denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

implemented reauthentication using the new reauth=yes|no parameter

Browse Source
This commit is contained in:
Martin Willi
2006-12-19 07:30:07 +00:00
parent 4986554f1a
commit 6fe03b0af0
20 changed files with 210 additions and 67 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/charon/config/connections/connection.c
+17 -2
View File
@@ -109,6 +109,11 @@ struct private_connection_t {
*/
u_int32_t hard_lifetime;
/**
* Use full reauthentication instead of rekeying
*/
bool reauth;
/**
* Time, which specifies the range of a random value
* substracted from soft_lifetime.
@@ -306,13 +311,21 @@ static u_int32_t get_soft_lifetime(private_connection_t *this)
}
/**
* Implementation of connection_t.get_hard_lifetime
* Implementation of connection_t.get_hard_lifetime.
*/
static u_int32_t get_hard_lifetime(private_connection_t *this)
{
return this->hard_lifetime;
}
/**
* Implementation of connection_t.get_reauth.
*/
static bool get_reauth(private_connection_t *this)
{
return this->reauth;
}
/**
* Implementation of connection_t.get_ref.
*/
@@ -343,7 +356,7 @@ connection_t * connection_create(char *name, bool ikev2,
cert_policy_t cert_policy,
cert_policy_t certreq_policy,
host_t *my_host, host_t *other_host,
u_int32_t dpd_delay,
u_int32_t dpd_delay, bool reauth,
u_int32_t retrans_sequences,
u_int32_t hard_lifetime,
u_int32_t soft_lifetime, u_int32_t jitter)
@@ -361,6 +374,7 @@ connection_t * connection_create(char *name, bool ikev2,
this->public.select_proposal = (proposal_t*(*)(connection_t*,linked_list_t*))select_proposal;
this->public.add_proposal = (void(*)(connection_t*, proposal_t*)) add_proposal;
this->public.get_dpd_delay = (u_int32_t(*)(connection_t*)) get_dpd_delay;
this->public.get_reauth = (bool(*)(connection_t*)) get_reauth;
this->public.get_retrans_seq = (u_int32_t(*)(connection_t*)) get_retrans_seq;
this->public.get_dh_group = (diffie_hellman_group_t(*)(connection_t*)) get_dh_group;
this->public.check_dh_group = (bool(*)(connection_t*,diffie_hellman_group_t)) check_dh_group;
@@ -378,6 +392,7 @@ connection_t * connection_create(char *name, bool ikev2,
this->my_host = my_host;
this->other_host = other_host;
this->dpd_delay = dpd_delay;
this->reauth = reauth;
this->retrans_sequences = retrans_sequences;
this->hard_lifetime = hard_lifetime;
this->soft_lifetime = soft_lifetime;
src/charon/config/connections/connection.h
+11 -1
View File
@@ -132,6 +132,14 @@ struct connection_t {
*/
u_int32_t (*get_dpd_delay) (connection_t *this);
/**
* @brief Should a full reauthentication be done instead of rekeying?
*
* @param this calling object
* @return TRUE to use full reauthentication
*/
bool (*get_reauth) (connection_t *this);
/**
* @brief Get the max number of retransmission sequences.
*
@@ -267,6 +275,7 @@ struct connection_t {
* @param my_host host_t representing local address
* @param other_host host_t representing remote address
* @param dpd_delay interval of DPD liveness checks
* @param reauth use full reauthentication instead of rekeying
* @param retrans_sequences number of retransmit sequences to use
* @param hard_lifetime lifetime before deleting an IKE_SA
* @param soft_lifetime lifetime before rekeying an IKE_SA
@@ -278,7 +287,8 @@ struct connection_t {
connection_t * connection_create(char *name, bool ikev2,
cert_policy_t cert_pol, cert_policy_t req_pol,
host_t *my_host, host_t *other_host,
u_int32_t dpd_delay, u_int32_t retrans_sequences,
u_int32_t dpd_delay, bool reauth,
u_int32_t retrans_sequences,
u_int32_t hard_lifetime, u_int32_t soft_lifetime,
u_int32_t jitter);
src/charon/queues/jobs/rekey_ike_sa_job.c
+25 -3
View File
@@ -40,6 +40,11 @@ struct private_rekey_ike_sa_job_t {
* ID of the IKE_SA to rekey
*/
ike_sa_id_t *ike_sa_id;
/**
* force reauthentication of the peer (full IKE_SA setup)
*/
bool reauth;
};
/**
@@ -56,6 +61,7 @@ static job_type_t get_type(private_rekey_ike_sa_job_t *this)
static status_t execute(private_rekey_ike_sa_job_t *this)
{
ike_sa_t *ike_sa;
status_t status;
ike_sa = charon->ike_sa_manager->checkout(charon->ike_sa_manager,
this->ike_sa_id);
@@ -64,9 +70,24 @@ static status_t execute(private_rekey_ike_sa_job_t *this)
DBG2(DBG_JOB, "IKE_SA %J to rekey not found", this->ike_sa_id);
return DESTROY_ME;
}
ike_sa->rekey(ike_sa);
charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
if (this->reauth)
{
status = ike_sa->reauth(ike_sa);
}
else
{
status = ike_sa->rekey(ike_sa);
}
if (status == DESTROY_ME)
{
charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager, ike_sa);
}
else
{
charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
}
return DESTROY_ME;
}
@@ -82,7 +103,7 @@ static void destroy(private_rekey_ike_sa_job_t *this)
/*
* Described in header
*/
rekey_ike_sa_job_t *rekey_ike_sa_job_create(ike_sa_id_t *ike_sa_id)
rekey_ike_sa_job_t *rekey_ike_sa_job_create(ike_sa_id_t *ike_sa_id, bool reauth)
{
private_rekey_ike_sa_job_t *this = malloc_thing(private_rekey_ike_sa_job_t);
@@ -93,6 +114,7 @@ rekey_ike_sa_job_t *rekey_ike_sa_job_create(ike_sa_id_t *ike_sa_id)
/* private variables */
this->ike_sa_id = ike_sa_id->clone(ike_sa_id);
this->reauth = reauth;
return &(this->public);
}
src/charon/queues/jobs/rekey_ike_sa_job.h
+2 -1
View File
@@ -50,10 +50,11 @@ struct rekey_ike_sa_job_t {
* @brief Creates a job of type REKEY_IKE_SA.
*
* @param ike_sa_id ID of the IKE_SA to rekey
* @param reauth TRUE to reauthenticate peer, FALSE for rekeying only
* @return rekey_ike_sa_job_t object
*
* @ingroup jobs
*/
rekey_ike_sa_job_t *rekey_ike_sa_job_create(ike_sa_id_t *ike_sa_id);
rekey_ike_sa_job_t *rekey_ike_sa_job_create(ike_sa_id_t *ike_sa_id, bool reauth);
#endif /* REKEY_IKE_SA_JOB_H_ */
src/charon/sa/ike_sa.c
+107 -55
View File
@@ -1730,7 +1730,7 @@ static status_t destroy_child_sa(private_ike_sa_t *this, protocol_id_t protocol,
/**
* Implementation of ike_sa_t.set_lifetimes.
*/
static void set_lifetimes(private_ike_sa_t *this,
static void set_lifetimes(private_ike_sa_t *this, bool reauth,
u_int32_t soft_lifetime, u_int32_t hard_lifetime)
{
job_t *job;
@@ -1738,7 +1738,7 @@ static void set_lifetimes(private_ike_sa_t *this,
if (soft_lifetime)
{
this->time.rekey = this->time.established + soft_lifetime;
job = (job_t*)rekey_ike_sa_job_create(this->ike_sa_id);
job = (job_t*)rekey_ike_sa_job_create(this->ike_sa_id, reauth);
charon->event_queue->add_relative(charon->event_queue, job,
soft_lifetime * 1000);
}
@@ -1752,58 +1752,6 @@ static void set_lifetimes(private_ike_sa_t *this,
}
}
/**
* Implementation of ike_sa_t.rekey.
*/
static status_t rekey(private_ike_sa_t *this)
{
rekey_ike_sa_t *rekey_ike_sa;
DBG1(DBG_IKE, "rekeying IKE_SA between %H[%D]..%H[%D]",
this->my_host, this->my_id, this->other_host, this->other_id);
if (this->state != IKE_ESTABLISHED)
{
SIG(IKE_REKEY_START, "rekeying IKE_SA");
SIG(IKE_REKEY_FAILED, "unable to rekey IKE_SA in state %N",
ike_sa_state_names, this->state);
return FAILED;
}
rekey_ike_sa = rekey_ike_sa_create(&this->public);
return queue_transaction(this, (transaction_t*)rekey_ike_sa, FALSE);
}
/**
* Implementation of ike_sa_t.get_rekeying_transaction.
*/
static transaction_t* get_rekeying_transaction(private_ike_sa_t *this)
{
return this->rekeying_transaction;
}
/**
* Implementation of ike_sa_t.set_rekeying_transaction.
*/
static void set_rekeying_transaction(private_ike_sa_t *this, transaction_t *rekey)
{
this->rekeying_transaction = rekey;
}
/**
* Implementation of ike_sa_t.adopt_children.
*/
static void adopt_children(private_ike_sa_t *this, private_ike_sa_t *other)
{
child_sa_t *child_sa;
while (other->child_sas->remove_last(other->child_sas,
(void**)&child_sa) == SUCCESS)
{
this->child_sas->insert_first(this->child_sas, (void*)child_sa);
}
}
/**
* Implementation of public_ike_sa_t.delete.
*/
@@ -1842,6 +1790,109 @@ static status_t delete_(private_ike_sa_t *this)
}
}
/**
* Implementation of ike_sa_t.rekey.
*/
static status_t rekey(private_ike_sa_t *this)
{
rekey_ike_sa_t *rekey_ike_sa;
DBG1(DBG_IKE, "rekeying IKE_SA between %H[%D]..%H[%D]",
this->my_host, this->my_id, this->other_host, this->other_id);
if (this->state != IKE_ESTABLISHED)
{
SIG(IKE_REKEY_START, "rekeying IKE_SA");
SIG(IKE_REKEY_FAILED, "unable to rekey IKE_SA in state %N",
ike_sa_state_names, this->state);
return FAILED;
}
rekey_ike_sa = rekey_ike_sa_create(&this->public);
return queue_transaction(this, (transaction_t*)rekey_ike_sa, FALSE);
}
/**
* Implementation of ike_sa_t.reauth.
*/
static status_t reauth(private_ike_sa_t *this)
{
connection_t *connection;
child_sa_t *child_sa;
iterator_t *iterator;
DBG1(DBG_IKE, "reauthenticating IKE_SA between %H[%D]..%H[%D]",
this->my_host, this->my_id, this->other_host, this->other_id);
/* get a connection to initiate */
connection = charon->connections->get_connection_by_hosts(charon->connections,
this->my_host, this->other_host);
if (connection == NULL)
{
DBG1(DBG_IKE, "no connection found to reauthenticate");
return FAILED;
}
/* queue CREATE_CHILD_SA transactions to set up all CHILD_SAs */
iterator = this->child_sas->create_iterator(this->child_sas, TRUE);
while (iterator->iterate(iterator, (void**)&child_sa))
{
job_t *job;
policy_t *policy;
linked_list_t *my_ts, *other_ts;
my_ts = child_sa->get_my_traffic_selectors(child_sa);
other_ts = child_sa->get_other_traffic_selectors(child_sa);
policy = charon->policies->get_policy(charon->policies,
this->my_id, this->other_id, my_ts, other_ts,
this->my_host, this->other_host, NULL);
if (policy == NULL)
{
DBG1(DBG_IKE, "policy not found to recreate CHILD_SA, skipped");
continue;
}
connection->get_ref(connection);
job = (job_t*)initiate_job_create(connection, policy);
charon->job_queue->add(charon->job_queue, job);
}
iterator->destroy(iterator);
connection->destroy(connection);
/* delete the old IKE_SA
* TODO: we should delay the delete to avoid connectivity gaps?! */
return delete_(this);
}
/**
* Implementation of ike_sa_t.get_rekeying_transaction.
*/
static transaction_t* get_rekeying_transaction(private_ike_sa_t *this)
{
return this->rekeying_transaction;
}
/**
* Implementation of ike_sa_t.set_rekeying_transaction.
*/
static void set_rekeying_transaction(private_ike_sa_t *this, transaction_t *rekey)
{
this->rekeying_transaction = rekey;
}
/**
* Implementation of ike_sa_t.adopt_children.
*/
static void adopt_children(private_ike_sa_t *this, private_ike_sa_t *other)
{
child_sa_t *child_sa;
while (other->child_sas->remove_last(other->child_sas,
(void**)&child_sa) == SUCCESS)
{
this->child_sas->insert_first(this->child_sas, (void*)child_sa);
}
}
/**
* Implementation of ike_sa_t.get_next_message_id.
*/
@@ -1987,9 +2038,10 @@ ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id)
this->public.destroy_child_sa = (status_t (*)(ike_sa_t*,protocol_id_t,u_int32_t))destroy_child_sa;
this->public.enable_natt = (void(*)(ike_sa_t*, bool)) enable_natt;
this->public.is_natt_enabled = (bool(*)(ike_sa_t*)) is_natt_enabled;
this->public.set_lifetimes = (void(*)(ike_sa_t*,u_int32_t,u_int32_t))set_lifetimes;
this->public.set_lifetimes = (void(*)(ike_sa_t*,bool,u_int32_t,u_int32_t))set_lifetimes;
this->public.apply_connection = (void(*)(ike_sa_t*,connection_t*))apply_connection;
this->public.rekey = (status_t(*)(ike_sa_t*))rekey;
this->public.reauth = (status_t(*)(ike_sa_t*))reauth;
this->public.get_rekeying_transaction = (transaction_t*(*)(ike_sa_t*))get_rekeying_transaction;
this->public.set_rekeying_transaction = (void(*)(ike_sa_t*,transaction_t*))set_rekeying_transaction;
this->public.adopt_children = (void(*)(ike_sa_t*,ike_sa_t*))adopt_children;
src/charon/sa/ike_sa.h
+13 -1
View File
@@ -545,10 +545,11 @@ struct ike_sa_t {
* hard_lifetime is only reached when rekeying at soft_lifetime fails.
*
* @param this calling object
* @param reauth use full reauthentication instead of rekeying.
* @param soft_lifetime soft_lifetime
* @param hard_lifetime hard_lifetime
*/
void (*set_lifetimes) (ike_sa_t *this,
void (*set_lifetimes) (ike_sa_t *this, bool reauth,
u_int32_t soft_lifetime, u_int32_t hard_lifetime);
/**
@@ -561,6 +562,17 @@ struct ike_sa_t {
*/
status_t (*rekey) (ike_sa_t *this);
/**
* @brief Reauthentication the IKE_SA.
*
* Create a completely new IKE_SA with authentication, recreates all children
* within the IKE_SA and shuts the old SA down.
*
* @param this calling object
* @return - SUCCESS, if IKE_SA rekeying initiated
*/
status_t (*reauth) (ike_sa_t *this);
/**
* @brief Get the transaction which rekeys this IKE_SA.
*
src/charon/sa/ike_sa_manager.c
+6
View File
@@ -323,6 +323,12 @@ static ike_sa_t* checkout_by_id(private_ike_sa_manager_t *this,
continue;
}
if (entry->ike_sa->get_state(entry->ike_sa) == IKE_DELETING)
{
/* skip IKE_SA which are not useable */
continue;
}
found_my_id = entry->ike_sa->get_my_id(entry->ike_sa);
found_other_id = entry->ike_sa->get_other_id(entry->ike_sa);
found_my_host = entry->ike_sa->get_my_host(entry->ike_sa);
src/charon/sa/ike_sa_manager.h
+2 -1
View File
@@ -72,7 +72,8 @@ struct ike_sa_manager_t {
* Allows the lookup of an IKE_SA by user IDs and hosts. It returns the
* first found occurence, if there are multiple candidates. Supplied IDs
* may contain wildcards, hosts may be %any.
* If no IKE_SA is found, a new one is created.
* If no IKE_SA is found, a new one is created. This is also the case when
* the found IKE_SA is in the DELETING state.
*
* @param this the manager object
* @param my_host address of our host
src/charon/sa/transactions/ike_sa_init.c
+3 -1
View File
@@ -790,7 +790,8 @@ static status_t get_response(private_ike_sa_init_t *this,
return DESTROY_ME;
}
this->ike_sa->set_lifetimes(this->ike_sa,
this->ike_sa->set_lifetimes(this->ike_sa,
this->connection->get_reauth(this->connection),
this->connection->get_soft_lifetime(this->connection),
this->connection->get_hard_lifetime(this->connection));
@@ -1030,6 +1031,7 @@ static status_t conclude(private_ike_sa_init_t *this, message_t *response,
}
this->ike_sa->set_lifetimes(this->ike_sa,
this->connection->get_reauth(this->connection),
this->connection->get_soft_lifetime(this->connection),
this->connection->get_hard_lifetime(this->connection));
src/charon/sa/transactions/rekey_ike_sa.c
+1
View File
@@ -366,6 +366,7 @@ static status_t switchto_new_sa(private_rekey_ike_sa_t* this, bool initiator)
this->new_sa->apply_connection(this->new_sa, this->connection);
this->new_sa->set_state(this->new_sa, IKE_ESTABLISHED);
this->new_sa->set_lifetimes(this->new_sa,
this->connection->get_reauth(this->connection),
this->connection->get_soft_lifetime(this->connection),
this->connection->get_hard_lifetime(this->connection));
return SUCCESS;
src/charon/threads/stroke_interface.c
+1
View File
@@ -347,6 +347,7 @@ static void stroke_add_conn(private_stroke_t *this, stroke_msg_t *msg)
msg->add_conn.other.sendcert,
my_host, other_host,
msg->add_conn.dpd.delay,
msg->add_conn.rekey.reauth,
msg->add_conn.rekey.tries,
msg->add_conn.rekey.ike_lifetime,
msg->add_conn.rekey.ike_lifetime - msg->add_conn.rekey.margin,