| Commit message (Collapse) | Author | Age | Files | Lines | ||
|---|---|---|---|---|---|---|
| ... | ||||||
| * | kernel-pfroute: struct sockaddr arguments are 4 byte aligned | Tobias Brunner | 2013-06-21 | 1 | -4/+8 | |
| | | | | | | | | | | This was noticed on Mac OS X where, if the default route is returned, RTA_NETMASK has sa_len set to 0, but skipping zero bytes to read the next address makes no sense, of course. Using 0 for sa_len seems a bit strange, in particular, because struct sockaddr has by definition a minimum length of 16 bytes. But it seems FreeBSD actually does the same. | |||||
| * | kernel-pfroute: Improve route lookup depending on information we get back | Tobias Brunner | 2013-06-21 | 1 | -12/+96 | |
| | | | | | Kernels don't provide the same information for all routes. | |||||
| * | kernel-pfroute: Try to ensure we get a source address or interface name | Tobias Brunner | 2013-06-21 | 1 | -0/+6 | |
| | | ||||||
| * | kernel-pfroute: Use DST as nexthop for host routes | Tobias Brunner | 2013-06-21 | 1 | -0/+6 | |
| | | | | | These are created as cache/clone on Mac OS X. | |||||
| * | kernel-pfroute: Implement get_source_addr() | Tobias Brunner | 2013-06-21 | 1 | -12/+27 | |
| | | ||||||
| * | kernel-pfroute: Properly install routes with interface and gateway | Tobias Brunner | 2013-06-21 | 1 | -5/+6 | |
| | | ||||||
| * | kernel-pfroute: Activate TUN device before setting address | Tobias Brunner | 2013-06-21 | 1 | -1/+1 | |
| | | | | | | On FreeBSD, for some reason, we don't learn the interface is up otherwise. Even though ifconfig lists it as up at the same time. | |||||
| * | kernel-pfroute: Raise tun event when creating/destroying TUN devices for ↵ | Tobias Brunner | 2013-06-21 | 1 | -1/+6 | |
| | | | | | virtual IPs | |||||
| * | kernel-netlink: Routes don't require a gateway/nexthop | Tobias Brunner | 2013-06-21 | 1 | -5/+9 | |
| | | ||||||
| * | kernel-netlink: install selectors on SA for transport/BEET mode without ↵ | Martin Willi | 2013-06-19 | 1 | -0/+6 | |
| | | | | | | | | | proto/port If a transport/BEET SA has different selectors for different proto/ports, installing just the proto/port of the first SA would break any additional selector. | |||||
| * | kernel-netlink: reject policy refcount if the reqid differs | Martin Willi | 2013-06-19 | 1 | -4/+17 | |
| | | | | | | | | | | | | | | Previously we silently replaced an existing policy with a new one if the reqid changed for the same selectors. This will break an old policy in the favour of the new one (for example if two clients behind the same NAT use transport mode). With this change any new policy gets rejected if the reqid differs. This will make sure we break no existing policy. For rekeying and acquires we still can have overlapping policies (as we use the same reqid), but for unrelated connections this is not true anymore (it wasn't actually before, we just silently broke the existing policy). | |||||
| * | kernel-interface: add an exchange initiator parameter to add_sa() | Martin Willi | 2013-06-11 | 3 | -6/+7 | |
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This new flag gives the kernel-interface a hint how it should priorize the use of newly installed SAs during rekeying. Consider the following rekey procedure in IKEv2: Initiator --- Responder I1 -------CREATE-------> R1 I2 <------CREATE-------- -------DELETE-------> R2 I3 <------DELETE-------- SAs are always handled as pairs, the following happens at the SA level: * Initiator starts the exchange at I1 * Responder installs new SA pair at R1 * Initiator installs new SA pair at I2 * Responder removes old SA pair at R2 * Initiator removes old SA pair at I3 This makes sure SAs get installed/removed overlapping during rekeying. However, to avoid any packet loss, it is crucial that the new outbound SA gets activated at the correct position: * as exchange initiator, in I2 * as exchange responder, in R2 This should guarantee that we don't use the new outbound SA before the peer could install its corresponding inbound SA. The new parameter allows the kernel backend to install the new SA with appropriate priorities, i.e. it should: * as exchange inititator, have the new outbound SA installed with higher priority than the old SA * as exchange responder, have the new outbound SA installed with lower priority than the old SA While we could split up the SA installation at the responder, this approach has another advantage: it allows the kernel backend to switch SAs based on other criteria, for example when receiving traffic on the new inbound SA. | |||||
| * | resolve: Use plugin features to register attribute handler | Tobias Brunner | 2013-06-11 | 2 | -4/+31 | |
| | | ||||||
| * | attr: Use plugin features to register attribute provider | Tobias Brunner | 2013-06-11 | 1 | -2/+31 | |
| | | ||||||
| * | attr-sql: Use plugin features with dependency to database backend | Tobias Brunner | 2013-06-11 | 1 | -24/+53 | |
| | | ||||||
| * | attr: Fix handling of invalid IPs listed after valid ones | Tobias Brunner | 2013-06-05 | 1 | -1/+1 | |
| | | | | | | Invalid IPs listed after a valid one resulted in an attribute of the same type but with invalid data. | |||||
| * | attr: fix a compiler warning that family is used uninitialized (seen with -Os) | Martin Willi | 2013-06-05 | 1 | -2/+13 | |
| | | ||||||
| * | kernel-netlink: add outer addresses to policy when using BEET mode | Michael Rossberg | 2013-05-24 | 1 | -1/+1 | |
| | | ||||||
| * | kernel-pfroute: allow only one thread to do a route look up simultaneously | Martin Willi | 2013-05-06 | 1 | -1/+8 | |
| | | | | | Otherwise we mess up the sequence number another thread is waiting for. | |||||
| * | kernel-interface: query SAD for last use time if SPD query didn't yield one | Martin Willi | 2013-05-06 | 3 | -4/+22 | |
| | | ||||||
| * | kernel-pfkey: be less verbose about unexpected sequence numbers | Martin Willi | 2013-05-06 | 1 | -1/+1 | |
| | | ||||||
| * | kernel-pfkey: install exclude routes if kernel-net requires them | Martin Willi | 2013-05-06 | 1 | -0/+152 | |
| | | ||||||
| * | kernel-pfroute: add a feature flag requesting "exclude" routes | Martin Willi | 2013-05-06 | 1 | -0/+7 | |
| | | | | | | | | | If routes installed along with policies covering the peer address affect local IKE/ESP packets, they won't get routed correctly. To work around this issue, the kernel interface can install "exclude" routes for the IKE peer. Not all networking backends require this workaround, hence we export a flag for it if it is required. | |||||
| * | kernel-pfroute: remove unused interface address refcounting | Martin Willi | 2013-05-06 | 1 | -11/+0 | |
| | | ||||||
| * | kernel-pfroute: mark IPs installed on tun device as virtual | Martin Willi | 2013-05-06 | 1 | -1/+24 | |
| | | ||||||
| * | kernel-pfroute: install virtual IPs using dedicated tun devices | Martin Willi | 2013-05-06 | 1 | -5/+91 | |
| | | ||||||
| * | kernel-pfkey: when installing a route for a virtual IP, use its interface | Martin Willi | 2013-05-06 | 1 | -1/+10 | |
| | | | | | | When installing a route over a tun device for a virtual IP, the route must be set over the tun, not the IKE interface. | |||||
| * | kernel-interface: get_address_by_ts() can tell if a returned IP is virtual | Martin Willi | 2013-05-06 | 3 | -3/+3 | |
| | | ||||||
| * | kernel-interface: support enumeration of virtual-only IPs | Martin Willi | 2013-05-06 | 2 | -3/+14 | |
| | | ||||||
| * | kernel-pfkey: refactor route installation to a dedicate function | Martin Willi | 2013-05-06 | 1 | -74/+81 | |
| | | ||||||
| * | kernel-pfroute: split /0 routes to avoid conflict with default route | Martin Willi | 2013-05-06 | 1 | -0/+15 | |
| | | ||||||
| * | kernel-pfkey: check if we have a gateway before comparing them | Martin Willi | 2013-05-06 | 1 | -0/+1 | |
| | | ||||||
| * | kernel-pfkey: install route along with input, not forward policies | Martin Willi | 2013-05-06 | 1 | -20/+20 | |
| | | | | | | | As forwarding policies are not available on all systems (OS X), using the forward policy to attach the route is a bad pick. Using input policies allows OS X to install routes. | |||||
| * | kernel-pfroute: rescan address list for an interface if its state changes | Martin Willi | 2013-05-06 | 1 | -0/+43 | |
| | | | | | | It seems that we don't get address notifications if the interface is down on OS X. | |||||
| * | kernel-pfroute: add newly appearing interfaces to the interface cache | Martin Willi | 2013-05-06 | 1 | -1/+22 | |
| | | ||||||
| * | kernel-pfroute: implement get_nexthop() | Martin Willi | 2013-05-06 | 1 | -6/+73 | |
| | | ||||||
| * | kernel-pfroute: install and uninstall routes | Martin Willi | 2013-05-06 | 1 | -2/+129 | |
| | | ||||||
| * | kernel-pfroute: collect replies received for our own queries | Martin Willi | 2013-05-06 | 1 | -4/+40 | |
| | | ||||||
| * | kernel-pfroute: refactor PF_ROUTE message processing, use an enumerator | Martin Willi | 2013-05-06 | 1 | -35/+117 | |
| | | ||||||
| * | kernel-pfkey: use an int to set esp_port with a sysctl on OS X | Martin Willi | 2013-05-06 | 1 | -2/+4 | |
| | | ||||||
| * | kernel-pfroute: use INIT() macro for allocations | Martin Willi | 2013-05-06 | 1 | -17/+21 | |
| | | ||||||
| * | kernel-pfroute: use only a single PF_ROUTE socket for both events and queries | Martin Willi | 2013-05-06 | 1 | -27/+11 | |
| | | ||||||
| * | kernel-pfroute: fix length check when receiving PF_ROUTE messages | Martin Willi | 2013-05-06 | 1 | -1/+1 | |
| | | ||||||
| * | kernel-pfkey: remove obsolete pluto specific behavior | Martin Willi | 2013-05-06 | 1 | -5/+1 | |
| | | ||||||
| * | kernel-netlink: remove obsolete pluto specific behavior | Martin Willi | 2013-05-06 | 1 | -7/+1 | |
| | | ||||||
| * | kernel-netlink: Add an option to disable roam events | Tobias Brunner | 2013-05-03 | 1 | -1/+13 | |
| | | ||||||
| * | kernel-netlink: Define defaults for routing table and prio | Tobias Brunner | 2013-05-03 | 1 | -0/+8 | |
| | | ||||||
| * | Use proper address family when adding multiple addresses to SQL pool | Tobias Brunner | 2013-03-19 | 1 | -0/+15 | |
| | | ||||||
| * | Ignore SQL-based IP address pools if their address family does not match | Tobias Brunner | 2013-03-19 | 1 | -10/+21 | |
| | | ||||||
| * | Load arbitrary (non-host) attributes from strongswan.conf | Tobias Brunner | 2013-03-19 | 1 | -21/+32 | |
| | | | | | This allows to e.g. load Cisco-specific attributes that contain FQDNs. | |||||
 |
index : tteras/strongswan | |
| tteras' strongSwan tree | gitolite |
| aboutsummaryrefslogtreecommitdiffstats |