removed deprecated iterator methods (has_next & current)
added iterator hook to manipulate iterator the clean way
This commit is contained in:
@@ -271,7 +271,7 @@ static status_t get_request(private_create_child_sa_t *this, message_t **result)
|
||||
this->child_sa->set_name(this->child_sa, this->policy->get_name(this->policy));
|
||||
if (this->child_sa->alloc(this->child_sa, proposals) != SUCCESS)
|
||||
{
|
||||
DBG1(SIG_DBG_IKE, "could not install CHILD_SA, CHILD_SA creation aborted");
|
||||
SIG(SIG_CHILD_FAILED, "could not install CHILD_SA, CHILD_SA creation aborted");
|
||||
return FAILED;
|
||||
}
|
||||
sa_payload = sa_payload_create_from_proposal_list(proposals);
|
||||
@@ -285,6 +285,7 @@ static status_t get_request(private_create_child_sa_t *this, message_t **result)
|
||||
if (this->randomizer->allocate_pseudo_random_bytes(this->randomizer,
|
||||
NONCE_SIZE, &this->nonce_i) != SUCCESS)
|
||||
{
|
||||
SIG(SIG_CHILD_FAILED, "could not create nonce");
|
||||
return FAILED;
|
||||
}
|
||||
nonce_payload = nonce_payload_create();
|
||||
@@ -345,17 +346,17 @@ static status_t process_notifys(private_create_child_sa_t *this, notify_payload_
|
||||
{
|
||||
case SINGLE_PAIR_REQUIRED:
|
||||
{
|
||||
DBG1(SIG_DBG_IKE, "received a SINGLE_PAIR_REQUIRED notify");
|
||||
SIG(SIG_CHILD_FAILED, "received a SINGLE_PAIR_REQUIRED notify");
|
||||
return FAILED;
|
||||
}
|
||||
case TS_UNACCEPTABLE:
|
||||
{
|
||||
DBG1(SIG_DBG_IKE, "received TS_UNACCEPTABLE notify");
|
||||
SIG(SIG_CHILD_FAILED, "received TS_UNACCEPTABLE notify");
|
||||
return FAILED;
|
||||
}
|
||||
case NO_PROPOSAL_CHOSEN:
|
||||
{
|
||||
DBG1(SIG_DBG_IKE, "received NO_PROPOSAL_CHOSEN notify");
|
||||
SIG(SIG_CHILD_FAILED, "received NO_PROPOSAL_CHOSEN notify");
|
||||
return FAILED;
|
||||
}
|
||||
case REKEY_SA:
|
||||
@@ -382,7 +383,7 @@ static status_t process_notifys(private_create_child_sa_t *this, notify_payload_
|
||||
{
|
||||
if (notify_type < 16383)
|
||||
{
|
||||
DBG1(SIG_DBG_IKE, "received %N notify error, CHILD_SA "
|
||||
SIG(SIG_CHILD_FAILED, "received %N notify error, CHILD_SA "
|
||||
"creation failed", notify_type_names, notify_type);
|
||||
return FAILED;
|
||||
}
|
||||
@@ -480,6 +481,7 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
|
||||
message_t *response;
|
||||
status_t status;
|
||||
iterator_t *payloads;
|
||||
payload_t *payload;
|
||||
sa_payload_t *sa_request = NULL;
|
||||
nonce_payload_t *nonce_request = NULL;
|
||||
ts_payload_t *tsi_request = NULL;
|
||||
@@ -513,7 +515,7 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
|
||||
/* check message type */
|
||||
if (request->get_exchange_type(request) != CREATE_CHILD_SA)
|
||||
{
|
||||
DBG1(SIG_DBG_IKE, "CREATE_CHILD_SA response of invalid type, aborted");
|
||||
SIG(SIG_CHILD_FAILED, "CREATE_CHILD_SA response of invalid type, aborted");
|
||||
return FAILED;
|
||||
}
|
||||
|
||||
@@ -523,16 +525,14 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
|
||||
this->ike_sa->get_state(this->ike_sa) == IKE_DELETING)
|
||||
{
|
||||
build_notify(NO_ADDITIONAL_SAS, CHUNK_INITIALIZER, response, TRUE);
|
||||
DBG1(SIG_DBG_IKE, "unable to create new CHILD_SAs, as rekeying in progress");
|
||||
SIG(SIG_CHILD_FAILED, "unable to create new CHILD_SAs, as rekeying in progress");
|
||||
return FAILED;
|
||||
}
|
||||
|
||||
/* Iterate over all payloads. */
|
||||
payloads = request->get_payload_iterator(request);
|
||||
while (payloads->has_next(payloads))
|
||||
while (payloads->iterate(payloads, (void**)&payload))
|
||||
{
|
||||
payload_t *payload;
|
||||
payloads->current(payloads, (void**)&payload);
|
||||
switch (payload->get_type(payload))
|
||||
{
|
||||
case SECURITY_ASSOCIATION:
|
||||
@@ -552,7 +552,7 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
|
||||
u_int8_t dh_buffer[] = {0x00, 0x00}; /* MODP_NONE */
|
||||
chunk_t group = chunk_from_buf(dh_buffer);
|
||||
build_notify(INVALID_KE_PAYLOAD, group, response, TRUE);
|
||||
DBG1(SIG_DBG_IKE, "CREATE_CHILD_SA used PFS, sending INVALID_KE_PAYLOAD");
|
||||
SIG(SIG_CHILD_FAILED, "CREATE_CHILD_SA used PFS, sending INVALID_KE_PAYLOAD");
|
||||
return FAILED;
|
||||
}
|
||||
case NOTIFY:
|
||||
@@ -579,7 +579,7 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
|
||||
if (!(sa_request && nonce_request && tsi_request && tsr_request))
|
||||
{
|
||||
build_notify(INVALID_SYNTAX, CHUNK_INITIALIZER, response, TRUE);
|
||||
DBG1(SIG_DBG_IKE, "request message incomplete, no CHILD_SA created");
|
||||
SIG(SIG_CHILD_FAILED, "request message incomplete, no CHILD_SA created");
|
||||
return FAILED;
|
||||
}
|
||||
|
||||
@@ -619,7 +619,7 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
|
||||
|
||||
if (this->policy == NULL)
|
||||
{
|
||||
DBG1(SIG_DBG_IKE, "no acceptable policy found, adding TS_UNACCEPTABLE notify");
|
||||
SIG(SIG_CHILD_FAILED, "no acceptable policy found, sending TS_UNACCEPTABLE notify");
|
||||
build_notify(TS_UNACCEPTABLE, CHUNK_INITIALIZER, response, TRUE);
|
||||
return FAILED;
|
||||
}
|
||||
@@ -642,14 +642,14 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
|
||||
/* do we have a proposal? */
|
||||
if (this->proposal == NULL)
|
||||
{
|
||||
DBG1(SIG_DBG_IKE, "CHILD_SA proposals unacceptable, adding NO_PROPOSAL_CHOSEN notify");
|
||||
SIG(SIG_CHILD_FAILED, "CHILD_SA proposals unacceptable, sending NO_PROPOSAL_CHOSEN notify");
|
||||
build_notify(NO_PROPOSAL_CHOSEN, CHUNK_INITIALIZER, response, TRUE);
|
||||
return FAILED;
|
||||
}
|
||||
/* do we have traffic selectors? */
|
||||
else if (this->tsi->get_count(this->tsi) == 0 || this->tsr->get_count(this->tsr) == 0)
|
||||
{
|
||||
DBG1(SIG_DBG_IKE, "CHILD_SA traffic selectors unacceptable, adding TS_UNACCEPTABLE notify");
|
||||
SIG(SIG_CHILD_FAILED, "CHILD_SA traffic selectors unacceptable, sending TS_UNACCEPTABLE notify");
|
||||
build_notify(TS_UNACCEPTABLE, CHUNK_INITIALIZER, response, TRUE);
|
||||
return FAILED;
|
||||
}
|
||||
@@ -670,7 +670,7 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
|
||||
this->child_sa->set_name(this->child_sa, this->policy->get_name(this->policy));
|
||||
if (install_child_sa(this, FALSE) != SUCCESS)
|
||||
{
|
||||
DBG1(SIG_DBG_IKE, "installing CHILD_SA failed, adding NO_PROPOSAL_CHOSEN notify");
|
||||
SIG(SIG_CHILD_FAILED, "installing CHILD_SA failed, sending NO_PROPOSAL_CHOSEN notify");
|
||||
build_notify(NO_PROPOSAL_CHOSEN, CHUNK_INITIALIZER, response, TRUE);
|
||||
return FAILED;
|
||||
}
|
||||
@@ -710,6 +710,10 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
|
||||
}
|
||||
this->rekeyed_sa->set_state(this->rekeyed_sa, CHILD_REKEYING);
|
||||
}
|
||||
else
|
||||
{
|
||||
SIG(SIG_CHILD_UP, "CHILD_SA created");
|
||||
}
|
||||
return SUCCESS;
|
||||
}
|
||||
|
||||
@@ -720,6 +724,7 @@ static status_t conclude(private_create_child_sa_t *this, message_t *response,
|
||||
transaction_t **next)
|
||||
{
|
||||
iterator_t *payloads;
|
||||
payload_t *payload;
|
||||
host_t *me, *other;
|
||||
sa_payload_t *sa_payload = NULL;
|
||||
nonce_payload_t *nonce_payload = NULL;
|
||||
@@ -732,7 +737,7 @@ static status_t conclude(private_create_child_sa_t *this, message_t *response,
|
||||
/* check message type */
|
||||
if (response->get_exchange_type(response) != CREATE_CHILD_SA)
|
||||
{
|
||||
DBG1(SIG_DBG_IKE, "CREATE_CHILD_SA response of invalid type, aborting");
|
||||
SIG(SIG_CHILD_FAILED, "CREATE_CHILD_SA response of invalid type, aborting");
|
||||
return FAILED;
|
||||
}
|
||||
|
||||
@@ -741,10 +746,8 @@ static status_t conclude(private_create_child_sa_t *this, message_t *response,
|
||||
|
||||
/* Iterate over all payloads to collect them */
|
||||
payloads = response->get_payload_iterator(response);
|
||||
while (payloads->has_next(payloads))
|
||||
while (payloads->iterate(payloads, (void**)&payload))
|
||||
{
|
||||
payload_t *payload;
|
||||
payloads->current(payloads, (void**)&payload);
|
||||
switch (payload->get_type(payload))
|
||||
{
|
||||
case SECURITY_ASSOCIATION:
|
||||
@@ -781,7 +784,7 @@ static status_t conclude(private_create_child_sa_t *this, message_t *response,
|
||||
|
||||
if (!(sa_payload && nonce_payload && tsi_payload && tsr_payload))
|
||||
{
|
||||
DBG1(SIG_DBG_IKE, "response message incomplete, no CHILD_SA built");
|
||||
SIG(SIG_CHILD_FAILED, "response message incomplete, no CHILD_SA built");
|
||||
return FAILED;
|
||||
}
|
||||
|
||||
@@ -814,15 +817,16 @@ static status_t conclude(private_create_child_sa_t *this, message_t *response,
|
||||
this->tsi->get_count(this->tsi) == 0 ||
|
||||
this->tsr->get_count(this->tsr) == 0)
|
||||
{
|
||||
DBG1(SIG_DBG_IKE, "CHILD_SA creation failed");
|
||||
SIG(SIG_CHILD_FAILED, "CHILD_SA negotiation failed, no CHILD_SA built");
|
||||
return FAILED;
|
||||
}
|
||||
new_child = this->child_sa;
|
||||
if (install_child_sa(this, TRUE) != SUCCESS)
|
||||
{
|
||||
DBG1(SIG_DBG_IKE, "installing CHILD_SA failed, no CHILD_SA built");
|
||||
SIG(SIG_CHILD_FAILED, "installing CHILD_SA failed, no CHILD_SA built");
|
||||
return FAILED;
|
||||
}
|
||||
SIG(SIG_CHILD_UP, "CHILD_SA created");
|
||||
}
|
||||
/* CHILD_SA successfully created. If the other peer initiated rekeying
|
||||
* in the meantime, we detect this by comparing the rekeying_transaction
|
||||
@@ -868,6 +872,10 @@ static status_t conclude(private_create_child_sa_t *this, message_t *response,
|
||||
*next = (transaction_t*)delete_child_sa;
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
SIG(SIG_CHILD_UP, "CHILD_SA created");
|
||||
}
|
||||
if (this->lost)
|
||||
{
|
||||
/* we have lost simlutaneous rekeying, delete the CHILD_SA we just have created */
|
||||
|
||||
@@ -217,6 +217,7 @@ static status_t get_response(private_delete_child_sa_t *this, message_t *request
|
||||
host_t *me, *other;
|
||||
message_t *response;
|
||||
iterator_t *payloads;
|
||||
payload_t *payload;
|
||||
|
||||
/* check if we already have built a response (retransmission) */
|
||||
if (this->message)
|
||||
@@ -258,11 +259,8 @@ static status_t get_response(private_delete_child_sa_t *this, message_t *request
|
||||
|
||||
/* iterate over all payloads */
|
||||
payloads = request->get_payload_iterator(request);
|
||||
while (payloads->has_next(payloads))
|
||||
while (payloads->iterate(payloads, (void**)&payload))
|
||||
{
|
||||
payload_t *payload;
|
||||
payloads->current(payloads, (void**)&payload);
|
||||
|
||||
switch (payload->get_type(payload))
|
||||
{
|
||||
case DELETE:
|
||||
@@ -289,6 +287,7 @@ static status_t conclude(private_delete_child_sa_t *this, message_t *response,
|
||||
transaction_t **transaction)
|
||||
{
|
||||
iterator_t *payloads;
|
||||
payload_t *payload;
|
||||
|
||||
/* check message type */
|
||||
if (response->get_exchange_type(response) != INFORMATIONAL)
|
||||
@@ -299,11 +298,8 @@ static status_t conclude(private_delete_child_sa_t *this, message_t *response,
|
||||
|
||||
/* iterate over all payloads */
|
||||
payloads = response->get_payload_iterator(response);
|
||||
while (payloads->has_next(payloads))
|
||||
while (payloads->iterate(payloads, (void**)&payload))
|
||||
{
|
||||
payload_t *payload;
|
||||
payloads->current(payloads, (void**)&payload);
|
||||
|
||||
switch (payload->get_type(payload))
|
||||
{
|
||||
case DELETE:
|
||||
|
||||
@@ -125,6 +125,7 @@ static status_t get_response(private_delete_ike_sa_t *this, message_t *request,
|
||||
host_t *me, *other;
|
||||
message_t *response;
|
||||
iterator_t *payloads;
|
||||
payload_t *payload;
|
||||
delete_payload_t *delete_request = NULL;
|
||||
|
||||
/* check if we already have built a response (retransmission)
|
||||
@@ -160,11 +161,8 @@ static status_t get_response(private_delete_ike_sa_t *this, message_t *request,
|
||||
|
||||
/* iterate over all payloads */
|
||||
payloads = request->get_payload_iterator(request);
|
||||
while (payloads->has_next(payloads))
|
||||
while (payloads->iterate(payloads, (void**)&payload))
|
||||
{
|
||||
payload_t *payload;
|
||||
payloads->current(payloads, (void**)&payload);
|
||||
|
||||
switch (payload->get_type(payload))
|
||||
{
|
||||
case DELETE:
|
||||
|
||||
@@ -271,7 +271,7 @@ static status_t get_request(private_ike_auth_t *this, message_t **result)
|
||||
authenticator->destroy(authenticator);
|
||||
if (status != SUCCESS)
|
||||
{
|
||||
DBG1(SIG_DBG_IKE, "could not generate AUTH data, deleting IKE_SA");
|
||||
SIG(SIG_IKE_FAILED, "could not generate AUTH data, deleting IKE_SA");
|
||||
return DESTROY_ME;
|
||||
}
|
||||
request->add_payload(request, (payload_t*)auth_payload);
|
||||
@@ -295,7 +295,7 @@ static status_t get_request(private_ike_auth_t *this, message_t **result)
|
||||
this->child_sa->set_name(this->child_sa, this->policy->get_name(this->policy));
|
||||
if (this->child_sa->alloc(this->child_sa, proposal_list) != SUCCESS)
|
||||
{
|
||||
DBG1(SIG_DBG_IKE, "could not install CHILD_SA, deleting IKE_SA");
|
||||
SIG(SIG_IKE_FAILED, "could not install CHILD_SA, deleting IKE_SA");
|
||||
return DESTROY_ME;
|
||||
}
|
||||
sa_payload = sa_payload_create_from_proposal_list(proposal_list);
|
||||
@@ -364,8 +364,8 @@ static status_t process_notifies(private_ike_auth_t *this, notify_payload_t *not
|
||||
{
|
||||
if (notify_type < 16383)
|
||||
{
|
||||
DBG1(SIG_DBG_IKE, "received %N notify error, deleting IKE_SA",
|
||||
notify_type_names, notify_type);
|
||||
SIG(SIG_IKE_FAILED, "received %N notify error, deleting IKE_SA",
|
||||
notify_type_names, notify_type);
|
||||
return DESTROY_ME;
|
||||
}
|
||||
else
|
||||
@@ -504,6 +504,7 @@ static status_t get_response(private_ike_auth_t *this, message_t *request,
|
||||
message_t *response;
|
||||
status_t status;
|
||||
iterator_t *payloads;
|
||||
payload_t *payload;
|
||||
id_payload_t *idi_request = NULL;
|
||||
id_payload_t *idr_request = NULL;
|
||||
auth_payload_t *auth_request = NULL;
|
||||
@@ -538,16 +539,14 @@ static status_t get_response(private_ike_auth_t *this, message_t *request,
|
||||
/* check message type */
|
||||
if (request->get_exchange_type(request) != IKE_AUTH)
|
||||
{
|
||||
DBG1(SIG_DBG_IKE, "IKE_AUTH response of invalid type, deleting IKE_SA");
|
||||
SIG(SIG_IKE_FAILED, "IKE_AUTH response of invalid type, deleting IKE_SA");
|
||||
return DESTROY_ME;
|
||||
}
|
||||
|
||||
/* Iterate over all payloads. */
|
||||
payloads = request->get_payload_iterator(request);
|
||||
while (payloads->has_next(payloads))
|
||||
while (payloads->iterate(payloads, (void**)&payload))
|
||||
{
|
||||
payload_t *payload;
|
||||
payloads->current(payloads, (void**)&payload);
|
||||
switch (payload->get_type(payload))
|
||||
{
|
||||
case ID_INITIATOR:
|
||||
@@ -601,7 +600,7 @@ static status_t get_response(private_ike_auth_t *this, message_t *request,
|
||||
if (!(idi_request && auth_request && sa_request && tsi_request && tsr_request))
|
||||
{
|
||||
build_notify(INVALID_SYNTAX, response, TRUE);
|
||||
DBG1(SIG_DBG_IKE, "request message incomplete, deleting IKE_SA");
|
||||
SIG(SIG_IKE_FAILED, "request message incomplete, deleting IKE_SA");
|
||||
return DESTROY_ME;
|
||||
}
|
||||
|
||||
@@ -639,8 +638,8 @@ static status_t get_response(private_ike_auth_t *this, message_t *request,
|
||||
* traffic selectors. Then we would create a IKE_SA without a CHILD_SA. */
|
||||
if (this->policy == NULL)
|
||||
{
|
||||
DBG1(SIG_DBG_IKE, "no acceptable policy for IDs %D - %D found, deleting IKE_SA",
|
||||
my_id, other_id);
|
||||
SIG(SIG_IKE_FAILED, "no acceptable policy for IDs %D - %D found, "
|
||||
"deleting IKE_SA", my_id, other_id);
|
||||
my_id->destroy(my_id);
|
||||
other_id->destroy(other_id);
|
||||
build_notify(AUTHENTICATION_FAILED, response, TRUE);
|
||||
@@ -696,7 +695,7 @@ static status_t get_response(private_ike_auth_t *this, message_t *request,
|
||||
TRUE);
|
||||
if (status != SUCCESS)
|
||||
{
|
||||
DBG1(SIG_DBG_IKE, "authentication failed, deleting IKE_SA");
|
||||
SIG(SIG_IKE_FAILED, "authentication failed, deleting IKE_SA");
|
||||
build_notify(AUTHENTICATION_FAILED, response, TRUE);
|
||||
authenticator->destroy(authenticator);
|
||||
return DESTROY_ME;
|
||||
@@ -710,7 +709,7 @@ static status_t get_response(private_ike_auth_t *this, message_t *request,
|
||||
authenticator->destroy(authenticator);
|
||||
if (status != SUCCESS)
|
||||
{
|
||||
DBG1(SIG_DBG_IKE, "authentication data generation failed, deleting IKE_SA");
|
||||
SIG(SIG_IKE_FAILED, "authentication data generation failed, deleting IKE_SA");
|
||||
build_notify(AUTHENTICATION_FAILED, response, TRUE);
|
||||
return DESTROY_ME;
|
||||
}
|
||||
@@ -736,13 +735,15 @@ static status_t get_response(private_ike_auth_t *this, message_t *request,
|
||||
/* do we have a proposal? */
|
||||
if (this->proposal == NULL)
|
||||
{
|
||||
DBG1(SIG_DBG_IKE, "CHILD_SA proposals unacceptable, adding NO_PROPOSAL_CHOSEN notify");
|
||||
SIG(SIG_CHILD_FAILED, "CHILD_SA proposals unacceptable, no CHILD_SA created");
|
||||
DBG1(SIG_DBG_IKE, "adding NO_PROPOSAL_CHOSEN notify to response");
|
||||
build_notify(NO_PROPOSAL_CHOSEN, response, FALSE);
|
||||
}
|
||||
/* do we have traffic selectors? */
|
||||
else if (this->tsi->get_count(this->tsi) == 0 || this->tsr->get_count(this->tsr) == 0)
|
||||
{
|
||||
DBG1(SIG_DBG_IKE, "CHILD_SA traffic selectors unacceptable, adding TS_UNACCEPTABLE notify");
|
||||
SIG(SIG_CHILD_FAILED, "CHILD_SA traffic selectors unacceptable, no CHILD_SA created");
|
||||
DBG1(SIG_DBG_IKE, "adding TS_UNACCEPTABLE notify to response");
|
||||
build_notify(TS_UNACCEPTABLE, response, FALSE);
|
||||
}
|
||||
else
|
||||
@@ -759,11 +760,16 @@ static status_t get_response(private_ike_auth_t *this, message_t *request,
|
||||
this->child_sa->set_name(this->child_sa, this->policy->get_name(this->policy));
|
||||
if (install_child_sa(this, FALSE) != SUCCESS)
|
||||
{
|
||||
DBG1(SIG_DBG_IKE, "installing CHILD_SA failed, adding NO_PROPOSAL_CHOSEN notify");
|
||||
SIG(SIG_IKE_FAILED, "installing CHILD_SA failed, no CHILD_SA created");
|
||||
DBG1(SIG_DBG_IKE, "adding NO_PROPOSAL_CHOSEN notify to response");
|
||||
build_notify(NO_PROPOSAL_CHOSEN, response, FALSE);
|
||||
}
|
||||
/* add proposal to sa payload */
|
||||
sa_response->add_proposal(sa_response, this->proposal);
|
||||
else
|
||||
{
|
||||
/* add proposal to sa payload */
|
||||
sa_response->add_proposal(sa_response, this->proposal);
|
||||
SIG(SIG_CHILD_UP, "CHILD_SA created");
|
||||
}
|
||||
}
|
||||
response->add_payload(response, (payload_t*)sa_response);
|
||||
|
||||
@@ -786,6 +792,7 @@ static status_t conclude(private_ike_auth_t *this, message_t *response,
|
||||
transaction_t **transaction)
|
||||
{
|
||||
iterator_t *payloads;
|
||||
payload_t *payload;
|
||||
host_t *me, *other;
|
||||
identification_t *other_id;
|
||||
ts_payload_t *tsi_payload = NULL;
|
||||
@@ -799,7 +806,7 @@ static status_t conclude(private_ike_auth_t *this, message_t *response,
|
||||
/* check message type */
|
||||
if (response->get_exchange_type(response) != IKE_AUTH)
|
||||
{
|
||||
DBG1(SIG_DBG_IKE, "IKE_AUTH response of invalid type, deleting IKE_SA");
|
||||
SIG(SIG_IKE_FAILED, "IKE_AUTH response of invalid type, deleting IKE_SA");
|
||||
return DESTROY_ME;
|
||||
}
|
||||
|
||||
@@ -808,11 +815,8 @@ static status_t conclude(private_ike_auth_t *this, message_t *response,
|
||||
|
||||
/* Iterate over all payloads to collect them */
|
||||
payloads = response->get_payload_iterator(response);
|
||||
while (payloads->has_next(payloads))
|
||||
{
|
||||
payload_t *payload;
|
||||
payloads->current(payloads, (void**)&payload);
|
||||
|
||||
while (payloads->iterate(payloads, (void**)&payload))
|
||||
{
|
||||
switch (payload->get_type(payload))
|
||||
{
|
||||
case ID_RESPONDER:
|
||||
@@ -861,7 +865,7 @@ static status_t conclude(private_ike_auth_t *this, message_t *response,
|
||||
|
||||
if (!(idr_payload && auth_payload && sa_payload && tsi_payload && tsr_payload))
|
||||
{
|
||||
DBG1(SIG_DBG_IKE, "response message incomplete, deleting IKE_SA");
|
||||
SIG(SIG_IKE_FAILED, "response message incomplete, deleting IKE_SA");
|
||||
return DESTROY_ME;
|
||||
}
|
||||
|
||||
@@ -875,8 +879,8 @@ static status_t conclude(private_ike_auth_t *this, message_t *response,
|
||||
if (!other_id->matches(other_id, configured_other_id, &wildcards))
|
||||
{
|
||||
other_id->destroy(other_id);
|
||||
DBG1(SIG_DBG_IKE, "other peer uses unacceptable ID (%D, excepted %D), deleting IKE_SA",
|
||||
other_id, configured_other_id);
|
||||
SIG(SIG_IKE_FAILED, "other peer uses unacceptable ID (%D, excepted "
|
||||
"%D), deleting IKE_SA", other_id, configured_other_id);
|
||||
return DESTROY_ME;
|
||||
}
|
||||
/* update other ID. It was already set, but may contain wildcards */
|
||||
@@ -908,7 +912,8 @@ static status_t conclude(private_ike_auth_t *this, message_t *response,
|
||||
authenticator->destroy(authenticator);
|
||||
if (status != SUCCESS)
|
||||
{
|
||||
DBG1(SIG_DBG_IKE, "authentication failed, deleting IKE_SA");
|
||||
SIG(SIG_IKE_FAILED, "authentication of '%D' with %N failed, "
|
||||
"deleting IKE_SA", other_id, auth_method_names, auth_method);
|
||||
return DESTROY_ME;
|
||||
}
|
||||
}
|
||||
@@ -939,13 +944,17 @@ static status_t conclude(private_ike_auth_t *this, message_t *response,
|
||||
this->tsr->get_count(this->tsr) == 0 ||
|
||||
!this->build_child)
|
||||
{
|
||||
DBG1(SIG_DBG_IKE, "CHILD_SA creation failed");
|
||||
SIG(SIG_CHILD_FAILED, "CHILD_SA negotiation failed, no CHILD_SA built");
|
||||
}
|
||||
else
|
||||
{
|
||||
if (install_child_sa(this, TRUE) != SUCCESS)
|
||||
{
|
||||
DBG1(SIG_DBG_IKE, "installing CHILD_SA failed, no CHILD_SA built");
|
||||
SIG(SIG_CHILD_FAILED, "installing CHILD_SA failed, no CHILD_SA built");
|
||||
}
|
||||
else
|
||||
{
|
||||
SIG(SIG_CHILD_UP, "CHILD_SA created");
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -497,6 +497,7 @@ static status_t get_response(private_ike_sa_init_t *this,
|
||||
message_t *response;
|
||||
status_t status;
|
||||
iterator_t *payloads;
|
||||
payload_t *payload;
|
||||
sa_payload_t *sa_request = NULL;
|
||||
ke_payload_t *ke_request = NULL;
|
||||
nonce_payload_t *nonce_request = NULL;
|
||||
@@ -562,10 +563,8 @@ static status_t get_response(private_ike_sa_init_t *this,
|
||||
|
||||
/* Iterate over all payloads. */
|
||||
payloads = request->get_payload_iterator(request);
|
||||
while (payloads->has_next(payloads))
|
||||
while (payloads->iterate(payloads, (void**)&payload))
|
||||
{
|
||||
payload_t *payload;
|
||||
payloads->current(payloads, (void**)&payload);
|
||||
switch (payload->get_type(payload))
|
||||
{
|
||||
case SECURITY_ASSOCIATION:
|
||||
@@ -668,9 +667,8 @@ static status_t get_response(private_ike_sa_init_t *this,
|
||||
|
||||
/* remove already added payloads */
|
||||
iterator = response->get_payload_iterator(response);
|
||||
while (iterator->has_next(iterator))
|
||||
while (iterator->iterate(iterator, (void**)&payload))
|
||||
{
|
||||
iterator->current(iterator, (void**)&payload);
|
||||
iterator->remove(iterator);
|
||||
payload->destroy(payload);
|
||||
}
|
||||
@@ -827,6 +825,7 @@ static status_t conclude(private_ike_sa_init_t *this, message_t *response,
|
||||
u_int64_t responder_spi;
|
||||
ike_sa_id_t *ike_sa_id;
|
||||
iterator_t *payloads;
|
||||
payload_t *payload;
|
||||
host_t *me, *other;
|
||||
sa_payload_t *sa_payload = NULL;
|
||||
ke_payload_t *ke_payload = NULL;
|
||||
@@ -861,11 +860,8 @@ static status_t conclude(private_ike_sa_init_t *this, message_t *response,
|
||||
|
||||
/* Iterate over all payloads to collect them */
|
||||
payloads = response->get_payload_iterator(response);
|
||||
while (payloads->has_next(payloads))
|
||||
while (payloads->iterate(payloads, (void**)&payload))
|
||||
{
|
||||
payload_t *payload;
|
||||
payloads->current(payloads, (void**)&payload);
|
||||
|
||||
switch (payload->get_type(payload))
|
||||
{
|
||||
case SECURITY_ASSOCIATION:
|
||||
|
||||
@@ -406,6 +406,7 @@ static status_t get_response(private_rekey_ike_sa_t *this, message_t *request,
|
||||
message_t *response;
|
||||
status_t status;
|
||||
iterator_t *payloads, *iterator;
|
||||
payload_t *payload;
|
||||
child_sa_t *child_sa;
|
||||
sa_payload_t *sa_request = NULL;
|
||||
nonce_payload_t *nonce_request = NULL;
|
||||
@@ -488,10 +489,8 @@ static status_t get_response(private_rekey_ike_sa_t *this, message_t *request,
|
||||
|
||||
/* Iterate over all payloads. */
|
||||
payloads = request->get_payload_iterator(request);
|
||||
while (payloads->has_next(payloads))
|
||||
while (payloads->iterate(payloads, (void**)&payload))
|
||||
{
|
||||
payload_t *payload;
|
||||
payloads->current(payloads, (void**)&payload);
|
||||
switch (payload->get_type(payload))
|
||||
{
|
||||
case SECURITY_ASSOCIATION:
|
||||
@@ -665,6 +664,7 @@ static status_t conclude(private_rekey_ike_sa_t *this, message_t *response,
|
||||
transaction_t **next)
|
||||
{
|
||||
iterator_t *payloads;
|
||||
payload_t *payload;
|
||||
host_t *me, *other;
|
||||
sa_payload_t *sa_payload = NULL;
|
||||
nonce_payload_t *nonce_payload = NULL;
|
||||
@@ -687,10 +687,8 @@ static status_t conclude(private_rekey_ike_sa_t *this, message_t *response,
|
||||
|
||||
/* Iterate over all payloads to collect them */
|
||||
payloads = response->get_payload_iterator(response);
|
||||
while (payloads->has_next(payloads))
|
||||
while (payloads->iterate(payloads, (void**)&payload))
|
||||
{
|
||||
payload_t *payload;
|
||||
payloads->current(payloads, (void**)&payload);
|
||||
switch (payload->get_type(payload))
|
||||
{
|
||||
case SECURITY_ASSOCIATION:
|
||||
|
||||
Reference in New Issue
Block a user