denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
11,009 Commits 1 Branch 0 Tags
77b6f19694e4705db56e6ee18c4e22a16f4910f7
Commit Graph
133 Commits
Author SHA1 Message Date
Martin Willi f52cf07532 kernel-interface: get_address_by_ts() can tell if a returned IP is virtual 2013-05-06 16:10:13 +02:00
Martin Willi 1a2a8bffed kernel-interface: support enumeration of virtual-only IPs 2013-05-06 16:10:13 +02:00
Martin Willi bc6275d21c kernel-netlink: remove obsolete pluto specific behavior 2013-05-06 16:10:11 +02:00
Tobias Brunner 37873f9994 kernel-netlink: Add an option to disable roam events 2013-05-03 15:11:19 +02:00
Tobias Brunner 0b9ce21b5e kernel-netlink: Define defaults for routing table and prio 2013-05-03 15:11:19 +02:00
Martin Willi d29246cabe Merge branch 'radius-ext' 
Bring some extensions to eap-radius, namely a virtual IP address provider based
on received Framed-IPs, forwarding of Cisco Unity banners, Interim Accounting
updates and the reporting of sent/received packets.
 2013-03-18 10:13:36 +01:00
Martin Willi cb14ecb1d3 Merge branch 'netlink-align' 
Fixes some Netlink alignment issues, and then refactors Netlink XFRM message
attribute handling.
 2013-03-18 10:09:35 +01:00
Martin Willi 94163816fa Use netlink_add_attribute() to copy over attributes during update_sa() 2013-03-15 16:02:01 +01:00
Martin Willi 0d9f31e1ed Use a helper function to add XFRM_MARK attribute 2013-03-15 16:02:01 +01:00
Martin Willi 6dfc633927 Use netlink_reserve() helper function in XFRM to simplify message construction 2013-03-15 16:02:01 +01:00
Martin Willi 6359ab04f4 Add a Netlink utility function to add a RTA header and reserve space for data 2013-03-15 14:32:51 +01:00
Martin Willi 53c98f098f Correctly check buffer length in netlink_add_attribute() 2013-03-15 14:32:25 +01:00
Martin Willi 6ac601f543 Avoid unneeded termination of netlink algorithm name arrays with END_OF_LIST 2013-03-15 14:01:15 +01:00
Martin Willi 7eeeb1c702 kernel_ipsec_t.query_sa() additionally returns the number of processed packets 2013-03-14 14:20:54 +01:00
Martin Willi cf6a4ea005 strdup() iface passed to queue_route_reinstall(), fixing double-free 2013-03-11 15:17:50 +01:00
Martin Willi d3f5a05e29 When adding Netlink attributes, increase header length with potential alignment 
If the payload is unaligned, we must make sure the total netlink message
length includes the added alignment for the first attribute.
 2013-03-11 12:32:21 +01:00
Martin Willi b611d8ba48 Merge branch 'ikev1-rekeying' 
Migrates Quick Modes to the new Main Mode if an IKEv1 reauthentication replaces
the old Main Mode having a uniqueids=replace policy.
 2013-03-01 11:32:02 +01:00
Martin Willi ec1b4e6638 Merge branch 'vip-shunts' 
Installs bypass policies for the physical address if a virtual address is
assigned, and installs a proper source route to actually use the physical
address for bypassed destinations.

Conflicts:
	src/libcharon/plugins/unity/unity_handler.c
 2013-03-01 11:30:13 +01:00
Martin Willi a36b49f3cb Merge branch 'opaque-ports' 
Adds a %opaque port option and support for port ranges in left/rightprotoport.
Currently not supported by any of our kernel backends.
 2013-03-01 11:27:12 +01:00
Martin Willi 53e62f5d0c Indicate support for processing ESPv3 TFC padding in Netlink IPsec backend 2013-03-01 11:11:51 +01:00
Martin Willi a1db77de7c Use a complete port range in traffic_selector_create_from_{subnet,cidr} 2013-02-21 11:52:33 +01:00
Martin Willi a2fd08dd26 Install a route for shunt policies 
If we install a virtual IP, its source route would render the shunt policy
useless, as locally generated traffic wouldn't match. Having a route for each
shunt policy with higher priority chooses the correct source address for
bypassed destinations.
 2013-02-20 16:32:24 +01:00
Martin Willi 3dc9d427c9 After IKEv1 reauthentication, reinstall VIP routes after migrating CHILD_SAs 
During IKEv1 reauthentication, the virtual IP gets removed, then reinstalled.
The CHILD_SAs get migrated, but any associated route gets removed from the
kernel. Reinstall routes after adding the virtual IP again.
 2013-02-20 09:16:00 +01:00
Martin Willi 544c2e3d7b kernel-netlinks get_interface() considers virtual IPs, too 
When using load-tester, we can install tunnel outer addresses on
demand. As these are installed as "virtual", we have to consider
virtual IPs in the get_interface() lookup to install "real" virtual
IPs to these dynamic external addresses.
 2012-12-17 14:23:44 +01:00
Martin Willi d88597f0dd Don't wait while removing external IPs used for load testing 2012-11-29 10:22:51 +01:00
Martin Willi b185cdd16d Install virtual IPs via interface name, and use an interface lookup where required 2012-11-29 10:22:51 +01:00
Martin Willi 50bd755871 Add an optional kernel-interface parameter to install IPs with a custom prefix 2012-11-29 10:22:51 +01:00
Tobias Brunner cbd52e7ddc Limit recursion when searching for source addresses 
This could be required if e.g. two default routes list gateways but the
corresponding outbound interfaces do not have any IP addresses on them.
 2012-11-13 09:06:02 +01:00
Tobias Brunner 5be88ca6bb Don't call get_route recursively if a route's gateway matches the destination 2012-11-13 09:06:02 +01:00
Tobias Brunner f05b427265 Moved debug.[ch] to utils folder 2012-10-24 16:00:51 +02:00
Tobias Brunner 12642a6831 Moved data structures to new collections subfolder 2012-10-24 16:00:49 +02:00
Tobias Brunner eecd41e349 Use a helper function to add milliseconds to timeval structs 2012-10-18 12:25:59 +02:00
Tobias Brunner 8e2d3075aa Use proper offset when adding mark attribute in kernel-netlink plugin 2012-10-15 11:11:29 +02:00
Tobias Brunner ac24c4d323 Also add mark when querying current replay state in kernel-netlink plugin 2012-10-15 10:15:53 +02:00
Tobias Brunner 2925aa725e Fixed update_sa in kernel-netlink plugin if marks are used 2012-10-11 19:08:47 +02:00
Tobias Brunner a37ac3a47a Make sure we successfully opened xfrm_acq_expires 2012-09-28 18:54:28 +02:00
Tobias Brunner 6ffb8f8634 Clarified code when hashing/comparing cached policies in kernel-netlink 2012-09-28 18:30:16 +02:00
Tobias Brunner 9a1ba213f4 Use proper argument for sizeof when copying replay state 2012-09-28 17:00:20 +02:00
Tobias Brunner bef21bd330 Algorithm names are not always static anymore, avoid string overflows 2012-09-28 16:49:05 +02:00
Tobias Brunner a79af394a0 Allow replay windows smaller than the default of 32 2012-09-27 12:43:39 +02:00
Tobias Brunner f65ec0aa90 Make sure the if_name member of cached route entries is initialized to NULL 2012-09-22 08:23:56 +02:00
Tobias Brunner a25d536eea Use rwlock and rwlock_condvar to increase concurrency in kernel-netlink plugin 2012-09-21 18:16:27 +02:00
Tobias Brunner 16d62305c2 Use a separate mutex for cached routes in kernel-netlink plugin 2012-09-21 18:16:27 +02:00
Tobias Brunner 4134108c77 Use a lock to safely check and update the time for the next roam event 2012-09-21 18:16:27 +02:00
Tobias Brunner e8e9048fee Added an option to configure the interface on which virtual IP addresses are installed 2012-09-21 18:16:26 +02:00
Tobias Brunner c6b401581a Changed how kernel-netlink handles virtual IP addresses 
Also tried to avoid the use of enumerators.
 2012-09-21 18:16:26 +02:00
Tobias Brunner 4106aea8e4 Made IP address enumeration more flexible 
Also added an option to enumerate addresses on ignored interfaces.
 2012-09-21 18:16:26 +02:00
Tobias Brunner 1f97e1aaca Use a hashtable to quickly check for usable IP addresses/interfaces 2012-09-21 18:16:26 +02:00
Tobias Brunner 940e1b0f66 Filter ignored interfaces in kernel interfaces (for events, address enumeration, etc.) 2012-09-21 18:16:26 +02:00
Tobias Brunner 645d7a5ef3 %any is never on a local interface 2012-09-21 18:16:26 +02:00