denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
9,706 Commits 1 Branch 0 Tags
d2e8f20d949dde98d5c42e5d7da9dae5771b56f1
Commit Graph
696 Commits
Author SHA1 Message Date
Tobias Brunner d2e8f20d94 Clear virtual IPs before storing assigned ones on the IKE_SA 
Otherwise we'll end up with duplicate or invalid VIPs stored on the
IKE_SA.
 2012-09-05 14:35:57 +02:00
Martin Willi 4c892fe533 In mode_config, destroy temporary pool list instead of the virtual IP list twice 2012-09-05 14:18:52 +02:00
Martin Willi 1323dc1138 Merge branch 'multi-vip' 
Brings support for multiple virtual IPs and multiple pools in
left/rigthsourceip definitions. Also introduces the new left/rightdns
options to configure requested DNS server address family and respond
with multiple connection specific servers.
 2012-08-31 12:55:56 +02:00
Tobias Brunner 868409139b Merge branch 'eap-client-select' 
This brings support for EAP-Nak payloads on the client (to select a
specific or supported method), and the server (via the eap-dynamic
plugin which selects a method supported/requested by the client).
 2012-08-31 12:25:41 +02:00
Tobias Brunner 7f2e3091ee Log the proper type for virtual EAP methods 2012-08-31 11:42:03 +02:00
Tobias Brunner cc4eec56f7 Encode EAP-Naks in expanded format if we got an expanded type request 
Since methods defined by the IETF (vendor ID 0) could also be encoded in
expanded type format the previous check was insufficient.
 2012-08-31 11:40:27 +02:00
Tobias Brunner 78e8dca94f Allow clients to request a configured EAP method via EAP-Nak 2012-08-31 11:40:27 +02:00
Tobias Brunner 34742f1bf8 Virtual EAP methods handle EAP-Naks themselves 2012-08-31 11:40:27 +02:00
Tobias Brunner af04233e14 Send EAP-Nak with supported types if requested type is unsupported 2012-08-31 11:40:27 +02:00
Tobias Brunner 7cad171da8 Filter invalid EAP authentication types when enumerating them 
Valid authentication types defined by the IETF are 4-253 and 255.
 2012-08-31 11:37:45 +02:00
Martin Willi b5d2bf975b Request and acquire multiple virtual IPs in IKEv1 Mode Config 2012-08-30 16:43:43 +02:00
Martin Willi 61d6ccf51c Request and acquire multiple virtual IPs in IKEv2 configuration payload 2012-08-30 16:43:43 +02:00
Martin Willi d55fe264d1 Pass all configured pool names to attribute provider enumerator 2012-08-30 16:43:43 +02:00
Martin Willi feb8550401 Pass a list instead of a single virtual IP to attribute enumerators 2012-08-30 16:43:42 +02:00
Martin Willi 497ce2cf51 Support multiple address pools configured on a peer_cfg 2012-08-30 16:43:42 +02:00
Martin Willi 101d26babe Support multiple virtual IPs on peer_cfg and ike_sa classes 2012-08-30 16:43:42 +02:00
Tobias Brunner 1184493407 Fall back to local address as IKEv1 identity if nothing else is configured 2012-08-24 12:55:01 +02:00
Tobias Brunner 078755d099 Added a method to enumerate registered EAP methods 2012-08-21 16:48:47 +02:00
Martin Willi 10bdc7a968 Remove the unused second IKE_SA entry match function argument 
LLVMs clang complains about this parameter, so remove it.
 2012-08-20 17:42:14 +02:00
Adrian-Ken Rueegsegger acf27437cd Add keymat_t constructor registration function 
Using the register_constructor function enables custom keymat_t
implementations per IKE version. If no constructor is registered the
default behavior is preserved.
 2012-08-20 13:02:47 +02:00
Tobias Brunner 09ae3d79ca Merge branch 'android-app' 
This branch introduces a userland IPsec implementation (libipsec) and an
Android App which targets the VpnService API that is provided by Android 4+.

The implementation is based on the bachelor thesis 'Userland IPsec for
Android 4' by Giuliano Grassi and Ralf Sager.
 2012-08-13 12:07:52 +02:00
Tobias Brunner e4ef4c9877 Merge branch 'android-ndk' 
This branch comes with some preliminary changes for the user-land IPsec
implementation and the Android App.

One important change is that the UDP ports used by the socket-default plugin
were made configurable (either via ./configure or strongswan.conf).
Also, the plugin does randomly allocate a port if it is configured to 0,
which is useful for client implementations.  A consequence of these
changes is that the local UDP port used when creating ike_cfg_t objects has
to be fetched from the socket.
 2012-08-13 10:45:39 +02:00
Martin Willi cd55a3cb77 Use actual daemon name to enable XAuth/PSK with aggressive mode 2012-08-10 11:53:18 +02:00
Tobias Brunner 5764a9b355 Moved packet_t to libstrongswan 2012-08-08 15:41:02 +02:00
Tobias Brunner f3fefb1847 Increase log verbosity when sending NAT keep-alives 2012-08-08 15:41:02 +02:00
Tobias Brunner b223d517c8 Replaced usages of CHARON_*_PORT with calls to get_port(). 2012-08-08 15:12:25 +02:00
Tobias Brunner 75f8316332 Use send_no_marker to send NAT keepalives. 2012-08-08 15:12:25 +02:00
Tobias Brunner e7ea057fd2 Make the UDP ports charon listens for packets on (and uses as source ports) configurable. 2012-08-08 15:07:43 +02:00
Martin Willi 4e98ca1800 Remove queued IKEv1 message before processing it 
Avoids destruction or processing of a queued message in
recursive process_message() call.
 2012-08-08 14:54:03 +02:00
Tobias Brunner 6204c1182d Include src address in hash of initial message for Main Mode 
If two initiators use the same SPI and also use the same SA proposal the
hash for the initial message would be exactly the same.  For IKEv2 and
Aggressive Mode that's not a problem as these messages include random
data (Ni, KEi payloads).
 2012-08-08 14:47:36 +02:00
Martin Willi 764035d515 Block XAuth transaction on established IKE_SAs, but allow Mode Config 2012-08-03 13:07:57 +02:00
Martin Willi 394b9f6b65 Reject initial exchange messages early once IKE_SA is established 2012-08-02 13:04:54 +02:00
Martin Willi f701ba8389 Lookup IKEv1 PSK even if the peer identity is not known 2012-07-31 15:39:33 +02:00
Martin Willi 777bcdc0d5 Don't include acquiring packet traffic selectors in IKEv1 
As we only can negotiate a single TS in IKEv1, don't prepend the
triggering packet TS, as we do in IKEv2. Otherwise we don't establish
the TS of the configuration, but only that of the triggering packet.

Fixes #207.
 2012-07-26 15:45:49 +02:00
Martin Willi 8b560a4565 Implement late peer config switching after XAuth authentication 
If additional authentication constraints, such as group membership,
is not fulfilled by an XAuth backend, we search for another
peer configuration that fulfills all constraints, including those
from phase1.
 2012-07-26 15:17:36 +02:00
Martin Willi 40ca05cff8 Check if XAuth round complies to configured authentication round 2012-07-26 12:40:27 +02:00
Martin Willi 9191946a63 Merge auth config items added from XAuth backends to IKE_SA 2012-07-26 12:07:48 +02:00
Martin Willi 81419807f5 Release leaking child config after uninstalling shunt policy 2012-07-23 17:15:40 +02:00
Martin Willi a564e4ca77 Refactored error handling in keymat_v1_t 2012-07-16 14:55:07 +02:00
Martin Willi 4decfae6c2 Clean up error handling in keymat_v2_t 2012-07-16 14:55:07 +02:00
Martin Willi 511f0b18b9 Cleaned up memory management and return values for encryption payload 2012-07-16 14:55:07 +02:00
Martin Willi 87dd205b61 Add a return value to hasher_t.allocate_hash() 2012-07-16 14:55:06 +02:00
Martin Willi e185612dd8 Add a return value to keymat_v1_t.{get,update,confirm}_iv 2012-07-16 14:55:06 +02:00
Martin Willi ce73fc19db Add a return value to crypter_t.set_key() 2012-07-16 14:53:38 +02:00
Martin Willi 3b96189a2a Add a return value to crypter_t.decrypt() 2012-07-16 14:53:38 +02:00
Martin Willi e35abbe588 Add a return value to crypter_t.encrypt 2012-07-16 14:53:37 +02:00
Tobias Brunner f1c78cfee7 Check rng return value when generating ME CONNECT_ID and KEY 2012-07-16 14:53:35 +02:00
Tobias Brunner 1bb9c51e87 Check rng return value when generating IKEv1 message IDs 2012-07-16 14:53:35 +02:00
Tobias Brunner 504918348d Check rng return value when generating COOKIE2 during MOBIKE 2012-07-16 14:53:35 +02:00
Tobias Brunner 92f207477c Check rng return value when generating fake NAT detection payloads 2012-07-16 14:53:35 +02:00