denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
17,289 Commits 1 Branch 0 Tags
10e0faf477edc8064b11471fd94deef2f49167c4
Commit Graph
1436 Commits
Author SHA1 Message Date
Martin Willi 9a96ba4b6e Added a get_count() method to IKE_SA manager 2011-05-16 15:24:15 +02:00
Martin Willi a836cf8085 Fixed identiation in private_ike_sa_manager 2011-05-16 15:24:15 +02:00
Martin Willi 69c3eca0e9 Added a non-blocking, skipping variant of IKE_SA enumerator 2011-05-16 15:24:13 +02:00
Tobias Brunner 68447302d6 Typo fixed. 2011-04-28 12:50:30 +02:00
Martin Willi f9a552f011 Resolve and connect to RADIUS servers not before required 2011-04-21 14:01:25 +02:00
Martin Willi 52846ec820 Remove superfluous test for peer_cfg on established IKE_SAs 2011-04-20 12:31:29 +02:00
Martin Willi bd01b9d8b2 Install ESN SAs if such a proposal has been negotiated 2011-04-20 12:26:58 +02:00
Martin Willi 4876d4f3b3 Added an esn parameter to the kernel interface add_sa functions 2011-04-20 12:26:57 +02:00
Tobias Brunner 1c004bebd8 Clearly mark switch cases that fall through. 2011-04-19 13:48:50 +02:00
Tobias Brunner 3c0c321776 Neither rekey nor del can be NULL. 2011-04-14 18:10:27 +02:00
Andreas Steffen c98ed04de0 display EAP identifiers in HEX format 2011-04-06 17:34:27 +02:00
Andreas Steffen adcb221f19 log the EAP identifier also for vendor specific EAP methods 2011-04-05 13:57:37 +02:00
Andreas Steffen de93154231 log the initial value of the EAP identifier 2011-04-05 13:54:26 +02:00
Andreas Steffen 2f7c12a2f4 added get_identifier() and set_identifier() methods 2011-04-05 13:32:10 +02:00
Martin Willi 3ced6b51e4 Move establish/inherit of rekeyed IKE_SAs to delete messages 
Having the inherit() function delayed to the IKE_SA establish procedure
was problematic. The task destroy function was never a good place and
results in locking/cleanup problems. After establishing the SA, it
should be really checked in ASAP to avoid any triggered DPD checks
to get lost.
 2011-03-15 15:20:09 +01:00
Martin Willi f42156a8c8 Wrap IKE delete after rekey into rekey task for responder, too 2011-03-15 11:51:53 +01:00
Martin Willi 41080cbbd9 Migrated ike_rekey task to INIT/METHOD macros 2011-03-15 11:30:02 +01:00
Martin Willi 5f47296f22 Migrated sim_manager to INIT/METHOD macros 2011-03-08 16:42:27 +01:00
Martin Willi 7b3bfe4b6c Protect sim card/provider/hook (un-)registration with a rwlock 2011-03-08 16:42:27 +01:00
Martin Willi f58db72482 Splitted sim_manager.h header to sim_{card,provider,hooks}.h 2011-03-08 16:42:27 +01:00
Martin Willi e44ebdcfc8 Slightly change IKE_SA destruction order to inherit properly during ike_rekey task destruction 2011-02-28 10:31:36 +00:00
Martin Willi 94030a670b Report correct key size if a cipher is not supported 2011-02-07 16:39:33 +01:00
Tobias Brunner 84545f6e7c Some typos fixed. 2011-02-07 11:39:41 +01:00
Martin Willi b49d047bfc Invoke the per-round authorize() hook before purging current auth info on IKE_SA 2011-02-03 17:08:39 +01:00
Martin Willi 2b7686b5d8 Migrated ike_auth to INIT/METHOD macros, fixes missing initial_contact initialization 2011-02-02 15:13:39 +01:00
Martin Willi 1d34612f07 Do not use destroyed rng/hasher if IKE_SA has been flush()ed 2011-02-01 09:25:55 +01:00
Martin Willi 5c89a00f05 Do not log potentially hundreds of cert requests for unknown CAs at level 1 2011-01-28 08:29:23 +01:00
Martin Willi 983a5e88d3 Revert "Send INITIAL_CONTACT even if we have a unique policy" 
It makes sense to omit INITIAL_CONTACT if don't have a unique policy,
as a client might want to connect from different devices to the same
account.

This reverts commit 719c33b41a.
 2011-01-13 10:50:46 +01:00
Martin Willi 2082417df3 Force port update as responder when initiator switches to 4500 in IKE_AUTH 2011-01-12 14:37:15 +01:00
Martin Willi 8ba805f4db Avoid variable name overloading 2011-01-12 14:37:09 +01:00
Martin Willi 719c33b41a Send INITIAL_CONTACT even if we have a unique policy 2011-01-10 11:54:10 +01:00
Martin Willi 1ed482d808 Fix nonce comparison in rekey collisions, lowest nonce loses 2011-01-07 15:51:35 +01:00
Martin Willi 6f5892f5c7 Destroy existing IKE_SAs with same identities when receiving INITIAL_CONTACT 2011-01-05 16:46:08 +01:00
Martin Willi a4a1e24d37 Send INITIAL_CONTACT for the first IKE_SA if it has a unique policy 2011-01-05 16:46:08 +01:00
Martin Willi 240bd7dbb7 Migrated ike_sa_manager_t to INIT/METHOD macros, some cleanups 2011-01-05 16:46:08 +01:00
Martin Willi 3a89b3c52f Provide CRLs received in CERT payloads to trustchain verification 2011-01-05 16:46:06 +01:00
Martin Willi 5f15faebc8 Include the used reserved bytes from ID payloads in AUTH calculation 2011-01-05 16:45:53 +01:00
Martin Willi 502edf425f Migrated psk/pubkey_authenticators to INIT/METHOD macros 2011-01-05 16:45:53 +01:00
Martin Willi 9ca5d0280e Moved check if packet already encoded to ike_sa, avoids message() hook invocation twice 2011-01-05 16:45:52 +01:00
Martin Willi c67de660d2 Move critical bit checking to ike_sa, notify payload includes unsupported payload type 2011-01-05 16:45:44 +01:00
Martin Willi e7099aa24e Handle all error notifies in CREATE_CHILD_SA exchanges 2011-01-05 16:45:44 +01:00
Martin Willi c146c3c4e1 Ingore messages with exchange type altered to UNDEFINED in message() hook 2011-01-05 16:45:42 +01:00
Martin Willi 89fda1abb5 Moved message()-hook invocation to generate_message(), catch pre-generated IKE_SA_INITs, too 2011-01-05 16:45:41 +01:00
Martin Willi 6c2d466b90 Support manually triggerd DPD check, even if DPD disabled in config 2011-01-05 16:45:40 +01:00
Andreas Steffen 905ab99fc1 eliminated whitespace 2010-12-21 17:51:27 +01:00
Andreas Steffen cf16a29dac Migrated child_create_t to INIT/METHOD macros 2010-12-21 17:49:07 +01:00
Martin Willi 55df72e6d5 Do not use TFC padding if peer does not support ESPv3 2010-12-20 09:45:39 +01:00
Martin Willi 37788b1d06 Added a TFC padding option to child_cfg 2010-12-20 09:45:39 +01:00
Martin Willi d86bb6ef4d Implemented Traffic Flow Confidentiality padding in kernel_interface 2010-12-20 09:45:39 +01:00
Jiri Bohac 19b7f763b3 Install selectors on transport mode IPsec SAs. 
This fixes several test cases in IKEv2_Self_Test (part of the IPv6 Ready
Logo Program) which is required for USGv6 certification, namely:

  - IKEv2.EN.I.1.1.7.1, IKEv2.EN.I.1.1.7.1: Narrowing the range of members
    of the set of traffic selectors
  - IKEv2.EN.R.1.1.7.3: Narrowing multiple traffic selector

When traffic selectors of a triggered SA are narrowed by the responder, the
installed policy and the broader trap policy share the same reqid.  Without
selectors on the IPsec SA packets matching the trap policy, but not the
narrowed policy, would incorrectly be handled by that IPsec SA.  Since only
one selector can be specified per IPsec SA, there is currently no solution
for tunnel mode SAs.
 2010-12-13 15:28:40 +01:00