aboutsummaryrefslogtreecommitdiffstats
path: root/src/charon-tkm
Commit message (Collapse)AuthorAgeFilesLines
* charon-tkm: Call esa_reset() when the inbound SA is deletedTobias Brunner2017-08-074-16/+40
| | | | | | | | | After a rekeying the outbound SA and policy is deleted immediately, however, the inbound SA is not removed until a few seconds later, so delayed packets can still be processed. This adds a flag to get_esa_id() that specifies the location of the given SPI.
* charon-tkm: Remove unused get_other_esa_id() methodTobias Brunner2017-08-073-101/+0
|
* charon-tkm: Don't select new outbound SA until the policy is installedTobias Brunner2017-08-071-22/+40
| | | | | | | | | This tries to avoid packet loss during rekeying by delaying the usage of the new outbound IKE_SA until the old one is deleted. Note that esa_select() is a no-op in the current TKM implementation. And the implementation also doesn't benefit from the delayed deletion of the inbound SA as it calls esa_reset() when the outbound SA is deleted.
* charon-tkm: Claim to support SPIs on policiesTobias Brunner2017-08-071-0/+7
| | | | | This fixes rekeying as the delayed installation of the outbound SA caused the nonce context to be expired already.
* charon-tkm: Return cloned host from tkm_kernel_sad_t::get_dst_host()Tobias Brunner2017-06-143-2/+4
| | | | | When an expire is triggered while rekeying, the CHILD_SA might be deleted while the returned host is still used to queue a rekey job for the CHILD_SA.
* linked-list: Change return value of find_first() and signature of its callbackTobias Brunner2017-05-261-50/+47
| | | | This avoids the unportable five pointer hack.
* tkm: Fix get_auth_octets() signatureTobias Brunner2017-02-131-1/+2
| | | | Fixes: 267c1f7083d4 ("keymat: Allow keymat to modify signature scheme(s)")
* daemon: Use separate method to set default loggersTobias Brunner2017-01-252-2/+2
| | | | | This way it is not necessary to pass the same values to reload the loggers.
* gmp: Support of SHA-3 RSA signaturesAndreas Steffen2016-09-221-1/+1
|
* charon-tkm: Build C code with debug informationTobias Brunner2016-09-201-1/+2
|
* charon-tkm: Free name of the PID fileTobias Brunner2016-09-201-0/+1
|
* charon-tkm: Deinitialize tkm before libstrongswanTobias Brunner2016-09-201-1/+1
| | | | In particular because of leak-detective.
* kernel: Use structs to pass information to the kernel-ipsec interfaceTobias Brunner2016-04-091-48/+39
|
* Use standard unsigned integer typesAndreas Steffen2016-03-248-52/+52
|
* libhydra: Remove empty unused libraryTobias Brunner2016-03-033-19/+2
|
* libhydra: Move kernel interface to libcharonTobias Brunner2016-03-032-6/+3
| | | | This moves hydra->kernel_interface to charon->kernel.
* sigwaitinfo() may fail with EINTR if interrupted by an unblocked signal not ↵Tobias Brunner2015-11-231-5/+4
| | | | | | in the set Fixes #1213.
* charon-tkm: Register SPI generator callbackAdrian-Ken Rueegsegger2015-11-111-0/+4
| | | | Set get_spi callback of IKE SA manager to TKM-specific implementation.
* charon-tkm: Implement SPI generatorAdrian-Ken Rueegsegger2015-11-112-0/+134
| | | | | The get_spi callback returns a random SPI with a label encoded according to the spi_label and spi_mask parameters read from the strongswan.conf.
* kernel-interface: Pass the same data to del_policy() that was passed to ↵Tobias Brunner2015-11-101-3/+4
| | | | | | | add_policy() The additional data can be helpful to identify the exact policy to delete.
* Fix typo in error handling for sigwaitinfo() in charon-systemd and charon-tkmTobias Brunner2015-10-291-1/+1
| | | | Fixes 858148092d1e ("Replace usages of sigwait(3) with sigwaitinfo(2)")
* Replace usages of sigwait(3) with sigwaitinfo(2)Tobias Brunner2015-10-291-5/+5
| | | | | | | This is basically the same call, but it has the advantage of being supported by FreeBSD's valgrind, which sigwait() is not. References #1106.
* unit-tests: Forward variable argument list in TEST_SUITE_DEPENDMartin Willi2015-07-121-2/+2
| | | | | For some plugin features, such as crypters or AEADs, we have some additional feature arguments, such as the key size.
* charon-tkm: Also store local SPI in SADAdrian-Ken Rueegsegger2015-05-044-27/+36
|
* charon-tkm: Reset stale nonce contextsReto Buerki2015-05-042-18/+30
| | | | | | | | | | | If the nonce generator detects a stale nonce upon destroy(), it resets the context in the TKM and releases associated resources in the ID manager and chunk map. Also, do not acquire the nonce context ID in tkm_nonceg_create function but rather when the nonce is actually created by get_nonce(). The nonces created with get_nonce must also be registered in the chunk map.
* charon-tkm: Drop unneeded nonceg get_id functionReto Buerki2015-05-043-16/+0
|
* charon-tkm: Remove ESA nonce mappings from chunk mapAdrian-Ken Rueegsegger2015-05-041-0/+2
|
* charon-tkm: Drop obsolete TKM_LIMIT defineReto Buerki2015-05-041-2/+0
|
* charon-tkm: Select other ESA if any is present upon deletionAdrian-Ken Rueegsegger2015-05-041-1/+12
| | | | | In the case that multiple ESAs exist (e.g. rekey collision) for a security policy, make sure to select one of the remaining ESAs.
* charon-tkm: Add get_other_esa_id function to TKM kernel SADAdrian-Ken Rueegsegger2015-05-043-0/+103
| | | | | The function gets the ESA id for another entry associated with the same security policy as the specified ESA.
* charon-tkm: Only skip creation of first child SAAdrian-Ken Rueegsegger2015-05-041-0/+9
| | | | | | Use the new is_first boolean parameter of the ALERT_KEEP_ON_CHILD_SA_FAILURE alert to determine if the failure was caused by the first CHILD SA.
* charon-tkm: Fix SAD insertion when adding ESAAdrian-Ken Rueegsegger2015-05-041-1/+1
| | | | | Commit f5fc592 added the reqid to the SAD. The insert call swapped the order of the esa_id and reqid parameters.
* aead: Create AEAD using traditional transforms with an explicit IV generatorMartin Willi2015-04-131-4/+11
| | | | | | Real AEADs directly provide a suitable IV generator, but traditional crypters do not. For some (stream) ciphers, we should use sequential IVs, for which we pass an appropriate generator to the AEAD wrapper.
* diffie-hellman: Add a bool return value to set_other_public_value()Martin Willi2015-03-232-5/+3
|
* diffie-hellman: Add a bool return value to get_my_public_value()Martin Willi2015-03-233-3/+4
|
* diffie-hellman: Use bool instead of status_t as get_shared_secret() return valueMartin Willi2015-03-231-2/+2
| | | | | While such a change is not unproblematic, keeping status_t makes the API inconsistent once we introduce return values for the public value operations.
* kernel-interface: Add a separate "update" flag to add_sa()Martin Willi2015-03-091-1/+1
| | | | | | | | | | | The current "inbound" flag is used for two purposes: To define the actual direction of the SA, but also to determine the operation used for SA installation. If an SPI has been allocated, an update operation is required instead of an add. While the inbound flag normally defines the kind of operation required, this is not necessarily true in all cases. On the HA passive node, we install inbound SAs without prior SPI allocation.
* tkm: Use the inbound flag do determine peer role in CHILD_SA exchangeMartin Willi2015-03-091-5/+1
| | | | | This was not available during initial implementation, but fits just fine to avoid reconstructing the peer role.
* tkm: Disable RFC 7427 signature authenticationTobias Brunner2015-03-091-0/+4
| | | | | | TKM can't verify such signatures so we'd fail in the authorize hook. Skipping the algorithm identifier doesn't help if the peer uses anything other than SHA-1, so config changes would be required.
* tkm: Implement hash algorithm storage methods of keymat_v2_t interfaceTobias Brunner2015-03-041-0/+29
|
* charon-tkm: Use get_dst_host getter in EES callbackReto Buerki2015-02-201-4/+14
| | | | | | Use the new get_dst_host getter to retrieve the destination host from the SAD using the reqid, spi and protocol values received from the xfrm-proxy.
* charon-tkm: Add get_dst_host getter to SADReto Buerki2015-02-203-0/+79
| | | | | This function returns the destination host of an SAD entry for given reqid, spi and protocol arguments or NULL if not found.
* charon-tkm: Improve SAD get_esa_id log messagesReto Buerki2015-02-201-4/+4
|
* charon-tkm: Store reqid in SADReto Buerki2015-02-204-15/+26
|
* charon-tkm: Store remote SPI in SADReto Buerki2015-02-201-1/+1
| | | | | | | | | Store the remote instead of the local SPI in the SAD when adding a new entry in the kernel plugin's add_sa() function. Since only one ESA context must be destroyed for an inbound/outbound CHILD SA pair, it does not matter which SPI is used to retrieve it in the del_sa function.
* charon-tkm: Make CHILD/ESP SA database publicReto Buerki2015-02-203-22/+15
| | | | | Make the CHILD/ESP SA database a public member of the global tkm_t struct.
* charon-tkm: Fix logger entity name in tests.cReto Buerki2015-02-201-2/+2
| | | | Change 'test_runner' to 'test-runner'.
* charon-tkm: Fix compilation of ees_callback.cReto Buerki2015-02-201-3/+5
| | | | | | Update the call to hydra->kernel_interface->expire to make ees_callback.c compile again. The required destination host argument is set to NULL for now.
* kernel-interface: Pass full list of traffic selectors to add_sa()Martin Willi2015-02-201-1/+1
| | | | | | While we can handle the first selector only in BEET mode in kernel-netlink, passing the full list gives the backend more flexibility how to handle this information.
* kernel-interface: Remove reqid parameter from get_spi/get_cpi() methodsMartin Willi2015-02-201-3/+2
| | | | | | | | | | The reqid is not strictly required, as we set the reqid with the update call when installing the negotiated SA. If we don't need a reqid at this stage, we can later allocate the reqid in the kernel backend once the SA parameters have been fully negotaited. This allows us to assign the same reqid for the same selectors to avoid conflicts on backends this is necessary.
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-11 15:38:14 +0000