fastd - Fast and Secure Tunnelling Daemon

Age	Commit message (Collapse)	Author
2013-07-25	Move _GNU_SOURCE define to types.h	Matthias Schiffer

2013-07-24	Allow specifying multiple remote entries for a single peer	Matthias Schiffer

2013-07-24	Remove dead code handling resolves triggered by received packets	Matthias Schiffer

2013-07-24	Remove handing for packets received on wrong sockets (this shouldn't happen)	Matthias Schiffer

2013-07-23	Don't trigger a resolve when a packet from an unknown peer is received	Matthias Schiffer

2013-07-12	Invalidate old session on method changes	Matthias Schiffer

2013-04-24	Provide the correct local address on first on-verify for a new temporary peer	Matthias Schiffer

2013-04-20	ec25519-fhmqvc: drop is_established test in protocol_handle_recv()	Matthias Schiffer
	handle_socket() now tests it before calling handle_recv
2013-04-20	Greatly improve handling of hosts with multiple IP addresses	Matthias Schiffer

2013-04-17	Fix handling of the local address in shell commands	Matthias Schiffer
	Without this fix, using on-establish/disestablish/verify would cause a strange zero port when a bind with a random port was used, and a segmentation fault with dynamic binds.
2013-03-09	Don't try to add temporary peers for disabled keys	Matthias Schiffer

2013-03-08	Fix crash on invalid key definitions	Matthias Schiffer

2013-03-08	Handle duplicate keys	Matthias Schiffer
	When two peers are configured with the same key, disable both. When a temporary peer's key is configured, delete the temporary key.
2013-03-08	Allow disabling previously enabled peers	Matthias Schiffer

2013-03-01	Re-verify unknown peers on each handshake	Matthias Schiffer

2013-03-01	Identify peers be key in log output when no name is available	Matthias Schiffer

2013-02-27	Don't set the peer address for temporary peers before the session is ↵	Matthias Schiffer
	actually established Doing so could lead to duplicate address entries in different peers, causing very strange behaviour. Add additional parameters for the local and the peer address to fastd_shell_exec() to allow the on-verify script to use this information nevertheless.
2013-02-26	Experimental support for accepting connections from unknown peers	Matthias Schiffer

2013-02-25	Add public keys to shell environment	Matthias Schiffer

2013-02-23	Differentiate between reasons for ignoring a handshake	Matthias Schiffer

2013-02-23	Use fastd_peer_t instead of fastd_peer_config_t in handshake code	Matthias Schiffer
	Directly using the peers allows us to get rid of the inefficient get_peer() function and is necessary for adding support for unknown peers.
2013-01-21	Add error message for OOM on buffer alloc	Matthias Schiffer

2013-01-09	Improve checking of received handshake keys	Matthias Schiffer

2013-01-09	Update to libuecc v3, check EC points for validity	Matthias Schiffer

2013-01-05	Adjust copyright years	Matthias Schiffer

2012-12-23	Fix up all usage of deprecated libuecc API	Matthias Schiffer

2012-12-18	Convert type names to _t convention	Matthias Schiffer

2012-11-05	Implement peer limit constraints	Matthias Schiffer

2012-11-02	Improve handling of associated sockets in key matching	Matthias Schiffer

2012-11-01	Dynamically create and destroy sockets without fixed binds	Matthias Schiffer

2012-10-29	Add support for multiple binds	Matthias Schiffer

2012-09-15	Use inline function for alignment	Matthias Schiffer

2012-09-15	Rework some parts of the AES128-GCM method	Matthias Schiffer
	These changes improve the performance of the AES128-GCM method by ~10% on my Intel CPU when compiled with -O2. Furthermore, the AES and the GHASH parts are separated now, allowing to switch to other implementations of the algorithms more easily.
2012-07-01	Add support for multiple crypto methods without reconfiguration	Matthias Schiffer

2012-06-15	Avoid using the same handshake key to establish more than one session	Matthias Schiffer
	This fix prevents a potential attack using intentional packet reordering to initialize more than one session with using the same handshake keys, leading to more that one session to be initialized with the same key data altogether, allowing to decrypt some packets in the worst case.
2012-06-07	Limit handshake frequency where possible	Matthias Schiffer

2012-06-06	Limit resolve frequency	Matthias Schiffer

2012-06-06	Improve some log levels	Matthias Schiffer

2012-06-05	Fix possible duplicate session establishment	Matthias Schiffer
	This is causing duplicate nonces in the worst case.
2012-06-05	Add support for receiving reordered packets	Matthias Schiffer

2012-06-04	Make sure refresh handshakes aren't cleaned	Matthias Schiffer

2012-06-04	Fix key invalidation order on key refresh	Matthias Schiffer

2012-06-04	Add version string to handshake	Matthias Schiffer

2012-06-04	Improve handshake logging	Matthias Schiffer

2012-05-03	Fix critical error introduced by copy-and-pasting, another possible NULL ↵	Matthias Schiffer
	dereference
2012-05-03	Critical fix: ignore disabled peers when searching peer key to avoid NULL ↵v0.4-rc6	Matthias Schiffer
	dereference
2012-04-22	Ignore handshakes for 15 seconds after session establishment to avoid ↵v0.4-rc2	Matthias Schiffer
	excessive and concurrent handshakes
2012-04-22	Add --show-key and --machine-readable options	Matthias Schiffer

2012-04-22	Ignore peers with own key	Matthias Schiffer

2012-04-19	Don't regenerate session handshake keypair for every handshake so a global ↵	Matthias Schiffer
	state can be used; remove the concept of temporary peers These changes will fix the possibility of a TCP-SYN-Flood-like DoS attack, at the cost of another protocol change: as we can't count request IDs when we don't know have temporary peers, request IDs are removed completely.