denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
13,778 Commits 1 Branch 0 Tags
85ace154d85c69f708d494c810e4d77af4587a8c
Commit Graph
76 Commits
Author SHA1 Message Date
Martin Willi 85ace154d8 inactivity-job: Schedule job by CHILD_SA unique ID instead of reqid 2015-02-20 13:34:51 +01:00
Martin Willi f81a949748 kernel-interface: Raise expires with a proto/SPI/dst tuple instead of reqid 2015-02-20 13:34:50 +01:00
Martin Willi 38227d0e08 ike: Maintain per-IKE_SA CHILD_SAs in the global CHILD_SA manager 2015-02-20 13:34:49 +01:00
Tobias Brunner f8a565fbcc ike: Remove redundant check for local NAT when handling changed NAT mappings 2014-10-13 15:20:17 +02:00
Martin Willi 898c8b12f9 ikev1: Extend adopt_children_job by task queuing, executed after adoption 2014-08-25 09:55:44 +02:00
Martin Willi 3ecfc83c6b payload: Use common prefixes for all payload type identifiers 
The old identifiers did not use a proper namespace and often clashed with
other defines.
 2014-06-04 15:53:03 +02:00
Martin Willi 0b3bea3965 ike: Delay actively initiated reauthentication when other exchanges in progress 
If any other IKE or CHILD_SA operation takes places, we should not start
initiating reauthentication to avoid any potential races.
 2014-04-17 09:59:06 +02:00
Martin Willi d048a319df ike: Restart inactivity counter after doing a CHILD_SA rekey 
When doing a rekey for a CHILD_SA, the use counters get reset. An inactivity
job is queued for a time unrelated to the rekey time, so it might happen
that the inactivity job gets executed just after rekeying. If this happens,
inactivity is detected even if we had traffic on the rekeyed CHILD_SA just
before rekeying.

This change implies that inactivity checks can't handle inactivity timeouts
for rekeyed CHILD_SAs, and therefore requires that inactivity timeout is shorter
than the rekey time to have any effect.
 2014-01-23 16:19:22 +01:00
Martin Willi 9c19d7ca31 ikev1: Don't log a reauthentication detection message if no children adopted 
When a replace unique policy is in place, the children get adopted during
the uniqueness check. In this case the message is just misleading.
 2013-09-30 13:51:11 +02:00
Tobias Brunner 4c74fa664b Reuse reqid for trap policies installed for dpd|closeaction=hold 2013-07-01 09:58:25 +02:00
Tobias Brunner 8a0a1ae857 Delete IKE_SAs if responder does not initiate XAuth exchange within a certain time frame 2013-03-19 12:00:00 +01:00
Martin Willi 335982169a When IKEv1 DPD times out, raise missing SEND_RETRANSMIT_TIMOUT alert 2013-03-14 14:20:54 +01:00
Martin Willi d954a2081b child_sa_t.get_usestats() can additionally return the number of processed packets 2013-03-14 14:20:54 +01:00
Tobias Brunner c849305ad7 Log message size for in- and outbound IKE messages 2012-12-24 12:29:30 +01:00
Martin Willi 578f72ceb0 Raise an alert if half-open timeout limit reached 2012-12-19 10:40:33 +01:00
Martin Willi 137ea41f45 Properly trigger ike_updown() event if IKEv1 DPD times out 
Fixes missing RADIUS Accounting Stop, #257.
 2012-12-04 11:11:50 +01:00
Tobias Brunner 12642a6831 Moved data structures to new collections subfolder 2012-10-24 16:00:49 +02:00
Tobias Brunner 2e7cc07ecd Moved host_t and host_resolver_t to a new networking subfolder 2012-10-24 15:06:18 +02:00
Martin Willi 101d26babe Support multiple virtual IPs on peer_cfg and ike_sa classes 2012-08-30 16:43:42 +02:00
Tobias Brunner b223d517c8 Replaced usages of CHARON_*_PORT with calls to get_port(). 2012-08-08 15:12:25 +02:00
Tobias Brunner e7ea057fd2 Make the UDP ports charon listens for packets on (and uses as source ports) configurable. 2012-08-08 15:07:43 +02:00
Tobias Brunner e0efd7c121 Make rescheduling a job more predictable 
This avoids race conditions between calls to cancel() and jobs that like
to be rescheduled.  If jobs were able to reschedule themselves it would
theoretically be possible that two worker threads have the same job
assigned (the one currently executing the job and the one executing the
same but rescheduled job if it already is time to execute it), this means
that cancel() could be called twice for that job.

Creating a new job based on the current one and reschedule that is also
OK, but rescheduling itself is more efficient for jobs that need to be
executed often.
 2012-06-25 17:49:12 +02:00
Tobias Brunner 7fec83af28 Give processor_t more control over the lifecycle of a job 
Jobs are now destroyed by the processor, but they are allowed to
reschedule themselves.  That is, parts of the reschedule functionality
already provided by callback_job_t is moved to the processor.  Not yet
fully supported is JOB_REQUEUE_DIRECT and canceling jobs.

Note: job_t.destroy() is now called not only for queued jobs but also
after execution or cancellation of jobs.  job_t.status can be used to
decide what to do in said method.
 2012-06-25 17:10:28 +02:00
Martin Willi 0fbfcf2a3a Use XAuth/EAP remote identity for uniqueness check 2012-06-25 10:18:34 +02:00
Tobias Brunner 77e4282643 Avoid queueing more than one retry initiate job. 2012-05-30 15:32:52 +02:00
Tobias Brunner eac9d77059 Job added to re-initiate an IKE_SA. 2012-05-30 15:32:52 +02:00
Martin Willi b5341bb07c Fix IKEv1 DPD clear, destroying IKE_SA even if reestablish not needed 2012-05-21 12:17:32 +02:00
Andreas Steffen 80c5b17d1a make IKEv1 DPD timeout configurable in charon 2012-05-17 19:49:22 +02:00
Martin Willi b7dafb3f5b Consider inbound ESP as a sign of liveness for DPD timeout 2012-05-15 14:58:28 +02:00
Martin Willi 4b38c22c00 Schedule a DPD timeout job that enforces the IKE message timeout policy 2012-05-15 14:46:02 +02:00
Tobias Brunner ead92870b8 Loggers specify what log messages they want to receive during registration. 
This also allows us to generate the log message only once for all
loggers that need it (avoids calls to custom printf specifier callbacks).

To update the log levels loggers can simply be registered again.
 2012-05-02 14:45:38 +02:00
Martin Willi aa3b53e716 Adopt children after syncing a rekeyed IKEv1 SA 2012-03-20 17:31:38 +01:00
Martin Willi 1a0648490c Invoke ike_updown hooks for reauthenticated IKEv1 SAs 2012-03-20 17:31:36 +01:00
Martin Willi b147679a2c Try to detect reauthentication as responder and adopt children to new SA 2012-03-20 17:31:33 +01:00
Martin Willi 3a925f74ab Do not query CHILD_SA during delete if they already expired 2012-03-20 17:31:31 +01:00
Martin Willi ef32c6866e Removed obsolete XAuth job 2012-03-20 17:31:25 +01:00
Martin Willi ac009df132 Pass IKE version to peer config enumerator, filter configs 2012-03-20 17:31:25 +01:00
Clavister OpenSource 02c36eeb86 IKEv1 XAuth: Adding "initiate" flag parameter to the initiate_xauth method, signalling whether or not to call the task_manager->initiate method after queueing the task. 2012-03-20 17:31:10 +01:00
Clavister OpenSource 2e210e3ef5 IKEv1 XAuth: Added a job to call the initiate_xauth method of ike_sa after the completion of the current set of tasks is complete. 2012-03-20 17:31:09 +01:00
Martin Willi cf1772f685 Do not ignore configs for IKEv1 in charon anymore 2012-03-20 17:30:43 +01:00
Tobias Brunner f7a8fcedc0 Use enum to define IKE version on peer_cfg_t. 
Replaced all those magic numbers.
 2012-03-20 17:30:41 +01:00
Tobias Brunner a36e175ade Migrated initiate_mediation_job_t to INIT/METHOD macros. 2011-10-03 18:53:14 +02:00
Tobias Brunner 17a5861a6e Migrated mediation_job_t to INIT/METHOD macros. 2011-10-03 18:47:25 +02:00
Martin Willi e6816e4670 Add missing semicolon 2011-09-12 13:01:40 +02:00
Martin Willi 8e3f14baab bus->listen() and the controller wrappers accept a timeout to wait for callbacks 2011-08-26 10:44:25 +02:00
Tobias Brunner 4bbce1ef37 Replaced ike_sa_t.create_child_sa_iterator with enumerator. 
This required two new methods on ike_sa_t. One returns the number of
CHILD_SAs and one allows to remove a CHILD_SA.
 2011-07-06 09:43:45 +02:00
Andreas Steffen f87991704e implemented PASS and DROP shunt policies 2011-06-28 19:42:54 +02:00
Martin Willi 69c3eca0e9 Added a non-blocking, skipping variant of IKE_SA enumerator 2011-05-16 15:24:13 +02:00
Martin Willi 06f0ede759 Use high priority for retransmit/dpd/keepalive jobs 2011-05-16 15:24:13 +02:00
Martin Willi ea69c70d0e Use job priorities in process_message job based on exchange types 2011-05-16 15:24:13 +02:00