denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
17,289 Commits 1 Branch 0 Tags
10e0faf477edc8064b11471fd94deef2f49167c4
Commit Graph
1436 Commits
Author SHA1 Message Date
Martin Willi cc787697b8 Be a little more verbose why a peer_cfg is inacceptable 2013-02-26 13:15:27 +01:00
Martin Willi 289b9b7b31 Refactor auth_cfg applying to a common function 2013-02-26 13:15:27 +01:00
Martin Willi e2857be823 For IKEv1 Main Mode, use message hash to detect early retransmissions 
As the message ID is zero in all Main Mode messages, it can't be used to detect
if we are already processing a given message.
 2013-02-25 12:12:38 +01:00
Martin Willi cdf75a39e3 Move initial message dropping to task manager 
When the last request message of the initial tunnel setup is retransmitted,
we must retransmit the response instead of ignoring the request.

Fixes #295.
 2013-02-25 12:12:19 +01:00
Martin Willi 9eaed7a5bb Use INIT macro to initialize IKE_SA manager entries 2013-02-25 12:10:02 +01:00
Martin Willi a1db77de7c Use a complete port range in traffic_selector_create_from_{subnet,cidr} 2013-02-21 11:52:33 +01:00
Martin Willi f836d433a9 When detecting a duplicate IKEv1 SA, adopt children, as it might be a rekeying 2013-02-20 08:57:17 +01:00
Martin Willi 4755ab505d Add a global return_success() method implementation 2013-02-14 17:17:45 +01:00
Martin Willi e212033ef2 Merge branch 'ike-dscp' 2013-02-14 17:11:35 +01:00
Andreas Steffen 2a421163bf make TNC client authentication type available to IMVs 2013-02-12 20:38:05 +01:00
Martin Willi 5b15bd5f9d Set configured DSCP value while generating IKE packets 2013-02-06 15:20:32 +01:00
Tobias Brunner 2ec3552fce Fix check-in of IKE_SA when IKE_SA_INIT fails and hash table is enabled 
Setting the responder SPI to 0 can only be done while generating the
response, otherwise we'd fail to check in the IKE_SA again in case the
hash table is enabled.  That's because we use the responder SPI as hash
value since 5.0.0.
 2013-01-24 19:13:40 +01:00
Tobias Brunner 4eb09d14e2 Avoid a deadlock when installing a trap policy failed 2013-01-23 15:51:47 +01:00
Adrian-Ken Rueegsegger cf3c72c480 Fix IKE SA inherit API doc 2013-01-22 11:02:20 +01:00
Tobias Brunner 66bb4f63b2 Properly send IKEv1 packets if no ike_cfg is known yet 
This applies for error notifies.
 2013-01-14 12:14:16 +01:00
Tobias Brunner 21235e1ec2 Merge branch 'ikev1-fragmentation' 
This adds support for the proprietary IKEv1 fragmentation extension.

Conflicts:
	NEWS
 2013-01-12 11:58:26 +01:00
Tobias Brunner ee6902ef7f Added an option to configure the maximum size of a fragment 2013-01-12 11:54:58 +01:00
Tobias Brunner 7ae245f685 Properly detect fragmentation capabilities 
Cisco sends 0xc0000000 so we check that part of the VID separately.
 2013-01-12 11:54:54 +01:00
Tobias Brunner 365d9a6f67 Added an option that allows to force IKEv1 fragmentation 2013-01-12 11:54:32 +01:00
Martin Willi 1954cc7720 Streamline debug output when receiving intermediate CA certificates in IKEv1 2013-01-11 10:24:23 +01:00
Martin Willi cde6a9ec9f Refactored IKEv2 cert/certreq payload processing to multiple functions 2013-01-11 10:21:56 +01:00
Martin Willi bf10ee9495 Refactored IKEv1 cert payload processing to multiple functions 2013-01-11 10:21:56 +01:00
Volker Rümelin 6d3e7a64a0 IKEv1 support for PKCS#7 wrapped certificates 2013-01-11 10:21:56 +01:00
Volker Rümelin 10eee5fcba Fixed some typos in comments 2013-01-11 10:21:51 +01:00
Tobias Brunner 97973f8609 Use a connection specific option to en-/disable IKEv1 fragmentation 2012-12-24 13:00:01 +01:00
Tobias Brunner e645c15b9c Include source port in init hash for fragmented messages 2012-12-24 12:29:31 +01:00
Tobias Brunner 2f62bb1549 Add an option to en-/disable IKE fragmentation 
Fragments are always accepted but will not be sent if disabled.  The
vendor ID is only sent if the option is enabled.
 2012-12-24 12:29:31 +01:00
Tobias Brunner 5cafefcd5d Split larger messages into fragments if IKE fragmentation is supported by peer 2012-12-24 12:29:31 +01:00
Tobias Brunner c4daac2c0b Log added NAT-T vendor IDs 2012-12-24 12:29:27 +01:00
Tobias Brunner 667720c801 Detect a peer's support for IKE fragmentation 
Fragments are accepted even if this vendor ID is not seen.
 2012-12-24 12:29:27 +01:00
Tobias Brunner fe26ddada9 Map fragmented initial initial Main or Aggressive Mode messages to the same IKE_SA 2012-12-24 12:29:27 +01:00
Tobias Brunner b816037739 Allow ID_PROT/AGGRESSIVE messages for established IKE_SAs if they contain fragments 
Other implementations send fragments always in an initial message type
even for transaction or quick mode exchanges.
 2012-12-24 12:29:27 +01:00
Tobias Brunner 8fc8383439 Don't handle fragmented messages larger than charon.max_packet 2012-12-24 12:29:27 +01:00
Tobias Brunner 7d85f94165 Don't update an IKE_SA-entry's cached message ID when handling fragments 2012-12-24 12:29:26 +01:00
Tobias Brunner 30216000d3 Store inbound IKE fragments and reassemble the message when all fragments are received 2012-12-24 12:29:26 +01:00
Martin Willi 656e01eab3 Add parantheses to avoid compiler warning 2012-12-24 10:12:23 +01:00
Tobias Brunner ef33a4ab82 Fixed some typos, courtesy of codespell 2012-12-20 09:35:26 +01:00
Adrian-Ken Rueegsegger ba8b28b67f Raise an alert if IKE SA is kept 
This alert is raised when the establishment of a child SA fails but the
IKE SA is kept.
 2012-12-20 09:15:07 +01:00
Volker Rümelin 0ff8d20a89 Add support for draft-ietf-ipsec-nat-t-ike-03 and earlier 
This adds support for early versions of the draft that eventually
resulted in RFC 3947.
 2012-12-19 11:03:42 +01:00
Martin Willi 45d6134218 Raise an alert if allocating virtual IPs fails 2012-12-19 10:40:33 +01:00
Martin Willi f285b9efc8 Raise an alert if kernel policy installation fails 2012-12-19 10:40:33 +01:00
Martin Willi bcf3147e0a Raise an alert if kernel SA installation fails 2012-12-19 10:40:33 +01:00
Martin Willi 24f30ec92f Raise an alert on traffic selector mismatch 2012-12-19 10:40:32 +01:00
Martin Willi c794455666 Raise alerts when enforcing IKE_SA unique policy 2012-12-19 10:40:32 +01:00
Martin Willi 5dd9c3087f Raise an alert if CHILD_SA proposals mismatch 2012-12-19 10:40:32 +01:00
Martin Willi bab949bb26 Raise an alert if IKE proposals mismatch 2012-12-19 10:40:32 +01:00
Martin Willi 3f7f5388a5 Raise an alert of generating local authentication data fails 2012-12-19 10:40:32 +01:00
Tobias Brunner 283898d6e0 Fix traffic selectors also as initiator in case of transport mode over NAT 2012-12-13 15:27:29 +01:00
Tobias Brunner 2990671748 Fix debug output if responder selected invalid traffic selectors during QM 2012-12-13 15:27:28 +01:00
Martin Willi 43b4c2ea75 Inherit virtual IP and attributes from old to new, not from new to old 2012-12-10 17:01:00 +01:00