Tobias Brunner
b4a0eb3603
testing: Add config for Linux 6.14
...
This has IP-TFS enabled.
2025-05-28 16:37:46 +02:00
Tobias Brunner
a7a3c4a22a
conf: Document global IP-TFS settings
2025-05-28 16:37:46 +02:00
Tobias Brunner
46525cdc4f
child-create: Negotiate IP-TFS mode if configured
2025-05-28 16:37:46 +02:00
Tobias Brunner
f5f7424e1d
notify-payload: Add notify type for IP-TFS/AGGFRAG
2025-05-28 16:37:46 +02:00
Tobias Brunner
6372b2890f
kernel-netlink: Support IPTFS mode and attributes
2025-05-28 16:37:46 +02:00
Tobias Brunner
f32773b3a8
child-sa: Allow disabling fragmenting packets across AGGFRAG payloads
...
This is necessary if the peer isn't able to handle such fragments.
2025-05-28 16:37:46 +02:00
Tobias Brunner
33db7a200f
kernel-ipsec: Add flag to disable sending fragments across AGGFRAG payloads
...
We have to set this if the peer indicates that it doesn't support
handling such fragments in the notify.
2025-05-28 16:37:46 +02:00
Tobias Brunner
1afc76dd56
vici: Make IP-TFS mode configurable
2025-05-28 16:37:46 +02:00
Tobias Brunner
e175abaf89
include: Add XFRM mode and attributes for IP-TFS
2025-05-28 16:37:46 +02:00
Tobias Brunner
419528f2ac
ipsec-types: Add new mode for IP-TFS
...
Added at the end as the numeric mode is e.g. used in SQL databases.
2025-05-28 16:37:27 +02:00
Tobias Brunner
72e3b7dcc8
Merge branch 'per-cpu-sas'
...
This adds support for per-CPU SAs (RFC 9611).
2025-05-28 16:36:10 +02:00
Tobias Brunner
b7d3349000
testing: Add ikev2/per-cpu-sas-encap-transport scenario
...
Tests transport mode and UDP encapsulation with random source ports.
Interestingly, the responder always uses the same SA to respond (maybe
due to the cache on the policy).
2025-05-28 16:35:27 +02:00
Tobias Brunner
3b2f8cf282
testing: Add ikev2/per-cpu-sas-encap scenario
...
Basically the same as the one without UDP encapsulation, but here the
outbound SAs use random source ports.
2025-05-28 16:35:27 +02:00
Tobias Brunner
d83fbe82e4
kernel-netlink: Suppress NAT mapping updates for per-CPU SAs
...
As we set the remote port to 0, we'd get a mapping change message with
every packet. Setting the threshold avoids all kernel messages after the
first, which we suppress explicitly as well.
2025-05-28 16:35:27 +02:00
Tobias Brunner
14e1ec2b77
child-sa: Configure UDP encapsulation for per-CPU SAs
...
As the kernel does not support processing UDP-encapsulated and plain ESP
for the same SA, we require forcing UDP encapsulation if there is no NAT.
2025-05-28 16:35:27 +02:00
Tobias Brunner
73083503f2
vici: Make UDP encapsulation for per-CPU SAs configurable
2025-05-28 16:35:27 +02:00
Tobias Brunner
d594171d9e
child-cfg: Add flag to enable UDP encapsulation for per-CPU SAs
2025-05-28 16:35:27 +02:00
Tobias Brunner
bf34484d24
testing: Add per-CPU SA test scenario
2025-05-28 16:35:27 +02:00
Tobias Brunner
e24edb2991
testing: Configure multiple virtual CPUs for moon and sun
...
This allows testing per-CPU SAs by e.g. pinging over a specific CPU
via taskset.
2025-05-28 16:35:27 +02:00
Tobias Brunner
0edaadfc94
testing: Enable SMP support for latest kernels
2025-05-28 16:35:27 +02:00
Tobias Brunner
f95bdb6fb0
swanctl: Report per-CPU information in --list-sas
2025-05-28 16:35:27 +02:00
Tobias Brunner
c176d32a73
vici: Report per-CPU SA information
2025-05-28 16:35:27 +02:00
Tobias Brunner
fbfae44dd1
vici: Make per-CPU CHILD_SAs configurable
2025-05-28 16:35:27 +02:00
Tobias Brunner
a950ca3ec2
kernel-netlink: Forward CPU ID from acquires
2025-05-28 16:35:27 +02:00
Tobias Brunner
4a595508b7
trap-manager: Add support to handle acquires for per-CPU SAs
2025-05-28 16:35:27 +02:00
Tobias Brunner
65b7f9d563
kernel-handler: Log CPU ID that's passed with an acquire
2025-05-28 16:35:27 +02:00
Tobias Brunner
d6eed3979b
kernel-interface: Optionally pass CPU ID for which an acquire was triggered
2025-05-28 16:35:27 +02:00
Tobias Brunner
2082fa5dd2
ike-sa: Accept optional CPU ID when initiating CHILD_SAs
2025-05-28 16:35:26 +02:00
Tobias Brunner
8e7f379f71
ike-sa: Sort CHILD_SAs by CPU ID
...
This might make debugging easier and also ensures that a possible
fallback SA without CPU ID is established first when reestablishing
an IKE_SA. Because even if such an SA is established first initially,
that might change later depending on when per-CPU SAs are rekeyed.
2025-05-28 16:35:26 +02:00
Tobias Brunner
af34b5b1dc
child-rekey: Maintain per-CPU values during rekeying
2025-05-28 16:35:26 +02:00
Tobias Brunner
bdf882d3af
child-create: Add support to negotiate per-CPU SAs
2025-05-28 16:35:26 +02:00
Tobias Brunner
3a8bb93761
updown: Don't call the script for per-CPU SAs
...
Rules are installed for the fallback SA that has no CPU ID assigned.
2025-05-28 16:35:26 +02:00
Tobias Brunner
297be45275
ha: Ignore per-CPU CHILD_SAs
...
These only work on initiators (with trap policies), which is something
the plugin doesn't support.
2025-05-28 16:35:26 +02:00
Tobias Brunner
17f2188756
forecast: Ignore per-CPU CHILD_SAs
...
Not sure if this combination does make sense as the plugin itself would
be a major bottleneck.
Similar to the connmark plugin, PREROUTING rules list SPIs or UDP ports,
which would be necessary for all SAs while the OUTPUT rules would only be
required once.
2025-05-28 16:35:26 +02:00
Tobias Brunner
5faf884285
connmark: Ignore per-CPU CHILD_SAs
...
The combination probably doesn't make much sense.
The OUTPUT rules would definitely only be required once, while the INPUT
and PREROUTING rules list individual SPIs and/or UDP ports, which would
be necessary for all SAs.
By the way, the rules in PREROUTING might actually not be necessary
anymore if the set_mark_in option was used for such SAs.
2025-05-28 16:35:26 +02:00
Tobias Brunner
a505f4b9b0
child-sa: Add support for per-CPU SAs
...
The CPU ID is also set on inbound SAs as it can be used to configure RSS
or some eBPF program.
2025-05-28 16:35:26 +02:00
Tobias Brunner
bdfcfea1f2
kernel-netlink: Add support to enable per-CPU acquires on policies
2025-05-28 16:35:26 +02:00
Tobias Brunner
53be94d06c
kernel-netlink: Add support to set CPU ID on SA
2025-05-28 16:35:26 +02:00
Tobias Brunner
12395cedf3
ipsec-types: Add identifier for the maximum (=no) CPU ID
2025-05-28 16:35:26 +02:00
Tobias Brunner
aa1322aed5
include: Add XFRM identifiers for per-CPU SAs/acquires
2025-05-28 16:35:26 +02:00
Tobias Brunner
d4575da53c
child-cfg: Add flag to enable per-CPU SAs
2025-05-28 16:35:26 +02:00
Tobias Brunner
749814a75f
notify-payload: Add notify types for per-resource CHILD_SAs
2025-05-28 16:35:26 +02:00
Tobias Brunner
8f6e3c164a
testing: Include the kernel build number
2025-05-28 16:35:26 +02:00
Tobias Brunner
b6a4cfc705
Merge branch 'acquires-seq'
...
This uses the sequence number from acquires when installing the SA. This
allows handling narrowing properly by changing the reqid and still
removing the temporary state in the kernel. It also changes that
traffic selectors are reused during rekeying/recreation/reauthentication,
so narrowed selectors won't return to the wider configured TS because
there won't be any TS from triggering packets to narrow again.
2025-05-28 16:30:56 +02:00
Tobias Brunner
8cb5918b0c
testing: Add ikev2/net2net-route-narrow scenario
2025-05-28 16:01:00 +02:00
Tobias Brunner
6c7c539eaf
child-create: Consider previous TS when checking for duplicates
2025-05-28 16:01:00 +02:00
Tobias Brunner
58d6778adb
child-sa: Add helper to check if a list of TS match negotiated TS
2025-05-28 16:01:00 +02:00
Tobias Brunner
e7fc7a4ecc
child-create: Maintain traffic selectors during rekeying/reauthentication
...
If we don't do this, narrowed SAs would default to the wide configured
traffic selectors and the peer won't know if/how to narrow.
2025-05-28 16:01:00 +02:00
Tobias Brunner
9205458355
child-create: Use more generic method to pass information from previous SA
...
Besides the previous key exchange method, this will allow us to also
reuse the previous traffic selectors. Some data is still passed in
separate methods as some are set even when there is no previous SA and
others are not set in all cases.
The interface for queue_child() now optionally takes the previous
Child SA to handle both recreations and initiations from scratch.
2025-05-28 11:06:19 +02:00
Tobias Brunner
ad1ad2159f
child-cfg: Use traffic selector list
2025-05-28 11:06:19 +02:00
