aboutsummaryrefslogtreecommitdiffstats
path: root/src/libcharon/plugins
Commit message (Collapse)AuthorAgeFilesLines
...
* kernel-netlink: Set NODAD flag for virtual IPv6 addressesTobias Brunner2017-02-061-10/+16
| | | | | | | The Optimistic Duplicate Address Detection (DAD) seems to fail in some cases (`dadfailed` in `ip addr`) rendering the virtual IP address unusable. Fixes #2183.
* kernel-netlink: Prefer matching label when selecting IPv6 source addressesTobias Brunner2017-02-061-3/+78
| | | | | | | | This implements rule 6 of RFC 6724 using the default priority table, so that e.g. global addresses are preferred over ULAs (which also have global scope) when the destination is a global address. Fixes #2138.
* kernel-netlink: Use correct 4 byte alignment for AH with IPv4Tobias Brunner2017-01-251-0/+5
| | | | | | | | By default, the kernel incorrectly uses an 8 byte alignment, which is mandatory for IPv6 but prohibited for IPv4. For many algorithms this doesn't matter but that's not the case for HMAC_SHA2_256_128. Since 2.6.39 the kernel can be explicitly configured to use a 4 byte alignment.
* kernel-netlink: Allow change of Netlink socket receive buffer sizeThomas Egerer2017-01-251-0/+44
| | | | Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
* kernel-pfkey: Set state to SADB_SASTATE_MATURE when adding/updating SAsTobias Brunner2017-01-251-0/+2
| | | | | | | Picky kernels might otherwise reject our messages as RFC 2367 explicitly mandates this. Fixes #2212.
* kernel-pfroute: Don't set a gateway if it is of a different address family ↵Tobias Brunner2017-01-251-1/+2
| | | | than the destination
* stroke: Default to %dynamic if no valid TS are specified in left|rightsubnetTobias Brunner2017-01-251-57/+44
| | | | | | | Otherwise, we'd end up with an empty TS list, which is not valid. Because end->tohost is set to !end->subnets in starter the removed branch was never used.
* vici: Reload loggers after reloading strongswan.conf via reload-setting commandTobias Brunner2017-01-251-0/+1
|
* ha: Fix assignment of IP addresses if multiple pools are definedTobias Brunner2017-01-251-2/+6
| | | | Fixes #2146.
* ha: Delete passive IKE_SA on other node after half-open timeoutTobias Brunner2017-01-251-0/+15
| | | | Fixes #1192.
* kernel-netlink: Return const pointer from lookup_algorithm()Thomas Egerer2017-01-231-3/+4
| | | | Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
* stroke: Load general PKCS#8 private keysAndreas Steffen2016-12-172-3/+9
|
* vici: Check for closed connection in Python bindingsWeilu Jia2016-12-141-1/+4
| | | | | | | The Python VICI library does not check if the socket is closed. If the daemon closes the connection, _recvall() spins forever. Closes strongswan/strongswan#56.
* kernel-netlink: Add support for AES-CMAC-96 (RFC 4494)Tobias Brunner2016-12-121-0/+1
| | | | The kernel apparently supports this since 3.10.
* farp: Fix BPF jump false offsetVolker Rümelin2016-10-311-1/+1
| | | | Jump to BPF_STMT(BPF_RET+BPF_K, 0) if protocol_size != 4
* connmark: Add CAP_NET_RAW to capabilities keep listTim Kent2016-10-251-0/+6
| | | | | | | | | Fix for "Permission denied (you must be root)" error when calling iptc_init(), which opens a RAW socket to communicate with the kernel, when built with "--with-capabilities=libcap". Closes strongswan/strongswan#53. Fixes #2157.
* kernel-netlink: Fix get_route() interface determinationChristophe Gouault2016-10-121-2/+2
| | | | | | | | | | | | A wrong variable is used (route instead of best), so much that the returned interface belongs to the last seen route instead of the best choice route. get_route() may therefore return mismatching interface and gateway. Fixes: 66e9165bc686 ("kernel-netlink: Return outbound interface in get_nexthop()") Signed-off-by: Christophe Gouault <christophe.gouault@6wind.com>
* Save both base and delta CRLs to diskAndreas Steffen2016-10-112-2/+9
|
* vici: strongswan.conf cache_crls = yes saves fetched CRLs to diskAndreas Steffen2016-10-116-4/+83
|
* kernel-netlink: Consider RTA_SRC when looking for a source addressTobias Brunner2016-10-051-52/+134
|
* vici: Enable IKE fragmentation by defaultTobias Brunner2016-10-041-1/+1
|
* kernel-netlink: Pass zero mark to kernel if mask is setTobias Brunner2016-09-301-2/+2
| | | | | | The kernel will apply the mask to the mark on the packet and then compare it to the configured mark. So to match only unmarked packets we have to be able to set 0/0xffffffff.
* kernel-netlink: Support configuring XFRM policy hashing thresholdsTobias Brunner2016-09-301-0/+107
| | | | | | | | | | | | | | | | | | | | | | | | If the number of flows over a gateway exceeds the flow cache size of the Linux kernel, policy lookup gets very expensive. Policies covering more than a single address don't get hash-indexed by default, which results in wasting most of the cycles in xfrm_policy_lookup_bytype() and its xfrm_policy_match() use. Starting with several hundred policies the overhead gets inacceptable. Starting with Linux 3.18, Linux can hash the first n-bit of a policy subnet to perform indexed lookup. With correctly chosen netbits, this can completely eliminate the performance impact of policy lookups, freeing the resources for ESP crypto. WARNING: Due to a bug in kernels 3.19 through 4.7, the kernel crashes with a NULL pointer dereference if a socket policy is installed while hash thresholds are changed. And because the hashtable rebuild triggered by the threshold change that causes this is scheduled it might also happen if the socket policies are seemingly installed after setting the thresholds. The fix for this bug - 6916fb3b10b3 ("xfrm: Ignore socket policies when rebuilding hash tables") - is included since 4.8 (and might get backported). As a workaround `charon.plugins.kernel-netlink.port_bypass` may be enabled to replace the socket policies that allow IKE traffic with port specific bypass policies.
* vici: Make installation of outbound FWD policies configurableTobias Brunner2016-09-281-25/+29
|
* kernel-netlink: Update cached reqid when updating policiesTobias Brunner2016-09-281-0/+2
|
* eap-peap: Fix memory leaks when handling tunneled methodsTobias Brunner2016-09-201-1/+3
|
* ipseckey: Properly free enumerated certificatesTobias Brunner2016-09-201-12/+14
|
* ipseckey: Properly free public key after creating certificateTobias Brunner2016-09-201-1/+1
|
* dnscert: Properly free enumerated certificatesTobias Brunner2016-09-201-8/+11
|
* vici: Fix indention of flush_certs() method in Python bindingsTobias Brunner2016-09-201-1/+1
|
* maemo: Remove unused pluginTobias Brunner2016-09-156-741/+0
|
* vici: flush-certs command flushes certificate cacheAndreas Steffen2016-09-136-0/+68
| | | | | | | | | | When fresh CRLs are released with a high update frequency (e.g. every 24 hours) or OCSP is used then the certificate cache gets quickly filled with stale CRLs or OCSP responses. The new VICI flush-certs command allows to flush e.g. cached CRLs or OCSP responses only. Without the type argument all kind of certificates (e.g. also received end entity and intermediate CA certificates) are purged.
* xof: Defined Extended Output FunctionsAndreas Steffen2016-07-292-0/+19
|
* vici: Increased various string buffers to BUF_LEN (512 bytes)Andreas Steffen2016-07-291-4/+4
|
* kernel-netlink: Don't set replay window for outbound SAsTobias Brunner2016-06-171-0/+6
| | | | | It's not necessary and might waste memory. However, if ESN is used we set the window to 1 as the kernel rejects the attribute otherwise.
* kernel-pfkey: Only set the replay window for inbound SAsTobias Brunner2016-06-171-3/+8
| | | | | It is not necessary for outbound SAs and might waste memory when large window sizes are used.
* load-tester: Fix load-tester on platforms where plain `char` is signedTobias Brunner2016-06-171-1/+1
| | | | | | | | fgetc() returns an int and EOF is usually -1 so when this gets casted to a char the result depends on whether `char` means `signed char` or `unsigned char` (the C standard does not specify it). If it is unsigned then its value is 0xff so the comparison with EOF will fail as that is an implicit signed int.
* resolve: Add refcounting for installed DNS serversTobias Brunner2016-06-101-27/+99
| | | | | | This fixes DNS server installation if make-before-break reauthentication is used as there the new SA and DNS server is installed before it then is removed again when the old IKE_SA is torn down.
* resolve: Use process abstraction when calling resolvconfTobias Brunner2016-06-101-18/+60
| | | | This allows us to capture output written to stderr/stdout.
* resolve: Make sure to clean up if calling resolvconf failedTobias Brunner2016-06-101-3/+4
| | | | | | If running resolvconf fails handle() fails release() is not called, which might leave an interface file on the system (or depending on which script called by resolvconf actually failed even the installed DNS server).
* kernel-pfroute: Return interface to reach destination from get_nexthop()Tobias Brunner2016-06-101-4/+13
|
* kernel-pfkey: Install routes with OUT policiesTobias Brunner2016-06-101-31/+30
|
* kernel-netlink: Install routes with OUT policiesTobias Brunner2016-06-101-25/+24
| | | | | This is the direction we actually need routes in and makes the code easier to read.
* kernel-pfkey: Don't install routes for drop policies and if protocol/ports ↵Tobias Brunner2016-06-101-3/+10
| | | | are in the selector
* kernel-netlink: Don't install routes for drop policies and if protocol/ports ↵Tobias Brunner2016-06-101-96/+106
| | | | | | | | | are in the selector We don't need them for drop policies and they might even mess with other routes we install. Routes for policies with protocol/ports in the selector will always be too broad and might conflict with other routes we install.
* kernel-pfkey: Also use interface returned by get_nexthop() for IPsec policiesTobias Brunner2016-06-101-1/+3
| | | | | An exception is if the local address is virtual, in which case we want the route to be via TUN device.
* kernel-netlink: Also use interface returned by get_nexthop() for IPsec policiesTobias Brunner2016-06-101-1/+2
|
* kernel-pfkey: Use interface to next hop for shunt policiesTobias Brunner2016-06-101-2/+3
|
* kernel-netlink: Use interface to next hop for shunt policiesTobias Brunner2016-06-101-10/+13
| | | | | | Using the source address to determine the interface is not correct for net-to-net shunts between two interfaces on which the host has IP addresses for each subnet.
* kernel-netlink: Return outbound interface in get_nexthop()Tobias Brunner2016-06-101-5/+43
|
generated by cgit v1.2.3 (git 2.25.1) at 2025-07-29 03:09:27 +0000