a65a282fd1
proposal: Correctly add AES-GMAC for AH proposals
...
We parse aes*gmac as encryption algorithm, which we have to map to an
integrity algorithm. We also make sure we remove all other encryption
algorithms and ensure there is an integrity algorithm.
2016-10-05 14:27:05 +02:00
6a5e6579ea
proposal: Enforce separate proposals for AEAD and classic encryption algorithms
2016-10-05 14:27:04 +02:00
e98414ea9c
proposal: Make sure there is a PRF defined in IKE proposals
...
But filter PRFs from ESP proposals.
2016-10-05 14:27:04 +02:00
9b191d5975
proposal: Make DH groups mandatory in IKE proposals parsed from strings
...
References #2051 .
2016-10-05 14:26:55 +02:00
c98e48cf0e
child-cfg: Add setting that controls whether outbound FWD policies are installed
2016-09-28 17:56:43 +02:00
393688aea0
Created newhope plugin implementing the New Hope key exchange algorithm
2016-08-10 14:22:00 +02:00
f2ea230b91
child-cfg: Add option to prefer supplied proposals over locally configured ones
2016-06-17 18:48:07 +02:00
3a40d572c6
ike-cfg: Add option to prefer supplied proposals over locally configured ones
2016-06-17 18:48:07 +02:00
f5e8bc18fd
proposal: Remove MODP_NONE from IKE proposals parsed from strings
2016-06-17 18:48:07 +02:00
aae9510148
proposal: Handle MODP_NONE in both directions when selecting proposals
2016-06-17 18:48:07 +02:00
b1df631212
vici list-conns sends reauthentication and rekeying time information
2016-05-04 18:13:52 +02:00
fae18fd201
proposal: Remove some weaker and rarely used DH groups from the default proposal
...
This fixes an interoperability issue with Windows Server 2012 R2 gateways.
They insist on using modp1024 for IKE, however, Microsoft's IKEv2
implementation seems only to consider the first 15 DH groups in the proposal.
Depending on the loaded plugins modp1024 is now at position 17 or even
later, causing the server to reject the proposal. By removing some of
the weaker and rarely used DH groups from the default proposal we make
sure modp1024 is among the first 15 DH groups. The removed groups may
still be used by configuring custom proposals.
2016-05-04 11:33:28 +02:00
c26e4330e7
Implemented IPsec policies restricted to given network interface
2016-04-09 16:51:02 +02:00
7f57c4f9fb
Support manually-set IPsec policy priorities
2016-04-09 16:51:01 +02:00
2ba5dadb12
peer-cfg: Use struct to pass data to constructor
2016-04-09 16:51:01 +02:00
8a00a8452d
child-cfg: Use struct to pass data to constructor
2016-04-09 16:51:01 +02:00
b12c53ce77
Use standard unsigned integer types
2016-03-24 18:52:48 +01:00
622c2b2c33
peer-cfg: Add method to atomically replace child configs
2016-03-08 10:21:58 +01:00
8db4f19ad9
ike-cfg: Use new method to compare proposal lists in equals()
2016-03-08 10:21:57 +01:00
f6a5e6b6a9
peer-cfg: Use new method to compare linked lists in equals()
...
This also compares the complete lists not only the first two items.
2016-03-08 10:21:57 +01:00
3af23606bf
child-cfg: Add equals() method
2016-03-08 10:21:57 +01:00
b4ae9e81f5
peer-cfg: Set DPD timeout to at least DPD delay
...
If DPD timeout is set but to a value smaller than the DPD delay the code
in task_manager_v1.c:queue_liveliness_check will run into an integer
underrun.
2016-02-01 15:29:25 +01:00
a78e1c3b11
128 bit default security strength for IKE and ESP algorithms
...
The default ESP cipher suite is now
AES_CBC-128/HMAC_SHA2_256_128
and requires SHA-2 HMAC support in the Linux kernel (correctly implemented
since 2.6.33).
The default IKE cipher suite is now
AES_CBC-128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/ECP_256
if the openssl plugin is loaded or
AES_CBC-128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_3072
if ECC is not available.
The use of the SHA-1 hash algorithm and the MODP_2048 DH group has been
deprecated and ENCR_CHACHA20_POLY1305 has been added to the default
IKE AEAD algorithms.
2015-12-17 17:49:48 +01:00
ebeb8c87c5
traffic-selector: Don't end printf'ed list of traffic selectors with a space
2015-11-10 12:13:06 +01:00
c605a96d7f
Fix some Doxygen issues
2015-08-27 12:03:11 +02:00
6bfa660693
ike-cfg: Add helper function to determine address family of IP addresses
...
All configured static addresses (hostnames, ranges or subnets are not
considered) must be of the same family, otherwise AF_UNSPEC is returned.
2015-07-27 11:59:37 +02:00
b1ef481ce1
proposal: Add default PRF for HMAC-MD5-128 and HMAC-SHA1-160 integrity algorithms
2014-10-31 10:09:54 +01:00
e0cd3bad3d
ike-cfg: Use host_create_from_range() helper
2014-10-30 12:32:45 +01:00
f92399ef18
child-cfg: Ignore duplicate proposals
...
If ESP proposals are added once with and once without DH groups
duplicates result during IKE_AUTH when DH groups are stripped.
2014-09-12 10:18:14 +02:00
8e52dc2733
proposal: Fix equals()
2014-09-12 10:18:13 +02:00
bdcaa5e680
child-cfg: Store connection specific replay window on CHILD_SA config
2014-06-17 15:42:02 +02:00
b9dd46d8a9
peer-cfg: Add missing UNIQUE_NEVER to unique_policy_names
2014-05-19 18:05:51 +02:00
2f893f278d
proposal: Don't return a default IKE proposal without encryption/AEAD algs
2014-05-16 16:51:19 +02:00
356846db5d
child-cfg: Allow passing NULL as proposal to add_proposal()
...
Making the API consistent to the one of ike_cfg.
2014-05-16 16:01:21 +02:00
3312c447ef
ike-cfg: Allow passing NULL to add_proposal()
...
This simplifies adding default proposals with constructors potentially
returning NULL.
2014-05-16 16:01:21 +02:00
8642f8bdb7
proposal: Use an additional "default" constructor specific to AEAD algorithms
...
This allows a caller to create a separated proposal for supported AEAD
algorithms, as required by RFC 5996.
2014-05-16 16:01:21 +02:00
0fc4dd429d
proposal: Don't include AEAD algorithms in the default proposal
...
According to RFC 5996 3.3 we should use a separate proposal for AEAD algorithms.
This was not clear in RFC 5282, hence we previously included both AEAD and
non-AEAD algorithms in a single proposal.
2014-05-16 16:01:21 +02:00
c478dfe617
child-cfg: Fix removal of redundant traffic selectors
...
We have to make sure we compare every selected traffic selector with every
other in the list.
Fixes #577 .
2014-04-25 19:04:35 +02:00
23f34f6ed5
ike-cfg: Properly compare IKE proposals for equality
2014-04-03 09:46:41 +02:00
a213944d4a
proposal: Don't fail DH proposal matching if peer includes NONE
...
The DH transform is optional for ESP/AH proposals. The initiator can
include NONE (0) in its proposal to indicate that while it prefers to
do a DH exchange, the responder may still decide to not do so.
Fixes #532 .
2014-03-31 14:32:44 +02:00
ab13364c65
uclibc only defines strndup(3) if _GNU_SOURCE is defined
...
References #516 .
2014-02-19 16:11:47 +01:00
798a36dc14
Added NTRU key exchange to default IKE proposal
2013-11-27 20:21:41 +01:00
7313499914
proposal: Add ECC Brainpool DH groups to the default proposal
2013-10-17 13:36:09 +02:00
dd438ee22c
Doxygen fixes
2013-10-15 11:25:55 +02:00
f0c59e1cf8
proposal: Strip redundant integrity algos for ESP proposals only
2013-10-11 10:15:21 +02:00
3070697f9f
ike: support multiple addresses, ranges and subnets in IKE address config
...
Replace the allowany semantic by a more powerful subnet and IP range matching.
Multiple addresses, DNS names, subnets and ranges can be specified in a comma
separated list. Initiators ignore the ranges/subnets, responders match
configurations against all addresses, ranges and subnets.
2013-09-04 10:38:37 +02:00
beffdc6ab8
ike-cfg: remove the to be obsoleted allow any parameter in get_my/other_addr
2013-09-04 10:38:37 +02:00
62282ec0ed
backends: use ike_cfg host matching functions
2013-09-04 10:38:37 +02:00
6f666192bb
ike-cfg: add methods to match a host against configured local/remote addresses
2013-09-04 10:38:37 +02:00
e743275cae
ike-cfg: add a method to resolve local/remote hosts with port
2013-09-04 10:38:36 +02:00
9aeaa7396e
peer-cfg: add a pull/push mode option to use with mode config
2013-09-04 10:33:37 +02:00
2fa92ad256
proposal: correctly enumerate registered AEADs to build default IKE proposal
...
AEADs are not returned (anymore) with the encryption enumerator.
2013-07-19 15:05:17 +02:00
0ceb288815
Fix various API doc issues and typos
...
Partially based on an old patch by Adrian-Ken Rueegsegger.
2013-07-18 18:30:36 +02:00
c907b57f56
proposal: use array to store proposal list
...
Removes another two linked lists (0.5KB) of memory per IKE/CHILD_SA pair.
2013-07-17 17:20:18 +02:00
5cd64f979c
proposal: use a single list to store all transforms
...
Beside that it makes the code actually simpler, it reduces the number of lists
stored by each IKE_SA and each CHILD_SA by 4, which can be up to 1KB per SA.
2013-07-17 17:20:17 +02:00
a485320393
Raise an alert if the responding peer narrowed traffic selectors
2013-06-19 16:11:46 +02:00
246e2bed1d
Use subset matching instead of is_contained_in() to select a child_cfg
...
If one selector has a wider IP range than the other, but the other has a
wider port/protocol selector than the first one, none is completely contained
in the other. The check for a match using is_contained_in() therefore would
fail. Using get_subset() can handle such cases, fixing configuration selection.
2013-06-13 13:37:50 +02:00
306a269e34
Add a DSCP configuration value to IKE configs
2013-02-06 15:20:32 +01:00
365d9a6f67
Added an option that allows to force IKEv1 fragmentation
2013-01-12 11:54:32 +01:00
97973f8609
Use a connection specific option to en-/disable IKEv1 fragmentation
2012-12-24 13:00:01 +01:00
eba65182e4
Include 'aggressive' when comparing peer_cfg_t objects
2012-11-07 12:44:58 +01:00
4eba7269b8
proposal_t.strip_dh() takes a DH group to keep, using MODP_NONE will remove all
2012-10-24 16:09:42 +02:00
12642a6831
Moved data structures to new collections subfolder
2012-10-24 16:00:49 +02:00
2e7cc07ecd
Moved host_t and host_resolver_t to a new networking subfolder
2012-10-24 15:06:18 +02:00
7ee16e4b85
Only add an implicit PRF based on the MAC alg if no PRF given in proposal
2012-10-24 11:49:37 +02:00
e19b23e0b9
Remove peer_cfg IKE version matching, as it is done in ike_cfg matching
2012-10-24 10:19:33 +02:00
7910116384
Respect IKE version while selecting an ike_cfg as responder
2012-10-24 10:19:33 +02:00
1fdd62ffce
Remove version argument on peer_cfg constructor, use ike_cfg version instead
2012-10-24 10:19:33 +02:00
9fc7cc6f9b
Add IKE version information to ike_cfg_t
2012-10-24 10:18:35 +02:00
cf62d073f1
Move ike_version_t definition from peer_cfg_t to ike_cfg_t
2012-10-24 10:17:36 +02:00
6676769e8c
Make sure we propose a dynamic TS if we don't have hosts to derive a TS from
...
7ee37114
2012-09-21 18:14:17 +02:00
7ee37114c9
Derive a dynamic TS to multiple virtual IPs
2012-09-18 17:11:03 +02:00
4c57c63062
Added possibility to register custom proposal keywords
...
Keyword lookup and registration are handled via the new lib->proposal object.
2012-09-13 15:44:46 +02:00
995875210a
Removed len argument from proposal_get_token()
...
Also use enumerators instead of lexparser.h to parse proposal strings.
2012-09-13 15:44:01 +02:00
455accc687
Ensure traffic selectors are dynamic before calling set_address() when deriving them
2012-09-12 18:13:47 +02:00
f4cc7ea11b
Add uniqueids=never to ignore INITIAL_CONTACT notifies
...
With uniqueids=no the daemon still deletes any existing IKE_SA with the
same peer if an INITIAL_CONTACT notify is received. With this new option
it also ignores these notifies.
2012-09-10 17:37:18 +02:00
1323dc1138
Merge branch 'multi-vip'
...
Brings support for multiple virtual IPs and multiple pools in
left/rigthsourceip definitions. Also introduces the new left/rightdns
options to configure requested DNS server address family and respond
with multiple connection specific servers.
2012-08-31 12:55:56 +02:00
497ce2cf51
Support multiple address pools configured on a peer_cfg
2012-08-30 16:43:42 +02:00
101d26babe
Support multiple virtual IPs on peer_cfg and ike_sa classes
2012-08-30 16:43:42 +02:00
a21fac9a85
Log configured IKE_SA proposals as initiator
2012-08-24 13:43:14 +02:00
d2b4dff5dd
Log configured CHILD_SA proposals as initiator
2012-08-24 13:43:14 +02:00
9c2f08860d
Add DH group 15 (MODP-3072) to IKE proposal
2012-08-06 11:22:33 +02:00
1b40b74de0
Pass opaque data to printf hooks and print_in_hook()
2012-07-13 13:23:29 +02:00
1d315bddd3
implemented the right|leftallowany feature
2012-06-08 21:24:41 +02:00
7a75cae856
Added support for IKEv1 IPComp proposals in proposal substructure.
2012-05-24 15:32:27 +02:00
80c5b17d1a
make IKEv1 DPD timeout configurable in charon
2012-05-17 19:49:22 +02:00
b24be29646
Merge branch 'ikev1'
...
Conflicts:
configure.in
man/ipsec.conf.5.in
src/libcharon/encoding/generator.c
src/libcharon/encoding/payloads/notify_payload.c
src/libcharon/encoding/payloads/notify_payload.h
src/libcharon/encoding/payloads/payload.c
src/libcharon/network/receiver.c
src/libcharon/sa/authenticator.c
src/libcharon/sa/authenticator.h
src/libcharon/sa/ikev2/tasks/ike_init.c
src/libcharon/sa/task_manager.c
src/libstrongswan/credentials/auth_cfg.c
2012-05-02 11:12:31 +02:00
bad192069f
Make AES-CMAC actually usable for IKEv2.
2012-04-04 10:51:46 +02:00
5ce59d4c06
Added an aggressive mode peer_cfg option
2012-03-20 17:31:34 +01:00
986237603f
Fix ike_version_t enum names
2012-03-20 17:31:29 +01:00
15a682f4c2
Separated libcharon/sa directory with ikev1 and ikev2 subfolders
2012-03-20 17:31:26 +01:00
ac009df132
Pass IKE version to peer config enumerator, filter configs
2012-03-20 17:31:25 +01:00
d94c923648
Support an "any" IKE version for both IKEv1 or IKEv2
2012-03-20 17:31:25 +01:00
e6503db2cf
Fixed SIGSEGV when logging peer config matches.
2012-03-20 17:31:20 +01:00
033dfba01f
Log peer cfg enumeration externally for flexibility
2012-03-20 17:31:17 +01:00
d7376e2ab4
Accept NULL identities passed to peer config enumeration
2012-03-20 17:31:17 +01:00
d08269c700
Added a get_rekey/reauth_time() jitter parameter to get time without randomization
2012-03-20 17:30:52 +01:00
f7a8fcedc0
Use enum to define IKE version on peer_cfg_t.
...
Replaced all those magic numbers.
2012-03-20 17:30:41 +01:00
dc299da8e5
Added additional debug info to peer config matching
2011-10-11 09:46:24 +02:00
6b444c5934
Migrated peer_cfg_t to INIT/METHOD macros.
2011-08-03 15:17:34 +02:00
Tobias Brunner