 Martin Willi
|
37c12bd31e
|
Streamlined debug output when initiating IKEv1 IKE_SAs
|
2012-03-20 17:31:34 +01:00 |
|
|
Martin Willi
|
c40963b457
|
Enforce encapsulation mode of configuration, in case initiator proposes both
|
2012-03-20 17:31:34 +01:00 |
|
|
Martin Willi
|
e129168ba6
|
Added a "aggressive" ipsec.conf connection option
|
2012-03-20 17:31:34 +01:00 |
|
|
Martin Willi
|
830ab2ae7f
|
Handle aggressive mode task in IKEv1 task manager
|
2012-03-20 17:31:34 +01:00 |
|
|
Martin Willi
|
91c212fd6a
|
Select IKEv1 configurations by main/aggressive mode option
|
2012-03-20 17:31:34 +01:00 |
|
|
Martin Willi
|
5ce59d4c06
|
Added an aggressive mode peer_cfg option
|
2012-03-20 17:31:34 +01:00 |
|
|
Martin Willi
|
a347c1ac43
|
Fix sending of CERTREQ/CERT payloads in aggressive mode
|
2012-03-20 17:31:34 +01:00 |
|
|
Martin Willi
|
ebc7bcb550
|
Encrypt payloads of third aggressive mode message
|
2012-03-20 17:31:33 +01:00 |
|
|
Martin Willi
|
ee325b555f
|
Implemented aggressive mode using Phase 1 helper class
|
2012-03-20 17:31:33 +01:00 |
|
|
Martin Willi
|
b4bd875612
|
Make use of the new Phase 1 helper class in main mode
|
2012-03-20 17:31:33 +01:00 |
|
|
Martin Willi
|
c29a89b80d
|
Implemented a common Phase 1 helper class to use by main and aggressive modes
|
2012-03-20 17:31:33 +01:00 |
|
|
Martin Willi
|
44dcd5944a
|
Fix error handling if no PSK found for main mode
|
2012-03-20 17:31:33 +01:00 |
|
|
Martin Willi
|
90731f38c9
|
Install quick mode CHILD_SAs with negotiated encapsulation mode
|
2012-03-20 17:31:33 +01:00 |
|
|
Martin Willi
|
927c1dd9d2
|
Support IKEv1 proposal encodings having both lifebytes and a lifetime
|
2012-03-20 17:31:33 +01:00 |
|
|
Martin Willi
|
b147679a2c
|
Try to detect reauthentication as responder and adopt children to new SA
|
2012-03-20 17:31:33 +01:00 |
|
|
Martin Willi
|
3a0b67bce5
|
Destroy IKE_SA after reauthentication initiatend and lifetime limit reached
|
2012-03-20 17:31:33 +01:00 |
|
|
Martin Willi
|
cb1a145ce2
|
Added an IKE_SA manager method to enumerate IKE_SA IDs filtered by identities
|
2012-03-20 17:31:33 +01:00 |
|
|
Martin Willi
|
beab4a90ae
|
Query for XAuth identity in get_other_eap_id(), too
|
2012-03-20 17:31:32 +01:00 |
|
|
Martin Willi
|
1b79299b89
|
Set ISAKMP SA state to rekeying after triggering reauthentication
|
2012-03-20 17:31:32 +01:00 |
|
|
Martin Willi
|
c9d68d17f0
|
Include peer config overtime in negotiated ISAKMP SA lifetime
|
2012-03-20 17:31:32 +01:00 |
|
|
Martin Willi
|
4f49b06843
|
Initiate IKEv1 reauthentication, take over all children
|
2012-03-20 17:31:32 +01:00 |
|
|
Martin Willi
|
17c64d5ff9
|
Establish IKE_SA only once as XAuth responder
|
2012-03-20 17:31:32 +01:00 |
|
|
Martin Willi
|
9c64f214f1
|
Support initiation of childless IKEv1 ISAKMP SAs
|
2012-03-20 17:31:32 +01:00 |
|
|
Martin Willi
|
7e9e1f96df
|
Don't trigger reauthentication if initiator authenticated using XAuth
|
2012-03-20 17:31:32 +01:00 |
|
|
Martin Willi
|
2da3ff7a52
|
Set a condition flag if peer has been authenticated using XAuth
|
2012-03-20 17:31:32 +01:00 |
|
|
Martin Willi
|
54773729a8
|
Queue Mode Config tasks after main mode as initiator, not as responder
|
2012-03-20 17:31:32 +01:00 |
|
|
Martin Willi
|
462c9a4f72
|
Try all matching XAuth secrets we find, not only the first one
|
2012-03-20 17:31:32 +01:00 |
|
|
Martin Willi
|
3d86d76b86
|
Fixed create_shared_enumerator method description
|
2012-03-20 17:31:31 +01:00 |
|
|
Martin Willi
|
f56c3c53f6
|
As responder, try to reuse the reqid of the CHILD_SA the initiator is rekeying
|
2012-03-20 17:31:31 +01:00 |
|
|
Martin Willi
|
31bd5c8c0e
|
Reply quick mode with the same SA lifetime that we received
|
2012-03-20 17:31:31 +01:00 |
|
|
Martin Willi
|
3a925f74ab
|
Do not query CHILD_SA during delete if they already expired
|
2012-03-20 17:31:31 +01:00 |
|
|
Martin Willi
|
07202a2bf1
|
Be less verbose when deleting SAs triggered by a hard expire
|
2012-03-20 17:31:31 +01:00 |
|
|
Martin Willi
|
23eb447c9a
|
Implemented CHILD_SA rekeying
|
2012-03-20 17:31:31 +01:00 |
|
|
Martin Willi
|
634ac410a2
|
Don't return FAILED if a CHILD_SA to delete could not be found
|
2012-03-20 17:31:31 +01:00 |
|
|
Martin Willi
|
14dc794165
|
Support installing of quick mode SAs with a specific reqid
|
2012-03-20 17:31:31 +01:00 |
|
|
Martin Willi
|
5f1df0a060
|
Double check that we could select a TS as quick mode responder
|
2012-03-20 17:31:31 +01:00 |
|
|
Martin Willi
|
f5a84055fe
|
Implemented responder retransmission, currently enabled for quick mode only
|
2012-03-20 17:31:30 +01:00 |
|
|
Martin Willi
|
dc8e964775
|
Queue IKEv1 INFORMATIONALS with higher priority to process notifies first
|
2012-03-20 17:31:30 +01:00 |
|
|
Martin Willi
|
96f98a8c11
|
Accept IKEv1 INVALID_KE_INFORMATION notifies without data
|
2012-03-20 17:31:30 +01:00 |
|
|
Martin Willi
|
253d7e3eff
|
Don't process notifies in quick mode task when we get an INFORMATIONAL
|
2012-03-20 17:31:30 +01:00 |
|
|
Martin Willi
|
9276f7121c
|
Always queue a new passive task when receiving an IKEv1 INFORMATIONAL
|
2012-03-20 17:31:30 +01:00 |
|
|
Martin Willi
|
8a395e889c
|
Fixed leak of a hash when checking out by hash
|
2012-03-20 17:31:30 +01:00 |
|
|
Martin Willi
|
dd5c3787dc
|
Give a hint that decryption failed if payload length invalid
|
2012-03-20 17:31:30 +01:00 |
|
|
Martin Willi
|
07b8ec7c00
|
Cast keymat safely, not based on external input
|
2012-03-20 17:31:30 +01:00 |
|
|
Martin Willi
|
3bacc1f429
|
Added a keymat_t version to cast it safely
|
2012-03-20 17:31:30 +01:00 |
|
|
Martin Willi
|
3d54ae94d9
|
Handle initiation of not supported IKE versions properly
|
2012-03-20 17:31:30 +01:00 |
|
|
Martin Willi
|
daee47ba46
|
Send a delete for every CHILD_SA before deleting IKE_SA
|
2012-03-20 17:31:30 +01:00 |
|
|
Martin Willi
|
6379c679ae
|
Set used auth_class in PSKv1 authenticator to comply to constraints
|
2012-03-20 17:31:30 +01:00 |
|
|
Martin Willi
|
8573b18d22
|
Fixed scheduling of IKEv2 init tasks in a second keyingtry
|
2012-03-20 17:31:29 +01:00 |
|
|
Martin Willi
|
8ed976c061
|
Don't requeue IKEv1 init tasks if they already exist in a second keyingtry
|
2012-03-20 17:31:29 +01:00 |
|
|
Martin Willi
|
d9c1dae293
|
Implemented resetting of IKEv1 task manager, enabling additional keyingtries
|
2012-03-20 17:31:29 +01:00 |
|
|
Martin Willi
|
94450913ef
|
Fixed migration of NATD task
|
2012-03-20 17:31:29 +01:00 |
|
|
Martin Willi
|
bce22af29e
|
Implemented migration of quick mode task
|
2012-03-20 17:31:29 +01:00 |
|
|
Martin Willi
|
ca037076bf
|
Implemented migration of XAuth task
|
2012-03-20 17:31:29 +01:00 |
|
|
Martin Willi
|
5903acd0ff
|
Implemented migration of certificate handling tasks
|
2012-03-20 17:31:29 +01:00 |
|
|
Martin Willi
|
451ebecc85
|
Implemented migration of Main Mode task
|
2012-03-20 17:31:29 +01:00 |
|
|
Martin Willi
|
448e2e2945
|
Check message version before processing it on an IKE_SA
|
2012-03-20 17:31:29 +01:00 |
|
|
Martin Willi
|
986237603f
|
Fix ike_version_t enum names
|
2012-03-20 17:31:29 +01:00 |
|
|
Martin Willi
|
82b1e5e270
|
Accept NULL as keymat when generating a message
|
2012-03-20 17:31:29 +01:00 |
|
|
Martin Willi
|
53300baded
|
Send correct INVALID_MAJOR_VERSION when receiving packet with unsupported protocol
|
2012-03-20 17:31:28 +01:00 |
|
|
Martin Willi
|
be83ea7ebf
|
Drop IKEv1 main/aggressive modes if peer to aggressive
|
2012-03-20 17:31:28 +01:00 |
|
|
Martin Willi
|
87791f7538
|
Added description for the xauth-eap plugin
|
2012-03-20 17:31:28 +01:00 |
|
|
Martin Willi
|
28e3c6595d
|
Check if a config has been selected before narrowing selectors in quick mode
|
2012-03-20 17:31:28 +01:00 |
|
|
Martin Willi
|
85fc1eb640
|
Added an XAuth plugin that forwards authentication to EAP methods
|
2012-03-20 17:31:28 +01:00 |
|
|
Martin Willi
|
747f837cce
|
Added a flag to register local credential sets exclusively, disabling all others
|
2012-03-20 17:31:28 +01:00 |
|
|
Martin Willi
|
5d1677f52d
|
Added missing XAuth plugin feature enum names
|
2012-03-20 17:31:28 +01:00 |
|
|
Martin Willi
|
438a8d785f
|
Added a TODO for creating IKE_SAs with unsupported protocol version
|
2012-03-20 17:31:28 +01:00 |
|
|
Martin Willi
|
38bb727c06
|
Don't accept IKEv2 packets if IKEv2 disabled
|
2012-03-20 17:31:28 +01:00 |
|
|
Martin Willi
|
7d788af0a0
|
Don't include ikev1/ikev2 subfolders in build when using --disable-ikev1/ikev2
|
2012-03-20 17:31:28 +01:00 |
|
|
Martin Willi
|
326a94232d
|
Moved eap/xauth classes out of protocol specific subdirectories
|
2012-03-20 17:31:27 +01:00 |
|
|
Martin Willi
|
3b08de850a
|
Removed obsolete task header inclusion in IKE_SA
|
2012-03-20 17:31:27 +01:00 |
|
|
Martin Willi
|
873df908cc
|
Moved MOBIKE task creation to protocol specific task manager
|
2012-03-20 17:31:27 +01:00 |
|
|
Martin Willi
|
26eee421b4
|
Check in task manager if we have to requeue IKE tasks in a non-first keyingtry
|
2012-03-20 17:31:27 +01:00 |
|
|
Martin Willi
|
cedb412e5a
|
Moved IKE_SA reauth task creation to protocol specific task manager
|
2012-03-20 17:31:27 +01:00 |
|
|
Martin Willi
|
dab60d6411
|
Moved IKE_SA rekey task creation to protocol specific task manager
|
2012-03-20 17:31:27 +01:00 |
|
|
Martin Willi
|
3ed148b37e
|
Moved IKE_SA delete task creation to protocol specific task manager
|
2012-03-20 17:31:27 +01:00 |
|
|
Martin Willi
|
83c5fda053
|
Moved CHILD_SA delete task creation to protocol specific task manager
|
2012-03-20 17:31:27 +01:00 |
|
|
Martin Willi
|
463a73cc0f
|
Moved CHILD_SA rekey task creation to protocol specific task manager
|
2012-03-20 17:31:27 +01:00 |
|
|
Martin Willi
|
fe43d9a237
|
Moved CHILD_SA initiate task creation to protocol specific task manager
|
2012-03-20 17:31:27 +01:00 |
|
|
Martin Willi
|
a60daa07f6
|
Moved IKE_SA initiate task creation to protocol specific task manager
|
2012-03-20 17:31:27 +01:00 |
|
|
Martin Willi
|
244d715de5
|
Moved liveness checking task creation to protocol specific task manager
|
2012-03-20 17:31:27 +01:00 |
|
|
Martin Willi
|
7d0a3a427d
|
Factories honor charon IKEv1/IKEv2 protocol support flags
|
2012-03-20 17:31:26 +01:00 |
|
|
Martin Willi
|
e51a28fda8
|
Added a --disable-ikev2 option to disable IKEv2 support in charon
|
2012-03-20 17:31:26 +01:00 |
|
|
Martin Willi
|
15a682f4c2
|
Separated libcharon/sa directory with ikev1 and ikev2 subfolders
|
2012-03-20 17:31:26 +01:00 |
|
|
Martin Willi
|
2e3c9f8799
|
Renamed ike_vendor_v1 to isakmp_vendor
|
2012-03-20 17:31:26 +01:00 |
|
|
Martin Willi
|
79d6fc7f72
|
Renamed ike_natd_v1 to isakmp_natd
|
2012-03-20 17:31:26 +01:00 |
|
|
Martin Willi
|
824dc0adad
|
Renamed ike_cert_pre_v1 to isakmp_cert_pre
|
2012-03-20 17:31:26 +01:00 |
|
|
Martin Willi
|
0aa2af5efc
|
Renamed ike_cert_post_v1 to isakmp_cert_post
|
2012-03-20 17:31:26 +01:00 |
|
|
Martin Willi
|
26a758ffcb
|
Fixed fix for XAuth plugin feature matching
|
2012-03-20 17:31:25 +01:00 |
|
|
Martin Willi
|
8833068877
|
Doxygen fixes
|
2012-03-20 17:31:25 +01:00 |
|
|
Martin Willi
|
ef32c6866e
|
Removed obsolete XAuth job
|
2012-03-20 17:31:25 +01:00 |
|
|
Martin Willi
|
26b02f50f4
|
Always use a transform number of 1 when encoding a single transform
|
2012-03-20 17:31:25 +01:00 |
|
|
Martin Willi
|
5d0458af0a
|
Another set of cleanups in message.c
|
2012-03-20 17:31:25 +01:00 |
|
|
Martin Willi
|
2ee83c2778
|
Fix XAuth plugin feature matching
|
2012-03-20 17:31:25 +01:00 |
|
|
Martin Willi
|
ef175c92d9
|
Initiate IKE_ANY configurations with IKEv2
|
2012-03-20 17:31:25 +01:00 |
|
|
Martin Willi
|
ac009df132
|
Pass IKE version to peer config enumerator, filter configs
|
2012-03-20 17:31:25 +01:00 |
|
|
Martin Willi
|
d94c923648
|
Support an "any" IKE version for both IKEv1 or IKEv2
|
2012-03-20 17:31:25 +01:00 |
|
|
Martin Willi
|
b9a707e696
|
Some coding style cleanups
|
2012-03-20 17:31:25 +01:00 |
|
|
Martin Willi
|
2f58f6cba1
|
Fixed notify enum names
|
2012-03-20 17:31:25 +01:00 |
|
|
Martin Willi
|
bf5b1d9e73
|
Send different notifies if quick mode fails
|
2012-03-20 17:31:24 +01:00 |
|