aboutsummaryrefslogtreecommitdiffstats
path: root/src/libcharon/plugins/kernel_netlink
Commit message (Collapse)AuthorAgeFilesLines
* unit-tests: Rename targets for libstrongswan and kernel-netlinkThomas Egerer2017-11-091-5/+5
| | | | | | | | | libstrongswan and kernel-netlink are the only two components which do not adhere to the naming scheme used for all other tests. If the tests are run by an external application this imposes problems due to clashing names. Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
* kernel-netlink: Add strings for newer XFRM attribute typesTobias Brunner2017-10-061-1/+6
|
* kernel-netlink: Set usable state whenever an interface appearsTobias Brunner2017-08-231-2/+2
| | | | | | | | If an interface is renamed we already have an entry (based on the ifindex) allocated but previously only set the usable state once based on the original name. Fixes #2403.
* kernel-netlink: Wipe buffer used to read Netlink messagesTobias Brunner2017-08-071-2/+12
| | | | | | | | | When querying SAs the keys will end up in this buffer (the allocated messages that are returned are already wiped). The kernel also returns XFRM_MSG_NEWSA as response to XFRM_MSG_ALLOCSPI but we can't distinguish this here as we only see the response. References #2388.
* kernel-netlink: Set SPI on outbound policyTobias Brunner2017-08-071-4/+10
| | | | | This should cause the right SA to get used if there are multiple outbound SAs and the policies are installed properly.
* linked-list: Change return value of find_first() and signature of its callbackTobias Brunner2017-05-261-25/+26
| | | | This avoids the unportable five pointer hack.
* linked-list: Change interface of callback for invoke_function()Tobias Brunner2017-05-262-9/+22
| | | | This avoids the unportable five pointer hack.
* Change interface for enumerator_create_filter() callbackTobias Brunner2017-05-261-44/+53
| | | | | This avoids the unportable 5 pointer hack, but requires enumerating in the callback.
* Migrate all enumerators to venumerate() interface changeTobias Brunner2017-05-261-2/+9
|
* kernel-netlink: Use total retransmit timeout as acquire timeoutTobias Brunner2017-05-232-13/+23
| | | | | | | By using the total retransmit timeout, modifications of timeout settings automatically reflect on the value of xfrm_acq_expires. If set, the value of xfrm_acq_expires configured by the user takes precedence over the calculated value.
* kernel-netlink: Try to add new inbound SA if update failsThomas Egerer2017-05-231-3/+12
| | | | | | | | | | | | | | | When establishing a traffic-triggered CHILD_SA involves the setup of an IKE_SA more than one exchange is required. As a result the temporary acquire state may have expired -- even if the acquire expiration (xfrm_acq_expires) time is set properly (165 by default). The expire message sent by the kernel is not processed in charon since no trap can be found by the trap manager. A possible solution could be to track allocated SPIs. But since this is a corner case and the tracking introduces quite a bit of overhead, it seems much more sensible to add a new state if the update of a state fails with NOT_FOUND. Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
* kernel-netlink: Update hardware offload attribute when SAs are updatedTobias Brunner2017-05-231-11/+37
|
* kernel-netlink: Base SA update on correct message in multi-message responseTobias Brunner2017-05-231-7/+7
|
* kernel-netlink: Enable hardware offloading if configured for an SATobias Brunner2017-05-231-0/+25
|
* kernel-netlink: Directly handle Netlink messages if thread pool is emptyTobias Brunner2017-05-231-1/+2
| | | | | | | | | During initialization of the plugins the thread pool is not yet initialized so there is no watcher thread that could handle the queued Netlink message and the main thread will wait indefinitely for a response. Fixes #2199.
* kernel-netlink: Avoid O(n^2) copy operations when concatenating Netlink ↵Jiri Horky2017-03-271-7/+13
| | | | | | | | | | | | | | | | | | | | responses When constructing the result, all responses from Netlink were concatenated iteratively, i.e. for each response, the previously acquired result was copied to newly allocated memory and the current response appended to it. This results in O(n^2) copy operations. Instead, we now check for the total final length of the result and copy the individual responses to it in one pass, i.e. in O(n) copy operations. In particular, this issue caused very high CPU usage in memcpy() function as the result is copied over and over. Common way how to hit the issue is when having 1000+ routes and 5+ connecting clients a second. In that case, the memcpy() function can take 50%+ of one CPU thread on a decent CPU and the whole charon daemon is stuck just reading routes and concatenating them together (connecting clients are blocked in that particular case as this is done under mutex). Closes strongswan/strongswan#65. References #2055.
* kernel: Make range of SPIs for IPsec SAs configurableTobias Brunner2017-03-021-3/+10
|
* kernel-netlink: Use RTA_SRC to specify route source in kernel-based lookupsMartin Willi2017-02-131-1/+8
| | | | | | | For table dumps the kernel accepts RTA_PREFSRC to filter the routes, which is what we do when doing userspace route calculations. For kernel-based route lookups, however, the RTA_PREFSRC attribute is ignored and we must specify RTA_SRC for policy based route lookups.
* kernel-netlink: Use kernel-based route lookup if we do not install routesMartin Willi2017-02-131-1/+11
| | | | | | | | | | | | For gateways with many connections, installing routes is often disabled, as we can use a static route configuration to achieve proper routing with a single rule. If this is the case, there is no need to dump all routes and do userspace route lookups, as there is no need to exclude routes we installed ourself. Doing kernel-based route lookups is not only faster with may routes, but also can use the full power of Linux policy based routing; something we can hardly rebuild in userspace when calculating routes.
* kernel-netlink: Return interface name in local subnet enumeratorTobias Brunner2017-02-081-5/+15
|
* kernel-interface: Add interface name to local subnet enumeratorTobias Brunner2017-02-081-1/+2
|
* kernel-netlink: Implement enumerator for local subnetsTobias Brunner2017-02-081-0/+130
|
* kernel-netlink: Use the same priority range for trap and regular policiesTobias Brunner2017-02-081-14/+14
| | | | | | | | | | | | | While trap and regular policies now often look the same (mainly because reqids are kept constant) trap policies still need to have a lower priority than regular policies to handle unroute/route correctly if e.g. IPComp is used or the mode changes. But if we use a completely different priority range that's lower than that of regular policies it is not possible to install overlapping trap policies. By differentiating trap from regular policies via the priority's LSB this issue is avoided while still maintaining the proper ordering of trap and regular policies. Fixes #1243.
* kernel-netlink: Fix spacing in log message when policy is unchangedTobias Brunner2017-02-081-1/+1
|
* kernel-netlink: Set NODAD flag for virtual IPv6 addressesTobias Brunner2017-02-061-10/+16
| | | | | | | The Optimistic Duplicate Address Detection (DAD) seems to fail in some cases (`dadfailed` in `ip addr`) rendering the virtual IP address unusable. Fixes #2183.
* kernel-netlink: Prefer matching label when selecting IPv6 source addressesTobias Brunner2017-02-061-3/+78
| | | | | | | | This implements rule 6 of RFC 6724 using the default priority table, so that e.g. global addresses are preferred over ULAs (which also have global scope) when the destination is a global address. Fixes #2138.
* kernel-netlink: Use correct 4 byte alignment for AH with IPv4Tobias Brunner2017-01-251-0/+5
| | | | | | | | By default, the kernel incorrectly uses an 8 byte alignment, which is mandatory for IPv6 but prohibited for IPv4. For many algorithms this doesn't matter but that's not the case for HMAC_SHA2_256_128. Since 2.6.39 the kernel can be explicitly configured to use a 4 byte alignment.
* kernel-netlink: Allow change of Netlink socket receive buffer sizeThomas Egerer2017-01-251-0/+44
| | | | Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
* kernel-netlink: Return const pointer from lookup_algorithm()Thomas Egerer2017-01-231-3/+4
| | | | Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
* kernel-netlink: Add support for AES-CMAC-96 (RFC 4494)Tobias Brunner2016-12-121-0/+1
| | | | The kernel apparently supports this since 3.10.
* kernel-netlink: Fix get_route() interface determinationChristophe Gouault2016-10-121-2/+2
| | | | | | | | | | | | A wrong variable is used (route instead of best), so much that the returned interface belongs to the last seen route instead of the best choice route. get_route() may therefore return mismatching interface and gateway. Fixes: 66e9165bc686 ("kernel-netlink: Return outbound interface in get_nexthop()") Signed-off-by: Christophe Gouault <christophe.gouault@6wind.com>
* kernel-netlink: Consider RTA_SRC when looking for a source addressTobias Brunner2016-10-051-52/+134
|
* kernel-netlink: Pass zero mark to kernel if mask is setTobias Brunner2016-09-301-2/+2
| | | | | | The kernel will apply the mask to the mark on the packet and then compare it to the configured mark. So to match only unmarked packets we have to be able to set 0/0xffffffff.
* kernel-netlink: Support configuring XFRM policy hashing thresholdsTobias Brunner2016-09-301-0/+107
| | | | | | | | | | | | | | | | | | | | | | | | If the number of flows over a gateway exceeds the flow cache size of the Linux kernel, policy lookup gets very expensive. Policies covering more than a single address don't get hash-indexed by default, which results in wasting most of the cycles in xfrm_policy_lookup_bytype() and its xfrm_policy_match() use. Starting with several hundred policies the overhead gets inacceptable. Starting with Linux 3.18, Linux can hash the first n-bit of a policy subnet to perform indexed lookup. With correctly chosen netbits, this can completely eliminate the performance impact of policy lookups, freeing the resources for ESP crypto. WARNING: Due to a bug in kernels 3.19 through 4.7, the kernel crashes with a NULL pointer dereference if a socket policy is installed while hash thresholds are changed. And because the hashtable rebuild triggered by the threshold change that causes this is scheduled it might also happen if the socket policies are seemingly installed after setting the thresholds. The fix for this bug - 6916fb3b10b3 ("xfrm: Ignore socket policies when rebuilding hash tables") - is included since 4.8 (and might get backported). As a workaround `charon.plugins.kernel-netlink.port_bypass` may be enabled to replace the socket policies that allow IKE traffic with port specific bypass policies.
* kernel-netlink: Update cached reqid when updating policiesTobias Brunner2016-09-281-0/+2
|
* kernel-netlink: Don't set replay window for outbound SAsTobias Brunner2016-06-171-0/+6
| | | | | It's not necessary and might waste memory. However, if ESN is used we set the window to 1 as the kernel rejects the attribute otherwise.
* kernel-netlink: Install routes with OUT policiesTobias Brunner2016-06-101-25/+24
| | | | | This is the direction we actually need routes in and makes the code easier to read.
* kernel-netlink: Don't install routes for drop policies and if protocol/ports ↵Tobias Brunner2016-06-101-96/+106
| | | | | | | | | are in the selector We don't need them for drop policies and they might even mess with other routes we install. Routes for policies with protocol/ports in the selector will always be too broad and might conflict with other routes we install.
* kernel-netlink: Also use interface returned by get_nexthop() for IPsec policiesTobias Brunner2016-06-101-1/+2
|
* kernel-netlink: Use interface to next hop for shunt policiesTobias Brunner2016-06-101-10/+13
| | | | | | Using the source address to determine the interface is not correct for net-to-net shunts between two interfaces on which the host has IP addresses for each subnet.
* kernel-netlink: Return outbound interface in get_nexthop()Tobias Brunner2016-06-101-5/+43
|
* kernel-net: Let get_nexthop() return an optional interface nameTobias Brunner2016-06-102-7/+12
| | | | | The returned name should be the interface over which the destination address/net is reachable.
* kernel-netlink: Let only a single thread work on a specific policyTobias Brunner2016-06-101-25/+69
| | | | | | | | | | | | | Other threads are free to add/update/delete other policies. This tries to prevent race conditions caused by releasing the mutex while sending messages to the kernel. For instance, if break-before-make reauthentication is used and one thread on the responder is delayed in deleting the policies that another thread is concurrently adding for the new SA. This could have resulted in no policies being installed eventually. Fixes #1400.
* kernel-netlink: Add priority and refcount to policy logTobias Brunner2016-06-101-9/+30
|
* kernel-netlink: Consistently print mark in log messages only if setTobias Brunner2016-06-101-108/+82
|
* kernel-netlink: Provide error information for Netlink socketsTobias Brunner2016-06-103-19/+25
| | | | #1467.
* kernel-netlink: Allow definition of a custom priority calculation functionTobias Brunner2016-06-102-3/+18
|
* kernel-netlink: Use ipsec_sa_cfg_equals() and compare marks properlyTobias Brunner2016-06-081-2/+3
|
* kernel-netlink: Check proper watcher state in parallel modeTobias Brunner2016-05-061-1/+1
| | | | | | | | | | | | | After adding the read callback the state is WATCHER_QUEUED and it is switched to WATCHER_RUNNING only later by an asynchronous job. This means that a thread that sent a Netlink message shortly after registration might see the state as WATCHER_QUEUED. If it then tries to read the response and the watcher thread is quicker to actually read the message from the socket, it could block on recv() while still holding the lock. And the asynchronous job that actually read the message and tries to queue it will block while trying to acquire the lock, so we'd end up in a deadlock. This is probably mostly a problem in the unit tests.
* kernel-netlink: Order routes by prefix before comparing priority/metricTobias Brunner2016-05-061-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | Metrics are basically defined to order routes with equal prefix, so ordering routes by metric first makes not much sense as that could prefer totally unspecific routes over very specific ones. For instance, the previous code did break installation of routes for passthrough policies with two routes like these in the main routing table: default via 192.168.2.1 dev eth0 proto static 192.168.2.0/24 dev eth0 proto kernel scope link src 192.168.2.10 metric 1 Because the default route has no metric set (0) it was used, instead of the more specific other one, to determine src and next hop when installing a route for a passthrough policy for 192.168.2.0/24. Therefore, the installed route in table 220 did then incorrectly redirect all local traffic to "next hop" 192.168.2.1. The same issue occurred when determining the source address while installing trap policies. Fixes 6b57790270fb ("kernel-netlink: Respect kernel routing priorities for IKE routes"). Fixes #1416.
generated by cgit v1.2.3 (git 2.25.1) at 2025-07-18 12:38:50 +0000