denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

improved signal handling and emitting

Browse Source
This commit is contained in:
Martin Willi
2006-10-26 09:46:56 +00:00
parent 80d35dd6d3
commit b83806d83d
46 changed files with 939 additions and 834 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/charon/sa/transactions/create_child_sa.c
+67 -33
View File
@@ -128,6 +128,12 @@ struct private_create_child_sa_t {
* source of randomness
*/
randomizer_t *randomizer;
/**
* signal to emit when transaction fails. As this transaction is used
* for CHILD_SA creation AND rekeying, we must emit different signals.
*/
signal_t failsig;
};
/**
@@ -168,6 +174,7 @@ static void set_reqid(private_create_child_sa_t *this, u_int32_t reqid)
static void rekeys_child(private_create_child_sa_t *this, child_sa_t *child_sa)
{
this->rekeyed_sa = child_sa;
this->failsig = CHILD_REKEY_FAILED;
}
/**
@@ -198,14 +205,16 @@ static status_t get_request(private_create_child_sa_t *this, message_t **result)
/* check if we are not already rekeying */
if (this->rekeyed_sa)
{
SIG(CHILD_REKEY_START, "rekeying CHILD_SA");
switch (this->rekeyed_sa->get_state(this->rekeyed_sa))
{
case CHILD_REKEYING:
DBG1(SIG_DBG_IKE,
SIG(CHILD_REKEY_FAILED,
"rekeying a CHILD_SA which is already rekeying, aborted");
return FAILED;
case CHILD_DELETING:
DBG1(SIG_DBG_IKE,
SIG(CHILD_REKEY_FAILED,
"rekeying a CHILD_SA which is deleting, aborted");
return FAILED;
default:
@@ -213,6 +222,10 @@ static status_t get_request(private_create_child_sa_t *this, message_t **result)
}
this->rekeyed_sa->set_state(this->rekeyed_sa, CHILD_REKEYING);
}
else
{
SIG(CHILD_UP_START, "creating CHILD_SA");
}
me = this->ike_sa->get_my_host(this->ike_sa);
other = this->ike_sa->get_other_host(this->ike_sa);
@@ -254,7 +267,7 @@ static status_t get_request(private_create_child_sa_t *this, message_t **result)
if (this->policy == NULL)
{
DBG1(SIG_DBG_IKE, "no policy found to rekey "
SIG(IKE_REKEY_FAILED, "no policy found to rekey "
"CHILD_SA with reqid %d", this->reqid);
return FAILED;
}
@@ -271,7 +284,7 @@ static status_t get_request(private_create_child_sa_t *this, message_t **result)
this->child_sa->set_name(this->child_sa, this->policy->get_name(this->policy));
if (this->child_sa->alloc(this->child_sa, proposals) != SUCCESS)
{
SIG(SIG_CHILD_FAILED, "could not install CHILD_SA, CHILD_SA creation aborted");
SIG(this->failsig, "could not install CHILD_SA, CHILD_SA creation failed");
return FAILED;
}
sa_payload = sa_payload_create_from_proposal_list(proposals);
@@ -285,7 +298,7 @@ static status_t get_request(private_create_child_sa_t *this, message_t **result)
if (this->randomizer->allocate_pseudo_random_bytes(this->randomizer,
NONCE_SIZE, &this->nonce_i) != SUCCESS)
{
SIG(SIG_CHILD_FAILED, "could not create nonce");
SIG(this->failsig, "could not create nonce, CHILD_SA creation failed");
return FAILED;
}
nonce_payload = nonce_payload_create();
@@ -340,23 +353,23 @@ static status_t process_notifys(private_create_child_sa_t *this, notify_payload_
{
notify_type_t notify_type = notify_payload->get_notify_type(notify_payload);
DBG2(SIG_DBG_IKE, "process notify type %N", notify_type_names, notify_type);
DBG2(DBG_IKE, "process notify type %N", notify_type_names, notify_type);
switch (notify_type)
{
case SINGLE_PAIR_REQUIRED:
{
SIG(SIG_CHILD_FAILED, "received a SINGLE_PAIR_REQUIRED notify");
SIG(this->failsig, "received a SINGLE_PAIR_REQUIRED notify");
return FAILED;
}
case TS_UNACCEPTABLE:
{
SIG(SIG_CHILD_FAILED, "received TS_UNACCEPTABLE notify");
SIG(this->failsig, "received TS_UNACCEPTABLE notify");
return FAILED;
}
case NO_PROPOSAL_CHOSEN:
{
SIG(SIG_CHILD_FAILED, "received NO_PROPOSAL_CHOSEN notify");
SIG(this->failsig, "received NO_PROPOSAL_CHOSEN notify");
return FAILED;
}
case REKEY_SA:
@@ -373,6 +386,7 @@ static status_t process_notifys(private_create_child_sa_t *this, notify_payload_
this->rekeyed_sa = this->ike_sa->get_child_sa(this->ike_sa,
protocol, spi,
FALSE);
this->failsig = CHILD_REKEY_FAILED;
break;
default:
break;
@@ -383,13 +397,13 @@ static status_t process_notifys(private_create_child_sa_t *this, notify_payload_
{
if (notify_type < 16383)
{
SIG(SIG_CHILD_FAILED, "received %N notify error, CHILD_SA "
SIG(this->failsig, "received %N notify error, CHILD_SA "
"creation failed", notify_type_names, notify_type);
return FAILED;
return FAILED;
}
else
{
DBG1(SIG_DBG_IKE, "received %N notify, ignored",
DBG1(DBG_IKE, "received %N notify, ignored",
notify_type_names, notify_type);
return SUCCESS;
}
@@ -515,7 +529,7 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
/* check message type */
if (request->get_exchange_type(request) != CREATE_CHILD_SA)
{
SIG(SIG_CHILD_FAILED, "CREATE_CHILD_SA response of invalid type, aborted");
DBG1(DBG_IKE, "CREATE_CHILD_SA response of invalid type, aborted");
return FAILED;
}
@@ -525,7 +539,7 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
this->ike_sa->get_state(this->ike_sa) == IKE_DELETING)
{
build_notify(NO_ADDITIONAL_SAS, CHUNK_INITIALIZER, response, TRUE);
SIG(SIG_CHILD_FAILED, "unable to create new CHILD_SAs, as rekeying in progress");
DBG1(DBG_IKE, "unable to create new CHILD_SAs, as rekeying in progress");
return FAILED;
}
@@ -552,7 +566,7 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
u_int8_t dh_buffer[] = {0x00, 0x00}; /* MODP_NONE */
chunk_t group = chunk_from_buf(dh_buffer);
build_notify(INVALID_KE_PAYLOAD, group, response, TRUE);
SIG(SIG_CHILD_FAILED, "CREATE_CHILD_SA used PFS, sending INVALID_KE_PAYLOAD");
DBG1(DBG_IKE, "CREATE_CHILD_SA used PFS, sending INVALID_KE_PAYLOAD");
return FAILED;
}
case NOTIFY:
@@ -567,7 +581,7 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
}
default:
{
DBG1(SIG_DBG_IKE, "ignoring %N payload",
DBG1(DBG_IKE, "ignoring %N payload",
payload_type_names, payload->get_type(payload));
break;
}
@@ -575,11 +589,22 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
}
payloads->destroy(payloads);
/* after processing the notify payloads, we know if this transaction is
* for rekeying or for a new CHILD_SA. We can emit the signals now. */
if (this->rekeyed_sa)
{
SIG(CHILD_REKEY_START, "rekeying CHILD_SA");
}
else
{
SIG(CHILD_UP_START, "creating CHILD_SA");
}
/* check if we have all payloads */
if (!(sa_request && nonce_request && tsi_request && tsr_request))
{
build_notify(INVALID_SYNTAX, CHUNK_INITIALIZER, response, TRUE);
SIG(SIG_CHILD_FAILED, "request message incomplete, no CHILD_SA created");
SIG(this->failsig, "request message incomplete, no CHILD_SA created");
return FAILED;
}
@@ -589,6 +614,7 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
NONCE_SIZE, &this->nonce_r) != SUCCESS)
{
build_notify(NO_PROPOSAL_CHOSEN, CHUNK_INITIALIZER, response, TRUE);
SIG(this->failsig, "nonce generation failed, no CHILD_SA created");
return FAILED;
}
nonce_response = nonce_payload_create();
@@ -619,7 +645,7 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
if (this->policy == NULL)
{
SIG(SIG_CHILD_FAILED, "no acceptable policy found, sending TS_UNACCEPTABLE notify");
SIG(this->failsig, "no acceptable policy found, sending TS_UNACCEPTABLE notify");
build_notify(TS_UNACCEPTABLE, CHUNK_INITIALIZER, response, TRUE);
return FAILED;
}
@@ -635,21 +661,21 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
sa_response = sa_payload_create();
/* get proposals from request, and select one with ours */
proposal_list = sa_request->get_proposals(sa_request);
DBG2(SIG_DBG_IKE, "selecting proposals:");
DBG2(DBG_IKE, "selecting proposals:");
this->proposal = this->policy->select_proposal(this->policy, proposal_list);
proposal_list->destroy_offset(proposal_list, offsetof(proposal_t, destroy));
/* do we have a proposal? */
if (this->proposal == NULL)
{
SIG(SIG_CHILD_FAILED, "CHILD_SA proposals unacceptable, sending NO_PROPOSAL_CHOSEN notify");
SIG(this->failsig, "CHILD_SA proposals unacceptable, sending NO_PROPOSAL_CHOSEN notify");
build_notify(NO_PROPOSAL_CHOSEN, CHUNK_INITIALIZER, response, TRUE);
return FAILED;
}
/* do we have traffic selectors? */
else if (this->tsi->get_count(this->tsi) == 0 || this->tsr->get_count(this->tsr) == 0)
{
SIG(SIG_CHILD_FAILED, "CHILD_SA traffic selectors unacceptable, sending TS_UNACCEPTABLE notify");
SIG(this->failsig, "CHILD_SA traffic selectors unacceptable, sending TS_UNACCEPTABLE notify");
build_notify(TS_UNACCEPTABLE, CHUNK_INITIALIZER, response, TRUE);
return FAILED;
}
@@ -670,7 +696,7 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
this->child_sa->set_name(this->child_sa, this->policy->get_name(this->policy));
if (install_child_sa(this, FALSE) != SUCCESS)
{
SIG(SIG_CHILD_FAILED, "installing CHILD_SA failed, sending NO_PROPOSAL_CHOSEN notify");
SIG(this->failsig, "installing CHILD_SA failed, sending NO_PROPOSAL_CHOSEN notify");
build_notify(NO_PROPOSAL_CHOSEN, CHUNK_INITIALIZER, response, TRUE);
return FAILED;
}
@@ -708,11 +734,16 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
other->nonce_s = chunk_clone(this->nonce_r);
}
}
else
{
/* we only signal when no other transaction is rekeying */
SIG(CHILD_REKEY_SUCCESS, "CHILD_SA rekeyed");
}
this->rekeyed_sa->set_state(this->rekeyed_sa, CHILD_REKEYING);
}
else
{
SIG(SIG_CHILD_UP, "CHILD_SA created");
SIG(CHILD_UP_SUCCESS, "CHILD_SA created");
}
return SUCCESS;
}
@@ -737,7 +768,7 @@ static status_t conclude(private_create_child_sa_t *this, message_t *response,
/* check message type */
if (response->get_exchange_type(response) != CREATE_CHILD_SA)
{
SIG(SIG_CHILD_FAILED, "CREATE_CHILD_SA response of invalid type, aborting");
SIG(this->failsig, "CREATE_CHILD_SA response of invalid type, aborting");
return FAILED;
}
@@ -774,7 +805,7 @@ static status_t conclude(private_create_child_sa_t *this, message_t *response,
}
default:
{
DBG1(SIG_DBG_IKE, "ignoring %N payload",
DBG1(DBG_IKE, "ignoring %N payload",
payload_type_names, payload->get_type(payload));
break;
}
@@ -784,7 +815,7 @@ static status_t conclude(private_create_child_sa_t *this, message_t *response,
if (!(sa_payload && nonce_payload && tsi_payload && tsr_payload))
{
SIG(SIG_CHILD_FAILED, "response message incomplete, no CHILD_SA built");
SIG(this->failsig, "response message incomplete, no CHILD_SA built");
return FAILED;
}
@@ -817,16 +848,15 @@ static status_t conclude(private_create_child_sa_t *this, message_t *response,
this->tsi->get_count(this->tsi) == 0 ||
this->tsr->get_count(this->tsr) == 0)
{
SIG(SIG_CHILD_FAILED, "CHILD_SA negotiation failed, no CHILD_SA built");
SIG(this->failsig, "CHILD_SA negotiation failed, no CHILD_SA built");
return FAILED;
}
new_child = this->child_sa;
if (install_child_sa(this, TRUE) != SUCCESS)
{
SIG(SIG_CHILD_FAILED, "installing CHILD_SA failed, no CHILD_SA built");
SIG(this->failsig, "installing CHILD_SA failed, no CHILD_SA built");
return FAILED;
}
SIG(SIG_CHILD_UP, "CHILD_SA created");
}
/* CHILD_SA successfully created. If the other peer initiated rekeying
* in the meantime, we detect this by comparing the rekeying_transaction
@@ -856,14 +886,14 @@ static status_t conclude(private_create_child_sa_t *this, message_t *response,
if (memcmp(this_lowest.ptr, this->nonce_s.ptr,
min(this_lowest.len, this->nonce_s.len)) < 0)
{
DBG1(SIG_DBG_IKE, "detected simultaneous CHILD_SA rekeying, deleting ours");
DBG1(DBG_IKE, "detected simultaneous CHILD_SA rekeying, deleting ours");
this->lost = TRUE;
}
else
{
DBG1(SIG_DBG_IKE, "detected simultaneous CHILD_SA rekeying, but ours is preferred");
DBG1(DBG_IKE, "detected simultaneous CHILD_SA rekeying, but ours is preferred");
}
}
}
/* delete the old SA if we have won the rekeying nonce compare*/
if (!this->lost)
{
@@ -871,10 +901,13 @@ static status_t conclude(private_create_child_sa_t *this, message_t *response,
delete_child_sa->set_child_sa(delete_child_sa, this->rekeyed_sa);
*next = (transaction_t*)delete_child_sa;
}
/* we send a rekey SUCCESS signal in any case. If the other transaction
* detected our transaction, it did not send a signal. We do it for it. */
SIG(CHILD_REKEY_SUCCESS, "CHILD_SA rekeyed");
}
else
{
SIG(SIG_CHILD_UP, "CHILD_SA created");
SIG(CHILD_UP_SUCCESS, "CHILD_SA created");
}
if (this->lost)
{
@@ -943,6 +976,7 @@ create_child_sa_t *create_child_sa_create(ike_sa_t *ike_sa)
this->tsi = NULL;
this->tsr = NULL;
this->randomizer = randomizer_create();
this->failsig = CHILD_UP_FAILED;
return &this->public;
}
src/charon/sa/transactions/delete_child_sa.c
+9 -9
View File
@@ -128,7 +128,7 @@ static status_t get_request(private_delete_child_sa_t *this, message_t **result)
spi = this->child_sa->get_spi(this->child_sa, TRUE);
delete_payload = delete_payload_create(protocol);
DBG1(SIG_DBG_IKE, "created DELETE payload for %N CHILD_SA with SPI 0x%x",
DBG1(DBG_IKE, "created DELETE payload for %N CHILD_SA with SPI 0x%x",
protocol_id_names, protocol, htonl(spi));
delete_payload->add_spi(delete_payload, spi);
request->add_payload(request, (payload_t*)delete_payload);
@@ -153,7 +153,7 @@ static status_t process_delete(private_delete_child_sa_t *this, delete_payload_t
protocol = delete_request->get_protocol_id(delete_request);
if (protocol != PROTO_ESP && protocol != PROTO_AH)
{
DBG1(SIG_DBG_IKE, "CHILD_SA delete response contained unexpected protocol");
DBG1(DBG_IKE, "CHILD_SA delete response contained unexpected protocol");
return FAILED;
}
@@ -177,7 +177,7 @@ static status_t process_delete(private_delete_child_sa_t *this, delete_payload_t
child_sa->set_state(child_sa, CHILD_DELETING);
DBG1(SIG_DBG_IKE, "received DELETE for %N CHILD_SA with SPI 0x%x, deleting",
DBG1(DBG_IKE, "received DELETE for %N CHILD_SA with SPI 0x%x, deleting",
protocol_id_names, protocol, ntohl(spi));
rekey = child_sa->get_rekeying_transaction(child_sa);
@@ -200,7 +200,7 @@ static status_t process_delete(private_delete_child_sa_t *this, delete_payload_t
}
else
{
DBG1(SIG_DBG_IKE, "received DELETE for %N CHILD_SA with SPI 0x%x, but no such SA",
DBG1(DBG_IKE, "received DELETE for %N CHILD_SA with SPI 0x%x, but no such SA",
protocol_id_names, protocol, ntohl(spi));
}
}
@@ -243,7 +243,7 @@ static status_t get_response(private_delete_child_sa_t *this, message_t *request
if (request->get_exchange_type(request) != INFORMATIONAL)
{
DBG1(SIG_DBG_IKE, "INFORMATIONAL response of invalid type, aborting");
DBG1(DBG_IKE, "INFORMATIONAL response of invalid type, aborting");
return FAILED;
}
@@ -253,7 +253,7 @@ static status_t get_response(private_delete_child_sa_t *this, message_t *request
if (this->ike_sa->get_state(this->ike_sa) == IKE_REKEYING ||
this->ike_sa->get_state(this->ike_sa) == IKE_DELETING)
{
DBG1(SIG_DBG_IKE, "unable to delete CHILD_SA, as rekeying in progress");
DBG1(DBG_IKE, "unable to delete CHILD_SA, as rekeying in progress");
return FAILED;
}
@@ -270,7 +270,7 @@ static status_t get_response(private_delete_child_sa_t *this, message_t *request
}
default:
{
DBG2(SIG_DBG_IKE, "ignoring payload %N",
DBG2(DBG_IKE, "ignoring payload %N",
payload_type_names, payload->get_type(payload));
break;
}
@@ -292,7 +292,7 @@ static status_t conclude(private_delete_child_sa_t *this, message_t *response,
/* check message type */
if (response->get_exchange_type(response) != INFORMATIONAL)
{
DBG1(SIG_DBG_IKE, "INFORMATIONAL response of invalid type, aborting");
DBG1(DBG_IKE, "INFORMATIONAL response of invalid type, aborting");
return FAILED;
}
@@ -309,7 +309,7 @@ static status_t conclude(private_delete_child_sa_t *this, message_t *response,
}
default:
{
DBG1(SIG_DBG_IKE, "ignoring payload %N",
DBG1(DBG_IKE, "ignoring payload %N",
payload_type_names, payload->get_type(payload));
break;
}
src/charon/sa/transactions/delete_ike_sa.c
+5 -5
View File
@@ -155,7 +155,7 @@ static status_t get_response(private_delete_ike_sa_t *this, message_t *request,
/* check message type */
if (request->get_exchange_type(request) != INFORMATIONAL)
{
DBG1(SIG_DBG_IKE, "INFORMATIONAL response of invalid type, deleting IKE_SA");
DBG1(DBG_IKE, "INFORMATIONAL response of invalid type, deleting IKE_SA");
return DESTROY_ME;
}
@@ -172,7 +172,7 @@ static status_t get_response(private_delete_ike_sa_t *this, message_t *request,
}
default:
{
DBG1(SIG_DBG_IKE, "ignoring payload %N",
DBG1(DBG_IKE, "ignoring payload %N",
payload_type_names, payload->get_type(payload));
break;
}
@@ -183,12 +183,12 @@ static status_t get_response(private_delete_ike_sa_t *this, message_t *request,
if (delete_request &&
delete_request->get_protocol_id(delete_request) == PROTO_IKE)
{
DBG1(SIG_DBG_IKE, "DELETE request for IKE_SA received, deleting IKE_SA");
DBG1(DBG_IKE, "DELETE request for IKE_SA received, deleting IKE_SA");
}
else
{
/* should not happen, as we preparsed this at transaction construction */
DBG1(SIG_DBG_IKE, "received a weird DELETE request for IKE_SA, deleting anyway");
DBG1(DBG_IKE, "received a weird DELETE request for IKE_SA, deleting anyway");
}
if (this->ike_sa->get_state(this->ike_sa) == IKE_DELETING)
{
@@ -210,7 +210,7 @@ static status_t conclude(private_delete_ike_sa_t *this, message_t *response,
/* check message type */
if (response->get_exchange_type(response) != INFORMATIONAL)
{
DBG1(SIG_DBG_IKE, "INFORMATIONAL response of invalid type, deleting IKE_SA");
DBG1(DBG_IKE, "INFORMATIONAL response of invalid type, deleting IKE_SA");
return DESTROY_ME;
}
/* this is only an acknowledge. We can't do anything here, but delete
src/charon/sa/transactions/ike_auth.c
+62 -40
View File
@@ -240,7 +240,7 @@ static status_t get_request(private_ike_auth_t *this, message_t **result)
}
else
{
DBG1(SIG_DBG_IKE, "could not find my certificate, certificate payload omitted");
DBG1(DBG_IKE, "could not find my certificate, certificate payload omitted");
}
}
@@ -271,7 +271,8 @@ static status_t get_request(private_ike_auth_t *this, message_t **result)
authenticator->destroy(authenticator);
if (status != SUCCESS)
{
SIG(SIG_IKE_FAILED, "could not generate AUTH data, deleting IKE_SA");
SIG(IKE_UP_FAILED, "could not generate AUTH data, deleting IKE_SA");
SIG(CHILD_UP_FAILED, "initiating CHILD_SA failed, unable to create IKE_SA");
return DESTROY_ME;
}
request->add_payload(request, (payload_t*)auth_payload);
@@ -295,7 +296,8 @@ static status_t get_request(private_ike_auth_t *this, message_t **result)
this->child_sa->set_name(this->child_sa, this->policy->get_name(this->policy));
if (this->child_sa->alloc(this->child_sa, proposal_list) != SUCCESS)
{
SIG(SIG_IKE_FAILED, "could not install CHILD_SA, deleting IKE_SA");
SIG(IKE_UP_FAILED, "could not install CHILD_SA, deleting IKE_SA");
SIG(CHILD_UP_FAILED, "initiating CHILD_SA failed, unable to create IKE_SA");
return DESTROY_ME;
}
sa_payload = sa_payload_create_from_proposal_list(proposal_list);
@@ -337,26 +339,26 @@ static status_t process_notifies(private_ike_auth_t *this, notify_payload_t *not
{
notify_type_t notify_type = notify_payload->get_notify_type(notify_payload);
DBG2(SIG_DBG_IKE, "process notify type %N", notify_type_names, notify_type);
DBG2(DBG_IKE, "process notify type %N", notify_type_names, notify_type);
switch (notify_type)
{
/* these notifies are not critical. no child_sa is built, but IKE stays alive */
case SINGLE_PAIR_REQUIRED:
{
DBG1(SIG_DBG_IKE, "received a SINGLE_PAIR_REQUIRED notify");
SIG(CHILD_UP_FAILED, "received a SINGLE_PAIR_REQUIRED notify");
this->build_child = FALSE;
return SUCCESS;
}
case TS_UNACCEPTABLE:
{
DBG1(SIG_DBG_IKE, "received TS_UNACCEPTABLE notify");
SIG(CHILD_UP_FAILED, "received TS_UNACCEPTABLE notify");
this->build_child = FALSE;
return SUCCESS;
}
case NO_PROPOSAL_CHOSEN:
{
DBG1(SIG_DBG_IKE, "received NO_PROPOSAL_CHOSEN notify");
SIG(CHILD_UP_FAILED, "received NO_PROPOSAL_CHOSEN notify");
this->build_child = FALSE;
return SUCCESS;
}
@@ -364,13 +366,13 @@ static status_t process_notifies(private_ike_auth_t *this, notify_payload_t *not
{
if (notify_type < 16383)
{
SIG(SIG_IKE_FAILED, "received %N notify error, deleting IKE_SA",
SIG(IKE_UP_FAILED, "received %N notify error, deleting IKE_SA",
notify_type_names, notify_type);
return DESTROY_ME;
}
else
{
DBG1(SIG_DBG_IKE, "received %N notify, ignored",
DBG1(DBG_IKE, "received %N notify, ignored",
notify_type_names, notify_type);
return SUCCESS;
}
@@ -414,7 +416,7 @@ static void import_certificate(private_ike_auth_t *this, cert_payload_t *cert_pa
encoding = cert_payload->get_cert_encoding(cert_payload);
if (encoding != CERT_X509_SIGNATURE)
{
DBG1(SIG_DBG_IKE, "certificate payload %N not supported, ignored",
DBG1(DBG_IKE, "certificate payload %N not supported, ignored",
cert_encoding_names, encoding);
return;
}
@@ -423,7 +425,7 @@ static void import_certificate(private_ike_auth_t *this, cert_payload_t *cert_pa
{
if (charon->credentials->verify(charon->credentials, cert, &found))
{
DBG2(SIG_DBG_IKE, "received end entity certificate is trusted, added to store");
DBG2(DBG_IKE, "received end entity certificate is trusted, added to store");
if (!found)
{
charon->credentials->add_end_certificate(charon->credentials, cert);
@@ -435,13 +437,13 @@ static void import_certificate(private_ike_auth_t *this, cert_payload_t *cert_pa
}
else
{
DBG1(SIG_DBG_IKE, "received end entity certificate is not trusted, discarded");
DBG1(DBG_IKE, "received end entity certificate is not trusted, discarded");
cert->destroy(cert);
}
}
else
{
DBG1(SIG_DBG_IKE, "parsing of received certificate failed, discarded");
DBG1(DBG_IKE, "parsing of received certificate failed, discarded");
}
}
@@ -521,6 +523,8 @@ static status_t get_response(private_ike_auth_t *this, message_t *request,
return SUCCESS;
}
SIG(CHILD_UP_START, "setting up CHILD_SA along with IKE_AUTH");
me = this->ike_sa->get_my_host(this->ike_sa);
other = this->ike_sa->get_other_host(this->ike_sa);
this->message_id = request->get_message_id(request);
@@ -539,7 +543,8 @@ static status_t get_response(private_ike_auth_t *this, message_t *request,
/* check message type */
if (request->get_exchange_type(request) != IKE_AUTH)
{
SIG(SIG_IKE_FAILED, "IKE_AUTH response of invalid type, deleting IKE_SA");
SIG(IKE_UP_FAILED, "IKE_AUTH response of invalid type, deleting IKE_SA");
SIG(CHILD_UP_FAILED, "initiating CHILD_SA failed, unable to create IKE_SA");
return DESTROY_ME;
}
@@ -582,13 +587,14 @@ static status_t get_response(private_ike_auth_t *this, message_t *request,
if (status == DESTROY_ME)
{
payloads->destroy(payloads);
SIG(CHILD_UP_FAILED, "initiating CHILD_SA failed, unable to create IKE_SA");
return DESTROY_ME;
}
break;
}
default:
{
DBG1(SIG_DBG_IKE, "ignoring %N payload",
DBG1(DBG_IKE, "ignoring %N payload",
payload_type_names, payload->get_type(payload));
break;
}
@@ -600,7 +606,8 @@ static status_t get_response(private_ike_auth_t *this, message_t *request,
if (!(idi_request && auth_request && sa_request && tsi_request && tsr_request))
{
build_notify(INVALID_SYNTAX, response, TRUE);
SIG(SIG_IKE_FAILED, "request message incomplete, deleting IKE_SA");
SIG(IKE_UP_FAILED, "request message incomplete, deleting IKE_SA");
SIG(CHILD_UP_FAILED, "initiating CHILD_SA failed, unable to create IKE_SA");
return DESTROY_ME;
}
@@ -638,8 +645,9 @@ static status_t get_response(private_ike_auth_t *this, message_t *request,
* traffic selectors. Then we would create a IKE_SA without a CHILD_SA. */
if (this->policy == NULL)
{
SIG(SIG_IKE_FAILED, "no acceptable policy for IDs %D - %D found, "
SIG(IKE_UP_FAILED, "no acceptable policy for IDs %D - %D found, "
"deleting IKE_SA", my_id, other_id);
SIG(CHILD_UP_FAILED, "initiating CHILD_SA failed, unable to create IKE_SA");
my_id->destroy(my_id);
other_id->destroy(other_id);
build_notify(AUTHENTICATION_FAILED, response, TRUE);
@@ -670,7 +678,7 @@ static status_t get_response(private_ike_auth_t *this, message_t *request,
}
else
{
DBG1(SIG_DBG_IKE, "could not find my certificate, cert payload omitted");
DBG1(DBG_IKE, "could not find my certificate, cert payload omitted");
}
}
@@ -695,7 +703,8 @@ static status_t get_response(private_ike_auth_t *this, message_t *request,
TRUE);
if (status != SUCCESS)
{
SIG(SIG_IKE_FAILED, "authentication failed, deleting IKE_SA");
SIG(IKE_UP_FAILED, "authentication failed, deleting IKE_SA");
SIG(CHILD_UP_FAILED, "initiating CHILD_SA failed, unable to create IKE_SA");
build_notify(AUTHENTICATION_FAILED, response, TRUE);
authenticator->destroy(authenticator);
return DESTROY_ME;
@@ -709,13 +718,17 @@ static status_t get_response(private_ike_auth_t *this, message_t *request,
authenticator->destroy(authenticator);
if (status != SUCCESS)
{
SIG(SIG_IKE_FAILED, "authentication data generation failed, deleting IKE_SA");
SIG(IKE_UP_FAILED, "authentication data generation failed, deleting IKE_SA");
SIG(CHILD_UP_FAILED, "initiating CHILD_SA failed, unable to create IKE_SA");
build_notify(AUTHENTICATION_FAILED, response, TRUE);
return DESTROY_ME;
}
response->add_payload(response, (payload_t*)auth_response);
}
SIG(IKE_UP_SUCCESS, "IKE_SA '%s' established between %H[%D]...%H[%D]",
this->ike_sa->get_name(this->ike_sa), me, my_id, other, other_id);
{ /* process SA payload */
linked_list_t *proposal_list;
sa_payload_t *sa_response;
@@ -728,22 +741,22 @@ static status_t get_response(private_ike_auth_t *this, message_t *request,
/* get proposals from request, and select one with ours */
proposal_list = sa_request->get_proposals(sa_request);
DBG2(SIG_DBG_IKE, "selecting proposals:");
DBG2(DBG_IKE, "selecting proposals:");
this->proposal = this->policy->select_proposal(this->policy, proposal_list);
proposal_list->destroy_offset(proposal_list, offsetof(proposal_t, destroy));
/* do we have a proposal? */
if (this->proposal == NULL)
{
SIG(SIG_CHILD_FAILED, "CHILD_SA proposals unacceptable, no CHILD_SA created");
DBG1(SIG_DBG_IKE, "adding NO_PROPOSAL_CHOSEN notify to response");
SIG(CHILD_UP_FAILED, "CHILD_SA proposals unacceptable, no CHILD_SA created");
DBG1(DBG_IKE, "adding NO_PROPOSAL_CHOSEN notify to response");
build_notify(NO_PROPOSAL_CHOSEN, response, FALSE);
}
/* do we have traffic selectors? */
else if (this->tsi->get_count(this->tsi) == 0 || this->tsr->get_count(this->tsr) == 0)
{
SIG(SIG_CHILD_FAILED, "CHILD_SA traffic selectors unacceptable, no CHILD_SA created");
DBG1(SIG_DBG_IKE, "adding TS_UNACCEPTABLE notify to response");
SIG(CHILD_UP_FAILED, "CHILD_SA traffic selectors unacceptable, no CHILD_SA created");
DBG1(DBG_IKE, "adding TS_UNACCEPTABLE notify to response");
build_notify(TS_UNACCEPTABLE, response, FALSE);
}
else
@@ -760,15 +773,15 @@ static status_t get_response(private_ike_auth_t *this, message_t *request,
this->child_sa->set_name(this->child_sa, this->policy->get_name(this->policy));
if (install_child_sa(this, FALSE) != SUCCESS)
{
SIG(SIG_IKE_FAILED, "installing CHILD_SA failed, no CHILD_SA created");
DBG1(SIG_DBG_IKE, "adding NO_PROPOSAL_CHOSEN notify to response");
SIG(CHILD_UP_FAILED, "installing CHILD_SA failed, no CHILD_SA created");
DBG1(DBG_IKE, "adding NO_PROPOSAL_CHOSEN notify to response");
build_notify(NO_PROPOSAL_CHOSEN, response, FALSE);
}
else
{
/* add proposal to sa payload */
sa_response->add_proposal(sa_response, this->proposal);
SIG(SIG_CHILD_UP, "CHILD_SA created");
SIG(CHILD_UP_SUCCESS, "CHILD_SA created");
}
}
response->add_payload(response, (payload_t*)sa_response);
@@ -794,7 +807,7 @@ static status_t conclude(private_ike_auth_t *this, message_t *response,
iterator_t *payloads;
payload_t *payload;
host_t *me, *other;
identification_t *other_id;
identification_t *other_id, *my_id;
ts_payload_t *tsi_payload = NULL;
ts_payload_t *tsr_payload = NULL;
id_payload_t *idr_payload = NULL;
@@ -806,7 +819,8 @@ static status_t conclude(private_ike_auth_t *this, message_t *response,
/* check message type */
if (response->get_exchange_type(response) != IKE_AUTH)
{
SIG(SIG_IKE_FAILED, "IKE_AUTH response of invalid type, deleting IKE_SA");
SIG(IKE_UP_FAILED, "IKE_AUTH response of invalid type, deleting IKE_SA");
SIG(CHILD_UP_FAILED, "initiating CHILD_SA failed, unable to create IKE_SA");
return DESTROY_ME;
}
@@ -843,11 +857,12 @@ static status_t conclude(private_ike_auth_t *this, message_t *response,
if (status == FAILED)
{
payloads->destroy(payloads);
/* we return SUCCESS, returned FAILED means do next transaction */
/* we return SUCCESS, as transaction completet */
return SUCCESS;
}
if (status == DESTROY_ME)
{
SIG(CHILD_UP_FAILED, "initiating CHILD_SA failed, unable to create IKE_SA");
payloads->destroy(payloads);
return status;
}
@@ -855,7 +870,7 @@ static status_t conclude(private_ike_auth_t *this, message_t *response,
}
default:
{
DBG1(SIG_DBG_IKE, "ignoring payload %N",
DBG1(DBG_IKE, "ignoring payload %N",
payload_type_names, payload->get_type(payload));
break;
}
@@ -865,7 +880,8 @@ static status_t conclude(private_ike_auth_t *this, message_t *response,
if (!(idr_payload && auth_payload && sa_payload && tsi_payload && tsr_payload))
{
SIG(SIG_IKE_FAILED, "response message incomplete, deleting IKE_SA");
SIG(IKE_UP_FAILED, "response message incomplete, deleting IKE_SA");
SIG(CHILD_UP_FAILED, "initiating CHILD_SA failed, unable to create IKE_SA");
return DESTROY_ME;
}
@@ -879,8 +895,9 @@ static status_t conclude(private_ike_auth_t *this, message_t *response,
if (!other_id->matches(other_id, configured_other_id, &wildcards))
{
other_id->destroy(other_id);
SIG(SIG_IKE_FAILED, "other peer uses unacceptable ID (%D, excepted "
SIG(IKE_UP_FAILED, "other peer uses unacceptable ID (%D, excepted "
"%D), deleting IKE_SA", other_id, configured_other_id);
SIG(CHILD_UP_FAILED, "initiating CHILD_SA failed, unable to create IKE_SA");
return DESTROY_ME;
}
/* update other ID. It was already set, but may contain wildcards */
@@ -895,7 +912,6 @@ static status_t conclude(private_ike_auth_t *this, message_t *response,
{ /* authenticate peer */
authenticator_t *authenticator;
auth_method_t auth_method;
identification_t *my_id;
status_t status;
auth_method = this->policy->get_auth_method(this->policy);
@@ -912,12 +928,16 @@ static status_t conclude(private_ike_auth_t *this, message_t *response,
authenticator->destroy(authenticator);
if (status != SUCCESS)
{
SIG(SIG_IKE_FAILED, "authentication of '%D' with %N failed, "
"deleting IKE_SA", other_id, auth_method_names, auth_method);
SIG(IKE_UP_FAILED, "authentication of '%D' with %N failed, "
"deleting IKE_SA", other_id, auth_method_names, auth_method);
SIG(CHILD_UP_FAILED, "initiating CHILD_SA failed, unable to create IKE_SA");
return DESTROY_ME;
}
}
SIG(IKE_UP_SUCCESS, "IKE_SA '%s' established between %H[%D]...%H[%D]",
this->ike_sa->get_name(this->ike_sa), me, my_id, other, other_id);
{ /* process traffic selectors for us */
linked_list_t *ts_received = tsi_payload->get_traffic_selectors(tsi_payload);
this->tsi = this->policy->select_my_traffic_selectors(this->policy, ts_received, me);
@@ -944,17 +964,19 @@ static status_t conclude(private_ike_auth_t *this, message_t *response,
this->tsr->get_count(this->tsr) == 0 ||
!this->build_child)
{
SIG(SIG_CHILD_FAILED, "CHILD_SA negotiation failed, no CHILD_SA built");
SIG(CHILD_UP_FAILED, "CHILD_SA negotiation failed, no CHILD_SA built");
}
else
{
if (install_child_sa(this, TRUE) != SUCCESS)
{
SIG(SIG_CHILD_FAILED, "installing CHILD_SA failed, no CHILD_SA built");
SIG(CHILD_UP_FAILED, "installing CHILD_SA failed, no CHILD_SA built");
/* TODO: we should send a DELETE for that CHILD to stay
* synchronous with the peer */
}
else
{
SIG(SIG_CHILD_UP, "CHILD_SA created");
SIG(CHILD_UP_SUCCESS, "CHILD_SA created");
}
}
}
src/charon/sa/transactions/ike_sa_init.c
+59 -38
View File
@@ -232,8 +232,8 @@ static chunk_t generate_natd_hash(private_ike_sa_init_t *this,
/* natd_hash = SHA1( spi_i | spi_r | address | port ) */
natd_chunk = chunk_cat("cccc", spi_i_chunk, spi_r_chunk, addr_chunk, port_chunk);
this->nat_hasher->allocate_hash(this->nat_hasher, natd_chunk, &natd_hash);
DBG3(SIG_DBG_IKE, "natd_chunk %B", &natd_chunk);
DBG3(SIG_DBG_IKE, "natd_hash %B", &natd_hash);
DBG3(DBG_IKE, "natd_chunk %B", &natd_chunk);
DBG3(DBG_IKE, "natd_hash %B", &natd_hash);
chunk_free(&natd_chunk);
return natd_hash;
@@ -280,7 +280,7 @@ static status_t get_request(private_ike_sa_init_t *this, message_t **result)
other = this->connection->get_other_host(this->connection);
/* we already set up the IDs. Mine is already fully qualified, other
* will be updated in the ike_auth transaction */
* will be updated in the ike_auth transaction */
my_id = this->policy->get_my_id(this->policy);
other_id = this->policy->get_other_id(this->policy);
this->ike_sa->set_my_id(this->ike_sa, my_id->clone(my_id));
@@ -292,6 +292,12 @@ static status_t get_request(private_ike_sa_init_t *this, message_t **result)
this->ike_sa->set_name(this->ike_sa, name);
}
/* setting up a IKE_SA implicitly requires setup of a CHILD_SA */
SIG(IKE_UP_START, "initiating IKE_SA '%s' between %H[%D]...%H[%D]",
this->connection->get_name(this->connection), me, my_id, other, other_id);
SIG(CHILD_UP_START, "establishing CHILD_SA '%s' along with IKE_SA",
this->policy->get_name(this->policy));
/* build the request */
request = message_create();
request->set_source(request, me->clone(me));
@@ -314,8 +320,10 @@ static status_t get_request(private_ike_sa_init_t *this, message_t **result)
this->diffie_hellman = diffie_hellman_create(dh_group);
if (this->diffie_hellman == NULL)
{
SIG(SIG_IKE_FAILED, "DH group %N not supported, aborting",
SIG(IKE_UP_FAILED, "DH group %N not supported, aborting",
diffie_hellman_group_names, dh_group);
SIG(CHILD_UP_FAILED,
"initiating CHILD_SA failed, unable to create IKE_SA");
return DESTROY_ME;
}
}
@@ -345,7 +353,9 @@ static status_t get_request(private_ike_sa_init_t *this, message_t **result)
if (this->randomizer->allocate_pseudo_random_bytes(this->randomizer,
NONCE_SIZE, &this->nonce_i) != SUCCESS)
{
SIG(SIG_IKE_FAILED, "could not generate nonce, aborting");
SIG(IKE_UP_FAILED, "could not generate nonce, aborting");
SIG(CHILD_UP_FAILED,
"initiating CHILD_SA failed, unable to create IKE_SA");
return DESTROY_ME;
}
nonce_payload = nonce_payload_create();
@@ -388,19 +398,19 @@ static status_t process_notifys(private_ike_sa_init_t *this, notify_payload_t *n
chunk_t notification_data;
notify_type_t notify_type = notify_payload->get_notify_type(notify_payload);
DBG2(SIG_DBG_IKE, "process notify type %N", notify_type_names, notify_type);
DBG2(DBG_IKE, "process notify type %N", notify_type_names, notify_type);
switch (notify_type)
{
case NO_PROPOSAL_CHOSEN:
{
SIG(SIG_IKE_FAILED,
SIG(IKE_UP_FAILED,
"received a NO_PROPOSAL_CHOSEN notify, deleting IKE_SA");
return DESTROY_ME;
}
case INVALID_MAJOR_VERSION:
{
SIG(SIG_IKE_FAILED,
SIG(IKE_UP_FAILED,
"received a INVALID_MAJOR_VERSION notify, deleting IKE_SA");
return DESTROY_ME;
}
@@ -414,12 +424,13 @@ static status_t process_notifys(private_ike_sa_init_t *this, notify_payload_t *n
notify_data = notify_payload->get_notification_data(notify_payload);
dh_group = ntohs(*((u_int16_t*)notify_data.ptr));
DBG1(SIG_DBG_IKE, "peer didn't accept DH group %N, it requested %N",
DBG1(DBG_IKE, "peer didn't accept DH group %N, it requested %N",
diffie_hellman_group_names, old_dh_group,
diffie_hellman_group_names, dh_group);
if (!this->connection->check_dh_group(this->connection, dh_group))
{
DBG1(SIG_DBG_IKE, "requested DH group not acceptable, aborting");
SIG(IKE_UP_FAILED, "DH group %N not acceptable, aborting",
diffie_hellman_group_names, dh_group);
return DESTROY_ME;
}
retry = ike_sa_init_create(this->ike_sa);
@@ -441,11 +452,11 @@ static status_t process_notifys(private_ike_sa_init_t *this, notify_payload_t *n
if (chunk_equals(notification_data, this->natd_dst_hash))
{
this->natd_dst_matched = TRUE;
DBG2(SIG_DBG_IKE, "NAT-D dst hash match");
DBG2(DBG_IKE, "NAT-D dst hash match");
}
else
{
DBG2(SIG_DBG_IKE, "NAT-D dst hash mismatch");
DBG2(DBG_IKE, "NAT-D dst hash mismatch");
}
return SUCCESS;
}
@@ -460,11 +471,11 @@ static status_t process_notifys(private_ike_sa_init_t *this, notify_payload_t *n
if (chunk_equals(notification_data, this->natd_src_hash))
{
this->natd_src_matched = TRUE;
DBG2(SIG_DBG_IKE, "NAT-D src hash match");
DBG2(DBG_IKE, "NAT-D src hash match");
}
else
{
DBG2(SIG_DBG_IKE, "NAT-D src hash mismatch");
DBG2(DBG_IKE, "NAT-D src hash mismatch");
}
return SUCCESS;
}
@@ -472,13 +483,13 @@ static status_t process_notifys(private_ike_sa_init_t *this, notify_payload_t *n
{
if (notify_type < 16383)
{
SIG(SIG_IKE_FAILED, "received %N notify error, deleting IKE_SA",
SIG(IKE_UP_FAILED, "received %N notify error, deleting IKE_SA",
notify_type_names, notify_type);
return DESTROY_ME;
}
else
{
SIG(SIG_IKE_FAILED, "received %N notify, ignored",
DBG1(DBG_IKE, "received %N notify, ignored",
notify_type_names, notify_type);
return SUCCESS;
}
@@ -516,6 +527,8 @@ static status_t get_response(private_ike_sa_init_t *this,
other = request->get_source(request);
this->message_id = request->get_message_id(request);
SIG(IKE_UP_START, "establishing IKE_SA between %H...%H", me, other);
/* set up response */
response = message_create();
response->set_source(response, me->clone(me));
@@ -530,7 +543,7 @@ static status_t get_response(private_ike_sa_init_t *this,
/* check message type */
if (request->get_exchange_type(request) != IKE_SA_INIT)
{
SIG(SIG_IKE_FAILED, "IKE_SA_INIT request of invalid type, deleting IKE_SA");
SIG(IKE_UP_FAILED, "IKE_SA_INIT request of invalid type, deleting IKE_SA");
return DESTROY_ME;
}
@@ -543,7 +556,7 @@ static status_t get_response(private_ike_sa_init_t *this,
notify->set_notify_type(notify, NO_PROPOSAL_CHOSEN);
response->add_payload(response, (payload_t*)notify);
SIG(SIG_IKE_FAILED, "no connection for hosts %H...%H found, "
SIG(IKE_UP_FAILED, "no connection for hosts %H...%H found, "
"deleting IKE_SA", me, other);
return DESTROY_ME;
}
@@ -594,7 +607,7 @@ static status_t get_response(private_ike_sa_init_t *this,
}
default:
{
DBG2(SIG_DBG_IKE, "ignoring %N payload",
DBG2(DBG_IKE, "ignoring %N payload",
payload_type_names, payload->get_type(payload));
break;
}
@@ -608,7 +621,7 @@ static status_t get_response(private_ike_sa_init_t *this,
notify_payload_t *notify = notify_payload_create();
notify->set_notify_type(notify, INVALID_SYNTAX);
response->add_payload(response, (payload_t*)notify);
SIG(SIG_IKE_FAILED, "request message incomplete, deleting IKE_SA");
SIG(IKE_UP_FAILED, "received request message incomplete, deleting IKE_SA");
return DESTROY_ME;
}
@@ -630,7 +643,7 @@ static status_t get_response(private_ike_sa_init_t *this,
notify_payload_t *notify = notify_payload_create();
notify->set_notify_type(notify, NO_PROPOSAL_CHOSEN);
response->add_payload(response, (payload_t*)notify);
SIG(SIG_IKE_FAILED, "request did not contain any acceptable "
SIG(IKE_UP_FAILED, "request did not contain any acceptable "
"proposals, deleting IKE_SA");
return DESTROY_ME;
}
@@ -660,10 +673,10 @@ static status_t get_response(private_ike_sa_init_t *this,
payload_t *payload;
notify_group = this->connection->get_dh_group(this->connection);
DBG1(SIG_DBG_IKE, "request used inacceptable DH group %N, sending "
"INVALID_KE_PAYLOAD with %N, deleting IKE_SA",
diffie_hellman_group_names, used_group,
diffie_hellman_group_names, notify_group);
SIG(IKE_UP_FAILED, "request used inacceptable DH group %N, sending "
"INVALID_KE_PAYLOAD with %N, deleting IKE_SA",
diffie_hellman_group_names, used_group,
diffie_hellman_group_names, notify_group);
/* remove already added payloads */
iterator = response->get_payload_iterator(response);
@@ -707,7 +720,7 @@ static status_t get_response(private_ike_sa_init_t *this,
notify_payload_t *notify = notify_payload_create();
notify->set_notify_type(notify, NO_PROPOSAL_CHOSEN);
response->add_payload(response, (payload_t*)notify);
SIG(SIG_IKE_FAILED, "could not create nonce, deleting IKE_SA");
SIG(IKE_UP_FAILED, "could not create nonce, deleting IKE_SA");
return DESTROY_ME;
}
nonce_response = nonce_payload_create();
@@ -729,7 +742,7 @@ static status_t get_response(private_ike_sa_init_t *this,
notify = notify_payload_create();
notify->set_notify_type(notify, INVALID_SYNTAX);
response->add_payload(response, (payload_t*)notify);
SIG(SIG_IKE_FAILED, "request contained invalid number of NAT-D"
SIG(IKE_UP_FAILED, "request contained invalid number of NAT-D"
"payloads, deleting IKE_SA");
return DESTROY_ME;
}
@@ -763,7 +776,7 @@ static status_t get_response(private_ike_sa_init_t *this,
notify_payload_t *notify = notify_payload_create();
notify->set_notify_type(notify, NO_PROPOSAL_CHOSEN);
response->add_payload(response, (payload_t*)notify);
SIG(SIG_IKE_FAILED, "error creating transform from proposal, deleting IKE_SA");
SIG(IKE_UP_FAILED, "error creating transforms from proposal, deleting IKE_SA");
return DESTROY_ME;
}
@@ -781,7 +794,7 @@ static status_t get_response(private_ike_sa_init_t *this,
* as we don't use a crypter/signer in ike_sa_init... */
if (response->generate(response, NULL, NULL, &response_packet) != SUCCESS)
{
SIG(SIG_IKE_FAILED, "error in response generation, deleting IKE_SA");
SIG(IKE_UP_FAILED, "error in response generation, deleting IKE_SA");
return DESTROY_ME;
}
response_packet->destroy(response_packet);
@@ -835,7 +848,8 @@ static status_t conclude(private_ike_sa_init_t *this, message_t *response,
/* check message type */
if (response->get_exchange_type(response) != IKE_SA_INIT)
{
SIG(SIG_IKE_FAILED, "IKE_SA_INIT response of invalid type, deleting IKE_SA");
SIG(IKE_UP_FAILED, "IKE_SA_INIT response of invalid type, deleting IKE_SA");
SIG(CHILD_UP_FAILED, "initiating CHILD_SA failed, unable to create IKE_SA");
return DESTROY_ME;
}
@@ -849,7 +863,8 @@ static status_t conclude(private_ike_sa_init_t *this, message_t *response,
responder_spi = response->get_responder_spi(response);
if (responder_spi == 0)
{
SIG(SIG_IKE_FAILED, "response contained a SPI of zero, deleting IKE_SA");
SIG(IKE_UP_FAILED, "response contained a SPI of zero, deleting IKE_SA");
SIG(CHILD_UP_FAILED, "initiating CHILD_SA failed, unable to create IKE_SA");
return DESTROY_ME;
}
@@ -890,6 +905,7 @@ static status_t conclude(private_ike_sa_init_t *this, message_t *response,
}
if (status == DESTROY_ME)
{
SIG(CHILD_UP_FAILED, "initiating CHILD_SA failed, unable to create IKE_SA");
payloads->destroy(payloads);
return status;
}
@@ -897,7 +913,7 @@ static status_t conclude(private_ike_sa_init_t *this, message_t *response,
}
default:
{
DBG1(SIG_DBG_IKE, "ignoring payload %N",
DBG1(DBG_IKE, "ignoring payload %N",
payload_type_names, payload->get_type(payload));
break;
}
@@ -907,7 +923,8 @@ static status_t conclude(private_ike_sa_init_t *this, message_t *response,
if (!(nonce_payload && sa_payload && ke_payload))
{
SIG(SIG_IKE_FAILED, "response message incomplete, deleting IKE_SA");
SIG(IKE_UP_FAILED, "response message incomplete, deleting IKE_SA");
SIG(CHILD_UP_FAILED, "initiating CHILD_SA failed, unable to create IKE_SA");
return DESTROY_ME;
}
@@ -923,7 +940,8 @@ static status_t conclude(private_ike_sa_init_t *this, message_t *response,
proposal_list = sa_payload->get_proposals (sa_payload);
if (proposal_list->get_count(proposal_list) != 1)
{
SIG(SIG_IKE_FAILED, "response did not contain a single proposal, deleting IKE_SA");
SIG(IKE_UP_FAILED, "response did not contain a single proposal, deleting IKE_SA");
SIG(CHILD_UP_FAILED, "initiating CHILD_SA failed, unable to create IKE_SA");
proposal_list->destroy_offset(proposal_list, offsetof(proposal_t, destroy));
return DESTROY_ME;
}
@@ -934,7 +952,8 @@ static status_t conclude(private_ike_sa_init_t *this, message_t *response,
if (this->proposal == NULL)
{
SIG(SIG_IKE_FAILED, "peer selected a proposal we did not offer, deleting IKE_SA");
SIG(IKE_UP_FAILED, "peer selected a proposal we did not offer, deleting IKE_SA");
SIG(CHILD_UP_FAILED, "initiating CHILD_SA failed, unable to create IKE_SA");
return DESTROY_ME;
}
}
@@ -962,7 +981,8 @@ static status_t conclude(private_ike_sa_init_t *this, message_t *response,
if ((!this->natd_dst_seen && this->natd_src_seen) ||
(this->natd_dst_seen && !this->natd_src_seen))
{
SIG(SIG_IKE_FAILED, "request contained invalid number of NAT-D payloads, deleting IKE_SA");
SIG(IKE_UP_FAILED, "request contained invalid number of NAT-D payloads, deleting IKE_SA");
SIG(CHILD_UP_FAILED, "initiating CHILD_SA failed, unable to create IKE_SA");
return DESTROY_ME;
}
if (this->natd_src_seen && !this->natd_src_matched)
@@ -980,7 +1000,7 @@ static status_t conclude(private_ike_sa_init_t *this, message_t *response,
other = this->ike_sa->get_other_host(this->ike_sa);
other->set_port(other, IKEV2_NATT_PORT);
DBG2(SIG_DBG_IKE, "switching to port %d", IKEV2_NATT_PORT);
DBG2(DBG_IKE, "switching to port %d", IKEV2_NATT_PORT);
}
}
@@ -994,7 +1014,8 @@ static status_t conclude(private_ike_sa_init_t *this, message_t *response,
this->nonce_i, this->nonce_r,
TRUE, NULL, NULL) != SUCCESS)
{
SIG(SIG_IKE_FAILED, "error creating transforms from proposal, deleting IKE_SA");
SIG(IKE_UP_FAILED, "error creating transforms from proposal, deleting IKE_SA");
SIG(CHILD_UP_FAILED, "initiating CHILD_SA failed, unable to create IKE_SA");
return DESTROY_ME;
}
src/charon/sa/transactions/rekey_ike_sa.c
+24 -24
View File
@@ -167,7 +167,7 @@ static status_t get_request(private_rekey_ike_sa_t *this, message_t **result)
if (this->ike_sa->get_state(this->ike_sa) != IKE_ESTABLISHED &&
!this->diffie_hellman)
{
DBG1(SIG_DBG_IKE, "tried to rekey in state %N, aborted",
DBG1(DBG_IKE, "tried to rekey in state %N, aborted",
ike_sa_state_names, this->ike_sa->get_state(this->ike_sa));
return FAILED;
}
@@ -205,7 +205,7 @@ static status_t get_request(private_rekey_ike_sa_t *this, message_t **result)
me, other);
if (this->connection == NULL)
{
DBG1(SIG_DBG_IKE, "no connection found to rekey IKE_SA");
DBG1(DBG_IKE, "no connection found to rekey IKE_SA");
return FAILED;
}
}
@@ -252,7 +252,7 @@ static status_t get_request(private_rekey_ike_sa_t *this, message_t **result)
this->diffie_hellman = diffie_hellman_create(dh_group);
if (this->diffie_hellman == NULL)
{
DBG1(SIG_DBG_IKE, "DH group %N not supported, aborting",
DBG1(DBG_IKE, "DH group %N not supported, aborting",
diffie_hellman_group_names, dh_group);
return FAILED;
}
@@ -282,13 +282,13 @@ static status_t process_notifys(private_rekey_ike_sa_t *this, notify_payload_t *
{
notify_type_t notify_type = notify_payload->get_notify_type(notify_payload);
DBG2(SIG_DBG_IKE,"process notify type %N", notify_type_names, notify_type);
DBG2(DBG_IKE,"process notify type %N", notify_type_names, notify_type);
switch (notify_type)
{
case NO_PROPOSAL_CHOSEN:
{
DBG1(SIG_DBG_IKE, "received a NO_PROPOSAL_CHOSEN notify, IKE_SA rekeying failed");
DBG1(DBG_IKE, "received a NO_PROPOSAL_CHOSEN notify, IKE_SA rekeying failed");
return FAILED;
}
case INVALID_KE_PAYLOAD:
@@ -301,12 +301,12 @@ static status_t process_notifys(private_rekey_ike_sa_t *this, notify_payload_t *
notify_data = notify_payload->get_notification_data(notify_payload);
dh_group = ntohs(*((u_int16_t*)notify_data.ptr));
DBG1(SIG_DBG_IKE, "peer didn't accept DH group %N, it requested %N",
DBG1(DBG_IKE, "peer didn't accept DH group %N, it requested %N",
diffie_hellman_group_names, old_dh_group,
diffie_hellman_group_names, dh_group);
if (!this->connection->check_dh_group(this->connection, dh_group))
{
DBG1(SIG_DBG_IKE, "requested DH group not acceptable, IKE_SA rekeying failed");
DBG1(DBG_IKE, "requested DH group not acceptable, IKE_SA rekeying failed");
return FAILED;
}
retry = rekey_ike_sa_create(this->ike_sa);
@@ -318,13 +318,13 @@ static status_t process_notifys(private_rekey_ike_sa_t *this, notify_payload_t *
{
if (notify_type < 16383)
{
DBG1(SIG_DBG_IKE, "received %N notify error, IKE_SA rekeying failed",
DBG1(DBG_IKE, "received %N notify error, IKE_SA rekeying failed",
notify_type_names, notify_type);
return FAILED;
}
else
{
DBG1(SIG_DBG_IKE, "received %N notify, ignored",
DBG1(DBG_IKE, "received %N notify, ignored",
notify_type_names, notify_type);
return SUCCESS;
}
@@ -438,7 +438,7 @@ static status_t get_response(private_rekey_ike_sa_t *this, message_t *request,
/* check message type */
if (request->get_exchange_type(request) != CREATE_CHILD_SA)
{
DBG1(SIG_DBG_IKE, "CREATE_CHILD_SA response of invalid type, aborted");
DBG1(DBG_IKE, "CREATE_CHILD_SA response of invalid type, aborted");
return FAILED;
}
@@ -446,7 +446,7 @@ static status_t get_response(private_rekey_ike_sa_t *this, message_t *request,
if (this->ike_sa->get_state(this->ike_sa) == IKE_DELETING)
{
build_notify(NO_PROPOSAL_CHOSEN, CHUNK_INITIALIZER, response, TRUE);
DBG1(SIG_DBG_IKE, "unable to rekey, as delete in progress. Sending NO_PROPOSAL_CHOSEN");
DBG1(DBG_IKE, "unable to rekey, as delete in progress. Sending NO_PROPOSAL_CHOSEN");
return FAILED;
}
@@ -460,7 +460,7 @@ static status_t get_response(private_rekey_ike_sa_t *this, message_t *request,
state == CHILD_DELETING)
{
build_notify(NO_PROPOSAL_CHOSEN, CHUNK_INITIALIZER, response, TRUE);
DBG1(SIG_DBG_IKE, "unable to rekey, one CHILD_SA is half open. Sending NO_PROPOSAL_CHOSEN");
DBG1(DBG_IKE, "unable to rekey, one CHILD_SA is half open. Sending NO_PROPOSAL_CHOSEN");
iterator->destroy(iterator);
return FAILED;
}
@@ -481,7 +481,7 @@ static status_t get_response(private_rekey_ike_sa_t *this, message_t *request,
charon->connections, me, other);
if (this->connection == NULL)
{
DBG1(SIG_DBG_IKE, "no connection found to rekey IKE_SA, sending NO_RROPOSAL_CHOSEN");
DBG1(DBG_IKE, "no connection found to rekey IKE_SA, sending NO_RROPOSAL_CHOSEN");
build_notify(NO_PROPOSAL_CHOSEN, CHUNK_INITIALIZER, response, TRUE);
return FAILED;
}
@@ -516,7 +516,7 @@ static status_t get_response(private_rekey_ike_sa_t *this, message_t *request,
}
default:
{
DBG1(SIG_DBG_IKE, "ignoring %N payload",
DBG1(DBG_IKE, "ignoring %N payload",
payload_type_names, payload->get_type(payload));
break;
}
@@ -528,7 +528,7 @@ static status_t get_response(private_rekey_ike_sa_t *this, message_t *request,
if (!(sa_request && nonce_request && ke_request))
{
build_notify(INVALID_SYNTAX, CHUNK_INITIALIZER, response, TRUE);
DBG1(SIG_DBG_IKE, "request message incomplete, IKE_SA rekeying failed");
DBG1(DBG_IKE, "request message incomplete, IKE_SA rekeying failed");
return FAILED;
}
@@ -553,14 +553,14 @@ static status_t get_response(private_rekey_ike_sa_t *this, message_t *request,
sa_response = sa_payload_create();
/* get proposals from request, and select one with ours */
proposal_list = sa_request->get_proposals(sa_request);
DBG2(SIG_DBG_IKE, "selecting proposals:");
DBG2(DBG_IKE, "selecting proposals:");
this->proposal = this->connection->select_proposal(this->connection, proposal_list);
proposal_list->destroy_offset(proposal_list, offsetof(proposal_t, destroy));
/* do we have a proposal? */
if (this->proposal == NULL)
{
DBG1(SIG_DBG_IKE, "no proposals acceptable to rekey IKE_SA, sending NO_PROPOSAL_CHOSEN");
DBG1(DBG_IKE, "no proposals acceptable to rekey IKE_SA, sending NO_PROPOSAL_CHOSEN");
build_notify(NO_PROPOSAL_CHOSEN, CHUNK_INITIALIZER, response, TRUE);
return FAILED;
}
@@ -593,7 +593,7 @@ static status_t get_response(private_rekey_ike_sa_t *this, message_t *request,
chunk_t notify_chunk;
notify_group = this->connection->get_dh_group(this->connection);
DBG1(SIG_DBG_IKE, "request used inacceptable DH group %N, sending "
DBG1(DBG_IKE, "request used inacceptable DH group %N, sending "
"INVALID_KE_PAYLOAD with %N",
diffie_hellman_group_names, used_group,
diffie_hellman_group_names, notify_group);
@@ -675,7 +675,7 @@ static status_t conclude(private_rekey_ike_sa_t *this, message_t *response,
/* check message type */
if (response->get_exchange_type(response) != CREATE_CHILD_SA)
{
DBG1(SIG_DBG_IKE, "CREATE_CHILD_SA response of invalid type, aborting");
DBG1(DBG_IKE, "CREATE_CHILD_SA response of invalid type, aborting");
return FAILED;
}
@@ -712,7 +712,7 @@ static status_t conclude(private_rekey_ike_sa_t *this, message_t *response,
}
default:
{
DBG1(SIG_DBG_IKE, "ignoring %N payload",
DBG1(DBG_IKE, "ignoring %N payload",
payload_type_names, payload->get_type(payload));
break;
}
@@ -722,7 +722,7 @@ static status_t conclude(private_rekey_ike_sa_t *this, message_t *response,
if (!(sa_payload && nonce_payload && ke_payload))
{
DBG1(SIG_DBG_IKE, "response message incomplete, rekeying IKE_SA failed");
DBG1(DBG_IKE, "response message incomplete, rekeying IKE_SA failed");
return FAILED;
}
@@ -742,7 +742,7 @@ static status_t conclude(private_rekey_ike_sa_t *this, message_t *response,
if (this->proposal == NULL)
{
DBG1(SIG_DBG_IKE, "no proposal selected, rekeying IKE_SA failed");
DBG1(DBG_IKE, "no proposal selected, rekeying IKE_SA failed");
return FAILED;
}
spi = this->proposal->get_spi(this->proposal);
@@ -788,12 +788,12 @@ static status_t conclude(private_rekey_ike_sa_t *this, message_t *response,
if (memcmp(this_lowest.ptr, this->nonce_s.ptr,
min(this_lowest.len, this->nonce_s.len)) < 0)
{
DBG1(SIG_DBG_IKE, "detected simultaneous IKE_SA rekeying, deleting ours");
DBG1(DBG_IKE, "detected simultaneous IKE_SA rekeying, deleting ours");
this->lost = TRUE;
}
else
{
DBG1(SIG_DBG_IKE, "detected simultaneous IKE_SA rekeying, but ours is preferred");
DBG1(DBG_IKE, "detected simultaneous IKE_SA rekeying, but ours is preferred");
}
if (this->lost)
{