denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ikev1: First do PSK lookups based on identities then fallback to IPs

Browse Source 
This provides a solution for configs where there is e.g. a catch-all %any
PSK, while more specific PSKs would be found by the identities of configs
that e.g. use FQDNs as local/remote addresses.

Fixes #2223.
This commit is contained in:
Tobias Brunner
2017-03-20 10:17:56 +01:00
parent ac9063dae2
commit e92d8a56b3
1 changed files with 34 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/ikev1/phase1.c
+21 -23
View File
@@ -113,22 +113,8 @@ static shared_key_t *lookup_shared_key(private_phase1_t *this,
auth_cfg_t *my_auth, *other_auth; auth_cfg_t *my_auth, *other_auth;
enumerator_t *enumerator; enumerator_t *enumerator;
/* try to get a PSK for IP addresses */
me = this->ike_sa->get_my_host(this->ike_sa); me = this->ike_sa->get_my_host(this->ike_sa);
other = this->ike_sa->get_other_host(this->ike_sa); other = this->ike_sa->get_other_host(this->ike_sa);
my_id = identification_create_from_sockaddr(me->get_sockaddr(me));
other_id = identification_create_from_sockaddr(other->get_sockaddr(other));
if (my_id && other_id)
{
shared_key = lib->credmgr->get_shared(lib->credmgr, SHARED_IKE,
my_id, other_id);
}
DESTROY_IF(my_id);
DESTROY_IF(other_id);
if (shared_key)
{
return shared_key;
}
if (peer_cfg) if (peer_cfg)
{ /* as initiator or aggressive responder, use identities */ { /* as initiator or aggressive responder, use identities */
@@ -156,11 +142,12 @@ static shared_key_t *lookup_shared_key(private_phase1_t *this,
} }
} }
} }
return shared_key;
} }
/* as responder, we try to find a config by IP */ else
enumerator = charon->backends->create_peer_cfg_enumerator(charon->backends, { /* as responder, we try to find a config by IP addresses and use the
me, other, NULL, NULL, IKEV1); * configured identities to find the PSK */
enumerator = charon->backends->create_peer_cfg_enumerator(
charon->backends, me, other, NULL, NULL, IKEV1);
while (enumerator->enumerate(enumerator, &peer_cfg)) while (enumerator->enumerate(enumerator, &peer_cfg))
{ {
my_auth = get_auth_cfg(peer_cfg, TRUE); my_auth = get_auth_cfg(peer_cfg, TRUE);
@@ -171,25 +158,36 @@ static shared_key_t *lookup_shared_key(private_phase1_t *this,
other_id = other_auth->get(other_auth, AUTH_RULE_IDENTITY); other_id = other_auth->get(other_auth, AUTH_RULE_IDENTITY);
if (my_id) if (my_id)
{ {
shared_key = lib->credmgr->get_shared(lib->credmgr, SHARED_IKE, shared_key = lib->credmgr->get_shared(lib->credmgr,
my_id, other_id); SHARED_IKE, my_id, other_id);
if (shared_key) if (shared_key)
{ {
break; break;
} }
else
{
DBG1(DBG_IKE, "no shared key found for '%Y'[%H] - '%Y'[%H]", DBG1(DBG_IKE, "no shared key found for '%Y'[%H] - '%Y'[%H]",
my_id, me, other_id, other); my_id, me, other_id, other);
} }
} }
} }
}
enumerator->destroy(enumerator); enumerator->destroy(enumerator);
}
if (!shared_key)
{ /* try to get a PSK for IP addresses */
my_id = identification_create_from_sockaddr(me->get_sockaddr(me));
other_id = identification_create_from_sockaddr(
other->get_sockaddr(other));
if (my_id && other_id)
{
shared_key = lib->credmgr->get_shared(lib->credmgr, SHARED_IKE,
my_id, other_id);
}
DESTROY_IF(my_id);
DESTROY_IF(other_id);
if (!shared_key) if (!shared_key)
{ {
DBG1(DBG_IKE, "no shared key found for %H - %H", me, other); DBG1(DBG_IKE, "no shared key found for %H - %H", me, other);
} }
}
return shared_key; return shared_key;
} }