sharpetronics/strongswan
1
0
Fork 0
mirror of https://github.com/strongswan/strongswan.git synced 2025-10-04 00:00:14 -04:00
Code Issues Projects Releases Wiki Activity
17,945 Commits 101 Branches 327 Tags
Commit Graph

17945 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Tobias Brunner
99c61737d4 bus: Support multiple key exchanges in ike/child_keys() events 2021-03-21 12:22:43 +01:00
Tobias Brunner
0743040675 keymat_v2: Support key derivation with multiple key exchanges 2021-03-21 12:22:43 +01:00
Tobias Brunner
6c9231d549 key-exchange: Add helper to concatenate shared secrets of several key exchanges 2021-03-21 12:22:43 +01:00
Tobias Brunner
12779db7cc keymat_v2: Proper cleanup if derive_ike_keys() is called multiple times 2021-03-21 12:22:43 +01:00
Tobias Brunner
8893ecf79d ike-sa-manager: Log SPIs when checking in an IKE_SA 2021-03-21 12:22:43 +01:00
Tobias Brunner
e4b67d3368 ikev2: Use hashes to detect retransmits 
We avoid parsing messages with unexpected message IDs.  This allows us to
process and detect retransmits of messages for which we don't have the keys
anymore (i.e. IKE_INTERMEDIATE after IKE_SA_INIT and changing the keys).

This also changes how retransmits for fragmented messages are triggered,
previously we waited for all fragments and reconstructed the message
before retransmitting the response.  Now we only track the first
fragment and if we receive a retransmit of it respond immediately
without waiting for other fragments (which are now ignored).  This is in
compliance with RFC 7383, section 2.6.1.
 2021-03-21 12:22:43 +01:00
Tobias Brunner
f33b1e42ce ike-auth: Calculate and collect IntAuth for IKE_INTERMEDIATE exchanges 2021-03-21 12:22:43 +01:00
Tobias Brunner
5d0cfcdb2a pubkey-authenticator: Handle IntAuth data 2021-03-21 12:22:43 +01:00
Tobias Brunner
eb8703dc1c psk-authenticator: Handle IntAuth data 2021-03-21 12:22:43 +01:00
Tobias Brunner
5a2fd6f4f6 eap-authenticator: Handle IntAuth data 2021-03-21 12:22:43 +01:00
Tobias Brunner
3326cf05ef keymat_v2: Include optional IntAuth in signed octets 2021-03-21 12:22:43 +01:00
Tobias Brunner
07f8611423 authenticator: Add optional method to set IntAuth data 2021-03-21 12:22:43 +01:00
Tobias Brunner
9a4ca41539 message: Add method to generate data to authenticate IKE_INTERMEDIATE exchanges 2021-03-21 12:22:43 +01:00
Tobias Brunner
85ccee4468 generator: Make pointer to length field optional 
Only useful if we generate an IKE header.
 2021-03-21 12:22:43 +01:00
Tobias Brunner
9c03cbb03c message: Fix payload type in last unprotected payload of a fragmented message 2021-03-21 12:22:43 +01:00
Tobias Brunner
03a032de6f keymat_v2: Add method to calculate IntAuth for IKE_INTERMEDIATE exchanges 2021-03-21 12:22:43 +01:00
Tobias Brunner
ee76b4bc5c ike-rekey: Reset IKE_SA after processing CREATE_CHILD_SA request 
This probably didn't cause any problems, as there wasn't really anything
happening between the calls, but reset it anyway, just to be safe.
 2021-03-21 12:22:43 +01:00
Tobias Brunner
c2360ec499 ikev2: Allow tasks to do work after processing requests/responses 2021-03-21 12:22:43 +01:00
Tobias Brunner
e86110338b task: Add optional post_process() method 
This will allows tasks to do some work after a message has been
processed.
 2021-03-21 12:22:43 +01:00
Tobias Brunner
2550cfde6e ikev2: Allow tasks to do work after generating requests/responses 2021-03-21 12:22:43 +01:00
Tobias Brunner
8731d24bb5 task: Add optional post_build() method 
This will allow tasks to do some work after the message has been
generated.
 2021-03-21 12:22:43 +01:00
Tobias Brunner
304c7615bd ike-auth: Support IKE_INTERMEDIATE exchange between IKE_SA_INIT and IKE_AUTH 2021-03-21 12:22:43 +01:00
Tobias Brunner
1e08167fc0 child-create: Support IKE_INTERMEDIATE exchange between IKE_SA_INIT and IKE_AUTH 2021-03-21 12:22:43 +01:00
Tobias Brunner
5094ad602d ike-mobike: Support IKE_INTERMEDIATE exchange between IKE_SA_INIT and IKE_AUTH 
This changes the MID of the first IKE_AUTH message.
 2021-03-21 12:22:42 +01:00
Tobias Brunner
7e7c2778f0 ike-config: Support IKE_INTERMEDIATE exchange between IKE_SA_INIT and IKE_AUTH 
This changes the MID of the first IKE_AUTH message.
 2021-03-21 12:22:42 +01:00
Tobias Brunner
f3f3f25676 ike-cert-post: Make absolutely sure certificates are only added to IKE_AUTH 
The AUTH payload check should be fine, but add some extra checks just to make
really sure and also for clarification.
 2021-03-21 12:22:42 +01:00
Tobias Brunner
a6fee86af4 ike-cert-pre: Support IKE_INTERMEDIATE exchange between IKE_SA_INIT and IKE_AUTH 
The first IKE_AUTH does not have MID 1 if that's the case.
 2021-03-21 12:22:42 +01:00
Tobias Brunner
6059db73c2 status: Add return_need_more() utility function 2021-03-21 12:22:42 +01:00
Tobias Brunner
259ee217cf message: Add rules for IKE_FOLLOWUP_KE exchanges 2021-03-21 12:22:42 +01:00
Tobias Brunner
5cab54fe54 wip: ike-header: Add IKE_FOLLOWUP_KE exchange type 2021-03-21 12:22:42 +01:00
Tobias Brunner
9f9b165cca message: Add rules for IKE_INTERMEDIATE exchanges 2021-03-21 12:22:42 +01:00
Tobias Brunner
5be6907b0e wip: ike-header: Add IKE_INTERMEDIATE exchange type 2021-03-21 12:22:42 +01:00
Tobias Brunner
0274431403 wip: notify-payload: Add notify types for multiple key exchanges 2021-03-21 12:22:42 +01:00
Tobias Brunner
6d94980fb3 wip: notify-payload: Add notify type for IKE_INTERMEDIATE exchange 2021-03-21 12:22:42 +01:00
Tobias Brunner
a6d5cb6c81 proposal-substructure: Encode additional key exchange methods 2021-03-21 12:22:42 +01:00
Tobias Brunner
5837fac164 child-cfg: Add method to check if an algorithm is proposed 2021-03-21 12:22:42 +01:00
Tobias Brunner
679ad84164 child-cfg: Generalize get_ke_method() method 2021-03-21 12:22:42 +01:00
Tobias Brunner
d7ab3a2588 ike-cfg: Generalize get_ke_method() method 2021-03-21 12:22:42 +01:00
Tobias Brunner
a3588bf943 proposal: Generalize KE methods 2021-03-21 12:22:42 +01:00
Tobias Brunner
0494de1883 proposal: Make all key exchange transforms optional in ESP/AH proposals 2021-03-21 12:22:42 +01:00
Tobias Brunner
a6ccfd08e7 proposal: Skip all KE transforms if PROPOSAL_SKIP_KE given 2021-03-21 12:22:42 +01:00
Tobias Brunner
f91e4b3709 transform: Add helper to check if transform type negotiates key exchange 2021-03-21 12:22:42 +01:00
Tobias Brunner
18ffccbd67 transform: Add additional key exchange transform types 2021-03-21 12:22:42 +01:00
Tobias Brunner
0cce60bbe7 Rename diffie_hellman_t to key_exchange_t and change the interface etc. 
This makes it more generic so we can use it for QSKE methods.
 2021-03-21 12:22:42 +01:00
Andreas Steffen
a91eb3eb96 wolfssl: Support SHA3 2021-03-20 11:15:42 +01:00
Andreas Steffen
b57215ba2b wolfssl: Support AES_ECB 2021-03-20 11:15:42 +01:00
Andreas Steffen
bd323ae6c8 openssl: Migrate from deprecated EC_POINT_[set|get]_affine_coordinates_GFp() functions 2021-03-19 08:50:27 +01:00
Petr Gotthard
c5eac9c390 libcharon: Include libtpmtss in monolithic build 2021-03-17 12:14:47 +01:00
Andreas Steffen
6aef079f59 testing: Bump guest kernel to Linux 5.11 2021-03-07 14:39:44 +01:00
Andreas Steffen
87ba3a424d Version bump to 5.9.2 5.9.2 2021-02-26 11:30:13 +01:00