denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

improved signal handling and emitting

Browse Source
This commit is contained in:
Martin Willi
2006-10-26 09:46:56 +00:00
parent 80d35dd6d3
commit b83806d83d
46 changed files with 939 additions and 834 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/charon/config/connections/connection.h
+2 -2
View File
@@ -36,7 +36,7 @@ typedef enum cert_policy_t cert_policy_t;
/**
* Certificate sending policy. This is also used for certificate
* requests when using this definition for the other peer. If
* it is CERT_NEVER_SEND, a certreq is ommited, otherwise its
* it is CERT_NEVER_SEND, a certreq is omitted, otherwise its
* included.
*
* @ingroup config
@@ -173,7 +173,7 @@ struct connection_t {
*
* A certificate request contains serials of our trusted CA certificates.
* This flag says if such a request is sent on connection setup to
* the peer. It should be ommited when CERT_SEND_NEVER, sended otherwise.
* the peer. It should be omitted when CERT_SEND_NEVER, sended otherwise.
*
* @param this calling object
* @return certificate request sending policy
src/charon/config/connections/local_connection_store.c
+3 -3
View File
@@ -69,7 +69,7 @@ static connection_t *get_connection_by_hosts(private_local_connection_store_t *t
connection_t *candidate;
connection_t *found = NULL;
DBG2(SIG_DBG_CFG, "looking for connection for host pair %H...%H",
DBG2(DBG_CFG, "looking for connection for host pair %H...%H",
my_host, other_host);
pthread_mutex_lock(&(this->mutex));
@@ -98,7 +98,7 @@ static connection_t *get_connection_by_hosts(private_local_connection_store_t *t
prio |= PRIO_ADDR_ANY;
}
DBG2(SIG_DBG_CFG, "candidate connection \"%s\": %H...%H (prio=%d)",
DBG2(DBG_CFG, "candidate connection \"%s\": %H...%H (prio=%d)",
candidate->get_name(candidate),
candidate_my_host, candidate_other_host, prio);
@@ -116,7 +116,7 @@ static connection_t *get_connection_by_hosts(private_local_connection_store_t *t
host_t *found_my_host = found->get_my_host(found);
host_t *found_other_host = found->get_other_host(found);
DBG2(SIG_DBG_CFG, "found matching connection \"%s\": %H...%H (prio=%d)",
DBG2(DBG_CFG, "found matching connection \"%s\": %H...%H (prio=%d)",
found->get_name(found), found_my_host, found_other_host, best_prio);
/* give out a new reference to it */
src/charon/config/credentials/local_credential_store.c
+46 -46
View File
@@ -256,19 +256,19 @@ static rsa_public_key_t *get_trusted_public_key(private_local_credential_store_t
ugh = cert->is_valid(cert, NULL);
if (ugh != NULL)
{
DBG1(SIG_DBG_CFG, "certificate %s", ugh);
DBG1(DBG_CFG, "certificate %s", ugh);
return NULL;
}
status = cert->get_status(cert);
if (status == CERT_REVOKED || status == CERT_UNTRUSTED || (this->strict && status != CERT_GOOD))
{
DBG1(SIG_DBG_CFG, "certificate status: %N", cert_status_names, status);
DBG1(DBG_CFG, "certificate status: %N", cert_status_names, status);
return NULL;
}
if (status == CERT_GOOD && cert->get_until(cert) < time(NULL))
{
DBG1(SIG_DBG_CFG, "certificate is good but crl is stale");
DBG1(DBG_CFG, "certificate is good but crl is stale");
return NULL;
}
@@ -379,20 +379,20 @@ static cert_status_t verify_by_crl(private_local_credential_store_t* this, const
crl = get_crl(this, issuer_cert);
if (crl == NULL)
{
DBG1(SIG_DBG_CFG, "crl not found");
DBG1(DBG_CFG, "crl not found");
goto err;
}
DBG2(SIG_DBG_CFG, "crl found");
DBG2(DBG_CFG, "crl found");
issuer_public_key = issuer_cert->get_public_key(issuer_cert);
valid_signature = crl->verify(crl, issuer_public_key);
if (!valid_signature)
{
DBG1(SIG_DBG_CFG, "crl signature is invalid");
DBG1(DBG_CFG, "crl signature is invalid");
goto err;
}
DBG2(SIG_DBG_CFG, "crl signature is valid");
DBG2(DBG_CFG, "crl signature is valid");
crl->get_status(crl, certinfo);
@@ -447,7 +447,7 @@ static bool verify(private_local_credential_store_t *this, x509_t *cert, bool *f
*found = (cert_copy != NULL);
if (*found)
{
DBG2(SIG_DBG_CFG,
DBG2(DBG_CFG,
"end entitity certificate is already in credential store");
}
@@ -461,39 +461,39 @@ static bool verify(private_local_credential_store_t *this, x509_t *cert, bool *f
identification_t *subject = cert->get_subject(cert);
identification_t *issuer = cert->get_issuer(cert);
DBG2(SIG_DBG_CFG, "subject: '%D'", subject);
DBG2(SIG_DBG_CFG, "issuer: '%D'", issuer);
DBG2(DBG_CFG, "subject: '%D'", subject);
DBG2(DBG_CFG, "issuer: '%D'", issuer);
ugh = cert->is_valid(cert, &until);
if (ugh != NULL)
{
DBG1(SIG_DBG_CFG, "certificate %s", ugh);
DBG1(DBG_CFG, "certificate %s", ugh);
return FALSE;
}
DBG2(SIG_DBG_CFG, "certificate is valid");
DBG2(DBG_CFG, "certificate is valid");
issuer_cert = get_issuer_certificate(this, cert);
if (issuer_cert == NULL)
{
DBG1(SIG_DBG_CFG, "issuer certificate not found");
DBG1(DBG_CFG, "issuer certificate not found");
return FALSE;
}
DBG2(SIG_DBG_CFG, "issuer certificate found");
DBG2(DBG_CFG, "issuer certificate found");
issuer_public_key = issuer_cert->get_public_key(issuer_cert);
valid_signature = cert->verify(cert, issuer_public_key);
if (!valid_signature)
{
DBG1(SIG_DBG_CFG, "certificate signature is invalid");
DBG1(DBG_CFG, "certificate signature is invalid");
return FALSE;
}
DBG2(SIG_DBG_CFG, "certificate signature is valid");
DBG2(DBG_CFG, "certificate signature is valid");
/* check if cert is a self-signed root ca */
if (pathlen > 0 && cert->is_self_signed(cert))
{
DBG2(SIG_DBG_CFG, "reached self-signed root ca");
DBG2(DBG_CFG, "reached self-signed root ca");
/* set the definite status and trust interval of the end entity certificate */
end_cert->set_until(end_cert, until);
@@ -533,10 +533,10 @@ static bool verify(private_local_credential_store_t *this, x509_t *cert, bool *f
/* if status information is stale */
if (this->strict && nextUpdate < time(NULL))
{
DBG2(SIG_DBG_CFG, "certificate is good but status is stale");
DBG2(DBG_CFG, "certificate is good but status is stale");
return FALSE;
}
DBG2(SIG_DBG_CFG, "certificate is good");
DBG2(DBG_CFG, "certificate is good");
/* with strict crl policy the public key must have the same
* lifetime as the validity of the ocsp status or crl lifetime
@@ -547,7 +547,7 @@ static bool verify(private_local_credential_store_t *this, x509_t *cert, bool *f
case CERT_REVOKED:
{
time_t revocationTime = certinfo->get_revocationTime(certinfo);
DBG1(SIG_DBG_CFG,
DBG1(DBG_CFG,
"certificate was revoked on %T, reason: %N",
revocationTime, crl_reason_names,
certinfo->get_revocationReason(certinfo));
@@ -574,7 +574,7 @@ static bool verify(private_local_credential_store_t *this, x509_t *cert, bool *f
case CERT_UNKNOWN:
case CERT_UNDEFINED:
default:
DBG2(SIG_DBG_CFG, "certificate status unknown");
DBG2(DBG_CFG, "certificate status unknown");
if (this->strict)
{
/* update status of end certificate in the credential store */
@@ -591,7 +591,7 @@ static bool verify(private_local_credential_store_t *this, x509_t *cert, bool *f
/* go up one step in the trust chain */
cert = issuer_cert;
}
DBG1(SIG_DBG_CFG, "maximum ca path length of %d levels exceeded", MAX_CA_PATH_LEN);
DBG1(DBG_CFG, "maximum ca path length of %d levels exceeded", MAX_CA_PATH_LEN);
return FALSE;
}
@@ -664,12 +664,12 @@ static void load_ca_certificates(private_local_credential_store_t *this)
DIR* dir;
x509_t *cert;
DBG1(SIG_DBG_CFG, "loading ca certificates from '%s/'", CA_CERTIFICATE_DIR);
DBG1(DBG_CFG, "loading ca certificates from '%s/'", CA_CERTIFICATE_DIR);
dir = opendir(CA_CERTIFICATE_DIR);
if (dir == NULL)
{
DBG1(SIG_DBG_CFG, "error opening ca certs directory %s'", CA_CERTIFICATE_DIR);
DBG1(DBG_CFG, "error opening ca certs directory %s'", CA_CERTIFICATE_DIR);
return;
}
@@ -693,7 +693,7 @@ static void load_ca_certificates(private_local_credential_store_t *this)
if (ugh != NULL)
{
DBG1(SIG_DBG_CFG, "warning: ca certificate %s", ugh);
DBG1(DBG_CFG, "warning: ca certificate %s", ugh);
}
if (cert->is_ca(cert))
{
@@ -701,7 +701,7 @@ static void load_ca_certificates(private_local_credential_store_t *this)
}
else
{
DBG1(SIG_DBG_CFG, " CA basic constraints flag not set, cert discarded");
DBG1(DBG_CFG, " CA basic constraints flag not set, cert discarded");
cert->destroy(cert);
}
}
@@ -734,13 +734,13 @@ static crl_t* add_crl(linked_list_t *crls, crl_t *crl)
{
old_crl->destroy(old_crl);
}
DBG2(SIG_DBG_CFG, " thisUpdate is newer - existing crl replaced");
DBG2(DBG_CFG, " thisUpdate is newer - existing crl replaced");
}
else
{
crl->destroy(crl);
crl = current_crl;
DBG2(SIG_DBG_CFG, " thisUpdate is not newer - existing crl retained");
DBG2(DBG_CFG, " thisUpdate is not newer - existing crl retained");
}
break;
}
@@ -750,7 +750,7 @@ static crl_t* add_crl(linked_list_t *crls, crl_t *crl)
if (!found)
{
crls->insert_last(crls, (void*)crl);
DBG2(SIG_DBG_CFG, " crl added");
DBG2(DBG_CFG, " crl added");
}
return crl;
}
@@ -765,12 +765,12 @@ static void load_crls(private_local_credential_store_t *this)
DIR* dir;
crl_t *crl;
DBG1(SIG_DBG_CFG, "loading crls from '%s/'", CRL_DIR);
DBG1(DBG_CFG, "loading crls from '%s/'", CRL_DIR);
dir = opendir(CRL_DIR);
if (dir == NULL)
{
DBG1(SIG_DBG_CFG, "error opening crl directory %s'", CRL_DIR);
DBG1(DBG_CFG, "error opening crl directory %s'", CRL_DIR);
return;
}
@@ -794,7 +794,7 @@ static void load_crls(private_local_credential_store_t *this)
if (ugh != NULL)
{
DBG1(SIG_DBG_CFG, "warning: crl %s", ugh);
DBG1(DBG_CFG, "warning: crl %s", ugh);
}
pthread_mutex_lock(&(this->crls_mutex));
crl = add_crl(this->crls, crl);
@@ -874,7 +874,7 @@ static void load_secrets(private_local_credential_store_t *this)
int line_nr = 0;
chunk_t chunk, src, line;
DBG1(SIG_DBG_CFG, "loading secrets from \"%s\"", SECRETS_FILE);
DBG1(DBG_CFG, "loading secrets from \"%s\"", SECRETS_FILE);
fseek(fd, 0, SEEK_END);
chunk.len = ftell(fd);
@@ -897,7 +897,7 @@ static void load_secrets(private_local_credential_store_t *this)
}
if (!extract_token(&ids, ':', &line))
{
DBG1(SIG_DBG_CFG, "line %d: missing ':' separator", line_nr);
DBG1(DBG_CFG, "line %d: missing ':' separator", line_nr);
goto error;
}
/* NULL terminate the ids string by replacing the : separator */
@@ -905,7 +905,7 @@ static void load_secrets(private_local_credential_store_t *this)
if (!eat_whitespace(&line) || !extract_token(&token, ' ', &line))
{
DBG1(SIG_DBG_CFG, "line %d: missing token", line_nr);
DBG1(DBG_CFG, "line %d: missing token", line_nr);
goto error;
}
if (match("RSA", &token))
@@ -923,12 +923,12 @@ static void load_secrets(private_local_credential_store_t *this)
if (ugh != NULL)
{
DBG1(SIG_DBG_CFG, "line %d: %s", line_nr, ugh);
DBG1(DBG_CFG, "line %d: %s", line_nr, ugh);
goto error;
}
if (filename.len == 0)
{
DBG1(SIG_DBG_CFG, "line %d: empty filename", line_nr);
DBG1(DBG_CFG, "line %d: empty filename", line_nr);
goto error;
}
if (*filename.ptr == '/')
@@ -949,7 +949,7 @@ static void load_secrets(private_local_credential_store_t *this)
ugh = extract_secret(&secret, &line);
if (ugh != NULL)
{
DBG1(SIG_DBG_CFG, "line %d: malformed passphrase: %s", line_nr, ugh);
DBG1(DBG_CFG, "line %d: malformed passphrase: %s", line_nr, ugh);
goto error;
}
if (secret.len > 0)
@@ -971,20 +971,20 @@ static void load_secrets(private_local_credential_store_t *this)
err_t ugh = extract_secret(&secret, &line);
if (ugh != NULL)
{
DBG1(SIG_DBG_CFG, "line %d: malformed secret: %s", line_nr, ugh);
DBG1(DBG_CFG, "line %d: malformed secret: %s", line_nr, ugh);
goto error;
}
if (ids.len > 0)
{
DBG1(SIG_DBG_CFG, " loading shared key for %s", ids.ptr);
DBG1(DBG_CFG, " loading shared key for %s", ids.ptr);
}
else
{
DBG1(SIG_DBG_CFG, " loading shared key for %%any");
DBG1(DBG_CFG, " loading shared key for %%any");
}
DBG4(SIG_DBG_CFG, " secret:", secret);
DBG4(DBG_CFG, " secret:", secret);
shared_key = shared_key_create(secret);
if (shared_key)
@@ -999,7 +999,7 @@ static void load_secrets(private_local_credential_store_t *this)
ugh = extract_value(&id, &ids);
if (ugh != NULL)
{
DBG1(SIG_DBG_CFG, "line %d: %s", line_nr, ugh);
DBG1(DBG_CFG, "line %d: %s", line_nr, ugh);
goto error;
}
if (id.len == 0)
@@ -1013,7 +1013,7 @@ static void load_secrets(private_local_credential_store_t *this)
peer_id = identification_create_from_string(id.ptr);
if (peer_id == NULL)
{
DBG1(SIG_DBG_CFG, "line %d: malformed ID: %s", line_nr, id.ptr);
DBG1(DBG_CFG, "line %d: malformed ID: %s", line_nr, id.ptr);
goto error;
}
@@ -1031,7 +1031,7 @@ static void load_secrets(private_local_credential_store_t *this)
}
else
{
DBG1(SIG_DBG_CFG, "line %d: token must be either "
DBG1(DBG_CFG, "line %d: token must be either "
"RSA, PSK, or PIN", line_nr, token.len);
goto error;
}
@@ -1041,7 +1041,7 @@ error:
}
else
{
DBG1(SIG_DBG_CFG, "could not open file '%s'", SECRETS_FILE);
DBG1(DBG_CFG, "could not open file '%s'", SECRETS_FILE);
}
}
src/charon/config/policies/local_policy_store.c
+5 -5
View File
@@ -106,7 +106,7 @@ static policy_t *get_policy(private_local_policy_store_t *this,
policy_t *candidate;
policy_t *found = NULL;
DBG2(SIG_DBG_CFG, "searching policy for ID pair %D...%D", my_id, other_id);
DBG2(DBG_CFG, "searching policy for ID pair %D...%D", my_id, other_id);
pthread_mutex_lock(&(this->mutex));
iterator = this->policies->create_iterator(this->policies, TRUE);
@@ -136,12 +136,12 @@ static policy_t *get_policy(private_local_policy_store_t *this,
if (!contains_traffic_selectors(candidate, TRUE, my_ts, my_host) ||
!contains_traffic_selectors(candidate, FALSE, other_ts, other_host))
{
DBG2(SIG_DBG_CFG, "candidate '%s' inacceptable due traffic "
DBG2(DBG_CFG, "candidate '%s' inacceptable due traffic "
"selector mismatch", candidate->get_name(candidate));
continue;
}
DBG2(SIG_DBG_CFG, "candidate policy '%s': %D...%D (prio=%d)",
DBG2(DBG_CFG, "candidate policy '%s': %D...%D (prio=%d)",
candidate->get_name(candidate),
candidate_my_id, candidate_other_id, prio);
@@ -159,7 +159,7 @@ static policy_t *get_policy(private_local_policy_store_t *this,
identification_t *found_my_id = found->get_my_id(found);
identification_t *found_other_id = found->get_other_id(found);
DBG1(SIG_DBG_CFG, "found matching policy '%s': %D...%D (prio=%d)",
DBG1(DBG_CFG, "found matching policy '%s': %D...%D (prio=%d)",
found->get_name(found), found_my_id, found_other_id, best_prio);
/* give out a new reference to it */
found->get_ref(found);
@@ -176,7 +176,7 @@ static policy_t *get_policy_by_name(private_local_policy_store_t *this, char *na
iterator_t *iterator;
policy_t *current, *found = NULL;
DBG2(SIG_DBG_CFG, "looking for policy '%s'", name);
DBG2(DBG_CFG, "looking for policy '%s'", name);
pthread_mutex_lock(&(this->mutex));
iterator = this->policies->create_iterator(this->policies, TRUE);
src/charon/config/policies/policy.c
+3 -3
View File
@@ -223,7 +223,7 @@ static linked_list_t *select_traffic_selectors(private_policy_t *this,
traffic_selector_t *supplied_ts, *stored_ts, *selected_ts;
linked_list_t *selected = linked_list_create();
DBG2(SIG_DBG_CFG, "selecting traffic selectors");
DBG2(DBG_CFG, "selecting traffic selectors");
stored_iter = stored->create_iterator(stored, TRUE);
supplied_iter = supplied->create_iterator(supplied, TRUE);
@@ -240,7 +240,7 @@ static linked_list_t *select_traffic_selectors(private_policy_t *this,
/* iterate over all supplied traffic selectors */
while (supplied_iter->iterate(supplied_iter, (void**)&supplied_ts))
{
DBG2(SIG_DBG_CFG, "stored %R <=> %R received",
DBG2(DBG_CFG, "stored %R <=> %R received",
stored_ts, supplied_ts);
selected_ts = stored_ts->get_subset(stored_ts, supplied_ts);
@@ -249,7 +249,7 @@ static linked_list_t *select_traffic_selectors(private_policy_t *this,
/* got a match, add to list */
selected->insert_last(selected, (void*)selected_ts);
DBG2(SIG_DBG_CFG, "found traffic selector for %s: %R",
DBG2(DBG_CFG, "found traffic selector for %s: %R",
stored == this->my_ts ? "us" : "other", selected_ts);
}
}