aboutsummaryrefslogtreecommitdiffstats
path: root/src/libcharon/sa/ikev1/task_manager_v1.c
Commit message (Collapse)AuthorAgeFilesLines
* ikev1: Only delete redundant CHILD_SAs if configuredTobias Brunner2017-06-261-1/+5
| | | | | | | | | If we find a redundant CHILD_SA (the peer probably rekeyed the SA before us) we might not want to delete the old SA because the peer might still use it (same applies to old CHILD_SAs after rekeyings). So only delete them if configured to do so. Fixes #2358.
* ike: Apply retransmission_limit before applying the jitterTobias Brunner2017-05-261-4/+4
|
* ike: Use optional jitter to calculate retransmission timeoutsTobias Brunner2017-05-231-4/+27
| | | | | Also adds an optional limit to avoid very high retransmission timeouts with high numbers of retries.
* ikev1: Respond to DPDs for rekeyed IKE_SAsTobias Brunner2017-02-171-0/+6
| | | | | | | | | Some devices always use the oldest IKE_SA to send DPDs and will delete all IKE_SAs when there is no response. If uniqueness is not enforced rekeyed IKE_SAs might not get deleted until they expire so we should respond to DPDs. References #2090.
* ike: Add getter for the current message ID to task managerTobias Brunner2017-02-081-0/+7
|
* ikev1: Minor code optimization in task managerThomas Egerer2016-12-071-11/+5
| | | | Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
* task-manager: Only trigger retransmit cleared alert if there was at least ↵Tobias Brunner2016-10-051-1/+1
| | | | | | | | one retransmit The counter is already increased when sending the original message. Fixes: bd71ba0ffb03 ("task-manager: Add retransmit cleared alert")
* ikev1: Activate task to delete the IKE_SA in state IKE_REKEYINGTobias Brunner2016-10-041-0/+8
| | | | It does not have any CHILD_SAs attached at that point.
* ikev1: Delete Quick Mode SAs before the ISAKMP SATobias Brunner2016-10-041-2/+2
| | | | | After the ISAKMP_DELETE task has been executed the IKE_SA is destroyed so we wouldn't be able to send deletes for the Quick Mode SAs.
* ike1: Flush active queue when queueing a delete of the IKE_SATobias Brunner2016-07-191-0/+3
| | | | | | | | | | | By aborting the active task we don't have to wait for potential retransmits if the other peer does not respond to the current task. Since IKEv1 has no sequential message IDs and INFORMATIONALs are no real exchanges this should not be a problem. Fixes #1537 References #429, #1410 Closes strongswan/strongswan#48
* ikev2: Add possibility to delay initiation of a queued taskTobias Brunner2016-06-171-3/+10
| | | | | | | | | | | Such a task is not initiated unless a certain time has passed. This allows delaying certain tasks but avoids problems if we'd do this via a scheduled job (e.g. if the IKE_SA is rekeyed in the meantime). If the IKE_SA is rekeyed the delay of such tasks is reset when the tasks are adopted i.e. they get executed immediately on the new IKE_SA. This hasn't been implemented for IKEv1 yet.
* task-manager: Add retransmit cleared alertTobias Brunner2016-06-061-0/+6
|
* task-manager: Add retransmit count to retransmit send alertThomas Egerer2016-06-061-1/+2
| | | | Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
* ikev1: Queue INFORMATIONAL messages during XAuthTobias Brunner2016-06-061-5/+12
| | | | | | | | | | Some peers send an INITIAL_CONTACT notify after they received our XAuth username. The XAuth task waiting for the third XAuth message handles this incorrectly and closes the IKE_SA as no configuration payloads are contained in the message. We queue the INFORMATIONAL until the XAuth exchange is complete to avoid this issue. Fixes #1434.
* ikev1: Activate DELETE tasks before other tasks in state ESTABLISHEDTobias Brunner2016-05-061-7/+7
| | | | Fixes #1410.
* ikev1: Don't call updown hook etc. when deleting redundant CHILD_SAsTobias Brunner2016-05-061-0/+1
| | | | Fixes #1421.
* Use standard unsigned integer typesAndreas Steffen2016-03-241-23/+23
|
* ikev1: Fix calculation of DPD timeoutTobias Brunner2015-11-091-0/+2
| | | | | A DPD timeout job is queued whenever a DPD is sent, i.e. after the DPD delay already has elapsed, so we have to compensate for that.
* ikev1: Handle queued INFORMATIONAL message after receiving the last AM requestTobias Brunner2015-10-301-0/+16
|
* ikev1: Queue INFORMATIONAL request if AM is not complete yetTobias Brunner2015-10-301-6/+13
|
* ikev1: Handle queued TRANSACTION messages only after processing repliesTobias Brunner2015-10-301-1/+2
|
* ikev1: Extract queueing of TRANSACTIONAL requests when MM is not complete yetTobias Brunner2015-10-301-17/+27
|
* ikev1: Drop TRANSACTION/QUICK_MODE requests until we received the last AM ↵Tobias Brunner2015-10-301-0/+32
| | | | message
* ikev1: Avoid fourth QM message if third QM messages of multiple exchanges ↵Tobias Brunner2015-10-291-0/+12
| | | | | | | | | | | | are handled delayed If we haven't received the third QM message for multiple exchanges the return value of NEED_MORE for passive tasks that are not responsible for a specific exchange would trigger a fourth empty QM message. Fixes: 4de361d92c54 ("ikev1: Fix handling of overlapping Quick Mode exchanges") References #1076.
* ikev1: Fix handling of overlapping Quick Mode exchangesTobias Brunner2015-08-201-1/+34
| | | | | | | | | | | | | In some cases the third message of a Quick Mode exchange might arrive after the first message of a subsequent Quick Mode exchange. Previously these messages were handled incorrectly and the second Quick Mode exchange failed. Some implementations might even try to establish multiple Quick Modes simultaneously, which is explicitly allowed in RFC 2409. We don't fully support that, though, in particular in case of retransmits. Fixes #1076.
* ikev1: Trigger children_migrate event if CHILD_SAs are adoptedTobias Brunner2015-05-211-0/+5
|
* ike: Consistently log CHILD_SAs with their unique_id instead of their reqidMartin Willi2015-02-201-1/+2
|
* child-sa: Replace reqid based marks by "unique" marksMartin Willi2015-02-201-0/+2
| | | | | | | | | | | As we now use the same reqid for multiple CHILD_SAs with the same selectors, having marks based on the reqid makes not that much sense anymore. Instead we use unique marks that use a custom identifier. This identifier is reused during rekeying, keeping the marks constant for any rule relying on it (for example installed by updown). This also simplifies handling of reqid allocation, as we do not have to query the marks that is not yet assigned for an unknown reqid.
* ikev1: Move defragmentation to message_tTobias Brunner2014-10-101-167/+16
|
* ike: Move fragmentation to ike_sa_tTobias Brunner2014-10-101-55/+6
| | | | | | | | | The message() hook on bus_t is now called exactly once before (plain) and once after fragmenting (!plain), not twice for the complete message and again for each individual fragment, as was the case in earlier iterations. For inbound messages the hook is called once for each fragment (!plain) and twice for the reassembled message.
* message: fragment() generates message and fragments and caches themTobias Brunner2014-10-101-31/+11
|
* ikev1: Move fragment generation to message_tTobias Brunner2014-10-101-132/+118
|
* ikev1: Don't queue more than one mode config or XAuth taskTobias Brunner2014-10-071-7/+22
| | | | | | | | At the time we reset an IKE_SA (e.g. when re-authenticating a not yet established SA due to a roaming event) such tasks might already be queued by one of the phase 1 tasks. If the SA is initiated again another task will get queued by the phase 1 task. This results in e.g. multiple mode config requests, which most gateways will have problems with.
* payload: Use common prefixes for all payload type identifiersMartin Willi2014-06-041-4/+4
| | | | | The old identifiers did not use a proper namespace and often clashed with other defines.
* libcharon: Use lib->ns instead of charon->nameTobias Brunner2014-02-121-6/+6
|
* ike_sa: Defer task manager destruction after child destructionThomas Egerer2014-01-161-4/+3
| | | | | | | | | | This patch exports the task manager's flush to allow flushing of all queues with one function call from ike_sa->destroy. It allows the access of intact children during task destructoin (see git-commit e44ebdcf) and allows the access of the task manager in child_state_change hook. Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
* ikev1: Properly initialize list of fragments in case fragment ID is 0Volker Rümelin2013-10-311-1/+1
| | | | Fixes CVE-2013-6076.
* ikev1: Fix double free when searching for redundant CHILD_SAsTobias Brunner2013-09-131-1/+1
| | | | Fixes #411.
* ikev1: implement mode config push modeMartin Willi2013-09-041-8/+26
|
* ikev1: Fix calculation of the number of fragmentsTobias Brunner2013-08-151-1/+1
| | | | The old code resulted in too few fragments in some cases.
* ikev1: When sending fragments, use ports to decide if a non-ESP marker is addedTobias Brunner2013-08-151-6/+8
| | | | | This is same same logic used by sender and might apply in some cases (e.g. when initiating to port 4500).
* ike: Migrate queued CHILD_SA-creating tasks when reestablishing an IKE_SATobias Brunner2013-07-171-0/+34
|
* child-sa: replace get_traffic_selectors() with create_ts_enumerator()Martin Willi2013-07-171-18/+18
| | | | | Not directly returning a linked list allows us to change the internals of the CHILD_SA transparently.
* Fixed some typos, courtesy of codespellTobias Brunner2013-03-251-1/+1
|
* Make check whether to use IKEv1 fragmentation more readableMartin Willi2013-03-141-5/+14
|
* Ignore fourth Qick Mode message sent by Windows servers.Martin Willi2013-03-111-0/+9
| | | | Initial patch by Paul Stewart, fixes #289.
* Move initial message dropping to task managerMartin Willi2013-02-251-1/+15
| | | | | | | When the last request message of the initial tunnel setup is retransmitted, we must retransmit the response instead of ignoring the request. Fixes #295.
* Properly send IKEv1 packets if no ike_cfg is known yetTobias Brunner2013-01-141-2/+5
| | | | This applies for error notifies.
* Added an option to configure the maximum size of a fragmentTobias Brunner2013-01-121-3/+10
|
* Added an option that allows to force IKEv1 fragmentationTobias Brunner2013-01-121-2/+5
|
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-05 19:55:46 +0000