aboutsummaryrefslogtreecommitdiffstats
path: root/src/libcharon/sa/ike_sa.c
Commit message (Collapse)AuthorAgeFilesLines
* Change interface for enumerator_create_filter() callbackTobias Brunner2017-05-261-17/+32
| | | | | This avoids the unportable 5 pointer hack, but requires enumerating in the callback.
* Migrate all enumerators to venumerate() interface changeTobias Brunner2017-05-261-2/+6
|
* ikev1: Respond to DPDs for rekeyed IKE_SAsTobias Brunner2017-02-171-0/+4
| | | | | | | | | Some devices always use the oldest IKE_SA to send DPDs and will delete all IKE_SAs when there is no response. If uniqueness is not enforced rekeyed IKE_SAs might not get deleted until they expire so we should respond to DPDs. References #2090.
* ike-sa: Optionally try to migrate to the best path on routing priority changesMartin Willi2017-02-171-1/+23
| | | | | | | | | | | | | | When multihomed, a setup might prefer to dynamically stay on the cheapest available path by using MOBIKE migrations. If the cheapest path goes away and comes back, we currently stay on the more expensive path to reduce noise and prevent potential migration issues. This is usually just fine for links not generating real cost. If we have more expensive links in the setup, it can be desirable to always migrate to the cheapest link available. By setting charon.prefer_best_path, charon tries to migrate to the path using the highest priority link, allowing an external application to update routes to indirectly control MOBIKE behavior. This option has no effect if MOBIKE is unavailable.
* ikev2: Ignore roam events without MOBIKE but static local addressTobias Brunner2017-02-171-0/+10
| | | | | | | | | | | | | | | Disabling MOBIKE and statically configuring a local address should be enough indication that the user doesn't want to roam to a different address. There might not be any routes that indicate we can use the current address but it might still work (e.g. if the address is on an interface that is not referenced in any routes and the address itself is neither). This way we avoid switching to another address for routes that might be available on the system. We currently don't make much use of COND_STALE anyway when MOBIKE is not enabled, e.g. to avoid sending DPDs if the connection is seemingly down. With MOBIKE enabled we don't exactly check that state but we do don't send DPDs if there is no route/source address available.
* ike: Publish getter for the current message ID on IKE_SATobias Brunner2017-02-081-0/+7
|
* ikev1: Send DELETE for rekeyed IKE_SAsTobias Brunner2016-10-041-9/+5
| | | | | | If we silently delete the IKE_SA the other peer might still use it even if only to send DPDs. If we don't answer to DPDs that might result in the deletion of the new IKE_SA too.
* ike: Set default IKE fragment size to 1280Tobias Brunner2016-10-041-1/+1
| | | | | | This is the minimum size an IPv6 implementation must support. This makes it the default for IPv4 too, which presumably is also generally routable (otherwise, setting this to 0 falls back to the minimum of 576 for IPv4).
* ikev2: (Re-)Queue tasks used to establish an IKE_SA in reset()Tobias Brunner2016-09-061-2/+1
| | | | | | | | | Some tasks might get removed immediately once the IKE_SA_INIT response has been handled even if there were notifies that require a restart of the IKE_SA (e.g. COOKIE or INVALID_KE_PAYLOAD). Such a task is ike_vendor, which caused vendor IDs not to get sent in a retry. This change ensures all required tasks are queued after the reset, which some callers did already anyway.
* ikev2: Add possibility to delay initiation of a queued taskTobias Brunner2016-06-171-2/+9
| | | | | | | | | | | Such a task is not initiated unless a certain time has passed. This allows delaying certain tasks but avoids problems if we'd do this via a scheduled job (e.g. if the IKE_SA is rekeyed in the meantime). If the IKE_SA is rekeyed the delay of such tasks is reset when the tasks are adopted i.e. they get executed immediately on the new IKE_SA. This hasn't been implemented for IKEv1 yet.
* ikev2: Add a new state to track rekeyed IKE_SAsTobias Brunner2016-06-171-1/+4
| | | | | | | | | This makes handling such IKE_SAs more specifically compared to keeping them in state IKE_CONNECTING or IKE_ESTABLISHED (which we did when we lost a collision - even triggering the ike_updown event), or using IKE_REKEYING for them, which would also be ambiguous. For instance, we can now reject anything but DELETES for such SAs.
* ike: Don't trigger message hook when fragmenting pre-generated messagesTobias Brunner2016-06-061-2/+10
| | | | | | | | | This is the case for the IKE_SA_INIT and the initial IKEv1 messages, which are pre-generated in tasks as at least parts of it are used to generate the AUTH payload. The IKE_SA_INIT message will never be fragmented, but the IKEv1 messages might be, so we can't just call generate_message(). Fixes #1478.
* Use standard unsigned integer typesAndreas Steffen2016-03-241-22/+22
|
* ike-sa: Improve interaction between flush_auth_cfg and delayed revocation checksTobias Brunner2016-03-101-26/+37
|
* ike-sa: Add method to verify certificates in completed authentication roundsTobias Brunner2016-03-101-0/+103
|
* ike-sa: Add limit for the number of redirects within a defined time periodTobias Brunner2016-03-041-0/+44
|
* ike-sa: Reauthenticate to the same addresses we currently useTobias Brunner2016-03-041-2/+5
| | | | | | If the SA got redirected this would otherwise cause a reauthentication with the original gateway. Reestablishing the SA to the original gateway, if e.g. the new gateway is not reachable makes sense though.
* ike-sa: Add redirect() method to actively redirect an IKE_SATobias Brunner2016-03-041-0/+41
|
* ike-sa: Handle redirect requests for established SAs as reestablishmentTobias Brunner2016-03-041-82/+174
| | | | | | | We handle this similar to how we do reestablishing IKE_SAs with all CHILD_SAs, which also includes the one actively queued during IKE_AUTH. To delete the old SA we use the recently added ike_reauth_complete task.
* ike-sa: Keep track of the address of the gateway that redirected usTobias Brunner2016-03-041-1/+20
|
* ikev2: Add option to disable following redirects as clientTobias Brunner2016-03-041-0/+12
|
* ikev2: Handle REDIRECT notifies during IKE_SA_INITTobias Brunner2016-03-041-0/+32
|
* libhydra: Move kernel interface to libcharonTobias Brunner2016-03-031-14/+11
| | | | This moves hydra->kernel_interface to charon->kernel.
* ike: Keep track of send keepalive jobs to avoid scheduling more than one per ↵Tobias Brunner2016-03-031-9/+20
| | | | IKE_SA
* ike: Don't send NAT keepalives if we have no path to the other peerTobias Brunner2016-03-031-3/+9
| | | | | | | | If there is no path to the other peer there is no point in trying to send a NAT keepalive. If the condition changes back and forth within the keepalive interval there is a chance that multiple jobs get queued.
* ike: Use the original port when remote resolves to %anyTobias Brunner2015-08-191-1/+3
| | | | | | When reestablishing the IKE_SA we should still use the original port when right resolves to %any as some implementations might not like initial IKE messages on port 4500 (especially for IKEv1).
* ike: Disable NAT keepalives in state PASSIVEThomas Egerer2015-08-041-3/+12
| | | | Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
* ike: Fix memory leak if remote address is keptTobias Brunner2015-07-271-0/+4
|
* ike: Fall back to the current remote IP if it resolves to %anyTobias Brunner2015-07-271-1/+6
| | | | | | | | | In some situations it might be valid for a host that configures right=%any to reestablish or reauthenticate an IKE_SA. Using %any would immediately abort the initiation causing the new SA to fail (which might already have the existing CHILD_SAs assigned). Fixes #1027.
* ike: Use address family of local address when resolving remote hostTobias Brunner2015-07-271-1/+14
| | | | | | | If static local addresses are configured we should use their address family as a hint when resolving the remote address. We don't do this if %any is configured as this might break existing configurations (%any4 and %any6 are however used as hint).
* ikev2: Migrate MOBIKE additional peer addresses to new SA after IKE_SA rekeyingMartin Willi2015-03-181-0/+6
|
* bus: Add an ike_update() hook invoked when peer endpoints changeMartin Willi2015-02-201-0/+2
|
* attribute-manager: Pass full IKE_SA to handler methodsMartin Willi2015-02-201-1/+1
|
* attribute-manager: Pass the full IKE_SA to provider methodsMartin Willi2015-02-201-3/+1
|
* attributes: Move the configuration attributes framework to libcharonMartin Willi2015-02-201-3/+4
|
* ike: Maintain per-IKE_SA CHILD_SAs in the global CHILD_SA managerMartin Willi2015-02-201-7/+58
|
* ike: Do remote address updates also when behind static NATsTobias Brunner2014-10-131-4/+7
| | | | | | | | We assume that a responder is behind a static NAT (e.g. port forwarding) and allow remote address updates in such situations. The problem described in RFC 5996 is only an issue if the NAT mapping can expire.
* ikev1: Add fragmentation support for Windows peersVolker Rümelin2014-10-101-0/+30
| | | | | | | | I still think ipsec/l2tp with fragmentation support is a useful fallback option in case the Windows IKEv2 connection fails because of fragmentation problems. Tested with Windows XP, 7 and 8.1.
* ike: IKE_SA may fragment IKEv2 messagesTobias Brunner2014-10-101-1/+1
|
* ike: Move fragmentation to ike_sa_tTobias Brunner2014-10-101-1/+64
| | | | | | | | | The message() hook on bus_t is now called exactly once before (plain) and once after fragmenting (!plain), not twice for the complete message and again for each individual fragment, as was the case in earlier iterations. For inbound messages the hook is called once for each fragment (!plain) and twice for the reassembled message.
* ikev2: Skip peer addresses we can't send packets to when looking for valid pathsTobias Brunner2014-09-121-0/+18
|
* ike: Reset IKE_SA in state CONNECTING instead of reauthenticatingTobias Brunner2014-09-091-0/+8
| | | | | | | | Due to how reauthentication works for IKEv1 we could get a second IKE_SA, which might cause problems, when connectivity problems arise when the connection is initially established. Fixes #670.
* bus: Add ike_reestablish_pre hook, called before DNS resolutionTobias Brunner2014-07-221-1/+5
| | | | | The old hook is renamed to ike_reestablish_post and is now also called when the initiation of the new IKE_SA failed.
* bus: Add a handle_vips() hook invoked after handling configuration attributesMartin Willi2014-06-171-0/+1
| | | | | | | | | Similar to assign_vips() used by a peer assigning virtual IPs to the other peer, the handle_vips() hook gets invoked on a peers after receiving attributes. On release of the same attributes the hook gets invoked again. This is useful to inspect handled attributes, as the ike_updown() hook is invoked after authentication, when attributes have not been handled yet.
* ike: Create an enumerator for (un-)handled configuration attributes on IKE_SAMartin Willi2014-06-161-0/+21
|
* ike: Store unhandled attributes on IKE_SA as wellMartin Willi2014-06-161-2/+5
|
* ikev2: Apply extensions and conditions before starting rekeyingMartin Willi2014-04-171-0/+6
| | | | | | The extensions and conditions apply to the rekeyed IKE_SA as well, so we should migrate them. Especially when using algorithms from private space, we need EXT_STRONGSWAN to properly select these algorithms during IKE rekeying.
* ikev2: Add inherit_pre() to apply config and hosts before IKE_SA rekeyingMartin Willi2014-04-171-2/+14
|
* libcharon: Use lib->ns instead of charon->nameTobias Brunner2014-02-121-3/+3
|
* ike: Simplify error handling if name resolution failedTobias Brunner2014-01-231-16/+3
| | | | | | | This avoids a second name resolution attempt just to determine if %any etc. was configured. Fixes #440.
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-16 08:18:19 +0000