denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
8,770 Commits 1 Branch 0 Tags
6e921f20170c49a8b6e3330064df2a4f314e4958
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Tobias Brunner 6e921f2017 Use single DBG2 statements in kernel_netlink plugin (i.e. ignore mark.value). 2012-03-27 10:37:56 +02:00
Tobias Brunner d112a7e1fe Properly handle retransmitted initial IKE messages. 
This change allows to properly handle retransmits of initial IKE
messages when we've already processed them (i.e. our response is now resent
immediately).
 2012-03-20 17:31:41 +01:00
Tobias Brunner de9357bb44 Implemented table of init hashes without linked_list_t. 2012-03-20 17:31:41 +01:00
Tobias Brunner 6f0cca20d8 Implemented table of connected peers without linked_list_t. 2012-03-20 17:31:41 +01:00
Tobias Brunner 3489370458 Implemented table of half open IKE_SAs without linked_list_t. 2012-03-20 17:31:41 +01:00
Tobias Brunner e49bb4e3e3 Don't use linked_list_t for buckets in main IKE_SA hash table. 2012-03-20 17:31:41 +01:00
Tobias Brunner 894c52cba2 Fixed deadlock if checkin_and_destroy is called during shutdown. 2012-03-20 17:31:40 +01:00
Tobias Brunner 4b2f428f40 Do not clone hashes of initial IKE messages when storing them in the hash table. 2012-03-20 17:31:40 +01:00
Tobias Brunner 20e3d5ea00 Store IKEv2 IKE_SAs by local SPI in the IKE_SA manager hash table. 
For IKEv1 the previous behavior of always using the initiator's SPI as
key is maintained.
 2012-03-20 17:31:40 +01:00
Tobias Brunner 71cf97871f Added separate hashtable for hashes of initial IKE messages. 
This does not require us to do a lookup for an SA by SPI first.
 2012-03-20 17:31:40 +01:00
Tobias Brunner 68611395dc chunk_equals_ptr added to compare chunks given as pointers. 2012-03-20 17:31:40 +01:00
Tobias Brunner 1726795fa9 Store the major IKE version on ike_sa_id_t. 2012-03-20 17:31:40 +01:00
Tobias Brunner 8254e7ecb8 Implemented handling of UNITY_LOAD_BALANCE as reauthentication. 2012-03-20 17:31:40 +01:00
Tobias Brunner eff331f799 Parse IKEv1 Cisco Load Balancing notify (can't act on it yet). 2012-03-20 17:31:40 +01:00
Tobias Brunner 3a9d5cbc14 Fixed transform numbering in IKEv1 proposal. 2012-03-20 17:31:40 +01:00
Tobias Brunner dcbdc914fa Compiler warning fixed. 2012-03-20 17:31:40 +01:00
Tobias Brunner bd8d1f1d9c Accept unencrypted Aggressive Mode messages. 
Racoon does not encrypt the third message during Aggressive Mode.
 2012-03-20 17:31:34 +01:00
Tobias Brunner db1dc81329 IKEv1 ATTRIBUTES_NOT_SUPPORTED error notify added. 2012-03-20 17:31:30 +01:00
Tobias Brunner fd5d6bb08e Use IPSEC DOI also for ISAKMP SA deletes. 2012-03-20 17:31:29 +01:00
Tobias Brunner 4bc4e8e17b Added support for iKEIntermediate flag to ipsec pki. 2012-03-20 17:31:25 +01:00
Tobias Brunner f29a4f1c64 Added support for iKEIntermediate X.509 extended key usage flag. 
Mac OS X requires server certificates to have this flag set.
 2012-03-20 17:31:24 +01:00
Tobias Brunner 00cc2188d4 Some whitespace fixes. 2012-03-20 17:31:24 +01:00
Tobias Brunner b46b56fac1 Log parsed unsigned ints with proper format strings. 2012-03-20 17:31:24 +01:00
Tobias Brunner a6c328a6e9 Use real ID payload to build HASH_I|R for Main Mode authentication. 
This is required for clients like the iPhone which set the protocol
and/or port fields of the ID payload.
 2012-03-20 17:31:21 +01:00
Tobias Brunner 19965ffe56 Create authenticators right when they are used during Main Mode. 2012-03-20 17:31:21 +01:00
Tobias Brunner 33493a5253 Added method to get encoded version if ID_V1 payload. 2012-03-20 17:31:21 +01:00
Tobias Brunner 6a6e000134 Log selected peer config during Main Mode. 2012-03-20 17:31:20 +01:00
Tobias Brunner 0a43f4b6c4 Log configured IKE version in stroke plugin. 2012-03-20 17:31:20 +01:00
Tobias Brunner e6503db2cf Fixed SIGSEGV when logging peer config matches. 2012-03-20 17:31:20 +01:00
Tobias Brunner 5383b50d88 Fixed missing shared_key initialization in main_mode task. 2012-03-20 17:31:19 +01:00
Tobias Brunner 0793ac497a Fixed memory leak when handling IKEv1 error notifications. 2012-03-20 17:31:18 +01:00
Tobias Brunner 4dbd81c669 Destroy IKE_SA after failed XAuth authentication. 2012-03-20 17:31:17 +01:00
Tobias Brunner 3d44d735c6 Added generic XAuth backend, using secrets provided by credential sets. 2012-03-20 17:31:17 +01:00
Tobias Brunner 41e1e435d9 Removed xauth-null dummy plugin. 2012-03-20 17:31:17 +01:00
Tobias Brunner 9f80110bc6 Install SAs with UDP encapsulation during Quick Mode. 2012-03-20 17:31:13 +01:00
Tobias Brunner 8cb6f4f979 Don't stop processing tasks if one returns SUCCESS. 
Only send a response if at least one of the tasks requires it.
 2012-03-20 17:31:11 +01:00
Tobias Brunner 3bf0be6b08 Add NAT-OA payloads during Quick Mode if transport mode is used. 
We don't parse them currently, as the Linux kernel does not need them to fix
the IP header checksum.
 2012-03-20 17:31:11 +01:00
Tobias Brunner 29b0cb328a Negotiate UDP encapsulation during Quick Mode if NAT is detected. 2012-03-20 17:31:10 +01:00
Tobias Brunner 1cc4ec46cf Task added for IKEv1 NAT detection. 
There is already support for both Main and Aggressive Mode.
 2012-03-20 17:31:10 +01:00
Tobias Brunner 61e2a1ad8a Create negotiated hasher earlier during Main Mode so it is available for building NAT-D payloads. 2012-03-20 17:31:10 +01:00
Tobias Brunner 4ace4daf0c Added a function to keymat_v1 to create the hasher earlier than during key derivation. 
The negotiated hasher is also used to generate NAT-D payloads.
 2012-03-20 17:31:10 +01:00
Tobias Brunner a0bea44a97 Message rules for IKEv1 NAT-T payloads added. 2012-03-20 17:31:10 +01:00
Tobias Brunner 06d29be714 Handle IKEv1 NAT-T vendor ID payload (only RFC 3947 for now). 2012-03-20 17:31:10 +01:00
Tobias Brunner 1e97783c99 Added payloads for IKEv1 NAT-Traversal negotiation. 2012-03-20 17:31:09 +01:00
Tobias Brunner 9eefb5f9b4 Use quiet generator when creating IKEv1 message hashes. 
This avoids cluttering the log with duplicate log messages when
generating and especially confusing log messages when parsing
authenticated messages.
 2012-03-20 17:31:09 +01:00
Tobias Brunner 24ddf03f52 Added an option to create a generator that does not log debug messages. 2012-03-20 17:31:09 +01:00
Tobias Brunner 4cfd0db854 Respond with NO_PROPOSAL_CHOSEN, if we don't find an ike_cfg. 2012-03-20 17:31:09 +01:00
Tobias Brunner 6be8d33daa Don't respond to malformed INFORMATIONAL_V1 messages with another INFORMATIONAL_V1 exchange. 2012-03-20 17:31:08 +01:00
Tobias Brunner 37639e94fb Handle invalid IKEv1 hashes more specifically. 2012-03-20 17:31:08 +01:00
Tobias Brunner 29a5e0707e Handle unsupported IKEv1 exchange types more specifically. 2012-03-20 17:31:08 +01:00
Tobias Brunner b235e69cde Send an INFORMATIONAL message on IKEv1 parse errors. 2012-03-20 17:31:08 +01:00
Tobias Brunner 983e852af8 Handle INFORMATIONAL_V1 messages when no keys have been derived yet. 
This allows to gracefully process the INFORMATIONAL_V1 message rules which
require the payloads to be encrypted and thus the exchange to be
authenticated with a HASH payload.  If such an exchange is now initiated
before the ISAKMP_SA is established, the message is simply sent unencrypted
and without HASH payload.
 2012-03-20 17:31:08 +01:00
Tobias Brunner e6732003f4 Error reporting for invalid IKEv2 responses fixed. 2012-03-20 17:31:08 +01:00
Tobias Brunner 7519106d07 Set request flag to proper value for IKEv1 messages before parsing them. 2012-03-20 17:31:08 +01:00
Tobias Brunner 1960312cfd Avoid parsing retransmits we already responded to. 
Decryption will fail as we already moved the IV when we sent the
response. Without this change, encrypted retransmits would have been
discarded during parsing already.
 2012-03-20 17:31:08 +01:00
Tobias Brunner 68c6863bbb Moved main part of message processing to task managers. 
This will allow individual error handling for each IKE version and should
allow better handling of IKEv1 retransmits.
 2012-03-20 17:31:08 +01:00
Tobias Brunner 44ff1153e8 Addded ike_sa_t.set_statistic to set timestamps from task manager. 2012-03-20 17:31:08 +01:00
Tobias Brunner 38d189eee9 Compiler warning fixed in prf_plus_t. 2012-03-20 17:31:07 +01:00
Tobias Brunner fd24c700fb Use proper enum types in proposal_substructure. 2012-03-20 17:31:07 +01:00
Tobias Brunner 78f7728c30 No need to build a HASH payload in XAUTH task. 
It gets added automatically when the message is generated.
 2012-03-20 17:30:51 +01:00
Tobias Brunner 97265a8927 Removed redundant '=>' when logging binary data in parser and generator. 2012-03-20 17:30:51 +01:00
Tobias Brunner f4e21faa98 Fixed encryption of IKEv2 messages. 2012-03-20 17:30:50 +01:00
Tobias Brunner cd200cb821 Authenticate and verify Phase 2 IKEv1 messages with appropriate hashes. 2012-03-20 17:30:50 +01:00
Tobias Brunner 1e5dd62bb2 Fixed verification of DELETE_V1 payloads. 2012-03-20 17:30:50 +01:00
Tobias Brunner f3cc8589b1 Fixed header length calculation of DELETE payload. 2012-03-20 17:30:50 +01:00
Tobias Brunner d6cec44b24 Fixed conftests after extending CERT payload. 2012-03-20 17:30:50 +01:00
Tobias Brunner 4c6dfbb26b Added missing comma after ME_CONNECT declaration. 2012-03-20 17:30:48 +01:00
Tobias Brunner 8c5e78ae4f Fixed creation of endpoint notifies. 2012-03-20 17:30:48 +01:00
Tobias Brunner 21da1087a5 Fixed diagram of IKEv1 encrypted "payload". 2012-03-20 17:30:47 +01:00
Tobias Brunner 42a69b05ab String for ENCRYPTED_DATA fixed. 2012-03-20 17:30:46 +01:00
Tobias Brunner 780ce7724d Strings for ENCRYPTED_V1 payload added. 2012-03-20 17:30:46 +01:00
Tobias Brunner d66199884f Set flags on message according to IKE version when parsing header. 2012-03-20 17:30:46 +01:00
Tobias Brunner c92f2cf36d Encrypt IKEv1 messages. 2012-03-20 17:30:46 +01:00
Tobias Brunner 477e856a15 Decrypt IKEv1 messages. 2012-03-20 17:30:46 +01:00
Tobias Brunner b6f0029497 Added IV generation to keymat_v1_t. 2012-03-20 17:30:46 +01:00
Tobias Brunner 6f5f8ee4b5 Use modified encryption payload to encrypt/decrypt complete IKEv1 messages. 2012-03-20 17:30:46 +01:00
Tobias Brunner 0463674971 Use key derivation in IKEv1 main mode (PSK authentication). 2012-03-20 17:30:46 +01:00
Tobias Brunner aadb9e8355 Added a simple AEAD wrapper for IKEv1 encryption/decryption. 2012-03-20 17:30:46 +01:00
Tobias Brunner b05d91edd7 Added IKEv1 key derivation with support for AUTH_CLASS_PSK. 2012-03-20 17:30:45 +01:00
Tobias Brunner 3d59c5c382 Update cached hosts on ike_sa_t when processing IKEv1 messages. 2012-03-20 17:30:45 +01:00
Tobias Brunner 0cec72df40 Provide keymat_t to message_t to encrypt/decrypt data. 2012-03-20 17:30:45 +01:00
Tobias Brunner 50d493808c Avoid compiler warnings due to extended enums. 2012-03-20 17:30:45 +01:00
Tobias Brunner a0563846b0 Moved version specific keymat functions to specific interfaces. 2012-03-20 17:30:45 +01:00
Tobias Brunner 043ed1b346 Memory leak fixed. 2012-03-20 17:30:43 +01:00
Tobias Brunner 273f2f8054 Added factory function to create task_manager_t implementations. 2012-03-20 17:30:43 +01:00
Tobias Brunner 4b64a1a17d Added factory function to create keymat_t implementations. 2012-03-20 17:30:43 +01:00
Tobias Brunner 0b611540ef Store IKE version of an SA on ike_sa_t. 2012-03-20 17:30:43 +01:00
Tobias Brunner 0fc9acdd23 Added stub for IKEv1 keymat_t implementation. 2012-03-20 17:30:42 +01:00
Tobias Brunner 6ab936f046 Use keymat_t as common interface, renamed current implementation to _v2. 2012-03-20 17:30:42 +01:00
Tobias Brunner f7a8fcedc0 Use enum to define IKE version on peer_cfg_t. 
Replaced all those magic numbers.
 2012-03-20 17:30:41 +01:00
Tobias Brunner 3238faf8e6 Fix init message arrival check. 2012-03-20 17:30:41 +01:00
Tobias Brunner 354ac9579f Compile error fixed. 2012-03-20 17:30:41 +01:00
Tobias Brunner 7f56cf1a65 Message parsing slightly refactored, allows parsing of unencrypted IKEv1 messages. 2012-03-20 17:30:40 +01:00
Tobias Brunner 4ed52db2bb Allow creation of message_t objects for IKEv1 packets. 2012-03-20 17:30:40 +01:00
Tobias Brunner 8a2d079d78 Certificate request payloads can be sent in pretty much any IKEv1 message. 2012-03-20 17:30:40 +01:00
Tobias Brunner 8f3aea2f77 Message rules for IKEv1 INFORMATIONAL exchange added. 
Since INFORMATIONAL "exchanges" are actually unidirectionally sent
message we don't have any responder rules.
 2012-03-20 17:30:40 +01:00
Tobias Brunner 130c9a54c2 Message rules for IKEv1 AGGRESSIVE exchange added. 
These are basically the same as for ID_PROT but no payloads are expected
to be encrypted (at least if using PSK or signatures for authentication).
 2012-03-20 17:30:40 +01:00
Tobias Brunner 6ba70ba8dd Message rules for IKEv1 ID_PROT exchange added. 
These rules are quite broad and cover main mode with at least PSK and
signature based authentication.
 2012-03-20 17:30:40 +01:00
Tobias Brunner fdb8421f36 Typo fixed. 2012-03-20 17:30:40 +01:00
Tobias Brunner ccdd3a4cee Added configure option for the IKEv1 implementation in charon. 2012-03-20 17:30:39 +01:00