This introduces support for specifying optional IKE SA specific source and remote address for child sa initiation. This allows to initiate wildcard connection for known address via vici.
Signed-off-by: Timo Teräs <[email protected]> --- In addition this allows simpler implementation of trap-any patches and functionality like this is a prerequisite for dmvpn support. src/charon-cmd/cmd/cmd_connection.c | 2 +- src/charon-nm/nm/nm_service.c | 2 +- .../jni/libandroidbridge/backend/android_service.c | 2 +- src/libcharon/control/controller.c | 21 +++++++++++- src/libcharon/control/controller.h | 3 ++ src/libcharon/plugins/maemo/maemo_service.c | 2 +- src/libcharon/plugins/stroke/stroke_control.c | 5 +-- src/libcharon/plugins/vici/vici_config.c | 2 +- src/libcharon/plugins/vici/vici_control.c | 36 ++++++++++++++++---- src/libcharon/processing/jobs/start_action_job.c | 2 +- src/libcharon/sa/ike_sa.c | 4 +++ src/libcharon/sa/ike_sa_manager.c | 38 ++++++++++++++++++---- src/libcharon/sa/ike_sa_manager.h | 8 +++-- src/libcharon/sa/trap_manager.c | 3 +- src/swanctl/commands/initiate.c | 18 +++++++++- 15 files changed, 122 insertions(+), 26 deletions(-) diff --git a/src/charon-cmd/cmd/cmd_connection.c b/src/charon-cmd/cmd/cmd_connection.c index 2c0b7b9..471b444 100644 --- a/src/charon-cmd/cmd/cmd_connection.c +++ b/src/charon-cmd/cmd/cmd_connection.c @@ -434,7 +434,7 @@ static job_requeue_t initiate(private_cmd_connection_t *this) child_cfg = create_child_cfg(this, peer_cfg); if (charon->controller->initiate(charon->controller, peer_cfg, child_cfg, - controller_cb_empty, NULL, 0) != SUCCESS) + NULL, NULL, controller_cb_empty, NULL, 0) != SUCCESS) { terminate(pid); } diff --git a/src/charon-nm/nm/nm_service.c b/src/charon-nm/nm/nm_service.c index fc7e899..4f4461a 100644 --- a/src/charon-nm/nm/nm_service.c +++ b/src/charon-nm/nm/nm_service.c @@ -579,7 +579,7 @@ static gboolean connect_(NMVPNPlugin *plugin, NMConnection *connection, * Prepare IKE_SA */ ike_sa = charon->ike_sa_manager->checkout_by_config(charon->ike_sa_manager, - peer_cfg); + peer_cfg, NULL, NULL); if (!ike_sa) { peer_cfg->destroy(peer_cfg); diff --git a/src/frontends/android/jni/libandroidbridge/backend/android_service.c b/src/frontends/android/jni/libandroidbridge/backend/android_service.c index e60c491..920081f 100644 --- a/src/frontends/android/jni/libandroidbridge/backend/android_service.c +++ b/src/frontends/android/jni/libandroidbridge/backend/android_service.c @@ -709,7 +709,7 @@ static job_requeue_t initiate(private_android_service_t *this) /* get us an IKE_SA */ ike_sa = charon->ike_sa_manager->checkout_by_config(charon->ike_sa_manager, - peer_cfg); + peer_cfg, NULL, NULL); if (!ike_sa) { peer_cfg->destroy(peer_cfg); diff --git a/src/libcharon/control/controller.c b/src/libcharon/control/controller.c index 25667e5..b05b2b1 100644 --- a/src/libcharon/control/controller.c +++ b/src/libcharon/control/controller.c @@ -103,6 +103,16 @@ struct interface_listener_t { ike_sa_t *ike_sa; /** + * Our host hint. + */ + host_t *my_host; + + /** + * Other host hint. + */ + host_t *other_host; + + /** * unique ID, used for various methods */ u_int32_t id; @@ -338,9 +348,14 @@ METHOD(job_t, initiate_execute, job_requeue_t, ike_sa_t *ike_sa; interface_listener_t *listener = &job->listener; peer_cfg_t *peer_cfg = listener->peer_cfg; + host_t *my_host = listener->my_host; + host_t *other_host = listener->other_host; ike_sa = charon->ike_sa_manager->checkout_by_config(charon->ike_sa_manager, - peer_cfg); + peer_cfg, my_host, other_host); + DESTROY_IF(my_host); + DESTROY_IF(other_host); + if (!ike_sa) { listener->child_cfg->destroy(listener->child_cfg); @@ -350,6 +365,7 @@ METHOD(job_t, initiate_execute, job_requeue_t, listener_done(listener); return JOB_REQUEUE_NONE; } + listener->lock->lock(listener->lock); listener->ike_sa = ike_sa; listener->lock->unlock(listener->lock); @@ -379,6 +395,7 @@ METHOD(job_t, initiate_execute, job_requeue_t, METHOD(controller_t, initiate, status_t, private_controller_t *this, peer_cfg_t *peer_cfg, child_cfg_t *child_cfg, + host_t *my_host, host_t *other_host, controller_cb_t callback, void *param, u_int timeout) { interface_job_t *job; @@ -401,6 +418,8 @@ METHOD(controller_t, initiate, status_t, .status = FAILED, .child_cfg = child_cfg, .peer_cfg = peer_cfg, + .my_host = my_host ? my_host->clone(my_host) : NULL, + .other_host = other_host ? other_host->clone(other_host) : NULL, .lock = spinlock_create(), }, .public = { diff --git a/src/libcharon/control/controller.h b/src/libcharon/control/controller.h index 222285c..3d4ea67 100644 --- a/src/libcharon/control/controller.h +++ b/src/libcharon/control/controller.h @@ -79,6 +79,8 @@ struct controller_t { * * @param peer_cfg peer_cfg to use for IKE_SA setup * @param child_cfg child_cfg to set up CHILD_SA from + * @param my_host optional address hint for source + * @param other_host optional address hint for destination * @param cb logging callback * @param param parameter to include in each call of cb * @param timeout timeout in ms to wait for callbacks, 0 to disable @@ -90,6 +92,7 @@ struct controller_t { */ status_t (*initiate)(controller_t *this, peer_cfg_t *peer_cfg, child_cfg_t *child_cfg, + host_t *my_host, host_t *other_host, controller_cb_t callback, void *param, u_int timeout); /** diff --git a/src/libcharon/plugins/maemo/maemo_service.c b/src/libcharon/plugins/maemo/maemo_service.c index 2e96f8f..e594a71 100644 --- a/src/libcharon/plugins/maemo/maemo_service.c +++ b/src/libcharon/plugins/maemo/maemo_service.c @@ -362,7 +362,7 @@ static gboolean initiate_connection(private_maemo_service_t *this, /* get us an IKE_SA */ ike_sa = charon->ike_sa_manager->checkout_by_config(charon->ike_sa_manager, - peer_cfg); + peer_cfg, NULL, NULL); if (!ike_sa) { peer_cfg->destroy(peer_cfg); diff --git a/src/libcharon/plugins/stroke/stroke_control.c b/src/libcharon/plugins/stroke/stroke_control.c index f770d7c..0da9d26 100644 --- a/src/libcharon/plugins/stroke/stroke_control.c +++ b/src/libcharon/plugins/stroke/stroke_control.c @@ -109,7 +109,7 @@ static void charon_initiate(private_stroke_control_t *this, peer_cfg_t *peer_cfg if (msg->output_verbosity < 0) { charon->controller->initiate(charon->controller, peer_cfg, child_cfg, - NULL, NULL, 0); + NULL, NULL, NULL, NULL, 0); } else { @@ -117,7 +117,8 @@ static void charon_initiate(private_stroke_control_t *this, peer_cfg_t *peer_cfg status_t status; status = charon->controller->initiate(charon->controller, - peer_cfg, child_cfg, (controller_cb_t)stroke_log, + peer_cfg, child_cfg, NULL, NULL, + (controller_cb_t)stroke_log, &info, this->timeout); switch (status) { diff --git a/src/libcharon/plugins/vici/vici_config.c b/src/libcharon/plugins/vici/vici_config.c index 113d480..a69039d 100644 --- a/src/libcharon/plugins/vici/vici_config.c +++ b/src/libcharon/plugins/vici/vici_config.c @@ -1521,7 +1521,7 @@ static void run_start_action(private_vici_config_t *this, peer_cfg_t *peer_cfg, DBG1(DBG_CFG, "initiating '%s'", child_cfg->get_name(child_cfg)); charon->controller->initiate(charon->controller, peer_cfg->get_ref(peer_cfg), child_cfg->get_ref(child_cfg), - NULL, NULL, 0); + NULL, NULL, NULL, NULL, 0); break; case ACTION_ROUTE: DBG1(DBG_CFG, "installing '%s'", child_cfg->get_name(child_cfg)); diff --git a/src/libcharon/plugins/vici/vici_control.c b/src/libcharon/plugins/vici/vici_control.c index 3cd0081..eb8bc81 100644 --- a/src/libcharon/plugins/vici/vici_control.c +++ b/src/libcharon/plugins/vici/vici_control.c @@ -159,9 +159,11 @@ static child_cfg_t* find_child_cfg(char *name, peer_cfg_t **out) CALLBACK(initiate, vici_message_t*, private_vici_control_t *this, char *name, u_int id, vici_message_t *request) { + vici_message_t* msg; child_cfg_t *child_cfg = NULL; peer_cfg_t *peer_cfg; - char *child; + host_t *my_host = NULL, *other_host = NULL; + char *child, *my_host_str, *other_host_str; u_int timeout; log_info_t log = { .dispatcher = this->dispatcher, @@ -171,31 +173,51 @@ CALLBACK(initiate, vici_message_t*, child = request->get_str(request, NULL, "child"); timeout = request->get_int(request, 0, "timeout"); log.level = request->get_int(request, 1, "loglevel"); + my_host_str = request->get_str(request, NULL, "my-host"); + other_host_str = request->get_str(request, NULL, "other-host"); if (!child) { return send_reply(this, "missing configuration name"); } - DBG1(DBG_CFG, "vici initiate '%s'", child); + if (my_host_str) + { + my_host = host_create_from_string(my_host_str, 0); + } + if (other_host_str) + { + other_host = host_create_from_string(other_host_str, 0); + } + + DBG1(DBG_CFG, "vici initiate '%s', me %H, other %H", child, my_host, other_host); child_cfg = find_child_cfg(child, &peer_cfg); if (!child_cfg) { - return send_reply(this, "CHILD_SA config '%s' not found", child); + msg = send_reply(this, "CHILD_SA config '%s' not found", child); + goto ret; } switch (charon->controller->initiate(charon->controller, - peer_cfg, child_cfg, (controller_cb_t)log_vici, &log, timeout)) + peer_cfg, child_cfg, my_host, other_host, + (controller_cb_t)log_vici, &log, timeout)) { case SUCCESS: - return send_reply(this, NULL); + msg = send_reply(this, NULL); + break; case OUT_OF_RES: - return send_reply(this, "CHILD_SA '%s' not established after %dms", + msg = send_reply(this, "CHILD_SA '%s' not established after %dms", child, timeout); + break; case FAILED: default: - return send_reply(this, "establishing CHILD_SA '%s' failed", child); + msg = send_reply(this, "establishing CHILD_SA '%s' failed", child); + break; } +ret: + if (my_host) my_host->destroy(my_host); + if (other_host) other_host->destroy(other_host); + return msg; } CALLBACK(terminate, vici_message_t*, diff --git a/src/libcharon/processing/jobs/start_action_job.c b/src/libcharon/processing/jobs/start_action_job.c index 981473b..fd42f3b 100644 --- a/src/libcharon/processing/jobs/start_action_job.c +++ b/src/libcharon/processing/jobs/start_action_job.c @@ -61,7 +61,7 @@ METHOD(job_t, execute, job_requeue_t, charon->controller->initiate(charon->controller, peer_cfg->get_ref(peer_cfg), child_cfg->get_ref(child_cfg), - NULL, NULL, 0); + NULL, NULL, NULL, NULL, 0); break; case ACTION_ROUTE: DBG1(DBG_JOB, "start action: route '%s'", name); diff --git a/src/libcharon/sa/ike_sa.c b/src/libcharon/sa/ike_sa.c index fddd83c..eb1c066 100644 --- a/src/libcharon/sa/ike_sa.c +++ b/src/libcharon/sa/ike_sa.c @@ -1108,6 +1108,10 @@ static void resolve_hosts(private_ike_sa_t *this) else { host = this->ike_cfg->resolve_other(this->ike_cfg, family); + if (host->is_anyaddr(host)) + { + host = NULL; + } } if (host) { diff --git a/src/libcharon/sa/ike_sa_manager.c b/src/libcharon/sa/ike_sa_manager.c index 8e68e7b..fffdb81 100644 --- a/src/libcharon/sa/ike_sa_manager.c +++ b/src/libcharon/sa/ike_sa_manager.c @@ -1337,16 +1337,28 @@ METHOD(ike_sa_manager_t, checkout_by_message, ike_sa_t*, } METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*, - private_ike_sa_manager_t *this, peer_cfg_t *peer_cfg) + private_ike_sa_manager_t *this, peer_cfg_t *peer_cfg, + host_t *my_host, host_t *other_host) { enumerator_t *enumerator; entry_t *entry; - ike_sa_t *ike_sa = NULL; + ike_sa_t *ike_sa; peer_cfg_t *current_peer; ike_cfg_t *current_ike; u_int segment; + bool matched = FALSE; + + if (my_host && my_host->get_port(my_host) == 0) + { + my_host->set_port(my_host, IKEV2_UDP_PORT); + } + if (other_host && other_host->get_port(other_host) == 0) + { + other_host->set_port(other_host, IKEV2_UDP_PORT); + } - DBG2(DBG_MGR, "checkout IKE_SA by config"); + DBG2(DBG_MGR, "checkout IKE_SA by config '%s', me %H, other %H", + peer_cfg->get_name(peer_cfg), my_host, other_host); if (!this->reuse_ikesa) { /* IKE_SA reuse disable by config */ @@ -1367,14 +1379,24 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*, continue; } - current_peer = entry->ike_sa->get_peer_cfg(entry->ike_sa); + ike_sa = entry->ike_sa; + if (my_host && !my_host->ip_equals(my_host, ike_sa->get_my_host(ike_sa))) + { + continue; + } + if (other_host && !other_host->ip_equals(other_host, ike_sa->get_other_host(ike_sa))) + { + continue; + } + + current_peer = ike_sa->get_peer_cfg(ike_sa); if (current_peer && current_peer->equals(current_peer, peer_cfg)) { current_ike = current_peer->get_ike_cfg(current_peer); if (current_ike->equals(current_ike, peer_cfg->get_ike_cfg(peer_cfg))) { entry->checked_out = TRUE; - ike_sa = entry->ike_sa; + matched = TRUE; DBG2(DBG_MGR, "found existing IKE_SA %u with a '%s' config", ike_sa->get_unique_id(ike_sa), current_peer->get_name(current_peer)); @@ -1384,9 +1406,13 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*, } enumerator->destroy(enumerator); - if (!ike_sa) + if (!matched) { /* no IKE_SA using such a config, hand out a new */ ike_sa = checkout_new(this, peer_cfg->get_ike_version(peer_cfg), TRUE); + if (my_host || other_host) + { + ike_sa->update_hosts(ike_sa, my_host, other_host, TRUE); + } } charon->bus->set_sa(charon->bus, ike_sa); return ike_sa; diff --git a/src/libcharon/sa/ike_sa_manager.h b/src/libcharon/sa/ike_sa_manager.h index a68ae77..2f17def 100644 --- a/src/libcharon/sa/ike_sa_manager.h +++ b/src/libcharon/sa/ike_sa_manager.h @@ -83,7 +83,8 @@ struct ike_sa_manager_t { ike_sa_t* (*checkout_by_message) (ike_sa_manager_t* this, message_t *message); /** - * Checkout an IKE_SA for initiation by a peer_config. + * Checkout an IKE_SA for initiation by a peer_config and optional + * source and remote host addresses. * * To initiate, a CHILD_SA may be established within an existing IKE_SA. * This call checks for an existing IKE_SA by comparing the configuration. @@ -93,10 +94,13 @@ struct ike_sa_manager_t { * the found IKE_SA is in the DELETING state. * * @param peer_cfg configuration used to find an existing IKE_SA + * @param my_host source host address for wildcard peer_cfg + * @param other_host remote host address for wildcard peer_cfg * @return checked out/created IKE_SA */ ike_sa_t* (*checkout_by_config) (ike_sa_manager_t* this, - peer_cfg_t *peer_cfg); + peer_cfg_t *peer_cfg, + host_t *my_host, host_t *other_host); /** * Check for duplicates of the given IKE_SA. diff --git a/src/libcharon/sa/trap_manager.c b/src/libcharon/sa/trap_manager.c index 7e55d6b..9e933d1 100644 --- a/src/libcharon/sa/trap_manager.c +++ b/src/libcharon/sa/trap_manager.c @@ -346,7 +346,8 @@ METHOD(trap_manager_t, acquire, void, this->lock->unlock(this->lock); ike_sa = charon->ike_sa_manager->checkout_by_config( - charon->ike_sa_manager, peer); + charon->ike_sa_manager, peer, + NULL, NULL); if (ike_sa) { if (ike_sa->get_peer_cfg(ike_sa) == NULL) diff --git a/src/swanctl/commands/initiate.c b/src/swanctl/commands/initiate.c index 080dc41..ced8f39 100644 --- a/src/swanctl/commands/initiate.c +++ b/src/swanctl/commands/initiate.c @@ -37,7 +37,7 @@ static int initiate(vici_conn_t *conn) vici_req_t *req; vici_res_t *res; command_format_options_t format = COMMAND_FORMAT_NONE; - char *arg, *child = NULL; + char *arg, *child = NULL, *my_host = NULL, *other_host = NULL; int ret = 0, timeout = 0, level = 1; while (TRUE) @@ -61,6 +61,12 @@ static int initiate(vici_conn_t *conn) case 'l': level = atoi(arg); continue; + case 'S': + my_host = arg; + continue; + case 'R': + other_host = arg; + continue; case EOF: break; default: @@ -79,6 +85,14 @@ static int initiate(vici_conn_t *conn) { vici_add_key_valuef(req, "child", "%s", child); } + if (my_host) + { + vici_add_key_valuef(req, "my-host", "%s", my_host); + } + if (other_host) + { + vici_add_key_valuef(req, "other-host", "%s", other_host); + } if (timeout) { vici_add_key_valuef(req, "timeout", "%d", timeout * 1000); @@ -123,6 +137,8 @@ static void __attribute__ ((constructor))reg() { {"help", 'h', 0, "show usage information"}, {"child", 'c', 1, "initate a CHILD_SA configuration"}, + {"source", 'S', 1, "override source address"}, + {"remote", 'R', 1, "override remote address"}, {"timeout", 't', 1, "timeout in seconds before detaching"}, {"raw", 'r', 0, "dump raw response message"}, {"pretty", 'P', 0, "dump raw response message in pretty print"}, -- 2.1.0 _______________________________________________ Dev mailing list [email protected] https://lists.strongswan.org/mailman/listinfo/dev
