denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
11,017 Commits 1 Branch 0 Tags
a8849e0713d3ae0f377f0b0e8c8fb83803d4eed4
Commit Graph
306 Commits
Author SHA1 Message Date
Thomas Egerer 64c4fd0a60 Always unlock mutex for installed policies in kernel-netlink plugin. 2011-12-14 18:17:49 +01:00
Thomas Jarosch 00b9e598f3 Fix copy'n'paste error in libhydra's netlink interface 
Detected by cppcheck.
 2011-11-21 09:00:39 +01:00
Mirko Parthey 7b21873668 Fix network interface deletion handling in kernel-netlink plugin. 
When the kernel reports the deletion of an interface (RTM_DELLINK),
the cached interface attributes, including ifindex, become invalid
and must be forgotten.

Interface link state changes ("up" and "down") show up as RTM_NEWLINK,
so they will not cause a cached entry to be removed or
prevent listening to address change notifications.

Once an interface has been deleted, the kernel ought to stop sending
notifications for it. If the interface gets recreated with the same
name later, the kernel again reports RTM_NEWLINK, which causes a new
cache entry to be created.

There should be no reason to keep a stale cache entry around, as was
claimed in the comment.
 2011-11-14 15:24:48 +01:00
Tobias Brunner 866858527d Fix 'ipsec pool --status' for empty pools. 2011-11-04 15:07:54 +01:00
Thomas Egerer c125d1ba13 Memwipe request after sa update, too 2011-11-04 11:11:17 +01:00
Thomas Egerer dbfd1a63aa Extend xfrm_attr_type_names by newly added enum values 2011-11-04 11:11:17 +01:00
Tobias Brunner 051226d5c0 Silently install route again, even if it did not change. 
Address/interface changes can cause the route to disappear. Afterwards
the route might look the same but that does not mean it is still installed.
 2011-11-04 11:11:17 +01:00
Tobias Brunner 25d59e9e2d Compile warning fixed in kernel interfaces. 2011-11-04 11:11:17 +01:00
Tobias Brunner 0e6aafb5b6 The kernel-klips plugin does currently not support SAD/SPD flushing. 2011-10-21 14:24:33 +02:00
Tobias Brunner 773572f9e0 Implemented flushing of SAD and SPD entries via PF_KEY. 2011-10-21 14:24:33 +02:00
Tobias Brunner 99d23ddf45 Implemented flushing of states and policies via XFRM. 2011-10-21 14:18:53 +02:00
Tobias Brunner 0b0f466bbc Defined functions in the kernel interface to flush SAD and SPD entries. 2011-10-21 14:18:23 +02:00
Tobias Brunner cfa15a71d9 Source files in Android.mk updated. 2011-10-14 17:36:20 +02:00
Martin Willi 3b62d5bad8 Add features support to kernel-klips plugin 2011-10-14 10:05:48 +02:00
Martin Willi 8da1f9f25d Add features support to kernel-pfroute plugin 2011-10-14 10:05:48 +02:00
Martin Willi e99cb0673d Add features support to kernel-pfkey plugin 2011-10-14 10:05:47 +02:00
Martin Willi 278e5f3d7a Add features support to kernel-netlink plugin 2011-10-14 10:05:47 +02:00
Martin Willi 29d30991f3 Added kernel_ipsec/net plugin feature loading callbacks 2011-10-14 10:05:47 +02:00
Tobias Brunner 439cb93ce9 Check for RTA_TABLE in configure. 2011-10-04 18:46:51 +02:00
Andreas Steffen 71b6235ad8 Migrated attribute_manager to INIT/METHOD macros 2011-10-02 12:23:31 +02:00
Andreas Steffen 784ce91d8b Migrated sql_attribute to INIT/METHOD macros 2011-09-29 23:35:32 +02:00
Andreas Steffen 07e62fd7a6 Migrated netlink_socket to INIT/METHOD macros 2011-09-29 23:24:51 +02:00
Andreas Steffen 769b490e05 Migrated resolve_handler to INIT/METHOD macros 2011-09-29 23:15:49 +02:00
Martin Willi 40e53c40d4 Destroy kernel interface during deregistration, as the plugin goes afterwards 2011-09-12 13:02:15 +02:00
Andreas Steffen 5c0ab65cae shortened XAUTH and UNITY attribute short names 2011-08-16 23:37:09 +02:00
Tobias Brunner 0057427008 Disable policy history for pluto. 
pluto tracks usage of policies already in its own way.
 2011-08-02 18:34:49 +02:00
Tobias Brunner 2e370a300d Allow routing table IDs > 255 when filtering them. 2011-07-29 12:16:18 +02:00
Tobias Brunner d7a59f1976 Install fallback drop policies to avoid transmitting unencrypted packets. 
During the update of a CHILD_SA (e.g. caused by MOBIKE) the old policy
is first uninstalled and then the new one is installed.  In the short
time in between, where no policy is available in the kernel, unencrypted
packets could have been transmitted.
 2011-07-27 13:44:33 +02:00
Tobias Brunner fbedc6a45b Remove policies in kernel interfaces based on their priority. 
This allows to unroute a connection while the same connection is
currently established.  In this case both CHILD_SAs share the same
reqid but the installed policies have different priorities.
 2011-07-27 13:41:35 +02:00
Tobias Brunner f3bb1bd039 Fixed common misspellings. 
Mostly found by 'codespell'.
 2011-07-20 16:14:10 +02:00
Andreas Steffen cad259e349 removed stray code 2011-07-18 10:22:29 +02:00
Andreas Steffen 6101ee9b06 added log and status output for ESN 2011-07-16 11:09:38 +02:00
Andreas Steffen 56bffdc03a added HOME_AGENT_ADDRESS CP attribute type 2011-07-14 11:05:13 +02:00
Tobias Brunner 17927ca615 Record usage history of policies in PF_KEY kernel interface. 
The implementation is nearly the same as in the Netlink kernel interface.
 2011-07-06 12:56:34 +02:00
Tobias Brunner 4e9e4372f5 Simplified destruction of policy_sa_t objects in Netlink interface. 2011-07-06 12:49:54 +02:00
Tobias Brunner 674bc34322 Some code cleanup in Netlink kernel interface. 2011-07-06 09:43:46 +02:00
Tobias Brunner 108357b106 Some code cleanup in PF_KEY kernel interface. 2011-07-06 09:43:46 +02:00
Tobias Brunner 9f49464d56 Reduce memory usage of policy history caching. 
Only cache data as needed (e.g. traffic selectors only for forward
policies) and at most once for each IPsec SA.
 2011-07-06 09:43:46 +02:00
Tobias Brunner c225f9b558 Keep the mutex locked as long as possible when deleting policies. 
This change tries to prevent a race condition where a thread tries to
install the same policy another thread is currently deleting. If the
second thread releases the mutex in del_policy too early the first
thread could assume the policy does not exist (as it is not cached
anymore) but would not be able to actually install it if the second
thread was not yet able to delete it.
 2011-07-06 09:43:46 +02:00
Tobias Brunner bd4f7dab75 Properly unlock the policy if no change in the kernel is required. 2011-07-06 09:43:46 +02:00
Tobias Brunner 32fbad4ec2 Make sure access to policy is thread-safe during installation of route. 2011-07-06 09:43:46 +02:00
Tobias Brunner e26304348c Replaced simple iterator usages. 2011-07-06 09:43:45 +02:00
Tobias Brunner f0ba8ae042 Record the history of a policy installed in the kernel. 
This allows to properly delete a policy e.g. if reauth=yes and
auto=route, because reqids are increased during reauthentication.

It also avoids overriding an installed policy with a trap policy.
 2011-07-06 09:43:45 +02:00
Tobias Brunner 328f22e1d3 Add the reqid to kernel_ipsec_t.del_policy. 2011-07-06 09:43:45 +02:00
Tobias Brunner 3ee8fed445 Cache the most recent reqid in the PF_KEY kernel interface. 
This makes the PF_KEY kernel interface behave the same as the Netlink
kernel interface.
 2011-07-06 09:43:45 +02:00
Andreas Steffen 06b5b61838 install PASS and DROP shunt policies via PFKEYv2 interface 2011-07-05 21:57:45 +02:00
Tobias Brunner 60d62b9e5c Don't install the libraries directly in lib/. 
Instead use a subdirectory (prefix/lib/ipsec by default). Also moved the
plugins from libexec to a subdirectory of that dir.
 2011-07-05 14:42:14 +02:00
Andreas Steffen f87991704e implemented PASS and DROP shunt policies 2011-06-28 19:42:54 +02:00
Martin Willi 14bf2f689d Use CRITICAL job priority class for long running dispatcher jobs 2011-05-16 15:24:15 +02:00
Tobias Brunner 38865eced3 Return correct status code in kernel_netlink_ipsec_t.query_sa. 2011-05-10 15:45:42 +02:00