denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
8,074 Commits 1 Branch 0 Tags
a6c328a6e9b865f51fb6a7129646552142157317
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Martin Willi 0b0191e143 Ignore additional TRANSACTION request if we already queued one 2012-03-20 17:31:21 +01:00
Martin Willi fce566a876 Keep a history of received response hashes to detect late retransmissions 
If we receive an old response and we already sent out the next request,
we must be able to identify that it is not the response to the new
request.
 2012-03-20 17:31:20 +01:00
Martin Willi 3643179535 Narrow down received and configured traffic selector to a common subset 2012-03-20 17:31:20 +01:00
Martin Willi 7b34de45c3 Don't send a retransmit for a request we never have sent a response 2012-03-20 17:31:20 +01:00
Martin Willi f5ef357791 Print unsigned IKEv1 message IDs 2012-03-20 17:31:20 +01:00
Martin Willi 9f10b95a3b Added a bunch of well known IKEv1 vendor IDs to database 2012-03-20 17:31:20 +01:00
Martin Willi 156cd8827f Use a generic IKEv1 vendor ID database to send and receive vendor IDs 2012-03-20 17:31:20 +01:00
Martin Willi 360c3394cf Fixed compiler warning (set but unused variable) 2012-03-20 17:31:20 +01:00
Martin Willi f91b6ac77a Queue a TRANSACTION message for later processing if Main Mode not yet completed 2012-03-20 17:31:20 +01:00
Martin Willi e33510f8a3 Fixed leak of shared keys in xauth-generic plugin 2012-03-20 17:31:20 +01:00
Martin Willi 45956d15ea Free list after removing the last local credential set, fixes a leak report 2012-03-20 17:31:19 +01:00
Martin Willi 226b0f36c7 Fixed SPI size calculation in DELETE payload 2012-03-20 17:31:19 +01:00
Martin Willi 41fbde4544 Reset task manager state when build() completes an exchange (quick mode) 2012-03-20 17:31:19 +01:00
Martin Willi 92aa6e0255 Include COOKIES in IKEv1 delete payloads 2012-03-20 17:31:19 +01:00
Martin Willi 0acb520758 Support IKEv1 SPIs in IKEv1 delete payload 2012-03-20 17:31:19 +01:00
Martin Willi c9fc577a8a Use version specific DELETE payload identifier in ike_delete task 2012-03-20 17:31:19 +01:00
Martin Willi 8ef2bae4db Activate DELETE tasks when queued 2012-03-20 17:31:19 +01:00
Martin Willi 5dec456b69 Fix IKEv1 DELETE subtask creation and processing 2012-03-20 17:31:19 +01:00
Martin Willi 10e18713f1 Handle DELETE as responder as INFORMATIONAL subtask 2012-03-20 17:31:19 +01:00
Martin Willi 46505067c7 Close SA immediately after sending an INFORMATIONAL error 2012-03-20 17:31:18 +01:00
Martin Willi 97933967a0 Moved responder informational handling to task 2012-03-20 17:31:18 +01:00
Martin Willi 1477ab157c Remove unused status type 2012-03-20 17:31:18 +01:00
Martin Willi 1cc3e92ccc Check if IKEv1 exchange type matches before handling it as response 2012-03-20 17:31:18 +01:00
Martin Willi e7ae90c194 Use informational task in quick mode to send notifies 2012-03-20 17:31:18 +01:00
Martin Willi b47052694f Cleaned up notification sending in IKEv1 task manager 2012-03-20 17:31:18 +01:00
Martin Willi accf46129a Use informational taks to send notify errors 2012-03-20 17:31:18 +01:00
Martin Willi f492907667 Added a task stub to create and process IKEv1 informational exchanges 2012-03-20 17:31:18 +01:00
Martin Willi 590ca1d482 Allow IKEv1 tasks to return ALREADY_DONE to flush all active or passive tasks 2012-03-20 17:31:18 +01:00
Martin Willi 0f61964ed7 Support flushing of single tasks queues in IKEv1 task manager 2012-03-20 17:31:18 +01:00
Martin Willi 9862852823 Double check if we have a packet before retransmitting it 2012-03-20 17:31:18 +01:00
Martin Willi cc6b03bb5a If no IKEv1 shared key found for hosts, try to find one based on config identities 2012-03-20 17:31:17 +01:00
Martin Willi 033dfba01f Log peer cfg enumeration externally for flexibility 2012-03-20 17:31:17 +01:00
Martin Willi d7376e2ab4 Accept NULL identities passed to peer config enumeration 2012-03-20 17:31:17 +01:00
Martin Willi 0e2cc3fed9 Fixed authentication method selection for main mode PSK authentication 2012-03-20 17:31:17 +01:00
Martin Willi ea9e047bc5 Use virtual IP to substitute dynamic traffic selectors in quick mode 2012-03-20 17:31:17 +01:00
Martin Willi 156b8662a6 Queue Mode Config tasks when required 2012-03-20 17:31:16 +01:00
Martin Willi b155084c42 Added IKEv1 Mode Config task based on IKEv2 ike_config 2012-03-20 17:31:16 +01:00
Martin Willi 21c916886d Added missing XAuth auth_class enum name 2012-03-20 17:31:16 +01:00
Martin Willi a22b9e4f33 Reject quick modes if IKE_SA not yet established 2012-03-20 17:31:16 +01:00
Martin Willi 67a753b95c Use a common function to set IKE_SA to established 2012-03-20 17:31:16 +01:00
Martin Willi f223a28ae7 Be less verbose if plugin dependecy not satisfied 2012-03-20 17:31:16 +01:00
Martin Willi 9626164e9a Don't complain when receiving XAuth or Unity configuration attributes 2012-03-20 17:31:16 +01:00
Martin Willi c9e5998d7f Interpret attribute format correctly in IKEv1 configuration format 2012-03-20 17:31:16 +01:00
Martin Willi 9f43868a01 Implemented responder part of XAUTH task 2012-03-20 17:31:16 +01:00
Martin Willi d192cc9dc8 Implemented initiator part of xauth task 2012-03-20 17:31:16 +01:00
Martin Willi 081b6dd3ed Ask for a username/password in xauth-null as XAUTH initiator 2012-03-20 17:31:16 +01:00
Martin Willi 59ee898326 Get first XAuth backend if none configured 2012-03-20 17:31:16 +01:00
Martin Willi cbda13f6fe Accept a xauth backend name appended to left/rightauth 2012-03-20 17:31:15 +01:00
Martin Willi 6ebcbc654c Added auth_cfg option to select XAUTH backend to use 2012-03-20 17:31:15 +01:00
Martin Willi 89afbe58bb Remove unused task swap_initiator method 2012-03-20 17:31:15 +01:00
Martin Willi 1fe6cdfac2 Use a string to identify xauth backends, no need for integer types 2012-03-20 17:31:15 +01:00
Martin Willi 4e73f85b81 Remove xauth_authenticator, we handle it in the task 2012-03-20 17:31:15 +01:00
Martin Willi 96c9159d96 Use a second authentication config to configure XAUTH authentication 2012-03-20 17:31:15 +01:00
Martin Willi 69adeb5bf2 Replace xauth_request task with a new stub where we reimplement it 2012-03-20 17:31:15 +01:00
Martin Willi c6d0098c1b Added missing auth_method_t enum names 2012-03-20 17:31:15 +01:00
Martin Willi a0eea1a7ac Defined hybrid IKEv1 authentication methods 2012-03-20 17:31:15 +01:00
Martin Willi 1755ac0617 Cleaned up quick mode notify processing 2012-03-20 17:31:14 +01:00
Martin Willi 5adf855e3d Add support for KE payloads in IKEv1 quick mode (PFS) 2012-03-20 17:31:14 +01:00
Martin Willi 9bb4de1d83 En- and decode DH group attribute in quick mode SA payloads 2012-03-20 17:31:14 +01:00
Martin Willi fb8bc6a764 Use authenticators in IKEv1 main mode 2012-03-20 17:31:14 +01:00
Martin Willi 76fe7de3fd Added a factory function for IKEv1 authenticators 2012-03-20 17:31:14 +01:00
Martin Willi 7c27c914d4 Implemented IKEv1 pubkey SIG payload processing in an authenticator 2012-03-20 17:31:14 +01:00
Martin Willi 2792587875 Implemented IKEv1 PSK HASH payload processing in separated authenticator 2012-03-20 17:31:14 +01:00
Martin Willi c64a4b4f8e Implemented post-authentication certificate handling for IKEv1 2012-03-20 17:31:13 +01:00
Martin Willi 9ad5b8fa95 Cleanup CERT payload constructors 2012-03-20 17:31:13 +01:00
Martin Willi 0bcdb8e571 Implemented pre-authentication certificate handling for IKEv1 2012-03-20 17:31:13 +01:00
Martin Willi 8c33850615 Added task types for IKEv1 certificate handling 2012-03-20 17:31:13 +01:00
Martin Willi df06ef2098 Cleaned up certreq payload for IKEv2/IKEv1 use 2012-03-20 17:31:13 +01:00
Martin Willi 6ccabe2561 Reverted ike_cert tasks to IKEv2 only, we use dedicated IKEv1 tasks 2012-03-20 17:31:13 +01:00
Martin Willi aaa8f88906 Fix support for plain RSA authentication in IKEv1, both as initiator and responder 2012-03-20 17:31:13 +01:00
Martin Willi a974700fc0 Fix referencing of multiple CERTREQ payload with IKEv1, other cleanups 2012-03-20 17:31:12 +01:00
Martin Willi 695aff41f5 Encode a single IP traffic selector as ID_IPV?_ADDRESS identity 2012-03-20 17:31:12 +01:00
Martin Willi caa6f772c8 Added missing break;s when converting ID_IP_ADDRESS types to ts, extracted function 2012-03-20 17:31:12 +01:00
Martin Willi bd8700f055 Don't use unportable htobe64 macro directly 2012-03-20 17:31:12 +01:00
Martin Willi f4e25e602b Implement htoun/untoh64 with potentially faster htobe64/be64toh macros, if available 2012-03-20 17:31:12 +01:00
Martin Willi a2f8fc9711 Use a dedicated IKEv1 vendor ID task to fix using IKEv2 payloads in IKEv1 2012-03-20 17:31:07 +01:00
Martin Willi abf9784786 Pass concrete auth_method to key derivation, as we have that as a responder 2012-03-20 17:30:53 +01:00
Martin Willi b4e815354c Map auth_class to auth method and IKEv1 proposal attribute 2012-03-20 17:30:53 +01:00
Martin Willi eeca2af81c Removed obsolete transform attribute setters 2012-03-20 17:30:53 +01:00
Martin Willi 914ec2dbf2 Implemented IKEv1 attribute encoding in SA payload 2012-03-20 17:30:53 +01:00
Martin Willi fbebc2a068 Implemented encoding of additional IKEv1 proposal attributes 2012-03-20 17:30:53 +01:00
Martin Willi cd0017d452 Exchange IKEv1 ESP SA proposal information 2012-03-20 17:30:53 +01:00
Martin Willi 132d5c56de Exchange IKEv1 SA specific proposal data with SA payload 2012-03-20 17:30:52 +01:00
Martin Willi e174e0d445 Added not-yet used sa_payload parameters used in IKEv1 2012-03-20 17:30:52 +01:00
Martin Willi d08269c700 Added a get_rekey/reauth_time() jitter parameter to get time without randomization 2012-03-20 17:30:52 +01:00
Martin Willi 9cc38c8efb Use quick mode task initiator flag instead of passing it as parameter 2012-03-20 17:30:51 +01:00
Martin Willi 4e0bc9af22 Add quick mode ID payloads only if establishing a non-host2host tunnel 2012-03-20 17:30:51 +01:00
Martin Willi c4b8539f93 Refactored traffic selector handling in quick mode 2012-03-20 17:30:51 +01:00
Martin Willi 818330aafe Refactored NONCE payload handling in quick mode 2012-03-20 17:30:51 +01:00
Martin Willi c4c5950458 Create host-to-host traffic selectors if quick mode identities missing 2012-03-20 17:30:51 +01:00
Martin Willi d020d4d695 Print message payload names after prepending IKEv1 HASH payload 2012-03-20 17:30:50 +01:00
Martin Willi da063ec95e Fixed task_manager_v1 compiler warnings 2012-03-20 17:30:50 +01:00
Martin Willi 3e246c4883 Generate a new mid only after we start a new task (and exchange) 2012-03-20 17:30:50 +01:00
Martin Willi a7910b1c6e Derive IKEv1 CHILD_SA keymat twice, once for each IPsec SA 2012-03-20 17:30:50 +01:00
Martin Willi 85f5c478bf Fix seed construction for IKEv1 key derivation 2012-03-20 17:30:50 +01:00
Martin Willi 9cc8bd4fd2 Use a dedicated message hash to detect IKEv1 retransmissions 2012-03-20 17:30:50 +01:00
Martin Willi 7a7f486df6 Include hardcoded tunnel mode attribute in porposal, remove ESN attribute 2012-03-20 17:30:50 +01:00
Martin Willi b6016fcab3 Fixed a config reference leak in IKEv2 initiate 2012-03-20 17:30:49 +01:00
Martin Willi 384c1a32a2 XAUTH is initiated based on configuration, no need to call externally 2012-03-20 17:30:49 +01:00
Martin Willi 017d98bf39 Merged IKEv1 attribute payload/data into configuration payload/attribute 2012-03-20 17:30:49 +01:00