denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
10,019 Commits 1 Branch 0 Tags
fdee6b5f5a7d711d68a77088b1e757fb6452bdee
Commit Graph
726 Commits
Author SHA1 Message Date
Tobias Brunner fdee6b5f5a Moved packet_t and tun_device_t to networking folder 2012-10-24 15:06:18 +02:00
Martin Willi 418f4bc7a5 Raise a bus alert when IKE message body parsing fails 2012-10-24 11:34:30 +02:00
Martin Willi f6f16131d0 Raise a bus alert when a received message contains unknown SPIs 2012-10-24 11:34:30 +02:00
Martin Willi 7910116384 Respect IKE version while selecting an ike_cfg as responder 2012-10-24 10:19:33 +02:00
Tobias Brunner 21037942e8 Update routed connections in trap manager 
Before this change, modified configs that have been updated with ipsec reload,
could properly be started manually, but the old config would get used if
triggered via trap policies.
 2012-10-18 14:42:10 +02:00
Tobias Brunner 1d6dc62727 Added a new alert that is raised if peer does not respond to initial IKE message 2012-10-16 14:16:17 +02:00
Tobias Brunner 48651d8d02 Ensure UNSUPPORTED_CRITICAL_PAYLOAD notify contains correct payload type 2012-09-28 22:31:06 +02:00
Tobias Brunner 2a43350334 Missed one in 6c10cece 2012-09-28 20:55:40 +02:00
Tobias Brunner 3973ffa4f6 Request is never NULL when responding with an INFORMATIONAL message 2012-09-28 19:10:03 +02:00
Tobias Brunner 6c10cecebf Completed state handling in isakmp_cert_pre 
Should not be a problem, but makes static analyzers happy.
 2012-09-28 19:01:09 +02:00
Tobias Brunner 2d39f79b9b IKE_AUTH_LIFETIME task is not defined if IKEv2 is disabled 
Fixes #229.
 2012-09-25 09:31:47 +02:00
Tobias Brunner 4106aea8e4 Made IP address enumeration more flexible 
Also added an option to enumerate addresses on ignored interfaces.
 2012-09-21 18:16:26 +02:00
Tobias Brunner aed33805ce Don't ignore loopback devices and allow addresses on them being enumerated 2012-09-21 18:16:26 +02:00
Martin Willi 336dd7a9c7 Don't complain about multiple TS in IKEv1, as it supported with Unity 2012-09-18 17:17:48 +02:00
Martin Willi 7ee37114c9 Derive a dynamic TS to multiple virtual IPs 2012-09-18 17:11:03 +02:00
Martin Willi abdb82fcc5 Use the vararg list constructor in quick mode task 2012-09-18 17:11:03 +02:00
Tobias Brunner 3a8852c76f Add AUTH_RULE_IDENTITY_LOOSE which allows to use IDr loosely as initiator 
If it is set on an auth config IDr will not be sent, and later the configured
identity will not only be checked against the returned IDr, but also
against other identities contained in the responder's certificate.
 2012-09-18 11:16:10 +02:00
Tobias Brunner a889cfe5e1 Change traffic selectors during Quick Mode in case of a NAT in transport mode 
Windows 7 sends its internal address as TSi.  While we don't support the
NAT-T drafts as used by Windows XP it is interesting to note that the
client there omits the TSi payload which then would automatically get set
to the public IP address of the client.

Fixes #220.
 2012-09-14 09:40:18 +02:00
Martin Willi d4cca1beea Always send a configuration payload in IKEv1 TRANSACTIONs, even if it is empty 2012-09-11 17:20:17 +02:00
Martin Willi c4acf37502 Don't use host address for dynamic TS in IKEv1 if a virtual IP was expected 2012-09-11 16:18:29 +02:00
Martin Willi 7d82aaea8d Don't use host address for dynamic TS in IKEv2 if a virtual IP was expected 2012-09-11 16:18:28 +02:00
Martin Willi c7294f7a58 Send FAILED_CP_REQUIRED if a configuration payload was expected, but not received 2012-09-11 16:18:28 +02:00
Martin Willi 28a3d5bfbd Pass full pool list to release_address 2012-09-11 16:18:28 +02:00
Martin Willi 594c58e111 Pass the full list of pools to acquire_address, enumerate in providers 
If the provider has access to the full pool list, it can enumerate
them twice, for example to search for existing leases first, and
only search for new leases in a second step.

Fixes lease enumeration in attr-sql using multiple pools.
 2012-09-11 16:18:28 +02:00
Martin Willi f942588f95 Add a responder narrow() hook to change TS in the kernel, but not on the wire 2012-09-11 16:14:39 +02:00
Tobias Brunner f4cc7ea11b Add uniqueids=never to ignore INITIAL_CONTACT notifies 
With uniqueids=no the daemon still deletes any existing IKE_SA with the
same peer if an INITIAL_CONTACT notify is received.  With this new option
it also ignores these notifies.
 2012-09-10 17:37:18 +02:00
Tobias Brunner bcf8cdd556 Only initiate an exchange from send_dpd() if a task was actually queued 
Otherwise, the initiator would prematurely initiate Quick Mode if it has
DPD enabled and XAuth is used.
 2012-09-07 18:05:22 +02:00
Tobias Brunner 3babde90bb Trigger ike_updown event caused by retransmits only after reestablish() has been called 
This allows listeners to migrate to the new IKE_SA with the
ike_reestablish event without having to worry about an ike_updown event
for the old IKE_SA.
 2012-09-06 11:27:28 +02:00
Tobias Brunner 4dbb193190 Add ike_reestablish() event that is triggered when an IKE_SA is reestablished 
This is particularly useful during reauthentication to get the new
IKE_SA.
 2012-09-06 11:25:14 +02:00
Tobias Brunner 873b63b771 Add a new condition to mark IKE_SAs that are currently being reauthenticated 2012-09-06 11:23:11 +02:00
Tobias Brunner d2e8f20d94 Clear virtual IPs before storing assigned ones on the IKE_SA 
Otherwise we'll end up with duplicate or invalid VIPs stored on the
IKE_SA.
 2012-09-05 14:35:57 +02:00
Martin Willi 4c892fe533 In mode_config, destroy temporary pool list instead of the virtual IP list twice 2012-09-05 14:18:52 +02:00
Martin Willi 1323dc1138 Merge branch 'multi-vip' 
Brings support for multiple virtual IPs and multiple pools in
left/rigthsourceip definitions. Also introduces the new left/rightdns
options to configure requested DNS server address family and respond
with multiple connection specific servers.
 2012-08-31 12:55:56 +02:00
Tobias Brunner 868409139b Merge branch 'eap-client-select' 
This brings support for EAP-Nak payloads on the client (to select a
specific or supported method), and the server (via the eap-dynamic
plugin which selects a method supported/requested by the client).
 2012-08-31 12:25:41 +02:00
Tobias Brunner 7f2e3091ee Log the proper type for virtual EAP methods 2012-08-31 11:42:03 +02:00
Tobias Brunner cc4eec56f7 Encode EAP-Naks in expanded format if we got an expanded type request 
Since methods defined by the IETF (vendor ID 0) could also be encoded in
expanded type format the previous check was insufficient.
 2012-08-31 11:40:27 +02:00
Tobias Brunner 78e8dca94f Allow clients to request a configured EAP method via EAP-Nak 2012-08-31 11:40:27 +02:00
Tobias Brunner 34742f1bf8 Virtual EAP methods handle EAP-Naks themselves 2012-08-31 11:40:27 +02:00
Tobias Brunner af04233e14 Send EAP-Nak with supported types if requested type is unsupported 2012-08-31 11:40:27 +02:00
Tobias Brunner 7cad171da8 Filter invalid EAP authentication types when enumerating them 
Valid authentication types defined by the IETF are 4-253 and 255.
 2012-08-31 11:37:45 +02:00
Martin Willi b5d2bf975b Request and acquire multiple virtual IPs in IKEv1 Mode Config 2012-08-30 16:43:43 +02:00
Martin Willi 61d6ccf51c Request and acquire multiple virtual IPs in IKEv2 configuration payload 2012-08-30 16:43:43 +02:00
Martin Willi d55fe264d1 Pass all configured pool names to attribute provider enumerator 2012-08-30 16:43:43 +02:00
Martin Willi feb8550401 Pass a list instead of a single virtual IP to attribute enumerators 2012-08-30 16:43:42 +02:00
Martin Willi 497ce2cf51 Support multiple address pools configured on a peer_cfg 2012-08-30 16:43:42 +02:00
Martin Willi 101d26babe Support multiple virtual IPs on peer_cfg and ike_sa classes 2012-08-30 16:43:42 +02:00
Tobias Brunner 1184493407 Fall back to local address as IKEv1 identity if nothing else is configured 2012-08-24 12:55:01 +02:00
Tobias Brunner 078755d099 Added a method to enumerate registered EAP methods 2012-08-21 16:48:47 +02:00
Martin Willi 10bdc7a968 Remove the unused second IKE_SA entry match function argument 
LLVMs clang complains about this parameter, so remove it.
 2012-08-20 17:42:14 +02:00
Adrian-Ken Rueegsegger acf27437cd Add keymat_t constructor registration function 
Using the register_constructor function enables custom keymat_t
implementations per IKE version. If no constructor is registered the
default behavior is preserved.
 2012-08-20 13:02:47 +02:00