denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
14,807 Commits 1 Branch 0 Tags
fa5cfbdcbfdda3417a6d963c7d69c41746240dc4
Commit Graph
1120 Commits
Author SHA1 Message Date
Martin Willi 41080cbbd9 Migrated ike_rekey task to INIT/METHOD macros 2011-03-15 11:30:02 +01:00
Martin Willi 5f47296f22 Migrated sim_manager to INIT/METHOD macros 2011-03-08 16:42:27 +01:00
Martin Willi 7b3bfe4b6c Protect sim card/provider/hook (un-)registration with a rwlock 2011-03-08 16:42:27 +01:00
Martin Willi f58db72482 Splitted sim_manager.h header to sim_{card,provider,hooks}.h 2011-03-08 16:42:27 +01:00
Martin Willi e44ebdcfc8 Slightly change IKE_SA destruction order to inherit properly during ike_rekey task destruction 2011-02-28 10:31:36 +00:00
Martin Willi 94030a670b Report correct key size if a cipher is not supported 2011-02-07 16:39:33 +01:00
Tobias Brunner 84545f6e7c Some typos fixed. 2011-02-07 11:39:41 +01:00
Martin Willi b49d047bfc Invoke the per-round authorize() hook before purging current auth info on IKE_SA 2011-02-03 17:08:39 +01:00
Martin Willi 2b7686b5d8 Migrated ike_auth to INIT/METHOD macros, fixes missing initial_contact initialization 2011-02-02 15:13:39 +01:00
Martin Willi 1d34612f07 Do not use destroyed rng/hasher if IKE_SA has been flush()ed 2011-02-01 09:25:55 +01:00
Martin Willi 5c89a00f05 Do not log potentially hundreds of cert requests for unknown CAs at level 1 2011-01-28 08:29:23 +01:00
Martin Willi 983a5e88d3 Revert "Send INITIAL_CONTACT even if we have a unique policy" 
It makes sense to omit INITIAL_CONTACT if don't have a unique policy,
as a client might want to connect from different devices to the same
account.

This reverts commit 719c33b41a.
 2011-01-13 10:50:46 +01:00
Martin Willi 2082417df3 Force port update as responder when initiator switches to 4500 in IKE_AUTH 2011-01-12 14:37:15 +01:00
Martin Willi 8ba805f4db Avoid variable name overloading 2011-01-12 14:37:09 +01:00
Martin Willi 719c33b41a Send INITIAL_CONTACT even if we have a unique policy 2011-01-10 11:54:10 +01:00
Martin Willi 1ed482d808 Fix nonce comparison in rekey collisions, lowest nonce loses 2011-01-07 15:51:35 +01:00
Martin Willi 6f5892f5c7 Destroy existing IKE_SAs with same identities when receiving INITIAL_CONTACT 2011-01-05 16:46:08 +01:00
Martin Willi a4a1e24d37 Send INITIAL_CONTACT for the first IKE_SA if it has a unique policy 2011-01-05 16:46:08 +01:00
Martin Willi 240bd7dbb7 Migrated ike_sa_manager_t to INIT/METHOD macros, some cleanups 2011-01-05 16:46:08 +01:00
Martin Willi 3a89b3c52f Provide CRLs received in CERT payloads to trustchain verification 2011-01-05 16:46:06 +01:00
Martin Willi 5f15faebc8 Include the used reserved bytes from ID payloads in AUTH calculation 2011-01-05 16:45:53 +01:00
Martin Willi 502edf425f Migrated psk/pubkey_authenticators to INIT/METHOD macros 2011-01-05 16:45:53 +01:00
Martin Willi 9ca5d0280e Moved check if packet already encoded to ike_sa, avoids message() hook invocation twice 2011-01-05 16:45:52 +01:00
Martin Willi c67de660d2 Move critical bit checking to ike_sa, notify payload includes unsupported payload type 2011-01-05 16:45:44 +01:00
Martin Willi e7099aa24e Handle all error notifies in CREATE_CHILD_SA exchanges 2011-01-05 16:45:44 +01:00
Martin Willi c146c3c4e1 Ingore messages with exchange type altered to UNDEFINED in message() hook 2011-01-05 16:45:42 +01:00
Martin Willi 89fda1abb5 Moved message()-hook invocation to generate_message(), catch pre-generated IKE_SA_INITs, too 2011-01-05 16:45:41 +01:00
Martin Willi 6c2d466b90 Support manually triggerd DPD check, even if DPD disabled in config 2011-01-05 16:45:40 +01:00
Andreas Steffen 905ab99fc1 eliminated whitespace 2010-12-21 17:51:27 +01:00
Andreas Steffen cf16a29dac Migrated child_create_t to INIT/METHOD macros 2010-12-21 17:49:07 +01:00
Martin Willi 55df72e6d5 Do not use TFC padding if peer does not support ESPv3 2010-12-20 09:45:39 +01:00
Martin Willi 37788b1d06 Added a TFC padding option to child_cfg 2010-12-20 09:45:39 +01:00
Martin Willi d86bb6ef4d Implemented Traffic Flow Confidentiality padding in kernel_interface 2010-12-20 09:45:39 +01:00
Jiri Bohac 19b7f763b3 Install selectors on transport mode IPsec SAs. 
This fixes several test cases in IKEv2_Self_Test (part of the IPv6 Ready
Logo Program) which is required for USGv6 certification, namely:

  - IKEv2.EN.I.1.1.7.1, IKEv2.EN.I.1.1.7.1: Narrowing the range of members
    of the set of traffic selectors
  - IKEv2.EN.R.1.1.7.3: Narrowing multiple traffic selector

When traffic selectors of a triggered SA are narrowed by the responder, the
installed policy and the broader trap policy share the same reqid.  Without
selectors on the IPsec SA packets matching the trap policy, but not the
narrowed policy, would incorrectly be handled by that IPsec SA.  Since only
one selector can be specified per IPsec SA, there is currently no solution
for tunnel mode SAs.
 2010-12-13 15:28:40 +01:00
Martin Willi 86993d6b90 Never register IKE_SA during checkout_new, as rekeying keeps it checked out 2010-12-07 16:30:38 +01:00
Thomas Egerer 76ce213c43 Guarantee entry->other is set when calling put_connected_peers 
Given the original intent of entry->host, the check for DoS attacks, it
can happen that this value remains NULL when an entry is created. This
is particularly awkward if put_connected_peers is called to check if a
connection to a given peer already exists, since it takes the address
family into consideration (git commit b74219d0) which is gleaned from
entry->host.
This patch guarantees that entry->other is a clone of host before
put_connected_peers is called.
 2010-12-06 10:56:57 +01:00
Thomas Egerer e66420566c Do not checkin a previously destroyed SA 2010-11-16 10:25:33 +01:00
Thomas Egerer 8f927116be Extend connected peers by peer family 
This allows for simultanious IPv4 and IPv6 tunnel for same peers with
matching identities.
 2010-11-12 16:28:04 +01:00
Tobias Brunner 1dbf0ed982 Do not add additional addresses to MOBIKE path probing messages. 2010-10-12 11:11:06 +02:00
Tobias Brunner 5774408898 Change behavior of responder during roaming. 
If the current source address is not available anymore, the responder
uses ike_mobike_t.roam, thus, uses multiple address combinations when
trying to notify the initiator.
 2010-10-12 11:11:05 +02:00
Tobias Brunner c5770f864f Allow responder to use ike_mobike_t.roam. 
After getting a response the responder updates the IPsec SAs.
 2010-10-12 11:11:05 +02:00
Tobias Brunner 261b2572d1 Send list of additional addresses even if current path is still valid. 2010-10-12 11:11:05 +02:00
Tobias Brunner bab56a4abb Extracted path checking in ike_sa_t.roam into separate functions. 2010-10-12 11:11:05 +02:00
Tobias Brunner 769c69facc Added support for responders to change their address via MOBIKE. 
If the original responder updates its list of additional addresses we
check if the remote endpoint changed and update the IPsec SAs if it did,
as we assume the original address became unavailable and the responder
already updated the SAs on its side.
 2010-10-12 11:11:05 +02:00
Tobias Brunner 13876431d6 Explicitly configure MOBIKE tasks to update the list of additional addresses. 2010-10-12 11:11:05 +02:00
Tobias Brunner 31e7dc4dfd Improved check for first IKE_AUTH message in ike_mobike task. 
If the original responder initiated a MOBIKE exchange, the previous
check was not always correct.
 2010-10-12 11:11:05 +02:00
Tobias Brunner c817e7bb90 Migrated ike_mobike task to INIT/METHOD macros. 2010-10-12 11:11:05 +02:00
Tobias Brunner be90134211 Simplified apply_port function in mobike task. 2010-10-12 11:11:04 +02:00
Tobias Brunner cd26eedc5c Do not update hosts based on retransmitted messages. 2010-10-12 11:11:04 +02:00
Tobias Brunner d5bd775126 Do not update remote host if we are behind a NAT. 2010-10-12 11:11:04 +02:00