| Commit message (Collapse) | Author | Age | Files | Lines | |
|---|---|---|---|---|---|
| * | kernel-netlink,pfroute: Properly update address flag within ROAM_DELAY | Tobias Brunner | 2013-08-12 | 2 | -2/+2 |
| | | | | | | | | 77d4a02 and 55da01f only updated the address flag when a job was created, which obviously had the same limitation as the old code. Fixes #374. | ||||
| * | kernel-pfroute: Implement roam event handling like in the kernel-netlink plugin | Tobias Brunner | 2013-08-12 | 1 | -13/+36 |
| | | | | | | There was no proper locking and the issue regarding the address flag also existed. | ||||
| * | kernel-netlink: Ensure address changes are not missed in roam events | Tobias Brunner | 2013-08-12 | 1 | -4/+15 |
| | | | | | | | | | | | | | | | | | If multiple roam events are triggered within ROAM_DELAY, only one job is created. The old code set the address flag to the value of the last triggering call. So if a route change followed an address change within ROAM_DELAY the address change was missed by the upper layers, e.g. causing it not to update the list of addresses via MOBIKE. The new code now keeps the state of the address flag until the job is actually executed, which still has some issues. For instance, if an address disappears and reappears within ROAM_RELAY, the flag would not have to be set to TRUE. So address updates might occasionally get triggered where none would actually be required. Fixes #374. | ||||
| * | mem-pool: add option for reusing online leases, and disable it by default | Martin Willi | 2013-07-29 | 1 | -1/+13 |
| | | | | | | | | | | | | Mainly for reauthentication with third party implementations, we allowed to reuse an online lease, but only for the same peer identity and when it explicitly requested the same address. This has always been problematic, because it changes the reqid of the CHILD_SA with the same traffic selectors, breaking the old tunnel. As we now reject such policy overwrites, this usually lets the installation of the new policies fail. We therefore disable reassignment of online leases by default. | ||||
| * | mem-pool: replace per-identity online/offline lists by more efficient arrays | Martin Willi | 2013-07-29 | 1 | -48/+52 |
| | | | | | This saves two lists per connected peer identity, up to 0.4KB. | ||||
| * | mem-pool: refcount online lease when reassigning it to another tunnel | Martin Willi | 2013-07-26 | 1 | -5/+28 |
| | | | | | | | | When we reassign an online lease for the same peer, we have to refcount it. Otherwise we would set it offline if one of the tunnels goes down, but it is actually still in use by a the second tunnel. This can finally lead in assigning the same virtual IP to different peers. | ||||
| * | kernel-pfkey: Add sanity check when deleting policies | Tobias Brunner | 2013-07-24 | 1 | -0/+5 |
| | | |||||
| * | Fix various API doc issues and typos | Tobias Brunner | 2013-07-18 | 2 | -7/+7 |
| | | | | | Partially based on an old patch by Adrian-Ken Rueegsegger. | ||||
| * | kernel-pfroute: use watcher to receive kernel events | Martin Willi | 2013-07-18 | 1 | -17/+13 |
| | | |||||
| * | kernel-pfkey: use watcher to receive networking events | Martin Willi | 2013-07-18 | 1 | -19/+13 |
| | | |||||
| * | kernel-netlink: use watcher to receive kernel events for net/ipsec | Martin Willi | 2013-07-18 | 2 | -35/+24 |
| | | |||||
| * | kernel-pfkey: Fail route installation if remote TS matches peer | Tobias Brunner | 2013-07-18 | 1 | -0/+8 |
| | | |||||
| * | capabilities: Some plugins don't actually require capabilities at runtime | Tobias Brunner | 2013-07-18 | 1 | -1/+1 |
| | | |||||
| * | automake: replace INCLUDES by AM_CPPFLAGS | Martin Willi | 2013-07-18 | 8 | -32/+44 |
| | | | | | | | INCLUDES are now deprecated and throw warnings when using automake 1.13. We now also differentiate AM_CPPFLAGS and AM_CFLAGS, where includes and defines are passed to AM_CPPFLAGS only. | ||||
| * | kernel-pfroute: Ignore IP address changes if address is %any | Tobias Brunner | 2013-07-17 | 1 | -1/+2 |
| | | |||||
| * | kernel-pfroute: Properly enumerate sockaddrs in interface messages | Tobias Brunner | 2013-07-17 | 1 | -9/+26 |
| | | | | | | The ifa_msghdr and rt_msghdr structs are not compatible (at least not on FreeBSD). | ||||
| * | kernel-pfroute: Provide name of interfaces on which virtual IPs are installed | Tobias Brunner | 2013-07-17 | 2 | -1/+23 |
| | | |||||
| * | kernel-pfroute: Ignore virtual IPs in address map | Tobias Brunner | 2013-07-17 | 1 | -13/+9 |
| | | | | | | As the virtual flag is set after the address has been added to the map, we make sure we ignore virtual IPs when doing lookups. | ||||
| * | kernel-pfroute: Make sure source addresses are not virtual and usable | Tobias Brunner | 2013-07-17 | 1 | -4/+20 |
| | | | | | | | | It seems we sometimes get the virtual IP as source (with rightsubnet=0.0.0.0/0) even if the exclude route is already installed. Might be a timing issue because shortly afterwards the lookup seems to succeed. | ||||
| * | kernel-pfroute: Don't report an error when trying to reinstall a route | Tobias Brunner | 2013-07-17 | 1 | -0/+4 |
| | | |||||
| * | kernel-pfkey: Provide interface name when installing exclude route | Tobias Brunner | 2013-07-17 | 1 | -4/+15 |
| | | |||||
| * | kernel-pfroute: Reinstall routes on interface/address changes | Tobias Brunner | 2013-07-17 | 1 | -7/+320 |
| | | |||||
| * | kernel-pfroute: Trigger a roam event if a new interface appears | Tobias Brunner | 2013-07-17 | 1 | -0/+4 |
| | | |||||
| * | kernel-pfroute: Use ref_get() to allocate sequence numbers | Tobias Brunner | 2013-07-17 | 1 | -3/+3 |
| | | |||||
| * | kernel-pfroute: Make time that is waited for VIPs to appear configurable | Tobias Brunner | 2013-07-17 | 1 | -2/+11 |
| | | | | | | One second might be too short for IPs to appear/disappear, especially on virtualized hosts. | ||||
| * | kernel-pfroute: Retry route lookup without source address on failure | Tobias Brunner | 2013-07-17 | 1 | -1/+16 |
| | | | | | | The known source address might be gone resulting in an error, making learning a new source address impossible. | ||||
| * | kernel-pfkey: Remove latest IPsec SA mapping when deleting a policy | Tobias Brunner | 2013-07-17 | 1 | -5/+12 |
| | | | | | | | | | | | | If IPsec SAs are rekeyed due to an address change (e.g. because update_sa is not supported) the exact same policy with the same reqid will be installed, but with different addresses. After the rekeying the old SA and its policies are removed, using the first matching mapping breaks the mapping between the policies and the new SA (at least on FreeBSD, the Linux kernel might only use the reqid for this). Using the oldest matching SA is still an approximation but it solves the above issue. | ||||
| * | kernel-pfkey: Correctly handle IPSEC_PROTO_ANY in an acquire | Tobias Brunner | 2013-07-17 | 1 | -2/+5 |
| | | |||||
| * | linked-list: Remove barely used find_last() method | Tobias Brunner | 2013-07-17 | 2 | -5/+6 |
| | | |||||
| * | Use strpfx() helper where appropriate | Tobias Brunner | 2013-07-08 | 2 | -3/+3 |
| | | |||||
| * | attr-sql: Add unity_split_exclude as alias for unity_local_lan | Tobias Brunner | 2013-07-08 | 1 | -0/+1 |
| | | |||||
| * | attr-sql: Fix double free when adding subnets for unknown attribute types | Tobias Brunner | 2013-07-08 | 1 | -0/+1 |
| | | |||||
| * | plugin-loader: Removed unused path argument of load() method | Tobias Brunner | 2013-06-28 | 1 | -1/+1 |
| | | | | | | Multiple additional search paths can be added with the add_path() method. | ||||
| * | kernel-netlink: Make CAP_NET_ADMIN capability optional | Tobias Brunner | 2013-06-25 | 1 | -3/+4 |
| | | | | | It is not required to use the kernel-net part of the plugin. | ||||
| * | capabilities: Only plugins that require CAP_NET_ADMIN demand it | Tobias Brunner | 2013-06-25 | 2 | -0/+13 |
| | | | | | The daemon as such does not require this capability. | ||||
| * | capabilities: Move global capabilities_t instance to libstrongswan | Tobias Brunner | 2013-06-25 | 1 | -1/+0 |
| | | |||||
| * | kernel-pfroute: Simplify route lookup after fixing sockaddr parsing | Tobias Brunner | 2013-06-21 | 1 | -90/+19 |
| | | |||||
| * | kernel-pfroute: Alignment of sockaddrs is not always the same | Tobias Brunner | 2013-06-21 | 1 | -1/+8 |
| | | |||||
| * | kernel-pfroute: struct sockaddr arguments are 4 byte aligned | Tobias Brunner | 2013-06-21 | 1 | -4/+8 |
| | | | | | | | | | | This was noticed on Mac OS X where, if the default route is returned, RTA_NETMASK has sa_len set to 0, but skipping zero bytes to read the next address makes no sense, of course. Using 0 for sa_len seems a bit strange, in particular, because struct sockaddr has by definition a minimum length of 16 bytes. But it seems FreeBSD actually does the same. | ||||
| * | kernel-pfroute: Improve route lookup depending on information we get back | Tobias Brunner | 2013-06-21 | 1 | -12/+96 |
| | | | | | Kernels don't provide the same information for all routes. | ||||
| * | kernel-pfroute: Try to ensure we get a source address or interface name | Tobias Brunner | 2013-06-21 | 1 | -0/+6 |
| | | |||||
| * | kernel-libipsec: Add a feature to request UDP encapsulation of ESP packets | Tobias Brunner | 2013-06-21 | 1 | -0/+2 |
| | | |||||
| * | kernel-pfroute: Use DST as nexthop for host routes | Tobias Brunner | 2013-06-21 | 1 | -0/+6 |
| | | | | | These are created as cache/clone on Mac OS X. | ||||
| * | kernel-pfroute: Implement get_source_addr() | Tobias Brunner | 2013-06-21 | 1 | -12/+27 |
| | | |||||
| * | kernel-pfroute: Properly install routes with interface and gateway | Tobias Brunner | 2013-06-21 | 1 | -5/+6 |
| | | |||||
| * | kernel-pfroute: Activate TUN device before setting address | Tobias Brunner | 2013-06-21 | 1 | -1/+1 |
| | | | | | | On FreeBSD, for some reason, we don't learn the interface is up otherwise. Even though ifconfig lists it as up at the same time. | ||||
| * | kernel-pfroute: Raise tun event when creating/destroying TUN devices for ↵ | Tobias Brunner | 2013-06-21 | 1 | -1/+6 |
| | | | | | virtual IPs | ||||
| * | kernel: Add an event kernel interfaces can raise if they create/destroy a ↵ | Tobias Brunner | 2013-06-21 | 3 | -5/+43 |
| | | | | | TUN device | ||||
| * | kernel-netlink: Routes don't require a gateway/nexthop | Tobias Brunner | 2013-06-21 | 1 | -5/+9 |
| | | |||||
| * | kernel-netlink: install selectors on SA for transport/BEET mode without ↵ | Martin Willi | 2013-06-19 | 1 | -0/+6 |
| | | | | | | | | | proto/port If a transport/BEET SA has different selectors for different proto/ports, installing just the proto/port of the first SA would break any additional selector. | ||||
 |
index : tteras/strongswan | |
| tteras' strongSwan tree | gitolite |
| aboutsummaryrefslogtreecommitdiffstats |