denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
8,843 Commits 1 Branch 0 Tags
b24be29646442210f43b100d2282b6c0a0e52e09
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Tobias Brunner 13de38e354 Documented strongswan.conf options for radattr plugin. 2012-05-01 13:32:43 +02:00
Tobias Brunner 88206458ce Properly initialize optional subject in PEM builder. 2012-04-30 10:48:57 +02:00
Tobias Brunner 00d79edc20 Typo fixed. 2012-04-30 10:47:42 +02:00
Tobias Brunner 23cb8ba72b Fixed null-pointer dereference in smp plugin. 2012-04-26 08:54:04 +02:00
Tobias Brunner 7d85bebc49 pluto: Fix for null-terminated XAuth secrets (as sent by Android 4). 2012-04-24 09:25:38 +02:00
Tobias Brunner 5895c2e948 Option added to set identifier for syslog(3) logging. 
This identifier is added to each log message by syslog.
 2012-04-20 09:26:12 +02:00
Tobias Brunner 7e84c4275c Removed auth_cfg_t.replace_value() and replaced usages with add(). 
replace_value() was used to replace identities. Since for these the latest is
now returned by get(), adding the new identity with add() is sufficient.
 2012-04-18 18:50:14 +02:00
Tobias Brunner ebc1ffe451 Changed the order and semantics of rules we expect only once in auth_cfg_t. 
These rules are now inserted at the front of the internal list, this
allows to retrieve the rule added last with get(). For other rules the
order in which they are added is maintained (this allows to properly
enumerate them).
 2012-04-18 18:50:14 +02:00
Tobias Brunner 80067cf9e6 Store password with remote ID to tie it stronger to a specific connection. 2012-04-18 13:32:49 +02:00
Tobias Brunner 9f1b303afc Added stroke user-creds command, to set username/password for a connection. 2012-04-17 14:20:58 +02:00
Tobias Brunner 7b00fdeb84 Added method to add additional shared secrets to stroke_cred_t. 2012-04-17 14:20:58 +02:00
Tobias Brunner ff5cb888f6 Additional prompt keyword added to stroke. 2012-04-17 14:20:58 +02:00
Tobias Brunner 4c31657d2c Typo fixed. 2012-04-17 14:20:58 +02:00
Tobias Brunner 7fd6c078b6 Use IP address as ID as responder if not configured or no IDr received. 2012-04-16 14:09:51 +02:00
Tobias Brunner b241a37411 Fall back on IP address as IDi if none is configured at all. 2012-04-16 13:44:27 +02:00
Tobias Brunner b447af658c Use auth_cfg_t.replace_value where appropriate. 2012-04-16 13:44:27 +02:00
Tobias Brunner 68cca941cf Added a simple method to replace the value of a rule in auth_cfg_t. 2012-04-16 13:44:27 +02:00
Tobias Brunner 4b32bde48e Fixed IDi in case neither left nor leftid is configured. 2012-04-16 13:44:27 +02:00
Tobias Brunner 4e2e77d540 Typo fixed in NEWS. 2012-04-14 08:41:32 +02:00
Tobias Brunner ae9ce83511 Properly initialize src in ike_sa_t.is_any_path_valid(). 2012-04-06 10:54:44 +02:00
Tobias Brunner bad192069f Make AES-CMAC actually usable for IKEv2. 2012-04-04 10:51:46 +02:00
Tobias Brunner 37d43ebbde Doxygen fixes. 2012-04-03 10:56:47 +02:00
Tobias Brunner d7590217c3 Added NEWS about cmac plugin. 2012-04-03 10:48:03 +02:00
Tobias Brunner 811e7490f6 Added test vectors for AES-CMAC. 2012-04-03 10:45:09 +02:00
Tobias Brunner c0d39c205c Implemented AES-CMAC based PRF and signer. 
The cmac plugin implements AES-CMAC as defined in RFC 4493 and the
signer and PRF based on it as defined in RFC 4494 and RFC 4615,
respectively.
 2012-04-03 10:40:47 +02:00
Tobias Brunner 9a6b1cb412 Fixed GNU license header in hmac and xcbc plugins. 2012-04-03 10:33:59 +02:00
Tobias Brunner ef511fc03d Add support for dnQualifier in DNs. 2012-03-29 10:01:55 +02:00
Tobias Brunner a281494abd Added NEWS about resolvconf support. 2012-03-27 10:44:21 +02:00
Tobias Brunner ed2cab08d2 Make resolvconf interface prefix configurable. 2012-03-27 10:44:21 +02:00
Tobias Brunner caae5a5c0f Added support for the resolvconf framework in resolve plugin. 
If /sbin/resolvconf is found nameservers are not written directly to
/etc/resolv.conf but instead resolvconf is invoked.
 2012-03-27 10:44:21 +02:00
Tobias Brunner 6e921f2017 Use single DBG2 statements in kernel_netlink plugin (i.e. ignore mark.value). 2012-03-27 10:37:56 +02:00
Tobias Brunner 817ab8a8d4 Don't cast second argument of mem_printf_hook (%b) to size_t. 
Also treat the given number as unsigned int.

Due to the printf hook registration the second argument of
mem_printf_hook (if called via printf etc.) is always of type int*.
Casting this to a size_t pointer and then dereferencing that as int does
not work on big endian machines if int is smaller than size_t (e.g. on ppc64).

In order to make this change work if the argument is of a type larger
than int, size_t for instance, the second argument for %b has to be casted
to (u_)int.
 2012-03-27 09:10:34 +02:00
Tobias Brunner adfd3b992f smp: Use proper signed type to get return value of read(2). 2012-03-27 09:10:33 +02:00
Tobias Brunner 008e2df477 pluto: Use time_monotonic() instead of a custom implementation. 2012-03-27 09:10:33 +02:00
Tobias Brunner 8e066237a7 Don't include individual glib headers in nm plugin. 
Expections are glib/gi18n.h, glib/gi18n-lib.h, glib/gprintf.h and
glib/gstdio.h.
 2012-03-26 15:23:17 +02:00
Tobias Brunner d112a7e1fe Properly handle retransmitted initial IKE messages. 
This change allows to properly handle retransmits of initial IKE
messages when we've already processed them (i.e. our response is now resent
immediately).
 2012-03-20 17:31:41 +01:00
Tobias Brunner de9357bb44 Implemented table of init hashes without linked_list_t. 2012-03-20 17:31:41 +01:00
Tobias Brunner 6f0cca20d8 Implemented table of connected peers without linked_list_t. 2012-03-20 17:31:41 +01:00
Tobias Brunner 3489370458 Implemented table of half open IKE_SAs without linked_list_t. 2012-03-20 17:31:41 +01:00
Tobias Brunner e49bb4e3e3 Don't use linked_list_t for buckets in main IKE_SA hash table. 2012-03-20 17:31:41 +01:00
Tobias Brunner 894c52cba2 Fixed deadlock if checkin_and_destroy is called during shutdown. 2012-03-20 17:31:40 +01:00
Tobias Brunner 4b2f428f40 Do not clone hashes of initial IKE messages when storing them in the hash table. 2012-03-20 17:31:40 +01:00
Tobias Brunner 20e3d5ea00 Store IKEv2 IKE_SAs by local SPI in the IKE_SA manager hash table. 
For IKEv1 the previous behavior of always using the initiator's SPI as
key is maintained.
 2012-03-20 17:31:40 +01:00
Tobias Brunner 71cf97871f Added separate hashtable for hashes of initial IKE messages. 
This does not require us to do a lookup for an SA by SPI first.
 2012-03-20 17:31:40 +01:00
Tobias Brunner 68611395dc chunk_equals_ptr added to compare chunks given as pointers. 2012-03-20 17:31:40 +01:00
Tobias Brunner 1726795fa9 Store the major IKE version on ike_sa_id_t. 2012-03-20 17:31:40 +01:00
Tobias Brunner 8254e7ecb8 Implemented handling of UNITY_LOAD_BALANCE as reauthentication. 2012-03-20 17:31:40 +01:00
Tobias Brunner eff331f799 Parse IKEv1 Cisco Load Balancing notify (can't act on it yet). 2012-03-20 17:31:40 +01:00
Tobias Brunner 3a9d5cbc14 Fixed transform numbering in IKEv1 proposal. 2012-03-20 17:31:40 +01:00
Tobias Brunner dcbdc914fa Compiler warning fixed. 2012-03-20 17:31:40 +01:00
Tobias Brunner bd8d1f1d9c Accept unencrypted Aggressive Mode messages. 
Racoon does not encrypt the third message during Aggressive Mode.
 2012-03-20 17:31:34 +01:00
Tobias Brunner db1dc81329 IKEv1 ATTRIBUTES_NOT_SUPPORTED error notify added. 2012-03-20 17:31:30 +01:00
Tobias Brunner fd5d6bb08e Use IPSEC DOI also for ISAKMP SA deletes. 2012-03-20 17:31:29 +01:00
Tobias Brunner 4bc4e8e17b Added support for iKEIntermediate flag to ipsec pki. 2012-03-20 17:31:25 +01:00
Tobias Brunner f29a4f1c64 Added support for iKEIntermediate X.509 extended key usage flag. 
Mac OS X requires server certificates to have this flag set.
 2012-03-20 17:31:24 +01:00
Tobias Brunner 00cc2188d4 Some whitespace fixes. 2012-03-20 17:31:24 +01:00
Tobias Brunner b46b56fac1 Log parsed unsigned ints with proper format strings. 2012-03-20 17:31:24 +01:00
Tobias Brunner a6c328a6e9 Use real ID payload to build HASH_I|R for Main Mode authentication. 
This is required for clients like the iPhone which set the protocol
and/or port fields of the ID payload.
 2012-03-20 17:31:21 +01:00
Tobias Brunner 19965ffe56 Create authenticators right when they are used during Main Mode. 2012-03-20 17:31:21 +01:00
Tobias Brunner 33493a5253 Added method to get encoded version if ID_V1 payload. 2012-03-20 17:31:21 +01:00
Tobias Brunner 6a6e000134 Log selected peer config during Main Mode. 2012-03-20 17:31:20 +01:00
Tobias Brunner 0a43f4b6c4 Log configured IKE version in stroke plugin. 2012-03-20 17:31:20 +01:00
Tobias Brunner e6503db2cf Fixed SIGSEGV when logging peer config matches. 2012-03-20 17:31:20 +01:00
Tobias Brunner 5383b50d88 Fixed missing shared_key initialization in main_mode task. 2012-03-20 17:31:19 +01:00
Tobias Brunner 0793ac497a Fixed memory leak when handling IKEv1 error notifications. 2012-03-20 17:31:18 +01:00
Tobias Brunner 4dbd81c669 Destroy IKE_SA after failed XAuth authentication. 2012-03-20 17:31:17 +01:00
Tobias Brunner 3d44d735c6 Added generic XAuth backend, using secrets provided by credential sets. 2012-03-20 17:31:17 +01:00
Tobias Brunner 41e1e435d9 Removed xauth-null dummy plugin. 2012-03-20 17:31:17 +01:00
Tobias Brunner 9f80110bc6 Install SAs with UDP encapsulation during Quick Mode. 2012-03-20 17:31:13 +01:00
Tobias Brunner 8cb6f4f979 Don't stop processing tasks if one returns SUCCESS. 
Only send a response if at least one of the tasks requires it.
 2012-03-20 17:31:11 +01:00
Tobias Brunner 3bf0be6b08 Add NAT-OA payloads during Quick Mode if transport mode is used. 
We don't parse them currently, as the Linux kernel does not need them to fix
the IP header checksum.
 2012-03-20 17:31:11 +01:00
Tobias Brunner 29b0cb328a Negotiate UDP encapsulation during Quick Mode if NAT is detected. 2012-03-20 17:31:10 +01:00
Tobias Brunner 1cc4ec46cf Task added for IKEv1 NAT detection. 
There is already support for both Main and Aggressive Mode.
 2012-03-20 17:31:10 +01:00
Tobias Brunner 61e2a1ad8a Create negotiated hasher earlier during Main Mode so it is available for building NAT-D payloads. 2012-03-20 17:31:10 +01:00
Tobias Brunner 4ace4daf0c Added a function to keymat_v1 to create the hasher earlier than during key derivation. 
The negotiated hasher is also used to generate NAT-D payloads.
 2012-03-20 17:31:10 +01:00
Tobias Brunner a0bea44a97 Message rules for IKEv1 NAT-T payloads added. 2012-03-20 17:31:10 +01:00
Tobias Brunner 06d29be714 Handle IKEv1 NAT-T vendor ID payload (only RFC 3947 for now). 2012-03-20 17:31:10 +01:00
Tobias Brunner 1e97783c99 Added payloads for IKEv1 NAT-Traversal negotiation. 2012-03-20 17:31:09 +01:00
Tobias Brunner 9eefb5f9b4 Use quiet generator when creating IKEv1 message hashes. 
This avoids cluttering the log with duplicate log messages when
generating and especially confusing log messages when parsing
authenticated messages.
 2012-03-20 17:31:09 +01:00
Tobias Brunner 24ddf03f52 Added an option to create a generator that does not log debug messages. 2012-03-20 17:31:09 +01:00
Tobias Brunner 4cfd0db854 Respond with NO_PROPOSAL_CHOSEN, if we don't find an ike_cfg. 2012-03-20 17:31:09 +01:00
Tobias Brunner 6be8d33daa Don't respond to malformed INFORMATIONAL_V1 messages with another INFORMATIONAL_V1 exchange. 2012-03-20 17:31:08 +01:00
Tobias Brunner 37639e94fb Handle invalid IKEv1 hashes more specifically. 2012-03-20 17:31:08 +01:00
Tobias Brunner 29a5e0707e Handle unsupported IKEv1 exchange types more specifically. 2012-03-20 17:31:08 +01:00
Tobias Brunner b235e69cde Send an INFORMATIONAL message on IKEv1 parse errors. 2012-03-20 17:31:08 +01:00
Tobias Brunner 983e852af8 Handle INFORMATIONAL_V1 messages when no keys have been derived yet. 
This allows to gracefully process the INFORMATIONAL_V1 message rules which
require the payloads to be encrypted and thus the exchange to be
authenticated with a HASH payload.  If such an exchange is now initiated
before the ISAKMP_SA is established, the message is simply sent unencrypted
and without HASH payload.
 2012-03-20 17:31:08 +01:00
Tobias Brunner e6732003f4 Error reporting for invalid IKEv2 responses fixed. 2012-03-20 17:31:08 +01:00
Tobias Brunner 7519106d07 Set request flag to proper value for IKEv1 messages before parsing them. 2012-03-20 17:31:08 +01:00
Tobias Brunner 1960312cfd Avoid parsing retransmits we already responded to. 
Decryption will fail as we already moved the IV when we sent the
response. Without this change, encrypted retransmits would have been
discarded during parsing already.
 2012-03-20 17:31:08 +01:00
Tobias Brunner 68c6863bbb Moved main part of message processing to task managers. 
This will allow individual error handling for each IKE version and should
allow better handling of IKEv1 retransmits.
 2012-03-20 17:31:08 +01:00
Tobias Brunner 44ff1153e8 Addded ike_sa_t.set_statistic to set timestamps from task manager. 2012-03-20 17:31:08 +01:00
Tobias Brunner 38d189eee9 Compiler warning fixed in prf_plus_t. 2012-03-20 17:31:07 +01:00
Tobias Brunner fd24c700fb Use proper enum types in proposal_substructure. 2012-03-20 17:31:07 +01:00
Tobias Brunner 78f7728c30 No need to build a HASH payload in XAUTH task. 
It gets added automatically when the message is generated.
 2012-03-20 17:30:51 +01:00
Tobias Brunner 97265a8927 Removed redundant '=>' when logging binary data in parser and generator. 2012-03-20 17:30:51 +01:00
Tobias Brunner f4e21faa98 Fixed encryption of IKEv2 messages. 2012-03-20 17:30:50 +01:00
Tobias Brunner cd200cb821 Authenticate and verify Phase 2 IKEv1 messages with appropriate hashes. 2012-03-20 17:30:50 +01:00
Tobias Brunner 1e5dd62bb2 Fixed verification of DELETE_V1 payloads. 2012-03-20 17:30:50 +01:00
Tobias Brunner f3cc8589b1 Fixed header length calculation of DELETE payload. 2012-03-20 17:30:50 +01:00
Tobias Brunner d6cec44b24 Fixed conftests after extending CERT payload. 2012-03-20 17:30:50 +01:00