denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
7,739 Commits 1 Branch 0 Tags
dbfd1a63aae484be369272b1f9eb6349fbcbb973
Commit Graph
53 Commits
Author SHA1 Message Date
Thomas Egerer dbfd1a63aa Extend xfrm_attr_type_names by newly added enum values 2011-11-04 11:11:17 +01:00
Tobias Brunner 051226d5c0 Silently install route again, even if it did not change. 
Address/interface changes can cause the route to disappear. Afterwards
the route might look the same but that does not mean it is still installed.
 2011-11-04 11:11:17 +01:00
Tobias Brunner 25d59e9e2d Compile warning fixed in kernel interfaces. 2011-11-04 11:11:17 +01:00
Tobias Brunner 99d23ddf45 Implemented flushing of states and policies via XFRM. 2011-10-21 14:18:53 +02:00
Martin Willi 278e5f3d7a Add features support to kernel-netlink plugin 2011-10-14 10:05:47 +02:00
Tobias Brunner 439cb93ce9 Check for RTA_TABLE in configure. 2011-10-04 18:46:51 +02:00
Andreas Steffen 07e62fd7a6 Migrated netlink_socket to INIT/METHOD macros 2011-09-29 23:24:51 +02:00
Tobias Brunner 0057427008 Disable policy history for pluto. 
pluto tracks usage of policies already in its own way.
 2011-08-02 18:34:49 +02:00
Tobias Brunner 2e370a300d Allow routing table IDs > 255 when filtering them. 2011-07-29 12:16:18 +02:00
Tobias Brunner d7a59f1976 Install fallback drop policies to avoid transmitting unencrypted packets. 
During the update of a CHILD_SA (e.g. caused by MOBIKE) the old policy
is first uninstalled and then the new one is installed.  In the short
time in between, where no policy is available in the kernel, unencrypted
packets could have been transmitted.
 2011-07-27 13:44:33 +02:00
Tobias Brunner fbedc6a45b Remove policies in kernel interfaces based on their priority. 
This allows to unroute a connection while the same connection is
currently established.  In this case both CHILD_SAs share the same
reqid but the installed policies have different priorities.
 2011-07-27 13:41:35 +02:00
Andreas Steffen cad259e349 removed stray code 2011-07-18 10:22:29 +02:00
Andreas Steffen 6101ee9b06 added log and status output for ESN 2011-07-16 11:09:38 +02:00
Tobias Brunner 4e9e4372f5 Simplified destruction of policy_sa_t objects in Netlink interface. 2011-07-06 12:49:54 +02:00
Tobias Brunner 674bc34322 Some code cleanup in Netlink kernel interface. 2011-07-06 09:43:46 +02:00
Tobias Brunner 9f49464d56 Reduce memory usage of policy history caching. 
Only cache data as needed (e.g. traffic selectors only for forward
policies) and at most once for each IPsec SA.
 2011-07-06 09:43:46 +02:00
Tobias Brunner c225f9b558 Keep the mutex locked as long as possible when deleting policies. 
This change tries to prevent a race condition where a thread tries to
install the same policy another thread is currently deleting. If the
second thread releases the mutex in del_policy too early the first
thread could assume the policy does not exist (as it is not cached
anymore) but would not be able to actually install it if the second
thread was not yet able to delete it.
 2011-07-06 09:43:46 +02:00
Tobias Brunner bd4f7dab75 Properly unlock the policy if no change in the kernel is required. 2011-07-06 09:43:46 +02:00
Tobias Brunner 32fbad4ec2 Make sure access to policy is thread-safe during installation of route. 2011-07-06 09:43:46 +02:00
Tobias Brunner e26304348c Replaced simple iterator usages. 2011-07-06 09:43:45 +02:00
Tobias Brunner f0ba8ae042 Record the history of a policy installed in the kernel. 
This allows to properly delete a policy e.g. if reauth=yes and
auto=route, because reqids are increased during reauthentication.

It also avoids overriding an installed policy with a trap policy.
 2011-07-06 09:43:45 +02:00
Tobias Brunner 328f22e1d3 Add the reqid to kernel_ipsec_t.del_policy. 2011-07-06 09:43:45 +02:00
Martin Willi 14bf2f689d Use CRITICAL job priority class for long running dispatcher jobs 2011-05-16 15:24:15 +02:00
Tobias Brunner 38865eced3 Return correct status code in kernel_netlink_ipsec_t.query_sa. 2011-05-10 15:45:42 +02:00
Martin Willi f7812f6492 Wipe memory after using key material (incomplete, to be continued) 2011-05-09 14:36:15 +02:00
Martin Willi 05e9589783 Copy ESN enabled replay state during update_sa, if supported 2011-04-20 12:26:58 +02:00
Martin Willi ee8c89e2ee Add ESN support to kernel netlink plugin, including custom replay windows 2011-04-20 12:26:58 +02:00
Martin Willi 4876d4f3b3 Added an esn parameter to the kernel interface add_sa functions 2011-04-20 12:26:57 +02:00
Tobias Brunner f526b35c45 Properly copy interface name if unknown. 
We use a static string if the interface name is unknown, so using memcpy
with IFNAMSIZ is incorrect as that would overrun the static string.
 2011-04-19 13:48:50 +02:00
Martin Willi c55818ebb0 Added a (not yet implemented) plugin_t method to reload plugin configuration 2011-04-15 10:07:13 +02:00
Martin Willi 787b5884aa Added a get_name() function to plugin_t, create_plugin_enumerator enumerates over plugin_t 2011-04-15 10:07:12 +02:00
Tobias Brunner 862ef49f85 Fixed potential memory leak when processing routes from the kernel. 2011-04-14 18:11:45 +02:00
Martin Willi 50110dfef8 Align netlink attributes properly if rta_len not a multiple of RTA_ALIGNTO 2011-03-02 16:07:38 +01:00
Martin Willi 887abfb1e7 Migrated kernel_netlink_net to INIT/METHOD macros 2011-02-17 09:34:53 +00:00
Martin Willi d86bb6ef4d Implemented Traffic Flow Confidentiality padding in kernel_interface 2010-12-20 09:45:39 +01:00
Jiri Bohac 19b7f763b3 Install selectors on transport mode IPsec SAs. 
This fixes several test cases in IKEv2_Self_Test (part of the IPv6 Ready
Logo Program) which is required for USGv6 certification, namely:

  - IKEv2.EN.I.1.1.7.1, IKEv2.EN.I.1.1.7.1: Narrowing the range of members
    of the set of traffic selectors
  - IKEv2.EN.R.1.1.7.3: Narrowing multiple traffic selector

When traffic selectors of a triggered SA are narrowed by the responder, the
installed policy and the broader trap policy share the same reqid.  Without
selectors on the IPsec SA packets matching the trap policy, but not the
narrowed policy, would incorrectly be handled by that IPsec SA.  Since only
one selector can be specified per IPsec SA, there is currently no solution
for tunnel mode SAs.
 2010-12-13 15:28:40 +01:00
Tobias Brunner e6f42b0721 Include the destination net in the policy priority calculation. 
The resulting priorities are as follows:

    IPv6               IPv4
    routed   normal    routed   normal
max 4096(+3) 2048(+3)  4096(+3) 2048(+3)
min 3072     1024      3840     1792

Where min is for a policy between two single hosts and max is
for /0 on both ends (lower priorities are preferred by the kernel).
(+3) applies for cases where no protocol and no ports are defined.
 2010-12-07 12:14:50 +01:00
Andreas Steffen 52c037997c Migrated kernel_netlink_plugin_t to INIT/METHOD macros 2010-11-25 23:12:12 +01:00
Martin Willi 213884f947 Print full source route on DBG2 that gets installed 2010-11-11 09:59:02 +01:00
Tobias Brunner ec0c756d07 Do not fire roam events based on local route changes. 
These kernel events are triggered on address changes, which is
problematic when deleting virtual IP addresses.
 2010-10-12 11:11:04 +02:00
Tobias Brunner 29607690a8 If a changed route has no src, try to find it via interface. 2010-10-12 11:11:04 +02:00
Tobias Brunner 0ac6d2e658 Get source address from interface if the route does not provide one. 2010-10-12 11:11:04 +02:00
Andreas Steffen 91a0825c39 added non-standard SERPENT and TWOFISH support to kernel_netlink plugin 2010-09-08 07:22:31 +02:00
Tobias Brunner b8bf01ddee Do not install routes for pluto. 
There are some incompatibilities with e.g. passthrough policies.
Pluto installs required source routes via updown script.
 2010-09-02 19:04:24 +02:00
Tobias Brunner 06cdeac25f Charon specific strongswan.conf options generalized. 2010-09-02 19:04:22 +02:00
Tobias Brunner 34cf6def83 Fixing installation of trap policies (SPI=0) in kernel interface. 2010-09-02 19:04:21 +02:00
Tobias Brunner 6da26f3008 Do not overwrite the original mode when installing policies. 
The mode is later used to decide if a route has to be installed.
 2010-09-02 19:04:20 +02:00
Tobias Brunner 749d3cccaf Added support for different policy types in kernel_netlink plugin. 2010-09-02 19:04:19 +02:00
Tobias Brunner bd7a2f3bfc Added an option to specify the type of a policy to kernel_ipsec.add_policy. 
This will later allow us to support pluto's passthrough and drop
policies in charon.
 2010-09-02 19:04:19 +02:00
Tobias Brunner 55be07a15f Added support for combined IPComp/ESP/AH policies in kernel_netlink plugin. 2010-09-02 19:04:19 +02:00