Commit Graph
185 Commits
Author SHA1 Message Date
Tobias Brunner 156f7e9b85 Moved types used by kernel_ipsec_t interface (and libipsec) to libstrongswan
This avoids a dependency of libipsec to libhydra.
2012-08-08 15:41:02 +02:00
Tobias Brunner e49abcede0 Let kernel interfaces decide how to enable UDP decapsulation of ESP packets. 2012-08-08 15:12:24 +02:00
Martin Willi 3b7468b245 Support Unity split-include/exclude options in attr plugin 2012-07-20 17:36:27 +02:00
Tobias Brunner 0159a54047 Check rng return value when generating SPIs in kernel-klips plugin 2012-07-16 14:53:36 +02:00
Tobias Brunner 63afd833b9 Avoid SIGSEGV during shutdown if charon is not started as root 2012-06-25 19:00:00 +02:00
Tobias Brunner 26d77eb3e6 Centralized thread cancellation in processor_t
This ensures that no threads are active when plugins and the rest of the
daemon are unloaded.

callback_job_t was simplified a lot in the process as its main
functionality is now contained in processor_t.  The parent-child
relationships were abandoned as these were only needed to simplify job
cancellation.
2012-06-25 17:38:59 +02:00
Tobias Brunner 7beb31aae4 Fixed IPv6 source address lookup
Because Linux kernels prior to 3.0 do not support RTA_PREFSRC for
IPv6 routes we didn't use NLM_F_DUMP to get all routes.
Still routes installed with policies are installed also for IPv6.
So since only one route is returned without DUMP, and we ignore
all routes from our own routing table, no source address was found
during roaming if DST of the installed route included the IKE peer.

With newer kernels we can now use DUMP as we did for IPv4 already,
for older kernels we do so if our own routes are installed in a
separate routing table, otherwise we still use GET.
2012-06-25 16:29:59 +02:00
Tobias Brunner 5c1332bf7c NLM_F_DUMP includes NLM_F_ROOT. 2012-06-15 16:46:27 +02:00
Tobias Brunner 8ec51f83e5 Don't create roam jobs based on cached/cloned routes. 2012-06-15 16:44:18 +02:00
Tobias Brunner 9896b6bd58 Don't compare ports when comparing cached routes.
At least src_ip has a port set sometimes.
2012-06-15 16:44:07 +02:00
Tobias Brunner 05ca56558c Disabled listening for kernel events in starter. 2012-06-08 14:12:06 +02:00
Tobias Brunner 9041c074b3 Properly install policies with ports in PF_KEY kernel interface. 2012-06-07 14:37:00 +02:00
Tobias Brunner 9e19cb912d Destroy Netlink socket only after deleting remaining source routes. 2012-05-21 13:33:13 +02:00
Tobias Brunner c732e22019 Fix route reinstallation if preferred source IP is not on outgoing interface. 2012-05-07 19:00:47 +02:00
Tobias Brunner bc798c9ce8 Route reinstallation in kernel_ipsec_t implementations is not needed anymore. 2012-05-02 15:24:47 +02:00
Tobias Brunner f834249c59 Reinstall routes in kernel-netlink plugin, if interfaces get reactivated or IPs reappear. 2012-05-02 15:24:47 +02:00
Tobias Brunner 74ba22c992 Keep track of installed source routes in kernel-netlink plugin. 2012-05-02 14:56:08 +02:00
Martin Willi b24be29646 Merge branch 'ikev1'
Conflicts:
	configure.in
	man/ipsec.conf.5.in
	src/libcharon/encoding/generator.c
	src/libcharon/encoding/payloads/notify_payload.c
	src/libcharon/encoding/payloads/notify_payload.h
	src/libcharon/encoding/payloads/payload.c
	src/libcharon/network/receiver.c
	src/libcharon/sa/authenticator.c
	src/libcharon/sa/authenticator.h
	src/libcharon/sa/ikev2/tasks/ike_init.c
	src/libcharon/sa/task_manager.c
	src/libstrongswan/credentials/auth_cfg.c
2012-05-02 11:12:31 +02:00
Tobias Brunner ed2cab08d2 Make resolvconf interface prefix configurable. 2012-03-27 10:44:21 +02:00
Tobias Brunner caae5a5c0f Added support for the resolvconf framework in resolve plugin.
If /sbin/resolvconf is found nameservers are not written directly to
/etc/resolv.conf but instead resolvconf is invoked.
2012-03-27 10:44:21 +02:00
Tobias Brunner 6e921f2017 Use single DBG2 statements in kernel_netlink plugin (i.e. ignore mark.value). 2012-03-27 10:37:56 +02:00
Martin Willi 3de54af7ec Define a special XFRM mark_t.value that dynamically uses the CHILD_SA reqid 2012-03-22 09:05:56 +01:00
Martin Willi b1f2f05c92 Merge branch 'ikev1-clean' into ikev1-master
Conflicts:
	configure.in
	man/ipsec.conf.5.in
	src/libcharon/daemon.c
	src/libcharon/plugins/eap_ttls/eap_ttls_peer.c
	src/libcharon/plugins/eap_radius/eap_radius_accounting.c
	src/libcharon/plugins/eap_radius/eap_radius_forward.c
	src/libcharon/plugins/farp/farp_listener.c
	src/libcharon/sa/ike_sa.c
	src/libcharon/sa/keymat.c
	src/libcharon/sa/task_manager.c
	src/libcharon/sa/trap_manager.c
	src/libstrongswan/plugins/x509/x509_cert.c
	src/libstrongswan/utils.h

Applied lost changes of moved files keymat.c and task_manager.c.
Updated listener_t.message hook signature in new plugins.
2012-03-20 17:57:53 +01:00
Martin Willi 07202a2bf1 Be less verbose when deleting SAs triggered by a hard expire 2012-03-20 17:31:31 +01:00
Martin Willi e174e0d445 Added not-yet used sa_payload parameters used in IKEv1 2012-03-20 17:30:52 +01:00
Martin Willi 21796bac9a Be less verbose if we don't have a local address for a tunnel 2012-03-06 16:05:58 +01:00
Tobias Brunner 686cfd4e34 Added support for untruncated MD5 and SHA1 HMACs in ESP as used in RFC 4595.
This requires a Linux kernel >= 2.6.33.
2012-02-27 14:31:19 +01:00
Tobias Brunner 2e0b478a01 Android 4 requires LOCAL_MODULE_TAGS to be set for all modules.
Because all packages are now marked as optional executables that are to
be installed on the final system have to be added to PRODUCT_PACKAGES in
build/target/product/core.mk.  Dependencies (such as libraries) are
installed automatically.
2012-01-12 19:18:35 +01:00
Tobias Brunner 35a1986142 Fixed additional typos in comments and log messages. 2012-01-12 11:42:42 +01:00
Thomas Egerer 64c4fd0a60 Always unlock mutex for installed policies in kernel-netlink plugin. 2011-12-14 18:17:49 +01:00
Thomas Jarosch 00b9e598f3 Fix copy'n'paste error in libhydra's netlink interface
Detected by cppcheck.
2011-11-21 09:00:39 +01:00
Mirko Parthey 7b21873668 Fix network interface deletion handling in kernel-netlink plugin.
When the kernel reports the deletion of an interface (RTM_DELLINK),
the cached interface attributes, including ifindex, become invalid
and must be forgotten.

Interface link state changes ("up" and "down") show up as RTM_NEWLINK,
so they will not cause a cached entry to be removed or
prevent listening to address change notifications.

Once an interface has been deleted, the kernel ought to stop sending
notifications for it. If the interface gets recreated with the same
name later, the kernel again reports RTM_NEWLINK, which causes a new
cache entry to be created.

There should be no reason to keep a stale cache entry around, as was
claimed in the comment.
2011-11-14 15:24:48 +01:00
Tobias Brunner 866858527d Fix 'ipsec pool --status' for empty pools. 2011-11-04 15:07:54 +01:00
Thomas Egerer c125d1ba13 Memwipe request after sa update, too 2011-11-04 11:11:17 +01:00
Thomas Egerer dbfd1a63aa Extend xfrm_attr_type_names by newly added enum values 2011-11-04 11:11:17 +01:00
Tobias Brunner 051226d5c0 Silently install route again, even if it did not change.
Address/interface changes can cause the route to disappear. Afterwards
the route might look the same but that does not mean it is still installed.
2011-11-04 11:11:17 +01:00
Tobias Brunner 25d59e9e2d Compile warning fixed in kernel interfaces. 2011-11-04 11:11:17 +01:00
Tobias Brunner 0e6aafb5b6 The kernel-klips plugin does currently not support SAD/SPD flushing. 2011-10-21 14:24:33 +02:00
Tobias Brunner 773572f9e0 Implemented flushing of SAD and SPD entries via PF_KEY. 2011-10-21 14:24:33 +02:00
Tobias Brunner 99d23ddf45 Implemented flushing of states and policies via XFRM. 2011-10-21 14:18:53 +02:00
Tobias Brunner 0b0f466bbc Defined functions in the kernel interface to flush SAD and SPD entries. 2011-10-21 14:18:23 +02:00
Tobias Brunner cfa15a71d9 Source files in Android.mk updated. 2011-10-14 17:36:20 +02:00
Martin Willi 3b62d5bad8 Add features support to kernel-klips plugin 2011-10-14 10:05:48 +02:00
Martin Willi 8da1f9f25d Add features support to kernel-pfroute plugin 2011-10-14 10:05:48 +02:00
Martin Willi e99cb0673d Add features support to kernel-pfkey plugin 2011-10-14 10:05:47 +02:00
Martin Willi 278e5f3d7a Add features support to kernel-netlink plugin 2011-10-14 10:05:47 +02:00
Martin Willi 29d30991f3 Added kernel_ipsec/net plugin feature loading callbacks 2011-10-14 10:05:47 +02:00
Tobias Brunner 439cb93ce9 Check for RTA_TABLE in configure. 2011-10-04 18:46:51 +02:00
Andreas Steffen 71b6235ad8 Migrated attribute_manager to INIT/METHOD macros 2011-10-02 12:23:31 +02:00
Andreas Steffen 784ce91d8b Migrated sql_attribute to INIT/METHOD macros 2011-09-29 23:35:32 +02:00