denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ikev2: Schedule a make-before-break completion task to delete old IKE_SA

Browse Source
This commit is contained in:
Martin Willi
2015-02-20 13:34:57 +01:00
parent 52bd3b8ef9
commit 3676023e54
8 changed files with 174 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/Android.mk
+1
View File
@@ -102,6 +102,7 @@ sa/ikev2/tasks/ike_natd.c sa/ikev2/tasks/ike_natd.h \
sa/ikev2/tasks/ike_mobike.c sa/ikev2/tasks/ike_mobike.h \
sa/ikev2/tasks/ike_rekey.c sa/ikev2/tasks/ike_rekey.h \
sa/ikev2/tasks/ike_reauth.c sa/ikev2/tasks/ike_reauth.h \
sa/ikev2/tasks/ike_reauth_complete.c sa/ikev2/tasks/ike_reauth_complete.h \
sa/ikev2/tasks/ike_auth_lifetime.c sa/ikev2/tasks/ike_auth_lifetime.h \
sa/ikev2/tasks/ike_vendor.c sa/ikev2/tasks/ike_vendor.h
src/libcharon/Makefile.am
+1
View File
@@ -101,6 +101,7 @@ sa/ikev2/tasks/ike_natd.c sa/ikev2/tasks/ike_natd.h \
sa/ikev2/tasks/ike_mobike.c sa/ikev2/tasks/ike_mobike.h \
sa/ikev2/tasks/ike_rekey.c sa/ikev2/tasks/ike_rekey.h \
sa/ikev2/tasks/ike_reauth.c sa/ikev2/tasks/ike_reauth.h \
sa/ikev2/tasks/ike_reauth_complete.c sa/ikev2/tasks/ike_reauth_complete.h \
sa/ikev2/tasks/ike_auth_lifetime.c sa/ikev2/tasks/ike_auth_lifetime.h \
sa/ikev2/tasks/ike_vendor.c sa/ikev2/tasks/ike_vendor.h
endif
src/libcharon/sa/ikev2/task_manager_v2.c
+8
View File
@@ -29,6 +29,7 @@
#include <sa/ikev2/tasks/ike_cert_post.h>
#include <sa/ikev2/tasks/ike_rekey.h>
#include <sa/ikev2/tasks/ike_reauth.h>
#include <sa/ikev2/tasks/ike_reauth_complete.h>
#include <sa/ikev2/tasks/ike_delete.h>
#include <sa/ikev2/tasks/ike_config.h>
#include <sa/ikev2/tasks/ike_dpd.h>
@@ -515,6 +516,11 @@ METHOD(task_manager_t, initiate, status_t,
break;
}
#endif /* ME */
if (activate_task(this, TASK_IKE_REAUTH_COMPLETE))
{
exchange = INFORMATIONAL;
break;
}
case IKE_REKEYING:
if (activate_task(this, TASK_IKE_DELETE))
{
@@ -1569,6 +1575,8 @@ static void trigger_mbb_reauth(private_task_manager_t *this)
if (new->initiate(new, NULL, 0, NULL, NULL) != DESTROY_ME)
{
new->queue_task(new, (task_t*)ike_reauth_complete_create(new,
this->ike_sa->get_id(this->ike_sa)));
charon->ike_sa_manager->checkin(charon->ike_sa_manager, new);
this->ike_sa->set_state(this->ike_sa, IKE_REKEYING);
}
src/libcharon/sa/ikev2/tasks/ike_reauth.h
+2
View File
@@ -29,6 +29,8 @@ typedef struct ike_reauth_t ike_reauth_t;
/**
* Task of type ike_reauth, reestablishes an IKE_SA.
*
* This task implements break-before-make reauthentication.
*/
struct ike_reauth_t {
src/libcharon/sa/ikev2/tasks/ike_reauth_complete.c
+102
View File
@@ -0,0 +1,102 @@
/*
* Copyright (C) 2014 Martin Willi
* Copyright (C) 2014 revosec AG
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include "ike_reauth_complete.h"
#include <daemon.h>
#include <processing/jobs/delete_ike_sa_job.h>
typedef struct private_ike_reauth_complete_t private_ike_reauth_complete_t;
/**
* Private members of a ike_reauth_complete_t task.
*/
struct private_ike_reauth_complete_t {
/**
* Public methods and task_t interface.
*/
ike_reauth_complete_t public;
/**
* Assigned IKE_SA.
*/
ike_sa_t *ike_sa;
/**
* Reauthenticated IKE_SA identifier
*/
ike_sa_id_t *id;
};
METHOD(task_t, build_i, status_t,
private_ike_reauth_complete_t *this, message_t *message)
{
message->set_exchange_type(message, EXCHANGE_TYPE_UNDEFINED);
lib->processor->queue_job(lib->processor,
(job_t*)delete_ike_sa_job_create(this->id, TRUE));
return SUCCESS;
}
METHOD(task_t, process_i, status_t,
private_ike_reauth_complete_t *this, message_t *message)
{
return DESTROY_ME;
}
METHOD(task_t, get_type, task_type_t,
private_ike_reauth_complete_t *this)
{
return TASK_IKE_REAUTH_COMPLETE;
}
METHOD(task_t, migrate, void,
private_ike_reauth_complete_t *this, ike_sa_t *ike_sa)
{
this->ike_sa = ike_sa;
}
METHOD(task_t, destroy, void,
private_ike_reauth_complete_t *this)
{
this->id->destroy(this->id);
free(this);
}
/*
* Described in header.
*/
ike_reauth_complete_t *ike_reauth_complete_create(ike_sa_t *ike_sa,
ike_sa_id_t *id)
{
private_ike_reauth_complete_t *this;
INIT(this,
.public = {
.task = {
.get_type = _get_type,
.migrate = _migrate,
.build = _build_i,
.process = _process_i,
.destroy = _destroy,
},
},
.ike_sa = ike_sa,
.id = id->clone(id),
);
return &this->public;
}
src/libcharon/sa/ikev2/tasks/ike_reauth_complete.h
+56
View File
@@ -0,0 +1,56 @@
/*
* Copyright (C) 2014 Martin Willi
* Copyright (C) 2014 revosec AG
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
* @defgroup ike_reauth_complete ike_reauth_complete
* @{ @ingroup tasks_v2
*/
#ifndef IKE_REAUTH_COMPLETE_H_
#define IKE_REAUTH_COMPLETE_H_
typedef struct ike_reauth_complete_t ike_reauth_complete_t;
#include <library.h>
#include <sa/ike_sa.h>
#include <sa/task.h>
/**
* Task of type IKE_REAUTH_COMPLETE, removes reauthenticated SA after reauth.
*
* This task completes make-before-break reauthentication by deleting the
* old, reauthenticated IKE_SA after the new one established.
*/
struct ike_reauth_complete_t {
/**
* Implements the task_t interface
*/
task_t task;
};
/**
* Create a new ike_reauth_complete task.
*
* This task is initiator only.
*
* @param ike_sa IKE_SA this task works for
* @param id old, reauthenticated IKE_SA
* @return ike_reauth_complete task to handle by the task_manager
*/
ike_reauth_complete_t *ike_reauth_complete_create(ike_sa_t *ike_sa,
ike_sa_id_t *id);
#endif /** IKE_REAUTH_COMPLETE_H_ @}*/
src/libcharon/sa/task.c
+1
View File
@@ -27,6 +27,7 @@ ENUM(task_type_names, TASK_IKE_INIT, TASK_ISAKMP_CERT_POST,
"IKE_CONFIG",
"IKE_REKEY",
"IKE_REAUTH",
"IKE_REAUTH_COMPLETE",
"IKE_DELETE",
"IKE_DPD",
"IKE_VENDOR",
src/libcharon/sa/task.h
+3 -1
View File
@@ -53,8 +53,10 @@ enum task_type_t {
TASK_IKE_CONFIG,
/** rekey an IKE_SA */
TASK_IKE_REKEY,
/** reestablish a complete IKE_SA */
/** reestablish a complete IKE_SA, break-before-make */
TASK_IKE_REAUTH,
/** completion task for make-before-break IKE_SA re-authentication */
TASK_IKE_REAUTH_COMPLETE,
/** delete an IKE_SA */
TASK_IKE_DELETE,
/** liveness check */