aboutsummaryrefslogtreecommitdiffstats
path: root/src/libhydra
Commit message (Collapse)AuthorAgeFilesLines
* mem-pool: add option for reusing online leases, and disable it by defaultMartin Willi2013-07-291-1/+13
| | | | | | | | | | | Mainly for reauthentication with third party implementations, we allowed to reuse an online lease, but only for the same peer identity and when it explicitly requested the same address. This has always been problematic, because it changes the reqid of the CHILD_SA with the same traffic selectors, breaking the old tunnel. As we now reject such policy overwrites, this usually lets the installation of the new policies fail. We therefore disable reassignment of online leases by default.
* mem-pool: replace per-identity online/offline lists by more efficient arraysMartin Willi2013-07-291-48/+52
| | | | This saves two lists per connected peer identity, up to 0.4KB.
* mem-pool: refcount online lease when reassigning it to another tunnelMartin Willi2013-07-261-5/+28
| | | | | | | When we reassign an online lease for the same peer, we have to refcount it. Otherwise we would set it offline if one of the tunnels goes down, but it is actually still in use by a the second tunnel. This can finally lead in assigning the same virtual IP to different peers.
* kernel-pfkey: Add sanity check when deleting policiesTobias Brunner2013-07-241-0/+5
|
* Fix various API doc issues and typosTobias Brunner2013-07-182-7/+7
| | | | Partially based on an old patch by Adrian-Ken Rueegsegger.
* kernel-pfroute: use watcher to receive kernel eventsMartin Willi2013-07-181-17/+13
|
* kernel-pfkey: use watcher to receive networking eventsMartin Willi2013-07-181-19/+13
|
* kernel-netlink: use watcher to receive kernel events for net/ipsecMartin Willi2013-07-182-35/+24
|
* kernel-pfkey: Fail route installation if remote TS matches peerTobias Brunner2013-07-181-0/+8
|
* capabilities: Some plugins don't actually require capabilities at runtimeTobias Brunner2013-07-181-1/+1
|
* automake: replace INCLUDES by AM_CPPFLAGSMartin Willi2013-07-188-32/+44
| | | | | | INCLUDES are now deprecated and throw warnings when using automake 1.13. We now also differentiate AM_CPPFLAGS and AM_CFLAGS, where includes and defines are passed to AM_CPPFLAGS only.
* kernel-pfroute: Ignore IP address changes if address is %anyTobias Brunner2013-07-171-1/+2
|
* kernel-pfroute: Properly enumerate sockaddrs in interface messagesTobias Brunner2013-07-171-9/+26
| | | | | The ifa_msghdr and rt_msghdr structs are not compatible (at least not on FreeBSD).
* kernel-pfroute: Provide name of interfaces on which virtual IPs are installedTobias Brunner2013-07-172-1/+23
|
* kernel-pfroute: Ignore virtual IPs in address mapTobias Brunner2013-07-171-13/+9
| | | | | As the virtual flag is set after the address has been added to the map, we make sure we ignore virtual IPs when doing lookups.
* kernel-pfroute: Make sure source addresses are not virtual and usableTobias Brunner2013-07-171-4/+20
| | | | | | | It seems we sometimes get the virtual IP as source (with rightsubnet=0.0.0.0/0) even if the exclude route is already installed. Might be a timing issue because shortly afterwards the lookup seems to succeed.
* kernel-pfroute: Don't report an error when trying to reinstall a routeTobias Brunner2013-07-171-0/+4
|
* kernel-pfkey: Provide interface name when installing exclude routeTobias Brunner2013-07-171-4/+15
|
* kernel-pfroute: Reinstall routes on interface/address changesTobias Brunner2013-07-171-7/+320
|
* kernel-pfroute: Trigger a roam event if a new interface appearsTobias Brunner2013-07-171-0/+4
|
* kernel-pfroute: Use ref_get() to allocate sequence numbersTobias Brunner2013-07-171-3/+3
|
* kernel-pfroute: Make time that is waited for VIPs to appear configurableTobias Brunner2013-07-171-2/+11
| | | | | One second might be too short for IPs to appear/disappear, especially on virtualized hosts.
* kernel-pfroute: Retry route lookup without source address on failureTobias Brunner2013-07-171-1/+16
| | | | | The known source address might be gone resulting in an error, making learning a new source address impossible.
* kernel-pfkey: Remove latest IPsec SA mapping when deleting a policyTobias Brunner2013-07-171-5/+12
| | | | | | | | | | | If IPsec SAs are rekeyed due to an address change (e.g. because update_sa is not supported) the exact same policy with the same reqid will be installed, but with different addresses. After the rekeying the old SA and its policies are removed, using the first matching mapping breaks the mapping between the policies and the new SA (at least on FreeBSD, the Linux kernel might only use the reqid for this). Using the oldest matching SA is still an approximation but it solves the above issue.
* kernel-pfkey: Correctly handle IPSEC_PROTO_ANY in an acquireTobias Brunner2013-07-171-2/+5
|
* linked-list: Remove barely used find_last() methodTobias Brunner2013-07-172-5/+6
|
* Use strpfx() helper where appropriateTobias Brunner2013-07-082-3/+3
|
* attr-sql: Add unity_split_exclude as alias for unity_local_lanTobias Brunner2013-07-081-0/+1
|
* attr-sql: Fix double free when adding subnets for unknown attribute typesTobias Brunner2013-07-081-0/+1
|
* plugin-loader: Removed unused path argument of load() methodTobias Brunner2013-06-281-1/+1
| | | | | Multiple additional search paths can be added with the add_path() method.
* kernel-netlink: Make CAP_NET_ADMIN capability optionalTobias Brunner2013-06-251-3/+4
| | | | It is not required to use the kernel-net part of the plugin.
* capabilities: Only plugins that require CAP_NET_ADMIN demand itTobias Brunner2013-06-252-0/+13
| | | | The daemon as such does not require this capability.
* capabilities: Move global capabilities_t instance to libstrongswanTobias Brunner2013-06-251-1/+0
|
* kernel-pfroute: Simplify route lookup after fixing sockaddr parsingTobias Brunner2013-06-211-90/+19
|
* kernel-pfroute: Alignment of sockaddrs is not always the sameTobias Brunner2013-06-211-1/+8
|
* kernel-pfroute: struct sockaddr arguments are 4 byte alignedTobias Brunner2013-06-211-4/+8
| | | | | | | | | This was noticed on Mac OS X where, if the default route is returned, RTA_NETMASK has sa_len set to 0, but skipping zero bytes to read the next address makes no sense, of course. Using 0 for sa_len seems a bit strange, in particular, because struct sockaddr has by definition a minimum length of 16 bytes. But it seems FreeBSD actually does the same.
* kernel-pfroute: Improve route lookup depending on information we get backTobias Brunner2013-06-211-12/+96
| | | | Kernels don't provide the same information for all routes.
* kernel-pfroute: Try to ensure we get a source address or interface nameTobias Brunner2013-06-211-0/+6
|
* kernel-libipsec: Add a feature to request UDP encapsulation of ESP packetsTobias Brunner2013-06-211-0/+2
|
* kernel-pfroute: Use DST as nexthop for host routesTobias Brunner2013-06-211-0/+6
| | | | These are created as cache/clone on Mac OS X.
* kernel-pfroute: Implement get_source_addr()Tobias Brunner2013-06-211-12/+27
|
* kernel-pfroute: Properly install routes with interface and gatewayTobias Brunner2013-06-211-5/+6
|
* kernel-pfroute: Activate TUN device before setting addressTobias Brunner2013-06-211-1/+1
| | | | | On FreeBSD, for some reason, we don't learn the interface is up otherwise. Even though ifconfig lists it as up at the same time.
* kernel-pfroute: Raise tun event when creating/destroying TUN devices for ↵Tobias Brunner2013-06-211-1/+6
| | | | virtual IPs
* kernel: Add an event kernel interfaces can raise if they create/destroy a ↵Tobias Brunner2013-06-213-5/+43
| | | | TUN device
* kernel-netlink: Routes don't require a gateway/nexthopTobias Brunner2013-06-211-5/+9
|
* kernel-netlink: install selectors on SA for transport/BEET mode without ↵Martin Willi2013-06-191-0/+6
| | | | | | | | proto/port If a transport/BEET SA has different selectors for different proto/ports, installing just the proto/port of the first SA would break any additional selector.
* kernel-netlink: reject policy refcount if the reqid differsMartin Willi2013-06-191-4/+17
| | | | | | | | | | | | | Previously we silently replaced an existing policy with a new one if the reqid changed for the same selectors. This will break an old policy in the favour of the new one (for example if two clients behind the same NAT use transport mode). With this change any new policy gets rejected if the reqid differs. This will make sure we break no existing policy. For rekeying and acquires we still can have overlapping policies (as we use the same reqid), but for unrelated connections this is not true anymore (it wasn't actually before, we just silently broke the existing policy).
* kernel-interface: add an exchange initiator parameter to add_sa()Martin Willi2013-06-116-10/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This new flag gives the kernel-interface a hint how it should priorize the use of newly installed SAs during rekeying. Consider the following rekey procedure in IKEv2: Initiator --- Responder I1 -------CREATE-------> R1 I2 <------CREATE-------- -------DELETE-------> R2 I3 <------DELETE-------- SAs are always handled as pairs, the following happens at the SA level: * Initiator starts the exchange at I1 * Responder installs new SA pair at R1 * Initiator installs new SA pair at I2 * Responder removes old SA pair at R2 * Initiator removes old SA pair at I3 This makes sure SAs get installed/removed overlapping during rekeying. However, to avoid any packet loss, it is crucial that the new outbound SA gets activated at the correct position: * as exchange initiator, in I2 * as exchange responder, in R2 This should guarantee that we don't use the new outbound SA before the peer could install its corresponding inbound SA. The new parameter allows the kernel backend to install the new SA with appropriate priorities, i.e. it should: * as exchange inititator, have the new outbound SA installed with higher priority than the old SA * as exchange responder, have the new outbound SA installed with lower priority than the old SA While we could split up the SA installation at the responder, this approach has another advantage: it allows the kernel backend to switch SAs based on other criteria, for example when receiving traffic on the new inbound SA.
* resolve: Use plugin features to register attribute handlerTobias Brunner2013-06-112-4/+31
|
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-04 19:11:54 +0000