denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
10,566 Commits 1 Branch 0 Tags
ec1b4e6638598b5c77684cd01ab4caeaf3e230a4
Commit Graph
115 Commits
Author SHA1 Message Date
Martin Willi ec1b4e6638 Merge branch 'vip-shunts' 
Installs bypass policies for the physical address if a virtual address is
assigned, and installs a proper source route to actually use the physical
address for bypassed destinations.

Conflicts:
	src/libcharon/plugins/unity/unity_handler.c
 2013-03-01 11:30:13 +01:00
Martin Willi a36b49f3cb Merge branch 'opaque-ports' 
Adds a %opaque port option and support for port ranges in left/rightprotoport.
Currently not supported by any of our kernel backends.
 2013-03-01 11:27:12 +01:00
Martin Willi 53e62f5d0c Indicate support for processing ESPv3 TFC padding in Netlink IPsec backend 2013-03-01 11:11:51 +01:00
Martin Willi a1db77de7c Use a complete port range in traffic_selector_create_from_{subnet,cidr} 2013-02-21 11:52:33 +01:00
Martin Willi a2fd08dd26 Install a route for shunt policies 
If we install a virtual IP, its source route would render the shunt policy
useless, as locally generated traffic wouldn't match. Having a route for each
shunt policy with higher priority chooses the correct source address for
bypassed destinations.
 2013-02-20 16:32:24 +01:00
Martin Willi 544c2e3d7b kernel-netlinks get_interface() considers virtual IPs, too 
When using load-tester, we can install tunnel outer addresses on
demand. As these are installed as "virtual", we have to consider
virtual IPs in the get_interface() lookup to install "real" virtual
IPs to these dynamic external addresses.
 2012-12-17 14:23:44 +01:00
Martin Willi d88597f0dd Don't wait while removing external IPs used for load testing 2012-11-29 10:22:51 +01:00
Martin Willi b185cdd16d Install virtual IPs via interface name, and use an interface lookup where required 2012-11-29 10:22:51 +01:00
Martin Willi 50bd755871 Add an optional kernel-interface parameter to install IPs with a custom prefix 2012-11-29 10:22:51 +01:00
Tobias Brunner cbd52e7ddc Limit recursion when searching for source addresses 
This could be required if e.g. two default routes list gateways but the
corresponding outbound interfaces do not have any IP addresses on them.
 2012-11-13 09:06:02 +01:00
Tobias Brunner 5be88ca6bb Don't call get_route recursively if a route's gateway matches the destination 2012-11-13 09:06:02 +01:00
Tobias Brunner f05b427265 Moved debug.[ch] to utils folder 2012-10-24 16:00:51 +02:00
Tobias Brunner 12642a6831 Moved data structures to new collections subfolder 2012-10-24 16:00:49 +02:00
Tobias Brunner eecd41e349 Use a helper function to add milliseconds to timeval structs 2012-10-18 12:25:59 +02:00
Tobias Brunner 8e2d3075aa Use proper offset when adding mark attribute in kernel-netlink plugin 2012-10-15 11:11:29 +02:00
Tobias Brunner ac24c4d323 Also add mark when querying current replay state in kernel-netlink plugin 2012-10-15 10:15:53 +02:00
Tobias Brunner 2925aa725e Fixed update_sa in kernel-netlink plugin if marks are used 2012-10-11 19:08:47 +02:00
Tobias Brunner a37ac3a47a Make sure we successfully opened xfrm_acq_expires 2012-09-28 18:54:28 +02:00
Tobias Brunner 6ffb8f8634 Clarified code when hashing/comparing cached policies in kernel-netlink 2012-09-28 18:30:16 +02:00
Tobias Brunner 9a1ba213f4 Use proper argument for sizeof when copying replay state 2012-09-28 17:00:20 +02:00
Tobias Brunner bef21bd330 Algorithm names are not always static anymore, avoid string overflows 2012-09-28 16:49:05 +02:00
Tobias Brunner a79af394a0 Allow replay windows smaller than the default of 32 2012-09-27 12:43:39 +02:00
Tobias Brunner f65ec0aa90 Make sure the if_name member of cached route entries is initialized to NULL 2012-09-22 08:23:56 +02:00
Tobias Brunner a25d536eea Use rwlock and rwlock_condvar to increase concurrency in kernel-netlink plugin 2012-09-21 18:16:27 +02:00
Tobias Brunner 16d62305c2 Use a separate mutex for cached routes in kernel-netlink plugin 2012-09-21 18:16:27 +02:00
Tobias Brunner 4134108c77 Use a lock to safely check and update the time for the next roam event 2012-09-21 18:16:27 +02:00
Tobias Brunner e8e9048fee Added an option to configure the interface on which virtual IP addresses are installed 2012-09-21 18:16:26 +02:00
Tobias Brunner c6b401581a Changed how kernel-netlink handles virtual IP addresses 
Also tried to avoid the use of enumerators.
 2012-09-21 18:16:26 +02:00
Tobias Brunner 4106aea8e4 Made IP address enumeration more flexible 
Also added an option to enumerate addresses on ignored interfaces.
 2012-09-21 18:16:26 +02:00
Tobias Brunner 1f97e1aaca Use a hashtable to quickly check for usable IP addresses/interfaces 2012-09-21 18:16:26 +02:00
Tobias Brunner 940e1b0f66 Filter ignored interfaces in kernel interfaces (for events, address enumeration, etc.) 2012-09-21 18:16:26 +02:00
Tobias Brunner 645d7a5ef3 %any is never on a local interface 2012-09-21 18:16:26 +02:00
Tobias Brunner 9ba36c0f7f Make it easy to check if an address is locally usable via changed get_interface() method 2012-09-21 18:16:26 +02:00
Tobias Brunner aed33805ce Don't ignore loopback devices and allow addresses on them being enumerated 2012-09-21 18:16:26 +02:00
Tobias Brunner dad6d904ee Use source address in get_nexthop() call 
Otherwise the nexthop returned might belong to a different route than
the one actually used with the current source address.
 2012-09-21 18:16:25 +02:00
Tobias Brunner 662534657f Source address lookup refactored 
Routes matching the destination are now first parsed and sorted by network
prefix length.  This list is then used to search for the best route with
a matching preferred source address (if one is specified).  This makes sure
we really check all routes for that address.
 2012-09-21 18:16:25 +02:00
Tobias Brunner cef0a8118e Check routes with equal prefix if preferred source is specified 2012-09-21 18:16:25 +02:00
Tobias Brunner 9d6b02d6c1 Try to find preferred source on interface if returned source does not match 2012-09-21 18:16:25 +02:00
Tobias Brunner da6d86dd94 Try to keep the given source address when looking up routes 
This allows to pin the local end of an IKE_SA to an address that is not the
physical address of an interface.  Without this patch the local address would
change to the physical address when roam events occur.
 2012-09-21 18:16:25 +02:00
Tobias Brunner 08ad639f32 Added algorithm lookup via kernel_interface_t to the various kernel interfaces 2012-09-13 15:48:49 +02:00
Tobias Brunner fa96a350c2 Consistently log XFRM mark masks with 0 prefix in kernel-netlink plugin 2012-09-12 17:40:36 +02:00
Tobias Brunner 31a0e24b0f Increased log level when listing interfaces and IP addresses during startup 
This avoids confusing log messages in starter and ipsec statusall
already lists the available addresses anyway.
 2012-08-16 16:14:15 +02:00
Tobias Brunner e49abcede0 Let kernel interfaces decide how to enable UDP decapsulation of ESP packets. 2012-08-08 15:12:24 +02:00
Tobias Brunner 26d77eb3e6 Centralized thread cancellation in processor_t 
This ensures that no threads are active when plugins and the rest of the
daemon are unloaded.

callback_job_t was simplified a lot in the process as its main
functionality is now contained in processor_t.  The parent-child
relationships were abandoned as these were only needed to simplify job
cancellation.
 2012-06-25 17:38:59 +02:00
Tobias Brunner 7beb31aae4 Fixed IPv6 source address lookup 
Because Linux kernels prior to 3.0 do not support RTA_PREFSRC for
IPv6 routes we didn't use NLM_F_DUMP to get all routes.
Still routes installed with policies are installed also for IPv6.
So since only one route is returned without DUMP, and we ignore
all routes from our own routing table, no source address was found
during roaming if DST of the installed route included the IKE peer.

With newer kernels we can now use DUMP as we did for IPv4 already,
for older kernels we do so if our own routes are installed in a
separate routing table, otherwise we still use GET.
 2012-06-25 16:29:59 +02:00
Tobias Brunner 5c1332bf7c NLM_F_DUMP includes NLM_F_ROOT. 2012-06-15 16:46:27 +02:00
Tobias Brunner 8ec51f83e5 Don't create roam jobs based on cached/cloned routes. 2012-06-15 16:44:18 +02:00
Tobias Brunner 9896b6bd58 Don't compare ports when comparing cached routes. 
At least src_ip has a port set sometimes.
 2012-06-15 16:44:07 +02:00
Tobias Brunner 05ca56558c Disabled listening for kernel events in starter. 2012-06-08 14:12:06 +02:00
Tobias Brunner 9e19cb912d Destroy Netlink socket only after deleting remaining source routes. 2012-05-21 13:33:13 +02:00