denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
8,034 Commits 1 Branch 0 Tags
41e1e435d9c70c28c3e38074d34c43e639ae79e6
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Martin Willi cc6b03bb5a If no IKEv1 shared key found for hosts, try to find one based on config identities 2012-03-20 17:31:17 +01:00
Martin Willi 033dfba01f Log peer cfg enumeration externally for flexibility 2012-03-20 17:31:17 +01:00
Martin Willi d7376e2ab4 Accept NULL identities passed to peer config enumeration 2012-03-20 17:31:17 +01:00
Martin Willi 0e2cc3fed9 Fixed authentication method selection for main mode PSK authentication 2012-03-20 17:31:17 +01:00
Martin Willi ea9e047bc5 Use virtual IP to substitute dynamic traffic selectors in quick mode 2012-03-20 17:31:17 +01:00
Martin Willi 156b8662a6 Queue Mode Config tasks when required 2012-03-20 17:31:16 +01:00
Martin Willi b155084c42 Added IKEv1 Mode Config task based on IKEv2 ike_config 2012-03-20 17:31:16 +01:00
Martin Willi 21c916886d Added missing XAuth auth_class enum name 2012-03-20 17:31:16 +01:00
Martin Willi a22b9e4f33 Reject quick modes if IKE_SA not yet established 2012-03-20 17:31:16 +01:00
Martin Willi 67a753b95c Use a common function to set IKE_SA to established 2012-03-20 17:31:16 +01:00
Martin Willi f223a28ae7 Be less verbose if plugin dependecy not satisfied 2012-03-20 17:31:16 +01:00
Martin Willi 9626164e9a Don't complain when receiving XAuth or Unity configuration attributes 2012-03-20 17:31:16 +01:00
Martin Willi c9e5998d7f Interpret attribute format correctly in IKEv1 configuration format 2012-03-20 17:31:16 +01:00
Martin Willi 9f43868a01 Implemented responder part of XAUTH task 2012-03-20 17:31:16 +01:00
Martin Willi d192cc9dc8 Implemented initiator part of xauth task 2012-03-20 17:31:16 +01:00
Martin Willi 081b6dd3ed Ask for a username/password in xauth-null as XAUTH initiator 2012-03-20 17:31:16 +01:00
Martin Willi 59ee898326 Get first XAuth backend if none configured 2012-03-20 17:31:16 +01:00
Martin Willi cbda13f6fe Accept a xauth backend name appended to left/rightauth 2012-03-20 17:31:15 +01:00
Martin Willi 6ebcbc654c Added auth_cfg option to select XAUTH backend to use 2012-03-20 17:31:15 +01:00
Martin Willi 89afbe58bb Remove unused task swap_initiator method 2012-03-20 17:31:15 +01:00
Martin Willi 1fe6cdfac2 Use a string to identify xauth backends, no need for integer types 2012-03-20 17:31:15 +01:00
Martin Willi 4e73f85b81 Remove xauth_authenticator, we handle it in the task 2012-03-20 17:31:15 +01:00
Martin Willi 96c9159d96 Use a second authentication config to configure XAUTH authentication 2012-03-20 17:31:15 +01:00
Martin Willi 69adeb5bf2 Replace xauth_request task with a new stub where we reimplement it 2012-03-20 17:31:15 +01:00
Martin Willi c6d0098c1b Added missing auth_method_t enum names 2012-03-20 17:31:15 +01:00
Martin Willi a0eea1a7ac Defined hybrid IKEv1 authentication methods 2012-03-20 17:31:15 +01:00
Martin Willi 1755ac0617 Cleaned up quick mode notify processing 2012-03-20 17:31:14 +01:00
Martin Willi 5adf855e3d Add support for KE payloads in IKEv1 quick mode (PFS) 2012-03-20 17:31:14 +01:00
Martin Willi 9bb4de1d83 En- and decode DH group attribute in quick mode SA payloads 2012-03-20 17:31:14 +01:00
Martin Willi fb8bc6a764 Use authenticators in IKEv1 main mode 2012-03-20 17:31:14 +01:00
Martin Willi 76fe7de3fd Added a factory function for IKEv1 authenticators 2012-03-20 17:31:14 +01:00
Martin Willi 7c27c914d4 Implemented IKEv1 pubkey SIG payload processing in an authenticator 2012-03-20 17:31:14 +01:00
Martin Willi 2792587875 Implemented IKEv1 PSK HASH payload processing in separated authenticator 2012-03-20 17:31:14 +01:00
Martin Willi c64a4b4f8e Implemented post-authentication certificate handling for IKEv1 2012-03-20 17:31:13 +01:00
Martin Willi 9ad5b8fa95 Cleanup CERT payload constructors 2012-03-20 17:31:13 +01:00
Martin Willi 0bcdb8e571 Implemented pre-authentication certificate handling for IKEv1 2012-03-20 17:31:13 +01:00
Martin Willi 8c33850615 Added task types for IKEv1 certificate handling 2012-03-20 17:31:13 +01:00
Martin Willi df06ef2098 Cleaned up certreq payload for IKEv2/IKEv1 use 2012-03-20 17:31:13 +01:00
Martin Willi 6ccabe2561 Reverted ike_cert tasks to IKEv2 only, we use dedicated IKEv1 tasks 2012-03-20 17:31:13 +01:00
Martin Willi aaa8f88906 Fix support for plain RSA authentication in IKEv1, both as initiator and responder 2012-03-20 17:31:13 +01:00
Martin Willi a974700fc0 Fix referencing of multiple CERTREQ payload with IKEv1, other cleanups 2012-03-20 17:31:12 +01:00
Martin Willi 695aff41f5 Encode a single IP traffic selector as ID_IPV?_ADDRESS identity 2012-03-20 17:31:12 +01:00
Martin Willi caa6f772c8 Added missing break;s when converting ID_IP_ADDRESS types to ts, extracted function 2012-03-20 17:31:12 +01:00
Martin Willi bd8700f055 Don't use unportable htobe64 macro directly 2012-03-20 17:31:12 +01:00
Martin Willi f4e25e602b Implement htoun/untoh64 with potentially faster htobe64/be64toh macros, if available 2012-03-20 17:31:12 +01:00
Martin Willi a2f8fc9711 Use a dedicated IKEv1 vendor ID task to fix using IKEv2 payloads in IKEv1 2012-03-20 17:31:07 +01:00
Martin Willi abf9784786 Pass concrete auth_method to key derivation, as we have that as a responder 2012-03-20 17:30:53 +01:00
Martin Willi b4e815354c Map auth_class to auth method and IKEv1 proposal attribute 2012-03-20 17:30:53 +01:00
Martin Willi eeca2af81c Removed obsolete transform attribute setters 2012-03-20 17:30:53 +01:00
Martin Willi 914ec2dbf2 Implemented IKEv1 attribute encoding in SA payload 2012-03-20 17:30:53 +01:00
Martin Willi fbebc2a068 Implemented encoding of additional IKEv1 proposal attributes 2012-03-20 17:30:53 +01:00
Martin Willi cd0017d452 Exchange IKEv1 ESP SA proposal information 2012-03-20 17:30:53 +01:00
Martin Willi 132d5c56de Exchange IKEv1 SA specific proposal data with SA payload 2012-03-20 17:30:52 +01:00
Martin Willi e174e0d445 Added not-yet used sa_payload parameters used in IKEv1 2012-03-20 17:30:52 +01:00
Martin Willi d08269c700 Added a get_rekey/reauth_time() jitter parameter to get time without randomization 2012-03-20 17:30:52 +01:00
Martin Willi 9cc38c8efb Use quick mode task initiator flag instead of passing it as parameter 2012-03-20 17:30:51 +01:00
Martin Willi 4e0bc9af22 Add quick mode ID payloads only if establishing a non-host2host tunnel 2012-03-20 17:30:51 +01:00
Martin Willi c4b8539f93 Refactored traffic selector handling in quick mode 2012-03-20 17:30:51 +01:00
Martin Willi 818330aafe Refactored NONCE payload handling in quick mode 2012-03-20 17:30:51 +01:00
Martin Willi c4c5950458 Create host-to-host traffic selectors if quick mode identities missing 2012-03-20 17:30:51 +01:00
Martin Willi d020d4d695 Print message payload names after prepending IKEv1 HASH payload 2012-03-20 17:30:50 +01:00
Martin Willi da063ec95e Fixed task_manager_v1 compiler warnings 2012-03-20 17:30:50 +01:00
Martin Willi 3e246c4883 Generate a new mid only after we start a new task (and exchange) 2012-03-20 17:30:50 +01:00
Martin Willi a7910b1c6e Derive IKEv1 CHILD_SA keymat twice, once for each IPsec SA 2012-03-20 17:30:50 +01:00
Martin Willi 85f5c478bf Fix seed construction for IKEv1 key derivation 2012-03-20 17:30:50 +01:00
Martin Willi 9cc8bd4fd2 Use a dedicated message hash to detect IKEv1 retransmissions 2012-03-20 17:30:50 +01:00
Martin Willi 7a7f486df6 Include hardcoded tunnel mode attribute in porposal, remove ESN attribute 2012-03-20 17:30:50 +01:00
Martin Willi b6016fcab3 Fixed a config reference leak in IKEv2 initiate 2012-03-20 17:30:49 +01:00
Martin Willi 384c1a32a2 XAUTH is initiated based on configuration, no need to call externally 2012-03-20 17:30:49 +01:00
Martin Willi 017d98bf39 Merged IKEv1 attribute payload/data into configuration payload/attribute 2012-03-20 17:30:49 +01:00
Martin Willi d50152a70b Parse proposal substructure with multiple IKEv1 transforms to multiple proposals 2012-03-20 17:30:49 +01:00
Martin Willi 62a27ba347 Encode multiple IKEv1 proposals in a single transform substructure 2012-03-20 17:30:48 +01:00
Martin Willi f9450fc9f7 Remove public sa_payload.add_proposal() method 2012-03-20 17:30:48 +01:00
Martin Willi cd89f1a074 Only add the first algorithm of a kind to IKEv1 transforms 2012-03-20 17:30:48 +01:00
Martin Willi 5351d63c79 Install negotiated IKEv1 CHILD_SA negotiated in quick mode 2012-03-20 17:30:48 +01:00
Martin Willi ff2a2ad33a Implemented IKEv1 keymat CHILD_SA key derivation function 2012-03-20 17:30:48 +01:00
Martin Willi 6cd72730bf Moved keymat key length lookup functions to keymat.c 2012-03-20 17:30:48 +01:00
Martin Willi d4f6686c69 Extended PRF+ by a non-counting variant as used by IKEv1 2012-03-20 17:30:48 +01:00
Martin Willi f5c0096086 Hardcode some SA lifetimes until we can configure them dynamically 2012-03-20 17:30:48 +01:00
Martin Willi a0b52db079 Refactored main mode NONCE/KE payload processing 2012-03-20 17:30:47 +01:00
Martin Willi a0f851cfe0 Refactored main mode HASH payload processing 2012-03-20 17:30:47 +01:00
Martin Willi 73380c8685 Skip any payloads in front of SA to extract initiators SA bytes 2012-03-20 17:30:47 +01:00
Martin Willi 21b7db99c6 Implemented quick mode protocol handling, no CHILD_SA or HASH payloads yet 2012-03-20 17:30:47 +01:00
Martin Willi cc9629d87c Partially implemented IKEv1 ESP proposal en-/decoding 2012-03-20 17:30:47 +01:00
Martin Willi 12b6a68a5f Add missing keymat cast to avoid compiler warning 2012-03-20 17:30:47 +01:00
Martin Willi 17ec1c74de Don't compare initiator flag in IKE_SA manager, pass initiator parameter to IKE_SA constructor 2012-03-20 17:30:47 +01:00
Martin Willi 1b99befac3 Create and verify PSK HASH payloads in IKEv1 main mode 2012-03-20 17:30:47 +01:00
Martin Willi 4eee34ac49 Added keymat_v1_t.get_hash() to calculate authentication hashes 2012-03-20 17:30:46 +01:00
Martin Willi e1f9d6476e Register HASH_V1 in payload factory 2012-03-20 17:30:46 +01:00
Martin Willi 059d694a6b Derive IKE keys as IKEv1 initiator, too 2012-03-20 17:30:46 +01:00
Martin Willi 7fcd26f4fc Fix payload length of id_payload created from a traffic selector 2012-03-20 17:30:46 +01:00
Martin Willi a09972df2b Added a generic TASK_ prefix to all task types 2012-03-20 17:30:45 +01:00
Martin Willi 744c080153 Initiate and respond to quick mode task (stub) 2012-03-20 17:30:45 +01:00
Martin Willi 3bd5fcc832 Print message ID as unsigned integer 2012-03-20 17:30:45 +01:00
Martin Willi 9e40e3e9fa Added message encoding rules for quick mode 2012-03-20 17:30:45 +01:00
Martin Willi 9124e3425b Fixed reference counting bugs in main mode 2012-03-20 17:30:44 +01:00
Martin Willi 73aaf76be3 Implemented basic message id handling for IKEv1 2012-03-20 17:30:44 +01:00
Martin Willi 2b04aa46ea Added a quick mode task stub 2012-03-20 17:30:44 +01:00
Martin Willi cbb6d765bc Fixed length calculation of delete payload 2012-03-20 17:30:44 +01:00
Martin Willi 4ea258538e Update header length after each parsed rule, as it might change when parsing SPI size 2012-03-20 17:30:44 +01:00