denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

added XAUTH server and client support

Browse Source
This commit is contained in:
Andreas Steffen
2007-01-04 14:28:57 +00:00
parent ac048a8d2c
commit b4f3cd5ccf
13 changed files with 577 additions and 424 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/pluto/ipsec_doi.c
+26 -44
View File
@@ -79,15 +79,6 @@
#define SEND_PLUTO_VID 0
#endif /* !VENDORID */
/*
* are we sending an XAUTH VID (Cisco Mode Config Interoperability)?
*/
#ifdef XAUTH_VID
#define SEND_XAUTH_VID 1
#else /* !XAUTH_VID */
#define SEND_XAUTH_VID 0
#endif /* !XAUTH_VID */
/*
* are we sending a Cisco Unity VID?
*/
@@ -900,12 +891,12 @@ main_outI1(int whack_sock, struct connection *c, struct state *predecessor
/* determine how many Vendor ID payloads we will be sending */
if (SEND_PLUTO_VID)
vids_to_send++;
if (SEND_XAUTH_VID)
vids_to_send++;
if (SEND_CISCO_UNITY_VID)
vids_to_send++;
if (c->spd.this.cert.type == CERT_PGP)
vids_to_send++;
/* always send XAUTH Vendor ID */
vids_to_send++;
/* always send DPD Vendor ID */
vids_to_send++;
if (nat_traversal_enabled)
@@ -974,17 +965,6 @@ main_outI1(int whack_sock, struct connection *c, struct state *predecessor
}
}
/* if enabled send XAUTH Vendor ID */
if (SEND_XAUTH_VID)
{
if (!out_vendorid(vids_to_send-- ? ISAKMP_NEXT_VID : ISAKMP_NEXT_NONE
, &rbody, VID_MISC_XAUTH))
{
reset_cur_state();
return STF_INTERNAL_ERROR;
}
}
/* if enabled send Cisco Unity Vendor ID */
if (SEND_CISCO_UNITY_VID)
{
@@ -1008,6 +988,14 @@ main_outI1(int whack_sock, struct connection *c, struct state *predecessor
}
}
/* Announce our ability to do eXtended AUTHentication to the peer */
if (!out_vendorid(vids_to_send-- ? ISAKMP_NEXT_VID : ISAKMP_NEXT_NONE
, &rbody, VID_MISC_XAUTH))
{
reset_cur_state();
return STF_INTERNAL_ERROR;
}
/* Announce our ability to do Dead Peer Detection to the peer */
{
if (!out_vendorid(vids_to_send-- ? ISAKMP_NEXT_VID : ISAKMP_NEXT_NONE
@@ -3118,12 +3106,12 @@ main_inI1_outR1(struct msg_digest *md)
/* determine how many Vendor ID payloads we will be sending */
if (SEND_PLUTO_VID)
vids_to_send++;
if (SEND_XAUTH_VID)
vids_to_send++;
if (SEND_CISCO_UNITY_VID)
vids_to_send++;
if (md->openpgp)
vids_to_send++;
/* always send XAUTH Vendor ID */
vids_to_send++;
/* always send DPD Vendor ID */
vids_to_send++;
if (md->nat_traversal_vid && nat_traversal_enabled)
@@ -3167,16 +3155,6 @@ main_inI1_outR1(struct msg_digest *md)
}
}
/* if enabled send XAUTH Vendor ID */
if (SEND_XAUTH_VID)
{
if (!out_vendorid(vids_to_send-- ? ISAKMP_NEXT_VID : ISAKMP_NEXT_NONE
, &md->rbody, VID_MISC_XAUTH))
{
return STF_INTERNAL_ERROR;
}
}
/* if enabled send Cisco Unity Vendor ID */
if (SEND_CISCO_UNITY_VID)
{
@@ -3199,13 +3177,18 @@ main_inI1_outR1(struct msg_digest *md)
}
}
/* Announce our ability to do Dead Peer Detection to the peer */
/* Announce our ability to do eXtended AUTHentication to the peer */
if (!out_vendorid(vids_to_send-- ? ISAKMP_NEXT_VID : ISAKMP_NEXT_NONE
, &md->rbody, VID_MISC_XAUTH))
{
if (!out_vendorid(vids_to_send-- ? ISAKMP_NEXT_VID : ISAKMP_NEXT_NONE
, &md->rbody, VID_MISC_DPD))
{
return STF_INTERNAL_ERROR;
}
return STF_INTERNAL_ERROR;
}
/* Announce our ability to do Dead Peer Detection to the peer */
if (!out_vendorid(vids_to_send-- ? ISAKMP_NEXT_VID : ISAKMP_NEXT_NONE
, &md->rbody, VID_MISC_DPD))
{
return STF_INTERNAL_ERROR;
}
if (md->nat_traversal_vid && nat_traversal_enabled)
@@ -3486,8 +3469,6 @@ main_inR2_outI3(struct msg_digest *md)
{
struct state *const st = md->st;
pb_stream *const keyex_pbs = &md->chain[ISAKMP_NEXT_KE]->pbs;
int auth_payload = st->st_oakley.auth == OAKLEY_PRESHARED_KEY
? ISAKMP_NEXT_HASH : ISAKMP_NEXT_SIG;
pb_stream id_pbs; /* ID Payload; also used for hash calculation */
certpolicy_t cert_policy = st->st_connection->spd.this.sendcert;
@@ -3498,6 +3479,8 @@ main_inR2_outI3(struct msg_digest *md)
|| st->st_oakley.auth == XAUTHInitRSA
|| st->st_oakley.auth == XAUTHRespRSA;
int auth_payload = RSA_auth ? ISAKMP_NEXT_SIG : ISAKMP_NEXT_HASH;
/* KE in */
RETURN_STF_FAILURE(accept_KE(&st->st_gr, "Gr", st->st_oakley.group, keyex_pbs));
@@ -3960,8 +3943,7 @@ main_inI3_outR3_tail(struct msg_digest *md
*/
echo_hdr(md, TRUE, ISAKMP_NEXT_ID);
auth_payload = st->st_oakley.auth == OAKLEY_PRESHARED_KEY
? ISAKMP_NEXT_HASH : ISAKMP_NEXT_SIG;
auth_payload = RSA_auth ? ISAKMP_NEXT_SIG : ISAKMP_NEXT_HASH;
/* IDir out */
{