denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
10,675 Commits 1 Branch 0 Tags
d29246cabe581f4937e740e251a935e629556f86
Commit Graph
73 Commits
Author SHA1 Message Date
Martin Willi 49960f021d Make check whether to use IKEv1 fragmentation more readable 2013-03-14 14:20:55 +01:00
Martin Willi 0235914d2f Ignore fourth Qick Mode message sent by Windows servers. 
Initial patch by Paul Stewart, fixes #289.
 2013-03-11 10:53:55 +01:00
Martin Willi cdf75a39e3 Move initial message dropping to task manager 
When the last request message of the initial tunnel setup is retransmitted,
we must retransmit the response instead of ignoring the request.

Fixes #295.
 2013-02-25 12:12:19 +01:00
Tobias Brunner 66bb4f63b2 Properly send IKEv1 packets if no ike_cfg is known yet 
This applies for error notifies.
 2013-01-14 12:14:16 +01:00
Tobias Brunner ee6902ef7f Added an option to configure the maximum size of a fragment 2013-01-12 11:54:58 +01:00
Tobias Brunner 365d9a6f67 Added an option that allows to force IKEv1 fragmentation 2013-01-12 11:54:32 +01:00
Tobias Brunner 97973f8609 Use a connection specific option to en-/disable IKEv1 fragmentation 2012-12-24 13:00:01 +01:00
Tobias Brunner 2f62bb1549 Add an option to en-/disable IKE fragmentation 
Fragments are always accepted but will not be sent if disabled.  The
vendor ID is only sent if the option is enabled.
 2012-12-24 12:29:31 +01:00
Tobias Brunner 5cafefcd5d Split larger messages into fragments if IKE fragmentation is supported by peer 2012-12-24 12:29:31 +01:00
Tobias Brunner 8fc8383439 Don't handle fragmented messages larger than charon.max_packet 2012-12-24 12:29:27 +01:00
Tobias Brunner 30216000d3 Store inbound IKE fragments and reassemble the message when all fragments are received 2012-12-24 12:29:26 +01:00
Martin Willi 3c79b7b7db Add alerts for sent/received message retransmissions and timeout 2012-11-29 10:22:51 +01:00
Martin Willi 418f4bc7a5 Raise a bus alert when IKE message body parsing fails 2012-10-24 11:34:30 +02:00
Martin Willi 7910116384 Respect IKE version while selecting an ike_cfg as responder 2012-10-24 10:19:33 +02:00
Tobias Brunner 3973ffa4f6 Request is never NULL when responding with an INFORMATIONAL message 2012-09-28 19:10:03 +02:00
Tobias Brunner 3babde90bb Trigger ike_updown event caused by retransmits only after reestablish() has been called 
This allows listeners to migrate to the new IKE_SA with the
ike_reestablish event without having to worry about an ike_updown event
for the old IKE_SA.
 2012-09-06 11:27:28 +02:00
Martin Willi 497ce2cf51 Support multiple address pools configured on a peer_cfg 2012-08-30 16:43:42 +02:00
Martin Willi 101d26babe Support multiple virtual IPs on peer_cfg and ike_sa classes 2012-08-30 16:43:42 +02:00
Martin Willi 4e98ca1800 Remove queued IKEv1 message before processing it 
Avoids destruction or processing of a queued message in
recursive process_message() call.
 2012-08-08 14:54:03 +02:00
Martin Willi 764035d515 Block XAuth transaction on established IKE_SAs, but allow Mode Config 2012-08-03 13:07:57 +02:00
Tobias Brunner 1bb9c51e87 Check rng return value when generating IKEv1 message IDs 2012-07-16 14:53:35 +02:00
Martin Willi 271377905d Defer quick mode initiation if we expect a mode config request 2012-06-27 11:42:56 +02:00
Martin Willi 2d4c347af9 While checking for redundant quick modes, compare traffic selectors 
If a configuration is instanced more than once using narrowing,
we should keep all unique quick modes up during rekeying.
 2012-06-08 10:22:03 +02:00
Martin Willi 7a5f372c57 Initiate quick mode rekeying with narrowed traffic selectors 2012-06-08 10:22:03 +02:00
Martin Willi 1e24fa4614 Instead of rekeying, delete a quick mode if we have a fresher instance 
If both peers initiate quick mode rekeying simultaneously, we end up
with duplicate SAs for a configuration. This can't be avoided, nor do
the standards provide an appropriate solution. Instead of closing one
SA immediately, we keep both. But once rekeying triggers, we don't
refresh the SA with the shorter soft lifetime, but delete it.
 2012-06-08 10:22:03 +02:00
Martin Willi 51754f6654 Check if we actually have an initiating packet to free while processing responses 2012-05-23 11:50:12 +02:00
Martin Willi 17949695bf Cancel pending retransmits when flushing active task queue 2012-05-21 14:57:33 +02:00
Martin Willi 7ce504e182 Flush task queues explicitly, not implicitly if task returns ALREADY_DONE 2012-05-21 14:17:09 +02:00
Martin Willi a5c799602f Make task managers flush_queue() method public 2012-05-21 14:02:35 +02:00
Tobias Brunner 7a56c35fc9 Remove executable flag from source files. 2012-05-18 10:04:08 +02:00
Andreas Steffen 80c5b17d1a make IKEv1 DPD timeout configurable in charon 2012-05-17 19:49:22 +02:00
Martin Willi 24742c0f83 Moved IKEv1 DPD processing to task manager, fix sequence issues 2012-05-15 17:00:12 +02:00
Martin Willi 4b38c22c00 Schedule a DPD timeout job that enforces the IKE message timeout policy 2012-05-15 14:46:02 +02:00
Martin Willi ebf829f2eb Send unanswered follow up R_U_THERE messages with the same DPD seq 2012-05-15 14:46:02 +02:00
Martin Willi 57a8418c88 Do not send IKEv1 DPD retransmit, but create a new INFORMATIONAL 2012-05-15 14:46:02 +02:00
Tobias Brunner 42500c274a Use name from initialization to access settings in libcharon. 
Also fixes several whitespace errors.
 2012-05-03 13:57:04 +02:00
Tobias Brunner 8254e7ecb8 Implemented handling of UNITY_LOAD_BALANCE as reauthentication. 2012-03-20 17:31:40 +01:00
Tobias Brunner dcbdc914fa Compiler warning fixed. 2012-03-20 17:31:40 +01:00
Martin Willi 182d55b229 Use correct enum values to detect three message tasks for retransmission 2012-03-20 17:31:40 +01:00
Martin Willi fd6fbf1764 Setting message ID on task manager sets DPD sequence numbers in IKEv1 2012-03-20 17:31:38 +01:00
Martin Willi 47b8f6ef4b Invoke bus_t.message hook twice, once plain and parsed, once encoded and encrypted 2012-03-20 17:31:37 +01:00
Martin Willi 669d8bded2 Invoke child_rekey hook instead of child_updown when rekeying a quick mode 2012-03-20 17:31:36 +01:00
Martin Willi c654d949f3 Fix "incoming" flag passed to bus_t.message() hook 2012-03-20 17:31:36 +01:00
Martin Willi 477559cab5 Continue with next exchange after sending an INFORMATIONAL 2012-03-20 17:31:36 +01:00
Martin Willi 1b82eb23a2 Handle retransmission of DPD exchange, both as initiator and responder 2012-03-20 17:31:36 +01:00
Martin Willi ff6b084ac4 Confirm message reception time only if DPD sequence number valid 2012-03-20 17:31:35 +01:00
Martin Willi 2ddd45c9a7 Simplified DPD handling by using a task for a single message only 2012-03-20 17:31:35 +01:00
Martin Willi 3fca5bd123 Check if we have an RNG for IKEv1 task manager before using it 2012-03-20 17:31:35 +01:00
Martin Willi 31689338d6 Remove unused DPD sequence number getter on task manager 2012-03-20 17:31:35 +01:00
Clavister OpenSource 3e6b740336 Isakmp_dpd task added. 2012-03-20 17:31:35 +01:00