denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

bus: Support multiple key exchanges in ike/child_keys() events

Browse Source
This commit is contained in:
Tobias Brunner
2024-08-07 16:20:18 +02:00
parent c14e4ab2a8
commit eff0c43a17
9 changed files with 42 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/bus/bus.c
+4 -4
View File
@@ -574,7 +574,7 @@ METHOD(bus_t, message, void,
}
METHOD(bus_t, ike_keys, void,
private_bus_t *this, ike_sa_t *ike_sa, key_exchange_t *dh,
private_bus_t *this, ike_sa_t *ike_sa, array_t *kes,
chunk_t dh_other, chunk_t nonce_i, chunk_t nonce_r,
ike_sa_t *rekey, shared_key_t *shared, auth_method_t method)
{
@@ -591,7 +591,7 @@ METHOD(bus_t, ike_keys, void,
continue;
}
entry->calling++;
keep = entry->listener->ike_keys(entry->listener, ike_sa, dh, dh_other,
keep = entry->listener->ike_keys(entry->listener, ike_sa, kes, dh_other,
nonce_i, nonce_r, rekey, shared,
method);
entry->calling--;
@@ -639,7 +639,7 @@ METHOD(bus_t, ike_derived_keys, void,
METHOD(bus_t, child_keys, void,
private_bus_t *this, child_sa_t *child_sa, bool initiator,
key_exchange_t *dh, chunk_t nonce_i, chunk_t nonce_r)
array_t *kes, chunk_t nonce_i, chunk_t nonce_r)
{
enumerator_t *enumerator;
ike_sa_t *ike_sa;
@@ -658,7 +658,7 @@ METHOD(bus_t, child_keys, void,
}
entry->calling++;
keep = entry->listener->child_keys(entry->listener, ike_sa,
child_sa, initiator, dh, nonce_i, nonce_r);
child_sa, initiator, kes, nonce_i, nonce_r);
entry->calling--;
if (!keep)
{
src/libcharon/bus/bus.h
+5 -4
View File
@@ -30,6 +30,7 @@ typedef struct bus_t bus_t;
#include <stdarg.h>
#include <utils/debug.h>
#include <collections/array.h>
#include <sa/ike_sa.h>
#include <sa/child_sa.h>
#include <processing/jobs/job.h>
@@ -348,7 +349,7 @@ struct bus_t {
* IKE_SA keymat hook.
*
* @param ike_sa IKE_SA this keymat belongs to
* @param dh diffie hellman shared secret
* @param kes array of key_exchange_t*
* @param dh_other others DH public value (IKEv1 only)
* @param nonce_i initiator's nonce
* @param nonce_r responder's nonce
@@ -356,7 +357,7 @@ struct bus_t {
* @param shared shared key used for key derivation (IKEv1-PSK only)
* @param method auth method for key derivation (IKEv1-non-PSK only)
*/
void (*ike_keys)(bus_t *this, ike_sa_t *ike_sa, key_exchange_t *dh,
void (*ike_keys)(bus_t *this, ike_sa_t *ike_sa, array_t *kes,
chunk_t dh_other, chunk_t nonce_i, chunk_t nonce_r,
ike_sa_t *rekey, shared_key_t *shared,
auth_method_t method);
@@ -381,12 +382,12 @@ struct bus_t {
*
* @param child_sa CHILD_SA this keymat is used for
* @param initiator initiator of the CREATE_CHILD_SA exchange
* @param dh diffie hellman shared secret
* @param kes array of key_exchange_t*, or NULL
* @param nonce_i initiator's nonce
* @param nonce_r responder's nonce
*/
void (*child_keys)(bus_t *this, child_sa_t *child_sa, bool initiator,
key_exchange_t *dh, chunk_t nonce_i, chunk_t nonce_r);
array_t *kes, chunk_t nonce_i, chunk_t nonce_r);
/**
* CHILD_SA derived keys hook.
src/libcharon/bus/listeners/listener.h
+4 -4
View File
@@ -83,7 +83,7 @@ struct listener_t {
* Hook called with IKE_SA key material.
*
* @param ike_sa IKE_SA this keymat belongs to
* @param dh diffie hellman shared secret
* @param kes array of key_exchange_t*
* @param dh_other others DH public value (IKEv1 only)
* @param nonce_i initiator's nonce
* @param nonce_r responder's nonce
@@ -92,7 +92,7 @@ struct listener_t {
* @param method auth method for key derivation (IKEv1-non-PSK only)
* @return TRUE to stay registered, FALSE to unregister
*/
bool (*ike_keys)(listener_t *this, ike_sa_t *ike_sa, key_exchange_t *dh,
bool (*ike_keys)(listener_t *this, ike_sa_t *ike_sa, array_t *kes,
chunk_t dh_other, chunk_t nonce_i, chunk_t nonce_r,
ike_sa_t *rekey, shared_key_t *shared,
auth_method_t method);
@@ -119,13 +119,13 @@ struct listener_t {
* @param ike_sa IKE_SA the child sa belongs to
* @param child_sa CHILD_SA this keymat is used for
* @param initiator initiator of the CREATE_CHILD_SA exchange
* @param dh diffie hellman shared secret
* @param kes array of key_exchange_t*, or NULL
* @param nonce_i initiator's nonce
* @param nonce_r responder's nonce
* @return TRUE to stay registered, FALSE to unregister
*/
bool (*child_keys)(listener_t *this, ike_sa_t *ike_sa, child_sa_t *child_sa,
bool initiator, key_exchange_t *dh,
bool initiator, array_t *kes,
chunk_t nonce_i, chunk_t nonce_r);
/**