aboutsummaryrefslogtreecommitdiffstats
path: root/src/libhydra/plugins/kernel_pfkey
Commit message (Collapse)AuthorAgeFilesLines
* libhydra: Move all kernel plugins to libcharonTobias Brunner2016-03-035-3291/+0
|
* kernel-pfkey: Enable ENCR_CAMELLIA_CBC when it's availableTobias Brunner2015-11-231-0/+3
| | | | Fixes #1214.
* kernel-pfkey: Make absolutely sure we always delete the right policy cache entryTobias Brunner2015-11-101-3/+8
|
* kernel-interface: Pass the same data to del_policy() that was passed to ↵Tobias Brunner2015-11-101-3/+5
| | | | | | | add_policy() The additional data can be helpful to identify the exact policy to delete.
* kernel-pfkey: Enable ENCR_AES_CTR when it's availableRenato Botelho2015-11-091-1/+3
| | | | | | Obtained-from: pfSense Sponsored-by: Rubicon Communications (Netgate) Closes strongswan/strongswan#17.
* kernel-pfkey: Properly encode ICMP type/code if only set on one sideTobias Brunner2015-08-311-34/+20
| | | | References #595.
* kernel-pfkey: Only flush SAs of types we actually manageTobias Brunner2015-08-211-13/+26
|
* kernel-pfkey: Add support for AES-GCMTobias Brunner2015-08-201-3/+11
| | | | | | | | | | The next release of FreeBSD will support this. While Linux defines constants for AES-GCM in pfkeyv2.h since 2.6.25 it does not actually support it. When SAs are installed via PF_KEY only a lookup in XFRM's list of encryption algorithms is done, but AES-GCM is in a different table for AEAD algorithms (there is currently no lookup function to find algorithms in that table via PF_KEY identifier).
* kernel-pfkey: When adding policies do an update if they already existTobias Brunner2015-08-131-1/+10
| | | | | This may be the case when SAs are reestablished after a crash of the IKE daemon.
* kernel-interface: Add a separate "update" flag to add_sa()Martin Willi2015-03-091-3/+3
| | | | | | | | | | | The current "inbound" flag is used for two purposes: To define the actual direction of the SA, but also to determine the operation used for SA installation. If an SPI has been allocated, an update operation is required instead of an add. While the inbound flag normally defines the kind of operation required, this is not necessarily true in all cases. On the HA passive node, we install inbound SAs without prior SPI allocation.
* kernel-pfkey: Add option to set receive buffer size of event socketTobias Brunner2015-03-061-0/+13
| | | | | | | | If many requests are sent to the kernel the events generated by these requests may fill the receive buffer before the daemon is able to read these messages. Fixes #783.
* kernel-interface: Raise mapping event with a proto/SPI/dst tupleMartin Willi2015-02-201-8/+12
|
* kernel-interface: Raise expires with a proto/SPI/dst tuple instead of reqidMartin Willi2015-02-201-9/+10
|
* kernel-interface: Pass full list of traffic selectors to add_sa()Martin Willi2015-02-201-1/+1
| | | | | | While we can handle the first selector only in BEET mode in kernel-netlink, passing the full list gives the backend more flexibility how to handle this information.
* kernel-pfkey: Don't update during add_sa(), but delete SPI allocation stateMartin Willi2015-02-201-7/+18
|
* kernel-interface: Remove reqid parameter from get_spi/get_cpi() methodsMartin Willi2015-02-201-13/+10
| | | | | | | | | | The reqid is not strictly required, as we set the reqid with the update call when installing the negotiated SA. If we don't need a reqid at this stage, we can later allocate the reqid in the kernel backend once the SA parameters have been fully negotaited. This allows us to assign the same reqid for the same selectors to avoid conflicts on backends this is necessary.
* kernel-pfkey: Fix replay window size on FreeBSD and Mac OS XTobias Brunner2014-12-151-0/+6
| | | | | | | | | The FreeBSD and Mac OS X kernels interpret sadb_sa_replay as the size of the replay window in bytes. Linux on the other hand does the same for PF_KEY it does for XFRM so sadb_sa_replay denotes the number of packets/bits in the window. Similarly, the window size on Linux is limited to 32 by the four byte default bitmap used for IPsec SAs (may only be changed with XFRMA_REPLAY_ESN_VAL), which is not the case on the other platforms.
* kernel-pfkey: Report packet counts of IPsec SAsTobias Brunner2014-09-091-2/+2
| | | | | | Seems that packet counts can be retrieved after all. At least the Linux and FreeBSD kernels treat the number of allocations as number of packets. We actually installed packet limits in that field already.
* kernel-pfkey: Use address in TS to determine interface for shunt routesTobias Brunner2014-06-261-6/+9
|
* kernel-pfkey: Use subnet and prefix when determining nexthop for shunt ↵Tobias Brunner2014-06-261-2/+12
| | | | | | policy routes This is basically the same as 88f125f5605e54b38cf8913df79e32ec6bddff10.
* kernel-pfkey: Install routes for shunt policiesTobias Brunner2014-06-261-4/+4
|
* kernel-interface: Add destination prefix to get_nexthop()Tobias Brunner2014-06-191-2/+2
| | | | | This allows to determine the next hop to reach a subnet, for instance, when installing routes for shunt policies.
* kernel-pfkey: Add support for new policy priority classTobias Brunner2014-06-191-2/+5
|
* kernel-pfkey: Support connection specific replay window sizes up to 32 packetsMartin Willi2014-06-171-1/+1
|
* kernel-interface: Add a replay_window parameter to add_sa()Martin Willi2014-06-171-3/+4
|
* plugins: Don't link with -rdynamic on WindowsMartin Willi2014-06-041-1/+1
|
* pfkey: Always include stdint.hTobias Brunner2014-05-191-1/+1
| | | | | | On some systems (e.g. on Debian/kFreeBSD) that header is required when including ipsec.h, on Linux we require it too when including pfkeyv2.h, so to simplify things we just always include it.
* kernel-pfkey: Added IPComp supportFrancois ten Krooden2014-04-241-19/+138
| | | | | | - get_cpi function was implemented to retrieve a CPI from the kernel. - add_sa/update_sa/del_sa were updated to accommodate for IPComp SA. - Updated add_policy_internal to update the SPD to support IPComp.
* libhydra: Use lib->ns instead of hydra->daemonTobias Brunner2014-02-121-2/+2
|
* kernel-pfkey: Install ICMP[v6] type/code as expected by the Linux kernelTobias Brunner2013-10-171-19/+52
|
* kernel: Use a time_t to report use time in query_policy()Martin Willi2013-10-111-1/+1
|
* kernel: Use a time_t to report use time in query_sa()Martin Willi2013-10-111-1/+1
|
* kernel-pfkey: Add sanity check when deleting policiesTobias Brunner2013-07-241-0/+5
|
* kernel-pfkey: use watcher to receive networking eventsMartin Willi2013-07-181-19/+13
|
* kernel-pfkey: Fail route installation if remote TS matches peerTobias Brunner2013-07-181-0/+8
|
* capabilities: Some plugins don't actually require capabilities at runtimeTobias Brunner2013-07-181-1/+1
|
* automake: replace INCLUDES by AM_CPPFLAGSMartin Willi2013-07-181-3/+5
| | | | | | INCLUDES are now deprecated and throw warnings when using automake 1.13. We now also differentiate AM_CPPFLAGS and AM_CFLAGS, where includes and defines are passed to AM_CPPFLAGS only.
* kernel-pfkey: Provide interface name when installing exclude routeTobias Brunner2013-07-171-4/+15
|
* kernel-pfkey: Remove latest IPsec SA mapping when deleting a policyTobias Brunner2013-07-171-5/+12
| | | | | | | | | | | If IPsec SAs are rekeyed due to an address change (e.g. because update_sa is not supported) the exact same policy with the same reqid will be installed, but with different addresses. After the rekeying the old SA and its policies are removed, using the first matching mapping breaks the mapping between the policies and the new SA (at least on FreeBSD, the Linux kernel might only use the reqid for this). Using the oldest matching SA is still an approximation but it solves the above issue.
* kernel-pfkey: Correctly handle IPSEC_PROTO_ANY in an acquireTobias Brunner2013-07-171-2/+5
|
* linked-list: Remove barely used find_last() methodTobias Brunner2013-07-171-3/+3
|
* capabilities: Only plugins that require CAP_NET_ADMIN demand itTobias Brunner2013-06-251-0/+6
| | | | The daemon as such does not require this capability.
* kernel-interface: add an exchange initiator parameter to add_sa()Martin Willi2013-06-111-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This new flag gives the kernel-interface a hint how it should priorize the use of newly installed SAs during rekeying. Consider the following rekey procedure in IKEv2: Initiator --- Responder I1 -------CREATE-------> R1 I2 <------CREATE-------- -------DELETE-------> R2 I3 <------DELETE-------- SAs are always handled as pairs, the following happens at the SA level: * Initiator starts the exchange at I1 * Responder installs new SA pair at R1 * Initiator installs new SA pair at I2 * Responder removes old SA pair at R2 * Initiator removes old SA pair at I3 This makes sure SAs get installed/removed overlapping during rekeying. However, to avoid any packet loss, it is crucial that the new outbound SA gets activated at the correct position: * as exchange initiator, in I2 * as exchange responder, in R2 This should guarantee that we don't use the new outbound SA before the peer could install its corresponding inbound SA. The new parameter allows the kernel backend to install the new SA with appropriate priorities, i.e. it should: * as exchange inititator, have the new outbound SA installed with higher priority than the old SA * as exchange responder, have the new outbound SA installed with lower priority than the old SA While we could split up the SA installation at the responder, this approach has another advantage: it allows the kernel backend to switch SAs based on other criteria, for example when receiving traffic on the new inbound SA.
* kernel-interface: query SAD for last use time if SPD query didn't yield oneMartin Willi2013-05-061-2/+14
|
* kernel-pfkey: be less verbose about unexpected sequence numbersMartin Willi2013-05-061-1/+1
|
* kernel-pfkey: install exclude routes if kernel-net requires themMartin Willi2013-05-061-0/+152
|
* kernel-pfkey: when installing a route for a virtual IP, use its interfaceMartin Willi2013-05-061-1/+10
| | | | | When installing a route over a tun device for a virtual IP, the route must be set over the tun, not the IKE interface.
* kernel-interface: get_address_by_ts() can tell if a returned IP is virtualMartin Willi2013-05-061-1/+1
|
* kernel-pfkey: refactor route installation to a dedicate functionMartin Willi2013-05-061-74/+81
|
* kernel-pfkey: check if we have a gateway before comparing themMartin Willi2013-05-061-0/+1
|
generated by cgit v1.2.3 (git 2.25.1) at 2025-07-20 04:58:15 +0000