denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

- policies contain a connections name now

Browse Source 
- used for initiate and delete
- connections won't get initiated twice anymore
- deleting of connections is now possible, which allows us to use
  ipsec update and ipsec reload
This commit is contained in:
Martin Willi
2006-05-29 11:09:45 +00:00
parent 4c59264d9b
commit 9fe14f4b8a
17 changed files with 483 additions and 326 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/charon/sa/ike_sa.c
+24 -12
View File
@@ -332,7 +332,7 @@ static host_t* get_other_host(private_ike_sa_t *this)
*/
static identification_t* get_my_id(private_ike_sa_t *this)
{
return this->connection->get_my_id(this->connection);;
return this->policy->get_my_id(this->policy);;
}
/**
@@ -340,7 +340,7 @@ static identification_t* get_my_id(private_ike_sa_t *this)
*/
static identification_t* get_other_id(private_ike_sa_t *this)
{
return this->connection->get_other_id(this->connection);;
return this->policy->get_other_id(this->policy);;
}
/**
@@ -919,7 +919,7 @@ static void log_status(private_ike_sa_t *this, logger_t *logger, char *name)
iterator_t *iterator;
child_sa_t *child_sa;
host_t *my_host, *other_host;
identification_t *my_id, *other_id;
identification_t *my_id = NULL, *other_id = NULL;
/* only log if name == NULL or name == connection_name */
if (name)
@@ -937,8 +937,11 @@ static void log_status(private_ike_sa_t *this, logger_t *logger, char *name)
my_host = this->connection->get_my_host(this->connection);
other_host = this->connection->get_other_host(this->connection);
my_id = this->connection->get_my_id(this->connection);
other_id = this->connection->get_other_id(this->connection);
if (this->policy)
{
my_id = this->policy->get_my_id(this->policy);
other_id = this->policy->get_other_id(this->policy);
}
if (logger == NULL)
{
@@ -952,9 +955,9 @@ static void log_status(private_ike_sa_t *this, logger_t *logger, char *name)
logger->log(logger, CONTROL, " \"%s\": %s[%s]...%s[%s]",
name,
my_host->get_address(my_host),
my_id->get_string(my_id),
my_id ? my_id->get_string(my_id) : "(unknown)",
other_host->get_address(other_host),
other_id->get_string(other_id));
other_id ? other_id->get_string(other_id) : "(unknown)");
iterator = this->child_sas->create_iterator(this->child_sas, TRUE);
while (iterator->has_next(iterator))
@@ -1067,12 +1070,21 @@ static void destroy(private_ike_sa_t *this)
}
if (this->connection)
{
host_t *me, *other;
me = this->connection->get_my_host(this->connection);
other = this->connection->get_other_host(this->connection);
host_t *my_host, *other_host;
identification_t *my_id = NULL, *other_id = NULL;
my_host = this->connection->get_my_host(this->connection);
other_host = this->connection->get_other_host(this->connection);
if (this->policy)
{
my_id = this->policy->get_my_id(this->policy);
other_id = this->policy->get_other_id(this->policy);
}
this->logger->log(this->logger, AUDIT, "IKE_SA deleted between %s - %s",
me->get_address(me), other->get_address(other));
this->logger->log(this->logger, AUDIT, "IKE_SA deleted between %s[%s]...%s[%s]",
my_host->get_address(my_host),
my_id ? my_id->get_string(my_id) : "(unknown)",
other_host->get_address(other_host),
other_id ? other_id->get_string(other_id) : "(unknown)");
this->connection->destroy(this->connection);
}
if (this->policy)
src/charon/sa/states/ike_auth_requested.c
+4 -5
View File
@@ -188,6 +188,7 @@ static status_t process_message(private_ike_auth_requested_t *this, message_t *i
chunk_t seed;
prf_plus_t *prf_plus;
connection_t *connection;
policy_t *policy;
if (ike_auth_reply->get_exchange_type(ike_auth_reply) != IKE_AUTH)
{
@@ -362,8 +363,9 @@ static status_t process_message(private_ike_auth_requested_t *this, message_t *i
connection = this->ike_sa->get_connection(this->ike_sa);
my_host = connection->get_my_host(connection);
other_host = connection->get_other_host(connection);
my_id = connection->get_my_id(connection);
other_id = connection->get_other_id(connection);
policy = this->ike_sa->get_policy(this->ike_sa);
my_id = policy->get_my_id(policy);
other_id = policy->get_other_id(policy);
this->logger->log(this->logger, AUDIT, "IKE_SA established %s[%s]...%s[%s]",
my_host->get_address(my_host), my_id->get_string(my_id),
other_host->get_address(other_host), other_id->get_string(other_id));
@@ -393,9 +395,6 @@ static status_t process_idr_payload(private_ike_auth_requested_t *this, id_paylo
return DESTROY_ME;
}
connection = this->ike_sa->get_connection(this->ike_sa);
connection->update_other_id(connection, other_id->clone(other_id));
this->policy->update_other_id(this->policy, other_id);
return SUCCESS;
}
src/charon/sa/states/ike_sa_init_responded.c
+8 -11
View File
@@ -185,6 +185,7 @@ static status_t process_message(private_ike_sa_init_responded_t *this, message_t
host_t *my_host, *other_host;
identification_t *my_id, *other_id;
connection_t *connection;
policy_t *policy;
if (request->get_exchange_type(request) != IKE_AUTH)
{
@@ -368,8 +369,9 @@ static status_t process_message(private_ike_sa_init_responded_t *this, message_t
connection = this->ike_sa->get_connection(this->ike_sa);
my_host = connection->get_my_host(connection);
other_host = connection->get_other_host(connection);
my_id = connection->get_my_id(connection);
other_id = connection->get_other_id(connection);
policy = this->ike_sa->get_policy(this->ike_sa);
my_id = policy->get_my_id(policy);
other_id = policy->get_other_id(policy);
this->logger->log(this->logger, AUDIT, "IKE_SA established %s[%s]...%s[%s]",
my_host->get_address(my_host), my_id->get_string(my_id),
other_host->get_address(other_host), other_id->get_string(other_id));
@@ -382,27 +384,22 @@ static status_t process_message(private_ike_sa_init_responded_t *this, message_t
*/
static status_t build_idr_payload(private_ike_sa_init_responded_t *this, id_payload_t *request_idi, id_payload_t *request_idr, message_t *response,id_payload_t **response_idr)
{
identification_t *other_id, *my_id = NULL;
connection_t *connection;
identification_t *other_id, *my_id;
id_payload_t *idr_response;
connection = this->ike_sa->get_connection(this->ike_sa);
/* update adresses, as connection may contain wildcards, or wrong IDs */
/* use others ID, an ours if peer requested one */
other_id = request_idi->get_identification(request_idi);
if (request_idr)
{
my_id = request_idr->get_identification(request_idr);
connection->update_my_id(connection, my_id);
}
else
{
my_id = connection->get_my_id(connection);
my_id = identification_create_from_encoding(ID_ANY, CHUNK_INITIALIZER);;
}
connection->update_other_id(connection, other_id);
/* build new sa config */
this->policy = charon->policies->get_policy(charon->policies, my_id, other_id);
this->policy = charon->policies->get_policy_by_ids(charon->policies, my_id, other_id);
if (this->policy == NULL)
{
this->logger->log(this->logger, AUDIT, "We don't have a policy for IDs %s - %s. Deleting IKE_SA",
src/charon/sa/states/initiator_init.c
+18 -16
View File
@@ -113,30 +113,32 @@ static status_t initiate_connection (private_initiator_init_t *this, connection_
diffie_hellman_group_t dh_group;
host_t *my_host, *other_host;
identification_t *my_id, *other_id;
char *name;
my_host = connection->get_my_host(connection);
other_host = connection->get_other_host(connection);
my_id = connection->get_my_id(connection);
other_id = connection->get_other_id(connection);
this->logger->log(this->logger, CONTROL, "initiating connection \"%s\": %s[%s]...%s[%s]",
connection->get_name(connection),
my_host->get_address(my_host),
my_id->get_string(my_id),
other_host->get_address(other_host),
other_id->get_string(other_id));
name = connection->get_name(connection);
this->ike_sa->set_connection(this->ike_sa, connection);
/* get policy */
policy = charon->policies->get_policy(charon->policies, my_id, other_id);
policy = charon->policies->get_policy_by_name(charon->policies, name);
if (policy == NULL)
{
this->logger->log(this->logger, ERROR | LEVEL1, "could not get a policy for '%s...%s', aborting",
my_id->get_string(my_id), other_id->get_string(other_id));
this->logger->log(this->logger, ERROR | LEVEL1,
"could not get a policy named '%s', aborting", name);
return DESTROY_ME;
}
this->ike_sa->set_policy(this->ike_sa,policy);
this->ike_sa->set_policy(this->ike_sa, policy);
my_host = connection->get_my_host(connection);
other_host = connection->get_other_host(connection);
my_id = policy->get_my_id(policy);
other_id = policy->get_other_id(policy);
this->logger->log(this->logger, CONTROL, "initiating connection \"%s\": %s[%s]...%s[%s]",
name,
my_host->get_address(my_host),
my_id->get_string(my_id),
other_host->get_address(other_host),
other_id->get_string(other_id));
/* we must guess now a DH group. For that we choose our most preferred group */
dh_group = connection->get_dh_group(connection);