denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
11,900 Commits 1 Branch 0 Tags
ef4560121dd5590b53b52ad1a048766fba90e8e2
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Martin Willi ef4560121d testing: Add an IKEv1 net2net AH test case 2013-10-11 10:15:22 +02:00
Martin Willi 80a82b8d67 testing: Add an IKEv2 host2host AH transport mode test case 2013-10-11 10:15:22 +02:00
Martin Willi 850bab6d58 testing: Add an IKEv2 net2net AH test case 2013-10-11 10:15:22 +02:00
Martin Willi 71d468ec90 testing: Allow AH packets in default INPUT/OUTPUT chains 2013-10-11 10:15:22 +02:00
Martin Willi 4817595876 updown: Install forwarding rules with the actually used protocol 2013-10-11 10:15:22 +02:00
Martin Willi c5d9b133e0 updown: Add a PLUTO_PROTO variable set to 'ah' or 'esp' 2013-10-11 10:15:21 +02:00
Martin Willi e48e530b44 starter: Reject connections having both 'ah' and 'esp' keywords set 
We currently don't support mixed proposals or bundles, so don't create the
illusion we would.
 2013-10-11 10:15:21 +02:00
Martin Willi 757343d90e ike: Define keylength for aescmac algorithm 2013-10-11 10:15:21 +02:00
Martin Willi a1379e3210 ikev1: Support parsing of AH+IPComp proposals 2013-10-11 10:15:21 +02:00
Martin Willi 25f74be8f9 starter: Remove obsolete 'auth' option 2013-10-11 10:15:21 +02:00
Martin Willi d489e75579 ikev1: Accept more than two certificate payloads 2013-10-11 10:15:21 +02:00
Martin Willi 3771b85806 ikev1: Support en-/decoding of SA payloads with AH algorithms 2013-10-11 10:15:21 +02:00
Martin Willi 44e6aa4fb7 kernel-handler: Whitespace cleanups 2013-10-11 10:15:21 +02:00
Martin Willi f6037b5506 stroke: List proposals in statusall without leading '/' in AH SAs 2013-10-11 10:15:21 +02:00
Martin Willi 4bf92306eb ikev1: Delete quick modes with the negotiated SA protocol 2013-10-11 10:15:21 +02:00
Martin Willi 5d569e07fd trap-manager: Install trap with SA protocol of the first configured proposal 2013-10-11 10:15:21 +02:00
Martin Willi 21b096f3b8 child-sa: Save protocol during SPI allocation 
This allows us to properly delete the incomplete SA with the correct protocol
should negotiation fail.
 2013-10-11 10:15:21 +02:00
Martin Willi 908fe1632d ikev1: Negotiate SPI with the first/negotiated proposal protocol 2013-10-11 10:15:21 +02:00
Martin Willi cdab8630d9 ikev2: Allocate SPI with the protocol of the first/negotiated proposal 2013-10-11 10:15:21 +02:00
Martin Willi f0c59e1cf8 proposal: Strip redundant integrity algos for ESP proposals only 2013-10-11 10:15:21 +02:00
Martin Willi 0576412989 stroke: Configure proposal with AH protocol if 'ah' option set 2013-10-11 10:15:20 +02:00
Martin Willi a07b97e804 starter: Add an 'ah' keyword for Authentication Header Security Associations 2013-10-11 10:15:20 +02:00
Martin Willi d2e4dd75b7 ikev1: Accept reauthentication attempts with a keep unique policy from same host 
When we have a "keep" unique policy in place, we have to be less strict in
rejecting Main/Aggressive Modes to enforce it. If the host/port equals to
that of an existing ISAKMP SA, we assume it is a reauthentication attempt
and accept the new SA (to replace the old).
 2013-09-30 13:51:12 +02:00
Martin Willi 9c19d7ca31 ikev1: Don't log a reauthentication detection message if no children adopted 
When a replace unique policy is in place, the children get adopted during
the uniqueness check. In this case the message is just misleading.
 2013-09-30 13:51:11 +02:00
Martin Willi ee99f37ecc ikev1: Delay a potential delete for a duplicate IKE_SA having a replace policy 
Sending a DELETE for the replaced SA immediately is problematic during
reauthentication, as the peer might have associated the Quick Modes to the
old SA, and also delete them.

With this change the delete for the old ISAKMP SA is usually omitted, as it
is gets implicitly deleted by the reauth.
 2013-09-30 13:51:11 +02:00
Martin Willi 25260a290d .gitignore: Add .dirstamp files touched by automake 2013-09-13 14:12:35 +02:00
Martin Willi 2b84ccd6a6 libipsec: fix memory management when cloning ip_packet 2013-09-13 13:56:44 +02:00
Martin Willi 96136a1229 libipsec: check for a policy with the reqid of the SA on decapsulation 
To prevent a client from sending a packet with a source address of a different
client, we require a policy bound via reqid to the decapsulating SA.
 2013-09-13 13:56:43 +02:00
Martin Willi 791fde1669 stroke: don't remove a matching peer config if used by other child configs 
When configurations get merged during add, we should not remove peer configs
if other connection entries use the same peer config.
 2013-09-13 13:56:31 +02:00
Martin Willi 38fb8e4ed5 NEWS: 5.1.1 update for merged branches 2013-09-04 11:06:58 +02:00
Martin Willi 1fd5c7fbac load-tester: support extended traffic selector syntax, as in leftsubnet 
In addition the initiator may use %unique as port, using a distinct port for
each connection, starting from 1025.
 2013-09-04 10:49:48 +02:00
Martin Willi 47b4a51402 load-tester: add an option to test transport/beet connections 2013-09-04 10:49:48 +02:00
Martin Willi 60fcbb8ba8 Merge branch 'ike-address-ranges' 
Adds support for multiple subnets and address ranges in left/right ipsec.conf
options. As responder the connection is acceptable if the address is in one of
the ranges/subnets. To initiate connections, at least one single IP or hostname
is required for the peer address.
 2013-09-04 10:43:35 +02:00
Martin Willi 6301ec0ac5 man: add support for multiple addresses/ranges/subnets in ipsec.conf left= 2013-09-04 10:38:37 +02:00
Martin Willi 3070697f9f ike: support multiple addresses, ranges and subnets in IKE address config 
Replace the allowany semantic by a more powerful subnet and IP range matching.
Multiple addresses, DNS names, subnets and ranges can be specified in a comma
separated list. Initiators ignore the ranges/subnets, responders match
configurations against all addresses, ranges and subnets.
 2013-09-04 10:38:37 +02:00
Martin Willi beffdc6ab8 ike-cfg: remove the to be obsoleted allow any parameter in get_my/other_addr 2013-09-04 10:38:37 +02:00
Martin Willi 62282ec0ed backends: use ike_cfg host matching functions 2013-09-04 10:38:37 +02:00
Martin Willi 6f666192bb ike-cfg: add methods to match a host against configured local/remote addresses 2013-09-04 10:38:37 +02:00
Martin Willi 7446fa2860 trap-manager: use ike_cfg resolver functions 2013-09-04 10:38:37 +02:00
Martin Willi 0edce68767 ike-sa: use ike_cfg resolver functions 2013-09-04 10:38:36 +02:00
Martin Willi e743275cae ike-cfg: add a method to resolve local/remote hosts with port 2013-09-04 10:38:36 +02:00
Martin Willi f7cb6eaaa8 Merge branch 'ikev1-pushmode' 
Implements Mode Config Push mode in IKEv1 using the existing modeconfig=push
ipsec.conf option.
 2013-09-04 10:35:26 +02:00
Martin Willi a858064455 stroke: ignore a leftsourceip if a rightsourceip is given as well 
As we always negotiate virtual IPs in charon, having both left- and
rightsourceip is not allowed. Both in IKEv1 and IKEv2 we support a single
configuration payload exchange only.
 2013-09-04 10:33:38 +02:00
Martin Willi 16149401e9 man: update ipsec.conf modeconfig keyword 2013-09-04 10:33:38 +02:00
Martin Willi e3311e9b87 ikev1: implement mode config push mode 2013-09-04 10:33:38 +02:00
Martin Willi 2bae838d5e stroke: re-enable modeconfig keyword 2013-09-04 10:33:38 +02:00
Martin Willi 9aeaa7396e peer-cfg: add a pull/push mode option to use with mode config 2013-09-04 10:33:37 +02:00
Martin Willi 478f9e772b Merge branch 'xauth-radius-multi' 
Introduces multiple rounds in the eap-radius XAuth backend, concatenating
answers to a single password to verify using a RADIUS User-Password attribute.
This is known to work fine with iOS and OS X clients, allowing two-factor
authentication with proper dialogs.

Different XAuth "profiles" for each backend can be selected using a generic
colon sperated suffix for the XAuth string.
 2013-09-03 16:36:25 +02:00
Martin Willi e8b36eb92f charon-cmd: support prompting for a PIN 
To support a Password and PIN XAuth combo, additionally support multiple
prompts for different credential types.
 2013-09-03 16:26:19 +02:00
Martin Willi 45797bd50b xauth-generic: honor requested XAuth credential types as a client 
Support requesting of XAuth PINs and print XAuth messages.
 2013-09-03 16:26:19 +02:00
Martin Willi 3482cc9cf6 attributes: shorten some Unity and XAuth attribute short names 2013-09-03 16:26:19 +02:00
Martin Willi 61b0079881 message: print type of configuration payload 2013-09-03 16:26:19 +02:00
Martin Willi 8e4b258030 message: print attributes for IKEv1 configuration payloads as well 2013-09-03 16:26:19 +02:00
Martin Willi d787ada894 eap-radius: support XAuth configuration profiles, defining multiple XAuth rounds 2013-09-03 16:26:19 +02:00
Martin Willi 510ecf612a xauth: add a configuration string option to be passed to XAuth instances 
The configuration string is appended to the XAuth backend name, separated by
a colon. The configuration string is passed untouched to the backend, where
it can change the behavior of the XAuth module.
 2013-09-03 16:26:19 +02:00
Martin Willi b656f63efe testing: support a .gitignored testing.conf.local for site-local configurations 2013-08-29 15:55:23 +02:00
Martin Willi a0cd955f42 charon-xpc: add a note how to build the source tarball 2013-08-29 12:28:54 +02:00
Martin Willi 74ee1120d7 charon-xpc: include and prefer AES-GCM algorithms in ESP proposal 2013-08-29 11:37:07 +02:00
Martin Willi 49032d15be stroke: stop enumerating IKE_SAs in statusall if output stream gets closed 
If the output stream is not interested in more information, it can close the
the stream. Checking for stream errors avoids useless enumeration of IKE_SAs,
saving resources. This allows to use "ipsec statusall | head" to monitor the
daemon, or stop enumerating IKE_SAs after a specific entry has been found.
 2013-08-23 14:27:17 +02:00
Martin Willi a24515c515 backtrace: rename clone() method clashing with system call 
Fixes #376.
 2013-08-09 09:13:39 +02:00
Martin Willi 881e9a7e2e updown: remove description of unsupported PLUTO_ variables 
These have been set by pluto, but are not by charons updown plugin.
 2013-08-08 14:48:32 +02:00
Martin Willi 3b6d8855e8 scripts: link against librt only if required 
With glibc, this seems to be the case for 2.17 and older versions only.
 2013-08-08 09:12:52 +02:00
Martin Willi 62e1c80803 scripts: link malloc_speed against librt 2013-08-08 09:09:00 +02:00
Martin Willi 8fa7c5c191 charon-xpc: load missing ctr/ccm/gcm plugins 2013-07-31 16:28:11 +02:00
Martin Willi aafb6fa6c2 charon-xpc: use kernel-libipsec instead of kernel-pfkey 2013-07-31 11:41:37 +02:00
Martin Willi 546235d34c charon-xpc: fix TS getting after changing CHILD_SA API 2013-07-31 11:41:31 +02:00
Martin Willi 83a0b74da8 keychain: be less verbose when loading certificates 2013-07-31 11:41:16 +02:00
Martin Willi 68957d1811 NEWS: mention xauth-radius backend in eap-radius plugin 2013-07-29 11:08:54 +02:00
Martin Willi 2cfe88aacb testing: enforce xauth-eap in ikev1/xauth-rsa-eap-md5-radius 
As eap-radius now provides its own XAuth backend and eap-radius is loaded before
xauth-eap, we have to enforce the exact XAuth backend to use.
 2013-07-29 10:35:59 +02:00
Martin Willi 14dfdf7dac Merge branch 'xauth-radius' 
Implements verification of XAuth credentials using simple RADIUS User-Name and
(encrypted) User-Password attributes. The XAuth backend is implemented in the
eap-radius plugin, reusing all existing infrastructure and features found in
that plugin, including RADIUS accounting.
 2013-07-29 09:00:56 +02:00
Martin Willi 9d75f04eee testing: add a testcase for plain XAuth RADIUS authentication 2013-07-29 09:00:49 +02:00
Martin Willi 44bb1dc3da charon-cmd: add --eap-identity and --xauth-username options 2013-07-29 09:00:49 +02:00
Martin Willi 3a399574c2 eap-radius: do RADIUS/IKE attribute forwarding in XAuth backend 2013-07-29 09:00:49 +02:00
Martin Willi c434b2a4a9 eap-radius: support plain XAuth RADIUS authentication using User-Password 2013-07-29 09:00:49 +02:00
Martin Willi 6bc0ce020d libradius: support encryption of User-Password attributes 2013-07-29 09:00:48 +02:00
Martin Willi 84044f9c73 utils: add round_up/down() helper functions 2013-07-29 09:00:48 +02:00
Martin Willi 15483a6223 libradius: refactor generic RADIUS en-/decryption function to a message method 2013-07-29 09:00:48 +02:00
Martin Willi 9aeb6cea4c eap-radius: export function to build common attributes of Access-Request 2013-07-29 09:00:48 +02:00
Martin Willi 94ec80e74c eap-radius: export function to process common attributes of Access-Accept 2013-07-29 09:00:48 +02:00
Martin Willi 7612a6e42f mem-pool: add option for reusing online leases, and disable it by default 
Mainly for reauthentication with third party implementations, we allowed to
reuse an online lease, but only for the same peer identity and when it
explicitly requested the same address.

This has always been problematic, because it changes the reqid of the CHILD_SA
with the same traffic selectors, breaking the old tunnel. As we now reject
such policy overwrites, this usually lets the installation of the new policies
fail. We therefore disable reassignment of online leases by default.
 2013-07-29 08:56:09 +02:00
Martin Willi c5d2d867f1 mem-pool: replace per-identity online/offline lists by more efficient arrays 
This saves two lists per connected peer identity, up to 0.4KB.
 2013-07-29 08:55:21 +02:00
Martin Willi d882880e87 mem-pool: refcount online lease when reassigning it to another tunnel 
When we reassign an online lease for the same peer, we have to refcount it.
Otherwise we would set it offline if one of the tunnels goes down, but it is
actually still in use by a the second tunnel. This can finally lead in
assigning the same virtual IP to different peers.
 2013-07-26 13:12:22 +02:00
Martin Willi dcd5129c25 processor: force synchronous execute_job() if set_threads(0) has been called 
During daemon shutdown, some idle threads might be lingering around even if
set_threads(0) already has been called. To avoid any races, we enforce
synchronous execution of the job.
 2013-07-19 15:30:22 +02:00
Martin Willi 2fa92ad256 proposal: correctly enumerate registered AEADs to build default IKE proposal 
AEADs are not returned (anymore) with the encryption enumerator.
 2013-07-19 15:05:17 +02:00
Martin Willi cb6c4e0430 identification: parse identities having a "@@" prefix as ID_RFC822_ADDR 
Original patch by Gerald Richter.
 2013-07-18 16:45:10 +02:00
Martin Willi c3b8335cfb NEWS: mention watcher and stream services 2013-07-18 16:10:48 +02:00
Martin Willi 666dff70eb Merge branch 'ipc-service' 
Adds network transparency and TCP support to the IPC interfaces of different
plugins using the new stream and stream service classes. A central watcher
thread can watch multiple file descriptors to handle connection requests
for these and other services using only a single thread.
 2013-07-18 16:03:14 +02:00
Martin Willi b4b3959b22 stream-service: move CAP_CHOWN check from plugins to service constructor 
A plugin service can be a TCP socket now, so it does not make much sense
to strictly check for CAP_CHOWN.
 2013-07-18 16:00:31 +02:00
Martin Willi 1897dd730f processor: remove the now unused get_threads() method again 2013-07-18 16:00:31 +02:00
Martin Willi ea009869e9 watcher: use processors new execute_job() to notify FDs 
Just queueing is problematic, as all threads might be busy waiting for events
that the queued (but never executed) job delivers.
 2013-07-18 16:00:31 +02:00
Martin Willi 6653e6c13e processor: add an execute_job() method to directly execute an important job 
If all worker threads are busy and waiting for an event, we must ensure that
a job delivering that event gets executed. This new method has this property
for CRITICAL jobs, using a worker if we have one, but executing the job directly
if not.
 2013-07-18 16:00:31 +02:00
Martin Willi 55240835b0 watcher: properly support multiple watch callback types for the same FD 2013-07-18 16:00:31 +02:00
Martin Willi d0c25a3f23 watcher: read multiple notifications if available 
Use non-blocking I/O on the read end of the notify pipe. This also makes sure
the read does not block should select() signal data while there is none.
 2013-07-18 16:00:31 +02:00
Martin Willi 8fc89db7b6 certexpire: add an option to enforce exporting trustchains having a private key 2013-07-18 16:00:31 +02:00
Martin Willi 868abd0626 error-notify: catch and forward some alerts related to certificate validation 2013-07-18 16:00:30 +02:00
Martin Willi 58750670cf bus: raise certificate validation alerts using credential manager hook 2013-07-18 16:00:30 +02:00
Martin Willi 4d7a762871 credmgr: introduce a hook function to catch trust chain validation errors 2013-07-18 16:00:30 +02:00
Martin Willi f7cff7fac4 lookip: double size of id field in message 2013-07-18 16:00:30 +02:00
Martin Willi f33d1d503f error-notify: increase size of string/identity fields in messages 2013-07-18 16:00:30 +02:00
Martin Willi 0a35ae781d whitelist: use a read-copy when listing entries 
While this requires a little more overhead, we can free the lock should the
stream block, allowing other threads to add/remove entries.
 2013-07-18 16:00:30 +02:00