sharpetronics/strongswan
1
0
Fork 0
mirror of https://github.com/strongswan/strongswan.git synced 2025-10-04 00:00:14 -04:00
Code Issues Projects Releases Wiki Activity
18,026 Commits 101 Branches 327 Tags
Commit Graph

18026 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Tobias Brunner
690eba24ca ike-rekey: Don't actively rekey already rekeyed SAs 
If the peer successfully rekeyed the SA it gets marked as IKE_REKEYED
and it remains until the peer deletes it (or a timeout).  There is no
point in rekeying such SAs again.

IKE_REKEYING will be relevant if we have multi-KE rekeyings and are
waiting for followup key exchanges for a passive rekeying.
 2021-07-06 14:45:42 +02:00
Tobias Brunner
f535d2208d ike-init: Ignore COOKIE payloads during rekeying 
This ensures that process_i() only returns NEED_MORE due to multiple
key exchanges or an INVALID_KE_PAYLOAD notify.
 2021-07-06 14:45:42 +02:00
Tobias Brunner
f065fc4109 ike-init: Add support for multiple key exchanges 
Initially, this is handled with a key derivation for each
IKE_INTERMEDIATE exchange.  When rekeying the keys are derived only when
all IKE_FOLLOWUP_KE exchanges are done.
 2021-07-06 14:45:42 +02:00
Tobias Brunner
cfae243d96 bus: Support multiple key exchanges in ike/child_keys() events 2021-07-06 14:45:42 +02:00
Tobias Brunner
5765d7cbd0 keymat_v2: Support key derivation with multiple key exchanges 2021-07-06 14:45:42 +02:00
Tobias Brunner
a11ce277de key-exchange: Add helper to concatenate shared secrets of several key exchanges 2021-07-06 14:45:42 +02:00
Tobias Brunner
ad62440cf6 keymat_v2: Proper cleanup if derive_ike_keys() is called multiple times 2021-07-06 14:45:42 +02:00
Tobias Brunner
3d5a96bd56 ike-sa-manager: Log SPIs when checking in an IKE_SA 2021-07-06 14:45:42 +02:00
Tobias Brunner
7d028ab2c9 ikev2: Use hashes to detect retransmits 
We avoid parsing messages with unexpected message IDs.  This allows us to
process and detect retransmits of messages for which we don't have the keys
anymore (i.e. IKE_INTERMEDIATE after IKE_SA_INIT and changing the keys).

This also changes how retransmits for fragmented messages are triggered,
previously we waited for all fragments and reconstructed the message
before retransmitting the response.  Now we only track the first
fragment and if we receive a retransmit of it respond immediately
without waiting for other fragments (which are now ignored).  This is in
compliance with RFC 7383, section 2.6.1.
 2021-07-06 14:45:42 +02:00
Tobias Brunner
e4e48e6f7f ike-auth: Calculate and collect IntAuth for IKE_INTERMEDIATE exchanges 2021-07-06 14:45:42 +02:00
Tobias Brunner
27c80ae017 pubkey-authenticator: Handle IntAuth data 2021-07-06 14:45:42 +02:00
Tobias Brunner
03d24398f5 psk-authenticator: Handle IntAuth data 2021-07-06 14:45:42 +02:00
Tobias Brunner
425630702e eap-authenticator: Handle IntAuth data 2021-07-06 14:45:42 +02:00
Tobias Brunner
19349aaeef keymat_v2: Include optional IntAuth in signed octets 2021-07-06 14:45:42 +02:00
Tobias Brunner
e8c7dfb391 authenticator: Add optional method to set IntAuth data 2021-07-06 14:45:42 +02:00
Tobias Brunner
8429e401a2 message: Add method to generate data to authenticate IKE_INTERMEDIATE exchanges 2021-07-06 14:45:42 +02:00
Tobias Brunner
68ef0e919b generator: Make pointer to length field optional 
Only useful if we generate an IKE header.
 2021-07-06 14:45:42 +02:00
Tobias Brunner
92e709397f message: Fix payload type in last unprotected payload of a fragmented message 2021-07-06 14:45:42 +02:00
Tobias Brunner
fe243606b5 keymat_v2: Add method to calculate IntAuth for IKE_INTERMEDIATE exchanges 2021-07-06 14:45:42 +02:00
Tobias Brunner
df5453b33f ike-rekey: Reset IKE_SA after processing CREATE_CHILD_SA request 
This probably didn't cause any problems, as there wasn't really anything
happening between the calls, but reset it anyway, just to be safe.
 2021-07-06 14:45:42 +02:00
Tobias Brunner
cc9e1c1e2f ikev2: Allow tasks to do work after processing requests/responses 2021-07-06 14:45:42 +02:00
Tobias Brunner
7015587e09 task: Add optional post_process() method 
This will allows tasks to do some work after a message has been
processed.
 2021-07-06 14:45:42 +02:00
Tobias Brunner
ab1d77168c ikev2: Allow tasks to do work after generating requests/responses 2021-07-06 14:45:42 +02:00
Tobias Brunner
7dd3bec141 task: Add optional post_build() method 
This will allow tasks to do some work after the message has been
generated.
 2021-07-06 14:45:41 +02:00
Tobias Brunner
0c375bf9a3 ike-auth: Support IKE_INTERMEDIATE exchange between IKE_SA_INIT and IKE_AUTH 2021-07-06 14:45:41 +02:00
Tobias Brunner
6b76261372 child-create: Support IKE_INTERMEDIATE exchange between IKE_SA_INIT and IKE_AUTH 2021-07-06 14:45:41 +02:00
Tobias Brunner
80af87de84 ike-mobike: Support IKE_INTERMEDIATE exchange between IKE_SA_INIT and IKE_AUTH 
This changes the MID of the first IKE_AUTH message.
 2021-07-06 14:45:41 +02:00
Tobias Brunner
12bb9a2c4d ike-config: Support IKE_INTERMEDIATE exchange between IKE_SA_INIT and IKE_AUTH 
This changes the MID of the first IKE_AUTH message.
 2021-07-06 14:45:41 +02:00
Tobias Brunner
8c9675a2fa ike-cert-post: Make absolutely sure certificates are only added to IKE_AUTH 
The AUTH payload check should be fine, but add some extra checks just to make
really sure and also for clarification.
 2021-07-06 14:45:41 +02:00
Tobias Brunner
c551724f3e ike-cert-pre: Support IKE_INTERMEDIATE exchange between IKE_SA_INIT and IKE_AUTH 
The first IKE_AUTH does not have MID 1 if that's the case.
 2021-07-06 14:45:41 +02:00
Tobias Brunner
611983987c status: Add return_need_more() utility function 2021-07-06 14:45:41 +02:00
Tobias Brunner
f9f8b175fd message: Add rules for IKE_FOLLOWUP_KE exchanges 2021-07-06 14:45:41 +02:00
Tobias Brunner
fd1e928e1f wip: ike-header: Add IKE_FOLLOWUP_KE exchange type 2021-07-06 14:45:41 +02:00
Tobias Brunner
8da5a95cfc message: Add rules for IKE_INTERMEDIATE exchanges 2021-07-06 14:45:41 +02:00
Tobias Brunner
19c9bb44c9 wip: ike-header: Add IKE_INTERMEDIATE exchange type 2021-07-06 14:45:41 +02:00
Tobias Brunner
497c40b70b wip: notify-payload: Add notify types for multiple key exchanges 2021-07-06 14:45:41 +02:00
Tobias Brunner
6110ad0181 wip: notify-payload: Add notify type for IKE_INTERMEDIATE exchange 2021-07-06 14:45:41 +02:00
Tobias Brunner
45d0ae5d4f proposal-substructure: Encode additional key exchange methods 2021-07-06 14:45:41 +02:00
Tobias Brunner
7db736c761 child-cfg: Add method to check if an algorithm is proposed 2021-07-06 14:45:41 +02:00
Tobias Brunner
d739316681 child-cfg: Generalize get_ke_method() method 2021-07-06 14:45:41 +02:00
Tobias Brunner
e47193a7c0 ike-cfg: Generalize get_ke_method() method 2021-07-06 14:45:41 +02:00
Tobias Brunner
80ad22563a proposal: Generalize KE methods 2021-07-06 14:45:41 +02:00
Tobias Brunner
ea1fb56281 proposal: Make all key exchange transforms optional in ESP/AH proposals 2021-07-06 14:45:41 +02:00
Tobias Brunner
f03e8863ac proposal: Skip all KE transforms if PROPOSAL_SKIP_KE given 2021-07-06 14:45:41 +02:00
Tobias Brunner
4c6fc2b62c transform: Add helper to check if transform type negotiates key exchange 2021-07-06 14:45:41 +02:00
Tobias Brunner
a8e55363fa transform: Add additional key exchange transform types 2021-07-06 14:45:41 +02:00
Tobias Brunner
4d773a1e48 Rename diffie_hellman_t to key_exchange_t and change the interface etc. 
This makes it more generic so we can use it for QSKE methods.
 2021-07-06 14:45:41 +02:00
Andreas Steffen
4817d5ed0d Version bump to 5.9.3 5.9.3 2021-07-06 14:00:39 +02:00
Andreas Steffen
a09a905e1d vici: Suppress trailing nul character 2021-07-06 12:06:23 +02:00
Tobias Brunner
2cd5314de7 testing: Use specific versions of swidGenerator and strongTNC 
This way we get updated versions automatically (referencing "master"
required manually deleting the downloaded archives and the unpacked
directories).  It also allows switching versions when working in different
branches (note that REV can also be set to a commit ID, e.g. to test
changes before tagging them later and merging the branch).
 2021-06-30 16:17:39 +02:00