denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
10,025 Commits 1 Branch 0 Tags
f05b427265e20ccb43889094e4c58c1a5bf3e290
Commit Graph
65 Commits
Author SHA1 Message Date
Tobias Brunner f05b427265 Moved debug.[ch] to utils folder 2012-10-24 16:00:51 +02:00
Tobias Brunner 12642a6831 Moved data structures to new collections subfolder 2012-10-24 16:00:49 +02:00
Tobias Brunner 8e2d3075aa Use proper offset when adding mark attribute in kernel-netlink plugin 2012-10-15 11:11:29 +02:00
Tobias Brunner ac24c4d323 Also add mark when querying current replay state in kernel-netlink plugin 2012-10-15 10:15:53 +02:00
Tobias Brunner 2925aa725e Fixed update_sa in kernel-netlink plugin if marks are used 2012-10-11 19:08:47 +02:00
Tobias Brunner a37ac3a47a Make sure we successfully opened xfrm_acq_expires 2012-09-28 18:54:28 +02:00
Tobias Brunner 6ffb8f8634 Clarified code when hashing/comparing cached policies in kernel-netlink 2012-09-28 18:30:16 +02:00
Tobias Brunner 9a1ba213f4 Use proper argument for sizeof when copying replay state 2012-09-28 17:00:20 +02:00
Tobias Brunner bef21bd330 Algorithm names are not always static anymore, avoid string overflows 2012-09-28 16:49:05 +02:00
Tobias Brunner a79af394a0 Allow replay windows smaller than the default of 32 2012-09-27 12:43:39 +02:00
Tobias Brunner f65ec0aa90 Make sure the if_name member of cached route entries is initialized to NULL 2012-09-22 08:23:56 +02:00
Tobias Brunner 9ba36c0f7f Make it easy to check if an address is locally usable via changed get_interface() method 2012-09-21 18:16:26 +02:00
Tobias Brunner dad6d904ee Use source address in get_nexthop() call 
Otherwise the nexthop returned might belong to a different route than
the one actually used with the current source address.
 2012-09-21 18:16:25 +02:00
Tobias Brunner 08ad639f32 Added algorithm lookup via kernel_interface_t to the various kernel interfaces 2012-09-13 15:48:49 +02:00
Tobias Brunner fa96a350c2 Consistently log XFRM mark masks with 0 prefix in kernel-netlink plugin 2012-09-12 17:40:36 +02:00
Tobias Brunner e49abcede0 Let kernel interfaces decide how to enable UDP decapsulation of ESP packets. 2012-08-08 15:12:24 +02:00
Tobias Brunner 26d77eb3e6 Centralized thread cancellation in processor_t 
This ensures that no threads are active when plugins and the rest of the
daemon are unloaded.

callback_job_t was simplified a lot in the process as its main
functionality is now contained in processor_t.  The parent-child
relationships were abandoned as these were only needed to simplify job
cancellation.
 2012-06-25 17:38:59 +02:00
Tobias Brunner 9896b6bd58 Don't compare ports when comparing cached routes. 
At least src_ip has a port set sometimes.
 2012-06-15 16:44:07 +02:00
Tobias Brunner 05ca56558c Disabled listening for kernel events in starter. 2012-06-08 14:12:06 +02:00
Tobias Brunner bc798c9ce8 Route reinstallation in kernel_ipsec_t implementations is not needed anymore. 2012-05-02 15:24:47 +02:00
Tobias Brunner 6e921f2017 Use single DBG2 statements in kernel_netlink plugin (i.e. ignore mark.value). 2012-03-27 10:37:56 +02:00
Martin Willi b1f2f05c92 Merge branch 'ikev1-clean' into ikev1-master 
Conflicts:
	configure.in
	man/ipsec.conf.5.in
	src/libcharon/daemon.c
	src/libcharon/plugins/eap_ttls/eap_ttls_peer.c
	src/libcharon/plugins/eap_radius/eap_radius_accounting.c
	src/libcharon/plugins/eap_radius/eap_radius_forward.c
	src/libcharon/plugins/farp/farp_listener.c
	src/libcharon/sa/ike_sa.c
	src/libcharon/sa/keymat.c
	src/libcharon/sa/task_manager.c
	src/libcharon/sa/trap_manager.c
	src/libstrongswan/plugins/x509/x509_cert.c
	src/libstrongswan/utils.h

Applied lost changes of moved files keymat.c and task_manager.c.
Updated listener_t.message hook signature in new plugins.
 2012-03-20 17:57:53 +01:00
Martin Willi 07202a2bf1 Be less verbose when deleting SAs triggered by a hard expire 2012-03-20 17:31:31 +01:00
Tobias Brunner 686cfd4e34 Added support for untruncated MD5 and SHA1 HMACs in ESP as used in RFC 4595. 
This requires a Linux kernel >= 2.6.33.
 2012-02-27 14:31:19 +01:00
Thomas Egerer 64c4fd0a60 Always unlock mutex for installed policies in kernel-netlink plugin. 2011-12-14 18:17:49 +01:00
Thomas Egerer c125d1ba13 Memwipe request after sa update, too 2011-11-04 11:11:17 +01:00
Thomas Egerer dbfd1a63aa Extend xfrm_attr_type_names by newly added enum values 2011-11-04 11:11:17 +01:00
Tobias Brunner 051226d5c0 Silently install route again, even if it did not change. 
Address/interface changes can cause the route to disappear. Afterwards
the route might look the same but that does not mean it is still installed.
 2011-11-04 11:11:17 +01:00
Tobias Brunner 25d59e9e2d Compile warning fixed in kernel interfaces. 2011-11-04 11:11:17 +01:00
Tobias Brunner 99d23ddf45 Implemented flushing of states and policies via XFRM. 2011-10-21 14:18:53 +02:00
Tobias Brunner 0057427008 Disable policy history for pluto. 
pluto tracks usage of policies already in its own way.
 2011-08-02 18:34:49 +02:00
Tobias Brunner d7a59f1976 Install fallback drop policies to avoid transmitting unencrypted packets. 
During the update of a CHILD_SA (e.g. caused by MOBIKE) the old policy
is first uninstalled and then the new one is installed.  In the short
time in between, where no policy is available in the kernel, unencrypted
packets could have been transmitted.
 2011-07-27 13:44:33 +02:00
Tobias Brunner fbedc6a45b Remove policies in kernel interfaces based on their priority. 
This allows to unroute a connection while the same connection is
currently established.  In this case both CHILD_SAs share the same
reqid but the installed policies have different priorities.
 2011-07-27 13:41:35 +02:00
Andreas Steffen cad259e349 removed stray code 2011-07-18 10:22:29 +02:00
Andreas Steffen 6101ee9b06 added log and status output for ESN 2011-07-16 11:09:38 +02:00
Tobias Brunner 4e9e4372f5 Simplified destruction of policy_sa_t objects in Netlink interface. 2011-07-06 12:49:54 +02:00
Tobias Brunner 674bc34322 Some code cleanup in Netlink kernel interface. 2011-07-06 09:43:46 +02:00
Tobias Brunner 9f49464d56 Reduce memory usage of policy history caching. 
Only cache data as needed (e.g. traffic selectors only for forward
policies) and at most once for each IPsec SA.
 2011-07-06 09:43:46 +02:00
Tobias Brunner c225f9b558 Keep the mutex locked as long as possible when deleting policies. 
This change tries to prevent a race condition where a thread tries to
install the same policy another thread is currently deleting. If the
second thread releases the mutex in del_policy too early the first
thread could assume the policy does not exist (as it is not cached
anymore) but would not be able to actually install it if the second
thread was not yet able to delete it.
 2011-07-06 09:43:46 +02:00
Tobias Brunner bd4f7dab75 Properly unlock the policy if no change in the kernel is required. 2011-07-06 09:43:46 +02:00
Tobias Brunner 32fbad4ec2 Make sure access to policy is thread-safe during installation of route. 2011-07-06 09:43:46 +02:00
Tobias Brunner f0ba8ae042 Record the history of a policy installed in the kernel. 
This allows to properly delete a policy e.g. if reauth=yes and
auto=route, because reqids are increased during reauthentication.

It also avoids overriding an installed policy with a trap policy.
 2011-07-06 09:43:45 +02:00
Tobias Brunner 328f22e1d3 Add the reqid to kernel_ipsec_t.del_policy. 2011-07-06 09:43:45 +02:00
Martin Willi 14bf2f689d Use CRITICAL job priority class for long running dispatcher jobs 2011-05-16 15:24:15 +02:00
Tobias Brunner 38865eced3 Return correct status code in kernel_netlink_ipsec_t.query_sa. 2011-05-10 15:45:42 +02:00
Martin Willi f7812f6492 Wipe memory after using key material (incomplete, to be continued) 2011-05-09 14:36:15 +02:00
Martin Willi 05e9589783 Copy ESN enabled replay state during update_sa, if supported 2011-04-20 12:26:58 +02:00
Martin Willi ee8c89e2ee Add ESN support to kernel netlink plugin, including custom replay windows 2011-04-20 12:26:58 +02:00
Martin Willi 4876d4f3b3 Added an esn parameter to the kernel interface add_sa functions 2011-04-20 12:26:57 +02:00
Martin Willi 50110dfef8 Align netlink attributes properly if rta_len not a multiple of RTA_ALIGNTO 2011-03-02 16:07:38 +01:00