denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sql: Handle %any better when looking up shared secrets

Browse Source 
This can be the case for IKEv1 since 419ae9a20a ("ikev1: Default remote
identity to %any for PSK lookup if not configured").

Closes strongswan/strongswan#128.
This commit is contained in:
Tobias Brunner
2019-03-14 13:55:58 +01:00
parent 4f8c00e3ed
commit 6ec9f68f32
1 changed files with 16 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/sql/sql_cred.c
+16 -13
View File
@@ -1,5 +1,5 @@
/* /*
* Copyright (C) 2010 Tobias Brunner * Copyright (C) 2010-2019 Tobias Brunner
* Copyright (C) 2008 Martin Willi * Copyright (C) 2008 Martin Willi
* HSR Hochschule fuer Technik Rapperswil * HSR Hochschule fuer Technik Rapperswil
* *
@@ -221,10 +221,10 @@ typedef struct {
enumerator_t public; enumerator_t public;
/** inner SQL enumerator */ /** inner SQL enumerator */
enumerator_t *inner; enumerator_t *inner;
/** own identity */ /** own identity is defined */
identification_t *me; bool me_defined;
/** remote identity */ /** remote identity is defined */
identification_t *other; bool other_defined;
/** currently enumerated private key */ /** currently enumerated private key */
shared_key_t *current; shared_key_t *current;
} shared_enumerator_t; } shared_enumerator_t;
@@ -248,11 +248,11 @@ METHOD(enumerator_t, shared_enumerator_enumerate, bool,
*shared = this->current; *shared = this->current;
if (me) if (me)
{ {
*me = this->me ? ID_MATCH_PERFECT : ID_MATCH_ANY; *me = this->me_defined ? ID_MATCH_PERFECT : ID_MATCH_ANY;
} }
if (other) if (other)
{ {
*other = this->other ? ID_MATCH_PERFECT : ID_MATCH_ANY; *other = this->other_defined ? ID_MATCH_PERFECT : ID_MATCH_ANY;
} }
return TRUE; return TRUE;
} }
@@ -274,6 +274,10 @@ METHOD(credential_set_t, create_shared_enumerator, enumerator_t*,
identification_t *me, identification_t *other) identification_t *me, identification_t *other)
{ {
shared_enumerator_t *e; shared_enumerator_t *e;
bool me_defined, other_defined;
me_defined = me && me->get_type(me) != ID_ANY;
other_defined = other && other->get_type(other) != ID_ANY;
INIT(e, INIT(e,
.public = { .public = {
@@ -281,10 +285,10 @@ METHOD(credential_set_t, create_shared_enumerator, enumerator_t*,
.venumerate = _shared_enumerator_enumerate, .venumerate = _shared_enumerator_enumerate,
.destroy = _shared_enumerator_destroy, .destroy = _shared_enumerator_destroy,
}, },
.me = me, .me_defined = me_defined,
.other = other, .other_defined = other_defined,
); );
if (!me && !other) if (!me_defined && !other_defined)
{ {
e->inner = this->db->query(this->db, e->inner = this->db->query(this->db,
"SELECT s.type, s.data FROM shared_secrets AS s " "SELECT s.type, s.data FROM shared_secrets AS s "
@@ -292,7 +296,7 @@ METHOD(credential_set_t, create_shared_enumerator, enumerator_t*,
DB_INT, type == SHARED_ANY, DB_INT, type, DB_INT, type == SHARED_ANY, DB_INT, type,
DB_INT, DB_BLOB); DB_INT, DB_BLOB);
} }
else if (me && other) else if (me_defined && other_defined)
{ {
e->inner = this->db->query(this->db, e->inner = this->db->query(this->db,
"SELECT s.type, s.data FROM shared_secrets AS s " "SELECT s.type, s.data FROM shared_secrets AS s "
@@ -309,7 +313,7 @@ METHOD(credential_set_t, create_shared_enumerator, enumerator_t*,
} }
else else
{ {
identification_t *id = me ? me : other; identification_t *id = me_defined ? me : other;
e->inner = this->db->query(this->db, e->inner = this->db->query(this->db,
"SELECT s.type, s.data FROM shared_secrets AS s " "SELECT s.type, s.data FROM shared_secrets AS s "
@@ -469,4 +473,3 @@ sql_cred_t *sql_cred_create(database_t *db)
return &this->public; return &this->public;
} }