aboutsummaryrefslogtreecommitdiffstats
path: root/src/libcharon/sa/child_sa.h
Commit message (Collapse)AuthorAgeFilesLines
* child-sa: Install outbound SA immediately if kernel supports SPIs on policiesTobias Brunner2017-08-071-5/+8
|
* child-sa: Use flags to track installation of outbound SA and policies separatelyTobias Brunner2017-08-071-5/+16
|
* child-sa: Remove state to track installation of half the SA againTobias Brunner2017-05-231-5/+0
|
* child-sa: Expose state of the outbound SATobias Brunner2017-05-231-1/+35
|
* child-sa: Add method to remove the outbound SA and policiesTobias Brunner2017-05-231-0/+5
|
* child-sa: Add method to associate rekeyed CHILD_SAs with their replacementTobias Brunner2017-05-231-0/+16
|
* child-sa: Add methods that allow partial installation of CHILD_SATobias Brunner2017-05-231-0/+27
| | | | | | | Using install() for the inbound SA and register_outbound() for the outbound SA followed by install_policies(), will delay the installation of the outbound SA as well as the installation of the outbound policies in the kernel until install_outbound() is called later.
* child-sa: Add new state to track installation of only the inbound SATobias Brunner2017-05-231-1/+6
|
* child-sa: Change API used to set/install policiesTobias Brunner2017-05-231-11/+23
| | | | This way we only have to pass the traffic selectors once.
* Use standard unsigned integer typesAndreas Steffen2016-03-241-9/+9
|
* child-sa: Add a new state to track rekeyed IKEv1 CHILD_SAsTobias Brunner2015-03-251-0/+5
| | | | | | This is needed to handle DELETEs properly, which was previously done via CHILD_REKEYING, which we don't use anymore since 5c6a62ceb6 as it prevents reauthentication.
* child-sa: Replace reqid based marks by "unique" marksMartin Willi2015-02-201-1/+4
| | | | | | | | | | | As we now use the same reqid for multiple CHILD_SAs with the same selectors, having marks based on the reqid makes not that much sense anymore. Instead we use unique marks that use a custom identifier. This identifier is reused during rekeying, keeping the marks constant for any rule relying on it (for example installed by updown). This also simplifies handling of reqid allocation, as we do not have to query the marks that is not yet assigned for an unknown reqid.
* child-sa: Introduce a unique CHILD_SA identifierMartin Willi2015-02-201-0/+10
| | | | | As the reqid is not that unique even among multiple IKE_SAs anymore, we need an identifier to uniquely identify a specific CHILD_SA instance.
* child-sa: Introduce a CHILD_RETRYING state to detect DH group retriesMartin Willi2014-11-211-0/+5
|
* child-sa: Add a getter for CHILD_SA install timeMartin Willi2014-01-231-0/+7
|
* Fix various API doc issues and typosTobias Brunner2013-07-181-2/+2
| | | | Partially based on an old patch by Adrian-Ken Rueegsegger.
* child-sa: replace get_traffic_selectors() with create_ts_enumerator()Martin Willi2013-07-171-5/+8
| | | | | Not directly returning a linked list allows us to change the internals of the CHILD_SA transparently.
* kernel-interface: add an exchange initiator parameter to add_sa()Martin Willi2013-06-111-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This new flag gives the kernel-interface a hint how it should priorize the use of newly installed SAs during rekeying. Consider the following rekey procedure in IKEv2: Initiator --- Responder I1 -------CREATE-------> R1 I2 <------CREATE-------- -------DELETE-------> R2 I3 <------DELETE-------- SAs are always handled as pairs, the following happens at the SA level: * Initiator starts the exchange at I1 * Responder installs new SA pair at R1 * Initiator installs new SA pair at I2 * Responder removes old SA pair at R2 * Initiator removes old SA pair at I3 This makes sure SAs get installed/removed overlapping during rekeying. However, to avoid any packet loss, it is crucial that the new outbound SA gets activated at the correct position: * as exchange initiator, in I2 * as exchange responder, in R2 This should guarantee that we don't use the new outbound SA before the peer could install its corresponding inbound SA. The new parameter allows the kernel backend to install the new SA with appropriate priorities, i.e. it should: * as exchange inititator, have the new outbound SA installed with higher priority than the old SA * as exchange responder, have the new outbound SA installed with lower priority than the old SA While we could split up the SA installation at the responder, this approach has another advantage: it allows the kernel backend to switch SAs based on other criteria, for example when receiving traffic on the new inbound SA.
* child_sa_t.get_usestats() can additionally return the number of processed ↵Martin Willi2013-03-141-1/+2
| | | | packets
* Support multiple virtual IPs on peer_cfg and ike_sa classesMartin Willi2012-08-301-2/+2
|
* Added a getter for CHILD_SA marksMartin Willi2012-03-221-0/+8
|
* Do not use TFC padding if peer does not support ESPv3Martin Willi2010-12-201-1/+2
|
* Wrap getters for dpd/close action into CHILD_SA, allows us to override themMartin Willi2010-06-021-0/+28
|
* manage synced SAs in IKE_SA Manager, tag them with IKE_PASSIVE stateMartin Willi2010-04-071-1/+1
|
* Moving charon to libcharon.Tobias Brunner2010-03-191-0/+337
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-29 16:31:50 +0000