Martin Willi
a4c040d536
Added strongswan.conf option to override half open IKE_SA timeout
2011-05-16 15:24:15 +02:00
Martin Willi
9a96ba4b6e
Added a get_count() method to IKE_SA manager
2011-05-16 15:24:15 +02:00
Martin Willi
a836cf8085
Fixed identiation in private_ike_sa_manager
2011-05-16 15:24:15 +02:00
Martin Willi
69c3eca0e9
Added a non-blocking, skipping variant of IKE_SA enumerator
2011-05-16 15:24:13 +02:00
Tobias Brunner
68447302d6
Typo fixed.
2011-04-28 12:50:30 +02:00
Martin Willi
f9a552f011
Resolve and connect to RADIUS servers not before required
2011-04-21 14:01:25 +02:00
Martin Willi
52846ec820
Remove superfluous test for peer_cfg on established IKE_SAs
2011-04-20 12:31:29 +02:00
Martin Willi
bd01b9d8b2
Install ESN SAs if such a proposal has been negotiated
2011-04-20 12:26:58 +02:00
Martin Willi
4876d4f3b3
Added an esn parameter to the kernel interface add_sa functions
2011-04-20 12:26:57 +02:00
Tobias Brunner
1c004bebd8
Clearly mark switch cases that fall through.
2011-04-19 13:48:50 +02:00
Tobias Brunner
3c0c321776
Neither rekey nor del can be NULL.
2011-04-14 18:10:27 +02:00
Andreas Steffen
c98ed04de0
display EAP identifiers in HEX format
2011-04-06 17:34:27 +02:00
Andreas Steffen
adcb221f19
log the EAP identifier also for vendor specific EAP methods
2011-04-05 13:57:37 +02:00
Andreas Steffen
de93154231
log the initial value of the EAP identifier
2011-04-05 13:54:26 +02:00
Andreas Steffen
2f7c12a2f4
added get_identifier() and set_identifier() methods
2011-04-05 13:32:10 +02:00
Martin Willi
3ced6b51e4
Move establish/inherit of rekeyed IKE_SAs to delete messages
...
Having the inherit() function delayed to the IKE_SA establish procedure
was problematic. The task destroy function was never a good place and
results in locking/cleanup problems. After establishing the SA, it
should be really checked in ASAP to avoid any triggered DPD checks
to get lost.
2011-03-15 15:20:09 +01:00
Martin Willi
f42156a8c8
Wrap IKE delete after rekey into rekey task for responder, too
2011-03-15 11:51:53 +01:00
Martin Willi
41080cbbd9
Migrated ike_rekey task to INIT/METHOD macros
2011-03-15 11:30:02 +01:00
Martin Willi
5f47296f22
Migrated sim_manager to INIT/METHOD macros
2011-03-08 16:42:27 +01:00
Martin Willi
7b3bfe4b6c
Protect sim card/provider/hook (un-)registration with a rwlock
2011-03-08 16:42:27 +01:00
Martin Willi
f58db72482
Splitted sim_manager.h header to sim_{card,provider,hooks}.h
2011-03-08 16:42:27 +01:00
Martin Willi
e44ebdcfc8
Slightly change IKE_SA destruction order to inherit properly during ike_rekey task destruction
2011-02-28 10:31:36 +00:00
Martin Willi
94030a670b
Report correct key size if a cipher is not supported
2011-02-07 16:39:33 +01:00
Tobias Brunner
84545f6e7c
Some typos fixed.
2011-02-07 11:39:41 +01:00
Martin Willi
b49d047bfc
Invoke the per-round authorize() hook before purging current auth info on IKE_SA
2011-02-03 17:08:39 +01:00
Martin Willi
2b7686b5d8
Migrated ike_auth to INIT/METHOD macros, fixes missing initial_contact initialization
2011-02-02 15:13:39 +01:00
Martin Willi
1d34612f07
Do not use destroyed rng/hasher if IKE_SA has been flush()ed
2011-02-01 09:25:55 +01:00
Martin Willi
5c89a00f05
Do not log potentially hundreds of cert requests for unknown CAs at level 1
2011-01-28 08:29:23 +01:00
Martin Willi
983a5e88d3
Revert "Send INITIAL_CONTACT even if we have a unique policy"
...
It makes sense to omit INITIAL_CONTACT if don't have a unique policy,
as a client might want to connect from different devices to the same
account.
This reverts commit 719c33b41a
2011-01-13 10:50:46 +01:00
Martin Willi
2082417df3
Force port update as responder when initiator switches to 4500 in IKE_AUTH
2011-01-12 14:37:15 +01:00
Martin Willi
8ba805f4db
Avoid variable name overloading
2011-01-12 14:37:09 +01:00
Martin Willi
719c33b41a
Send INITIAL_CONTACT even if we have a unique policy
2011-01-10 11:54:10 +01:00
Martin Willi
1ed482d808
Fix nonce comparison in rekey collisions, lowest nonce loses
2011-01-07 15:51:35 +01:00
Martin Willi
6f5892f5c7
Destroy existing IKE_SAs with same identities when receiving INITIAL_CONTACT
2011-01-05 16:46:08 +01:00
Martin Willi
a4a1e24d37
Send INITIAL_CONTACT for the first IKE_SA if it has a unique policy
2011-01-05 16:46:08 +01:00
Martin Willi
240bd7dbb7
Migrated ike_sa_manager_t to INIT/METHOD macros, some cleanups
2011-01-05 16:46:08 +01:00
Martin Willi
3a89b3c52f
Provide CRLs received in CERT payloads to trustchain verification
2011-01-05 16:46:06 +01:00
Martin Willi
5f15faebc8
Include the used reserved bytes from ID payloads in AUTH calculation
2011-01-05 16:45:53 +01:00
Martin Willi
502edf425f
Migrated psk/pubkey_authenticators to INIT/METHOD macros
2011-01-05 16:45:53 +01:00
Martin Willi
9ca5d0280e
Moved check if packet already encoded to ike_sa, avoids message() hook invocation twice
2011-01-05 16:45:52 +01:00
Martin Willi
c67de660d2
Move critical bit checking to ike_sa, notify payload includes unsupported payload type
2011-01-05 16:45:44 +01:00
Martin Willi
e7099aa24e
Handle all error notifies in CREATE_CHILD_SA exchanges
2011-01-05 16:45:44 +01:00
Martin Willi
c146c3c4e1
Ingore messages with exchange type altered to UNDEFINED in message() hook
2011-01-05 16:45:42 +01:00
Martin Willi
89fda1abb5
Moved message()-hook invocation to generate_message(), catch pre-generated IKE_SA_INITs, too
2011-01-05 16:45:41 +01:00
Martin Willi
6c2d466b90
Support manually triggerd DPD check, even if DPD disabled in config
2011-01-05 16:45:40 +01:00
Andreas Steffen
905ab99fc1
eliminated whitespace
2010-12-21 17:51:27 +01:00
Andreas Steffen
cf16a29dac
Migrated child_create_t to INIT/METHOD macros
2010-12-21 17:49:07 +01:00
Martin Willi
55df72e6d5
Do not use TFC padding if peer does not support ESPv3
2010-12-20 09:45:39 +01:00
Martin Willi
37788b1d06
Added a TFC padding option to child_cfg
2010-12-20 09:45:39 +01:00
Martin Willi
d86bb6ef4d
Implemented Traffic Flow Confidentiality padding in kernel_interface
2010-12-20 09:45:39 +01:00
Martin Willi