denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

If no IKEv1 shared key found for hosts, try to find one based on config identities

Browse Source
This commit is contained in:
Martin Willi
2012-03-20 17:31:17 +01:00
parent 033dfba01f
commit cc6b03bb5a
1 changed files with 68 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/tasks/main_mode.c
+68 -17
View File
@@ -145,13 +145,12 @@ struct private_main_mode_t {
/** /**
* Get the first authentcation config from peer config * Get the first authentcation config from peer config
*/ */
static auth_cfg_t *get_auth_cfg(private_main_mode_t *this, bool local) static auth_cfg_t *get_auth_cfg(peer_cfg_t *peer_cfg, bool local)
{ {
enumerator_t *enumerator; enumerator_t *enumerator;
auth_cfg_t *cfg = NULL; auth_cfg_t *cfg = NULL;
enumerator = this->peer_cfg->create_auth_cfg_enumerator(this->peer_cfg, enumerator = peer_cfg->create_auth_cfg_enumerator(peer_cfg, local);
local);
enumerator->enumerate(enumerator, &cfg); enumerator->enumerate(enumerator, &cfg);
enumerator->destroy(enumerator); enumerator->destroy(enumerator);
return cfg; return cfg;
@@ -465,8 +464,8 @@ METHOD(task_t, build_i, status_t,
this->peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa); this->peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
this->peer_cfg->get_ref(this->peer_cfg); this->peer_cfg->get_ref(this->peer_cfg);
this->my_auth = get_auth_cfg(this, TRUE); this->my_auth = get_auth_cfg(this->peer_cfg, TRUE);
this->other_auth = get_auth_cfg(this, FALSE); this->other_auth = get_auth_cfg(this->peer_cfg, FALSE);
if (!this->my_auth || !this->other_auth) if (!this->my_auth || !this->other_auth)
{ {
DBG1(DBG_CFG, "no auth config found"); DBG1(DBG_CFG, "no auth config found");
@@ -659,8 +658,8 @@ METHOD(task_t, process_r, status_t,
} }
this->ike_sa->set_peer_cfg(this->ike_sa, this->peer_cfg); this->ike_sa->set_peer_cfg(this->ike_sa, this->peer_cfg);
this->my_auth = get_auth_cfg(this, TRUE); this->my_auth = get_auth_cfg(this->peer_cfg, TRUE);
this->other_auth = get_auth_cfg(this, FALSE); this->other_auth = get_auth_cfg(this->peer_cfg, FALSE);
if (!this->my_auth || !this->other_auth) if (!this->my_auth || !this->other_auth)
{ {
DBG1(DBG_IKE, "auth config missing"); DBG1(DBG_IKE, "auth config missing");
@@ -694,24 +693,76 @@ static shared_key_t *lookup_shared_key(private_main_mode_t *this)
identification_t *my_id, *other_id; identification_t *my_id, *other_id;
shared_key_t *shared_key; shared_key_t *shared_key;
/* try to get a PSK for IP addresses */
me = this->ike_sa->get_my_host(this->ike_sa); me = this->ike_sa->get_my_host(this->ike_sa);
other = this->ike_sa->get_other_host(this->ike_sa); other = this->ike_sa->get_other_host(this->ike_sa);
my_id = identification_create_from_sockaddr(me->get_sockaddr(me)); my_id = identification_create_from_sockaddr(me->get_sockaddr(me));
other_id = identification_create_from_sockaddr(other->get_sockaddr(other)); other_id = identification_create_from_sockaddr(other->get_sockaddr(other));
if (!my_id || !other_id) if (my_id && other_id)
{ {
DESTROY_IF(my_id); shared_key = lib->credmgr->get_shared(lib->credmgr, SHARED_IKE,
DESTROY_IF(other_id); my_id, other_id);
return NULL;
} }
shared_key = lib->credmgr->get_shared(lib->credmgr, SHARED_IKE, my_id, DESTROY_IF(my_id);
other_id); DESTROY_IF(other_id);
if (!shared_key) if (shared_key)
{ {
DBG1(DBG_IKE, "no shared key found for %H - %H", me, other); return shared_key;
}
if (this->my_auth && this->other_auth)
{ /* as initiator, use identities from configuraiton */
my_id = this->my_auth->get(this->my_auth, AUTH_RULE_IDENTITY);
other_id = this->other_auth->get(this->other_auth, AUTH_RULE_IDENTITY);
if (my_id && other_id)
{
shared_key = lib->credmgr->get_shared(lib->credmgr, SHARED_IKE,
my_id, other_id);
}
else
{
DBG1(DBG_IKE, "no shared key found for '%Y'[%H] - '%Y'[%H]",
my_id, me, other_id, other);
}
}
else
{ /* as responder, we try to find a config by IP */
enumerator_t *enumerator;
auth_cfg_t *my_auth, *other_auth;
peer_cfg_t *peer_cfg = NULL;
enumerator = charon->backends->create_peer_cfg_enumerator(
charon->backends, me, other, NULL, NULL);
while (enumerator->enumerate(enumerator, &peer_cfg))
{
my_auth = get_auth_cfg(peer_cfg, TRUE);
other_auth = get_auth_cfg(peer_cfg, FALSE);
if (my_auth && other_auth)
{
my_id = my_auth->get(my_auth, AUTH_RULE_IDENTITY);
other_id = other_auth->get(other_auth, AUTH_RULE_IDENTITY);
if (my_id && other_id)
{
shared_key = lib->credmgr->get_shared(lib->credmgr,
SHARED_IKE, my_id, other_id);
if (shared_key)
{
break;
}
else
{
DBG1(DBG_IKE, "no shared key found for "
"'%Y'[%H] - '%Y'[%H]", my_id, me, other_id, other);
}
}
}
}
enumerator->destroy(enumerator);
if (!peer_cfg)
{
DBG1(DBG_IKE, "no shared key found for %H - %H", me, other);
}
} }
my_id->destroy(my_id);
other_id->destroy(other_id);
return shared_key; return shared_key;
} }