denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
14,851 Commits 1 Branch 0 Tags
ec9566ae24c3212924b04ab1d9f3ab9ca2fdc0df
Commit Graph
1145 Commits
Author SHA1 Message Date
Martin Willi 4dd8d5430d Merge branch 'multi-eap' 
Fixes the use of EAP methods in the non-first authentication round if the
initiator demands mutual EAP. Also mutual EAP can now be enforced when the
initiator sets rightauth=eap, not only with rightauth=any.
 2013-03-01 11:36:41 +01:00
Martin Willi b611d8ba48 Merge branch 'ikev1-rekeying' 
Migrates Quick Modes to the new Main Mode if an IKEv1 reauthentication replaces
the old Main Mode having a uniqueids=replace policy.
 2013-03-01 11:32:02 +01:00
Martin Willi a36b49f3cb Merge branch 'opaque-ports' 
Adds a %opaque port option and support for port ranges in left/rightprotoport.
Currently not supported by any of our kernel backends.
 2013-03-01 11:27:12 +01:00
Martin Willi 21dd4c4bea Without MOBIKE, update remote host only if it is behind NAT 2013-03-01 11:26:47 +01:00
Martin Willi 00683b6864 Merge branch 'ikev1-mm-retransmits' 
Fixes retransmit of the last Main Mode or IKE_AUTH message, and correctly
queues Main Mode messages when processing of the last message is still in
progress.
 2013-03-01 11:24:42 +01:00
Martin Willi d634109f1d Merge branch 'tfc-notify' 
Introduces kernel backend features, sends ESP_TFC_PADDING_NOT_SUPPORTED if
kernel does not support it.
 2013-03-01 11:16:58 +01:00
Martin Willi 5c55be4915 Send ESP_TFC_PADDING_NOT_SUPPORTED if the used kernel doesn't support it 2013-03-01 11:12:17 +01:00
Tobias Brunner 6e935c6fe0 Trigger an updown event when destroying an IKE_SA based on INITIAL_CONTACT 
In other cases (i.e. when functions return DESTROY_ME) the event should
already be triggered, but not in this forced situation.
 2013-02-28 18:07:29 +01:00
Martin Willi d8a94c18c6 Apply a mutual EAP auth_cfg not before the EAP method completes 2013-02-26 13:15:27 +01:00
Martin Willi cc787697b8 Be a little more verbose why a peer_cfg is inacceptable 2013-02-26 13:15:27 +01:00
Martin Willi 289b9b7b31 Refactor auth_cfg applying to a common function 2013-02-26 13:15:27 +01:00
Martin Willi e2857be823 For IKEv1 Main Mode, use message hash to detect early retransmissions 
As the message ID is zero in all Main Mode messages, it can't be used to detect
if we are already processing a given message.
 2013-02-25 12:12:38 +01:00
Martin Willi cdf75a39e3 Move initial message dropping to task manager 
When the last request message of the initial tunnel setup is retransmitted,
we must retransmit the response instead of ignoring the request.

Fixes #295.
 2013-02-25 12:12:19 +01:00
Martin Willi 9eaed7a5bb Use INIT macro to initialize IKE_SA manager entries 2013-02-25 12:10:02 +01:00
Martin Willi a1db77de7c Use a complete port range in traffic_selector_create_from_{subnet,cidr} 2013-02-21 11:52:33 +01:00
Martin Willi f836d433a9 When detecting a duplicate IKEv1 SA, adopt children, as it might be a rekeying 2013-02-20 08:57:17 +01:00
Martin Willi 4755ab505d Add a global return_success() method implementation 2013-02-14 17:17:45 +01:00
Martin Willi e212033ef2 Merge branch 'ike-dscp' 2013-02-14 17:11:35 +01:00
Andreas Steffen 2a421163bf make TNC client authentication type available to IMVs 2013-02-12 20:38:05 +01:00
Martin Willi 5b15bd5f9d Set configured DSCP value while generating IKE packets 2013-02-06 15:20:32 +01:00
Tobias Brunner 2ec3552fce Fix check-in of IKE_SA when IKE_SA_INIT fails and hash table is enabled 
Setting the responder SPI to 0 can only be done while generating the
response, otherwise we'd fail to check in the IKE_SA again in case the
hash table is enabled.  That's because we use the responder SPI as hash
value since 5.0.0.
 2013-01-24 19:13:40 +01:00
Tobias Brunner 4eb09d14e2 Avoid a deadlock when installing a trap policy failed 2013-01-23 15:51:47 +01:00
Adrian-Ken Rueegsegger cf3c72c480 Fix IKE SA inherit API doc 2013-01-22 11:02:20 +01:00
Tobias Brunner 66bb4f63b2 Properly send IKEv1 packets if no ike_cfg is known yet 
This applies for error notifies.
 2013-01-14 12:14:16 +01:00
Tobias Brunner 21235e1ec2 Merge branch 'ikev1-fragmentation' 
This adds support for the proprietary IKEv1 fragmentation extension.

Conflicts:
	NEWS
 2013-01-12 11:58:26 +01:00
Tobias Brunner ee6902ef7f Added an option to configure the maximum size of a fragment 2013-01-12 11:54:58 +01:00
Tobias Brunner 7ae245f685 Properly detect fragmentation capabilities 
Cisco sends 0xc0000000 so we check that part of the VID separately.
 2013-01-12 11:54:54 +01:00
Tobias Brunner 365d9a6f67 Added an option that allows to force IKEv1 fragmentation 2013-01-12 11:54:32 +01:00
Martin Willi 1954cc7720 Streamline debug output when receiving intermediate CA certificates in IKEv1 2013-01-11 10:24:23 +01:00
Martin Willi cde6a9ec9f Refactored IKEv2 cert/certreq payload processing to multiple functions 2013-01-11 10:21:56 +01:00
Martin Willi bf10ee9495 Refactored IKEv1 cert payload processing to multiple functions 2013-01-11 10:21:56 +01:00
Volker Rümelin 6d3e7a64a0 IKEv1 support for PKCS#7 wrapped certificates 2013-01-11 10:21:56 +01:00
Volker Rümelin 10eee5fcba Fixed some typos in comments 2013-01-11 10:21:51 +01:00
Tobias Brunner 97973f8609 Use a connection specific option to en-/disable IKEv1 fragmentation 2012-12-24 13:00:01 +01:00
Tobias Brunner e645c15b9c Include source port in init hash for fragmented messages 2012-12-24 12:29:31 +01:00
Tobias Brunner 2f62bb1549 Add an option to en-/disable IKE fragmentation 
Fragments are always accepted but will not be sent if disabled.  The
vendor ID is only sent if the option is enabled.
 2012-12-24 12:29:31 +01:00
Tobias Brunner 5cafefcd5d Split larger messages into fragments if IKE fragmentation is supported by peer 2012-12-24 12:29:31 +01:00
Tobias Brunner c4daac2c0b Log added NAT-T vendor IDs 2012-12-24 12:29:27 +01:00
Tobias Brunner 667720c801 Detect a peer's support for IKE fragmentation 
Fragments are accepted even if this vendor ID is not seen.
 2012-12-24 12:29:27 +01:00
Tobias Brunner fe26ddada9 Map fragmented initial initial Main or Aggressive Mode messages to the same IKE_SA 2012-12-24 12:29:27 +01:00
Tobias Brunner b816037739 Allow ID_PROT/AGGRESSIVE messages for established IKE_SAs if they contain fragments 
Other implementations send fragments always in an initial message type
even for transaction or quick mode exchanges.
 2012-12-24 12:29:27 +01:00
Tobias Brunner 8fc8383439 Don't handle fragmented messages larger than charon.max_packet 2012-12-24 12:29:27 +01:00
Tobias Brunner 7d85f94165 Don't update an IKE_SA-entry's cached message ID when handling fragments 2012-12-24 12:29:26 +01:00
Tobias Brunner 30216000d3 Store inbound IKE fragments and reassemble the message when all fragments are received 2012-12-24 12:29:26 +01:00
Martin Willi 656e01eab3 Add parantheses to avoid compiler warning 2012-12-24 10:12:23 +01:00
Tobias Brunner ef33a4ab82 Fixed some typos, courtesy of codespell 2012-12-20 09:35:26 +01:00
Adrian-Ken Rueegsegger ba8b28b67f Raise an alert if IKE SA is kept 
This alert is raised when the establishment of a child SA fails but the
IKE SA is kept.
 2012-12-20 09:15:07 +01:00
Volker Rümelin 0ff8d20a89 Add support for draft-ietf-ipsec-nat-t-ike-03 and earlier 
This adds support for early versions of the draft that eventually
resulted in RFC 3947.
 2012-12-19 11:03:42 +01:00
Martin Willi 45d6134218 Raise an alert if allocating virtual IPs fails 2012-12-19 10:40:33 +01:00
Martin Willi f285b9efc8 Raise an alert if kernel policy installation fails 2012-12-19 10:40:33 +01:00