denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Moved credential manager to libstrongswan

Browse Source
This commit is contained in:
Martin Willi
2010-07-13 10:26:07 +02:00
parent 2ca7db1337
commit 2ccc02a4fd
48 changed files with 191 additions and 205 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/authenticators/authenticator.c
-7
View File
@@ -34,13 +34,6 @@ ENUM_NEXT(auth_method_names, AUTH_ECDSA_256, AUTH_ECDSA_521, AUTH_DSS,
"ECDSA-521 signature");
ENUM_END(auth_method_names, AUTH_ECDSA_521);
ENUM(auth_class_names, AUTH_CLASS_ANY, AUTH_CLASS_EAP,
"any",
"public key",
"pre-shared key",
"EAP",
);
/**
* Described in header.
*/
src/libcharon/sa/authenticators/authenticator.h
+1 -23
View File
@@ -24,11 +24,10 @@
#define AUTHENTICATOR_H_
typedef enum auth_method_t auth_method_t;
typedef enum auth_class_t auth_class_t;
typedef struct authenticator_t authenticator_t;
#include <library.h>
#include <config/auth_cfg.h>
#include <credentials/auth_cfg.h>
#include <sa/ike_sa.h>
/**
@@ -75,27 +74,6 @@ enum auth_method_t {
*/
extern enum_name_t *auth_method_names;
/**
* Class of authentication to use. This is different to auth_method_t in that
* it does not specify a method, but a class of acceptable methods. The found
* certificate finally dictates wich method is used.
*/
enum auth_class_t {
/** any class acceptable */
AUTH_CLASS_ANY = 0,
/** authentication using public keys (RSA, ECDSA) */
AUTH_CLASS_PUBKEY = 1,
/** authentication using a pre-shared secrets */
AUTH_CLASS_PSK = 2,
/** authentication using EAP */
AUTH_CLASS_EAP = 3,
};
/**
* enum strings for auth_class_t
*/
extern enum_name_t *auth_class_names;
/**
* Authenticator interface implemented by the various authenticators.
*
src/libcharon/sa/authenticators/eap/eap_method.c
-38
View File
@@ -15,44 +15,6 @@
#include "eap_method.h"
ENUM_BEGIN(eap_type_names, EAP_IDENTITY, EAP_GTC,
"EAP_IDENTITY",
"EAP_NOTIFICATION",
"EAP_NAK",
"EAP_MD5",
"EAP_OTP",
"EAP_GTC");
ENUM_NEXT(eap_type_names, EAP_SIM, EAP_SIM, EAP_GTC,
"EAP_SIM");
ENUM_NEXT(eap_type_names, EAP_AKA, EAP_AKA, EAP_SIM,
"EAP_AKA");
ENUM_NEXT(eap_type_names, EAP_MSCHAPV2, EAP_MSCHAPV2, EAP_AKA,
"EAP_MSCHAPV2");
ENUM_NEXT(eap_type_names, EAP_RADIUS, EAP_EXPERIMENTAL, EAP_MSCHAPV2,
"EAP_RADIUS",
"EAP_EXPANDED",
"EAP_EXPERIMENTAL");
ENUM_END(eap_type_names, EAP_EXPERIMENTAL);
ENUM_BEGIN(eap_type_short_names, EAP_IDENTITY, EAP_GTC,
"ID",
"NTF",
"NAK",
"MD5",
"OTP",
"GTC");
ENUM_NEXT(eap_type_short_names, EAP_SIM, EAP_SIM, EAP_GTC,
"SIM");
ENUM_NEXT(eap_type_short_names, EAP_AKA, EAP_AKA, EAP_SIM,
"AKA");
ENUM_NEXT(eap_type_short_names, EAP_MSCHAPV2, EAP_MSCHAPV2, EAP_AKA,
"MSCHAPV2");
ENUM_NEXT(eap_type_short_names, EAP_RADIUS, EAP_EXPERIMENTAL, EAP_MSCHAPV2,
"RAD",
"EXP",
"XP");
ENUM_END(eap_type_short_names, EAP_EXPERIMENTAL);
/*
* See header
*/
src/libcharon/sa/authenticators/eap/eap_method.h
-30
View File
@@ -23,7 +23,6 @@
typedef struct eap_method_t eap_method_t;
typedef enum eap_role_t eap_role_t;
typedef enum eap_type_t eap_type_t;
typedef enum eap_code_t eap_code_t;
#include <library.h>
@@ -42,35 +41,6 @@ enum eap_role_t {
*/
extern enum_name_t *eap_role_names;
/**
* EAP types, defines the EAP method implementation
*/
enum eap_type_t {
EAP_IDENTITY = 1,
EAP_NOTIFICATION = 2,
EAP_NAK = 3,
EAP_MD5 = 4,
EAP_OTP = 5,
EAP_GTC = 6,
EAP_SIM = 18,
EAP_AKA = 23,
EAP_MSCHAPV2 = 26,
/** not a method, but an implementation providing different methods */
EAP_RADIUS = 253,
EAP_EXPANDED = 254,
EAP_EXPERIMENTAL = 255,
};
/**
* enum names for eap_type_t.
*/
extern enum_name_t *eap_type_names;
/**
* short string enum names for eap_type_t.
*/
extern enum_name_t *eap_type_short_names;
/**
* Lookup the EAP method type from a string.
*
src/libcharon/sa/authenticators/psk_authenticator.c
+3 -4
View File
@@ -63,8 +63,7 @@ static status_t build(private_psk_authenticator_t *this, message_t *message)
other_id = this->ike_sa->get_other_id(this->ike_sa);
DBG1(DBG_IKE, "authentication of '%Y' (myself) with %N",
my_id, auth_method_names, AUTH_PSK);
key = charon->credentials->get_shared(charon->credentials, SHARED_IKE,
my_id, other_id);
key = lib->credmgr->get_shared(lib->credmgr, SHARED_IKE, my_id, other_id);
if (key == NULL)
{
DBG1(DBG_IKE, "no shared key found for '%Y' - '%Y'", my_id, other_id);
@@ -107,8 +106,8 @@ static status_t process(private_psk_authenticator_t *this, message_t *message)
recv_auth_data = auth_payload->get_data(auth_payload);
my_id = this->ike_sa->get_my_id(this->ike_sa);
other_id = this->ike_sa->get_other_id(this->ike_sa);
enumerator = charon->credentials->create_shared_enumerator(
charon->credentials, SHARED_IKE, my_id, other_id);
enumerator = lib->credmgr->create_shared_enumerator(lib->credmgr,
SHARED_IKE, my_id, other_id);
while (!authenticated && enumerator->enumerate(enumerator, &key, NULL, NULL))
{
keys_found++;
src/libcharon/sa/authenticators/pubkey_authenticator.c
+3 -4
View File
@@ -65,8 +65,7 @@ static status_t build(private_pubkey_authenticator_t *this, message_t *message)
id = this->ike_sa->get_my_id(this->ike_sa);
auth = this->ike_sa->get_auth_cfg(this->ike_sa, TRUE);
private = charon->credentials->get_private(charon->credentials, KEY_ANY,
id, auth);
private = lib->credmgr->get_private(lib->credmgr, KEY_ANY, id, auth);
if (private == NULL)
{
DBG1(DBG_IKE, "no private key found for '%Y'", id);
@@ -178,8 +177,8 @@ static status_t process(private_pubkey_authenticator_t *this, message_t *message
octets = keymat->get_auth_octets(keymat, TRUE, this->ike_sa_init,
this->nonce, id);
auth = this->ike_sa->get_auth_cfg(this->ike_sa, FALSE);
enumerator = charon->credentials->create_public_enumerator(
charon->credentials, key_type, id, auth);
enumerator = lib->credmgr->create_public_enumerator(lib->credmgr,
key_type, id, auth);
while (enumerator->enumerate(enumerator, &public, &current_auth))
{
if (public->verify(public, scheme, octets, auth_data))
src/libcharon/sa/ike_sa.h
+1 -1
View File
@@ -41,7 +41,7 @@ typedef struct ike_sa_t ike_sa_t;
#include <sa/keymat.h>
#include <config/peer_cfg.h>
#include <config/ike_cfg.h>
#include <config/auth_cfg.h>
#include <credentials/auth_cfg.h>
/**
* Timeout in seconds after that a half open IKE_SA gets deleted.
src/libcharon/sa/tasks/ike_cert_post.c
+1 -2
View File
@@ -78,8 +78,7 @@ static cert_payload_t *build_cert_payload(private_ike_cert_post_t *this,
hasher->destroy(hasher);
id = identification_create_from_encoding(ID_KEY_ID, hash);
enumerator = charon->credentials->create_cdp_enumerator(charon->credentials,
CERT_X509, id);
enumerator = lib->credmgr->create_cdp_enumerator(lib->credmgr, CERT_X509, id);
if (enumerator->enumerate(enumerator, &url))
{
payload = cert_payload_create_from_hash_and_url(hash, url);
src/libcharon/sa/tasks/ike_cert_pre.c
+6 -6
View File
@@ -93,8 +93,8 @@ static void process_certreqs(private_ike_cert_pre_t *this, message_t *message)
certificate_t *cert;
id = identification_create_from_encoding(ID_KEY_ID, keyid);
cert = charon->credentials->get_cert(charon->credentials,
CERT_X509, KEY_ANY, id, TRUE);
cert = lib->credmgr->get_cert(lib->credmgr,
CERT_X509, KEY_ANY, id, TRUE);
if (cert)
{
DBG1(DBG_IKE, "received cert request for \"%Y\"",
@@ -156,8 +156,8 @@ static certificate_t *try_get_cert(cert_payload_t *cert_payload)
break;
}
id = identification_create_from_encoding(ID_KEY_ID, hash);
cert = charon->credentials->get_cert(charon->credentials,
CERT_X509, KEY_ANY, id, FALSE);
cert = lib->credmgr->get_cert(lib->credmgr,
CERT_X509, KEY_ANY, id, FALSE);
id->destroy(id);
break;
}
@@ -370,8 +370,8 @@ static void build_certreqs(private_ike_cert_pre_t *this, message_t *message)
if (!req)
{
/* otherwise add all trusted CA certificates */
enumerator = charon->credentials->create_cert_enumerator(
charon->credentials, CERT_ANY, KEY_ANY, NULL, TRUE);
enumerator = lib->credmgr->create_cert_enumerator(lib->credmgr,
CERT_ANY, KEY_ANY, NULL, TRUE);
while (enumerator->enumerate(enumerator, &cert))
{
add_certreq(&req, cert);