denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ike-auth: Support exchange between IKE_SA_INIT and IKE_AUTH

Browse Source
This commit is contained in:
Tobias Brunner
2022-06-29 10:28:50 +02:00
parent 09a4aed3a2
commit 28b33d7cac
1 changed files with 53 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/ikev2/tasks/ike_auth.c
+53 -22
View File
@@ -131,6 +131,11 @@ struct private_ike_auth_t {
*/
bool eap_acceptable;
/**
* Whether we already handled the first IKE_AUTH message
*/
bool first_auth;
/**
* Gateway ID if redirected
*/
@@ -588,10 +593,20 @@ METHOD(task_t, build_i, status_t,
private_ike_auth_t *this, message_t *message)
{
auth_cfg_t *cfg;
bool first_auth = FALSE;
if (message->get_exchange_type(message) == IKE_SA_INIT)
switch (message->get_exchange_type(message))
{
return collect_my_init_data(this, message);
case IKE_SA_INIT:
return collect_my_init_data(this, message);
case IKE_AUTH:
if (!this->first_auth)
{ /* some special handling for the first IKE_AUTH message below */
first_auth = this->first_auth = TRUE;
}
break;
default:
return NEED_MORE;
}
if (!this->peer_cfg)
@@ -600,7 +615,7 @@ METHOD(task_t, build_i, status_t,
this->peer_cfg->get_ref(this->peer_cfg);
}
if (message->get_message_id(message) == 1)
if (first_auth)
{ /* in the first IKE_AUTH ... */
if (this->ike_sa->supports_extension(this->ike_sa, EXT_MULTIPLE_AUTH))
{ /* indicate support for multiple authentication */
@@ -668,8 +683,7 @@ METHOD(task_t, build_i, status_t,
get_reserved_id_bytes(this, id_payload);
message->add_payload(message, (payload_t*)id_payload);
if (idr && !idr->contains_wildcards(idr) &&
message->get_message_id(message) == 1 &&
if (idr && !idr->contains_wildcards(idr) && first_auth &&
this->peer_cfg->get_unique_policy(this->peer_cfg) != UNIQUE_NEVER)
{
host_t *host;
@@ -744,9 +758,14 @@ METHOD(task_t, process_r, status_t,
id_payload_t *id_payload;
identification_t *id;
if (message->get_exchange_type(message) == IKE_SA_INIT)
switch (message->get_exchange_type(message))
{
return collect_other_init_data(this, message);
case IKE_SA_INIT:
return collect_other_init_data(this, message);
case IKE_AUTH:
break;
default:
return NEED_MORE;
}
if (!this->my_auth && this->do_another_auth)
@@ -769,7 +788,7 @@ METHOD(task_t, process_r, status_t,
return NEED_MORE;
}
if (message->get_message_id(message) == 1)
if (!this->first_auth)
{ /* check for extensions in the first IKE_AUTH */
if (message->get_notify(message, MULTIPLE_AUTH_SUPPORTED))
{
@@ -784,6 +803,7 @@ METHOD(task_t, process_r, status_t,
{
this->initial_contact = TRUE;
}
this->first_auth = TRUE;
}
if (!this->other_auth)
@@ -950,14 +970,19 @@ METHOD(task_t, build_r, status_t,
identification_t *gateway;
auth_cfg_t *cfg;
if (message->get_exchange_type(message) == IKE_SA_INIT)
switch (message->get_exchange_type(message))
{
if (multiple_auth_enabled())
{
message->add_notify(message, FALSE, MULTIPLE_AUTH_SUPPORTED,
chunk_empty);
}
return collect_my_init_data(this, message);
case IKE_SA_INIT:
if (multiple_auth_enabled())
{
message->add_notify(message, FALSE, MULTIPLE_AUTH_SUPPORTED,
chunk_empty);
}
return collect_my_init_data(this, message);
case IKE_AUTH:
break;
default:
return NEED_MORE;
}
if (this->authentication_failed || !this->peer_cfg)
@@ -1225,14 +1250,19 @@ METHOD(task_t, process_i, status_t,
auth_cfg_t *cfg;
bool mutual_eap = FALSE, ppk_id_received = FALSE;
if (message->get_exchange_type(message) == IKE_SA_INIT)
switch (message->get_exchange_type(message))
{
if (message->get_notify(message, MULTIPLE_AUTH_SUPPORTED) &&
multiple_auth_enabled())
{
this->ike_sa->enable_extension(this->ike_sa, EXT_MULTIPLE_AUTH);
}
return collect_other_init_data(this, message);
case IKE_SA_INIT:
if (message->get_notify(message, MULTIPLE_AUTH_SUPPORTED) &&
multiple_auth_enabled())
{
this->ike_sa->enable_extension(this->ike_sa, EXT_MULTIPLE_AUTH);
}
return collect_other_init_data(this, message);
case IKE_AUTH:
break;
default:
return NEED_MORE;
}
enumerator = message->create_payload_enumerator(message);
@@ -1514,6 +1544,7 @@ METHOD(task_t, migrate, void,
this->expect_another_auth = TRUE;
this->authentication_failed = FALSE;
this->candidates = linked_list_create();
this->first_auth = FALSE;
}
METHOD(task_t, destroy, void,