aboutsummaryrefslogtreecommitdiffstats
path: root/src/libhydra/plugins/kernel_netlink
Commit message (Collapse)AuthorAgeFilesLines
* kernel-netlink: Add ChaCha20-Poly1305 AEAD supportMartin Willi2015-06-291-0/+2
|
* kernel-netlink: Ignore unusable routesTobias Brunner2015-05-211-0/+24
|
* kernel-netlink: Make buffer size for received Netlink messages configurableTobias Brunner2015-05-211-7/+11
|
* kernel-netlink: Don't mangle verbosity during test initializationMartin Willi2015-04-151-2/+0
| | | | | We now properly manage thread verbosity in the test framework, and don't need to silence thread spawning messages.
* kernel-netlink: Fix GCC error about uninitialized variable useMartin Willi2015-04-081-1/+1
| | | | | get_replay_state() always returns a replay_state_len when returning a replay state, but GCC doesn't know about that.
* kernel-netlink: Copy current usage stats to new SA in update_sa()Tobias Brunner2015-03-251-6/+34
| | | | | | | | | | | | This is needed to fix usage stats sent via RADIUS Accounting if clients use MOBIKE or e.g. the kernel notifies us about a changed NAT mapping. The upper layers won't expect the stats to get reset if only the IPs have changed (and some kernel interface might actually allow such updates without reset). It also fixes traffic based lifetimes in such situations. Fixes #799.
* kernel-interface: Add a separate "update" flag to add_sa()Martin Willi2015-03-091-3/+3
| | | | | | | | | | | The current "inbound" flag is used for two purposes: To define the actual direction of the SA, but also to determine the operation used for SA installation. If an SPI has been allocated, an update operation is required instead of an add. While the inbound flag normally defines the kind of operation required, this is not necessarily true in all cases. On the HA passive node, we install inbound SAs without prior SPI allocation.
* kernel-netlink: Respect kernel routing priorities for IKE routesMartin Willi2015-03-031-2/+15
| | | | | | | | If a system uses routing metrics, we should honor them when doing (manual) routing lookups for IKE. When enumerating routes, the kernel reports priorities with the RTA_PRIORITY attribute, not RTA_METRICS. We prefer routes with a lower priority value, and fall back to longest prefix match priorities if the priority value is equal.
* kernel-interface: Raise mapping event with a proto/SPI/dst tupleMartin Willi2015-02-201-8/+14
|
* kernel-interface: Raise expires with a proto/SPI/dst tuple instead of reqidMartin Willi2015-02-201-9/+10
|
* kernel-interface: Pass full list of traffic selectors to add_sa()Martin Willi2015-02-201-3/+5
| | | | | | While we can handle the first selector only in BEET mode in kernel-netlink, passing the full list gives the backend more flexibility how to handle this information.
* kernel-interface: Remove reqid parameter from get_spi/get_cpi() methodsMartin Willi2015-02-201-14/+9
| | | | | | | | | | The reqid is not strictly required, as we set the reqid with the update call when installing the negotiated SA. If we don't need a reqid at this stage, we can later allocate the reqid in the kernel backend once the SA parameters have been fully negotaited. This allows us to assign the same reqid for the same selectors to avoid conflicts on backends this is necessary.
* Fixed some typos, courtesy of codespellTobias Brunner2014-12-151-1/+1
|
* kernel-netlink: Optionally ignore errors resulting from response message lossMartin Willi2014-11-211-0/+82
| | | | | | | | | | | | | | | As some backends over unreliable transport do not cache response messages, retransmissions due the loss of responses perform the operation again. Add an option to ignore some errors arising from such duplicate operations. Note: This approach can't distinguish between real EXIST/NOTFOUND errors and packet failures, and therefore is a source of race conditions and can't detect any of these errors actually happening. Therefore that behavior is disabled by default, and can be enabled with the ignore_retransmit_errors strongswan.conf option. To properly distinguish between real and retransmission errors, a Netlink backend should implement retransmission detection using sequence numbers.
* kernel-netlink: Add an option to enforce using XFRM_MSG_UPDPOLICYMartin Willi2014-11-211-0/+12
|
* kernel-netlink: Fallback to UDP if detecting socket protocol failsMartin Willi2014-11-211-2/+4
| | | | | getsockopt(SO_PROTOCOL) is not supported before 2.6.32. Default to UDP if either the SO_PROTOCOL define is missing or the syscall fails.
* kernel-netlink: Alternatively support global port based IKE bypass policiesMartin Willi2014-11-211-3/+160
| | | | | | The socket based IKE bypass policies are usually superior, but not supported on all networking stacks. The port based variant uses global policies for the UDP ports we have IKE sockets for.
* kernel-netlink: Add options to enable parallel Netlink queries explicitlyMartin Willi2014-11-215-20/+39
| | | | | | As under vanilla Linux the kernel can't handle parallel dump queries and returns EBUSY, it makes not much sense to use them. Disable parallel queries by default to basically restore original behavior, improving performance.
* kernel-netlink: Release lock while doing Netlink NEW/DELADDR operationsMartin Willi2014-11-211-8/+17
| | | | | | | | Besides that it can improve throughput, it avoids a deadlock situation. If all threads are busy, watcher will invoke the FD notification for NEWADDR events itself. If the lock is held, it gets locked up. As watcher is not dispatching anymore, it can't signal Netlink socket send() completion, and the send() operation does not return and keeps the lock.
* kernel-netlink: Add non-dumping variants of echo and stress testsMartin Willi2014-11-211-0/+84
|
* kernel-netlink: Add test cases for successful and timing out retransmissionsMartin Willi2014-11-212-0/+90
|
* kernel-netlink: Add a compile-time hook to simulate request message lossMartin Willi2014-11-211-0/+15
|
* kernel-netlink: Implement configurable Netlink request retransmissionMartin Willi2014-11-211-15/+86
|
* kernel-netlink: Add a stress test with several threads doing Netlink exchangesMartin Willi2014-11-211-0/+62
|
* kernel-netlink: Retry netlink query while kernel returns EBUSYMartin Willi2014-11-211-3/+37
| | | | | | If the kernel can't execute a Netlink query because a different query is already active, it returns EBUSY. As this can happen now as we support parallel queries, retry on this error condition.
* kernel-netlink: Support parallel Netlink queriesMartin Willi2014-11-211-74/+192
| | | | | | | | | | | | | | | | | | Instead of locking the socket exclusively to wait for replies, use watcher to wait for and read in responses asynchronously. This allows multiple parallel Netlink queries, which can significantly improve performance if the kernel Netlink layer has longer latencies and supports parallel queries. For vanilla Linux, parallel queries don't make much sense, as it usually returns EBUSY for the relevant dump requests. This requires a retry, and in the end makes queries more expensive under high load. Instead of checking the Netlink message sequence number to detect multi-part messages, this code now relies on the NLM_F_MULTI flag to detect them. This has previously been avoided (by 1d51abb7). It is unclear if the flag did not work correctly on very old Linux kernels, or if the flag was not used appropriately by strongSwan. The flag seems to work just fine back to 2.6.18, which is a kernel still in use by RedHat/CentOS 5.
* kernel-netlink: Add a simple send message test querying available linksMartin Willi2014-11-213-0/+70
|
* kernel-netlink: Add a stub for a test-runnerMartin Willi2014-11-214-0/+85
|
* kernel-netlink: Define and use rtnetlink message typesMartin Willi2014-09-241-1/+22
|
* kernel-netlink: Pass protocol specific enum names to socket constructorMartin Willi2014-09-244-12/+13
| | | | | This avoid the hard dependency on enum names, and makes kernel_netlink_shared independent of kernel_netlink_ipsec.
* kernel-netlink: Clean up socket initialization, handle 0 as valid socket fdMartin Willi2014-09-241-9/+6
|
* kernel-netlink: Clean up response buffer managementMartin Willi2014-09-241-24/+16
|
* kernel-netlink: Use recv() instead of recvfrom()Martin Willi2014-09-241-11/+3
| | | | | As we are not interested in the returned address, there is really no need in passing that argument.
* kernel-netlink: Avoid casting the NLMSG_DATA() return valueMartin Willi2014-09-243-26/+26
| | | | There is really no need for doing so, and it makes the code just unreadable.
* kernel-netlink: Define netlink buffer as an union having a netlink headerMartin Willi2014-09-243-20/+23
| | | | | This allows us to streamline the netlink buffers, and avoid extensive casting.
* kernel-netlink: Optionally install protocol and ports on transport mode SAsTobias Brunner2014-09-121-6/+18
|
* kernel-netlink: Add global option to configure MSS-clamping on installed routesTobias Brunner2014-09-121-6/+26
|
* kernel-netlink: Add global option to set MTU on installed routesTobias Brunner2014-09-121-0/+19
|
* kernel-netlink: Rename algorithm identifier from cast128 to cast5Martin Willi2014-07-041-1/+1
| | | | | | | | | | | Even if the XFRM identifier was named cast128 in the kernel before 2.6.31, it actually never worked, because there is no such crypto algorithm. The identifier has been changed to cast5 in https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=245acb87 to make it work, so we should use that. Fixes #633.
* kernel-netlink: Cast IPv6 address blobs to the proper typeTobias Brunner2014-06-241-3/+3
| | | | On Android these macros are defined as functions.
* kernel-netlink: Install virtual IPv6 addresses as deprecatedTobias Brunner2014-06-201-0/+11
| | | | | | | | This should prevent the kernel's IPv6 source address selection algorithm from using this address unless it is forced to by our source route. This is helpful if split tunneling is used. Fixes #598.
* kernel-netlink: Pass prefix when looking up next hop for shunt policiesTobias Brunner2014-06-191-1/+12
|
* kernel-netlink: Add support for destination prefix when determining next hopTobias Brunner2014-06-191-20/+35
|
* kernel-interface: Add destination prefix to get_nexthop()Tobias Brunner2014-06-192-2/+2
| | | | | This allows to determine the next hop to reach a subnet, for instance, when installing routes for shunt policies.
* kernel-netlink: Add support for new policy priority classTobias Brunner2014-06-191-2/+5
|
* kernel-netlink: Follow RFC 6724 when selecting IPv6 source addressesTobias Brunner2014-06-191-26/+170
| | | | | | | | Instead of using the first address we find on an interface we should consider properties like an address' scope or whether it is temporary or public. Fixes #543.
* kernel-netlink: Never use XFRMA_REPLAY_ESN_VAL to configure zero replay windowsMartin Willi2014-06-181-1/+1
| | | | | | Trying to disable replay windows using the ESN attribute fails with EINVAL. Use non-ESN legacy format to disable replay windows, even if ESN has been negotiated over IKE.
* kernel-netlink: Support connection specific replay window sizesMartin Willi2014-06-171-39/+16
|
* kernel-interface: Add a replay_window parameter to add_sa()Martin Willi2014-06-171-4/+5
|
* plugins: Don't link with -rdynamic on WindowsMartin Willi2014-06-041-1/+1
|
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-04 16:37:28 +0000