denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
16,673 Commits 1 Branch 0 Tags
c163a53a3a1d8c7e89b095f35e4a78007929826f
Commit Graph
103 Commits
Author SHA1 Message Date
Tobias Brunner fe26ddada9 Map fragmented initial initial Main or Aggressive Mode messages to the same IKE_SA 2012-12-24 12:29:27 +01:00
Tobias Brunner 7d85f94165 Don't update an IKE_SA-entry's cached message ID when handling fragments 2012-12-24 12:29:26 +01:00
Martin Willi c794455666 Raise alerts when enforcing IKE_SA unique policy 2012-12-19 10:40:32 +01:00
Martin Willi 2354b10576 Add an ikesa_limit option to limit number of IKE_SAs as responder 2012-11-16 10:27:36 +01:00
Tobias Brunner 12642a6831 Moved data structures to new collections subfolder 2012-10-24 16:00:49 +02:00
Martin Willi f6f16131d0 Raise a bus alert when a received message contains unknown SPIs 2012-10-24 11:34:30 +02:00
Tobias Brunner f4cc7ea11b Add uniqueids=never to ignore INITIAL_CONTACT notifies 
With uniqueids=no the daemon still deletes any existing IKE_SA with the
same peer if an INITIAL_CONTACT notify is received.  With this new option
it also ignores these notifies.
 2012-09-10 17:37:18 +02:00
Martin Willi 10bdc7a968 Remove the unused second IKE_SA entry match function argument 
LLVMs clang complains about this parameter, so remove it.
 2012-08-20 17:42:14 +02:00
Tobias Brunner 6204c1182d Include src address in hash of initial message for Main Mode 
If two initiators use the same SPI and also use the same SA proposal the
hash for the initial message would be exactly the same.  For IKEv2 and
Aggressive Mode that's not a problem as these messages include random
data (Ni, KEi payloads).
 2012-08-08 14:47:36 +02:00
Martin Willi 87dd205b61 Add a return value to hasher_t.allocate_hash() 2012-07-16 14:55:06 +02:00
Tobias Brunner 5d91d8c469 Check rng return value when generating SPIs in ike_sa_manager_t 2012-07-16 14:53:35 +02:00
Martin Willi 0fbfcf2a3a Use XAuth/EAP remote identity for uniqueness check 2012-06-25 10:18:34 +02:00
Tobias Brunner 42500c274a Use name from initialization to access settings in libcharon. 
Also fixes several whitespace errors.
 2012-05-03 13:57:04 +02:00
Martin Willi 4837d2a981 Fix iteration through half-open IKE_SA table 2012-04-16 16:47:17 +02:00
Tobias Brunner d112a7e1fe Properly handle retransmitted initial IKE messages. 
This change allows to properly handle retransmits of initial IKE
messages when we've already processed them (i.e. our response is now resent
immediately).
 2012-03-20 17:31:41 +01:00
Tobias Brunner de9357bb44 Implemented table of init hashes without linked_list_t. 2012-03-20 17:31:41 +01:00
Tobias Brunner 6f0cca20d8 Implemented table of connected peers without linked_list_t. 2012-03-20 17:31:41 +01:00
Tobias Brunner 3489370458 Implemented table of half open IKE_SAs without linked_list_t. 2012-03-20 17:31:41 +01:00
Tobias Brunner e49bb4e3e3 Don't use linked_list_t for buckets in main IKE_SA hash table. 2012-03-20 17:31:41 +01:00
Tobias Brunner 894c52cba2 Fixed deadlock if checkin_and_destroy is called during shutdown. 2012-03-20 17:31:40 +01:00
Tobias Brunner 4b2f428f40 Do not clone hashes of initial IKE messages when storing them in the hash table. 2012-03-20 17:31:40 +01:00
Tobias Brunner 20e3d5ea00 Store IKEv2 IKE_SAs by local SPI in the IKE_SA manager hash table. 
For IKEv1 the previous behavior of always using the initiator's SPI as
key is maintained.
 2012-03-20 17:31:40 +01:00
Tobias Brunner 71cf97871f Added separate hashtable for hashes of initial IKE messages. 
This does not require us to do a lookup for an SA by SPI first.
 2012-03-20 17:31:40 +01:00
Tobias Brunner 1726795fa9 Store the major IKE version on ike_sa_id_t. 2012-03-20 17:31:40 +01:00
Martin Willi aa3b53e716 Adopt children after syncing a rekeyed IKEv1 SA 2012-03-20 17:31:38 +01:00
Martin Willi a46b8e16ad Set thread specific SA on bus for each enumerated IKE_SA 2012-03-20 17:31:38 +01:00
Martin Willi a0fa7a7f64 Clear initiator flag when checking out initial IKEv1 SA from message 2012-03-20 17:31:37 +01:00
Martin Willi 5b7fc76861 Don't invoke updown hook when flushing SAs for IKEv1, tasks will do it 2012-03-20 17:31:36 +01:00
Martin Willi cb1a145ce2 Added an IKE_SA manager method to enumerate IKE_SA IDs filtered by identities 2012-03-20 17:31:33 +01:00
Martin Willi f5a84055fe Implemented responder retransmission, currently enabled for quick mode only 2012-03-20 17:31:30 +01:00
Martin Willi 8a395e889c Fixed leak of a hash when checking out by hash 2012-03-20 17:31:30 +01:00
Martin Willi 3d54ae94d9 Handle initiation of not supported IKE versions properly 2012-03-20 17:31:30 +01:00
Martin Willi 3ba15819ed Remove executable flag from source code files 2012-03-20 17:31:22 +01:00
Clavister OpenSource a064eaa8a6 Handling of initial contact 2012-03-20 17:31:14 +01:00
Martin Willi 17ec1c74de Don't compare initiator flag in IKE_SA manager, pass initiator parameter to IKE_SA constructor 2012-03-20 17:30:47 +01:00
Martin Willi c311d22d0f Don't clone chunk in message.get_packet_data 2012-03-20 17:30:44 +01:00
Tobias Brunner 0b611540ef Store IKE version of an SA on ike_sa_t. 2012-03-20 17:30:43 +01:00
Tobias Brunner 3238faf8e6 Fix init message arrival check. 2012-03-20 17:30:41 +01:00
Martin Willi 2fc986182f Handle IKEv1 messages in managers checkout_by_message 2012-03-20 17:30:39 +01:00
Tobias Brunner 4bbce1ef37 Replaced ike_sa_t.create_child_sa_iterator with enumerator. 
This required two new methods on ike_sa_t. One returns the number of
CHILD_SAs and one allows to remove a CHILD_SA.
 2011-07-06 09:43:45 +02:00
Martin Willi 9a96ba4b6e Added a get_count() method to IKE_SA manager 2011-05-16 15:24:15 +02:00
Martin Willi a836cf8085 Fixed identiation in private_ike_sa_manager 2011-05-16 15:24:15 +02:00
Martin Willi 69c3eca0e9 Added a non-blocking, skipping variant of IKE_SA enumerator 2011-05-16 15:24:13 +02:00
Martin Willi 1d34612f07 Do not use destroyed rng/hasher if IKE_SA has been flush()ed 2011-02-01 09:25:55 +01:00
Martin Willi 6f5892f5c7 Destroy existing IKE_SAs with same identities when receiving INITIAL_CONTACT 2011-01-05 16:46:08 +01:00
Martin Willi a4a1e24d37 Send INITIAL_CONTACT for the first IKE_SA if it has a unique policy 2011-01-05 16:46:08 +01:00
Martin Willi 240bd7dbb7 Migrated ike_sa_manager_t to INIT/METHOD macros, some cleanups 2011-01-05 16:46:08 +01:00
Martin Willi 86993d6b90 Never register IKE_SA during checkout_new, as rekeying keeps it checked out 2010-12-07 16:30:38 +01:00
Thomas Egerer 76ce213c43 Guarantee entry->other is set when calling put_connected_peers 
Given the original intent of entry->host, the check for DoS attacks, it
can happen that this value remains NULL when an entry is created. This
is particularly awkward if put_connected_peers is called to check if a
connection to a given peer already exists, since it takes the address
family into consideration (git commit b74219d0) which is gleaned from
entry->host.
This patch guarantees that entry->other is a clone of host before
put_connected_peers is called.
 2010-12-06 10:56:57 +01:00
Thomas Egerer 8f927116be Extend connected peers by peer family 
This allows for simultanious IPv4 and IPv6 tunnel for same peers with
matching identities.
 2010-11-12 16:28:04 +01:00