denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
11,017 Commits 1 Branch 0 Tags
a8849e0713d3ae0f377f0b0e8c8fb83803d4eed4
Commit Graph
306 Commits
Author SHA1 Message Date
Martin Willi c9a323c1d9 kernel-pfroute: allow only one thread to do a route look up simultaneously 
Otherwise we mess up the sequence number another thread is waiting for.
 2013-05-06 17:01:13 +02:00
Martin Willi 5c12700f9a kernel-interface: query SAD for last use time if SPD query didn't yield one 2013-05-06 17:01:13 +02:00
Martin Willi 470aad7e0c kernel-pfkey: be less verbose about unexpected sequence numbers 2013-05-06 17:01:13 +02:00
Martin Willi df919d50d0 kernel-pfkey: install exclude routes if kernel-net requires them 2013-05-06 17:01:13 +02:00
Martin Willi 580b768d03 kernel-pfroute: add a feature flag requesting "exclude" routes 
If routes installed along with policies covering the peer address affect local
IKE/ESP packets, they won't get routed correctly. To work around this issue,
the kernel interface can install "exclude" routes for the IKE peer. Not all
networking backends require this workaround, hence we export a flag for it
if it is required.
 2013-05-06 17:01:13 +02:00
Martin Willi bd520193a4 kernel-pfroute: remove unused interface address refcounting 2013-05-06 17:01:13 +02:00
Martin Willi 77b6f19694 kernel-pfroute: mark IPs installed on tun device as virtual 2013-05-06 17:00:55 +02:00
Martin Willi 2a2d7a4dc8 kernel-pfroute: install virtual IPs using dedicated tun devices 2013-05-06 16:10:13 +02:00
Martin Willi ca4a14ae83 kernel-pfkey: when installing a route for a virtual IP, use its interface 
When installing a route over a tun device for a virtual IP, the route must
be set over the tun, not the IKE interface.
 2013-05-06 16:10:13 +02:00
Martin Willi f52cf07532 kernel-interface: get_address_by_ts() can tell if a returned IP is virtual 2013-05-06 16:10:13 +02:00
Martin Willi 1a2a8bffed kernel-interface: support enumeration of virtual-only IPs 2013-05-06 16:10:13 +02:00
Martin Willi 5f7f8c92ca kernel-pfkey: refactor route installation to a dedicate function 2013-05-06 16:10:13 +02:00
Martin Willi 121783035c kernel-pfroute: split /0 routes to avoid conflict with default route 2013-05-06 16:10:13 +02:00
Martin Willi f8646dd65e kernel-pfkey: check if we have a gateway before comparing them 2013-05-06 16:10:13 +02:00
Martin Willi d4260c5f7f kernel-pfkey: install route along with input, not forward policies 
As forwarding policies are not available on all systems (OS X), using the
forward policy to attach the route is a bad pick. Using input policies allows
OS X to install routes.
 2013-05-06 16:10:13 +02:00
Martin Willi 6e879a59fc kernel-pfroute: rescan address list for an interface if its state changes 
It seems that we don't get address notifications if the interface is down
on OS X.
 2013-05-06 16:10:13 +02:00
Martin Willi 0fd409db77 kernel-pfroute: add newly appearing interfaces to the interface cache 2013-05-06 16:10:12 +02:00
Martin Willi 9bc342eae4 kernel-pfroute: implement get_nexthop() 2013-05-06 16:10:12 +02:00
Martin Willi 272bcac894 kernel-pfroute: install and uninstall routes 2013-05-06 16:10:12 +02:00
Martin Willi 3a7f4b5c8d kernel-pfroute: collect replies received for our own queries 2013-05-06 16:10:12 +02:00
Martin Willi b1c6b68e4c kernel-pfroute: refactor PF_ROUTE message processing, use an enumerator 2013-05-06 16:10:12 +02:00
Martin Willi 889efae4cf kernel-pfkey: use an int to set esp_port with a sysctl on OS X 2013-05-06 16:10:12 +02:00
Martin Willi 9650bf3cc7 kernel-pfroute: use INIT() macro for allocations 2013-05-06 16:10:12 +02:00
Martin Willi 0e107f03ac kernel-pfroute: use only a single PF_ROUTE socket for both events and queries 2013-05-06 16:10:12 +02:00
Martin Willi e8002956c9 kernel-pfroute: fix length check when receiving PF_ROUTE messages 2013-05-06 16:10:12 +02:00
Martin Willi 64f309e735 kernel-pfkey: remove obsolete pluto specific behavior 2013-05-06 16:10:12 +02:00
Martin Willi bc6275d21c kernel-netlink: remove obsolete pluto specific behavior 2013-05-06 16:10:11 +02:00
Tobias Brunner 37873f9994 kernel-netlink: Add an option to disable roam events 2013-05-03 15:11:19 +02:00
Tobias Brunner 0b9ce21b5e kernel-netlink: Define defaults for routing table and prio 2013-05-03 15:11:19 +02:00
Tobias Brunner e5d819b617 android: Remove/filter header files from LOCAL_SRC_FILES 
This avoids huge warnings when building the native code.
 2013-03-20 15:24:26 +01:00
Tobias Brunner 2ac772a5d0 Use proper address family when adding multiple addresses to SQL pool 2013-03-19 16:33:07 +01:00
Tobias Brunner fe62707209 Ignore SQL-based IP address pools if their address family does not match 2013-03-19 16:33:07 +01:00
Tobias Brunner deafaf51f1 Load arbitrary (non-host) attributes from strongswan.conf 
This allows to e.g. load Cisco-specific attributes that contain FQDNs.
 2013-03-19 15:21:30 +01:00
Martin Willi d29246cabe Merge branch 'radius-ext' 
Bring some extensions to eap-radius, namely a virtual IP address provider based
on received Framed-IPs, forwarding of Cisco Unity banners, Interim Accounting
updates and the reporting of sent/received packets.
 2013-03-18 10:13:36 +01:00
Martin Willi cb14ecb1d3 Merge branch 'netlink-align' 
Fixes some Netlink alignment issues, and then refactors Netlink XFRM message
attribute handling.
 2013-03-18 10:09:35 +01:00
Martin Willi 94163816fa Use netlink_add_attribute() to copy over attributes during update_sa() 2013-03-15 16:02:01 +01:00
Martin Willi 0d9f31e1ed Use a helper function to add XFRM_MARK attribute 2013-03-15 16:02:01 +01:00
Martin Willi 6dfc633927 Use netlink_reserve() helper function in XFRM to simplify message construction 2013-03-15 16:02:01 +01:00
Martin Willi 6359ab04f4 Add a Netlink utility function to add a RTA header and reserve space for data 2013-03-15 14:32:51 +01:00
Martin Willi 53c98f098f Correctly check buffer length in netlink_add_attribute() 2013-03-15 14:32:25 +01:00
Martin Willi 6ac601f543 Avoid unneeded termination of netlink algorithm name arrays with END_OF_LIST 2013-03-15 14:01:15 +01:00
Martin Willi 6b35ab84da Pass correclty sized pointer to lookup_algorithm() in PF_KEY 2013-03-14 14:20:54 +01:00
Martin Willi 7eeeb1c702 kernel_ipsec_t.query_sa() additionally returns the number of processed packets 2013-03-14 14:20:54 +01:00
Martin Willi cf6a4ea005 strdup() iface passed to queue_route_reinstall(), fixing double-free 2013-03-11 15:17:50 +01:00
Martin Willi 0897cda33b Add a constructor to create in-memory pools from an address range 2013-03-11 15:12:47 +01:00
Martin Willi d3f5a05e29 When adding Netlink attributes, increase header length with potential alignment 
If the payload is unaligned, we must make sure the total netlink message
length includes the added alignment for the first attribute.
 2013-03-11 12:32:21 +01:00
Tobias Brunner 292ee515db Fix maximum size of a mem_pool_t 2013-03-07 18:21:02 +01:00
Martin Willi ad9af9e2d8 Fix some apidoc in mem_pool.h 2013-03-06 10:26:52 +01:00
Martin Willi b611d8ba48 Merge branch 'ikev1-rekeying' 
Migrates Quick Modes to the new Main Mode if an IKEv1 reauthentication replaces
the old Main Mode having a uniqueids=replace policy.
 2013-03-01 11:32:02 +01:00
Martin Willi ec1b4e6638 Merge branch 'vip-shunts' 
Installs bypass policies for the physical address if a virtual address is
assigned, and installs a proper source route to actually use the physical
address for bypassed destinations.

Conflicts:
	src/libcharon/plugins/unity/unity_handler.c
 2013-03-01 11:30:13 +01:00