Andreas Steffen
c26e4330e7
Implemented IPsec policies restricted to given network interface
2016-04-09 16:51:02 +02:00
Andreas Steffen
7f57c4f9fb
Support manually-set IPsec policy priorities
2016-04-09 16:51:01 +02:00
Tobias Brunner
23f25f9647
shunt-manager: Install "outbound" FWD policy
...
If there is a default drop policy forwarded traffic might otherwise not
be allowed by a specific passthrough policy (while local traffic is
allowed).
2016-04-09 16:51:00 +02:00
Tobias Brunner
89da06ace9
kernel: Use structs to pass information to the kernel-ipsec interface
2016-04-09 16:50:59 +02:00
Tobias Brunner
8394ea2a42
libhydra: Move kernel interface to libcharon
...
This moves hydra->kernel_interface to charon->kernel.
2016-03-03 17:36:11 +01:00
Tobias Brunner
a6e0f14fd2
kernel-interface: Pass the same data to del_policy() that was passed to add_policy()
...
The additional data can be helpful to identify the exact policy to
delete.
2015-11-10 16:42:52 +01:00
Tobias Brunner
08afc33e52
shunt-manager: Resolve %dynamic to %any4/6 before installing policies
...
left|rightsubnet default to %dynamic, which is basically 0.0.0.0/0 until an
address is assigned to it. So if only one side was undefined and the other
traffic selector was IPv6 an address family mismatch would occur.
References #595 .
2015-09-16 15:01:05 +02:00
Tobias Brunner
65978f08f4
shunt-manager: Don't install policies in case of an address family or IP protocol mismatch
...
References #595 .
2015-09-16 15:00:46 +02:00
Tobias Brunner
bc36530670
shunt-manager: Add flush() method to properly uninstall shunts
...
This will allow us to uninstall shunts before unloading the
kernel-interface plugins.
2015-07-27 13:51:10 +02:00
Tobias Brunner
616ff9a236
shunt-manager: Remove stored entries if installation fails
2015-07-27 13:51:07 +02:00
Tobias Brunner
f3d39666e0
shunt-manager: Add a lock to safely access the list of shunt policies
2015-07-27 13:50:52 +02:00
Tobias Brunner
981466251f
shunt-manager: Install passthrough policies with highest priority
...
This avoids conflicts with regular IPsec policies.
Similarly, use the lowest priority for drop policies.
2014-06-19 14:20:33 +02:00
Tobias Brunner
12642a6831
Moved data structures to new collections subfolder
2012-10-24 16:00:49 +02:00
Martin Willi
81419807f5
Release leaking child config after uninstalling shunt policy
2012-07-23 17:15:40 +02:00
Tobias Brunner
fbedc6a45b
Remove policies in kernel interfaces based on their priority.
...
This allows to unroute a connection while the same connection is
currently established. In this case both CHILD_SAs share the same
reqid but the installed policies have different priorities.
2011-07-27 13:41:35 +02:00
Andreas Steffen
4742d6501a
shunt manager installs policies with %any hosts
2011-07-14 13:51:36 +02:00
Tobias Brunner
0c2ce1905a
Adapted shunt manager to changed kernel interface (reqid in del_policy).
2011-07-06 12:48:26 +02:00
Andreas Steffen
f87991704e
implemented PASS and DROP shunt policies
2011-06-28 19:42:54 +02:00
Andreas Steffen