aboutsummaryrefslogtreecommitdiffstats
path: root/src/libhydra/plugins/kernel_netlink
Commit message (Collapse)AuthorAgeFilesLines
...
* kernel-netlink: Add global option to set MTU on installed routesTobias Brunner2014-09-121-0/+19
|
* kernel-netlink: Rename algorithm identifier from cast128 to cast5Martin Willi2014-07-041-1/+1
| | | | | | | | | | | Even if the XFRM identifier was named cast128 in the kernel before 2.6.31, it actually never worked, because there is no such crypto algorithm. The identifier has been changed to cast5 in https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=245acb87 to make it work, so we should use that. Fixes #633.
* kernel-netlink: Cast IPv6 address blobs to the proper typeTobias Brunner2014-06-241-3/+3
| | | | On Android these macros are defined as functions.
* kernel-netlink: Install virtual IPv6 addresses as deprecatedTobias Brunner2014-06-201-0/+11
| | | | | | | | This should prevent the kernel's IPv6 source address selection algorithm from using this address unless it is forced to by our source route. This is helpful if split tunneling is used. Fixes #598.
* kernel-netlink: Pass prefix when looking up next hop for shunt policiesTobias Brunner2014-06-191-1/+12
|
* kernel-netlink: Add support for destination prefix when determining next hopTobias Brunner2014-06-191-20/+35
|
* kernel-interface: Add destination prefix to get_nexthop()Tobias Brunner2014-06-192-2/+2
| | | | | This allows to determine the next hop to reach a subnet, for instance, when installing routes for shunt policies.
* kernel-netlink: Add support for new policy priority classTobias Brunner2014-06-191-2/+5
|
* kernel-netlink: Follow RFC 6724 when selecting IPv6 source addressesTobias Brunner2014-06-191-26/+170
| | | | | | | | Instead of using the first address we find on an interface we should consider properties like an address' scope or whether it is temporary or public. Fixes #543.
* kernel-netlink: Never use XFRMA_REPLAY_ESN_VAL to configure zero replay windowsMartin Willi2014-06-181-1/+1
| | | | | | Trying to disable replay windows using the ESN attribute fails with EINVAL. Use non-ESN legacy format to disable replay windows, even if ESN has been negotiated over IKE.
* kernel-netlink: Support connection specific replay window sizesMartin Willi2014-06-171-39/+16
|
* kernel-interface: Add a replay_window parameter to add_sa()Martin Willi2014-06-171-4/+5
|
* plugins: Don't link with -rdynamic on WindowsMartin Willi2014-06-041-1/+1
|
* libhydra: Use lib->ns instead of hydra->daemonTobias Brunner2014-02-122-13/+13
|
* kernel-netlink: Don't cache route entries if installation failsTobias Brunner2014-02-121-2/+5
| | | | Fixes #500.
* kernel-netlink: Set selector on transport mode IPComp SAsTobias Brunner2014-01-231-1/+1
|
* kernel-netlink: Selectively add selector on SAs that use IPCompTobias Brunner2014-01-231-1/+7
| | | | | | Don't add a selector to tunnel mode SAs, these might serve multiple traffic selectors but with only one selector on the SA only the traffic matching the first one would actually get tunneled.
* kernel-netlink: Enable TFC padding only for tunnel mode ESP SAsTobias Brunner2013-11-191-2/+2
| | | | | | | The kernel does not allow them for transport mode SAs or IPComp SAs (and of course not for AH SAs). Fixes #446.
* kernel-netlink: Check existence of linux/fib_rules.h, don't include it in ↵Tobias Brunner2013-10-181-1/+8
| | | | | | distribution This reverts commit b0761f1f0a5abd225edc291c8285f99a538e6a66.
* kernel-netlink: Convert ports in acquires to ICMP[v6] type and codeTobias Brunner2013-10-171-3/+8
|
* kernel-netlink: Properly install policies with ICMP[v6] types and codesTobias Brunner2013-10-171-1/+12
|
* kernel-netlink: Allow setting firewall marks on routing ruleTobias Brunner2013-10-111-0/+20
|
* kernel: Use a time_t to report use time in query_policy()Martin Willi2013-10-111-1/+1
|
* kernel: Use a time_t to report use time in query_sa()Martin Willi2013-10-111-1/+1
|
* kernel-netlink: Allow to override xfrm_acq_expires valueAnsis Atteka2013-09-231-6/+10
| | | | | | | | | | | | | | | | When using auto=route, current xfrm_acq_expires default value implies that tunnel can be down for up to 165 seconds, if other peer rejected first IKE request with an AUTH_FAILED or NO_PROPOSAL_CHOSEN error message. These error messages are completely normal in setups where another application pushes configuration to both strongSwans without waiting for acknowledgment that they have updated their configurations. This patch allows strongswan to override xfrm_acq_expires default value by setting charon.plugins.kernel-netlink.xfrm_acq_expires in strongswan.conf. Signed-off-by: Ansis Atteka <aatteka@nicira.com>
* kernel-netlink: increase buffer size for RT netlink messagesAnsis Atteka2013-09-101-1/+1
| | | | | | | | | | | | | | | | | | | | Commit 940e1b0f66dc04b0853414c1f4c45fa3f6e33bdd "Filter ignored interfaces in kernel interfaces (for events, address enumeration, etc.)" made charon to ignore routes with unusable interfaces. Unusable interface is one where charon has not seen RTM_NEWLINK message from the kernel. Sometime RTM_NEWLINK message can be 1048 bytes large. This is 24 bytes more than currently allocated buffer of 1024 bytes. If kernel sends such a large message, then it would be silently ignored by charon and corresponding interface would never become usable. Hence strongSwan might resolve invalid source IP address in get_route() function. This would prevent IPsec tunnel to be established. To reproduce create a VLAN interface with following command: vconfig add eth1 12
* kernel-netlink: Fix calculation of ESN bitmap lengthTobias Brunner2013-08-211-4/+12
| | | | | While bmp_len stores the number of u_int32_t the allocated bitmap actually consists of those integers.
* kernel-netlink,pfroute: Properly update address flag within ROAM_DELAYTobias Brunner2013-08-121-1/+1
| | | | | | | 77d4a02 and 55da01f only updated the address flag when a job was created, which obviously had the same limitation as the old code. Fixes #374.
* kernel-netlink: Ensure address changes are not missed in roam eventsTobias Brunner2013-08-121-4/+15
| | | | | | | | | | | | | | | | If multiple roam events are triggered within ROAM_DELAY, only one job is created. The old code set the address flag to the value of the last triggering call. So if a route change followed an address change within ROAM_DELAY the address change was missed by the upper layers, e.g. causing it not to update the list of addresses via MOBIKE. The new code now keeps the state of the address flag until the job is actually executed, which still has some issues. For instance, if an address disappears and reappears within ROAM_RELAY, the flag would not have to be set to TRUE. So address updates might occasionally get triggered where none would actually be required. Fixes #374.
* kernel-netlink: use watcher to receive kernel events for net/ipsecMartin Willi2013-07-182-35/+24
|
* automake: replace INCLUDES by AM_CPPFLAGSMartin Willi2013-07-181-6/+8
| | | | | | INCLUDES are now deprecated and throw warnings when using automake 1.13. We now also differentiate AM_CPPFLAGS and AM_CFLAGS, where includes and defines are passed to AM_CPPFLAGS only.
* kernel-pfroute: Provide name of interfaces on which virtual IPs are installedTobias Brunner2013-07-171-1/+1
|
* kernel-netlink: Make CAP_NET_ADMIN capability optionalTobias Brunner2013-06-251-3/+4
| | | | It is not required to use the kernel-net part of the plugin.
* capabilities: Only plugins that require CAP_NET_ADMIN demand itTobias Brunner2013-06-251-0/+7
| | | | The daemon as such does not require this capability.
* kernel-netlink: Routes don't require a gateway/nexthopTobias Brunner2013-06-211-5/+9
|
* kernel-netlink: install selectors on SA for transport/BEET mode without ↵Martin Willi2013-06-191-0/+6
| | | | | | | | proto/port If a transport/BEET SA has different selectors for different proto/ports, installing just the proto/port of the first SA would break any additional selector.
* kernel-netlink: reject policy refcount if the reqid differsMartin Willi2013-06-191-4/+17
| | | | | | | | | | | | | Previously we silently replaced an existing policy with a new one if the reqid changed for the same selectors. This will break an old policy in the favour of the new one (for example if two clients behind the same NAT use transport mode). With this change any new policy gets rejected if the reqid differs. This will make sure we break no existing policy. For rekeying and acquires we still can have overlapping policies (as we use the same reqid), but for unrelated connections this is not true anymore (it wasn't actually before, we just silently broke the existing policy).
* kernel-interface: add an exchange initiator parameter to add_sa()Martin Willi2013-06-111-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This new flag gives the kernel-interface a hint how it should priorize the use of newly installed SAs during rekeying. Consider the following rekey procedure in IKEv2: Initiator --- Responder I1 -------CREATE-------> R1 I2 <------CREATE-------- -------DELETE-------> R2 I3 <------DELETE-------- SAs are always handled as pairs, the following happens at the SA level: * Initiator starts the exchange at I1 * Responder installs new SA pair at R1 * Initiator installs new SA pair at I2 * Responder removes old SA pair at R2 * Initiator removes old SA pair at I3 This makes sure SAs get installed/removed overlapping during rekeying. However, to avoid any packet loss, it is crucial that the new outbound SA gets activated at the correct position: * as exchange initiator, in I2 * as exchange responder, in R2 This should guarantee that we don't use the new outbound SA before the peer could install its corresponding inbound SA. The new parameter allows the kernel backend to install the new SA with appropriate priorities, i.e. it should: * as exchange inititator, have the new outbound SA installed with higher priority than the old SA * as exchange responder, have the new outbound SA installed with lower priority than the old SA While we could split up the SA installation at the responder, this approach has another advantage: it allows the kernel backend to switch SAs based on other criteria, for example when receiving traffic on the new inbound SA.
* kernel-netlink: add outer addresses to policy when using BEET modeMichael Rossberg2013-05-241-1/+1
|
* kernel-interface: query SAD for last use time if SPD query didn't yield oneMartin Willi2013-05-061-1/+7
|
* kernel-interface: get_address_by_ts() can tell if a returned IP is virtualMartin Willi2013-05-061-1/+1
|
* kernel-interface: support enumeration of virtual-only IPsMartin Willi2013-05-061-3/+10
|
* kernel-netlink: remove obsolete pluto specific behaviorMartin Willi2013-05-061-7/+1
|
* kernel-netlink: Add an option to disable roam eventsTobias Brunner2013-05-031-1/+13
|
* kernel-netlink: Define defaults for routing table and prioTobias Brunner2013-05-031-0/+8
|
* Merge branch 'radius-ext'Martin Willi2013-03-181-2/+10
|\ | | | | | | | | | | Bring some extensions to eap-radius, namely a virtual IP address provider based on received Framed-IPs, forwarding of Cisco Unity banners, Interim Accounting updates and the reporting of sent/received packets.
| * kernel_ipsec_t.query_sa() additionally returns the number of processed packetsMartin Willi2013-03-141-2/+10
| |
* | Merge branch 'netlink-align'Martin Willi2013-03-183-268/+151
|\ \ | |/ |/| | | | | Fixes some Netlink alignment issues, and then refactors Netlink XFRM message attribute handling.
| * Use netlink_add_attribute() to copy over attributes during update_sa()Martin Willi2013-03-151-9/+6
| |
| * Use a helper function to add XFRM_MARK attributeMartin Willi2013-03-151-81/+37
| |
generated by cgit v1.2.3 (git 2.25.1) at 2025-07-27 16:52:55 +0000