denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fixed notify handling in IKE_AUTH

Browse Source 
moved nonce payload before TS in CHILD_SA setup
This commit is contained in:
Martin Willi
2007-03-06 20:58:39 +00:00
parent f2d4ec5639
commit c676f2e2a6
2 changed files with 25 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/charon/sa/tasks/child_create.c
+24 -12
View File
@@ -330,12 +330,6 @@ static void build_payloads(private_child_create_t *this, message_t *message)
} }
message->add_payload(message, (payload_t*)sa_payload); message->add_payload(message, (payload_t*)sa_payload);
/* add TSi/TSr payloads */
ts_payload = ts_payload_create_from_traffic_selectors(TRUE, this->tsi);
message->add_payload(message, (payload_t*)ts_payload);
ts_payload = ts_payload_create_from_traffic_selectors(FALSE, this->tsr);
message->add_payload(message, (payload_t*)ts_payload);
/* add nonce payload if not in IKE_AUTH */ /* add nonce payload if not in IKE_AUTH */
if (message->get_exchange_type(message) == CREATE_CHILD_SA) if (message->get_exchange_type(message) == CREATE_CHILD_SA)
{ {
@@ -344,6 +338,12 @@ static void build_payloads(private_child_create_t *this, message_t *message)
message->add_payload(message, (payload_t*)nonce_payload); message->add_payload(message, (payload_t*)nonce_payload);
} }
/* add TSi/TSr payloads */
ts_payload = ts_payload_create_from_traffic_selectors(TRUE, this->tsi);
message->add_payload(message, (payload_t*)ts_payload);
ts_payload = ts_payload_create_from_traffic_selectors(FALSE, this->tsr);
message->add_payload(message, (payload_t*)ts_payload);
/* add a notify if we are not in tunnel mode */ /* add a notify if we are not in tunnel mode */
switch (this->mode) switch (this->mode)
{ {
@@ -590,13 +590,25 @@ static status_t process_i(private_child_create_t *this, message_t *message)
notify_payload_t *notify = (notify_payload_t*)payload; notify_payload_t *notify = (notify_payload_t*)payload;
notify_type_t type = notify->get_notify_type(notify); notify_type_t type = notify->get_notify_type(notify);
if (type < 16383) switch (type)
{ {
SIG(CHILD_UP_FAILED, "received %N notify error", /* handle notify errors related to CHILD_SA only */
notify_type_names, type); case NO_PROPOSAL_CHOSEN:
iterator->destroy(iterator); case SINGLE_PAIR_REQUIRED:
/* an error in CHILD_SA creation is not critical */ case NO_ADDITIONAL_SAS:
return SUCCESS; case INTERNAL_ADDRESS_FAILURE:
case FAILED_CP_REQUIRED:
case TS_UNACCEPTABLE:
case INVALID_SELECTORS:
{
SIG(CHILD_UP_FAILED, "received %N notify, no CHILD_SA built",
notify_type_names, type);
iterator->destroy(iterator);
/* an error in CHILD_SA creation is not critical */
return SUCCESS;
}
default:
break;
} }
} }
} }
src/charon/sa/tasks/ike_auth.c
+1 -4
View File
@@ -386,10 +386,7 @@ static status_t process_i(private_ike_auth_t *this, message_t *message)
case INVALID_SELECTORS: case INVALID_SELECTORS:
/* these are errors, but are not critical as only the /* these are errors, but are not critical as only the
* CHILD_SA won't get build, but IKE_SA establishes anyway */ * CHILD_SA won't get build, but IKE_SA establishes anyway */
DBG1(DBG_IKE, "received %N notify, no CHILD_SA built", break;
notify_type_names, type);
iterator->destroy(iterator);
return SUCCESS;
default: default:
{ {
if (type < 16383) if (type < 16383)