denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
6,209 Commits 1 Branch 0 Tags
2f942ba67ddca55d6fafc639669336d4f855271f
Commit Graph
86 Commits
Author SHA1 Message Date
Martin Willi 86993d6b90 Never register IKE_SA during checkout_new, as rekeying keeps it checked out 2010-12-07 16:30:38 +01:00
Thomas Egerer 76ce213c43 Guarantee entry->other is set when calling put_connected_peers 
Given the original intent of entry->host, the check for DoS attacks, it
can happen that this value remains NULL when an entry is created. This
is particularly awkward if put_connected_peers is called to check if a
connection to a given peer already exists, since it takes the address
family into consideration (git commit b74219d0) which is gleaned from
entry->host.
This patch guarantees that entry->other is a clone of host before
put_connected_peers is called.
 2010-12-06 10:56:57 +01:00
Thomas Egerer e66420566c Do not checkin a previously destroyed SA 2010-11-16 10:25:33 +01:00
Thomas Egerer 8f927116be Extend connected peers by peer family 
This allows for simultanious IPv4 and IPv6 tunnel for same peers with
matching identities.
 2010-11-12 16:28:04 +01:00
Tobias Brunner 1dbf0ed982 Do not add additional addresses to MOBIKE path probing messages. 2010-10-12 11:11:06 +02:00
Tobias Brunner 5774408898 Change behavior of responder during roaming. 
If the current source address is not available anymore, the responder
uses ike_mobike_t.roam, thus, uses multiple address combinations when
trying to notify the initiator.
 2010-10-12 11:11:05 +02:00
Tobias Brunner c5770f864f Allow responder to use ike_mobike_t.roam. 
After getting a response the responder updates the IPsec SAs.
 2010-10-12 11:11:05 +02:00
Tobias Brunner 261b2572d1 Send list of additional addresses even if current path is still valid. 2010-10-12 11:11:05 +02:00
Tobias Brunner bab56a4abb Extracted path checking in ike_sa_t.roam into separate functions. 2010-10-12 11:11:05 +02:00
Tobias Brunner 769c69facc Added support for responders to change their address via MOBIKE. 
If the original responder updates its list of additional addresses we
check if the remote endpoint changed and update the IPsec SAs if it did,
as we assume the original address became unavailable and the responder
already updated the SAs on its side.
 2010-10-12 11:11:05 +02:00
Tobias Brunner 13876431d6 Explicitly configure MOBIKE tasks to update the list of additional addresses. 2010-10-12 11:11:05 +02:00
Tobias Brunner 31e7dc4dfd Improved check for first IKE_AUTH message in ike_mobike task. 
If the original responder initiated a MOBIKE exchange, the previous
check was not always correct.
 2010-10-12 11:11:05 +02:00
Tobias Brunner c817e7bb90 Migrated ike_mobike task to INIT/METHOD macros. 2010-10-12 11:11:05 +02:00
Tobias Brunner be90134211 Simplified apply_port function in mobike task. 2010-10-12 11:11:04 +02:00
Tobias Brunner cd26eedc5c Do not update hosts based on retransmitted messages. 2010-10-12 11:11:04 +02:00
Tobias Brunner d5bd775126 Do not update remote host if we are behind a NAT. 2010-10-12 11:11:04 +02:00
Andreas Steffen 3c354b6d11 NOTIFY error message types include 16383 2010-09-29 19:01:36 +02:00
Tobias Brunner 71b6d2ff5e Adapted child_sa_t to changed kernel interface. 2010-09-02 19:04:22 +02:00
Tobias Brunner bd7a2f3bfc Added an option to specify the type of a policy to kernel_ipsec.add_policy. 
This will later allow us to support pluto's passthrough and drop
policies in charon.
 2010-09-02 19:04:19 +02:00
Tobias Brunner b4872c1e09 Replaced the protocol argument in add_policy with an optional SPI for an AH SA. 2010-09-02 19:04:19 +02:00
Tobias Brunner bb381e26c6 Refer to scheduler and processor via lib and not hydra. 2010-09-02 19:04:18 +02:00
Tobias Brunner f6659688ab Refer to kernel interface via hydra and not charon. 2010-09-02 19:01:25 +02:00
Tobias Brunner 9f166d9ac2 Removed references to protocol_id_t from kernel interface. 
Instead we use the actual IP protocol identifier (the conversion now happens in
child_sa_t and kernel_handler_t).
 2010-09-02 19:01:25 +02:00
Tobias Brunner 9d94174242 Migrated child_sa_t to INIT/METHOD macros. 2010-09-02 19:01:25 +02:00
Tobias Brunner 61e8e73206 Refer to scheduler via hydra and not charon. 2010-09-02 19:01:24 +02:00
Tobias Brunner c5f7146b17 Refer to processor via hydra and not charon. 2010-09-02 19:01:22 +02:00
Martin Willi 36eafea232 Use the AAA Identity for EAP authentication, if given 2010-08-31 18:10:23 +02:00
Martin Willi f13a03add0 Moved EAP type/code definitions to a seprate header file in libstrongswan 2010-08-31 15:35:29 +02:00
Tobias Brunner 2402dee177 Port floating patch partially reversed. 
If MOBIKE is enabled, we do have to switch to port 4500 with the
IKE_AUTH request, that is, before we know whether the other peer
actually supports MOBIKE or not.
 2010-08-30 14:54:31 +02:00
Tobias Brunner 277f02ce9e Slightly refactored port floating. 
In case of MOBIKE, only float to port 4500 if the other peer actually supports MOBIKE.
 2010-08-30 13:42:58 +02:00
Tobias Brunner fde2d34d0f Fixed ME after introduction of AEAD wrapper. 2010-08-30 10:48:09 +02:00
Martin Willi 5299719569 Migrated delete_payload to INIT/METHOD macros, replaced iterator 2010-08-25 17:03:00 +02:00
Thomas Egerer e54e86cb49 Check if colliding rekey actually created an IKE_INIT 
In some cases (especially if a child is half-open) the colliding
rekey-job might not have created the ike_init member. If so, the
nonce check fails with SIGSEGV.
 2010-08-25 10:16:42 +02:00
Martin Willi 2e64455ee1 Fixed crypter keymat derivation bug 2010-08-19 19:28:08 +02:00
Martin Willi 84eb3aa456 Implemented IKEv2 keymat derivation for AEAD algorithms 2010-08-19 19:02:34 +02:00
Martin Willi b519071299 Use AEAD wrapper for encryption payload encryption/decryption 2010-08-19 19:02:33 +02:00
Martin Willi 5555b900b2 Migrated keymat to INIT/METHOD macros 2010-08-19 12:35:53 +02:00
Martin Willi ba31fe1fd6 Use a seperate section for each nested struct member in INIT macro 2010-08-18 12:15:03 +02:00
Andreas Steffen 53115857ae some simplifications using the INIT macro 2010-08-17 20:09:32 +02:00
Martin Willi c03b0d7e6b Added support for Camellia cipher to xcbc 2010-08-13 17:11:54 +02:00
Andreas Steffen 45c4021bd0 Migrated eap_authenticator to INIT/METHOD macros 2010-08-13 15:58:53 +02:00
Andreas Steffen fe6ae23d1f Migrated eap_manager to INIT/METHOD macros 2010-08-13 15:32:37 +02:00
Andreas Steffen 87799b0c00 moved eap_from_string() fomr libcharon to libstrongswan to make it available in starter 2010-08-13 15:07:53 +02:00
Andreas Steffen 4412ee86c5 recognize eap-ttls method 2010-08-12 23:58:54 +02:00
Martin Willi a944d2092b Use bits instead of bytes for a private/public key 2010-08-10 18:46:30 +02:00
Jiri Bohac 30d8e8d04d fix error-type range in parsing of NOTIFY payloads 2010-08-06 11:47:35 +02:00
Tobias Brunner 83628fd600 Accept EAP_ONLY_AUTHENTICATION notifies from any client, now that IANA allocated an ID. 2010-08-04 12:58:53 +02:00
Martin Willi 65858b83f8 Destroy IKE_SA Managers crypto primitives during flush, the plugins are gone in destroy 2010-08-04 09:26:21 +02:00
Martin Willi 2107953804 Added EAP-TLS plugin stub 2010-08-03 15:39:24 +02:00
Thomas Egerer 86a73f16ab Do not touch child from collision if peer deleted it 2010-08-03 10:32:38 +02:00