denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ikev2: Send derived CHILD_SA keys to the bus

Browse Source
This commit is contained in:
Tobias Brunner
2016-10-04 10:01:50 +02:00
parent 4f373c7f20
commit 0e80f5c3ff
1 changed files with 45 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/ikev2/tasks/child_create.c
+28 -11
View File
@@ -666,10 +666,6 @@ static status_t select_and_install(private_child_create_t *this,
FALSE, this->tfcv3, my_ts, other_ts); FALSE, this->tfcv3, my_ts, other_ts);
} }
} }
chunk_clear(&integ_i);
chunk_clear(&integ_r);
chunk_clear(&encr_i);
chunk_clear(&encr_r);
if (status_i != SUCCESS || status_o != SUCCESS) if (status_i != SUCCESS || status_o != SUCCESS)
{ {
@@ -679,12 +675,14 @@ static status_t select_and_install(private_child_create_t *this,
(status_o != SUCCESS) ? "outbound " : ""); (status_o != SUCCESS) ? "outbound " : "");
charon->bus->alert(charon->bus, ALERT_INSTALL_CHILD_SA_FAILED, charon->bus->alert(charon->bus, ALERT_INSTALL_CHILD_SA_FAILED,
this->child_sa); this->child_sa);
return FAILED; status = FAILED;
} }
else
{
if (this->initiator) if (this->initiator)
{ {
status = this->child_sa->add_policies(this->child_sa, my_ts, other_ts); status = this->child_sa->add_policies(this->child_sa,
my_ts, other_ts);
} }
else else
{ {
@@ -696,7 +694,8 @@ static status_t select_and_install(private_child_create_t *this,
offsetof(traffic_selector_t, clone)); offsetof(traffic_selector_t, clone));
charon->bus->narrow(charon->bus, this->child_sa, charon->bus->narrow(charon->bus, this->child_sa,
NARROW_RESPONDER_POST, my_ts, other_ts); NARROW_RESPONDER_POST, my_ts, other_ts);
if (my_ts->get_count(my_ts) == 0 || other_ts->get_count(other_ts) == 0) if (my_ts->get_count(my_ts) == 0 ||
other_ts->get_count(other_ts) == 0)
{ {
status = FAILED; status = FAILED;
} }
@@ -705,15 +704,33 @@ static status_t select_and_install(private_child_create_t *this,
status = this->child_sa->add_policies(this->child_sa, status = this->child_sa->add_policies(this->child_sa,
my_ts, other_ts); my_ts, other_ts);
} }
my_ts->destroy_offset(my_ts, offsetof(traffic_selector_t, destroy)); my_ts->destroy_offset(my_ts,
other_ts->destroy_offset(other_ts, offsetof(traffic_selector_t, destroy)); offsetof(traffic_selector_t, destroy));
other_ts->destroy_offset(other_ts,
offsetof(traffic_selector_t, destroy));
} }
if (status != SUCCESS) if (status != SUCCESS)
{ {
DBG1(DBG_IKE, "unable to install IPsec policies (SPD) in kernel"); DBG1(DBG_IKE, "unable to install IPsec policies (SPD) in kernel");
charon->bus->alert(charon->bus, ALERT_INSTALL_CHILD_POLICY_FAILED, charon->bus->alert(charon->bus, ALERT_INSTALL_CHILD_POLICY_FAILED,
this->child_sa); this->child_sa);
return NOT_FOUND; status = NOT_FOUND;
}
else
{
charon->bus->child_derived_keys(charon->bus, this->child_sa,
this->initiator, encr_i, encr_r,
integ_i, integ_r);
}
}
chunk_clear(&integ_i);
chunk_clear(&integ_r);
chunk_clear(&encr_i);
chunk_clear(&encr_r);
if (status != SUCCESS)
{
return status;
} }
charon->bus->child_keys(charon->bus, this->child_sa, this->initiator, charon->bus->child_keys(charon->bus, this->child_sa, this->initiator,