denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'ikev1-clean' into ikev1-master

Browse Source 
Conflicts:
	configure.in
	man/ipsec.conf.5.in
	src/libcharon/daemon.c
	src/libcharon/plugins/eap_ttls/eap_ttls_peer.c
	src/libcharon/plugins/eap_radius/eap_radius_accounting.c
	src/libcharon/plugins/eap_radius/eap_radius_forward.c
	src/libcharon/plugins/farp/farp_listener.c
	src/libcharon/sa/ike_sa.c
	src/libcharon/sa/keymat.c
	src/libcharon/sa/task_manager.c
	src/libcharon/sa/trap_manager.c
	src/libstrongswan/plugins/x509/x509_cert.c
	src/libstrongswan/utils.h

Applied lost changes of moved files keymat.c and task_manager.c.
Updated listener_t.message hook signature in new plugins.
This commit is contained in:
Martin Willi
2012-03-20 17:57:53 +01:00
parent 3cea55b0c8 d112a7e1fe
commit b1f2f05c92
295 changed files with 21948 additions and 5444 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/stroke/stroke_config.c
+19 -44
View File
@@ -266,7 +266,6 @@ static auth_cfg_t *build_auth_cfg(private_stroke_config_t *this,
char *auth, *id, *cert, *ca;
stroke_end_t *end, *other_end;
auth_cfg_t *cfg;
char eap_buf[32];
/* select strings */
if (local)
@@ -314,47 +313,7 @@ static auth_cfg_t *build_auth_cfg(private_stroke_config_t *this,
{
if (primary)
{
if (local)
{ /* "leftauth" not defined, fall back to deprecated "authby" */
switch (msg->add_conn.auth_method)
{
default:
case AUTH_CLASS_PUBKEY:
auth = "pubkey";
break;
case AUTH_CLASS_PSK:
auth = "psk";
break;
case AUTH_CLASS_EAP:
auth = "eap";
break;
case AUTH_CLASS_ANY:
auth = "any";
break;
}
}
else
{ /* "rightauth" not defined, fall back to deprecated "eap" */
if (msg->add_conn.eap_type)
{
if (msg->add_conn.eap_vendor)
{
snprintf(eap_buf, sizeof(eap_buf), "eap-%d-%d",
msg->add_conn.eap_type,
msg->add_conn.eap_vendor);
}
else
{
snprintf(eap_buf, sizeof(eap_buf), "eap-%d",
msg->add_conn.eap_type);
}
auth = eap_buf;
}
else
{ /* not EAP => no constraints for this peer */
auth = "any";
}
}
auth = "pubkey";
}
else
{ /* no second authentication round, fine. But load certificates
@@ -469,6 +428,22 @@ static auth_cfg_t *build_auth_cfg(private_stroke_config_t *this,
{
cfg->add(cfg, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PSK);
}
else if (strneq(auth, "xauth", 5))
{
char *pos;
pos = strchr(auth, '-');
if (pos)
{
cfg->add(cfg, AUTH_RULE_XAUTH_BACKEND, strdup(++pos));
}
cfg->add(cfg, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_XAUTH);
if (msg->add_conn.xauth_identity)
{
cfg->add(cfg, AUTH_RULE_XAUTH_IDENTITY,
identification_create_from_string(msg->add_conn.xauth_identity));
}
}
else if (strneq(auth, "eap", 3))
{
enumerator_t *enumerator;
@@ -670,10 +645,10 @@ static peer_cfg_t *build_peer_cfg(private_stroke_config_t *this,
* the pool name as the connection name, which the attribute provider
* uses to serve pool addresses. */
peer_cfg = peer_cfg_create(msg->add_conn.name,
msg->add_conn.ikev2 ? 2 : 1, ike_cfg,
msg->add_conn.version, ike_cfg,
msg->add_conn.me.sendcert, unique,
msg->add_conn.rekey.tries, rekey, reauth, jitter, over,
msg->add_conn.mobike, msg->add_conn.dpd.delay,
msg->add_conn.mobike, msg->add_conn.aggressive, msg->add_conn.dpd.delay,
vip, msg->add_conn.other.sourceip_mask ?
msg->add_conn.name : msg->add_conn.other.sourceip,
msg->add_conn.ikeme.mediation, mediated_by, peer_id);
src/libcharon/plugins/stroke/stroke_control.c
+4 -28
View File
@@ -126,14 +126,6 @@ METHOD(stroke_control_t, initiate, void,
msg->initiate.name);
if (peer_cfg)
{
if (peer_cfg->get_ike_version(peer_cfg) != 2)
{
DBG1(DBG_CFG, "ignoring initiation request for IKEv%d config",
peer_cfg->get_ike_version(peer_cfg));
peer_cfg->destroy(peer_cfg);
return;
}
child_cfg = get_child_from_peer(peer_cfg, msg->initiate.name);
if (child_cfg == NULL)
{
@@ -157,14 +149,10 @@ METHOD(stroke_control_t, initiate, void,
}
else
{
enumerator = charon->backends->create_peer_cfg_enumerator(charon->backends,
NULL, NULL, NULL, NULL);
enumerator = charon->backends->create_peer_cfg_enumerator(
charon->backends, NULL, NULL, NULL, NULL, IKE_ANY);
while (enumerator->enumerate(enumerator, &peer_cfg))
{
if (peer_cfg->get_ike_version(peer_cfg) != 2)
{
continue;
}
child_cfg = get_child_from_peer(peer_cfg, msg->initiate.name);
if (child_cfg)
{
@@ -568,14 +556,6 @@ METHOD(stroke_control_t, route, void,
msg->route.name);
if (peer_cfg)
{
if (peer_cfg->get_ike_version(peer_cfg) != 2)
{
DBG1(DBG_CFG, "ignoring initiation request for IKEv%d config",
peer_cfg->get_ike_version(peer_cfg));
peer_cfg->destroy(peer_cfg);
return;
}
child_cfg = get_child_from_peer(peer_cfg, msg->route.name);
if (child_cfg == NULL)
{
@@ -599,14 +579,10 @@ METHOD(stroke_control_t, route, void,
}
else
{
enumerator = charon->backends->create_peer_cfg_enumerator(charon->backends,
NULL, NULL, NULL, NULL);
enumerator = charon->backends->create_peer_cfg_enumerator(
charon->backends, NULL, NULL, NULL, NULL, IKE_ANY);
while (enumerator->enumerate(enumerator, &peer_cfg))
{
if (peer_cfg->get_ike_version(peer_cfg) != 2)
{
continue;
}
child_cfg = get_child_from_peer(peer_cfg, msg->route.name);
if (child_cfg)
{
src/libcharon/plugins/stroke/stroke_cred.c
+4 -4
View File
@@ -603,7 +603,7 @@ static bool load_pin(private_stroke_cred_t *this, chunk_t line, int line_nr,
pin_data.keyid = chunk;
pin_data.try = 1;
cb = callback_cred_create_shared((void*)pin_cb, &pin_data);
lib->credmgr->add_local_set(lib->credmgr, &cb->set);
lib->credmgr->add_local_set(lib->credmgr, &cb->set, FALSE);
}
else
{
@@ -612,7 +612,7 @@ static bool load_pin(private_stroke_cred_t *this, chunk_t line, int line_nr,
id = identification_create_from_encoding(ID_KEY_ID, chunk);
mem = mem_cred_create();
mem->add_shared(mem, shared, id, NULL);
lib->credmgr->add_local_set(lib->credmgr, &mem->set);
lib->credmgr->add_local_set(lib->credmgr, &mem->set, FALSE);
}
/* unlock: smartcard needs the pin and potentially calls public set */
@@ -720,7 +720,7 @@ static bool load_private(private_stroke_cred_t *this, chunk_t line, int line_nr,
pp_data.path = path;
pp_data.try = 1;
cb = callback_cred_create_shared((void*)passphrase_cb, &pp_data);
lib->credmgr->add_local_set(lib->credmgr, &cb->set);
lib->credmgr->add_local_set(lib->credmgr, &cb->set, FALSE);
key = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, key_type,
BUILD_FROM_FILE, path, BUILD_END);
@@ -737,7 +737,7 @@ static bool load_private(private_stroke_cred_t *this, chunk_t line, int line_nr,
shared = shared_key_create(SHARED_PRIVATE_KEY_PASS, secret);
mem = mem_cred_create();
mem->add_shared(mem, shared, NULL);
lib->credmgr->add_local_set(lib->credmgr, &mem->set);
lib->credmgr->add_local_set(lib->credmgr, &mem->set, FALSE);
key = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, key_type,
BUILD_FROM_FILE, path, BUILD_END);
src/libcharon/plugins/stroke/stroke_list.c
+26 -17
View File
@@ -118,8 +118,9 @@ static void log_ike_sa(FILE *out, ike_sa_t *ike_sa, bool all)
ike_proposal = ike_sa->get_proposal(ike_sa);
fprintf(out, "%12s[%d]: IKE SPIs: %.16"PRIx64"_i%s %.16"PRIx64"_r%s",
fprintf(out, "%12s[%d]: %N SPIs: %.16"PRIx64"_i%s %.16"PRIx64"_r%s",
ike_sa->get_name(ike_sa), ike_sa->get_unique_id(ike_sa),
ike_version_names, ike_sa->get_version(ike_sa),
id->get_initiator_spi(id), id->is_initiator(id) ? "*" : "",
id->get_responder_spi(id), id->is_initiator(id) ? "" : "*");
@@ -319,11 +320,7 @@ static void log_auth_cfgs(FILE *out, peer_cfg_t *peer_cfg, bool local)
auth->get(auth, AUTH_RULE_IDENTITY));
auth_class = (uintptr_t)auth->get(auth, AUTH_RULE_AUTH_CLASS);
if (auth_class != AUTH_CLASS_EAP)
{
fprintf(out, "%N authentication\n", auth_class_names, auth_class);
}
else
if (auth_class == AUTH_CLASS_EAP)
{
if ((uintptr_t)auth->get(auth, AUTH_RULE_EAP_TYPE) == EAP_NAK)
{
@@ -350,6 +347,21 @@ static void log_auth_cfgs(FILE *out, peer_cfg_t *peer_cfg, bool local)
}
fprintf(out, "\n");
}
else if (auth_class == AUTH_CLASS_XAUTH)
{
fprintf(out, "%N authentication: %s", auth_class_names, auth_class,
auth->get(auth, AUTH_RULE_XAUTH_BACKEND) ?: "any");
id = auth->get(auth, AUTH_RULE_XAUTH_IDENTITY);
if (id)
{
fprintf(out, " with XAuth identity '%Y'", id);
}
fprintf(out, "\n");
}
else
{
fprintf(out, "%N authentication\n", auth_class_names, auth_class);
}
cert = auth->get(auth, AUTH_RULE_CA_CERT);
if (cert)
@@ -479,18 +491,18 @@ METHOD(stroke_list_t, status, void,
fprintf(out, "Connections:\n");
enumerator = charon->backends->create_peer_cfg_enumerator(
charon->backends, NULL, NULL, NULL, NULL);
charon->backends, NULL, NULL, NULL, NULL, IKE_ANY);
while (enumerator->enumerate(enumerator, &peer_cfg))
{
if (peer_cfg->get_ike_version(peer_cfg) != 2 ||
(name && !streq(name, peer_cfg->get_name(peer_cfg))))
if (name && !streq(name, peer_cfg->get_name(peer_cfg)))
{
continue;
}
ike_cfg = peer_cfg->get_ike_cfg(peer_cfg);
fprintf(out, "%12s: %s...%s", peer_cfg->get_name(peer_cfg),
ike_cfg->get_my_addr(ike_cfg), ike_cfg->get_other_addr(ike_cfg));
fprintf(out, "%12s: %s...%s (%N)", peer_cfg->get_name(peer_cfg),
ike_cfg->get_my_addr(ike_cfg), ike_cfg->get_other_addr(ike_cfg),
ike_version_names, peer_cfg->get_ike_version(peer_cfg));
dpd = peer_cfg->get_dpd(peer_cfg);
if (dpd)
@@ -666,15 +678,12 @@ static void list_public_key(public_key_t *public, FILE *out)
private_key_t *private = NULL;
chunk_t keyid;
identification_t *id;
auth_cfg_t *auth;
if (public->get_fingerprint(public, KEYID_PUBKEY_SHA1, &keyid))
{
id = identification_create_from_encoding(ID_KEY_ID, keyid);
auth = auth_cfg_create();
private = lib->credmgr->get_private(lib->credmgr,
public->get_type(public), id, auth);
auth->destroy(auth);
public->get_type(public), id, NULL);
id->destroy(id);
}
@@ -782,8 +791,8 @@ static void stroke_list_certs(linked_list_t *list, char *label,
x509_flag_t flag_mask;
/* mask all auxiliary flags */
flag_mask = ~(X509_SERVER_AUTH | X509_CLIENT_AUTH |
X509_SELF_SIGNED | X509_IP_ADDR_BLOCKS );
flag_mask = ~(X509_SERVER_AUTH | X509_CLIENT_AUTH | X509_IKE_INTERMEDIATE |
X509_SELF_SIGNED | X509_IP_ADDR_BLOCKS);
enumerator = list->create_enumerator(list);
while (enumerator->enumerate(enumerator, (void**)&cert))
src/libcharon/plugins/stroke/stroke_socket.c
+3
View File
@@ -221,12 +221,14 @@ static void stroke_add_conn(private_stroke_socket_t *this, stroke_msg_t *msg)
pop_end(msg, "right", &msg->add_conn.other);
pop_string(msg, &msg->add_conn.eap_identity);
pop_string(msg, &msg->add_conn.aaa_identity);
pop_string(msg, &msg->add_conn.xauth_identity);
pop_string(msg, &msg->add_conn.algorithms.ike);
pop_string(msg, &msg->add_conn.algorithms.esp);
pop_string(msg, &msg->add_conn.ikeme.mediated_by);
pop_string(msg, &msg->add_conn.ikeme.peerid);
DBG2(DBG_CFG, " eap_identity=%s", msg->add_conn.eap_identity);
DBG2(DBG_CFG, " aaa_identity=%s", msg->add_conn.aaa_identity);
DBG2(DBG_CFG, " xauth_identity=%s", msg->add_conn.xauth_identity);
DBG2(DBG_CFG, " ike=%s", msg->add_conn.algorithms.ike);
DBG2(DBG_CFG, " esp=%s", msg->add_conn.algorithms.esp);
DBG2(DBG_CFG, " dpddelay=%d", msg->add_conn.dpd.delay);
@@ -235,6 +237,7 @@ static void stroke_add_conn(private_stroke_socket_t *this, stroke_msg_t *msg)
DBG2(DBG_CFG, " mediation=%s", msg->add_conn.ikeme.mediation ? "yes" : "no");
DBG2(DBG_CFG, " mediated_by=%s", msg->add_conn.ikeme.mediated_by);
DBG2(DBG_CFG, " me_peerid=%s", msg->add_conn.ikeme.peerid);
DBG2(DBG_CFG, " keyexchange=ikev%u", msg->add_conn.version);
this->config->add(this->config, msg);
this->attribute->add_pool(this->attribute, msg);