:13:59 +01:00
• 0394bbf58c Merge branch 'mid-sync' Tobias Brunner 2017-02-08 15:11:20 +01:00
• 2f6ec15dff unit-tests: Add test cases for MID sync exchanges Tobias Brunner 2016-10-04 19:35:51 +02:00
• cbb6885e9b ikev2: Ignore IKEV2_MESSAGE_ID_SYNC notifies if extension is disabled Tobias Brunner 2016-10-04 17:07:30 +02:00
• c3d98d298e ikev2: Don't increase expected MID after handling MID sync message Tobias Brunner 2016-10-04 15:15:36 +02:00
• fb57904cbf ikev2: Don't cache response to MID sync request Tobias Brunner 2016-09-19 11:16:06 +02:00
• 3abc104f7e ikev2: Accept INFORMATIONAL messages with MID 0 if used to sync MIDs Tobias Brunner 2016-09-16 17:44:39 +02:00
• d6ffa85fea ikev2: Negotiate support for IKE message ID synchronisation during IKE_AUTH Tobias Brunner 2016-09-16 17:37:59 +02:00
• 5ab59221d2 ikev2: Add task to handle IKEV2_MESSAGE_ID_SYNC notifies as responder Tobias Brunner 2016-09-16 17:26:41 +02:00
• 347c403cf6 ike: Publish getter for the current message ID on IKE_SA Tobias Brunner 2016-09-16 16:19:25 +02:00
• 05a2be82c2 ike: Add getter for the current message ID to task manager Tobias Brunner 2016-09-16 16:18:32 +02:00
• e9d13476cb Merge branch 'bypass-lan' Tobias Brunner 2017-02-08 10:47:33 +01:00
• 21df4cc1ed kernel-pfroute: Implement enumeration of local subnets Tobias Brunner 2016-10-12 18:32:14 +02:00
• 0aabfe0780 bypass-lan: Allow ignoring or only considering subnets of specific interfaces Tobias Brunner 2016-10-12 15:56:12 +02:00
• 62b58a40da bypass-lan: Configure interface on bypass policy Tobias Brunner 2016-10-12 12:28:18 +02:00
• 2406474158 kernel-netlink: Return interface name in local subnet enumerator Tobias Brunner 2016-10-12 12:22:42 +02:00
• 46c21e3cc3 kernel-interface: Add interface name to local subnet enumerator Tobias Brunner 2016-10-12 12:11:24 +02:00
• f8a362bfbc bypass-lan: Add plugin that installs bypass policies for locally attached subnets Tobias Brunner 2016-10-12 10:05:10 +02:00
• eac584a37d kernel-netlink: Implement enumerator for local subnets Tobias Brunner 2016-10-12 09:52:45 +02:00
• 324fc2cb52 kernel-interface: Add method to enumerate locally attached subnets Tobias Brunner 2016-10-12 09:24:49 +02:00
• 3c46ce2834 kernel-pfkey: Use the same priority range for trap and regular policies Tobias Brunner 2016-10-11 15:14:27 +02:00
• 0e9d6c4605 kernel-netlink: Use the same priority range for trap and regular policies Tobias Brunner 2016-10-11 14:30:21 +02:00