denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
8,863 Commits 1 Branch 0 Tags
bc798c9ce8d4b6b214d9f6a01bd97b1d854c3bba
Commit Graph
138 Commits
Author SHA1 Message Date
Tobias Brunner bc798c9ce8 Route reinstallation in kernel_ipsec_t implementations is not needed anymore. 2012-05-02 15:24:47 +02:00
Tobias Brunner f834249c59 Reinstall routes in kernel-netlink plugin, if interfaces get reactivated or IPs reappear. 2012-05-02 15:24:47 +02:00
Tobias Brunner 74ba22c992 Keep track of installed source routes in kernel-netlink plugin. 2012-05-02 14:56:08 +02:00
Martin Willi b24be29646 Merge branch 'ikev1' 
Conflicts:
	configure.in
	man/ipsec.conf.5.in
	src/libcharon/encoding/generator.c
	src/libcharon/encoding/payloads/notify_payload.c
	src/libcharon/encoding/payloads/notify_payload.h
	src/libcharon/encoding/payloads/payload.c
	src/libcharon/network/receiver.c
	src/libcharon/sa/authenticator.c
	src/libcharon/sa/authenticator.h
	src/libcharon/sa/ikev2/tasks/ike_init.c
	src/libcharon/sa/task_manager.c
	src/libstrongswan/credentials/auth_cfg.c
 2012-05-02 11:12:31 +02:00
Tobias Brunner ed2cab08d2 Make resolvconf interface prefix configurable. 2012-03-27 10:44:21 +02:00
Tobias Brunner caae5a5c0f Added support for the resolvconf framework in resolve plugin. 
If /sbin/resolvconf is found nameservers are not written directly to
/etc/resolv.conf but instead resolvconf is invoked.
 2012-03-27 10:44:21 +02:00
Tobias Brunner 6e921f2017 Use single DBG2 statements in kernel_netlink plugin (i.e. ignore mark.value). 2012-03-27 10:37:56 +02:00
Martin Willi b1f2f05c92 Merge branch 'ikev1-clean' into ikev1-master 
Conflicts:
	configure.in
	man/ipsec.conf.5.in
	src/libcharon/daemon.c
	src/libcharon/plugins/eap_ttls/eap_ttls_peer.c
	src/libcharon/plugins/eap_radius/eap_radius_accounting.c
	src/libcharon/plugins/eap_radius/eap_radius_forward.c
	src/libcharon/plugins/farp/farp_listener.c
	src/libcharon/sa/ike_sa.c
	src/libcharon/sa/keymat.c
	src/libcharon/sa/task_manager.c
	src/libcharon/sa/trap_manager.c
	src/libstrongswan/plugins/x509/x509_cert.c
	src/libstrongswan/utils.h

Applied lost changes of moved files keymat.c and task_manager.c.
Updated listener_t.message hook signature in new plugins.
 2012-03-20 17:57:53 +01:00
Martin Willi 07202a2bf1 Be less verbose when deleting SAs triggered by a hard expire 2012-03-20 17:31:31 +01:00
Tobias Brunner 686cfd4e34 Added support for untruncated MD5 and SHA1 HMACs in ESP as used in RFC 4595. 
This requires a Linux kernel >= 2.6.33.
 2012-02-27 14:31:19 +01:00
Tobias Brunner 35a1986142 Fixed additional typos in comments and log messages. 2012-01-12 11:42:42 +01:00
Thomas Egerer 64c4fd0a60 Always unlock mutex for installed policies in kernel-netlink plugin. 2011-12-14 18:17:49 +01:00
Thomas Jarosch 00b9e598f3 Fix copy'n'paste error in libhydra's netlink interface 
Detected by cppcheck.
 2011-11-21 09:00:39 +01:00
Mirko Parthey 7b21873668 Fix network interface deletion handling in kernel-netlink plugin. 
When the kernel reports the deletion of an interface (RTM_DELLINK),
the cached interface attributes, including ifindex, become invalid
and must be forgotten.

Interface link state changes ("up" and "down") show up as RTM_NEWLINK,
so they will not cause a cached entry to be removed or
prevent listening to address change notifications.

Once an interface has been deleted, the kernel ought to stop sending
notifications for it. If the interface gets recreated with the same
name later, the kernel again reports RTM_NEWLINK, which causes a new
cache entry to be created.

There should be no reason to keep a stale cache entry around, as was
claimed in the comment.
 2011-11-14 15:24:48 +01:00
Tobias Brunner 866858527d Fix 'ipsec pool --status' for empty pools. 2011-11-04 15:07:54 +01:00
Thomas Egerer c125d1ba13 Memwipe request after sa update, too 2011-11-04 11:11:17 +01:00
Thomas Egerer dbfd1a63aa Extend xfrm_attr_type_names by newly added enum values 2011-11-04 11:11:17 +01:00
Tobias Brunner 051226d5c0 Silently install route again, even if it did not change. 
Address/interface changes can cause the route to disappear. Afterwards
the route might look the same but that does not mean it is still installed.
 2011-11-04 11:11:17 +01:00
Tobias Brunner 25d59e9e2d Compile warning fixed in kernel interfaces. 2011-11-04 11:11:17 +01:00
Tobias Brunner 0e6aafb5b6 The kernel-klips plugin does currently not support SAD/SPD flushing. 2011-10-21 14:24:33 +02:00
Tobias Brunner 773572f9e0 Implemented flushing of SAD and SPD entries via PF_KEY. 2011-10-21 14:24:33 +02:00
Tobias Brunner 99d23ddf45 Implemented flushing of states and policies via XFRM. 2011-10-21 14:18:53 +02:00
Martin Willi 3b62d5bad8 Add features support to kernel-klips plugin 2011-10-14 10:05:48 +02:00
Martin Willi 8da1f9f25d Add features support to kernel-pfroute plugin 2011-10-14 10:05:48 +02:00
Martin Willi e99cb0673d Add features support to kernel-pfkey plugin 2011-10-14 10:05:47 +02:00
Martin Willi 278e5f3d7a Add features support to kernel-netlink plugin 2011-10-14 10:05:47 +02:00
Tobias Brunner 439cb93ce9 Check for RTA_TABLE in configure. 2011-10-04 18:46:51 +02:00
Andreas Steffen 784ce91d8b Migrated sql_attribute to INIT/METHOD macros 2011-09-29 23:35:32 +02:00
Andreas Steffen 07e62fd7a6 Migrated netlink_socket to INIT/METHOD macros 2011-09-29 23:24:51 +02:00
Andreas Steffen 769b490e05 Migrated resolve_handler to INIT/METHOD macros 2011-09-29 23:15:49 +02:00
Tobias Brunner 0057427008 Disable policy history for pluto. 
pluto tracks usage of policies already in its own way.
 2011-08-02 18:34:49 +02:00
Tobias Brunner 2e370a300d Allow routing table IDs > 255 when filtering them. 2011-07-29 12:16:18 +02:00
Tobias Brunner d7a59f1976 Install fallback drop policies to avoid transmitting unencrypted packets. 
During the update of a CHILD_SA (e.g. caused by MOBIKE) the old policy
is first uninstalled and then the new one is installed.  In the short
time in between, where no policy is available in the kernel, unencrypted
packets could have been transmitted.
 2011-07-27 13:44:33 +02:00
Tobias Brunner fbedc6a45b Remove policies in kernel interfaces based on their priority. 
This allows to unroute a connection while the same connection is
currently established.  In this case both CHILD_SAs share the same
reqid but the installed policies have different priorities.
 2011-07-27 13:41:35 +02:00
Tobias Brunner f3bb1bd039 Fixed common misspellings. 
Mostly found by 'codespell'.
 2011-07-20 16:14:10 +02:00
Andreas Steffen cad259e349 removed stray code 2011-07-18 10:22:29 +02:00
Andreas Steffen 6101ee9b06 added log and status output for ESN 2011-07-16 11:09:38 +02:00
Tobias Brunner 17927ca615 Record usage history of policies in PF_KEY kernel interface. 
The implementation is nearly the same as in the Netlink kernel interface.
 2011-07-06 12:56:34 +02:00
Tobias Brunner 4e9e4372f5 Simplified destruction of policy_sa_t objects in Netlink interface. 2011-07-06 12:49:54 +02:00
Tobias Brunner 674bc34322 Some code cleanup in Netlink kernel interface. 2011-07-06 09:43:46 +02:00
Tobias Brunner 108357b106 Some code cleanup in PF_KEY kernel interface. 2011-07-06 09:43:46 +02:00
Tobias Brunner 9f49464d56 Reduce memory usage of policy history caching. 
Only cache data as needed (e.g. traffic selectors only for forward
policies) and at most once for each IPsec SA.
 2011-07-06 09:43:46 +02:00
Tobias Brunner c225f9b558 Keep the mutex locked as long as possible when deleting policies. 
This change tries to prevent a race condition where a thread tries to
install the same policy another thread is currently deleting. If the
second thread releases the mutex in del_policy too early the first
thread could assume the policy does not exist (as it is not cached
anymore) but would not be able to actually install it if the second
thread was not yet able to delete it.
 2011-07-06 09:43:46 +02:00
Tobias Brunner bd4f7dab75 Properly unlock the policy if no change in the kernel is required. 2011-07-06 09:43:46 +02:00
Tobias Brunner 32fbad4ec2 Make sure access to policy is thread-safe during installation of route. 2011-07-06 09:43:46 +02:00
Tobias Brunner e26304348c Replaced simple iterator usages. 2011-07-06 09:43:45 +02:00
Tobias Brunner f0ba8ae042 Record the history of a policy installed in the kernel. 
This allows to properly delete a policy e.g. if reauth=yes and
auto=route, because reqids are increased during reauthentication.

It also avoids overriding an installed policy with a trap policy.
 2011-07-06 09:43:45 +02:00
Tobias Brunner 328f22e1d3 Add the reqid to kernel_ipsec_t.del_policy. 2011-07-06 09:43:45 +02:00
Tobias Brunner 3ee8fed445 Cache the most recent reqid in the PF_KEY kernel interface. 
This makes the PF_KEY kernel interface behave the same as the Netlink
kernel interface.
 2011-07-06 09:43:45 +02:00
Andreas Steffen 06b5b61838 install PASS and DROP shunt policies via PFKEYv2 interface 2011-07-05 21:57:45 +02:00