denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
9,164 Commits 1 Branch 0 Tags
2a5952765956192359a0f0b8506c5ec266a6d387
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Martin Willi 0f018a7324 Show some uname() info in "ipsec statusall" 2012-06-28 11:56:40 +02:00
Martin Willi b8e17eb36f Show some uname() info during charon startup 2012-06-28 11:56:15 +02:00
Martin Willi 271377905d Defer quick mode initiation if we expect a mode config request 2012-06-27 11:42:56 +02:00
Martin Willi 8ff45cfd99 Queue a mode config task as responder if we need a virtual IP 2012-06-27 11:42:56 +02:00
Martin Willi c2a391746c Add basic support for XAuth responder authentication 2012-06-27 11:42:56 +02:00
Martin Willi a9aa75b90e Map XAuth responder authentication methods between IKEv1 and IKEv2 2012-06-27 11:42:56 +02:00
Martin Willi dc6d259635 Show remote EAP/XAuth identity in "statusall" on a separate line 2012-06-27 11:42:00 +02:00
Martin Willi 5def45b890 Ignore a received %any virtual IP for installation 2012-06-26 18:00:40 +02:00
Martin Willi 0ba1ddaa24 Enforce uniqueids=keep based on XAuth identity 2012-06-25 10:18:35 +02:00
Martin Willi f145ea29e0 Don't send XAUTH_OK if a hook prevents SA to establish 2012-06-25 10:18:35 +02:00
Martin Willi 0c32b9c62f Enforce uniqueids=keep only for non-XAuth Main/Agressive Modes 2012-06-25 10:18:35 +02:00
Martin Willi dd1381e7d3 Show EAP/XAuth identity in "ipsec status", if available 2012-06-25 10:18:35 +02:00
Martin Willi 0fbfcf2a3a Use XAuth/EAP remote identity for uniqueness check 2012-06-25 10:18:34 +02:00
Martin Willi de5e8fb4e0 Add missing XAuth name variable when complaining about missing XAuth backend 2012-06-25 10:09:27 +02:00
Martin Willi e2dd114f37 Select requested virtual IP family based on remote TS, if no local TS available 2012-06-20 10:02:01 +02:00
Martin Willi af518b450e Adopt children as XAuth initiator (which is IKE responder) 2012-06-14 14:49:19 +02:00
Martin Willi 794cdbc53f Added 5.0 NEWS about IKEv1 in charon 2012-06-14 10:57:29 +02:00
Martin Willi e36497700c Print the kind of *Swan during starter startup 2012-06-14 10:25:48 +02:00
Martin Willi 137035cc78 Show what kind of *Swan we run in "ipsec status" 2012-06-14 10:25:48 +02:00
Martin Willi b31a56f128 Require a scary option to respond to Aggressive Mode PSK requests 
While Aggressive Mode PSK is widely used, it is known to be subject
to dictionary attacks by passive attackers. We don't complain as
initiator to be compatible with existing (insecure) setups, but
require a scary strongswan.conf option if someone wants to use it
as responder.
 2012-06-14 10:25:48 +02:00
Martin Willi 5a6e5e0d2d NEWS about specifying trustchain HASH algorithm requirements 2012-06-12 15:01:39 +02:00
Martin Willi 7c4214bd38 Add documentation for signature hash algorithm enforcing to man ipsec.conf 2012-06-12 15:01:39 +02:00
Martin Willi e35bbb9740 Added signature scheme options left/rightauth 2012-06-12 15:01:39 +02:00
Martin Willi 918e92c4c9 Support multiple different public key strength types in constraints 2012-06-12 14:24:49 +02:00
Martin Willi fd4ff11858 Add signature schemes to auth_cfg during trustchain validation 2012-06-12 14:24:49 +02:00
Martin Willi a37f2d2006 certificate_t->issued_by takes an argument to receive signature scheme 2012-06-12 14:24:49 +02:00
Martin Willi 439d0742e9 Define auth_cfg rules for signature schemes 2012-06-12 14:24:49 +02:00
Martin Willi e5f0f9ff96 Enforce uniqueness policy in IKEv1 main and aggressive modes 2012-06-08 16:15:22 +02:00
Martin Willi 82ad53b776 Try to rekey without KE exchange if peer returns INVALID_KE_PAYLOAD(NONE) 
According to RFC5996, implementations should just ignore the KE payload
if they select a non-PFS proposals. Some implementations don't, but
return MODP_NONE in INVALID_KE_PAYLOAD, hence we accept that, too.
 2012-06-08 10:35:02 +02:00
Martin Willi 2d4c347af9 While checking for redundant quick modes, compare traffic selectors 
If a configuration is instanced more than once using narrowing,
we should keep all unique quick modes up during rekeying.
 2012-06-08 10:22:03 +02:00
Martin Willi 106b938b6b Store shorter soft lifetime of in- and outbound SAs only 2012-06-08 10:22:03 +02:00
Martin Willi 7a5f372c57 Initiate quick mode rekeying with narrowed traffic selectors 2012-06-08 10:22:03 +02:00
Martin Willi d61f2906d4 Use traffic selectors passed to quick mode constructor as initiator 2012-06-08 10:22:03 +02:00
Martin Willi 1e24fa4614 Instead of rekeying, delete a quick mode if we have a fresher instance 
If both peers initiate quick mode rekeying simultaneously, we end up
with duplicate SAs for a configuration. This can't be avoided, nor do
the standards provide an appropriate solution. Instead of closing one
SA immediately, we keep both. But once rekeying triggers, we don't
refresh the SA with the shorter soft lifetime, but delete it.
 2012-06-08 10:22:03 +02:00
Martin Willi ab24a32edf As responder, enforce the same configuration while rekeying CHILD_SAs 2012-06-06 16:06:49 +02:00
Martin Willi 21043198ff Show expiration time of rekeyed CHILD_SAs in statusall 2012-06-05 10:29:43 +02:00
Martin Willi 060b508e0e Fix boolean return value if an empty RSA signature is detected in gmp plugin 
Fixes CVE-2012-2388.
 2012-05-31 17:38:59 +02:00
Martin Willi 3c475660c5 Apply IDir before deriving keys as aggressive initiator 2012-05-23 12:27:47 +02:00
Martin Willi 523ce7c20c Use received identity to look up PSK as aggressive responder 2012-05-23 12:18:45 +02:00
Martin Willi 51754f6654 Check if we actually have an initiating packet to free while processing responses 2012-05-23 11:50:12 +02:00
Martin Willi 17949695bf Cancel pending retransmits when flushing active task queue 2012-05-21 14:57:33 +02:00
Martin Willi 4ce92ef350 Cancel active quick mode task when receiving INFORMATIONAL error 2012-05-21 14:57:33 +02:00
Martin Willi 7ce504e182 Flush task queues explicitly, not implicitly if task returns ALREADY_DONE 2012-05-21 14:17:09 +02:00
Martin Willi cbc1a20ffe Wrap task managers flush_queue() in IKE_SA 2012-05-21 14:05:01 +02:00
Martin Willi a5c799602f Make task managers flush_queue() method public 2012-05-21 14:02:35 +02:00
Martin Willi 75d4e01c4a Enumerate correct list while removing nonce_gens, fix deregistration 2012-05-21 12:28:01 +02:00
Martin Willi 32400cd91a Added a convenience function to dump backtraces for gdb-less debugging 2012-05-21 12:18:49 +02:00
Martin Willi b5341bb07c Fix IKEv1 DPD clear, destroying IKE_SA even if reestablish not needed 2012-05-21 12:17:32 +02:00
Martin Willi 24742c0f83 Moved IKEv1 DPD processing to task manager, fix sequence issues 2012-05-15 17:00:12 +02:00
Martin Willi b7dafb3f5b Consider inbound ESP as a sign of liveness for DPD timeout 2012-05-15 14:58:28 +02:00
Martin Willi 4b38c22c00 Schedule a DPD timeout job that enforces the IKE message timeout policy 2012-05-15 14:46:02 +02:00
Martin Willi ebf829f2eb Send unanswered follow up R_U_THERE messages with the same DPD seq 2012-05-15 14:46:02 +02:00
Martin Willi 57a8418c88 Do not send IKEv1 DPD retransmit, but create a new INFORMATIONAL 2012-05-15 14:46:02 +02:00
Martin Willi 9e25007646 Explicitly cast from strict_t to crl_policy_t 2012-05-14 14:11:54 +02:00
Martin Willi 1b82fdb2e5 Use correct integrity_algorithm_t enum type in bench_signer() 2012-05-14 14:11:22 +02:00
Martin Willi d185b6acee Make function pointer defined with METHOD() macro non-const 
clang complains about it being const, and the object code
generated from gcc is the same.
 2012-05-14 14:10:00 +02:00
Martin Willi 2e1f4a4631 Remove unused return value of INIT(), making clang happy 2012-05-14 14:07:00 +02:00
Martin Willi 29b56078ea Register load-tester faked kernel interface before other kernel interfaces 2012-05-14 13:21:35 +02:00
Martin Willi d4078ca796 Load tester can enforce a local IP to use 2012-05-14 10:03:05 +02:00
Martin Willi d684242510 Add plugin features support to load-tester plugin 2012-05-14 09:52:53 +02:00
Martin Willi 40ca363a8b If we load new features from a plugin, restart loading from first plugin 2012-05-03 11:08:09 +02:00
Martin Willi c9931135d1 stroke plugin sdepends on building CERT_ANY certificates 2012-05-03 11:07:21 +02:00
Martin Willi 7f957b3379 Building CERT_ANY through PEM requires either a CERT_X509 or a CERT_PGP builder 2012-05-03 09:40:25 +02:00
Martin Willi daab152afa Add plugin features support to stroke plugin 2012-05-02 14:05:52 +02:00
Martin Willi 0c7af2ce27 Certificate decoding soft-depends on public key decoding of specific types 2012-05-02 14:05:52 +02:00
Martin Willi 4b5e637472 PEM loading plugin features depend on the same feature, they are helpers only 2012-05-02 14:05:52 +02:00
Martin Willi f14bf6345f Don't depend on a feature that has a dependency to the same feauture during unload 2012-05-02 14:05:52 +02:00
Martin Willi b24be29646 Merge branch 'ikev1' 
Conflicts:
	configure.in
	man/ipsec.conf.5.in
	src/libcharon/encoding/generator.c
	src/libcharon/encoding/payloads/notify_payload.c
	src/libcharon/encoding/payloads/notify_payload.h
	src/libcharon/encoding/payloads/payload.c
	src/libcharon/network/receiver.c
	src/libcharon/sa/authenticator.c
	src/libcharon/sa/authenticator.h
	src/libcharon/sa/ikev2/tasks/ike_init.c
	src/libcharon/sa/task_manager.c
	src/libstrongswan/credentials/auth_cfg.c
 2012-05-02 11:12:31 +02:00
Martin Willi f99d8b10c9 Added a dedicated sender flush method, delay sender destruction until users gone 2012-05-02 10:22:59 +02:00
Martin Willi 8c35f5d460 Fixed Android null terminated password fixup in xauth-eap 2012-04-26 14:35:27 +02:00
Martin Willi 1b7debcc04 Keep COOKIEs enabled once threshold is hit, until we see no COOKIEs for a few secs 
Toggling COOKIEs on/off is problematic: After doing a COOKIE exchange as
initiator, we can't know if the completing IKE_SA_INIT message is to our first
request or the one with the COOKIE. If the responder just enabled/disabled
COOKIEs and packets get retransmitted, both might be true. Avoiding COOKIE
behavior toggling improves the situation, but does not solve the problem during
the initial COOKIE activation.
 2012-04-17 10:02:21 +02:00
Martin Willi d0d600e1ef Added a note about DH/keymat lifecycle for custom implementations 2012-04-17 10:02:21 +02:00
Martin Willi a59a03670b Reuse existing DH value when retrying IKE_SA_INIT with a COOKIE 2012-04-17 10:02:21 +02:00
Martin Willi 4837d2a981 Fix iteration through half-open IKE_SA table 2012-04-16 16:47:17 +02:00
Martin Willi 10f24e6599 Don't invoke child_updown hook twice as responder 2012-04-11 17:45:12 +02:00
Martin Willi 4ef867f578 Accept zero-length certificate request payloads 2012-04-11 17:22:23 +02:00
Martin Willi 89a5881c63 Added another bunch of commonly used IKEv1 NATT vendor IDs 2012-04-04 10:32:15 +02:00
Martin Willi 4bc7577db2 More detailed NEWS about RADIUS extensions 2012-04-02 13:58:21 +02:00
Martin Willi 3110744a6b Fix null-terminated XAuth passwords, as sent by Android 4 2012-03-22 15:09:25 +01:00
Martin Willi 83d77866f4 Store authentication info of a XAUTH round on IKE_SA 2012-03-22 09:06:31 +01:00
Martin Willi 79f39ecf5d Added a getter for CHILD_SA marks 2012-03-22 09:06:12 +01:00
Martin Willi 3de54af7ec Define a special XFRM mark_t.value that dynamically uses the CHILD_SA reqid 2012-03-22 09:05:56 +01:00
Martin Willi 4f3cf61dfd Reply with received configuration payload identifier in Mode Config 2012-03-20 18:06:29 +01:00
Martin Willi b1f2f05c92 Merge branch 'ikev1-clean' into ikev1-master 
Conflicts:
	configure.in
	man/ipsec.conf.5.in
	src/libcharon/daemon.c
	src/libcharon/plugins/eap_ttls/eap_ttls_peer.c
	src/libcharon/plugins/eap_radius/eap_radius_accounting.c
	src/libcharon/plugins/eap_radius/eap_radius_forward.c
	src/libcharon/plugins/farp/farp_listener.c
	src/libcharon/sa/ike_sa.c
	src/libcharon/sa/keymat.c
	src/libcharon/sa/task_manager.c
	src/libcharon/sa/trap_manager.c
	src/libstrongswan/plugins/x509/x509_cert.c
	src/libstrongswan/utils.h

Applied lost changes of moved files keymat.c and task_manager.c.
Updated listener_t.message hook signature in new plugins.
 2012-03-20 17:57:53 +01:00
Martin Willi a7d3b0e098 Check if we actually have a packet before retransmitting it 2012-03-20 17:31:40 +01:00
Martin Willi 35852af7b1 Use a single set of FDs for all random plugin RNG instances 2012-03-20 17:31:40 +01:00
Martin Willi 182d55b229 Use correct enum values to detect three message tasks for retransmission 2012-03-20 17:31:40 +01:00
Martin Willi f98af1ddd5 Trigger DPD not before IKE_SA state gets updated 2012-03-20 17:31:39 +01:00
Martin Willi 5ed4b727d0 Fix mapping of IKEv1 encapsulation mode 2012-03-20 17:31:39 +01:00
Martin Willi 7fd7ffc649 Use UDP encapsulation even in non-NAT situation if initiator requests it 2012-03-20 17:31:39 +01:00
Martin Willi 75e3d90d43 Updated ipsec.conf man page for the use of IKEv1 with pluto 2012-03-20 17:31:39 +01:00
Martin Willi c60246a618 Support inactivity timeout in IKEv1 CHILD_SAs 2012-03-20 17:31:39 +01:00
Martin Willi a0c17d4157 Use a dedicated PRF for HASH/SIG payloads using ECDSA specific hasher 2012-03-20 17:31:39 +01:00
Martin Willi 4c685e8850 Select public key auth method by checking what key we have 2012-03-20 17:31:39 +01:00
Martin Willi 83b152dd4f Support ECDSA signatures in IKEv1 pubkey authenticator 2012-03-20 17:31:39 +01:00
Martin Willi 5be386ff8e Exchange certificates when using IKEv1 ECDSA authentication 2012-03-20 17:31:39 +01:00
Martin Willi 5aef6bd0f3 Accept NULL auth_cfg_t passed to credential_manager_t.get_private() 2012-03-20 17:31:39 +01:00
Martin Willi 6261c0c3b7 Support encoding of IKEv1 ECDSA proposals 2012-03-20 17:31:38 +01:00
Martin Willi c8d46f2959 Dropped support of deprecated authby=eap and eap= options 2012-03-20 17:31:38 +01:00
Martin Willi c791def8c1 Added support for authby/xauth_server legacy options 2012-03-20 17:31:38 +01:00