denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Invoke authorization hooks for IKEv1 connections

Browse Source
This commit is contained in:
Martin Willi
2012-03-20 17:31:36 +01:00
parent 1a0648490c
commit f420f51f55
3 changed files with 95 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/ikev1/tasks/aggressive_mode.c
+39 -11
View File
@@ -95,8 +95,14 @@ struct private_aggressive_mode_t {
/**
* Set IKE_SA to established state
*/
static void establish(private_aggressive_mode_t *this)
static bool establish(private_aggressive_mode_t *this)
{
if (!charon->bus->authorize(charon->bus, TRUE))
{
DBG1(DBG_IKE, "final authorization hook forbids IKE_SA, cancelling");
return FALSE;
}
DBG0(DBG_IKE, "IKE_SA %s[%d] established between %H[%Y]...%H[%Y]",
this->ike_sa->get_name(this->ike_sa),
this->ike_sa->get_unique_id(this->ike_sa),
@@ -107,6 +113,8 @@ static void establish(private_aggressive_mode_t *this)
this->ike_sa->set_state(this->ike_sa, IKE_ESTABLISHED);
charon->bus->ike_updown(charon->bus, this->ike_sa, TRUE);
return TRUE;
}
/**
@@ -278,28 +286,31 @@ METHOD(task_t, build_i, status_t,
}
this->id_data = chunk_empty;
if (this->peer_cfg->get_virtual_ip(this->peer_cfg))
{
this->ike_sa->queue_task(this->ike_sa,
(task_t*)mode_config_create(this->ike_sa, TRUE));
}
switch (this->method)
{
case AUTH_XAUTH_INIT_PSK:
case AUTH_XAUTH_INIT_RSA:
case AUTH_HYBRID_INIT_RSA:
/* wait for XAUTH request */
return SUCCESS;
break;
case AUTH_XAUTH_RESP_PSK:
case AUTH_XAUTH_RESP_RSA:
case AUTH_HYBRID_RESP_RSA:
/* TODO-IKEv1: not yet */
return FAILED;
default:
establish(this);
return SUCCESS;
if (!establish(this))
{
return send_notify(this, AUTHENTICATION_FAILED);
}
break;
}
if (this->peer_cfg->get_virtual_ip(this->peer_cfg))
{
this->ike_sa->queue_task(this->ike_sa,
(task_t*)mode_config_create(this->ike_sa, TRUE));
}
return SUCCESS;
}
default:
return FAILED;
@@ -405,6 +416,13 @@ METHOD(task_t, process_r, status_t,
}
this->id_data = chunk_empty;
if (!charon->bus->authorize(charon->bus, FALSE))
{
DBG1(DBG_IKE, "Aggressive Mode authorization hook forbids "
"IKE_SA, cancelling");
return send_delete(this);
}
switch (this->method)
{
case AUTH_XAUTH_INIT_PSK:
@@ -419,7 +437,10 @@ METHOD(task_t, process_r, status_t,
/* TODO-IKEv1: not yet supported */
return FAILED;
default:
establish(this);
if (!establish(this))
{
return send_delete(this);
}
lib->processor->queue_job(lib->processor, (job_t*)
adopt_children_job_create(
this->ike_sa->get_id(this->ike_sa)));
@@ -557,6 +578,13 @@ METHOD(task_t, process_i, status_t,
{
return send_notify(this, AUTHENTICATION_FAILED);
}
if (!charon->bus->authorize(charon->bus, FALSE))
{
DBG1(DBG_IKE, "Aggressive Mode authorization hook forbids IKE_SA, "
"cancelling");
return send_notify(this, AUTHENTICATION_FAILED);
}
return NEED_MORE;
}
return FAILED;