denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

android: Handle EAP-TLS in Android service

Browse Source
This commit is contained in:
Tobias Brunner
2014-11-06 16:28:40 +01:00
parent 93923149e4
commit 34ca3795c8
1 changed files with 19 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/frontends/android/jni/libandroidbridge/backend/android_service.c
+19 -6
View File
@@ -617,8 +617,8 @@ METHOD(listener_t, ike_reestablish_post, bool,
return TRUE; return TRUE;
} }
static void add_auth_cfg_eap(private_android_service_t *this, static void add_auth_cfg_pw(private_android_service_t *this,
peer_cfg_t *peer_cfg, bool byod) peer_cfg_t *peer_cfg, bool byod)
{ {
identification_t *user; identification_t *user;
auth_cfg_t *auth; auth_cfg_t *auth;
@@ -653,7 +653,15 @@ static bool add_auth_cfg_cert(private_android_service_t *this,
} }
auth = auth_cfg_create(); auth = auth_cfg_create();
auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PUBKEY); if (strpfx("ikev2-eap-tls", this->type))
{
auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_EAP);
auth->add(auth, AUTH_RULE_EAP_TYPE, EAP_TLS);
}
else
{
auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PUBKEY);
}
auth->add(auth, AUTH_RULE_SUBJECT_CERT, cert); auth->add(auth, AUTH_RULE_SUBJECT_CERT, cert);
id = cert->get_subject(cert); id = cert->get_subject(cert);
@@ -698,7 +706,8 @@ static job_requeue_t initiate(private_android_service_t *this)
/* local auth config */ /* local auth config */
if (streq("ikev2-cert", this->type) || if (streq("ikev2-cert", this->type) ||
streq("ikev2-cert-eap", this->type)) streq("ikev2-cert-eap", this->type) ||
streq("ikev2-eap-tls", this->type))
{ {
if (!add_auth_cfg_cert(this, peer_cfg)) if (!add_auth_cfg_cert(this, peer_cfg))
{ {
@@ -712,15 +721,19 @@ static job_requeue_t initiate(private_android_service_t *this)
streq("ikev2-cert-eap", this->type) || streq("ikev2-cert-eap", this->type) ||
streq("ikev2-byod-eap", this->type)) streq("ikev2-byod-eap", this->type))
{ {
add_auth_cfg_eap(this, peer_cfg, strpfx(this->type, "ikev2-byod")); add_auth_cfg_pw(this, peer_cfg, strpfx(this->type, "ikev2-byod"));
} }
/* remote auth config */ /* remote auth config */
auth = auth_cfg_create(); auth = auth_cfg_create();
auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PUBKEY);
gateway = identification_create_from_string(this->gateway); gateway = identification_create_from_string(this->gateway);
auth->add(auth, AUTH_RULE_IDENTITY, gateway); auth->add(auth, AUTH_RULE_IDENTITY, gateway);
auth->add(auth, AUTH_RULE_IDENTITY_LOOSE, TRUE); auth->add(auth, AUTH_RULE_IDENTITY_LOOSE, TRUE);
/* for EAP-TLS we don't add an auth class to allow pubkey and EAP-only */
if (!streq("ikev2-eap-tls", this->type))
{
auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PUBKEY);
}
peer_cfg->add_auth_cfg(peer_cfg, auth, FALSE); peer_cfg->add_auth_cfg(peer_cfg, auth, FALSE);
child_cfg = child_cfg_create("android", &lifetime, NULL, TRUE, MODE_TUNNEL, child_cfg = child_cfg_create("android", &lifetime, NULL, TRUE, MODE_TUNNEL,