denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Check if XAuth round complies to configured authentication round

Browse Source
This commit is contained in:
Martin Willi
2012-07-26 12:40:27 +02:00
parent 6a8786b55f
commit 40ca05cff8
1 changed files with 18 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/ikev1/tasks/xauth.c
+18 -7
View File
@@ -50,6 +50,11 @@ struct private_xauth_t {
*/ */
bool initiator; bool initiator;
/**
* Authentication requirements to fulfill
*/
auth_cfg_t *auth;
/** /**
* XAuth backend to use * XAuth backend to use
*/ */
@@ -114,13 +119,14 @@ static xauth_method_t *load_method(private_xauth_t* this)
return NULL; return NULL;
} }
} }
enumerator->destroy(enumerator);
name = auth->get(auth, AUTH_RULE_XAUTH_BACKEND); name = auth->get(auth, AUTH_RULE_XAUTH_BACKEND);
this->user = auth->get(auth, AUTH_RULE_XAUTH_IDENTITY); this->user = auth->get(auth, AUTH_RULE_XAUTH_IDENTITY);
if (!this->initiator && this->user) if (!this->initiator && this->user)
{ /* use XAUTH username, if configured */ { /* use XAUTH username, if configured */
peer = this->user; peer = this->user;
} }
enumerator->destroy(enumerator); this->auth = auth;
xauth = charon->xauth->create_instance(charon->xauth, name, role, xauth = charon->xauth->create_instance(charon->xauth, name, role,
server, peer); server, peer);
if (!xauth) if (!xauth)
@@ -183,16 +189,22 @@ static bool establish(private_xauth_t *this)
/** /**
* Create auth config after successful authentication * Create auth config after successful authentication
*/ */
static void add_auth_cfg(private_xauth_t *this, identification_t *id, bool local) static bool add_auth_cfg(private_xauth_t *this, identification_t *id, bool local)
{ {
auth_cfg_t *auth; auth_cfg_t *auth;
auth = auth_cfg_create(); auth = auth_cfg_create();
auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_XAUTH); auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_XAUTH);
auth->add(auth, AUTH_RULE_XAUTH_IDENTITY, id->clone(id)); auth->add(auth, AUTH_RULE_XAUTH_IDENTITY, id->clone(id));
auth->merge(auth, this->ike_sa->get_auth_cfg(this->ike_sa, local), FALSE); auth->merge(auth, this->ike_sa->get_auth_cfg(this->ike_sa, local), TRUE);
if (!auth->complies(auth, this->auth, TRUE))
{
auth->destroy(auth);
return FALSE;
}
this->ike_sa->add_auth_cfg(this->ike_sa, local, auth); this->ike_sa->add_auth_cfg(this->ike_sa, local, auth);
return TRUE;
} }
METHOD(task_t, build_i_status, status_t, METHOD(task_t, build_i_status, status_t,
@@ -305,11 +317,11 @@ METHOD(task_t, process_r, status_t,
} }
} }
enumerator->destroy(enumerator); enumerator->destroy(enumerator);
if (this->status == XAUTH_OK) if (this->status == XAUTH_OK &&
add_auth_cfg(this, this->xauth->get_identity(this->xauth), TRUE))
{ {
DBG1(DBG_IKE, "XAuth authentication of '%Y' (myself) successful", DBG1(DBG_IKE, "XAuth authentication of '%Y' (myself) successful",
this->xauth->get_identity(this->xauth)); this->xauth->get_identity(this->xauth));
add_auth_cfg(this, this->xauth->get_identity(this->xauth), TRUE);
} }
else else
{ {
@@ -385,8 +397,7 @@ METHOD(task_t, process_i, status_t,
break; break;
} }
DBG1(DBG_IKE, "XAuth authentication of '%Y' successful", id); DBG1(DBG_IKE, "XAuth authentication of '%Y' successful", id);
add_auth_cfg(this, id, FALSE); if (add_auth_cfg(this, id, FALSE) && allowed(this))
if (allowed(this))
{ {
this->status = XAUTH_OK; this->status = XAUTH_OK;
} }