denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Commit Graph

  • 1755ac0617 Cleaned up quick mode notify processing Martin Willi 2011-12-07 17:51:35 +01:00
  • 5adf855e3d Add support for KE payloads in IKEv1 quick mode (PFS) Martin Willi 2011-12-07 17:43:58 +01:00
  • 9bb4de1d83 En- and decode DH group attribute in quick mode SA payloads Martin Willi 2011-12-07 17:41:16 +01:00
  • fb8bc6a764 Use authenticators in IKEv1 main mode Martin Willi 2011-12-07 14:10:05 +00:00
  • 76fe7de3fd Added a factory function for IKEv1 authenticators Martin Willi 2011-12-07 14:09:34 +00:00
  • 7c27c914d4 Implemented IKEv1 pubkey SIG payload processing in an authenticator Martin Willi 2011-12-07 14:08:06 +00:00
  • 2792587875 Implemented IKEv1 PSK HASH payload processing in separated authenticator Martin Willi 2011-12-07 14:52:02 +01:00
  • 5d1eeec297 Handle incoming delete messages Clavister OpenSource 2011-12-07 13:30:53 +01:00
  • 6f6380e670 use untoh64 instead of non-portable be64toh Andreas Steffen 2011-12-06 15:15:40 +01:00
  • c64a4b4f8e Implemented post-authentication certificate handling for IKEv1 Martin Willi 2011-12-06 13:38:27 +01:00
  • 9ad5b8fa95 Cleanup CERT payload constructors Martin Willi 2011-12-06 13:37:57 +01:00
  • 0bcdb8e571 Implemented pre-authentication certificate handling for IKEv1 Martin Willi 2011-12-06 12:14:48 +01:00
  • 8c33850615 Added task types for IKEv1 certificate handling Martin Willi 2011-12-06 11:44:17 +01:00
  • df06ef2098 Cleaned up certreq payload for IKEv2/IKEv1 use Martin Willi 2011-12-06 10:56:39 +01:00
  • 6ccabe2561 Reverted ike_cert tasks to IKEv2 only, we use dedicated IKEv1 tasks Martin Willi 2011-12-06 10:55:15 +01:00
  • 9f80110bc6 Install SAs with UDP encapsulation during Quick Mode. Tobias Brunner 2011-12-06 10:33:10 +01:00
  • aaa8f88906 Fix support for plain RSA authentication in IKEv1, both as initiator and responder Martin Willi 2011-12-05 17:24:17 +01:00
  • a974700fc0 Fix referencing of multiple CERTREQ payload with IKEv1, other cleanups Martin Willi 2011-12-05 17:07:48 +01:00
  • 695aff41f5 Encode a single IP traffic selector as ID_IPV?_ADDRESS identity Martin Willi 2011-12-05 16:20:56 +01:00
  • caa6f772c8 Added missing break;s when converting ID_IP_ADDRESS types to ts, extracted function Martin Willi 2011-12-05 16:14:52 +01:00
  • bd8700f055 Don't use unportable htobe64 macro directly Martin Willi 2011-12-05 15:45:01 +01:00
  • f4e25e602b Implement htoun/untoh64 with potentially faster htobe64/be64toh macros, if available Martin Willi 2011-12-05 15:44:51 +01:00
  • 65840cc462 fixed copy-and-paste error Andreas Steffen 2011-12-04 12:53:47 +01:00
  • cd419ae446 extended bio_reader and bio_writer to handle u_int64_t Andreas Steffen 2011-10-27 00:37:24 +02:00
  • d82a68642d XAUTH additions for certificates. Clavister OpenSource 2011-12-05 14:27:53 +01:00
  • a874a1f50b signature payload handling. Clavister OpenSource 2011-12-05 14:22:11 +01:00
  • 8ad5cd1f6c certificate tasks added to passive list for responder Clavister OpenSource 2011-12-05 14:17:17 +01:00
  • 7d9269bfce certificate handling for XAuth responder. Clavister OpenSource 2011-12-05 14:11:48 +01:00
  • a846be3116 keymat: derive_ike_keys updated with XAUTH RSA:s Clavister OpenSource 2011-12-05 13:54:54 +01:00
  • e102f86e88 Setting transform number in esp proposal. Clavister OpenSource 2011-12-05 13:44:22 +01:00
  • 8a9ab2035f ID_IPV4_ADDR and ID_IPV6_ADDR cases added to get_ts Clavister OpenSource 2011-12-05 12:48:14 +01:00
  • 8c583c110e version bump to 5.0.0dr1 Andreas Steffen 2011-12-03 15:12:14 +01:00
  • 07abb470c6 IKEv1: Added basic support for INFORMATIONAL exchange types, and for NOTIFY_V1 messages in the 3rd message in quick_mode. Clavister OpenSource 2011-12-02 16:22:42 +01:00
  • f00ffe4dd2 IKEv1 XAuth: Added changes to Makefile.am to compile the xauth_null plugin. Clavister OpenSource 2011-12-02 15:39:09 +01:00
  • 8cb6f4f979 Don't stop processing tasks if one returns SUCCESS. Tobias Brunner 2011-12-02 08:38:43 +01:00
  • 4394d96844 IKEv1 XAuth: Added a "NULL" XAuth plugin which sends a hardcoded user/pass, and blindly accepts whatever user/pass is sent it. Changed the xauth_request task to use this new plugin. Add --enable-xauth-null to your configure line to build with the new plugin. Clavister OpenSource 2011-12-01 16:34:30 +01:00
  • 9c5366446a IKEv1 XAuth: Added plugin support for XAuth, which allows us to have plugins to talk to servers with different quirks for XAuth authentication. Clavister OpenSource 2011-12-01 14:08:24 +01:00
  • 781f4c8898 IKEv1 XAuth: Add XAuth defines for plugin types. Clavister OpenSource 2011-12-01 13:11:36 +01:00
  • 3bf0be6b08 Add NAT-OA payloads during Quick Mode if transport mode is used. Tobias Brunner 2011-11-30 18:03:06 +01:00
  • 29b0cb328a Negotiate UDP encapsulation during Quick Mode if NAT is detected. Tobias Brunner 2011-11-30 17:52:14 +01:00
  • 1cc4ec46cf Task added for IKEv1 NAT detection. Tobias Brunner 2011-11-30 17:09:42 +01:00
  • 61e2a1ad8a Create negotiated hasher earlier during Main Mode so it is available for building NAT-D payloads. Tobias Brunner 2011-11-30 17:04:21 +01:00
  • 4ace4daf0c Added a function to keymat_v1 to create the hasher earlier than during key derivation. Tobias Brunner 2011-11-30 17:03:01 +01:00
  • a0bea44a97 Message rules for IKEv1 NAT-T payloads added. Tobias Brunner 2011-11-30 16:55:24 +01:00
  • c5dc9d3383 IKEv1 XAuth: Moving the state change to IKE_CONNECTED until after XAuth exchanges are complete. Clavister OpenSource 2011-11-30 10:43:38 +01:00
  • 02c36eeb86 IKEv1 XAuth: Adding "initiate" flag parameter to the initiate_xauth method, signalling whether or not to call the task_manager->initiate method after queueing the task. Clavister OpenSource 2011-11-30 10:39:29 +01:00
  • 06d29be714 Handle IKEv1 NAT-T vendor ID payload (only RFC 3947 for now). Tobias Brunner 2011-11-29 14:26:52 +01:00
  • 1e97783c99 Added payloads for IKEv1 NAT-Traversal negotiation. Tobias Brunner 2011-11-29 11:14:25 +01:00
  • 3fa8db8b59 IKEv1 XAuth: Clean up debug prints in xauth_request task. Clavister OpenSource 2011-11-29 11:41:56 +01:00
  • 735fa3e5b9 IKEv1 XAuth: Remove XAuth task from the passive task list for ID_PROT. Clavister OpenSource 2011-11-29 11:36:53 +01:00
  • 0ea77083bb Revert "IKEv1 XAuth: Added new MIGRATE status type to status_t." Clavister OpenSource 2011-11-29 11:21:54 +01:00
  • c961d110ab IKEv1 XAuth + CfgMode: Added ability to process CfgMode messages in the xauth task. Migrated away from using the MIGRATE method to switch queues. Clavister OpenSource 2011-11-29 11:04:36 +01:00
  • ef2eac7fb0 IKEv1 XAuth: Change the main_mode task to use the new initiate_xauth job instead of the old MIGRATE method. Clavister OpenSource 2011-11-29 10:52:31 +01:00
  • 56fb0f0b3a IKEv1 XAuth: Added XAuthResp authentication modes. Clavister OpenSource 2011-11-29 10:42:31 +01:00
  • 2e210e3ef5 IKEv1 XAuth: Added a job to call the initiate_xauth method of ike_sa after the completion of the current set of tasks is complete. Clavister OpenSource 2011-11-29 09:24:29 +01:00
  • 65359ccbbc IKEv1 XAuth: Add "initiate xauth" method, which adds the xauth task into the queue for initiation. Clavister OpenSource 2011-11-29 09:15:59 +01:00
  • 9eefb5f9b4 Use quiet generator when creating IKEv1 message hashes. Tobias Brunner 2011-11-25 18:58:18 +01:00
  • 24ddf03f52 Added an option to create a generator that does not log debug messages. Tobias Brunner 2011-11-25 18:57:03 +01:00
  • 4cfd0db854 Respond with NO_PROPOSAL_CHOSEN, if we don't find an ike_cfg. Tobias Brunner 2011-11-25 18:01:25 +01:00
  • 6be8d33daa Don't respond to malformed INFORMATIONAL_V1 messages with another INFORMATIONAL_V1 exchange. Tobias Brunner 2011-11-25 18:00:06 +01:00
  • 37639e94fb Handle invalid IKEv1 hashes more specifically. Tobias Brunner 2011-11-25 17:59:39 +01:00
  • 29a5e0707e Handle unsupported IKEv1 exchange types more specifically. Tobias Brunner 2011-11-25 17:58:37 +01:00
  • b235e69cde Send an INFORMATIONAL message on IKEv1 parse errors. Tobias Brunner 2011-11-25 17:54:28 +01:00
  • 983e852af8 Handle INFORMATIONAL_V1 messages when no keys have been derived yet. Tobias Brunner 2011-11-25 17:45:30 +01:00
  • e6732003f4 Error reporting for invalid IKEv2 responses fixed. Tobias Brunner 2011-11-25 16:24:32 +01:00
  • 7519106d07 Set request flag to proper value for IKEv1 messages before parsing them. Tobias Brunner 2011-11-25 16:08:12 +01:00
  • 1960312cfd Avoid parsing retransmits we already responded to. Tobias Brunner 2011-11-25 16:05:00 +01:00
  • 68c6863bbb Moved main part of message processing to task managers. Tobias Brunner 2011-11-25 15:53:23 +01:00
  • 44ff1153e8 Addded ike_sa_t.set_statistic to set timestamps from task manager. Tobias Brunner 2011-11-25 14:48:57 +01:00
  • 38d189eee9 Compiler warning fixed in prf_plus_t. Tobias Brunner 2011-11-25 11:26:20 +01:00
  • fd24c700fb Use proper enum types in proposal_substructure. Tobias Brunner 2011-11-25 11:25:45 +01:00
  • 52ac2cebe2 IKEv1 XAuth: Fix XAuth task so that it reinitiates. Clavister OpenSource 2011-11-25 08:45:42 +01:00
  • e63cb7f816 Revert "IKEv1 XAuth: Temporarilty add an "initiate_later" flag to the task manager. When set to TRUE it will cause "initiate" to be called when the current process_response call is finished. This change should be reverted once we have a better method in place." Clavister OpenSource 2011-11-25 08:41:41 +01:00
  • 2c49c53186 IKEv1 XAuth: Fix main mode to work with XAuth PSK. Clavister OpenSource 2011-11-25 08:24:30 +01:00
  • a2f8fc9711 Use a dedicated IKEv1 vendor ID task to fix using IKEv2 payloads in IKEv1 Martin Willi 2011-11-24 16:32:14 +01:00
  • abf9784786 Pass concrete auth_method to key derivation, as we have that as a responder Martin Willi 2011-11-24 16:11:05 +01:00
  • b4e815354c Map auth_class to auth method and IKEv1 proposal attribute Martin Willi 2011-11-24 16:07:13 +01:00
  • eeca2af81c Removed obsolete transform attribute setters Martin Willi 2011-11-24 15:32:13 +01:00
  • 914ec2dbf2 Implemented IKEv1 attribute encoding in SA payload Martin Willi 2011-11-24 15:25:22 +01:00
  • fbebc2a068 Implemented encoding of additional IKEv1 proposal attributes Martin Willi 2011-11-24 12:52:11 +01:00
  • cd0017d452 Exchange IKEv1 ESP SA proposal information Martin Willi 2011-11-24 15:25:00 +01:00
  • 132d5c56de Exchange IKEv1 SA specific proposal data with SA payload Martin Willi 2011-11-24 14:51:04 +01:00
  • e174e0d445 Added not-yet used sa_payload parameters used in IKEv1 Martin Willi 2011-11-24 11:39:31 +01:00
  • d08269c700 Added a get_rekey/reauth_time() jitter parameter to get time without randomization Martin Willi 2011-11-24 11:38:37 +01:00
  • b03c700d08 IKEv1 XAuth: Changed the xauth_request task to use the new MIGRATE status. Clavister OpenSource 2011-11-24 16:57:10 +01:00
  • b94f248ea9 IKEv1 XAuth: Added new MIGRATE status type to status_t. When a task returns this status from a build or process method, it is a signal to the task manager that it should treat it as if the task returned SUCCESS. Additionally it will migrate all remaining tasks from the current queue to a different one, calling swap_initiator for each applicable task. Finally, the task manager will call "initiate", if applicable, to kick off tasks in the "queued_tasks" queue. Task queue relocation mapping: passive_tasks moves to queued_tasks (which is then fed to active by the initiate call). active_tasks moves to passive_tasks Clavister OpenSource 2011-11-24 16:48:41 +01:00
  • 46897273d7 IKEv1 XAuth: Added new "swap_initiator" method to the standard task_t interface. This is needed for when we move a task from the passive queue to the active one. I'm not a huge fan of this method of doing things. Perhaps we should change task_t to have build_i, build_r, process_i, and process_r methods, and call the appropriate one from the task manager, since we have these methods for most tasks anyways. Clavister OpenSource 2011-11-24 16:35:22 +01:00
  • cc50df9e6c IKEv1 XAuth: XAuthInitPreShared working for XAuth initiator (Main Mode responder). Creates USER/PASS request, retrieves the result and sends status. Clavister OpenSource 2011-11-24 11:46:02 +01:00
  • 2d97ec0d35 IKEv1 XAuth: Added ability to initiate the XAuth transactions under a flag, default not to initiate XAuth. Clavister OpenSource 2011-11-24 11:40:55 +01:00
  • 8b30286fcf IKEv1 XAuth: Add XAUTH authentication types to the enum. Added the ability to switch between hardcoded PSK and XAUTH_INIT_PSK authentications using a flag, default to PSK. Clavister OpenSource 2011-11-24 11:37:36 +01:00
  • ece4ed3fcd IKEv1 ConfigMode: Fix configuration_attribute encoding rules for IKEv1 to use the attribute type instead of the internal only payload type. Clavister OpenSource 2011-11-24 11:33:38 +01:00
  • 0b6811b4a7 IKEv1 ConfigMode: Fixed cp_payload to use CONFIGURATION_ATTRIBUTE_V1 in all appropriate places, so the parsing is done correctly. Clavister OpenSource 2011-11-24 11:30:19 +01:00
  • 01685247b0 IKEv1 XAuth: Added ike_vendor task to the ID_PROT exchange type processing. We need to process vendor payloads to check to see if our peer understands XAuth before using any of these payload types. Clavister OpenSource 2011-11-24 11:26:04 +01:00
  • e3bb68841a IKEv1 XAuth: Added temporary "initiate_xauth" public method to ike_sa_t. This allows us to initiate an XAuth password authentication exchange after responding to the final message of Main Mode. This change should be reverted once we have a better method to initiate this exchange. Clavister OpenSource 2011-11-24 11:21:43 +01:00
  • adf7b76f4c IKEv1 XAuth: Temporarilty add an "initiate_later" flag to the task manager. When set to TRUE it will cause "initiate" to be called when the current process_response call is finished. This change should be reverted once we have a better method in place. Clavister OpenSource 2011-11-24 11:12:59 +01:00
  • 9cc38c8efb Use quick mode task initiator flag instead of passing it as parameter Martin Willi 2011-11-24 10:33:43 +01:00
  • 4e0bc9af22 Add quick mode ID payloads only if establishing a non-host2host tunnel Martin Willi 2011-11-24 10:28:49 +01:00
  • c4b8539f93 Refactored traffic selector handling in quick mode Martin Willi 2011-11-24 10:20:59 +01:00
  • 818330aafe Refactored NONCE payload handling in quick mode Martin Willi 2011-11-24 09:51:40 +01:00
  • 78f7728c30 No need to build a HASH payload in XAUTH task. Tobias Brunner 2011-11-23 16:08:40 +01:00