denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

restructured file layout

Browse Source 
new configuration structure:
  peer_cfg: configuration related to a peer (authenitcation, ...=
  ike_cfg: config to use for IKE setup (proposals)
  child_Cfg: config for CHILD_SA (proposals, traffic selectors)
  a peer_cfg has one ike_cfg and multiple child_cfg's
stroke now uses fixed count of threads
This commit is contained in:
Martin Willi
2007-04-10 06:01:03 +00:00
parent 1628cd6bda
commit e0fe765152
104 changed files with 3466 additions and 3470 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/charon/sa/authenticators/eap_authenticator.c
+1 -1
View File
@@ -25,7 +25,7 @@
#include "eap_authenticator.h"
#include <daemon.h>
#include <config/policies/policy.h>
#include <config/peer_cfg.h>
#include <sa/authenticators/eap/eap_method.h>
typedef struct private_eap_authenticator_t private_eap_authenticator_t;
src/charon/sa/authenticators/psk_authenticator.c
-1
View File
@@ -25,7 +25,6 @@
#include "psk_authenticator.h"
#include <config/policies/policy.h>
#include <daemon.h>
/**
src/charon/sa/authenticators/rsa_authenticator.c
-1
View File
@@ -25,7 +25,6 @@
#include "rsa_authenticator.h"
#include <config/policies/policy.h>
#include <daemon.h>
src/charon/sa/child_sa.c
+29 -34
View File
@@ -154,9 +154,9 @@ struct private_child_sa_t {
host_t *virtual_ip;
/**
* policy used to create this child
* config used to create this child
*/
policy_t *policy;
child_cfg_t *config;
};
/**
@@ -164,7 +164,7 @@ struct private_child_sa_t {
*/
static char *get_name(private_child_sa_t *this)
{
return this->policy->get_name(this->policy);;
return this->config->get_name(this->config);
}
/**
@@ -204,11 +204,11 @@ static child_sa_state_t get_state(private_child_sa_t *this)
}
/**
* Implements child_sa_t.get_policy
* Implements child_sa_t.get_config
*/
static policy_t* get_policy(private_child_sa_t *this)
static child_cfg_t* get_config(private_child_sa_t *this)
{
return this->policy;
return this->config;
}
/**
@@ -220,7 +220,7 @@ static void updown(private_child_sa_t *this, bool up)
iterator_t *iterator;
char *script;
script = this->policy->get_updown(this->policy);
script = this->config->get_updown(this->config);
if (script == NULL)
{
@@ -300,7 +300,7 @@ static void updown(private_child_sa_t *this, bool up)
policy->my_ts->is_host(policy->my_ts,
this->me.addr) ? "-host" : "-client",
this->me.addr->get_family(this->me.addr) == AF_INET ? "" : "-ipv6",
this->policy->get_name(this->policy),
this->config->get_name(this->config),
ifname ? ifname : "(unknown)",
this->reqid,
this->me.addr,
@@ -316,7 +316,7 @@ static void updown(private_child_sa_t *this, bool up)
policy->other_ts->get_from_port(policy->other_ts),
policy->other_ts->get_protocol(policy->other_ts),
virtual_ip,
this->policy->get_hostaccess(this->policy) ?
this->config->get_hostaccess(this->config) ?
"PLUTO_HOST_ACCESS='1' " : "",
script);
free(ifname);
@@ -528,8 +528,8 @@ static status_t install(private_child_sa_t *this, proposal_t *proposal,
natt = NULL;
}
soft = this->policy->get_soft_lifetime(this->policy);
hard = this->policy->get_hard_lifetime(this->policy);
soft = this->config->get_lifetime(this->config, TRUE);
hard = this->config->get_lifetime(this->config, FALSE);
/* send SA down to the kernel */
DBG2(DBG_CHD, " SPI 0x%.8x, src %H dst %H", ntohl(spi), src, dst);
@@ -665,10 +665,10 @@ static status_t add_policies(private_child_sa_t *this,
policy = malloc_thing(sa_policy_t);
policy->my_ts = my_ts->clone(my_ts);
policy->other_ts = other_ts->clone(other_ts);
this->policies->insert_last(this->policies, (void*)policy);
this->policies->insert_last(this->policies, policy);
/* add to separate list to query them via get_*_traffic_selectors() */
this->my_ts->insert_last(this->my_ts, (void*)policy->my_ts);
this->other_ts->insert_last(this->other_ts, (void*)policy->other_ts);
this->my_ts->insert_last(this->my_ts, policy->my_ts);
this->other_ts->insert_last(this->other_ts, policy->other_ts);
}
}
my_iter->destroy(my_iter);
@@ -685,18 +685,14 @@ static status_t add_policies(private_child_sa_t *this,
}
/**
* Implementation of child_sa_t.get_my_traffic_selectors.
* Implementation of child_sa_t.get_traffic_selectors.
*/
static linked_list_t *get_my_traffic_selectors(private_child_sa_t *this)
{
return this->my_ts;
}
/**
* Implementation of child_sa_t.get_my_traffic_selectors.
*/
static linked_list_t *get_other_traffic_selectors(private_child_sa_t *this)
static linked_list_t *get_traffic_selectors(private_child_sa_t *this, bool local)
{
if (local)
{
return this->my_ts;
}
return this->other_ts;
}
@@ -762,7 +758,7 @@ static int print(FILE *stream, const struct printf_info *info,
now = time(NULL);
written += fprintf(stream, "%12s{%d}: %N, %N",
this->policy->get_name(this->policy), this->reqid,
this->config->get_name(this->config), this->reqid,
child_sa_state_names, this->state,
mode_names, this->mode);
@@ -775,7 +771,7 @@ static int print(FILE *stream, const struct printf_info *info,
if (info->alt)
{
written += fprintf(stream, "\n%12s{%d}: ",
this->policy->get_name(this->policy),
this->config->get_name(this->config),
this->reqid);
if (this->protocol == PROTO_ESP)
@@ -814,7 +810,7 @@ static int print(FILE *stream, const struct printf_info *info,
while (iterator->iterate(iterator, (void**)&policy))
{
written += fprintf(stream, "\n%12s{%d}: %R===%R, last use: ",
this->policy->get_name(this->policy), this->reqid,
this->config->get_name(this->config), this->reqid,
policy->my_ts, policy->other_ts);
/* query time of last policy use */
@@ -1066,7 +1062,7 @@ static void destroy(private_child_sa_t *this)
this->other.addr->destroy(this->other.addr);
this->me.id->destroy(this->me.id);
this->other.id->destroy(this->other.id);
this->policy->destroy(this->policy);
this->config->destroy(this->config);
DESTROY_IF(this->virtual_ip);
free(this);
}
@@ -1076,7 +1072,7 @@ static void destroy(private_child_sa_t *this)
*/
child_sa_t * child_sa_create(host_t *me, host_t* other,
identification_t *my_id, identification_t *other_id,
policy_t *policy, u_int32_t rekey, bool use_natt)
child_cfg_t *config, u_int32_t rekey, bool use_natt)
{
static u_int32_t reqid = 0;
private_child_sa_t *this = malloc_thing(private_child_sa_t);
@@ -1091,12 +1087,11 @@ child_sa_t * child_sa_create(host_t *me, host_t* other,
this->public.update = (status_t(*)(child_sa_t*,proposal_t*,mode_t,prf_plus_t*))update;
this->public.update_hosts = (status_t (*)(child_sa_t*,host_t*,host_t*,host_diff_t,host_diff_t))update_hosts;
this->public.add_policies = (status_t (*)(child_sa_t*, linked_list_t*,linked_list_t*,mode_t))add_policies;
this->public.get_my_traffic_selectors = (linked_list_t*(*)(child_sa_t*))get_my_traffic_selectors;
this->public.get_other_traffic_selectors = (linked_list_t*(*)(child_sa_t*))get_other_traffic_selectors;
this->public.get_traffic_selectors = (linked_list_t*(*)(child_sa_t*,bool))get_traffic_selectors;
this->public.get_use_time = (status_t (*)(child_sa_t*,bool,time_t*))get_use_time;
this->public.set_state = (void(*)(child_sa_t*,child_sa_state_t))set_state;
this->public.get_state = (child_sa_state_t(*)(child_sa_t*))get_state;
this->public.get_policy = (policy_t*(*)(child_sa_t*))get_policy;
this->public.get_config = (child_cfg_t*(*)(child_sa_t*))get_config;
this->public.set_virtual_ip = (void(*)(child_sa_t*,host_t*))set_virtual_ip;
this->public.destroy = (void(*)(child_sa_t*))destroy;
@@ -1123,8 +1118,8 @@ child_sa_t * child_sa_create(host_t *me, host_t* other,
this->protocol = PROTO_NONE;
this->mode = MODE_TUNNEL;
this->virtual_ip = NULL;
this->policy = policy;
policy->get_ref(policy);
this->config = config;
config->get_ref(config);
return &this->public;
}
src/charon/sa/child_sa.h
+9 -16
View File
@@ -32,7 +32,7 @@ typedef struct child_sa_t child_sa_t;
#include <crypto/prf_plus.h>
#include <encoding/payloads/proposal_substructure.h>
#include <config/proposal.h>
#include <config/policies/policy.h>
#include <config/child_cfg.h>
/**
* Where we should start with reqid enumeration
@@ -101,7 +101,7 @@ extern enum_name_t *child_sa_state_names;
struct child_sa_t {
/**
* @brief Get the name of the policy this CHILD_SA uses.
* @brief Get the name of the config this CHILD_SA uses.
*
* @param this calling object
* @return name
@@ -214,17 +214,10 @@ struct child_sa_t {
* @brief Get the traffic selectors of added policies of local host.
*
* @param this calling object
* @param local TRUE for own traffic selectors, FALSE for remote
* @return list of traffic selectors
*/
linked_list_t* (*get_my_traffic_selectors) (child_sa_t *this);
/**
* @brief Get the traffic selectors of added policies of remote host.
*
* @param this calling object
* @return list of traffic selectors
*/
linked_list_t* (*get_other_traffic_selectors) (child_sa_t *this);
linked_list_t* (*get_traffic_selectors) (child_sa_t *this, bool local);
/**
* @brief Get the time of this child_sa_t's last use (i.e. last use of any of its policies)
@@ -251,12 +244,12 @@ struct child_sa_t {
void (*set_state) (child_sa_t *this, child_sa_state_t state);
/**
* @brief Get the policy used to set up this child sa.
* @brief Get the config used to set up this child sa.
*
* @param this calling object
* @return policy
* @return child_cfg
*/
policy_t* (*get_policy) (child_sa_t *this);
child_cfg_t* (*get_config) (child_sa_t *this);
/**
* @brief Set the virtual IP used received from IRAS.
@@ -284,7 +277,7 @@ struct child_sa_t {
* @param other remote address
* @param my_id id of own peer
* @param other_id id of remote peer
* @param policy policy this CHILD_SA instantiates
* @param config config to use for this CHILD_SA
* @param reqid reqid of old CHILD_SA when rekeying, 0 otherwise
* @param use_natt TRUE if NAT traversal is used
* @return child_sa_t object
@@ -293,6 +286,6 @@ struct child_sa_t {
*/
child_sa_t * child_sa_create(host_t *me, host_t *other,
identification_t *my_id, identification_t* other_id,
policy_t *policy, u_int32_t reqid, bool use_natt);
child_cfg_t *config, u_int32_t reqid, bool use_natt);
#endif /*CHILD_SA_H_*/
src/charon/sa/ike_sa.c
+167 -221
View File
@@ -56,13 +56,13 @@
#include <sa/tasks/child_create.h>
#include <sa/tasks/child_delete.h>
#include <sa/tasks/child_rekey.h>
#include <queues/jobs/retransmit_job.h>
#include <queues/jobs/delete_ike_sa_job.h>
#include <queues/jobs/send_dpd_job.h>
#include <queues/jobs/send_keepalive_job.h>
#include <queues/jobs/rekey_ike_sa_job.h>
#include <queues/jobs/route_job.h>
#include <queues/jobs/initiate_job.h>
#include <processing/jobs/retransmit_job.h>
#include <processing/jobs/delete_ike_sa_job.h>
#include <processing/jobs/send_dpd_job.h>
#include <processing/jobs/send_keepalive_job.h>
#include <processing/jobs/rekey_ike_sa_job.h>
#include <processing/jobs/route_job.h>
#include <processing/jobs/initiate_job.h>
#ifndef RESOLV_CONF
@@ -105,14 +105,14 @@ struct private_ike_sa_t {
ike_sa_state_t state;
/**
* connection used to establish this IKE_SA.
* IKE configuration used to set up this IKE_SA
*/
connection_t *connection;
ike_cfg_t *ike_cfg;
/**
* Peer and authentication information to establish IKE_SA.
*/
policy_t *policy;
peer_cfg_t *peer_cfg;
/**
* Juggles tasks to process messages
@@ -273,47 +273,13 @@ static u_int32_t get_unique_id(private_ike_sa_t *this)
*/
static char *get_name(private_ike_sa_t *this)
{
if (this->connection)
if (this->peer_cfg)
{
return this->connection->get_name(this->connection);
return this->peer_cfg->get_name(this->peer_cfg);
}
return "(unnamed)";
}
/**
* Implementation of ike_sa_t.get_connection
*/
static connection_t* get_connection(private_ike_sa_t *this)
{
return this->connection;
}
/**
* Implementation of ike_sa_t.set_connection
*/
static void set_connection(private_ike_sa_t *this, connection_t *connection)
{
this->connection = connection;
connection->get_ref(connection);
}
/**
* Implementation of ike_sa_t.get_policy
*/
static policy_t *get_policy(private_ike_sa_t *this)
{
return this->policy;
}
/**
* Implementation of ike_sa_t.set_policy
*/
static void set_policy(private_ike_sa_t *this, policy_t *policy)
{
policy->get_ref(policy);
this->policy = policy;
}
/**
* Implementation of ike_sa_t.get_my_host.
*/
@@ -348,6 +314,66 @@ static void set_other_host(private_ike_sa_t *this, host_t *other)
this->other_host = other;
}
/**
* Implementation of ike_sa_t.get_peer_cfg
*/
static peer_cfg_t* get_peer_cfg(private_ike_sa_t *this)
{
return this->peer_cfg;
}
/**
* Implementation of ike_sa_t.set_peer_cfg
*/
static void set_peer_cfg(private_ike_sa_t *this, peer_cfg_t *peer_cfg)
{
host_t *me, *other;
identification_t *my_id, *other_id;
peer_cfg->get_ref(peer_cfg);
this->peer_cfg = peer_cfg;
if (this->ike_cfg == NULL)
{
this->ike_cfg = peer_cfg->get_ike_cfg(peer_cfg);
this->ike_cfg->get_ref(this->ike_cfg);
}
/* apply values, so we are ready to initate/acquire */
if (this->my_host->is_anyaddr(this->my_host))
{
me = this->ike_cfg->get_my_host(this->ike_cfg);
set_my_host(this, me->clone(me));
}
if (this->other_host->is_anyaddr(this->other_host))
{
other = this->ike_cfg->get_other_host(this->ike_cfg);
set_other_host(this, other->clone(other));
}
my_id = this->peer_cfg->get_my_id(this->peer_cfg);
other_id = this->peer_cfg->get_other_id(this->peer_cfg);
DESTROY_IF(this->my_id);
DESTROY_IF(this->other_id);
this->my_id = my_id->clone(my_id);
this->other_id = other_id->clone(other_id);
}
/**
* Implementation of ike_sa_t.get_ike_cfg
*/
static ike_cfg_t *get_ike_cfg(private_ike_sa_t *this)
{
return this->ike_cfg;
}
/**
* Implementation of ike_sa_t.set_ike_cfg
*/
static void set_ike_cfg(private_ike_sa_t *this, ike_cfg_t *ike_cfg)
{
ike_cfg->get_ref(ike_cfg);
this->ike_cfg = ike_cfg;
}
/**
* Implementation of ike_sa_t.send_dpd
*/
@@ -356,7 +382,7 @@ static status_t send_dpd(private_ike_sa_t *this)
send_dpd_job_t *job;
time_t diff, delay;
delay = this->connection->get_dpd_delay(this->connection);
delay = this->peer_cfg->get_dpd_delay(this->peer_cfg);
if (delay == 0)
{
@@ -464,9 +490,9 @@ static void set_state(private_ike_sa_t *this, ike_sa_state_t state)
send_dpd(this);
/* schedule rekeying/reauthentication */
soft = this->connection->get_soft_lifetime(this->connection);
hard = this->connection->get_hard_lifetime(this->connection);
reauth = this->connection->get_reauth(this->connection);
soft = this->peer_cfg->get_lifetime(this->peer_cfg, TRUE);
hard = this->peer_cfg->get_lifetime(this->peer_cfg, FALSE);
reauth = this->peer_cfg->use_reauth(this->peer_cfg);
DBG1(DBG_IKE, "scheduling %s in %ds, maximum lifetime %ds",
reauth ? "reauthentication": "rekeying", soft, hard);
@@ -521,7 +547,7 @@ static void reset(private_ike_sa_t *this)
}
/**
* Update connection host, as addresses may change (NAT)
* Update hosts, as addresses may change (NAT)
*/
static void update_hosts(private_ike_sa_t *this, host_t *me, host_t *other)
{
@@ -696,16 +722,16 @@ static status_t process_message(private_ike_sa_t *this, message_t *message)
me = message->get_destination(message);
other = message->get_source(message);
/* if this IKE_SA is virgin, we check for a connection */
if (this->connection == NULL)
/* if this IKE_SA is virgin, we check for a config */
if (this->ike_cfg == NULL)
{
job_t *job;
this->connection = charon->connections->get_connection_by_hosts(
charon->connections, me, other);
if (this->connection == NULL)
this->ike_cfg = charon->cfg_store->get_ike_cfg(charon->cfg_store,
me, other);
if (this->ike_cfg == NULL)
{
/* no connection found for these hosts, destroy */
DBG1(DBG_IKE, "no connection found for %H...%H, sending %N",
/* no config found for these hosts, destroy */
DBG1(DBG_IKE, "no IKE config found for %H...%H, sending %N",
me, other, notify_type_names, NO_PROPOSAL_CHOSEN);
send_notify_response(this, message, NO_PROPOSAL_CHOSEN);
return DESTROY_ME;
@@ -717,7 +743,7 @@ static status_t process_message(private_ike_sa_t *this, message_t *message)
charon->configuration));
}
/* check if message is trustworthy, and update connection information */
/* check if message is trustworthy, and update host information */
if (this->state == IKE_CREATED ||
message->get_exchange_type(message) != IKE_SA_INIT)
{
@@ -728,47 +754,15 @@ static status_t process_message(private_ike_sa_t *this, message_t *message)
}
}
/**
* apply the connection/policy information to this IKE_SA
*/
static void apply_config(private_ike_sa_t *this,
connection_t *connection, policy_t *policy)
{
host_t *me, *other;
identification_t *my_id, *other_id;
if (this->connection == NULL && this->policy == NULL)
{
this->connection = connection;
connection->get_ref(connection);
this->policy = policy;
policy->get_ref(policy);
me = connection->get_my_host(connection);
other = connection->get_other_host(connection);
my_id = policy->get_my_id(policy);
other_id = policy->get_other_id(policy);
set_my_host(this, me->clone(me));
set_other_host(this, other->clone(other));
DESTROY_IF(this->my_id);
DESTROY_IF(this->other_id);
this->my_id = my_id->clone(my_id);
this->other_id = other_id->clone(other_id);
}
}
/**
* Implementation of ike_sa_t.initiate.
*/
static status_t initiate(private_ike_sa_t *this,
connection_t *connection, policy_t *policy)
static status_t initiate(private_ike_sa_t *this, child_cfg_t *child_cfg)
{
task_t *task;
if (this->state == IKE_CREATED)
{
/* if we aren't established/establishing, do so */
apply_config(this, connection, policy);
if (this->other_host->is_anyaddr(this->other_host))
{
@@ -785,11 +779,11 @@ static status_t initiate(private_ike_sa_t *this,
this->task_manager->queue_task(this->task_manager, task);
task = (task_t*)ike_auth_create(&this->public, TRUE);
this->task_manager->queue_task(this->task_manager, task);
task = (task_t*)ike_config_create(&this->public, policy);
task = (task_t*)ike_config_create(&this->public, TRUE);
this->task_manager->queue_task(this->task_manager, task);
}
task = (task_t*)child_create_create(&this->public, policy);
task = (task_t*)child_create_create(&this->public, child_cfg);
this->task_manager->queue_task(this->task_manager, task);
return this->task_manager->initiate(this->task_manager);
@@ -800,7 +794,7 @@ static status_t initiate(private_ike_sa_t *this,
*/
static status_t acquire(private_ike_sa_t *this, u_int32_t reqid)
{
policy_t *policy;
child_cfg_t *child_cfg;
iterator_t *iterator;
child_sa_t *current, *child_sa = NULL;
task_t *task;
@@ -833,7 +827,6 @@ static status_t acquire(private_ike_sa_t *this, u_int32_t reqid)
return FAILED;
}
policy = child_sa->get_policy(child_sa);
if (this->state == IKE_CREATED)
{
@@ -845,52 +838,24 @@ static status_t acquire(private_ike_sa_t *this, u_int32_t reqid)
this->task_manager->queue_task(this->task_manager, task);
task = (task_t*)ike_auth_create(&this->public, TRUE);
this->task_manager->queue_task(this->task_manager, task);
task = (task_t*)ike_config_create(&this->public, policy);
task = (task_t*)ike_config_create(&this->public, TRUE);
this->task_manager->queue_task(this->task_manager, task);
}
child_create = child_create_create(&this->public, policy);
child_cfg = child_sa->get_config(child_sa);
child_create = child_create_create(&this->public, child_cfg);
child_create->use_reqid(child_create, reqid);
this->task_manager->queue_task(this->task_manager, (task_t*)child_create);
return this->task_manager->initiate(this->task_manager);
}
/**
* compare two lists of traffic selectors for equality
*/
static bool ts_list_equals(linked_list_t *l1, linked_list_t *l2)
{
bool equals = TRUE;
iterator_t *i1, *i2;
traffic_selector_t *t1, *t2;
if (l1->get_count(l1) != l2->get_count(l2))
{
return FALSE;
}
i1 = l1->create_iterator(l1, TRUE);
i2 = l2->create_iterator(l2, TRUE);
while (i1->iterate(i1, (void**)&t1) && i2->iterate(i2, (void**)&t2))
{
if (!t1->equals(t1, t2))
{
equals = FALSE;
break;
}
}
i1->destroy(i1);
i2->destroy(i2);
return equals;
}
/**
* Implementation of ike_sa_t.route.
*/
static status_t route(private_ike_sa_t *this, connection_t *connection, policy_t *policy)
static status_t route(private_ike_sa_t *this, child_cfg_t *child_cfg)
{
child_sa_t *child_sa = NULL;
child_sa_t *child_sa;
iterator_t *iterator;
linked_list_t *my_ts, *other_ts;
status_t status;
@@ -901,27 +866,12 @@ static status_t route(private_ike_sa_t *this, connection_t *connection, policy_t
iterator = this->child_sas->create_iterator(this->child_sas, TRUE);
while (iterator->iterate(iterator, (void**)&child_sa))
{
if (child_sa->get_state(child_sa) == CHILD_ROUTED)
if (child_sa->get_state(child_sa) == CHILD_ROUTED &&
streq(child_sa->get_name(child_sa), child_cfg->get_name(child_cfg)))
{
linked_list_t *my_ts_conf, *other_ts_conf;
my_ts = child_sa->get_my_traffic_selectors(child_sa);
other_ts = child_sa->get_other_traffic_selectors(child_sa);
my_ts_conf = policy->get_my_traffic_selectors(policy, this->my_host);
other_ts_conf = policy->get_other_traffic_selectors(policy, this->other_host);
if (ts_list_equals(my_ts, my_ts_conf) &&
ts_list_equals(other_ts, other_ts_conf))
{
iterator->destroy(iterator);
my_ts_conf->destroy_offset(my_ts_conf, offsetof(traffic_selector_t, destroy));
other_ts_conf->destroy_offset(other_ts_conf, offsetof(traffic_selector_t, destroy));
SIG(CHILD_ROUTE_FAILED, "CHILD_SA with such a policy already routed");
return FAILED;
}
my_ts_conf->destroy_offset(my_ts_conf, offsetof(traffic_selector_t, destroy));
other_ts_conf->destroy_offset(other_ts_conf, offsetof(traffic_selector_t, destroy));
iterator->destroy(iterator);
SIG(CHILD_ROUTE_FAILED, "CHILD_SA with such a config already routed");
return FAILED;
}
}
iterator->destroy(iterator);
@@ -934,9 +884,6 @@ static status_t route(private_ike_sa_t *this, connection_t *connection, policy_t
"unable to route CHILD_SA, as its IKE_SA gets deleted");
return FAILED;
case IKE_CREATED:
/* apply connection information, we need it to acquire */
apply_config(this, connection, policy);
break;
case IKE_CONNECTING:
case IKE_ESTABLISHED:
default:
@@ -944,29 +891,37 @@ static status_t route(private_ike_sa_t *this, connection_t *connection, policy_t
}
/* install kernel policies */
child_sa = child_sa_create(this->my_host, this->other_host,
this->my_id, this->other_id, policy, FALSE, 0);
child_sa = child_sa_create(this->my_host, this->other_host, this->my_id,
this->other_id, child_cfg, FALSE, 0);
my_ts = policy->get_my_traffic_selectors(policy, this->my_host);
other_ts = policy->get_other_traffic_selectors(policy, this->other_host);
my_ts = child_cfg->get_traffic_selectors(child_cfg, TRUE, NULL,
this->my_host);
other_ts = child_cfg->get_traffic_selectors(child_cfg, FALSE, NULL,
this->other_host);
status = child_sa->add_policies(child_sa, my_ts, other_ts,
policy->get_mode(policy));
child_cfg->get_mode(child_cfg));
my_ts->destroy_offset(my_ts, offsetof(traffic_selector_t, destroy));
other_ts->destroy_offset(other_ts, offsetof(traffic_selector_t, destroy));
this->child_sas->insert_last(this->child_sas, child_sa);
SIG(CHILD_ROUTE_SUCCESS, "CHILD_SA routed");
if (status == SUCCESS)
{
this->child_sas->insert_last(this->child_sas, child_sa);
SIG(CHILD_ROUTE_SUCCESS, "CHILD_SA routed");
}
else
{
SIG(CHILD_ROUTE_FAILED, "routing CHILD_SA failed");
}
return status;
}
/**
* Implementation of ike_sa_t.unroute.
*/
static status_t unroute(private_ike_sa_t *this, policy_t *policy)
static status_t unroute(private_ike_sa_t *this, child_cfg_t *child_cfg)
{
iterator_t *iterator;
child_sa_t *child_sa = NULL;
child_sa_t *child_sa;
bool found = FALSE;
linked_list_t *my_ts, *other_ts, *my_ts_conf, *other_ts_conf;
SIG(CHILD_UNROUTE_START, "unrouting CHILD_SA");
@@ -974,27 +929,14 @@ static status_t unroute(private_ike_sa_t *this, policy_t *policy)
iterator = this->child_sas->create_iterator(this->child_sas, TRUE);
while (iterator->iterate(iterator, (void**)&child_sa))
{
if (child_sa->get_state(child_sa) == CHILD_ROUTED)
if (child_sa->get_state(child_sa) == CHILD_ROUTED &&
streq(child_sa->get_name(child_sa), child_cfg->get_name(child_cfg)))
{
my_ts = child_sa->get_my_traffic_selectors(child_sa);
other_ts = child_sa->get_other_traffic_selectors(child_sa);
my_ts_conf = policy->get_my_traffic_selectors(policy, this->my_host);
other_ts_conf = policy->get_other_traffic_selectors(policy, this->other_host);
if (ts_list_equals(my_ts, my_ts_conf) &&
ts_list_equals(other_ts, other_ts_conf))
{
iterator->remove(iterator);
SIG(CHILD_UNROUTE_SUCCESS, "CHILD_SA unrouted");
child_sa->destroy(child_sa);
my_ts_conf->destroy_offset(my_ts_conf, offsetof(traffic_selector_t, destroy));
other_ts_conf->destroy_offset(other_ts_conf, offsetof(traffic_selector_t, destroy));
found = TRUE;
break;
}
my_ts_conf->destroy_offset(my_ts_conf, offsetof(traffic_selector_t, destroy));
other_ts_conf->destroy_offset(other_ts_conf, offsetof(traffic_selector_t, destroy));
iterator->remove(iterator);
SIG(CHILD_UNROUTE_SUCCESS, "CHILD_SA unrouted");
child_sa->destroy(child_sa);
found = TRUE;
break;
}
}
iterator->destroy(iterator);
@@ -1021,7 +963,7 @@ static status_t retransmit(private_ike_sa_t *this, u_int32_t message_id)
this->time.outbound = time(NULL);
if (this->task_manager->retransmit(this->task_manager, message_id) != SUCCESS)
{
policy_t *policy;
child_cfg_t *child_cfg;
child_sa_t* child_sa;
linked_list_t *to_route, *to_restart;
iterator_t *iterator;
@@ -1032,7 +974,7 @@ static status_t retransmit(private_ike_sa_t *this, u_int32_t message_id)
case IKE_CONNECTING:
{
/* retry IKE_SA_INIT if we have multiple keyingtries */
u_int32_t tries = this->connection->get_keyingtries(this->connection);
u_int32_t tries = this->peer_cfg->get_keyingtries(this->peer_cfg);
this->keyingtry++;
if (tries == 0 || tries > this->keyingtry)
{
@@ -1060,23 +1002,23 @@ static status_t retransmit(private_ike_sa_t *this, u_int32_t message_id)
iterator = this->child_sas->create_iterator(this->child_sas, TRUE);
while (iterator->iterate(iterator, (void**)&child_sa))
{
policy = child_sa->get_policy(child_sa);
child_cfg = child_sa->get_config(child_sa);
if (child_sa->get_state(child_sa) == CHILD_ROUTED)
{
/* reroute routed CHILD_SAs */
to_route->insert_last(to_route, policy);
to_route->insert_last(to_route, child_cfg);
}
else
{
/* use DPD action for established CHILD_SAs */
switch (policy->get_dpd_action(policy))
switch (this->peer_cfg->get_dpd_action(this->peer_cfg))
{
case DPD_ROUTE:
to_route->insert_last(to_route, policy);
to_route->insert_last(to_route, child_cfg);
break;
case DPD_RESTART:
to_restart->insert_last(to_restart, policy);
to_restart->insert_last(to_restart, child_cfg);
break;
default:
break;
@@ -1094,15 +1036,15 @@ static status_t retransmit(private_ike_sa_t *this, u_int32_t message_id)
new = (private_ike_sa_t*)charon->ike_sa_manager->checkout_new(
charon->ike_sa_manager, TRUE);
apply_config(new, this->connection, this->policy);
/* use actual used host, not the wildcarded one in connection */
set_peer_cfg(new, this->peer_cfg);
/* use actual used host, not the wildcarded one in config */
new->other_host->destroy(new->other_host);
new->other_host = this->other_host->clone(this->other_host);
/* install routes */
while (to_route->remove_last(to_route, (void**)&policy) == SUCCESS)
while (to_route->remove_last(to_route, (void**)&child_cfg) == SUCCESS)
{
route(new, new->connection, policy);
route(new, child_cfg);
}
/* restart children */
@@ -1114,14 +1056,14 @@ static status_t retransmit(private_ike_sa_t *this, u_int32_t message_id)
new->task_manager->queue_task(new->task_manager, task);
task = (task_t*)ike_cert_create(&new->public, TRUE);
new->task_manager->queue_task(new->task_manager, task);
task = (task_t*)ike_config_create(&new->public, new->policy);
task = (task_t*)ike_config_create(&new->public, TRUE);
new->task_manager->queue_task(new->task_manager, task);
task = (task_t*)ike_auth_create(&new->public, TRUE);
new->task_manager->queue_task(new->task_manager, task);
while (to_restart->remove_last(to_restart, (void**)&policy) == SUCCESS)
while (to_restart->remove_last(to_restart, (void**)&child_cfg) == SUCCESS)
{
task = (task_t*)child_create_create(&new->public, policy);
task = (task_t*)child_create_create(&new->public, child_cfg);
new->task_manager->queue_task(new->task_manager, task);
}
new->task_manager->initiate(new->task_manager);
@@ -1542,14 +1484,14 @@ static void reestablish(private_ike_sa_t *this)
private_ike_sa_t *other;
iterator_t *iterator;
child_sa_t *child_sa;
policy_t *policy;
child_cfg_t *child_cfg;
task_t *task;
job_t *job;
other = (private_ike_sa_t*)charon->ike_sa_manager->checkout_new(
charon->ike_sa_manager, TRUE);
apply_config(other, this->connection, this->policy);
set_peer_cfg(other, this->peer_cfg);
other->other_host->destroy(other->other_host);
other->other_host = this->other_host->clone(this->other_host);
@@ -1561,7 +1503,7 @@ static void reestablish(private_ike_sa_t *this)
other->task_manager->queue_task(other->task_manager, task);
task = (task_t*)ike_cert_create(&other->public, TRUE);
other->task_manager->queue_task(other->task_manager, task);
task = (task_t*)ike_config_create(&other->public, other->policy);
task = (task_t*)ike_config_create(&other->public, TRUE);
other->task_manager->queue_task(other->task_manager, task);
task = (task_t*)ike_auth_create(&other->public, TRUE);
other->task_manager->queue_task(other->task_manager, task);
@@ -1583,8 +1525,8 @@ static void reestablish(private_ike_sa_t *this)
}
default:
{
policy = child_sa->get_policy(child_sa);
task = (task_t*)child_create_create(&other->public, policy);
child_cfg = child_sa->get_config(child_sa);
task = (task_t*)child_create_create(&other->public, child_cfg);
other->task_manager->queue_task(other->task_manager, task);
break;
}
@@ -1865,9 +1807,9 @@ static int print(FILE *stream, const struct printf_info *info,
bool reauth = FALSE;
private_ike_sa_t *this = *((private_ike_sa_t**)(args[0]));
if (this->connection)
if (this->peer_cfg)
{
reauth = this->connection->get_reauth(this->connection);
reauth = this->peer_cfg->use_reauth(this->peer_cfg);
}
if (this == NULL)
@@ -1879,15 +1821,19 @@ static int print(FILE *stream, const struct printf_info *info,
this->unique_id, ike_sa_state_names, this->state,
this->my_host, this->my_id, this->other_host,
this->other_id);
written += fprintf(stream, "\n%12s[%d]: IKE SPIs: %J, %s in %ds",
get_name(this), this->unique_id, this->ike_sa_id,
this->connection && reauth? "reauthentication":"rekeying",
this->time.rekey - time(NULL));
if (info->alt)
if (this->time.rekey)
{
written += fprintf(stream, "\n%12s[%d]: IKE SPIs: %J, %s in %ds",
get_name(this), this->unique_id, this->ike_sa_id,
reauth ? "reauthentication" : "rekeying",
this->time.rekey - time(NULL));
}
else
{
written += fprintf(stream, "\n%12s[%d]: IKE SPIs: %J, rekeying disabled",
get_name(this), this->unique_id, this->ike_sa_id);
}
return written;
}
@@ -1931,8 +1877,8 @@ static void destroy(private_ike_sa_t *this)
DESTROY_IF(this->my_id);
DESTROY_IF(this->other_id);
DESTROY_IF(this->connection);
DESTROY_IF(this->policy);
DESTROY_IF(this->ike_cfg);
DESTROY_IF(this->peer_cfg);
this->ike_sa_id->destroy(this->ike_sa_id);
this->task_manager->destroy(this->task_manager);
@@ -1952,14 +1898,14 @@ ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id)
this->public.set_state = (void(*)(ike_sa_t*,ike_sa_state_t)) set_state;
this->public.get_name = (char*(*)(ike_sa_t*))get_name;
this->public.process_message = (status_t(*)(ike_sa_t*, message_t*)) process_message;
this->public.initiate = (status_t(*)(ike_sa_t*,connection_t*,policy_t*)) initiate;
this->public.route = (status_t(*)(ike_sa_t*,connection_t*,policy_t*)) route;
this->public.unroute = (status_t(*)(ike_sa_t*,policy_t*)) unroute;
this->public.initiate = (status_t(*)(ike_sa_t*,child_cfg_t*)) initiate;
this->public.route = (status_t(*)(ike_sa_t*,child_cfg_t*)) route;
this->public.unroute = (status_t(*)(ike_sa_t*,child_cfg_t*)) unroute;
this->public.acquire = (status_t(*)(ike_sa_t*,u_int32_t)) acquire;
this->public.get_connection = (connection_t*(*)(ike_sa_t*))get_connection;
this->public.set_connection = (void(*)(ike_sa_t*,connection_t*))set_connection;
this->public.get_policy = (policy_t*(*)(ike_sa_t*))get_policy;
this->public.set_policy = (void(*)(ike_sa_t*,policy_t*))set_policy;
this->public.get_ike_cfg = (ike_cfg_t*(*)(ike_sa_t*))get_ike_cfg;
this->public.set_ike_cfg = (void(*)(ike_sa_t*,ike_cfg_t*))set_ike_cfg;
this->public.get_peer_cfg = (peer_cfg_t*(*)(ike_sa_t*))get_peer_cfg;
this->public.set_peer_cfg = (void(*)(ike_sa_t*,peer_cfg_t*))set_peer_cfg;
this->public.get_id = (ike_sa_id_t*(*)(ike_sa_t*)) get_id;
this->public.get_my_host = (host_t*(*)(ike_sa_t*)) get_my_host;
this->public.set_my_host = (void(*)(ike_sa_t*,host_t*)) set_my_host;
@@ -2019,8 +1965,8 @@ ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id)
this->time.established = 0;
this->time.rekey = 0;
this->time.delete = 0;
this->connection = NULL;
this->policy = NULL;
this->ike_cfg = NULL;
this->peer_cfg = NULL;
this->task_manager = task_manager_create(&this->public);
this->unique_id = ++unique_id;
this->my_virtual_ip = NULL;
src/charon/sa/ike_sa.h
+25 -30
View File
@@ -39,9 +39,8 @@ typedef struct ike_sa_t ike_sa_t;
#include <crypto/prfs/prf.h>
#include <crypto/crypters/crypter.h>
#include <crypto/signers/signer.h>
#include <config/connections/connection.h>
#include <config/policies/policy.h>
#include <config/proposal.h>
#include <config/peer_cfg.h>
#include <config/ike_cfg.h>
/**
* @brief State of an IKE_SA.
@@ -237,51 +236,49 @@ struct ike_sa_t {
void (*set_other_id) (ike_sa_t *this, identification_t *other);
/**
* @brief Get the connection used by this IKE_SA.
* @brief Get the config used to setup this IKE_SA.
*
* @param this calling object
* @return connection
* @return ike_config
*/
connection_t* (*get_connection) (ike_sa_t *this);
ike_cfg_t* (*get_ike_cfg) (ike_sa_t *this);
/**
* @brief Set the connection to use with this IKE_SA.
* @brief Set the config to setup this IKE_SA.
*
* @param this calling object
* @param connection connection to use
* @param config ike_config to use
*/
void (*set_connection) (ike_sa_t *this, connection_t* connection);
void (*set_ike_cfg) (ike_sa_t *this, ike_cfg_t* config);
/**
* @brief Get the policy used by this IKE_SA.
* @brief Get the peer config used by this IKE_SA.
*
* @param this calling object
* @return policy
* @return peer_config
*/
policy_t* (*get_policy) (ike_sa_t *this);
peer_cfg_t* (*get_peer_cfg) (ike_sa_t *this);
/**
* @brief Set the policy to use with this IKE_SA.
* @brief Set the peer config to use with this IKE_SA.
*
* @param this calling object
* @param policy policy to use
* @param config peer_config to use
*/
void (*set_policy) (ike_sa_t *this, policy_t *policy);
void (*set_peer_cfg) (ike_sa_t *this, peer_cfg_t *config);
/**
* @brief Initiate a new connection.
*
* The policy/connection is owned by the IKE_SA after the call, so
* do not modify or destroy it.
* The configs are owned by the IKE_SA after the call.
*
* @param this calling object
* @param connection connection to initiate
* @param policy policy to set up
* @param child_cfg child config to create CHILD from
* @return
* - SUCCESS if initialization started
* - DESTROY_ME if initialization failed and IKE_SA MUST be deleted
* - DESTROY_ME if initialization failed
*/
status_t (*initiate) (ike_sa_t *this, connection_t *connection, policy_t *policy);
status_t (*initiate) (ike_sa_t *this, child_cfg_t *child_cfg);
/**
* @brief Route a policy in the kernel.
@@ -290,28 +287,26 @@ struct ike_sa_t {
* the kernel requests connection setup from the IKE_SA via acquire().
*
* @param this calling object
* @param connection connection definition used for routing
* @param policy policy to route
* @param child_cfg child config to route
* @return
* - SUCCESS if routed successfully
* - FAILED if routing failed
*/
status_t (*route) (ike_sa_t *this, connection_t *connection, policy_t *policy);
status_t (*route) (ike_sa_t *this, child_cfg_t *child_cfg);
/**
* @brief Unroute a policy in the kernel previously routed.
*
* @param this calling object
* @param policy policy to route
* @param child_cfg child config to unroute
* @return
* - SUCCESS if route removed
* - DESTROY_ME if last route was removed from
* an IKE_SA which was not established
* - DESTROY_ME if last CHILD_SA was unrouted
*/
status_t (*unroute) (ike_sa_t *this, policy_t *policy);
status_t (*unroute) (ike_sa_t *this, child_cfg_t *child_cfg);
/**
* @brief Acquire connection setup for a policy.
* @brief Acquire connection setup for an installed kernel policy.
*
* If an installed policy raises an acquire, the kernel calls
* this function to establish the CHILD_SA (and maybe the IKE_SA).
@@ -320,7 +315,7 @@ struct ike_sa_t {
* @param reqid reqid of the CHILD_SA the policy belongs to.
* @return
* - SUCCESS if initialization started
* - DESTROY_ME if initialization failed and IKE_SA MUST be deleted
* - DESTROY_ME if initialization failed
*/
status_t (*acquire) (ike_sa_t *this, u_int32_t reqid);
src/charon/sa/ike_sa_manager.c
+1
View File
@@ -363,6 +363,7 @@ static ike_sa_t *checkout_new(private_ike_sa_manager_t* this, bool initiator)
pthread_mutex_unlock(&this->mutex);
DBG2(DBG_MGR, "created IKE_SA: %J, %d IKE_SAs in manager",
id, this->ike_sa_list->get_count(this->ike_sa_list));
id->destroy(id);
return entry->ike_sa;
}
src/charon/sa/task_manager.c
+2 -2
View File
@@ -35,7 +35,7 @@
#include <sa/tasks/child_rekey.h>
#include <sa/tasks/child_delete.h>
#include <encoding/payloads/delete_payload.h>
#include <queues/jobs/retransmit_job.h>
#include <processing/jobs/retransmit_job.h>
typedef struct exchange_t exchange_t;
@@ -577,7 +577,7 @@ static status_t process_request(private_task_manager_t *this,
this->passive_tasks->insert_last(this->passive_tasks, task);
task = (task_t*)ike_auth_create(this->ike_sa, FALSE);
this->passive_tasks->insert_last(this->passive_tasks, task);
task = (task_t*)ike_config_create(this->ike_sa, NULL);
task = (task_t*)ike_config_create(this->ike_sa, FALSE);
this->passive_tasks->insert_last(this->passive_tasks, task);
task = (task_t*)child_create_create(this->ike_sa, NULL);
this->passive_tasks->insert_last(this->passive_tasks, task);
src/charon/sa/tasks/child_create.c
+53 -54
View File
@@ -64,9 +64,9 @@ struct private_child_create_t {
chunk_t other_nonce;
/**
* policy to create the CHILD_SA from
* config to create the CHILD_SA from
*/
policy_t *policy;
child_cfg_t *config;
/**
* list of proposal candidates
@@ -198,7 +198,7 @@ static status_t select_and_install(private_child_create_t *this)
my_vip = this->ike_sa->get_virtual_ip(this->ike_sa, TRUE);
other_vip = this->ike_sa->get_virtual_ip(this->ike_sa, FALSE);
this->proposal = this->policy->select_proposal(this->policy, this->proposals);
this->proposal = this->config->select_proposal(this->config, this->proposals);
if (this->proposal == NULL)
{
@@ -206,28 +206,31 @@ static status_t select_and_install(private_child_create_t *this)
return FAILED;
}
if (this->initiator && my_vip)
{ /* if we have a virtual IP, shorten our TS to the minimum */
my_ts = this->policy->select_my_traffic_selectors(this->policy, my_ts,
my_vip);
if (my_vip == NULL)
{
my_vip = me;
}
else if (this->initiator)
{
/* to setup firewall rules correctly, CHILD_SA needs the virtual IP */
this->child_sa->set_virtual_ip(this->child_sa, my_vip);
}
else
{ /* shorten in the host2host case only */
my_ts = this->policy->select_my_traffic_selectors(this->policy,
my_ts, me);
if (other_vip == NULL)
{
other_vip = other;
}
if (other_vip)
{ /* if other has a virtual IP, shorten it's traffic selectors to it */
other_ts = this->policy->select_other_traffic_selectors(this->policy,
other_ts, other_vip);
}
else
{ /* use his host for the host2host case */
other_ts = this->policy->select_other_traffic_selectors(this->policy,
other_ts, other);
my_ts = this->config->get_traffic_selectors(this->config, TRUE, my_ts,
my_vip);
other_ts = this->config->get_traffic_selectors(this->config, FALSE, other_ts,
other_vip);
if (my_ts->get_count(my_ts) == 0 || other_ts->get_count(other_ts) == 0)
{
SIG(CHILD_UP_FAILED, "no acceptable traffic selectors found");
return FAILED;
}
this->tsr->destroy_offset(this->tsr, offsetof(traffic_selector_t, destroy));
this->tsi->destroy_offset(this->tsi, offsetof(traffic_selector_t, destroy));
if (this->initiator)
@@ -241,13 +244,6 @@ static status_t select_and_install(private_child_create_t *this)
this->tsi = other_ts;
}
if (this->tsi->get_count(this->tsi) == 0 ||
this->tsr->get_count(this->tsr) == 0)
{
SIG(CHILD_UP_FAILED, "no acceptable traffic selectors found");
return FAILED;
}
if (!this->initiator)
{
/* check if requested mode is acceptable, downgrade if required */
@@ -421,6 +417,7 @@ static void process_payloads(private_child_create_t *this, message_t *message)
static status_t build_i(private_child_create_t *this, message_t *message)
{
host_t *me, *other, *vip;
peer_cfg_t *peer_cfg;
switch (message->get_exchange_type(message))
{
@@ -448,25 +445,29 @@ static status_t build_i(private_child_create_t *this, message_t *message)
me = this->ike_sa->get_my_host(this->ike_sa);
other = this->ike_sa->get_other_host(this->ike_sa);
vip = this->policy->get_virtual_ip(this->policy, NULL);
peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
vip = peer_cfg->get_virtual_ip(peer_cfg, NULL);
if (vip)
{ /* propose a 0.0.0.0/0 subnet when we use virtual ip */
this->tsi = this->policy->get_my_traffic_selectors(this->policy, NULL);
this->tsi = this->config->get_traffic_selectors(this->config, TRUE,
NULL, NULL);
vip->destroy(vip);
}
else
{ /* but shorten a 0.0.0.0/0 subnet to the actual address if host2host */
this->tsi = this->policy->get_my_traffic_selectors(this->policy, me);
this->tsi = this->config->get_traffic_selectors(this->config, TRUE,
NULL, me);
}
this->tsr = this->policy->get_other_traffic_selectors(this->policy, other);
this->proposals = this->policy->get_proposals(this->policy);
this->mode = this->policy->get_mode(this->policy);
this->tsr = this->config->get_traffic_selectors(this->config, FALSE,
NULL, other);
this->proposals = this->config->get_proposals(this->config);
this->mode = this->config->get_mode(this->config);
this->child_sa = child_sa_create(me, other,
this->ike_sa->get_my_id(this->ike_sa),
this->ike_sa->get_other_id(this->ike_sa),
this->policy, this->reqid,
this->config, this->reqid,
this->ike_sa->is_natt_enabled(this->ike_sa));
if (this->child_sa->alloc(this->child_sa, this->proposals) != SUCCESS)
@@ -492,6 +493,8 @@ static status_t build_i(private_child_create_t *this, message_t *message)
*/
static status_t process_r(private_child_create_t *this, message_t *message)
{
peer_cfg_t *peer_cfg;
switch (message->get_exchange_type(message))
{
case IKE_SA_INIT:
@@ -517,18 +520,13 @@ static status_t process_r(private_child_create_t *this, message_t *message)
return NEED_MORE;
}
this->policy = charon->policies->get_policy(charon->policies,
this->ike_sa->get_my_id(this->ike_sa),
this->ike_sa->get_other_id(this->ike_sa),
this->tsr, this->tsi,
this->ike_sa->get_my_host(this->ike_sa),
this->ike_sa->get_other_host(this->ike_sa));
if (this->policy && this->ike_sa->get_policy(this->ike_sa) == NULL)
peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
if (peer_cfg)
{
this->ike_sa->set_policy(this->ike_sa, this->policy);
this->config = peer_cfg->select_child_cfg(peer_cfg, this->tsr, this->tsi,
this->ike_sa->get_my_host(this->ike_sa),
this->ike_sa->get_other_host(this->ike_sa));
}
return NEED_MORE;
}
@@ -565,10 +563,11 @@ static status_t build_r(private_child_create_t *this, message_t *message)
return SUCCESS;
}
if (this->policy == NULL)
if (this->config == NULL)
{
SIG(CHILD_UP_FAILED, "no acceptable policy found");
message->add_notify(message, FALSE, NO_PROPOSAL_CHOSEN, chunk_empty);
SIG(CHILD_UP_FAILED, "traffic selectors %#R=== %#R inacceptable",
this->tsr, this->tsi);
message->add_notify(message, FALSE, TS_UNACCEPTABLE, chunk_empty);
return SUCCESS;
}
@@ -576,12 +575,12 @@ static status_t build_r(private_child_create_t *this, message_t *message)
this->ike_sa->get_other_host(this->ike_sa),
this->ike_sa->get_my_id(this->ike_sa),
this->ike_sa->get_other_id(this->ike_sa),
this->policy, this->reqid,
this->config, this->reqid,
this->ike_sa->is_natt_enabled(this->ike_sa));
if (select_and_install(this) != SUCCESS)
{
message->add_notify(message, FALSE, TS_UNACCEPTABLE, chunk_empty);
message->add_notify(message, FALSE, NO_PROPOSAL_CHOSEN, chunk_empty);
return SUCCESS;
}
@@ -756,14 +755,14 @@ static void destroy(private_child_create_t *this)
this->proposals->destroy_offset(this->proposals, offsetof(proposal_t, destroy));
}
DESTROY_IF(this->policy);
DESTROY_IF(this->config);
free(this);
}
/*
* Described in header.
*/
child_create_t *child_create_create(ike_sa_t *ike_sa, policy_t *policy)
child_create_t *child_create_create(ike_sa_t *ike_sa, child_cfg_t *config)
{
private_child_create_t *this = malloc_thing(private_child_create_t);
@@ -773,12 +772,12 @@ child_create_t *child_create_create(ike_sa_t *ike_sa, policy_t *policy)
this->public.task.get_type = (task_type_t(*)(task_t*))get_type;
this->public.task.migrate = (void(*)(task_t*,ike_sa_t*))migrate;
this->public.task.destroy = (void(*)(task_t*))destroy;
if (policy)
if (config)
{
this->public.task.build = (status_t(*)(task_t*,message_t*))build_i;
this->public.task.process = (status_t(*)(task_t*,message_t*))process_i;
this->initiator = TRUE;
policy->get_ref(policy);
config->get_ref(config);
}
else
{
@@ -788,7 +787,7 @@ child_create_t *child_create_create(ike_sa_t *ike_sa, policy_t *policy)
}
this->ike_sa = ike_sa;
this->policy = policy;
this->config = config;
this->my_nonce = chunk_empty;
this->other_nonce = chunk_empty;
this->proposals = NULL;
src/charon/sa/tasks/child_create.h
+3 -3
View File
@@ -28,7 +28,7 @@ typedef struct child_create_t child_create_t;
#include <library.h>
#include <sa/ike_sa.h>
#include <sa/tasks/task.h>
#include <config/policies/policy.h>
#include <config/child_cfg.h>
/**
* @brief Task of type CHILD_CREATE, established a new CHILD_SA.
@@ -80,9 +80,9 @@ struct child_create_t {
* @brief Create a new child_create task.
*
* @param ike_sa IKE_SA this task works for
* @param policy policy if task initiator, NULL if responder
* @param config child_cfg if task initiator, NULL if responder
* @return child_create task to handle by the task_manager
*/
child_create_t *child_create_create(ike_sa_t *ike_sa, policy_t *policy);
child_create_t *child_create_create(ike_sa_t *ike_sa, child_cfg_t *config);
#endif /* CHILD_CREATE_H_ */
src/charon/sa/tasks/child_rekey.c
+4 -4
View File
@@ -27,7 +27,7 @@
#include <encoding/payloads/notify_payload.h>
#include <sa/tasks/child_create.h>
#include <sa/tasks/child_delete.h>
#include <queues/jobs/rekey_child_sa_job.h>
#include <processing/jobs/rekey_child_sa_job.h>
typedef struct private_child_rekey_t private_child_rekey_t;
@@ -315,8 +315,8 @@ static void destroy(private_child_rekey_t *this)
*/
child_rekey_t *child_rekey_create(ike_sa_t *ike_sa, child_sa_t *child_sa)
{
child_cfg_t *config;
private_child_rekey_t *this = malloc_thing(private_child_rekey_t);
policy_t *policy;
this->public.collide = (void (*)(child_rekey_t*,task_t*))collide;
this->public.task.get_type = (task_type_t(*)(task_t*))get_type;
@@ -327,8 +327,8 @@ child_rekey_t *child_rekey_create(ike_sa_t *ike_sa, child_sa_t *child_sa)
this->public.task.build = (status_t(*)(task_t*,message_t*))build_i;
this->public.task.process = (status_t(*)(task_t*,message_t*))process_i;
this->initiator = TRUE;
policy = child_sa->get_policy(child_sa);
this->child_create = child_create_create(ike_sa, policy);
config = child_sa->get_config(child_sa);
this->child_create = child_create_create(ike_sa, config);
}
else
{
src/charon/sa/tasks/ike_auth.c
+30 -17
View File
@@ -100,18 +100,18 @@ static status_t build_auth(private_ike_auth_t *this, message_t *message)
{
authenticator_t *auth;
auth_payload_t *auth_payload;
policy_t *policy;
peer_cfg_t *config;
auth_method_t method;
status_t status;
/* create own authenticator and add auth payload */
policy = this->ike_sa->get_policy(this->ike_sa);
if (!policy)
config = this->ike_sa->get_peer_cfg(this->ike_sa);
if (!config)
{
SIG(IKE_UP_FAILED, "unable to authenticate, no policy found");
SIG(IKE_UP_FAILED, "unable to authenticate, no peer config found");
return FAILED;
}
method = policy->get_auth_method(policy);
method = config->get_auth_method(config);
auth = authenticator_create(this->ike_sa, method);
if (auth == NULL)
@@ -140,15 +140,15 @@ static status_t build_id(private_ike_auth_t *this, message_t *message)
{
identification_t *me, *other;
id_payload_t *id;
policy_t *policy;
peer_cfg_t *config;
me = this->ike_sa->get_my_id(this->ike_sa);
other = this->ike_sa->get_other_id(this->ike_sa);
policy = this->ike_sa->get_policy(this->ike_sa);
config = this->ike_sa->get_peer_cfg(this->ike_sa);
if (me->contains_wildcards(me))
{
me = policy->get_my_id(policy);
me = config->get_my_id(config);
if (me->contains_wildcards(me))
{
SIG(IKE_UP_FAILED, "negotiation of own ID failed");
@@ -459,7 +459,7 @@ static status_t build_eap_r(private_ike_auth_t *this, message_t *message)
*/
static status_t build_i(private_ike_auth_t *this, message_t *message)
{
policy_t *policy;
peer_cfg_t *config;
if (message->get_exchange_type(message) == IKE_SA_INIT)
{
@@ -471,8 +471,8 @@ static status_t build_i(private_ike_auth_t *this, message_t *message)
return FAILED;
}
policy = this->ike_sa->get_policy(this->ike_sa);
if (policy->get_auth_method(policy) == AUTH_EAP)
config = this->ike_sa->get_peer_cfg(this->ike_sa);
if (config->get_auth_method(config) == AUTH_EAP)
{
this->eap_auth = eap_authenticator_create(this->ike_sa);
}
@@ -491,7 +491,9 @@ static status_t build_i(private_ike_auth_t *this, message_t *message)
* Implementation of task_t.process for initiator
*/
static status_t process_r(private_ike_auth_t *this, message_t *message)
{
{
peer_cfg_t *config;
if (message->get_exchange_type(message) == IKE_SA_INIT)
{
return collect_other_init_data(this, message);
@@ -502,6 +504,15 @@ static status_t process_r(private_ike_auth_t *this, message_t *message)
return NEED_MORE;
}
config = charon->cfg_store->get_peer_cfg(charon->cfg_store,
this->ike_sa->get_my_id(this->ike_sa),
this->ike_sa->get_other_id(this->ike_sa));
if (config)
{
this->ike_sa->set_peer_cfg(this->ike_sa, config);
config->destroy(config);
}
switch (process_auth(this, message))
{
case SUCCESS:
@@ -522,7 +533,7 @@ static status_t process_r(private_ike_auth_t *this, message_t *message)
*/
static status_t build_r(private_ike_auth_t *this, message_t *message)
{
policy_t *policy;
peer_cfg_t *config;
eap_type_t eap_type;
eap_payload_t *eap_payload;
status_t status;
@@ -532,10 +543,12 @@ static status_t build_r(private_ike_auth_t *this, message_t *message)
return collect_my_init_data(this, message);
}
policy = this->ike_sa->get_policy(this->ike_sa);
if (policy == NULL)
config = this->ike_sa->get_peer_cfg(this->ike_sa);
if (config == NULL)
{
SIG(IKE_UP_FAILED, "no acceptable policy found");
SIG(IKE_UP_FAILED, "no acceptable peer config found for %D...%D",
this->ike_sa->get_my_id(this->ike_sa),
this->ike_sa->get_other_id(this->ike_sa));
message->add_notify(message, TRUE, AUTHENTICATION_FAILED, chunk_empty);
return FAILED;
}
@@ -567,7 +580,7 @@ static status_t build_r(private_ike_auth_t *this, message_t *message)
}
/* initiate EAP authenitcation */
eap_type = policy->get_eap_type(policy);
eap_type = config->get_eap_type(config);
status = this->eap_auth->initiate(this->eap_auth, eap_type, &eap_payload);
message->add_payload(message, (payload_t*)eap_payload);
if (status != NEED_MORE)
src/charon/sa/tasks/ike_cert.c
+12 -14
View File
@@ -171,20 +171,20 @@ static void process_certs(private_ike_cert_t *this, message_t *message)
*/
static void build_certreqs(private_ike_cert_t *this, message_t *message)
{
connection_t *connection;
policy_t *policy;
ike_cfg_t *ike_cfg;
peer_cfg_t *peer_cfg;
identification_t *ca;
certreq_payload_t *certreq;
connection = this->ike_sa->get_connection(this->ike_sa);
ike_cfg = this->ike_sa->get_ike_cfg(this->ike_sa);
if (connection->get_certreq_policy(connection) != CERT_NEVER_SEND)
if (ike_cfg->send_certreq(ike_cfg) != CERT_NEVER_SEND)
{
policy = this->ike_sa->get_policy(this->ike_sa);
peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
if (policy)
if (peer_cfg)
{
ca = policy->get_other_ca(policy);
ca = peer_cfg->get_other_ca(peer_cfg);
if (ca && ca->get_type(ca) != ID_ANY)
{
@@ -212,17 +212,15 @@ static void build_certreqs(private_ike_cert_t *this, message_t *message)
*/
static void build_certs(private_ike_cert_t *this, message_t *message)
{
policy_t *policy;
connection_t *connection;
peer_cfg_t *peer_cfg;
x509_t *cert;
cert_payload_t *payload;
policy = this->ike_sa->get_policy(this->ike_sa);
connection = this->ike_sa->get_connection(this->ike_sa);
peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
if (policy && policy->get_auth_method(policy) == AUTH_RSA)
if (peer_cfg && peer_cfg->get_auth_method(peer_cfg) == AUTH_RSA)
{
switch (connection->get_cert_policy(connection))
switch (peer_cfg->get_cert_policy(peer_cfg))
{
case CERT_NEVER_SEND:
break;
@@ -236,7 +234,7 @@ static void build_certs(private_ike_cert_t *this, message_t *message)
{
/* TODO: respect CA cert request */
cert = charon->credentials->get_certificate(charon->credentials,
policy->get_my_id(policy));
peer_cfg->get_my_id(peer_cfg));
if (cert)
{
payload = cert_payload_create_from_x509(cert);
src/charon/sa/tasks/ike_config.c
+8 -15
View File
@@ -48,11 +48,6 @@ struct private_ike_config_t {
*/
bool initiator;
/**
* associated policy with virtual IP configuration
*/
policy_t *policy;
/**
* virtual ip
*/
@@ -266,7 +261,8 @@ static status_t build_i(private_ike_config_t *this, message_t *message)
if (message->get_exchange_type(message) == IKE_AUTH &&
message->get_payload(message, ID_INITIATOR))
{
this->virtual_ip = this->policy->get_virtual_ip(this->policy, NULL);
peer_cfg_t *config = this->ike_sa->get_peer_cfg(this->ike_sa);
this->virtual_ip = config->get_virtual_ip(config, NULL);
build_payloads(this, message, CFG_REQUEST);
}
@@ -295,14 +291,14 @@ static status_t build_r(private_ike_config_t *this, message_t *message)
if (message->get_exchange_type(message) == IKE_AUTH &&
message->get_payload(message, EXTENSIBLE_AUTHENTICATION) == NULL)
{
this->policy = this->ike_sa->get_policy(this->ike_sa);
peer_cfg_t *config = this->ike_sa->get_peer_cfg(this->ike_sa);
if (this->policy && this->virtual_ip)
if (config && this->virtual_ip)
{
host_t *ip;
DBG1(DBG_IKE, "peer requested virtual IP %H", this->virtual_ip);
ip = this->policy->get_virtual_ip(this->policy, this->virtual_ip);
ip = config->get_virtual_ip(config, this->virtual_ip);
if (ip == NULL || ip->is_anyaddr(ip))
{
DBG1(DBG_IKE, "not assigning a virtual IP to peer");
@@ -398,7 +394,7 @@ static void destroy(private_ike_config_t *this)
/*
* Described in header.
*/
ike_config_t *ike_config_create(ike_sa_t *ike_sa, policy_t *policy)
ike_config_t *ike_config_create(ike_sa_t *ike_sa, bool initiator)
{
private_ike_config_t *this = malloc_thing(private_ike_config_t);
@@ -406,21 +402,18 @@ ike_config_t *ike_config_create(ike_sa_t *ike_sa, policy_t *policy)
this->public.task.migrate = (void(*)(task_t*,ike_sa_t*))migrate;
this->public.task.destroy = (void(*)(task_t*))destroy;
if (policy)
if (initiator)
{
this->public.task.build = (status_t(*)(task_t*,message_t*))build_i;
this->public.task.process = (status_t(*)(task_t*,message_t*))process_i;
this->initiator = TRUE;
}
else
{
this->public.task.build = (status_t(*)(task_t*,message_t*))build_r;
this->public.task.process = (status_t(*)(task_t*,message_t*))process_r;
this->initiator = FALSE;
}
this->initiator = initiator;
this->ike_sa = ike_sa;
this->policy = policy;
this->virtual_ip = NULL;
this->dns = linked_list_create();
src/charon/sa/tasks/ike_config.h
+2 -3
View File
@@ -28,7 +28,6 @@ typedef struct ike_config_t ike_config_t;
#include <library.h>
#include <sa/ike_sa.h>
#include <sa/tasks/task.h>
#include <config/policies/policy.h>
/**
* @brief Task of type IKE_CONFIG, sets up a virtual IP and other
@@ -51,9 +50,9 @@ struct ike_config_t {
* @brief Create a new ike_config task.
*
* @param ike_sa IKE_SA this task works for
* @param policy policy for the initiator, NULL for the responder
* @param initiator TRUE for initiator
* @return ike_config task to handle by the task_manager
*/
ike_config_t *ike_config_create(ike_sa_t *ike_sa, policy_t *policy);
ike_config_t *ike_config_create(ike_sa_t *ike_sa, bool initiator);
#endif /* IKE_CONFIG_H_ */
src/charon/sa/tasks/ike_delete.c
+1 -1
View File
@@ -28,7 +28,7 @@
typedef struct private_ike_delete_t private_ike_delete_t;
/**
/**file
* Private members of a ike_delete_t task.
*/
struct private_ike_delete_t {
src/charon/sa/tasks/ike_init.c
+14 -16
View File
@@ -57,9 +57,9 @@ struct private_ike_init_t {
bool initiator;
/**
* Connection established by this IKE_SA
* IKE config to establish
*/
connection_t *connection;
ike_cfg_t *config;
/**
* diffie hellman group to use
@@ -117,11 +117,11 @@ static void build_payloads(private_ike_init_t *this, message_t *message)
id = this->ike_sa->get_id(this->ike_sa);
this->connection = this->ike_sa->get_connection(this->ike_sa);
this->config = this->ike_sa->get_ike_cfg(this->ike_sa);
if (this->initiator)
{
proposal_list = this->connection->get_proposals(this->connection);
proposal_list = this->config->get_proposals(this->config);
if (this->old_sa)
{
/* include SPI of new IKE_SA when we are rekeying */
@@ -174,8 +174,8 @@ static void process_payloads(private_ike_init_t *this, message_t *message)
linked_list_t *proposal_list;
proposal_list = sa_payload->get_proposals(sa_payload);
this->proposal = this->connection->select_proposal(
this->connection, proposal_list);
this->proposal = this->config->select_proposal(this->config,
proposal_list);
proposal_list->destroy_offset(proposal_list,
offsetof(proposal_t, destroy));
break;
@@ -200,8 +200,7 @@ static void process_payloads(private_ike_init_t *this, message_t *message)
else
{
this->dh_group = dh_group;
if (!this->connection->check_dh_group(this->connection,
dh_group))
if (!this->config->check_dh_group(this->config, dh_group))
{
break;
}
@@ -235,9 +234,9 @@ static status_t build_i(private_ike_init_t *this, message_t *message)
randomizer_t *randomizer;
status_t status;
this->connection = this->ike_sa->get_connection(this->ike_sa);
this->config = this->ike_sa->get_ike_cfg(this->ike_sa);
SIG(IKE_UP_START, "initiating IKE_SA to %H",
this->connection->get_other_host(this->connection));
this->config->get_other_host(this->config));
this->ike_sa->set_state(this->ike_sa, IKE_CONNECTING);
if (this->retry++ >= MAX_RETRIES)
@@ -249,7 +248,7 @@ static status_t build_i(private_ike_init_t *this, message_t *message)
/* if the DH group is set via use_dh_group(), we already have a DH object */
if (!this->diffie_hellman)
{
this->dh_group = this->connection->get_dh_group(this->connection);
this->dh_group = this->config->get_dh_group(this->config);
this->diffie_hellman = diffie_hellman_create(this->dh_group);
if (this->diffie_hellman == NULL)
{
@@ -291,7 +290,7 @@ static status_t process_r(private_ike_init_t *this, message_t *message)
{
randomizer_t *randomizer;
this->connection = this->ike_sa->get_connection(this->ike_sa);
this->config = this->ike_sa->get_ike_cfg(this->ike_sa);
SIG(IKE_UP_FAILED, "%H is initiating an IKE_SA",
message->get_source(message));
this->ike_sa->set_state(this->ike_sa, IKE_CONNECTING);
@@ -335,7 +334,7 @@ static status_t build_r(private_ike_init_t *this, message_t *message)
SIG(IKE_UP_FAILED, "received inacceptable DH group (%N)",
diffie_hellman_group_names, this->dh_group);
this->dh_group = this->connection->get_dh_group(this->connection);
this->dh_group = this->config->get_dh_group(this->config);
dh_enc = htons(this->dh_group);
chunk.ptr = (u_int8_t*)&dh_enc;
chunk.len = sizeof(dh_enc);
@@ -414,8 +413,7 @@ static status_t process_i(private_ike_init_t *this, message_t *message)
DBG1(DBG_IKE, "peer didn't accept DH group %N, it requested"
" %N", diffie_hellman_group_names, old_dh_group,
diffie_hellman_group_names, this->dh_group);
if (!this->connection->check_dh_group(this->connection,
this->dh_group))
if (!this->config->check_dh_group(this->config, this->dh_group))
{
DBG1(DBG_IKE, "requested DH group %N not acceptable, "
"giving up", diffie_hellman_group_names,
@@ -590,7 +588,7 @@ ike_init_t *ike_init_create(ike_sa_t *ike_sa, bool initiator, ike_sa_t *old_sa)
this->other_nonce = chunk_empty;
this->cookie = chunk_empty;
this->proposal = NULL;
this->connection = NULL;
this->config = NULL;
this->old_sa = old_sa;
this->retry = 0;
src/charon/sa/tasks/ike_rekey.c
+8 -17
View File
@@ -26,8 +26,8 @@
#include <daemon.h>
#include <encoding/payloads/notify_payload.h>
#include <sa/tasks/ike_init.h>
#include <queues/jobs/delete_ike_sa_job.h>
#include <queues/jobs/rekey_ike_sa_job.h>
#include <processing/jobs/delete_ike_sa_job.h>
#include <processing/jobs/rekey_ike_sa_job.h>
typedef struct private_ike_rekey_t private_ike_rekey_t;
@@ -73,20 +73,15 @@ struct private_ike_rekey_t {
*/
static status_t build_i(private_ike_rekey_t *this, message_t *message)
{
connection_t *connection;
policy_t *policy;
peer_cfg_t *peer_cfg;
this->new_sa = charon->ike_sa_manager->checkout_new(charon->ike_sa_manager,
TRUE);
connection = this->ike_sa->get_connection(this->ike_sa);
policy = this->ike_sa->get_policy(this->ike_sa);
this->new_sa->set_connection(this->new_sa, connection);
this->new_sa->set_policy(this->new_sa, policy);
peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
this->new_sa->set_peer_cfg(this->new_sa, peer_cfg);
this->ike_init = ike_init_create(this->new_sa, TRUE, this->ike_sa);
this->ike_init->task.build(&this->ike_init->task, message);
this->ike_sa->set_state(this->ike_sa, IKE_REKEYING);
return NEED_MORE;
@@ -97,8 +92,7 @@ static status_t build_i(private_ike_rekey_t *this, message_t *message)
*/
static status_t process_r(private_ike_rekey_t *this, message_t *message)
{
connection_t *connection;
policy_t *policy;
peer_cfg_t *peer_cfg;
iterator_t *iterator;
child_sa_t *child_sa;
@@ -129,11 +123,8 @@ static status_t process_r(private_ike_rekey_t *this, message_t *message)
this->new_sa = charon->ike_sa_manager->checkout_new(charon->ike_sa_manager,
FALSE);
connection = this->ike_sa->get_connection(this->ike_sa);
policy = this->ike_sa->get_policy(this->ike_sa);
this->new_sa->set_connection(this->new_sa, connection);
this->new_sa->set_policy(this->new_sa, policy);
peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
this->new_sa->set_peer_cfg(this->new_sa, peer_cfg);
this->ike_init = ike_init_create(this->new_sa, FALSE, this->ike_sa);
this->ike_init->task.process(&this->ike_init->task, message);