aboutsummaryrefslogtreecommitdiffstats
path: root/src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c
Commit message (Collapse)AuthorAgeFilesLines
* kernel-netlink: Add strings for newer XFRM attribute typesTobias Brunner2017-10-061-1/+6
|
* kernel-netlink: Set SPI on outbound policyTobias Brunner2017-08-071-4/+10
| | | | | This should cause the right SA to get used if there are multiple outbound SAs and the policies are installed properly.
* linked-list: Change interface of callback for invoke_function()Tobias Brunner2017-05-261-6/+15
| | | | This avoids the unportable five pointer hack.
* kernel-netlink: Use total retransmit timeout as acquire timeoutTobias Brunner2017-05-231-13/+0
| | | | | | | By using the total retransmit timeout, modifications of timeout settings automatically reflect on the value of xfrm_acq_expires. If set, the value of xfrm_acq_expires configured by the user takes precedence over the calculated value.
* kernel-netlink: Try to add new inbound SA if update failsThomas Egerer2017-05-231-3/+12
| | | | | | | | | | | | | | | When establishing a traffic-triggered CHILD_SA involves the setup of an IKE_SA more than one exchange is required. As a result the temporary acquire state may have expired -- even if the acquire expiration (xfrm_acq_expires) time is set properly (165 by default). The expire message sent by the kernel is not processed in charon since no trap can be found by the trap manager. A possible solution could be to track allocated SPIs. But since this is a corner case and the tracking introduces quite a bit of overhead, it seems much more sensible to add a new state if the update of a state fails with NOT_FOUND. Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
* kernel-netlink: Update hardware offload attribute when SAs are updatedTobias Brunner2017-05-231-11/+37
|
* kernel-netlink: Base SA update on correct message in multi-message responseTobias Brunner2017-05-231-7/+7
|
* kernel-netlink: Enable hardware offloading if configured for an SATobias Brunner2017-05-231-0/+25
|
* kernel: Make range of SPIs for IPsec SAs configurableTobias Brunner2017-03-021-3/+10
|
* kernel-netlink: Use the same priority range for trap and regular policiesTobias Brunner2017-02-081-14/+14
| | | | | | | | | | | | | While trap and regular policies now often look the same (mainly because reqids are kept constant) trap policies still need to have a lower priority than regular policies to handle unroute/route correctly if e.g. IPComp is used or the mode changes. But if we use a completely different priority range that's lower than that of regular policies it is not possible to install overlapping trap policies. By differentiating trap from regular policies via the priority's LSB this issue is avoided while still maintaining the proper ordering of trap and regular policies. Fixes #1243.
* kernel-netlink: Fix spacing in log message when policy is unchangedTobias Brunner2017-02-081-1/+1
|
* kernel-netlink: Use correct 4 byte alignment for AH with IPv4Tobias Brunner2017-01-251-0/+5
| | | | | | | | By default, the kernel incorrectly uses an 8 byte alignment, which is mandatory for IPv6 but prohibited for IPv4. For many algorithms this doesn't matter but that's not the case for HMAC_SHA2_256_128. Since 2.6.39 the kernel can be explicitly configured to use a 4 byte alignment.
* kernel-netlink: Return const pointer from lookup_algorithm()Thomas Egerer2017-01-231-3/+4
| | | | Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
* kernel-netlink: Add support for AES-CMAC-96 (RFC 4494)Tobias Brunner2016-12-121-0/+1
| | | | The kernel apparently supports this since 3.10.
* kernel-netlink: Pass zero mark to kernel if mask is setTobias Brunner2016-09-301-2/+2
| | | | | | The kernel will apply the mask to the mark on the packet and then compare it to the configured mark. So to match only unmarked packets we have to be able to set 0/0xffffffff.
* kernel-netlink: Support configuring XFRM policy hashing thresholdsTobias Brunner2016-09-301-0/+107
| | | | | | | | | | | | | | | | | | | | | | | | If the number of flows over a gateway exceeds the flow cache size of the Linux kernel, policy lookup gets very expensive. Policies covering more than a single address don't get hash-indexed by default, which results in wasting most of the cycles in xfrm_policy_lookup_bytype() and its xfrm_policy_match() use. Starting with several hundred policies the overhead gets inacceptable. Starting with Linux 3.18, Linux can hash the first n-bit of a policy subnet to perform indexed lookup. With correctly chosen netbits, this can completely eliminate the performance impact of policy lookups, freeing the resources for ESP crypto. WARNING: Due to a bug in kernels 3.19 through 4.7, the kernel crashes with a NULL pointer dereference if a socket policy is installed while hash thresholds are changed. And because the hashtable rebuild triggered by the threshold change that causes this is scheduled it might also happen if the socket policies are seemingly installed after setting the thresholds. The fix for this bug - 6916fb3b10b3 ("xfrm: Ignore socket policies when rebuilding hash tables") - is included since 4.8 (and might get backported). As a workaround `charon.plugins.kernel-netlink.port_bypass` may be enabled to replace the socket policies that allow IKE traffic with port specific bypass policies.
* kernel-netlink: Update cached reqid when updating policiesTobias Brunner2016-09-281-0/+2
|
* kernel-netlink: Don't set replay window for outbound SAsTobias Brunner2016-06-171-0/+6
| | | | | It's not necessary and might waste memory. However, if ESN is used we set the window to 1 as the kernel rejects the attribute otherwise.
* kernel-netlink: Install routes with OUT policiesTobias Brunner2016-06-101-25/+24
| | | | | This is the direction we actually need routes in and makes the code easier to read.
* kernel-netlink: Don't install routes for drop policies and if protocol/ports ↵Tobias Brunner2016-06-101-96/+106
| | | | | | | | | are in the selector We don't need them for drop policies and they might even mess with other routes we install. Routes for policies with protocol/ports in the selector will always be too broad and might conflict with other routes we install.
* kernel-netlink: Also use interface returned by get_nexthop() for IPsec policiesTobias Brunner2016-06-101-1/+2
|
* kernel-netlink: Use interface to next hop for shunt policiesTobias Brunner2016-06-101-10/+13
| | | | | | Using the source address to determine the interface is not correct for net-to-net shunts between two interfaces on which the host has IP addresses for each subnet.
* kernel-net: Let get_nexthop() return an optional interface nameTobias Brunner2016-06-101-2/+2
| | | | | The returned name should be the interface over which the destination address/net is reachable.
* kernel-netlink: Let only a single thread work on a specific policyTobias Brunner2016-06-101-25/+69
| | | | | | | | | | | | | Other threads are free to add/update/delete other policies. This tries to prevent race conditions caused by releasing the mutex while sending messages to the kernel. For instance, if break-before-make reauthentication is used and one thread on the responder is delayed in deleting the policies that another thread is concurrently adding for the new SA. This could have resulted in no policies being installed eventually. Fixes #1400.
* kernel-netlink: Add priority and refcount to policy logTobias Brunner2016-06-101-9/+30
|
* kernel-netlink: Consistently print mark in log messages only if setTobias Brunner2016-06-101-108/+82
|
* kernel-netlink: Provide error information for Netlink socketsTobias Brunner2016-06-101-14/+15
| | | | #1467.
* kernel-netlink: Allow definition of a custom priority calculation functionTobias Brunner2016-06-101-3/+16
|
* kernel-netlink: Use ipsec_sa_cfg_equals() and compare marks properlyTobias Brunner2016-06-081-2/+3
|
* kernel-netlink: Order policies with equal priorities by their automatic priorityTobias Brunner2016-04-151-11/+24
| | | | | | | | | | | | This allows using manual priorities for traps, which have a lower base priority than the resulting IPsec policies. This could otherwise be problematic if, for example, swanctl --install/uninstall is used while an SA is established combined with e.g. IPComp, where the trap policy does not look the same as the IPsec policy (which is now otherwise often the case as the reqids stay the same). It also orders policies by selector size if manual priorities are configured and narrowing occurs.
* Extended IPsec kernel policy schemeAndreas Steffen2016-04-091-18/+53
| | | | | | | | The kernel policy now considers src and dst port masks as well as restictions to a given network interface. The base priority is 100'000 for passthrough shunts, 200'000 for IPsec policies, 300'000 for IPsec policy traps and 400'000 for fallback drop shunts. The values 1..30'000 can be used for manually set priorities.
* Implemented IPsec policies restricted to given network interfaceAndreas Steffen2016-04-091-6/+9
|
* Support manually-set IPsec policy prioritiesAndreas Steffen2016-04-091-2/+4
|
* kernel-netlink: Prefer policies with reqid over those withoutTobias Brunner2016-04-091-1/+7
| | | | | | | This allows two CHILD_SAs with reversed subnets to install two FWD policies each. Since the outbound policy won't have a reqid set we will end up with the two inbound FWD policies installed in the kernel, with the correct templates to allow decrypted traffic.
* kernel-netlink: Only associate templates with inbound FWD policiesTobias Brunner2016-04-091-1/+1
| | | | | | We can't set a template on the outbound FWD policy (or we'd have to make it optional). Because if the traffic does not come from another (matching) IPsec tunnel it would get dropped due to the template mismatch.
* kernel-netlink: Associate routes with IN policies instead of FWD policiesTobias Brunner2016-04-091-21/+21
| | | | | | This allows us to install more than one FWD policy. We already do this in the kernel-pfkey plugin (there the original reason was that not all kernels support FWD policies).
* kernel: Use structs to pass information to the kernel-ipsec interfaceTobias Brunner2016-04-091-215/+255
|
* Use standard unsigned integer typesAndreas Steffen2016-03-241-48/+48
|
* Implemented port ranges in kernel_netlink interfaceAndreas Steffen2016-03-041-7/+19
|
* libhydra: Move kernel interface to libcharonTobias Brunner2016-03-031-31/+28
| | | | This moves hydra->kernel_interface to charon->kernel.
* libhydra: Move all kernel plugins to libcharonTobias Brunner2016-03-031-0/+2966
|
* Moved all kernel plugins to libhydra.Tobias Brunner2010-09-021-2208/+0
|
* Refer to kernel interface via hydra and not charon.Tobias Brunner2010-09-021-16/+16
|
* Removed references to protocol_id_t from kernel interface.Tobias Brunner2010-09-021-57/+22
| | | | | Instead we use the actual IP protocol identifier (the conversion now happens in child_sa_t and kernel_handler_t).
* Moved migrate job creation to kernel event handler.Tobias Brunner2010-09-021-7/+2
|
* Moved update SA job creation to kernel event handler.Tobias Brunner2010-09-021-6/+2
|
* Moved delete/rekey CHILD_SA job creation to kernel event handler.Tobias Brunner2010-09-021-17/+4
|
* Moved acquire job creation to kernel event handler.Tobias Brunner2010-09-021-6/+3
|
* Refer to processor via hydra and not charon.Tobias Brunner2010-09-021-7/+8
|
* Use a seperate section for each nested struct member in INIT macroMartin Willi2010-08-181-14/+16
|
generated by cgit v1.2.3 (git 2.25.1) at 2025-07-18 04:29:42 +0000