denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
7,988 Commits 1 Branch 0 Tags
9ad5b8fa951c294f3f79ffe701cac712a6cf18df
Commit Graph
53 Commits
Author SHA1 Message Date
Clavister OpenSource 7d9269bfce certificate handling for XAuth responder. 2012-03-20 17:31:11 +01:00
Clavister OpenSource 07abb470c6 IKEv1: Added basic support for INFORMATIONAL exchange types, and for NOTIFY_V1 messages in the 3rd message in quick_mode. 2012-03-20 17:31:11 +01:00
Tobias Brunner a0bea44a97 Message rules for IKEv1 NAT-T payloads added. 2012-03-20 17:31:10 +01:00
Tobias Brunner 1e97783c99 Added payloads for IKEv1 NAT-Traversal negotiation. 2012-03-20 17:31:09 +01:00
Tobias Brunner 37639e94fb Handle invalid IKEv1 hashes more specifically. 2012-03-20 17:31:08 +01:00
Tobias Brunner 29a5e0707e Handle unsupported IKEv1 exchange types more specifically. 2012-03-20 17:31:08 +01:00
Tobias Brunner 983e852af8 Handle INFORMATIONAL_V1 messages when no keys have been derived yet. 
This allows to gracefully process the INFORMATIONAL_V1 message rules which
require the payloads to be encrypted and thus the exchange to be
authenticated with a HASH payload.  If such an exchange is now initiated
before the ISAKMP_SA is established, the message is simply sent unencrypted
and without HASH payload.
 2012-03-20 17:31:08 +01:00
Tobias Brunner f4e21faa98 Fixed encryption of IKEv2 messages. 2012-03-20 17:30:50 +01:00
Martin Willi d020d4d695 Print message payload names after prepending IKEv1 HASH payload 2012-03-20 17:30:50 +01:00
Tobias Brunner cd200cb821 Authenticate and verify Phase 2 IKEv1 messages with appropriate hashes. 2012-03-20 17:30:50 +01:00
Martin Willi 017d98bf39 Merged IKEv1 attribute payload/data into configuration payload/attribute 2012-03-20 17:30:49 +01:00
Clavister OpenSource 54a8a94fa9 IKEv1 ConfigMode: Added TRANSACTION exchange type. Added attribute_payload (IKEv2 equiv cp_payload) and data_attribute (IKEv2 equiv configuration_attribute) payload types. Did not combine with IKEv2 because it wasn't trivial to do so. This might be a task worth investigating in the future, because there is a decent amount of shared code here. 2012-03-20 17:30:49 +01:00
Tobias Brunner d66199884f Set flags on message according to IKE version when parsing header. 2012-03-20 17:30:46 +01:00
Tobias Brunner c92f2cf36d Encrypt IKEv1 messages. 2012-03-20 17:30:46 +01:00
Tobias Brunner 477e856a15 Decrypt IKEv1 messages. 2012-03-20 17:30:46 +01:00
Tobias Brunner 0cec72df40 Provide keymat_t to message_t to encrypt/decrypt data. 2012-03-20 17:30:45 +01:00
Martin Willi 3bd5fcc832 Print message ID as unsigned integer 2012-03-20 17:30:45 +01:00
Martin Willi 9e40e3e9fa Added message encoding rules for quick mode 2012-03-20 17:30:45 +01:00
Martin Willi c311d22d0f Don't clone chunk in message.get_packet_data 2012-03-20 17:30:44 +01:00
Martin Willi 04ee2b7fed Added IKEv1 support to notify payload 2012-03-20 17:30:43 +01:00
Martin Willi bce8d3be11 Don't set IKEv2 only header flags when using IKEv1 2012-03-20 17:30:41 +01:00
Tobias Brunner 354ac9579f Compile error fixed. 2012-03-20 17:30:41 +01:00
Tobias Brunner 7f56cf1a65 Message parsing slightly refactored, allows parsing of unencrypted IKEv1 messages. 2012-03-20 17:30:40 +01:00
Tobias Brunner 4ed52db2bb Allow creation of message_t objects for IKEv1 packets. 2012-03-20 17:30:40 +01:00
Tobias Brunner 8a2d079d78 Certificate request payloads can be sent in pretty much any IKEv1 message. 2012-03-20 17:30:40 +01:00
Tobias Brunner 8f3aea2f77 Message rules for IKEv1 INFORMATIONAL exchange added. 
Since INFORMATIONAL "exchanges" are actually unidirectionally sent
message we don't have any responder rules.
 2012-03-20 17:30:40 +01:00
Tobias Brunner 130c9a54c2 Message rules for IKEv1 AGGRESSIVE exchange added. 
These are basically the same as for ID_PROT but no payloads are expected
to be encrypted (at least if using PSK or signatures for authentication).
 2012-03-20 17:30:40 +01:00
Tobias Brunner 6ba70ba8dd Message rules for IKEv1 ID_PROT exchange added. 
These rules are quite broad and cover main mode with at least PSK and
signature based authentication.
 2012-03-20 17:30:40 +01:00
Martin Willi 526b5afb45 Extended IKE header for IKEv1 support 2012-03-20 17:30:39 +01:00
Andreas Steffen a022f0863d increased message buffer to cope with NCP's innumerable UNITY Configuration Payloads 2011-08-16 23:22:20 +02:00
Martin Willi 61e13630f8 Show error code of Microsoft specific error notify 2011-08-03 12:01:15 +02:00
Tobias Brunner f3bb1bd039 Fixed common misspellings. 
Mostly found by 'codespell'.
 2011-07-20 16:14:10 +02:00
Tobias Brunner a07568cf6a Use has_more in decrypt_payloads instead of calling enumerate twice. 2011-07-06 09:43:46 +02:00
Martin Willi 6d41218ced Be a little more liberal in checking maximum payload count 2011-04-20 15:15:00 +02:00
Martin Willi f7aca91603 Accept IKE_SA_INIT responses without CERTIFICATE_REQUESTs 2011-04-20 15:04:02 +02:00
Martin Willi fe79cd4257 Accept non-encrypted INFORMATIONALs for ME connectivity checks 2011-02-01 09:47:36 +01:00
Martin Willi 9ca5d0280e Moved check if packet already encoded to ike_sa, avoids message() hook invocation twice 2011-01-05 16:45:52 +01:00
Martin Willi 2813be18f5 Added a message method to set the "higher version supported" flag 2011-01-05 16:45:52 +01:00
Martin Willi 166a2a45d9 Added reserved bit mangling wrapper functions to message 2011-01-05 16:45:51 +01:00
Martin Willi 2a19095e4c Apply IKE major/minor version set on message to IKE header 2011-01-05 16:45:46 +01:00
Martin Willi c67de660d2 Move critical bit checking to ike_sa, notify payload includes unsupported payload type 2011-01-05 16:45:44 +01:00
Martin Willi fea3aa5d12 Check for exceeded payload count even if we have a found one flagged as sufficient 2011-01-05 16:45:43 +01:00
Martin Willi b6c796464d Use the payloads actual type in unknown_payload_t 2011-01-05 16:45:43 +01:00
Martin Willi a30dba9282 Fail silently without INVALID_SYNTAX if message not verified 2011-01-05 16:45:42 +01:00
Martin Willi e6c6a4d304 Support removal of payloads from messages 2011-01-05 16:45:41 +01:00
Martin Willi 363ec8986c Added a message_t option to disable automatic payload sorting 2011-01-05 16:45:41 +01:00
Tobias Brunner 9b698a771c Enable the generation of unencrypted messages (e.g. ME connectivity checks). 2010-08-30 17:25:12 +02:00
Martin Willi e5c6ebb697 Use different return values in payload decryption to distinguish between integrity and syntax errors 2010-08-25 15:29:53 +02:00
Martin Willi b519071299 Use AEAD wrapper for encryption payload encryption/decryption 2010-08-19 19:02:33 +02:00
Martin Willi 7c9d8e1476 Migrated message_t to INIT/METHOD macros 2010-08-19 12:35:53 +02:00