denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
8,074 Commits 1 Branch 0 Tags
a6c328a6e9b865f51fb6a7129646552142157317
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Tobias Brunner a6c328a6e9 Use real ID payload to build HASH_I|R for Main Mode authentication. 
This is required for clients like the iPhone which set the protocol
and/or port fields of the ID payload.
 2012-03-20 17:31:21 +01:00
Tobias Brunner 19965ffe56 Create authenticators right when they are used during Main Mode. 2012-03-20 17:31:21 +01:00
Tobias Brunner 33493a5253 Added method to get encoded version if ID_V1 payload. 2012-03-20 17:31:21 +01:00
Tobias Brunner 6a6e000134 Log selected peer config during Main Mode. 2012-03-20 17:31:20 +01:00
Tobias Brunner 0a43f4b6c4 Log configured IKE version in stroke plugin. 2012-03-20 17:31:20 +01:00
Tobias Brunner e6503db2cf Fixed SIGSEGV when logging peer config matches. 2012-03-20 17:31:20 +01:00
Tobias Brunner 5383b50d88 Fixed missing shared_key initialization in main_mode task. 2012-03-20 17:31:19 +01:00
Tobias Brunner 0793ac497a Fixed memory leak when handling IKEv1 error notifications. 2012-03-20 17:31:18 +01:00
Tobias Brunner 4dbd81c669 Destroy IKE_SA after failed XAuth authentication. 2012-03-20 17:31:17 +01:00
Tobias Brunner 3d44d735c6 Added generic XAuth backend, using secrets provided by credential sets. 2012-03-20 17:31:17 +01:00
Tobias Brunner 41e1e435d9 Removed xauth-null dummy plugin. 2012-03-20 17:31:17 +01:00
Tobias Brunner 9f80110bc6 Install SAs with UDP encapsulation during Quick Mode. 2012-03-20 17:31:13 +01:00
Tobias Brunner 8cb6f4f979 Don't stop processing tasks if one returns SUCCESS. 
Only send a response if at least one of the tasks requires it.
 2012-03-20 17:31:11 +01:00
Tobias Brunner 3bf0be6b08 Add NAT-OA payloads during Quick Mode if transport mode is used. 
We don't parse them currently, as the Linux kernel does not need them to fix
the IP header checksum.
 2012-03-20 17:31:11 +01:00
Tobias Brunner 29b0cb328a Negotiate UDP encapsulation during Quick Mode if NAT is detected. 2012-03-20 17:31:10 +01:00
Tobias Brunner 1cc4ec46cf Task added for IKEv1 NAT detection. 
There is already support for both Main and Aggressive Mode.
 2012-03-20 17:31:10 +01:00
Tobias Brunner 61e2a1ad8a Create negotiated hasher earlier during Main Mode so it is available for building NAT-D payloads. 2012-03-20 17:31:10 +01:00
Tobias Brunner 4ace4daf0c Added a function to keymat_v1 to create the hasher earlier than during key derivation. 
The negotiated hasher is also used to generate NAT-D payloads.
 2012-03-20 17:31:10 +01:00
Tobias Brunner a0bea44a97 Message rules for IKEv1 NAT-T payloads added. 2012-03-20 17:31:10 +01:00
Tobias Brunner 06d29be714 Handle IKEv1 NAT-T vendor ID payload (only RFC 3947 for now). 2012-03-20 17:31:10 +01:00
Tobias Brunner 1e97783c99 Added payloads for IKEv1 NAT-Traversal negotiation. 2012-03-20 17:31:09 +01:00
Tobias Brunner 9eefb5f9b4 Use quiet generator when creating IKEv1 message hashes. 
This avoids cluttering the log with duplicate log messages when
generating and especially confusing log messages when parsing
authenticated messages.
 2012-03-20 17:31:09 +01:00
Tobias Brunner 24ddf03f52 Added an option to create a generator that does not log debug messages. 2012-03-20 17:31:09 +01:00
Tobias Brunner 4cfd0db854 Respond with NO_PROPOSAL_CHOSEN, if we don't find an ike_cfg. 2012-03-20 17:31:09 +01:00
Tobias Brunner 6be8d33daa Don't respond to malformed INFORMATIONAL_V1 messages with another INFORMATIONAL_V1 exchange. 2012-03-20 17:31:08 +01:00
Tobias Brunner 37639e94fb Handle invalid IKEv1 hashes more specifically. 2012-03-20 17:31:08 +01:00
Tobias Brunner 29a5e0707e Handle unsupported IKEv1 exchange types more specifically. 2012-03-20 17:31:08 +01:00
Tobias Brunner b235e69cde Send an INFORMATIONAL message on IKEv1 parse errors. 2012-03-20 17:31:08 +01:00
Tobias Brunner 983e852af8 Handle INFORMATIONAL_V1 messages when no keys have been derived yet. 
This allows to gracefully process the INFORMATIONAL_V1 message rules which
require the payloads to be encrypted and thus the exchange to be
authenticated with a HASH payload.  If such an exchange is now initiated
before the ISAKMP_SA is established, the message is simply sent unencrypted
and without HASH payload.
 2012-03-20 17:31:08 +01:00
Tobias Brunner e6732003f4 Error reporting for invalid IKEv2 responses fixed. 2012-03-20 17:31:08 +01:00
Tobias Brunner 7519106d07 Set request flag to proper value for IKEv1 messages before parsing them. 2012-03-20 17:31:08 +01:00
Tobias Brunner 1960312cfd Avoid parsing retransmits we already responded to. 
Decryption will fail as we already moved the IV when we sent the
response. Without this change, encrypted retransmits would have been
discarded during parsing already.
 2012-03-20 17:31:08 +01:00
Tobias Brunner 68c6863bbb Moved main part of message processing to task managers. 
This will allow individual error handling for each IKE version and should
allow better handling of IKEv1 retransmits.
 2012-03-20 17:31:08 +01:00
Tobias Brunner 44ff1153e8 Addded ike_sa_t.set_statistic to set timestamps from task manager. 2012-03-20 17:31:08 +01:00
Tobias Brunner 38d189eee9 Compiler warning fixed in prf_plus_t. 2012-03-20 17:31:07 +01:00
Tobias Brunner fd24c700fb Use proper enum types in proposal_substructure. 2012-03-20 17:31:07 +01:00
Tobias Brunner 78f7728c30 No need to build a HASH payload in XAUTH task. 
It gets added automatically when the message is generated.
 2012-03-20 17:30:51 +01:00
Tobias Brunner 97265a8927 Removed redundant '=>' when logging binary data in parser and generator. 2012-03-20 17:30:51 +01:00
Tobias Brunner f4e21faa98 Fixed encryption of IKEv2 messages. 2012-03-20 17:30:50 +01:00
Tobias Brunner cd200cb821 Authenticate and verify Phase 2 IKEv1 messages with appropriate hashes. 2012-03-20 17:30:50 +01:00
Tobias Brunner 1e5dd62bb2 Fixed verification of DELETE_V1 payloads. 2012-03-20 17:30:50 +01:00
Tobias Brunner f3cc8589b1 Fixed header length calculation of DELETE payload. 2012-03-20 17:30:50 +01:00
Tobias Brunner d6cec44b24 Fixed conftests after extending CERT payload. 2012-03-20 17:30:50 +01:00
Tobias Brunner 4c6dfbb26b Added missing comma after ME_CONNECT declaration. 2012-03-20 17:30:48 +01:00
Tobias Brunner 8c5e78ae4f Fixed creation of endpoint notifies. 2012-03-20 17:30:48 +01:00
Tobias Brunner 21da1087a5 Fixed diagram of IKEv1 encrypted "payload". 2012-03-20 17:30:47 +01:00
Tobias Brunner 42a69b05ab String for ENCRYPTED_DATA fixed. 2012-03-20 17:30:46 +01:00
Tobias Brunner 780ce7724d Strings for ENCRYPTED_V1 payload added. 2012-03-20 17:30:46 +01:00
Tobias Brunner d66199884f Set flags on message according to IKE version when parsing header. 2012-03-20 17:30:46 +01:00
Tobias Brunner c92f2cf36d Encrypt IKEv1 messages. 2012-03-20 17:30:46 +01:00
Tobias Brunner 477e856a15 Decrypt IKEv1 messages. 2012-03-20 17:30:46 +01:00
Tobias Brunner b6f0029497 Added IV generation to keymat_v1_t. 2012-03-20 17:30:46 +01:00
Tobias Brunner 6f5f8ee4b5 Use modified encryption payload to encrypt/decrypt complete IKEv1 messages. 2012-03-20 17:30:46 +01:00
Tobias Brunner 0463674971 Use key derivation in IKEv1 main mode (PSK authentication). 2012-03-20 17:30:46 +01:00
Tobias Brunner aadb9e8355 Added a simple AEAD wrapper for IKEv1 encryption/decryption. 2012-03-20 17:30:46 +01:00
Tobias Brunner b05d91edd7 Added IKEv1 key derivation with support for AUTH_CLASS_PSK. 2012-03-20 17:30:45 +01:00
Tobias Brunner 3d59c5c382 Update cached hosts on ike_sa_t when processing IKEv1 messages. 2012-03-20 17:30:45 +01:00
Tobias Brunner 0cec72df40 Provide keymat_t to message_t to encrypt/decrypt data. 2012-03-20 17:30:45 +01:00
Tobias Brunner 50d493808c Avoid compiler warnings due to extended enums. 2012-03-20 17:30:45 +01:00
Tobias Brunner a0563846b0 Moved version specific keymat functions to specific interfaces. 2012-03-20 17:30:45 +01:00
Tobias Brunner 043ed1b346 Memory leak fixed. 2012-03-20 17:30:43 +01:00
Tobias Brunner 273f2f8054 Added factory function to create task_manager_t implementations. 2012-03-20 17:30:43 +01:00
Tobias Brunner 4b64a1a17d Added factory function to create keymat_t implementations. 2012-03-20 17:30:43 +01:00
Tobias Brunner 0b611540ef Store IKE version of an SA on ike_sa_t. 2012-03-20 17:30:43 +01:00
Tobias Brunner 0fc9acdd23 Added stub for IKEv1 keymat_t implementation. 2012-03-20 17:30:42 +01:00
Tobias Brunner 6ab936f046 Use keymat_t as common interface, renamed current implementation to _v2. 2012-03-20 17:30:42 +01:00
Tobias Brunner f7a8fcedc0 Use enum to define IKE version on peer_cfg_t. 
Replaced all those magic numbers.
 2012-03-20 17:30:41 +01:00
Tobias Brunner 3238faf8e6 Fix init message arrival check. 2012-03-20 17:30:41 +01:00
Tobias Brunner 354ac9579f Compile error fixed. 2012-03-20 17:30:41 +01:00
Tobias Brunner 7f56cf1a65 Message parsing slightly refactored, allows parsing of unencrypted IKEv1 messages. 2012-03-20 17:30:40 +01:00
Tobias Brunner 4ed52db2bb Allow creation of message_t objects for IKEv1 packets. 2012-03-20 17:30:40 +01:00
Tobias Brunner 8a2d079d78 Certificate request payloads can be sent in pretty much any IKEv1 message. 2012-03-20 17:30:40 +01:00
Tobias Brunner 8f3aea2f77 Message rules for IKEv1 INFORMATIONAL exchange added. 
Since INFORMATIONAL "exchanges" are actually unidirectionally sent
message we don't have any responder rules.
 2012-03-20 17:30:40 +01:00
Tobias Brunner 130c9a54c2 Message rules for IKEv1 AGGRESSIVE exchange added. 
These are basically the same as for ID_PROT but no payloads are expected
to be encrypted (at least if using PSK or signatures for authentication).
 2012-03-20 17:30:40 +01:00
Tobias Brunner 6ba70ba8dd Message rules for IKEv1 ID_PROT exchange added. 
These rules are quite broad and cover main mode with at least PSK and
signature based authentication.
 2012-03-20 17:30:40 +01:00
Tobias Brunner fdb8421f36 Typo fixed. 2012-03-20 17:30:40 +01:00
Tobias Brunner ccdd3a4cee Added configure option for the IKEv1 implementation in charon. 2012-03-20 17:30:39 +01:00
Tobias Brunner 856baca23e Fixed monolithic build of libcharon with libtnccs enabled. 2011-11-08 18:35:11 +01:00
Tobias Brunner 59c5f048bb Correctly refer to tnc-tnccs plugin when building monolithically. 2011-11-08 18:35:11 +01:00
Tobias Brunner b12ad862c1 Calculate checksums for libsimaka and libtls. 
These are currently not checked though. And because they don't define a
<libname>_init function an warning is reported when the checksum is
calculated.
 2011-11-08 18:35:11 +01:00
Tobias Brunner 89bad63bac Defer calculation of checksums until installation. 
The checksum is now calculated from the installed libraries and plugins.
This allows to calculate checksums for plugins linking to libraries like
libtls as these are relinked during installation.
 2011-11-08 18:35:11 +01:00
Tobias Brunner 4ad67fe7d5 Fixed formatting for longer plugin names in checksum_builder output. 2011-11-08 18:35:11 +01:00
Tobias Brunner 9192f78f70 Don't link libtnccs to checksum_builder. 
Linking is only required for libraries defining global symbols used by
plugins to which the plugins do not link themselves.
 2011-11-08 18:35:11 +01:00
Tobias Brunner 48e87e12ab Revert "fixed integrity tests of plugins using libtls or libtnccs" 
This reverts commit b597ac4a4c (not
completely).
 2011-11-08 18:35:11 +01:00
Tobias Brunner e034cc9ca9 Revert "fixed integrity tests of plugins using libsimaka" 
This reverts commit 8c42f16dee.

Conflicts:

	src/charon/Makefile.am
 2011-11-08 18:35:11 +01:00
Tobias Brunner 9b6502ade8 maemo: New upstream release. 2011-11-08 18:35:11 +01:00
Tobias Brunner 866858527d Fix 'ipsec pool --status' for empty pools. 2011-11-04 15:07:54 +01:00
Tobias Brunner 39b30518c2 Syntax error in sqlite.sql fixed. 2011-11-04 14:37:22 +01:00
Tobias Brunner 5fd8e53002 Some Android NEWS added. 2011-11-04 12:24:16 +01:00
Tobias Brunner 2e94a02115 Don't build pluto and starter by default on Android. 2011-11-04 12:20:21 +01:00
Tobias Brunner 051226d5c0 Silently install route again, even if it did not change. 
Address/interface changes can cause the route to disappear. Afterwards
the route might look the same but that does not mean it is still installed.
 2011-11-04 11:11:17 +01:00
Tobias Brunner 25d59e9e2d Compile warning fixed in kernel interfaces. 2011-11-04 11:11:17 +01:00
Tobias Brunner f3eef176f4 Common spelling errors fixed. 2011-11-03 19:30:17 +01:00
Tobias Brunner 602ee58e45 NEWS about pkcs11 plugin added. 2011-11-03 18:39:57 +01:00
Tobias Brunner 53e2fc690e pkcs11: Documented use_pubkey option in strongswan.conf(5). 2011-11-03 18:36:34 +01:00
Tobias Brunner 1bdd255ed3 pkcs11: Make public key operations on tokens optional. 2011-11-03 17:56:40 +01:00
Tobias Brunner 5b85b94e27 pkcs11: Make sure a key can be used for a given signature scheme. 2011-11-02 20:27:55 +01:00
Tobias Brunner 58d0a8d49b pkcs11: Register ECDSA feature. 2011-11-02 20:27:55 +01:00
Tobias Brunner fd48b220ed pkcs11: We have to create our own hashes for some signature schemes. 2011-11-02 20:27:55 +01:00
Tobias Brunner 30a3ede8ce pkcs11: Lookup the public key of a private key by CKA_ID. 
Currently this only works if a public key object with the same ID is
available, if there isn't one we could search for a certificate with the
same ID and extract the key from there.
 2011-11-02 20:27:55 +01:00