sharpetronics/strongswan
1
0
Fork 0
mirror of https://github.com/strongswan/strongswan.git synced 2025-10-05 00:00:45 -04:00
Code Issues Projects Releases Wiki Activity
17,963 Commits 101 Branches 327 Tags
Commit Graph

17963 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Tobias Brunner
19349aaeef keymat_v2: Include optional IntAuth in signed octets 2021-07-06 14:45:42 +02:00
Tobias Brunner
e8c7dfb391 authenticator: Add optional method to set IntAuth data 2021-07-06 14:45:42 +02:00
Tobias Brunner
8429e401a2 message: Add method to generate data to authenticate IKE_INTERMEDIATE exchanges 2021-07-06 14:45:42 +02:00
Tobias Brunner
68ef0e919b generator: Make pointer to length field optional 
Only useful if we generate an IKE header.
 2021-07-06 14:45:42 +02:00
Tobias Brunner
92e709397f message: Fix payload type in last unprotected payload of a fragmented message 2021-07-06 14:45:42 +02:00
Tobias Brunner
fe243606b5 keymat_v2: Add method to calculate IntAuth for IKE_INTERMEDIATE exchanges 2021-07-06 14:45:42 +02:00
Tobias Brunner
df5453b33f ike-rekey: Reset IKE_SA after processing CREATE_CHILD_SA request 
This probably didn't cause any problems, as there wasn't really anything
happening between the calls, but reset it anyway, just to be safe.
 2021-07-06 14:45:42 +02:00
Tobias Brunner
cc9e1c1e2f ikev2: Allow tasks to do work after processing requests/responses 2021-07-06 14:45:42 +02:00
Tobias Brunner
7015587e09 task: Add optional post_process() method 
This will allows tasks to do some work after a message has been
processed.
 2021-07-06 14:45:42 +02:00
Tobias Brunner
ab1d77168c ikev2: Allow tasks to do work after generating requests/responses 2021-07-06 14:45:42 +02:00
Tobias Brunner
7dd3bec141 task: Add optional post_build() method 
This will allow tasks to do some work after the message has been
generated.
 2021-07-06 14:45:41 +02:00
Tobias Brunner
0c375bf9a3 ike-auth: Support IKE_INTERMEDIATE exchange between IKE_SA_INIT and IKE_AUTH 2021-07-06 14:45:41 +02:00
Tobias Brunner
6b76261372 child-create: Support IKE_INTERMEDIATE exchange between IKE_SA_INIT and IKE_AUTH 2021-07-06 14:45:41 +02:00
Tobias Brunner
80af87de84 ike-mobike: Support IKE_INTERMEDIATE exchange between IKE_SA_INIT and IKE_AUTH 
This changes the MID of the first IKE_AUTH message.
 2021-07-06 14:45:41 +02:00
Tobias Brunner
12bb9a2c4d ike-config: Support IKE_INTERMEDIATE exchange between IKE_SA_INIT and IKE_AUTH 
This changes the MID of the first IKE_AUTH message.
 2021-07-06 14:45:41 +02:00
Tobias Brunner
8c9675a2fa ike-cert-post: Make absolutely sure certificates are only added to IKE_AUTH 
The AUTH payload check should be fine, but add some extra checks just to make
really sure and also for clarification.
 2021-07-06 14:45:41 +02:00
Tobias Brunner
c551724f3e ike-cert-pre: Support IKE_INTERMEDIATE exchange between IKE_SA_INIT and IKE_AUTH 
The first IKE_AUTH does not have MID 1 if that's the case.
 2021-07-06 14:45:41 +02:00
Tobias Brunner
611983987c status: Add return_need_more() utility function 2021-07-06 14:45:41 +02:00
Tobias Brunner
f9f8b175fd message: Add rules for IKE_FOLLOWUP_KE exchanges 2021-07-06 14:45:41 +02:00
Tobias Brunner
fd1e928e1f wip: ike-header: Add IKE_FOLLOWUP_KE exchange type 2021-07-06 14:45:41 +02:00
Tobias Brunner
8da5a95cfc message: Add rules for IKE_INTERMEDIATE exchanges 2021-07-06 14:45:41 +02:00
Tobias Brunner
19c9bb44c9 wip: ike-header: Add IKE_INTERMEDIATE exchange type 2021-07-06 14:45:41 +02:00
Tobias Brunner
497c40b70b wip: notify-payload: Add notify types for multiple key exchanges 2021-07-06 14:45:41 +02:00
Tobias Brunner
6110ad0181 wip: notify-payload: Add notify type for IKE_INTERMEDIATE exchange 2021-07-06 14:45:41 +02:00
Tobias Brunner
45d0ae5d4f proposal-substructure: Encode additional key exchange methods 2021-07-06 14:45:41 +02:00
Tobias Brunner
7db736c761 child-cfg: Add method to check if an algorithm is proposed 2021-07-06 14:45:41 +02:00
Tobias Brunner
d739316681 child-cfg: Generalize get_ke_method() method 2021-07-06 14:45:41 +02:00
Tobias Brunner
e47193a7c0 ike-cfg: Generalize get_ke_method() method 2021-07-06 14:45:41 +02:00
Tobias Brunner
80ad22563a proposal: Generalize KE methods 2021-07-06 14:45:41 +02:00
Tobias Brunner
ea1fb56281 proposal: Make all key exchange transforms optional in ESP/AH proposals 2021-07-06 14:45:41 +02:00
Tobias Brunner
f03e8863ac proposal: Skip all KE transforms if PROPOSAL_SKIP_KE given 2021-07-06 14:45:41 +02:00
Tobias Brunner
4c6fc2b62c transform: Add helper to check if transform type negotiates key exchange 2021-07-06 14:45:41 +02:00
Tobias Brunner
a8e55363fa transform: Add additional key exchange transform types 2021-07-06 14:45:41 +02:00
Tobias Brunner
4d773a1e48 Rename diffie_hellman_t to key_exchange_t and change the interface etc. 
This makes it more generic so we can use it for QSKE methods.
 2021-07-06 14:45:41 +02:00
Andreas Steffen
4817d5ed0d Version bump to 5.9.3 5.9.3 2021-07-06 14:00:39 +02:00
Andreas Steffen
a09a905e1d vici: Suppress trailing nul character 2021-07-06 12:06:23 +02:00
Tobias Brunner
2cd5314de7 testing: Use specific versions of swidGenerator and strongTNC 
This way we get updated versions automatically (referencing "master"
required manually deleting the downloaded archives and the unpacked
directories).  It also allows switching versions when working in different
branches (note that REV can also be set to a commit ID, e.g. to test
changes before tagging them later and merging the branch).
 2021-06-30 16:17:39 +02:00
Tobias Brunner
06e11b481b kernel-netlink: Fix theoretical memory leak when parsing routes 
This currently can't happen as the kernel always puts RTA_TABLE as first
attribute in RTM_NEWROUTE messages.
 2021-06-25 13:51:44 +02:00
Tobias Brunner
f6aafb3005 Fixed some typos, courtesy of codespell 
Main change is the conversion from the British cancelling/-ed to the
American canceling/-ed.
 2021-06-25 11:32:29 +02:00
Andreas Steffen
30fab57124 Version bump to 5.9.3rc1 5.9.3rc1 2021-06-24 09:18:54 +02:00
Tobias Brunner
19611b1d28 testing: Build wolfSSL from the Git repository 
Use the same configure options etc. for both builds (no need for the cert
options as we don't use TLS or X.509 parsing) and switch to a Git commit
that includes the SHA-3 OID fix (it's actually the fix itself).
 2021-06-22 17:54:15 +02:00
Andreas Steffen
4baca5ca80 testing: Fixed ikev2/farp scenario 2021-06-22 12:32:35 +02:00
Andreas Steffen
dbd1534875 Version bump to 5.9.3dr4 5.9.3dr4 2021-06-22 10:33:07 +02:00
Andreas Steffen
eba2622587 testing: Migrate ikev2-stroke-bye scenarios to vici 2021-06-22 10:23:06 +02:00
Andreas Steffen
706c58b291 testing: Fixed pretest script of ikev1/rw-psk-aggressive scenario 2021-06-21 12:03:36 +02:00
Tobias Brunner
6d8890767c testing: Migrate ikev2/host2host-transport-nat scenario to vici 
This also restores the test as it was before the referenced commit so it
again, as written in the description, demonstrates that venus is unable
to ping sun without IPsec tunnel.

Fixes: f27fb58ae0ec ("testing: Update description and test evaluation of host2host-transport-nat")
 2021-06-21 12:03:36 +02:00
Tobias Brunner
2b5c743952 testing: Migrate MOBIKE tests to vici 
Note that the mobike-nat test has been removed as it basically did the same
as the mobike-virtual-ip-nat test.  Instead, the mobike-nat-mapping scenario
is added, which simulates a NAT router restart.
 2021-06-21 12:03:36 +02:00
Tobias Brunner
abe51389c5 ike-mobike: Force MOBIKE update after NAT mappings changed 
The addresses observed by the client behind the NAT are exactly the same if
the NAT router gets restarted.

Fixes: 2b255f01afbc ("ike-mobike: Use ike_sa_t::update_hosts() to trigger events")
 2021-06-21 12:03:36 +02:00
Tobias Brunner
036ae27645 ike-sa: Log IKE endpoint changes 2021-06-21 12:03:36 +02:00
Tobias Brunner
79b526deba ha: Register the correct IKE_SA with the manager after a rekeying 
Fixes: 20dfbcad0875 ("ha: Register new IKE_SAs before calling inherit_post()")
Closes strongswan/strongswan#456.
 2021-06-21 10:02:26 +02:00