sharpetronics/strongswan
1
0
Fork 0
mirror of https://github.com/strongswan/strongswan.git synced 2025-10-05 00:00:45 -04:00
Code Issues Projects Releases Wiki Activity
17,728 Commits 101 Branches 327 Tags
Commit Graph

17728 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Tobias Brunner
46eb7d9030 ike-init: Add support for multiple key exchanges 
Initially, this is handled with a key derivation for each
IKE_INTERMEDIATE exchange.  When rekeying the keys are derived only when
all IKE_FOLLOWUP_KE exchanges are done.
 2020-12-07 13:28:34 +01:00
Tobias Brunner
0ec45dfd56 bus: Support multiple key exchanges in ike/child_keys() events 2020-12-07 13:28:34 +01:00
Tobias Brunner
5be238d71e keymat_v2: Support key derivation with multiple key exchanges 2020-12-07 13:28:34 +01:00
Tobias Brunner
0321a2a304 key-exchange: Add helper to concatenate shared secrets of several key exchanges 2020-12-07 13:28:34 +01:00
Tobias Brunner
41842faad9 keymat_v2: Proper cleanup if derive_ike_keys() is called multiple times 2020-12-07 13:28:34 +01:00
Tobias Brunner
0d5a94c1db ike-sa-manager: Log SPIs when checking in an IKE_SA 2020-12-07 13:28:34 +01:00
Tobias Brunner
f25932be14 ikev2: Use hashes to detect retransmits 
We avoid parsing messages with unexpected message IDs.  This allows us to
process and detect retransmits of messages for which we don't have the keys
anymore (i.e. IKE_INTERMEDIATE after IKE_SA_INIT and changing the keys).

This also changes how retransmits for fragmented messages are triggered,
previously we waited for all fragments and reconstructed the message
before retransmitting the response.  Now we only track the first
fragment and if we receive a retransmit of it respond immediately
without waiting for other fragments (which are now ignored).  This is in
compliance with RFC 7383, section 2.6.1.
 2020-12-07 13:28:34 +01:00
Tobias Brunner
bc513b2848 ike-auth: Calculate and collect IntAuth for IKE_INTERMEDIATE exchanges 2020-12-07 13:28:34 +01:00
Tobias Brunner
40f49249a9 pubkey-authenticator: Handle IntAuth data 2020-12-07 13:28:34 +01:00
Tobias Brunner
6527e3961c psk-authenticator: Handle IntAuth data 2020-12-07 13:28:34 +01:00
Tobias Brunner
b315f6a8f7 eap-authenticator: Handle IntAuth data 2020-12-07 13:28:34 +01:00
Tobias Brunner
eb7f6d3108 keymat_v2: Include optional IntAuth in signed octets 2020-12-07 13:28:34 +01:00
Tobias Brunner
9f1be4ef71 authenticator: Add optional method to set IntAuth data 2020-12-07 13:28:34 +01:00
Tobias Brunner
90fd6457c3 message: Add method to generate data to authenticate IKE_INTERMEDIATE exchanges 2020-12-07 13:28:34 +01:00
Tobias Brunner
a1efa5510a generator: Make pointer to length field optional 
Only useful if we generate an IKE header.
 2020-12-07 13:28:34 +01:00
Tobias Brunner
21b4bc87c8 message: Fix payload type in last unprotected payload of a fragmented message 2020-12-07 13:28:34 +01:00
Tobias Brunner
9a5626d91a keymat_v2: Add method to calculate IntAuth for IKE_INTERMEDIATE exchanges 2020-12-07 13:28:34 +01:00
Tobias Brunner
1e82c9577a ike-rekey: Reset IKE_SA after processing CREATE_CHILD_SA request 
This probably didn't cause any problems, as there wasn't really anything
happening between the calls, but reset it anyway, just to be safe.
 2020-12-07 13:28:34 +01:00
Tobias Brunner
f7882a24b4 ikev2: Allow tasks to do work after processing requests/responses 2020-12-07 13:28:34 +01:00
Tobias Brunner
a6a6461430 task: Add optional post_process() method 
This will allows tasks to do some work after a message has been
processed.
 2020-12-07 13:28:34 +01:00
Tobias Brunner
1250917f79 ikev2: Allow tasks to do work after generating requests/responses 2020-12-07 13:28:34 +01:00
Tobias Brunner
89ca791979 task: Add optional post_build() method 
This will allow tasks to do some work after the message has been
generated.
 2020-12-07 13:28:34 +01:00
Tobias Brunner
2455322ae2 ike-auth: Support IKE_INTERMEDIATE exchange between IKE_SA_INIT and IKE_AUTH 2020-12-07 13:28:34 +01:00
Tobias Brunner
d29d140630 child-create: Support IKE_INTERMEDIATE exchange between IKE_SA_INIT and IKE_AUTH 2020-12-07 13:28:34 +01:00
Tobias Brunner
1949a290c0 ike-mobike: Support IKE_INTERMEDIATE exchange between IKE_SA_INIT and IKE_AUTH 
This changes the MID of the first IKE_AUTH message.
 2020-12-07 13:28:34 +01:00
Tobias Brunner
41a5473556 ike-config: Support IKE_INTERMEDIATE exchange between IKE_SA_INIT and IKE_AUTH 
This changes the MID of the first IKE_AUTH message.
 2020-12-07 13:28:34 +01:00
Tobias Brunner
24a0d22fc1 ike-cert-post: Make absolutely sure certificates are only added to IKE_AUTH 
The AUTH payload check should be fine, but add some extra checks just to make
really sure and also for clarification.
 2020-12-07 13:28:34 +01:00
Tobias Brunner
b911387d0f ike-cert-pre: Support IKE_INTERMEDIATE exchange between IKE_SA_INIT and IKE_AUTH 
The first IKE_AUTH does not have MID 1 if that's the case.
 2020-12-07 13:28:34 +01:00
Tobias Brunner
7321602bcd status: Add return_need_more() utility function 2020-12-07 13:28:34 +01:00
Tobias Brunner
abb8199cdc message: Add rules for IKE_FOLLOWUP_KE exchanges 2020-12-07 13:28:34 +01:00
Tobias Brunner
cbf93d853e wip: ike-header: Add IKE_FOLLOWUP_KE exchange type 2020-12-07 13:28:34 +01:00
Tobias Brunner
9c7ef3be52 message: Add rules for IKE_INTERMEDIATE exchanges 2020-12-07 13:28:34 +01:00
Tobias Brunner
cc3eaa23e4 wip: ike-header: Add IKE_INTERMEDIATE exchange type 2020-12-07 13:28:34 +01:00
Tobias Brunner
6fb7abdac5 wip: notify-payload: Add notify types for multiple key exchanges 2020-12-07 13:28:34 +01:00
Tobias Brunner
68e01624e8 wip: notify-payload: Add notify type for IKE_INTERMEDIATE exchange 2020-12-07 13:28:34 +01:00
Tobias Brunner
b2adef9363 proposal-substructure: Encode additional key exchange methods 2020-12-07 13:28:34 +01:00
Tobias Brunner
764d2d8805 child-cfg: Add method to check if an algorithm is proposed 2020-12-07 13:28:34 +01:00
Tobias Brunner
a542f345ab child-cfg: Generalize get_ke_method() method 2020-12-07 13:28:34 +01:00
Tobias Brunner
436a714a03 ike-cfg: Generalize get_ke_method() method 2020-12-07 13:28:34 +01:00
Tobias Brunner
d7b74b9d1b proposal: Generalize KE methods 2020-12-07 13:28:34 +01:00
Tobias Brunner
2873f4024f proposal: Make all key exchange transforms optional in ESP/AH proposals 2020-12-07 13:28:34 +01:00
Tobias Brunner
4fb449b1a4 proposal: Skip all KE transforms if PROPOSAL_SKIP_KE given 2020-12-07 13:28:34 +01:00
Tobias Brunner
f4df1f8459 transform: Add helper to check if transform type negotiates key exchange 2020-12-07 13:28:34 +01:00
Tobias Brunner
e530db2a51 transform: Add additional key exchange transform types 2020-12-07 13:28:34 +01:00
Tobias Brunner
edc4279420 Rename diffie_hellman_t to key_exchange_t and change the interface etc. 
This makes it more generic so we can use it for QSKE methods.
 2020-12-07 13:28:34 +01:00
Tobias Brunner
25ec2d04aa child-rekey: Don't migrate child-create task if we already are deleting 
If we are already deleting the old/redundant CHILD_SA, we must not
migrate the child-create task as that would destroy the new CHILD_SA we
already moved to the IKE_SA.

Fixes #3644.
 2020-12-03 11:06:23 +01:00
Tobias Brunner
7d2d94f3e1 host-resolver: Don't wait for a reply if there are no threads 
Without threads handling the resolution, there is no point waiting
for a reply.  If no subsequent resolution successfully starts a
thread (there might not even be one), we'd wait indefinitely.

Fixes #3634.
 2020-12-03 08:36:20 +01:00
Tobias Brunner
9248f636b0 kernel-netlink: Make sure we successfully opened a Netlink socket 
This is in addition to the fix in the destructor in 991e9e5dc9.
 2020-12-03 08:34:18 +01:00
Tobias Brunner
e8fae43768 identification: Validate ASN.1 DN in from_data() constructor 
The DN is otherwise not parsed until compared/printed.  This avoids
false detections as ASN.1 DN if e.g. an email address starts with "0",
which is 0x30 = ASN.1 sequence tag, and the next character denotes
the exact length of the rest of the string (see the unit tests for an
example).
 2020-12-03 08:23:54 +01:00
Tobias Brunner
4c61d7aedc android: New release after avoiding marking VPN connections as metered 2020-12-02 16:09:38 +01:00