denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
6,813 Commits 1 Branch 0 Tags
5b0bcfb1fc4aabb6535db91e70f7f262328e664f
Commit Graph
103 Commits
Author SHA1 Message Date
Martin Willi 5b0bcfb1fc Revert alloc_str changes 
This reverts commit fdead26ffe.
This reverts commit 3e2419ebe3.
This reverts commit 17ce69b47a.
 2011-04-21 13:35:31 +02:00
Martin Willi 3e2419ebe3 Use thread save settings alloc_str function where appropriate 2011-04-21 10:48:16 +02:00
Martin Willi 4778655726 Cast size_t len arguments to %.*s to int 2011-04-20 13:08:32 +02:00
Martin Willi 05e9589783 Copy ESN enabled replay state during update_sa, if supported 2011-04-20 12:26:58 +02:00
Martin Willi ee8c89e2ee Add ESN support to kernel netlink plugin, including custom replay windows 2011-04-20 12:26:58 +02:00
Martin Willi 4876d4f3b3 Added an esn parameter to the kernel interface add_sa functions 2011-04-20 12:26:57 +02:00
Tobias Brunner 00b9f755f8 pool: Proper cleanup in error cases when adding addresses from a file. 2011-04-19 13:48:50 +02:00
Tobias Brunner e5143952f0 pool: Proper handling of address family when adding addresses. 2011-04-19 13:48:50 +02:00
Tobias Brunner 119fc2d3d7 Added missing break statement. 2011-04-19 13:48:50 +02:00
Tobias Brunner f526b35c45 Properly copy interface name if unknown. 
We use a static string if the interface name is unknown, so using memcpy
with IFNAMSIZ is incorrect as that would overrun the static string.
 2011-04-19 13:48:50 +02:00
Martin Willi 96409be320 Add reload support to attr plugin 2011-04-15 10:07:13 +02:00
Martin Willi 00b4b4b0d1 Migrated attr plugin to INIT/METHOD macros 2011-04-15 10:07:13 +02:00
Martin Willi c55818ebb0 Added a (not yet implemented) plugin_t method to reload plugin configuration 2011-04-15 10:07:13 +02:00
Martin Willi 787b5884aa Added a get_name() function to plugin_t, create_plugin_enumerator enumerates over plugin_t 2011-04-15 10:07:12 +02:00
Tobias Brunner e5e5bcc92f Removed superfluous parameter to printf. 2011-04-14 18:11:46 +02:00
Tobias Brunner 862ef49f85 Fixed potential memory leak when processing routes from the kernel. 2011-04-14 18:11:45 +02:00
Tobias Brunner 24e0595437 Removed unused variables. 2011-04-12 14:44:49 +02:00
Martin Willi 50110dfef8 Align netlink attributes properly if rta_len not a multiple of RTA_ALIGNTO 2011-03-02 16:07:38 +01:00
Martin Willi e131f11779 Migrated kernel_pfroute_net to INIT/METHOD macros 2011-02-17 09:39:25 +00:00
Martin Willi 887abfb1e7 Migrated kernel_netlink_net to INIT/METHOD macros 2011-02-17 09:34:53 +00:00
Tobias Brunner e185d78fc9 Kernel interface updated for KLIPS plugin (TFC padding). 2011-02-10 16:49:42 +01:00
Andreas Steffen e3504d6011 added missing tfc argument to kernel_pfkey_ipsec interface 2010-12-27 05:53:36 +01:00
Martin Willi d86bb6ef4d Implemented Traffic Flow Confidentiality padding in kernel_interface 2010-12-20 09:45:39 +01:00
Jiri Bohac 19b7f763b3 Install selectors on transport mode IPsec SAs. 
This fixes several test cases in IKEv2_Self_Test (part of the IPv6 Ready
Logo Program) which is required for USGv6 certification, namely:

  - IKEv2.EN.I.1.1.7.1, IKEv2.EN.I.1.1.7.1: Narrowing the range of members
    of the set of traffic selectors
  - IKEv2.EN.R.1.1.7.3: Narrowing multiple traffic selector

When traffic selectors of a triggered SA are narrowed by the responder, the
installed policy and the broader trap policy share the same reqid.  Without
selectors on the IPsec SA packets matching the trap policy, but not the
narrowed policy, would incorrectly be handled by that IPsec SA.  Since only
one selector can be specified per IPsec SA, there is currently no solution
for tunnel mode SAs.
 2010-12-13 15:28:40 +01:00
Tobias Brunner e6f42b0721 Include the destination net in the policy priority calculation. 
The resulting priorities are as follows:

    IPv6               IPv4
    routed   normal    routed   normal
max 4096(+3) 2048(+3)  4096(+3) 2048(+3)
min 3072     1024      3840     1792

Where min is for a policy between two single hosts and max is
for /0 on both ends (lower priorities are preferred by the kernel).
(+3) applies for cases where no protocol and no ports are defined.
 2010-12-07 12:14:50 +01:00
Andreas Steffen 5b2547c7a7 commas, commas, .. 2010-11-25 23:25:01 +01:00
Andreas Steffen 53e159f111 Migrated resolve_plugin_t to INIT/METHOD macros 2010-11-25 23:19:33 +01:00
Andreas Steffen 8ac5fb345f Migrated kernel_pfroute_plugin_t to INIT/METHOD macros 2010-11-25 23:17:18 +01:00
Andreas Steffen cd5feee356 Migrated kernel_pfkey_plugin_t to INIT/METHOD macros 2010-11-25 23:14:29 +01:00
Andreas Steffen 52c037997c Migrated kernel_netlink_plugin_t to INIT/METHOD macros 2010-11-25 23:12:12 +01:00
Andreas Steffen ea6dc84f09 INIT allocates memory 2010-11-25 23:09:12 +01:00
Andreas Steffen a95d5760df INIT allocates memory 2010-11-25 23:08:00 +01:00
Andreas Steffen c6753bd4a7 Migrated kernel_klips_plugin_t to INIT/METHOD macros 2010-11-25 23:06:20 +01:00
Andreas Steffen a76ad38365 Migrated attr_plugin_t to INIT/METHOD macros 2010-11-25 22:52:32 +01:00
Andreas Steffen bd801f1b97 Migrated attr_sql_plugin_t to INIT/METHOD macros 2010-11-25 22:49:44 +01:00
Martin Willi 213884f947 Print full source route on DBG2 that gets installed 2010-11-11 09:59:02 +01:00
Tobias Brunner ec0c756d07 Do not fire roam events based on local route changes. 
These kernel events are triggered on address changes, which is
problematic when deleting virtual IP addresses.
 2010-10-12 11:11:04 +02:00
Tobias Brunner 29607690a8 If a changed route has no src, try to find it via interface. 2010-10-12 11:11:04 +02:00
Tobias Brunner 0ac6d2e658 Get source address from interface if the route does not provide one. 2010-10-12 11:11:04 +02:00
Andreas Steffen 91a0825c39 added non-standard SERPENT and TWOFISH support to kernel_netlink plugin 2010-09-08 07:22:31 +02:00
Tobias Brunner b8bf01ddee Do not install routes for pluto. 
There are some incompatibilities with e.g. passthrough policies.
Pluto installs required source routes via updown script.
 2010-09-02 19:04:24 +02:00
Tobias Brunner 06cdeac25f Charon specific strongswan.conf options generalized. 2010-09-02 19:04:22 +02:00
Tobias Brunner 34cf6def83 Fixing installation of trap policies (SPI=0) in kernel interface. 2010-09-02 19:04:21 +02:00
Tobias Brunner 6da26f3008 Do not overwrite the original mode when installing policies. 
The mode is later used to decide if a route has to be installed.
 2010-09-02 19:04:20 +02:00
Tobias Brunner 749d3cccaf Added support for different policy types in kernel_netlink plugin. 2010-09-02 19:04:19 +02:00
Tobias Brunner bd7a2f3bfc Added an option to specify the type of a policy to kernel_ipsec.add_policy. 
This will later allow us to support pluto's passthrough and drop
policies in charon.
 2010-09-02 19:04:19 +02:00
Tobias Brunner 55be07a15f Added support for combined IPComp/ESP/AH policies in kernel_netlink plugin. 2010-09-02 19:04:19 +02:00
Tobias Brunner b4872c1e09 Replaced the protocol argument in add_policy with an optional SPI for an AH SA. 2010-09-02 19:04:19 +02:00
Tobias Brunner bb381e26c6 Refer to scheduler and processor via lib and not hydra. 2010-09-02 19:04:18 +02:00
Tobias Brunner e18556e9e9 Moved scheduler and thread pool to libstrongswan. 2010-09-02 19:04:18 +02:00