denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Integrated main parts of IKE_REAUTH task into ike_sa_t.reestablish.

Browse Source
This commit is contained in:
Tobias Brunner
2012-05-25 17:05:53 +02:00
parent 12715f1953
commit 23470d849a
2 changed files with 77 additions and 115 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/ike_sa.c
+74 -28
View File
@@ -239,6 +239,11 @@ struct private_ike_sa_t {
* Flush auth configs once established? * Flush auth configs once established?
*/ */
bool flush_auth_cfg; bool flush_auth_cfg;
/**
* TRUE if we are currently reauthenticating this IKE_SA
*/
bool is_reauthenticating;
}; };
/** /**
@@ -1411,6 +1416,7 @@ METHOD(ike_sa_t, reauth, status_t,
DBG0(DBG_IKE, "reauthenticating IKE_SA %s[%d]", DBG0(DBG_IKE, "reauthenticating IKE_SA %s[%d]",
get_name(this), this->unique_id); get_name(this), this->unique_id);
} }
this->is_reauthenticating = TRUE;
this->task_manager->queue_ike_reauth(this->task_manager); this->task_manager->queue_ike_reauth(this->task_manager);
return this->task_manager->initiate(this->task_manager); return this->task_manager->initiate(this->task_manager);
} }
@@ -1427,39 +1433,58 @@ METHOD(ike_sa_t, reestablish, status_t,
bool restart = FALSE; bool restart = FALSE;
status_t status = FAILED; status_t status = FAILED;
/* check if we have children to keep up at all */ if (this->is_reauthenticating)
enumerator = this->child_sas->create_enumerator(this->child_sas); { /* only reauthenticate if we have children */
while (enumerator->enumerate(enumerator, (void**)&child_sa)) if (this->child_sas->get_count(this->child_sas) == 0
{ #ifdef ME
if (this->state == IKE_DELETING) /* allow reauth of mediation connections without CHILD_SAs */
&& !this->peer_cfg->is_mediation(this->peer_cfg)
#endif /* ME */
)
{ {
action = child_sa->get_close_action(child_sa); DBG1(DBG_IKE, "unable to reauthenticate IKE_SA, no CHILD_SA "
"to recreate");
} }
else else
{ {
action = child_sa->get_dpd_action(child_sa); restart = TRUE;
} }
switch (action) }
else
{ /* check if we have children to keep up at all */
enumerator = this->child_sas->create_enumerator(this->child_sas);
while (enumerator->enumerate(enumerator, (void**)&child_sa))
{ {
case ACTION_RESTART: if (this->state == IKE_DELETING)
restart = TRUE; {
break; action = child_sa->get_close_action(child_sa);
case ACTION_ROUTE: }
charon->traps->install(charon->traps, this->peer_cfg, else
child_sa->get_config(child_sa)); {
break; action = child_sa->get_dpd_action(child_sa);
default: }
break; switch (action)
{
case ACTION_RESTART:
restart = TRUE;
break;
case ACTION_ROUTE:
charon->traps->install(charon->traps, this->peer_cfg,
child_sa->get_config(child_sa));
break;
default:
break;
}
} }
} enumerator->destroy(enumerator);
enumerator->destroy(enumerator);
#ifdef ME #ifdef ME
/* mediation connections have no children, keep them up anyway */ /* mediation connections have no children, keep them up anyway */
if (this->peer_cfg->is_mediation(this->peer_cfg)) if (this->peer_cfg->is_mediation(this->peer_cfg))
{ {
restart = TRUE; restart = TRUE;
} }
#endif /* ME */ #endif /* ME */
}
if (!restart) if (!restart)
{ {
return FAILED; return FAILED;
@@ -1507,13 +1532,34 @@ METHOD(ike_sa_t, reestablish, status_t,
enumerator = this->child_sas->create_enumerator(this->child_sas); enumerator = this->child_sas->create_enumerator(this->child_sas);
while (enumerator->enumerate(enumerator, (void**)&child_sa)) while (enumerator->enumerate(enumerator, (void**)&child_sa))
{ {
if (this->state == IKE_DELETING) if (this->is_reauthenticating)
{ {
action = child_sa->get_close_action(child_sa); switch (child_sa->get_state(child_sa))
{
case CHILD_ROUTED:
{ /* move routed child directly */
this->child_sas->remove_at(this->child_sas, enumerator);
new->add_child_sa(new, child_sa);
action = ACTION_NONE;
break;
}
default:
{ /* initiate/queue all other CHILD_SAs */
action = ACTION_RESTART;
break;
}
}
} }
else else
{ { /* only restart CHILD_SAs that are configured accordingly */
action = child_sa->get_dpd_action(child_sa); if (this->state == IKE_DELETING)
{
action = child_sa->get_close_action(child_sa);
}
else
{
action = child_sa->get_dpd_action(child_sa);
}
} }
switch (action) switch (action)
{ {
src/libcharon/sa/ikev2/tasks/ike_reauth.c
+3 -87
View File
@@ -51,100 +51,16 @@ METHOD(task_t, build_i, status_t,
METHOD(task_t, process_i, status_t, METHOD(task_t, process_i, status_t,
private_ike_reauth_t *this, message_t *message) private_ike_reauth_t *this, message_t *message)
{ {
ike_sa_t *new;
host_t *host;
enumerator_t *enumerator;
child_sa_t *child_sa;
peer_cfg_t *peer_cfg;
/* process delete response first */ /* process delete response first */
this->ike_delete->task.process(&this->ike_delete->task, message); this->ike_delete->task.process(&this->ike_delete->task, message);
peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa); /* reestablish the IKE_SA with all children */
if (this->ike_sa->reestablish(this->ike_sa) != SUCCESS)
/* reauthenticate only if we have children */
if (this->ike_sa->get_child_count(this->ike_sa) == 0
#ifdef ME
/* we allow peers to reauth mediation connections (without children) */
&& !peer_cfg->is_mediation(peer_cfg)
#endif /* ME */
)
{ {
DBG1(DBG_IKE, "unable to reauthenticate IKE_SA, no CHILD_SA to recreate"); DBG1(DBG_IKE, "reauthenticating IKE_SA failed");
return FAILED; return FAILED;
} }
new = charon->ike_sa_manager->checkout_new(charon->ike_sa_manager,
this->ike_sa->get_version(this->ike_sa), TRUE);
if (!new)
{ /* shouldn't happen */
return FAILED;
}
new->set_peer_cfg(new, peer_cfg);
host = this->ike_sa->get_other_host(this->ike_sa);
new->set_other_host(new, host->clone(host));
host = this->ike_sa->get_my_host(this->ike_sa);
new->set_my_host(new, host->clone(host));
/* if we already have a virtual IP, we reuse it */
host = this->ike_sa->get_virtual_ip(this->ike_sa, TRUE);
if (host)
{
new->set_virtual_ip(new, TRUE, host);
}
#ifdef ME
/* we initiate the new IKE_SA of the mediation connection without CHILD_SA */
if (peer_cfg->is_mediation(peer_cfg))
{
if (new->initiate(new, NULL, 0, NULL, NULL) == DESTROY_ME)
{
charon->ike_sa_manager->checkin_and_destroy(
charon->ike_sa_manager, new);
/* set threads active IKE_SA after checkin */
charon->bus->set_sa(charon->bus, this->ike_sa);
DBG1(DBG_IKE, "reauthenticating IKE_SA failed");
return FAILED;
}
}
#endif /* ME */
enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
while (enumerator->enumerate(enumerator, (void**)&child_sa))
{
switch (child_sa->get_state(child_sa))
{
case CHILD_ROUTED:
{
/* move routed child directly */
this->ike_sa->remove_child_sa(this->ike_sa, enumerator);
new->add_child_sa(new, child_sa);
break;
}
default:
{
/* initiate/queue all child SAs */
child_cfg_t *child_cfg = child_sa->get_config(child_sa);
child_cfg->get_ref(child_cfg);
if (new->initiate(new, child_cfg, 0, NULL, NULL) == DESTROY_ME)
{
enumerator->destroy(enumerator);
charon->ike_sa_manager->checkin_and_destroy(
charon->ike_sa_manager, new);
/* set threads active IKE_SA after checkin */
charon->bus->set_sa(charon->bus, this->ike_sa);
DBG1(DBG_IKE, "reauthenticating IKE_SA failed");
return FAILED;
}
break;
}
}
}
enumerator->destroy(enumerator);
charon->ike_sa_manager->checkin(charon->ike_sa_manager, new);
/* set threads active IKE_SA after checkin */
charon->bus->set_sa(charon->bus, this->ike_sa);
/* we always destroy the obsolete IKE_SA */ /* we always destroy the obsolete IKE_SA */
return DESTROY_ME; return DESTROY_ME;
} }