Commit message (Collapse) | Author | Age | Files | Lines | |
---|---|---|---|---|---|
* | Refactor check_for_rekeyed_child() in quick_mode task | Martin Willi | 2013-04-03 | 1 | -18/+24 |
| | |||||
* | Reuse reqid of an existing Quick Mode, even if it has been rekeyed | Martin Willi | 2013-04-03 | 1 | -1/+2 |
| | | | | | | If two peers rekey Quick Modes at the same time, the original Quick Mode is in REKEYING state and hence the requid is not reused. This is required though, as two identical policies won't work if they have different requids. | ||||
* | Fixed some typos, courtesy of codespell | Tobias Brunner | 2013-03-25 | 1 | -1/+1 |
| | |||||
* | Delete IKE_SAs if responder does not initiate XAuth exchange within a ↵ | Tobias Brunner | 2013-03-19 | 2 | -2/+16 |
| | | | | certain time frame | ||||
* | Added xauth-noauth plugin | Tobias Brunner | 2013-03-19 | 1 | -29/+37 |
| | | | | | | | | This XAuth backend does not do any authentication of client credentials but simply sends a successful XAuth status to the client, thereby concluding the XAuth exchange. This can be useful to fallback to basic RSA authentication with clients that can not be configured without XAuth authentication. | ||||
* | Make check whether to use IKEv1 fragmentation more readable | Martin Willi | 2013-03-14 | 1 | -5/+14 |
| | |||||
* | child_sa_t.get_usestats() can additionally return the number of processed ↵ | Martin Willi | 2013-03-14 | 1 | -2/+2 |
| | | | | packets | ||||
* | Add missing XAuthRespPSK switch case to IKEv1 key derivation | Martin Willi | 2013-03-12 | 1 | -0/+1 |
| | |||||
* | Ignore fourth Qick Mode message sent by Windows servers. | Martin Willi | 2013-03-11 | 1 | -0/+9 |
| | | | | Initial patch by Paul Stewart, fixes #289. | ||||
* | As Quick Mode initiator, select a subset of the proposed and the returned TS | Martin Willi | 2013-03-07 | 1 | -4/+11 |
| | | | | | | | | Cisco 5505 firewalls don't return the port if we send a specific one, letting the is_contained_in() checks fail. Using get_subset() selection builds the Quick Mode correctly with the common subset of selectors. Based on an initial patch from Paul Stewart. | ||||
* | Merge branch 'opaque-ports' | Martin Willi | 2013-03-01 | 1 | -2/+2 |
|\ | | | | | | | | | Adds a %opaque port option and support for port ranges in left/rightprotoport. Currently not supported by any of our kernel backends. | ||||
| * | Use a complete port range in traffic_selector_create_from_{subnet,cidr} | Martin Willi | 2013-02-21 | 1 | -2/+2 |
| | | |||||
* | | Move initial message dropping to task manager | Martin Willi | 2013-02-25 | 1 | -1/+15 |
|/ | | | | | | | When the last request message of the initial tunnel setup is retransmitted, we must retransmit the response instead of ignoring the request. Fixes #295. | ||||
* | Properly send IKEv1 packets if no ike_cfg is known yet | Tobias Brunner | 2013-01-14 | 1 | -2/+5 |
| | | | | This applies for error notifies. | ||||
* | Merge branch 'ikev1-fragmentation' | Tobias Brunner | 2013-01-12 | 2 | -22/+371 |
|\ | | | | | | | | | | | | | This adds support for the proprietary IKEv1 fragmentation extension. Conflicts: NEWS | ||||
| * | Added an option to configure the maximum size of a fragment | Tobias Brunner | 2013-01-12 | 1 | -3/+10 |
| | | |||||
| * | Properly detect fragmentation capabilities | Tobias Brunner | 2013-01-12 | 1 | -3/+27 |
| | | | | | | | | Cisco sends 0xc0000000 so we check that part of the VID separately. | ||||
| * | Added an option that allows to force IKEv1 fragmentation | Tobias Brunner | 2013-01-12 | 2 | -3/+6 |
| | | |||||
| * | Use a connection specific option to en-/disable IKEv1 fragmentation | Tobias Brunner | 2012-12-24 | 2 | -10/+7 |
| | | |||||
| * | Add an option to en-/disable IKE fragmentation | Tobias Brunner | 2012-12-24 | 2 | -5/+20 |
| | | | | | | | | | | Fragments are always accepted but will not be sent if disabled. The vendor ID is only sent if the option is enabled. | ||||
| * | Split larger messages into fragments if IKE fragmentation is supported by peer | Tobias Brunner | 2012-12-24 | 1 | -14/+114 |
| | | |||||
| * | Log added NAT-T vendor IDs | Tobias Brunner | 2012-12-24 | 1 | -0/+1 |
| | | |||||
| * | Detect a peer's support for IKE fragmentation | Tobias Brunner | 2012-12-24 | 1 | -0/+4 |
| | | | | | | | | Fragments are accepted even if this vendor ID is not seen. | ||||
| * | Don't handle fragmented messages larger than charon.max_packet | Tobias Brunner | 2012-12-24 | 1 | -4/+39 |
| | | |||||
| * | Store inbound IKE fragments and reassemble the message when all fragments ↵ | Tobias Brunner | 2012-12-24 | 1 | -3/+166 |
| | | | | | | | | are received | ||||
* | | Streamline debug output when receiving intermediate CA certificates in IKEv1 | Martin Willi | 2013-01-11 | 1 | -1/+1 |
| | | |||||
* | | Refactored IKEv1 cert payload processing to multiple functions | Martin Willi | 2013-01-11 | 1 | -73/+102 |
| | | |||||
* | | IKEv1 support for PKCS#7 wrapped certificates | Volker Rümelin | 2013-01-11 | 1 | -0/+70 |
| | | |||||
* | | Fixed some typos in comments | Volker Rümelin | 2013-01-11 | 1 | -1/+1 |
|/ | |||||
* | Add parantheses to avoid compiler warning | Martin Willi | 2012-12-24 | 1 | -1/+1 |
| | |||||
* | Fixed some typos, courtesy of codespell | Tobias Brunner | 2012-12-20 | 1 | -1/+1 |
| | |||||
* | Add support for draft-ietf-ipsec-nat-t-ike-03 and earlier | Volker Rümelin | 2012-12-19 | 5 | -36/+204 |
| | | | | | This adds support for early versions of the draft that eventually resulted in RFC 3947. | ||||
* | Fix traffic selectors also as initiator in case of transport mode over NAT | Tobias Brunner | 2012-12-13 | 1 | -1/+1 |
| | |||||
* | Fix debug output if responder selected invalid traffic selectors during QM | Tobias Brunner | 2012-12-13 | 1 | -2/+2 |
| | |||||
* | Add alerts for sent/received message retransmissions and timeout | Martin Willi | 2012-11-29 | 1 | -0/+3 |
| | |||||
* | Log sent vendor IDs for IKEv1 | Tobias Brunner | 2012-11-02 | 1 | -0/+1 |
| | |||||
* | Fixed log message when no shared secret is found during IKEv1 Main Mode | Tobias Brunner | 2012-10-29 | 1 | -1/+1 |
| | |||||
* | Remove all ESP proposals with non-matching DH group during Quick Mode | Tobias Brunner | 2012-10-24 | 1 | -10/+22 |
| | | | | | | According to RFC 2409, section 5.5, if PFS is used all proposals MUST include the selected DH group, so we remove proposals without the proposed group and remove other DH groups from the remaining proposals. | ||||
* | Moved data structures to new collections subfolder | Tobias Brunner | 2012-10-24 | 2 | -2/+2 |
| | |||||
* | Raise a bus alert when IKE message body parsing fails | Martin Willi | 2012-10-24 | 1 | -0/+2 |
| | |||||
* | Respect IKE version while selecting an ike_cfg as responder | Martin Willi | 2012-10-24 | 1 | -1/+2 |
| | |||||
* | Missed one in 6c10cece | Tobias Brunner | 2012-09-28 | 1 | -0/+2 |
| | |||||
* | Request is never NULL when responding with an INFORMATIONAL message | Tobias Brunner | 2012-09-28 | 1 | -1/+1 |
| | |||||
* | Completed state handling in isakmp_cert_pre | Tobias Brunner | 2012-09-28 | 1 | -0/+4 |
| | | | | Should not be a problem, but makes static analyzers happy. | ||||
* | Don't complain about multiple TS in IKEv1, as it supported with Unity | Martin Willi | 2012-09-18 | 1 | -5/+0 |
| | |||||
* | Derive a dynamic TS to multiple virtual IPs | Martin Willi | 2012-09-18 | 1 | -23/+28 |
| | |||||
* | Use the vararg list constructor in quick mode task | Martin Willi | 2012-09-18 | 1 | -16/+8 |
| | |||||
* | Change traffic selectors during Quick Mode in case of a NAT in transport mode | Tobias Brunner | 2012-09-14 | 1 | -9/+19 |
| | | | | | | | | | Windows 7 sends its internal address as TSi. While we don't support the NAT-T drafts as used by Windows XP it is interesting to note that the client there omits the TSi payload which then would automatically get set to the public IP address of the client. Fixes #220. | ||||
* | Always send a configuration payload in IKEv1 TRANSACTIONs, even if it is empty | Martin Willi | 2012-09-11 | 1 | -29/+14 |
| | |||||
* | Don't use host address for dynamic TS in IKEv1 if a virtual IP was expected | Martin Willi | 2012-09-11 | 1 | -40/+57 |
| |