denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

vici: Improve log messages for terminate/rekey() in case of combined filters

Browse Source 
As long as any `child*` selector is received, only CHILD_SAs will be
terminated or rekeyed.  Any passed `ike*` selectors will only be used to
filter the IKE_SAs when looking for matching CHILD_SAs.  However, the
previous log messages seemed to indicate that IKE_SAs will also be
terminated/rekeyed.

References strongswan/strongswan#1655
This commit is contained in:
Tobias Brunner
2023-05-01 10:19:29 +02:00
parent 00a75e332f
commit 5e46e101a6
1 changed files with 36 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/vici/vici_control.c
+36 -32
View File
@@ -226,11 +226,32 @@ CALLBACK(initiate, vici_message_t*,
} }
} }
/**
* Format the given SA filter parameters for logging.
*/
static inline void format_sa_selector(char *buf, size_t len, char *name,
u_int id)
{
if (name && id)
{
snprintf(buf, len, "'%s' #%d", name, id);
}
else if (name)
{
snprintf(buf, len, "'%s'", name);
}
else if (id)
{
snprintf(buf, len, "#%d", id);
}
}
CALLBACK(terminate, vici_message_t*, CALLBACK(terminate, vici_message_t*,
private_vici_control_t *this, char *name, u_int id, vici_message_t *request) private_vici_control_t *this, char *name, u_int id, vici_message_t *request)
{ {
enumerator_t *enumerator, *isas, *csas; enumerator_t *enumerator, *isas, *csas;
char *child, *ike, *errmsg = NULL; char *child, *ike, *errmsg = NULL;
char child_sel[BUF_LEN] = "", ike_sel[BUF_LEN] = "";
u_int child_id, ike_id, current, *del, done = 0; u_int child_id, ike_id, current, *del, done = 0;
bool force; bool force;
int timeout; int timeout;
@@ -257,22 +278,13 @@ CALLBACK(terminate, vici_message_t*,
return send_reply(this, "missing terminate selector"); return send_reply(this, "missing terminate selector");
} }
if (ike_id) format_sa_selector(child_sel, sizeof(child_sel), child, child_id);
{ format_sa_selector(ike_sel, sizeof(ike_sel), ike, ike_id);
DBG1(DBG_CFG, "vici terminate IKE_SA #%d", ike_id);
} DBG1(DBG_CFG, "vici terminate%s%s%s%s%s",
if (child_id) child_sel[0] ? " CHILD_SA " : "", child_sel,
{ child_sel[0] && ike_sel[0] ? " of" : "",
DBG1(DBG_CFG, "vici terminate CHILD_SA #%d", child_id); ike_sel[0] ? " IKE_SA ": "", ike_sel);
}
if (ike)
{
DBG1(DBG_CFG, "vici terminate IKE_SA '%s'", ike);
}
if (child)
{
DBG1(DBG_CFG, "vici terminate CHILD_SA '%s'", child);
}
if (timeout >= 0) if (timeout >= 0)
{ {
@@ -376,6 +388,7 @@ CALLBACK(rekey, vici_message_t*,
{ {
enumerator_t *isas, *csas; enumerator_t *isas, *csas;
char *child, *ike, *errmsg = NULL; char *child, *ike, *errmsg = NULL;
char child_sel[BUF_LEN] = "", ike_sel[BUF_LEN] = "";
u_int child_id, ike_id, found = 0; u_int child_id, ike_id, found = 0;
ike_sa_t *ike_sa; ike_sa_t *ike_sa;
child_sa_t *child_sa; child_sa_t *child_sa;
@@ -393,22 +406,13 @@ CALLBACK(rekey, vici_message_t*,
return send_reply(this, "missing rekey selector"); return send_reply(this, "missing rekey selector");
} }
if (ike_id) format_sa_selector(child_sel, sizeof(child_sel), child, child_id);
{ format_sa_selector(ike_sel, sizeof(ike_sel), ike, ike_id);
DBG1(DBG_CFG, "vici rekey IKE_SA #%d", ike_id);
} DBG1(DBG_CFG, "vici rekey%s%s%s%s%s",
if (child_id) child_sel[0] ? " CHILD_SA " : "", child_sel,
{ child_sel[0] && ike_sel[0] ? " of" : "",
DBG1(DBG_CFG, "vici rekey CHILD_SA #%d", child_id); ike_sel[0] ? " IKE_SA ": "", ike_sel);
}
if (ike)
{
DBG1(DBG_CFG, "vici rekey IKE_SA '%s'", ike);
}
if (child)
{
DBG1(DBG_CFG, "vici rekey CHILD_SA '%s'", child);
}
isas = charon->controller->create_ike_sa_enumerator(charon->controller, TRUE); isas = charon->controller->create_ike_sa_enumerator(charon->controller, TRUE);
while (isas->enumerate(isas, &ike_sa)) while (isas->enumerate(isas, &ike_sa))