aboutsummaryrefslogtreecommitdiffstats
path: root/src/libcharon/sa
Commit message (Collapse)AuthorAgeFilesLines
* ike-sa-manager: Log some additional details like SPIs when checking out SAsTobias Brunner2016-03-041-7/+16
|
* ikev2: Always store signature scheme in auth-cfgTobias Brunner2016-03-041-12/+1
| | | | As we use a different rule we can always store the scheme.
* ikev2: Diversify signature scheme ruleThomas Egerer2016-03-042-3/+4
| | | | | | | This allows for different signature schemes for IKE authentication and trustchain verification. Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
* ike-init: Verify REDIRECT notify before processing IKE_SA_INIT messageTobias Brunner2016-03-041-7/+51
| | | | | | An attacker could blindly send a message with invalid nonce data (or none at all) to DoS an initiator if we just destroy the SA. To prevent this we ignore the message and wait for the one by the correct responder.
* ikev2: Allow tasks to verify request messages before processing themTobias Brunner2016-03-041-4/+47
|
* ikev2: Allow tasks to verify response messages before processing themTobias Brunner2016-03-041-1/+27
|
* task: Add optional pre_process() methodTobias Brunner2016-03-041-1/+13
| | | | | This will eventually allow tasks to pre-process and verify received messages.
* ike-init: Ignore notifies related to redirects during rekeyingTobias Brunner2016-03-041-3/+13
| | | | Also don't query redirect providers in this case.
* ike-sa: Add limit for the number of redirects within a defined time periodTobias Brunner2016-03-042-0/+54
|
* ike-sa: Reauthenticate to the same addresses we currently useTobias Brunner2016-03-041-2/+5
| | | | | | If the SA got redirected this would otherwise cause a reauthentication with the original gateway. Reestablishing the SA to the original gateway, if e.g. the new gateway is not reachable makes sense though.
* ike-sa: Add redirect() method to actively redirect an IKE_SATobias Brunner2016-03-042-0/+50
|
* ike-redirect: Add task to redirect active IKE_SAsTobias Brunner2016-03-045-0/+218
|
* ike-auth: Handle REDIRECT notifies during IKE_AUTHTobias Brunner2016-03-041-22/+44
|
* ike-sa: Handle redirect requests for established SAs as reestablishmentTobias Brunner2016-03-041-82/+174
| | | | | | | We handle this similar to how we do reestablishing IKE_SAs with all CHILD_SAs, which also includes the one actively queued during IKE_AUTH. To delete the old SA we use the recently added ike_reauth_complete task.
* ike-auth: Send REDIRECT notify during IKE_AUTH if requested by providersTobias Brunner2016-03-041-27/+51
| | | | | | To prevent the creation of the CHILD_SA we set a condition on the IKE_SA. We also schedule a delete job in case the client does not terminate the IKE_SA (which is a SHOULD in RFC 5685).
* ike-config: Do not assign attributes for redirected IKE_SAsTobias Brunner2016-03-041-0/+5
|
* child-create: Don't create CHILD_SA if the IKE_SA got redirected in IKE_AUTHTobias Brunner2016-03-041-0/+4
|
* ike-sa: Add a condition to mark redirected IKE_SAsTobias Brunner2016-03-041-0/+5
|
* ike-init: Handle REDIRECTED_FROM similar to REDIRECT_SUPPORTED as serverTobias Brunner2016-03-041-0/+17
|
* ike-init: Send REDIRECTED_FROM instead of REDIRECT_SUPPORTED if appropriateTobias Brunner2016-03-041-1/+19
|
* ike-sa: Keep track of the address of the gateway that redirected usTobias Brunner2016-03-042-1/+27
|
* ikev2: Add option to disable following redirects as clientTobias Brunner2016-03-042-1/+20
|
* ikev2: Handle REDIRECT notifies during IKE_SA_INITTobias Brunner2016-03-043-0/+64
|
* ike-init: Send REDIRECT notify during IKE_SA_INIT if requested by providersTobias Brunner2016-03-041-0/+17
|
* redirect-manager: Add helper function to create and parse REDIRECT notify dataTobias Brunner2016-03-042-11/+162
| | | | The same encoding is also used for the REDIRECT_FROM notifies.
* redirect-manager: Verify type of returned gateway IDTobias Brunner2016-03-041-1/+12
|
* ike-init: Send REDIRECT_SUPPORTED as initiatorTobias Brunner2016-03-041-0/+5
|
* ike-init: Enable redirection extension if client sends REDIRECT_SUPPORTED notifyTobias Brunner2016-03-041-0/+4
|
* ike-sa: Add new extension for IKEv2 redirection (RFC 5685)Tobias Brunner2016-03-041-1/+6
|
* redirect-manager: Add manager for redirect providersTobias Brunner2016-03-042-0/+221
|
* redirect-provider: Add interface to redirect clients during initial messagesTobias Brunner2016-03-041-0/+59
| | | | | This will allow e.g. plugins to decide whether a connecting client is redirected to a different gateway using RFC 5685.
* libhydra: Move kernel interface to libcharonTobias Brunner2016-03-0310-95/+75
| | | | This moves hydra->kernel_interface to charon->kernel.
* ikev1: Send and verify IPv6 addresses correctlyTobias Brunner2016-03-031-26/+11
| | | | | | | | According to the mode-config draft there is no prefix sent for IPv6 addresses in IKEv1. We still accept 17 bytes long addresses for backwards compatibility with older strongSwan releases. Fixes #1304.
* ikev1: Allow immediate deletion of rekeyed CHILD_SAsTobias Brunner2016-03-031-1/+17
| | | | | | | | | | | | | | | When charon rekeys a CHILD_SA after a soft limit expired, it is only deleted after the hard limit is reached. In case of packet/byte limits this may not be the case for a long time since the packets/bytes are usually sent using the new SA. This may result in a very large number of stale CHILD_SAs and kernel states. With enough connections configured this will ultimately exhaust the memory of the system. This patch adds a strongswan.conf setting that, if enabled, causes the old CHILD_SA to be deleted by the initiator after a successful rekeying. Enabling this setting might create problems with implementations that continue to use rekeyed SAs (e.g. if the DELETE notify is lost).
* ikev1: Avoid modifying local auth config when detecting pubkey methodTobias Brunner2016-03-031-1/+1
| | | | | | | | | If it was necessary to pass the local certificates we could probably clone the config (but we don't do that either when later looking for the key to actually authenticate). Passing auth adds the same subject cert to the config over and over again (I guess we could also try to prevent that by searching for duplicates).
* ike: Keep track of send keepalive jobs to avoid scheduling more than one per ↵Tobias Brunner2016-03-032-10/+23
| | | | IKE_SA
* ike: Don't send NAT keepalives if we have no path to the other peerTobias Brunner2016-03-031-3/+9
| | | | | | | | If there is no path to the other peer there is no point in trying to send a NAT keepalive. If the condition changes back and forth within the keepalive interval there is a chance that multiple jobs get queued.
* ikev2: Use config value for sending of vendor IDsThomas Egerer2016-03-011-13/+43
| | | | Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
* ike-sa-manager: Store a reference to the thread that checked out an IKE_SATobias Brunner2016-02-171-13/+14
| | | | | | This could be helpful when debugging deadlocks that manifest around wait_for_entry(), as it helps identifying other involved threads (the thread object is seen in the thread_main() call in each thread's backtrace).
* ikev2: Add debug message about failed IKE authenticationThomas Egerer2016-02-021-0/+4
| | | | Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
* ikev1: Log successful authentication with signature schemeThomas Egerer2016-02-011-1/+1
| | | | | | Output is now identical to that of the IKEv2 pubkey authenticator. Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
* ikev1: Always enable charon.reuse_ikesaTobias Brunner2016-02-011-2/+2
| | | | | | | | | With IKEv1 we have to reuse IKE_SAs as otherwise the responder might detect the new SA as reauthentication and will "adopt" the CHILD_SAs of the original IKE_SA, while the initiator will not do so. This could cause CHILD_SA rekeying to fail later. Fixes #1236.
* child-rekey: Suppress updown event when deleting redundant CHILD_SAsTobias Brunner2016-02-011-1/+10
| | | | | | | | | When handling a rekey collision we might have to delete an already installed redundant CHILD_SA (or expect the other peer to do so). We don't want to trigger updown events for these as neither do we do so for successfully rekeyed CHILD_SAs. Fixes #853.
* ike-sa-manager: Don't update entries for init messages after unlocking segmentTobias Brunner2016-02-011-3/+2
| | | | | | | | | | | | | If the retransmit of an initial message is processed concurrently with the original message it might not have been handled as intended as the thread processing the retransmit might not have seen the correct value of entry->processing set by the thread handling the original request. For IKEv1, i.e. without proper message IDs, there might still be races e.g. when receiving a retransmit of the initial IKE message while processing the initiator's second request. Fixes #1269.
* mode-config: Reassign migrated virtual IP if client requests %anyTobias Brunner2015-11-121-1/+3
| | | | | | | | | If we mistakenly detect a new IKE_SA as a reauthentication the client won't request the previous virtual IP, but since we already migrated it we already triggered the assign_vips() hook, so we should reassign the migrated virtual IP. Fixes #1152.
* ike-sa-manager: Allow plugins to provide IKE SPIs via a callbackTobias Brunner2015-11-112-11/+54
| | | | | Plugins must depend on `libcharon-sa-managers` to ensure the manager exists.
* ikev1: Also use message hashes for Quick Mode for the early retransmission checkTobias Brunner2015-11-111-4/+8
| | | | | | | | | | We already did so during Phase 1 but because all three Quick Mode message have the same message ID we occasionally dropped the third message as retransmit, so we do it there too. For INFORMATIONAL and TRANSACTION exchanges we don't expect more than one inbound message with the same message ID so we still use them there. Fixes #1198.
* kernel-interface: Pass the same data to del_policy() that was passed to ↵Tobias Brunner2015-11-102-98/+107
| | | | | | | add_policy() The additional data can be helpful to identify the exact policy to delete.
* trap-manager: Also clean up remote address in error casesTobias Brunner2015-11-101-0/+2
| | | | Fixes #1201.
* traffic-selector: Don't end printf'ed list of traffic selectors with a spaceTobias Brunner2015-11-104-7/+7
|
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-16 20:58:19 +0000