denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

error-notify: Handle missing alerts

Browse Source 
References strongswan/strongswan#876.
This commit is contained in:
Tobias Brunner
2022-02-15 15:23:37 +01:00
parent b47e9919f5
commit 801bb8536a
2 changed files with 86 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/error_notify/error_notify_listener.c
+74 -3
View File
@@ -47,6 +47,7 @@ METHOD(listener_t, alert, bool,
peer_cfg_t *peer_cfg;
certificate_t *cert;
time_t not_before, not_after;
int num;
if (!this->socket->has_listeners(this->socket))
{
@@ -64,13 +65,28 @@ METHOD(listener_t, alert, bool,
break;
case ALERT_LOCAL_AUTH_FAILED:
msg.type = htonl(ERROR_NOTIFY_LOCAL_AUTH_FAILED);
snprintf(msg.str, sizeof(msg.str),
"creating local authentication data failed");
snprintf(msg.str, sizeof(msg.str), "local authentication failed");
break;
case ALERT_PEER_AUTH_FAILED:
msg.type = htonl(ERROR_NOTIFY_PEER_AUTH_FAILED);
snprintf(msg.str, sizeof(msg.str), "peer authentication failed");
break;
case ALERT_PEER_ADDR_FAILED:
msg.type = htonl(ERROR_NOTIFY_PEER_ADDR_FAILED);
snprintf(msg.str, sizeof(msg.str), "failed to resolve peer address");
break;
case ALERT_PEER_INIT_UNREACHABLE:
msg.type = htonl(ERROR_NOTIFY_PEER_INIT_UNREACHABLE);
num = va_arg(args, int) + 1;
snprintf(msg.str, sizeof(msg.str), "peer did not respond to initial "
"message, try %d", num);
break;
case ALERT_INVALID_IKE_SPI:
msg.type = htonl(ERROR_NOTIFY_INVALID_IKE_SPI);
message = va_arg(args, message_t*);
snprintf(msg.str, sizeof(msg.str), "received IKE message with unknown "
"SPI from %#H", message->get_source(message));
break;
case ALERT_PARSE_ERROR_HEADER:
msg.type = htonl(ERROR_NOTIFY_PARSE_ERROR_HEADER);
message = va_arg(args, message_t*);
@@ -85,14 +101,27 @@ METHOD(listener_t, alert, bool,
break;
case ALERT_RETRANSMIT_SEND:
msg.type = htonl(ERROR_NOTIFY_RETRANSMIT_SEND);
va_arg(args, packet_t*);
snprintf(msg.str, sizeof(msg.str), "IKE message retransmission "
"number %u", va_arg(args, u_int));
break;
case ALERT_RETRANSMIT_SEND_CLEARED:
msg.type = htonl(ERROR_NOTIFY_RETRANSMIT_CLEARED);
snprintf(msg.str, sizeof(msg.str), "IKE response received after "
"retransmission");
break;
case ALERT_RETRANSMIT_SEND_TIMEOUT:
msg.type = htonl(ERROR_NOTIFY_RETRANSMIT_SEND_TIMEOUT);
snprintf(msg.str, sizeof(msg.str),
"IKE message retransmission timed out");
break;
case ALERT_RETRANSMIT_RECEIVE:
msg.type = htonl(ERROR_NOTIFY_RETRANSMIT_RECEIVE);
message = va_arg(args, message_t*);
snprintf(msg.str, sizeof(msg.str), "received retransmit of request "
"with ID %d from %#H", message->get_message_id(message),
message->get_source(message));
break;
case ALERT_HALF_OPEN_TIMEOUT:
msg.type = htonl(ERROR_NOTIFY_HALF_OPEN_TIMEOUT);
snprintf(msg.str, sizeof(msg.str), "IKE_SA timed out before it "
@@ -117,6 +146,13 @@ METHOD(listener_t, alert, bool,
snprintf(msg.str, sizeof(msg.str), "the received traffic selectors "
"did not match: %#R === %#R", list, list2);
break;
case ALERT_TS_NARROWED:
msg.type = htonl(ERROR_NOTIFY_TS_NARROWED);
num = va_arg(args, int);
list = va_arg(args, linked_list_t*);
snprintf(msg.str, sizeof(msg.str), "%s traffic selectors narrowed "
"to %#R", num ? "local" : "remote", list);
break;
case ALERT_INSTALL_CHILD_SA_FAILED:
msg.type = htonl(ERROR_NOTIFY_INSTALL_CHILD_SA_FAILED);
snprintf(msg.str, sizeof(msg.str), "installing IPsec SA failed");
@@ -135,6 +171,12 @@ METHOD(listener_t, alert, bool,
snprintf(msg.str, sizeof(msg.str), "keep existing in favor of "
"rejected new IKE_SA due to uniqueness policy");
break;
case ALERT_KEEP_ON_CHILD_SA_FAILURE:
msg.type = htonl(ERROR_NOTIFY_KEEP_ON_CHILD_SA_FAILURE);
num = va_arg(args, int);
snprintf(msg.str, sizeof(msg.str), "keeping IKE_SA after failing to "
"establish %sCHILD_SA", num ? "first " : "");
break;
case ALERT_VIP_FAILURE:
msg.type = htonl(ERROR_NOTIFY_VIP_FAILURE);
list = va_arg(args, linked_list_t*);
@@ -154,6 +196,11 @@ METHOD(listener_t, alert, bool,
snprintf(msg.str, sizeof(msg.str), "an authorization plugin "
"prevented establishment of an IKE_SA");
break;
case ALERT_IKE_SA_EXPIRED:
msg.type = htonl(ERROR_NOTIFY_IKE_SA_EXPIRED);
snprintf(msg.str, sizeof(msg.str), "IKE_SA expired without "
"replacement");
break;
case ALERT_CERT_EXPIRED:
msg.type = htonl(ERROR_NOTIFY_CERT_EXPIRED);
cert = va_arg(args, certificate_t*);
@@ -168,13 +215,37 @@ METHOD(listener_t, alert, bool,
snprintf(msg.str, sizeof(msg.str), "certificate revoked: '%Y'",
cert->get_subject(cert));
break;
case ALERT_CERT_VALIDATION_FAILED:
msg.type = htonl(ERROR_NOTIFY_CERT_VALIDATION_FAILED);
cert = va_arg(args, certificate_t*);
snprintf(msg.str, sizeof(msg.str), "failed to validate certificate "
"status: '%Y'", cert->get_subject(cert));
break;
case ALERT_CERT_NO_ISSUER:
msg.type = htonl(ERROR_NOTIFY_NO_ISSUER_CERT);
cert = va_arg(args, certificate_t*);
snprintf(msg.str, sizeof(msg.str), "no trusted issuer certificate "
"found: '%Y'", cert->get_issuer(cert));
break;
default:
case ALERT_CERT_UNTRUSTED_ROOT:
msg.type = htonl(ERROR_NOTIFY_UNTRUSTED_ROOT_CERT);
cert = va_arg(args, certificate_t*);
snprintf(msg.str, sizeof(msg.str), "self-signed issuer certificate "
"is not trusted: '%Y'", cert->get_issuer(cert));
break;
case ALERT_CERT_EXCEEDED_PATH_LEN:
msg.type = htonl(ERROR_NOTIFY_CERT_EXCEEDED_PATH_LEN);
cert = va_arg(args, certificate_t*);
snprintf(msg.str, sizeof(msg.str), "maximum path length in trust "
"chain exceeded: '%Y'", cert->get_issuer(cert));
break;
case ALERT_CERT_POLICY_VIOLATION:
msg.type = htonl(ERROR_NOTIFY_CERT_POLICY_VIOLATION);
cert = va_arg(args, certificate_t*);
snprintf(msg.str, sizeof(msg.str), "certificate rejected because of "
"policy violation: '%Y'", cert->get_issuer(cert));
break;
case ALERT_SHUTDOWN_SIGNAL:
return TRUE;
}
src/libcharon/plugins/error_notify/error_notify_msg.h
+12
View File
@@ -49,6 +49,18 @@ enum {
ERROR_NOTIFY_CERT_REVOKED = 18,
ERROR_NOTIFY_NO_ISSUER_CERT = 19,
ERROR_NOTIFY_RETRANSMIT_SEND = 20,
ERROR_NOTIFY_RETRANSMIT_CLEARED = 21,
ERROR_NOTIFY_RETRANSMIT_RECEIVE = 22,
ERROR_NOTIFY_PEER_ADDR_FAILED = 23,
ERROR_NOTIFY_PEER_INIT_UNREACHABLE = 24,
ERROR_NOTIFY_INVALID_IKE_SPI = 25,
ERROR_NOTIFY_TS_NARROWED = 26,
ERROR_NOTIFY_KEEP_ON_CHILD_SA_FAILURE = 27,
ERROR_NOTIFY_IKE_SA_EXPIRED = 28,
ERROR_NOTIFY_CERT_VALIDATION_FAILED = 29,
ERROR_NOTIFY_UNTRUSTED_ROOT_CERT = 30,
ERROR_NOTIFY_CERT_EXCEEDED_PATH_LEN = 31,
ERROR_NOTIFY_CERT_POLICY_VIOLATION = 32,
};
/**