Commit Graph

Select branches

Hide Pull Requests

main

Mono Color

• 3de54af7ec Define a special XFRM mark_t.value that dynamically uses the CHILD_SA reqid Martin Willi 2012-03-21 15:41:45 +01:00
• 80abe22f65 fixed parsing of IF-MAP SOAP responses Andreas Steffen 2012-03-21 14:25:19 +01:00
• 4f3cf61dfd Reply with received configuration payload identifier in Mode Config Martin Willi 2012-03-20 18:06:29 +01:00
• b1f2f05c92 Merge branch 'ikev1-clean' into ikev1-master Martin Willi 2012-03-20 17:56:18 +01:00
• d112a7e1fe Properly handle retransmitted initial IKE messages. Tobias Brunner 2012-03-08 15:23:20 +01:00
• de9357bb44 Implemented table of init hashes without linked_list_t. Tobias Brunner 2012-03-01 17:37:38 +01:00
• 6f0cca20d8 Implemented table of connected peers without linked_list_t. Tobias Brunner 2012-03-01 17:24:44 +01:00
• 3489370458 Implemented table of half open IKE_SAs without linked_list_t. Tobias Brunner 2012-03-01 16:34:45 +01:00
• e49bb4e3e3 Don't use linked_list_t for buckets in main IKE_SA hash table. Tobias Brunner 2012-03-01 12:51:34 +01:00
• 894c52cba2 Fixed deadlock if checkin_and_destroy is called during shutdown. Tobias Brunner 2012-03-01 12:52:17 +01:00
• 4b2f428f40 Do not clone hashes of initial IKE messages when storing them in the hash table. Tobias Brunner 2012-03-01 18:07:48 +01:00
• 20e3d5ea00 Store IKEv2 IKE_SAs by local SPI in the IKE_SA manager hash table. Tobias Brunner 2012-02-29 18:17:50 +01:00
• 71cf97871f Added separate hashtable for hashes of initial IKE messages. Tobias Brunner 2012-02-29 18:15:42 +01:00
• 68611395dc chunk_equals_ptr added to compare chunks given as pointers. Tobias Brunner 2012-02-29 18:06:49 +01:00
• 1726795fa9 Store the major IKE version on ike_sa_id_t. Tobias Brunner 2012-02-29 14:47:09 +01:00
• 8254e7ecb8 Implemented handling of UNITY_LOAD_BALANCE as reauthentication. Tobias Brunner 2012-03-02 19:17:13 +01:00
• a7d3b0e098 Check if we actually have a packet before retransmitting it Martin Willi 2012-02-21 10:23:20 +01:00
• 35852af7b1 Use a single set of FDs for all random plugin RNG instances Martin Willi 2012-02-21 10:22:48 +01:00
• eff331f799 Parse IKEv1 Cisco Load Balancing notify (can't act on it yet). Tobias Brunner 2012-02-03 12:58:11 +01:00
• 3a9d5cbc14 Fixed transform numbering in IKEv1 proposal. Tobias Brunner 2012-02-03 12:56:30 +01:00
• dcbdc914fa Compiler warning fixed. Tobias Brunner 2012-02-03 12:56:14 +01:00
• 182d55b229 Use correct enum values to detect three message tasks for retransmission Martin Willi 2012-02-02 10:49:19 +01:00
• f98af1ddd5 Trigger DPD not before IKE_SA state gets updated Martin Willi 2012-02-02 10:33:40 +01:00
• 5ed4b727d0 Fix mapping of IKEv1 encapsulation mode Martin Willi 2012-01-24 13:31:37 +01:00
• 7fd7ffc649 Use UDP encapsulation even in non-NAT situation if initiator requests it Martin Willi 2012-01-23 15:11:13 +01:00
• 75e3d90d43 Updated ipsec.conf man page for the use of IKEv1 with pluto Martin Willi 2012-01-23 14:35:57 +01:00
• c60246a618 Support inactivity timeout in IKEv1 CHILD_SAs Martin Willi 2012-01-23 13:49:56 +01:00
• a0c17d4157 Use a dedicated PRF for HASH/SIG payloads using ECDSA specific hasher Martin Willi 2012-01-23 12:46:46 +01:00
• 4c685e8850 Select public key auth method by checking what key we have Martin Willi 2012-01-23 12:28:55 +01:00
• 83b152dd4f Support ECDSA signatures in IKEv1 pubkey authenticator Martin Willi 2012-01-23 12:27:57 +01:00
• 5be386ff8e Exchange certificates when using IKEv1 ECDSA authentication Martin Willi 2012-01-23 12:26:42 +01:00
• 5aef6bd0f3 Accept NULL auth_cfg_t passed to credential_manager_t.get_private() Martin Willi 2012-01-23 12:25:38 +01:00
• 6261c0c3b7 Support encoding of IKEv1 ECDSA proposals Martin Willi 2012-01-23 12:25:00 +01:00
• c8d46f2959 Dropped support of deprecated authby=eap and eap= options Martin Willi 2012-01-20 16:03:18 +01:00
• c791def8c1 Added support for authby/xauth_server legacy options Martin Willi 2012-01-20 15:33:26 +01:00
• c390569a76 Renamed CONFIGURATION_ATTRIBUTE_LENGTH to streamline it with other ATTRIBUTE rules Martin Willi 2012-01-20 15:00:06 +01:00
• 05cb240215 Use ATTRIBUTE_VALUE rule in configuration attribute to parse it with correct length Martin Willi 2012-01-20 14:57:18 +01:00
• a994050e9c Don't re-resolve addresses during initiate if they have already been set Martin Willi 2012-01-20 13:54:39 +01:00
• aa3b53e716 Adopt children after syncing a rekeyed IKEv1 SA Martin Willi 2012-01-20 13:42:37 +01:00
• fed5c33440 Synchronize IKEv1 DPD sequence numbers Martin Willi 2012-01-20 12:23:46 +01:00
• fd6fbf1764 Setting message ID on task manager sets DPD sequence numbers in IKEv1 Martin Willi 2012-01-20 12:22:56 +01:00
• 783c496966 Update state before triggering DPD, as we cancel it if PASSIVE Martin Willi 2012-01-20 12:21:48 +01:00
• a46b8e16ad Set thread specific SA on bus for each enumerated IKE_SA Martin Willi 2012-01-20 12:21:13 +01:00
• b226fd300d Sync remote virtual IP for IKEv1 SAs Martin Willi 2012-01-20 11:36:26 +01:00
• 868d92a402 Sync new IKE_SA condition/extension flags Martin Willi 2012-01-20 11:23:27 +01:00
• c8531b7e69 Added support for Phase1 IV synchronization to HA plugin Martin Willi 2012-01-19 16:34:59 +01:00
• 47b8f6ef4b Invoke bus_t.message hook twice, once plain and parsed, once encoded and encrypted Martin Willi 2012-01-19 16:22:25 +01:00
• ae92641806 Create IKEv1 keymat hasher explicitly on sync Martin Willi 2012-01-19 15:55:29 +01:00
• a0fa7a7f64 Clear initiator flag when checking out initial IKEv1 SA from message Martin Willi 2012-01-19 15:54:38 +01:00
• 8bcd9bd161 Added support to sync IKEv1 SAs key material in HA plugin Martin Willi 2012-01-19 11:11:22 +01:00
• 23f9e7a18d Pass IKEv1 specific keymat to ike_keys hook Martin Willi 2012-01-18 18:34:07 +01:00
• 264514826c Use a more complete implementation of a HA specific diffie_hellman_t Martin Willi 2012-01-18 18:24:48 +01:00
• 5763367cac Show IKE version in ipsec statusall Martin Willi 2012-01-18 17:50:07 +01:00
• c3f1839ab7 Apply proposal to a HA synced IKE_SA Martin Willi 2012-01-18 17:49:52 +01:00
• 3624b09e21 Set selected proposal on IKEv1 SA, don't pass it separately to Phase 1 helper Martin Willi 2012-01-18 17:42:06 +01:00
• 6bc6f67b0f Updated HA plugin to new IKEv2 specific keymat functions Martin Willi 2012-01-18 17:24:31 +01:00
• 3957a6e4f3 Get a reference for the child_cfg passed to child_create_create() Martin Willi 2012-01-18 17:24:08 +01:00
• 696fa8e003 Invoke bus_t.narrow hook in quick mode exchange Martin Willi 2012-01-18 13:28:15 +01:00
• f420f51f55 Invoke authorization hooks for IKEv1 connections Martin Willi 2012-01-18 13:12:07 +01:00
• 1a0648490c Invoke ike_updown hooks for reauthenticated IKEv1 SAs Martin Willi 2012-01-16 16:47:18 +01:00
• b6ac063c36 Don't invoke a child_updown hook when a quick mode to delete has been rekeyed Martin Willi 2012-01-16 16:18:01 +01:00
• 669d8bded2 Invoke child_rekey hook instead of child_updown when rekeying a quick mode Martin Willi 2012-01-16 16:17:27 +01:00
• 5b7fc76861 Don't invoke updown hook when flushing SAs for IKEv1, tasks will do it Martin Willi 2012-01-16 15:57:46 +01:00
• c654d949f3 Fix "incoming" flag passed to bus_t.message() hook Martin Willi 2012-01-16 15:31:53 +01:00
• 477559cab5 Continue with next exchange after sending an INFORMATIONAL Martin Willi 2012-01-13 09:27:26 +01:00
• 1b82eb23a2 Handle retransmission of DPD exchange, both as initiator and responder Martin Willi 2012-01-10 19:13:58 +01:00
• 11aadd7722 Disable DPD checking for peers not supporting it Martin Willi 2012-01-10 17:40:07 +01:00
• 214d4e4090 Added missing DPD task name Martin Willi 2012-01-10 17:28:25 +01:00
• ff6b084ac4 Confirm message reception time only if DPD sequence number valid Martin Willi 2012-01-10 17:26:42 +01:00
• 2ddd45c9a7 Simplified DPD handling by using a task for a single message only Martin Willi 2012-01-10 17:21:52 +01:00
• 5ac4c2e1a9 Added missing short enum names for DPD notify types Martin Willi 2012-01-10 17:10:22 +01:00
• bb2d4e1882 Print IKEv1 notify types in message summary Martin Willi 2012-01-10 17:09:47 +01:00
• 5f2f864efc Support IKEv1 notifies in message_t.get_notify() Martin Willi 2012-01-10 17:09:20 +01:00
• 3fca5bd123 Check if we have an RNG for IKEv1 task manager before using it Martin Willi 2012-01-10 16:02:46 +01:00
• 31689338d6 Remove unused DPD sequence number getter on task manager Martin Willi 2012-01-10 15:44:17 +01:00
• 1e624ce876 Don't retransmit, rekey, reauth or DPD check SAs when in PASSIVE state Martin Willi 2012-01-10 13:32:06 +01:00
• c9a160953e Send DPD vendor ID Clavister OpenSource 2012-01-10 14:38:01 +01:00
• 3e6b740336 Isakmp_dpd task added. Clavister OpenSource 2012-01-10 14:37:39 +01:00
• 36c8169629 DPD_R_U_THERE defines added Clavister OpenSource 2012-01-10 14:31:51 +01:00
• 346dad30d4 Request and handle retransmission of a lost third aggressive mode message Martin Willi 2012-01-10 11:37:06 +01:00
• 37c12bd31e Streamlined debug output when initiating IKEv1 IKE_SAs Martin Willi 2012-01-10 11:23:04 +01:00
• bd8d1f1d9c Accept unencrypted Aggressive Mode messages. Tobias Brunner 2012-01-10 10:58:29 +01:00
• c40963b457 Enforce encapsulation mode of configuration, in case initiator proposes both Martin Willi 2012-01-09 18:12:17 +01:00
• e129168ba6 Added a "aggressive" ipsec.conf connection option Martin Willi 2012-01-09 17:44:43 +01:00
• 830ab2ae7f Handle aggressive mode task in IKEv1 task manager Martin Willi 2012-01-09 16:35:02 +00:00
• 91c212fd6a Select IKEv1 configurations by main/aggressive mode option Martin Willi 2012-01-09 16:33:15 +00:00
• 5ce59d4c06 Added an aggressive mode peer_cfg option Martin Willi 2012-01-09 16:32:41 +00:00
• a347c1ac43 Fix sending of CERTREQ/CERT payloads in aggressive mode Martin Willi 2012-01-09 17:10:48 +01:00
• ebc7bcb550 Encrypt payloads of third aggressive mode message Martin Willi 2012-01-09 17:10:18 +01:00
• ee325b555f Implemented aggressive mode using Phase 1 helper class Martin Willi 2012-01-09 17:09:38 +01:00
• b4bd875612 Make use of the new Phase 1 helper class in main mode Martin Willi 2012-01-09 17:05:16 +01:00
• c29a89b80d Implemented a common Phase 1 helper class to use by main and aggressive modes Martin Willi 2012-01-09 17:04:41 +01:00
• 44dcd5944a Fix error handling if no PSK found for main mode Martin Willi 2012-01-09 13:41:35 +01:00
• 90731f38c9 Install quick mode CHILD_SAs with negotiated encapsulation mode Martin Willi 2012-01-05 15:02:40 +01:00
• 927c1dd9d2 Support IKEv1 proposal encodings having both lifebytes and a lifetime Martin Willi 2012-01-04 14:43:15 +01:00
• b147679a2c Try to detect reauthentication as responder and adopt children to new SA Martin Willi 2012-01-04 17:51:22 +01:00
• 3a0b67bce5 Destroy IKE_SA after reauthentication initiatend and lifetime limit reached Martin Willi 2012-01-04 17:50:19 +01:00
• cb1a145ce2 Added an IKE_SA manager method to enumerate IKE_SA IDs filtered by identities Martin Willi 2012-01-03 16:23:37 +01:00
• beab4a90ae Query for XAuth identity in get_other_eap_id(), too Martin Willi 2012-01-04 17:32:41 +01:00
• 1b79299b89 Set ISAKMP SA state to rekeying after triggering reauthentication Martin Willi 2012-01-03 14:47:44 +01:00