denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
15,203 Commits 1 Branch 0 Tags
0a954d678979624806a2d250208530291da34e32
Commit Graph
36 Commits
Author SHA1 Message Date
Tobias Brunner 0a954d6789 ike: Add configuration option to switch to preferring supplied proposals over local ones 2016-06-17 18:48:07 +02:00
Tobias Brunner 3a40d572c6 ike-cfg: Add option to prefer supplied proposals over locally configured ones 2016-06-17 18:48:07 +02:00
Andreas Steffen b12c53ce77 Use standard unsigned integer types 2016-03-24 18:52:48 +01:00
Tobias Brunner 9fda0bf007 ikev1: Set protocol ID and SPIs in INITIAL-CONTACT notification payloads 
The payload we sent before is not compliant with RFC 2407 and thus some
peers might abort negotiation (e.g. with an INVALID-PROTOCOL-ID error).

Fixes #819.
 2015-03-06 16:50:13 +01:00
Thomas Egerer 11b42933bf ikev1: Send INITIAL_CONTACT notify in Main Mode 
We currently send the notify in Main Mode only, as it is explicitly not allowed
by RFC 2407 to send (unprotected) notifications in Aggressive Mode. To make
that work, we'd need to handle that notify in Aggressive Mode, which could
allow a MitM to inject such notifies and do some harm.

Signed-off-by: Thomas Egerer <[email protected]>
 2014-10-30 11:53:56 +01:00
Martin Willi 4f243dfaa9 ikev1: Defer Mode Config push after CHILD adoption when using XAuth 2014-08-25 09:55:44 +02:00
Martin Willi 891bbbd4bb ikev1: Defer Mode Config push after CHILD adoption and reauth detection 
When an initiator starts reauthentication on a connection that uses push
mode to assign a virtual IP, we can't execute the Mode Config before releasing
the virtual IP. Otherwise we would request a new and different lease, which
the client probably can't handle. Defer Mode Config execution, so the same IP
gets first released then reassigned during reauthentication.
 2014-08-25 09:55:44 +02:00
Martin Willi 3ecfc83c6b payload: Use common prefixes for all payload type identifiers 
The old identifiers did not use a proper namespace and often clashed with
other defines.
 2014-06-04 15:53:03 +02:00
Martin Willi e3311e9b87 ikev1: implement mode config push mode 2013-09-04 10:33:38 +02:00
Tobias Brunner 8a0a1ae857 Delete IKE_SAs if responder does not initiate XAuth exchange within a certain time frame 2013-03-19 12:00:00 +01:00
Volker Rümelin 0ff8d20a89 Add support for draft-ietf-ipsec-nat-t-ike-03 and earlier 
This adds support for early versions of the draft that eventually
resulted in RFC 3947.
 2012-12-19 11:03:42 +01:00
Martin Willi 497ce2cf51 Support multiple address pools configured on a peer_cfg 2012-08-30 16:43:42 +02:00
Martin Willi 101d26babe Support multiple virtual IPs on peer_cfg and ike_sa classes 2012-08-30 16:43:42 +02:00
Martin Willi 9d2968e272 As a responder, don't start a TRANSACTION request if we expect one from the initiator 2012-06-29 13:40:31 +02:00
Martin Willi 8ff45cfd99 Queue a mode config task as responder if we need a virtual IP 2012-06-27 11:42:56 +02:00
Martin Willi c2a391746c Add basic support for XAuth responder authentication 2012-06-27 11:42:56 +02:00
Martin Willi 0c32b9c62f Enforce uniqueids=keep only for non-XAuth Main/Agressive Modes 2012-06-25 10:18:35 +02:00
Martin Willi e5f0f9ff96 Enforce uniqueness policy in IKEv1 main and aggressive modes 2012-06-08 16:15:22 +02:00
Tobias Brunner 647cd741e8 Added support for IKEv1 IPComp proposals in SA payload. 2012-05-24 15:32:28 +02:00
Tobias Brunner 1a624ff45a Switch to alternative peer config in IKEv1 Main and Aggressive Mode. 2012-05-21 15:49:25 +02:00
Martin Willi 7ce504e182 Flush task queues explicitly, not implicitly if task returns ALREADY_DONE 2012-05-21 14:17:09 +02:00
Tobias Brunner 7a56c35fc9 Remove executable flag from source files. 2012-05-18 10:04:08 +02:00
Andreas Steffen 44bd9b48c8 allow private algorithms 2012-05-05 23:25:51 +02:00
Martin Willi 3624b09e21 Set selected proposal on IKEv1 SA, don't pass it separately to Phase 1 helper 2012-03-20 17:31:37 +01:00
Martin Willi f420f51f55 Invoke authorization hooks for IKEv1 connections 2012-03-20 17:31:36 +01:00
Martin Willi 2ddd45c9a7 Simplified DPD handling by using a task for a single message only 2012-03-20 17:31:35 +01:00
Clavister OpenSource 3e6b740336 Isakmp_dpd task added. 2012-03-20 17:31:35 +01:00
Martin Willi 37c12bd31e Streamlined debug output when initiating IKEv1 IKE_SAs 2012-03-20 17:31:34 +01:00
Martin Willi 91c212fd6a Select IKEv1 configurations by main/aggressive mode option 2012-03-20 17:31:34 +01:00
Martin Willi b4bd875612 Make use of the new Phase 1 helper class in main mode 2012-03-20 17:31:33 +01:00
Martin Willi 44dcd5944a Fix error handling if no PSK found for main mode 2012-03-20 17:31:33 +01:00
Martin Willi b147679a2c Try to detect reauthentication as responder and adopt children to new SA 2012-03-20 17:31:33 +01:00
Martin Willi c9d68d17f0 Include peer config overtime in negotiated ISAKMP SA lifetime 2012-03-20 17:31:32 +01:00
Martin Willi 54773729a8 Queue Mode Config tasks after main mode as initiator, not as responder 2012-03-20 17:31:32 +01:00
Martin Willi 451ebecc85 Implemented migration of Main Mode task 2012-03-20 17:31:29 +01:00
Martin Willi 15a682f4c2 Separated libcharon/sa directory with ikev1 and ikev2 subfolders 2012-03-20 17:31:26 +01:00