aboutsummaryrefslogtreecommitdiffstats
path: root/src/libhydra
Commit message (Collapse)AuthorAgeFilesLines
* libhydra: Remove empty unused libraryTobias Brunner2016-03-038-305/+0
|
* libhydra: Move kernel interface to libcharonTobias Brunner2016-03-0311-2436/+2
| | | | This moves hydra->kernel_interface to charon->kernel.
* libhydra: Move all kernel plugins to libcharonTobias Brunner2016-03-0325-12445/+0
|
* kernel-netlink: Allow Netlink send buffer size to be configured via compile ↵Tobias Brunner2016-02-121-3/+11
| | | | | | | option The receive buffer size can already be changed via strongswan.conf if necessary.
* kernel-pfkey: Enable ENCR_CAMELLIA_CBC when it's availableTobias Brunner2015-11-231-0/+3
| | | | Fixes #1214.
* android: Fix build after updating Linux headersTobias Brunner2015-11-121-1/+0
| | | | | | | | Since we don't use the kernel-netlink plugin anymore and the headers in the NDK are reasonably recent, we don't need this anymore (at least when building the app). Fixes #1172.
* kernel-netlink: Allow IPsec policies to replace shunt policiesTobias Brunner2015-11-101-3/+3
| | | | | Shunt policies don't have a reqid set, so we allow unequal reqids in this particular case (i.e. if one of the reqids is 0).
* kernel-pfkey: Make absolutely sure we always delete the right policy cache entryTobias Brunner2015-11-101-3/+8
|
* kernel-netlink: Make absolutely sure we always delete the right policy cache ↵Tobias Brunner2015-11-101-2/+9
| | | | entry
* kernel-interface: Pass the same data to del_policy() that was passed to ↵Tobias Brunner2015-11-105-37/+35
| | | | | | | add_policy() The additional data can be helpful to identify the exact policy to delete.
* kernel-netlink: Remove the unused policy_history flagTobias Brunner2015-11-101-41/+20
| | | | This was used with pluto, which had its own policy tracking.
* kernel-interface: Return bool for kernel interface registrationThomas Egerer2015-11-104-20/+40
| | | | | | | | If the (un)registering of a kernel interface (net or ipsec) fails, the plugin loader will never know, since the appropriate functions always returns TRUE. By making the (un)register functions return a boolean value, the loader can detect a failure during initializing the kernel interface and abort charon startup if desired.
* kernel-pfkey: Enable ENCR_AES_CTR when it's availableRenato Botelho2015-11-091-1/+3
| | | | | | Obtained-from: pfSense Sponsored-by: Rubicon Communications (Netgate) Closes strongswan/strongswan#17.
* kernel-netlink: Properly set port mask for ICMP type/code if only set on one ↵Tobias Brunner2015-08-311-7/+8
| | | | | | | | | | | | side If only one traffic selector had a port (type/code) the other side had the port mask set to 0, which canceled out the applied type/code. It also fixes the installation of ICMP type/code on big-endian hosts. Fixes #1091. References #595.
* kernel-pfkey: Properly encode ICMP type/code if only set on one sideTobias Brunner2015-08-311-34/+20
| | | | References #595.
* kernel-pfkey: Only flush SAs of types we actually manageTobias Brunner2015-08-211-13/+26
|
* kernel-netlink: Only flush SAs of types we actually manageTobias Brunner2015-08-211-6/+19
|
* kernel-pfkey: Add support for AES-GCMTobias Brunner2015-08-201-3/+11
| | | | | | | | | | The next release of FreeBSD will support this. While Linux defines constants for AES-GCM in pfkeyv2.h since 2.6.25 it does not actually support it. When SAs are installed via PF_KEY only a lookup in XFRM's list of encryption algorithms is done, but AES-GCM is in a different table for AEAD algorithms (there is currently no lookup function to find algorithms in that table via PF_KEY identifier).
* kernel-netlink: Avoid route dump if routing rule excludes traffic with a ↵Tobias Brunner2015-08-181-7/+33
| | | | | | | | | | | certain mark If the routing rule we use to direct traffic to our own routing table excludes traffic with a certain mark (fwmark = !<mark>) we can simplify the route lookup and avoid dumping all routes by passing the mark to the request. That way our own routes are ignored and we get the preferred route back without having to dump and analyze all routes, which is quite a burden on hosts with lots of routes.
* kernel-pfroute: Don't install virtual IPs if charon.install_virtual_ip is ↵Tobias Brunner2015-08-131-0/+17
| | | | disabled
* kernel-netlink: When adding a policy do an update if it already existsTobias Brunner2015-08-131-1/+9
| | | | | | | | | | This may be the case when SAs are reestablished after a crash of the IKE daemon. We could actually always do updates. The kernel doesn't care, the only difference is the possible EEXIST if XFRM_MSG_NEWPOLICY is used. The advantage of not doing this, though, is that we get a warning in the log if a policy already exists, as that should usually not be the case.
* kernel-pfkey: When adding policies do an update if they already existTobias Brunner2015-08-131-1/+10
| | | | | This may be the case when SAs are reestablished after a crash of the IKE daemon.
* kernel-netlink: Use PAGE_SIZE as default size for the netlink receive bufferTobias Brunner2015-08-041-1/+11
| | | | | | | | The kernel uses NLMSG_GOODSIZE as default buffer size, which defaults to the PAGE_SIZE if it is lower than 8192 or to that value otherwise. In some cases (e.g. for dump messages) the kernel might use up to 16k for messages, which might require increasing this value.
* kernel-netlink: Actually verify if the netlink message exceeds the buffer sizeTobias Brunner2015-08-041-2/+2
| | | | | | It might equal it and that's fine. With MSG_TRUNC we get the actual message size and can only report an error if we haven't received the complete message.
* kernel-netlink: Unlock mutex in del_policy() if mark can't be added to messageTobias Brunner2015-07-311-0/+1
|
* unit-tests: Forward variable argument list in TEST_SUITE_DEPENDMartin Willi2015-07-121-2/+2
| | | | | For some plugin features, such as crypters or AEADs, we have some additional feature arguments, such as the key size.
* kernel-netlink: Add ChaCha20-Poly1305 AEAD supportMartin Willi2015-06-291-0/+2
|
* kernel-netlink: Ignore unusable routesTobias Brunner2015-05-211-0/+24
|
* kernel-netlink: Make buffer size for received Netlink messages configurableTobias Brunner2015-05-211-7/+11
|
* kernel-netlink: Don't mangle verbosity during test initializationMartin Willi2015-04-151-2/+0
| | | | | We now properly manage thread verbosity in the test framework, and don't need to silence thread spawning messages.
* kernel-netlink: Fix GCC error about uninitialized variable useMartin Willi2015-04-081-1/+1
| | | | | get_replay_state() always returns a replay_state_len when returning a replay state, but GCC doesn't know about that.
* kernel-netlink: Copy current usage stats to new SA in update_sa()Tobias Brunner2015-03-251-6/+34
| | | | | | | | | | | | This is needed to fix usage stats sent via RADIUS Accounting if clients use MOBIKE or e.g. the kernel notifies us about a changed NAT mapping. The upper layers won't expect the stats to get reset if only the IPs have changed (and some kernel interface might actually allow such updates without reset). It also fixes traffic based lifetimes in such situations. Fixes #799.
* kernel-interface: Add a separate "update" flag to add_sa()Martin Willi2015-03-095-12/+14
| | | | | | | | | | | The current "inbound" flag is used for two purposes: To define the actual direction of the SA, but also to determine the operation used for SA installation. If an SPI has been allocated, an update operation is required instead of an add. While the inbound flag normally defines the kind of operation required, this is not necessarily true in all cases. On the HA passive node, we install inbound SAs without prior SPI allocation.
* kernel-pfkey: Add option to set receive buffer size of event socketTobias Brunner2015-03-061-0/+13
| | | | | | | | If many requests are sent to the kernel the events generated by these requests may fill the receive buffer before the daemon is able to read these messages. Fixes #783.
* kernel-netlink: Respect kernel routing priorities for IKE routesMartin Willi2015-03-031-2/+15
| | | | | | | | If a system uses routing metrics, we should honor them when doing (manual) routing lookups for IKE. When enumerating routes, the kernel reports priorities with the RTA_PRIORITY attribute, not RTA_METRICS. We prefer routes with a lower priority value, and fall back to longest prefix match priorities if the priority value is equal.
* attributes: Move the configuration attributes framework to libcharonMartin Willi2015-02-2015-1944/+0
|
* attr-sql: Move plugin to libcharonMartin Willi2015-02-206-721/+0
|
* attr: Move plugin to libcharonMartin Willi2015-02-207-562/+0
|
* resolve: Move plugin back to libcharonMartin Willi2015-02-206-596/+0
| | | | Since pluto is gone, all existing users build upon libcharon.
* kernel-interface: Raise mapping event with a proto/SPI/dst tupleMartin Willi2015-02-205-25/+38
|
* kernel-interface: Raise expires with a proto/SPI/dst tuple instead of reqidMartin Willi2015-02-205-27/+30
|
* child-sa: Replace reqid based marks by "unique" marksMartin Willi2015-02-202-61/+14
| | | | | | | | | | | As we now use the same reqid for multiple CHILD_SAs with the same selectors, having marks based on the reqid makes not that much sense anymore. Instead we use unique marks that use a custom identifier. This identifier is reused during rekeying, keeping the marks constant for any rule relying on it (for example installed by updown). This also simplifies handling of reqid allocation, as we do not have to query the marks that is not yet assigned for an unknown reqid.
* kernel-interface: Add reqid allocation and release functionsMartin Willi2015-02-202-1/+329
| | | | | | | | | To reassign reqids where appropriate, we explicitly allocate or confirm them centrally on the kernel-interface. Currently the state is stored in the kernel-interface wrapper for all backends, but we may add appropriate methods to each backend to implement a custom reqid allocation logic, if required.
* kernel-interface: Pass full list of traffic selectors to add_sa()Martin Willi2015-02-205-21/+17
| | | | | | While we can handle the first selector only in BEET mode in kernel-netlink, passing the full list gives the backend more flexibility how to handle this information.
* kernel-pfkey: Don't update during add_sa(), but delete SPI allocation stateMartin Willi2015-02-201-7/+18
|
* kernel-interface: Remove reqid parameter from get_spi/get_cpi() methodsMartin Willi2015-02-205-43/+31
| | | | | | | | | | The reqid is not strictly required, as we set the reqid with the update call when installing the negotiated SA. If we don't need a reqid at this stage, we can later allocate the reqid in the kernel backend once the SA parameters have been fully negotaited. This allows us to assign the same reqid for the same selectors to avoid conflicts on backends this is necessary.
* kernel-pfroute: If a new interface appears, slightly delay address enumerationMartin Willi2014-12-161-0/+9
| | | | | | | On OS X 10.10, when installing a virtual IP on a tun device, there is a chance that a RTM_IFANNOUNCE is sent before the IP is ready on that link when calling getifaddrs(). As we don't get an RTM_NEWADDR event either, that race lets us miss the virtual IP install event, failing the add_ip() call.
* Fixed some typos, courtesy of codespellTobias Brunner2014-12-151-1/+1
|
* kernel-pfkey: Fix replay window size on FreeBSD and Mac OS XTobias Brunner2014-12-151-0/+6
| | | | | | | | | The FreeBSD and Mac OS X kernels interpret sadb_sa_replay as the size of the replay window in bytes. Linux on the other hand does the same for PF_KEY it does for XFRM so sadb_sa_replay denotes the number of packets/bits in the window. Similarly, the window size on Linux is limited to 32 by the four byte default bitmap used for IPsec SAs (may only be changed with XFRMA_REPLAY_ESN_VAL), which is not the case on the other platforms.
* kernel-netlink: Optionally ignore errors resulting from response message lossMartin Willi2014-11-211-0/+82
| | | | | | | | | | | | | | | As some backends over unreliable transport do not cache response messages, retransmissions due the loss of responses perform the operation again. Add an option to ignore some errors arising from such duplicate operations. Note: This approach can't distinguish between real EXIST/NOTFOUND errors and packet failures, and therefore is a source of race conditions and can't detect any of these errors actually happening. Therefore that behavior is disabled by default, and can be enabled with the ignore_retransmit_errors strongswan.conf option. To properly distinguish between real and retransmission errors, a Netlink backend should implement retransmission detection using sequence numbers.
generated by cgit v1.2.3 (git 2.25.1) at 2025-07-29 02:52:48 +0000