denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Switch to alternative peer config in IKEv1 Main and Aggressive Mode.

Browse Source
This commit is contained in:
Tobias Brunner
2012-05-21 15:49:25 +02:00
parent 17949695bf
commit 1a624ff45a
4 changed files with 85 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/ikev1/tasks/aggressive_mode.c
+18 -5
View File
@@ -1,4 +1,7 @@
/*
* Copyright (C) 2012 Tobias Brunner
* Hochschule fuer Technik Rapperswil
*
* Copyright (C) 2012 Martin Willi
* Copyright (C) 2012 revosec AG
*
@@ -399,7 +402,6 @@ METHOD(task_t, process_r, status_t,
this->method, TRUE, id);
if (!this->peer_cfg)
{
DBG1(DBG_IKE, "no peer config found");
return send_notify(this, AUTHENTICATION_FAILED);
}
this->ike_sa->set_peer_cfg(this->ike_sa, this->peer_cfg);
@@ -413,11 +415,22 @@ METHOD(task_t, process_r, status_t,
}
case AM_AUTH:
{
if (!this->ph1->verify_auth(this->ph1, this->method, message,
this->id_data))
while (TRUE)
{
this->id_data = chunk_empty;
return send_delete(this);
if (this->ph1->verify_auth(this->ph1, this->method, message,
this->id_data))
{
break;
}
this->peer_cfg->destroy(this->peer_cfg);
this->peer_cfg = this->ph1->select_config(this->ph1,
this->method, TRUE, NULL);
if (!this->peer_cfg)
{
this->id_data = chunk_empty;
return send_delete(this);
}
this->ike_sa->set_peer_cfg(this->ike_sa, this->peer_cfg);
}
this->id_data = chunk_empty;
src/libcharon/sa/ikev1/tasks/main_mode.c
+17 -13
View File
@@ -1,5 +1,5 @@
/*
* Copyright (C) 2011 Tobias Brunner
* Copyright (C) 2011-2012 Tobias Brunner
* Hochschule fuer Technik Rapperswil
*
* Copyright (C) 2011 Martin Willi
@@ -405,23 +405,27 @@ METHOD(task_t, process_r, status_t,
DBG1(DBG_IKE, "IDii payload missing");
return send_notify(this, INVALID_PAYLOAD_TYPE);
}
id = id_payload->get_identification(id_payload);
this->ike_sa->set_other_id(this->ike_sa, id);
this->peer_cfg = this->ph1->select_config(this->ph1,
this->method, FALSE, id);
if (!this->peer_cfg)
{
DBG1(DBG_IKE, "no peer config found");
return send_notify(this, AUTHENTICATION_FAILED);
}
this->ike_sa->set_peer_cfg(this->ike_sa, this->peer_cfg);
if (!this->ph1->verify_auth(this->ph1, this->method, message,
id_payload->get_encoded(id_payload)))
while (TRUE)
{
return send_notify(this, AUTHENTICATION_FAILED);
DESTROY_IF(this->peer_cfg);
this->peer_cfg = this->ph1->select_config(this->ph1,
this->method, FALSE, id);
if (!this->peer_cfg)
{
return send_notify(this, AUTHENTICATION_FAILED);
}
this->ike_sa->set_peer_cfg(this->ike_sa, this->peer_cfg);
if (this->ph1->verify_auth(this->ph1, this->method, message,
id_payload->get_encoded(id_payload)))
{
break;
}
}
if (!charon->bus->authorize(charon->bus, FALSE))
{
DBG1(DBG_IKE, "Main Mode authorization hook forbids IKE_SA, "