Reto Buerki
605985d122
Nonce: Let get_nonce, allocate_nonce return boolean
2012-07-16 14:53:34 +02:00
Martin Willi
07836f559d
Send cert request based on peers configured authentication class
2012-07-10 17:15:59 +02:00
Martin Willi
3128e7fa7c
Don't send CERTREQs when initiating aggressive mode PSK
2012-07-09 12:05:23 +02:00
Martin Willi
9d2968e272
As a responder, don't start a TRANSACTION request if we expect one from the initiator
2012-06-29 13:40:31 +02:00
Martin Willi
8ff45cfd99
Queue a mode config task as responder if we need a virtual IP
2012-06-27 11:42:56 +02:00
Martin Willi
c2a391746c
Add basic support for XAuth responder authentication
2012-06-27 11:42:56 +02:00
Andreas Steffen
554a697a84
support Cisco Unity VID
2012-06-25 11:09:06 +02:00
Martin Willi
0ba1ddaa24
Enforce uniqueids=keep based on XAuth identity
2012-06-25 10:18:35 +02:00
Martin Willi
f145ea29e0
Don't send XAUTH_OK if a hook prevents SA to establish
2012-06-25 10:18:35 +02:00
Martin Willi
0c32b9c62f
Enforce uniqueids=keep only for non-XAuth Main/Agressive Modes
2012-06-25 10:18:35 +02:00
Martin Willi
de5e8fb4e0
Add missing XAuth name variable when complaining about missing XAuth backend
2012-06-25 10:09:27 +02:00
Tobias Brunner
e91157a4b6
Fix SIGSEGV if kernel install fails during Quick Mode as responder.
2012-06-22 11:34:38 +02:00
Martin Willi
af518b450e
Adopt children as XAuth initiator (which is IKE responder)
2012-06-14 14:49:19 +02:00
Martin Willi
b31a56f128
Require a scary option to respond to Aggressive Mode PSK requests
...
While Aggressive Mode PSK is widely used, it is known to be subject
to dictionary attacks by passive attackers. We don't complain as
initiator to be compatible with existing (insecure) setups, but
require a scary strongswan.conf option if someone wants to use it
as responder.
2012-06-14 10:25:48 +02:00
Martin Willi
e5f0f9ff96
Enforce uniqueness policy in IKEv1 main and aggressive modes
2012-06-08 16:15:22 +02:00
Martin Willi
d61f2906d4
Use traffic selectors passed to quick mode constructor as initiator
2012-06-08 10:22:03 +02:00
Tobias Brunner
3451ecd7ac
Added log message if peer does not accept/provide IPComp proposal.
2012-05-24 15:32:28 +02:00
Tobias Brunner
47b448b807
Added support to negotiate IPComp during Quick Mode.
2012-05-24 15:32:28 +02:00
Tobias Brunner
647cd741e8
Added support for IKEv1 IPComp proposals in SA payload.
2012-05-24 15:32:28 +02:00
Tobias Brunner
00e11bcefd
Fix memleak during Quick Mode in case no SPI can be allocated from kernel.
2012-05-24 15:32:27 +02:00
Martin Willi
3c475660c5
Apply IDir before deriving keys as aggressive initiator
2012-05-23 12:27:47 +02:00
Tobias Brunner
1a624ff45a
Switch to alternative peer config in IKEv1 Main and Aggressive Mode.
2012-05-21 15:49:25 +02:00
Martin Willi
4ce92ef350
Cancel active quick mode task when receiving INFORMATIONAL error
2012-05-21 14:57:33 +02:00
Martin Willi
7ce504e182
Flush task queues explicitly, not implicitly if task returns ALREADY_DONE
2012-05-21 14:17:09 +02:00
Tobias Brunner
7a56c35fc9
Remove executable flag from source files.
2012-05-18 10:04:08 +02:00
Tobias Brunner
22bf44c8b9
Use separate Doxygen groups for IKEv1 and IKEv2 entities (authenticators, tasks etc.).
2012-05-18 10:04:08 +02:00
Adrian-Ken Rueegsegger
afaf1bdf5e
Use nonce_gen instead of rng to generate nonces
...
Replace usage of rng plugin with nonce generator to create nonces in
IKE_INIT, CHILD_CREATE and QUICK_MODE tasks and the IKEv1 phase 1 helper.
2012-05-18 08:15:41 +02:00
Martin Willi
24742c0f83
Moved IKEv1 DPD processing to task manager, fix sequence issues
2012-05-15 17:00:12 +02:00
Andreas Steffen
44bd9b48c8
allow private algorithms
2012-05-05 23:25:51 +02:00
Andreas Steffen
f7cd1cde70
vendor ID cosmetics
2012-05-05 18:13:05 +02:00
Tobias Brunner
42500c274a
Use name from initialization to access settings in libcharon.
...
Also fixes several whitespace errors.
2012-05-03 13:57:04 +02:00
Martin Willi
89a5881c63
Added another bunch of commonly used IKEv1 NATT vendor IDs
2012-04-04 10:32:15 +02:00
Martin Willi
83d77866f4
Store authentication info of a XAUTH round on IKE_SA
2012-03-22 09:06:31 +01:00
Martin Willi
4f3cf61dfd
Reply with received configuration payload identifier in Mode Config
2012-03-20 18:06:29 +01:00
Tobias Brunner
8254e7ecb8
Implemented handling of UNITY_LOAD_BALANCE as reauthentication.
2012-03-20 17:31:40 +01:00
Tobias Brunner
eff331f799
Parse IKEv1 Cisco Load Balancing notify (can't act on it yet).
2012-03-20 17:31:40 +01:00
Martin Willi
7fd7ffc649
Use UDP encapsulation even in non-NAT situation if initiator requests it
2012-03-20 17:31:39 +01:00
Martin Willi
c60246a618
Support inactivity timeout in IKEv1 CHILD_SAs
2012-03-20 17:31:39 +01:00
Martin Willi
5be386ff8e
Exchange certificates when using IKEv1 ECDSA authentication
2012-03-20 17:31:39 +01:00
Martin Willi
3624b09e21
Set selected proposal on IKEv1 SA, don't pass it separately to Phase 1 helper
2012-03-20 17:31:37 +01:00
Martin Willi
696fa8e003
Invoke bus_t.narrow hook in quick mode exchange
2012-03-20 17:31:36 +01:00
Martin Willi
f420f51f55
Invoke authorization hooks for IKEv1 connections
2012-03-20 17:31:36 +01:00
Martin Willi
b6ac063c36
Don't invoke a child_updown hook when a quick mode to delete has been rekeyed
2012-03-20 17:31:36 +01:00
Martin Willi
669d8bded2
Invoke child_rekey hook instead of child_updown when rekeying a quick mode
2012-03-20 17:31:36 +01:00
Martin Willi
11aadd7722
Disable DPD checking for peers not supporting it
2012-03-20 17:31:35 +01:00
Martin Willi
ff6b084ac4
Confirm message reception time only if DPD sequence number valid
2012-03-20 17:31:35 +01:00
Martin Willi
2ddd45c9a7
Simplified DPD handling by using a task for a single message only
2012-03-20 17:31:35 +01:00
Clavister OpenSource
c9a160953e
Send DPD vendor ID
2012-03-20 17:31:35 +01:00
Clavister OpenSource
3e6b740336
Isakmp_dpd task added.
2012-03-20 17:31:35 +01:00
Martin Willi
37c12bd31e
Streamlined debug output when initiating IKEv1 IKE_SAs
2012-03-20 17:31:34 +01:00
Reto Buerki