aboutsummaryrefslogtreecommitdiffstats
path: root/src/libcharon/sa/ike_sa.c
Commit message (Collapse)AuthorAgeFilesLines
* ikev2: Add possibility to delay initiation of a queued taskTobias Brunner2016-06-171-2/+9
| | | | | | | | | | | Such a task is not initiated unless a certain time has passed. This allows delaying certain tasks but avoids problems if we'd do this via a scheduled job (e.g. if the IKE_SA is rekeyed in the meantime). If the IKE_SA is rekeyed the delay of such tasks is reset when the tasks are adopted i.e. they get executed immediately on the new IKE_SA. This hasn't been implemented for IKEv1 yet.
* ikev2: Add a new state to track rekeyed IKE_SAsTobias Brunner2016-06-171-1/+4
| | | | | | | | | This makes handling such IKE_SAs more specifically compared to keeping them in state IKE_CONNECTING or IKE_ESTABLISHED (which we did when we lost a collision - even triggering the ike_updown event), or using IKE_REKEYING for them, which would also be ambiguous. For instance, we can now reject anything but DELETES for such SAs.
* ike: Don't trigger message hook when fragmenting pre-generated messagesTobias Brunner2016-06-061-2/+10
| | | | | | | | | This is the case for the IKE_SA_INIT and the initial IKEv1 messages, which are pre-generated in tasks as at least parts of it are used to generate the AUTH payload. The IKE_SA_INIT message will never be fragmented, but the IKEv1 messages might be, so we can't just call generate_message(). Fixes #1478.
* Use standard unsigned integer typesAndreas Steffen2016-03-241-22/+22
|
* ike-sa: Improve interaction between flush_auth_cfg and delayed revocation checksTobias Brunner2016-03-101-26/+37
|
* ike-sa: Add method to verify certificates in completed authentication roundsTobias Brunner2016-03-101-0/+103
|
* ike-sa: Add limit for the number of redirects within a defined time periodTobias Brunner2016-03-041-0/+44
|
* ike-sa: Reauthenticate to the same addresses we currently useTobias Brunner2016-03-041-2/+5
| | | | | | If the SA got redirected this would otherwise cause a reauthentication with the original gateway. Reestablishing the SA to the original gateway, if e.g. the new gateway is not reachable makes sense though.
* ike-sa: Add redirect() method to actively redirect an IKE_SATobias Brunner2016-03-041-0/+41
|
* ike-sa: Handle redirect requests for established SAs as reestablishmentTobias Brunner2016-03-041-82/+174
| | | | | | | We handle this similar to how we do reestablishing IKE_SAs with all CHILD_SAs, which also includes the one actively queued during IKE_AUTH. To delete the old SA we use the recently added ike_reauth_complete task.
* ike-sa: Keep track of the address of the gateway that redirected usTobias Brunner2016-03-041-1/+20
|
* ikev2: Add option to disable following redirects as clientTobias Brunner2016-03-041-0/+12
|
* ikev2: Handle REDIRECT notifies during IKE_SA_INITTobias Brunner2016-03-041-0/+32
|
* libhydra: Move kernel interface to libcharonTobias Brunner2016-03-031-14/+11
| | | | This moves hydra->kernel_interface to charon->kernel.
* ike: Keep track of send keepalive jobs to avoid scheduling more than one per ↵Tobias Brunner2016-03-031-9/+20
| | | | IKE_SA
* ike: Don't send NAT keepalives if we have no path to the other peerTobias Brunner2016-03-031-3/+9
| | | | | | | | If there is no path to the other peer there is no point in trying to send a NAT keepalive. If the condition changes back and forth within the keepalive interval there is a chance that multiple jobs get queued.
* ike: Use the original port when remote resolves to %anyTobias Brunner2015-08-191-1/+3
| | | | | | When reestablishing the IKE_SA we should still use the original port when right resolves to %any as some implementations might not like initial IKE messages on port 4500 (especially for IKEv1).
* ike: Disable NAT keepalives in state PASSIVEThomas Egerer2015-08-041-3/+12
| | | | Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
* ike: Fix memory leak if remote address is keptTobias Brunner2015-07-271-0/+4
|
* ike: Fall back to the current remote IP if it resolves to %anyTobias Brunner2015-07-271-1/+6
| | | | | | | | | In some situations it might be valid for a host that configures right=%any to reestablish or reauthenticate an IKE_SA. Using %any would immediately abort the initiation causing the new SA to fail (which might already have the existing CHILD_SAs assigned). Fixes #1027.
* ike: Use address family of local address when resolving remote hostTobias Brunner2015-07-271-1/+14
| | | | | | | If static local addresses are configured we should use their address family as a hint when resolving the remote address. We don't do this if %any is configured as this might break existing configurations (%any4 and %any6 are however used as hint).
* ikev2: Migrate MOBIKE additional peer addresses to new SA after IKE_SA rekeyingMartin Willi2015-03-181-0/+6
|
* bus: Add an ike_update() hook invoked when peer endpoints changeMartin Willi2015-02-201-0/+2
|
* attribute-manager: Pass full IKE_SA to handler methodsMartin Willi2015-02-201-1/+1
|
* attribute-manager: Pass the full IKE_SA to provider methodsMartin Willi2015-02-201-3/+1
|
* attributes: Move the configuration attributes framework to libcharonMartin Willi2015-02-201-3/+4
|
* ike: Maintain per-IKE_SA CHILD_SAs in the global CHILD_SA managerMartin Willi2015-02-201-7/+58
|
* ike: Do remote address updates also when behind static NATsTobias Brunner2014-10-131-4/+7
| | | | | | | | We assume that a responder is behind a static NAT (e.g. port forwarding) and allow remote address updates in such situations. The problem described in RFC 5996 is only an issue if the NAT mapping can expire.
* ikev1: Add fragmentation support for Windows peersVolker Rümelin2014-10-101-0/+30
| | | | | | | | I still think ipsec/l2tp with fragmentation support is a useful fallback option in case the Windows IKEv2 connection fails because of fragmentation problems. Tested with Windows XP, 7 and 8.1.
* ike: IKE_SA may fragment IKEv2 messagesTobias Brunner2014-10-101-1/+1
|
* ike: Move fragmentation to ike_sa_tTobias Brunner2014-10-101-1/+64
| | | | | | | | | The message() hook on bus_t is now called exactly once before (plain) and once after fragmenting (!plain), not twice for the complete message and again for each individual fragment, as was the case in earlier iterations. For inbound messages the hook is called once for each fragment (!plain) and twice for the reassembled message.
* ikev2: Skip peer addresses we can't send packets to when looking for valid pathsTobias Brunner2014-09-121-0/+18
|
* ike: Reset IKE_SA in state CONNECTING instead of reauthenticatingTobias Brunner2014-09-091-0/+8
| | | | | | | | Due to how reauthentication works for IKEv1 we could get a second IKE_SA, which might cause problems, when connectivity problems arise when the connection is initially established. Fixes #670.
* bus: Add ike_reestablish_pre hook, called before DNS resolutionTobias Brunner2014-07-221-1/+5
| | | | | The old hook is renamed to ike_reestablish_post and is now also called when the initiation of the new IKE_SA failed.
* bus: Add a handle_vips() hook invoked after handling configuration attributesMartin Willi2014-06-171-0/+1
| | | | | | | | | Similar to assign_vips() used by a peer assigning virtual IPs to the other peer, the handle_vips() hook gets invoked on a peers after receiving attributes. On release of the same attributes the hook gets invoked again. This is useful to inspect handled attributes, as the ike_updown() hook is invoked after authentication, when attributes have not been handled yet.
* ike: Create an enumerator for (un-)handled configuration attributes on IKE_SAMartin Willi2014-06-161-0/+21
|
* ike: Store unhandled attributes on IKE_SA as wellMartin Willi2014-06-161-2/+5
|
* ikev2: Apply extensions and conditions before starting rekeyingMartin Willi2014-04-171-0/+6
| | | | | | The extensions and conditions apply to the rekeyed IKE_SA as well, so we should migrate them. Especially when using algorithms from private space, we need EXT_STRONGSWAN to properly select these algorithms during IKE rekeying.
* ikev2: Add inherit_pre() to apply config and hosts before IKE_SA rekeyingMartin Willi2014-04-171-2/+14
|
* libcharon: Use lib->ns instead of charon->nameTobias Brunner2014-02-121-3/+3
|
* ike: Simplify error handling if name resolution failedTobias Brunner2014-01-231-16/+3
| | | | | | | This avoids a second name resolution attempt just to determine if %any etc. was configured. Fixes #440.
* ike: Use proper hostname(s) when name resolution failedTobias Brunner2014-01-231-1/+1
| | | | | | Was wrong since 0edce687675df8f10f4026fa12a8fc3b3dd003f5. Fixes #440.
* ike_sa: Defer task manager destruction after child destructionThomas Egerer2014-01-161-1/+5
| | | | | | | | | | This patch exports the task manager's flush to allow flushing of all queues with one function call from ike_sa->destroy. It allows the access of intact children during task destructoin (see git-commit e44ebdcf) and allows the access of the task manager in child_state_change hook. Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
* ike: Don't immediately DPD after deferred DELETEs following IKE_SA rekeyingMartin Willi2013-11-011-0/+8
| | | | | | | Some peers seem to defer DELETEs a few seconds after rekeying the IKE_SA, which is perfectly valid. For short(er) DPD delays, this leads to the situation where we send a DPD request during set_state(), but the IKE_SA has no hosts set yet. Avoid that DPD by resetting the INBOUND timestamp during set_state().
* ike-sa: Resolve hosts before reestablishing an IKE_SATobias Brunner2013-09-231-0/+2
|
* ike-cfg: remove the to be obsoleted allow any parameter in get_my/other_addrMartin Willi2013-09-041-1/+1
|
* ike-sa: use ike_cfg resolver functionsMartin Willi2013-09-041-16/+12
|
* ike: Fix reestablishing SAs if no child-creating tasks are queuedTobias Brunner2013-07-181-2/+5
|
* ike-sa: uninstall CHILD_SAs before removing virtual IPsMartin Willi2013-07-181-1/+8
| | | | | | a3854d83 changed cleanup order. But we should remove CHILD_SAs first, as routes for CHILD_SAs might get deleted while removing virtual IPs, resulting in an error when a CHILD_SA tries to uninstall its route.
* ike: Migrate queued CHILD_SA-creating tasks when reestablishing an IKE_SATobias Brunner2013-07-171-1/+39
|
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-19 19:34:38 +0000