denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

vici: Add options to only return specific CHILD_SAs in list-sas()

Browse Source
This commit is contained in:
Tobias Brunner
2022-04-14 18:42:01 +02:00
parent 994d9d37d4
commit b1c7fac768
2 changed files with 17 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/vici/README.md
+4 -2
View File
@@ -277,7 +277,7 @@ Terminates an SA while streaming _control-log_ events.
{ {
child = <terminate a CHILD_SA by configuration name> child = <terminate a CHILD_SA by configuration name>
ike = <terminate an IKE_SA by configuration name> ike = <terminate an IKE_SA by configuration name>
child-id = <terminate a CHILD_SA by its reqid> child-id = <terminate a CHILD_SA by its unique id>
ike-id = <terminate an IKE_SA by its unique id> ike-id = <terminate an IKE_SA by its unique id>
force = <terminate IKE_SA without waiting for proper DELETE, if timeout force = <terminate IKE_SA without waiting for proper DELETE, if timeout
is given, waits for a response until it is reached> is given, waits for a response until it is reached>
@@ -300,7 +300,7 @@ Initiate the rekeying of an SA.
{ {
child = <rekey a CHILD_SA by configuration name> child = <rekey a CHILD_SA by configuration name>
ike = <rekey an IKE_SA by configuration name> ike = <rekey an IKE_SA by configuration name>
child-id = <rekey a CHILD_SA by its reqid> child-id = <rekey a CHILD_SA by its unique id>
ike-id = <rekey an IKE_SA by its unique id> ike-id = <rekey an IKE_SA by its unique id>
reauth = <reauthenticate instead of rekey an IKEv2 SA> reauth = <reauthenticate instead of rekey an IKEv2 SA>
} => { } => {
@@ -361,6 +361,8 @@ events.
noblock = <use non-blocking mode if key is set> noblock = <use non-blocking mode if key is set>
ike = <filter listed IKE_SAs by its name> ike = <filter listed IKE_SAs by its name>
ike-id = <filter listed IKE_SA by its unique id> ike-id = <filter listed IKE_SA by its unique id>
child = <filter listed CHILD_SAs by name>
child-id = <filter listed CHILD_SAs by unique id>
} => { } => {
# completes after streaming list-sa events # completes after streaming list-sa events
} }
src/libcharon/plugins/vici/vici_query.c
+13 -3
View File
@@ -529,15 +529,16 @@ CALLBACK(list_sas, vici_message_t*,
ike_sa_t *ike_sa; ike_sa_t *ike_sa;
child_sa_t *child_sa; child_sa_t *child_sa;
time_t now; time_t now;
char *ike; char *ike, *child;
u_int ike_id; u_int ike_id, child_id;
bool bl; bool bl;
char buf[BUF_LEN]; char buf[BUF_LEN];
bl = request->get_str(request, NULL, "noblock") == NULL; bl = request->get_str(request, NULL, "noblock") == NULL;
ike = request->get_str(request, NULL, "ike"); ike = request->get_str(request, NULL, "ike");
ike_id = request->get_int(request, 0, "ike-id"); ike_id = request->get_int(request, 0, "ike-id");
child = request->get_str(request, NULL, "child");
child_id = request->get_int(request, 0, "child-id");
isas = charon->controller->create_ike_sa_enumerator(charon->controller, bl); isas = charon->controller->create_ike_sa_enumerator(charon->controller, bl);
while (isas->enumerate(isas, &ike_sa)) while (isas->enumerate(isas, &ike_sa))
@@ -562,6 +563,15 @@ CALLBACK(list_sas, vici_message_t*,
csas = ike_sa->create_child_sa_enumerator(ike_sa); csas = ike_sa->create_child_sa_enumerator(ike_sa);
while (csas->enumerate(csas, &child_sa)) while (csas->enumerate(csas, &child_sa))
{ {
if (child && !streq(child, child_sa->get_name(child_sa)))
{
continue;
}
if (child_id && child_sa->get_unique_id(child_sa) != child_id)
{
continue;
}
snprintf(buf, sizeof(buf), "%s-%u", child_sa->get_name(child_sa), snprintf(buf, sizeof(buf), "%s-%u", child_sa->get_name(child_sa),
child_sa->get_unique_id(child_sa)); child_sa->get_unique_id(child_sa));
b->begin_section(b, buf); b->begin_section(b, buf);