aboutsummaryrefslogtreecommitdiffstats
path: root/src/libhydra/plugins/kernel_pfkey
Commit message (Collapse)AuthorAgeFilesLines
* libhydra: Use lib->ns instead of hydra->daemonTobias Brunner2014-02-121-2/+2
|
* kernel-pfkey: Install ICMP[v6] type/code as expected by the Linux kernelTobias Brunner2013-10-171-19/+52
|
* kernel: Use a time_t to report use time in query_policy()Martin Willi2013-10-111-1/+1
|
* kernel: Use a time_t to report use time in query_sa()Martin Willi2013-10-111-1/+1
|
* kernel-pfkey: Add sanity check when deleting policiesTobias Brunner2013-07-241-0/+5
|
* kernel-pfkey: use watcher to receive networking eventsMartin Willi2013-07-181-19/+13
|
* kernel-pfkey: Fail route installation if remote TS matches peerTobias Brunner2013-07-181-0/+8
|
* capabilities: Some plugins don't actually require capabilities at runtimeTobias Brunner2013-07-181-1/+1
|
* automake: replace INCLUDES by AM_CPPFLAGSMartin Willi2013-07-181-3/+5
| | | | | | INCLUDES are now deprecated and throw warnings when using automake 1.13. We now also differentiate AM_CPPFLAGS and AM_CFLAGS, where includes and defines are passed to AM_CPPFLAGS only.
* kernel-pfkey: Provide interface name when installing exclude routeTobias Brunner2013-07-171-4/+15
|
* kernel-pfkey: Remove latest IPsec SA mapping when deleting a policyTobias Brunner2013-07-171-5/+12
| | | | | | | | | | | If IPsec SAs are rekeyed due to an address change (e.g. because update_sa is not supported) the exact same policy with the same reqid will be installed, but with different addresses. After the rekeying the old SA and its policies are removed, using the first matching mapping breaks the mapping between the policies and the new SA (at least on FreeBSD, the Linux kernel might only use the reqid for this). Using the oldest matching SA is still an approximation but it solves the above issue.
* kernel-pfkey: Correctly handle IPSEC_PROTO_ANY in an acquireTobias Brunner2013-07-171-2/+5
|
* linked-list: Remove barely used find_last() methodTobias Brunner2013-07-171-3/+3
|
* capabilities: Only plugins that require CAP_NET_ADMIN demand itTobias Brunner2013-06-251-0/+6
| | | | The daemon as such does not require this capability.
* kernel-interface: add an exchange initiator parameter to add_sa()Martin Willi2013-06-111-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This new flag gives the kernel-interface a hint how it should priorize the use of newly installed SAs during rekeying. Consider the following rekey procedure in IKEv2: Initiator --- Responder I1 -------CREATE-------> R1 I2 <------CREATE-------- -------DELETE-------> R2 I3 <------DELETE-------- SAs are always handled as pairs, the following happens at the SA level: * Initiator starts the exchange at I1 * Responder installs new SA pair at R1 * Initiator installs new SA pair at I2 * Responder removes old SA pair at R2 * Initiator removes old SA pair at I3 This makes sure SAs get installed/removed overlapping during rekeying. However, to avoid any packet loss, it is crucial that the new outbound SA gets activated at the correct position: * as exchange initiator, in I2 * as exchange responder, in R2 This should guarantee that we don't use the new outbound SA before the peer could install its corresponding inbound SA. The new parameter allows the kernel backend to install the new SA with appropriate priorities, i.e. it should: * as exchange inititator, have the new outbound SA installed with higher priority than the old SA * as exchange responder, have the new outbound SA installed with lower priority than the old SA While we could split up the SA installation at the responder, this approach has another advantage: it allows the kernel backend to switch SAs based on other criteria, for example when receiving traffic on the new inbound SA.
* kernel-interface: query SAD for last use time if SPD query didn't yield oneMartin Willi2013-05-061-2/+14
|
* kernel-pfkey: be less verbose about unexpected sequence numbersMartin Willi2013-05-061-1/+1
|
* kernel-pfkey: install exclude routes if kernel-net requires themMartin Willi2013-05-061-0/+152
|
* kernel-pfkey: when installing a route for a virtual IP, use its interfaceMartin Willi2013-05-061-1/+10
| | | | | When installing a route over a tun device for a virtual IP, the route must be set over the tun, not the IKE interface.
* kernel-interface: get_address_by_ts() can tell if a returned IP is virtualMartin Willi2013-05-061-1/+1
|
* kernel-pfkey: refactor route installation to a dedicate functionMartin Willi2013-05-061-74/+81
|
* kernel-pfkey: check if we have a gateway before comparing themMartin Willi2013-05-061-0/+1
|
* kernel-pfkey: install route along with input, not forward policiesMartin Willi2013-05-061-20/+20
| | | | | | As forwarding policies are not available on all systems (OS X), using the forward policy to attach the route is a bad pick. Using input policies allows OS X to install routes.
* kernel-pfkey: use an int to set esp_port with a sysctl on OS XMartin Willi2013-05-061-2/+4
|
* kernel-pfkey: remove obsolete pluto specific behaviorMartin Willi2013-05-061-5/+1
|
* Pass correclty sized pointer to lookup_algorithm() in PF_KEYMartin Willi2013-03-141-1/+1
|
* kernel_ipsec_t.query_sa() additionally returns the number of processed packetsMartin Willi2013-03-141-2/+11
|
* Use a complete port range in traffic_selector_create_from_{subnet,cidr}Martin Willi2013-02-211-2/+2
|
* Moved debug.[ch] to utils folderTobias Brunner2012-10-241-1/+1
|
* Moved data structures to new collections subfolderTobias Brunner2012-10-241-2/+2
|
* Moved host_t and host_resolver_t to a new networking subfolderTobias Brunner2012-10-241-1/+1
|
* Added missing break statements in NAT-T mapping handling in PF_KEY pluginTobias Brunner2012-09-281-0/+2
|
* Make sure the if_name member of cached route entries is initialized to NULLTobias Brunner2012-09-221-2/+5
|
* Make it easy to check if an address is locally usable via changed ↵Tobias Brunner2012-09-211-4/+3
| | | | get_interface() method
* Use source address in get_nexthop() callTobias Brunner2012-09-211-1/+2
| | | | | Otherwise the nexthop returned might belong to a different route than the one actually used with the current source address.
* Added algorithm lookup via kernel_interface_t to the various kernel interfacesTobias Brunner2012-09-131-4/+20
|
* Let kernel interfaces decide how to enable UDP decapsulation of ESP packets.Tobias Brunner2012-08-081-0/+42
|
* Centralized thread cancellation in processor_tTobias Brunner2012-06-251-12/+4
| | | | | | | | | | This ensures that no threads are active when plugins and the rest of the daemon are unloaded. callback_job_t was simplified a lot in the process as its main functionality is now contained in processor_t. The parent-child relationships were abandoned as these were only needed to simplify job cancellation.
* Don't compare ports when comparing cached routes.Tobias Brunner2012-06-151-2/+2
| | | | At least src_ip has a port set sometimes.
* Disabled listening for kernel events in starter.Tobias Brunner2012-06-081-18/+26
|
* Properly install policies with ports in PF_KEY kernel interface.Tobias Brunner2012-06-071-27/+28
|
* Route reinstallation in kernel_ipsec_t implementations is not needed anymore.Tobias Brunner2012-05-021-6/+1
|
* Silently install route again, even if it did not change.Tobias Brunner2011-11-041-1/+6
| | | | | Address/interface changes can cause the route to disappear. Afterwards the route might look the same but that does not mean it is still installed.
* Compile warning fixed in kernel interfaces.Tobias Brunner2011-11-041-1/+1
|
* Implemented flushing of SAD and SPD entries via PF_KEY.Tobias Brunner2011-10-211-0/+68
|
* Add features support to kernel-pfkey pluginMartin Willi2011-10-141-5/+12
|
* Install fallback drop policies to avoid transmitting unencrypted packets.Tobias Brunner2011-07-271-0/+3
| | | | | | | During the update of a CHILD_SA (e.g. caused by MOBIKE) the old policy is first uninstalled and then the new one is installed. In the short time in between, where no policy is available in the kernel, unencrypted packets could have been transmitted.
* Remove policies in kernel interfaces based on their priority.Tobias Brunner2011-07-271-17/+34
| | | | | | This allows to unroute a connection while the same connection is currently established. In this case both CHILD_SAs share the same reqid but the installed policies have different priorities.
* Fixed common misspellings.Tobias Brunner2011-07-201-1/+1
| | | | Mostly found by 'codespell'.
* Record usage history of policies in PF_KEY kernel interface.Tobias Brunner2011-07-061-169/+457
| | | | The implementation is nearly the same as in the Netlink kernel interface.
generated by cgit v1.2.3 (git 2.25.1) at 2025-07-28 17:04:34 +0000