| Commit message (Collapse) | Author | Age | Files | Lines | |
|---|---|---|---|---|---|
| * | libhydra: Move all kernel plugins to libcharon | Tobias Brunner | 2016-03-03 | 1 | -2685/+0 |
| | | |||||
| * | kernel-netlink: Avoid route dump if routing rule excludes traffic with a ↵ | Tobias Brunner | 2015-08-18 | 1 | -7/+33 |
| | | | | | | | | | | | | certain mark If the routing rule we use to direct traffic to our own routing table excludes traffic with a certain mark (fwmark = !<mark>) we can simplify the route lookup and avoid dumping all routes by passing the mark to the request. That way our own routes are ignored and we get the preferred route back without having to dump and analyze all routes, which is quite a burden on hosts with lots of routes. | ||||
| * | kernel-netlink: Ignore unusable routes | Tobias Brunner | 2015-05-21 | 1 | -0/+24 |
| | | |||||
| * | kernel-netlink: Respect kernel routing priorities for IKE routes | Martin Willi | 2015-03-03 | 1 | -2/+15 |
| | | | | | | | | | If a system uses routing metrics, we should honor them when doing (manual) routing lookups for IKE. When enumerating routes, the kernel reports priorities with the RTA_PRIORITY attribute, not RTA_METRICS. We prefer routes with a lower priority value, and fall back to longest prefix match priorities if the priority value is equal. | ||||
| * | kernel-netlink: Add options to enable parallel Netlink queries explicitly | Martin Willi | 2014-11-21 | 1 | -1/+3 |
| | | | | | | | As under vanilla Linux the kernel can't handle parallel dump queries and returns EBUSY, it makes not much sense to use them. Disable parallel queries by default to basically restore original behavior, improving performance. | ||||
| * | kernel-netlink: Release lock while doing Netlink NEW/DELADDR operations | Martin Willi | 2014-11-21 | 1 | -8/+17 |
| | | | | | | | | | Besides that it can improve throughput, it avoids a deadlock situation. If all threads are busy, watcher will invoke the FD notification for NEWADDR events itself. If the lock is held, it gets locked up. As watcher is not dispatching anymore, it can't signal Netlink socket send() completion, and the send() operation does not return and keeps the lock. | ||||
| * | kernel-netlink: Define and use rtnetlink message types | Martin Willi | 2014-09-24 | 1 | -1/+22 |
| | | |||||
| * | kernel-netlink: Pass protocol specific enum names to socket constructor | Martin Willi | 2014-09-24 | 1 | -1/+1 |
| | | | | | | This avoid the hard dependency on enum names, and makes kernel_netlink_shared independent of kernel_netlink_ipsec. | ||||
| * | kernel-netlink: Avoid casting the NLMSG_DATA() return value | Martin Willi | 2014-09-24 | 1 | -9/+9 |
| | | | | | There is really no need for doing so, and it makes the code just unreadable. | ||||
| * | kernel-netlink: Define netlink buffer as an union having a netlink header | Martin Willi | 2014-09-24 | 1 | -5/+5 |
| | | | | | | This allows us to streamline the netlink buffers, and avoid extensive casting. | ||||
| * | kernel-netlink: Add global option to configure MSS-clamping on installed routes | Tobias Brunner | 2014-09-12 | 1 | -6/+26 |
| | | |||||
| * | kernel-netlink: Add global option to set MTU on installed routes | Tobias Brunner | 2014-09-12 | 1 | -0/+19 |
| | | |||||
| * | kernel-netlink: Cast IPv6 address blobs to the proper type | Tobias Brunner | 2014-06-24 | 1 | -3/+3 |
| | | | | | On Android these macros are defined as functions. | ||||
| * | kernel-netlink: Install virtual IPv6 addresses as deprecated | Tobias Brunner | 2014-06-20 | 1 | -0/+11 |
| | | | | | | | | | This should prevent the kernel's IPv6 source address selection algorithm from using this address unless it is forced to by our source route. This is helpful if split tunneling is used. Fixes #598. | ||||
| * | kernel-netlink: Add support for destination prefix when determining next hop | Tobias Brunner | 2014-06-19 | 1 | -20/+35 |
| | | |||||
| * | kernel-interface: Add destination prefix to get_nexthop() | Tobias Brunner | 2014-06-19 | 1 | -1/+1 |
| | | | | | | This allows to determine the next hop to reach a subnet, for instance, when installing routes for shunt policies. | ||||
| * | kernel-netlink: Follow RFC 6724 when selecting IPv6 source addresses | Tobias Brunner | 2014-06-19 | 1 | -26/+170 |
| | | | | | | | | | Instead of using the first address we find on an interface we should consider properties like an address' scope or whether it is temporary or public. Fixes #543. | ||||
| * | libhydra: Use lib->ns instead of hydra->daemon | Tobias Brunner | 2014-02-12 | 1 | -9/+9 |
| | | |||||
| * | kernel-netlink: Don't cache route entries if installation fails | Tobias Brunner | 2014-02-12 | 1 | -2/+5 |
| | | | | | Fixes #500. | ||||
| * | kernel-netlink: Check existence of linux/fib_rules.h, don't include it in ↵ | Tobias Brunner | 2013-10-18 | 1 | -1/+8 |
| | | | | | | | distribution This reverts commit b0761f1f0a5abd225edc291c8285f99a538e6a66. | ||||
| * | kernel-netlink: Allow setting firewall marks on routing rule | Tobias Brunner | 2013-10-11 | 1 | -0/+20 |
| | | |||||
| * | kernel-netlink: increase buffer size for RT netlink messages | Ansis Atteka | 2013-09-10 | 1 | -1/+1 |
| | | | | | | | | | | | | | | | | | | | | | Commit 940e1b0f66dc04b0853414c1f4c45fa3f6e33bdd "Filter ignored interfaces in kernel interfaces (for events, address enumeration, etc.)" made charon to ignore routes with unusable interfaces. Unusable interface is one where charon has not seen RTM_NEWLINK message from the kernel. Sometime RTM_NEWLINK message can be 1048 bytes large. This is 24 bytes more than currently allocated buffer of 1024 bytes. If kernel sends such a large message, then it would be silently ignored by charon and corresponding interface would never become usable. Hence strongSwan might resolve invalid source IP address in get_route() function. This would prevent IPsec tunnel to be established. To reproduce create a VLAN interface with following command: vconfig add eth1 12 | ||||
| * | kernel-netlink,pfroute: Properly update address flag within ROAM_DELAY | Tobias Brunner | 2013-08-12 | 1 | -1/+1 |
| | | | | | | | | 77d4a02 and 55da01f only updated the address flag when a job was created, which obviously had the same limitation as the old code. Fixes #374. | ||||
| * | kernel-netlink: Ensure address changes are not missed in roam events | Tobias Brunner | 2013-08-12 | 1 | -4/+15 |
| | | | | | | | | | | | | | | | | | If multiple roam events are triggered within ROAM_DELAY, only one job is created. The old code set the address flag to the value of the last triggering call. So if a route change followed an address change within ROAM_DELAY the address change was missed by the upper layers, e.g. causing it not to update the list of addresses via MOBIKE. The new code now keeps the state of the address flag until the job is actually executed, which still has some issues. For instance, if an address disappears and reappears within ROAM_RELAY, the flag would not have to be set to TRUE. So address updates might occasionally get triggered where none would actually be required. Fixes #374. | ||||
| * | kernel-netlink: use watcher to receive kernel events for net/ipsec | Martin Willi | 2013-07-18 | 1 | -17/+12 |
| | | |||||
| * | kernel-pfroute: Provide name of interfaces on which virtual IPs are installed | Tobias Brunner | 2013-07-17 | 1 | -1/+1 |
| | | |||||
| * | kernel-netlink: Routes don't require a gateway/nexthop | Tobias Brunner | 2013-06-21 | 1 | -5/+9 |
| | | |||||
| * | kernel-interface: support enumeration of virtual-only IPs | Martin Willi | 2013-05-06 | 1 | -3/+10 |
| | | |||||
| * | kernel-netlink: Add an option to disable roam events | Tobias Brunner | 2013-05-03 | 1 | -1/+13 |
| | | |||||
| * | kernel-netlink: Define defaults for routing table and prio | Tobias Brunner | 2013-05-03 | 1 | -0/+8 |
| | | |||||
| * | strdup() iface passed to queue_route_reinstall(), fixing double-free | Martin Willi | 2013-03-11 | 1 | -1/+1 |
| | | |||||
| * | After IKEv1 reauthentication, reinstall VIP routes after migrating CHILD_SAs | Martin Willi | 2013-02-20 | 1 | -0/+4 |
| | | | | | | | During IKEv1 reauthentication, the virtual IP gets removed, then reinstalled. The CHILD_SAs get migrated, but any associated route gets removed from the kernel. Reinstall routes after adding the virtual IP again. | ||||
| * | kernel-netlinks get_interface() considers virtual IPs, too | Martin Willi | 2012-12-17 | 1 | -0/+13 |
| | | | | | | | | When using load-tester, we can install tunnel outer addresses on demand. As these are installed as "virtual", we have to consider virtual IPs in the get_interface() lookup to install "real" virtual IPs to these dynamic external addresses. | ||||
| * | Don't wait while removing external IPs used for load testing | Martin Willi | 2012-11-29 | 1 | -2/+3 |
| | | |||||
| * | Install virtual IPs via interface name, and use an interface lookup where ↵ | Martin Willi | 2012-11-29 | 1 | -9/+3 |
| | | | | | required | ||||
| * | Add an optional kernel-interface parameter to install IPs with a custom prefix | Martin Willi | 2012-11-29 | 1 | -6/+7 |
| | | |||||
| * | Limit recursion when searching for source addresses | Tobias Brunner | 2012-11-13 | 1 | -5/+14 |
| | | | | | | This could be required if e.g. two default routes list gateways but the corresponding outbound interfaces do not have any IP addresses on them. | ||||
| * | Don't call get_route recursively if a route's gateway matches the destination | Tobias Brunner | 2012-11-13 | 1 | -2/+5 |
| | | |||||
| * | Moved debug.[ch] to utils folder | Tobias Brunner | 2012-10-24 | 1 | -1/+1 |
| | | |||||
| * | Moved data structures to new collections subfolder | Tobias Brunner | 2012-10-24 | 1 | -2/+2 |
| | | |||||
| * | Use a helper function to add milliseconds to timeval structs | Tobias Brunner | 2012-10-18 | 1 | -12/+2 |
| | | |||||
| * | Use rwlock and rwlock_condvar to increase concurrency in kernel-netlink plugin | Tobias Brunner | 2012-09-21 | 1 | -58/+55 |
| | | |||||
| * | Use a separate mutex for cached routes in kernel-netlink plugin | Tobias Brunner | 2012-09-21 | 1 | -8/+15 |
| | | |||||
| * | Use a lock to safely check and update the time for the next roam event | Tobias Brunner | 2012-09-21 | 1 | -16/+28 |
| | | |||||
| * | Added an option to configure the interface on which virtual IP addresses are ↵ | Tobias Brunner | 2012-09-21 | 1 | -19/+29 |
| | | | | | installed | ||||
| * | Changed how kernel-netlink handles virtual IP addresses | Tobias Brunner | 2012-09-21 | 1 | -248/+308 |
| | | | | | Also tried to avoid the use of enumerators. | ||||
| * | Made IP address enumeration more flexible | Tobias Brunner | 2012-09-21 | 1 | -15/+8 |
| | | | | | Also added an option to enumerate addresses on ignored interfaces. | ||||
| * | Use a hashtable to quickly check for usable IP addresses/interfaces | Tobias Brunner | 2012-09-21 | 1 | -42/+143 |
| | | |||||
| * | Filter ignored interfaces in kernel interfaces (for events, address ↵ | Tobias Brunner | 2012-09-21 | 1 | -39/+79 |
| | | | | | enumeration, etc.) | ||||
| * | %any is never on a local interface | Tobias Brunner | 2012-09-21 | 1 | -0/+5 |
| | | |||||
 |
index : tteras/strongswan | |
| tteras' strongSwan tree | gitolite |
| aboutsummaryrefslogtreecommitdiffstats |