aboutsummaryrefslogtreecommitdiffstats
path: root/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c
Commit message (Collapse)AuthorAgeFilesLines
* libhydra: Move all kernel plugins to libcharonTobias Brunner2016-03-031-2966/+0
|
* kernel-netlink: Allow IPsec policies to replace shunt policiesTobias Brunner2015-11-101-3/+3
| | | | | Shunt policies don't have a reqid set, so we allow unequal reqids in this particular case (i.e. if one of the reqids is 0).
* kernel-netlink: Make absolutely sure we always delete the right policy cache ↵Tobias Brunner2015-11-101-2/+9
| | | | entry
* kernel-interface: Pass the same data to del_policy() that was passed to ↵Tobias Brunner2015-11-101-3/+4
| | | | | | | add_policy() The additional data can be helpful to identify the exact policy to delete.
* kernel-netlink: Remove the unused policy_history flagTobias Brunner2015-11-101-41/+20
| | | | This was used with pluto, which had its own policy tracking.
* kernel-netlink: Properly set port mask for ICMP type/code if only set on one ↵Tobias Brunner2015-08-311-7/+8
| | | | | | | | | | | | side If only one traffic selector had a port (type/code) the other side had the port mask set to 0, which canceled out the applied type/code. It also fixes the installation of ICMP type/code on big-endian hosts. Fixes #1091. References #595.
* kernel-netlink: Only flush SAs of types we actually manageTobias Brunner2015-08-211-6/+19
|
* kernel-netlink: When adding a policy do an update if it already existsTobias Brunner2015-08-131-1/+9
| | | | | | | | | | This may be the case when SAs are reestablished after a crash of the IKE daemon. We could actually always do updates. The kernel doesn't care, the only difference is the possible EEXIST if XFRM_MSG_NEWPOLICY is used. The advantage of not doing this, though, is that we get a warning in the log if a policy already exists, as that should usually not be the case.
* kernel-netlink: Unlock mutex in del_policy() if mark can't be added to messageTobias Brunner2015-07-311-0/+1
|
* kernel-netlink: Add ChaCha20-Poly1305 AEAD supportMartin Willi2015-06-291-0/+2
|
* kernel-netlink: Fix GCC error about uninitialized variable useMartin Willi2015-04-081-1/+1
| | | | | get_replay_state() always returns a replay_state_len when returning a replay state, but GCC doesn't know about that.
* kernel-netlink: Copy current usage stats to new SA in update_sa()Tobias Brunner2015-03-251-6/+34
| | | | | | | | | | | | This is needed to fix usage stats sent via RADIUS Accounting if clients use MOBIKE or e.g. the kernel notifies us about a changed NAT mapping. The upper layers won't expect the stats to get reset if only the IPs have changed (and some kernel interface might actually allow such updates without reset). It also fixes traffic based lifetimes in such situations. Fixes #799.
* kernel-interface: Add a separate "update" flag to add_sa()Martin Willi2015-03-091-3/+3
| | | | | | | | | | | The current "inbound" flag is used for two purposes: To define the actual direction of the SA, but also to determine the operation used for SA installation. If an SPI has been allocated, an update operation is required instead of an add. While the inbound flag normally defines the kind of operation required, this is not necessarily true in all cases. On the HA passive node, we install inbound SAs without prior SPI allocation.
* kernel-interface: Raise mapping event with a proto/SPI/dst tupleMartin Willi2015-02-201-8/+14
|
* kernel-interface: Raise expires with a proto/SPI/dst tuple instead of reqidMartin Willi2015-02-201-9/+10
|
* kernel-interface: Pass full list of traffic selectors to add_sa()Martin Willi2015-02-201-3/+5
| | | | | | While we can handle the first selector only in BEET mode in kernel-netlink, passing the full list gives the backend more flexibility how to handle this information.
* kernel-interface: Remove reqid parameter from get_spi/get_cpi() methodsMartin Willi2015-02-201-14/+9
| | | | | | | | | | The reqid is not strictly required, as we set the reqid with the update call when installing the negotiated SA. If we don't need a reqid at this stage, we can later allocate the reqid in the kernel backend once the SA parameters have been fully negotaited. This allows us to assign the same reqid for the same selectors to avoid conflicts on backends this is necessary.
* Fixed some typos, courtesy of codespellTobias Brunner2014-12-151-1/+1
|
* kernel-netlink: Add an option to enforce using XFRM_MSG_UPDPOLICYMartin Willi2014-11-211-0/+12
|
* kernel-netlink: Fallback to UDP if detecting socket protocol failsMartin Willi2014-11-211-2/+4
| | | | | getsockopt(SO_PROTOCOL) is not supported before 2.6.32. Default to UDP if either the SO_PROTOCOL define is missing or the syscall fails.
* kernel-netlink: Alternatively support global port based IKE bypass policiesMartin Willi2014-11-211-3/+160
| | | | | | The socket based IKE bypass policies are usually superior, but not supported on all networking stacks. The port based variant uses global policies for the UDP ports we have IKE sockets for.
* kernel-netlink: Add options to enable parallel Netlink queries explicitlyMartin Willi2014-11-211-1/+3
| | | | | | As under vanilla Linux the kernel can't handle parallel dump queries and returns EBUSY, it makes not much sense to use them. Disable parallel queries by default to basically restore original behavior, improving performance.
* kernel-netlink: Pass protocol specific enum names to socket constructorMartin Willi2014-09-241-1/+1
| | | | | This avoid the hard dependency on enum names, and makes kernel_netlink_shared independent of kernel_netlink_ipsec.
* kernel-netlink: Avoid casting the NLMSG_DATA() return valueMartin Willi2014-09-241-16/+16
| | | | There is really no need for doing so, and it makes the code just unreadable.
* kernel-netlink: Define netlink buffer as an union having a netlink headerMartin Willi2014-09-241-14/+14
| | | | | This allows us to streamline the netlink buffers, and avoid extensive casting.
* kernel-netlink: Optionally install protocol and ports on transport mode SAsTobias Brunner2014-09-121-6/+18
|
* kernel-netlink: Rename algorithm identifier from cast128 to cast5Martin Willi2014-07-041-1/+1
| | | | | | | | | | | Even if the XFRM identifier was named cast128 in the kernel before 2.6.31, it actually never worked, because there is no such crypto algorithm. The identifier has been changed to cast5 in https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=245acb87 to make it work, so we should use that. Fixes #633.
* kernel-netlink: Pass prefix when looking up next hop for shunt policiesTobias Brunner2014-06-191-1/+12
|
* kernel-interface: Add destination prefix to get_nexthop()Tobias Brunner2014-06-191-1/+1
| | | | | This allows to determine the next hop to reach a subnet, for instance, when installing routes for shunt policies.
* kernel-netlink: Add support for new policy priority classTobias Brunner2014-06-191-2/+5
|
* kernel-netlink: Never use XFRMA_REPLAY_ESN_VAL to configure zero replay windowsMartin Willi2014-06-181-1/+1
| | | | | | Trying to disable replay windows using the ESN attribute fails with EINVAL. Use non-ESN legacy format to disable replay windows, even if ESN has been negotiated over IKE.
* kernel-netlink: Support connection specific replay window sizesMartin Willi2014-06-171-39/+16
|
* kernel-interface: Add a replay_window parameter to add_sa()Martin Willi2014-06-171-4/+5
|
* libhydra: Use lib->ns instead of hydra->daemonTobias Brunner2014-02-121-4/+4
|
* kernel-netlink: Set selector on transport mode IPComp SAsTobias Brunner2014-01-231-1/+1
|
* kernel-netlink: Selectively add selector on SAs that use IPCompTobias Brunner2014-01-231-1/+7
| | | | | | Don't add a selector to tunnel mode SAs, these might serve multiple traffic selectors but with only one selector on the SA only the traffic matching the first one would actually get tunneled.
* kernel-netlink: Enable TFC padding only for tunnel mode ESP SAsTobias Brunner2013-11-191-2/+2
| | | | | | | The kernel does not allow them for transport mode SAs or IPComp SAs (and of course not for AH SAs). Fixes #446.
* kernel-netlink: Convert ports in acquires to ICMP[v6] type and codeTobias Brunner2013-10-171-3/+8
|
* kernel-netlink: Properly install policies with ICMP[v6] types and codesTobias Brunner2013-10-171-1/+12
|
* kernel: Use a time_t to report use time in query_policy()Martin Willi2013-10-111-1/+1
|
* kernel: Use a time_t to report use time in query_sa()Martin Willi2013-10-111-1/+1
|
* kernel-netlink: Allow to override xfrm_acq_expires valueAnsis Atteka2013-09-231-6/+10
| | | | | | | | | | | | | | | | When using auto=route, current xfrm_acq_expires default value implies that tunnel can be down for up to 165 seconds, if other peer rejected first IKE request with an AUTH_FAILED or NO_PROPOSAL_CHOSEN error message. These error messages are completely normal in setups where another application pushes configuration to both strongSwans without waiting for acknowledgment that they have updated their configurations. This patch allows strongswan to override xfrm_acq_expires default value by setting charon.plugins.kernel-netlink.xfrm_acq_expires in strongswan.conf. Signed-off-by: Ansis Atteka <aatteka@nicira.com>
* kernel-netlink: Fix calculation of ESN bitmap lengthTobias Brunner2013-08-211-4/+12
| | | | | While bmp_len stores the number of u_int32_t the allocated bitmap actually consists of those integers.
* kernel-netlink: use watcher to receive kernel events for net/ipsecMartin Willi2013-07-181-18/+12
|
* kernel-netlink: install selectors on SA for transport/BEET mode without ↵Martin Willi2013-06-191-0/+6
| | | | | | | | proto/port If a transport/BEET SA has different selectors for different proto/ports, installing just the proto/port of the first SA would break any additional selector.
* kernel-netlink: reject policy refcount if the reqid differsMartin Willi2013-06-191-4/+17
| | | | | | | | | | | | | Previously we silently replaced an existing policy with a new one if the reqid changed for the same selectors. This will break an old policy in the favour of the new one (for example if two clients behind the same NAT use transport mode). With this change any new policy gets rejected if the reqid differs. This will make sure we break no existing policy. For rekeying and acquires we still can have overlapping policies (as we use the same reqid), but for unrelated connections this is not true anymore (it wasn't actually before, we just silently broke the existing policy).
* kernel-interface: add an exchange initiator parameter to add_sa()Martin Willi2013-06-111-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This new flag gives the kernel-interface a hint how it should priorize the use of newly installed SAs during rekeying. Consider the following rekey procedure in IKEv2: Initiator --- Responder I1 -------CREATE-------> R1 I2 <------CREATE-------- -------DELETE-------> R2 I3 <------DELETE-------- SAs are always handled as pairs, the following happens at the SA level: * Initiator starts the exchange at I1 * Responder installs new SA pair at R1 * Initiator installs new SA pair at I2 * Responder removes old SA pair at R2 * Initiator removes old SA pair at I3 This makes sure SAs get installed/removed overlapping during rekeying. However, to avoid any packet loss, it is crucial that the new outbound SA gets activated at the correct position: * as exchange initiator, in I2 * as exchange responder, in R2 This should guarantee that we don't use the new outbound SA before the peer could install its corresponding inbound SA. The new parameter allows the kernel backend to install the new SA with appropriate priorities, i.e. it should: * as exchange inititator, have the new outbound SA installed with higher priority than the old SA * as exchange responder, have the new outbound SA installed with lower priority than the old SA While we could split up the SA installation at the responder, this approach has another advantage: it allows the kernel backend to switch SAs based on other criteria, for example when receiving traffic on the new inbound SA.
* kernel-netlink: add outer addresses to policy when using BEET modeMichael Rossberg2013-05-241-1/+1
|
* kernel-interface: query SAD for last use time if SPD query didn't yield oneMartin Willi2013-05-061-1/+7
|
* kernel-interface: get_address_by_ts() can tell if a returned IP is virtualMartin Willi2013-05-061-1/+1
|
generated by cgit v1.2.3 (git 2.25.1) at 2025-07-20 09:10:44 +0000