denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

- works quite well now with ipsec.conf & ipsec starter

Browse Source
This commit is contained in:
Martin Willi
2006-03-20 15:43:26 +00:00
parent e8d25806f3
commit 87a217f9f1
22 changed files with 631 additions and 127 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Source/charon/sa/authenticator.c
+24 -4
View File
@@ -206,9 +206,9 @@ static status_t verify_auth_data (private_authenticator_t *this,
status = charon->credentials->get_shared_secret(charon->credentials,
other_id,
&preshared_secret);
other_id->destroy(other_id);
if (status != SUCCESS)
{
other_id->destroy(other_id);
return status;
}
@@ -218,20 +218,26 @@ static status_t verify_auth_data (private_authenticator_t *this,
other_id_payload,
initiator,
preshared_secret);
allocator_free_chunk(&preshared_secret);
if (auth_data.len != my_auth_data.len)
{
allocator_free_chunk(&my_auth_data);
return FAILED;
status = FAILED;
}
if (memcmp(auth_data.ptr,my_auth_data.ptr, my_auth_data.len) == 0)
else if (memcmp(auth_data.ptr,my_auth_data.ptr, my_auth_data.len) == 0)
{
this->logger->log(this->logger, CONTROL, "Authentication of %s with preshared secret successful",
other_id->get_string(other_id));
status = SUCCESS;
}
else
{
this->logger->log(this->logger, CONTROL, "Authentication of %s with preshared secret failed",
other_id->get_string(other_id));
status = FAILED;
}
other_id->destroy(other_id);
allocator_free_chunk(&my_auth_data);
return status;
}
@@ -247,16 +253,28 @@ static status_t verify_auth_data (private_authenticator_t *this,
status = charon->credentials->get_rsa_public_key(charon->credentials,
other_id,
&public_key);
other_id->destroy(other_id);
if (status != SUCCESS)
{
other_id->destroy(other_id);
return status;
}
octets = this->allocate_octets(this,last_received_packet, my_nonce,other_id_payload, initiator);
status = public_key->verify_emsa_pkcs1_signature(public_key, octets, auth_data);
if (status == SUCCESS)
{
this->logger->log(this->logger, CONTROL, "Authentication of %s with RSA successful",
other_id->get_string(other_id));
}
else
{
this->logger->log(this->logger, CONTROL, "Authentication of %s with RSA failed",
other_id->get_string(other_id));
}
public_key->destroy(public_key);
other_id->destroy(other_id);
allocator_free_chunk(&octets);
return status;
}
@@ -300,6 +318,7 @@ static status_t compute_auth_data (private_authenticator_t *this,
auth_data = this->build_preshared_secret_signature(this, last_sent_packet, other_nonce,
my_id_payload, initiator, preshared_secret);
allocator_free_chunk(&preshared_secret);
*auth_payload = auth_payload_create();
(*auth_payload)->set_auth_method(*auth_payload, SHARED_KEY_MESSAGE_INTEGRITY_CODE);
(*auth_payload)->set_data(*auth_payload, auth_data);
@@ -334,6 +353,7 @@ static status_t compute_auth_data (private_authenticator_t *this,
(*auth_payload)->set_auth_method(*auth_payload, RSA_DIGITAL_SIGNATURE);
(*auth_payload)->set_data(*auth_payload, auth_data);
private_key->destroy(private_key);
allocator_free_chunk(&auth_data);
return SUCCESS;
}
Source/charon/sa/ike_sa.c
+22 -14
View File
@@ -210,8 +210,8 @@ static status_t process_message (private_ike_sa_t *this, message_t *message)
is_request = message->get_request(message);
exchange_type = message->get_exchange_type(message);
this->logger->log(this->logger, CONTROL, "Process %s message of exchange type %s",
(is_request) ? "REQUEST" : "RESPONSE",mapping_find(exchange_type_m,exchange_type));
this->logger->log(this->logger, CONTROL|LEVEL1, "Process %s of exchange type %s",
(is_request) ? "request" : "response",mapping_find(exchange_type_m,exchange_type));
message_id = message->get_message_id(message);
@@ -966,53 +966,61 @@ static void destroy (private_ike_sa_t *this)
/* inform other peer of delete */
send_delete_ike_sa_request(this);
while (this->child_sas->remove_last(this->child_sas, (void**)&child_sa) == SUCCESS)
{
child_sa->destroy(child_sa);
}
this->child_sas->destroy(this->child_sas);
if (this->crypter_initiator != NULL)
if (this->crypter_initiator)
{
this->crypter_initiator->destroy(this->crypter_initiator);
}
if (this->crypter_responder != NULL)
if (this->crypter_responder)
{
this->crypter_responder->destroy(this->crypter_responder);
}
if (this->signer_initiator != NULL)
if (this->signer_initiator)
{
this->signer_initiator->destroy(this->signer_initiator);
}
if (this->signer_responder != NULL)
if (this->signer_responder)
{
this->signer_responder->destroy(this->signer_responder);
}
if (this->prf != NULL)
if (this->prf)
{
this->prf->destroy(this->prf);
}
if (this->child_prf != NULL)
if (this->child_prf)
{
this->child_prf->destroy(this->child_prf);
}
if (this->prf_auth_i != NULL)
if (this->prf_auth_i)
{
this->prf_auth_i->destroy(this->prf_auth_i);
}
if (this->prf_auth_r != NULL)
if (this->prf_auth_r)
{
this->prf_auth_r->destroy(this->prf_auth_r);
}
this->ike_sa_id->destroy(this->ike_sa_id);
if (this->last_requested_message != NULL)
if (this->connection)
{
this->connection->destroy(this->connection);
}
if (this->policy)
{
this->policy->destroy(this->policy);
}
if (this->last_requested_message)
{
this->last_requested_message->destroy(this->last_requested_message);
}
if (this->last_responded_message != NULL)
if (this->last_responded_message)
{
this->last_responded_message->destroy(this->last_responded_message);
}
this->ike_sa_id->destroy(this->ike_sa_id);
this->randomizer->destroy(this->randomizer);
this->current_state->destroy(this->current_state);
charon->logger_manager->destroy_logger(charon->logger_manager, this->logger);
Source/charon/sa/states/ike_auth_requested.c
+7 -6
View File
@@ -352,16 +352,17 @@ static status_t process_message(private_ike_auth_requested_t *this, message_t *i
}
this->ike_sa->set_last_replied_message_id(this->ike_sa,ike_auth_reply->get_message_id(ike_auth_reply));
/* create new state */
this->ike_sa->set_new_state(this->ike_sa, (state_t*)ike_sa_established_create(this->ike_sa));
this->destroy_after_state_change(this);
connection = this->ike_sa->get_connection(this->ike_sa);
my_host = connection->get_my_host(connection);
other_host = connection->get_other_host(connection);
this->logger->log(this->logger, AUDIT, "IKE_SA established between %s - %s, authenticated peer with %s",
my_host->get_address(my_host), other_host->get_address(other_host),
mapping_find(auth_method_m, auth_payload->get_auth_method(auth_payload)));
this->ike_sa->set_new_state(this->ike_sa, (state_t*)ike_sa_established_create(this->ike_sa));
this->destroy_after_state_change(this);
this->logger->log(this->logger, AUDIT, "IKE_SA established between %s - %s",
my_host->get_address(my_host), other_host->get_address(other_host));
return SUCCESS;
}
Source/charon/sa/states/ike_sa_init_requested.c
+3
View File
@@ -215,6 +215,7 @@ static status_t process_message(private_ike_sa_init_requested_t *this, message_t
iterator_t *payloads;
host_t *me;
connection_t *connection;
policy_t *policy;
message_t *request;
status_t status;
@@ -344,6 +345,8 @@ static status_t process_message(private_ike_sa_init_requested_t *this, message_t
connection = this->ike_sa->get_connection(this->ike_sa);
me = ike_sa_init_reply->get_destination(ike_sa_init_reply);
connection->update_my_host(connection, me->clone(me));
policy = this->ike_sa->get_policy(this->ike_sa);
policy->update_my_ts(policy, me);
/* build empty message */
this->ike_sa->build_message(this->ike_sa, IKE_AUTH, TRUE, &request);
Source/charon/sa/states/ike_sa_init_responded.c
+13 -12
View File
@@ -247,10 +247,9 @@ static status_t process_message(private_ike_sa_init_responded_t *this, message_t
sa_request = (sa_payload_t*)payload;
break;
}
case TRAFFIC_SELECTOR_INITIATOR:
{
tsi_request = (ts_payload_t*)payload;
tsi_request = (ts_payload_t*)payload;
break;
}
case TRAFFIC_SELECTOR_RESPONDER:
@@ -360,16 +359,15 @@ static status_t process_message(private_ike_sa_init_responded_t *this, message_t
this->ike_sa->add_child_sa(this->ike_sa, this->child_sa);
}
/* create new state */
/* create new state */
this->ike_sa->set_new_state(this->ike_sa, (state_t*)ike_sa_established_create(this->ike_sa));
this->destroy_after_state_change(this);
connection = this->ike_sa->get_connection(this->ike_sa);
my_host = connection->get_my_host(connection);
other_host = connection->get_other_host(connection);
this->logger->log(this->logger, AUDIT, "IKE_SA established between %s - %s, authenticated peer with %s",
my_host->get_address(my_host), other_host->get_address(other_host),
mapping_find(auth_method_m, auth_request->get_auth_method(auth_request)));
this->ike_sa->set_new_state(this->ike_sa, (state_t*)ike_sa_established_create(this->ike_sa));
this->destroy_after_state_change(this);
this->logger->log(this->logger, AUDIT, "IKE_SA established between %s - %s",
my_host->get_address(my_host), other_host->get_address(other_host));
return SUCCESS;
}
@@ -396,13 +394,13 @@ static status_t build_idr_payload(private_ike_sa_init_responded_t *this, id_payl
{
if (my_id)
{
this->logger->log(this->logger, AUDIT, "IKE_AUTH request uses IDs %s to %s, which we have no policy for",
this->logger->log(this->logger, AUDIT, "We don't have a policy for IDs %s - %s. Deleting IKE_SA",
other_id->get_string(other_id),my_id->get_string(my_id));
my_id->destroy(my_id);
}
else
{
this->logger->log(this->logger, AUDIT, "IKE_AUTH request uses ID %s, which we have no policy for",
this->logger->log(this->logger, AUDIT, "We don't have a policy for remote ID %s. Deleting IKE_SA",
other_id->get_string(other_id));
}
other_id->destroy(other_id);
@@ -416,7 +414,10 @@ static status_t build_idr_payload(private_ike_sa_init_responded_t *this, id_payl
other_id->destroy(other_id);
/* get my id, if not requested */
my_id = this->policy->get_my_id(this->policy);
my_id = this->policy->get_my_id(this->policy);
/* update others traffic selectors with actually used address */
this->policy->update_other_ts(this->policy, response->get_destination(response));
/* set policy in ike_sa for other states */
this->ike_sa->set_policy(this->ike_sa, this->policy);