Annotation of embedaddon/strongswan/src/libcharon/plugins/ha/ha_child.c, revision 1.1.1.1
1.1 misho 1: /*
2: * Copyright (C) 2008 Martin Willi
3: * HSR Hochschule fuer Technik Rapperswil
4: *
5: * This program is free software; you can redistribute it and/or modify it
6: * under the terms of the GNU General Public License as published by the
7: * Free Software Foundation; either version 2 of the License, or (at your
8: * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9: *
10: * This program is distributed in the hope that it will be useful, but
11: * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12: * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13: * for more details.
14: */
15:
16: #include "ha_child.h"
17:
18: typedef struct private_ha_child_t private_ha_child_t;
19:
20: /**
21: * Private data of an ha_child_t object.
22: */
23: struct private_ha_child_t {
24:
25: /**
26: * Public ha_child_t interface.
27: */
28: ha_child_t public;
29:
30: /**
31: * socket we use for syncing
32: */
33: ha_socket_t *socket;
34:
35: /**
36: * tunnel securing sync messages
37: */
38: ha_tunnel_t *tunnel;
39:
40: /**
41: * Segment handling
42: */
43: ha_segments_t *segments;
44:
45: /**
46: * Kernel helper
47: */
48: ha_kernel_t *kernel;
49: };
50:
51: METHOD(listener_t, child_keys, bool,
52: private_ha_child_t *this, ike_sa_t *ike_sa, child_sa_t *child_sa,
53: bool initiator, diffie_hellman_t *dh, chunk_t nonce_i, chunk_t nonce_r)
54: {
55: ha_message_t *m;
56: chunk_t secret;
57: proposal_t *proposal;
58: uint16_t alg, len;
59: linked_list_t *local_ts, *remote_ts;
60: enumerator_t *enumerator;
61: traffic_selector_t *ts;
62: u_int seg_i, seg_o;
63:
64: if (this->tunnel && this->tunnel->is_sa(this->tunnel, ike_sa))
65: { /* do not sync SA between nodes */
66: return TRUE;
67: }
68:
69: m = ha_message_create(HA_CHILD_ADD);
70:
71: m->add_attribute(m, HA_IKE_ID, ike_sa->get_id(ike_sa));
72: m->add_attribute(m, HA_INITIATOR, (uint8_t)initiator);
73: m->add_attribute(m, HA_INBOUND_SPI, child_sa->get_spi(child_sa, TRUE));
74: m->add_attribute(m, HA_OUTBOUND_SPI, child_sa->get_spi(child_sa, FALSE));
75: m->add_attribute(m, HA_INBOUND_CPI, child_sa->get_cpi(child_sa, TRUE));
76: m->add_attribute(m, HA_OUTBOUND_CPI, child_sa->get_cpi(child_sa, FALSE));
77: m->add_attribute(m, HA_IPSEC_MODE, child_sa->get_mode(child_sa));
78: m->add_attribute(m, HA_IPCOMP, child_sa->get_ipcomp(child_sa));
79: m->add_attribute(m, HA_CONFIG_NAME, child_sa->get_name(child_sa));
80:
81: proposal = child_sa->get_proposal(child_sa);
82: if (proposal->get_algorithm(proposal, ENCRYPTION_ALGORITHM, &alg, &len))
83: {
84: m->add_attribute(m, HA_ALG_ENCR, alg);
85: if (len)
86: {
87: m->add_attribute(m, HA_ALG_ENCR_LEN, len);
88: }
89: }
90: if (proposal->get_algorithm(proposal, INTEGRITY_ALGORITHM, &alg, NULL))
91: {
92: m->add_attribute(m, HA_ALG_INTEG, alg);
93: }
94: if (proposal->get_algorithm(proposal, DIFFIE_HELLMAN_GROUP, &alg, NULL))
95: {
96: m->add_attribute(m, HA_ALG_DH, alg);
97: }
98: if (proposal->get_algorithm(proposal, EXTENDED_SEQUENCE_NUMBERS, &alg, NULL))
99: {
100: m->add_attribute(m, HA_ESN, alg);
101: }
102: m->add_attribute(m, HA_NONCE_I, nonce_i);
103: m->add_attribute(m, HA_NONCE_R, nonce_r);
104: if (dh && dh->get_shared_secret(dh, &secret))
105: {
106: m->add_attribute(m, HA_SECRET, secret);
107: chunk_clear(&secret);
108: }
109:
110: local_ts = linked_list_create();
111: remote_ts = linked_list_create();
112:
113: enumerator = child_sa->create_ts_enumerator(child_sa, TRUE);
114: while (enumerator->enumerate(enumerator, &ts))
115: {
116: m->add_attribute(m, HA_LOCAL_TS, ts);
117: local_ts->insert_last(local_ts, ts);
118: }
119: enumerator->destroy(enumerator);
120:
121: enumerator = child_sa->create_ts_enumerator(child_sa, FALSE);
122: while (enumerator->enumerate(enumerator, &ts))
123: {
124: m->add_attribute(m, HA_REMOTE_TS, ts);
125: remote_ts->insert_last(remote_ts, ts);
126: }
127: enumerator->destroy(enumerator);
128:
129: seg_i = this->kernel->get_segment_spi(this->kernel,
130: ike_sa->get_my_host(ike_sa), child_sa->get_spi(child_sa, TRUE));
131: seg_o = this->kernel->get_segment_spi(this->kernel,
132: ike_sa->get_other_host(ike_sa), child_sa->get_spi(child_sa, FALSE));
133: DBG1(DBG_CFG, "handling HA CHILD_SA %s{%d} %#R === %#R "
134: "(segment in: %d%s, out: %d%s)", child_sa->get_name(child_sa),
135: child_sa->get_unique_id(child_sa), local_ts, remote_ts,
136: seg_i, this->segments->is_active(this->segments, seg_i) ? "*" : "",
137: seg_o, this->segments->is_active(this->segments, seg_o) ? "*" : "");
138:
139: local_ts->destroy(local_ts);
140: remote_ts->destroy(remote_ts);
141:
142: this->socket->push(this->socket, m);
143: m->destroy(m);
144:
145: return TRUE;
146: }
147:
148: METHOD(listener_t, child_state_change, bool,
149: private_ha_child_t *this, ike_sa_t *ike_sa,
150: child_sa_t *child_sa, child_sa_state_t state)
151: {
152: if (!ike_sa ||
153: ike_sa->get_state(ike_sa) == IKE_PASSIVE ||
154: ike_sa->get_state(ike_sa) == IKE_DESTROYING)
155: { /* only sync active IKE_SAs */
156: return TRUE;
157: }
158: if (this->tunnel && this->tunnel->is_sa(this->tunnel, ike_sa))
159: { /* do not sync SA between nodes */
160: return TRUE;
161: }
162:
163:
164: if (state == CHILD_DESTROYING)
165: {
166: ha_message_t *m;
167:
168: m = ha_message_create(HA_CHILD_DELETE);
169:
170: m->add_attribute(m, HA_IKE_ID, ike_sa->get_id(ike_sa));
171: m->add_attribute(m, HA_INBOUND_SPI,
172: child_sa->get_spi(child_sa, TRUE));
173: this->socket->push(this->socket, m);
174: m->destroy(m);
175: }
176: return TRUE;
177: }
178:
179: METHOD(ha_child_t, destroy, void,
180: private_ha_child_t *this)
181: {
182: free(this);
183: }
184:
185: /**
186: * See header
187: */
188: ha_child_t *ha_child_create(ha_socket_t *socket, ha_tunnel_t *tunnel,
189: ha_segments_t *segments, ha_kernel_t *kernel)
190: {
191: private_ha_child_t *this;
192:
193: INIT(this,
194: .public = {
195: .listener = {
196: .child_keys = _child_keys,
197: .child_state_change = _child_state_change,
198: },
199: .destroy = _destroy,
200: },
201: .socket = socket,
202: .tunnel = tunnel,
203: .segments = segments,
204: .kernel = kernel,
205: );
206:
207: return &this->public;
208: }
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to ha_child.c CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / strongswan / src / libcharon / plugins / ha