denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

trap-manager: Uninstall trap policies by name and not reqid

Browse Source 
If a trap policy is concurrently uninstalled and reinstalled under a
different name the reqid will be the same so the wrong trap might be
removed.
This commit is contained in:
Tobias Brunner
2018-02-22 11:31:05 +01:00
parent 6f569263a0
commit ca213e1907
6 changed files with 23 additions and 72 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/ha/ha_tunnel.c
+5 -3
View File
@@ -20,6 +20,8 @@
#include <utils/identification.h>
#include <processing/jobs/callback_job.h>
#define HA_CFG_NAME "ha"
typedef struct private_ha_tunnel_t private_ha_tunnel_t;
typedef struct ha_backend_t ha_backend_t;
typedef struct ha_creds_t ha_creds_t;
@@ -225,7 +227,7 @@ static void setup_tunnel(private_ha_tunnel_t *this,
remote, IKEV2_UDP_PORT, FRAGMENTATION_NO, 0);
ike_cfg->add_proposal(ike_cfg, proposal_create_default(PROTO_IKE));
ike_cfg->add_proposal(ike_cfg, proposal_create_default_aead(PROTO_IKE));
peer_cfg = peer_cfg_create("ha", ike_cfg, &peer);
peer_cfg = peer_cfg_create(HA_CFG_NAME, ike_cfg, &peer);
auth_cfg = auth_cfg_create();
auth_cfg->add(auth_cfg, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PSK);
@@ -239,7 +241,7 @@ static void setup_tunnel(private_ha_tunnel_t *this,
identification_create_from_string(remote));
peer_cfg->add_auth_cfg(peer_cfg, auth_cfg, FALSE);
child_cfg = child_cfg_create("ha", &child);
child_cfg = child_cfg_create(HA_CFG_NAME, &child);
ts = traffic_selector_create_dynamic(IPPROTO_UDP, HA_PORT, HA_PORT);
child_cfg->add_traffic_selector(child_cfg, TRUE, ts);
ts = traffic_selector_create_dynamic(IPPROTO_ICMP, 0, 65535);
@@ -280,7 +282,7 @@ METHOD(ha_tunnel_t, destroy, void,
this->creds.remote->destroy(this->creds.remote);
if (this->trap)
{
charon->traps->uninstall(charon->traps, this->trap);
charon->traps->uninstall(charon->traps, HA_CFG_NAME, HA_CFG_NAME);
}
free(this);
}
src/libcharon/plugins/stroke/stroke_control.c
+2 -20
View File
@@ -730,31 +730,13 @@ METHOD(stroke_control_t, route, void,
METHOD(stroke_control_t, unroute, void,
private_stroke_control_t *this, stroke_msg_t *msg, FILE *out)
{
child_sa_t *child_sa;
enumerator_t *enumerator;
uint32_t id = 0;
if (charon->shunts->uninstall(charon->shunts, NULL, msg->unroute.name))
{
fprintf(out, "shunt policy '%s' uninstalled\n", msg->unroute.name);
return;
}
enumerator = charon->traps->create_enumerator(charon->traps);
while (enumerator->enumerate(enumerator, NULL, &child_sa))
else if (charon->traps->uninstall(charon->traps, NULL, msg->unroute.name))
{
if (streq(msg->unroute.name, child_sa->get_name(child_sa)))
{
id = child_sa->get_reqid(child_sa);
break;
}
}
enumerator->destroy(enumerator);
if (id)
{
charon->traps->uninstall(charon->traps, id);
fprintf(out, "configuration '%s' unrouted\n", msg->unroute.name);
fprintf(out, "trap policy '%s' unrouted\n", msg->unroute.name);
}
else
{
src/libcharon/plugins/vici/vici_config.c
+1 -17
View File
@@ -2030,7 +2030,6 @@ static void clear_start_action(private_vici_config_t *this, char *peer_name,
{
enumerator_t *enumerator, *children;
child_sa_t *child_sa;
peer_cfg_t *peer_cfg;
ike_sa_t *ike_sa;
uint32_t id = 0, others;
array_t *ids = NULL, *ikeids = NULL;
@@ -2121,22 +2120,7 @@ static void clear_start_action(private_vici_config_t *this, char *peer_name,
charon->shunts->uninstall(charon->shunts, peer_name, name);
break;
default:
enumerator = charon->traps->create_enumerator(charon->traps);
while (enumerator->enumerate(enumerator, &peer_cfg,
&child_sa))
{
if (streq(peer_name, peer_cfg->get_name(peer_cfg)) &&
streq(name, child_sa->get_name(child_sa)))
{
id = child_sa->get_reqid(child_sa);
break;
}
}
enumerator->destroy(enumerator);
if (id)
{
charon->traps->uninstall(charon->traps, id);
}
charon->traps->uninstall(charon->traps, peer_name, name);
break;
}
break;
src/libcharon/plugins/vici/vici_control.c
+2 -23
View File
@@ -679,10 +679,6 @@ CALLBACK(install, vici_message_t*,
CALLBACK(uninstall, vici_message_t*,
private_vici_control_t *this, char *name, u_int id, vici_message_t *request)
{
peer_cfg_t *peer_cfg;
child_sa_t *child_sa;
enumerator_t *enumerator;
uint32_t reqid = 0;
char *child, *ike;
child = request->get_str(request, NULL, "child");
@@ -698,26 +694,9 @@ CALLBACK(uninstall, vici_message_t*,
{
return send_reply(this, NULL);
}
enumerator = charon->traps->create_enumerator(charon->traps);
while (enumerator->enumerate(enumerator, &peer_cfg, &child_sa))
else if (charon->traps->uninstall(charon->traps, ike, child))
{
if ((!ike || streq(ike, peer_cfg->get_name(peer_cfg))) &&
streq(child, child_sa->get_name(child_sa)))
{
reqid = child_sa->get_reqid(child_sa);
break;
}
}
enumerator->destroy(enumerator);
if (reqid)
{
if (charon->traps->uninstall(charon->traps, reqid))
{
return send_reply(this, NULL);
}
return send_reply(this, "uninstalling policy '%s' failed", child);
return send_reply(this, NULL);
}
return send_reply(this, "policy '%s' not found", child);
}