denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
10,231 Commits 1 Branch 0 Tags
063ae4e52ab1e522694a5e2d4853db5d63a673c0
Commit Graph
200 Commits
Author SHA1 Message Date
Martin Willi 544c2e3d7b kernel-netlinks get_interface() considers virtual IPs, too 
When using load-tester, we can install tunnel outer addresses on
demand. As these are installed as "virtual", we have to consider
virtual IPs in the get_interface() lookup to install "real" virtual
IPs to these dynamic external addresses.
 2012-12-17 14:23:44 +01:00
Martin Willi d88597f0dd Don't wait while removing external IPs used for load testing 2012-11-29 10:22:51 +01:00
Martin Willi b185cdd16d Install virtual IPs via interface name, and use an interface lookup where required 2012-11-29 10:22:51 +01:00
Martin Willi 50bd755871 Add an optional kernel-interface parameter to install IPs with a custom prefix 2012-11-29 10:22:51 +01:00
Tobias Brunner cbd52e7ddc Limit recursion when searching for source addresses 
This could be required if e.g. two default routes list gateways but the
corresponding outbound interfaces do not have any IP addresses on them.
 2012-11-13 09:06:02 +01:00
Tobias Brunner 5be88ca6bb Don't call get_route recursively if a route's gateway matches the destination 2012-11-13 09:06:02 +01:00
Tobias Brunner f05b427265 Moved debug.[ch] to utils folder 2012-10-24 16:00:51 +02:00
Tobias Brunner 12642a6831 Moved data structures to new collections subfolder 2012-10-24 16:00:49 +02:00
Tobias Brunner 2e7cc07ecd Moved host_t and host_resolver_t to a new networking subfolder 2012-10-24 15:06:18 +02:00
Tobias Brunner eecd41e349 Use a helper function to add milliseconds to timeval structs 2012-10-18 12:25:59 +02:00
Tobias Brunner 8e2d3075aa Use proper offset when adding mark attribute in kernel-netlink plugin 2012-10-15 11:11:29 +02:00
Tobias Brunner ac24c4d323 Also add mark when querying current replay state in kernel-netlink plugin 2012-10-15 10:15:53 +02:00
Tobias Brunner 2925aa725e Fixed update_sa in kernel-netlink plugin if marks are used 2012-10-11 19:08:47 +02:00
Tobias Brunner 9ff9c3d11b Added missing break statements in NAT-T mapping handling in PF_KEY plugin 2012-09-28 18:57:56 +02:00
Tobias Brunner a37ac3a47a Make sure we successfully opened xfrm_acq_expires 2012-09-28 18:54:28 +02:00
Tobias Brunner 6ffb8f8634 Clarified code when hashing/comparing cached policies in kernel-netlink 2012-09-28 18:30:16 +02:00
Tobias Brunner a05f3b2021 Make sure first argument is an int when using %.*s to print e.g. chunks 2012-09-28 18:01:49 +02:00
Tobias Brunner 53ab3c27cd Ensure that pipe is closed when calling resolvconf(8) 2012-09-28 17:33:24 +02:00
Tobias Brunner 9a1ba213f4 Use proper argument for sizeof when copying replay state 2012-09-28 17:00:20 +02:00
Tobias Brunner bef21bd330 Algorithm names are not always static anymore, avoid string overflows 2012-09-28 16:49:05 +02:00
Tobias Brunner a79af394a0 Allow replay windows smaller than the default of 32 2012-09-27 12:43:39 +02:00
Tobias Brunner 9845391a95 Properly initialize cached address map in kernel-pfroute plugin 2012-09-27 12:43:36 +02:00
Tobias Brunner bfd2cc1cd7 Fixed compilation of kernel-pfroute plugin 2012-09-27 09:23:58 +02:00
Tobias Brunner f65ec0aa90 Make sure the if_name member of cached route entries is initialized to NULL 2012-09-22 08:23:56 +02:00
Tobias Brunner bdf36dac71 Use an rwlock in kernel-pfroute too 2012-09-21 18:16:27 +02:00
Tobias Brunner a25d536eea Use rwlock and rwlock_condvar to increase concurrency in kernel-netlink plugin 2012-09-21 18:16:27 +02:00
Tobias Brunner 16d62305c2 Use a separate mutex for cached routes in kernel-netlink plugin 2012-09-21 18:16:27 +02:00
Tobias Brunner 4134108c77 Use a lock to safely check and update the time for the next roam event 2012-09-21 18:16:27 +02:00
Tobias Brunner e8e9048fee Added an option to configure the interface on which virtual IP addresses are installed 2012-09-21 18:16:26 +02:00
Tobias Brunner c6b401581a Changed how kernel-netlink handles virtual IP addresses 
Also tried to avoid the use of enumerators.
 2012-09-21 18:16:26 +02:00
Tobias Brunner 4106aea8e4 Made IP address enumeration more flexible 
Also added an option to enumerate addresses on ignored interfaces.
 2012-09-21 18:16:26 +02:00
Tobias Brunner 1f97e1aaca Use a hashtable to quickly check for usable IP addresses/interfaces 2012-09-21 18:16:26 +02:00
Tobias Brunner 940e1b0f66 Filter ignored interfaces in kernel interfaces (for events, address enumeration, etc.) 2012-09-21 18:16:26 +02:00
Tobias Brunner 645d7a5ef3 %any is never on a local interface 2012-09-21 18:16:26 +02:00
Tobias Brunner 9ba36c0f7f Make it easy to check if an address is locally usable via changed get_interface() method 2012-09-21 18:16:26 +02:00
Tobias Brunner aed33805ce Don't ignore loopback devices and allow addresses on them being enumerated 2012-09-21 18:16:26 +02:00
Tobias Brunner dad6d904ee Use source address in get_nexthop() call 
Otherwise the nexthop returned might belong to a different route than
the one actually used with the current source address.
 2012-09-21 18:16:25 +02:00
Tobias Brunner 662534657f Source address lookup refactored 
Routes matching the destination are now first parsed and sorted by network
prefix length.  This list is then used to search for the best route with
a matching preferred source address (if one is specified).  This makes sure
we really check all routes for that address.
 2012-09-21 18:16:25 +02:00
Tobias Brunner cef0a8118e Check routes with equal prefix if preferred source is specified 2012-09-21 18:16:25 +02:00
Tobias Brunner 9d6b02d6c1 Try to find preferred source on interface if returned source does not match 2012-09-21 18:16:25 +02:00
Tobias Brunner da6d86dd94 Try to keep the given source address when looking up routes 
This allows to pin the local end of an IKE_SA to an address that is not the
physical address of an interface.  Without this patch the local address would
change to the physical address when roam events occur.
 2012-09-21 18:16:25 +02:00
Tobias Brunner 08ad639f32 Added algorithm lookup via kernel_interface_t to the various kernel interfaces 2012-09-13 15:48:49 +02:00
Tobias Brunner fa96a350c2 Consistently log XFRM mark masks with 0 prefix in kernel-netlink plugin 2012-09-12 17:40:36 +02:00
Martin Willi 28a3d5bfbd Pass full pool list to release_address 2012-09-11 16:18:28 +02:00
Martin Willi 594c58e111 Pass the full list of pools to acquire_address, enumerate in providers 
If the provider has access to the full pool list, it can enumerate
them twice, for example to search for existing leases first, and
only search for new leases in a second step.

Fixes lease enumeration in attr-sql using multiple pools.
 2012-09-11 16:18:28 +02:00
Tobias Brunner 4065e2504c Use the proper types for comma separated attributes read from strongswan.conf 
Attributes of different address families previously were mapped to
the same attribute type (the one derived from the address family of the
first address).
 2012-09-10 15:17:17 +02:00
Martin Willi 13f11ccf46 Don't parse comma separated pool names in attr-sql 
We now handle multiple pools at a deeper level, making that special
handling obsolete. Comma separated pools are parsed in stroke.
 2012-08-30 16:43:44 +02:00
Martin Willi d55fe264d1 Pass all configured pool names to attribute provider enumerator 2012-08-30 16:43:43 +02:00
Martin Willi feb8550401 Pass a list instead of a single virtual IP to attribute enumerators 2012-08-30 16:43:42 +02:00
Tobias Brunner 31a0e24b0f Increased log level when listing interfaces and IP addresses during startup 
This avoids confusing log messages in starter and ipsec statusall
already lists the available addresses anyway.
 2012-08-16 16:14:15 +02:00