denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
11,009 Commits 1 Branch 0 Tags
77b6f19694e4705db56e6ee18c4e22a16f4910f7
Commit Graph
245 Commits
Author SHA1 Message Date
Martin Willi 77b6f19694 kernel-pfroute: mark IPs installed on tun device as virtual 2013-05-06 17:00:55 +02:00
Martin Willi 2a2d7a4dc8 kernel-pfroute: install virtual IPs using dedicated tun devices 2013-05-06 16:10:13 +02:00
Martin Willi ca4a14ae83 kernel-pfkey: when installing a route for a virtual IP, use its interface 
When installing a route over a tun device for a virtual IP, the route must
be set over the tun, not the IKE interface.
 2013-05-06 16:10:13 +02:00
Martin Willi f52cf07532 kernel-interface: get_address_by_ts() can tell if a returned IP is virtual 2013-05-06 16:10:13 +02:00
Martin Willi 1a2a8bffed kernel-interface: support enumeration of virtual-only IPs 2013-05-06 16:10:13 +02:00
Martin Willi 5f7f8c92ca kernel-pfkey: refactor route installation to a dedicate function 2013-05-06 16:10:13 +02:00
Martin Willi 121783035c kernel-pfroute: split /0 routes to avoid conflict with default route 2013-05-06 16:10:13 +02:00
Martin Willi f8646dd65e kernel-pfkey: check if we have a gateway before comparing them 2013-05-06 16:10:13 +02:00
Martin Willi d4260c5f7f kernel-pfkey: install route along with input, not forward policies 
As forwarding policies are not available on all systems (OS X), using the
forward policy to attach the route is a bad pick. Using input policies allows
OS X to install routes.
 2013-05-06 16:10:13 +02:00
Martin Willi 6e879a59fc kernel-pfroute: rescan address list for an interface if its state changes 
It seems that we don't get address notifications if the interface is down
on OS X.
 2013-05-06 16:10:13 +02:00
Martin Willi 0fd409db77 kernel-pfroute: add newly appearing interfaces to the interface cache 2013-05-06 16:10:12 +02:00
Martin Willi 9bc342eae4 kernel-pfroute: implement get_nexthop() 2013-05-06 16:10:12 +02:00
Martin Willi 272bcac894 kernel-pfroute: install and uninstall routes 2013-05-06 16:10:12 +02:00
Martin Willi 3a7f4b5c8d kernel-pfroute: collect replies received for our own queries 2013-05-06 16:10:12 +02:00
Martin Willi b1c6b68e4c kernel-pfroute: refactor PF_ROUTE message processing, use an enumerator 2013-05-06 16:10:12 +02:00
Martin Willi 889efae4cf kernel-pfkey: use an int to set esp_port with a sysctl on OS X 2013-05-06 16:10:12 +02:00
Martin Willi 9650bf3cc7 kernel-pfroute: use INIT() macro for allocations 2013-05-06 16:10:12 +02:00
Martin Willi 0e107f03ac kernel-pfroute: use only a single PF_ROUTE socket for both events and queries 2013-05-06 16:10:12 +02:00
Martin Willi e8002956c9 kernel-pfroute: fix length check when receiving PF_ROUTE messages 2013-05-06 16:10:12 +02:00
Martin Willi 64f309e735 kernel-pfkey: remove obsolete pluto specific behavior 2013-05-06 16:10:12 +02:00
Martin Willi bc6275d21c kernel-netlink: remove obsolete pluto specific behavior 2013-05-06 16:10:11 +02:00
Tobias Brunner 37873f9994 kernel-netlink: Add an option to disable roam events 2013-05-03 15:11:19 +02:00
Tobias Brunner 0b9ce21b5e kernel-netlink: Define defaults for routing table and prio 2013-05-03 15:11:19 +02:00
Tobias Brunner 2ac772a5d0 Use proper address family when adding multiple addresses to SQL pool 2013-03-19 16:33:07 +01:00
Tobias Brunner fe62707209 Ignore SQL-based IP address pools if their address family does not match 2013-03-19 16:33:07 +01:00
Tobias Brunner deafaf51f1 Load arbitrary (non-host) attributes from strongswan.conf 
This allows to e.g. load Cisco-specific attributes that contain FQDNs.
 2013-03-19 15:21:30 +01:00
Martin Willi d29246cabe Merge branch 'radius-ext' 
Bring some extensions to eap-radius, namely a virtual IP address provider based
on received Framed-IPs, forwarding of Cisco Unity banners, Interim Accounting
updates and the reporting of sent/received packets.
 2013-03-18 10:13:36 +01:00
Martin Willi cb14ecb1d3 Merge branch 'netlink-align' 
Fixes some Netlink alignment issues, and then refactors Netlink XFRM message
attribute handling.
 2013-03-18 10:09:35 +01:00
Martin Willi 94163816fa Use netlink_add_attribute() to copy over attributes during update_sa() 2013-03-15 16:02:01 +01:00
Martin Willi 0d9f31e1ed Use a helper function to add XFRM_MARK attribute 2013-03-15 16:02:01 +01:00
Martin Willi 6dfc633927 Use netlink_reserve() helper function in XFRM to simplify message construction 2013-03-15 16:02:01 +01:00
Martin Willi 6359ab04f4 Add a Netlink utility function to add a RTA header and reserve space for data 2013-03-15 14:32:51 +01:00
Martin Willi 53c98f098f Correctly check buffer length in netlink_add_attribute() 2013-03-15 14:32:25 +01:00
Martin Willi 6ac601f543 Avoid unneeded termination of netlink algorithm name arrays with END_OF_LIST 2013-03-15 14:01:15 +01:00
Martin Willi 6b35ab84da Pass correclty sized pointer to lookup_algorithm() in PF_KEY 2013-03-14 14:20:54 +01:00
Martin Willi 7eeeb1c702 kernel_ipsec_t.query_sa() additionally returns the number of processed packets 2013-03-14 14:20:54 +01:00
Martin Willi cf6a4ea005 strdup() iface passed to queue_route_reinstall(), fixing double-free 2013-03-11 15:17:50 +01:00
Martin Willi d3f5a05e29 When adding Netlink attributes, increase header length with potential alignment 
If the payload is unaligned, we must make sure the total netlink message
length includes the added alignment for the first attribute.
 2013-03-11 12:32:21 +01:00
Martin Willi b611d8ba48 Merge branch 'ikev1-rekeying' 
Migrates Quick Modes to the new Main Mode if an IKEv1 reauthentication replaces
the old Main Mode having a uniqueids=replace policy.
 2013-03-01 11:32:02 +01:00
Martin Willi ec1b4e6638 Merge branch 'vip-shunts' 
Installs bypass policies for the physical address if a virtual address is
assigned, and installs a proper source route to actually use the physical
address for bypassed destinations.

Conflicts:
	src/libcharon/plugins/unity/unity_handler.c
 2013-03-01 11:30:13 +01:00
Martin Willi a36b49f3cb Merge branch 'opaque-ports' 
Adds a %opaque port option and support for port ranges in left/rightprotoport.
Currently not supported by any of our kernel backends.
 2013-03-01 11:27:12 +01:00
Martin Willi 53e62f5d0c Indicate support for processing ESPv3 TFC padding in Netlink IPsec backend 2013-03-01 11:11:51 +01:00
Martin Willi a1db77de7c Use a complete port range in traffic_selector_create_from_{subnet,cidr} 2013-02-21 11:52:33 +01:00
Martin Willi a2fd08dd26 Install a route for shunt policies 
If we install a virtual IP, its source route would render the shunt policy
useless, as locally generated traffic wouldn't match. Having a route for each
shunt policy with higher priority chooses the correct source address for
bypassed destinations.
 2013-02-20 16:32:24 +01:00
Martin Willi 3dc9d427c9 After IKEv1 reauthentication, reinstall VIP routes after migrating CHILD_SAs 
During IKEv1 reauthentication, the virtual IP gets removed, then reinstalled.
The CHILD_SAs get migrated, but any associated route gets removed from the
kernel. Reinstall routes after adding the virtual IP again.
 2013-02-20 09:16:00 +01:00
Martin Willi 544c2e3d7b kernel-netlinks get_interface() considers virtual IPs, too 
When using load-tester, we can install tunnel outer addresses on
demand. As these are installed as "virtual", we have to consider
virtual IPs in the get_interface() lookup to install "real" virtual
IPs to these dynamic external addresses.
 2012-12-17 14:23:44 +01:00
Martin Willi d88597f0dd Don't wait while removing external IPs used for load testing 2012-11-29 10:22:51 +01:00
Martin Willi b185cdd16d Install virtual IPs via interface name, and use an interface lookup where required 2012-11-29 10:22:51 +01:00
Martin Willi 50bd755871 Add an optional kernel-interface parameter to install IPs with a custom prefix 2012-11-29 10:22:51 +01:00
Tobias Brunner cbd52e7ddc Limit recursion when searching for source addresses 
This could be required if e.g. two default routes list gateways but the
corresponding outbound interfaces do not have any IP addresses on them.
 2012-11-13 09:06:02 +01:00