denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'cmd-proposals'

Browse Source 
Introduce --ike/esp/ah-proposal options to offer custom proposals, and requests
an IPv6 virtual IP if an IPv6 --remote-ts is given.

Fixes #508.
This commit is contained in:
Martin Willi
2014-02-06 15:58:41 +01:00
parent 0edd13b6c8 e2de972c55
commit fe40c47547
5 changed files with 119 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/charon-cmd/charon-cmd.8.in
+18
View File
@@ -116,6 +116,24 @@ address will always be proposed.
.BI "\-\-remote\-ts " subnet
Traffic selector to propose for remote side, defaults to 0.0.0.0/0.
.TP
.BI "\-\-ike\-proposal " proposal
IKE proposal to offer instead of default. For IKEv1, a single proposal consists
of one encryption algorithm, an integrity/PRF algorithm and a DH group. IKEv2
can propose multiple algorithms of the same kind. To specify multiple proposals,
repeat the option.
.TP
.BI "\-\-esp\-proposal " proposal
ESP proposal to offer instead of default. For IKEv1, a single proposal consists
of one encryption algorithm, an integrity algorithm and an optional DH group for
Perfect Forward Secrecy rekeying. IKEv2 can propose multiple algorithms of the
same kind. To specify multiple proposals, repeat the option.
.TP
.BI "\-\-ah\-proposal " proposal
AH proposal to offer instead of ESP. For IKEv1, a single proposal consists
of an integrity algorithm and an optional DH group for Perfect Forward Secrecy
rekeying. IKEv2 can propose multiple algorithms of the same kind. To specify
multiple proposals, repeat the option.
.TP
.BI "\-\-profile " name
Authentication profile to use, the list of supported profiles can be found
in the
src/charon-cmd/charon-cmd.c
+1
View File
@@ -389,6 +389,7 @@ int main(int argc, char *argv[])
sigaddset(&action.sa_mask, SIGINT);
sigaddset(&action.sa_mask, SIGTERM);
sigaddset(&action.sa_mask, SIGHUP);
sigaddset(&action.sa_mask, SIGUSR1);
sigaction(SIGSEGV, &action, NULL);
sigaction(SIGILL, &action, NULL);
sigaction(SIGBUS, &action, NULL);
src/charon-cmd/cmd/cmd_connection.c
+91 -6
View File
@@ -86,6 +86,16 @@ struct private_cmd_connection_t {
*/
linked_list_t *remote_ts;
/**
* List of IKE proposals
*/
linked_list_t *ike_proposals;
/**
* List of CHILD proposals
*/
linked_list_t *child_proposals;
/**
* Hostname to connect to
*/
@@ -135,6 +145,7 @@ static peer_cfg_t* create_peer_cfg(private_cmd_connection_t *this)
u_int16_t local_port, remote_port = IKEV2_UDP_PORT;
ike_version_t version = IKE_ANY;
bool aggressive = FALSE;
proposal_t *proposal;
switch (this->profile)
{
@@ -165,7 +176,18 @@ static peer_cfg_t* create_peer_cfg(private_cmd_connection_t *this)
}
ike_cfg = ike_cfg_create(version, TRUE, FALSE, "0.0.0.0", local_port,
this->host, remote_port, FRAGMENTATION_NO, 0);
ike_cfg->add_proposal(ike_cfg, proposal_create_default(PROTO_IKE));
if (this->ike_proposals->get_count(this->ike_proposals))
{
while (this->ike_proposals->remove_first(this->ike_proposals,
(void**)&proposal) == SUCCESS)
{
ike_cfg->add_proposal(ike_cfg, proposal);
}
}
else
{
ike_cfg->add_proposal(ike_cfg, proposal_create_default(PROTO_IKE));
}
peer_cfg = peer_cfg_create("cmd", ike_cfg,
CERT_SEND_IF_ASKED, UNIQUE_REPLACE, 1, /* keyingtries */
36000, 0, /* rekey 10h, reauth none */
@@ -173,7 +195,6 @@ static peer_cfg_t* create_peer_cfg(private_cmd_connection_t *this)
TRUE, aggressive, TRUE, /* mobike, aggressive, pull */
30, 0, /* DPD delay, timeout */
FALSE, NULL, NULL); /* mediation */
peer_cfg->add_virtual_ip(peer_cfg, host_create_from_string("0.0.0.0", 0));
return peer_cfg;
}
@@ -306,10 +327,13 @@ static bool add_auth_cfgs(private_cmd_connection_t *this, peer_cfg_t *peer_cfg)
/**
* Attach child config to peer config
*/
static child_cfg_t* create_child_cfg(private_cmd_connection_t *this)
static child_cfg_t* create_child_cfg(private_cmd_connection_t *this,
peer_cfg_t *peer_cfg)
{
child_cfg_t *child_cfg;
traffic_selector_t *ts;
proposal_t *proposal;
bool has_v4 = FALSE, has_v6 = FALSE;
lifetime_cfg_t lifetime = {
.time = {
.life = 10800 /* 3h */,
@@ -322,7 +346,18 @@ static child_cfg_t* create_child_cfg(private_cmd_connection_t *this)
NULL, FALSE, MODE_TUNNEL, /* updown, hostaccess */
ACTION_NONE, ACTION_NONE, ACTION_NONE, FALSE,
0, 0, NULL, NULL, 0);
child_cfg->add_proposal(child_cfg, proposal_create_default(PROTO_ESP));
if (this->child_proposals->get_count(this->child_proposals))
{
while (this->child_proposals->remove_first(this->child_proposals,
(void**)&proposal) == SUCCESS)
{
child_cfg->add_proposal(child_cfg, proposal);
}
}
else
{
child_cfg->add_proposal(child_cfg, proposal_create_default(PROTO_ESP));
}
while (this->local_ts->remove_first(this->local_ts, (void**)&ts) == SUCCESS)
{
child_cfg->add_traffic_selector(child_cfg, TRUE, ts);
@@ -333,12 +368,31 @@ static child_cfg_t* create_child_cfg(private_cmd_connection_t *this)
ts = traffic_selector_create_from_string(0, TS_IPV4_ADDR_RANGE,
"0.0.0.0", 0, "255.255.255.255", 65535);
this->remote_ts->insert_last(this->remote_ts, ts);
has_v4 = TRUE;
}
while (this->remote_ts->remove_first(this->remote_ts,
(void**)&ts) == SUCCESS)
{
switch (ts->get_type(ts))
{
case TS_IPV4_ADDR_RANGE:
has_v4 = TRUE;
break;
case TS_IPV6_ADDR_RANGE:
has_v6 = TRUE;
break;
}
child_cfg->add_traffic_selector(child_cfg, FALSE, ts);
}
if (has_v4)
{
peer_cfg->add_virtual_ip(peer_cfg, host_create_from_string("0.0.0.0", 0));
}
if (has_v6)
{
peer_cfg->add_virtual_ip(peer_cfg, host_create_from_string("::", 0));
}
peer_cfg->add_child_cfg(peer_cfg, child_cfg->get_ref(child_cfg));
return child_cfg;
}
@@ -374,8 +428,7 @@ static job_requeue_t initiate(private_cmd_connection_t *this)
return JOB_REQUEUE_NONE;
}
child_cfg = create_child_cfg(this);
peer_cfg->add_child_cfg(peer_cfg, child_cfg->get_ref(child_cfg));
child_cfg = create_child_cfg(this, peer_cfg);
if (charon->controller->initiate(charon->controller, peer_cfg, child_cfg,
controller_cb_empty, NULL, 0) != SUCCESS)
@@ -421,6 +474,8 @@ static void set_profile(private_cmd_connection_t *this, char *name)
METHOD(cmd_connection_t, handle, bool,
private_cmd_connection_t *this, cmd_option_type_t opt, char *arg)
{
proposal_t *proposal;
switch (opt)
{
case CMD_OPT_HOST:
@@ -447,6 +502,30 @@ METHOD(cmd_connection_t, handle, bool,
case CMD_OPT_REMOTE_TS:
add_ts(this, this->remote_ts, arg);
break;
case CMD_OPT_IKE_PROPOSAL:
proposal = proposal_create_from_string(PROTO_IKE, arg);
if (!proposal)
{
exit(1);
}
this->ike_proposals->insert_last(this->ike_proposals, proposal);
break;
case CMD_OPT_ESP_PROPOSAL:
proposal = proposal_create_from_string(PROTO_ESP, arg);
if (!proposal)
{
exit(1);
}
this->child_proposals->insert_last(this->child_proposals, proposal);
break;
case CMD_OPT_AH_PROPOSAL:
proposal = proposal_create_from_string(PROTO_AH, arg);
if (!proposal)
{
exit(1);
}
this->child_proposals->insert_last(this->child_proposals, proposal);
break;
case CMD_OPT_PROFILE:
set_profile(this, arg);
break;
@@ -459,6 +538,10 @@ METHOD(cmd_connection_t, handle, bool,
METHOD(cmd_connection_t, destroy, void,
private_cmd_connection_t *this)
{
this->ike_proposals->destroy_offset(this->ike_proposals,
offsetof(proposal_t, destroy));
this->child_proposals->destroy_offset(this->child_proposals,
offsetof(proposal_t, destroy));
this->local_ts->destroy_offset(this->local_ts,
offsetof(traffic_selector_t, destroy));
this->remote_ts->destroy_offset(this->remote_ts,
@@ -481,6 +564,8 @@ cmd_connection_t *cmd_connection_create()
.pid = getpid(),
.local_ts = linked_list_create(),
.remote_ts = linked_list_create(),
.ike_proposals = linked_list_create(),
.child_proposals = linked_list_create(),
.profile = PROF_UNDEF,
);
src/charon-cmd/cmd/cmd_options.c
+6
View File
@@ -56,6 +56,12 @@ cmd_option_t cmd_options[CMD_OPT_COUNT] = {
"additional traffic selector to propose for our side", {}},
{ CMD_OPT_REMOTE_TS, "remote-ts", required_argument, "subnet",
"traffic selector to propose for remote side", {}},
{ CMD_OPT_IKE_PROPOSAL, "ike-proposal", required_argument, "proposal",
"a single IKE proposal to offer instead of the default", {}},
{ CMD_OPT_ESP_PROPOSAL, "esp-proposal", required_argument, "proposal",
"a single ESP proposal to offer instead of the default", {}},
{ CMD_OPT_AH_PROPOSAL, "ah-proposal", required_argument, "proposal",
"a single AH proposal to offer instead of the default", {}},
{ CMD_OPT_PROFILE, "profile", required_argument, "name",
"authentication profile to use, where name is one of:", {
" ikev2-pub, ikev2-eap, ikev2-pub-eap",
src/charon-cmd/cmd/cmd_options.h
+3
View File
@@ -45,6 +45,9 @@ enum cmd_option_type_t {
CMD_OPT_AGENT,
CMD_OPT_LOCAL_TS,
CMD_OPT_REMOTE_TS,
CMD_OPT_IKE_PROPOSAL,
CMD_OPT_AH_PROPOSAL,
CMD_OPT_ESP_PROPOSAL,
CMD_OPT_PROFILE,
CMD_OPT_COUNT