aboutsummaryrefslogtreecommitdiffstats
path: root/src/libhydra/kernel
Commit message (Collapse)AuthorAgeFilesLines
* libhydra: Move kernel interface to libcharonTobias Brunner2016-03-037-2417/+0
| | | | This moves hydra->kernel_interface to charon->kernel.
* kernel-interface: Pass the same data to del_policy() that was passed to ↵Tobias Brunner2015-11-103-31/+26
| | | | | | | add_policy() The additional data can be helpful to identify the exact policy to delete.
* kernel-interface: Return bool for kernel interface registrationThomas Egerer2015-11-104-20/+40
| | | | | | | | If the (un)registering of a kernel interface (net or ipsec) fails, the plugin loader will never know, since the appropriate functions always returns TRUE. By making the (un)register functions return a boolean value, the loader can detect a failure during initializing the kernel interface and abort charon startup if desired.
* kernel-interface: Add a separate "update" flag to add_sa()Martin Willi2015-03-093-6/+8
| | | | | | | | | | | The current "inbound" flag is used for two purposes: To define the actual direction of the SA, but also to determine the operation used for SA installation. If an SPI has been allocated, an update operation is required instead of an add. While the inbound flag normally defines the kind of operation required, this is not necessarily true in all cases. On the HA passive node, we install inbound SAs without prior SPI allocation.
* kernel-interface: Raise mapping event with a proto/SPI/dst tupleMartin Willi2015-02-203-9/+12
|
* kernel-interface: Raise expires with a proto/SPI/dst tuple instead of reqidMartin Willi2015-02-203-9/+10
|
* child-sa: Replace reqid based marks by "unique" marksMartin Willi2015-02-202-61/+14
| | | | | | | | | | | As we now use the same reqid for multiple CHILD_SAs with the same selectors, having marks based on the reqid makes not that much sense anymore. Instead we use unique marks that use a custom identifier. This identifier is reused during rekeying, keeping the marks constant for any rule relying on it (for example installed by updown). This also simplifies handling of reqid allocation, as we do not have to query the marks that is not yet assigned for an unknown reqid.
* kernel-interface: Add reqid allocation and release functionsMartin Willi2015-02-202-1/+329
| | | | | | | | | To reassign reqids where appropriate, we explicitly allocate or confirm them centrally on the kernel-interface. Currently the state is stored in the kernel-interface wrapper for all backends, but we may add appropriate methods to each backend to implement a custom reqid allocation logic, if required.
* kernel-interface: Pass full list of traffic selectors to add_sa()Martin Willi2015-02-203-17/+11
| | | | | | While we can handle the first selector only in BEET mode in kernel-netlink, passing the full list gives the backend more flexibility how to handle this information.
* kernel-interface: Remove reqid parameter from get_spi/get_cpi() methodsMartin Willi2015-02-203-16/+12
| | | | | | | | | | The reqid is not strictly required, as we set the reqid with the update call when installing the negotiated SA. If we don't need a reqid at this stage, we can later allocate the reqid in the kernel backend once the SA parameters have been fully negotaited. This allows us to assign the same reqid for the same selectors to avoid conflicts on backends this is necessary.
* kernel-interface: Add destination prefix to get_nexthop()Tobias Brunner2014-06-193-4/+9
| | | | | This allows to determine the next hop to reach a subnet, for instance, when installing routes for shunt policies.
* kernel-interface: Add a replay_window parameter to add_sa()Martin Willi2014-06-173-4/+10
|
* kernel-interface: Add a flag to indicate no policy updates requiredMartin Willi2014-06-041-0/+2
|
* libhydra: Use lib->ns instead of hydra->daemonTobias Brunner2014-02-121-2/+2
|
* kernel: Use a time_t to report use time in query_policy()Martin Willi2013-10-113-4/+4
|
* kernel: Use a time_t to report use time in query_sa()Martin Willi2013-10-113-5/+5
|
* kernel: Restore enumeration of all addresses when searching for address in TSTobias Brunner2013-08-211-3/+6
| | | | | | | | | Since f52cf07532 addresses on ignored, down or loopback interfaces were not considered as valid addresses anymore when searching for an address contained in the local traffic selector. This meant that route installation failed, for instance, if charon.install_virtual_ip_on was set to 'lo', or, on gateways, if internal interfaces were ignored with the charon.interfaces_* options.
* Fix various API doc issues and typosTobias Brunner2013-07-182-7/+7
| | | | Partially based on an old patch by Adrian-Ken Rueegsegger.
* kernel-libipsec: Add a feature to request UDP encapsulation of ESP packetsTobias Brunner2013-06-211-0/+2
|
* kernel: Add an event kernel interfaces can raise if they create/destroy a ↵Tobias Brunner2013-06-213-5/+43
| | | | TUN device
* kernel-interface: add an exchange initiator parameter to add_sa()Martin Willi2013-06-113-4/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This new flag gives the kernel-interface a hint how it should priorize the use of newly installed SAs during rekeying. Consider the following rekey procedure in IKEv2: Initiator --- Responder I1 -------CREATE-------> R1 I2 <------CREATE-------- -------DELETE-------> R2 I3 <------DELETE-------- SAs are always handled as pairs, the following happens at the SA level: * Initiator starts the exchange at I1 * Responder installs new SA pair at R1 * Initiator installs new SA pair at I2 * Responder removes old SA pair at R2 * Initiator removes old SA pair at I3 This makes sure SAs get installed/removed overlapping during rekeying. However, to avoid any packet loss, it is crucial that the new outbound SA gets activated at the correct position: * as exchange initiator, in I2 * as exchange responder, in R2 This should guarantee that we don't use the new outbound SA before the peer could install its corresponding inbound SA. The new parameter allows the kernel backend to install the new SA with appropriate priorities, i.e. it should: * as exchange inititator, have the new outbound SA installed with higher priority than the old SA * as exchange responder, have the new outbound SA installed with lower priority than the old SA While we could split up the SA installation at the responder, this approach has another advantage: it allows the kernel backend to switch SAs based on other criteria, for example when receiving traffic on the new inbound SA.
* kernel-interface: query SAD for last use time if SPD query didn't yield oneMartin Willi2013-05-063-4/+6
|
* kernel-pfroute: add a feature flag requesting "exclude" routesMartin Willi2013-05-061-0/+2
| | | | | | | | If routes installed along with policies covering the peer address affect local IKE/ESP packets, they won't get routed correctly. To work around this issue, the kernel interface can install "exclude" routes for the IKE peer. Not all networking backends require this workaround, hence we export a flag for it if it is required.
* kernel-interface: get_address_by_ts() can tell if a returned IP is virtualMartin Willi2013-05-062-3/+28
|
* kernel-interface: support enumeration of virtual-only IPsMartin Willi2013-05-061-6/+6
|
* kernel_ipsec_t.query_sa() additionally returns the number of processed packetsMartin Willi2013-03-143-4/+8
|
* Introduce "features" for the kernel backends returning kernel capabilitiesMartin Willi2013-03-014-1/+52
|
* Don't wait while removing external IPs used for load testingMartin Willi2012-11-293-4/+8
|
* Install virtual IPs via interface name, and use an interface lookup where ↵Martin Willi2012-11-293-8/+6
| | | | required
* Add an optional kernel-interface parameter to install IPs with a custom prefixMartin Willi2012-11-293-8/+13
|
* Moved debug.[ch] to utils folderTobias Brunner2012-10-241-1/+1
|
* Moved data structures to new collections subfolderTobias Brunner2012-10-242-2/+2
|
* Moved host_t and host_resolver_t to a new networking subfolderTobias Brunner2012-10-244-4/+4
|
* Don't check interface of inbound message if interfaces are not filteredTobias Brunner2012-09-242-5/+16
| | | | | We don't have a proper kernel-net interface on Android yet, so the check for a usable interface does not work there.
* Made IP address enumeration more flexibleTobias Brunner2012-09-213-17/+28
| | | | Also added an option to enumerate addresses on ignored interfaces.
* Filter ignored interfaces in kernel interfaces (for events, address ↵Tobias Brunner2012-09-212-2/+4
| | | | enumeration, etc.)
* Make it easy to check if an address is locally usable via changed ↵Tobias Brunner2012-09-213-7/+9
| | | | get_interface() method
* Don't ignore loopback devices and allow addresses on them being enumeratedTobias Brunner2012-09-213-8/+12
|
* Added options and a lookup function that will allow filtering of network ↵Tobias Brunner2012-09-212-2/+70
| | | | interfaces
* Use source address in get_nexthop() callTobias Brunner2012-09-213-6/+11
| | | | | Otherwise the nexthop returned might belong to a different route than the one actually used with the current source address.
* Added possibility to register custom kernel algorithms to kernel interfaceTobias Brunner2012-09-132-1/+172
|
* Moved types used by kernel_ipsec_t interface (and libipsec) to libstrongswanTobias Brunner2012-08-082-168/+1
| | | | This avoids a dependency of libipsec to libhydra.
* Let kernel interfaces decide how to enable UDP decapsulation of ESP packets.Tobias Brunner2012-08-083-4/+38
|
* Avoid SIGSEGV during shutdown if charon is not started as rootTobias Brunner2012-06-251-2/+2
|
* Define a special XFRM mark_t.value that dynamically uses the CHILD_SA reqidMartin Willi2012-03-221-0/+5
|
* Merge branch 'ikev1-clean' into ikev1-masterMartin Willi2012-03-201-0/+2
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Conflicts: configure.in man/ipsec.conf.5.in src/libcharon/daemon.c src/libcharon/plugins/eap_ttls/eap_ttls_peer.c src/libcharon/plugins/eap_radius/eap_radius_accounting.c src/libcharon/plugins/eap_radius/eap_radius_forward.c src/libcharon/plugins/farp/farp_listener.c src/libcharon/sa/ike_sa.c src/libcharon/sa/keymat.c src/libcharon/sa/task_manager.c src/libcharon/sa/trap_manager.c src/libstrongswan/plugins/x509/x509_cert.c src/libstrongswan/utils.h Applied lost changes of moved files keymat.c and task_manager.c. Updated listener_t.message hook signature in new plugins.
| * Added not-yet used sa_payload parameters used in IKEv1Martin Willi2012-03-201-0/+2
| |
* | Be less verbose if we don't have a local address for a tunnelMartin Willi2012-03-061-1/+1
|/
* Defined functions in the kernel interface to flush SAD and SPD entries.Tobias Brunner2011-10-213-0/+50
|
* Added kernel_ipsec/net plugin feature loading callbacksMartin Willi2011-10-144-0/+87
|
generated by cgit v1.2.3 (git 2.25.1) at 2025-07-21 16:21:22 +0000