denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

- installing of child sa works

Browse Source 
- need correct IP adresses to actually use IPsec
This commit is contained in:
Martin Willi
2006-02-16 09:55:07 +00:00
parent ce461bbd13
commit 30b5b412da
23 changed files with 770 additions and 277 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Source/charon/sa/states/ike_auth_requested.c
+45 -7
View File
@@ -71,6 +71,11 @@ struct private_ike_auth_requested_t {
* IKE_SA_INIT-Request in binary form.
*/
chunk_t ike_sa_init_reply_data;
/**
* Child sa created in ike_sa_init_requested
*/
child_sa_t *child_sa;
/**
* Assigned Logger.
@@ -136,6 +141,16 @@ struct private_ike_auth_requested_t {
* - DELETE_ME
*/
status_t (*process_notify_payload) (private_ike_auth_requested_t *this, notify_payload_t *notify_payload);
/**
* Destroy function called internally of this class after state change to
* state IKE_SA_ESTABLISHED succeeded.
*
* This destroy function does not destroy objects which were passed to the new state.
*
* @param this calling object
*/
void (*destroy_after_state_change) (private_ike_auth_requested_t *this);
};
@@ -288,7 +303,7 @@ static status_t process_message(private_ike_auth_requested_t *this, message_t *i
this->ike_sa->create_delete_established_ike_sa_job(this->ike_sa,this->sa_config->get_ike_sa_lifetime(this->sa_config));
this->ike_sa->set_new_state(this->ike_sa, (state_t*)ike_sa_established_create(this->ike_sa));
this->public.state_interface.destroy(&(this->public.state_interface));
this->destroy_after_state_change(this);
return SUCCESS;
}
@@ -328,7 +343,6 @@ static status_t process_sa_payload(private_ike_auth_requested_t *this, sa_payloa
{
proposal_t *proposal, *proposal_tmp;
linked_list_t *proposal_list;
child_sa_t *child_sa;
chunk_t seed;
prf_plus_t *prf_plus;
@@ -377,10 +391,19 @@ static status_t process_sa_payload(private_ike_auth_requested_t *this, sa_payloa
prf_plus = prf_plus_create(this->ike_sa->get_child_prf(this->ike_sa), seed);
allocator_free_chunk(&seed);
child_sa = child_sa_create(proposal, prf_plus);
prf_plus->destroy(prf_plus);
child_sa->destroy(child_sa);
if (this->child_sa)
{
if (this->child_sa->update(this->child_sa, proposal, prf_plus) != SUCCESS)
{
this->logger->log(this->logger, AUDIT, "Could not install CHILD_SA! Deleting IKE_SA");
prf_plus->destroy(prf_plus);
proposal->destroy(proposal);
return DELETE_ME;
}
this->ike_sa->add_child_sa(this->ike_sa, this->child_sa);
}
prf_plus->destroy(prf_plus);
proposal->destroy(proposal);
return SUCCESS;
@@ -521,6 +544,20 @@ static ike_sa_state_t get_state(private_ike_auth_requested_t *this)
* Implements state_t.get_state
*/
static void destroy(private_ike_auth_requested_t *this)
{
allocator_free_chunk(&(this->received_nonce));
allocator_free_chunk(&(this->sent_nonce));
allocator_free_chunk(&(this->ike_sa_init_reply_data));
if (this->child_sa)
{
this->child_sa->destroy(this->child_sa);
}
allocator_free(this);
}
/**
* Implements protected_ike_sa_t.destroy_after_state_change
*/
static void destroy_after_state_change(private_ike_auth_requested_t *this)
{
allocator_free_chunk(&(this->received_nonce));
allocator_free_chunk(&(this->sent_nonce));
@@ -531,7 +568,7 @@ static void destroy(private_ike_auth_requested_t *this)
/*
* Described in header.
*/
ike_auth_requested_t *ike_auth_requested_create(protected_ike_sa_t *ike_sa,chunk_t sent_nonce,chunk_t received_nonce,chunk_t ike_sa_init_reply_data)
ike_auth_requested_t *ike_auth_requested_create(protected_ike_sa_t *ike_sa,chunk_t sent_nonce,chunk_t received_nonce,chunk_t ike_sa_init_reply_data, child_sa_t *child_sa)
{
private_ike_auth_requested_t *this = allocator_alloc_thing(private_ike_auth_requested_t);
@@ -541,12 +578,12 @@ ike_auth_requested_t *ike_auth_requested_create(protected_ike_sa_t *ike_sa,chunk
this->public.state_interface.destroy = (void (*) (state_t *)) destroy;
/* private functions */
this->process_idr_payload = process_idr_payload;
this->process_sa_payload = process_sa_payload;
this->process_auth_payload = process_auth_payload;
this->process_ts_payload = process_ts_payload;
this->process_notify_payload = process_notify_payload;
this->destroy_after_state_change = destroy_after_state_change;
/* private data */
this->ike_sa = ike_sa;
@@ -554,6 +591,7 @@ ike_auth_requested_t *ike_auth_requested_create(protected_ike_sa_t *ike_sa,chunk
this->sent_nonce = sent_nonce;
this->ike_sa_init_reply_data = ike_sa_init_reply_data;
this->logger = this->ike_sa->get_logger(this->ike_sa);
this->child_sa = child_sa;
return &(this->public);
}
Source/charon/sa/states/ike_auth_requested.h
+3 -3
View File
@@ -41,8 +41,6 @@ typedef struct ike_auth_requested_t ike_auth_requested_t;
*
* @todo handle certificate payloads
*
* @todo setup child SAs, if requested
*
* @ingroup states
*/
struct ike_auth_requested_t {
@@ -60,6 +58,7 @@ struct ike_auth_requested_t {
* @param sent_nonce Sent nonce value in IKE_SA_INIT request
* @param received_nonce Received nonce value in IKE_SA_INIT response
* @param ike_sa_init_reply_data binary representation of IKE_SA_INIT reply
* @param child_sa opened but not completed child_sa
* @return created ike_auth_requested_t object
*
* @ingroup states
@@ -67,6 +66,7 @@ struct ike_auth_requested_t {
ike_auth_requested_t *ike_auth_requested_create(protected_ike_sa_t *ike_sa,
chunk_t sent_nonce,
chunk_t received_nonce,
chunk_t ike_sa_init_reply_data);
chunk_t ike_sa_init_reply_data,
child_sa_t *child_sa);
#endif /*IKE_AUTH_REQUESTED_H_*/
Source/charon/sa/states/ike_sa_init_requested.c
+26 -5
View File
@@ -79,6 +79,11 @@ struct private_ike_sa_init_requested_t {
*/
chunk_t ike_sa_init_request_data;
/**
* Created child sa, if any
*/
child_sa_t *child_sa;
/**
* Assigned logger
*
@@ -187,8 +192,6 @@ struct private_ike_sa_init_requested_t {
* Destroy function called internally of this class after state change to
* state IKE_AUTH_REQUESTED succeeded.
*
* In case of state change to INITIATOR_INIT the default destroy function gets called.
*
* This destroy function does not destroy objects which were passed to the new state.
*
* @param this calling object
@@ -383,7 +386,8 @@ static status_t process_message(private_ike_sa_init_requested_t *this, message_t
ike_sa_init_reply_data = ike_sa_init_reply->get_packet_data(ike_sa_init_reply);
/* state can now be changed */
next_state = ike_auth_requested_create(this->ike_sa,this->sent_nonce,this->received_nonce,ike_sa_init_reply_data);
next_state = ike_auth_requested_create(this->ike_sa, this->sent_nonce, this->received_nonce,
ike_sa_init_reply_data, this->child_sa);
this->ike_sa->set_new_state(this->ike_sa,(state_t *) next_state);
this->destroy_after_state_change(this);
@@ -512,10 +516,22 @@ static status_t build_sa_payload (private_ike_sa_init_requested_t *this, message
/* get proposals form config, add to payload */
sa_config = this->ike_sa->get_sa_config(this->ike_sa);
proposal_list = sa_config->get_proposals(sa_config);
/* build child sa */
this->child_sa = child_sa_create(this->ike_sa->get_my_host(this->ike_sa),
this->ike_sa->get_other_host(this->ike_sa));
if (this->child_sa->alloc(this->child_sa, proposal_list) != SUCCESS)
{
this->logger->log(this->logger, AUDIT, "Could not install CHILD_SA! Deleting IKE_SA");
return DELETE_ME;
}
/* TODO:
* Huston, we've got a problem here. Since SPIs are stored in
* the proposal, and these proposals are shared across configs,
* there may be some threading issues... fix it!
*/
sa_payload = sa_payload_create_from_proposal_list(proposal_list);
/* TODO child sa stuff */
this->logger->log(this->logger, CONTROL|LEVEL2, "Add SA payload to message");
request->add_payload(request,(payload_t *) sa_payload);
@@ -705,6 +721,10 @@ static void destroy(private_ike_sa_init_requested_t *this)
allocator_free(this->sent_nonce.ptr);
allocator_free(this->received_nonce.ptr);
allocator_free_chunk(&(this->ike_sa_init_request_data));
if (this->child_sa)
{
this->child_sa->destroy(this->child_sa);
}
if (this->proposal)
{
this->proposal->destroy(this->proposal);
@@ -743,6 +763,7 @@ ike_sa_init_requested_t *ike_sa_init_requested_create(protected_ike_sa_t *ike_sa
this->diffie_hellman = diffie_hellman;
this->proposal = NULL;
this->sent_nonce = sent_nonce;
this->child_sa = NULL;
this->ike_sa_init_request_data = ike_sa_init_request_data;
return &(this->public);
Source/charon/sa/states/ike_sa_init_responded.c
+15 -7
View File
@@ -425,10 +425,6 @@ static status_t build_sa_payload(private_ike_sa_init_responded_t *this, sa_paylo
return DELETE_ME;
}
/* create payload with selected propsal */
sa_response = sa_payload_create_from_proposal(proposal);
response->add_payload(response, (payload_t*)sa_response);
/* install child SAs for AH and esp */
seed = allocator_alloc_as_chunk(this->received_nonce.len + this->sent_nonce.len);
memcpy(seed.ptr, this->received_nonce.ptr, this->received_nonce.len);
@@ -436,10 +432,22 @@ static status_t build_sa_payload(private_ike_sa_init_responded_t *this, sa_paylo
prf_plus = prf_plus_create(this->ike_sa->get_child_prf(this->ike_sa), seed);
allocator_free_chunk(&seed);
child_sa = child_sa_create(proposal, prf_plus);
prf_plus->destroy(prf_plus);
child_sa->destroy(child_sa);
child_sa = child_sa_create(this->ike_sa->get_my_host(this->ike_sa),
this->ike_sa->get_other_host(this->ike_sa));
if (child_sa->add(child_sa, proposal, prf_plus) != SUCCESS)
{
this->logger->log(this->logger, AUDIT, "Could not install CHILD_SA! Deleting IKE_SA");
prf_plus->destroy(prf_plus);
proposal->destroy(proposal);
return DELETE_ME;
}
this->ike_sa->add_child_sa(this->ike_sa, child_sa);
/* create payload with selected propsal */
sa_response = sa_payload_create_from_proposal(proposal);
response->add_payload(response, (payload_t*)sa_response);
prf_plus->destroy(prf_plus);
proposal->destroy(proposal);
return SUCCESS;
}