Tobias Brunner
99d23ddf45
Implemented flushing of states and policies via XFRM.
2011-10-21 14:18:53 +02:00
Martin Willi
3b62d5bad8
Add features support to kernel-klips plugin
2011-10-14 10:05:48 +02:00
Martin Willi
8da1f9f25d
Add features support to kernel-pfroute plugin
2011-10-14 10:05:48 +02:00
Martin Willi
e99cb0673d
Add features support to kernel-pfkey plugin
2011-10-14 10:05:47 +02:00
Martin Willi
278e5f3d7a
Add features support to kernel-netlink plugin
2011-10-14 10:05:47 +02:00
Tobias Brunner
439cb93ce9
Check for RTA_TABLE in configure.
2011-10-04 18:46:51 +02:00
Andreas Steffen
784ce91d8b
Migrated sql_attribute to INIT/METHOD macros
2011-09-29 23:35:32 +02:00
Andreas Steffen
07e62fd7a6
Migrated netlink_socket to INIT/METHOD macros
2011-09-29 23:24:51 +02:00
Andreas Steffen
769b490e05
Migrated resolve_handler to INIT/METHOD macros
2011-09-29 23:15:49 +02:00
Tobias Brunner
0057427008
Disable policy history for pluto.
...
pluto tracks usage of policies already in its own way.
2011-08-02 18:34:49 +02:00
Tobias Brunner
2e370a300d
Allow routing table IDs > 255 when filtering them.
2011-07-29 12:16:18 +02:00
Tobias Brunner
d7a59f1976
Install fallback drop policies to avoid transmitting unencrypted packets.
...
During the update of a CHILD_SA (e.g. caused by MOBIKE) the old policy
is first uninstalled and then the new one is installed. In the short
time in between, where no policy is available in the kernel, unencrypted
packets could have been transmitted.
2011-07-27 13:44:33 +02:00
Tobias Brunner
fbedc6a45b
Remove policies in kernel interfaces based on their priority.
...
This allows to unroute a connection while the same connection is
currently established. In this case both CHILD_SAs share the same
reqid but the installed policies have different priorities.
2011-07-27 13:41:35 +02:00
Tobias Brunner
f3bb1bd039
Fixed common misspellings.
...
Mostly found by 'codespell'.
2011-07-20 16:14:10 +02:00
Andreas Steffen
cad259e349
removed stray code
2011-07-18 10:22:29 +02:00
Andreas Steffen
6101ee9b06
added log and status output for ESN
2011-07-16 11:09:38 +02:00
Tobias Brunner
17927ca615
Record usage history of policies in PF_KEY kernel interface.
...
The implementation is nearly the same as in the Netlink kernel interface.
2011-07-06 12:56:34 +02:00
Tobias Brunner
4e9e4372f5
Simplified destruction of policy_sa_t objects in Netlink interface.
2011-07-06 12:49:54 +02:00
Tobias Brunner
674bc34322
Some code cleanup in Netlink kernel interface.
2011-07-06 09:43:46 +02:00
Tobias Brunner
108357b106
Some code cleanup in PF_KEY kernel interface.
2011-07-06 09:43:46 +02:00
Tobias Brunner
9f49464d56
Reduce memory usage of policy history caching.
...
Only cache data as needed (e.g. traffic selectors only for forward
policies) and at most once for each IPsec SA.
2011-07-06 09:43:46 +02:00
Tobias Brunner
c225f9b558
Keep the mutex locked as long as possible when deleting policies.
...
This change tries to prevent a race condition where a thread tries to
install the same policy another thread is currently deleting. If the
second thread releases the mutex in del_policy too early the first
thread could assume the policy does not exist (as it is not cached
anymore) but would not be able to actually install it if the second
thread was not yet able to delete it.
2011-07-06 09:43:46 +02:00
Tobias Brunner
bd4f7dab75
Properly unlock the policy if no change in the kernel is required.
2011-07-06 09:43:46 +02:00
Tobias Brunner
32fbad4ec2
Make sure access to policy is thread-safe during installation of route.
2011-07-06 09:43:46 +02:00
Tobias Brunner
e26304348c
Replaced simple iterator usages.
2011-07-06 09:43:45 +02:00
Tobias Brunner
f0ba8ae042
Record the history of a policy installed in the kernel.
...
This allows to properly delete a policy e.g. if reauth=yes and
auto=route, because reqids are increased during reauthentication.
It also avoids overriding an installed policy with a trap policy.
2011-07-06 09:43:45 +02:00
Tobias Brunner
328f22e1d3
Add the reqid to kernel_ipsec_t.del_policy.
2011-07-06 09:43:45 +02:00
Tobias Brunner
3ee8fed445
Cache the most recent reqid in the PF_KEY kernel interface.
...
This makes the PF_KEY kernel interface behave the same as the Netlink
kernel interface.
2011-07-06 09:43:45 +02:00
Andreas Steffen
06b5b61838
install PASS and DROP shunt policies via PFKEYv2 interface
2011-07-05 21:57:45 +02:00
Martin Willi
14bf2f689d
Use CRITICAL job priority class for long running dispatcher jobs
2011-05-16 15:24:15 +02:00
Tobias Brunner
38865eced3
Return correct status code in kernel_netlink_ipsec_t.query_sa.
2011-05-10 15:45:42 +02:00
Martin Willi
f7812f6492
Wipe memory after using key material (incomplete, to be continued)
2011-05-09 14:36:15 +02:00
Tobias Brunner
7b12521679
Removed superfluous parameter missed in e5e5bcc92f.
2011-05-02 17:13:14 +02:00
Tobias Brunner
cce8f65232
Fixed two typos in kernel-pfroute plugin.
2011-04-26 17:58:39 +02:00
Martin Willi
5b0bcfb1fc
Revert alloc_str changes
...
This reverts commit fdead26ffe3e2419ebe317ce69b47a
2011-04-21 13:35:31 +02:00
Martin Willi
3e2419ebe3
Use thread save settings alloc_str function where appropriate
2011-04-21 10:48:16 +02:00
Martin Willi
4778655726
Cast size_t len arguments to %.*s to int
2011-04-20 13:08:32 +02:00
Martin Willi
05e9589783
Copy ESN enabled replay state during update_sa, if supported
2011-04-20 12:26:58 +02:00
Martin Willi
ee8c89e2ee
Add ESN support to kernel netlink plugin, including custom replay windows
2011-04-20 12:26:58 +02:00
Martin Willi
4876d4f3b3
Added an esn parameter to the kernel interface add_sa functions
2011-04-20 12:26:57 +02:00
Tobias Brunner
00b9f755f8
pool: Proper cleanup in error cases when adding addresses from a file.
2011-04-19 13:48:50 +02:00
Tobias Brunner
e5143952f0
pool: Proper handling of address family when adding addresses.
2011-04-19 13:48:50 +02:00
Tobias Brunner
119fc2d3d7
Added missing break statement.
2011-04-19 13:48:50 +02:00
Tobias Brunner
f526b35c45
Properly copy interface name if unknown.
...
We use a static string if the interface name is unknown, so using memcpy
with IFNAMSIZ is incorrect as that would overrun the static string.
2011-04-19 13:48:50 +02:00
Martin Willi
96409be320
Add reload support to attr plugin
2011-04-15 10:07:13 +02:00
Martin Willi
00b4b4b0d1
Migrated attr plugin to INIT/METHOD macros
2011-04-15 10:07:13 +02:00
Martin Willi
c55818ebb0
Added a (not yet implemented) plugin_t method to reload plugin configuration
2011-04-15 10:07:13 +02:00
Martin Willi
787b5884aa
Added a get_name() function to plugin_t, create_plugin_enumerator enumerates over plugin_t
2011-04-15 10:07:12 +02:00
Tobias Brunner
e5e5bcc92f
Removed superfluous parameter to printf.
2011-04-14 18:11:46 +02:00
Tobias Brunner
862ef49f85
Fixed potential memory leak when processing routes from the kernel.
2011-04-14 18:11:45 +02:00
Tobias Brunner