denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
11,144 Commits 1 Branch 0 Tags
924196d6d46d45f7fe7bc66161cf63a6c645fb01
Commit Graph
819 Commits
Author SHA1 Message Date
Martin Willi 965348cd7a Raise LOCAL_AUTH_FAILED alert after receiving AUTHENTICATION_FAILURE 2013-05-15 17:18:03 +02:00
Martin Willi 5c12700f9a kernel-interface: query SAD for last use time if SPD query didn't yield one 2013-05-06 17:01:13 +02:00
Martin Willi bdaf9f97e6 child-sa: query SAD/SPD just for what we actually need to update statistics 2013-05-06 17:01:13 +02:00
Martin Willi 60ed88b2c7 child-sa: pass traffic selector to add_sa() regardless of IPsec mode 
This lets the kernel backend decide what to do with it, and in fact all kernel
interfaces already handle this correctly.
 2013-05-06 16:10:11 +02:00
Martin Willi e93f386dbb Raise an ALERT_PROPOSAL_MISMATCH_CHILD also when receiving NO_PROPOSAL_CHOSEN 2013-05-06 14:56:50 +02:00
Martin Willi 00080d2b8b Raise an ALERT_PROPOSAL_MISMATCH_IKE also when receiving NO_PROPOSAL_CHOSEN 2013-05-06 14:56:50 +02:00
Martin Willi a3854d8371 Don't unset IKE_SA on bus before we released virtual IPs and attributes 2013-05-06 14:56:01 +02:00
Andreas Steffen 12fa1784d0 emit a single assig_vips bus message for all VIPs 2013-04-06 14:16:30 +02:00
Andreas Steffen ba2880d569 ifmap plugin subscribes to assing_vip bus signal 2013-04-06 11:09:41 +02:00
Martin Willi bee8b5e385 Refactor check_for_rekeyed_child() in quick_mode task 2013-04-03 17:08:00 +02:00
Martin Willi ac48d9e458 Reuse reqid of an existing Quick Mode, even if it has been rekeyed 
If two peers rekey Quick Modes at the same time, the original Quick Mode is
in REKEYING state and hence the requid is not reused. This is required though,
as two identical policies won't work if they have different requids.
 2013-04-03 15:56:26 +02:00
Martin Willi bee6515a28 Defer CHILD_SA rekeying if allocating an SPI fails 2013-04-03 12:25:27 +02:00
Tobias Brunner cf95d2926c Fixed some typos, courtesy of codespell 2013-03-25 10:59:37 +01:00
Tobias Brunner 8a0a1ae857 Delete IKE_SAs if responder does not initiate XAuth exchange within a certain time frame 2013-03-19 12:00:00 +01:00
Tobias Brunner 3c34e15ee4 Make sure that xauth-noauth is not used accidentally 
It has to be selected explicitly with rightauth2=xauth-noauth.
 2013-03-19 11:23:03 +01:00
Tobias Brunner e4013bb904 Added xauth-noauth plugin 
This XAuth backend does not do any authentication of client credentials
but simply sends a successful XAuth status to the client, thereby
concluding the XAuth exchange.  This can be useful to fallback to basic
RSA authentication with clients that can not be configured without XAuth
authentication.
 2013-03-19 11:23:03 +01:00
Martin Willi 49960f021d Make check whether to use IKEv1 fragmentation more readable 2013-03-14 14:20:55 +01:00
Martin Willi c45cf9048e Raise an alert if an IKE_SA could not have been reauthenticated and expires 2013-03-14 14:20:54 +01:00
Martin Willi d954a2081b child_sa_t.get_usestats() can additionally return the number of processed packets 2013-03-14 14:20:54 +01:00
Martin Willi 7eeeb1c702 kernel_ipsec_t.query_sa() additionally returns the number of processed packets 2013-03-14 14:20:54 +01:00
Martin Willi 3a23794fa2 Add missing XAuthRespPSK switch case to IKEv1 key derivation 2013-03-12 10:09:23 +01:00
Martin Willi 8f727d8007 Clean up IKE_SA state if IKE_SA_INIT request does not have message ID 0 2013-03-11 11:30:47 +01:00
Martin Willi 0235914d2f Ignore fourth Qick Mode message sent by Windows servers. 
Initial patch by Paul Stewart, fixes #289.
 2013-03-11 10:53:55 +01:00
Martin Willi 9d9042d6d9 As Quick Mode initiator, select a subset of the proposed and the returned TS 
Cisco 5505 firewalls don't return the port if we send a specific one, letting
the is_contained_in() checks fail. Using get_subset() selection builds the
Quick Mode correctly with the common subset of selectors.

Based on an initial patch from Paul Stewart.
 2013-03-07 10:00:06 +01:00
Martin Willi 4dd8d5430d Merge branch 'multi-eap' 
Fixes the use of EAP methods in the non-first authentication round if the
initiator demands mutual EAP. Also mutual EAP can now be enforced when the
initiator sets rightauth=eap, not only with rightauth=any.
 2013-03-01 11:36:41 +01:00
Martin Willi b611d8ba48 Merge branch 'ikev1-rekeying' 
Migrates Quick Modes to the new Main Mode if an IKEv1 reauthentication replaces
the old Main Mode having a uniqueids=replace policy.
 2013-03-01 11:32:02 +01:00
Martin Willi a36b49f3cb Merge branch 'opaque-ports' 
Adds a %opaque port option and support for port ranges in left/rightprotoport.
Currently not supported by any of our kernel backends.
 2013-03-01 11:27:12 +01:00
Martin Willi 21dd4c4bea Without MOBIKE, update remote host only if it is behind NAT 2013-03-01 11:26:47 +01:00
Martin Willi 00683b6864 Merge branch 'ikev1-mm-retransmits' 
Fixes retransmit of the last Main Mode or IKE_AUTH message, and correctly
queues Main Mode messages when processing of the last message is still in
progress.
 2013-03-01 11:24:42 +01:00
Martin Willi d634109f1d Merge branch 'tfc-notify' 
Introduces kernel backend features, sends ESP_TFC_PADDING_NOT_SUPPORTED if
kernel does not support it.
 2013-03-01 11:16:58 +01:00
Martin Willi 5c55be4915 Send ESP_TFC_PADDING_NOT_SUPPORTED if the used kernel doesn't support it 2013-03-01 11:12:17 +01:00
Tobias Brunner 6e935c6fe0 Trigger an updown event when destroying an IKE_SA based on INITIAL_CONTACT 
In other cases (i.e. when functions return DESTROY_ME) the event should
already be triggered, but not in this forced situation.
 2013-02-28 18:07:29 +01:00
Martin Willi d8a94c18c6 Apply a mutual EAP auth_cfg not before the EAP method completes 2013-02-26 13:15:27 +01:00
Martin Willi cc787697b8 Be a little more verbose why a peer_cfg is inacceptable 2013-02-26 13:15:27 +01:00
Martin Willi 289b9b7b31 Refactor auth_cfg applying to a common function 2013-02-26 13:15:27 +01:00
Martin Willi e2857be823 For IKEv1 Main Mode, use message hash to detect early retransmissions 
As the message ID is zero in all Main Mode messages, it can't be used to detect
if we are already processing a given message.
 2013-02-25 12:12:38 +01:00
Martin Willi cdf75a39e3 Move initial message dropping to task manager 
When the last request message of the initial tunnel setup is retransmitted,
we must retransmit the response instead of ignoring the request.

Fixes #295.
 2013-02-25 12:12:19 +01:00
Martin Willi 9eaed7a5bb Use INIT macro to initialize IKE_SA manager entries 2013-02-25 12:10:02 +01:00
Martin Willi a1db77de7c Use a complete port range in traffic_selector_create_from_{subnet,cidr} 2013-02-21 11:52:33 +01:00
Martin Willi f836d433a9 When detecting a duplicate IKEv1 SA, adopt children, as it might be a rekeying 2013-02-20 08:57:17 +01:00
Martin Willi 4755ab505d Add a global return_success() method implementation 2013-02-14 17:17:45 +01:00
Martin Willi e212033ef2 Merge branch 'ike-dscp' 2013-02-14 17:11:35 +01:00
Andreas Steffen 2a421163bf make TNC client authentication type available to IMVs 2013-02-12 20:38:05 +01:00
Martin Willi 5b15bd5f9d Set configured DSCP value while generating IKE packets 2013-02-06 15:20:32 +01:00
Tobias Brunner 2ec3552fce Fix check-in of IKE_SA when IKE_SA_INIT fails and hash table is enabled 
Setting the responder SPI to 0 can only be done while generating the
response, otherwise we'd fail to check in the IKE_SA again in case the
hash table is enabled.  That's because we use the responder SPI as hash
value since 5.0.0.
 2013-01-24 19:13:40 +01:00
Tobias Brunner 4eb09d14e2 Avoid a deadlock when installing a trap policy failed 2013-01-23 15:51:47 +01:00
Adrian-Ken Rueegsegger cf3c72c480 Fix IKE SA inherit API doc 2013-01-22 11:02:20 +01:00
Tobias Brunner 66bb4f63b2 Properly send IKEv1 packets if no ike_cfg is known yet 
This applies for error notifies.
 2013-01-14 12:14:16 +01:00
Tobias Brunner 21235e1ec2 Merge branch 'ikev1-fragmentation' 
This adds support for the proprietary IKEv1 fragmentation extension.

Conflicts:
	NEWS
 2013-01-12 11:58:26 +01:00
Tobias Brunner ee6902ef7f Added an option to configure the maximum size of a fragment 2013-01-12 11:54:58 +01:00