denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ikev2: Trigger ike_updown() event after all IKE-specific tasks ran

Browse Source 
This makes sure the event is only triggered after the IKE_SA is fully
established and e.g. virtual IPs, additional peer addresses or
a modified reauth time (on the initiator) are assigned to it.  This was
e.g. a problem for the selinux plugin if virtual IPs are used.

We use a separate task to trigger the event that's queued before the
child-create task so the event is triggered before the child_updown()
event.  Same goes for the state change to IKE_ESTABLISHED.

A new condition is used to indicate the successful completion of all
authentication rounds, so we don't have to set the IKE_ESTABLISHED state
in the ike-auth task (it was used as condition in other tasks).

Since set_state() also sets the rekey and reauth times, this required
some minor changes in regards to how AUTH_LIFETIME notifies are handled.
This commit is contained in:
Tobias Brunner
2022-09-23 16:28:35 +02:00
parent 14243dcdb5
commit 5ce1c91b58
17 changed files with 236 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/ikev2/task_manager_v2.c
+14 -2
View File
@@ -38,6 +38,7 @@
#include <sa/ikev2/tasks/ike_mid_sync.h>
#include <sa/ikev2/tasks/ike_vendor.h>
#include <sa/ikev2/tasks/ike_verify_peer_cert.h>
#include <sa/ikev2/tasks/ike_establish.h>
#include <sa/ikev2/tasks/child_create.h>
#include <sa/ikev2/tasks/child_rekey.h>
#include <sa/ikev2/tasks/child_delete.h>
@@ -554,6 +555,8 @@ METHOD(task_manager_t, initiate, status_t,
activate_task(this, TASK_IKE_CONFIG);
activate_task(this, TASK_IKE_AUTH_LIFETIME);
activate_task(this, TASK_IKE_MOBIKE);
/* make sure this is the last IKE-related task */
activate_task(this, TASK_IKE_ESTABLISH);
activate_task(this, TASK_CHILD_CREATE);
}
break;
@@ -1151,10 +1154,15 @@ static status_t process_request(private_task_manager_t *this,
#endif /* ME */
task = (task_t*)ike_config_create(this->ike_sa, FALSE);
array_insert(this->passive_tasks, ARRAY_TAIL, task);
task = (task_t*)ike_auth_lifetime_create(this->ike_sa, FALSE);
array_insert(this->passive_tasks, ARRAY_TAIL, task);
task = (task_t*)ike_mobike_create(this->ike_sa, FALSE);
array_insert(this->passive_tasks, ARRAY_TAIL, task);
/* this should generally be the last IKE-related task */
task = (task_t*)ike_establish_create(this->ike_sa, FALSE);
array_insert(this->passive_tasks, ARRAY_TAIL, task);
/* make sure this comes after the above task to send the correct
* reauth time, as responder the task doesn't modify it anymore */
task = (task_t*)ike_auth_lifetime_create(this->ike_sa, FALSE);
array_insert(this->passive_tasks, ARRAY_TAIL, task);
task = (task_t*)child_create_create(this->ike_sa, NULL, FALSE,
NULL, NULL);
array_insert(this->passive_tasks, ARRAY_TAIL, task);
@@ -2129,6 +2137,10 @@ METHOD(task_manager_t, queue_ike, void,
queue_task(this, (task_t*)ike_mobike_create(this->ike_sa, TRUE));
}
}
if (!has_queued(this, TASK_IKE_ESTABLISH))
{
queue_task(this, (task_t*)ike_establish_create(this->ike_sa, TRUE));
}
#ifdef ME
if (!has_queued(this, TASK_IKE_ME))
{