 Clavister OpenSource
|
d82a68642d
|
XAUTH additions for certificates.
|
2012-03-20 17:31:12 +01:00 |
|
|
Clavister OpenSource
|
a874a1f50b
|
signature payload handling.
|
2012-03-20 17:31:12 +01:00 |
|
|
Clavister OpenSource
|
7d9269bfce
|
certificate handling for XAuth responder.
|
2012-03-20 17:31:11 +01:00 |
|
|
Clavister OpenSource
|
07abb470c6
|
IKEv1: Added basic support for INFORMATIONAL exchange types, and for NOTIFY_V1 messages in the 3rd message in quick_mode.
|
2012-03-20 17:31:11 +01:00 |
|
|
Clavister OpenSource
|
4394d96844
|
IKEv1 XAuth: Added a "NULL" XAuth plugin which sends a hardcoded user/pass, and blindly accepts whatever user/pass is sent it. Changed the xauth_request task to use this new plugin. Add --enable-xauth-null to your configure line to build with the new plugin.
|
2012-03-20 17:31:11 +01:00 |
|
|
Tobias Brunner
|
3bf0be6b08
|
Add NAT-OA payloads during Quick Mode if transport mode is used.
We don't parse them currently, as the Linux kernel does not need them to fix
the IP header checksum.
|
2012-03-20 17:31:11 +01:00 |
|
|
Tobias Brunner
|
29b0cb328a
|
Negotiate UDP encapsulation during Quick Mode if NAT is detected.
|
2012-03-20 17:31:10 +01:00 |
|
|
Tobias Brunner
|
1cc4ec46cf
|
Task added for IKEv1 NAT detection.
There is already support for both Main and Aggressive Mode.
|
2012-03-20 17:31:10 +01:00 |
|
|
Tobias Brunner
|
61e2a1ad8a
|
Create negotiated hasher earlier during Main Mode so it is available for building NAT-D payloads.
|
2012-03-20 17:31:10 +01:00 |
|
|
Clavister OpenSource
|
c5dc9d3383
|
IKEv1 XAuth: Moving the state change to IKE_CONNECTED until after XAuth exchanges are complete.
|
2012-03-20 17:31:10 +01:00 |
|
|
Tobias Brunner
|
06d29be714
|
Handle IKEv1 NAT-T vendor ID payload (only RFC 3947 for now).
|
2012-03-20 17:31:10 +01:00 |
|
|
Tobias Brunner
|
1e97783c99
|
Added payloads for IKEv1 NAT-Traversal negotiation.
|
2012-03-20 17:31:09 +01:00 |
|
|
Clavister OpenSource
|
3fa8db8b59
|
IKEv1 XAuth: Clean up debug prints in xauth_request task.
|
2012-03-20 17:31:09 +01:00 |
|
|
Clavister OpenSource
|
c961d110ab
|
IKEv1 XAuth + CfgMode: Added ability to process CfgMode messages in the xauth task. Migrated away from using the MIGRATE method to switch queues.
|
2012-03-20 17:31:09 +01:00 |
|
|
Clavister OpenSource
|
ef2eac7fb0
|
IKEv1 XAuth: Change the main_mode task to use the new initiate_xauth job instead of the old MIGRATE method.
|
2012-03-20 17:31:09 +01:00 |
|
|
Clavister OpenSource
|
2c49c53186
|
IKEv1 XAuth: Fix main mode to work with XAuth PSK.
|
2012-03-20 17:31:07 +01:00 |
|
|
Martin Willi
|
a2f8fc9711
|
Use a dedicated IKEv1 vendor ID task to fix using IKEv2 payloads in IKEv1
|
2012-03-20 17:31:07 +01:00 |
|
|
Martin Willi
|
abf9784786
|
Pass concrete auth_method to key derivation, as we have that as a responder
|
2012-03-20 17:30:53 +01:00 |
|
|
Martin Willi
|
b4e815354c
|
Map auth_class to auth method and IKEv1 proposal attribute
|
2012-03-20 17:30:53 +01:00 |
|
|
Martin Willi
|
cd0017d452
|
Exchange IKEv1 ESP SA proposal information
|
2012-03-20 17:30:53 +01:00 |
|
|
Martin Willi
|
132d5c56de
|
Exchange IKEv1 SA specific proposal data with SA payload
|
2012-03-20 17:30:52 +01:00 |
|
|
Martin Willi
|
e174e0d445
|
Added not-yet used sa_payload parameters used in IKEv1
|
2012-03-20 17:30:52 +01:00 |
|
|
Clavister OpenSource
|
b03c700d08
|
IKEv1 XAuth: Changed the xauth_request task to use the new MIGRATE status.
|
2012-03-20 17:30:52 +01:00 |
|
|
Clavister OpenSource
|
46897273d7
|
IKEv1 XAuth: Added new "swap_initiator" method to the standard task_t interface. This is needed for when we move a task from the passive queue to the active one. I'm not a huge fan of this method of doing things. Perhaps we should change task_t to have build_i, build_r, process_i, and process_r methods, and call the appropriate one from the task manager, since we have these methods for most tasks anyways.
|
2012-03-20 17:30:52 +01:00 |
|
|
Clavister OpenSource
|
cc50df9e6c
|
IKEv1 XAuth: XAuthInitPreShared working for XAuth initiator (Main Mode responder). Creates USER/PASS request, retrieves the result and sends status.
|
2012-03-20 17:30:52 +01:00 |
|
|
Clavister OpenSource
|
2d97ec0d35
|
IKEv1 XAuth: Added ability to initiate the XAuth transactions under a flag, default not to initiate XAuth.
|
2012-03-20 17:30:52 +01:00 |
|
|
Martin Willi
|
9cc38c8efb
|
Use quick mode task initiator flag instead of passing it as parameter
|
2012-03-20 17:30:51 +01:00 |
|
|
Martin Willi
|
4e0bc9af22
|
Add quick mode ID payloads only if establishing a non-host2host tunnel
|
2012-03-20 17:30:51 +01:00 |
|
|
Martin Willi
|
c4b8539f93
|
Refactored traffic selector handling in quick mode
|
2012-03-20 17:30:51 +01:00 |
|
|
Martin Willi
|
818330aafe
|
Refactored NONCE payload handling in quick mode
|
2012-03-20 17:30:51 +01:00 |
|
|
Tobias Brunner
|
78f7728c30
|
No need to build a HASH payload in XAUTH task.
It gets added automatically when the message is generated.
|
2012-03-20 17:30:51 +01:00 |
|
|
Martin Willi
|
c4c5950458
|
Create host-to-host traffic selectors if quick mode identities missing
|
2012-03-20 17:30:51 +01:00 |
|
|
Martin Willi
|
a7910b1c6e
|
Derive IKEv1 CHILD_SA keymat twice, once for each IPsec SA
|
2012-03-20 17:30:50 +01:00 |
|
|
Martin Willi
|
b6016fcab3
|
Fixed a config reference leak in IKEv2 initiate
|
2012-03-20 17:30:49 +01:00 |
|
|
Martin Willi
|
017d98bf39
|
Merged IKEv1 attribute payload/data into configuration payload/attribute
|
2012-03-20 17:30:49 +01:00 |
|
|
Clavister OpenSource
|
23f4e4b42d
|
IKEv1 XAUTH: Added ability to configure XAUTH+PSK. Added task to handle XAUTH requests. Modified task_manager_v1 to enable it to initiate new tasks immediately after finishing a response.
|
2012-03-20 17:30:49 +01:00 |
|
|
Clavister OpenSource
|
79e9f776dc
|
Updates ike_cert_post task with modifications needed for dealing with updated cert_payload class.
|
2012-03-20 17:30:49 +01:00 |
|
|
Martin Willi
|
5351d63c79
|
Install negotiated IKEv1 CHILD_SA negotiated in quick mode
|
2012-03-20 17:30:48 +01:00 |
|
|
Martin Willi
|
a0b52db079
|
Refactored main mode NONCE/KE payload processing
|
2012-03-20 17:30:47 +01:00 |
|
|
Martin Willi
|
a0f851cfe0
|
Refactored main mode HASH payload processing
|
2012-03-20 17:30:47 +01:00 |
|
|
Martin Willi
|
73380c8685
|
Skip any payloads in front of SA to extract initiators SA bytes
|
2012-03-20 17:30:47 +01:00 |
|
|
Martin Willi
|
21b7db99c6
|
Implemented quick mode protocol handling, no CHILD_SA or HASH payloads yet
|
2012-03-20 17:30:47 +01:00 |
|
|
Martin Willi
|
12b6a68a5f
|
Add missing keymat cast to avoid compiler warning
|
2012-03-20 17:30:47 +01:00 |
|
|
Martin Willi
|
1b99befac3
|
Create and verify PSK HASH payloads in IKEv1 main mode
|
2012-03-20 17:30:47 +01:00 |
|
|
Martin Willi
|
059d694a6b
|
Derive IKE keys as IKEv1 initiator, too
|
2012-03-20 17:30:46 +01:00 |
|
|
Tobias Brunner
|
0463674971
|
Use key derivation in IKEv1 main mode (PSK authentication).
|
2012-03-20 17:30:46 +01:00 |
|
|
Tobias Brunner
|
a0563846b0
|
Moved version specific keymat functions to specific interfaces.
|
2012-03-20 17:30:45 +01:00 |
|
|
Martin Willi
|
a09972df2b
|
Added a generic TASK_ prefix to all task types
|
2012-03-20 17:30:45 +01:00 |
|
|
Martin Willi
|
9124e3425b
|
Fixed reference counting bugs in main mode
|
2012-03-20 17:30:44 +01:00 |
|
|
Martin Willi
|
2b04aa46ea
|
Added a quick mode task stub
|
2012-03-20 17:30:44 +01:00 |
|