denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Do not build own authentication data before we've verified others, we need the other identity in EAP

Browse Source
This commit is contained in:
Martin Willi
2010-02-09 16:11:07 +01:00
parent 2d07095e01
commit 2aa553d773
1 changed files with 33 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/charon/sa/tasks/ike_auth.c
+33 -28
View File
@@ -766,6 +766,7 @@ static status_t process_i(private_ike_auth_t *this, message_t *message)
enumerator_t *enumerator; enumerator_t *enumerator;
payload_t *payload; payload_t *payload;
auth_cfg_t *cfg; auth_cfg_t *cfg;
bool mutual_eap = FALSE;
if (message->get_exchange_type(message) == IKE_SA_INIT) if (message->get_exchange_type(message) == IKE_SA_INIT)
{ {
@@ -826,26 +827,6 @@ static status_t process_i(private_ike_auth_t *this, message_t *message)
} }
enumerator->destroy(enumerator); enumerator->destroy(enumerator);
if (this->my_auth)
{
switch (this->my_auth->process(this->my_auth, message))
{
case SUCCESS:
cfg = auth_cfg_create();
cfg->merge(cfg, this->ike_sa->get_auth_cfg(this->ike_sa, TRUE),
TRUE);
this->ike_sa->add_auth_cfg(this->ike_sa, TRUE, cfg);
this->my_auth->destroy(this->my_auth);
this->my_auth = NULL;
this->do_another_auth = do_another_auth(this);
break;
case NEED_MORE:
break;
default:
return FAILED;
}
}
if (this->expect_another_auth) if (this->expect_another_auth)
{ {
if (this->other_auth == NULL) if (this->other_auth == NULL)
@@ -879,14 +860,9 @@ static status_t process_i(private_ike_auth_t *this, message_t *message)
} }
} }
else else
{ /* responder omitted AUTH payload, indicating EAP-only */ {
if (!this->my_auth || !this->my_auth->is_mutual(this->my_auth)) /* responder omitted AUTH payload, indicating EAP-only */
{ mutual_eap = TRUE;
DBG1(DBG_IKE, "do not allow non-mutual or weak "
"EAP-only authentication");
return FAILED;
}
DBG1(DBG_IKE, "allow mutual EAP-only authentication");
} }
} }
if (this->other_auth) if (this->other_auth)
@@ -916,6 +892,35 @@ static status_t process_i(private_ike_auth_t *this, message_t *message)
} }
} }
if (this->my_auth)
{
switch (this->my_auth->process(this->my_auth, message))
{
case SUCCESS:
cfg = auth_cfg_create();
cfg->merge(cfg, this->ike_sa->get_auth_cfg(this->ike_sa, TRUE),
TRUE);
this->ike_sa->add_auth_cfg(this->ike_sa, TRUE, cfg);
this->my_auth->destroy(this->my_auth);
this->my_auth = NULL;
this->do_another_auth = do_another_auth(this);
break;
case NEED_MORE:
break;
default:
return FAILED;
}
}
if (mutual_eap)
{
if (!this->my_auth || !this->my_auth->is_mutual(this->my_auth))
{
DBG1(DBG_IKE, "do not allow non-mutual EAP-only authentication");
return FAILED;
}
DBG1(DBG_IKE, "allow mutual EAP-only authentication");
}
if (message->get_notify(message, ANOTHER_AUTH_FOLLOWS) == NULL) if (message->get_notify(message, ANOTHER_AUTH_FOLLOWS) == NULL)
{ {
this->expect_another_auth = FALSE; this->expect_another_auth = FALSE;