aboutsummaryrefslogtreecommitdiffstats
path: root/src/libhydra/kernel/kernel_ipsec.h
Commit message (Collapse)AuthorAgeFilesLines
* kernel-interface: add an exchange initiator parameter to add_sa()Martin Willi2013-06-111-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This new flag gives the kernel-interface a hint how it should priorize the use of newly installed SAs during rekeying. Consider the following rekey procedure in IKEv2: Initiator --- Responder I1 -------CREATE-------> R1 I2 <------CREATE-------- -------DELETE-------> R2 I3 <------DELETE-------- SAs are always handled as pairs, the following happens at the SA level: * Initiator starts the exchange at I1 * Responder installs new SA pair at R1 * Initiator installs new SA pair at I2 * Responder removes old SA pair at R2 * Initiator removes old SA pair at I3 This makes sure SAs get installed/removed overlapping during rekeying. However, to avoid any packet loss, it is crucial that the new outbound SA gets activated at the correct position: * as exchange initiator, in I2 * as exchange responder, in R2 This should guarantee that we don't use the new outbound SA before the peer could install its corresponding inbound SA. The new parameter allows the kernel backend to install the new SA with appropriate priorities, i.e. it should: * as exchange inititator, have the new outbound SA installed with higher priority than the old SA * as exchange responder, have the new outbound SA installed with lower priority than the old SA While we could split up the SA installation at the responder, this approach has another advantage: it allows the kernel backend to switch SAs based on other criteria, for example when receiving traffic on the new inbound SA.
* kernel-interface: query SAD for last use time if SPD query didn't yield oneMartin Willi2013-05-061-1/+2
|
* kernel_ipsec_t.query_sa() additionally returns the number of processed packetsMartin Willi2013-03-141-1/+2
|
* Introduce "features" for the kernel backends returning kernel capabilitiesMartin Willi2013-03-011-0/+8
|
* Moved host_t and host_resolver_t to a new networking subfolderTobias Brunner2012-10-241-1/+1
|
* Moved types used by kernel_ipsec_t interface (and libipsec) to libstrongswanTobias Brunner2012-08-081-146/+1
| | | | This avoids a dependency of libipsec to libhydra.
* Let kernel interfaces decide how to enable UDP decapsulation of ESP packets.Tobias Brunner2012-08-081-1/+12
|
* Define a special XFRM mark_t.value that dynamically uses the CHILD_SA reqidMartin Willi2012-03-221-0/+5
|
* Added not-yet used sa_payload parameters used in IKEv1Martin Willi2012-03-201-0/+2
|
* Defined functions in the kernel interface to flush SAD and SPD entries.Tobias Brunner2011-10-211-0/+14
|
* Added kernel_ipsec/net plugin feature loading callbacksMartin Willi2011-10-141-0/+15
|
* Install fallback drop policies to avoid transmitting unencrypted packets.Tobias Brunner2011-07-271-0/+2
| | | | | | | During the update of a CHILD_SA (e.g. caused by MOBIKE) the old policy is first uninstalled and then the new one is installed. In the short time in between, where no policy is available in the kernel, unencrypted packets could have been transmitted.
* Remove policies in kernel interfaces based on their priority.Tobias Brunner2011-07-271-4/+16
| | | | | | This allows to unroute a connection while the same connection is currently established. In this case both CHILD_SAs share the same reqid but the installed policies have different priorities.
* Add the reqid to kernel_ipsec_t.del_policy.Tobias Brunner2011-07-061-3/+4
|
* implemented PASS and DROP shunt policiesAndreas Steffen2011-06-281-0/+4
|
* Added an esn parameter to the kernel interface add_sa functionsMartin Willi2011-04-201-1/+2
|
* Implemented Traffic Flow Confidentiality padding in kernel_interfaceMartin Willi2010-12-201-1/+2
|
* Fixing installation of trap policies (SPI=0) in kernel interface.Tobias Brunner2010-09-021-9/+27
|
* Added an option to specify the type of a policy to kernel_ipsec.add_policy.Tobias Brunner2010-09-021-2/+16
| | | | | This will later allow us to support pluto's passthrough and drop policies in charon.
* Replaced the protocol argument in add_policy with an optional SPI for an AH SA.Tobias Brunner2010-09-021-3/+3
|
* Moved ipsec_transform_t to kernel_ipsec.h in libhydra.Tobias Brunner2010-09-021-1/+18
| | | | | Because of this libfreeswan, pluto, starter etc. now depend on that file (and libhydra). This resolved some duplicate declarations.
* Moved kernel interface to libhydra.Tobias Brunner2010-09-021-0/+319
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-07 01:14:15 +0000