Martin Willi
ee8c89e2ee
Add ESN support to kernel netlink plugin, including custom replay windows
2011-04-20 12:26:58 +02:00
Martin Willi
4876d4f3b3
Added an esn parameter to the kernel interface add_sa functions
2011-04-20 12:26:57 +02:00
Tobias Brunner
f526b35c45
Properly copy interface name if unknown.
...
We use a static string if the interface name is unknown, so using memcpy
with IFNAMSIZ is incorrect as that would overrun the static string.
2011-04-19 13:48:50 +02:00
Martin Willi
c55818ebb0
Added a (not yet implemented) plugin_t method to reload plugin configuration
2011-04-15 10:07:13 +02:00
Martin Willi
787b5884aa
Added a get_name() function to plugin_t, create_plugin_enumerator enumerates over plugin_t
2011-04-15 10:07:12 +02:00
Tobias Brunner
862ef49f85
Fixed potential memory leak when processing routes from the kernel.
2011-04-14 18:11:45 +02:00
Martin Willi
50110dfef8
Align netlink attributes properly if rta_len not a multiple of RTA_ALIGNTO
2011-03-02 16:07:38 +01:00
Martin Willi
887abfb1e7
Migrated kernel_netlink_net to INIT/METHOD macros
2011-02-17 09:34:53 +00:00
Martin Willi
d86bb6ef4d
Implemented Traffic Flow Confidentiality padding in kernel_interface
2010-12-20 09:45:39 +01:00
Jiri Bohac
19b7f763b3
Install selectors on transport mode IPsec SAs.
...
This fixes several test cases in IKEv2_Self_Test (part of the IPv6 Ready
Logo Program) which is required for USGv6 certification, namely:
- IKEv2.EN.I.1.1.7.1, IKEv2.EN.I.1.1.7.1: Narrowing the range of members
of the set of traffic selectors
- IKEv2.EN.R.1.1.7.3: Narrowing multiple traffic selector
When traffic selectors of a triggered SA are narrowed by the responder, the
installed policy and the broader trap policy share the same reqid. Without
selectors on the IPsec SA packets matching the trap policy, but not the
narrowed policy, would incorrectly be handled by that IPsec SA. Since only
one selector can be specified per IPsec SA, there is currently no solution
for tunnel mode SAs.
2010-12-13 15:28:40 +01:00
Tobias Brunner
e6f42b0721
Include the destination net in the policy priority calculation.
...
The resulting priorities are as follows:
IPv6 IPv4
routed normal routed normal
max 4096(+3) 2048(+3) 4096(+3) 2048(+3)
min 3072 1024 3840 1792
Where min is for a policy between two single hosts and max is
for /0 on both ends (lower priorities are preferred by the kernel).
(+3) applies for cases where no protocol and no ports are defined.
2010-12-07 12:14:50 +01:00
Andreas Steffen
52c037997c
Migrated kernel_netlink_plugin_t to INIT/METHOD macros
2010-11-25 23:12:12 +01:00
Martin Willi
213884f947
Print full source route on DBG2 that gets installed
2010-11-11 09:59:02 +01:00
Tobias Brunner
ec0c756d07
Do not fire roam events based on local route changes.
...
These kernel events are triggered on address changes, which is
problematic when deleting virtual IP addresses.
2010-10-12 11:11:04 +02:00
Tobias Brunner
29607690a8
If a changed route has no src, try to find it via interface.
2010-10-12 11:11:04 +02:00
Tobias Brunner
0ac6d2e658
Get source address from interface if the route does not provide one.
2010-10-12 11:11:04 +02:00
Andreas Steffen
91a0825c39
added non-standard SERPENT and TWOFISH support to kernel_netlink plugin
2010-09-08 07:22:31 +02:00
Tobias Brunner
b8bf01ddee
Do not install routes for pluto.
...
There are some incompatibilities with e.g. passthrough policies.
Pluto installs required source routes via updown script.
2010-09-02 19:04:24 +02:00
Tobias Brunner
06cdeac25f
Charon specific strongswan.conf options generalized.
2010-09-02 19:04:22 +02:00
Tobias Brunner
34cf6def83
Fixing installation of trap policies (SPI=0) in kernel interface.
2010-09-02 19:04:21 +02:00
Tobias Brunner
6da26f3008
Do not overwrite the original mode when installing policies.
...
The mode is later used to decide if a route has to be installed.
2010-09-02 19:04:20 +02:00
Tobias Brunner
749d3cccaf
Added support for different policy types in kernel_netlink plugin.
2010-09-02 19:04:19 +02:00
Tobias Brunner
bd7a2f3bfc
Added an option to specify the type of a policy to kernel_ipsec.add_policy.
...
This will later allow us to support pluto's passthrough and drop
policies in charon.
2010-09-02 19:04:19 +02:00
Tobias Brunner
55be07a15f
Added support for combined IPComp/ESP/AH policies in kernel_netlink plugin.
2010-09-02 19:04:19 +02:00
Tobias Brunner
b4872c1e09
Replaced the protocol argument in add_policy with an optional SPI for an AH SA.
2010-09-02 19:04:19 +02:00
Tobias Brunner
bb381e26c6
Refer to scheduler and processor via lib and not hydra.
2010-09-02 19:04:18 +02:00
Tobias Brunner
062a602216
Moved all kernel plugins to libhydra.
2010-09-02 19:01:26 +02:00
Martin Willi