aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
| * attribute-handler: Pass full IKE_SA to handler backendsMartin Willi2015-02-2010-79/+61
| |
| * attribute-provider: Pass full IKE_SA to provider backendsMartin Willi2015-02-2010-65/+55
| |
| * attribute-manager: Pass full IKE_SA to handler methodsMartin Willi2015-02-205-23/+28
| |
| * attribute-manager: Pass the full IKE_SA to provider methodsMartin Willi2015-02-205-23/+32
| |
| * unit-tester: Drop the old unit-tester libcharon pluginMartin Willi2015-02-2014-957/+0
| | | | | | | | | | | | While it has some tests that we don't directly cover with the new unit tests, most of them require special infrastructure and therefore have not been used for a long time.
| * attributes: Move the configuration attributes framework to libcharonMartin Willi2015-02-2040-129/+119
| |
| * libcharon: Add a test runnerMartin Willi2015-02-206-0/+97
| |
| * attr-sql: Move plugin to libcharonMartin Willi2015-02-209-13/+16
| |
| * attr: Move plugin to libcharonMartin Willi2015-02-209-15/+13
| |
| * resolve: Move plugin back to libcharonMartin Willi2015-02-208-12/+11
|/ | | | Since pluto is gone, all existing users build upon libcharon.
* Merge branch 'tkm-reqid-alloc'Martin Willi2015-02-2022-46/+266
|\ | | | | | | | | Fixes expires raised by charon-tkm to actually use a proto/dst/SPI tuple to identify CHILD_SAs.
| * testing: Add tkm xfrmproxy-expire testReto Buerki2015-02-2011-0/+121
| | | | | | | | | | | | This test asserts that the handling of XFRM expire messages from the kernel are handled correctly by the xfrm-proxy and the Esa Event Service (EES) in charon-tkm.
| * testing: Assert ees acquire messages in xfrmproxy testsReto Buerki2015-02-202-0/+2
| |
| * charon-tkm: Use get_dst_host getter in EES callbackReto Buerki2015-02-201-4/+14
| | | | | | | | | | | | Use the new get_dst_host getter to retrieve the destination host from the SAD using the reqid, spi and protocol values received from the xfrm-proxy.
| * charon-tkm: Add get_dst_host getter to SADReto Buerki2015-02-203-0/+79
| | | | | | | | | | This function returns the destination host of an SAD entry for given reqid, spi and protocol arguments or NULL if not found.
| * charon-tkm: Improve SAD get_esa_id log messagesReto Buerki2015-02-201-4/+4
| |
| * charon-tkm: Store reqid in SADReto Buerki2015-02-204-15/+26
| |
| * charon-tkm: Store remote SPI in SADReto Buerki2015-02-201-1/+1
| | | | | | | | | | | | | | | | | | Store the remote instead of the local SPI in the SAD when adding a new entry in the kernel plugin's add_sa() function. Since only one ESA context must be destroyed for an inbound/outbound CHILD SA pair, it does not matter which SPI is used to retrieve it in the del_sa function.
| * charon-tkm: Make CHILD/ESP SA database publicReto Buerki2015-02-203-22/+15
| | | | | | | | | | Make the CHILD/ESP SA database a public member of the global tkm_t struct.
| * charon-tkm: Fix logger entity name in tests.cReto Buerki2015-02-201-2/+2
| | | | | | | | Change 'test_runner' to 'test-runner'.
| * testing: Assert proper ESA deletionReto Buerki2015-02-201-0/+4
|/ | | | | Extend the tkm/host2host-initiator testcase by asserting proper ESA deletion after connection shutdown.
* Merge branch 'reqid-alloc'Martin Willi2015-02-2073-529/+1798
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | With these changes, charon dynamically allocates reqids for CHILD_SAs. This allows the reuse of reqids for identical policies, and basically allows multiple CHILD_SAs with the same selectors. As reqids do not uniquely define a CHILD_SA, a new unique identifier for CHILD_SAs is introduced, and the kernel backends use a proto/dst/SPI tuple to identify CHILD_SAs. charon-tkm is not yet updated and expires are actually broken with this merge. As some significant refactorings are required, this is fixed using a separate merge. References #422, #431, #463.
| * ike: Consistently log CHILD_SAs with their unique_id instead of their reqidMartin Willi2015-02-208-11/+13
| |
| * unity: Reference IKE_SAs by the IKEv1 COOKIEs, improving lookup performanceMartin Willi2015-02-203-14/+17
| | | | | | | | | | When handling thousands of IKE_SAs, the unique ID based lookup is rather slow, as we have no indexing.
| * ike-sa-manager: Remove IKE_SA checkout by CHILD_SA reqidMartin Willi2015-02-205-40/+16
| |
| * migrate-job: Do CHILD_SA reqid lookup locallyMartin Willi2015-02-202-26/+21
| |
| * kernel-interface: Raise mapping event with a proto/SPI/dst tupleMartin Willi2015-02-208-41/+75
| |
| * inactivity-job: Schedule job by CHILD_SA unique ID instead of reqidMartin Willi2015-02-204-23/+17
| |
| * charon-tkm: Fix compilation of ees_callback.cReto Buerki2015-02-201-3/+5
| | | | | | | | | | | | Update the call to hydra->kernel_interface->expire to make ees_callback.c compile again. The required destination host argument is set to NULL for now.
| * kernel-interface: Raise expires with a proto/SPI/dst tuple instead of reqidMartin Willi2015-02-2020-118/+124
| |
| * controller: Use the CHILD_SA unique_id to terminate CHILD_SAsMartin Willi2015-02-206-38/+24
| |
| * swanctl: List CHILD_SA unique ID as the primary identifier, but print reqid, tooMartin Willi2015-02-201-2/+2
| |
| * stroke: List CHILD_SA unique ID as the primary identifier, but print reqid, tooMartin Willi2015-02-201-5/+6
| |
| * vici: Include the CHILD_SA unique ID in list-sa eventMartin Willi2015-02-202-0/+2
| |
| * ike: Maintain per-IKE_SA CHILD_SAs in the global CHILD_SA managerMartin Willi2015-02-203-19/+92
| |
| * child-sa-manager: Add a global manager storing CHILD_SA relationsMartin Willi2015-02-206-1/+432
| | | | | | | | | | | | To quickly check out IKE_SAs and find associated CHILD_SAs, the child_sa_manager stores relations between CHILD_SAs and IKE_SAs. It provides CHILD_SA specific IKE_SA checkout functions wrapping the ike_sa_manager.
| * child-sa: Replace reqid based marks by "unique" marksMartin Willi2015-02-2013-74/+126
| | | | | | | | | | | | | | | | | | | | | | As we now use the same reqid for multiple CHILD_SAs with the same selectors, having marks based on the reqid makes not that much sense anymore. Instead we use unique marks that use a custom identifier. This identifier is reused during rekeying, keeping the marks constant for any rule relying on it (for example installed by updown). This also simplifies handling of reqid allocation, as we do not have to query the marks that is not yet assigned for an unknown reqid.
| * child-sa: Introduce a unique CHILD_SA identifierMartin Willi2015-02-202-0/+24
| | | | | | | | | | As the reqid is not that unique even among multiple IKE_SAs anymore, we need an identifier to uniquely identify a specific CHILD_SA instance.
| * child-sa: Delegate reqid allocation to the kernel interfaceMartin Willi2015-02-201-15/+46
| |
| * kernel-interface: Add reqid allocation and release functionsMartin Willi2015-02-202-1/+329
| | | | | | | | | | | | | | | | | | To reassign reqids where appropriate, we explicitly allocate or confirm them centrally on the kernel-interface. Currently the state is stored in the kernel-interface wrapper for all backends, but we may add appropriate methods to each backend to implement a custom reqid allocation logic, if required.
| * traffic-selector: Add a hash() methodMartin Willi2015-02-202-0/+20
| |
| * child-sa: Sort traffic selectors after adding CHILD_SA policiesMartin Willi2015-02-201-0/+3
| | | | | | | | Having traffic selectors sorted properly makes comparing them much simpler.
| * unit-tests: Add an initial set of traffic selector unit testsMartin Willi2015-02-203-0/+281
| |
| * traffic-selector: Add a compare function to sort traffic selectorsMartin Willi2015-02-202-34/+86
| |
| * child-sa: Remove the obsolete update logicMartin Willi2015-02-201-6/+1
| | | | | | | | | | | | The kernel backend uses an inbound parameter these days, where it makes no sense to pass the update flag. The kernel backend decides itself how it handles SA installation based on the inbound flag.
| * kernel-interface: Pass full list of traffic selectors to add_sa()Martin Willi2015-02-2011-34/+28
| | | | | | | | | | | | While we can handle the first selector only in BEET mode in kernel-netlink, passing the full list gives the backend more flexibility how to handle this information.
| * libipsec: Remove unused src/dst_ts parameters from ipsec_sa_mgr_t.add_sa()Martin Willi2015-02-206-18/+7
| |
| * kernel-pfkey: Don't update during add_sa(), but delete SPI allocation stateMartin Willi2015-02-201-7/+18
| |
| * kernel-interface: Remove reqid parameter from get_spi/get_cpi() methodsMartin Willi2015-02-2011-56/+43
| | | | | | | | | | | | | | | | | | | | The reqid is not strictly required, as we set the reqid with the update call when installing the negotiated SA. If we don't need a reqid at this stage, we can later allocate the reqid in the kernel backend once the SA parameters have been fully negotaited. This allows us to assign the same reqid for the same selectors to avoid conflicts on backends this is necessary.
| * libipsec: Remove unused reqid parameter from ipsec_sa_mgr_t.get_spi()Martin Willi2015-02-194-9/+6
|/
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-14 06:53:31 +0000