denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'trap-manager-uninstall'

Browse Source 
This changes how trap policies are deleted in order to avoid conflicts if a
trap policy with changed peer config is concurrently removed and reinstalled
under a different name (the reqid will be the same, so the wrong policy
could have been deleted by the old code).
This commit is contained in:
Tobias Brunner
2018-02-22 11:36:53 +01:00
parent c1c63a400e a541cf05c1
commit 6df2938fd2
13 changed files with 76 additions and 317 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/ha/ha_tunnel.c
+6 -7
View File
@@ -20,6 +20,8 @@
#include <utils/identification.h> #include <utils/identification.h>
#include <processing/jobs/callback_job.h> #include <processing/jobs/callback_job.h>
#define HA_CFG_NAME "ha"
typedef struct private_ha_tunnel_t private_ha_tunnel_t; typedef struct private_ha_tunnel_t private_ha_tunnel_t;
typedef struct ha_backend_t ha_backend_t; typedef struct ha_backend_t ha_backend_t;
typedef struct ha_creds_t ha_creds_t; typedef struct ha_creds_t ha_creds_t;
@@ -225,7 +227,7 @@ static void setup_tunnel(private_ha_tunnel_t *this,
remote, IKEV2_UDP_PORT, FRAGMENTATION_NO, 0); remote, IKEV2_UDP_PORT, FRAGMENTATION_NO, 0);
ike_cfg->add_proposal(ike_cfg, proposal_create_default(PROTO_IKE)); ike_cfg->add_proposal(ike_cfg, proposal_create_default(PROTO_IKE));
ike_cfg->add_proposal(ike_cfg, proposal_create_default_aead(PROTO_IKE)); ike_cfg->add_proposal(ike_cfg, proposal_create_default_aead(PROTO_IKE));
peer_cfg = peer_cfg_create("ha", ike_cfg, &peer); peer_cfg = peer_cfg_create(HA_CFG_NAME, ike_cfg, &peer);
auth_cfg = auth_cfg_create(); auth_cfg = auth_cfg_create();
auth_cfg->add(auth_cfg, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PSK); auth_cfg->add(auth_cfg, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PSK);
@@ -239,7 +241,7 @@ static void setup_tunnel(private_ha_tunnel_t *this,
identification_create_from_string(remote)); identification_create_from_string(remote));
peer_cfg->add_auth_cfg(peer_cfg, auth_cfg, FALSE); peer_cfg->add_auth_cfg(peer_cfg, auth_cfg, FALSE);
child_cfg = child_cfg_create("ha", &child); child_cfg = child_cfg_create(HA_CFG_NAME, &child);
ts = traffic_selector_create_dynamic(IPPROTO_UDP, HA_PORT, HA_PORT); ts = traffic_selector_create_dynamic(IPPROTO_UDP, HA_PORT, HA_PORT);
child_cfg->add_traffic_selector(child_cfg, TRUE, ts); child_cfg->add_traffic_selector(child_cfg, TRUE, ts);
ts = traffic_selector_create_dynamic(IPPROTO_ICMP, 0, 65535); ts = traffic_selector_create_dynamic(IPPROTO_ICMP, 0, 65535);
@@ -260,7 +262,7 @@ static void setup_tunnel(private_ha_tunnel_t *this,
charon->backends->add_backend(charon->backends, &this->backend.public); charon->backends->add_backend(charon->backends, &this->backend.public);
/* install an acquiring trap */ /* install an acquiring trap */
this->trap = charon->traps->install(charon->traps, peer_cfg, child_cfg, 0); charon->traps->install(charon->traps, peer_cfg, child_cfg);
} }
METHOD(ha_tunnel_t, destroy, void, METHOD(ha_tunnel_t, destroy, void,
@@ -278,10 +280,7 @@ METHOD(ha_tunnel_t, destroy, void,
} }
this->creds.local->destroy(this->creds.local); this->creds.local->destroy(this->creds.local);
this->creds.remote->destroy(this->creds.remote); this->creds.remote->destroy(this->creds.remote);
if (this->trap) charon->traps->uninstall(charon->traps, HA_CFG_NAME, HA_CFG_NAME);
{
charon->traps->uninstall(charon->traps, this->trap);
}
free(this); free(this);
} }
src/libcharon/plugins/stroke/stroke_control.c
+4 -80
View File
@@ -588,47 +588,6 @@ METHOD(stroke_control_t, purge_ike, void,
list->destroy(list); list->destroy(list);
} }
/**
* Find an existing CHILD_SA/reqid
*/
static uint32_t find_reqid(child_cfg_t *child_cfg)
{
enumerator_t *enumerator, *children;
child_sa_t *child_sa;
ike_sa_t *ike_sa;
char *name;
uint32_t reqid;
reqid = charon->traps->find_reqid(charon->traps, child_cfg);
if (reqid)
{ /* already trapped */
return reqid;
}
name = child_cfg->get_name(child_cfg);
enumerator = charon->controller->create_ike_sa_enumerator(
charon->controller, TRUE);
while (enumerator->enumerate(enumerator, &ike_sa))
{
children = ike_sa->create_child_sa_enumerator(ike_sa);
while (children->enumerate(children, (void**)&child_sa))
{
if (streq(name, child_sa->get_name(child_sa)))
{
reqid = child_sa->get_reqid(child_sa);
break;
}
}
children->destroy(children);
if (reqid)
{
break;
}
}
enumerator->destroy(enumerator);
return reqid;
}
/** /**
* call charon to install a shunt or trap * call charon to install a shunt or trap
*/ */
@@ -636,7 +595,6 @@ static void charon_route(peer_cfg_t *peer_cfg, child_cfg_t *child_cfg,
char *name, FILE *out) char *name, FILE *out)
{ {
ipsec_mode_t mode; ipsec_mode_t mode;
uint32_t reqid;
mode = child_cfg->get_mode(child_cfg); mode = child_cfg->get_mode(child_cfg);
if (mode == MODE_PASS || mode == MODE_DROP) if (mode == MODE_PASS || mode == MODE_DROP)
@@ -655,8 +613,7 @@ static void charon_route(peer_cfg_t *peer_cfg, child_cfg_t *child_cfg,
} }
else else
{ {
reqid = find_reqid(child_cfg); if (charon->traps->install(charon->traps, peer_cfg, child_cfg))
if (charon->traps->install(charon->traps, peer_cfg, child_cfg, reqid))
{ {
fprintf(out, "'%s' routed\n", name); fprintf(out, "'%s' routed\n", name);
} }
@@ -730,46 +687,13 @@ METHOD(stroke_control_t, route, void,
METHOD(stroke_control_t, unroute, void, METHOD(stroke_control_t, unroute, void,
private_stroke_control_t *this, stroke_msg_t *msg, FILE *out) private_stroke_control_t *this, stroke_msg_t *msg, FILE *out)
{ {
child_cfg_t *child_cfg; if (charon->shunts->uninstall(charon->shunts, NULL, msg->unroute.name))
child_sa_t *child_sa;
enumerator_t *enumerator;
char *ns, *found = NULL;
uint32_t id = 0;
enumerator = charon->shunts->create_enumerator(charon->shunts);
while (enumerator->enumerate(enumerator, &ns, &child_cfg))
{ {
if (ns && streq(msg->unroute.name, child_cfg->get_name(child_cfg)))
{
found = strdup(ns);
break;
}
}
enumerator->destroy(enumerator);
if (found && charon->shunts->uninstall(charon->shunts, found,
msg->unroute.name))
{
free(found);
fprintf(out, "shunt policy '%s' uninstalled\n", msg->unroute.name); fprintf(out, "shunt policy '%s' uninstalled\n", msg->unroute.name);
return;
} }
free(found); else if (charon->traps->uninstall(charon->traps, NULL, msg->unroute.name))
enumerator = charon->traps->create_enumerator(charon->traps);
while (enumerator->enumerate(enumerator, NULL, &child_sa))
{ {
if (streq(msg->unroute.name, child_sa->get_name(child_sa))) fprintf(out, "trap policy '%s' unrouted\n", msg->unroute.name);
{
id = child_sa->get_reqid(child_sa);
break;
}
}
enumerator->destroy(enumerator);
if (id)
{
charon->traps->uninstall(charon->traps, id);
fprintf(out, "configuration '%s' unrouted\n", msg->unroute.name);
} }
else else
{ {
src/libcharon/plugins/vici/vici_config.c
+2 -54
View File
@@ -1953,41 +1953,6 @@ CALLBACK(peer_sn, bool,
return FALSE; return FALSE;
} }
/**
* Find reqid of an existing CHILD_SA
*/
static uint32_t find_reqid(child_cfg_t *cfg)
{
enumerator_t *enumerator, *children;
child_sa_t *child_sa;
ike_sa_t *ike_sa;
uint32_t reqid;
reqid = charon->traps->find_reqid(charon->traps, cfg);
if (reqid)
{ /* already trapped */
return reqid;
}
enumerator = charon->controller->create_ike_sa_enumerator(
charon->controller, TRUE);
while (!reqid && enumerator->enumerate(enumerator, &ike_sa))
{
children = ike_sa->create_child_sa_enumerator(ike_sa);
while (children->enumerate(children, &child_sa))
{
if (streq(cfg->get_name(cfg), child_sa->get_name(child_sa)))
{
reqid = child_sa->get_reqid(child_sa);
break;
}
}
children->destroy(children);
}
enumerator->destroy(enumerator);
return reqid;
}
/** /**
* Perform start actions associated with a child config * Perform start actions associated with a child config
*/ */
@@ -2012,8 +1977,7 @@ static void run_start_action(private_vici_config_t *this, peer_cfg_t *peer_cfg,
peer_cfg->get_name(peer_cfg), child_cfg); peer_cfg->get_name(peer_cfg), child_cfg);
break; break;
default: default:
charon->traps->install(charon->traps, peer_cfg, child_cfg, charon->traps->install(charon->traps, peer_cfg, child_cfg);
find_reqid(child_cfg));
break; break;
} }
break; break;
@@ -2030,7 +1994,6 @@ static void clear_start_action(private_vici_config_t *this, char *peer_name,
{ {
enumerator_t *enumerator, *children; enumerator_t *enumerator, *children;
child_sa_t *child_sa; child_sa_t *child_sa;
peer_cfg_t *peer_cfg;
ike_sa_t *ike_sa; ike_sa_t *ike_sa;
uint32_t id = 0, others; uint32_t id = 0, others;
array_t *ids = NULL, *ikeids = NULL; array_t *ids = NULL, *ikeids = NULL;
@@ -2121,22 +2084,7 @@ static void clear_start_action(private_vici_config_t *this, char *peer_name,
charon->shunts->uninstall(charon->shunts, peer_name, name); charon->shunts->uninstall(charon->shunts, peer_name, name);
break; break;
default: default:
enumerator = charon->traps->create_enumerator(charon->traps); charon->traps->uninstall(charon->traps, peer_name, name);
while (enumerator->enumerate(enumerator, &peer_cfg,
&child_sa))
{
if (streq(peer_name, peer_cfg->get_name(peer_cfg)) &&
streq(name, child_sa->get_name(child_sa)))
{
id = child_sa->get_reqid(child_sa);
break;
}
}
enumerator->destroy(enumerator);
if (id)
{
charon->traps->uninstall(charon->traps, id);
}
break; break;
} }
break; break;
src/libcharon/plugins/vici/vici_control.c
+5 -86
View File
@@ -601,41 +601,6 @@ CALLBACK(redirect, vici_message_t*,
return builder->finalize(builder); return builder->finalize(builder);
} }
/**
* Find reqid of an existing CHILD_SA
*/
static uint32_t find_reqid(child_cfg_t *cfg)
{
enumerator_t *enumerator, *children;
child_sa_t *child_sa;
ike_sa_t *ike_sa;
uint32_t reqid;
reqid = charon->traps->find_reqid(charon->traps, cfg);
if (reqid)
{ /* already trapped */
return reqid;
}
enumerator = charon->controller->create_ike_sa_enumerator(
charon->controller, TRUE);
while (!reqid && enumerator->enumerate(enumerator, &ike_sa))
{
children = ike_sa->create_child_sa_enumerator(ike_sa);
while (children->enumerate(children, &child_sa))
{
if (streq(cfg->get_name(cfg), child_sa->get_name(child_sa)))
{
reqid = child_sa->get_reqid(child_sa);
break;
}
}
children->destroy(children);
}
enumerator->destroy(enumerator);
return reqid;
}
CALLBACK(install, vici_message_t*, CALLBACK(install, vici_message_t*,
private_vici_control_t *this, char *name, u_int id, vici_message_t *request) private_vici_control_t *this, char *name, u_int id, vici_message_t *request)
{ {
@@ -666,8 +631,7 @@ CALLBACK(install, vici_message_t*,
peer_cfg->get_name(peer_cfg), child_cfg); peer_cfg->get_name(peer_cfg), child_cfg);
break; break;
default: default:
ok = charon->traps->install(charon->traps, peer_cfg, child_cfg, ok = charon->traps->install(charon->traps, peer_cfg, child_cfg);
find_reqid(child_cfg));
break; break;
} }
peer_cfg->destroy(peer_cfg); peer_cfg->destroy(peer_cfg);
@@ -679,12 +643,7 @@ CALLBACK(install, vici_message_t*,
CALLBACK(uninstall, vici_message_t*, CALLBACK(uninstall, vici_message_t*,
private_vici_control_t *this, char *name, u_int id, vici_message_t *request) private_vici_control_t *this, char *name, u_int id, vici_message_t *request)
{ {
peer_cfg_t *peer_cfg; char *child, *ike;
child_cfg_t *child_cfg;
child_sa_t *child_sa;
enumerator_t *enumerator;
uint32_t reqid = 0;
char *child, *ike, *ns;
child = request->get_str(request, NULL, "child"); child = request->get_str(request, NULL, "child");
ike = request->get_str(request, NULL, "ike"); ike = request->get_str(request, NULL, "ike");
@@ -695,53 +654,13 @@ CALLBACK(uninstall, vici_message_t*,
DBG1(DBG_CFG, "vici uninstall '%s'", child); DBG1(DBG_CFG, "vici uninstall '%s'", child);
if (!ike) if (charon->shunts->uninstall(charon->shunts, ike, child))
{
enumerator = charon->shunts->create_enumerator(charon->shunts);
while (enumerator->enumerate(enumerator, &ns, &child_cfg))
{
if (ns && streq(child, child_cfg->get_name(child_cfg)))
{
ike = strdup(ns);
break;
}
}
enumerator->destroy(enumerator);
if (ike)
{
if (charon->shunts->uninstall(charon->shunts, ike, child))
{
free(ike);
return send_reply(this, NULL);
}
free(ike);
return send_reply(this, "uninstalling policy '%s' failed", child);
}
}
else if (charon->shunts->uninstall(charon->shunts, ike, child))
{ {
return send_reply(this, NULL); return send_reply(this, NULL);
} }
else if (charon->traps->uninstall(charon->traps, ike, child))
enumerator = charon->traps->create_enumerator(charon->traps);
while (enumerator->enumerate(enumerator, &peer_cfg, &child_sa))
{ {
if ((!ike || streq(ike, peer_cfg->get_name(peer_cfg))) && return send_reply(this, NULL);
streq(child, child_sa->get_name(child_sa)))
{
reqid = child_sa->get_reqid(child_sa);
break;
}
}
enumerator->destroy(enumerator);
if (reqid)
{
if (charon->traps->uninstall(charon->traps, reqid))
{
return send_reply(this, NULL);
}
return send_reply(this, "uninstalling policy '%s' failed", child);
} }
return send_reply(this, "policy '%s' not found", child); return send_reply(this, "policy '%s' not found", child);
} }
src/libcharon/processing/jobs/start_action_job.c
+1 -1
View File
@@ -75,7 +75,7 @@ METHOD(job_t, execute, job_requeue_t,
else else
{ {
charon->traps->install(charon->traps, peer_cfg, charon->traps->install(charon->traps, peer_cfg,
child_cfg, 0); child_cfg);
} }
break; break;
case ACTION_NONE: case ACTION_NONE:
src/libcharon/sa/child_sa.c
+10 -16
View File
@@ -1754,7 +1754,7 @@ static host_t* get_proxy_addr(child_cfg_t *config, host_t *ike, bool local)
* Described in header. * Described in header.
*/ */
child_sa_t * child_sa_create(host_t *me, host_t* other, child_sa_t * child_sa_create(host_t *me, host_t* other,
child_cfg_t *config, uint32_t rekey, bool encap, child_cfg_t *config, uint32_t reqid, bool encap,
u_int mark_in, u_int mark_out) u_int mark_in, u_int mark_out)
{ {
private_child_sa_t *this; private_child_sa_t *this;
@@ -1865,21 +1865,15 @@ child_sa_t * child_sa_create(host_t *me, host_t* other,
if (!this->reqid) if (!this->reqid)
{ {
/* reuse old reqid if we are rekeying an existing CHILD_SA. While the /* reuse old reqid if we are rekeying an existing CHILD_SA and when
* reqid cache would find the same reqid for our selectors, this does * initiating a trap policy. While the reqid cache would find the same
* not work in a special case: If an SA is triggered by a trap policy, * reqid for our selectors, this does not work in a special case: If an
* but the negotiated SA gets narrowed, we still must reuse the same * SA is triggered by a trap policy, but the negotiated TS get
* reqid to successfully "trigger" the SA on the kernel level. Rekeying * narrowed, we still must reuse the same reqid to successfully
* such an SA requires an explicit reqid, as the cache currently knows * replace the temporary SA on the kernel level. Rekeying such an SA
* the original selectors only for that reqid. */ * requires an explicit reqid, as the cache currently knows the original
if (rekey) * selectors only for that reqid. */
{ this->reqid = reqid;
this->reqid = rekey;
}
else
{
this->reqid = charon->traps->find_reqid(charon->traps, config);
}
} }
else else
{ {
src/libcharon/sa/ike_sa.c
+1 -2
View File
@@ -2035,8 +2035,7 @@ METHOD(ike_sa_t, reestablish, status_t,
break; break;
case ACTION_ROUTE: case ACTION_ROUTE:
charon->traps->install(charon->traps, this->peer_cfg, charon->traps->install(charon->traps, this->peer_cfg,
child_sa->get_config(child_sa), child_sa->get_config(child_sa));
child_sa->get_reqid(child_sa));
break; break;
default: default:
break; break;
src/libcharon/sa/ikev1/tasks/quick_delete.c
+1 -1
View File
@@ -154,7 +154,7 @@ static bool delete_child(private_quick_delete_t *this, protocol_id_t protocol,
case ACTION_ROUTE: case ACTION_ROUTE:
charon->traps->install(charon->traps, charon->traps->install(charon->traps,
this->ike_sa->get_peer_cfg(this->ike_sa), this->ike_sa->get_peer_cfg(this->ike_sa),
child_cfg, child_sa->get_reqid(child_sa)); child_cfg);
break; break;
default: default:
break; break;
src/libcharon/sa/ikev2/tasks/child_delete.c
+2 -2
View File
@@ -374,8 +374,8 @@ static status_t destroy_and_reestablish(private_child_delete_t *this)
break; break;
case ACTION_ROUTE: case ACTION_ROUTE:
charon->traps->install(charon->traps, charon->traps->install(charon->traps,
this->ike_sa->get_peer_cfg(this->ike_sa), child_cfg, this->ike_sa->get_peer_cfg(this->ike_sa),
reqid); child_cfg);
break; break;
default: default:
break; break;
src/libcharon/sa/shunt_manager.c
+10 -3
View File
@@ -1,5 +1,5 @@
/* /*
* Copyright (C) 2015-2016 Tobias Brunner * Copyright (C) 2015-2017 Tobias Brunner
* Copyright (C) 2011-2016 Andreas Steffen * Copyright (C) 2011-2016 Andreas Steffen
* HSR Hochschule fuer Technik Rapperswil * HSR Hochschule fuer Technik Rapperswil
* *
@@ -198,6 +198,13 @@ METHOD(shunt_manager_t, install, bool,
entry_t *entry; entry_t *entry;
bool found = FALSE, success; bool found = FALSE, success;
if (!ns)
{
DBG1(DBG_CFG, "missing namespace for shunt policy '%s'",
cfg->get_name(cfg));
return FALSE;
}
/* check if not already installed */ /* check if not already installed */
this->lock->write_lock(this->lock); this->lock->write_lock(this->lock);
if (this->installing == INSTALL_DISABLED) if (this->installing == INSTALL_DISABLED)
@@ -224,7 +231,7 @@ METHOD(shunt_manager_t, install, bool,
return TRUE; return TRUE;
} }
INIT(entry, INIT(entry,
.ns = strdupnull(ns), .ns = strdup(ns),
.cfg = cfg->get_ref(cfg), .cfg = cfg->get_ref(cfg),
); );
this->shunts->insert_last(this->shunts, entry); this->shunts->insert_last(this->shunts, entry);
@@ -369,7 +376,7 @@ METHOD(shunt_manager_t, uninstall, bool,
enumerator = this->shunts->create_enumerator(this->shunts); enumerator = this->shunts->create_enumerator(this->shunts);
while (enumerator->enumerate(enumerator, &entry)) while (enumerator->enumerate(enumerator, &entry))
{ {
if (streq(ns, entry->ns) && if ((!ns || streq(ns, entry->ns)) &&
streq(name, entry->cfg->get_name(entry->cfg))) streq(name, entry->cfg->get_name(entry->cfg)))
{ {
this->shunts->remove_at(this->shunts, enumerator); this->shunts->remove_at(this->shunts, enumerator);
src/libcharon/sa/shunt_manager.h
+6 -4
View File
@@ -1,5 +1,5 @@
/* /*
* Copyright (C) 2015-2016 Tobias Brunner * Copyright (C) 2015-2017 Tobias Brunner
* Copyright (C) 2011 Andreas Steffen * Copyright (C) 2011 Andreas Steffen
* HSR Hochschule fuer Technik Rapperswil * HSR Hochschule fuer Technik Rapperswil
* *
@@ -36,8 +36,7 @@ struct shunt_manager_t {
/** /**
* Install a policy as a shunt. * Install a policy as a shunt.
* *
* @param ns optional namespace (e.g. name of a connection or * @param ns namespace (e.g. name of a connection or plugin), cloned
* plugin), cloned
* @param child child configuration to install as a shunt * @param child child configuration to install as a shunt
* @return TRUE if installed successfully * @return TRUE if installed successfully
*/ */
@@ -46,7 +45,10 @@ struct shunt_manager_t {
/** /**
* Uninstall a shunt policy. * Uninstall a shunt policy.
* *
* @param ns namespace (same as given during installation) * If no namespace is given the first matching child configuration is
* removed.
*
* @param ns namespace (same as given during installation) or NULL
* @param name name of child configuration to uninstall as a shunt * @param name name of child configuration to uninstall as a shunt
* @return TRUE if uninstalled successfully * @return TRUE if uninstalled successfully
*/ */
src/libcharon/sa/trap_manager.c
+18 -46
View File
@@ -1,7 +1,7 @@
/* /*
* Copyright (C) 2011-2015 Tobias Brunner * Copyright (C) 2011-2017 Tobias Brunner
* Copyright (C) 2009 Martin Willi * Copyright (C) 2009 Martin Willi
* Hochschule fuer Technik Rapperswil * HSR Hochschule fuer Technik Rapperswil
* *
* This program is free software; you can redistribute it and/or modify it * This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the * under the terms of the GNU General Public License as published by the
@@ -183,9 +183,8 @@ static bool dynamic_remote_ts(child_cfg_t *child)
return found; return found;
} }
METHOD(trap_manager_t, install, uint32_t, METHOD(trap_manager_t, install, bool,
private_trap_manager_t *this, peer_cfg_t *peer, child_cfg_t *child, private_trap_manager_t *this, peer_cfg_t *peer, child_cfg_t *child)
uint32_t reqid)
{ {
entry_t *entry, *found = NULL; entry_t *entry, *found = NULL;
ike_cfg_t *ike_cfg; ike_cfg_t *ike_cfg;
@@ -197,7 +196,7 @@ METHOD(trap_manager_t, install, uint32_t,
linked_list_t *proposals; linked_list_t *proposals;
proposal_t *proposal; proposal_t *proposal;
protocol_id_t proto = PROTO_ESP; protocol_id_t proto = PROTO_ESP;
bool wildcard = FALSE; bool result = FALSE, wildcard = FALSE;
/* try to resolve addresses */ /* try to resolve addresses */
ike_cfg = peer->get_ike_cfg(peer); ike_cfg = peer->get_ike_cfg(peer);
@@ -213,7 +212,7 @@ METHOD(trap_manager_t, install, uint32_t,
{ {
other->destroy(other); other->destroy(other);
DBG1(DBG_CFG, "installing trap failed, remote address unknown"); DBG1(DBG_CFG, "installing trap failed, remote address unknown");
return 0; return FALSE;
} }
else else
{ /* depending on the traffic selectors we don't really need a remote { /* depending on the traffic selectors we don't really need a remote
@@ -223,7 +222,7 @@ METHOD(trap_manager_t, install, uint32_t,
* which is probably not what users expect*/ * which is probably not what users expect*/
DBG1(DBG_CFG, "installing trap failed, remote address unknown with " DBG1(DBG_CFG, "installing trap failed, remote address unknown with "
"dynamic traffic selector"); "dynamic traffic selector");
return 0; return FALSE;
} }
me = ike_cfg->resolve_me(ike_cfg, other ? other->get_family(other) me = ike_cfg->resolve_me(ike_cfg, other ? other->get_family(other)
: AF_UNSPEC); : AF_UNSPEC);
@@ -250,12 +249,14 @@ METHOD(trap_manager_t, install, uint32_t,
this->lock->unlock(this->lock); this->lock->unlock(this->lock);
other->destroy(other); other->destroy(other);
me->destroy(me); me->destroy(me);
return 0; return FALSE;
} }
enumerator = this->traps->create_enumerator(this->traps); enumerator = this->traps->create_enumerator(this->traps);
while (enumerator->enumerate(enumerator, &entry)) while (enumerator->enumerate(enumerator, &entry))
{ {
if (streq(entry->name, child->get_name(child))) if (streq(entry->name, child->get_name(child)) &&
streq(entry->peer_cfg->get_name(entry->peer_cfg),
peer->get_name(peer)))
{ {
found = entry; found = entry;
if (entry->child_sa) if (entry->child_sa)
@@ -275,11 +276,10 @@ METHOD(trap_manager_t, install, uint32_t,
this->lock->unlock(this->lock); this->lock->unlock(this->lock);
other->destroy(other); other->destroy(other);
me->destroy(me); me->destroy(me);
return 0; return FALSE;
} }
/* config might have changed so update everything */ /* config might have changed so update everything */
DBG1(DBG_CFG, "updating already routed CHILD_SA '%s'", found->name); DBG1(DBG_CFG, "updating already routed CHILD_SA '%s'", found->name);
reqid = found->child_sa->get_reqid(found->child_sa);
} }
INIT(entry, INIT(entry,
@@ -293,7 +293,7 @@ METHOD(trap_manager_t, install, uint32_t,
this->lock->unlock(this->lock); this->lock->unlock(this->lock);
/* create and route CHILD_SA */ /* create and route CHILD_SA */
child_sa = child_sa_create(me, other, child, reqid, FALSE, 0, 0); child_sa = child_sa_create(me, other, child, 0, FALSE, 0, 0);
list = linked_list_create_with_items(me, NULL); list = linked_list_create_with_items(me, NULL);
my_ts = child->get_traffic_selectors(child, TRUE, NULL, list); my_ts = child->get_traffic_selectors(child, TRUE, NULL, list);
@@ -325,14 +325,13 @@ METHOD(trap_manager_t, install, uint32_t,
this->lock->unlock(this->lock); this->lock->unlock(this->lock);
entry->child_sa = child_sa; entry->child_sa = child_sa;
destroy_entry(entry); destroy_entry(entry);
reqid = 0;
} }
else else
{ {
reqid = child_sa->get_reqid(child_sa);
this->lock->write_lock(this->lock); this->lock->write_lock(this->lock);
entry->child_sa = child_sa; entry->child_sa = child_sa;
this->lock->unlock(this->lock); this->lock->unlock(this->lock);
result = TRUE;
} }
if (found) if (found)
{ {
@@ -343,11 +342,11 @@ METHOD(trap_manager_t, install, uint32_t,
this->installing--; this->installing--;
this->condvar->signal(this->condvar); this->condvar->signal(this->condvar);
this->lock->unlock(this->lock); this->lock->unlock(this->lock);
return reqid; return result;
} }
METHOD(trap_manager_t, uninstall, bool, METHOD(trap_manager_t, uninstall, bool,
private_trap_manager_t *this, uint32_t reqid) private_trap_manager_t *this, char *peer, char *child)
{ {
enumerator_t *enumerator; enumerator_t *enumerator;
entry_t *entry, *found = NULL; entry_t *entry, *found = NULL;
@@ -356,8 +355,8 @@ METHOD(trap_manager_t, uninstall, bool,
enumerator = this->traps->create_enumerator(this->traps); enumerator = this->traps->create_enumerator(this->traps);
while (enumerator->enumerate(enumerator, &entry)) while (enumerator->enumerate(enumerator, &entry))
{ {
if (entry->child_sa && if (streq(entry->name, child) &&
entry->child_sa->get_reqid(entry->child_sa) == reqid) (!peer || streq(peer, entry->peer_cfg->get_name(entry->peer_cfg))))
{ {
this->traps->remove_at(this->traps, enumerator); this->traps->remove_at(this->traps, enumerator);
found = entry; found = entry;
@@ -369,7 +368,6 @@ METHOD(trap_manager_t, uninstall, bool,
if (!found) if (!found)
{ {
DBG1(DBG_CFG, "trap %d not found to uninstall", reqid);
return FALSE; return FALSE;
} }
destroy_entry(found); destroy_entry(found);
@@ -413,31 +411,6 @@ METHOD(trap_manager_t, create_enumerator, enumerator_t*,
(void*)this->lock->unlock); (void*)this->lock->unlock);
} }
METHOD(trap_manager_t, find_reqid, uint32_t,
private_trap_manager_t *this, child_cfg_t *child)
{
enumerator_t *enumerator;
entry_t *entry;
uint32_t reqid = 0;
this->lock->read_lock(this->lock);
enumerator = this->traps->create_enumerator(this->traps);
while (enumerator->enumerate(enumerator, &entry))
{
if (streq(entry->name, child->get_name(child)))
{
if (entry->child_sa)
{
reqid = entry->child_sa->get_reqid(entry->child_sa);
}
break;
}
}
enumerator->destroy(enumerator);
this->lock->unlock(this->lock);
return reqid;
}
METHOD(trap_manager_t, acquire, void, METHOD(trap_manager_t, acquire, void,
private_trap_manager_t *this, uint32_t reqid, private_trap_manager_t *this, uint32_t reqid,
traffic_selector_t *src, traffic_selector_t *dst) traffic_selector_t *src, traffic_selector_t *dst)
@@ -693,7 +666,6 @@ trap_manager_t *trap_manager_create(void)
.install = _install, .install = _install,
.uninstall = _uninstall, .uninstall = _uninstall,
.create_enumerator = _create_enumerator, .create_enumerator = _create_enumerator,
.find_reqid = _find_reqid,
.acquire = _acquire, .acquire = _acquire,
.flush = _flush, .flush = _flush,
.destroy = _destroy, .destroy = _destroy,
src/libcharon/sa/trap_manager.h
+10 -15
View File
@@ -1,6 +1,7 @@
/* /*
* Copyright (C) 2013-2017 Tobias Brunner
* Copyright (C) 2009 Martin Willi * Copyright (C) 2009 Martin Willi
* Hochschule fuer Technik Rapperswil * HSR Hochschule fuer Technik Rapperswil
* *
* This program is free software; you can redistribute it and/or modify it * This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the * under the terms of the GNU General Public License as published by the
@@ -37,19 +38,21 @@ struct trap_manager_t {
* *
* @param peer peer configuration to initiate on trap * @param peer peer configuration to initiate on trap
* @param child child configuration to install as a trap * @param child child configuration to install as a trap
* @param reqid optional reqid to use * @return TRUE if successfully installed
* @return reqid of installed CHILD_SA, 0 if failed
*/ */
uint32_t (*install)(trap_manager_t *this, peer_cfg_t *peer, bool (*install)(trap_manager_t *this, peer_cfg_t *peer, child_cfg_t *child);
child_cfg_t *child, uint32_t reqid);
/** /**
* Uninstall a trap policy. * Uninstall a trap policy.
* *
* @param id reqid of CHILD_SA to uninstall, returned by install() * If no peer configuration name is given the first matching child
* configuration is uninstalled.
*
* @param peer peer configuration name or NULL
* @param child child configuration name
* @return TRUE if uninstalled successfully * @return TRUE if uninstalled successfully
*/ */
bool (*uninstall)(trap_manager_t *this, uint32_t reqid); bool (*uninstall)(trap_manager_t *this, char *peer, char *child);
/** /**
* Create an enumerator over all installed traps. * Create an enumerator over all installed traps.
@@ -58,14 +61,6 @@ struct trap_manager_t {
*/ */
enumerator_t* (*create_enumerator)(trap_manager_t *this); enumerator_t* (*create_enumerator)(trap_manager_t *this);
/**
* Find the reqid of a child config installed as a trap.
*
* @param child CHILD_SA config to get the reqid for
* @return reqid of trap, 0 if not found
*/
uint32_t (*find_reqid)(trap_manager_t *this, child_cfg_t *child);
/** /**
* Acquire an SA triggered by an installed trap. * Acquire an SA triggered by an installed trap.
* *