denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
13,783 Commits 1 Branch 0 Tags
246c969d8bc98194c300989d545d8fa40e246399
Commit Graph
981 Commits
Author SHA1 Message Date
Volker Rümelin 643da9d2e6 ikev1: Properly initialize list of fragments in case fragment ID is 0 
Fixes CVE-2013-6076.
 2013-10-31 21:58:42 +01:00
Tobias Brunner 1dd58b0e21 Fixed some typos 2013-10-29 11:44:23 +01:00
Tobias Brunner 6278e64230 trap-manager: Make sure a config is not trapped twice 2013-10-17 10:23:32 +02:00
Tobias Brunner 50bd28d549 iv_gen: aead_t implementations provide an IV generator 2013-10-11 15:55:40 +02:00
Tobias Brunner e2c9a03d15 Remove HASH_PREFERRED, usages are replaced with HASH_SHA1, which is required for IKEv2 anyway 2013-10-11 15:13:25 +02:00
Martin Willi d7083b6541 kernel: Use a time_t to report use time in query_policy() 2013-10-11 10:23:17 +02:00
Martin Willi c99458e94e kernel: Use a time_t to report use time in query_sa() 2013-10-11 10:23:17 +02:00
Martin Willi 757343d90e ike: Define keylength for aescmac algorithm 2013-10-11 10:15:21 +02:00
Martin Willi 4bf92306eb ikev1: Delete quick modes with the negotiated SA protocol 2013-10-11 10:15:21 +02:00
Martin Willi 5d569e07fd trap-manager: Install trap with SA protocol of the first configured proposal 2013-10-11 10:15:21 +02:00
Martin Willi 21b096f3b8 child-sa: Save protocol during SPI allocation 
This allows us to properly delete the incomplete SA with the correct protocol
should negotiation fail.
 2013-10-11 10:15:21 +02:00
Martin Willi 908fe1632d ikev1: Negotiate SPI with the first/negotiated proposal protocol 2013-10-11 10:15:21 +02:00
Martin Willi cdab8630d9 ikev2: Allocate SPI with the protocol of the first/negotiated proposal 2013-10-11 10:15:21 +02:00
Martin Willi d2e4dd75b7 ikev1: Accept reauthentication attempts with a keep unique policy from same host 
When we have a "keep" unique policy in place, we have to be less strict in
rejecting Main/Aggressive Modes to enforce it. If the host/port equals to
that of an existing ISAKMP SA, we assume it is a reauthentication attempt
and accept the new SA (to replace the old).
 2013-09-30 13:51:12 +02:00
Martin Willi ee99f37ecc ikev1: Delay a potential delete for a duplicate IKE_SA having a replace policy 
Sending a DELETE for the replaced SA immediately is problematic during
reauthentication, as the peer might have associated the Quick Modes to the
old SA, and also delete them.

With this change the delete for the old ISAKMP SA is usually omitted, as it
is gets implicitly deleted by the reauth.
 2013-09-30 13:51:11 +02:00
Tobias Brunner 561f94ae58 ikev2: Force an update of the host addresses on the first response 
This is especially useful on Android where we are able to send messages
even if we don't know the correct local address (this is possible
because we don't set source addresses in outbound messages).  This way
we may learn the correct local address if it e.g. changed right before
reestablishing an SA.

Updating the local address later is tricky without MOBIKE as the
responder might not update the associated IPsec SAs properly.
 2013-09-23 11:50:12 +02:00
Tobias Brunner 9292357030 ike-sa: Resolve hosts before reestablishing an IKE_SA 2013-09-23 11:49:52 +02:00
Tobias Brunner fafa768478 ikev1: Fix double free when searching for redundant CHILD_SAs 
Fixes #411.
 2013-09-13 10:14:45 +02:00
Thomas Egerer 7d938be9e9 ikev1: For PFS prefer DH group from IKE_SA over first configured 
If PFS is configured for a CHILD_SA first try to create a list of
proposals with using DH group negotiated during phase 1. If the
resulting list is empty (i.e. the DH group(s) configured for PFS differ
from the one(s) configured for the IKE_SA), fall back to the first
configured DH group from the CHILD_SA.
This modificiation is due to the fact that it is likely that the peer
supports the same DH group for PFS it did already for the IKE_SA.
 2013-09-10 10:28:32 +02:00
Martin Willi beffdc6ab8 ike-cfg: remove the to be obsoleted allow any parameter in get_my/other_addr 2013-09-04 10:38:37 +02:00
Martin Willi 7446fa2860 trap-manager: use ike_cfg resolver functions 2013-09-04 10:38:37 +02:00
Martin Willi 0edce68767 ike-sa: use ike_cfg resolver functions 2013-09-04 10:38:36 +02:00
Martin Willi e3311e9b87 ikev1: implement mode config push mode 2013-09-04 10:33:38 +02:00
Martin Willi 510ecf612a xauth: add a configuration string option to be passed to XAuth instances 
The configuration string is appended to the XAuth backend name, separated by
a colon. The configuration string is passed untouched to the backend, where
it can change the behavior of the XAuth module.
 2013-09-03 16:26:19 +02:00
Tobias Brunner f853e7bcc0 ikev1: Fix calculation of the number of fragments 
The old code resulted in too few fragments in some cases.
 2013-08-15 15:15:34 +02:00
Tobias Brunner c81a6ff907 ikev1: When sending fragments, use ports to decide if a non-ESP marker is added 
This is same same logic used by sender and might apply in some cases (e.g.
when initiating to port 4500).
 2013-08-15 15:12:00 +02:00
Tobias Brunner e42ab08a73 ikev2: Fix segfault when reestablishing CHILD_SAs due to closeaction=restart|hold 
This regression was introduced with c949a4d5.
 2013-08-13 10:08:08 +02:00
Tobias Brunner 4dc8978000 ikev2: Only schedule half-open-timeout delete job after successfully handling IKE_SA_INIT 
We want to avoid this allocation if the initial message is invalid (e.g.
if the message ID is != 0).
 2013-07-29 11:25:43 +02:00
Tobias Brunner 77ccff82cf ikev1: Always send ID payloads (traffic selectors) during Quick Mode 
Especially Windows 7 has problems if the peer does not send ID payloads
for host-to-host connections (tunnel and transport mode).

Fixes #319.
 2013-07-25 17:08:17 +02:00
Tobias Brunner 0ceb288815 Fix various API doc issues and typos 
Partially based on an old patch by Adrian-Ken Rueegsegger.
 2013-07-18 18:30:36 +02:00
Tobias Brunner 07a9d5c91a ike: Fix reestablishing SAs if no child-creating tasks are queued 2013-07-18 10:40:08 +02:00
Martin Willi 2b0c8ee37d ike-sa: uninstall CHILD_SAs before removing virtual IPs 
a3854d83 changed cleanup order. But we should remove CHILD_SAs first, as routes
for CHILD_SAs might get deleted while removing virtual IPs, resulting in
an error when a CHILD_SA tries to uninstall its route.
 2013-07-18 10:35:38 +02:00
Tobias Brunner a9ffb48f21 ikev1: Reestablish IKE_SA/CHILD_SAs if it gets deleted by the peer 
We call ike_sa_t.reestablish() so the IKE_SA is only recreated if any
CHILD_SA requires it.
 2013-07-17 18:16:59 +02:00
Tobias Brunner 68db844f99 ike: Migrate queued CHILD_SA-creating tasks when reestablishing an IKE_SA 2013-07-17 18:16:58 +02:00
Oliver Smith b79fdab878 ikev1: Support closeaction of CHILD_SA. 
When a CHILD_SA is closed in IKEv1, if it is not being rekeyed and
closeaction has been set, we can now perform a restart or hold as is
currently done for IKEv2.
 2013-07-17 18:16:58 +02:00
Martin Willi c6f1d0de94 child-sa: refactor proxy transport mode address lookup 2013-07-17 17:20:18 +02:00
Martin Willi 2745ae264a child-sa: replace traffic selector lists by arrays 
Saves up to another 0.5KB of memory per CHILD_SA.
 2013-07-17 17:20:18 +02:00
Martin Willi 553bb78730 child-sa: replace get_traffic_selectors() with create_ts_enumerator() 
Not directly returning a linked list allows us to change the internals of
the CHILD_SA transparently.
 2013-07-17 17:20:18 +02:00
Martin Willi 6207fadb6c ikev2: replace linked lists by arrays in task manager 
Eliminates another three lists, 0.5KB per IKE_SA.
 2013-07-17 17:20:18 +02:00
Martin Willi 893da0411f ike-sa: use arrays instead of linked lists in long lived collections 
This saves about 1.5KB of memory per IKE_SA.
 2013-07-17 17:20:17 +02:00
Tobias Brunner bf92887af1 ike: Resolve hosts only for address families currently supported 2013-07-05 09:48:26 +02:00
Tobias Brunner c949a4d501 Reuse reqid when restarting CHILD_SAs for dpd|closeaction=restart 2013-07-01 09:58:34 +02:00
Tobias Brunner 4c74fa664b Reuse reqid for trap policies installed for dpd|closeaction=hold 2013-07-01 09:58:25 +02:00
Martin Willi a650242643 ikev2: keep the CHILD_SA we delete as initiator in the list to destroy 
If the responder not correctly send the correct protocol or SPI in the delete
response, we should remove the CHILD_SA regardless.
 2013-06-25 14:03:51 +02:00
Tobias Brunner 01955eec71 ike: Force NAT-T/UDP encapsulation if kernel interface requires it 2013-06-21 17:03:21 +02:00
Martin Willi 888dbac50e ikev2: use protocol of selected proposal to delete a failed CHILD_SA 
Depending on the failure, the protocol might not yet be set on the CHILD_SA.
 2013-06-20 12:09:46 +02:00
Martin Willi ad5ad02ade ikev2: properly fall back to tunnel mode if transport/BEET mode not configured 2013-06-19 16:36:01 +02:00
Martin Willi 975457c4d8 ikev2: support transport mode over NAT 2013-06-19 16:36:01 +02:00
Martin Willi a7bc0bf4a6 ike: reuse the reqid of an installed trap having the same config 
When we have a trap installed, but a CHILD_SA gets established for the same
config from the peer, we should reuse the same reqid. Otherwise we would have
two identical policies using different reqids, what we can't handle in our
kernel backend.
 2013-06-19 16:30:40 +02:00
Martin Willi 2dcfc6983b trap-manager: add a method to find reqid for installed traps by config 2013-06-19 16:30:40 +02:00