denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

added XAUTH server and client support

Browse Source
This commit is contained in:
Andreas Steffen
2006-12-19 22:51:48 +00:00
parent 0c409f097c
commit 86ae0969b4
12 changed files with 767 additions and 268 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/pluto/connections.c
+29 -15
View File
@@ -1043,10 +1043,10 @@ add_connection(const whack_message_t *wm)
c->sa_keying_tries = wm->sa_keying_tries;
/* RFC 3706 DPD */
c->dpd_delay = wm->dpd_delay;
c->dpd_timeout = wm->dpd_timeout;
c->dpd_action = wm->dpd_action;
c->dpd_delay = wm->dpd_delay;
c->dpd_timeout = wm->dpd_timeout;
c->dpd_action = wm->dpd_action;
c->addr_family = wm->addr_family;
c->tunnel_addr_family = wm->tunnel_addr_family;
@@ -3213,13 +3213,17 @@ find_host_connection(const ip_address *me, u_int16_t my_port
if (policy != LEMPTY)
{
lset_t auth_requested = policy & POLICY_ID_AUTH_MASK;
/* if we have requirements for the policy,
* choose the first matching connection.
*/
while (c != NULL)
{
if ((c->policy & policy) == policy)
break;
if (c->policy & auth_requested)
{
break;
}
c = c->hp_next;
}
}
@@ -3326,11 +3330,17 @@ refine_host_connection(const struct state *st, const struct id *peer_id
if (psk == NULL)
return NULL; /* cannot determine PSK! */
break;
case XAUTHInitPreShared:
case XAUTHRespPreShared:
auth_policy = POLICY_XAUTH_PSK;
break;
case OAKLEY_RSA_SIG:
auth_policy = POLICY_RSASIG;
break;
case XAUTHInitRSA:
case XAUTHRespRSA:
auth_policy = POLICY_XAUTH_RSASIG;
break;
default:
bad_case(auth);
}
@@ -3353,17 +3363,21 @@ refine_host_connection(const struct state *st, const struct id *peer_id
bool matching_id = match_id(peer_id
, &d->spd.that.id, &wildcards);
bool matching_auth = (d->policy & auth_policy) != LEMPTY;
bool matching_trust = trusted_ca(peer_ca
, d->spd.that.ca, &peer_pathlen);
bool matching_request = match_requested_ca(c->requested_ca
, d->spd.this.ca, &our_pathlen);
bool match = matching_id && matching_trust && matching_request;
bool match = matching_id && matching_auth &&
matching_trust && matching_request;
DBG(DBG_CONTROLMORE,
DBG_log("%s: %s match (id: %s, trust: %s, request: %s)"
DBG_log("%s: %s match (id: %s, auth: %s, trust: %s, request: %s)"
, d->name
, match ? "full":" no"
, match_name[matching_id]
, match_name[matching_auth]
, match_name[matching_trust]
, match_name[matching_request])
)
@@ -3382,13 +3396,11 @@ refine_host_connection(const struct state *st, const struct id *peer_id
continue;
}
/* authentication used must fit policy of this connection */
if ((d->policy & auth_policy) == LEMPTY)
continue; /* our auth isn't OK for this connection */
switch (auth)
{
case OAKLEY_PRESHARED_KEY:
case XAUTHInitPreShared:
case XAUTHRespPreShared:
/* secret must match the one we already used */
{
const chunk_t *dpsk = get_preshared_secret(d);
@@ -3404,6 +3416,8 @@ refine_host_connection(const struct state *st, const struct id *peer_id
break;
case OAKLEY_RSA_SIG:
case XAUTHInitRSA:
case XAUTHRespRSA:
/*
* We must at least be able to find our private key
.*/