aboutsummaryrefslogtreecommitdiffstats
path: root/src/libhydra/plugins/kernel_pfkey
Commit message (Collapse)AuthorAgeFilesLines
* kernel-pfkey: Report packet counts of IPsec SAsTobias Brunner2014-09-091-2/+2
| | | | | | Seems that packet counts can be retrieved after all. At least the Linux and FreeBSD kernels treat the number of allocations as number of packets. We actually installed packet limits in that field already.
* kernel-pfkey: Use address in TS to determine interface for shunt routesTobias Brunner2014-06-261-6/+9
|
* kernel-pfkey: Use subnet and prefix when determining nexthop for shunt ↵Tobias Brunner2014-06-261-2/+12
| | | | | | policy routes This is basically the same as 88f125f5605e54b38cf8913df79e32ec6bddff10.
* kernel-pfkey: Install routes for shunt policiesTobias Brunner2014-06-261-4/+4
|
* kernel-interface: Add destination prefix to get_nexthop()Tobias Brunner2014-06-191-2/+2
| | | | | This allows to determine the next hop to reach a subnet, for instance, when installing routes for shunt policies.
* kernel-pfkey: Add support for new policy priority classTobias Brunner2014-06-191-2/+5
|
* kernel-pfkey: Support connection specific replay window sizes up to 32 packetsMartin Willi2014-06-171-1/+1
|
* kernel-interface: Add a replay_window parameter to add_sa()Martin Willi2014-06-171-3/+4
|
* plugins: Don't link with -rdynamic on WindowsMartin Willi2014-06-041-1/+1
|
* pfkey: Always include stdint.hTobias Brunner2014-05-191-1/+1
| | | | | | On some systems (e.g. on Debian/kFreeBSD) that header is required when including ipsec.h, on Linux we require it too when including pfkeyv2.h, so to simplify things we just always include it.
* kernel-pfkey: Added IPComp supportFrancois ten Krooden2014-04-241-19/+138
| | | | | | - get_cpi function was implemented to retrieve a CPI from the kernel. - add_sa/update_sa/del_sa were updated to accommodate for IPComp SA. - Updated add_policy_internal to update the SPD to support IPComp.
* libhydra: Use lib->ns instead of hydra->daemonTobias Brunner2014-02-121-2/+2
|
* kernel-pfkey: Install ICMP[v6] type/code as expected by the Linux kernelTobias Brunner2013-10-171-19/+52
|
* kernel: Use a time_t to report use time in query_policy()Martin Willi2013-10-111-1/+1
|
* kernel: Use a time_t to report use time in query_sa()Martin Willi2013-10-111-1/+1
|
* kernel-pfkey: Add sanity check when deleting policiesTobias Brunner2013-07-241-0/+5
|
* kernel-pfkey: use watcher to receive networking eventsMartin Willi2013-07-181-19/+13
|
* kernel-pfkey: Fail route installation if remote TS matches peerTobias Brunner2013-07-181-0/+8
|
* capabilities: Some plugins don't actually require capabilities at runtimeTobias Brunner2013-07-181-1/+1
|
* automake: replace INCLUDES by AM_CPPFLAGSMartin Willi2013-07-181-3/+5
| | | | | | INCLUDES are now deprecated and throw warnings when using automake 1.13. We now also differentiate AM_CPPFLAGS and AM_CFLAGS, where includes and defines are passed to AM_CPPFLAGS only.
* kernel-pfkey: Provide interface name when installing exclude routeTobias Brunner2013-07-171-4/+15
|
* kernel-pfkey: Remove latest IPsec SA mapping when deleting a policyTobias Brunner2013-07-171-5/+12
| | | | | | | | | | | If IPsec SAs are rekeyed due to an address change (e.g. because update_sa is not supported) the exact same policy with the same reqid will be installed, but with different addresses. After the rekeying the old SA and its policies are removed, using the first matching mapping breaks the mapping between the policies and the new SA (at least on FreeBSD, the Linux kernel might only use the reqid for this). Using the oldest matching SA is still an approximation but it solves the above issue.
* kernel-pfkey: Correctly handle IPSEC_PROTO_ANY in an acquireTobias Brunner2013-07-171-2/+5
|
* linked-list: Remove barely used find_last() methodTobias Brunner2013-07-171-3/+3
|
* capabilities: Only plugins that require CAP_NET_ADMIN demand itTobias Brunner2013-06-251-0/+6
| | | | The daemon as such does not require this capability.
* kernel-interface: add an exchange initiator parameter to add_sa()Martin Willi2013-06-111-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This new flag gives the kernel-interface a hint how it should priorize the use of newly installed SAs during rekeying. Consider the following rekey procedure in IKEv2: Initiator --- Responder I1 -------CREATE-------> R1 I2 <------CREATE-------- -------DELETE-------> R2 I3 <------DELETE-------- SAs are always handled as pairs, the following happens at the SA level: * Initiator starts the exchange at I1 * Responder installs new SA pair at R1 * Initiator installs new SA pair at I2 * Responder removes old SA pair at R2 * Initiator removes old SA pair at I3 This makes sure SAs get installed/removed overlapping during rekeying. However, to avoid any packet loss, it is crucial that the new outbound SA gets activated at the correct position: * as exchange initiator, in I2 * as exchange responder, in R2 This should guarantee that we don't use the new outbound SA before the peer could install its corresponding inbound SA. The new parameter allows the kernel backend to install the new SA with appropriate priorities, i.e. it should: * as exchange inititator, have the new outbound SA installed with higher priority than the old SA * as exchange responder, have the new outbound SA installed with lower priority than the old SA While we could split up the SA installation at the responder, this approach has another advantage: it allows the kernel backend to switch SAs based on other criteria, for example when receiving traffic on the new inbound SA.
* kernel-interface: query SAD for last use time if SPD query didn't yield oneMartin Willi2013-05-061-2/+14
|
* kernel-pfkey: be less verbose about unexpected sequence numbersMartin Willi2013-05-061-1/+1
|
* kernel-pfkey: install exclude routes if kernel-net requires themMartin Willi2013-05-061-0/+152
|
* kernel-pfkey: when installing a route for a virtual IP, use its interfaceMartin Willi2013-05-061-1/+10
| | | | | When installing a route over a tun device for a virtual IP, the route must be set over the tun, not the IKE interface.
* kernel-interface: get_address_by_ts() can tell if a returned IP is virtualMartin Willi2013-05-061-1/+1
|
* kernel-pfkey: refactor route installation to a dedicate functionMartin Willi2013-05-061-74/+81
|
* kernel-pfkey: check if we have a gateway before comparing themMartin Willi2013-05-061-0/+1
|
* kernel-pfkey: install route along with input, not forward policiesMartin Willi2013-05-061-20/+20
| | | | | | As forwarding policies are not available on all systems (OS X), using the forward policy to attach the route is a bad pick. Using input policies allows OS X to install routes.
* kernel-pfkey: use an int to set esp_port with a sysctl on OS XMartin Willi2013-05-061-2/+4
|
* kernel-pfkey: remove obsolete pluto specific behaviorMartin Willi2013-05-061-5/+1
|
* Pass correclty sized pointer to lookup_algorithm() in PF_KEYMartin Willi2013-03-141-1/+1
|
* kernel_ipsec_t.query_sa() additionally returns the number of processed packetsMartin Willi2013-03-141-2/+11
|
* Use a complete port range in traffic_selector_create_from_{subnet,cidr}Martin Willi2013-02-211-2/+2
|
* Moved debug.[ch] to utils folderTobias Brunner2012-10-241-1/+1
|
* Moved data structures to new collections subfolderTobias Brunner2012-10-241-2/+2
|
* Moved host_t and host_resolver_t to a new networking subfolderTobias Brunner2012-10-241-1/+1
|
* Added missing break statements in NAT-T mapping handling in PF_KEY pluginTobias Brunner2012-09-281-0/+2
|
* Make sure the if_name member of cached route entries is initialized to NULLTobias Brunner2012-09-221-2/+5
|
* Make it easy to check if an address is locally usable via changed ↵Tobias Brunner2012-09-211-4/+3
| | | | get_interface() method
* Use source address in get_nexthop() callTobias Brunner2012-09-211-1/+2
| | | | | Otherwise the nexthop returned might belong to a different route than the one actually used with the current source address.
* Added algorithm lookup via kernel_interface_t to the various kernel interfacesTobias Brunner2012-09-131-4/+20
|
* Let kernel interfaces decide how to enable UDP decapsulation of ESP packets.Tobias Brunner2012-08-081-0/+42
|
* Centralized thread cancellation in processor_tTobias Brunner2012-06-251-12/+4
| | | | | | | | | | This ensures that no threads are active when plugins and the rest of the daemon are unloaded. callback_job_t was simplified a lot in the process as its main functionality is now contained in processor_t. The parent-child relationships were abandoned as these were only needed to simplify job cancellation.
* Don't compare ports when comparing cached routes.Tobias Brunner2012-06-151-2/+2
| | | | At least src_ip has a port set sometimes.
generated by cgit v1.2.3 (git 2.25.1) at 2025-07-31 15:35:57 +0000