denozord/strongswan-ext
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
20,183 Commits 3 Branches 0 Tags
feature/update-api
Commit Graph
4851 Commits
Author SHA1 Message Date
Tobias Brunner 39c66693a0 ike-init: Ignore COOKIE payloads during rekeying 
This ensures that process_i() only returns NEED_MORE due to multiple
key exchanges or an INVALID_KE_PAYLOAD notify.
 2022-06-29 10:28:50 +02:00
Tobias Brunner e5bf9b23b2 ike-sa-manager: Log SPIs when checking in an IKE_SA 2022-06-29 10:28:50 +02:00
Tobias Brunner c1987aefbe message: Fix payload type in last unprotected payload of a fragmented message 2022-06-29 10:28:50 +02:00
Tobias Brunner ba348b4799 ike-rekey: Reset IKE_SA after processing CREATE_CHILD_SA request 
This probably didn't cause any problems, as there wasn't really anything
happening between the calls, but reset it anyway, just to be safe.
 2022-06-29 10:28:50 +02:00
Tobias Brunner 36312808d1 ikev2: Allow tasks to do work after processing requests/responses 2022-06-29 10:28:50 +02:00
Tobias Brunner 210e2177aa task: Add optional post_process() method 
This will allows tasks to do some work after a message has been
processed.
 2022-06-29 10:28:50 +02:00
Tobias Brunner 1719e0f0aa ikev2: Allow tasks to do work after generating requests/responses 2022-06-29 10:28:50 +02:00
Tobias Brunner 87caf36bb9 task: Add optional post_build() method 
This will allow tasks to do some work after the message has been
generated.
 2022-06-29 10:28:50 +02:00
Tobias Brunner 28b33d7cac ike-auth: Support exchange between IKE_SA_INIT and IKE_AUTH 2022-06-29 10:28:50 +02:00
Tobias Brunner 09a4aed3a2 child-create: Support exchange between IKE_SA_INIT and IKE_AUTH 2022-06-29 10:28:50 +02:00
Tobias Brunner 3a8ea08686 ike-mobike: Support exchange between IKE_SA_INIT and IKE_AUTH 
This changes the MID of the first IKE_AUTH message.
 2022-06-29 10:28:50 +02:00
Tobias Brunner 366fce8f03 ike-config: Support exchange between IKE_SA_INIT and IKE_AUTH 
This changes the MID of the first IKE_AUTH message.
 2022-06-29 10:28:50 +02:00
Tobias Brunner 09d4497536 ike-cert-post: Make absolutely sure certificates are only added to IKE_AUTH 
The AUTH payload check in build_certs() should be fine, but add some
extra checks just to make really sure and also for clarification.
 2022-06-29 10:28:50 +02:00
Tobias Brunner f2e79bf334 ike-cert-pre: Support exchange between IKE_SA_INIT and IKE_AUTH 
The first IKE_AUTH does not have MID 1 if that's the case.
 2022-06-29 10:28:50 +02:00
Tobias Brunner f00e80d759 status: Add return_need_more() utility function 2022-06-29 10:28:50 +02:00
Tobias Brunner ec350ebb78 child-cfg: Generalize get_ke_method() method 2022-06-29 10:28:50 +02:00
Tobias Brunner 093fc1ac63 ike-cfg: Generalize get_ke_method() method 2022-06-29 10:28:50 +02:00
Tobias Brunner 3bebf5bf8d proposal: Generalize KE methods 2022-06-29 10:28:50 +02:00
Andreas Steffen b7c167f972 Rename MODP_NONE to KE_NONE 2022-06-29 10:28:50 +02:00
Tobias Brunner 3af7c6db87 Rename diffie_hellman_t to key_exchange_t and change the interface etc. 
This makes it more generic so we can use it for QSKE methods.
 2022-06-29 10:28:50 +02:00
Tobias Brunner df18934d20 Replace or remove wiki.strongswan.org URLs 2022-06-28 13:33:51 +02:00
Tobias Brunner 19ef2aec15 Update copyright headers after acquisition by secunet 2022-06-28 10:22:56 +02:00
Tobias Brunner 64d73235c4 adopt-children-job: Avoid reordering CHILD_SAs 
References strongswan/strongswan#1041
 2022-05-10 09:08:17 +02:00
Xiao Liang 3b742c75ab quick-mode: Remove outbound SA/policy of rekeyed CHILD_SA 
Remove outbound SA and policy of rekeyed CHILD_SA since only one is valid.
Otherwise, during update-SA job (when NAT mapping changed), CHILD_SA are
updated and installed one by one, leaving a window where old SAs are being
used. There are also circumstances where the new SA is not processed last.

Closes strongswan/strongswan#1041
 2022-05-10 09:07:37 +02:00
Tobias Brunner 4de8b81dea keymat_v2: Fix error message if KDF can't be created 
Fixes: f619b833ac ("keymat_v2: Use plugin-provided KDF_PRF to derive SKEYSEED")
References strongswan/strongswan#1026
 2022-05-06 11:45:10 +02:00
Tobias Brunner c9d471091f Use mallinfo2() if available 
mallinfo() is deprecated because it uses `int` for the members of the
returned struct, whereas mallinfo2() uses `size_t`.  It's available
since glibc 2.33.
 2022-04-25 14:16:20 +02:00
Tobias Brunner f4d6539b49 ikev2: Maintain labels during make-before-break reauthentication 2022-04-20 14:45:41 +02:00
Tobias Brunner f619b833ac keymat_v2: Use plugin-provided KDF_PRF to derive SKEYSEED 2022-04-14 19:02:56 +02:00
Tobias Brunner 743b486118 unit-tests: Hand out an actual shared secret and pubkey in mock KE implementation 
Makes this a bit more realistic and makes key derivation via OpenSSL's
HKDF work during tests.
 2022-04-14 19:02:56 +02:00
Tobias Brunner 9cb3c10418 keymat_v1: Derive CHILD_SA keys without using prf_plus_t 
We already expand skeyid_e in a similar fashion so do this analogous
without relying on prf_plus_t.
 2022-04-14 19:02:56 +02:00
Tobias Brunner 7161c87617 keymat_v2: Use plugin-provided prf+ to derive keys 2022-04-14 19:02:56 +02:00
Tobias Brunner 742134c112 keymat_v2: Refactor CHILD_SA key derivation so it only needs one prf+ call 2022-04-14 18:54:24 +02:00
Tobias Brunner 00cfc05467 keymat_v2: Refactor IKE key derivation so it only needs one prf+ call 2022-04-14 18:54:24 +02:00
Tobias Brunner ec17fa2fef vici: Report registered KDFs 2022-04-14 18:54:24 +02:00
Tobias Brunner 07bf428ad1 stroke: List registered KDFs 2022-04-14 18:54:24 +02:00
Tobias Brunner b1c7fac768 vici: Add options to only return specific CHILD_SAs in list-sas() 2022-04-14 18:42:01 +02:00
Tobias Brunner 2994347d18 vici: Report security label on CHILD_SA, policies and configs 2022-04-14 18:42:01 +02:00
Tobias Brunner 7cf6f29ac5 vici: Make security labels and mode configurable 2022-04-14 18:42:01 +02:00
Tobias Brunner f52e565ad3 kernel-netlink: Forward labels from acquires 2022-04-14 18:42:01 +02:00
Tobias Brunner 0a673794d8 trap-manager: Add support to handle acquires with security labels 2022-04-14 18:42:01 +02:00
Tobias Brunner 81c362829e kernel-handler: Log security label received with acquire 2022-04-14 18:42:01 +02:00
Tobias Brunner 52a05d7f6c kernel-interface: Optionally pass security label with an acquire 2022-04-14 18:42:01 +02:00
Tobias Brunner 3f3838d1f9 ike-sa: Accept optional security label when initiating CHILD_SAs 2022-04-14 18:42:01 +02:00
Tobias Brunner 92f54e55e9 child-rekey: Maintain security label during rekeying 2022-04-14 18:42:01 +02:00
Tobias Brunner b00a4e778f selinux: Add plugin to install trap policies with generic labels 
After establishing an IKE_SA, we check if any of its child configs
define generic SELinux labels and install trap policies for them if
necessary narrowed to the current (virtual) IPs.
 2022-04-14 18:42:01 +02:00
Tobias Brunner 065685dde7 ike-sa: Add helper to determine an IKE_SA's dynamic hosts 2022-04-14 18:42:01 +02:00
Tobias Brunner 3c65cf6456 trap-manager: Add facility to install externally managed trap policies 
This allows managing trap policies outside of the trap manager.

We'll use this to create trap policies with generic labels if trap policies
can't (or won't) be used (e.g. as responder for roadwarriors).
 2022-04-14 18:42:01 +02:00
Tobias Brunner 8f4cfe9669 child-sa: Allocate a new reqid if dynamic traffic selectors are updated 
If update_sa() is called and dynamic traffic selectors are changed using
new addresses, this might cause issues if we continue to use a reqid that
doesn't match the updated traffic selectors.  For instance, if the initiator
then uses make-before-break reauth from the new IP.  It's also a particular
problem in the SELinux case where multiple CHILD_SAs with specific labels
all share the same (trap) policy with generic label.  However, SAs created
after the update would not match due to the new reqid.
 2022-04-14 18:42:01 +02:00
Tobias Brunner 96ecc39cd0 kernel-netlink: Allow reqid updates for policies again 
This was originally added with 1551d8b13d ("kernel-netlink: reject
policy refcount if the reqid differs").  Since then we added code to
allocate constant reqids for the same TS, which pretty much avoids the
previous issues.

However, the reqid might have to be changed due to MOBIKE updates. And
because reqids are allocated for a complete set of traffic selectors and
not individual pairs, this can create a problem with drop policies as
those will use the old reqid (they are installed with the same priority,
reqid etc. to replace the actual IPsec policies), while unmodified
replacement policies will use the new one.  A similar issue exists for
CHILD_SAs with SELinux contexts as those all use duplicate policies (same
generic label) but can't all be updated concurrently.
 2022-04-14 18:42:01 +02:00
Tobias Brunner 1b3af3e37d kernel-interface: Add support to change the reqid in update_sa() 2022-04-14 18:42:01 +02:00