denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
9,685 Commits 1 Branch 0 Tags
1323dc1138246a6e2819bcc20b167b75d52e6d7c
Commit Graph
132 Commits
Author SHA1 Message Date
Martin Willi 79d6fc7f72 Renamed ike_natd_v1 to isakmp_natd 2012-03-20 17:31:26 +01:00
Martin Willi 824dc0adad Renamed ike_cert_pre_v1 to isakmp_cert_pre 2012-03-20 17:31:26 +01:00
Martin Willi 0aa2af5efc Renamed ike_cert_post_v1 to isakmp_cert_post 2012-03-20 17:31:26 +01:00
Martin Willi ef175c92d9 Initiate IKE_ANY configurations with IKEv2 2012-03-20 17:31:25 +01:00
Martin Willi 53816600ff Added a quick_delete task flag to enforce delete, even if CHILD_SA not found 2012-03-20 17:31:24 +01:00
Martin Willi b24b73b7f3 Flush auth configs, if enabled, for both IKEv1 and IKEv2 2012-03-20 17:31:23 +01:00
Martin Willi c459dae556 Use IKEv1 specific tasks to close Quick Mode SAs 2012-03-20 17:31:22 +01:00
Martin Willi 5f23be840b Use the IKEv1 specific delete in IKEv1 SAs 2012-03-20 17:31:22 +01:00
Martin Willi 69adeb5bf2 Replace xauth_request task with a new stub where we reimplement it 2012-03-20 17:31:15 +01:00
Martin Willi c64a4b4f8e Implemented post-authentication certificate handling for IKEv1 2012-03-20 17:31:13 +01:00
Martin Willi 0bcdb8e571 Implemented pre-authentication certificate handling for IKEv1 2012-03-20 17:31:13 +01:00
Tobias Brunner 1cc4ec46cf Task added for IKEv1 NAT detection. 
There is already support for both Main and Aggressive Mode.
 2012-03-20 17:31:10 +01:00
Clavister OpenSource 02c36eeb86 IKEv1 XAuth: Adding "initiate" flag parameter to the initiate_xauth method, signalling whether or not to call the task_manager->initiate method after queueing the task. 2012-03-20 17:31:10 +01:00
Clavister OpenSource 65359ccbbc IKEv1 XAuth: Add "initiate xauth" method, which adds the xauth task into the queue for initiation. 2012-03-20 17:31:09 +01:00
Tobias Brunner 68c6863bbb Moved main part of message processing to task managers. 
This will allow individual error handling for each IKE version and should
allow better handling of IKEv1 retransmits.
 2012-03-20 17:31:08 +01:00
Tobias Brunner 44ff1153e8 Addded ike_sa_t.set_statistic to set timestamps from task manager. 2012-03-20 17:31:08 +01:00
Clavister OpenSource e63cb7f816 Revert "IKEv1 XAuth: Temporarilty add an "initiate_later" flag to the task manager. When set to TRUE it will cause "initiate" to be called when the current process_response call is finished. This change should be reverted once we have a better method in place." 
This reverts commit c6c28f4ac522dd8afb457847bca79eee77f78706.

Revert "IKEv1 XAuth: Added temporary "initiate_xauth" public method to ike_sa_t.  This allows us to initiate an XAuth password authentication exchange after responding to the final message of Main Mode.  This change should be reverted once we have a better method to initiate this exchange."

This reverts commit 5529dc50477e25df9dd5f3c442bb1521c0baf225.
 2012-03-20 17:31:07 +01:00
Martin Willi a2f8fc9711 Use a dedicated IKEv1 vendor ID task to fix using IKEv2 payloads in IKEv1 2012-03-20 17:31:07 +01:00
Martin Willi d08269c700 Added a get_rekey/reauth_time() jitter parameter to get time without randomization 2012-03-20 17:30:52 +01:00
Clavister OpenSource e3bb68841a IKEv1 XAuth: Added temporary "initiate_xauth" public method to ike_sa_t. This allows us to initiate an XAuth password authentication exchange after responding to the final message of Main Mode. This change should be reverted once we have a better method to initiate this exchange. 2012-03-20 17:30:51 +01:00
Martin Willi 384c1a32a2 XAUTH is initiated based on configuration, no need to call externally 2012-03-20 17:30:49 +01:00
Clavister OpenSource df99e976be Temp fix for compile error with XAUTH code. 2012-03-20 17:30:49 +01:00
Clavister OpenSource 23f4e4b42d IKEv1 XAUTH: Added ability to configure XAUTH+PSK. Added task to handle XAUTH requests. Modified task_manager_v1 to enable it to initiate new tasks immediately after finishing a response. 2012-03-20 17:30:49 +01:00
Martin Willi 17ec1c74de Don't compare initiator flag in IKE_SA manager, pass initiator parameter to IKE_SA constructor 2012-03-20 17:30:47 +01:00
Tobias Brunner 0cec72df40 Provide keymat_t to message_t to encrypt/decrypt data. 2012-03-20 17:30:45 +01:00
Martin Willi a09972df2b Added a generic TASK_ prefix to all task types 2012-03-20 17:30:45 +01:00
Martin Willi 744c080153 Initiate and respond to quick mode task (stub) 2012-03-20 17:30:45 +01:00
Martin Willi 26b55dc6c8 Implemented first two exchanges of Main Mode as initiator 2012-03-20 17:30:43 +01:00
Tobias Brunner 273f2f8054 Added factory function to create task_manager_t implementations. 2012-03-20 17:30:43 +01:00
Tobias Brunner 4b64a1a17d Added factory function to create keymat_t implementations. 2012-03-20 17:30:43 +01:00
Tobias Brunner 0b611540ef Store IKE version of an SA on ike_sa_t. 2012-03-20 17:30:43 +01:00
Tobias Brunner 6ab936f046 Use keymat_t as common interface, renamed current implementation to _v2. 2012-03-20 17:30:42 +01:00
Martin Willi e69f7dcddf Use task manager as generic interface, renamed implementation to _v2. 2012-03-20 17:30:41 +01:00
Tobias Brunner 4ed52db2bb Allow creation of message_t objects for IKEv1 packets. 2012-03-20 17:30:40 +01:00
Tobias Brunner 72b2811204 Simplified some route lookups now that we store all peer addresses in a list. 2012-03-09 10:22:21 +01:00
Tobias Brunner 94bbc60256 Renamed list of additional peer addresses as it now stores all known addresses. 2012-03-09 10:17:42 +01:00
Martin Willi 4d7a2128b6 Re-resolve hosts on additional keyingtries 2012-03-06 16:05:28 +01:00
Martin Willi fbaf5cd213 Be a little more verbose before starting IKE_SA reauthentication 2012-03-05 18:06:14 +01:00
Martin Willi a07b69734b Send an AUTH_LIFETIME update after updating the lifetime, but can not reauth actively 2012-03-05 18:06:14 +01:00
Martin Willi bdcf441703 Set hard timeouts when setting a lifetime 2012-03-05 18:06:13 +01:00
Martin Willi e9fcf1c6cc Fix IKE_SA timeout debug output on 64bit platforms 2012-03-05 18:06:13 +01:00
Martin Willi 85dd6a8deb Trigger DPD not before IKE_SA state gets updated 2012-02-02 10:35:50 +01:00
Martin Willi 916cdca851 Don't retransmit, rekey, reauth or DPD check SAs when in PASSIVE state 2012-02-02 10:34:04 +01:00
Thomas Egerer dbd2169569 Change order of destroy/get_ref function calls 
Since DESTROY_IF might destroy the peer_cfg, a get_ref on a freed object
is subject to fail.
 2011-11-04 11:11:17 +01:00
Tobias Brunner 7ab19d571d Throw an alert when the peer address cannot be resolved during initiation. 2011-08-12 09:59:27 +02:00
Tobias Brunner 5baaaa5ed5 Properly initialize ike_sa_t. 2011-08-01 13:08:15 +02:00
Martin Willi 5d6b981572 Inherit authentication information during IKE_SA rekeying 2011-07-25 14:19:17 +02:00
Tobias Brunner f3bb1bd039 Fixed common misspellings. 
Mostly found by 'codespell'.
 2011-07-20 16:14:10 +02:00
Tobias Brunner 572abc6cbd Replaced ike_sa_t.create_additional_address_iterator with enumerator. 2011-07-06 09:43:45 +02:00
Tobias Brunner 4bbce1ef37 Replaced ike_sa_t.create_child_sa_iterator with enumerator. 
This required two new methods on ike_sa_t. One returns the number of
CHILD_SAs and one allows to remove a CHILD_SA.
 2011-07-06 09:43:45 +02:00