denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

use group membership to implement access/isolate redirection in filter-based TNC scenario

Browse Source
This commit is contained in:
Andreas Steffen
2010-10-05 20:40:36 +02:00
parent 48e16e0ae1
commit a1edf4d33e
1 changed files with 14 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/eap_radius/eap_radius.c
+14 -4
View File
@@ -221,13 +221,13 @@ static void process_class(private_eap_radius_t *this, radius_message_t *msg)
/**
* Handle the Filter-Id attribute as IPsec CHILD_SA name
*/
static void process_filter(private_eap_radius_t *this, radius_message_t *msg)
static void process_filter_id(private_eap_radius_t *this, radius_message_t *msg)
{
enumerator_t *enumerator;
chunk_t data, filter_id = chunk_empty;
int type;
u_int8_t tunnel_tag;
u_int32_t tunnel_type;
chunk_t filter_id = chunk_empty, data;
bool is_esp_tunnel = FALSE;
enumerator = msg->create_enumerator(msg);
@@ -260,7 +260,17 @@ static void process_filter(private_eap_radius_t *this, radius_message_t *msg)
if (is_esp_tunnel && filter_id.len)
{
/* TODO filter_id specifies name of CHILD_SA to be installed */
identification_t *id;
ike_sa_t *ike_sa;
auth_cfg_t *auth;
ike_sa = charon->bus->get_sa(charon->bus);
if (ike_sa)
{
auth = ike_sa->get_auth_cfg(ike_sa, FALSE);
id = identification_create_from_data(filter_id);
auth->add(auth, AUTH_RULE_GROUP, id);
}
}
}
@@ -302,7 +312,7 @@ METHOD(eap_method_t, process, status_t,
}
if (this->filter_id)
{
process_filter(this, response);
process_filter_id(this, response);
}
status = SUCCESS;
break;