denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
9,413 Commits 1 Branch 0 Tags
764035d515e4532dfd9e95f96c67ef4bb0c4c4be
Commit Graph
1843 Commits
Author SHA1 Message Date
Martin Willi 764035d515 Block XAuth transaction on established IKE_SAs, but allow Mode Config 2012-08-03 13:07:57 +02:00
Martin Willi f02a305569 Fix linking of addrblock plugin when building monolithic 
Fixes #212.
 2012-08-03 10:50:21 +02:00
Martin Willi 394b9f6b65 Reject initial exchange messages early once IKE_SA is established 2012-08-02 13:04:54 +02:00
Martin Willi f701ba8389 Lookup IKEv1 PSK even if the peer identity is not known 2012-07-31 15:39:33 +02:00
Tobias Brunner 63ac6d00b0 Proper fallback if capability dropping is not available 2012-07-27 14:46:42 +02:00
Tobias Brunner d511a71daa Include stdint.h for UINTxx_MAX defines 
Fixes #205.
 2012-07-27 13:47:59 +02:00
Martin Willi 777bcdc0d5 Don't include acquiring packet traffic selectors in IKEv1 
As we only can negotiate a single TS in IKEv1, don't prepend the
triggering packet TS, as we do in IKEv2. Otherwise we don't establish
the TS of the configuration, but only that of the triggering packet.

Fixes #207.
 2012-07-26 15:45:49 +02:00
Martin Willi 8b560a4565 Implement late peer config switching after XAuth authentication 
If additional authentication constraints, such as group membership,
is not fulfilled by an XAuth backend, we search for another
peer configuration that fulfills all constraints, including those
from phase1.
 2012-07-26 15:17:36 +02:00
Martin Willi 40ca05cff8 Check if XAuth round complies to configured authentication round 2012-07-26 12:40:27 +02:00
Martin Willi 874f7c7e2c Don't add ANY identity constraint to auth config, as XAuth rounds don't use one 2012-07-26 12:38:34 +02:00
Martin Willi 9191946a63 Merge auth config items added from XAuth backends to IKE_SA 2012-07-26 12:07:48 +02:00
Martin Willi 46df61dff7 Add an ipsec.conf leftgroups2 parameter for the second authentication round 2012-07-26 11:51:58 +02:00
Martin Willi 81419807f5 Release leaking child config after uninstalling shunt policy 2012-07-23 17:15:40 +02:00
Martin Willi 73514b3217 Don't print hexdumps on loglevel 1 if hash verification fails 2012-07-20 17:36:27 +02:00
Martin Willi 09e3717525 Fix EAP-MSCHAPv2 master key derivation, broken with 87dd205b 2012-07-18 16:46:05 +02:00
Martin Willi 6719889e0a Use centralized hasher names in coupling plugin 2012-07-17 17:32:03 +02:00
Andreas Steffen 931da8202b handled return values in tnc-pdp 2012-07-16 22:54:38 +02:00
Martin Willi ff9e46772f Handle PRF failures in eap-aka-3gpp2 2012-07-16 14:55:08 +02:00
Martin Willi a564e4ca77 Refactored error handling in keymat_v1_t 2012-07-16 14:55:07 +02:00
Martin Willi 4decfae6c2 Clean up error handling in keymat_v2_t 2012-07-16 14:55:07 +02:00
Martin Willi 511f0b18b9 Cleaned up memory management and return values for encryption payload 2012-07-16 14:55:07 +02:00
Martin Willi 87dd205b61 Add a return value to hasher_t.allocate_hash() 2012-07-16 14:55:06 +02:00
Martin Willi e185612dd8 Add a return value to keymat_v1_t.{get,update,confirm}_iv 2012-07-16 14:55:06 +02:00
Martin Willi 8bd6a30af1 Add a return value to hasher_t.get_hash() 2012-07-16 14:55:06 +02:00
Martin Willi ce73fc19db Add a return value to crypter_t.set_key() 2012-07-16 14:53:38 +02:00
Martin Willi 3b96189a2a Add a return value to crypter_t.decrypt() 2012-07-16 14:53:38 +02:00
Martin Willi e35abbe588 Add a return value to crypter_t.encrypt 2012-07-16 14:53:37 +02:00
Tobias Brunner e59f983160 Check rng return value when generating identity in eap-simaka-reauth plugin 2012-07-16 14:53:36 +02:00
Tobias Brunner e37f9ac2c9 Check rng return value when generating pseudonym in eap-simaka-pseudonym plugin 2012-07-16 14:53:36 +02:00
Tobias Brunner 8beeb8e116 Check rng return value when generating nonces in eap-aka plugin 2012-07-16 14:53:36 +02:00
Tobias Brunner 18ce1bb721 Check rng return value when generating nonces in eap-sim plugin 2012-07-16 14:53:36 +02:00
Tobias Brunner 10b6ca5fb2 Check rng return value when generating RAND in eap-aka-3gpp2 plugin 2012-07-16 14:53:36 +02:00
Tobias Brunner 162f489a27 Check rng return value when generating challenges in eap-md5 and mschapv2 plugins 2012-07-16 14:53:36 +02:00
Tobias Brunner 7ae2671036 Check rng return value when generating Transaction IDs in DHCP plugin 2012-07-16 14:53:36 +02:00
Tobias Brunner f1c78cfee7 Check rng return value when generating ME CONNECT_ID and KEY 2012-07-16 14:53:35 +02:00
Tobias Brunner 1bb9c51e87 Check rng return value when generating IKEv1 message IDs 2012-07-16 14:53:35 +02:00
Tobias Brunner 504918348d Check rng return value when generating COOKIE2 during MOBIKE 2012-07-16 14:53:35 +02:00
Tobias Brunner 0c096e9bb5 Check rng return value when generating COOKIE secret in receiver 2012-07-16 14:53:35 +02:00
Tobias Brunner 92f207477c Check rng return value when generating fake NAT detection payloads 2012-07-16 14:53:35 +02:00
Tobias Brunner ca9b68eb9e Check rng return value when encrypting encryption payload 2012-07-16 14:53:35 +02:00
Tobias Brunner 5d91d8c469 Check rng return value when generating SPIs in ike_sa_manager_t 2012-07-16 14:53:35 +02:00
Reto Buerki 605985d122 Nonce: Let get_nonce, allocate_nonce return boolean 2012-07-16 14:53:34 +02:00
Martin Willi f3ca96b2bf Add a return value to prf_t.set_key() 2012-07-16 14:53:34 +02:00
Martin Willi ecc080b393 Add a return value to prf_t.allocate_bytes() 2012-07-16 14:53:34 +02:00
Martin Willi a7e6539135 Use a bool return value in keymat_v1_t.get_hash_phase2() 2012-07-16 14:53:34 +02:00
Martin Willi e4c5c1d03e Add a return value to keymat_v1_t.get_hash() 2012-07-16 14:53:34 +02:00
Martin Willi bb1e0c59e1 Add a return value to keymat_v2_t.get_auth_octets() 2012-07-16 14:53:34 +02:00
Martin Willi 2baae8e3ea Add a return value to keymat_v2_t.get_psk_sig() 2012-07-16 14:53:34 +02:00
Martin Willi bc47488323 Add a return value to prf_t.get_bytes() 2012-07-16 14:53:33 +02:00
Martin Willi edd54734c8 prf_plus_create() can return NULL on failure 2012-07-16 14:53:33 +02:00