aboutsummaryrefslogtreecommitdiffstats
path: root/src/libhydra/plugins
Commit message (Collapse)AuthorAgeFilesLines
...
* pool: Move the pool utility to its own directory in srcTobias Brunner2013-10-117-2232/+1
|
* attr-sql: Handle concurrent insertion of identitiesTobias Brunner2013-10-111-2/+12
| | | | | | | | | If the same identity is added concurrently by two threads (or by the pool utility) INSERT might fail even though the SELECT was unsuccessful before. We are currently not able to lock the identities table in a portable way (something like SELECT ... FOR UPDATE on MySQL).
* attr-sql: Don't use database transactions in create_attribute_enumeratorTobias Brunner2013-10-111-5/+0
| | | | | | | | | There could, of course, be race conditions when enumerating the attributes, but those probably don't matter (e.g. missing an attribute that was concurrently added). Transactions are more intended to revert multiple changes if anything fails in the process.
* kernel: Use a time_t to report use time in query_policy()Martin Willi2013-10-113-3/+3
|
* kernel: Use a time_t to report use time in query_sa()Martin Willi2013-10-113-3/+3
|
* kernel-netlink: Allow to override xfrm_acq_expires valueAnsis Atteka2013-09-231-6/+10
| | | | | | | | | | | | | | | | When using auto=route, current xfrm_acq_expires default value implies that tunnel can be down for up to 165 seconds, if other peer rejected first IKE request with an AUTH_FAILED or NO_PROPOSAL_CHOSEN error message. These error messages are completely normal in setups where another application pushes configuration to both strongSwans without waiting for acknowledgment that they have updated their configurations. This patch allows strongswan to override xfrm_acq_expires default value by setting charon.plugins.kernel-netlink.xfrm_acq_expires in strongswan.conf. Signed-off-by: Ansis Atteka <aatteka@nicira.com>
* resolve: Remove comment when using resolvconf(8)Tobias Brunner2013-09-131-2/+1
| | | | | | | | | | | Since comments in resolv.conf are only valid at the beginning of a line resolvconf(8) seems to have started treating any text after 'nameserver <ip>' as additional IP addresses for name servers. Since it ignores comments, and we can easily remove the added servers again, there is no point to add any. Fixes #410.
* kernel-netlink: increase buffer size for RT netlink messagesAnsis Atteka2013-09-101-1/+1
| | | | | | | | | | | | | | | | | | | | Commit 940e1b0f66dc04b0853414c1f4c45fa3f6e33bdd "Filter ignored interfaces in kernel interfaces (for events, address enumeration, etc.)" made charon to ignore routes with unusable interfaces. Unusable interface is one where charon has not seen RTM_NEWLINK message from the kernel. Sometime RTM_NEWLINK message can be 1048 bytes large. This is 24 bytes more than currently allocated buffer of 1024 bytes. If kernel sends such a large message, then it would be silently ignored by charon and corresponding interface would never become usable. Hence strongSwan might resolve invalid source IP address in get_route() function. This would prevent IPsec tunnel to be established. To reproduce create a VLAN interface with following command: vconfig add eth1 12
* kernel-pfroute: Fix mixed up memset() call in get_route()Mathias Krause2013-08-291-1/+1
| | | | | | | | | | The retry code introduced in dc8b083 got the memset() arguments wrong. Fix this to ensure the buffer gets zeroed, for real. It probably doesn't matter as we do reset the message length on retry, so the stale data shouldn't be seen by anyone. Found-by: git grep 'memset\s*\([^,]*,\s*[^,]*,\s*0\s*\)'
* kernel-netlink: Fix calculation of ESN bitmap lengthTobias Brunner2013-08-211-4/+12
| | | | | While bmp_len stores the number of u_int32_t the allocated bitmap actually consists of those integers.
* kernel-netlink,pfroute: Properly update address flag within ROAM_DELAYTobias Brunner2013-08-122-2/+2
| | | | | | | 77d4a02 and 55da01f only updated the address flag when a job was created, which obviously had the same limitation as the old code. Fixes #374.
* kernel-pfroute: Implement roam event handling like in the kernel-netlink pluginTobias Brunner2013-08-121-13/+36
| | | | | There was no proper locking and the issue regarding the address flag also existed.
* kernel-netlink: Ensure address changes are not missed in roam eventsTobias Brunner2013-08-121-4/+15
| | | | | | | | | | | | | | | | If multiple roam events are triggered within ROAM_DELAY, only one job is created. The old code set the address flag to the value of the last triggering call. So if a route change followed an address change within ROAM_DELAY the address change was missed by the upper layers, e.g. causing it not to update the list of addresses via MOBIKE. The new code now keeps the state of the address flag until the job is actually executed, which still has some issues. For instance, if an address disappears and reappears within ROAM_RELAY, the flag would not have to be set to TRUE. So address updates might occasionally get triggered where none would actually be required. Fixes #374.
* kernel-pfkey: Add sanity check when deleting policiesTobias Brunner2013-07-241-0/+5
|
* kernel-pfroute: use watcher to receive kernel eventsMartin Willi2013-07-181-17/+13
|
* kernel-pfkey: use watcher to receive networking eventsMartin Willi2013-07-181-19/+13
|
* kernel-netlink: use watcher to receive kernel events for net/ipsecMartin Willi2013-07-182-35/+24
|
* kernel-pfkey: Fail route installation if remote TS matches peerTobias Brunner2013-07-181-0/+8
|
* capabilities: Some plugins don't actually require capabilities at runtimeTobias Brunner2013-07-181-1/+1
|
* automake: replace INCLUDES by AM_CPPFLAGSMartin Willi2013-07-187-26/+39
| | | | | | INCLUDES are now deprecated and throw warnings when using automake 1.13. We now also differentiate AM_CPPFLAGS and AM_CFLAGS, where includes and defines are passed to AM_CPPFLAGS only.
* kernel-pfroute: Ignore IP address changes if address is %anyTobias Brunner2013-07-171-1/+2
|
* kernel-pfroute: Properly enumerate sockaddrs in interface messagesTobias Brunner2013-07-171-9/+26
| | | | | The ifa_msghdr and rt_msghdr structs are not compatible (at least not on FreeBSD).
* kernel-pfroute: Provide name of interfaces on which virtual IPs are installedTobias Brunner2013-07-172-1/+23
|
* kernel-pfroute: Ignore virtual IPs in address mapTobias Brunner2013-07-171-13/+9
| | | | | As the virtual flag is set after the address has been added to the map, we make sure we ignore virtual IPs when doing lookups.
* kernel-pfroute: Make sure source addresses are not virtual and usableTobias Brunner2013-07-171-4/+20
| | | | | | | It seems we sometimes get the virtual IP as source (with rightsubnet=0.0.0.0/0) even if the exclude route is already installed. Might be a timing issue because shortly afterwards the lookup seems to succeed.
* kernel-pfroute: Don't report an error when trying to reinstall a routeTobias Brunner2013-07-171-0/+4
|
* kernel-pfkey: Provide interface name when installing exclude routeTobias Brunner2013-07-171-4/+15
|
* kernel-pfroute: Reinstall routes on interface/address changesTobias Brunner2013-07-171-7/+320
|
* kernel-pfroute: Trigger a roam event if a new interface appearsTobias Brunner2013-07-171-0/+4
|
* kernel-pfroute: Use ref_get() to allocate sequence numbersTobias Brunner2013-07-171-3/+3
|
* kernel-pfroute: Make time that is waited for VIPs to appear configurableTobias Brunner2013-07-171-2/+11
| | | | | One second might be too short for IPs to appear/disappear, especially on virtualized hosts.
* kernel-pfroute: Retry route lookup without source address on failureTobias Brunner2013-07-171-1/+16
| | | | | The known source address might be gone resulting in an error, making learning a new source address impossible.
* kernel-pfkey: Remove latest IPsec SA mapping when deleting a policyTobias Brunner2013-07-171-5/+12
| | | | | | | | | | | If IPsec SAs are rekeyed due to an address change (e.g. because update_sa is not supported) the exact same policy with the same reqid will be installed, but with different addresses. After the rekeying the old SA and its policies are removed, using the first matching mapping breaks the mapping between the policies and the new SA (at least on FreeBSD, the Linux kernel might only use the reqid for this). Using the oldest matching SA is still an approximation but it solves the above issue.
* kernel-pfkey: Correctly handle IPSEC_PROTO_ANY in an acquireTobias Brunner2013-07-171-2/+5
|
* linked-list: Remove barely used find_last() methodTobias Brunner2013-07-172-5/+6
|
* Use strpfx() helper where appropriateTobias Brunner2013-07-082-3/+3
|
* attr-sql: Add unity_split_exclude as alias for unity_local_lanTobias Brunner2013-07-081-0/+1
|
* attr-sql: Fix double free when adding subnets for unknown attribute typesTobias Brunner2013-07-081-0/+1
|
* plugin-loader: Removed unused path argument of load() methodTobias Brunner2013-06-281-1/+1
| | | | | Multiple additional search paths can be added with the add_path() method.
* kernel-netlink: Make CAP_NET_ADMIN capability optionalTobias Brunner2013-06-251-3/+4
| | | | It is not required to use the kernel-net part of the plugin.
* capabilities: Only plugins that require CAP_NET_ADMIN demand itTobias Brunner2013-06-252-0/+13
| | | | The daemon as such does not require this capability.
* kernel-pfroute: Simplify route lookup after fixing sockaddr parsingTobias Brunner2013-06-211-90/+19
|
* kernel-pfroute: Alignment of sockaddrs is not always the sameTobias Brunner2013-06-211-1/+8
|
* kernel-pfroute: struct sockaddr arguments are 4 byte alignedTobias Brunner2013-06-211-4/+8
| | | | | | | | | This was noticed on Mac OS X where, if the default route is returned, RTA_NETMASK has sa_len set to 0, but skipping zero bytes to read the next address makes no sense, of course. Using 0 for sa_len seems a bit strange, in particular, because struct sockaddr has by definition a minimum length of 16 bytes. But it seems FreeBSD actually does the same.
* kernel-pfroute: Improve route lookup depending on information we get backTobias Brunner2013-06-211-12/+96
| | | | Kernels don't provide the same information for all routes.
* kernel-pfroute: Try to ensure we get a source address or interface nameTobias Brunner2013-06-211-0/+6
|
* kernel-pfroute: Use DST as nexthop for host routesTobias Brunner2013-06-211-0/+6
| | | | These are created as cache/clone on Mac OS X.
* kernel-pfroute: Implement get_source_addr()Tobias Brunner2013-06-211-12/+27
|
* kernel-pfroute: Properly install routes with interface and gatewayTobias Brunner2013-06-211-5/+6
|
* kernel-pfroute: Activate TUN device before setting addressTobias Brunner2013-06-211-1/+1
| | | | | On FreeBSD, for some reason, we don't learn the interface is up otherwise. Even though ifconfig lists it as up at the same time.
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-02 02:17:33 +0000