denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
19,626 Commits 1 Branch 0 Tags
4840507d7aeec03845f4cecb7cdea73b9a0c2021
Commit Graph
394 Commits
Author SHA1 Message Date
Tobias Brunner f5f7424e1d notify-payload: Add notify type for IP-TFS/AGGFRAG 2025-05-28 16:37:46 +02:00
Tobias Brunner 749814a75f notify-payload: Add notify types for per-resource CHILD_SAs 2025-05-28 16:35:26 +02:00
Tobias Brunner 6ed63be612 peer-cfg: Use flags for boolean options 
Makes it potentially easier to add new flags.

The mediation flag is not converted as the #ifdefs make it awkward.
 2025-04-10 08:31:09 +02:00
Tobias Brunner 11978ddd39 Cast uses of return_*(), nop() and enumerator_create_empty() 
As described in the previous commit, GCC 15 uses C23 by default and that
changes the meaning of such argument-less function declarations.  So
whenever we assign such a function to a pointer that expects a function
with arguments it causes an incompatible pointer type warning.  We
could define dedicated functions/callbacks whenever necessary, but this
seems like the simpler approach for now (especially since most uses of
these functions have already been cast).
 2025-03-19 10:22:37 +01:00
Tobias Brunner 17bc5166d4 Fixed some typos, courtesy of codespell 2024-11-25 12:06:54 +01:00
Tobias Brunner 089977b69d generator: Make debug log for payload substructure rules more clear 
Similar to the previous commit.  Instead of

  generating rule 10 (1258)

followed by (or not if the list is empty)

  generating payload of type PROPOSAL_SUBSTRUCTURE

we now get

  generating rule 10 LIST of PROPOSAL_SUBSTRUCTURE

in the debug log.
 2024-10-02 10:08:51 +02:00
Tobias Brunner 2ec6d50a3c parser: Make debug log for payload substructure rules more clear 
Instead of this

  parsing rule 10 (1258)

we now see this

  parsing rule 10 LIST of PROPOSAL_SUBSTRUCTURE

in the debug log. Particularly useful if the list is empty as there won't
be a message like this following it:

  x bytes left, parsing recursively PROPOSAL_SUBSTRUCTURE
 2024-10-02 10:07:36 +02:00
Tobias Brunner 515b9303de message: Store original encrypted payload when generating fragments 
If we don't do this, get_plain() will fail after generating the message
fragmented unless it was generated non-fragmented previously.
 2024-08-07 16:20:18 +02:00
Tobias Brunner b9c69f9080 message: Add method to generate data to authenticate IKE_INTERMEDIATE exchanges 2024-08-07 16:20:18 +02:00
Tobias Brunner 5c439bb8a3 generator: Make pointer to length field optional 
Only useful if we generate an IKE header.
 2024-08-07 16:20:18 +02:00
Tobias Brunner b8358936aa message: Add rules for IKE_FOLLOWUP_KE exchanges 2024-08-07 16:20:18 +02:00
Tobias Brunner 414db6cab1 ike-header: Add IKE_FOLLOWUP_KE exchange type 2024-08-07 16:20:18 +02:00
Tobias Brunner 041358976b notify-payload: Add notify types for multiple key exchanges 2024-08-07 16:20:18 +02:00
Tobias Brunner 25f2cdfc56 message: Add rules for IKE_INTERMEDIATE exchanges 2024-08-07 16:20:18 +02:00
Tobias Brunner a45d454e94 ike-header: Add IKE_INTERMEDIATE exchange type 2024-08-07 16:20:18 +02:00
Tobias Brunner cc9ab450d6 notify-payload: Add notify type for IKE_INTERMEDIATE exchange 2024-08-07 16:20:18 +02:00
Tobias Brunner 3e0495745c proposal-substructure: Encode additional key exchange methods 2024-08-07 16:20:18 +02:00
Thomas Egerer 84bd011752 ike-sa: Add address family specific configuration of fragment size 
Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
 2024-08-07 14:19:41 +02:00
Jean-François HrenandTobias Brunner 15612b3a42 Add support for IKEv2 OCSP extensions (RFC 4806) 
Closes strongswan/strongswan#2016

Co-authored-by: Tobias Brunner <tobias@strongswan.org>
 2024-03-13 15:10:50 +01:00
Tobias Brunner 10a3c44a41 notify-payload: Add methods to simplify encoding and retrieving IKE SPIs 
The get_spi_data() method is currently not used, so that has been
simplified so it can be used for any protocol type and any SPI length.
Same for set_spi_data(), which is currently used for IKEv1 to encode
two SPIs.
 2023-07-26 15:09:49 +02:00
Tobias Brunner 79d49ea05b message: Fix build with DEBUG__LEVEL < 1 2023-05-08 17:32:17 +02:00
Tobias Brunner 9b9464fdcd generator: Fix build with DEBUG_LEVEL < 2 2023-05-08 17:32:17 +02:00
Tobias Brunner 9efd7d7e90 eap: Print vendor (PEN) names for vendor-specific EAP methods 2022-09-21 13:53:44 +02:00
Tobias Brunner f6e6fcd2f6 eap: Use pen_t instead of uint32_t for vendor ID 2022-09-21 13:53:44 +02:00
Tobias Brunner c1987aefbe message: Fix payload type in last unprotected payload of a fragmented message 2022-06-29 10:28:50 +02:00
Andreas Steffen b7c167f972 Rename MODP_NONE to KE_NONE 2022-06-29 10:28:50 +02:00
Tobias Brunner 3af7c6db87 Rename diffie_hellman_t to key_exchange_t and change the interface etc. 
This makes it more generic so we can use it for QSKE methods.
 2022-06-29 10:28:50 +02:00
Tobias Brunner 19ef2aec15 Update copyright headers after acquisition by secunet 2022-06-28 10:22:56 +02:00
Tobias Brunner c4e2b7617f encoding: Remove unused TS_TYPE and ADDRESS encodings 2022-04-14 18:42:01 +02:00
Tobias Brunner f4c0ec0b71 ts-payload: Add support for TS of type TS_SECLABEL 
The security labels can be retrieved in a separate list from the
regular traffic selectors.  We currently only plan to support a single
security label ourselves, so when generating we don't expect a list.
 2022-04-14 18:42:01 +02:00
Tobias Brunner a44de0b957 traffic-selector-substructure: Add support for TS_SECLABEL 
Changes how regular address range traffic selectors are parsed as the
IKE parser currently doesn't provide sub-type parsing.

Also removed a lot of unused method definitions.
 2022-04-14 18:42:01 +02:00
Tobias Brunner 6867050d47 message: Add getter/setter for metadata handling 2022-01-14 10:13:21 +01:00
Tobias Brunner db93938297 notify-payload: Update reference for notify types for PPKs 
draft-ietf-ipsecme-qr-ikev2 was released as RFC 8784 in June of 2020.
 2021-05-11 14:30:05 +02:00
Tobias Brunner e0dd36c9c7 ikev1: Get and set the lifetimes of the selected proposal/transform 
Previously, we simply used the lifetimes of the first
proposal/transform, which is not correct if the initiator uses different
lifetimes in its proposals/transforms.
 2020-03-06 10:31:30 +01:00
Tobias Brunner 1c6b43b8ea proposal-substructure: Start numbering IKEv1 proposals with 1 2020-03-06 10:31:30 +01:00
Tobias Brunner 859f9c8c83 proposal-substructure: Encode transform number of selected IKEv1 proposal 2020-03-06 10:31:30 +01:00
Tobias Brunner 7da3143aac proposal-substructure: Store transform number for IKEv1 proposals 2020-03-06 10:31:30 +01:00
Josh Soref b3ab7a48cc Spelling fixes 
* accumulating
* acquire
* alignment
* appropriate
* argument
* assign
* attribute
* authenticate
* authentication
* authenticator
* authority
* auxiliary
* brackets
* callback
* camellia
* can't
* cancelability
* certificate
* choinyambuu
* chunk
* collector
* collision
* communicating
* compares
* compatibility
* compressed
* confidentiality
* configuration
* connection
* consistency
* constraint
* construction
* constructor
* database
* decapsulated
* declaration
* decrypt
* derivative
* destination
* destroyed
* details
* devised
* dynamic
* ecapsulation
* encoded
* encoding
* encrypted
* enforcing
* enumerator
* establishment
* excluded
* exclusively
* exited
* expecting
* expire
* extension
* filter
* firewall
* foundation
* fulfillment
* gateways
* hashing
* hashtable
* heartbeats
* identifier
* identifiers
* identities
* identity
* implementers
* indicating
* initialize
* initiate
* initiation
* initiator
* inner
* instantiate
* legitimate
* libraries
* libstrongswan
* logger
* malloc
* manager
* manually
* measurement
* mechanism
* message
* network
* nonexistent
* object
* occurrence
* optional
* outgoing
* packages
* packets
* padding
* particular
* passphrase
* payload
* periodically
* policies
* possible
* previously
* priority
* proposal
* protocol
* provide
* provider
* pseudo
* pseudonym
* public
* qualifier
* quantum
* quintuplets
* reached
* reading
* recommendation to
* recommendation
* recursive
* reestablish
* referencing
* registered
* rekeying
* reliable
* replacing
* representing
* represents
* request
* request
* resolver
* result
* resulting
* resynchronization
* retriable
* revocation
* right
* rollback
* rule
* rules
* runtime
* scenario
* scheduled
* security
* segment
* service
* setting
* signature
* specific
* specified
* speed
* started
* steffen
* strongswan
* subjectaltname
* supported
* threadsafe
* traffic
* tremendously
* treshold
* unique
* uniqueness
* unknown
* until
* upper
* using
* validator
* verification
* version
* version
* warrior

Closes strongswan/strongswan#164.
 2020-02-11 18:23:07 +01:00
Tobias Brunner 17c9972252 Fixed some typos, courtesy of codespell 2019-08-28 14:03:41 +02:00
Tobias Brunner 902f38dd3e ikev2: Check the length of received COOKIE notifies 
As specified by RFC 7296, section 2.6, the data associated with COOKIE
notifications MUST be between 1 and 64 octets in length (inclusive).

Fixes #3160.
 2019-08-28 12:15:27 +02:00
Tobias Brunner 02b348403a Fixed some typos, courtesy of codespell 2019-04-29 15:09:20 +02:00
SophieK de77957eda proposal-substructure: Fix incorrect type for IKEv2 proposals 
Luckily, the type is only used once when generating payloads and there it
doesn't matter because the encoding rules are the same.

Closes strongswan/strongswan#135.
 2019-04-25 09:40:51 +02:00
Tobias Brunner 7b2236526c message: Enforce encryption except for INFORMATIONALs 
The only messages that are generally sent encrypted but could be sent
unencrypted are INFORMATIONALs (currently only used for IKEv1 and ME
connectivity checks).  This should prevent issues if the keymat_t behaves
incorrectly and does not return an aead_t when it actually should.
 2019-04-15 14:01:02 +02:00
Tobias Brunner 333adbc25b generator: Don't print any tainted values in DBG3 messages for U_INT_4 
The bits not written to are marked tainted by valgrind, don't print
them in the debug messages.  Also use more specific printf-specifiers
for other values.
 2019-03-27 10:00:09 +01:00
Tobias Brunner 0f423dda28 ikev2: Add notify types for Postquantum Preshared Keys 2018-09-10 18:03:00 +02:00
Tobias Brunner 9403320fca message: Report the size of the complete reassembled IKE message 
This way we see the same size on both ends, namely that of the complete
IKE message as if it was sent in a single packet (excluding UDP/IP headers).
 2018-07-09 17:49:07 +02:00
Tobias Brunner 62721936b1 encrypted-payload: Change how the length for reassembled messages is calculated 
If we have an AEAD transform we add the overhead as if the data would have
been transported in a single encrypted payload.
 2018-07-09 17:25:02 +02:00
Tobias Brunner cc1f01e009 encrypted-payload: Add getter for the used AEAD transform 2018-07-09 17:15:07 +02:00
Tobias Brunner b68a0adace ike: Include length of reassembled IKE message in log message 
Also simplify wording a bit when fragmenting.
 2018-07-02 12:19:00 +02:00
Tobias Brunner 1b67166921 Unify format of HSR copyright statements 2018-05-23 16:32:53 +02:00