denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Streamlined log messages in ipseckey plugin

Browse Source
This commit is contained in:
Andreas Steffen
2013-02-19 12:25:00 +01:00
committed by Tobias Brunner
parent a4ddc0bb26
commit 65cdda5cf8
2 changed files with 30 additions and 58 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/ipseckey/ipseckey.c
+12 -15
View File
@@ -118,7 +118,7 @@ ipseckey_t *ipseckey_create_frm_rr(rr_t *rr)
if (rr->get_type(rr) != RR_TYPE_IPSECKEY) if (rr->get_type(rr) != RR_TYPE_IPSECKEY)
{ {
DBG1(DBG_CFG, "unable to create an ipseckey out of a RR " DBG1(DBG_CFG, "unable to create an ipseckey out of an RR "
"whose type is not IPSECKEY"); "whose type is not IPSECKEY");
free(this); free(this);
return NULL; return NULL;
@@ -143,8 +143,8 @@ ipseckey_t *ipseckey_create_frm_rr(rr_t *rr)
case IPSECKEY_GW_TP_IPV4: case IPSECKEY_GW_TP_IPV4:
if (!reader->read_data(reader, 4, &this->gateway)) if (!reader->read_data(reader, 4, &this->gateway))
{ {
DBG1(DBG_CFG, "ipseckey gateway field does not contain an IPv4 " DBG1(DBG_CFG, "ipseckey gateway field does not contain an "
"address as expected"); "IPv4 address as expected");
reader->destroy(reader); reader->destroy(reader);
free(this); free(this);
return NULL; return NULL;
@@ -155,8 +155,8 @@ ipseckey_t *ipseckey_create_frm_rr(rr_t *rr)
case IPSECKEY_GW_TP_IPV6: case IPSECKEY_GW_TP_IPV6:
if (!reader->read_data(reader, 16, &this->gateway)) if (!reader->read_data(reader, 16, &this->gateway))
{ {
DBG1(DBG_CFG, "ipseckey gateway field does not contain an IPv6 " DBG1(DBG_CFG, "ipseckey gateway field does not contain an "
"address as expected"); "IPv6 address as expected");
reader->destroy(reader); reader->destroy(reader);
free(this); free(this);
return NULL; return NULL;
@@ -171,13 +171,13 @@ ipseckey_t *ipseckey_create_frm_rr(rr_t *rr)
* TODO: Currently we ignore wire encoded domain names. * TODO: Currently we ignore wire encoded domain names.
* *
*/ */
while(reader->read_uint8(reader, &label) && label != 0 && while (reader->read_uint8(reader, &label) &&
label < 192) label != 0 && label < 192)
{ {
if(!reader->read_data(reader, label, &tmp)) if (!reader->read_data(reader, label, &tmp))
{ {
DBG1(DBG_CFG, "ipseckey gateway field: Wire encoded " DBG1(DBG_CFG, "wrong wire encoded domain name format "
"domain name has the wrong format"); "in ipseckey gateway field");
reader->destroy(reader); reader->destroy(reader);
free(this); free(this);
return NULL; return NULL;
@@ -186,9 +186,7 @@ ipseckey_t *ipseckey_create_frm_rr(rr_t *rr)
break; break;
default: default:
DBG1(DBG_CFG, "ipseckey gateway field: Unable to parse the " DBG1(DBG_CFG, "unable to parse ipseckey gateway field");
"ipseckey gateway field. The gateway type field "
"indicates an unknown gateway type");
reader->destroy(reader); reader->destroy(reader);
free(this); free(this);
return NULL; return NULL;
@@ -197,8 +195,7 @@ ipseckey_t *ipseckey_create_frm_rr(rr_t *rr)
if (!reader->read_data(reader, reader->remaining(reader), if (!reader->read_data(reader, reader->remaining(reader),
&this->public_key)) &this->public_key))
{ {
DBG1(DBG_CFG, "ipseckey public key field: Failure while reading " DBG1(DBG_CFG, "failed to read ipseckey public key field");
"the public key");
reader->destroy(reader); reader->destroy(reader);
chunk_free(&this->gateway); chunk_free(&this->gateway);
free(this); free(this);
src/libcharon/plugins/ipseckey/ipseckey_cred.c
+18 -43
View File
@@ -67,8 +67,6 @@ METHOD(enumerator_t, cert_enumerator_enumerate, bool,
public_key_t * key = NULL; public_key_t * key = NULL;
bool supported_ipseckey_found = FALSE; bool supported_ipseckey_found = FALSE;
DBG1(DBG_CFG, "ipseckey_cred: Enumerating over IPSECKEY certificates");
/* Get the next supported IPSECKEY using the inner enumerator. */ /* Get the next supported IPSECKEY using the inner enumerator. */
while (this->inner->enumerate(this->inner, &cur_rr) && while (this->inner->enumerate(this->inner, &cur_rr) &&
!supported_ipseckey_found) !supported_ipseckey_found)
@@ -79,16 +77,14 @@ METHOD(enumerator_t, cert_enumerator_enumerate, bool,
if (!cur_ipseckey) if (!cur_ipseckey)
{ {
DBG1(DBG_CFG, "ipseckey_cred: Error while parsing an IPSECKEY. " DBG1(DBG_CFG, "failed to parse ipseckey - skipping this key");
"Skipping this key");
supported_ipseckey_found = FALSE; supported_ipseckey_found = FALSE;
} }
if (cur_ipseckey && if (cur_ipseckey &&
cur_ipseckey->get_algorithm(cur_ipseckey) != IPSECKEY_ALGORITHM_RSA) cur_ipseckey->get_algorithm(cur_ipseckey) != IPSECKEY_ALGORITHM_RSA)
{ {
DBG1(DBG_CFG, "ipseckey_cred: Skipping an IPSECKEY which uses an " DBG1(DBG_CFG, "unsupported ipseckey algorithm -skipping this key");
"unsupported algorithm");
cur_ipseckey->destroy(cur_ipseckey); cur_ipseckey->destroy(cur_ipseckey);
supported_ipseckey_found = FALSE; supported_ipseckey_found = FALSE;
} }
@@ -108,8 +104,7 @@ METHOD(enumerator_t, cert_enumerator_enumerate, bool,
if (!key) if (!key)
{ {
DBG1(DBG_CFG, "ipseckey_cred: Failed to create a public key " DBG1(DBG_CFG, "failed to create public key from ipseckey");
"from the IPSECKEY");
cur_ipseckey->destroy(cur_ipseckey); cur_ipseckey->destroy(cur_ipseckey);
return FALSE; return FALSE;
} }
@@ -155,18 +150,17 @@ METHOD(credential_set_t, create_cert_enumerator, enumerator_t*,
if (0 >= asprintf(&fqdn, "%Y", id)) if (0 >= asprintf(&fqdn, "%Y", id))
{ {
DBG1(DBG_CFG, "ipseckey_cred: ID is empty"); DBG1(DBG_CFG, "empty FQDN string");
return enumerator_create_empty(); return enumerator_create_empty();
} }
DBG1(DBG_CFG, "ipseckey_cred: Performing a DNS query for the IPSECKEY " DBG1(DBG_CFG, "performing a DNS query for IPSECKEY RRs of '%s'",
"RRs of the domain %s", fqdn); fqdn);
response = this->res->query(this->res, fqdn, RR_CLASS_IN, response = this->res->query(this->res, fqdn, RR_CLASS_IN,
RR_TYPE_IPSECKEY); RR_TYPE_IPSECKEY);
if (!response) if (!response)
{ {
DBG1(DBG_CFG, "ipseckey_cred: DNS query failed"); DBG1(DBG_CFG, " query for IPSECKEY RRs failed");
free(fqdn); free(fqdn);
return enumerator_create_empty(); return enumerator_create_empty();
} }
@@ -174,8 +168,7 @@ METHOD(credential_set_t, create_cert_enumerator, enumerator_t*,
if (!response->has_data(response) || if (!response->has_data(response) ||
!response->query_name_exist(response)) !response->query_name_exist(response))
{ {
DBG1(DBG_CFG, "ipseckey_cred: Unable to retrieve IPSECKEY RRs " DBG1(DBG_CFG, " unable to retrieve IPSECKEY RRs from the DNS");
"for the domain %s from the DNS", fqdn);
response->destroy(response); response->destroy(response);
free(fqdn); free(fqdn);
return enumerator_create_empty(); return enumerator_create_empty();
@@ -183,9 +176,7 @@ METHOD(credential_set_t, create_cert_enumerator, enumerator_t*,
if (!(response->get_security_state(response) == SECURE)) if (!(response->get_security_state(response) == SECURE))
{ {
DBG1(DBG_CFG, "ipseckey_cred: DNSSEC security state of the " DBG1(DBG_CFG, " DNSSEC state of IPSECKEY RRs is not secure");
"IPSECKEY RRs of the domain %s is not SECURE "
"as required", fqdn);
response->destroy(response); response->destroy(response);
free(fqdn); free(fqdn);
return enumerator_create_empty(); return enumerator_create_empty();
@@ -196,38 +187,22 @@ METHOD(credential_set_t, create_cert_enumerator, enumerator_t*,
/** Determine the validity period of the retrieved IPSECKEYs /** Determine the validity period of the retrieved IPSECKEYs
* *
* We use the "Signature Inception" and "Signature Expiration" field * We use the "Signature Inception" and "Signature Expiration" field
* of the RRSIG resource record to determine the validity period of the * of the first RRSIG RR to determine the validity period of the
* IPSECKEY RRs. * IPSECKEY RRs. TODO: Take multiple RRSIGs into account.
*/ */
rrset = response->get_rr_set(response); rrset = response->get_rr_set(response);
rrsig_enum = rrset->create_rrsig_enumerator(rrset); rrsig_enum = rrset->create_rrsig_enumerator(rrset);
if (!rrsig_enum) if (!rrsig_enum || !rrsig_enum->enumerate(rrsig_enum, &rrsig))
{ {
DBG1(DBG_CFG, "ipseckey_cred: Unable to determine the validity " DBG1(DBG_CFG, " unable to determine the validity period of "
"period of the RRs, because there are " "IPSECKEY RRs because no RRSIGs are present");
"no RRSIGs present"); DESTROY_IF(rrsig_enum);
response->destroy(response); response->destroy(response);
return enumerator_create_empty(); return enumerator_create_empty();
} }
/** /**
* Currently we use the first RRSIG of the IPSECKEY RRset * Parse the RRSIG for its validity period (RFC 4034)
* to determine the validity period of the IPSECKEYs.
* TODO: Take multiple RRSIGs into account.
*/
if (!rrsig_enum->enumerate(rrsig_enum, &rrsig))
{
DBG1(DBG_CFG, "ipseckey_cred: Unable to determine the validity "
"period of the IPSECKEY RRs, because there are "
"no RRSIGs present");
rrsig_enum->destroy(rrsig_enum);
response->destroy(response);
return enumerator_create_empty();
}
/**
* Parse the RRSIG for its validity period.
* For the format of a RRSIG see RFC 4034.
*/ */
reader = bio_reader_create(rrsig->get_rdata(rrsig)); reader = bio_reader_create(rrsig->get_rdata(rrsig));
reader->read_data(reader, 8, &ignore); reader->read_data(reader, 8, &ignore);
@@ -235,14 +210,14 @@ METHOD(credential_set_t, create_cert_enumerator, enumerator_t*,
reader->read_uint32(reader, &nBefore); reader->read_uint32(reader, &nBefore);
reader->destroy(reader); reader->destroy(reader);
/** Create and return an iterator over the retrieved IPSECKEYs */ /*Create and return an iterator over the retrieved IPSECKEYs */
INIT(e, INIT(e,
.public = { .public = {
.enumerate = (void*)_cert_enumerator_enumerate, .enumerate = (void*)_cert_enumerator_enumerate,
.destroy = _cert_enumerator_destroy, .destroy = _cert_enumerator_destroy,
}, },
.inner = response->get_rr_set(response)->create_rr_enumerator( .inner = response->get_rr_set(response)->create_rr_enumerator(
response->get_rr_set(response)), response->get_rr_set(response)),
.response = response, .response = response,
.notBefore = nBefore, .notBefore = nBefore,
.notAfter = nAfter, .notAfter = nAfter,