denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
15,270 Commits 1 Branch 0 Tags
60d0f52fd6da3cb9ac379487344c4936e5f73882
Commit Graph
1211 Commits
Author SHA1 Message Date
Martin Willi 40ca05cff8 Check if XAuth round complies to configured authentication round 2012-07-26 12:40:27 +02:00
Martin Willi 9191946a63 Merge auth config items added from XAuth backends to IKE_SA 2012-07-26 12:07:48 +02:00
Martin Willi 81419807f5 Release leaking child config after uninstalling shunt policy 2012-07-23 17:15:40 +02:00
Martin Willi a564e4ca77 Refactored error handling in keymat_v1_t 2012-07-16 14:55:07 +02:00
Martin Willi 4decfae6c2 Clean up error handling in keymat_v2_t 2012-07-16 14:55:07 +02:00
Martin Willi 511f0b18b9 Cleaned up memory management and return values for encryption payload 2012-07-16 14:55:07 +02:00
Martin Willi 87dd205b61 Add a return value to hasher_t.allocate_hash() 2012-07-16 14:55:06 +02:00
Martin Willi e185612dd8 Add a return value to keymat_v1_t.{get,update,confirm}_iv 2012-07-16 14:55:06 +02:00
Martin Willi ce73fc19db Add a return value to crypter_t.set_key() 2012-07-16 14:53:38 +02:00
Martin Willi 3b96189a2a Add a return value to crypter_t.decrypt() 2012-07-16 14:53:38 +02:00
Martin Willi e35abbe588 Add a return value to crypter_t.encrypt 2012-07-16 14:53:37 +02:00
Tobias Brunner f1c78cfee7 Check rng return value when generating ME CONNECT_ID and KEY 2012-07-16 14:53:35 +02:00
Tobias Brunner 1bb9c51e87 Check rng return value when generating IKEv1 message IDs 2012-07-16 14:53:35 +02:00
Tobias Brunner 504918348d Check rng return value when generating COOKIE2 during MOBIKE 2012-07-16 14:53:35 +02:00
Tobias Brunner 92f207477c Check rng return value when generating fake NAT detection payloads 2012-07-16 14:53:35 +02:00
Tobias Brunner 5d91d8c469 Check rng return value when generating SPIs in ike_sa_manager_t 2012-07-16 14:53:35 +02:00
Reto Buerki 605985d122 Nonce: Let get_nonce, allocate_nonce return boolean 2012-07-16 14:53:34 +02:00
Martin Willi f3ca96b2bf Add a return value to prf_t.set_key() 2012-07-16 14:53:34 +02:00
Martin Willi ecc080b393 Add a return value to prf_t.allocate_bytes() 2012-07-16 14:53:34 +02:00
Martin Willi a7e6539135 Use a bool return value in keymat_v1_t.get_hash_phase2() 2012-07-16 14:53:34 +02:00
Martin Willi e4c5c1d03e Add a return value to keymat_v1_t.get_hash() 2012-07-16 14:53:34 +02:00
Martin Willi bb1e0c59e1 Add a return value to keymat_v2_t.get_auth_octets() 2012-07-16 14:53:34 +02:00
Martin Willi 2baae8e3ea Add a return value to keymat_v2_t.get_psk_sig() 2012-07-16 14:53:34 +02:00
Martin Willi bc47488323 Add a return value to prf_t.get_bytes() 2012-07-16 14:53:33 +02:00
Martin Willi edd54734c8 prf_plus_create() can return NULL on failure 2012-07-16 14:53:33 +02:00
Martin Willi 5d79e6c6b4 Add a return value to prf_plus_t.allocate_bytes() 2012-07-16 14:53:33 +02:00
Martin Willi 2d56575d52 Add a return value to signer_t.set_key() 2012-07-16 14:53:33 +02:00
Martin Willi ad08730a4b Add a return value to aead_t.set_key() 2012-07-16 14:53:32 +02:00
Martin Willi e2ed7bfd22 Add a return value to aead_t.encrypt() 2012-07-16 14:53:32 +02:00
Tobias Brunner 893c3a4ead Simplify NAT-D payload creation if UDP encapsulation is forced 
We don't need any address lookups in that case as the content of the
payload is generated randomly anyway.
 2012-07-13 11:13:43 +02:00
Martin Willi 07836f559d Send cert request based on peers configured authentication class 2012-07-10 17:15:59 +02:00
Martin Willi 3128e7fa7c Don't send CERTREQs when initiating aggressive mode PSK 2012-07-09 12:05:23 +02:00
Martin Willi 9d2968e272 As a responder, don't start a TRANSACTION request if we expect one from the initiator 2012-06-29 13:40:31 +02:00
Martin Willi 271377905d Defer quick mode initiation if we expect a mode config request 2012-06-27 11:42:56 +02:00
Martin Willi 8ff45cfd99 Queue a mode config task as responder if we need a virtual IP 2012-06-27 11:42:56 +02:00
Martin Willi c2a391746c Add basic support for XAuth responder authentication 2012-06-27 11:42:56 +02:00
Martin Willi 5def45b890 Ignore a received %any virtual IP for installation 2012-06-26 18:00:40 +02:00
Tobias Brunner 26d77eb3e6 Centralized thread cancellation in processor_t 
This ensures that no threads are active when plugins and the rest of the
daemon are unloaded.

callback_job_t was simplified a lot in the process as its main
functionality is now contained in processor_t.  The parent-child
relationships were abandoned as these were only needed to simplify job
cancellation.
 2012-06-25 17:38:59 +02:00
Andreas Steffen 554a697a84 support Cisco Unity VID 2012-06-25 11:09:06 +02:00
Martin Willi 0ba1ddaa24 Enforce uniqueids=keep based on XAuth identity 2012-06-25 10:18:35 +02:00
Martin Willi f145ea29e0 Don't send XAUTH_OK if a hook prevents SA to establish 2012-06-25 10:18:35 +02:00
Martin Willi 0c32b9c62f Enforce uniqueids=keep only for non-XAuth Main/Agressive Modes 2012-06-25 10:18:35 +02:00
Martin Willi 0fbfcf2a3a Use XAuth/EAP remote identity for uniqueness check 2012-06-25 10:18:34 +02:00
Martin Willi de5e8fb4e0 Add missing XAuth name variable when complaining about missing XAuth backend 2012-06-25 10:09:27 +02:00
Tobias Brunner e91157a4b6 Fix SIGSEGV if kernel install fails during Quick Mode as responder. 2012-06-22 11:34:38 +02:00
Martin Willi af518b450e Adopt children as XAuth initiator (which is IKE responder) 2012-06-14 14:49:19 +02:00
Martin Willi b31a56f128 Require a scary option to respond to Aggressive Mode PSK requests 
While Aggressive Mode PSK is widely used, it is known to be subject
to dictionary attacks by passive attackers. We don't complain as
initiator to be compatible with existing (insecure) setups, but
require a scary strongswan.conf option if someone wants to use it
as responder.
 2012-06-14 10:25:48 +02:00
Andreas Steffen 1d315bddd3 implemented the right|leftallowany feature 2012-06-08 21:24:41 +02:00
Martin Willi e5f0f9ff96 Enforce uniqueness policy in IKEv1 main and aggressive modes 2012-06-08 16:15:22 +02:00
Martin Willi 82ad53b776 Try to rekey without KE exchange if peer returns INVALID_KE_PAYLOAD(NONE) 
According to RFC5996, implementations should just ignore the KE payload
if they select a non-PFS proposals. Some implementations don't, but
return MODP_NONE in INVALID_KE_PAYLOAD, hence we accept that, too.
 2012-06-08 10:35:02 +02:00