denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

added equals() method to peer_cfg, ike_cfg, proposals, auth_info

Browse Source 
allows easier merging of ipsec.conf connections
replaced some iterators through enumerators
made proposals algorithm_t private using enumerator
This commit is contained in:
Martin Willi
2008-03-26 10:06:45 +00:00
parent a852928a6f
commit 3c7e72f5b0
18 changed files with 573 additions and 265 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/charon/sa/child_sa.c
+32 -36
View File
@@ -110,12 +110,22 @@ struct private_child_sa_t {
/**
* encryption algorithm used for this SA
*/
algorithm_t encryption;
u_int16_t enc_alg;
/**
* key size of enc_alg
*/
u_int16_t enc_size;
/**
* integrity protection algorithm used for this SA
*/
algorithm_t integrity;
u_int16_t int_alg;
/**
* key size of int_alg
*/
u_int16_t int_size;
/**
* time, on which SA was installed
@@ -246,10 +256,10 @@ static void get_stats(private_child_sa_t *this, mode_t *mode,
iterator->destroy(iterator);
*mode = this->mode;
*encr_algo = this->encryption.algorithm;
*encr_len = this->encryption.key_size;
*int_algo = this->integrity.algorithm;
*int_len = this->integrity.key_size;
*encr_algo = this->enc_alg;
*encr_len = this->enc_size;
*int_algo = this->int_alg;
*int_len = this->int_size;
*rekey = this->rekey_time;
*use_in = in;
*use_out = out;
@@ -493,10 +503,7 @@ static status_t alloc(private_child_sa_t *this, linked_list_t *proposals)
static status_t install(private_child_sa_t *this, proposal_t *proposal,
mode_t mode, prf_plus_t *prf_plus, bool mine)
{
u_int32_t spi, soft, hard;;
algorithm_t *enc_algo, *int_algo;
algorithm_t enc_algo_none = {ENCR_UNDEFINED, 0};
algorithm_t int_algo_none = {AUTH_UNDEFINED, 0};
u_int32_t spi, soft, hard;
host_t *src;
host_t *dst;
status_t status;
@@ -544,43 +551,32 @@ static status_t install(private_child_sa_t *this, proposal_t *proposal,
protocol_id_names, this->protocol);
/* select encryption algo */
if (proposal->get_algorithm(proposal, ENCRYPTION_ALGORITHM, &enc_algo))
if (proposal->get_algorithm(proposal, ENCRYPTION_ALGORITHM,
&this->enc_alg, &this->enc_size))
{
DBG2(DBG_CHD, " using %N for encryption",
encryption_algorithm_names, enc_algo->algorithm);
}
else
{
enc_algo = &enc_algo_none;
DBG2(DBG_CHD, " using %N for encryption",
encryption_algorithm_names, this->enc_alg);
}
/* select integrity algo */
if (proposal->get_algorithm(proposal, INTEGRITY_ALGORITHM, &int_algo))
if (proposal->get_algorithm(proposal, INTEGRITY_ALGORITHM,
&this->int_alg, &this->int_size))
{
DBG2(DBG_CHD, " using %N for integrity",
integrity_algorithm_names, int_algo->algorithm);
integrity_algorithm_names, this->int_alg);
}
else
{
int_algo = &int_algo_none;
}
soft = this->config->get_lifetime(this->config, TRUE);
hard = this->config->get_lifetime(this->config, FALSE);
/* send SA down to the kernel */
DBG2(DBG_CHD, " SPI 0x%.8x, src %H dst %H", ntohl(spi), src, dst);
status = charon->kernel_interface->add_sa(charon->kernel_interface,
src, dst, spi, this->protocol,
this->reqid, mine ? soft : 0,
hard, enc_algo, int_algo,
prf_plus, mode, this->encap, mine);
this->encryption = *enc_algo;
this->integrity = *int_algo;
src, dst, spi, this->protocol, this->reqid, mine ? soft : 0, hard,
this->enc_alg, this->enc_size, this->int_alg, this->int_size,
prf_plus, mode, this->encap, mine);
this->install_time = time(NULL);
this->rekey_time = this->install_time + soft;
return status;
}
@@ -987,10 +983,10 @@ child_sa_t * child_sa_create(host_t *me, host_t* other,
this->state = CHILD_CREATED;
/* reuse old reqid if we are rekeying an existing CHILD_SA */
this->reqid = rekey ? rekey : ++reqid;
this->encryption.algorithm = ENCR_UNDEFINED;
this->encryption.key_size = 0;
this->integrity.algorithm = AUTH_UNDEFINED;
this->encryption.key_size = 0;
this->enc_alg = ENCR_UNDEFINED;
this->enc_size = 0;
this->int_alg = AUTH_UNDEFINED;
this->int_size = 0;
this->policies = linked_list_create();
this->my_ts = linked_list_create();
this->other_ts = linked_list_create();
src/charon/sa/ike_sa.c
+14 -17
View File
@@ -1639,8 +1639,7 @@ static status_t derive_keys(private_ike_sa_t *this,
{
prf_plus_t *prf_plus;
chunk_t skeyseed, key, nonces, prf_plus_seed;
algorithm_t *algo;
size_t key_size;
u_int16_t alg, key_size;
crypter_t *crypter_i, *crypter_r;
signer_t *signer_i, *signer_r;
u_int8_t spi_i_buf[sizeof(u_int64_t)], spi_r_buf[sizeof(u_int64_t)];
@@ -1648,18 +1647,18 @@ static status_t derive_keys(private_ike_sa_t *this,
chunk_t spi_r = chunk_from_buf(spi_r_buf);
/* Create SAs general purpose PRF first, we may use it here */
if (!proposal->get_algorithm(proposal, PSEUDO_RANDOM_FUNCTION, &algo))
if (!proposal->get_algorithm(proposal, PSEUDO_RANDOM_FUNCTION, &alg, NULL))
{
DBG1(DBG_IKE, "no %N selected",
transform_type_names, PSEUDO_RANDOM_FUNCTION);
return FAILED;
}
this->prf = lib->crypto->create_prf(lib->crypto, algo->algorithm);
this->prf = lib->crypto->create_prf(lib->crypto, alg);
if (this->prf == NULL)
{
DBG1(DBG_IKE, "%N %N not supported!",
transform_type_names, PSEUDO_RANDOM_FUNCTION,
pseudo_random_function_names, algo->algorithm);
pseudo_random_function_names, alg);
return FAILED;
}
@@ -1702,8 +1701,8 @@ static status_t derive_keys(private_ike_sa_t *this,
/* KEYMAT = SK_d | SK_ai | SK_ar | SK_ei | SK_er | SK_pi | SK_pr */
/* SK_d is used for generating CHILD_SA key mat => child_prf */
proposal->get_algorithm(proposal, PSEUDO_RANDOM_FUNCTION, &algo);
this->child_prf = lib->crypto->create_prf(lib->crypto, algo->algorithm);
proposal->get_algorithm(proposal, PSEUDO_RANDOM_FUNCTION, &alg, NULL);
this->child_prf = lib->crypto->create_prf(lib->crypto, alg);
key_size = this->child_prf->get_key_size(this->child_prf);
prf_plus->allocate_bytes(prf_plus, key_size, &key);
DBG4(DBG_IKE, "Sk_d secret %B", &key);
@@ -1711,19 +1710,19 @@ static status_t derive_keys(private_ike_sa_t *this,
chunk_free(&key);
/* SK_ai/SK_ar used for integrity protection => signer_in/signer_out */
if (!proposal->get_algorithm(proposal, INTEGRITY_ALGORITHM, &algo))
if (!proposal->get_algorithm(proposal, INTEGRITY_ALGORITHM, &alg, NULL))
{
DBG1(DBG_IKE, "no %N selected",
transform_type_names, INTEGRITY_ALGORITHM);
return FAILED;
}
signer_i = lib->crypto->create_signer(lib->crypto, algo->algorithm);
signer_r = lib->crypto->create_signer(lib->crypto, algo->algorithm);
signer_i = lib->crypto->create_signer(lib->crypto, alg);
signer_r = lib->crypto->create_signer(lib->crypto, alg);
if (signer_i == NULL || signer_r == NULL)
{
DBG1(DBG_IKE, "%N %N not supported!",
transform_type_names, INTEGRITY_ALGORITHM,
integrity_algorithm_names ,algo->algorithm);
integrity_algorithm_names ,alg);
prf_plus->destroy(prf_plus);
return FAILED;
}
@@ -1751,22 +1750,20 @@ static status_t derive_keys(private_ike_sa_t *this,
}
/* SK_ei/SK_er used for encryption => crypter_in/crypter_out */
if (!proposal->get_algorithm(proposal, ENCRYPTION_ALGORITHM, &algo))
if (!proposal->get_algorithm(proposal, ENCRYPTION_ALGORITHM, &alg, &key_size))
{
DBG1(DBG_IKE, "no %N selected",
transform_type_names, ENCRYPTION_ALGORITHM);
prf_plus->destroy(prf_plus);
return FAILED;
}
crypter_i = lib->crypto->create_crypter(lib->crypto, algo->algorithm,
algo->key_size / 8);
crypter_r = lib->crypto->create_crypter(lib->crypto, algo->algorithm,
algo->key_size / 8);
crypter_i = lib->crypto->create_crypter(lib->crypto, alg, key_size / 8);
crypter_r = lib->crypto->create_crypter(lib->crypto, alg, key_size / 8);
if (crypter_i == NULL || crypter_r == NULL)
{
DBG1(DBG_IKE, "%N %N (key size %d) not supported!",
transform_type_names, ENCRYPTION_ALGORITHM,
encryption_algorithm_names, algo->algorithm, algo->key_size);
encryption_algorithm_names, alg, key_size);
prf_plus->destroy(prf_plus);
return FAILED;
}
src/charon/sa/tasks/child_create.c
+3 -3
View File
@@ -222,11 +222,11 @@ static status_t select_and_install(private_child_create_t *this, bool no_dh)
if (!this->proposal->has_dh_group(this->proposal, this->dh_group))
{
algorithm_t *algo;
u_int16_t group;
if (this->proposal->get_algorithm(this->proposal, DIFFIE_HELLMAN_GROUP,
&algo))
&group, NULL))
{
u_int16_t group = algo->algorithm;
SIG(CHILD_UP_FAILED, "DH group %N inacceptable, requesting %N",
diffie_hellman_group_names, this->dh_group,
diffie_hellman_group_names, group);
src/charon/sa/tasks/ike_init.c
+3 -3
View File
@@ -316,11 +316,11 @@ static status_t build_r(private_ike_init_t *this, message_t *message)
!this->proposal->has_dh_group(this->proposal, this->dh_group) ||
this->dh->get_shared_secret(this->dh, &secret) != SUCCESS)
{
algorithm_t *algo;
u_int16_t group;
if (this->proposal->get_algorithm(this->proposal, DIFFIE_HELLMAN_GROUP,
&algo))
&group, NULL))
{
u_int16_t group = algo->algorithm;
SIG(CHILD_UP_FAILED, "DH group %N inacceptable, requesting %N",
diffie_hellman_group_names, this->dh_group,
diffie_hellman_group_names, group);