denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
7,062 Commits 1 Branch 0 Tags
e26304348c80697ae299081567bddf1acbf022e2
Commit Graph
93 Commits
Author SHA1 Message Date
Tobias Brunner e26304348c Replaced simple iterator usages. 2011-07-06 09:43:45 +02:00
Tobias Brunner f0ba8ae042 Record the history of a policy installed in the kernel. 
This allows to properly delete a policy e.g. if reauth=yes and
auto=route, because reqids are increased during reauthentication.

It also avoids overriding an installed policy with a trap policy.
 2011-07-06 09:43:45 +02:00
Tobias Brunner 328f22e1d3 Add the reqid to kernel_ipsec_t.del_policy. 2011-07-06 09:43:45 +02:00
Tobias Brunner 3ee8fed445 Cache the most recent reqid in the PF_KEY kernel interface. 
This makes the PF_KEY kernel interface behave the same as the Netlink
kernel interface.
 2011-07-06 09:43:45 +02:00
Andreas Steffen 06b5b61838 install PASS and DROP shunt policies via PFKEYv2 interface 2011-07-05 21:57:45 +02:00
Martin Willi 14bf2f689d Use CRITICAL job priority class for long running dispatcher jobs 2011-05-16 15:24:15 +02:00
Tobias Brunner 38865eced3 Return correct status code in kernel_netlink_ipsec_t.query_sa. 2011-05-10 15:45:42 +02:00
Martin Willi f7812f6492 Wipe memory after using key material (incomplete, to be continued) 2011-05-09 14:36:15 +02:00
Tobias Brunner 7b12521679 Removed superfluous parameter missed in e5e5bcc92f. 2011-05-02 17:13:14 +02:00
Tobias Brunner cce8f65232 Fixed two typos in kernel-pfroute plugin. 2011-04-26 17:58:39 +02:00
Martin Willi 5b0bcfb1fc Revert alloc_str changes 
This reverts commit fdead26ffe.
This reverts commit 3e2419ebe3.
This reverts commit 17ce69b47a.
 2011-04-21 13:35:31 +02:00
Martin Willi 3e2419ebe3 Use thread save settings alloc_str function where appropriate 2011-04-21 10:48:16 +02:00
Martin Willi 4778655726 Cast size_t len arguments to %.*s to int 2011-04-20 13:08:32 +02:00
Martin Willi 05e9589783 Copy ESN enabled replay state during update_sa, if supported 2011-04-20 12:26:58 +02:00
Martin Willi ee8c89e2ee Add ESN support to kernel netlink plugin, including custom replay windows 2011-04-20 12:26:58 +02:00
Martin Willi 4876d4f3b3 Added an esn parameter to the kernel interface add_sa functions 2011-04-20 12:26:57 +02:00
Tobias Brunner 00b9f755f8 pool: Proper cleanup in error cases when adding addresses from a file. 2011-04-19 13:48:50 +02:00
Tobias Brunner e5143952f0 pool: Proper handling of address family when adding addresses. 2011-04-19 13:48:50 +02:00
Tobias Brunner 119fc2d3d7 Added missing break statement. 2011-04-19 13:48:50 +02:00
Tobias Brunner f526b35c45 Properly copy interface name if unknown. 
We use a static string if the interface name is unknown, so using memcpy
with IFNAMSIZ is incorrect as that would overrun the static string.
 2011-04-19 13:48:50 +02:00
Martin Willi 96409be320 Add reload support to attr plugin 2011-04-15 10:07:13 +02:00
Martin Willi 00b4b4b0d1 Migrated attr plugin to INIT/METHOD macros 2011-04-15 10:07:13 +02:00
Martin Willi c55818ebb0 Added a (not yet implemented) plugin_t method to reload plugin configuration 2011-04-15 10:07:13 +02:00
Martin Willi 787b5884aa Added a get_name() function to plugin_t, create_plugin_enumerator enumerates over plugin_t 2011-04-15 10:07:12 +02:00
Tobias Brunner e5e5bcc92f Removed superfluous parameter to printf. 2011-04-14 18:11:46 +02:00
Tobias Brunner 862ef49f85 Fixed potential memory leak when processing routes from the kernel. 2011-04-14 18:11:45 +02:00
Tobias Brunner 24e0595437 Removed unused variables. 2011-04-12 14:44:49 +02:00
Martin Willi 50110dfef8 Align netlink attributes properly if rta_len not a multiple of RTA_ALIGNTO 2011-03-02 16:07:38 +01:00
Martin Willi e131f11779 Migrated kernel_pfroute_net to INIT/METHOD macros 2011-02-17 09:39:25 +00:00
Martin Willi 887abfb1e7 Migrated kernel_netlink_net to INIT/METHOD macros 2011-02-17 09:34:53 +00:00
Tobias Brunner e185d78fc9 Kernel interface updated for KLIPS plugin (TFC padding). 2011-02-10 16:49:42 +01:00
Andreas Steffen e3504d6011 added missing tfc argument to kernel_pfkey_ipsec interface 2010-12-27 05:53:36 +01:00
Martin Willi d86bb6ef4d Implemented Traffic Flow Confidentiality padding in kernel_interface 2010-12-20 09:45:39 +01:00
Jiri Bohac 19b7f763b3 Install selectors on transport mode IPsec SAs. 
This fixes several test cases in IKEv2_Self_Test (part of the IPv6 Ready
Logo Program) which is required for USGv6 certification, namely:

  - IKEv2.EN.I.1.1.7.1, IKEv2.EN.I.1.1.7.1: Narrowing the range of members
    of the set of traffic selectors
  - IKEv2.EN.R.1.1.7.3: Narrowing multiple traffic selector

When traffic selectors of a triggered SA are narrowed by the responder, the
installed policy and the broader trap policy share the same reqid.  Without
selectors on the IPsec SA packets matching the trap policy, but not the
narrowed policy, would incorrectly be handled by that IPsec SA.  Since only
one selector can be specified per IPsec SA, there is currently no solution
for tunnel mode SAs.
 2010-12-13 15:28:40 +01:00
Tobias Brunner e6f42b0721 Include the destination net in the policy priority calculation. 
The resulting priorities are as follows:

    IPv6               IPv4
    routed   normal    routed   normal
max 4096(+3) 2048(+3)  4096(+3) 2048(+3)
min 3072     1024      3840     1792

Where min is for a policy between two single hosts and max is
for /0 on both ends (lower priorities are preferred by the kernel).
(+3) applies for cases where no protocol and no ports are defined.
 2010-12-07 12:14:50 +01:00
Andreas Steffen 5b2547c7a7 commas, commas, .. 2010-11-25 23:25:01 +01:00
Andreas Steffen 53e159f111 Migrated resolve_plugin_t to INIT/METHOD macros 2010-11-25 23:19:33 +01:00
Andreas Steffen 8ac5fb345f Migrated kernel_pfroute_plugin_t to INIT/METHOD macros 2010-11-25 23:17:18 +01:00
Andreas Steffen cd5feee356 Migrated kernel_pfkey_plugin_t to INIT/METHOD macros 2010-11-25 23:14:29 +01:00
Andreas Steffen 52c037997c Migrated kernel_netlink_plugin_t to INIT/METHOD macros 2010-11-25 23:12:12 +01:00
Andreas Steffen ea6dc84f09 INIT allocates memory 2010-11-25 23:09:12 +01:00
Andreas Steffen a95d5760df INIT allocates memory 2010-11-25 23:08:00 +01:00
Andreas Steffen c6753bd4a7 Migrated kernel_klips_plugin_t to INIT/METHOD macros 2010-11-25 23:06:20 +01:00
Andreas Steffen a76ad38365 Migrated attr_plugin_t to INIT/METHOD macros 2010-11-25 22:52:32 +01:00
Andreas Steffen bd801f1b97 Migrated attr_sql_plugin_t to INIT/METHOD macros 2010-11-25 22:49:44 +01:00
Martin Willi 213884f947 Print full source route on DBG2 that gets installed 2010-11-11 09:59:02 +01:00
Tobias Brunner ec0c756d07 Do not fire roam events based on local route changes. 
These kernel events are triggered on address changes, which is
problematic when deleting virtual IP addresses.
 2010-10-12 11:11:04 +02:00
Tobias Brunner 29607690a8 If a changed route has no src, try to find it via interface. 2010-10-12 11:11:04 +02:00
Tobias Brunner 0ac6d2e658 Get source address from interface if the route does not provide one. 2010-10-12 11:11:04 +02:00
Andreas Steffen 91a0825c39 added non-standard SERPENT and TWOFISH support to kernel_netlink plugin 2010-09-08 07:22:31 +02:00