denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
9,329 Commits 1 Branch 0 Tags
3b96189a2afa4949e1d9cdf7c9fa8244d8d817f0
Commit Graph
140 Commits
Author SHA1 Message Date
Martin Willi 3b96189a2a Add a return value to crypter_t.decrypt() 2012-07-16 14:53:38 +02:00
Martin Willi e35abbe588 Add a return value to crypter_t.encrypt 2012-07-16 14:53:37 +02:00
Tobias Brunner 1bb9c51e87 Check rng return value when generating IKEv1 message IDs 2012-07-16 14:53:35 +02:00
Tobias Brunner 92f207477c Check rng return value when generating fake NAT detection payloads 2012-07-16 14:53:35 +02:00
Reto Buerki 605985d122 Nonce: Let get_nonce, allocate_nonce return boolean 2012-07-16 14:53:34 +02:00
Martin Willi f3ca96b2bf Add a return value to prf_t.set_key() 2012-07-16 14:53:34 +02:00
Martin Willi ecc080b393 Add a return value to prf_t.allocate_bytes() 2012-07-16 14:53:34 +02:00
Martin Willi a7e6539135 Use a bool return value in keymat_v1_t.get_hash_phase2() 2012-07-16 14:53:34 +02:00
Martin Willi e4c5c1d03e Add a return value to keymat_v1_t.get_hash() 2012-07-16 14:53:34 +02:00
Martin Willi bc47488323 Add a return value to prf_t.get_bytes() 2012-07-16 14:53:33 +02:00
Martin Willi edd54734c8 prf_plus_create() can return NULL on failure 2012-07-16 14:53:33 +02:00
Martin Willi 5d79e6c6b4 Add a return value to prf_plus_t.allocate_bytes() 2012-07-16 14:53:33 +02:00
Martin Willi ad08730a4b Add a return value to aead_t.set_key() 2012-07-16 14:53:32 +02:00
Martin Willi e2ed7bfd22 Add a return value to aead_t.encrypt() 2012-07-16 14:53:32 +02:00
Martin Willi 07836f559d Send cert request based on peers configured authentication class 2012-07-10 17:15:59 +02:00
Martin Willi 3128e7fa7c Don't send CERTREQs when initiating aggressive mode PSK 2012-07-09 12:05:23 +02:00
Martin Willi 9d2968e272 As a responder, don't start a TRANSACTION request if we expect one from the initiator 2012-06-29 13:40:31 +02:00
Martin Willi 271377905d Defer quick mode initiation if we expect a mode config request 2012-06-27 11:42:56 +02:00
Martin Willi 8ff45cfd99 Queue a mode config task as responder if we need a virtual IP 2012-06-27 11:42:56 +02:00
Martin Willi c2a391746c Add basic support for XAuth responder authentication 2012-06-27 11:42:56 +02:00
Andreas Steffen 554a697a84 support Cisco Unity VID 2012-06-25 11:09:06 +02:00
Martin Willi 0ba1ddaa24 Enforce uniqueids=keep based on XAuth identity 2012-06-25 10:18:35 +02:00
Martin Willi f145ea29e0 Don't send XAUTH_OK if a hook prevents SA to establish 2012-06-25 10:18:35 +02:00
Martin Willi 0c32b9c62f Enforce uniqueids=keep only for non-XAuth Main/Agressive Modes 2012-06-25 10:18:35 +02:00
Martin Willi de5e8fb4e0 Add missing XAuth name variable when complaining about missing XAuth backend 2012-06-25 10:09:27 +02:00
Tobias Brunner e91157a4b6 Fix SIGSEGV if kernel install fails during Quick Mode as responder. 2012-06-22 11:34:38 +02:00
Martin Willi af518b450e Adopt children as XAuth initiator (which is IKE responder) 2012-06-14 14:49:19 +02:00
Martin Willi b31a56f128 Require a scary option to respond to Aggressive Mode PSK requests 
While Aggressive Mode PSK is widely used, it is known to be subject
to dictionary attacks by passive attackers. We don't complain as
initiator to be compatible with existing (insecure) setups, but
require a scary strongswan.conf option if someone wants to use it
as responder.
 2012-06-14 10:25:48 +02:00
Martin Willi e5f0f9ff96 Enforce uniqueness policy in IKEv1 main and aggressive modes 2012-06-08 16:15:22 +02:00
Martin Willi 2d4c347af9 While checking for redundant quick modes, compare traffic selectors 
If a configuration is instanced more than once using narrowing,
we should keep all unique quick modes up during rekeying.
 2012-06-08 10:22:03 +02:00
Martin Willi 7a5f372c57 Initiate quick mode rekeying with narrowed traffic selectors 2012-06-08 10:22:03 +02:00
Martin Willi d61f2906d4 Use traffic selectors passed to quick mode constructor as initiator 2012-06-08 10:22:03 +02:00
Martin Willi 1e24fa4614 Instead of rekeying, delete a quick mode if we have a fresher instance 
If both peers initiate quick mode rekeying simultaneously, we end up
with duplicate SAs for a configuration. This can't be avoided, nor do
the standards provide an appropriate solution. Instead of closing one
SA immediately, we keep both. But once rekeying triggers, we don't
refresh the SA with the shorter soft lifetime, but delete it.
 2012-06-08 10:22:03 +02:00
Tobias Brunner 3451ecd7ac Added log message if peer does not accept/provide IPComp proposal. 2012-05-24 15:32:28 +02:00
Tobias Brunner 47b448b807 Added support to negotiate IPComp during Quick Mode. 2012-05-24 15:32:28 +02:00
Tobias Brunner 647cd741e8 Added support for IKEv1 IPComp proposals in SA payload. 2012-05-24 15:32:28 +02:00
Tobias Brunner 00e11bcefd Fix memleak during Quick Mode in case no SPI can be allocated from kernel. 2012-05-24 15:32:27 +02:00
Martin Willi 3c475660c5 Apply IDir before deriving keys as aggressive initiator 2012-05-23 12:27:47 +02:00
Martin Willi 523ce7c20c Use received identity to look up PSK as aggressive responder 2012-05-23 12:18:45 +02:00
Martin Willi 51754f6654 Check if we actually have an initiating packet to free while processing responses 2012-05-23 11:50:12 +02:00
Tobias Brunner 1a624ff45a Switch to alternative peer config in IKEv1 Main and Aggressive Mode. 2012-05-21 15:49:25 +02:00
Martin Willi 17949695bf Cancel pending retransmits when flushing active task queue 2012-05-21 14:57:33 +02:00
Martin Willi 4ce92ef350 Cancel active quick mode task when receiving INFORMATIONAL error 2012-05-21 14:57:33 +02:00
Martin Willi 7ce504e182 Flush task queues explicitly, not implicitly if task returns ALREADY_DONE 2012-05-21 14:17:09 +02:00
Martin Willi a5c799602f Make task managers flush_queue() method public 2012-05-21 14:02:35 +02:00
Tobias Brunner 7a56c35fc9 Remove executable flag from source files. 2012-05-18 10:04:08 +02:00
Tobias Brunner 22bf44c8b9 Use separate Doxygen groups for IKEv1 and IKEv2 entities (authenticators, tasks etc.). 2012-05-18 10:04:08 +02:00
Adrian-Ken Rueegsegger afaf1bdf5e Use nonce_gen instead of rng to generate nonces 
Replace usage of rng plugin with nonce generator to create nonces in
IKE_INIT, CHILD_CREATE and QUICK_MODE tasks and the IKEv1 phase 1 helper.
 2012-05-18 08:15:41 +02:00
Adrian-Ken Rueegsegger 5338fe5e79 Add create_nonce_gen function to keymat interface 
This function returns a nonce generator object.
 2012-05-18 08:15:41 +02:00
Andreas Steffen 80c5b17d1a make IKEv1 DPD timeout configurable in charon 2012-05-17 19:49:22 +02:00