denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
17,289 Commits 1 Branch 0 Tags
10e0faf477edc8064b11471fd94deef2f49167c4
Commit Graph
1436 Commits
Author SHA1 Message Date
Martin Willi c60246a618 Support inactivity timeout in IKEv1 CHILD_SAs 2012-03-20 17:31:39 +01:00
Martin Willi a0c17d4157 Use a dedicated PRF for HASH/SIG payloads using ECDSA specific hasher 2012-03-20 17:31:39 +01:00
Martin Willi 4c685e8850 Select public key auth method by checking what key we have 2012-03-20 17:31:39 +01:00
Martin Willi 83b152dd4f Support ECDSA signatures in IKEv1 pubkey authenticator 2012-03-20 17:31:39 +01:00
Martin Willi 5be386ff8e Exchange certificates when using IKEv1 ECDSA authentication 2012-03-20 17:31:39 +01:00
Martin Willi a994050e9c Don't re-resolve addresses during initiate if they have already been set 2012-03-20 17:31:38 +01:00
Martin Willi aa3b53e716 Adopt children after syncing a rekeyed IKEv1 SA 2012-03-20 17:31:38 +01:00
Martin Willi fd6fbf1764 Setting message ID on task manager sets DPD sequence numbers in IKEv1 2012-03-20 17:31:38 +01:00
Martin Willi 783c496966 Update state before triggering DPD, as we cancel it if PASSIVE 2012-03-20 17:31:38 +01:00
Martin Willi a46b8e16ad Set thread specific SA on bus for each enumerated IKE_SA 2012-03-20 17:31:38 +01:00
Martin Willi 47b8f6ef4b Invoke bus_t.message hook twice, once plain and parsed, once encoded and encrypted 2012-03-20 17:31:37 +01:00
Martin Willi a0fa7a7f64 Clear initiator flag when checking out initial IKEv1 SA from message 2012-03-20 17:31:37 +01:00
Martin Willi 23f9e7a18d Pass IKEv1 specific keymat to ike_keys hook 2012-03-20 17:31:37 +01:00
Martin Willi 3624b09e21 Set selected proposal on IKEv1 SA, don't pass it separately to Phase 1 helper 2012-03-20 17:31:37 +01:00
Martin Willi 3957a6e4f3 Get a reference for the child_cfg passed to child_create_create() 2012-03-20 17:31:36 +01:00
Martin Willi 696fa8e003 Invoke bus_t.narrow hook in quick mode exchange 2012-03-20 17:31:36 +01:00
Martin Willi f420f51f55 Invoke authorization hooks for IKEv1 connections 2012-03-20 17:31:36 +01:00
Martin Willi 1a0648490c Invoke ike_updown hooks for reauthenticated IKEv1 SAs 2012-03-20 17:31:36 +01:00
Martin Willi b6ac063c36 Don't invoke a child_updown hook when a quick mode to delete has been rekeyed 2012-03-20 17:31:36 +01:00
Martin Willi 669d8bded2 Invoke child_rekey hook instead of child_updown when rekeying a quick mode 2012-03-20 17:31:36 +01:00
Martin Willi 5b7fc76861 Don't invoke updown hook when flushing SAs for IKEv1, tasks will do it 2012-03-20 17:31:36 +01:00
Martin Willi c654d949f3 Fix "incoming" flag passed to bus_t.message() hook 2012-03-20 17:31:36 +01:00
Martin Willi 477559cab5 Continue with next exchange after sending an INFORMATIONAL 2012-03-20 17:31:36 +01:00
Martin Willi 1b82eb23a2 Handle retransmission of DPD exchange, both as initiator and responder 2012-03-20 17:31:36 +01:00
Martin Willi 11aadd7722 Disable DPD checking for peers not supporting it 2012-03-20 17:31:35 +01:00
Martin Willi 214d4e4090 Added missing DPD task name 2012-03-20 17:31:35 +01:00
Martin Willi ff6b084ac4 Confirm message reception time only if DPD sequence number valid 2012-03-20 17:31:35 +01:00
Martin Willi 2ddd45c9a7 Simplified DPD handling by using a task for a single message only 2012-03-20 17:31:35 +01:00
Martin Willi 3fca5bd123 Check if we have an RNG for IKEv1 task manager before using it 2012-03-20 17:31:35 +01:00
Martin Willi 31689338d6 Remove unused DPD sequence number getter on task manager 2012-03-20 17:31:35 +01:00
Martin Willi 1e624ce876 Don't retransmit, rekey, reauth or DPD check SAs when in PASSIVE state 2012-03-20 17:31:35 +01:00
Clavister OpenSource c9a160953e Send DPD vendor ID 2012-03-20 17:31:35 +01:00
Clavister OpenSource 3e6b740336 Isakmp_dpd task added. 2012-03-20 17:31:35 +01:00
Martin Willi 346dad30d4 Request and handle retransmission of a lost third aggressive mode message 2012-03-20 17:31:34 +01:00
Martin Willi 37c12bd31e Streamlined debug output when initiating IKEv1 IKE_SAs 2012-03-20 17:31:34 +01:00
Martin Willi c40963b457 Enforce encapsulation mode of configuration, in case initiator proposes both 2012-03-20 17:31:34 +01:00
Martin Willi 830ab2ae7f Handle aggressive mode task in IKEv1 task manager 2012-03-20 17:31:34 +01:00
Martin Willi 91c212fd6a Select IKEv1 configurations by main/aggressive mode option 2012-03-20 17:31:34 +01:00
Martin Willi a347c1ac43 Fix sending of CERTREQ/CERT payloads in aggressive mode 2012-03-20 17:31:34 +01:00
Martin Willi ee325b555f Implemented aggressive mode using Phase 1 helper class 2012-03-20 17:31:33 +01:00
Martin Willi b4bd875612 Make use of the new Phase 1 helper class in main mode 2012-03-20 17:31:33 +01:00
Martin Willi c29a89b80d Implemented a common Phase 1 helper class to use by main and aggressive modes 2012-03-20 17:31:33 +01:00
Martin Willi 44dcd5944a Fix error handling if no PSK found for main mode 2012-03-20 17:31:33 +01:00
Martin Willi 90731f38c9 Install quick mode CHILD_SAs with negotiated encapsulation mode 2012-03-20 17:31:33 +01:00
Martin Willi b147679a2c Try to detect reauthentication as responder and adopt children to new SA 2012-03-20 17:31:33 +01:00
Martin Willi 3a0b67bce5 Destroy IKE_SA after reauthentication initiatend and lifetime limit reached 2012-03-20 17:31:33 +01:00
Martin Willi cb1a145ce2 Added an IKE_SA manager method to enumerate IKE_SA IDs filtered by identities 2012-03-20 17:31:33 +01:00
Martin Willi beab4a90ae Query for XAuth identity in get_other_eap_id(), too 2012-03-20 17:31:32 +01:00
Martin Willi 1b79299b89 Set ISAKMP SA state to rekeying after triggering reauthentication 2012-03-20 17:31:32 +01:00
Martin Willi c9d68d17f0 Include peer config overtime in negotiated ISAKMP SA lifetime 2012-03-20 17:31:32 +01:00