denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

removed deprecated iterator methods (has_next & current)

Browse Source 
added iterator hook to manipulate iterator the clean way
This commit is contained in:
Martin Willi
2006-10-24 14:20:45 +00:00
parent 55bbff11ec
commit 191a26a6a7
31 changed files with 366 additions and 529 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/charon/sa/authenticator.c
+6 -3
View File
@@ -213,9 +213,12 @@ static status_t verify_auth_data (private_authenticator_t *this,
}
}
DBG1(SIG_DBG_IKE, "authentication of '%D' with %N %s",
other_id, auth_method_names, auth_method,
(status == SUCCESS)? "successful":"failed");
if (status == SUCCESS)
{
DBG1(SIG_DBG_IKE, "authentication of '%D' with %N successful",
other_id, auth_method_names, auth_method);
}
return status;
}
src/charon/sa/child_sa.c
+5 -12
View File
@@ -233,6 +233,7 @@ static child_sa_state_t get_state(private_child_sa_t *this)
*/
static void updown(private_child_sa_t *this, bool up)
{
sa_policy_t *policy;
iterator_t *iterator;
if (this->script == NULL)
@@ -241,18 +242,14 @@ static void updown(private_child_sa_t *this, bool up)
}
iterator = this->policies->create_iterator(this->policies, TRUE);
while (iterator->has_next(iterator))
while (iterator->iterate(iterator, (void**)&policy))
{
sa_policy_t *policy;
char command[1024];
char *ifname = NULL;
char *my_client, *other_client, *my_client_mask, *other_client_mask;
char *pos;
FILE *shell;
/* get ts strings */
iterator->current(iterator, (void**)&policy);
/* get subnet/bits from string */
asprintf(&my_client, "%R", policy->my_ts);
pos = strchr(my_client, '/');
@@ -430,9 +427,8 @@ static status_t alloc(private_child_sa_t *this, linked_list_t *proposals)
/* iterator through proposals to update spis */
iterator = proposals->create_iterator(proposals, TRUE);
while(iterator->has_next(iterator))
while(iterator->iterate(iterator, (void**)&proposal))
{
iterator->current(iterator, (void**)&proposal);
if (alloc_proposal(this, proposal) != SUCCESS)
{
iterator->destroy(iterator);
@@ -614,18 +610,15 @@ static status_t add_policies(private_child_sa_t *this, linked_list_t *my_ts_list
/* iterate over both lists */
my_iter = my_ts_list->create_iterator(my_ts_list, TRUE);
other_iter = other_ts_list->create_iterator(other_ts_list, TRUE);
while (my_iter->has_next(my_iter))
while (my_iter->iterate(my_iter, (void**)&my_ts))
{
my_iter->current(my_iter, (void**)&my_ts);
other_iter->reset(other_iter);
while (other_iter->has_next(other_iter))
while (other_iter->iterate(other_iter, (void**)&other_ts))
{
/* set up policies for every entry in my_ts_list to every entry in other_ts_list */
status_t status;
sa_policy_t *policy;
other_iter->current(other_iter, (void**)&other_ts);
if (my_ts->get_type(my_ts) != other_ts->get_type(other_ts))
{
DBG2(SIG_DBG_CHD,
src/charon/sa/ike_sa.c
+8 -9
View File
@@ -1056,6 +1056,11 @@ static bool ts_list_equals(linked_list_t *l1, linked_list_t *l2)
iterator_t *i1, *i2;
traffic_selector_t *t1, *t2;
if (l1->get_count(l1) != l2->get_count(l2))
{
return FALSE;
}
i1 = l1->create_iterator(l1, TRUE);
i2 = l2->create_iterator(l2, TRUE);
while (i1->iterate(i1, (void**)&t1) && i2->iterate(i2, (void**)&t2))
@@ -1066,11 +1071,6 @@ static bool ts_list_equals(linked_list_t *l1, linked_list_t *l2)
break;
}
}
/* check if one iterator is not at the end */
if (i1->has_next(i1) || i2->has_next(i2))
{
equals = FALSE;
}
i1->destroy(i1);
i2->destroy(i2);
return equals;
@@ -1623,11 +1623,10 @@ static child_sa_t* get_child_sa(private_ike_sa_t *this, protocol_id_t protocol,
child_sa_t *current, *found = NULL;
iterator = this->child_sas->create_iterator(this->child_sas, TRUE);
while (iterator->has_next(iterator))
{
iterator->current(iterator, (void**)&current);
while (iterator->iterate(iterator, (void**)&current))
{;
if (current->get_spi(current, inbound) == spi &&
current->get_protocol(current) == protocol)
current->get_protocol(current) == protocol)
{
found = current;
}
src/charon/sa/ike_sa_manager.c
+17 -32
View File
@@ -191,6 +191,7 @@ static status_t get_entry_by_sa(private_ike_sa_manager_t *this, ike_sa_t *ike_sa
{
linked_list_t *list = this->ike_sa_list;
iterator_t *iterator;
entry_t *current;
status_t status;
iterator = list->create_iterator(list, TRUE);
@@ -198,10 +199,8 @@ static status_t get_entry_by_sa(private_ike_sa_manager_t *this, ike_sa_t *ike_sa
/* default status */
status = NOT_FOUND;
while (iterator->has_next(iterator))
while (iterator->iterate(iterator, (void**)&current))
{
entry_t *current;
iterator->current(iterator, (void**)&current);
/* only pointers are compared */
if (current->ike_sa == ike_sa)
{
@@ -223,17 +222,16 @@ static status_t delete_entry(private_ike_sa_manager_t *this, entry_t *entry)
{
linked_list_t *list = this->ike_sa_list;
iterator_t *iterator;
entry_t *current;
status_t status;
iterator = list->create_iterator(list, TRUE);
status = NOT_FOUND;
while (iterator->has_next(iterator))
while (iterator->iterate(iterator, (void**)&current))
{
entry_t *current;
iterator->current(iterator, (void**)&current);
if (current == entry)
if (current == entry)
{
/* mark it, so now new threads can get this entry */
entry->driveout_new_threads = TRUE;
@@ -308,19 +306,18 @@ static ike_sa_t* checkout_by_id(private_ike_sa_manager_t *this,
identification_t *other_id)
{
iterator_t *iterator;
entry_t *entry;
ike_sa_t *ike_sa = NULL;
pthread_mutex_lock(&(this->mutex));
iterator = this->ike_sa_list->create_iterator(this->ike_sa_list, TRUE);
while (iterator->has_next(iterator))
while (iterator->iterate(iterator, (void**)&entry))
{
entry_t *entry;
identification_t *found_my_id, *found_other_id;
host_t *found_my_host, *found_other_host;
int wc;
iterator->current(iterator, (void**)&entry);
if (!wait_for_entry(this, entry))
{
continue;
@@ -496,16 +493,14 @@ static ike_sa_t* checkout_by_child(private_ike_sa_manager_t *this,
u_int32_t reqid)
{
iterator_t *iterator;
entry_t *entry;
ike_sa_t *ike_sa = NULL;
pthread_mutex_lock(&(this->mutex));
iterator = this->ike_sa_list->create_iterator(this->ike_sa_list, TRUE);
while (iterator->has_next(iterator))
while (iterator->iterate(iterator, (void**)&entry))
{
entry_t *entry;
iterator->current(iterator, (void**)&entry);
if (wait_for_entry(this, entry))
{
/* ok, access is exclusive for us, check for child */
@@ -526,18 +521,11 @@ static ike_sa_t* checkout_by_child(private_ike_sa_manager_t *this,
}
/**
* Iterator hook for iterate
* Iterator hook for iterate, gets ike_sas instead of entries
*/
static bool iterate(iterator_t *iterator, void **value)
static void* iterator_hook(void *value)
{
if (iterator->has_next(iterator))
{
entry_t *entry;
iterator->current(iterator, (void**)&entry);
*value = entry->ike_sa;
return TRUE;
}
return FALSE;
return ((entry_t*)value)->ike_sa;
}
/**
@@ -547,8 +535,8 @@ static iterator_t *create_iterator(private_ike_sa_manager_t* this)
{
iterator_t *iterator = this->ike_sa_list->create_iterator_locked(
this->ike_sa_list, &this->mutex);
/* overload iterator */
iterator->iterate = iterate;
/* register hook to iterator over ike_sas, not entries */
iterator->set_iterator_hook(iterator, iterator_hook);
return iterator;
}
@@ -818,9 +806,8 @@ static void destroy(private_ike_sa_manager_t *this)
/* Step 1: drive out all waiting threads */
DBG2(SIG_DBG_MGR, "set driveout flags for all stored IKE_SA's");
iterator = list->create_iterator(list, TRUE);
while (iterator->has_next(iterator))
while (iterator->iterate(iterator, (void**)&entry))
{
iterator->current(iterator, (void**)&entry);
/* do not accept new threads, drive out waiting threads */
entry->driveout_new_threads = TRUE;
entry->driveout_waiting_threads = TRUE;
@@ -828,9 +815,8 @@ static void destroy(private_ike_sa_manager_t *this)
DBG2(SIG_DBG_MGR, "wait for all threads to leave IKE_SA's");
/* Step 2: wait until all are gone */
iterator->reset(iterator);
while (iterator->has_next(iterator))
while (iterator->iterate(iterator, (void**)&entry))
{
iterator->current(iterator, (void**)&entry);
while (entry->waiting_threads)
{
/* wake up all */
@@ -842,9 +828,8 @@ static void destroy(private_ike_sa_manager_t *this)
DBG2(SIG_DBG_MGR, "delete all IKE_SA's");
/* Step 3: initiate deletion of all IKE_SAs */
iterator->reset(iterator);
while (iterator->has_next(iterator))
while (iterator->iterate(iterator, (void**)&entry))
{
iterator->current(iterator, (void**)&entry);
entry->ike_sa->delete(entry->ike_sa);
}
iterator->destroy(iterator);
src/charon/sa/ike_sa_manager.h
+1 -2
View File
@@ -106,8 +106,7 @@ struct ike_sa_manager_t {
*
* The avoid synchronization issues, the iterator locks access
* to the manager exclusively, until it gets destroyed.
* Only use the iterate() functions of this iterator!!! Anything other
* is not implemented and causes crashes.
* This iterator is for reading only! Writing will corrupt the manager.
*
* @param this the manager object
* @return iterator over all IKE_SAs.
src/charon/sa/transactions/create_child_sa.c
+31 -23
View File
@@ -271,7 +271,7 @@ static status_t get_request(private_create_child_sa_t *this, message_t **result)
this->child_sa->set_name(this->child_sa, this->policy->get_name(this->policy));
if (this->child_sa->alloc(this->child_sa, proposals) != SUCCESS)
{
DBG1(SIG_DBG_IKE, "could not install CHILD_SA, CHILD_SA creation aborted");
SIG(SIG_CHILD_FAILED, "could not install CHILD_SA, CHILD_SA creation aborted");
return FAILED;
}
sa_payload = sa_payload_create_from_proposal_list(proposals);
@@ -285,6 +285,7 @@ static status_t get_request(private_create_child_sa_t *this, message_t **result)
if (this->randomizer->allocate_pseudo_random_bytes(this->randomizer,
NONCE_SIZE, &this->nonce_i) != SUCCESS)
{
SIG(SIG_CHILD_FAILED, "could not create nonce");
return FAILED;
}
nonce_payload = nonce_payload_create();
@@ -345,17 +346,17 @@ static status_t process_notifys(private_create_child_sa_t *this, notify_payload_
{
case SINGLE_PAIR_REQUIRED:
{
DBG1(SIG_DBG_IKE, "received a SINGLE_PAIR_REQUIRED notify");
SIG(SIG_CHILD_FAILED, "received a SINGLE_PAIR_REQUIRED notify");
return FAILED;
}
case TS_UNACCEPTABLE:
{
DBG1(SIG_DBG_IKE, "received TS_UNACCEPTABLE notify");
SIG(SIG_CHILD_FAILED, "received TS_UNACCEPTABLE notify");
return FAILED;
}
case NO_PROPOSAL_CHOSEN:
{
DBG1(SIG_DBG_IKE, "received NO_PROPOSAL_CHOSEN notify");
SIG(SIG_CHILD_FAILED, "received NO_PROPOSAL_CHOSEN notify");
return FAILED;
}
case REKEY_SA:
@@ -382,7 +383,7 @@ static status_t process_notifys(private_create_child_sa_t *this, notify_payload_
{
if (notify_type < 16383)
{
DBG1(SIG_DBG_IKE, "received %N notify error, CHILD_SA "
SIG(SIG_CHILD_FAILED, "received %N notify error, CHILD_SA "
"creation failed", notify_type_names, notify_type);
return FAILED;
}
@@ -480,6 +481,7 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
message_t *response;
status_t status;
iterator_t *payloads;
payload_t *payload;
sa_payload_t *sa_request = NULL;
nonce_payload_t *nonce_request = NULL;
ts_payload_t *tsi_request = NULL;
@@ -513,7 +515,7 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
/* check message type */
if (request->get_exchange_type(request) != CREATE_CHILD_SA)
{
DBG1(SIG_DBG_IKE, "CREATE_CHILD_SA response of invalid type, aborted");
SIG(SIG_CHILD_FAILED, "CREATE_CHILD_SA response of invalid type, aborted");
return FAILED;
}
@@ -523,16 +525,14 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
this->ike_sa->get_state(this->ike_sa) == IKE_DELETING)
{
build_notify(NO_ADDITIONAL_SAS, CHUNK_INITIALIZER, response, TRUE);
DBG1(SIG_DBG_IKE, "unable to create new CHILD_SAs, as rekeying in progress");
SIG(SIG_CHILD_FAILED, "unable to create new CHILD_SAs, as rekeying in progress");
return FAILED;
}
/* Iterate over all payloads. */
payloads = request->get_payload_iterator(request);
while (payloads->has_next(payloads))
while (payloads->iterate(payloads, (void**)&payload))
{
payload_t *payload;
payloads->current(payloads, (void**)&payload);
switch (payload->get_type(payload))
{
case SECURITY_ASSOCIATION:
@@ -552,7 +552,7 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
u_int8_t dh_buffer[] = {0x00, 0x00}; /* MODP_NONE */
chunk_t group = chunk_from_buf(dh_buffer);
build_notify(INVALID_KE_PAYLOAD, group, response, TRUE);
DBG1(SIG_DBG_IKE, "CREATE_CHILD_SA used PFS, sending INVALID_KE_PAYLOAD");
SIG(SIG_CHILD_FAILED, "CREATE_CHILD_SA used PFS, sending INVALID_KE_PAYLOAD");
return FAILED;
}
case NOTIFY:
@@ -579,7 +579,7 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
if (!(sa_request && nonce_request && tsi_request && tsr_request))
{
build_notify(INVALID_SYNTAX, CHUNK_INITIALIZER, response, TRUE);
DBG1(SIG_DBG_IKE, "request message incomplete, no CHILD_SA created");
SIG(SIG_CHILD_FAILED, "request message incomplete, no CHILD_SA created");
return FAILED;
}
@@ -619,7 +619,7 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
if (this->policy == NULL)
{
DBG1(SIG_DBG_IKE, "no acceptable policy found, adding TS_UNACCEPTABLE notify");
SIG(SIG_CHILD_FAILED, "no acceptable policy found, sending TS_UNACCEPTABLE notify");
build_notify(TS_UNACCEPTABLE, CHUNK_INITIALIZER, response, TRUE);
return FAILED;
}
@@ -642,14 +642,14 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
/* do we have a proposal? */
if (this->proposal == NULL)
{
DBG1(SIG_DBG_IKE, "CHILD_SA proposals unacceptable, adding NO_PROPOSAL_CHOSEN notify");
SIG(SIG_CHILD_FAILED, "CHILD_SA proposals unacceptable, sending NO_PROPOSAL_CHOSEN notify");
build_notify(NO_PROPOSAL_CHOSEN, CHUNK_INITIALIZER, response, TRUE);
return FAILED;
}
/* do we have traffic selectors? */
else if (this->tsi->get_count(this->tsi) == 0 || this->tsr->get_count(this->tsr) == 0)
{
DBG1(SIG_DBG_IKE, "CHILD_SA traffic selectors unacceptable, adding TS_UNACCEPTABLE notify");
SIG(SIG_CHILD_FAILED, "CHILD_SA traffic selectors unacceptable, sending TS_UNACCEPTABLE notify");
build_notify(TS_UNACCEPTABLE, CHUNK_INITIALIZER, response, TRUE);
return FAILED;
}
@@ -670,7 +670,7 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
this->child_sa->set_name(this->child_sa, this->policy->get_name(this->policy));
if (install_child_sa(this, FALSE) != SUCCESS)
{
DBG1(SIG_DBG_IKE, "installing CHILD_SA failed, adding NO_PROPOSAL_CHOSEN notify");
SIG(SIG_CHILD_FAILED, "installing CHILD_SA failed, sending NO_PROPOSAL_CHOSEN notify");
build_notify(NO_PROPOSAL_CHOSEN, CHUNK_INITIALIZER, response, TRUE);
return FAILED;
}
@@ -710,6 +710,10 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
}
this->rekeyed_sa->set_state(this->rekeyed_sa, CHILD_REKEYING);
}
else
{
SIG(SIG_CHILD_UP, "CHILD_SA created");
}
return SUCCESS;
}
@@ -720,6 +724,7 @@ static status_t conclude(private_create_child_sa_t *this, message_t *response,
transaction_t **next)
{
iterator_t *payloads;
payload_t *payload;
host_t *me, *other;
sa_payload_t *sa_payload = NULL;
nonce_payload_t *nonce_payload = NULL;
@@ -732,7 +737,7 @@ static status_t conclude(private_create_child_sa_t *this, message_t *response,
/* check message type */
if (response->get_exchange_type(response) != CREATE_CHILD_SA)
{
DBG1(SIG_DBG_IKE, "CREATE_CHILD_SA response of invalid type, aborting");
SIG(SIG_CHILD_FAILED, "CREATE_CHILD_SA response of invalid type, aborting");
return FAILED;
}
@@ -741,10 +746,8 @@ static status_t conclude(private_create_child_sa_t *this, message_t *response,
/* Iterate over all payloads to collect them */
payloads = response->get_payload_iterator(response);
while (payloads->has_next(payloads))
while (payloads->iterate(payloads, (void**)&payload))
{
payload_t *payload;
payloads->current(payloads, (void**)&payload);
switch (payload->get_type(payload))
{
case SECURITY_ASSOCIATION:
@@ -781,7 +784,7 @@ static status_t conclude(private_create_child_sa_t *this, message_t *response,
if (!(sa_payload && nonce_payload && tsi_payload && tsr_payload))
{
DBG1(SIG_DBG_IKE, "response message incomplete, no CHILD_SA built");
SIG(SIG_CHILD_FAILED, "response message incomplete, no CHILD_SA built");
return FAILED;
}
@@ -814,15 +817,16 @@ static status_t conclude(private_create_child_sa_t *this, message_t *response,
this->tsi->get_count(this->tsi) == 0 ||
this->tsr->get_count(this->tsr) == 0)
{
DBG1(SIG_DBG_IKE, "CHILD_SA creation failed");
SIG(SIG_CHILD_FAILED, "CHILD_SA negotiation failed, no CHILD_SA built");
return FAILED;
}
new_child = this->child_sa;
if (install_child_sa(this, TRUE) != SUCCESS)
{
DBG1(SIG_DBG_IKE, "installing CHILD_SA failed, no CHILD_SA built");
SIG(SIG_CHILD_FAILED, "installing CHILD_SA failed, no CHILD_SA built");
return FAILED;
}
SIG(SIG_CHILD_UP, "CHILD_SA created");
}
/* CHILD_SA successfully created. If the other peer initiated rekeying
* in the meantime, we detect this by comparing the rekeying_transaction
@@ -868,6 +872,10 @@ static status_t conclude(private_create_child_sa_t *this, message_t *response,
*next = (transaction_t*)delete_child_sa;
}
}
else
{
SIG(SIG_CHILD_UP, "CHILD_SA created");
}
if (this->lost)
{
/* we have lost simlutaneous rekeying, delete the CHILD_SA we just have created */
src/charon/sa/transactions/delete_child_sa.c
+4 -8
View File
@@ -217,6 +217,7 @@ static status_t get_response(private_delete_child_sa_t *this, message_t *request
host_t *me, *other;
message_t *response;
iterator_t *payloads;
payload_t *payload;
/* check if we already have built a response (retransmission) */
if (this->message)
@@ -258,11 +259,8 @@ static status_t get_response(private_delete_child_sa_t *this, message_t *request
/* iterate over all payloads */
payloads = request->get_payload_iterator(request);
while (payloads->has_next(payloads))
while (payloads->iterate(payloads, (void**)&payload))
{
payload_t *payload;
payloads->current(payloads, (void**)&payload);
switch (payload->get_type(payload))
{
case DELETE:
@@ -289,6 +287,7 @@ static status_t conclude(private_delete_child_sa_t *this, message_t *response,
transaction_t **transaction)
{
iterator_t *payloads;
payload_t *payload;
/* check message type */
if (response->get_exchange_type(response) != INFORMATIONAL)
@@ -299,11 +298,8 @@ static status_t conclude(private_delete_child_sa_t *this, message_t *response,
/* iterate over all payloads */
payloads = response->get_payload_iterator(response);
while (payloads->has_next(payloads))
while (payloads->iterate(payloads, (void**)&payload))
{
payload_t *payload;
payloads->current(payloads, (void**)&payload);
switch (payload->get_type(payload))
{
case DELETE:
src/charon/sa/transactions/delete_ike_sa.c
+2 -4
View File
@@ -125,6 +125,7 @@ static status_t get_response(private_delete_ike_sa_t *this, message_t *request,
host_t *me, *other;
message_t *response;
iterator_t *payloads;
payload_t *payload;
delete_payload_t *delete_request = NULL;
/* check if we already have built a response (retransmission)
@@ -160,11 +161,8 @@ static status_t get_response(private_delete_ike_sa_t *this, message_t *request,
/* iterate over all payloads */
payloads = request->get_payload_iterator(request);
while (payloads->has_next(payloads))
while (payloads->iterate(payloads, (void**)&payload))
{
payload_t *payload;
payloads->current(payloads, (void**)&payload);
switch (payload->get_type(payload))
{
case DELETE:
src/charon/sa/transactions/ike_auth.c
+39 -30
View File
@@ -271,7 +271,7 @@ static status_t get_request(private_ike_auth_t *this, message_t **result)
authenticator->destroy(authenticator);
if (status != SUCCESS)
{
DBG1(SIG_DBG_IKE, "could not generate AUTH data, deleting IKE_SA");
SIG(SIG_IKE_FAILED, "could not generate AUTH data, deleting IKE_SA");
return DESTROY_ME;
}
request->add_payload(request, (payload_t*)auth_payload);
@@ -295,7 +295,7 @@ static status_t get_request(private_ike_auth_t *this, message_t **result)
this->child_sa->set_name(this->child_sa, this->policy->get_name(this->policy));
if (this->child_sa->alloc(this->child_sa, proposal_list) != SUCCESS)
{
DBG1(SIG_DBG_IKE, "could not install CHILD_SA, deleting IKE_SA");
SIG(SIG_IKE_FAILED, "could not install CHILD_SA, deleting IKE_SA");
return DESTROY_ME;
}
sa_payload = sa_payload_create_from_proposal_list(proposal_list);
@@ -364,8 +364,8 @@ static status_t process_notifies(private_ike_auth_t *this, notify_payload_t *not
{
if (notify_type < 16383)
{
DBG1(SIG_DBG_IKE, "received %N notify error, deleting IKE_SA",
notify_type_names, notify_type);
SIG(SIG_IKE_FAILED, "received %N notify error, deleting IKE_SA",
notify_type_names, notify_type);
return DESTROY_ME;
}
else
@@ -504,6 +504,7 @@ static status_t get_response(private_ike_auth_t *this, message_t *request,
message_t *response;
status_t status;
iterator_t *payloads;
payload_t *payload;
id_payload_t *idi_request = NULL;
id_payload_t *idr_request = NULL;
auth_payload_t *auth_request = NULL;
@@ -538,16 +539,14 @@ static status_t get_response(private_ike_auth_t *this, message_t *request,
/* check message type */
if (request->get_exchange_type(request) != IKE_AUTH)
{
DBG1(SIG_DBG_IKE, "IKE_AUTH response of invalid type, deleting IKE_SA");
SIG(SIG_IKE_FAILED, "IKE_AUTH response of invalid type, deleting IKE_SA");
return DESTROY_ME;
}
/* Iterate over all payloads. */
payloads = request->get_payload_iterator(request);
while (payloads->has_next(payloads))
while (payloads->iterate(payloads, (void**)&payload))
{
payload_t *payload;
payloads->current(payloads, (void**)&payload);
switch (payload->get_type(payload))
{
case ID_INITIATOR:
@@ -601,7 +600,7 @@ static status_t get_response(private_ike_auth_t *this, message_t *request,
if (!(idi_request && auth_request && sa_request && tsi_request && tsr_request))
{
build_notify(INVALID_SYNTAX, response, TRUE);
DBG1(SIG_DBG_IKE, "request message incomplete, deleting IKE_SA");
SIG(SIG_IKE_FAILED, "request message incomplete, deleting IKE_SA");
return DESTROY_ME;
}
@@ -639,8 +638,8 @@ static status_t get_response(private_ike_auth_t *this, message_t *request,
* traffic selectors. Then we would create a IKE_SA without a CHILD_SA. */
if (this->policy == NULL)
{
DBG1(SIG_DBG_IKE, "no acceptable policy for IDs %D - %D found, deleting IKE_SA",
my_id, other_id);
SIG(SIG_IKE_FAILED, "no acceptable policy for IDs %D - %D found, "
"deleting IKE_SA", my_id, other_id);
my_id->destroy(my_id);
other_id->destroy(other_id);
build_notify(AUTHENTICATION_FAILED, response, TRUE);
@@ -696,7 +695,7 @@ static status_t get_response(private_ike_auth_t *this, message_t *request,
TRUE);
if (status != SUCCESS)
{
DBG1(SIG_DBG_IKE, "authentication failed, deleting IKE_SA");
SIG(SIG_IKE_FAILED, "authentication failed, deleting IKE_SA");
build_notify(AUTHENTICATION_FAILED, response, TRUE);
authenticator->destroy(authenticator);
return DESTROY_ME;
@@ -710,7 +709,7 @@ static status_t get_response(private_ike_auth_t *this, message_t *request,
authenticator->destroy(authenticator);
if (status != SUCCESS)
{
DBG1(SIG_DBG_IKE, "authentication data generation failed, deleting IKE_SA");
SIG(SIG_IKE_FAILED, "authentication data generation failed, deleting IKE_SA");
build_notify(AUTHENTICATION_FAILED, response, TRUE);
return DESTROY_ME;
}
@@ -736,13 +735,15 @@ static status_t get_response(private_ike_auth_t *this, message_t *request,
/* do we have a proposal? */
if (this->proposal == NULL)
{
DBG1(SIG_DBG_IKE, "CHILD_SA proposals unacceptable, adding NO_PROPOSAL_CHOSEN notify");
SIG(SIG_CHILD_FAILED, "CHILD_SA proposals unacceptable, no CHILD_SA created");
DBG1(SIG_DBG_IKE, "adding NO_PROPOSAL_CHOSEN notify to response");
build_notify(NO_PROPOSAL_CHOSEN, response, FALSE);
}
/* do we have traffic selectors? */
else if (this->tsi->get_count(this->tsi) == 0 || this->tsr->get_count(this->tsr) == 0)
{
DBG1(SIG_DBG_IKE, "CHILD_SA traffic selectors unacceptable, adding TS_UNACCEPTABLE notify");
SIG(SIG_CHILD_FAILED, "CHILD_SA traffic selectors unacceptable, no CHILD_SA created");
DBG1(SIG_DBG_IKE, "adding TS_UNACCEPTABLE notify to response");
build_notify(TS_UNACCEPTABLE, response, FALSE);
}
else
@@ -759,11 +760,16 @@ static status_t get_response(private_ike_auth_t *this, message_t *request,
this->child_sa->set_name(this->child_sa, this->policy->get_name(this->policy));
if (install_child_sa(this, FALSE) != SUCCESS)
{
DBG1(SIG_DBG_IKE, "installing CHILD_SA failed, adding NO_PROPOSAL_CHOSEN notify");
SIG(SIG_IKE_FAILED, "installing CHILD_SA failed, no CHILD_SA created");
DBG1(SIG_DBG_IKE, "adding NO_PROPOSAL_CHOSEN notify to response");
build_notify(NO_PROPOSAL_CHOSEN, response, FALSE);
}
/* add proposal to sa payload */
sa_response->add_proposal(sa_response, this->proposal);
else
{
/* add proposal to sa payload */
sa_response->add_proposal(sa_response, this->proposal);
SIG(SIG_CHILD_UP, "CHILD_SA created");
}
}
response->add_payload(response, (payload_t*)sa_response);
@@ -786,6 +792,7 @@ static status_t conclude(private_ike_auth_t *this, message_t *response,
transaction_t **transaction)
{
iterator_t *payloads;
payload_t *payload;
host_t *me, *other;
identification_t *other_id;
ts_payload_t *tsi_payload = NULL;
@@ -799,7 +806,7 @@ static status_t conclude(private_ike_auth_t *this, message_t *response,
/* check message type */
if (response->get_exchange_type(response) != IKE_AUTH)
{
DBG1(SIG_DBG_IKE, "IKE_AUTH response of invalid type, deleting IKE_SA");
SIG(SIG_IKE_FAILED, "IKE_AUTH response of invalid type, deleting IKE_SA");
return DESTROY_ME;
}
@@ -808,11 +815,8 @@ static status_t conclude(private_ike_auth_t *this, message_t *response,
/* Iterate over all payloads to collect them */
payloads = response->get_payload_iterator(response);
while (payloads->has_next(payloads))
{
payload_t *payload;
payloads->current(payloads, (void**)&payload);
while (payloads->iterate(payloads, (void**)&payload))
{
switch (payload->get_type(payload))
{
case ID_RESPONDER:
@@ -861,7 +865,7 @@ static status_t conclude(private_ike_auth_t *this, message_t *response,
if (!(idr_payload && auth_payload && sa_payload && tsi_payload && tsr_payload))
{
DBG1(SIG_DBG_IKE, "response message incomplete, deleting IKE_SA");
SIG(SIG_IKE_FAILED, "response message incomplete, deleting IKE_SA");
return DESTROY_ME;
}
@@ -875,8 +879,8 @@ static status_t conclude(private_ike_auth_t *this, message_t *response,
if (!other_id->matches(other_id, configured_other_id, &wildcards))
{
other_id->destroy(other_id);
DBG1(SIG_DBG_IKE, "other peer uses unacceptable ID (%D, excepted %D), deleting IKE_SA",
other_id, configured_other_id);
SIG(SIG_IKE_FAILED, "other peer uses unacceptable ID (%D, excepted "
"%D), deleting IKE_SA", other_id, configured_other_id);
return DESTROY_ME;
}
/* update other ID. It was already set, but may contain wildcards */
@@ -908,7 +912,8 @@ static status_t conclude(private_ike_auth_t *this, message_t *response,
authenticator->destroy(authenticator);
if (status != SUCCESS)
{
DBG1(SIG_DBG_IKE, "authentication failed, deleting IKE_SA");
SIG(SIG_IKE_FAILED, "authentication of '%D' with %N failed, "
"deleting IKE_SA", other_id, auth_method_names, auth_method);
return DESTROY_ME;
}
}
@@ -939,13 +944,17 @@ static status_t conclude(private_ike_auth_t *this, message_t *response,
this->tsr->get_count(this->tsr) == 0 ||
!this->build_child)
{
DBG1(SIG_DBG_IKE, "CHILD_SA creation failed");
SIG(SIG_CHILD_FAILED, "CHILD_SA negotiation failed, no CHILD_SA built");
}
else
{
if (install_child_sa(this, TRUE) != SUCCESS)
{
DBG1(SIG_DBG_IKE, "installing CHILD_SA failed, no CHILD_SA built");
SIG(SIG_CHILD_FAILED, "installing CHILD_SA failed, no CHILD_SA built");
}
else
{
SIG(SIG_CHILD_UP, "CHILD_SA created");
}
}
}
src/charon/sa/transactions/ike_sa_init.c
+5 -9
View File
@@ -497,6 +497,7 @@ static status_t get_response(private_ike_sa_init_t *this,
message_t *response;
status_t status;
iterator_t *payloads;
payload_t *payload;
sa_payload_t *sa_request = NULL;
ke_payload_t *ke_request = NULL;
nonce_payload_t *nonce_request = NULL;
@@ -562,10 +563,8 @@ static status_t get_response(private_ike_sa_init_t *this,
/* Iterate over all payloads. */
payloads = request->get_payload_iterator(request);
while (payloads->has_next(payloads))
while (payloads->iterate(payloads, (void**)&payload))
{
payload_t *payload;
payloads->current(payloads, (void**)&payload);
switch (payload->get_type(payload))
{
case SECURITY_ASSOCIATION:
@@ -668,9 +667,8 @@ static status_t get_response(private_ike_sa_init_t *this,
/* remove already added payloads */
iterator = response->get_payload_iterator(response);
while (iterator->has_next(iterator))
while (iterator->iterate(iterator, (void**)&payload))
{
iterator->current(iterator, (void**)&payload);
iterator->remove(iterator);
payload->destroy(payload);
}
@@ -827,6 +825,7 @@ static status_t conclude(private_ike_sa_init_t *this, message_t *response,
u_int64_t responder_spi;
ike_sa_id_t *ike_sa_id;
iterator_t *payloads;
payload_t *payload;
host_t *me, *other;
sa_payload_t *sa_payload = NULL;
ke_payload_t *ke_payload = NULL;
@@ -861,11 +860,8 @@ static status_t conclude(private_ike_sa_init_t *this, message_t *response,
/* Iterate over all payloads to collect them */
payloads = response->get_payload_iterator(response);
while (payloads->has_next(payloads))
while (payloads->iterate(payloads, (void**)&payload))
{
payload_t *payload;
payloads->current(payloads, (void**)&payload);
switch (payload->get_type(payload))
{
case SECURITY_ASSOCIATION:
src/charon/sa/transactions/rekey_ike_sa.c
+4 -6
View File
@@ -406,6 +406,7 @@ static status_t get_response(private_rekey_ike_sa_t *this, message_t *request,
message_t *response;
status_t status;
iterator_t *payloads, *iterator;
payload_t *payload;
child_sa_t *child_sa;
sa_payload_t *sa_request = NULL;
nonce_payload_t *nonce_request = NULL;
@@ -488,10 +489,8 @@ static status_t get_response(private_rekey_ike_sa_t *this, message_t *request,
/* Iterate over all payloads. */
payloads = request->get_payload_iterator(request);
while (payloads->has_next(payloads))
while (payloads->iterate(payloads, (void**)&payload))
{
payload_t *payload;
payloads->current(payloads, (void**)&payload);
switch (payload->get_type(payload))
{
case SECURITY_ASSOCIATION:
@@ -665,6 +664,7 @@ static status_t conclude(private_rekey_ike_sa_t *this, message_t *response,
transaction_t **next)
{
iterator_t *payloads;
payload_t *payload;
host_t *me, *other;
sa_payload_t *sa_payload = NULL;
nonce_payload_t *nonce_payload = NULL;
@@ -687,10 +687,8 @@ static status_t conclude(private_rekey_ike_sa_t *this, message_t *response,
/* Iterate over all payloads to collect them */
payloads = response->get_payload_iterator(response);
while (payloads->has_next(payloads))
while (payloads->iterate(payloads, (void**)&payload))
{
payload_t *payload;
payloads->current(payloads, (void**)&payload);
switch (payload->get_type(payload))
{
case SECURITY_ASSOCIATION: