denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

improved signal handling and emitting

Browse Source
This commit is contained in:
Martin Willi
2006-10-26 09:46:56 +00:00
parent 80d35dd6d3
commit b83806d83d
46 changed files with 939 additions and 834 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/charon/sa/authenticator.c
+17 -17
View File
@@ -130,11 +130,11 @@ static chunk_t build_shared_key_signature(private_authenticator_t *this,
this->prf->get_bytes(this->prf, key_pad, key_buffer);
this->prf->set_key(this->prf, key);
this->prf->allocate_bytes(this->prf, octets, &auth_data);
DBG3(SIG_DBG_IKE, "octets = message + nonce + prf(Sk_px, IDx') %B", &octets);
DBG3(SIG_DBG_IKE, "secret %B", &secret);
DBG3(SIG_DBG_IKE, "keypad %B", &key_pad);
DBG3(SIG_DBG_IKE, "prf(secret, keypad) %B", &key);
DBG3(SIG_DBG_IKE, "AUTH = prf(prf(secret, keypad), octets) %B", &auth_data);
DBG3(DBG_IKE, "octets = message + nonce + prf(Sk_px, IDx') %B", &octets);
DBG3(DBG_IKE, "secret %B", &secret);
DBG3(DBG_IKE, "keypad %B", &key_pad);
DBG3(DBG_IKE, "prf(secret, keypad) %B", &key);
DBG3(DBG_IKE, "AUTH = prf(prf(secret, keypad), octets) %B", &auth_data);
chunk_free(&octets);
return auth_data;
@@ -168,7 +168,7 @@ static status_t verify_auth_data (private_authenticator_t *this,
&shared_key);
if (status != SUCCESS)
{
DBG1(SIG_DBG_IKE, "no shared key found for '%D' - '%D'",
DBG1(DBG_IKE, "no shared key found for '%D' - '%D'",
my_id, other_id);
chunk_free(&shared_key);
break;
@@ -195,7 +195,7 @@ static status_t verify_auth_data (private_authenticator_t *this,
if (public_key == NULL)
{
DBG1(SIG_DBG_IKE, "no RSA public key found for '%D'", other_id);
DBG1(DBG_IKE, "no RSA public key found for '%D'", other_id);
status = NOT_FOUND;
break;
}
@@ -215,7 +215,7 @@ static status_t verify_auth_data (private_authenticator_t *this,
if (status == SUCCESS)
{
DBG1(SIG_DBG_IKE, "authentication of '%D' with %N successful",
DBG1(DBG_IKE, "authentication of '%D' with %N successful",
other_id, auth_method_names, auth_method);
}
@@ -233,7 +233,7 @@ static status_t compute_auth_data (private_authenticator_t *this,
identification_t *other_id,
bool initiator)
{
DBG1(SIG_DBG_IKE, "authentication of '%D' with %N (myself)",
DBG1(DBG_IKE, "authentication of '%D' with %N (myself)",
my_id, auth_method_names, this->auth_method);
switch (this->auth_method)
@@ -250,7 +250,7 @@ static status_t compute_auth_data (private_authenticator_t *this,
if (status != SUCCESS)
{
DBG1(SIG_DBG_IKE, "no shared key found for '%D' - '%D'",
DBG1(DBG_IKE, "no shared key found for '%D' - '%D'",
my_id, other_id);
return status;
}
@@ -276,28 +276,28 @@ static status_t compute_auth_data (private_authenticator_t *this,
rsa_public_key_t *my_pubkey;
rsa_private_key_t *my_key;
DBG2(SIG_DBG_IKE, "looking for RSA public key belonging to '%D'",
DBG2(DBG_IKE, "looking for RSA public key belonging to '%D'",
my_id);
my_pubkey = charon->credentials->get_rsa_public_key(charon->credentials, my_id);
if (my_pubkey == NULL)
{
DBG1(SIG_DBG_IKE, "no RSA public key found for '%D'", my_id);
DBG1(DBG_IKE, "no RSA public key found for '%D'", my_id);
return NOT_FOUND;
}
DBG2(SIG_DBG_IKE, "matching RSA public key found");
DBG2(DBG_IKE, "matching RSA public key found");
chunk = my_pubkey->get_keyid(my_pubkey);
DBG2(SIG_DBG_IKE, "looking for RSA private key with keyid %#B", &chunk);
DBG2(DBG_IKE, "looking for RSA private key with keyid %#B", &chunk);
my_key = charon->credentials->get_rsa_private_key(charon->credentials, my_pubkey);
if (my_key == NULL)
{
DBG1(SIG_DBG_IKE, "no RSA private key found with for %D with keyid %#B",
DBG1(DBG_IKE, "no RSA private key found with for %D with keyid %#B",
my_id, &chunk);
return NOT_FOUND;
}
DBG2(SIG_DBG_IKE, "matching RSA private key found");
DBG2(DBG_IKE, "matching RSA private key found");
octets = build_tbs_octets(this, last_sent_packet, other_nonce,
my_id, initiator);
@@ -310,7 +310,7 @@ static status_t compute_auth_data (private_authenticator_t *this,
my_key->destroy(my_key);
return status;
}
DBG2(SIG_DBG_IKE, "successfully signed with RSA private key");
DBG2(DBG_IKE, "successfully signed with RSA private key");
*auth_payload = auth_payload_create();
(*auth_payload)->set_auth_method(*auth_payload, RSA_DIGITAL_SIGNATURE);
src/charon/sa/child_sa.c
+10 -10
View File
@@ -327,7 +327,7 @@ static void updown(private_child_sa_t *this, bool up)
if (shell == NULL)
{
DBG1(SIG_DBG_CHD, "could not execute updown script '%s'", this->script);
DBG1(DBG_CHD, "could not execute updown script '%s'", this->script);
return;
}
@@ -339,7 +339,7 @@ static void updown(private_child_sa_t *this, bool up)
{
if (ferror(shell))
{
DBG1(SIG_DBG_CHD, "error reading output from updown script");
DBG1(DBG_CHD, "error reading output from updown script");
return;
}
else
@@ -354,7 +354,7 @@ static void updown(private_child_sa_t *this, bool up)
{ /* trim trailing '\n' */
e[-1] = '\0';
}
DBG1(SIG_DBG_CHD, "updown: %s", resp);
DBG1(DBG_CHD, "updown: %s", resp);
}
}
pclose(shell);
@@ -489,13 +489,13 @@ static status_t install(private_child_sa_t *this, proposal_t *proposal, prf_plus
dst = this->other.addr;
}
DBG2(SIG_DBG_CHD, "adding %s %N SA", mine ? "inbound" : "outbound",
DBG2(DBG_CHD, "adding %s %N SA", mine ? "inbound" : "outbound",
protocol_id_names, this->protocol);
/* select encryption algo */
if (proposal->get_algorithm(proposal, ENCRYPTION_ALGORITHM, &enc_algo))
{
DBG2(SIG_DBG_CHD, " using %N for encryption",
DBG2(DBG_CHD, " using %N for encryption",
encryption_algorithm_names, enc_algo->algorithm);
}
else
@@ -506,7 +506,7 @@ static status_t install(private_child_sa_t *this, proposal_t *proposal, prf_plus
/* select integrity algo */
if (proposal->get_algorithm(proposal, INTEGRITY_ALGORITHM, &int_algo))
{
DBG2(SIG_DBG_CHD, " using %N for integrity",
DBG2(DBG_CHD, " using %N for integrity",
integrity_algorithm_names, int_algo->algorithm);
}
else
@@ -528,7 +528,7 @@ static status_t install(private_child_sa_t *this, proposal_t *proposal, prf_plus
/* send SA down to the kernel */
DBG2(SIG_DBG_CHD, " SPI 0x%.8x, src %H dst %H", ntohl(spi), src, dst);
DBG2(DBG_CHD, " SPI 0x%.8x, src %H dst %H", ntohl(spi), src, dst);
status = charon->kernel_interface->add_sa(charon->kernel_interface,
src, dst,
spi, this->protocol,
@@ -621,7 +621,7 @@ static status_t add_policies(private_child_sa_t *this, linked_list_t *my_ts_list
if (my_ts->get_type(my_ts) != other_ts->get_type(other_ts))
{
DBG2(SIG_DBG_CHD,
DBG2(DBG_CHD,
"CHILD_SA policy uses two different IP families, ignored");
continue;
}
@@ -630,7 +630,7 @@ static status_t add_policies(private_child_sa_t *this, linked_list_t *my_ts_list
if (my_ts->get_protocol(my_ts) != other_ts->get_protocol(other_ts) &&
my_ts->get_protocol(my_ts) && other_ts->get_protocol(other_ts))
{
DBG2(SIG_DBG_CHD,
DBG2(DBG_CHD,
"CHILD_SA policy uses two different protocols, ignored");
continue;
}
@@ -908,7 +908,7 @@ static status_t update_sa_hosts(private_child_sa_t *this, host_t *new_me, host_t
spi = this->me.spi;
}
DBG2(SIG_DBG_CHD, "updating %N SA 0x%x, from %#H..#H to %#H..%#H",
DBG2(DBG_CHD, "updating %N SA 0x%x, from %#H..#H to %#H..%#H",
protocol_id_names, this->protocol, ntohl(spi), src, dst, new_src, new_dst);
status = charon->kernel_interface->update_sa(charon->kernel_interface,
src/charon/sa/ike_sa.c
+101 -86
View File
@@ -431,7 +431,6 @@ static void update_hosts(private_ike_sa_t *this, host_t *me, host_t *other)
*/
static void dpd_detected(private_ike_sa_t *this)
{
/* check for childrens with dpdaction=hold */
connection_t *connection = NULL;
policy_t *policy;
linked_list_t *my_ts, *other_ts;
@@ -439,10 +438,11 @@ static void dpd_detected(private_ike_sa_t *this)
dpd_action_t action;
job_t *job;
DBG2(SIG_DBG_IKE, "dead peer detected, handling CHILD_SAs dpd action");
DBG2(DBG_IKE, "dead peer detected, handling CHILD_SAs dpd action");
/* check for childrens with dpdaction = hold */
while(this->child_sas->remove_first(this->child_sas,
(void**)&child_sa) == SUCCESS)
(void**)&child_sa) == SUCCESS)
{
/* get the policy which belongs to this CHILD */
my_ts = child_sa->get_my_traffic_selectors(child_sa);
@@ -453,13 +453,13 @@ static void dpd_detected(private_ike_sa_t *this)
this->my_host, this->other_host);
if (policy == NULL)
{
SIG(SIG_CHILD_FAILED, "no policy for CHILD to handle DPD");
DBG1(DBG_IKE, "no policy for CHILD to handle DPD");
continue;
}
action = policy->get_dpd_action(policy);
/* get a connection for further actions */
if (connection == NULL &&
if (connection == NULL &&
(action == DPD_ROUTE || action == DPD_RESTART))
{
connection = charon->connections->get_connection_by_hosts(
@@ -467,12 +467,12 @@ static void dpd_detected(private_ike_sa_t *this)
this->my_host, this->other_host);
if (connection == NULL)
{
SIG(SIG_IKE_FAILED, "no connection found to handle DPD");
SIG(IKE_UP_FAILED, "no connection found to handle DPD");
break;
}
}
DBG1(SIG_DBG_IKE, "dpd action for %s is %N",
DBG1(DBG_IKE, "dpd action for %s is %N",
policy->get_name(policy), dpd_action_names, action);
switch (action)
@@ -516,8 +516,8 @@ static status_t transmit_request(private_ike_sa_t *this)
this->retrans_sequences);
if (timeout == 0)
{
SIG(SIG_IKE_FAILED, "giving up after %d retransmits, deleting IKE_SA",
transmitted - 1);
DBG1(DBG_IKE, "giving up after %d retransmits, deleting IKE_SA",
transmitted - 1);
dpd_detected(this);
return DESTROY_ME;
}
@@ -535,13 +535,13 @@ static status_t transmit_request(private_ike_sa_t *this)
status = request->generate(request, this->crypter_out, this->signer_out, &packet);
if (status != SUCCESS)
{
DBG1(SIG_DBG_IKE, "request generation failed. transaction discarded");
DBG1(DBG_IKE, "request generation failed. transaction discarded");
return FAILED;
}
}
else
{
DBG1(SIG_DBG_IKE, "sending retransmit %d for %N request with messageID %d",
DBG1(DBG_IKE, "sending retransmit %d for %N request with messageID %d",
transmitted, exchange_type_names, request->get_exchange_type(request),
message_id);
packet = request->get_packet(request);
@@ -649,7 +649,7 @@ static status_t process_request(private_ike_sa_t *this, message_t *request)
if (last_mid == request_mid)
{
/* retransmit detected */
DBG1(SIG_DBG_IKE, "received retransmitted request for message "
DBG1(DBG_IKE, "received retransmitted request for message "
"ID %d, retransmitting response", request_mid);
last->get_response(last, request, &response, &this->transaction_in_next);
packet = response->get_packet(response);
@@ -661,14 +661,14 @@ static status_t process_request(private_ike_sa_t *this, message_t *request)
if (last_mid > request_mid)
{
/* something seriously wrong here, message id may not decrease */
DBG1(SIG_DBG_IKE, "received request with message ID %d, "
DBG1(DBG_IKE, "received request with message ID %d, "
"excepted %d, ingored", request_mid, last_mid + 1);
return FAILED;
}
/* we allow jumps in message IDs, as long as they are incremental */
if (last_mid + 1 < request_mid)
{
DBG1(SIG_DBG_IKE, "received request with message ID %d, excepted %d",
DBG1(DBG_IKE, "received request with message ID %d, excepted %d",
request_mid, last_mid + 1);
}
}
@@ -677,7 +677,7 @@ static status_t process_request(private_ike_sa_t *this, message_t *request)
if (request_mid != 0)
{
/* warn, but allow it */
DBG1(SIG_DBG_IKE, "first received request has message ID %d, "
DBG1(DBG_IKE, "first received request has message ID %d, "
"excepted 0", request_mid);
}
}
@@ -693,7 +693,7 @@ static status_t process_request(private_ike_sa_t *this, message_t *request)
current = transaction_create(&this->public, request);
if (current == NULL)
{
DBG1(SIG_DBG_IKE, "no idea how to handle received message (exchange"
DBG1(DBG_IKE, "no idea how to handle received message (exchange"
" type %d), ignored", request->get_exchange_type(request));
return FAILED;
}
@@ -703,7 +703,7 @@ static status_t process_request(private_ike_sa_t *this, message_t *request)
status = current->get_response(current, request, &response, &this->transaction_in_next);
if (response->generate(response, this->crypter_out, this->signer_out, &packet) != SUCCESS)
{
DBG1(SIG_DBG_IKE, "response generation failed, discarding transaction");
DBG1(DBG_IKE, "response generation failed, discarding transaction");
current->destroy(current);
return FAILED;
}
@@ -740,7 +740,7 @@ static status_t process_response(private_ike_sa_t *this, message_t *response)
if (current == NULL ||
current->get_message_id(current) != response->get_message_id(response))
{
DBG1(SIG_DBG_IKE, "received response with message ID %d "
DBG1(DBG_IKE, "received response with message ID %d "
"not requested, ignored", response->get_message_id(response));
return FAILED;
}
@@ -816,32 +816,32 @@ static status_t process_message(private_ike_sa_t *this, message_t *message)
switch (status)
{
case NOT_SUPPORTED:
DBG1(SIG_DBG_IKE, "ciritcal unknown payloads found");
DBG1(DBG_IKE, "ciritcal unknown payloads found");
if (is_request)
{
send_notify_response(this, message, UNSUPPORTED_CRITICAL_PAYLOAD);
}
break;
case PARSE_ERROR:
DBG1(SIG_DBG_IKE, "message parsing failed");
DBG1(DBG_IKE, "message parsing failed");
if (is_request)
{
send_notify_response(this, message, INVALID_SYNTAX);
}
break;
case VERIFY_ERROR:
DBG1(SIG_DBG_IKE, "message verification failed");
DBG1(DBG_IKE, "message verification failed");
if (is_request)
{
send_notify_response(this, message, INVALID_SYNTAX);
}
break;
case FAILED:
DBG1(SIG_DBG_IKE, "integrity check failed");
DBG1(DBG_IKE, "integrity check failed");
/* ignored */
break;
case INVALID_STATE:
DBG1(SIG_DBG_IKE, "found encrypted message, but no keys available");
DBG1(DBG_IKE, "found encrypted message, but no keys available");
if (is_request)
{
send_notify_response(this, message, INVALID_SYNTAX);
@@ -850,7 +850,7 @@ static status_t process_message(private_ike_sa_t *this, message_t *message)
break;
}
}
DBG1(SIG_DBG_IKE, "%N %s with message ID %d processing failed",
DBG1(DBG_IKE, "%N %s with message ID %d processing failed",
exchange_type_names, message->get_exchange_type(message),
message->get_request(message) ? "request" : "response",
message->get_message_id(message));
@@ -893,7 +893,7 @@ static status_t initiate(private_ike_sa_t *this,
*/
ike_sa_init_t *ike_sa_init;
SIG(SIG_INITIATE, "initiating new IKE_SA for CHILD_SA");
DBG2(DBG_IKE, "initiating new IKE_SA for CHILD_SA");
DESTROY_IF(this->my_host);
this->my_host = connection->get_my_host(connection);
this->my_host = this->my_host->clone(this->my_host);
@@ -905,10 +905,8 @@ static status_t initiate(private_ike_sa_t *this,
if (this->other_host->is_anyaddr(this->other_host))
{
SIG(SIG_IKE_FAILED,
"can not initiate a connection to %%any, aborting");
SIG(SIG_CHILD_FAILED,
"unable to create an IKE_SA to instantiate policy");
SIG(IKE_UP_START, "establishing new IKE_SA for CHILD_SA");
SIG(IKE_UP_FAILED, "can not initiate a connection to %%any, aborting");
policy->destroy(policy);
connection->destroy(connection);
return DESTROY_ME;
@@ -924,9 +922,9 @@ static status_t initiate(private_ike_sa_t *this,
{
/* if we are in DELETING/REKEYING, we deny set up of a policy.
* TODO: would it make sense to queue the transaction and adopt
* it all transactions to the new IKE_SA? */
SIG(SIG_CHILD_FAILED,
"creating CHILD_SA discarded, as IKE_SA is in state %N",
* all transactions to the new IKE_SA? */
SIG(IKE_UP_START, "creating CHILD_SA in existing IKE_SA");
SIG(IKE_UP_FAILED, "creating CHILD_SA discarded, as IKE_SA is in state %N",
ike_sa_state_names, this->state);
policy->destroy(policy);
connection->destroy(connection);
@@ -942,7 +940,7 @@ static status_t initiate(private_ike_sa_t *this,
*/
create_child_sa_t *create_child;
SIG(SIG_INITIATE, "creating CHILD_SA in existing IKE_SA");
DBG1(DBG_IKE, "creating CHILD_SA in existing IKE_SA");
connection->destroy(connection);
create_child = create_child_sa_create(&this->public);
create_child->set_policy(create_child, policy);
@@ -965,7 +963,8 @@ static status_t acquire(private_ike_sa_t *this, u_int32_t reqid)
if (this->state == IKE_DELETING)
{
SIG(SIG_CHILD_FAILED, "acquiring CHILD_SA (reqid %d) failed: "
SIG(CHILD_UP_START, "acquiring CHILD_SA on kernel request");
SIG(CHILD_UP_FAILED, "acquiring CHILD_SA (reqid %d) failed: "
"IKE_SA is deleting", reqid);
return FAILED;
}
@@ -983,7 +982,8 @@ static status_t acquire(private_ike_sa_t *this, u_int32_t reqid)
iterator->destroy(iterator);
if (!child_sa)
{
SIG(SIG_CHILD_FAILED, "acquiring CHILD_SA (reqid %d) failed: "
SIG(CHILD_UP_START, "acquiring CHILD_SA on kernel request");
SIG(CHILD_UP_FAILED, "acquiring CHILD_SA (reqid %d) failed: "
"CHILD_SA not found", reqid);
return FAILED;
}
@@ -996,7 +996,8 @@ static status_t acquire(private_ike_sa_t *this, u_int32_t reqid)
this->my_host, this->other_host);
if (policy == NULL)
{
SIG(SIG_CHILD_FAILED, "acquiring CHILD_SA (reqid %d) failed: "
SIG(CHILD_UP_START, "acquiring CHILD_SA with reqid %d", reqid);
SIG(CHILD_UP_FAILED, "acquiring CHILD_SA (reqid %d) failed: "
"no policy found", reqid);
return FAILED;
}
@@ -1007,20 +1008,21 @@ static status_t acquire(private_ike_sa_t *this, u_int32_t reqid)
{
ike_sa_init_t *ike_sa_init;
DBG1(SIG_DBG_CHD,
"acquiring CHILD_SA with reqid %d, IKE_SA setup needed", reqid);
connection = charon->connections->get_connection_by_hosts(
charon->connections, this->my_host, this->other_host);
if (connection == NULL)
{
SIG(SIG_CHILD_FAILED, "acquiring CHILD_SA "
"(reqid %d) failed: no connection found for IKE_SA", reqid);
SIG(CHILD_UP_START, "acquiring CHILD_SA with reqid %d", reqid);
SIG(CHILD_UP_FAILED, "acquiring CHILD_SA (reqid %d) failed: "
"no connection found to establsih IKE_SA", reqid);
policy->destroy(policy);
return FAILED;
}
DBG1(DBG_IKE, "establishing IKE_SA to acquire CHILD_SA "
"with reqid %d", reqid);
this->message_id_out = 1;
ike_sa_init = ike_sa_init_create(&this->public);
ike_sa_init->set_config(ike_sa_init, connection, policy);
@@ -1033,7 +1035,7 @@ static status_t acquire(private_ike_sa_t *this, u_int32_t reqid)
{
create_child_sa_t *create_child;
DBG1(SIG_DBG_CHD, "acquiring CHILD_SA with reqid %d", reqid);
DBG1(DBG_CHD, "acquiring CHILD_SA with reqid %d", reqid);
create_child = create_child_sa_create(&this->public);
create_child->set_policy(create_child, policy);
@@ -1086,6 +1088,8 @@ static status_t route(private_ike_sa_t *this, connection_t *connection, policy_t
linked_list_t *my_ts, *other_ts;
status_t status;
SIG(CHILD_ROUTE_START, "routing CHILD_SA");
/* check if not already routed*/
iterator = this->child_sas->create_iterator(this->child_sas, TRUE);
while (iterator->iterate(iterator, (void**)&child_sa))
@@ -1106,8 +1110,7 @@ static status_t route(private_ike_sa_t *this, connection_t *connection, policy_t
iterator->destroy(iterator);
my_ts_conf->destroy_offset(my_ts_conf, offsetof(traffic_selector_t, destroy));
other_ts_conf->destroy_offset(other_ts_conf, offsetof(traffic_selector_t, destroy));
SIG(SIG_CHILD_FAILED, "CHILD_SA with such a policy "
"already routed");
SIG(CHILD_ROUTE_FAILED, "CHILD_SA with such a policy already routed");
return FAILED;
}
my_ts_conf->destroy_offset(my_ts_conf, offsetof(traffic_selector_t, destroy));
@@ -1120,7 +1123,7 @@ static status_t route(private_ike_sa_t *this, connection_t *connection, policy_t
{
case IKE_CREATED:
case IKE_CONNECTING:
/* we update IKE_SA information as good as possible,
/* we update IKE_SA information as good as possible,
* this allows us to set up the SA later when an acquire comes in. */
if (this->my_id->get_type(this->my_id) == ID_ANY)
{
@@ -1156,8 +1159,8 @@ static status_t route(private_ike_sa_t *this, connection_t *connection, policy_t
* adopted by the new IKE_SA */
break;
case IKE_DELETING:
SIG(SIG_CHILD_FAILED, "CHILD_SA with such a policy "
"already routed");
/* TODO: hanlde this case, create a new IKE_SA and route CHILD_SA */
SIG(CHILD_ROUTE_FAILED, "unable to route CHILD_SA, as its IKE_SA gets deleted");
return FAILED;
}
@@ -1173,8 +1176,7 @@ static status_t route(private_ike_sa_t *this, connection_t *connection, policy_t
my_ts->destroy_offset(my_ts, offsetof(traffic_selector_t, destroy));
other_ts->destroy_offset(other_ts, offsetof(traffic_selector_t, destroy));
this->child_sas->insert_last(this->child_sas, child_sa);
SIG(SIG_CHILD_ROUTE,
"CHILD_SA routed: %R...%R", my_ts, other_ts);
SIG(CHILD_ROUTE_SUCCESS, "CHILD_SA routed");
return status;
}
@@ -1185,8 +1187,11 @@ static status_t unroute(private_ike_sa_t *this, policy_t *policy)
{
iterator_t *iterator;
child_sa_t *child_sa = NULL;
bool found = FALSE;
linked_list_t *my_ts, *other_ts, *my_ts_conf, *other_ts_conf;
SIG(CHILD_UNROUTE_START, "unrouting CHILD_SA");
/* find CHILD_SA in ROUTED state */
iterator = this->child_sas->create_iterator(this->child_sas, TRUE);
while (iterator->iterate(iterator, (void**)&child_sa))
@@ -1203,10 +1208,11 @@ static status_t unroute(private_ike_sa_t *this, policy_t *policy)
ts_list_equals(other_ts, other_ts_conf))
{
iterator->remove(iterator);
SIG(SIG_CHILD_UNROUTE, "CHILD_SA unrouted");
SIG(CHILD_UNROUTE_SUCCESS, "CHILD_SA unrouted");
child_sa->destroy(child_sa);
my_ts_conf->destroy_offset(my_ts_conf, offsetof(traffic_selector_t, destroy));
other_ts_conf->destroy_offset(other_ts_conf, offsetof(traffic_selector_t, destroy));
found = TRUE;
break;
}
my_ts_conf->destroy_offset(my_ts_conf, offsetof(traffic_selector_t, destroy));
@@ -1214,6 +1220,12 @@ static status_t unroute(private_ike_sa_t *this, policy_t *policy)
}
}
iterator->destroy(iterator);
if (!found)
{
SIG(CHILD_UNROUTE_FAILED, "CHILD_SA to unroute not found");
return FAILED;
}
/* if we are not established, and we have no more routed childs, remove whole SA */
if (this->state == IKE_CREATED &&
this->child_sas->get_count(this->child_sas) == 0)
@@ -1253,7 +1265,7 @@ static status_t send_dpd(private_ike_sa_t *this)
{
/* to long ago, initiate dead peer detection */
dead_peer_detection_t *dpd;
DBG1(SIG_DBG_IKE, "sending DPD request");
DBG1(DBG_IKE, "sending DPD request");
dpd = dead_peer_detection_create(&this->public);
queue_transaction(this, (transaction_t*)dpd, FALSE);
diff = 0;
@@ -1293,7 +1305,7 @@ static void send_keepalive(private_ike_sa_t *this)
data.len = 1;
packet->set_data(packet, data);
charon->send_queue->add(charon->send_queue, packet);
DBG1(SIG_DBG_IKE, "sending keep alive");
DBG1(DBG_IKE, "sending keep alive");
diff = 0;
}
job = send_keepalive_job_create(this->ike_sa_id);
@@ -1314,7 +1326,7 @@ static ike_sa_state_t get_state(private_ike_sa_t *this)
*/
static void set_state(private_ike_sa_t *this, ike_sa_state_t state)
{
DBG1(SIG_DBG_IKE, "state change: %N => %N",
DBG1(DBG_IKE, "IKE_SA state change: %N => %N",
ike_sa_state_names, this->state,
ike_sa_state_names, state);
@@ -1323,9 +1335,6 @@ static void set_state(private_ike_sa_t *this, ike_sa_state_t state)
this->time.established = time(NULL);
/* start DPD checks */
send_dpd(this);
SIG(SIG_IKE_UP, "IKE_SA established: %H[%D]...%H[%D]",
this->my_host, this->my_id, this->other_host, this->other_id);
}
this->state = state;
@@ -1426,19 +1435,19 @@ static status_t derive_keys(private_ike_sa_t *this,
/* Create SAs general purpose PRF first, we may use it here */
if (!proposal->get_algorithm(proposal, PSEUDO_RANDOM_FUNCTION, &algo))
{
DBG1(SIG_DBG_IKE, "key derivation failed: no PSEUDO_RANDOM_FUNCTION");;
DBG1(DBG_IKE, "key derivation failed: no PSEUDO_RANDOM_FUNCTION");;
return FAILED;
}
this->prf = prf_create(algo->algorithm);
if (this->prf == NULL)
{
DBG1(SIG_DBG_IKE, "key derivation failed: PSEUDO_RANDOM_FUNCTION "
DBG1(DBG_IKE, "key derivation failed: PSEUDO_RANDOM_FUNCTION "
"%N not supported!", pseudo_random_function_names, algo->algorithm);
return FAILED;
}
dh->get_shared_secret(dh, &secret);
DBG4(SIG_DBG_IKE, "shared Diffie Hellman secret %B", &secret);
DBG4(DBG_IKE, "shared Diffie Hellman secret %B", &secret);
nonces = chunk_cat("cc", nonce_i, nonce_r);
*((u_int64_t*)spi_i.ptr) = this->ike_sa_id->get_initiator_spi(this->ike_sa_id);
*((u_int64_t*)spi_r.ptr) = this->ike_sa_id->get_responder_spi(this->ike_sa_id);
@@ -1446,14 +1455,14 @@ static status_t derive_keys(private_ike_sa_t *this,
/* KEYMAT = prf+ (SKEYSEED, Ni | Nr | SPIi | SPIr)
*
* if we are rekeying, SKEYSEED built on another way
* if we are rekeying, SKEYSEED is built on another way
*/
if (child_prf == NULL) /* not rekeying */
{
/* SKEYSEED = prf(Ni | Nr, g^ir) */
this->prf->set_key(this->prf, nonces);
this->prf->allocate_bytes(this->prf, secret, &skeyseed);
DBG4(SIG_DBG_IKE, "SKEYSEED %B", &skeyseed);
DBG4(DBG_IKE, "SKEYSEED %B", &skeyseed);
this->prf->set_key(this->prf, skeyseed);
chunk_free(&skeyseed);
chunk_free(&secret);
@@ -1465,7 +1474,7 @@ static status_t derive_keys(private_ike_sa_t *this,
* use OLD SAs PRF functions for both prf_plus and prf */
secret = chunk_cat("mc", secret, nonces);
child_prf->allocate_bytes(child_prf, secret, &skeyseed);
DBG4(SIG_DBG_IKE, "SKEYSEED %B", &skeyseed);
DBG4(DBG_IKE, "SKEYSEED %B", &skeyseed);
old_prf->set_key(old_prf, skeyseed);
chunk_free(&skeyseed);
chunk_free(&secret);
@@ -1481,33 +1490,33 @@ static status_t derive_keys(private_ike_sa_t *this,
this->child_prf = prf_create(algo->algorithm);
key_size = this->child_prf->get_key_size(this->child_prf);
prf_plus->allocate_bytes(prf_plus, key_size, &key);
DBG4(SIG_DBG_IKE, "Sk_d secret %B", &key);
DBG4(DBG_IKE, "Sk_d secret %B", &key);
this->child_prf->set_key(this->child_prf, key);
chunk_free(&key);
/* SK_ai/SK_ar used for integrity protection => signer_in/signer_out */
if (!proposal->get_algorithm(proposal, INTEGRITY_ALGORITHM, &algo))
{
DBG1(SIG_DBG_IKE, "key derivation failed: no INTEGRITY_ALGORITHM");
DBG1(DBG_IKE, "key derivation failed: no INTEGRITY_ALGORITHM");
return FAILED;
}
signer_i = signer_create(algo->algorithm);
signer_r = signer_create(algo->algorithm);
if (signer_i == NULL || signer_r == NULL)
{
DBG1(SIG_DBG_IKE, "key derivation failed: INTEGRITY_ALGORITHM "
DBG1(DBG_IKE, "key derivation failed: INTEGRITY_ALGORITHM "
"%N not supported!", integrity_algorithm_names ,algo->algorithm);
return FAILED;
}
key_size = signer_i->get_key_size(signer_i);
prf_plus->allocate_bytes(prf_plus, key_size, &key);
DBG4(SIG_DBG_IKE, "Sk_ai secret %B", &key);
DBG4(DBG_IKE, "Sk_ai secret %B", &key);
signer_i->set_key(signer_i, key);
chunk_free(&key);
prf_plus->allocate_bytes(prf_plus, key_size, &key);
DBG4(SIG_DBG_IKE, "Sk_ar secret %B", &key);
DBG4(DBG_IKE, "Sk_ar secret %B", &key);
signer_r->set_key(signer_r, key);
chunk_free(&key);
@@ -1525,14 +1534,14 @@ static status_t derive_keys(private_ike_sa_t *this,
/* SK_ei/SK_er used for encryption => crypter_in/crypter_out */
if (!proposal->get_algorithm(proposal, ENCRYPTION_ALGORITHM, &algo))
{
DBG1(SIG_DBG_IKE, "key derivation failed: no ENCRYPTION_ALGORITHM");
DBG1(DBG_IKE, "key derivation failed: no ENCRYPTION_ALGORITHM");
return FAILED;
}
crypter_i = crypter_create(algo->algorithm, algo->key_size / 8);
crypter_r = crypter_create(algo->algorithm, algo->key_size / 8);
if (crypter_i == NULL || crypter_r == NULL)
{
DBG1(SIG_DBG_IKE, "key derivation failed: ENCRYPTION_ALGORITHM "
DBG1(DBG_IKE, "key derivation failed: ENCRYPTION_ALGORITHM "
"%N (key size %d) not supported!",
encryption_algorithm_names, algo->algorithm, algo->key_size);
return FAILED;
@@ -1540,12 +1549,12 @@ static status_t derive_keys(private_ike_sa_t *this,
key_size = crypter_i->get_key_size(crypter_i);
prf_plus->allocate_bytes(prf_plus, key_size, &key);
DBG4(SIG_DBG_IKE, "Sk_ei secret %B", &key);
DBG4(DBG_IKE, "Sk_ei secret %B", &key);
crypter_i->set_key(crypter_i, key);
chunk_free(&key);
prf_plus->allocate_bytes(prf_plus, key_size, &key);
DBG4(SIG_DBG_IKE, "Sk_er secret %B", &key);
DBG4(DBG_IKE, "Sk_er secret %B", &key);
crypter_r->set_key(crypter_r, key);
chunk_free(&key);
@@ -1567,12 +1576,12 @@ static status_t derive_keys(private_ike_sa_t *this,
key_size = this->prf_auth_i->get_key_size(this->prf_auth_i);
prf_plus->allocate_bytes(prf_plus, key_size, &key);
DBG4(SIG_DBG_IKE, "Sk_pi secret %B", &key);
DBG4(DBG_IKE, "Sk_pi secret %B", &key);
this->prf_auth_i->set_key(this->prf_auth_i, key);
chunk_free(&key);
prf_plus->allocate_bytes(prf_plus, key_size, &key);
DBG4(SIG_DBG_IKE, "Sk_pr secret %B", &key);
DBG4(DBG_IKE, "Sk_pr secret %B", &key);
this->prf_auth_r->set_key(this->prf_auth_r, key);
chunk_free(&key);
@@ -1580,7 +1589,6 @@ static status_t derive_keys(private_ike_sa_t *this,
prf_plus->destroy(prf_plus);
return SUCCESS;
}
/**
@@ -1738,13 +1746,13 @@ static status_t rekey(private_ike_sa_t *this)
{
rekey_ike_sa_t *rekey_ike_sa;
DBG1(SIG_DBG_IKE, "rekeying IKE_SA between %H[%D]..%H[%D]",
this->my_host, this->my_id,
this->other_host, this->other_id);
DBG1(DBG_IKE, "rekeying IKE_SA between %H[%D]..%H[%D]",
this->my_host, this->my_id, this->other_host, this->other_id);
if (this->state != IKE_ESTABLISHED)
{
SIG(SIG_IKE_FAILED, "unable to rekey IKE_SA in state %N",
SIG(IKE_REKEY_START, "rekeying IKE_SA");
SIG(IKE_REKEY_FAILED, "unable to rekey IKE_SA in state %N",
ike_sa_state_names, this->state);
return FAILED;
}
@@ -1791,6 +1799,12 @@ static status_t delete_(private_ike_sa_t *this)
switch (this->state)
{
case IKE_CONNECTING:
{
/* this may happen if a half open IKE_SA gets closed after a
* timeout. We signal here UP_FAILED to complete the SIG schema */
SIG(IKE_UP_FAILED, "half open IKE_SA deleted after timeout");
return DESTROY_ME;
}
case IKE_ESTABLISHED:
{
delete_ike_sa_t *delete_ike_sa;
@@ -1807,6 +1821,9 @@ static status_t delete_(private_ike_sa_t *this)
case IKE_DELETING:
default:
{
SIG(IKE_DOWN_START, "closing IKE_SA");
SIG(IKE_DOWN_SUCCESS, "IKE_SA closed between %H[%D]...%H[%D]",
this->my_host, this->my_id, this->other_host, this->other_id);
return DESTROY_ME;
}
}
@@ -1823,7 +1840,7 @@ static u_int32_t get_next_message_id (private_ike_sa_t *this)
/**
* Implementation of ike_sa_t.is_natt_enabled.
*/
static bool is_natt_enabled (private_ike_sa_t *this)
static bool is_natt_enabled(private_ike_sa_t *this)
{
return this->nat_here || this->nat_there;
}
@@ -1831,18 +1848,18 @@ static bool is_natt_enabled (private_ike_sa_t *this)
/**
* Implementation of ike_sa_t.enable_natt.
*/
static void enable_natt (private_ike_sa_t *this, bool local)
static void enable_natt(private_ike_sa_t *this, bool local)
{
if (local)
{
DBG1(SIG_DBG_IKE, "local host is behind NAT, using NAT-T, "
DBG1(DBG_IKE, "local host is behind NAT, using NAT-T, "
"scheduled keep alives");
this->nat_here = TRUE;
send_keepalive(this);
}
else
{
DBG1(SIG_DBG_IKE, "remote host is behind NAT, using NAT-T");
DBG1(DBG_IKE, "remote host is behind NAT, using NAT-T");
this->nat_there = TRUE;
}
}
@@ -1905,9 +1922,6 @@ static void destroy(private_ike_sa_t *this)
DESTROY_IF(this->child_prf);
DESTROY_IF(this->prf_auth_i);
DESTROY_IF(this->prf_auth_r);
DBG1(SIG_DBG_IKE, "IKE_SA deleted between %H[%D]...%H[%D]",
this->my_host, this->my_id, this->other_host, this->other_id);
DESTROY_IF(this->my_host);
DESTROY_IF(this->other_host);
@@ -1997,7 +2011,8 @@ ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id)
this->rekeying_transaction = NULL;
this->state = IKE_CREATED;
this->message_id_out = 0;
/* set to NOW, as when we rekey an existing IKE_SA no message is exchanged */
/* set to NOW, as when we rekey an existing IKE_SA no message is exchanged
* and inbound therefore uninitialized */
this->time.inbound = this->time.outbound = time(NULL);
this->time.established = 0;
this->time.rekey = 0;
src/charon/sa/ike_sa_manager.c
+30 -30
View File
@@ -158,7 +158,7 @@ static status_t get_entry_by_id(private_ike_sa_manager_t *this, ike_sa_id_t *ike
{
if (current->ike_sa_id->equals(current->ike_sa_id, ike_sa_id))
{
DBG2(SIG_DBG_MGR, "found entry by both SPIs");
DBG2(DBG_MGR, "found entry by both SPIs");
*entry = current;
status = SUCCESS;
break;
@@ -172,7 +172,7 @@ static status_t get_entry_by_id(private_ike_sa_manager_t *this, ike_sa_id_t *ike
(current->ike_sa_id->is_initiator(ike_sa_id) ==
ike_sa_id->is_initiator(current->ike_sa_id)))
{
DBG2(SIG_DBG_MGR, "found entry by initiator SPI");
DBG2(DBG_MGR, "found entry by initiator SPI");
*entry = current;
status = SUCCESS;
break;
@@ -204,7 +204,7 @@ static status_t get_entry_by_sa(private_ike_sa_manager_t *this, ike_sa_t *ike_sa
/* only pointers are compared */
if (current->ike_sa == ike_sa)
{
DBG2(SIG_DBG_MGR, "found entry by pointer");
DBG2(DBG_MGR, "found entry by pointer");
*entry = current;
status = SUCCESS;
break;
@@ -244,7 +244,7 @@ static status_t delete_entry(private_ike_sa_manager_t *this, entry_t *entry)
pthread_cond_wait(&(entry->condvar), &(this->mutex));
}
DBG2(SIG_DBG_MGR, "found entry by pointer, deleting it");
DBG2(DBG_MGR, "found entry by pointer, deleting it");
iterator->remove(iterator);
entry_destroy(entry);
status = SUCCESS;
@@ -345,7 +345,7 @@ static ike_sa_t* checkout_by_id(private_ike_sa_manager_t *this,
found_other_id->matches(found_other_id, other_id, &wc))
{
/* looks good, we take this one */
DBG2(SIG_DBG_MGR, "found an existing IKE_SA for %H[%D]...%H[%D]",
DBG2(DBG_MGR, "found an existing IKE_SA for %H[%D]...%H[%D]",
my_host, other_host, my_id, other_id);
entry->checked_out = TRUE;
ike_sa = entry->ike_sa;
@@ -365,13 +365,13 @@ static ike_sa_t* checkout_by_id(private_ike_sa_manager_t *this,
/* create entry */
new_entry = entry_create(new_ike_sa_id);
DBG2(SIG_DBG_MGR, "created IKE_SA: %J", new_ike_sa_id);
DBG2(DBG_MGR, "created IKE_SA: %J", new_ike_sa_id);
new_ike_sa_id->destroy(new_ike_sa_id);
this->ike_sa_list->insert_last(this->ike_sa_list, new_entry);
/* check ike_sa out */
DBG2(SIG_DBG_MGR, "new IKE_SA created for IDs [%D]...[%D]", my_id, other_id);
DBG2(DBG_MGR, "new IKE_SA created for IDs [%D]...[%D]", my_id, other_id);
new_entry->checked_out = TRUE;
ike_sa = new_entry->ike_sa;
}
@@ -390,9 +390,9 @@ static ike_sa_t* checkout(private_ike_sa_manager_t *this, ike_sa_id_t *ike_sa_id
bool original_initiator;
ike_sa_t *ike_sa = NULL;
DBG2(SIG_DBG_MGR, "checkout IKE_SA: %J", ike_sa_id);
DBG2(DBG_MGR, "checkout IKE_SA: %J", ike_sa_id);
DBG2(SIG_DBG_MGR, "%d IKE_SAs in manager",
DBG2(DBG_MGR, "%d IKE_SAs in manager",
this->ike_sa_list->get_count(this->ike_sa_list));
/* each access is locked */
@@ -414,19 +414,19 @@ static ike_sa_t* checkout(private_ike_sa_manager_t *this, ike_sa_id_t *ike_sa_id
{
if (wait_for_entry(this, entry))
{
DBG2(SIG_DBG_MGR, "IKE_SA successfully checked out");
DBG2(DBG_MGR, "IKE_SA successfully checked out");
/* ok, this IKE_SA is finally ours */
entry->checked_out = TRUE;
ike_sa = entry->ike_sa;
}
else
{
DBG2(SIG_DBG_MGR, "IKE_SA found, but not allowed to check it out");
DBG2(DBG_MGR, "IKE_SA found, but not allowed to check it out");
}
}
else
{
DBG2(SIG_DBG_MGR, "IKE_SA not stored in list");
DBG2(DBG_MGR, "IKE_SA not stored in list");
/* looks like there is no such IKE_SA, better luck next time... */
}
}
@@ -454,7 +454,7 @@ static ike_sa_t* checkout(private_ike_sa_manager_t *this, ike_sa_id_t *ike_sa_id
this->ike_sa_list->insert_last(this->ike_sa_list, new_entry);
/* check ike_sa out */
DBG2(SIG_DBG_MGR, "IKE_SA added to list of known IKE_SAs");
DBG2(DBG_MGR, "IKE_SA added to list of known IKE_SAs");
new_entry->checked_out = TRUE;
ike_sa = new_entry->ike_sa;
}
@@ -466,7 +466,7 @@ static ike_sa_t* checkout(private_ike_sa_manager_t *this, ike_sa_id_t *ike_sa_id
ike_sa_id->set_initiator_spi(ike_sa_id, get_next_spi(this));
/* create entry */
new_entry = entry_create(ike_sa_id);
DBG2(SIG_DBG_MGR, "created IKE_SA: %J", ike_sa_id);
DBG2(DBG_MGR, "created IKE_SA: %J", ike_sa_id);
this->ike_sa_list->insert_last(this->ike_sa_list, new_entry);
@@ -477,7 +477,7 @@ static ike_sa_t* checkout(private_ike_sa_manager_t *this, ike_sa_id_t *ike_sa_id
else
{
/* responder set, initiator not: here is something seriously wrong! */
DBG2(SIG_DBG_MGR, "invalid IKE_SA SPIs");
DBG2(DBG_MGR, "invalid IKE_SA SPIs");
}
pthread_mutex_unlock(&(this->mutex));
@@ -556,7 +556,7 @@ static status_t checkin(private_ike_sa_manager_t *this, ike_sa_t *ike_sa)
ike_sa_id = ike_sa->get_id(ike_sa);
DBG2(SIG_DBG_MGR, "checkin IKE_SA: %J", ike_sa_id);
DBG2(DBG_MGR, "checkin IKE_SA: %J", ike_sa_id);
pthread_mutex_lock(&(this->mutex));
@@ -567,18 +567,18 @@ static status_t checkin(private_ike_sa_manager_t *this, ike_sa_t *ike_sa)
entry->ike_sa_id->replace_values(entry->ike_sa_id, ike_sa->get_id(ike_sa));
/* signal waiting threads */
entry->checked_out = FALSE;
DBG2(SIG_DBG_MGR, "check-in of IKE_SA successful.");
DBG2(DBG_MGR, "check-in of IKE_SA successful.");
pthread_cond_signal(&(entry->condvar));
retval = SUCCESS;
}
else
{
DBG2(SIG_DBG_MGR, "tried to check in nonexisting IKE_SA");
DBG2(DBG_MGR, "tried to check in nonexisting IKE_SA");
/* this SA is no more, this REALLY should not happen */
retval = NOT_FOUND;
}
DBG2(SIG_DBG_MGR, "%d IKE_SAs in manager now",
DBG2(DBG_MGR, "%d IKE_SAs in manager now",
this->ike_sa_list->get_count(this->ike_sa_list));
pthread_mutex_unlock(&(this->mutex));
@@ -602,7 +602,7 @@ static status_t checkin_and_destroy(private_ike_sa_manager_t *this, ike_sa_t *ik
ike_sa_id_t *ike_sa_id;
ike_sa_id = ike_sa->get_id(ike_sa);
DBG2(SIG_DBG_MGR, "checkin and destroy IKE_SA: %J", ike_sa_id);
DBG2(DBG_MGR, "checkin and destroy IKE_SA: %J", ike_sa_id);
pthread_mutex_lock(&(this->mutex));
@@ -613,12 +613,12 @@ static status_t checkin_and_destroy(private_ike_sa_manager_t *this, ike_sa_t *ik
delete_entry(this, entry);
DBG2(SIG_DBG_MGR, "check-in and destroy of IKE_SA successful");
DBG2(DBG_MGR, "check-in and destroy of IKE_SA successful");
retval = SUCCESS;
}
else
{
DBG2(SIG_DBG_MGR, "tried to check-in and delete nonexisting IKE_SA");
DBG2(DBG_MGR, "tried to check-in and delete nonexisting IKE_SA");
retval = NOT_FOUND;
}
@@ -640,7 +640,7 @@ static status_t delete_(private_ike_sa_manager_t *this, ike_sa_id_t *ike_sa_id)
entry_t *entry;
status_t retval;
DBG2(SIG_DBG_MGR, "delete IKE_SA: %J", ike_sa_id);
DBG2(DBG_MGR, "delete IKE_SA: %J", ike_sa_id);
pthread_mutex_lock(&(this->mutex));
@@ -651,7 +651,7 @@ static status_t delete_(private_ike_sa_manager_t *this, ike_sa_id_t *ike_sa_id)
*/
if (entry->ike_sa->delete(entry->ike_sa) == SUCCESS)
{
DBG2(SIG_DBG_MGR, "initiated delete for IKE_SA");
DBG2(DBG_MGR, "initiated delete for IKE_SA");
}
/* but if the IKE SA is not in a state where the deletion is
* negotiated with the other peer, we can destroy the IKE SA on our own.
@@ -664,7 +664,7 @@ static status_t delete_(private_ike_sa_manager_t *this, ike_sa_id_t *ike_sa_id)
}
else
{
DBG2(SIG_DBG_MGR, "tried to delete nonexisting IKE_SA");
DBG2(DBG_MGR, "tried to delete nonexisting IKE_SA");
retval = NOT_FOUND;
}
@@ -802,9 +802,9 @@ static void destroy(private_ike_sa_manager_t *this)
entry_t *entry;
pthread_mutex_lock(&(this->mutex));
DBG2(SIG_DBG_MGR, "going to destroy IKE_SA manager and all managed IKE_SA's");
DBG2(DBG_MGR, "going to destroy IKE_SA manager and all managed IKE_SA's");
/* Step 1: drive out all waiting threads */
DBG2(SIG_DBG_MGR, "set driveout flags for all stored IKE_SA's");
DBG2(DBG_MGR, "set driveout flags for all stored IKE_SA's");
iterator = list->create_iterator(list, TRUE);
while (iterator->iterate(iterator, (void**)&entry))
{
@@ -812,7 +812,7 @@ static void destroy(private_ike_sa_manager_t *this)
entry->driveout_new_threads = TRUE;
entry->driveout_waiting_threads = TRUE;
}
DBG2(SIG_DBG_MGR, "wait for all threads to leave IKE_SA's");
DBG2(DBG_MGR, "wait for all threads to leave IKE_SA's");
/* Step 2: wait until all are gone */
iterator->reset(iterator);
while (iterator->iterate(iterator, (void**)&entry))
@@ -825,7 +825,7 @@ static void destroy(private_ike_sa_manager_t *this)
pthread_cond_wait(&(entry->condvar), &(this->mutex));
}
}
DBG2(SIG_DBG_MGR, "delete all IKE_SA's");
DBG2(DBG_MGR, "delete all IKE_SA's");
/* Step 3: initiate deletion of all IKE_SAs */
iterator->reset(iterator);
while (iterator->iterate(iterator, (void**)&entry))
@@ -834,7 +834,7 @@ static void destroy(private_ike_sa_manager_t *this)
}
iterator->destroy(iterator);
DBG2(SIG_DBG_MGR, "destroy all entries");
DBG2(DBG_MGR, "destroy all entries");
/* Step 4: destroy all entries */
list->destroy_function(list, (void*)entry_destroy);
pthread_mutex_unlock(&(this->mutex));
src/charon/sa/transactions/create_child_sa.c
+67 -33
View File
@@ -128,6 +128,12 @@ struct private_create_child_sa_t {
* source of randomness
*/
randomizer_t *randomizer;
/**
* signal to emit when transaction fails. As this transaction is used
* for CHILD_SA creation AND rekeying, we must emit different signals.
*/
signal_t failsig;
};
/**
@@ -168,6 +174,7 @@ static void set_reqid(private_create_child_sa_t *this, u_int32_t reqid)
static void rekeys_child(private_create_child_sa_t *this, child_sa_t *child_sa)
{
this->rekeyed_sa = child_sa;
this->failsig = CHILD_REKEY_FAILED;
}
/**
@@ -198,14 +205,16 @@ static status_t get_request(private_create_child_sa_t *this, message_t **result)
/* check if we are not already rekeying */
if (this->rekeyed_sa)
{
SIG(CHILD_REKEY_START, "rekeying CHILD_SA");
switch (this->rekeyed_sa->get_state(this->rekeyed_sa))
{
case CHILD_REKEYING:
DBG1(SIG_DBG_IKE,
SIG(CHILD_REKEY_FAILED,
"rekeying a CHILD_SA which is already rekeying, aborted");
return FAILED;
case CHILD_DELETING:
DBG1(SIG_DBG_IKE,
SIG(CHILD_REKEY_FAILED,
"rekeying a CHILD_SA which is deleting, aborted");
return FAILED;
default:
@@ -213,6 +222,10 @@ static status_t get_request(private_create_child_sa_t *this, message_t **result)
}
this->rekeyed_sa->set_state(this->rekeyed_sa, CHILD_REKEYING);
}
else
{
SIG(CHILD_UP_START, "creating CHILD_SA");
}
me = this->ike_sa->get_my_host(this->ike_sa);
other = this->ike_sa->get_other_host(this->ike_sa);
@@ -254,7 +267,7 @@ static status_t get_request(private_create_child_sa_t *this, message_t **result)
if (this->policy == NULL)
{
DBG1(SIG_DBG_IKE, "no policy found to rekey "
SIG(IKE_REKEY_FAILED, "no policy found to rekey "
"CHILD_SA with reqid %d", this->reqid);
return FAILED;
}
@@ -271,7 +284,7 @@ static status_t get_request(private_create_child_sa_t *this, message_t **result)
this->child_sa->set_name(this->child_sa, this->policy->get_name(this->policy));
if (this->child_sa->alloc(this->child_sa, proposals) != SUCCESS)
{
SIG(SIG_CHILD_FAILED, "could not install CHILD_SA, CHILD_SA creation aborted");
SIG(this->failsig, "could not install CHILD_SA, CHILD_SA creation failed");
return FAILED;
}
sa_payload = sa_payload_create_from_proposal_list(proposals);
@@ -285,7 +298,7 @@ static status_t get_request(private_create_child_sa_t *this, message_t **result)
if (this->randomizer->allocate_pseudo_random_bytes(this->randomizer,
NONCE_SIZE, &this->nonce_i) != SUCCESS)
{
SIG(SIG_CHILD_FAILED, "could not create nonce");
SIG(this->failsig, "could not create nonce, CHILD_SA creation failed");
return FAILED;
}
nonce_payload = nonce_payload_create();
@@ -340,23 +353,23 @@ static status_t process_notifys(private_create_child_sa_t *this, notify_payload_
{
notify_type_t notify_type = notify_payload->get_notify_type(notify_payload);
DBG2(SIG_DBG_IKE, "process notify type %N", notify_type_names, notify_type);
DBG2(DBG_IKE, "process notify type %N", notify_type_names, notify_type);
switch (notify_type)
{
case SINGLE_PAIR_REQUIRED:
{
SIG(SIG_CHILD_FAILED, "received a SINGLE_PAIR_REQUIRED notify");
SIG(this->failsig, "received a SINGLE_PAIR_REQUIRED notify");
return FAILED;
}
case TS_UNACCEPTABLE:
{
SIG(SIG_CHILD_FAILED, "received TS_UNACCEPTABLE notify");
SIG(this->failsig, "received TS_UNACCEPTABLE notify");
return FAILED;
}
case NO_PROPOSAL_CHOSEN:
{
SIG(SIG_CHILD_FAILED, "received NO_PROPOSAL_CHOSEN notify");
SIG(this->failsig, "received NO_PROPOSAL_CHOSEN notify");
return FAILED;
}
case REKEY_SA:
@@ -373,6 +386,7 @@ static status_t process_notifys(private_create_child_sa_t *this, notify_payload_
this->rekeyed_sa = this->ike_sa->get_child_sa(this->ike_sa,
protocol, spi,
FALSE);
this->failsig = CHILD_REKEY_FAILED;
break;
default:
break;
@@ -383,13 +397,13 @@ static status_t process_notifys(private_create_child_sa_t *this, notify_payload_
{
if (notify_type < 16383)
{
SIG(SIG_CHILD_FAILED, "received %N notify error, CHILD_SA "
SIG(this->failsig, "received %N notify error, CHILD_SA "
"creation failed", notify_type_names, notify_type);
return FAILED;
return FAILED;
}
else
{
DBG1(SIG_DBG_IKE, "received %N notify, ignored",
DBG1(DBG_IKE, "received %N notify, ignored",
notify_type_names, notify_type);
return SUCCESS;
}
@@ -515,7 +529,7 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
/* check message type */
if (request->get_exchange_type(request) != CREATE_CHILD_SA)
{
SIG(SIG_CHILD_FAILED, "CREATE_CHILD_SA response of invalid type, aborted");
DBG1(DBG_IKE, "CREATE_CHILD_SA response of invalid type, aborted");
return FAILED;
}
@@ -525,7 +539,7 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
this->ike_sa->get_state(this->ike_sa) == IKE_DELETING)
{
build_notify(NO_ADDITIONAL_SAS, CHUNK_INITIALIZER, response, TRUE);
SIG(SIG_CHILD_FAILED, "unable to create new CHILD_SAs, as rekeying in progress");
DBG1(DBG_IKE, "unable to create new CHILD_SAs, as rekeying in progress");
return FAILED;
}
@@ -552,7 +566,7 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
u_int8_t dh_buffer[] = {0x00, 0x00}; /* MODP_NONE */
chunk_t group = chunk_from_buf(dh_buffer);
build_notify(INVALID_KE_PAYLOAD, group, response, TRUE);
SIG(SIG_CHILD_FAILED, "CREATE_CHILD_SA used PFS, sending INVALID_KE_PAYLOAD");
DBG1(DBG_IKE, "CREATE_CHILD_SA used PFS, sending INVALID_KE_PAYLOAD");
return FAILED;
}
case NOTIFY:
@@ -567,7 +581,7 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
}
default:
{
DBG1(SIG_DBG_IKE, "ignoring %N payload",
DBG1(DBG_IKE, "ignoring %N payload",
payload_type_names, payload->get_type(payload));
break;
}
@@ -575,11 +589,22 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
}
payloads->destroy(payloads);
/* after processing the notify payloads, we know if this transaction is
* for rekeying or for a new CHILD_SA. We can emit the signals now. */
if (this->rekeyed_sa)
{
SIG(CHILD_REKEY_START, "rekeying CHILD_SA");
}
else
{
SIG(CHILD_UP_START, "creating CHILD_SA");
}
/* check if we have all payloads */
if (!(sa_request && nonce_request && tsi_request && tsr_request))
{
build_notify(INVALID_SYNTAX, CHUNK_INITIALIZER, response, TRUE);
SIG(SIG_CHILD_FAILED, "request message incomplete, no CHILD_SA created");
SIG(this->failsig, "request message incomplete, no CHILD_SA created");
return FAILED;
}
@@ -589,6 +614,7 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
NONCE_SIZE, &this->nonce_r) != SUCCESS)
{
build_notify(NO_PROPOSAL_CHOSEN, CHUNK_INITIALIZER, response, TRUE);
SIG(this->failsig, "nonce generation failed, no CHILD_SA created");
return FAILED;
}
nonce_response = nonce_payload_create();
@@ -619,7 +645,7 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
if (this->policy == NULL)
{
SIG(SIG_CHILD_FAILED, "no acceptable policy found, sending TS_UNACCEPTABLE notify");
SIG(this->failsig, "no acceptable policy found, sending TS_UNACCEPTABLE notify");
build_notify(TS_UNACCEPTABLE, CHUNK_INITIALIZER, response, TRUE);
return FAILED;
}
@@ -635,21 +661,21 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
sa_response = sa_payload_create();
/* get proposals from request, and select one with ours */
proposal_list = sa_request->get_proposals(sa_request);
DBG2(SIG_DBG_IKE, "selecting proposals:");
DBG2(DBG_IKE, "selecting proposals:");
this->proposal = this->policy->select_proposal(this->policy, proposal_list);
proposal_list->destroy_offset(proposal_list, offsetof(proposal_t, destroy));
/* do we have a proposal? */
if (this->proposal == NULL)
{
SIG(SIG_CHILD_FAILED, "CHILD_SA proposals unacceptable, sending NO_PROPOSAL_CHOSEN notify");
SIG(this->failsig, "CHILD_SA proposals unacceptable, sending NO_PROPOSAL_CHOSEN notify");
build_notify(NO_PROPOSAL_CHOSEN, CHUNK_INITIALIZER, response, TRUE);
return FAILED;
}
/* do we have traffic selectors? */
else if (this->tsi->get_count(this->tsi) == 0 || this->tsr->get_count(this->tsr) == 0)
{
SIG(SIG_CHILD_FAILED, "CHILD_SA traffic selectors unacceptable, sending TS_UNACCEPTABLE notify");
SIG(this->failsig, "CHILD_SA traffic selectors unacceptable, sending TS_UNACCEPTABLE notify");
build_notify(TS_UNACCEPTABLE, CHUNK_INITIALIZER, response, TRUE);
return FAILED;
}
@@ -670,7 +696,7 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
this->child_sa->set_name(this->child_sa, this->policy->get_name(this->policy));
if (install_child_sa(this, FALSE) != SUCCESS)
{
SIG(SIG_CHILD_FAILED, "installing CHILD_SA failed, sending NO_PROPOSAL_CHOSEN notify");
SIG(this->failsig, "installing CHILD_SA failed, sending NO_PROPOSAL_CHOSEN notify");
build_notify(NO_PROPOSAL_CHOSEN, CHUNK_INITIALIZER, response, TRUE);
return FAILED;
}
@@ -708,11 +734,16 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
other->nonce_s = chunk_clone(this->nonce_r);
}
}
else
{
/* we only signal when no other transaction is rekeying */
SIG(CHILD_REKEY_SUCCESS, "CHILD_SA rekeyed");
}
this->rekeyed_sa->set_state(this->rekeyed_sa, CHILD_REKEYING);
}
else
{
SIG(SIG_CHILD_UP, "CHILD_SA created");
SIG(CHILD_UP_SUCCESS, "CHILD_SA created");
}
return SUCCESS;
}
@@ -737,7 +768,7 @@ static status_t conclude(private_create_child_sa_t *this, message_t *response,
/* check message type */
if (response->get_exchange_type(response) != CREATE_CHILD_SA)
{
SIG(SIG_CHILD_FAILED, "CREATE_CHILD_SA response of invalid type, aborting");
SIG(this->failsig, "CREATE_CHILD_SA response of invalid type, aborting");
return FAILED;
}
@@ -774,7 +805,7 @@ static status_t conclude(private_create_child_sa_t *this, message_t *response,
}
default:
{
DBG1(SIG_DBG_IKE, "ignoring %N payload",
DBG1(DBG_IKE, "ignoring %N payload",
payload_type_names, payload->get_type(payload));
break;
}
@@ -784,7 +815,7 @@ static status_t conclude(private_create_child_sa_t *this, message_t *response,
if (!(sa_payload && nonce_payload && tsi_payload && tsr_payload))
{
SIG(SIG_CHILD_FAILED, "response message incomplete, no CHILD_SA built");
SIG(this->failsig, "response message incomplete, no CHILD_SA built");
return FAILED;
}
@@ -817,16 +848,15 @@ static status_t conclude(private_create_child_sa_t *this, message_t *response,
this->tsi->get_count(this->tsi) == 0 ||
this->tsr->get_count(this->tsr) == 0)
{
SIG(SIG_CHILD_FAILED, "CHILD_SA negotiation failed, no CHILD_SA built");
SIG(this->failsig, "CHILD_SA negotiation failed, no CHILD_SA built");
return FAILED;
}
new_child = this->child_sa;
if (install_child_sa(this, TRUE) != SUCCESS)
{
SIG(SIG_CHILD_FAILED, "installing CHILD_SA failed, no CHILD_SA built");
SIG(this->failsig, "installing CHILD_SA failed, no CHILD_SA built");
return FAILED;
}
SIG(SIG_CHILD_UP, "CHILD_SA created");
}
/* CHILD_SA successfully created. If the other peer initiated rekeying
* in the meantime, we detect this by comparing the rekeying_transaction
@@ -856,14 +886,14 @@ static status_t conclude(private_create_child_sa_t *this, message_t *response,
if (memcmp(this_lowest.ptr, this->nonce_s.ptr,
min(this_lowest.len, this->nonce_s.len)) < 0)
{
DBG1(SIG_DBG_IKE, "detected simultaneous CHILD_SA rekeying, deleting ours");
DBG1(DBG_IKE, "detected simultaneous CHILD_SA rekeying, deleting ours");
this->lost = TRUE;
}
else
{
DBG1(SIG_DBG_IKE, "detected simultaneous CHILD_SA rekeying, but ours is preferred");
DBG1(DBG_IKE, "detected simultaneous CHILD_SA rekeying, but ours is preferred");
}
}
}
/* delete the old SA if we have won the rekeying nonce compare*/
if (!this->lost)
{
@@ -871,10 +901,13 @@ static status_t conclude(private_create_child_sa_t *this, message_t *response,
delete_child_sa->set_child_sa(delete_child_sa, this->rekeyed_sa);
*next = (transaction_t*)delete_child_sa;
}
/* we send a rekey SUCCESS signal in any case. If the other transaction
* detected our transaction, it did not send a signal. We do it for it. */
SIG(CHILD_REKEY_SUCCESS, "CHILD_SA rekeyed");
}
else
{
SIG(SIG_CHILD_UP, "CHILD_SA created");
SIG(CHILD_UP_SUCCESS, "CHILD_SA created");
}
if (this->lost)
{
@@ -943,6 +976,7 @@ create_child_sa_t *create_child_sa_create(ike_sa_t *ike_sa)
this->tsi = NULL;
this->tsr = NULL;
this->randomizer = randomizer_create();
this->failsig = CHILD_UP_FAILED;
return &this->public;
}
src/charon/sa/transactions/delete_child_sa.c
+9 -9
View File
@@ -128,7 +128,7 @@ static status_t get_request(private_delete_child_sa_t *this, message_t **result)
spi = this->child_sa->get_spi(this->child_sa, TRUE);
delete_payload = delete_payload_create(protocol);
DBG1(SIG_DBG_IKE, "created DELETE payload for %N CHILD_SA with SPI 0x%x",
DBG1(DBG_IKE, "created DELETE payload for %N CHILD_SA with SPI 0x%x",
protocol_id_names, protocol, htonl(spi));
delete_payload->add_spi(delete_payload, spi);
request->add_payload(request, (payload_t*)delete_payload);
@@ -153,7 +153,7 @@ static status_t process_delete(private_delete_child_sa_t *this, delete_payload_t
protocol = delete_request->get_protocol_id(delete_request);
if (protocol != PROTO_ESP && protocol != PROTO_AH)
{
DBG1(SIG_DBG_IKE, "CHILD_SA delete response contained unexpected protocol");
DBG1(DBG_IKE, "CHILD_SA delete response contained unexpected protocol");
return FAILED;
}
@@ -177,7 +177,7 @@ static status_t process_delete(private_delete_child_sa_t *this, delete_payload_t
child_sa->set_state(child_sa, CHILD_DELETING);
DBG1(SIG_DBG_IKE, "received DELETE for %N CHILD_SA with SPI 0x%x, deleting",
DBG1(DBG_IKE, "received DELETE for %N CHILD_SA with SPI 0x%x, deleting",
protocol_id_names, protocol, ntohl(spi));
rekey = child_sa->get_rekeying_transaction(child_sa);
@@ -200,7 +200,7 @@ static status_t process_delete(private_delete_child_sa_t *this, delete_payload_t
}
else
{
DBG1(SIG_DBG_IKE, "received DELETE for %N CHILD_SA with SPI 0x%x, but no such SA",
DBG1(DBG_IKE, "received DELETE for %N CHILD_SA with SPI 0x%x, but no such SA",
protocol_id_names, protocol, ntohl(spi));
}
}
@@ -243,7 +243,7 @@ static status_t get_response(private_delete_child_sa_t *this, message_t *request
if (request->get_exchange_type(request) != INFORMATIONAL)
{
DBG1(SIG_DBG_IKE, "INFORMATIONAL response of invalid type, aborting");
DBG1(DBG_IKE, "INFORMATIONAL response of invalid type, aborting");
return FAILED;
}
@@ -253,7 +253,7 @@ static status_t get_response(private_delete_child_sa_t *this, message_t *request
if (this->ike_sa->get_state(this->ike_sa) == IKE_REKEYING ||
this->ike_sa->get_state(this->ike_sa) == IKE_DELETING)
{
DBG1(SIG_DBG_IKE, "unable to delete CHILD_SA, as rekeying in progress");
DBG1(DBG_IKE, "unable to delete CHILD_SA, as rekeying in progress");
return FAILED;
}
@@ -270,7 +270,7 @@ static status_t get_response(private_delete_child_sa_t *this, message_t *request
}
default:
{
DBG2(SIG_DBG_IKE, "ignoring payload %N",
DBG2(DBG_IKE, "ignoring payload %N",
payload_type_names, payload->get_type(payload));
break;
}
@@ -292,7 +292,7 @@ static status_t conclude(private_delete_child_sa_t *this, message_t *response,
/* check message type */
if (response->get_exchange_type(response) != INFORMATIONAL)
{
DBG1(SIG_DBG_IKE, "INFORMATIONAL response of invalid type, aborting");
DBG1(DBG_IKE, "INFORMATIONAL response of invalid type, aborting");
return FAILED;
}
@@ -309,7 +309,7 @@ static status_t conclude(private_delete_child_sa_t *this, message_t *response,
}
default:
{
DBG1(SIG_DBG_IKE, "ignoring payload %N",
DBG1(DBG_IKE, "ignoring payload %N",
payload_type_names, payload->get_type(payload));
break;
}
src/charon/sa/transactions/delete_ike_sa.c
+5 -5
View File
@@ -155,7 +155,7 @@ static status_t get_response(private_delete_ike_sa_t *this, message_t *request,
/* check message type */
if (request->get_exchange_type(request) != INFORMATIONAL)
{
DBG1(SIG_DBG_IKE, "INFORMATIONAL response of invalid type, deleting IKE_SA");
DBG1(DBG_IKE, "INFORMATIONAL response of invalid type, deleting IKE_SA");
return DESTROY_ME;
}
@@ -172,7 +172,7 @@ static status_t get_response(private_delete_ike_sa_t *this, message_t *request,
}
default:
{
DBG1(SIG_DBG_IKE, "ignoring payload %N",
DBG1(DBG_IKE, "ignoring payload %N",
payload_type_names, payload->get_type(payload));
break;
}
@@ -183,12 +183,12 @@ static status_t get_response(private_delete_ike_sa_t *this, message_t *request,
if (delete_request &&
delete_request->get_protocol_id(delete_request) == PROTO_IKE)
{
DBG1(SIG_DBG_IKE, "DELETE request for IKE_SA received, deleting IKE_SA");
DBG1(DBG_IKE, "DELETE request for IKE_SA received, deleting IKE_SA");
}
else
{
/* should not happen, as we preparsed this at transaction construction */
DBG1(SIG_DBG_IKE, "received a weird DELETE request for IKE_SA, deleting anyway");
DBG1(DBG_IKE, "received a weird DELETE request for IKE_SA, deleting anyway");
}
if (this->ike_sa->get_state(this->ike_sa) == IKE_DELETING)
{
@@ -210,7 +210,7 @@ static status_t conclude(private_delete_ike_sa_t *this, message_t *response,
/* check message type */
if (response->get_exchange_type(response) != INFORMATIONAL)
{
DBG1(SIG_DBG_IKE, "INFORMATIONAL response of invalid type, deleting IKE_SA");
DBG1(DBG_IKE, "INFORMATIONAL response of invalid type, deleting IKE_SA");
return DESTROY_ME;
}
/* this is only an acknowledge. We can't do anything here, but delete
src/charon/sa/transactions/ike_auth.c
+62 -40
View File
@@ -240,7 +240,7 @@ static status_t get_request(private_ike_auth_t *this, message_t **result)
}
else
{
DBG1(SIG_DBG_IKE, "could not find my certificate, certificate payload omitted");
DBG1(DBG_IKE, "could not find my certificate, certificate payload omitted");
}
}
@@ -271,7 +271,8 @@ static status_t get_request(private_ike_auth_t *this, message_t **result)
authenticator->destroy(authenticator);
if (status != SUCCESS)
{
SIG(SIG_IKE_FAILED, "could not generate AUTH data, deleting IKE_SA");
SIG(IKE_UP_FAILED, "could not generate AUTH data, deleting IKE_SA");
SIG(CHILD_UP_FAILED, "initiating CHILD_SA failed, unable to create IKE_SA");
return DESTROY_ME;
}
request->add_payload(request, (payload_t*)auth_payload);
@@ -295,7 +296,8 @@ static status_t get_request(private_ike_auth_t *this, message_t **result)
this->child_sa->set_name(this->child_sa, this->policy->get_name(this->policy));
if (this->child_sa->alloc(this->child_sa, proposal_list) != SUCCESS)
{
SIG(SIG_IKE_FAILED, "could not install CHILD_SA, deleting IKE_SA");
SIG(IKE_UP_FAILED, "could not install CHILD_SA, deleting IKE_SA");
SIG(CHILD_UP_FAILED, "initiating CHILD_SA failed, unable to create IKE_SA");
return DESTROY_ME;
}
sa_payload = sa_payload_create_from_proposal_list(proposal_list);
@@ -337,26 +339,26 @@ static status_t process_notifies(private_ike_auth_t *this, notify_payload_t *not
{
notify_type_t notify_type = notify_payload->get_notify_type(notify_payload);
DBG2(SIG_DBG_IKE, "process notify type %N", notify_type_names, notify_type);
DBG2(DBG_IKE, "process notify type %N", notify_type_names, notify_type);
switch (notify_type)
{
/* these notifies are not critical. no child_sa is built, but IKE stays alive */
case SINGLE_PAIR_REQUIRED:
{
DBG1(SIG_DBG_IKE, "received a SINGLE_PAIR_REQUIRED notify");
SIG(CHILD_UP_FAILED, "received a SINGLE_PAIR_REQUIRED notify");
this->build_child = FALSE;
return SUCCESS;
}
case TS_UNACCEPTABLE:
{
DBG1(SIG_DBG_IKE, "received TS_UNACCEPTABLE notify");
SIG(CHILD_UP_FAILED, "received TS_UNACCEPTABLE notify");
this->build_child = FALSE;
return SUCCESS;
}
case NO_PROPOSAL_CHOSEN:
{
DBG1(SIG_DBG_IKE, "received NO_PROPOSAL_CHOSEN notify");
SIG(CHILD_UP_FAILED, "received NO_PROPOSAL_CHOSEN notify");
this->build_child = FALSE;
return SUCCESS;
}
@@ -364,13 +366,13 @@ static status_t process_notifies(private_ike_auth_t *this, notify_payload_t *not
{
if (notify_type < 16383)
{
SIG(SIG_IKE_FAILED, "received %N notify error, deleting IKE_SA",
SIG(IKE_UP_FAILED, "received %N notify error, deleting IKE_SA",
notify_type_names, notify_type);
return DESTROY_ME;
}
else
{
DBG1(SIG_DBG_IKE, "received %N notify, ignored",
DBG1(DBG_IKE, "received %N notify, ignored",
notify_type_names, notify_type);
return SUCCESS;
}
@@ -414,7 +416,7 @@ static void import_certificate(private_ike_auth_t *this, cert_payload_t *cert_pa
encoding = cert_payload->get_cert_encoding(cert_payload);
if (encoding != CERT_X509_SIGNATURE)
{
DBG1(SIG_DBG_IKE, "certificate payload %N not supported, ignored",
DBG1(DBG_IKE, "certificate payload %N not supported, ignored",
cert_encoding_names, encoding);
return;
}
@@ -423,7 +425,7 @@ static void import_certificate(private_ike_auth_t *this, cert_payload_t *cert_pa
{
if (charon->credentials->verify(charon->credentials, cert, &found))
{
DBG2(SIG_DBG_IKE, "received end entity certificate is trusted, added to store");
DBG2(DBG_IKE, "received end entity certificate is trusted, added to store");
if (!found)
{
charon->credentials->add_end_certificate(charon->credentials, cert);
@@ -435,13 +437,13 @@ static void import_certificate(private_ike_auth_t *this, cert_payload_t *cert_pa
}
else
{
DBG1(SIG_DBG_IKE, "received end entity certificate is not trusted, discarded");
DBG1(DBG_IKE, "received end entity certificate is not trusted, discarded");
cert->destroy(cert);
}
}
else
{
DBG1(SIG_DBG_IKE, "parsing of received certificate failed, discarded");
DBG1(DBG_IKE, "parsing of received certificate failed, discarded");
}
}
@@ -521,6 +523,8 @@ static status_t get_response(private_ike_auth_t *this, message_t *request,
return SUCCESS;
}
SIG(CHILD_UP_START, "setting up CHILD_SA along with IKE_AUTH");
me = this->ike_sa->get_my_host(this->ike_sa);
other = this->ike_sa->get_other_host(this->ike_sa);
this->message_id = request->get_message_id(request);
@@ -539,7 +543,8 @@ static status_t get_response(private_ike_auth_t *this, message_t *request,
/* check message type */
if (request->get_exchange_type(request) != IKE_AUTH)
{
SIG(SIG_IKE_FAILED, "IKE_AUTH response of invalid type, deleting IKE_SA");
SIG(IKE_UP_FAILED, "IKE_AUTH response of invalid type, deleting IKE_SA");
SIG(CHILD_UP_FAILED, "initiating CHILD_SA failed, unable to create IKE_SA");
return DESTROY_ME;
}
@@ -582,13 +587,14 @@ static status_t get_response(private_ike_auth_t *this, message_t *request,
if (status == DESTROY_ME)
{
payloads->destroy(payloads);
SIG(CHILD_UP_FAILED, "initiating CHILD_SA failed, unable to create IKE_SA");
return DESTROY_ME;
}
break;
}
default:
{
DBG1(SIG_DBG_IKE, "ignoring %N payload",
DBG1(DBG_IKE, "ignoring %N payload",
payload_type_names, payload->get_type(payload));
break;
}
@@ -600,7 +606,8 @@ static status_t get_response(private_ike_auth_t *this, message_t *request,
if (!(idi_request && auth_request && sa_request && tsi_request && tsr_request))
{
build_notify(INVALID_SYNTAX, response, TRUE);
SIG(SIG_IKE_FAILED, "request message incomplete, deleting IKE_SA");
SIG(IKE_UP_FAILED, "request message incomplete, deleting IKE_SA");
SIG(CHILD_UP_FAILED, "initiating CHILD_SA failed, unable to create IKE_SA");
return DESTROY_ME;
}
@@ -638,8 +645,9 @@ static status_t get_response(private_ike_auth_t *this, message_t *request,
* traffic selectors. Then we would create a IKE_SA without a CHILD_SA. */
if (this->policy == NULL)
{
SIG(SIG_IKE_FAILED, "no acceptable policy for IDs %D - %D found, "
SIG(IKE_UP_FAILED, "no acceptable policy for IDs %D - %D found, "
"deleting IKE_SA", my_id, other_id);
SIG(CHILD_UP_FAILED, "initiating CHILD_SA failed, unable to create IKE_SA");
my_id->destroy(my_id);
other_id->destroy(other_id);
build_notify(AUTHENTICATION_FAILED, response, TRUE);
@@ -670,7 +678,7 @@ static status_t get_response(private_ike_auth_t *this, message_t *request,
}
else
{
DBG1(SIG_DBG_IKE, "could not find my certificate, cert payload omitted");
DBG1(DBG_IKE, "could not find my certificate, cert payload omitted");
}
}
@@ -695,7 +703,8 @@ static status_t get_response(private_ike_auth_t *this, message_t *request,
TRUE);
if (status != SUCCESS)
{
SIG(SIG_IKE_FAILED, "authentication failed, deleting IKE_SA");
SIG(IKE_UP_FAILED, "authentication failed, deleting IKE_SA");
SIG(CHILD_UP_FAILED, "initiating CHILD_SA failed, unable to create IKE_SA");
build_notify(AUTHENTICATION_FAILED, response, TRUE);
authenticator->destroy(authenticator);
return DESTROY_ME;
@@ -709,13 +718,17 @@ static status_t get_response(private_ike_auth_t *this, message_t *request,
authenticator->destroy(authenticator);
if (status != SUCCESS)
{
SIG(SIG_IKE_FAILED, "authentication data generation failed, deleting IKE_SA");
SIG(IKE_UP_FAILED, "authentication data generation failed, deleting IKE_SA");
SIG(CHILD_UP_FAILED, "initiating CHILD_SA failed, unable to create IKE_SA");
build_notify(AUTHENTICATION_FAILED, response, TRUE);
return DESTROY_ME;
}
response->add_payload(response, (payload_t*)auth_response);
}
SIG(IKE_UP_SUCCESS, "IKE_SA '%s' established between %H[%D]...%H[%D]",
this->ike_sa->get_name(this->ike_sa), me, my_id, other, other_id);
{ /* process SA payload */
linked_list_t *proposal_list;
sa_payload_t *sa_response;
@@ -728,22 +741,22 @@ static status_t get_response(private_ike_auth_t *this, message_t *request,
/* get proposals from request, and select one with ours */
proposal_list = sa_request->get_proposals(sa_request);
DBG2(SIG_DBG_IKE, "selecting proposals:");
DBG2(DBG_IKE, "selecting proposals:");
this->proposal = this->policy->select_proposal(this->policy, proposal_list);
proposal_list->destroy_offset(proposal_list, offsetof(proposal_t, destroy));
/* do we have a proposal? */
if (this->proposal == NULL)
{
SIG(SIG_CHILD_FAILED, "CHILD_SA proposals unacceptable, no CHILD_SA created");
DBG1(SIG_DBG_IKE, "adding NO_PROPOSAL_CHOSEN notify to response");
SIG(CHILD_UP_FAILED, "CHILD_SA proposals unacceptable, no CHILD_SA created");
DBG1(DBG_IKE, "adding NO_PROPOSAL_CHOSEN notify to response");
build_notify(NO_PROPOSAL_CHOSEN, response, FALSE);
}
/* do we have traffic selectors? */
else if (this->tsi->get_count(this->tsi) == 0 || this->tsr->get_count(this->tsr) == 0)
{
SIG(SIG_CHILD_FAILED, "CHILD_SA traffic selectors unacceptable, no CHILD_SA created");
DBG1(SIG_DBG_IKE, "adding TS_UNACCEPTABLE notify to response");
SIG(CHILD_UP_FAILED, "CHILD_SA traffic selectors unacceptable, no CHILD_SA created");
DBG1(DBG_IKE, "adding TS_UNACCEPTABLE notify to response");
build_notify(TS_UNACCEPTABLE, response, FALSE);
}
else
@@ -760,15 +773,15 @@ static status_t get_response(private_ike_auth_t *this, message_t *request,
this->child_sa->set_name(this->child_sa, this->policy->get_name(this->policy));
if (install_child_sa(this, FALSE) != SUCCESS)
{
SIG(SIG_IKE_FAILED, "installing CHILD_SA failed, no CHILD_SA created");
DBG1(SIG_DBG_IKE, "adding NO_PROPOSAL_CHOSEN notify to response");
SIG(CHILD_UP_FAILED, "installing CHILD_SA failed, no CHILD_SA created");
DBG1(DBG_IKE, "adding NO_PROPOSAL_CHOSEN notify to response");
build_notify(NO_PROPOSAL_CHOSEN, response, FALSE);
}
else
{
/* add proposal to sa payload */
sa_response->add_proposal(sa_response, this->proposal);
SIG(SIG_CHILD_UP, "CHILD_SA created");
SIG(CHILD_UP_SUCCESS, "CHILD_SA created");
}
}
response->add_payload(response, (payload_t*)sa_response);
@@ -794,7 +807,7 @@ static status_t conclude(private_ike_auth_t *this, message_t *response,
iterator_t *payloads;
payload_t *payload;
host_t *me, *other;
identification_t *other_id;
identification_t *other_id, *my_id;
ts_payload_t *tsi_payload = NULL;
ts_payload_t *tsr_payload = NULL;
id_payload_t *idr_payload = NULL;
@@ -806,7 +819,8 @@ static status_t conclude(private_ike_auth_t *this, message_t *response,
/* check message type */
if (response->get_exchange_type(response) != IKE_AUTH)
{
SIG(SIG_IKE_FAILED, "IKE_AUTH response of invalid type, deleting IKE_SA");
SIG(IKE_UP_FAILED, "IKE_AUTH response of invalid type, deleting IKE_SA");
SIG(CHILD_UP_FAILED, "initiating CHILD_SA failed, unable to create IKE_SA");
return DESTROY_ME;
}
@@ -843,11 +857,12 @@ static status_t conclude(private_ike_auth_t *this, message_t *response,
if (status == FAILED)
{
payloads->destroy(payloads);
/* we return SUCCESS, returned FAILED means do next transaction */
/* we return SUCCESS, as transaction completet */
return SUCCESS;
}
if (status == DESTROY_ME)
{
SIG(CHILD_UP_FAILED, "initiating CHILD_SA failed, unable to create IKE_SA");
payloads->destroy(payloads);
return status;
}
@@ -855,7 +870,7 @@ static status_t conclude(private_ike_auth_t *this, message_t *response,
}
default:
{
DBG1(SIG_DBG_IKE, "ignoring payload %N",
DBG1(DBG_IKE, "ignoring payload %N",
payload_type_names, payload->get_type(payload));
break;
}
@@ -865,7 +880,8 @@ static status_t conclude(private_ike_auth_t *this, message_t *response,
if (!(idr_payload && auth_payload && sa_payload && tsi_payload && tsr_payload))
{
SIG(SIG_IKE_FAILED, "response message incomplete, deleting IKE_SA");
SIG(IKE_UP_FAILED, "response message incomplete, deleting IKE_SA");
SIG(CHILD_UP_FAILED, "initiating CHILD_SA failed, unable to create IKE_SA");
return DESTROY_ME;
}
@@ -879,8 +895,9 @@ static status_t conclude(private_ike_auth_t *this, message_t *response,
if (!other_id->matches(other_id, configured_other_id, &wildcards))
{
other_id->destroy(other_id);
SIG(SIG_IKE_FAILED, "other peer uses unacceptable ID (%D, excepted "
SIG(IKE_UP_FAILED, "other peer uses unacceptable ID (%D, excepted "
"%D), deleting IKE_SA", other_id, configured_other_id);
SIG(CHILD_UP_FAILED, "initiating CHILD_SA failed, unable to create IKE_SA");
return DESTROY_ME;
}
/* update other ID. It was already set, but may contain wildcards */
@@ -895,7 +912,6 @@ static status_t conclude(private_ike_auth_t *this, message_t *response,
{ /* authenticate peer */
authenticator_t *authenticator;
auth_method_t auth_method;
identification_t *my_id;
status_t status;
auth_method = this->policy->get_auth_method(this->policy);
@@ -912,12 +928,16 @@ static status_t conclude(private_ike_auth_t *this, message_t *response,
authenticator->destroy(authenticator);
if (status != SUCCESS)
{
SIG(SIG_IKE_FAILED, "authentication of '%D' with %N failed, "
"deleting IKE_SA", other_id, auth_method_names, auth_method);
SIG(IKE_UP_FAILED, "authentication of '%D' with %N failed, "
"deleting IKE_SA", other_id, auth_method_names, auth_method);
SIG(CHILD_UP_FAILED, "initiating CHILD_SA failed, unable to create IKE_SA");
return DESTROY_ME;
}
}
SIG(IKE_UP_SUCCESS, "IKE_SA '%s' established between %H[%D]...%H[%D]",
this->ike_sa->get_name(this->ike_sa), me, my_id, other, other_id);
{ /* process traffic selectors for us */
linked_list_t *ts_received = tsi_payload->get_traffic_selectors(tsi_payload);
this->tsi = this->policy->select_my_traffic_selectors(this->policy, ts_received, me);
@@ -944,17 +964,19 @@ static status_t conclude(private_ike_auth_t *this, message_t *response,
this->tsr->get_count(this->tsr) == 0 ||
!this->build_child)
{
SIG(SIG_CHILD_FAILED, "CHILD_SA negotiation failed, no CHILD_SA built");
SIG(CHILD_UP_FAILED, "CHILD_SA negotiation failed, no CHILD_SA built");
}
else
{
if (install_child_sa(this, TRUE) != SUCCESS)
{
SIG(SIG_CHILD_FAILED, "installing CHILD_SA failed, no CHILD_SA built");
SIG(CHILD_UP_FAILED, "installing CHILD_SA failed, no CHILD_SA built");
/* TODO: we should send a DELETE for that CHILD to stay
* synchronous with the peer */
}
else
{
SIG(SIG_CHILD_UP, "CHILD_SA created");
SIG(CHILD_UP_SUCCESS, "CHILD_SA created");
}
}
}
src/charon/sa/transactions/ike_sa_init.c
+59 -38
View File
@@ -232,8 +232,8 @@ static chunk_t generate_natd_hash(private_ike_sa_init_t *this,
/* natd_hash = SHA1( spi_i | spi_r | address | port ) */
natd_chunk = chunk_cat("cccc", spi_i_chunk, spi_r_chunk, addr_chunk, port_chunk);
this->nat_hasher->allocate_hash(this->nat_hasher, natd_chunk, &natd_hash);
DBG3(SIG_DBG_IKE, "natd_chunk %B", &natd_chunk);
DBG3(SIG_DBG_IKE, "natd_hash %B", &natd_hash);
DBG3(DBG_IKE, "natd_chunk %B", &natd_chunk);
DBG3(DBG_IKE, "natd_hash %B", &natd_hash);
chunk_free(&natd_chunk);
return natd_hash;
@@ -280,7 +280,7 @@ static status_t get_request(private_ike_sa_init_t *this, message_t **result)
other = this->connection->get_other_host(this->connection);
/* we already set up the IDs. Mine is already fully qualified, other
* will be updated in the ike_auth transaction */
* will be updated in the ike_auth transaction */
my_id = this->policy->get_my_id(this->policy);
other_id = this->policy->get_other_id(this->policy);
this->ike_sa->set_my_id(this->ike_sa, my_id->clone(my_id));
@@ -292,6 +292,12 @@ static status_t get_request(private_ike_sa_init_t *this, message_t **result)
this->ike_sa->set_name(this->ike_sa, name);
}
/* setting up a IKE_SA implicitly requires setup of a CHILD_SA */
SIG(IKE_UP_START, "initiating IKE_SA '%s' between %H[%D]...%H[%D]",
this->connection->get_name(this->connection), me, my_id, other, other_id);
SIG(CHILD_UP_START, "establishing CHILD_SA '%s' along with IKE_SA",
this->policy->get_name(this->policy));
/* build the request */
request = message_create();
request->set_source(request, me->clone(me));
@@ -314,8 +320,10 @@ static status_t get_request(private_ike_sa_init_t *this, message_t **result)
this->diffie_hellman = diffie_hellman_create(dh_group);
if (this->diffie_hellman == NULL)
{
SIG(SIG_IKE_FAILED, "DH group %N not supported, aborting",
SIG(IKE_UP_FAILED, "DH group %N not supported, aborting",
diffie_hellman_group_names, dh_group);
SIG(CHILD_UP_FAILED,
"initiating CHILD_SA failed, unable to create IKE_SA");
return DESTROY_ME;
}
}
@@ -345,7 +353,9 @@ static status_t get_request(private_ike_sa_init_t *this, message_t **result)
if (this->randomizer->allocate_pseudo_random_bytes(this->randomizer,
NONCE_SIZE, &this->nonce_i) != SUCCESS)
{
SIG(SIG_IKE_FAILED, "could not generate nonce, aborting");
SIG(IKE_UP_FAILED, "could not generate nonce, aborting");
SIG(CHILD_UP_FAILED,
"initiating CHILD_SA failed, unable to create IKE_SA");
return DESTROY_ME;
}
nonce_payload = nonce_payload_create();
@@ -388,19 +398,19 @@ static status_t process_notifys(private_ike_sa_init_t *this, notify_payload_t *n
chunk_t notification_data;
notify_type_t notify_type = notify_payload->get_notify_type(notify_payload);
DBG2(SIG_DBG_IKE, "process notify type %N", notify_type_names, notify_type);
DBG2(DBG_IKE, "process notify type %N", notify_type_names, notify_type);
switch (notify_type)
{
case NO_PROPOSAL_CHOSEN:
{
SIG(SIG_IKE_FAILED,
SIG(IKE_UP_FAILED,
"received a NO_PROPOSAL_CHOSEN notify, deleting IKE_SA");
return DESTROY_ME;
}
case INVALID_MAJOR_VERSION:
{
SIG(SIG_IKE_FAILED,
SIG(IKE_UP_FAILED,
"received a INVALID_MAJOR_VERSION notify, deleting IKE_SA");
return DESTROY_ME;
}
@@ -414,12 +424,13 @@ static status_t process_notifys(private_ike_sa_init_t *this, notify_payload_t *n
notify_data = notify_payload->get_notification_data(notify_payload);
dh_group = ntohs(*((u_int16_t*)notify_data.ptr));
DBG1(SIG_DBG_IKE, "peer didn't accept DH group %N, it requested %N",
DBG1(DBG_IKE, "peer didn't accept DH group %N, it requested %N",
diffie_hellman_group_names, old_dh_group,
diffie_hellman_group_names, dh_group);
if (!this->connection->check_dh_group(this->connection, dh_group))
{
DBG1(SIG_DBG_IKE, "requested DH group not acceptable, aborting");
SIG(IKE_UP_FAILED, "DH group %N not acceptable, aborting",
diffie_hellman_group_names, dh_group);
return DESTROY_ME;
}
retry = ike_sa_init_create(this->ike_sa);
@@ -441,11 +452,11 @@ static status_t process_notifys(private_ike_sa_init_t *this, notify_payload_t *n
if (chunk_equals(notification_data, this->natd_dst_hash))
{
this->natd_dst_matched = TRUE;
DBG2(SIG_DBG_IKE, "NAT-D dst hash match");
DBG2(DBG_IKE, "NAT-D dst hash match");
}
else
{
DBG2(SIG_DBG_IKE, "NAT-D dst hash mismatch");
DBG2(DBG_IKE, "NAT-D dst hash mismatch");
}
return SUCCESS;
}
@@ -460,11 +471,11 @@ static status_t process_notifys(private_ike_sa_init_t *this, notify_payload_t *n
if (chunk_equals(notification_data, this->natd_src_hash))
{
this->natd_src_matched = TRUE;
DBG2(SIG_DBG_IKE, "NAT-D src hash match");
DBG2(DBG_IKE, "NAT-D src hash match");
}
else
{
DBG2(SIG_DBG_IKE, "NAT-D src hash mismatch");
DBG2(DBG_IKE, "NAT-D src hash mismatch");
}
return SUCCESS;
}
@@ -472,13 +483,13 @@ static status_t process_notifys(private_ike_sa_init_t *this, notify_payload_t *n
{
if (notify_type < 16383)
{
SIG(SIG_IKE_FAILED, "received %N notify error, deleting IKE_SA",
SIG(IKE_UP_FAILED, "received %N notify error, deleting IKE_SA",
notify_type_names, notify_type);
return DESTROY_ME;
}
else
{
SIG(SIG_IKE_FAILED, "received %N notify, ignored",
DBG1(DBG_IKE, "received %N notify, ignored",
notify_type_names, notify_type);
return SUCCESS;
}
@@ -516,6 +527,8 @@ static status_t get_response(private_ike_sa_init_t *this,
other = request->get_source(request);
this->message_id = request->get_message_id(request);
SIG(IKE_UP_START, "establishing IKE_SA between %H...%H", me, other);
/* set up response */
response = message_create();
response->set_source(response, me->clone(me));
@@ -530,7 +543,7 @@ static status_t get_response(private_ike_sa_init_t *this,
/* check message type */
if (request->get_exchange_type(request) != IKE_SA_INIT)
{
SIG(SIG_IKE_FAILED, "IKE_SA_INIT request of invalid type, deleting IKE_SA");
SIG(IKE_UP_FAILED, "IKE_SA_INIT request of invalid type, deleting IKE_SA");
return DESTROY_ME;
}
@@ -543,7 +556,7 @@ static status_t get_response(private_ike_sa_init_t *this,
notify->set_notify_type(notify, NO_PROPOSAL_CHOSEN);
response->add_payload(response, (payload_t*)notify);
SIG(SIG_IKE_FAILED, "no connection for hosts %H...%H found, "
SIG(IKE_UP_FAILED, "no connection for hosts %H...%H found, "
"deleting IKE_SA", me, other);
return DESTROY_ME;
}
@@ -594,7 +607,7 @@ static status_t get_response(private_ike_sa_init_t *this,
}
default:
{
DBG2(SIG_DBG_IKE, "ignoring %N payload",
DBG2(DBG_IKE, "ignoring %N payload",
payload_type_names, payload->get_type(payload));
break;
}
@@ -608,7 +621,7 @@ static status_t get_response(private_ike_sa_init_t *this,
notify_payload_t *notify = notify_payload_create();
notify->set_notify_type(notify, INVALID_SYNTAX);
response->add_payload(response, (payload_t*)notify);
SIG(SIG_IKE_FAILED, "request message incomplete, deleting IKE_SA");
SIG(IKE_UP_FAILED, "received request message incomplete, deleting IKE_SA");
return DESTROY_ME;
}
@@ -630,7 +643,7 @@ static status_t get_response(private_ike_sa_init_t *this,
notify_payload_t *notify = notify_payload_create();
notify->set_notify_type(notify, NO_PROPOSAL_CHOSEN);
response->add_payload(response, (payload_t*)notify);
SIG(SIG_IKE_FAILED, "request did not contain any acceptable "
SIG(IKE_UP_FAILED, "request did not contain any acceptable "
"proposals, deleting IKE_SA");
return DESTROY_ME;
}
@@ -660,10 +673,10 @@ static status_t get_response(private_ike_sa_init_t *this,
payload_t *payload;
notify_group = this->connection->get_dh_group(this->connection);
DBG1(SIG_DBG_IKE, "request used inacceptable DH group %N, sending "
"INVALID_KE_PAYLOAD with %N, deleting IKE_SA",
diffie_hellman_group_names, used_group,
diffie_hellman_group_names, notify_group);
SIG(IKE_UP_FAILED, "request used inacceptable DH group %N, sending "
"INVALID_KE_PAYLOAD with %N, deleting IKE_SA",
diffie_hellman_group_names, used_group,
diffie_hellman_group_names, notify_group);
/* remove already added payloads */
iterator = response->get_payload_iterator(response);
@@ -707,7 +720,7 @@ static status_t get_response(private_ike_sa_init_t *this,
notify_payload_t *notify = notify_payload_create();
notify->set_notify_type(notify, NO_PROPOSAL_CHOSEN);
response->add_payload(response, (payload_t*)notify);
SIG(SIG_IKE_FAILED, "could not create nonce, deleting IKE_SA");
SIG(IKE_UP_FAILED, "could not create nonce, deleting IKE_SA");
return DESTROY_ME;
}
nonce_response = nonce_payload_create();
@@ -729,7 +742,7 @@ static status_t get_response(private_ike_sa_init_t *this,
notify = notify_payload_create();
notify->set_notify_type(notify, INVALID_SYNTAX);
response->add_payload(response, (payload_t*)notify);
SIG(SIG_IKE_FAILED, "request contained invalid number of NAT-D"
SIG(IKE_UP_FAILED, "request contained invalid number of NAT-D"
"payloads, deleting IKE_SA");
return DESTROY_ME;
}
@@ -763,7 +776,7 @@ static status_t get_response(private_ike_sa_init_t *this,
notify_payload_t *notify = notify_payload_create();
notify->set_notify_type(notify, NO_PROPOSAL_CHOSEN);
response->add_payload(response, (payload_t*)notify);
SIG(SIG_IKE_FAILED, "error creating transform from proposal, deleting IKE_SA");
SIG(IKE_UP_FAILED, "error creating transforms from proposal, deleting IKE_SA");
return DESTROY_ME;
}
@@ -781,7 +794,7 @@ static status_t get_response(private_ike_sa_init_t *this,
* as we don't use a crypter/signer in ike_sa_init... */
if (response->generate(response, NULL, NULL, &response_packet) != SUCCESS)
{
SIG(SIG_IKE_FAILED, "error in response generation, deleting IKE_SA");
SIG(IKE_UP_FAILED, "error in response generation, deleting IKE_SA");
return DESTROY_ME;
}
response_packet->destroy(response_packet);
@@ -835,7 +848,8 @@ static status_t conclude(private_ike_sa_init_t *this, message_t *response,
/* check message type */
if (response->get_exchange_type(response) != IKE_SA_INIT)
{
SIG(SIG_IKE_FAILED, "IKE_SA_INIT response of invalid type, deleting IKE_SA");
SIG(IKE_UP_FAILED, "IKE_SA_INIT response of invalid type, deleting IKE_SA");
SIG(CHILD_UP_FAILED, "initiating CHILD_SA failed, unable to create IKE_SA");
return DESTROY_ME;
}
@@ -849,7 +863,8 @@ static status_t conclude(private_ike_sa_init_t *this, message_t *response,
responder_spi = response->get_responder_spi(response);
if (responder_spi == 0)
{
SIG(SIG_IKE_FAILED, "response contained a SPI of zero, deleting IKE_SA");
SIG(IKE_UP_FAILED, "response contained a SPI of zero, deleting IKE_SA");
SIG(CHILD_UP_FAILED, "initiating CHILD_SA failed, unable to create IKE_SA");
return DESTROY_ME;
}
@@ -890,6 +905,7 @@ static status_t conclude(private_ike_sa_init_t *this, message_t *response,
}
if (status == DESTROY_ME)
{
SIG(CHILD_UP_FAILED, "initiating CHILD_SA failed, unable to create IKE_SA");
payloads->destroy(payloads);
return status;
}
@@ -897,7 +913,7 @@ static status_t conclude(private_ike_sa_init_t *this, message_t *response,
}
default:
{
DBG1(SIG_DBG_IKE, "ignoring payload %N",
DBG1(DBG_IKE, "ignoring payload %N",
payload_type_names, payload->get_type(payload));
break;
}
@@ -907,7 +923,8 @@ static status_t conclude(private_ike_sa_init_t *this, message_t *response,
if (!(nonce_payload && sa_payload && ke_payload))
{
SIG(SIG_IKE_FAILED, "response message incomplete, deleting IKE_SA");
SIG(IKE_UP_FAILED, "response message incomplete, deleting IKE_SA");
SIG(CHILD_UP_FAILED, "initiating CHILD_SA failed, unable to create IKE_SA");
return DESTROY_ME;
}
@@ -923,7 +940,8 @@ static status_t conclude(private_ike_sa_init_t *this, message_t *response,
proposal_list = sa_payload->get_proposals (sa_payload);
if (proposal_list->get_count(proposal_list) != 1)
{
SIG(SIG_IKE_FAILED, "response did not contain a single proposal, deleting IKE_SA");
SIG(IKE_UP_FAILED, "response did not contain a single proposal, deleting IKE_SA");
SIG(CHILD_UP_FAILED, "initiating CHILD_SA failed, unable to create IKE_SA");
proposal_list->destroy_offset(proposal_list, offsetof(proposal_t, destroy));
return DESTROY_ME;
}
@@ -934,7 +952,8 @@ static status_t conclude(private_ike_sa_init_t *this, message_t *response,
if (this->proposal == NULL)
{
SIG(SIG_IKE_FAILED, "peer selected a proposal we did not offer, deleting IKE_SA");
SIG(IKE_UP_FAILED, "peer selected a proposal we did not offer, deleting IKE_SA");
SIG(CHILD_UP_FAILED, "initiating CHILD_SA failed, unable to create IKE_SA");
return DESTROY_ME;
}
}
@@ -962,7 +981,8 @@ static status_t conclude(private_ike_sa_init_t *this, message_t *response,
if ((!this->natd_dst_seen && this->natd_src_seen) ||
(this->natd_dst_seen && !this->natd_src_seen))
{
SIG(SIG_IKE_FAILED, "request contained invalid number of NAT-D payloads, deleting IKE_SA");
SIG(IKE_UP_FAILED, "request contained invalid number of NAT-D payloads, deleting IKE_SA");
SIG(CHILD_UP_FAILED, "initiating CHILD_SA failed, unable to create IKE_SA");
return DESTROY_ME;
}
if (this->natd_src_seen && !this->natd_src_matched)
@@ -980,7 +1000,7 @@ static status_t conclude(private_ike_sa_init_t *this, message_t *response,
other = this->ike_sa->get_other_host(this->ike_sa);
other->set_port(other, IKEV2_NATT_PORT);
DBG2(SIG_DBG_IKE, "switching to port %d", IKEV2_NATT_PORT);
DBG2(DBG_IKE, "switching to port %d", IKEV2_NATT_PORT);
}
}
@@ -994,7 +1014,8 @@ static status_t conclude(private_ike_sa_init_t *this, message_t *response,
this->nonce_i, this->nonce_r,
TRUE, NULL, NULL) != SUCCESS)
{
SIG(SIG_IKE_FAILED, "error creating transforms from proposal, deleting IKE_SA");
SIG(IKE_UP_FAILED, "error creating transforms from proposal, deleting IKE_SA");
SIG(CHILD_UP_FAILED, "initiating CHILD_SA failed, unable to create IKE_SA");
return DESTROY_ME;
}
src/charon/sa/transactions/rekey_ike_sa.c
+24 -24
View File
@@ -167,7 +167,7 @@ static status_t get_request(private_rekey_ike_sa_t *this, message_t **result)
if (this->ike_sa->get_state(this->ike_sa) != IKE_ESTABLISHED &&
!this->diffie_hellman)
{
DBG1(SIG_DBG_IKE, "tried to rekey in state %N, aborted",
DBG1(DBG_IKE, "tried to rekey in state %N, aborted",
ike_sa_state_names, this->ike_sa->get_state(this->ike_sa));
return FAILED;
}
@@ -205,7 +205,7 @@ static status_t get_request(private_rekey_ike_sa_t *this, message_t **result)
me, other);
if (this->connection == NULL)
{
DBG1(SIG_DBG_IKE, "no connection found to rekey IKE_SA");
DBG1(DBG_IKE, "no connection found to rekey IKE_SA");
return FAILED;
}
}
@@ -252,7 +252,7 @@ static status_t get_request(private_rekey_ike_sa_t *this, message_t **result)
this->diffie_hellman = diffie_hellman_create(dh_group);
if (this->diffie_hellman == NULL)
{
DBG1(SIG_DBG_IKE, "DH group %N not supported, aborting",
DBG1(DBG_IKE, "DH group %N not supported, aborting",
diffie_hellman_group_names, dh_group);
return FAILED;
}
@@ -282,13 +282,13 @@ static status_t process_notifys(private_rekey_ike_sa_t *this, notify_payload_t *
{
notify_type_t notify_type = notify_payload->get_notify_type(notify_payload);
DBG2(SIG_DBG_IKE,"process notify type %N", notify_type_names, notify_type);
DBG2(DBG_IKE,"process notify type %N", notify_type_names, notify_type);
switch (notify_type)
{
case NO_PROPOSAL_CHOSEN:
{
DBG1(SIG_DBG_IKE, "received a NO_PROPOSAL_CHOSEN notify, IKE_SA rekeying failed");
DBG1(DBG_IKE, "received a NO_PROPOSAL_CHOSEN notify, IKE_SA rekeying failed");
return FAILED;
}
case INVALID_KE_PAYLOAD:
@@ -301,12 +301,12 @@ static status_t process_notifys(private_rekey_ike_sa_t *this, notify_payload_t *
notify_data = notify_payload->get_notification_data(notify_payload);
dh_group = ntohs(*((u_int16_t*)notify_data.ptr));
DBG1(SIG_DBG_IKE, "peer didn't accept DH group %N, it requested %N",
DBG1(DBG_IKE, "peer didn't accept DH group %N, it requested %N",
diffie_hellman_group_names, old_dh_group,
diffie_hellman_group_names, dh_group);
if (!this->connection->check_dh_group(this->connection, dh_group))
{
DBG1(SIG_DBG_IKE, "requested DH group not acceptable, IKE_SA rekeying failed");
DBG1(DBG_IKE, "requested DH group not acceptable, IKE_SA rekeying failed");
return FAILED;
}
retry = rekey_ike_sa_create(this->ike_sa);
@@ -318,13 +318,13 @@ static status_t process_notifys(private_rekey_ike_sa_t *this, notify_payload_t *
{
if (notify_type < 16383)
{
DBG1(SIG_DBG_IKE, "received %N notify error, IKE_SA rekeying failed",
DBG1(DBG_IKE, "received %N notify error, IKE_SA rekeying failed",
notify_type_names, notify_type);
return FAILED;
}
else
{
DBG1(SIG_DBG_IKE, "received %N notify, ignored",
DBG1(DBG_IKE, "received %N notify, ignored",
notify_type_names, notify_type);
return SUCCESS;
}
@@ -438,7 +438,7 @@ static status_t get_response(private_rekey_ike_sa_t *this, message_t *request,
/* check message type */
if (request->get_exchange_type(request) != CREATE_CHILD_SA)
{
DBG1(SIG_DBG_IKE, "CREATE_CHILD_SA response of invalid type, aborted");
DBG1(DBG_IKE, "CREATE_CHILD_SA response of invalid type, aborted");
return FAILED;
}
@@ -446,7 +446,7 @@ static status_t get_response(private_rekey_ike_sa_t *this, message_t *request,
if (this->ike_sa->get_state(this->ike_sa) == IKE_DELETING)
{
build_notify(NO_PROPOSAL_CHOSEN, CHUNK_INITIALIZER, response, TRUE);
DBG1(SIG_DBG_IKE, "unable to rekey, as delete in progress. Sending NO_PROPOSAL_CHOSEN");
DBG1(DBG_IKE, "unable to rekey, as delete in progress. Sending NO_PROPOSAL_CHOSEN");
return FAILED;
}
@@ -460,7 +460,7 @@ static status_t get_response(private_rekey_ike_sa_t *this, message_t *request,
state == CHILD_DELETING)
{
build_notify(NO_PROPOSAL_CHOSEN, CHUNK_INITIALIZER, response, TRUE);
DBG1(SIG_DBG_IKE, "unable to rekey, one CHILD_SA is half open. Sending NO_PROPOSAL_CHOSEN");
DBG1(DBG_IKE, "unable to rekey, one CHILD_SA is half open. Sending NO_PROPOSAL_CHOSEN");
iterator->destroy(iterator);
return FAILED;
}
@@ -481,7 +481,7 @@ static status_t get_response(private_rekey_ike_sa_t *this, message_t *request,
charon->connections, me, other);
if (this->connection == NULL)
{
DBG1(SIG_DBG_IKE, "no connection found to rekey IKE_SA, sending NO_RROPOSAL_CHOSEN");
DBG1(DBG_IKE, "no connection found to rekey IKE_SA, sending NO_RROPOSAL_CHOSEN");
build_notify(NO_PROPOSAL_CHOSEN, CHUNK_INITIALIZER, response, TRUE);
return FAILED;
}
@@ -516,7 +516,7 @@ static status_t get_response(private_rekey_ike_sa_t *this, message_t *request,
}
default:
{
DBG1(SIG_DBG_IKE, "ignoring %N payload",
DBG1(DBG_IKE, "ignoring %N payload",
payload_type_names, payload->get_type(payload));
break;
}
@@ -528,7 +528,7 @@ static status_t get_response(private_rekey_ike_sa_t *this, message_t *request,
if (!(sa_request && nonce_request && ke_request))
{
build_notify(INVALID_SYNTAX, CHUNK_INITIALIZER, response, TRUE);
DBG1(SIG_DBG_IKE, "request message incomplete, IKE_SA rekeying failed");
DBG1(DBG_IKE, "request message incomplete, IKE_SA rekeying failed");
return FAILED;
}
@@ -553,14 +553,14 @@ static status_t get_response(private_rekey_ike_sa_t *this, message_t *request,
sa_response = sa_payload_create();
/* get proposals from request, and select one with ours */
proposal_list = sa_request->get_proposals(sa_request);
DBG2(SIG_DBG_IKE, "selecting proposals:");
DBG2(DBG_IKE, "selecting proposals:");
this->proposal = this->connection->select_proposal(this->connection, proposal_list);
proposal_list->destroy_offset(proposal_list, offsetof(proposal_t, destroy));
/* do we have a proposal? */
if (this->proposal == NULL)
{
DBG1(SIG_DBG_IKE, "no proposals acceptable to rekey IKE_SA, sending NO_PROPOSAL_CHOSEN");
DBG1(DBG_IKE, "no proposals acceptable to rekey IKE_SA, sending NO_PROPOSAL_CHOSEN");
build_notify(NO_PROPOSAL_CHOSEN, CHUNK_INITIALIZER, response, TRUE);
return FAILED;
}
@@ -593,7 +593,7 @@ static status_t get_response(private_rekey_ike_sa_t *this, message_t *request,
chunk_t notify_chunk;
notify_group = this->connection->get_dh_group(this->connection);
DBG1(SIG_DBG_IKE, "request used inacceptable DH group %N, sending "
DBG1(DBG_IKE, "request used inacceptable DH group %N, sending "
"INVALID_KE_PAYLOAD with %N",
diffie_hellman_group_names, used_group,
diffie_hellman_group_names, notify_group);
@@ -675,7 +675,7 @@ static status_t conclude(private_rekey_ike_sa_t *this, message_t *response,
/* check message type */
if (response->get_exchange_type(response) != CREATE_CHILD_SA)
{
DBG1(SIG_DBG_IKE, "CREATE_CHILD_SA response of invalid type, aborting");
DBG1(DBG_IKE, "CREATE_CHILD_SA response of invalid type, aborting");
return FAILED;
}
@@ -712,7 +712,7 @@ static status_t conclude(private_rekey_ike_sa_t *this, message_t *response,
}
default:
{
DBG1(SIG_DBG_IKE, "ignoring %N payload",
DBG1(DBG_IKE, "ignoring %N payload",
payload_type_names, payload->get_type(payload));
break;
}
@@ -722,7 +722,7 @@ static status_t conclude(private_rekey_ike_sa_t *this, message_t *response,
if (!(sa_payload && nonce_payload && ke_payload))
{
DBG1(SIG_DBG_IKE, "response message incomplete, rekeying IKE_SA failed");
DBG1(DBG_IKE, "response message incomplete, rekeying IKE_SA failed");
return FAILED;
}
@@ -742,7 +742,7 @@ static status_t conclude(private_rekey_ike_sa_t *this, message_t *response,
if (this->proposal == NULL)
{
DBG1(SIG_DBG_IKE, "no proposal selected, rekeying IKE_SA failed");
DBG1(DBG_IKE, "no proposal selected, rekeying IKE_SA failed");
return FAILED;
}
spi = this->proposal->get_spi(this->proposal);
@@ -788,12 +788,12 @@ static status_t conclude(private_rekey_ike_sa_t *this, message_t *response,
if (memcmp(this_lowest.ptr, this->nonce_s.ptr,
min(this_lowest.len, this->nonce_s.len)) < 0)
{
DBG1(SIG_DBG_IKE, "detected simultaneous IKE_SA rekeying, deleting ours");
DBG1(DBG_IKE, "detected simultaneous IKE_SA rekeying, deleting ours");
this->lost = TRUE;
}
else
{
DBG1(SIG_DBG_IKE, "detected simultaneous IKE_SA rekeying, but ours is preferred");
DBG1(DBG_IKE, "detected simultaneous IKE_SA rekeying, but ours is preferred");
}
if (this->lost)
{