aboutsummaryrefslogtreecommitdiffstats
path: root/src/libcharon/plugins/load_tester/load_tester_ipsec.c
Commit message (Collapse)AuthorAgeFilesLines
* kernel: Use structs to pass information to the kernel-ipsec interfaceTobias Brunner2016-04-091-26/+15
|
* Use standard unsigned integer typesAndreas Steffen2016-03-241-11/+11
|
* kernel-interface: Pass the same data to del_policy() that was passed to ↵Tobias Brunner2015-11-101-2/+3
| | | | | | | add_policy() The additional data can be helpful to identify the exact policy to delete.
* kernel-interface: Add a separate "update" flag to add_sa()Martin Willi2015-03-091-1/+1
| | | | | | | | | | | The current "inbound" flag is used for two purposes: To define the actual direction of the SA, but also to determine the operation used for SA installation. If an SPI has been allocated, an update operation is required instead of an add. While the inbound flag normally defines the kind of operation required, this is not necessarily true in all cases. On the HA passive node, we install inbound SAs without prior SPI allocation.
* kernel-interface: Pass full list of traffic selectors to add_sa()Martin Willi2015-02-201-1/+1
| | | | | | While we can handle the first selector only in BEET mode in kernel-netlink, passing the full list gives the backend more flexibility how to handle this information.
* kernel-interface: Remove reqid parameter from get_spi/get_cpi() methodsMartin Willi2015-02-201-2/+2
| | | | | | | | | | The reqid is not strictly required, as we set the reqid with the update call when installing the negotiated SA. If we don't need a reqid at this stage, we can later allocate the reqid in the kernel backend once the SA parameters have been fully negotaited. This allows us to assign the same reqid for the same selectors to avoid conflicts on backends this is necessary.
* kernel-interface: Add a replay_window parameter to add_sa()Martin Willi2014-06-171-2/+3
|
* load-tester: Fix race condition issuing same SPIChristophe Gouault2014-04-241-2/+2
| | | | | | | | | | Due to an unprotected incrementation, two load-tester initiators occasionally use the same SPI under high load, and hence generate 2 IPsec SAs with the same identifier. The responder IPsec stack will refuse to configure the second SA. Use an atomic incrementation to avoid this race condition. Signed-off-by: Christophe Gouault <christophe.gouault@6wind.com>
* kernel: Use a time_t to report use time in query_policy()Martin Willi2013-10-111-1/+1
|
* kernel: Use a time_t to report use time in query_sa()Martin Willi2013-10-111-1/+1
|
* kernel-interface: add an exchange initiator parameter to add_sa()Martin Willi2013-06-111-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This new flag gives the kernel-interface a hint how it should priorize the use of newly installed SAs during rekeying. Consider the following rekey procedure in IKEv2: Initiator --- Responder I1 -------CREATE-------> R1 I2 <------CREATE-------- -------DELETE-------> R2 I3 <------DELETE-------- SAs are always handled as pairs, the following happens at the SA level: * Initiator starts the exchange at I1 * Responder installs new SA pair at R1 * Initiator installs new SA pair at I2 * Responder removes old SA pair at R2 * Initiator removes old SA pair at I3 This makes sure SAs get installed/removed overlapping during rekeying. However, to avoid any packet loss, it is crucial that the new outbound SA gets activated at the correct position: * as exchange initiator, in I2 * as exchange responder, in R2 This should guarantee that we don't use the new outbound SA before the peer could install its corresponding inbound SA. The new parameter allows the kernel backend to install the new SA with appropriate priorities, i.e. it should: * as exchange inititator, have the new outbound SA installed with higher priority than the old SA * as exchange responder, have the new outbound SA installed with lower priority than the old SA While we could split up the SA installation at the responder, this approach has another advantage: it allows the kernel backend to switch SAs based on other criteria, for example when receiving traffic on the new inbound SA.
* kernel-interface: query SAD for last use time if SPD query didn't yield oneMartin Willi2013-05-061-1/+1
|
* kernel_ipsec_t.query_sa() additionally returns the number of processed packetsMartin Willi2013-03-141-2/+2
|
* Let kernel interfaces decide how to enable UDP decapsulation of ESP packets.Tobias Brunner2012-08-081-7/+2
|
* The load-tester plugin does not support SAD/SPD flushing.Tobias Brunner2011-10-211-0/+2
|
* Fixed indention in load-tester kernel interface.Tobias Brunner2011-10-211-28/+28
|
* Remove policies in kernel interfaces based on their priority.Tobias Brunner2011-07-271-2/+2
| | | | | | This allows to unroute a connection while the same connection is currently established. In this case both CHILD_SAs share the same reqid but the installed policies have different priorities.
* Add the reqid to kernel_ipsec_t.del_policy.Tobias Brunner2011-07-061-2/+2
|
* Don't simulate traffic on load-tester kernel interfaceMartin Willi2011-05-161-1/+1
|
* Added an esn parameter to the kernel interface add_sa functionsMartin Willi2011-04-201-2/+2
|
* Implemented Traffic Flow Confidentiality padding in kernel_interfaceMartin Willi2010-12-201-1/+1
|
* Fixing installation of trap policies (SPI=0) in kernel interface.Tobias Brunner2010-09-021-3/+2
|
* Replaced the protocol argument in add_policy with an optional SPI for an AH SA.Tobias Brunner2010-09-021-1/+1
|
* Removed references to protocol_id_t from kernel interface.Tobias Brunner2010-09-021-6/+6
| | | | | Instead we use the actual IP protocol identifier (the conversion now happens in child_sa_t and kernel_handler_t).
* Implemented missing bypass_socket() method in load-testers faked kernel ↵Martin Willi2010-07-071-0/+7
| | | | interface
* Added missing markt_t in load tester, also migrated to INIT/METHOD macros.Tobias Brunner2010-07-061-89/+58
|
* Moving charon to libcharon.Tobias Brunner2010-03-191-0/+176
generated by cgit v1.2.3 (git 2.25.1) at 2025-07-18 10:01:39 +0000