denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

vici: Fix fallback to remote ID if no mediation peer ID is configured

Browse Source 
Also adds error reporting via VICI for issues with mediation settings.

Fixes: 229cdf6bc8 ("vici: Order auth rounds by optional `round` parameter instead of by position in the request")
References strongswan/strongswan#1569
This commit is contained in:
Tobias Brunner
2023-03-21 16:21:48 +01:00
parent 3c8887326a
commit dd79253e2d
1 changed files with 12 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/vici/vici_config.c
+12 -12
View File
@@ -2604,8 +2604,8 @@ CALLBACK(config_sn, bool,
#ifdef ME #ifdef ME
if (peer.mediation && peer.mediated_by) if (peer.mediation && peer.mediated_by)
{ {
DBG1(DBG_CFG, "a mediation connection cannot be a mediated connection " request->reply = create_reply("a mediation connection cannot be a "
"at the same time, config discarded"); "mediated connection at the same time");
free_peer_data(&peer); free_peer_data(&peer);
return FALSE; return FALSE;
} }
@@ -2616,23 +2616,23 @@ CALLBACK(config_sn, bool,
else if (peer.mediated_by) else if (peer.mediated_by)
{ /* fallback to remote identity of first auth round if peer_id is not { /* fallback to remote identity of first auth round if peer_id is not
* given explicitly */ * given explicitly */
auth_cfg_t *cfg; auth_data_t *auth;
if (!peer.peer_id && if (!peer.peer_id &&
peer.remote->get_first(peer.remote, (void**)&cfg) == SUCCESS) peer.remote->get_first(peer.remote, (void**)&auth) == SUCCESS)
{ {
peer.peer_id = cfg->get(cfg, AUTH_RULE_IDENTITY); peer.peer_id = auth->cfg->get(auth->cfg, AUTH_RULE_IDENTITY);
if (peer.peer_id) if (peer.peer_id)
{ {
peer.peer_id = peer.peer_id->clone(peer.peer_id); peer.peer_id = peer.peer_id->clone(peer.peer_id);
} }
else }
{ if (!peer.peer_id)
DBG1(DBG_CFG, "mediation peer missing for mediated connection, " {
"config discarded"); request->reply = create_reply("mediation peer or remote identity "
free_peer_data(&peer); "missing for mediated connection");
return FALSE; free_peer_data(&peer);
} return FALSE;
} }
} }
#endif /* ME */ #endif /* ME */