denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
2,846 Commits 1 Branch 0 Tags
a01ad993411a729544447b5f9f83f60133c84b09
Commit Graph
50 Commits
Author SHA1 Message Date
Andreas Steffen bc997f6583 display selected IKE proposal in ipsec statusall 2008-06-22 11:24:33 +00:00
Tobias Brunner 6439267a8c support for hash and URL encoded certificate payloads in charon 2008-04-18 11:24:45 +00:00
Martin Willi 6a365f0740 added API for random number generators, served through credential factory 
ported randomizer_t to a rng_t on top of /dev/(u)random (plugin random)
 2008-04-15 05:56:35 +00:00
Martin Willi 96926b006d using dpd actions to enforce connection state 
dpd actions a per child-, not peer ike-sa
 2008-04-11 08:14:48 +00:00
Tobias Brunner 4a6474c2c3 enabling acquire for mediated connections 2008-04-10 12:51:04 +00:00
Tobias Brunner 4a03518112 fixing a problem if the mediation server initiates the rekeying 2008-04-10 07:24:30 +00:00
Tobias Brunner 22452f70fc mediation connections should now properly rekey 2008-04-09 18:12:22 +00:00
Tobias Brunner 9c2a905d63 stopping connectivity checks on the responders side after receiving an IKE_SA_INIT request with the proper ME_CONNECTID 2008-04-01 11:38:18 +00:00
Tobias Brunner dc04b7c743 mediation extension adapted to the naming convention of the current version of the draft. note: the external interface (config, autotools) has not yet been changed 2008-03-26 18:40:19 +00:00
Martin Willi 552cc11b1f merged the modularization branch (credentials) back to trunk 2008-03-13 14:14:44 +00:00
Martin Willi ee61471113 implemented RFC4478 (repeated authentication) 
changed %V printf handler to take a time delta, %#V now takes two arguments
 2007-11-20 12:06:40 +00:00
Tobias Brunner d5cc175833 experimental P2P-NAT-T for IKEv2 merged back from branch 2007-10-03 15:10:41 +00:00
Martin Willi 9dae1bed00 implemented IKEv2 force_encap connection parameter 
enforces UDP encapsulation by faking NAT detection payloads
  to hurdle restrictive firewalls
 2007-10-01 12:19:39 +00:00
Martin Willi 3bc62fe70e improved MOBIKE: 
prefer address family already used
  do not change address implicit when mobike supported
  handle multiple simultaneous roaming requests more properly
  proper enabling/disabling of UDP encapsulation
 2007-07-03 12:32:38 +00:00
Martin Willi 2b3100b5d0 simple roaming of the client works (not MOBIKE conform yet!) 2007-06-26 13:04:13 +00:00
Martin Willi 17d92e9732 further MOBIKE stuff: 
kernel properly reports network reconfiguration and informs all IKE_SAs
  MOBIKE in IKE_AUTH: MOBIKE_SUPPORTED notify and address exchange
  reestablishment of IKE_SAs on network reconfiguration kinda works
  not stable yet!
 2007-06-21 15:25:28 +00:00
Martin Willi 3b04350ab2 added extensions management to IKE_SA 
fixed NATD payload (port) when using route lookup
 2007-06-18 10:32:01 +00:00
Martin Willi 26424f03c3 proper reauthentication: 
IKE_SA is closed completely before the new is initiated, 
  resolves some issues when a dynamic IP is requested from a pool
 2007-06-14 08:13:05 +00:00
Andreas Steffen 7d26a0ee03 added set_other_ca() and get_other_ca() 2007-05-17 17:55:02 +00:00
Martin Willi ce27ac8012 routing/unrouting through interface 2007-05-16 08:32:15 +00:00
Martin Willi 0706c39cda added support for EAP methods not establishing an MSK 2007-04-19 12:37:48 +00:00
Martin Willi a3ce4bc214 removed IKE_SA (%K) and CHILD_SA (%P) printf handlers, 3 more to go 2007-04-11 12:14:51 +00:00
Martin Willi 3b138b8422 cleaned up apidoc 
added some comments
removed configuration.[ch], as it does not make sense like it is
 2007-04-11 07:20:39 +00:00
Martin Willi e0fe765152 restructured file layout 
new configuration structure:
  peer_cfg: configuration related to a peer (authenitcation, ...=
  ike_cfg: config to use for IKE setup (proposals)
  child_Cfg: config for CHILD_SA (proposals, traffic selectors)
  a peer_cfg has one ike_cfg and multiple child_cfg's
stroke now uses fixed count of threads
 2007-04-10 06:01:03 +00:00
Martin Willi e23a59f635 fixed deferred CHILD_SA rekeying while IKE_SA rekeying in progress 2007-03-27 13:32:12 +00:00
Martin Willi c60c7694d2 merged tasking branch into trunk 2007-02-28 14:04:36 +00:00
Martin Willi 6fe03b0af0 implemented reauthentication using the new reauth=yes|no parameter 2006-12-19 07:30:07 +00:00
Martin Willi db7ef62494 better split up of library files "types.h" & "definitions.h" 
centralized all printf specifier character definitions
reuse of arginfo handlers
more cleanups
fixed more AMD64 issues
added DEBUG_LEVEL compile flag to exclude DBGn() statements
 2006-10-31 12:27:59 +00:00
Martin Willi 382b481795 moved typedefs to beginning of files to solve some include problems 
splitted authenticator to have a separate implementation for each auth_method_t
using va_copy to clone va_lists, should fix proplems on AMD64
some other cleanups
 2006-10-30 14:07:05 +00:00
Martin Willi 60356f3375 introduced new logging subsystem using bus: 
passive listeners can register on the bus
  active listeners wait for signals actively
  multiplexing allows multiple listeners to receive debug signals
  a lot more...
 2006-10-18 11:46:13 +00:00
Martin Willi 1ce2ad09c3 fixed retransmission policy for responder 2006-09-25 07:24:08 +00:00
Martin Willi 397f344879 fixed dpd for responder 2006-09-25 06:38:58 +00:00
Martin Willi 3183006de2 implement proper handling of most simultaneous IKE_SA rekeying cases 2006-08-23 07:30:43 +00:00
Martin Willi fe04e93a8b implemented IKE_SA rekeying 
uses ikelifetime, rekeymargin and rekeyfuzz config settings
	no handling of simultaneus exchanges yet!
 2006-07-27 12:18:40 +00:00
Martin Willi 45f76a7ddd added possibility to route CHILD_SAs, without to set them up 
support for auto=route parameter
	support for ipsec route and ipsec unroute
	initiating of CHILD and/or IKE_SAs based on kernel acquires
 2006-07-21 13:31:53 +00:00
Martin Willi 8dfbe71b34 introduced refcounting on policy and connections 
aren't stored in the IKE_SA anymore, they are queried on the fly
	are immutable now, allows it to share them
policy selection based on traffic selectors, leads to valid lookup results
	rekeying queries the policy based on its traffic selectors
 2006-07-20 10:09:32 +00:00
Martin Willi bcb95ced3d added CHILD_SA states, which allows us to detect further simultaneous transactions 
reimplemented the buggy message id handling
 2006-07-13 08:26:54 +00:00
Martin Willi cb5c41cde9 updated some inline docs 2006-07-12 14:08:52 +00:00
Martin Willi c71d53ba4e updated copyright information 2006-07-07 08:49:06 +00:00
Martin Willi 698d774918 reimplemented CHILD_SA rekeying & delete 
no simultanous transaction with CHILD_SAs yet!
 2006-07-07 07:04:07 +00:00
Martin Willi 3dd3c5f39e redesigned IKE_SA using a transaction mechanism: 
removed old state machine
  reimplemented IKE_SA setup and delete
  implemented dead peer detection
  implemented keep-alives
  a lot of fixes
  no rekeying yet
 2006-07-05 10:53:20 +00:00
Andreas Steffen 971218c3ae support of cert payloads 2006-07-03 06:27:45 +00:00
Martin Willi 2f89902d07 applied new changes from NATT team 
DPD only done when no IPsec and IKE traffic processed
	minor changes here and there
 2006-06-23 14:02:30 +00:00
Martin Willi 1396815afb first merge of NATT code 2006-06-22 06:36:28 +00:00
Martin Willi 695723d4e8 old child_sa gets deleted after rekeying 
rekeying almost complete, but:
	IKE_SA get in an invalid state when both initiate rekeying at the same time,
 2006-06-09 15:12:43 +00:00
Martin Willi 8d77eddec2 further work for rekeying: 
get liftimes from policy
  added new state
  initiation of rekeying done
proposal redone:
  removed support for AH+ESP proposals
 2006-06-07 13:26:23 +00:00
Martin Willi 32b6500fbf job management: 
moved job code from thread_pool to job, jobs have an "execute" method now
  added two new jobs: delete_child_sa & rekey_child_sa
kernel interface:
  listens now for ACQUIRE & EXPIRE
  supports hard and soft lifetimes
  fires jobs for delete and rekey child sa
ike sa manager:
  can checkout IKE SAs by requid of owned CHILD SAs
we have now the infrastructure to do the rekeying... :-)
 2006-05-31 14:23:15 +00:00
Martin Willi 4a5bba25e2 - reimplemented proper IKE SA deletion using a seperate state, 
should conform now to IKEv2
 2006-05-23 08:01:49 +00:00
Martin Willi 7881ac141e - applied patch from the NAT-T team fixing several typos 2006-05-19 06:46:22 +00:00
Martin Willi b8577029d1 2006-05-10 08:02:49 +00:00