summaryrefslogtreecommitdiff
path: root/src/charon
diff options
context:
space:
mode:
Diffstat (limited to 'src/charon')
-rw-r--r--src/charon/Makefile.am55
-rw-r--r--src/charon/Makefile.in839
-rw-r--r--src/charon/bus/bus.c164
-rw-r--r--src/charon/bus/bus.h49
-rw-r--r--src/charon/bus/listeners/file_logger.c16
-rw-r--r--src/charon/bus/listeners/file_logger.h6
-rw-r--r--src/charon/bus/listeners/listener.h29
-rw-r--r--src/charon/bus/listeners/sys_logger.c16
-rw-r--r--src/charon/bus/listeners/sys_logger.h6
-rw-r--r--src/charon/config/attributes/attribute_handler.h58
-rw-r--r--src/charon/config/attributes/attribute_manager.c267
-rw-r--r--src/charon/config/attributes/attribute_manager.h135
-rw-r--r--src/charon/config/attributes/attribute_provider.h67
-rw-r--r--src/charon/config/auth_cfg.c56
-rw-r--r--src/charon/config/auth_cfg.h24
-rw-r--r--src/charon/config/backend_manager.c67
-rw-r--r--src/charon/config/backend_manager.h14
-rw-r--r--src/charon/config/child_cfg.c143
-rw-r--r--src/charon/config/child_cfg.h146
-rw-r--r--src/charon/config/ike_cfg.c44
-rw-r--r--src/charon/config/ike_cfg.h48
-rw-r--r--src/charon/config/peer_cfg.c90
-rw-r--r--src/charon/config/peer_cfg.h90
-rw-r--r--src/charon/config/proposal.c131
-rw-r--r--src/charon/config/proposal.h63
-rw-r--r--src/charon/config/traffic_selector.c856
-rw-r--r--src/charon/config/traffic_selector.h304
-rw-r--r--src/charon/control/controller.c62
-rw-r--r--src/charon/control/controller.h12
-rw-r--r--src/charon/credentials/credential_manager.c337
-rw-r--r--src/charon/credentials/credential_manager.h36
-rw-r--r--src/charon/credentials/credential_set.h12
-rw-r--r--src/charon/credentials/sets/auth_cfg_wrapper.c24
-rw-r--r--src/charon/credentials/sets/auth_cfg_wrapper.h8
-rw-r--r--src/charon/credentials/sets/cert_cache.c46
-rw-r--r--src/charon/credentials/sets/cert_cache.h6
-rw-r--r--src/charon/credentials/sets/ocsp_response_wrapper.c14
-rw-r--r--src/charon/credentials/sets/ocsp_response_wrapper.h8
-rw-r--r--src/charon/daemon.c160
-rw-r--r--src/charon/daemon.h119
-rw-r--r--src/charon/encoding/generator.c172
-rw-r--r--src/charon/encoding/generator.h10
-rw-r--r--src/charon/encoding/message.c480
-rw-r--r--src/charon/encoding/message.h114
-rw-r--r--src/charon/encoding/parser.c44
-rw-r--r--src/charon/encoding/parser.h16
-rw-r--r--src/charon/encoding/payloads/auth_payload.c30
-rw-r--r--src/charon/encoding/payloads/auth_payload.h20
-rw-r--r--src/charon/encoding/payloads/cert_payload.c43
-rw-r--r--src/charon/encoding/payloads/cert_payload.h30
-rw-r--r--src/charon/encoding/payloads/certreq_payload.c26
-rw-r--r--src/charon/encoding/payloads/certreq_payload.h10
-rw-r--r--src/charon/encoding/payloads/configuration_attribute.c217
-rw-r--r--src/charon/encoding/payloads/configuration_attribute.h99
-rw-r--r--src/charon/encoding/payloads/cp_payload.c159
-rw-r--r--src/charon/encoding/payloads/cp_payload.h61
-rw-r--r--src/charon/encoding/payloads/delete_payload.c34
-rw-r--r--src/charon/encoding/payloads/delete_payload.h10
-rw-r--r--src/charon/encoding/payloads/eap_payload.c197
-rw-r--r--src/charon/encoding/payloads/eap_payload.h16
-rw-r--r--src/charon/encoding/payloads/encodings.h378
-rw-r--r--src/charon/encoding/payloads/encryption_payload.c132
-rw-r--r--src/charon/encoding/payloads/encryption_payload.h44
-rw-r--r--src/charon/encoding/payloads/endpoint_notify.c90
-rw-r--r--src/charon/encoding/payloads/endpoint_notify.h62
-rw-r--r--src/charon/encoding/payloads/id_payload.c34
-rw-r--r--src/charon/encoding/payloads/id_payload.h26
-rw-r--r--src/charon/encoding/payloads/ike_header.c83
-rw-r--r--src/charon/encoding/payloads/ike_header.h41
-rw-r--r--src/charon/encoding/payloads/ke_payload.c54
-rw-r--r--src/charon/encoding/payloads/ke_payload.h22
-rw-r--r--src/charon/encoding/payloads/nonce_payload.c48
-rw-r--r--src/charon/encoding/payloads/nonce_payload.h10
-rw-r--r--src/charon/encoding/payloads/notify_payload.c96
-rw-r--r--src/charon/encoding/payloads/notify_payload.h54
-rw-r--r--src/charon/encoding/payloads/payload.h64
-rw-r--r--src/charon/encoding/payloads/proposal_substructure.c106
-rw-r--r--src/charon/encoding/payloads/proposal_substructure.h36
-rw-r--r--src/charon/encoding/payloads/sa_payload.c74
-rw-r--r--src/charon/encoding/payloads/sa_payload.h26
-rw-r--r--src/charon/encoding/payloads/traffic_selector_substructure.c46
-rw-r--r--src/charon/encoding/payloads/traffic_selector_substructure.h48
-rw-r--r--src/charon/encoding/payloads/transform_attribute.c50
-rw-r--r--src/charon/encoding/payloads/transform_attribute.h34
-rw-r--r--src/charon/encoding/payloads/transform_substructure.c80
-rw-r--r--src/charon/encoding/payloads/transform_substructure.h50
-rw-r--r--src/charon/encoding/payloads/ts_payload.c54
-rw-r--r--src/charon/encoding/payloads/ts_payload.h32
-rw-r--r--src/charon/encoding/payloads/unknown_payload.c28
-rw-r--r--src/charon/encoding/payloads/unknown_payload.h14
-rw-r--r--src/charon/encoding/payloads/vendor_id_payload.c99
-rw-r--r--src/charon/encoding/payloads/vendor_id_payload.h49
-rw-r--r--src/charon/kernel/kernel_interface.c53
-rw-r--r--src/charon/kernel/kernel_interface.h106
-rw-r--r--src/charon/kernel/kernel_ipsec.c2
-rw-r--r--src/charon/kernel/kernel_ipsec.h82
-rw-r--r--src/charon/kernel/kernel_net.h26
-rw-r--r--src/charon/network/packet.c16
-rw-r--r--src/charon/network/packet.h46
-rw-r--r--src/charon/network/receiver.c84
-rw-r--r--src/charon/network/receiver.h12
-rw-r--r--src/charon/network/sender.c39
-rw-r--r--src/charon/network/sender.h10
-rw-r--r--src/charon/network/socket-raw.c106
-rw-r--r--src/charon/network/socket.c93
-rw-r--r--src/charon/network/socket.h28
-rw-r--r--src/charon/plugins/attr/Makefile.in143
-rw-r--r--src/charon/plugins/attr/attr_plugin.c14
-rw-r--r--src/charon/plugins/attr/attr_plugin.h2
-rw-r--r--src/charon/plugins/attr/attr_provider.c118
-rw-r--r--src/charon/plugins/attr/attr_provider.h6
-rw-r--r--src/charon/plugins/eap_aka/Makefile.am13
-rw-r--r--src/charon/plugins/eap_aka/Makefile.in183
-rw-r--r--src/charon/plugins/eap_aka/eap_aka.c1553
-rw-r--r--src/charon/plugins/eap_aka/eap_aka.h81
-rw-r--r--src/charon/plugins/eap_aka/eap_aka_peer.c583
-rw-r--r--src/charon/plugins/eap_aka/eap_aka_peer.h49
-rw-r--r--src/charon/plugins/eap_aka/eap_aka_plugin.c19
-rw-r--r--src/charon/plugins/eap_aka/eap_aka_plugin.h7
-rw-r--r--src/charon/plugins/eap_aka/eap_aka_server.c700
-rw-r--r--src/charon/plugins/eap_aka/eap_aka_server.h49
-rw-r--r--src/charon/plugins/eap_aka_3gpp2/Makefile.am15
-rw-r--r--src/charon/plugins/eap_aka_3gpp2/Makefile.in579
-rw-r--r--src/charon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_card.c178
-rw-r--r--src/charon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_card.h53
-rw-r--r--src/charon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_functions.c394
-rw-r--r--src/charon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_functions.h125
-rw-r--r--src/charon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_plugin.c87
-rw-r--r--src/charon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_plugin.h62
-rw-r--r--src/charon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_provider.c204
-rw-r--r--src/charon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_provider.h52
-rw-r--r--src/charon/plugins/eap_gtc/Makefile.am6
-rw-r--r--src/charon/plugins/eap_gtc/Makefile.in169
-rw-r--r--src/charon/plugins/eap_gtc/eap_gtc.c54
-rw-r--r--src/charon/plugins/eap_gtc/eap_gtc_plugin.c8
-rw-r--r--src/charon/plugins/eap_identity/Makefile.am6
-rw-r--r--src/charon/plugins/eap_identity/Makefile.in171
-rw-r--r--src/charon/plugins/eap_identity/eap_identity.c32
-rw-r--r--src/charon/plugins/eap_identity/eap_identity_plugin.c6
-rw-r--r--src/charon/plugins/eap_md5/Makefile.am6
-rw-r--r--src/charon/plugins/eap_md5/Makefile.in169
-rw-r--r--src/charon/plugins/eap_md5/eap_md5.c52
-rw-r--r--src/charon/plugins/eap_md5/eap_md5_plugin.c6
-rw-r--r--src/charon/plugins/eap_mschapv2/Makefile.am6
-rw-r--r--src/charon/plugins/eap_mschapv2/Makefile.in171
-rw-r--r--src/charon/plugins/eap_mschapv2/eap_mschapv2.c317
-rw-r--r--src/charon/plugins/eap_mschapv2/eap_mschapv2_plugin.c6
-rw-r--r--src/charon/plugins/eap_radius/Makefile.am6
-rw-r--r--src/charon/plugins/eap_radius/Makefile.in169
-rw-r--r--src/charon/plugins/eap_radius/eap_radius.c76
-rw-r--r--src/charon/plugins/eap_radius/eap_radius_plugin.c8
-rw-r--r--src/charon/plugins/eap_radius/radius_client.c69
-rw-r--r--src/charon/plugins/eap_radius/radius_client.h8
-rw-r--r--src/charon/plugins/eap_radius/radius_message.c33
-rw-r--r--src/charon/plugins/eap_radius/radius_message.h20
-rw-r--r--src/charon/plugins/eap_sim/Makefile.am15
-rw-r--r--src/charon/plugins/eap_sim/Makefile.in184
-rw-r--r--src/charon/plugins/eap_sim/eap_sim.c1149
-rw-r--r--src/charon/plugins/eap_sim/eap_sim_peer.c654
-rw-r--r--src/charon/plugins/eap_sim/eap_sim_peer.h57
-rw-r--r--src/charon/plugins/eap_sim/eap_sim_plugin.c19
-rw-r--r--src/charon/plugins/eap_sim/eap_sim_server.c611
-rw-r--r--src/charon/plugins/eap_sim/eap_sim_server.h (renamed from src/charon/plugins/eap_sim/eap_sim.h)44
-rw-r--r--src/charon/plugins/eap_sim_file/Makefile.am8
-rw-r--r--src/charon/plugins/eap_sim_file/Makefile.in173
-rw-r--r--src/charon/plugins/eap_sim_file/eap_sim_file_card.c71
-rw-r--r--src/charon/plugins/eap_sim_file/eap_sim_file_card.h4
-rw-r--r--src/charon/plugins/eap_sim_file/eap_sim_file_plugin.c24
-rw-r--r--src/charon/plugins/eap_sim_file/eap_sim_file_provider.c43
-rw-r--r--src/charon/plugins/eap_sim_file/eap_sim_file_provider.h6
-rw-r--r--src/charon/plugins/eap_sim_file/eap_sim_file_triplets.c58
-rw-r--r--src/charon/plugins/eap_sim_file/eap_sim_file_triplets.h20
-rw-r--r--src/charon/plugins/eap_simaka_pseudonym/Makefile.am13
-rw-r--r--src/charon/plugins/eap_simaka_pseudonym/Makefile.in577
-rw-r--r--src/charon/plugins/eap_simaka_pseudonym/eap_simaka_pseudonym_card.c154
-rw-r--r--src/charon/plugins/eap_simaka_pseudonym/eap_simaka_pseudonym_card.h49
-rw-r--r--src/charon/plugins/eap_simaka_pseudonym/eap_simaka_pseudonym_plugin.c81
-rw-r--r--src/charon/plugins/eap_simaka_pseudonym/eap_simaka_pseudonym_plugin.h47
-rw-r--r--src/charon/plugins/eap_simaka_pseudonym/eap_simaka_pseudonym_provider.c182
-rw-r--r--src/charon/plugins/eap_simaka_pseudonym/eap_simaka_pseudonym_provider.h49
-rw-r--r--src/charon/plugins/eap_simaka_reauth/Makefile.am13
-rw-r--r--src/charon/plugins/eap_simaka_reauth/Makefile.in576
-rw-r--r--src/charon/plugins/eap_simaka_reauth/eap_simaka_reauth_card.c170
-rw-r--r--src/charon/plugins/eap_simaka_reauth/eap_simaka_reauth_card.h49
-rw-r--r--src/charon/plugins/eap_simaka_reauth/eap_simaka_reauth_plugin.c79
-rw-r--r--src/charon/plugins/eap_simaka_reauth/eap_simaka_reauth_plugin.h47
-rw-r--r--src/charon/plugins/eap_simaka_reauth/eap_simaka_reauth_provider.c209
-rw-r--r--src/charon/plugins/eap_simaka_reauth/eap_simaka_reauth_provider.h49
-rw-r--r--src/charon/plugins/kernel_klips/Makefile.am2
-rw-r--r--src/charon/plugins/kernel_klips/Makefile.in145
-rw-r--r--src/charon/plugins/kernel_klips/kernel_klips_ipsec.c618
-rw-r--r--src/charon/plugins/kernel_klips/kernel_klips_plugin.c6
-rw-r--r--src/charon/plugins/kernel_klips/pfkeyv2.h4
-rw-r--r--src/charon/plugins/kernel_netlink/Makefile.am6
-rw-r--r--src/charon/plugins/kernel_netlink/Makefile.in150
-rw-r--r--src/charon/plugins/kernel_netlink/kernel_netlink_ipsec.c591
-rw-r--r--src/charon/plugins/kernel_netlink/kernel_netlink_net.c384
-rw-r--r--src/charon/plugins/kernel_netlink/kernel_netlink_plugin.c6
-rw-r--r--src/charon/plugins/kernel_netlink/kernel_netlink_shared.c58
-rw-r--r--src/charon/plugins/kernel_netlink/kernel_netlink_shared.h12
-rw-r--r--src/charon/plugins/kernel_pfkey/Makefile.am2
-rw-r--r--src/charon/plugins/kernel_pfkey/Makefile.in145
-rw-r--r--src/charon/plugins/kernel_pfkey/kernel_pfkey_ipsec.c392
-rw-r--r--src/charon/plugins/kernel_pfkey/kernel_pfkey_plugin.c6
-rw-r--r--src/charon/plugins/kernel_pfroute/Makefile.am2
-rw-r--r--src/charon/plugins/kernel_pfroute/Makefile.in145
-rw-r--r--src/charon/plugins/kernel_pfroute/kernel_pfroute_net.c131
-rw-r--r--src/charon/plugins/kernel_pfroute/kernel_pfroute_plugin.c6
-rw-r--r--src/charon/plugins/load_tester/Makefile.in143
-rw-r--r--src/charon/plugins/load_tester/load_tester_config.c75
-rw-r--r--src/charon/plugins/load_tester/load_tester_config.h4
-rw-r--r--src/charon/plugins/load_tester/load_tester_creds.c65
-rw-r--r--src/charon/plugins/load_tester/load_tester_creds.h4
-rw-r--r--src/charon/plugins/load_tester/load_tester_diffie_hellman.c8
-rw-r--r--src/charon/plugins/load_tester/load_tester_diffie_hellman.h6
-rw-r--r--src/charon/plugins/load_tester/load_tester_ipsec.c29
-rw-r--r--src/charon/plugins/load_tester/load_tester_listener.c20
-rw-r--r--src/charon/plugins/load_tester/load_tester_listener.h4
-rw-r--r--src/charon/plugins/load_tester/load_tester_plugin.c59
-rw-r--r--src/charon/plugins/load_tester/load_tester_plugin.h2
-rw-r--r--src/charon/plugins/medcli/Makefile.in143
-rw-r--r--src/charon/plugins/medcli/medcli_config.c85
-rw-r--r--src/charon/plugins/medcli/medcli_config.h4
-rw-r--r--src/charon/plugins/medcli/medcli_creds.c18
-rw-r--r--src/charon/plugins/medcli/medcli_creds.h4
-rw-r--r--src/charon/plugins/medcli/medcli_listener.c10
-rw-r--r--src/charon/plugins/medcli/medcli_listener.h4
-rw-r--r--src/charon/plugins/medcli/medcli_plugin.c20
-rw-r--r--src/charon/plugins/medsrv/Makefile.in143
-rw-r--r--src/charon/plugins/medsrv/medsrv_config.c20
-rw-r--r--src/charon/plugins/medsrv/medsrv_config.h4
-rw-r--r--src/charon/plugins/medsrv/medsrv_creds.c12
-rw-r--r--src/charon/plugins/medsrv/medsrv_creds.h4
-rw-r--r--src/charon/plugins/medsrv/medsrv_plugin.c18
-rw-r--r--src/charon/plugins/nm/Makefile.am3
-rw-r--r--src/charon/plugins/nm/Makefile.in147
-rw-r--r--src/charon/plugins/nm/nm_creds.c240
-rw-r--r--src/charon/plugins/nm/nm_creds.h15
-rw-r--r--src/charon/plugins/nm/nm_handler.c69
-rw-r--r--src/charon/plugins/nm/nm_handler.h10
-rw-r--r--src/charon/plugins/nm/nm_plugin.c26
-rw-r--r--src/charon/plugins/nm/nm_service.c168
-rw-r--r--src/charon/plugins/resolv_conf/Makefile.am13
-rw-r--r--src/charon/plugins/resolve/Makefile.am13
-rw-r--r--src/charon/plugins/resolve/Makefile.in (renamed from src/charon/plugins/resolv_conf/Makefile.in)184
-rw-r--r--src/charon/plugins/resolve/resolve_handler.c (renamed from src/charon/plugins/resolv_conf/resolv_conf_handler.c)145
-rw-r--r--src/charon/plugins/resolve/resolve_handler.h (renamed from src/charon/plugins/resolv_conf/resolv_conf_handler.h)28
-rw-r--r--src/charon/plugins/resolve/resolve_plugin.c (renamed from src/charon/plugins/resolv_conf/resolv_conf_plugin.c)32
-rw-r--r--src/charon/plugins/resolve/resolve_plugin.h (renamed from src/charon/plugins/resolv_conf/resolv_conf_plugin.h)20
-rw-r--r--src/charon/plugins/smp/Makefile.in143
-rw-r--r--src/charon/plugins/smp/smp.c156
-rw-r--r--src/charon/plugins/sql/Makefile.am11
-rw-r--r--src/charon/plugins/sql/Makefile.in240
-rw-r--r--src/charon/plugins/sql/pool.c797
-rw-r--r--src/charon/plugins/sql/sql_attribute.c363
-rw-r--r--src/charon/plugins/sql/sql_config.c49
-rw-r--r--src/charon/plugins/sql/sql_config.h4
-rw-r--r--src/charon/plugins/sql/sql_cred.c20
-rw-r--r--src/charon/plugins/sql/sql_cred.h4
-rw-r--r--src/charon/plugins/sql/sql_logger.c20
-rw-r--r--src/charon/plugins/sql/sql_logger.h4
-rw-r--r--src/charon/plugins/sql/sql_plugin.c30
-rw-r--r--src/charon/plugins/stroke/Makefile.am2
-rw-r--r--src/charon/plugins/stroke/Makefile.in145
-rw-r--r--src/charon/plugins/stroke/stroke_attribute.c68
-rw-r--r--src/charon/plugins/stroke/stroke_attribute.h14
-rw-r--r--src/charon/plugins/stroke/stroke_ca.c77
-rw-r--r--src/charon/plugins/stroke/stroke_ca.h18
-rw-r--r--src/charon/plugins/stroke/stroke_config.c142
-rw-r--r--src/charon/plugins/stroke/stroke_config.h12
-rw-r--r--src/charon/plugins/stroke/stroke_control.c52
-rw-r--r--src/charon/plugins/stroke/stroke_control.h12
-rw-r--r--src/charon/plugins/stroke/stroke_cred.c357
-rw-r--r--src/charon/plugins/stroke/stroke_cred.h21
-rw-r--r--src/charon/plugins/stroke/stroke_list.c385
-rw-r--r--src/charon/plugins/stroke/stroke_list.h6
-rw-r--r--src/charon/plugins/stroke/stroke_plugin.c6
-rw-r--r--src/charon/plugins/stroke/stroke_plugin.h2
-rw-r--r--src/charon/plugins/stroke/stroke_shared_key.c12
-rw-r--r--src/charon/plugins/stroke/stroke_shared_key.h6
-rw-r--r--src/charon/plugins/stroke/stroke_socket.c95
-rw-r--r--src/charon/plugins/stroke/stroke_socket.h8
-rw-r--r--src/charon/plugins/uci/Makefile.in143
-rw-r--r--src/charon/plugins/uci/uci_config.c47
-rw-r--r--src/charon/plugins/uci/uci_config.h4
-rw-r--r--src/charon/plugins/uci/uci_control.c35
-rw-r--r--src/charon/plugins/uci/uci_control.h2
-rw-r--r--src/charon/plugins/uci/uci_creds.c14
-rw-r--r--src/charon/plugins/uci/uci_creds.h4
-rw-r--r--src/charon/plugins/uci/uci_parser.c24
-rw-r--r--src/charon/plugins/uci/uci_parser.h4
-rw-r--r--src/charon/plugins/uci/uci_plugin.c12
-rw-r--r--src/charon/plugins/unit_tester/Makefile.in221
-rw-r--r--src/charon/plugins/unit_tester/tests.h2
-rw-r--r--src/charon/plugins/unit_tester/tests/test_agent.c14
-rw-r--r--src/charon/plugins/unit_tester/tests/test_auth_info.c17
-rw-r--r--src/charon/plugins/unit_tester/tests/test_cert.c12
-rw-r--r--src/charon/plugins/unit_tester/tests/test_chunk.c20
-rw-r--r--src/charon/plugins/unit_tester/tests/test_curl.c4
-rw-r--r--src/charon/plugins/unit_tester/tests/test_enumerator.c34
-rw-r--r--src/charon/plugins/unit_tester/tests/test_id.c22
-rw-r--r--src/charon/plugins/unit_tester/tests/test_med_db.c16
-rw-r--r--src/charon/plugins/unit_tester/tests/test_mutex.c16
-rw-r--r--src/charon/plugins/unit_tester/tests/test_mysql.c5
-rw-r--r--src/charon/plugins/unit_tester/tests/test_pool.c21
-rw-r--r--src/charon/plugins/unit_tester/tests/test_rsa_gen.c55
-rw-r--r--src/charon/plugins/unit_tester/tests/test_sqlite.c5
-rw-r--r--src/charon/plugins/unit_tester/unit_tester.c16
-rw-r--r--src/charon/plugins/unit_tester/unit_tester.h2
-rw-r--r--src/charon/plugins/updown/Makefile.am2
-rw-r--r--src/charon/plugins/updown/Makefile.in145
-rw-r--r--src/charon/plugins/updown/updown_listener.c102
-rw-r--r--src/charon/plugins/updown/updown_listener.h6
-rw-r--r--src/charon/plugins/updown/updown_plugin.c8
-rw-r--r--src/charon/processing/jobs/acquire_job.c12
-rw-r--r--src/charon/processing/jobs/acquire_job.h4
-rw-r--r--src/charon/processing/jobs/callback_job.c178
-rw-r--r--src/charon/processing/jobs/callback_job.h13
-rw-r--r--src/charon/processing/jobs/delete_child_sa_job.c20
-rw-r--r--src/charon/processing/jobs/delete_child_sa_job.h6
-rw-r--r--src/charon/processing/jobs/delete_ike_sa_job.c14
-rw-r--r--src/charon/processing/jobs/delete_ike_sa_job.h8
-rw-r--r--src/charon/processing/jobs/inactivity_job.c150
-rw-r--r--src/charon/processing/jobs/inactivity_job.h53
-rw-r--r--src/charon/processing/jobs/initiate_mediation_job.c78
-rw-r--r--src/charon/processing/jobs/initiate_mediation_job.h11
-rw-r--r--src/charon/processing/jobs/job.h2
-rw-r--r--src/charon/processing/jobs/mediation_job.c34
-rw-r--r--src/charon/processing/jobs/mediation_job.h10
-rw-r--r--src/charon/processing/jobs/migrate_job.c12
-rw-r--r--src/charon/processing/jobs/migrate_job.h18
-rw-r--r--src/charon/processing/jobs/process_message_job.c12
-rw-r--r--src/charon/processing/jobs/process_message_job.h2
-rw-r--r--src/charon/processing/jobs/rekey_child_sa_job.c20
-rw-r--r--src/charon/processing/jobs/rekey_child_sa_job.h2
-rw-r--r--src/charon/processing/jobs/rekey_ike_sa_job.c16
-rw-r--r--src/charon/processing/jobs/rekey_ike_sa_job.h2
-rw-r--r--src/charon/processing/jobs/retransmit_job.c10
-rw-r--r--src/charon/processing/jobs/retransmit_job.h2
-rw-r--r--src/charon/processing/jobs/roam_job.c16
-rw-r--r--src/charon/processing/jobs/roam_job.h4
-rw-r--r--src/charon/processing/jobs/send_dpd_job.c12
-rw-r--r--src/charon/processing/jobs/send_dpd_job.h4
-rw-r--r--src/charon/processing/jobs/send_keepalive_job.c10
-rw-r--r--src/charon/processing/jobs/send_keepalive_job.h4
-rw-r--r--src/charon/processing/jobs/update_sa_job.c14
-rw-r--r--src/charon/processing/jobs/update_sa_job.h2
-rw-r--r--src/charon/processing/processor.c87
-rw-r--r--src/charon/processing/processor.h16
-rw-r--r--src/charon/processing/scheduler.c86
-rw-r--r--src/charon/processing/scheduler.h15
-rw-r--r--src/charon/sa/authenticators/authenticator.c2
-rw-r--r--src/charon/sa/authenticators/authenticator.h34
-rw-r--r--src/charon/sa/authenticators/eap/eap_manager.c26
-rw-r--r--src/charon/sa/authenticators/eap/eap_manager.h12
-rw-r--r--src/charon/sa/authenticators/eap/eap_method.c28
-rw-r--r--src/charon/sa/authenticators/eap/eap_method.h24
-rw-r--r--src/charon/sa/authenticators/eap/sim_manager.c462
-rw-r--r--src/charon/sa/authenticators/eap/sim_manager.h459
-rw-r--r--src/charon/sa/authenticators/eap_authenticator.c175
-rw-r--r--src/charon/sa/authenticators/eap_authenticator.h2
-rw-r--r--src/charon/sa/authenticators/psk_authenticator.c30
-rw-r--r--src/charon/sa/authenticators/psk_authenticator.h2
-rw-r--r--src/charon/sa/authenticators/pubkey_authenticator.c34
-rw-r--r--src/charon/sa/authenticators/pubkey_authenticator.h2
-rw-r--r--src/charon/sa/child_sa.c185
-rw-r--r--src/charon/sa/child_sa.h71
-rw-r--r--src/charon/sa/connect_manager.c663
-rw-r--r--src/charon/sa/connect_manager.h105
-rw-r--r--src/charon/sa/ike_sa.c453
-rw-r--r--src/charon/sa/ike_sa.h351
-rw-r--r--src/charon/sa/ike_sa_id.h12
-rw-r--r--src/charon/sa/ike_sa_manager.c256
-rw-r--r--src/charon/sa/ike_sa_manager.h56
-rw-r--r--src/charon/sa/keymat.c113
-rw-r--r--src/charon/sa/keymat.h14
-rw-r--r--src/charon/sa/mediation_manager.c78
-rw-r--r--src/charon/sa/mediation_manager.h43
-rw-r--r--src/charon/sa/task_manager.c170
-rw-r--r--src/charon/sa/task_manager.h26
-rw-r--r--src/charon/sa/tasks/child_create.c325
-rw-r--r--src/charon/sa/tasks/child_create.h10
-rw-r--r--src/charon/sa/tasks/child_delete.c63
-rw-r--r--src/charon/sa/tasks/child_delete.h2
-rw-r--r--src/charon/sa/tasks/child_rekey.c173
-rw-r--r--src/charon/sa/tasks/child_rekey.h4
-rw-r--r--src/charon/sa/tasks/ike_auth.c363
-rw-r--r--src/charon/sa/tasks/ike_auth_lifetime.c44
-rw-r--r--src/charon/sa/tasks/ike_auth_lifetime.h4
-rw-r--r--src/charon/sa/tasks/ike_cert_post.c100
-rw-r--r--src/charon/sa/tasks/ike_cert_post.h2
-rw-r--r--src/charon/sa/tasks/ike_cert_pre.c101
-rw-r--r--src/charon/sa/tasks/ike_cert_pre.h2
-rw-r--r--src/charon/sa/tasks/ike_config.c276
-rw-r--r--src/charon/sa/tasks/ike_config.h2
-rw-r--r--src/charon/sa/tasks/ike_delete.c18
-rw-r--r--src/charon/sa/tasks/ike_dpd.c6
-rw-r--r--src/charon/sa/tasks/ike_init.c168
-rw-r--r--src/charon/sa/tasks/ike_init.h2
-rw-r--r--src/charon/sa/tasks/ike_me.c316
-rw-r--r--src/charon/sa/tasks/ike_me.h40
-rw-r--r--src/charon/sa/tasks/ike_mobike.c74
-rw-r--r--src/charon/sa/tasks/ike_mobike.h16
-rw-r--r--src/charon/sa/tasks/ike_natd.c80
-rw-r--r--src/charon/sa/tasks/ike_natd.h2
-rw-r--r--src/charon/sa/tasks/ike_reauth.c26
-rw-r--r--src/charon/sa/tasks/ike_rekey.c89
-rw-r--r--src/charon/sa/tasks/ike_rekey.h4
-rw-r--r--src/charon/sa/tasks/ike_vendor.c139
-rw-r--r--src/charon/sa/tasks/ike_vendor.h (renamed from src/charon/plugins/sql/sql_attribute.h)38
-rw-r--r--src/charon/sa/tasks/task.c2
-rw-r--r--src/charon/sa/tasks/task.h12
-rw-r--r--src/charon/sa/trap_manager.c112
-rw-r--r--src/charon/sa/trap_manager.h12
414 files changed, 21522 insertions, 16608 deletions
diff --git a/src/charon/Makefile.am b/src/charon/Makefile.am
index dd51555c0..e20d45cf8 100644
--- a/src/charon/Makefile.am
+++ b/src/charon/Makefile.am
@@ -11,10 +11,6 @@ config/ike_cfg.c config/ike_cfg.h \
config/peer_cfg.c config/peer_cfg.h \
config/proposal.c config/proposal.h \
config/auth_cfg.c config/auth_cfg.h \
-config/traffic_selector.c config/traffic_selector.h \
-config/attributes/attribute_provider.h \
-config/attributes/attribute_handler.h \
-config/attributes/attribute_manager.c config/attributes/attribute_manager.h \
control/controller.c control/controller.h \
daemon.c daemon.h \
encoding/generator.c encoding/generator.h \
@@ -64,6 +60,7 @@ processing/jobs/send_dpd_job.c processing/jobs/send_dpd_job.h \
processing/jobs/send_keepalive_job.c processing/jobs/send_keepalive_job.h \
processing/jobs/roam_job.c processing/jobs/roam_job.h \
processing/jobs/update_sa_job.c processing/jobs/update_sa_job.h \
+processing/jobs/inactivity_job.c processing/jobs/inactivity_job.h \
processing/scheduler.c processing/scheduler.h \
processing/processor.c processing/processor.h \
sa/authenticators/authenticator.c sa/authenticators/authenticator.h \
@@ -95,6 +92,7 @@ sa/tasks/ike_mobike.c sa/tasks/ike_mobike.h \
sa/tasks/ike_rekey.c sa/tasks/ike_rekey.h \
sa/tasks/ike_reauth.c sa/tasks/ike_reauth.h \
sa/tasks/ike_auth_lifetime.c sa/tasks/ike_auth_lifetime.h \
+sa/tasks/ike_vendor.c sa/tasks/ike_vendor.h \
sa/tasks/task.c sa/tasks/task.h \
credentials/credential_manager.c credentials/credential_manager.h \
credentials/sets/auth_cfg_wrapper.c credentials/sets/auth_cfg_wrapper.h \
@@ -102,13 +100,11 @@ credentials/sets/ocsp_response_wrapper.c credentials/sets/ocsp_response_wrapper.
credentials/sets/cert_cache.c credentials/sets/cert_cache.h \
credentials/credential_set.h
-INCLUDES = -I${linuxdir} -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
+INCLUDES = -I${linux_headers} -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
AM_CFLAGS = -rdynamic \
-DIPSEC_DIR=\"${ipsecdir}\" \
- -DIPSEC_PIDDIR=\"${piddir}\" \
- -DIPSEC_PLUGINDIR=\"${plugindir}\" \
- -DSTRONGSWAN_CONF=\"${strongswan_conf}\"
-charon_LDADD = $(top_builddir)/src/libstrongswan/libstrongswan.la -lpthread -lm $(DLLIB) $(SOCKLIB)
+ -DIPSEC_PIDDIR=\"${piddir}\"
+charon_LDADD = $(top_builddir)/src/libstrongswan/libstrongswan.la -lm $(PTHREADLIB) $(DLLIB) $(SOCKLIB)
# compile options
#################
@@ -137,10 +133,10 @@ endif
# build optional plugins
########################
-SUBDIRS = .
+SUBDIRS = .
PLUGINS = ${libstrongswan_plugins}
-if USE_LOAD_TESTS
+if USE_LOAD_TESTER
SUBDIRS += plugins/load_tester
PLUGINS += load-tester
endif
@@ -192,42 +188,57 @@ endif
if USE_EAP_IDENTITY
SUBDIRS += plugins/eap_identity
- PLUGINS += eapidentity
+ PLUGINS += eap-identity
endif
if USE_EAP_SIM
SUBDIRS += plugins/eap_sim
- PLUGINS += eapsim
+ PLUGINS += eap-sim
endif
if USE_EAP_SIM_FILE
SUBDIRS += plugins/eap_sim_file
- PLUGINS += eapsim-file
+ PLUGINS += eap-sim-file
+endif
+
+if USE_EAP_SIMAKA_PSEUDONYM
+ SUBDIRS += plugins/eap_simaka_pseudonym
+ PLUGINS += eap-simaka-pseudonym
+endif
+
+if USE_EAP_SIMAKA_REAUTH
+ SUBDIRS += plugins/eap_simaka_reauth
+ PLUGINS += eap-simaka-reauth
endif
if USE_EAP_MD5
SUBDIRS += plugins/eap_md5
- PLUGINS += eapmd5
+ PLUGINS += eap-md5
endif
if USE_EAP_GTC
SUBDIRS += plugins/eap_gtc
- PLUGINS += eapgtc
+ PLUGINS += eap-gtc
endif
if USE_EAP_AKA
SUBDIRS += plugins/eap_aka
- PLUGINS += eapaka
+ PLUGINS += eap-aka
+endif
+
+if USE_EAP_AKA_3GPP2
+ SUBDIRS += plugins/eap_aka_3gpp2
+ PLUGINS += eap-aka-3gpp2
endif
if USE_EAP_MSCHAPV2
SUBDIRS += plugins/eap_mschapv2
- PLUGINS += eapmschapv2
+ PLUGINS += eap-mschapv2
endif
if USE_EAP_RADIUS
SUBDIRS += plugins/eap_radius
- PLUGINS += eapradius
+ PLUGINS += eap-radius
endif
if USE_MEDSRV
@@ -245,9 +256,9 @@ if USE_NM
PLUGINS += nm
endif
-if USE_RESOLV_CONF
- SUBDIRS += plugins/resolv_conf
- PLUGINS += resolv-conf
+if USE_RESOLVE
+ SUBDIRS += plugins/resolve
+ PLUGINS += resolve
endif
if USE_UCI
diff --git a/src/charon/Makefile.in b/src/charon/Makefile.in
index 59c0228f8..d7339b226 100644
--- a/src/charon/Makefile.in
+++ b/src/charon/Makefile.in
@@ -1,8 +1,9 @@
-# Makefile.in generated by automake 1.10.2 from Makefile.am.
+# Makefile.in generated by automake 1.11 from Makefile.am.
# @configure_input@
# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,
-# 2003, 2004, 2005, 2006, 2007, 2008 Free Software Foundation, Inc.
+# 2003, 2004, 2005, 2006, 2007, 2008, 2009 Free Software Foundation,
+# Inc.
# This Makefile.in is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.
@@ -16,8 +17,9 @@
VPATH = @srcdir@
pkgdatadir = $(datadir)/@PACKAGE@
-pkglibdir = $(libdir)/@PACKAGE@
pkgincludedir = $(includedir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkglibexecdir = $(libexecdir)/@PACKAGE@
am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
install_sh_DATA = $(install_sh) -c -m 644
install_sh_PROGRAM = $(install_sh) -c
@@ -48,8 +50,8 @@ ipsec_PROGRAMS = charon$(EXEEXT)
@USE_ME_TRUE@ sa/tasks/ike_me.c sa/tasks/ike_me.h
@USE_CAPABILITIES_TRUE@am__append_4 = -lcap
-@USE_LOAD_TESTS_TRUE@am__append_5 = plugins/load_tester
-@USE_LOAD_TESTS_TRUE@am__append_6 = load-tester
+@USE_LOAD_TESTER_TRUE@am__append_5 = plugins/load_tester
+@USE_LOAD_TESTER_TRUE@am__append_6 = load-tester
@USE_KERNEL_PFKEY_TRUE@am__append_7 = plugins/kernel_pfkey
@USE_KERNEL_PFKEY_TRUE@am__append_8 = kernel-pfkey
@USE_KERNEL_PFROUTE_TRUE@am__append_9 = plugins/kernel_pfroute
@@ -69,43 +71,56 @@ ipsec_PROGRAMS = charon$(EXEEXT)
@USE_ATTR_TRUE@am__append_23 = plugins/attr
@USE_ATTR_TRUE@am__append_24 = attr
@USE_EAP_IDENTITY_TRUE@am__append_25 = plugins/eap_identity
-@USE_EAP_IDENTITY_TRUE@am__append_26 = eapidentity
+@USE_EAP_IDENTITY_TRUE@am__append_26 = eap-identity
@USE_EAP_SIM_TRUE@am__append_27 = plugins/eap_sim
-@USE_EAP_SIM_TRUE@am__append_28 = eapsim
+@USE_EAP_SIM_TRUE@am__append_28 = eap-sim
@USE_EAP_SIM_FILE_TRUE@am__append_29 = plugins/eap_sim_file
-@USE_EAP_SIM_FILE_TRUE@am__append_30 = eapsim-file
-@USE_EAP_MD5_TRUE@am__append_31 = plugins/eap_md5
-@USE_EAP_MD5_TRUE@am__append_32 = eapmd5
-@USE_EAP_GTC_TRUE@am__append_33 = plugins/eap_gtc
-@USE_EAP_GTC_TRUE@am__append_34 = eapgtc
-@USE_EAP_AKA_TRUE@am__append_35 = plugins/eap_aka
-@USE_EAP_AKA_TRUE@am__append_36 = eapaka
-@USE_EAP_MSCHAPV2_TRUE@am__append_37 = plugins/eap_mschapv2
-@USE_EAP_MSCHAPV2_TRUE@am__append_38 = eapmschapv2
-@USE_EAP_RADIUS_TRUE@am__append_39 = plugins/eap_radius
-@USE_EAP_RADIUS_TRUE@am__append_40 = eapradius
-@USE_MEDSRV_TRUE@am__append_41 = plugins/medsrv
-@USE_MEDSRV_TRUE@am__append_42 = medsrv
-@USE_MEDCLI_TRUE@am__append_43 = plugins/medcli
-@USE_MEDCLI_TRUE@am__append_44 = medcli
-@USE_NM_TRUE@am__append_45 = plugins/nm
-@USE_NM_TRUE@am__append_46 = nm
-@USE_RESOLV_CONF_TRUE@am__append_47 = plugins/resolv_conf
-@USE_RESOLV_CONF_TRUE@am__append_48 = resolv-conf
-@USE_UCI_TRUE@am__append_49 = plugins/uci
-@USE_UCI_TRUE@am__append_50 = uci
-@USE_UNIT_TESTS_TRUE@am__append_51 = plugins/unit_tester
-@USE_UNIT_TESTS_TRUE@am__append_52 = unit-tester
+@USE_EAP_SIM_FILE_TRUE@am__append_30 = eap-sim-file
+@USE_EAP_SIMAKA_PSEUDONYM_TRUE@am__append_31 = plugins/eap_simaka_pseudonym
+@USE_EAP_SIMAKA_PSEUDONYM_TRUE@am__append_32 = eap-simaka-pseudonym
+@USE_EAP_SIMAKA_REAUTH_TRUE@am__append_33 = plugins/eap_simaka_reauth
+@USE_EAP_SIMAKA_REAUTH_TRUE@am__append_34 = eap-simaka-reauth
+@USE_EAP_MD5_TRUE@am__append_35 = plugins/eap_md5
+@USE_EAP_MD5_TRUE@am__append_36 = eap-md5
+@USE_EAP_GTC_TRUE@am__append_37 = plugins/eap_gtc
+@USE_EAP_GTC_TRUE@am__append_38 = eap-gtc
+@USE_EAP_AKA_TRUE@am__append_39 = plugins/eap_aka
+@USE_EAP_AKA_TRUE@am__append_40 = eap-aka
+@USE_EAP_AKA_3GPP2_TRUE@am__append_41 = plugins/eap_aka_3gpp2
+@USE_EAP_AKA_3GPP2_TRUE@am__append_42 = eap-aka-3gpp2
+@USE_EAP_MSCHAPV2_TRUE@am__append_43 = plugins/eap_mschapv2
+@USE_EAP_MSCHAPV2_TRUE@am__append_44 = eap-mschapv2
+@USE_EAP_RADIUS_TRUE@am__append_45 = plugins/eap_radius
+@USE_EAP_RADIUS_TRUE@am__append_46 = eap-radius
+@USE_MEDSRV_TRUE@am__append_47 = plugins/medsrv
+@USE_MEDSRV_TRUE@am__append_48 = medsrv
+@USE_MEDCLI_TRUE@am__append_49 = plugins/medcli
+@USE_MEDCLI_TRUE@am__append_50 = medcli
+@USE_NM_TRUE@am__append_51 = plugins/nm
+@USE_NM_TRUE@am__append_52 = nm
+@USE_RESOLVE_TRUE@am__append_53 = plugins/resolve
+@USE_RESOLVE_TRUE@am__append_54 = resolve
+@USE_UCI_TRUE@am__append_55 = plugins/uci
+@USE_UCI_TRUE@am__append_56 = uci
+@USE_UNIT_TESTS_TRUE@am__append_57 = plugins/unit_tester
+@USE_UNIT_TESTS_TRUE@am__append_58 = unit-tester
subdir = src/charon
DIST_COMMON = $(srcdir)/Makefile.am $(srcdir)/Makefile.in
ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
-am__aclocal_m4_deps = $(top_srcdir)/configure.in
+am__aclocal_m4_deps = $(top_srcdir)/m4/config/libtool.m4 \
+ $(top_srcdir)/m4/config/ltoptions.m4 \
+ $(top_srcdir)/m4/config/ltsugar.m4 \
+ $(top_srcdir)/m4/config/ltversion.m4 \
+ $(top_srcdir)/m4/config/lt~obsolete.m4 \
+ $(top_srcdir)/m4/macros/with.m4 \
+ $(top_srcdir)/m4/macros/enable-disable.m4 \
+ $(top_srcdir)/configure.in
am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
$(ACLOCAL_M4)
mkinstalldirs = $(install_sh) -d
CONFIG_CLEAN_FILES =
+CONFIG_CLEAN_VPATH_FILES =
am__installdirs = "$(DESTDIR)$(ipsecdir)"
-ipsecPROGRAMS_INSTALL = $(INSTALL_PROGRAM)
PROGRAMS = $(ipsec_PROGRAMS)
am__charon_SOURCES_DIST = bus/bus.c bus/bus.h bus/listeners/listener.h \
bus/listeners/file_logger.c bus/listeners/file_logger.h \
@@ -114,12 +129,7 @@ am__charon_SOURCES_DIST = bus/bus.c bus/bus.h bus/listeners/listener.h \
config/backend.h config/child_cfg.c config/child_cfg.h \
config/ike_cfg.c config/ike_cfg.h config/peer_cfg.c \
config/peer_cfg.h config/proposal.c config/proposal.h \
- config/auth_cfg.c config/auth_cfg.h config/traffic_selector.c \
- config/traffic_selector.h \
- config/attributes/attribute_provider.h \
- config/attributes/attribute_handler.h \
- config/attributes/attribute_manager.c \
- config/attributes/attribute_manager.h control/controller.c \
+ config/auth_cfg.c config/auth_cfg.h control/controller.c \
control/controller.h daemon.c daemon.h encoding/generator.c \
encoding/generator.h encoding/message.c encoding/message.h \
encoding/parser.c encoding/parser.h \
@@ -186,7 +196,9 @@ am__charon_SOURCES_DIST = bus/bus.c bus/bus.h bus/listeners/listener.h \
processing/jobs/send_keepalive_job.h \
processing/jobs/roam_job.c processing/jobs/roam_job.h \
processing/jobs/update_sa_job.c \
- processing/jobs/update_sa_job.h processing/scheduler.c \
+ processing/jobs/update_sa_job.h \
+ processing/jobs/inactivity_job.c \
+ processing/jobs/inactivity_job.h processing/scheduler.c \
processing/scheduler.h processing/processor.c \
processing/processor.h sa/authenticators/authenticator.c \
sa/authenticators/authenticator.h \
@@ -218,7 +230,8 @@ am__charon_SOURCES_DIST = bus/bus.c bus/bus.h bus/listeners/listener.h \
sa/tasks/ike_mobike.h sa/tasks/ike_rekey.c \
sa/tasks/ike_rekey.h sa/tasks/ike_reauth.c \
sa/tasks/ike_reauth.h sa/tasks/ike_auth_lifetime.c \
- sa/tasks/ike_auth_lifetime.h sa/tasks/task.c sa/tasks/task.h \
+ sa/tasks/ike_auth_lifetime.h sa/tasks/ike_vendor.c \
+ sa/tasks/ike_vendor.h sa/tasks/task.c sa/tasks/task.h \
credentials/credential_manager.c \
credentials/credential_manager.h \
credentials/sets/auth_cfg_wrapper.c \
@@ -244,15 +257,14 @@ am__charon_SOURCES_DIST = bus/bus.c bus/bus.h bus/listeners/listener.h \
am_charon_OBJECTS = bus.$(OBJEXT) file_logger.$(OBJEXT) \
sys_logger.$(OBJEXT) backend_manager.$(OBJEXT) \
child_cfg.$(OBJEXT) ike_cfg.$(OBJEXT) peer_cfg.$(OBJEXT) \
- proposal.$(OBJEXT) auth_cfg.$(OBJEXT) \
- traffic_selector.$(OBJEXT) attribute_manager.$(OBJEXT) \
- controller.$(OBJEXT) daemon.$(OBJEXT) generator.$(OBJEXT) \
- message.$(OBJEXT) parser.$(OBJEXT) auth_payload.$(OBJEXT) \
- cert_payload.$(OBJEXT) certreq_payload.$(OBJEXT) \
- configuration_attribute.$(OBJEXT) cp_payload.$(OBJEXT) \
- delete_payload.$(OBJEXT) eap_payload.$(OBJEXT) \
- encodings.$(OBJEXT) encryption_payload.$(OBJEXT) \
- id_payload.$(OBJEXT) ike_header.$(OBJEXT) ke_payload.$(OBJEXT) \
+ proposal.$(OBJEXT) auth_cfg.$(OBJEXT) controller.$(OBJEXT) \
+ daemon.$(OBJEXT) generator.$(OBJEXT) message.$(OBJEXT) \
+ parser.$(OBJEXT) auth_payload.$(OBJEXT) cert_payload.$(OBJEXT) \
+ certreq_payload.$(OBJEXT) configuration_attribute.$(OBJEXT) \
+ cp_payload.$(OBJEXT) delete_payload.$(OBJEXT) \
+ eap_payload.$(OBJEXT) encodings.$(OBJEXT) \
+ encryption_payload.$(OBJEXT) id_payload.$(OBJEXT) \
+ ike_header.$(OBJEXT) ke_payload.$(OBJEXT) \
nonce_payload.$(OBJEXT) notify_payload.$(OBJEXT) \
payload.$(OBJEXT) proposal_substructure.$(OBJEXT) \
sa_payload.$(OBJEXT) traffic_selector_substructure.$(OBJEXT) \
@@ -266,20 +278,21 @@ am_charon_OBJECTS = bus.$(OBJEXT) file_logger.$(OBJEXT) \
rekey_child_sa_job.$(OBJEXT) rekey_ike_sa_job.$(OBJEXT) \
retransmit_job.$(OBJEXT) send_dpd_job.$(OBJEXT) \
send_keepalive_job.$(OBJEXT) roam_job.$(OBJEXT) \
- update_sa_job.$(OBJEXT) scheduler.$(OBJEXT) \
- processor.$(OBJEXT) authenticator.$(OBJEXT) \
- eap_authenticator.$(OBJEXT) eap_method.$(OBJEXT) \
- eap_manager.$(OBJEXT) sim_manager.$(OBJEXT) \
- psk_authenticator.$(OBJEXT) pubkey_authenticator.$(OBJEXT) \
- child_sa.$(OBJEXT) ike_sa.$(OBJEXT) ike_sa_id.$(OBJEXT) \
- ike_sa_manager.$(OBJEXT) task_manager.$(OBJEXT) \
- keymat.$(OBJEXT) trap_manager.$(OBJEXT) child_create.$(OBJEXT) \
- child_delete.$(OBJEXT) child_rekey.$(OBJEXT) \
- ike_auth.$(OBJEXT) ike_cert_pre.$(OBJEXT) \
- ike_cert_post.$(OBJEXT) ike_config.$(OBJEXT) \
- ike_delete.$(OBJEXT) ike_dpd.$(OBJEXT) ike_init.$(OBJEXT) \
- ike_natd.$(OBJEXT) ike_mobike.$(OBJEXT) ike_rekey.$(OBJEXT) \
- ike_reauth.$(OBJEXT) ike_auth_lifetime.$(OBJEXT) \
+ update_sa_job.$(OBJEXT) inactivity_job.$(OBJEXT) \
+ scheduler.$(OBJEXT) processor.$(OBJEXT) \
+ authenticator.$(OBJEXT) eap_authenticator.$(OBJEXT) \
+ eap_method.$(OBJEXT) eap_manager.$(OBJEXT) \
+ sim_manager.$(OBJEXT) psk_authenticator.$(OBJEXT) \
+ pubkey_authenticator.$(OBJEXT) child_sa.$(OBJEXT) \
+ ike_sa.$(OBJEXT) ike_sa_id.$(OBJEXT) ike_sa_manager.$(OBJEXT) \
+ task_manager.$(OBJEXT) keymat.$(OBJEXT) trap_manager.$(OBJEXT) \
+ child_create.$(OBJEXT) child_delete.$(OBJEXT) \
+ child_rekey.$(OBJEXT) ike_auth.$(OBJEXT) \
+ ike_cert_pre.$(OBJEXT) ike_cert_post.$(OBJEXT) \
+ ike_config.$(OBJEXT) ike_delete.$(OBJEXT) ike_dpd.$(OBJEXT) \
+ ike_init.$(OBJEXT) ike_natd.$(OBJEXT) ike_mobike.$(OBJEXT) \
+ ike_rekey.$(OBJEXT) ike_reauth.$(OBJEXT) \
+ ike_auth_lifetime.$(OBJEXT) ike_vendor.$(OBJEXT) \
task.$(OBJEXT) credential_manager.$(OBJEXT) \
auth_cfg_wrapper.$(OBJEXT) ocsp_response_wrapper.$(OBJEXT) \
cert_cache.$(OBJEXT) $(am__objects_1) $(am__objects_2) \
@@ -289,10 +302,11 @@ am__DEPENDENCIES_1 =
charon_DEPENDENCIES = \
$(top_builddir)/src/libstrongswan/libstrongswan.la \
$(am__DEPENDENCIES_1) $(am__DEPENDENCIES_1) \
- $(am__DEPENDENCIES_1)
+ $(am__DEPENDENCIES_1) $(am__DEPENDENCIES_1)
DEFAULT_INCLUDES = -I.@am__isrc@
depcomp = $(SHELL) $(top_srcdir)/depcomp
am__depfiles_maybe = depfiles
+am__mv = mv -f
COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
LTCOMPILE = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
@@ -313,17 +327,47 @@ RECURSIVE_TARGETS = all-recursive check-recursive dvi-recursive \
ps-recursive uninstall-recursive
RECURSIVE_CLEAN_TARGETS = mostlyclean-recursive clean-recursive \
distclean-recursive maintainer-clean-recursive
+AM_RECURSIVE_TARGETS = $(RECURSIVE_TARGETS:-recursive=) \
+ $(RECURSIVE_CLEAN_TARGETS:-recursive=) tags TAGS ctags CTAGS \
+ distdir
ETAGS = etags
CTAGS = ctags
DIST_SUBDIRS = . plugins/load_tester plugins/kernel_pfkey \
plugins/kernel_pfroute plugins/kernel_klips \
plugins/kernel_netlink plugins/stroke plugins/smp plugins/sql \
plugins/updown plugins/attr plugins/eap_identity \
- plugins/eap_sim plugins/eap_sim_file plugins/eap_md5 \
- plugins/eap_gtc plugins/eap_aka plugins/eap_mschapv2 \
- plugins/eap_radius plugins/medsrv plugins/medcli plugins/nm \
- plugins/resolv_conf plugins/uci plugins/unit_tester
+ plugins/eap_sim plugins/eap_sim_file \
+ plugins/eap_simaka_pseudonym plugins/eap_simaka_reauth \
+ plugins/eap_md5 plugins/eap_gtc plugins/eap_aka \
+ plugins/eap_aka_3gpp2 plugins/eap_mschapv2 plugins/eap_radius \
+ plugins/medsrv plugins/medcli plugins/nm plugins/resolve \
+ plugins/uci plugins/unit_tester
DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
+am__relativize = \
+ dir0=`pwd`; \
+ sed_first='s,^\([^/]*\)/.*$$,\1,'; \
+ sed_rest='s,^[^/]*/*,,'; \
+ sed_last='s,^.*/\([^/]*\)$$,\1,'; \
+ sed_butlast='s,/*[^/]*$$,,'; \
+ while test -n "$$dir1"; do \
+ first=`echo "$$dir1" | sed -e "$$sed_first"`; \
+ if test "$$first" != "."; then \
+ if test "$$first" = ".."; then \
+ dir2=`echo "$$dir0" | sed -e "$$sed_last"`/"$$dir2"; \
+ dir0=`echo "$$dir0" | sed -e "$$sed_butlast"`; \
+ else \
+ first2=`echo "$$dir2" | sed -e "$$sed_first"`; \
+ if test "$$first2" = "$$first"; then \
+ dir2=`echo "$$dir2" | sed -e "$$sed_rest"`; \
+ else \
+ dir2="../$$dir2"; \
+ fi; \
+ dir0="$$dir0"/"$$first"; \
+ fi; \
+ fi; \
+ dir1=`echo "$$dir1" | sed -e "$$sed_rest"`; \
+ done; \
+ reldir="$$dir2"
ACLOCAL = @ACLOCAL@
ALLOCA = @ALLOCA@
AMTAR = @AMTAR@
@@ -357,25 +401,22 @@ INSTALL_DATA = @INSTALL_DATA@
INSTALL_PROGRAM = @INSTALL_PROGRAM@
INSTALL_SCRIPT = @INSTALL_SCRIPT@
INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
-IPSEC_ROUTING_TABLE = @IPSEC_ROUTING_TABLE@
-IPSEC_ROUTING_TABLE_PRIO = @IPSEC_ROUTING_TABLE_PRIO@
LD = @LD@
LDFLAGS = @LDFLAGS@
LEX = @LEX@
LEXLIB = @LEXLIB@
LEX_OUTPUT_ROOT = @LEX_OUTPUT_ROOT@
-LIBGCRYPT_CFLAGS = @LIBGCRYPT_CFLAGS@
-LIBGCRYPT_CONFIG = @LIBGCRYPT_CONFIG@
-LIBGCRYPT_LIBS = @LIBGCRYPT_LIBS@
LIBOBJS = @LIBOBJS@
LIBS = @LIBS@
LIBTOOL = @LIBTOOL@
-LINUX_HEADERS = @LINUX_HEADERS@
LIPO = @LIPO@
LN_S = @LN_S@
LTLIBOBJS = @LTLIBOBJS@
MAKEINFO = @MAKEINFO@
MKDIR_P = @MKDIR_P@
+MYSQLCFLAG = @MYSQLCFLAG@
+MYSQLCONFIG = @MYSQLCONFIG@
+MYSQLLIB = @MYSQLLIB@
NM = @NM@
NMEDIT = @NMEDIT@
OBJDUMP = @OBJDUMP@
@@ -387,11 +428,14 @@ PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
PACKAGE_NAME = @PACKAGE_NAME@
PACKAGE_STRING = @PACKAGE_STRING@
PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_URL = @PACKAGE_URL@
PACKAGE_VERSION = @PACKAGE_VERSION@
PATH_SEPARATOR = @PATH_SEPARATOR@
PERL = @PERL@
PKG_CONFIG = @PKG_CONFIG@
+PTHREADLIB = @PTHREADLIB@
RANLIB = @RANLIB@
+RTLIB = @RTLIB@
RUBY = @RUBY@
RUBYINCLUDE = @RUBYINCLUDE@
SED = @SED@
@@ -420,9 +464,9 @@ build_cpu = @build_cpu@
build_os = @build_os@
build_vendor = @build_vendor@
builddir = @builddir@
-confdir = @confdir@
datadir = @datadir@
datarootdir = @datarootdir@
+default_pkcs11 = @default_pkcs11@
docdir = @docdir@
dvidir = @dvidir@
exec_prefix = @exec_prefix@
@@ -445,7 +489,7 @@ ipsecuser = @ipsecuser@
libdir = @libdir@
libexecdir = @libexecdir@
libstrongswan_plugins = @libstrongswan_plugins@
-linuxdir = @linuxdir@
+linux_headers = @linux_headers@
localedir = @localedir@
localstatedir = @localstatedir@
lt_ECHO = @lt_ECHO@
@@ -453,6 +497,7 @@ mandir = @mandir@
mkdir_p = @mkdir_p@
nm_CFLAGS = @nm_CFLAGS@
nm_LIBS = @nm_LIBS@
+nm_ca_dir = @nm_ca_dir@
oldincludedir = @oldincludedir@
pdfdir = @pdfdir@
piddir = @piddir@
@@ -461,10 +506,12 @@ pluto_plugins = @pluto_plugins@
prefix = @prefix@
program_transform_name = @program_transform_name@
psdir = @psdir@
+random_device = @random_device@
resolv_conf = @resolv_conf@
+routing_table = @routing_table@
+routing_table_prio = @routing_table_prio@
sbindir = @sbindir@
sharedstatedir = @sharedstatedir@
-simreader = @simreader@
srcdir = @srcdir@
strongswan_conf = @strongswan_conf@
sysconfdir = @sysconfdir@
@@ -472,6 +519,7 @@ target_alias = @target_alias@
top_build_prefix = @top_build_prefix@
top_builddir = @top_builddir@
top_srcdir = @top_srcdir@
+urandom_device = @urandom_device@
xml_CFLAGS = @xml_CFLAGS@
xml_LIBS = @xml_LIBS@
charon_SOURCES = bus/bus.c bus/bus.h bus/listeners/listener.h \
@@ -481,12 +529,7 @@ charon_SOURCES = bus/bus.c bus/bus.h bus/listeners/listener.h \
config/backend.h config/child_cfg.c config/child_cfg.h \
config/ike_cfg.c config/ike_cfg.h config/peer_cfg.c \
config/peer_cfg.h config/proposal.c config/proposal.h \
- config/auth_cfg.c config/auth_cfg.h config/traffic_selector.c \
- config/traffic_selector.h \
- config/attributes/attribute_provider.h \
- config/attributes/attribute_handler.h \
- config/attributes/attribute_manager.c \
- config/attributes/attribute_manager.h control/controller.c \
+ config/auth_cfg.c config/auth_cfg.h control/controller.c \
control/controller.h daemon.c daemon.h encoding/generator.c \
encoding/generator.h encoding/message.c encoding/message.h \
encoding/parser.c encoding/parser.h \
@@ -553,7 +596,9 @@ charon_SOURCES = bus/bus.c bus/bus.h bus/listeners/listener.h \
processing/jobs/send_keepalive_job.h \
processing/jobs/roam_job.c processing/jobs/roam_job.h \
processing/jobs/update_sa_job.c \
- processing/jobs/update_sa_job.h processing/scheduler.c \
+ processing/jobs/update_sa_job.h \
+ processing/jobs/inactivity_job.c \
+ processing/jobs/inactivity_job.h processing/scheduler.c \
processing/scheduler.h processing/processor.c \
processing/processor.h sa/authenticators/authenticator.c \
sa/authenticators/authenticator.h \
@@ -585,7 +630,8 @@ charon_SOURCES = bus/bus.c bus/bus.h bus/listeners/listener.h \
sa/tasks/ike_mobike.h sa/tasks/ike_rekey.c \
sa/tasks/ike_rekey.h sa/tasks/ike_reauth.c \
sa/tasks/ike_reauth.h sa/tasks/ike_auth_lifetime.c \
- sa/tasks/ike_auth_lifetime.h sa/tasks/task.c sa/tasks/task.h \
+ sa/tasks/ike_auth_lifetime.h sa/tasks/ike_vendor.c \
+ sa/tasks/ike_vendor.h sa/tasks/task.c sa/tasks/task.h \
credentials/credential_manager.c \
credentials/credential_manager.h \
credentials/sets/auth_cfg_wrapper.c \
@@ -595,14 +641,11 @@ charon_SOURCES = bus/bus.c bus/bus.h bus/listeners/listener.h \
credentials/sets/cert_cache.c credentials/sets/cert_cache.h \
credentials/credential_set.h $(am__append_1) $(am__append_2) \
$(am__append_3)
-INCLUDES = -I${linuxdir} -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
+INCLUDES = -I${linux_headers} -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
AM_CFLAGS = -rdynamic -DIPSEC_DIR=\"${ipsecdir}\" \
- -DIPSEC_PIDDIR=\"${piddir}\" \
- -DIPSEC_PLUGINDIR=\"${plugindir}\" \
- -DSTRONGSWAN_CONF=\"${strongswan_conf}\" \
- -DPLUGINS=\""${PLUGINS}\""
-charon_LDADD = $(top_builddir)/src/libstrongswan/libstrongswan.la \
- -lpthread -lm $(DLLIB) $(SOCKLIB) $(am__append_4)
+ -DIPSEC_PIDDIR=\"${piddir}\" -DPLUGINS=\""${PLUGINS}\""
+charon_LDADD = $(top_builddir)/src/libstrongswan/libstrongswan.la -lm \
+ $(PTHREADLIB) $(DLLIB) $(SOCKLIB) $(am__append_4)
# build optional plugins
########################
@@ -613,7 +656,8 @@ SUBDIRS = . $(am__append_5) $(am__append_7) $(am__append_9) \
$(am__append_29) $(am__append_31) $(am__append_33) \
$(am__append_35) $(am__append_37) $(am__append_39) \
$(am__append_41) $(am__append_43) $(am__append_45) \
- $(am__append_47) $(am__append_49) $(am__append_51)
+ $(am__append_47) $(am__append_49) $(am__append_51) \
+ $(am__append_53) $(am__append_55) $(am__append_57)
PLUGINS = ${libstrongswan_plugins} $(am__append_6) $(am__append_8) \
$(am__append_10) $(am__append_12) $(am__append_14) \
$(am__append_16) $(am__append_18) $(am__append_20) \
@@ -622,7 +666,8 @@ PLUGINS = ${libstrongswan_plugins} $(am__append_6) $(am__append_8) \
$(am__append_34) $(am__append_36) $(am__append_38) \
$(am__append_40) $(am__append_42) $(am__append_44) \
$(am__append_46) $(am__append_48) $(am__append_50) \
- $(am__append_52)
+ $(am__append_52) $(am__append_54) $(am__append_56) \
+ $(am__append_58)
all: all-recursive
.SUFFIXES:
@@ -636,9 +681,9 @@ $(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps)
exit 1;; \
esac; \
done; \
- echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/charon/Makefile'; \
- cd $(top_srcdir) && \
- $(AUTOMAKE) --gnu src/charon/Makefile
+ echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/charon/Makefile'; \
+ $(am__cd) $(top_srcdir) && \
+ $(AUTOMAKE) --gnu src/charon/Makefile
.PRECIOUS: Makefile
Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
@case '$?' in \
@@ -656,34 +701,50 @@ $(top_srcdir)/configure: $(am__configure_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
$(ACLOCAL_M4): $(am__aclocal_m4_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(am__aclocal_m4_deps):
install-ipsecPROGRAMS: $(ipsec_PROGRAMS)
@$(NORMAL_INSTALL)
test -z "$(ipsecdir)" || $(MKDIR_P) "$(DESTDIR)$(ipsecdir)"
- @list='$(ipsec_PROGRAMS)'; for p in $$list; do \
- p1=`echo $$p|sed 's/$(EXEEXT)$$//'`; \
- if test -f $$p \
- || test -f $$p1 \
- ; then \
- f=`echo "$$p1" | sed 's,^.*/,,;$(transform);s/$$/$(EXEEXT)/'`; \
- echo " $(INSTALL_PROGRAM_ENV) $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(ipsecPROGRAMS_INSTALL) '$$p' '$(DESTDIR)$(ipsecdir)/$$f'"; \
- $(INSTALL_PROGRAM_ENV) $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(ipsecPROGRAMS_INSTALL) "$$p" "$(DESTDIR)$(ipsecdir)/$$f" || exit 1; \
- else :; fi; \
- done
+ @list='$(ipsec_PROGRAMS)'; test -n "$(ipsecdir)" || list=; \
+ for p in $$list; do echo "$$p $$p"; done | \
+ sed 's/$(EXEEXT)$$//' | \
+ while read p p1; do if test -f $$p || test -f $$p1; \
+ then echo "$$p"; echo "$$p"; else :; fi; \
+ done | \
+ sed -e 'p;s,.*/,,;n;h' -e 's|.*|.|' \
+ -e 'p;x;s,.*/,,;s/$(EXEEXT)$$//;$(transform);s/$$/$(EXEEXT)/' | \
+ sed 'N;N;N;s,\n, ,g' | \
+ $(AWK) 'BEGIN { files["."] = ""; dirs["."] = 1 } \
+ { d=$$3; if (dirs[d] != 1) { print "d", d; dirs[d] = 1 } \
+ if ($$2 == $$4) files[d] = files[d] " " $$1; \
+ else { print "f", $$3 "/" $$4, $$1; } } \
+ END { for (d in files) print "f", d, files[d] }' | \
+ while read type dir files; do \
+ if test "$$dir" = .; then dir=; else dir=/$$dir; fi; \
+ test -z "$$files" || { \
+ echo " $(INSTALL_PROGRAM_ENV) $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL_PROGRAM) $$files '$(DESTDIR)$(ipsecdir)$$dir'"; \
+ $(INSTALL_PROGRAM_ENV) $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL_PROGRAM) $$files "$(DESTDIR)$(ipsecdir)$$dir" || exit $$?; \
+ } \
+ ; done
uninstall-ipsecPROGRAMS:
@$(NORMAL_UNINSTALL)
- @list='$(ipsec_PROGRAMS)'; for p in $$list; do \
- f=`echo "$$p" | sed 's,^.*/,,;s/$(EXEEXT)$$//;$(transform);s/$$/$(EXEEXT)/'`; \
- echo " rm -f '$(DESTDIR)$(ipsecdir)/$$f'"; \
- rm -f "$(DESTDIR)$(ipsecdir)/$$f"; \
- done
+ @list='$(ipsec_PROGRAMS)'; test -n "$(ipsecdir)" || list=; \
+ files=`for p in $$list; do echo "$$p"; done | \
+ sed -e 'h;s,^.*/,,;s/$(EXEEXT)$$//;$(transform)' \
+ -e 's/$$/$(EXEEXT)/' `; \
+ test -n "$$list" || exit 0; \
+ echo " ( cd '$(DESTDIR)$(ipsecdir)' && rm -f" $$files ")"; \
+ cd "$(DESTDIR)$(ipsecdir)" && rm -f $$files
clean-ipsecPROGRAMS:
- @list='$(ipsec_PROGRAMS)'; for p in $$list; do \
- f=`echo $$p|sed 's/$(EXEEXT)$$//'`; \
- echo " rm -f $$p $$f"; \
- rm -f $$p $$f ; \
- done
+ @list='$(ipsec_PROGRAMS)'; test -n "$$list" || exit 0; \
+ echo " rm -f" $$list; \
+ rm -f $$list || exit $$?; \
+ test -n "$(EXEEXT)" || exit 0; \
+ list=`for p in $$list; do echo "$$p"; done | sed 's/$(EXEEXT)$$//'`; \
+ echo " rm -f" $$list; \
+ rm -f $$list
charon$(EXEEXT): $(charon_OBJECTS) $(charon_DEPENDENCIES)
@rm -f charon$(EXEEXT)
$(LINK) $(charon_OBJECTS) $(charon_LDADD) $(LIBS)
@@ -695,7 +756,6 @@ distclean-compile:
-rm -f *.tab.c
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/acquire_job.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/attribute_manager.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/auth_cfg.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/auth_cfg_wrapper.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/auth_payload.Po@am__quote@
@@ -748,6 +808,8 @@ distclean-compile:
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ike_sa.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ike_sa_id.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ike_sa_manager.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ike_vendor.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/inactivity_job.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/initiate_mediation_job.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ke_payload.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/kernel_interface.Po@am__quote@
@@ -786,7 +848,6 @@ distclean-compile:
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/sys_logger.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/task.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/task_manager.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/traffic_selector.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/traffic_selector_substructure.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/transform_attribute.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/transform_substructure.Po@am__quote@
@@ -798,1421 +859,1421 @@ distclean-compile:
.c.o:
@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(COMPILE) -c $<
.c.obj:
@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(COMPILE) -c `$(CYGPATH_W) '$<'`
.c.lo:
@am__fastdepCC_TRUE@ $(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(LTCOMPILE) -c -o $@ $<
bus.o: bus/bus.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT bus.o -MD -MP -MF $(DEPDIR)/bus.Tpo -c -o bus.o `test -f 'bus/bus.c' || echo '$(srcdir)/'`bus/bus.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/bus.Tpo $(DEPDIR)/bus.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/bus.Tpo $(DEPDIR)/bus.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='bus/bus.c' object='bus.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o bus.o `test -f 'bus/bus.c' || echo '$(srcdir)/'`bus/bus.c
bus.obj: bus/bus.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT bus.obj -MD -MP -MF $(DEPDIR)/bus.Tpo -c -o bus.obj `if test -f 'bus/bus.c'; then $(CYGPATH_W) 'bus/bus.c'; else $(CYGPATH_W) '$(srcdir)/bus/bus.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/bus.Tpo $(DEPDIR)/bus.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/bus.Tpo $(DEPDIR)/bus.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='bus/bus.c' object='bus.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o bus.obj `if test -f 'bus/bus.c'; then $(CYGPATH_W) 'bus/bus.c'; else $(CYGPATH_W) '$(srcdir)/bus/bus.c'; fi`
file_logger.o: bus/listeners/file_logger.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT file_logger.o -MD -MP -MF $(DEPDIR)/file_logger.Tpo -c -o file_logger.o `test -f 'bus/listeners/file_logger.c' || echo '$(srcdir)/'`bus/listeners/file_logger.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/file_logger.Tpo $(DEPDIR)/file_logger.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/file_logger.Tpo $(DEPDIR)/file_logger.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='bus/listeners/file_logger.c' object='file_logger.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o file_logger.o `test -f 'bus/listeners/file_logger.c' || echo '$(srcdir)/'`bus/listeners/file_logger.c
file_logger.obj: bus/listeners/file_logger.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT file_logger.obj -MD -MP -MF $(DEPDIR)/file_logger.Tpo -c -o file_logger.obj `if test -f 'bus/listeners/file_logger.c'; then $(CYGPATH_W) 'bus/listeners/file_logger.c'; else $(CYGPATH_W) '$(srcdir)/bus/listeners/file_logger.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/file_logger.Tpo $(DEPDIR)/file_logger.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/file_logger.Tpo $(DEPDIR)/file_logger.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='bus/listeners/file_logger.c' object='file_logger.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o file_logger.obj `if test -f 'bus/listeners/file_logger.c'; then $(CYGPATH_W) 'bus/listeners/file_logger.c'; else $(CYGPATH_W) '$(srcdir)/bus/listeners/file_logger.c'; fi`
sys_logger.o: bus/listeners/sys_logger.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT sys_logger.o -MD -MP -MF $(DEPDIR)/sys_logger.Tpo -c -o sys_logger.o `test -f 'bus/listeners/sys_logger.c' || echo '$(srcdir)/'`bus/listeners/sys_logger.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/sys_logger.Tpo $(DEPDIR)/sys_logger.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/sys_logger.Tpo $(DEPDIR)/sys_logger.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='bus/listeners/sys_logger.c' object='sys_logger.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o sys_logger.o `test -f 'bus/listeners/sys_logger.c' || echo '$(srcdir)/'`bus/listeners/sys_logger.c
sys_logger.obj: bus/listeners/sys_logger.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT sys_logger.obj -MD -MP -MF $(DEPDIR)/sys_logger.Tpo -c -o sys_logger.obj `if test -f 'bus/listeners/sys_logger.c'; then $(CYGPATH_W) 'bus/listeners/sys_logger.c'; else $(CYGPATH_W) '$(srcdir)/bus/listeners/sys_logger.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/sys_logger.Tpo $(DEPDIR)/sys_logger.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/sys_logger.Tpo $(DEPDIR)/sys_logger.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='bus/listeners/sys_logger.c' object='sys_logger.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o sys_logger.obj `if test -f 'bus/listeners/sys_logger.c'; then $(CYGPATH_W) 'bus/listeners/sys_logger.c'; else $(CYGPATH_W) '$(srcdir)/bus/listeners/sys_logger.c'; fi`
backend_manager.o: config/backend_manager.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT backend_manager.o -MD -MP -MF $(DEPDIR)/backend_manager.Tpo -c -o backend_manager.o `test -f 'config/backend_manager.c' || echo '$(srcdir)/'`config/backend_manager.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/backend_manager.Tpo $(DEPDIR)/backend_manager.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/backend_manager.Tpo $(DEPDIR)/backend_manager.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='config/backend_manager.c' object='backend_manager.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o backend_manager.o `test -f 'config/backend_manager.c' || echo '$(srcdir)/'`config/backend_manager.c
backend_manager.obj: config/backend_manager.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT backend_manager.obj -MD -MP -MF $(DEPDIR)/backend_manager.Tpo -c -o backend_manager.obj `if test -f 'config/backend_manager.c'; then $(CYGPATH_W) 'config/backend_manager.c'; else $(CYGPATH_W) '$(srcdir)/config/backend_manager.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/backend_manager.Tpo $(DEPDIR)/backend_manager.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/backend_manager.Tpo $(DEPDIR)/backend_manager.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='config/backend_manager.c' object='backend_manager.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o backend_manager.obj `if test -f 'config/backend_manager.c'; then $(CYGPATH_W) 'config/backend_manager.c'; else $(CYGPATH_W) '$(srcdir)/config/backend_manager.c'; fi`
child_cfg.o: config/child_cfg.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT child_cfg.o -MD -MP -MF $(DEPDIR)/child_cfg.Tpo -c -o child_cfg.o `test -f 'config/child_cfg.c' || echo '$(srcdir)/'`config/child_cfg.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/child_cfg.Tpo $(DEPDIR)/child_cfg.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/child_cfg.Tpo $(DEPDIR)/child_cfg.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='config/child_cfg.c' object='child_cfg.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o child_cfg.o `test -f 'config/child_cfg.c' || echo '$(srcdir)/'`config/child_cfg.c
child_cfg.obj: config/child_cfg.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT child_cfg.obj -MD -MP -MF $(DEPDIR)/child_cfg.Tpo -c -o child_cfg.obj `if test -f 'config/child_cfg.c'; then $(CYGPATH_W) 'config/child_cfg.c'; else $(CYGPATH_W) '$(srcdir)/config/child_cfg.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/child_cfg.Tpo $(DEPDIR)/child_cfg.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/child_cfg.Tpo $(DEPDIR)/child_cfg.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='config/child_cfg.c' object='child_cfg.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o child_cfg.obj `if test -f 'config/child_cfg.c'; then $(CYGPATH_W) 'config/child_cfg.c'; else $(CYGPATH_W) '$(srcdir)/config/child_cfg.c'; fi`
ike_cfg.o: config/ike_cfg.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ike_cfg.o -MD -MP -MF $(DEPDIR)/ike_cfg.Tpo -c -o ike_cfg.o `test -f 'config/ike_cfg.c' || echo '$(srcdir)/'`config/ike_cfg.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/ike_cfg.Tpo $(DEPDIR)/ike_cfg.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/ike_cfg.Tpo $(DEPDIR)/ike_cfg.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='config/ike_cfg.c' object='ike_cfg.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ike_cfg.o `test -f 'config/ike_cfg.c' || echo '$(srcdir)/'`config/ike_cfg.c
ike_cfg.obj: config/ike_cfg.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ike_cfg.obj -MD -MP -MF $(DEPDIR)/ike_cfg.Tpo -c -o ike_cfg.obj `if test -f 'config/ike_cfg.c'; then $(CYGPATH_W) 'config/ike_cfg.c'; else $(CYGPATH_W) '$(srcdir)/config/ike_cfg.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/ike_cfg.Tpo $(DEPDIR)/ike_cfg.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/ike_cfg.Tpo $(DEPDIR)/ike_cfg.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='config/ike_cfg.c' object='ike_cfg.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ike_cfg.obj `if test -f 'config/ike_cfg.c'; then $(CYGPATH_W) 'config/ike_cfg.c'; else $(CYGPATH_W) '$(srcdir)/config/ike_cfg.c'; fi`
peer_cfg.o: config/peer_cfg.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT peer_cfg.o -MD -MP -MF $(DEPDIR)/peer_cfg.Tpo -c -o peer_cfg.o `test -f 'config/peer_cfg.c' || echo '$(srcdir)/'`config/peer_cfg.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/peer_cfg.Tpo $(DEPDIR)/peer_cfg.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/peer_cfg.Tpo $(DEPDIR)/peer_cfg.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='config/peer_cfg.c' object='peer_cfg.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o peer_cfg.o `test -f 'config/peer_cfg.c' || echo '$(srcdir)/'`config/peer_cfg.c
peer_cfg.obj: config/peer_cfg.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT peer_cfg.obj -MD -MP -MF $(DEPDIR)/peer_cfg.Tpo -c -o peer_cfg.obj `if test -f 'config/peer_cfg.c'; then $(CYGPATH_W) 'config/peer_cfg.c'; else $(CYGPATH_W) '$(srcdir)/config/peer_cfg.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/peer_cfg.Tpo $(DEPDIR)/peer_cfg.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/peer_cfg.Tpo $(DEPDIR)/peer_cfg.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='config/peer_cfg.c' object='peer_cfg.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o peer_cfg.obj `if test -f 'config/peer_cfg.c'; then $(CYGPATH_W) 'config/peer_cfg.c'; else $(CYGPATH_W) '$(srcdir)/config/peer_cfg.c'; fi`
proposal.o: config/proposal.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT proposal.o -MD -MP -MF $(DEPDIR)/proposal.Tpo -c -o proposal.o `test -f 'config/proposal.c' || echo '$(srcdir)/'`config/proposal.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/proposal.Tpo $(DEPDIR)/proposal.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/proposal.Tpo $(DEPDIR)/proposal.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='config/proposal.c' object='proposal.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o proposal.o `test -f 'config/proposal.c' || echo '$(srcdir)/'`config/proposal.c
proposal.obj: config/proposal.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT proposal.obj -MD -MP -MF $(DEPDIR)/proposal.Tpo -c -o proposal.obj `if test -f 'config/proposal.c'; then $(CYGPATH_W) 'config/proposal.c'; else $(CYGPATH_W) '$(srcdir)/config/proposal.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/proposal.Tpo $(DEPDIR)/proposal.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/proposal.Tpo $(DEPDIR)/proposal.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='config/proposal.c' object='proposal.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o proposal.obj `if test -f 'config/proposal.c'; then $(CYGPATH_W) 'config/proposal.c'; else $(CYGPATH_W) '$(srcdir)/config/proposal.c'; fi`
auth_cfg.o: config/auth_cfg.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT auth_cfg.o -MD -MP -MF $(DEPDIR)/auth_cfg.Tpo -c -o auth_cfg.o `test -f 'config/auth_cfg.c' || echo '$(srcdir)/'`config/auth_cfg.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/auth_cfg.Tpo $(DEPDIR)/auth_cfg.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/auth_cfg.Tpo $(DEPDIR)/auth_cfg.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='config/auth_cfg.c' object='auth_cfg.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o auth_cfg.o `test -f 'config/auth_cfg.c' || echo '$(srcdir)/'`config/auth_cfg.c
auth_cfg.obj: config/auth_cfg.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT auth_cfg.obj -MD -MP -MF $(DEPDIR)/auth_cfg.Tpo -c -o auth_cfg.obj `if test -f 'config/auth_cfg.c'; then $(CYGPATH_W) 'config/auth_cfg.c'; else $(CYGPATH_W) '$(srcdir)/config/auth_cfg.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/auth_cfg.Tpo $(DEPDIR)/auth_cfg.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/auth_cfg.Tpo $(DEPDIR)/auth_cfg.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='config/auth_cfg.c' object='auth_cfg.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o auth_cfg.obj `if test -f 'config/auth_cfg.c'; then $(CYGPATH_W) 'config/auth_cfg.c'; else $(CYGPATH_W) '$(srcdir)/config/auth_cfg.c'; fi`
-traffic_selector.o: config/traffic_selector.c
-@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT traffic_selector.o -MD -MP -MF $(DEPDIR)/traffic_selector.Tpo -c -o traffic_selector.o `test -f 'config/traffic_selector.c' || echo '$(srcdir)/'`config/traffic_selector.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/traffic_selector.Tpo $(DEPDIR)/traffic_selector.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='config/traffic_selector.c' object='traffic_selector.o' libtool=no @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o traffic_selector.o `test -f 'config/traffic_selector.c' || echo '$(srcdir)/'`config/traffic_selector.c
-
-traffic_selector.obj: config/traffic_selector.c
-@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT traffic_selector.obj -MD -MP -MF $(DEPDIR)/traffic_selector.Tpo -c -o traffic_selector.obj `if test -f 'config/traffic_selector.c'; then $(CYGPATH_W) 'config/traffic_selector.c'; else $(CYGPATH_W) '$(srcdir)/config/traffic_selector.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/traffic_selector.Tpo $(DEPDIR)/traffic_selector.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='config/traffic_selector.c' object='traffic_selector.obj' libtool=no @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o traffic_selector.obj `if test -f 'config/traffic_selector.c'; then $(CYGPATH_W) 'config/traffic_selector.c'; else $(CYGPATH_W) '$(srcdir)/config/traffic_selector.c'; fi`
-
-attribute_manager.o: config/attributes/attribute_manager.c
-@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT attribute_manager.o -MD -MP -MF $(DEPDIR)/attribute_manager.Tpo -c -o attribute_manager.o `test -f 'config/attributes/attribute_manager.c' || echo '$(srcdir)/'`config/attributes/attribute_manager.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/attribute_manager.Tpo $(DEPDIR)/attribute_manager.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='config/attributes/attribute_manager.c' object='attribute_manager.o' libtool=no @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o attribute_manager.o `test -f 'config/attributes/attribute_manager.c' || echo '$(srcdir)/'`config/attributes/attribute_manager.c
-
-attribute_manager.obj: config/attributes/attribute_manager.c
-@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT attribute_manager.obj -MD -MP -MF $(DEPDIR)/attribute_manager.Tpo -c -o attribute_manager.obj `if test -f 'config/attributes/attribute_manager.c'; then $(CYGPATH_W) 'config/attributes/attribute_manager.c'; else $(CYGPATH_W) '$(srcdir)/config/attributes/attribute_manager.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/attribute_manager.Tpo $(DEPDIR)/attribute_manager.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='config/attributes/attribute_manager.c' object='attribute_manager.obj' libtool=no @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o attribute_manager.obj `if test -f 'config/attributes/attribute_manager.c'; then $(CYGPATH_W) 'config/attributes/attribute_manager.c'; else $(CYGPATH_W) '$(srcdir)/config/attributes/attribute_manager.c'; fi`
-
controller.o: control/controller.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT controller.o -MD -MP -MF $(DEPDIR)/controller.Tpo -c -o controller.o `test -f 'control/controller.c' || echo '$(srcdir)/'`control/controller.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/controller.Tpo $(DEPDIR)/controller.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/controller.Tpo $(DEPDIR)/controller.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='control/controller.c' object='controller.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o controller.o `test -f 'control/controller.c' || echo '$(srcdir)/'`control/controller.c
controller.obj: control/controller.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT controller.obj -MD -MP -MF $(DEPDIR)/controller.Tpo -c -o controller.obj `if test -f 'control/controller.c'; then $(CYGPATH_W) 'control/controller.c'; else $(CYGPATH_W) '$(srcdir)/control/controller.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/controller.Tpo $(DEPDIR)/controller.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/controller.Tpo $(DEPDIR)/controller.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='control/controller.c' object='controller.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o controller.obj `if test -f 'control/controller.c'; then $(CYGPATH_W) 'control/controller.c'; else $(CYGPATH_W) '$(srcdir)/control/controller.c'; fi`
generator.o: encoding/generator.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT generator.o -MD -MP -MF $(DEPDIR)/generator.Tpo -c -o generator.o `test -f 'encoding/generator.c' || echo '$(srcdir)/'`encoding/generator.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/generator.Tpo $(DEPDIR)/generator.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/generator.Tpo $(DEPDIR)/generator.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='encoding/generator.c' object='generator.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o generator.o `test -f 'encoding/generator.c' || echo '$(srcdir)/'`encoding/generator.c
generator.obj: encoding/generator.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT generator.obj -MD -MP -MF $(DEPDIR)/generator.Tpo -c -o generator.obj `if test -f 'encoding/generator.c'; then $(CYGPATH_W) 'encoding/generator.c'; else $(CYGPATH_W) '$(srcdir)/encoding/generator.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/generator.Tpo $(DEPDIR)/generator.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/generator.Tpo $(DEPDIR)/generator.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='encoding/generator.c' object='generator.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o generator.obj `if test -f 'encoding/generator.c'; then $(CYGPATH_W) 'encoding/generator.c'; else $(CYGPATH_W) '$(srcdir)/encoding/generator.c'; fi`
message.o: encoding/message.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT message.o -MD -MP -MF $(DEPDIR)/message.Tpo -c -o message.o `test -f 'encoding/message.c' || echo '$(srcdir)/'`encoding/message.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/message.Tpo $(DEPDIR)/message.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/message.Tpo $(DEPDIR)/message.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='encoding/message.c' object='message.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o message.o `test -f 'encoding/message.c' || echo '$(srcdir)/'`encoding/message.c
message.obj: encoding/message.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT message.obj -MD -MP -MF $(DEPDIR)/message.Tpo -c -o message.obj `if test -f 'encoding/message.c'; then $(CYGPATH_W) 'encoding/message.c'; else $(CYGPATH_W) '$(srcdir)/encoding/message.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/message.Tpo $(DEPDIR)/message.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/message.Tpo $(DEPDIR)/message.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='encoding/message.c' object='message.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o message.obj `if test -f 'encoding/message.c'; then $(CYGPATH_W) 'encoding/message.c'; else $(CYGPATH_W) '$(srcdir)/encoding/message.c'; fi`
parser.o: encoding/parser.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT parser.o -MD -MP -MF $(DEPDIR)/parser.Tpo -c -o parser.o `test -f 'encoding/parser.c' || echo '$(srcdir)/'`encoding/parser.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/parser.Tpo $(DEPDIR)/parser.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/parser.Tpo $(DEPDIR)/parser.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='encoding/parser.c' object='parser.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o parser.o `test -f 'encoding/parser.c' || echo '$(srcdir)/'`encoding/parser.c
parser.obj: encoding/parser.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT parser.obj -MD -MP -MF $(DEPDIR)/parser.Tpo -c -o parser.obj `if test -f 'encoding/parser.c'; then $(CYGPATH_W) 'encoding/parser.c'; else $(CYGPATH_W) '$(srcdir)/encoding/parser.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/parser.Tpo $(DEPDIR)/parser.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/parser.Tpo $(DEPDIR)/parser.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='encoding/parser.c' object='parser.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o parser.obj `if test -f 'encoding/parser.c'; then $(CYGPATH_W) 'encoding/parser.c'; else $(CYGPATH_W) '$(srcdir)/encoding/parser.c'; fi`
auth_payload.o: encoding/payloads/auth_payload.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT auth_payload.o -MD -MP -MF $(DEPDIR)/auth_payload.Tpo -c -o auth_payload.o `test -f 'encoding/payloads/auth_payload.c' || echo '$(srcdir)/'`encoding/payloads/auth_payload.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/auth_payload.Tpo $(DEPDIR)/auth_payload.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/auth_payload.Tpo $(DEPDIR)/auth_payload.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='encoding/payloads/auth_payload.c' object='auth_payload.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o auth_payload.o `test -f 'encoding/payloads/auth_payload.c' || echo '$(srcdir)/'`encoding/payloads/auth_payload.c
auth_payload.obj: encoding/payloads/auth_payload.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT auth_payload.obj -MD -MP -MF $(DEPDIR)/auth_payload.Tpo -c -o auth_payload.obj `if test -f 'encoding/payloads/auth_payload.c'; then $(CYGPATH_W) 'encoding/payloads/auth_payload.c'; else $(CYGPATH_W) '$(srcdir)/encoding/payloads/auth_payload.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/auth_payload.Tpo $(DEPDIR)/auth_payload.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/auth_payload.Tpo $(DEPDIR)/auth_payload.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='encoding/payloads/auth_payload.c' object='auth_payload.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o auth_payload.obj `if test -f 'encoding/payloads/auth_payload.c'; then $(CYGPATH_W) 'encoding/payloads/auth_payload.c'; else $(CYGPATH_W) '$(srcdir)/encoding/payloads/auth_payload.c'; fi`
cert_payload.o: encoding/payloads/cert_payload.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT cert_payload.o -MD -MP -MF $(DEPDIR)/cert_payload.Tpo -c -o cert_payload.o `test -f 'encoding/payloads/cert_payload.c' || echo '$(srcdir)/'`encoding/payloads/cert_payload.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/cert_payload.Tpo $(DEPDIR)/cert_payload.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/cert_payload.Tpo $(DEPDIR)/cert_payload.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='encoding/payloads/cert_payload.c' object='cert_payload.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o cert_payload.o `test -f 'encoding/payloads/cert_payload.c' || echo '$(srcdir)/'`encoding/payloads/cert_payload.c
cert_payload.obj: encoding/payloads/cert_payload.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT cert_payload.obj -MD -MP -MF $(DEPDIR)/cert_payload.Tpo -c -o cert_payload.obj `if test -f 'encoding/payloads/cert_payload.c'; then $(CYGPATH_W) 'encoding/payloads/cert_payload.c'; else $(CYGPATH_W) '$(srcdir)/encoding/payloads/cert_payload.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/cert_payload.Tpo $(DEPDIR)/cert_payload.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/cert_payload.Tpo $(DEPDIR)/cert_payload.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='encoding/payloads/cert_payload.c' object='cert_payload.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o cert_payload.obj `if test -f 'encoding/payloads/cert_payload.c'; then $(CYGPATH_W) 'encoding/payloads/cert_payload.c'; else $(CYGPATH_W) '$(srcdir)/encoding/payloads/cert_payload.c'; fi`
certreq_payload.o: encoding/payloads/certreq_payload.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT certreq_payload.o -MD -MP -MF $(DEPDIR)/certreq_payload.Tpo -c -o certreq_payload.o `test -f 'encoding/payloads/certreq_payload.c' || echo '$(srcdir)/'`encoding/payloads/certreq_payload.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/certreq_payload.Tpo $(DEPDIR)/certreq_payload.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/certreq_payload.Tpo $(DEPDIR)/certreq_payload.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='encoding/payloads/certreq_payload.c' object='certreq_payload.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o certreq_payload.o `test -f 'encoding/payloads/certreq_payload.c' || echo '$(srcdir)/'`encoding/payloads/certreq_payload.c
certreq_payload.obj: encoding/payloads/certreq_payload.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT certreq_payload.obj -MD -MP -MF $(DEPDIR)/certreq_payload.Tpo -c -o certreq_payload.obj `if test -f 'encoding/payloads/certreq_payload.c'; then $(CYGPATH_W) 'encoding/payloads/certreq_payload.c'; else $(CYGPATH_W) '$(srcdir)/encoding/payloads/certreq_payload.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/certreq_payload.Tpo $(DEPDIR)/certreq_payload.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/certreq_payload.Tpo $(DEPDIR)/certreq_payload.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='encoding/payloads/certreq_payload.c' object='certreq_payload.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o certreq_payload.obj `if test -f 'encoding/payloads/certreq_payload.c'; then $(CYGPATH_W) 'encoding/payloads/certreq_payload.c'; else $(CYGPATH_W) '$(srcdir)/encoding/payloads/certreq_payload.c'; fi`
configuration_attribute.o: encoding/payloads/configuration_attribute.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT configuration_attribute.o -MD -MP -MF $(DEPDIR)/configuration_attribute.Tpo -c -o configuration_attribute.o `test -f 'encoding/payloads/configuration_attribute.c' || echo '$(srcdir)/'`encoding/payloads/configuration_attribute.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/configuration_attribute.Tpo $(DEPDIR)/configuration_attribute.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/configuration_attribute.Tpo $(DEPDIR)/configuration_attribute.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='encoding/payloads/configuration_attribute.c' object='configuration_attribute.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o configuration_attribute.o `test -f 'encoding/payloads/configuration_attribute.c' || echo '$(srcdir)/'`encoding/payloads/configuration_attribute.c
configuration_attribute.obj: encoding/payloads/configuration_attribute.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT configuration_attribute.obj -MD -MP -MF $(DEPDIR)/configuration_attribute.Tpo -c -o configuration_attribute.obj `if test -f 'encoding/payloads/configuration_attribute.c'; then $(CYGPATH_W) 'encoding/payloads/configuration_attribute.c'; else $(CYGPATH_W) '$(srcdir)/encoding/payloads/configuration_attribute.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/configuration_attribute.Tpo $(DEPDIR)/configuration_attribute.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/configuration_attribute.Tpo $(DEPDIR)/configuration_attribute.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='encoding/payloads/configuration_attribute.c' object='configuration_attribute.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o configuration_attribute.obj `if test -f 'encoding/payloads/configuration_attribute.c'; then $(CYGPATH_W) 'encoding/payloads/configuration_attribute.c'; else $(CYGPATH_W) '$(srcdir)/encoding/payloads/configuration_attribute.c'; fi`
cp_payload.o: encoding/payloads/cp_payload.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT cp_payload.o -MD -MP -MF $(DEPDIR)/cp_payload.Tpo -c -o cp_payload.o `test -f 'encoding/payloads/cp_payload.c' || echo '$(srcdir)/'`encoding/payloads/cp_payload.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/cp_payload.Tpo $(DEPDIR)/cp_payload.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/cp_payload.Tpo $(DEPDIR)/cp_payload.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='encoding/payloads/cp_payload.c' object='cp_payload.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o cp_payload.o `test -f 'encoding/payloads/cp_payload.c' || echo '$(srcdir)/'`encoding/payloads/cp_payload.c
cp_payload.obj: encoding/payloads/cp_payload.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT cp_payload.obj -MD -MP -MF $(DEPDIR)/cp_payload.Tpo -c -o cp_payload.obj `if test -f 'encoding/payloads/cp_payload.c'; then $(CYGPATH_W) 'encoding/payloads/cp_payload.c'; else $(CYGPATH_W) '$(srcdir)/encoding/payloads/cp_payload.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/cp_payload.Tpo $(DEPDIR)/cp_payload.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/cp_payload.Tpo $(DEPDIR)/cp_payload.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='encoding/payloads/cp_payload.c' object='cp_payload.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o cp_payload.obj `if test -f 'encoding/payloads/cp_payload.c'; then $(CYGPATH_W) 'encoding/payloads/cp_payload.c'; else $(CYGPATH_W) '$(srcdir)/encoding/payloads/cp_payload.c'; fi`
delete_payload.o: encoding/payloads/delete_payload.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT delete_payload.o -MD -MP -MF $(DEPDIR)/delete_payload.Tpo -c -o delete_payload.o `test -f 'encoding/payloads/delete_payload.c' || echo '$(srcdir)/'`encoding/payloads/delete_payload.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/delete_payload.Tpo $(DEPDIR)/delete_payload.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/delete_payload.Tpo $(DEPDIR)/delete_payload.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='encoding/payloads/delete_payload.c' object='delete_payload.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o delete_payload.o `test -f 'encoding/payloads/delete_payload.c' || echo '$(srcdir)/'`encoding/payloads/delete_payload.c
delete_payload.obj: encoding/payloads/delete_payload.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT delete_payload.obj -MD -MP -MF $(DEPDIR)/delete_payload.Tpo -c -o delete_payload.obj `if test -f 'encoding/payloads/delete_payload.c'; then $(CYGPATH_W) 'encoding/payloads/delete_payload.c'; else $(CYGPATH_W) '$(srcdir)/encoding/payloads/delete_payload.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/delete_payload.Tpo $(DEPDIR)/delete_payload.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/delete_payload.Tpo $(DEPDIR)/delete_payload.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='encoding/payloads/delete_payload.c' object='delete_payload.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o delete_payload.obj `if test -f 'encoding/payloads/delete_payload.c'; then $(CYGPATH_W) 'encoding/payloads/delete_payload.c'; else $(CYGPATH_W) '$(srcdir)/encoding/payloads/delete_payload.c'; fi`
eap_payload.o: encoding/payloads/eap_payload.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT eap_payload.o -MD -MP -MF $(DEPDIR)/eap_payload.Tpo -c -o eap_payload.o `test -f 'encoding/payloads/eap_payload.c' || echo '$(srcdir)/'`encoding/payloads/eap_payload.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/eap_payload.Tpo $(DEPDIR)/eap_payload.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/eap_payload.Tpo $(DEPDIR)/eap_payload.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='encoding/payloads/eap_payload.c' object='eap_payload.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o eap_payload.o `test -f 'encoding/payloads/eap_payload.c' || echo '$(srcdir)/'`encoding/payloads/eap_payload.c
eap_payload.obj: encoding/payloads/eap_payload.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT eap_payload.obj -MD -MP -MF $(DEPDIR)/eap_payload.Tpo -c -o eap_payload.obj `if test -f 'encoding/payloads/eap_payload.c'; then $(CYGPATH_W) 'encoding/payloads/eap_payload.c'; else $(CYGPATH_W) '$(srcdir)/encoding/payloads/eap_payload.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/eap_payload.Tpo $(DEPDIR)/eap_payload.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/eap_payload.Tpo $(DEPDIR)/eap_payload.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='encoding/payloads/eap_payload.c' object='eap_payload.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o eap_payload.obj `if test -f 'encoding/payloads/eap_payload.c'; then $(CYGPATH_W) 'encoding/payloads/eap_payload.c'; else $(CYGPATH_W) '$(srcdir)/encoding/payloads/eap_payload.c'; fi`
encodings.o: encoding/payloads/encodings.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT encodings.o -MD -MP -MF $(DEPDIR)/encodings.Tpo -c -o encodings.o `test -f 'encoding/payloads/encodings.c' || echo '$(srcdir)/'`encoding/payloads/encodings.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/encodings.Tpo $(DEPDIR)/encodings.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/encodings.Tpo $(DEPDIR)/encodings.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='encoding/payloads/encodings.c' object='encodings.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o encodings.o `test -f 'encoding/payloads/encodings.c' || echo '$(srcdir)/'`encoding/payloads/encodings.c
encodings.obj: encoding/payloads/encodings.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT encodings.obj -MD -MP -MF $(DEPDIR)/encodings.Tpo -c -o encodings.obj `if test -f 'encoding/payloads/encodings.c'; then $(CYGPATH_W) 'encoding/payloads/encodings.c'; else $(CYGPATH_W) '$(srcdir)/encoding/payloads/encodings.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/encodings.Tpo $(DEPDIR)/encodings.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/encodings.Tpo $(DEPDIR)/encodings.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='encoding/payloads/encodings.c' object='encodings.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o encodings.obj `if test -f 'encoding/payloads/encodings.c'; then $(CYGPATH_W) 'encoding/payloads/encodings.c'; else $(CYGPATH_W) '$(srcdir)/encoding/payloads/encodings.c'; fi`
encryption_payload.o: encoding/payloads/encryption_payload.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT encryption_payload.o -MD -MP -MF $(DEPDIR)/encryption_payload.Tpo -c -o encryption_payload.o `test -f 'encoding/payloads/encryption_payload.c' || echo '$(srcdir)/'`encoding/payloads/encryption_payload.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/encryption_payload.Tpo $(DEPDIR)/encryption_payload.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/encryption_payload.Tpo $(DEPDIR)/encryption_payload.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='encoding/payloads/encryption_payload.c' object='encryption_payload.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o encryption_payload.o `test -f 'encoding/payloads/encryption_payload.c' || echo '$(srcdir)/'`encoding/payloads/encryption_payload.c
encryption_payload.obj: encoding/payloads/encryption_payload.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT encryption_payload.obj -MD -MP -MF $(DEPDIR)/encryption_payload.Tpo -c -o encryption_payload.obj `if test -f 'encoding/payloads/encryption_payload.c'; then $(CYGPATH_W) 'encoding/payloads/encryption_payload.c'; else $(CYGPATH_W) '$(srcdir)/encoding/payloads/encryption_payload.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/encryption_payload.Tpo $(DEPDIR)/encryption_payload.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/encryption_payload.Tpo $(DEPDIR)/encryption_payload.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='encoding/payloads/encryption_payload.c' object='encryption_payload.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o encryption_payload.obj `if test -f 'encoding/payloads/encryption_payload.c'; then $(CYGPATH_W) 'encoding/payloads/encryption_payload.c'; else $(CYGPATH_W) '$(srcdir)/encoding/payloads/encryption_payload.c'; fi`
id_payload.o: encoding/payloads/id_payload.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT id_payload.o -MD -MP -MF $(DEPDIR)/id_payload.Tpo -c -o id_payload.o `test -f 'encoding/payloads/id_payload.c' || echo '$(srcdir)/'`encoding/payloads/id_payload.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/id_payload.Tpo $(DEPDIR)/id_payload.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/id_payload.Tpo $(DEPDIR)/id_payload.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='encoding/payloads/id_payload.c' object='id_payload.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o id_payload.o `test -f 'encoding/payloads/id_payload.c' || echo '$(srcdir)/'`encoding/payloads/id_payload.c
id_payload.obj: encoding/payloads/id_payload.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT id_payload.obj -MD -MP -MF $(DEPDIR)/id_payload.Tpo -c -o id_payload.obj `if test -f 'encoding/payloads/id_payload.c'; then $(CYGPATH_W) 'encoding/payloads/id_payload.c'; else $(CYGPATH_W) '$(srcdir)/encoding/payloads/id_payload.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/id_payload.Tpo $(DEPDIR)/id_payload.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/id_payload.Tpo $(DEPDIR)/id_payload.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='encoding/payloads/id_payload.c' object='id_payload.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o id_payload.obj `if test -f 'encoding/payloads/id_payload.c'; then $(CYGPATH_W) 'encoding/payloads/id_payload.c'; else $(CYGPATH_W) '$(srcdir)/encoding/payloads/id_payload.c'; fi`
ike_header.o: encoding/payloads/ike_header.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ike_header.o -MD -MP -MF $(DEPDIR)/ike_header.Tpo -c -o ike_header.o `test -f 'encoding/payloads/ike_header.c' || echo '$(srcdir)/'`encoding/payloads/ike_header.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/ike_header.Tpo $(DEPDIR)/ike_header.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/ike_header.Tpo $(DEPDIR)/ike_header.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='encoding/payloads/ike_header.c' object='ike_header.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ike_header.o `test -f 'encoding/payloads/ike_header.c' || echo '$(srcdir)/'`encoding/payloads/ike_header.c
ike_header.obj: encoding/payloads/ike_header.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ike_header.obj -MD -MP -MF $(DEPDIR)/ike_header.Tpo -c -o ike_header.obj `if test -f 'encoding/payloads/ike_header.c'; then $(CYGPATH_W) 'encoding/payloads/ike_header.c'; else $(CYGPATH_W) '$(srcdir)/encoding/payloads/ike_header.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/ike_header.Tpo $(DEPDIR)/ike_header.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/ike_header.Tpo $(DEPDIR)/ike_header.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='encoding/payloads/ike_header.c' object='ike_header.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ike_header.obj `if test -f 'encoding/payloads/ike_header.c'; then $(CYGPATH_W) 'encoding/payloads/ike_header.c'; else $(CYGPATH_W) '$(srcdir)/encoding/payloads/ike_header.c'; fi`
ke_payload.o: encoding/payloads/ke_payload.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ke_payload.o -MD -MP -MF $(DEPDIR)/ke_payload.Tpo -c -o ke_payload.o `test -f 'encoding/payloads/ke_payload.c' || echo '$(srcdir)/'`encoding/payloads/ke_payload.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/ke_payload.Tpo $(DEPDIR)/ke_payload.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/ke_payload.Tpo $(DEPDIR)/ke_payload.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='encoding/payloads/ke_payload.c' object='ke_payload.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ke_payload.o `test -f 'encoding/payloads/ke_payload.c' || echo '$(srcdir)/'`encoding/payloads/ke_payload.c
ke_payload.obj: encoding/payloads/ke_payload.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ke_payload.obj -MD -MP -MF $(DEPDIR)/ke_payload.Tpo -c -o ke_payload.obj `if test -f 'encoding/payloads/ke_payload.c'; then $(CYGPATH_W) 'encoding/payloads/ke_payload.c'; else $(CYGPATH_W) '$(srcdir)/encoding/payloads/ke_payload.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/ke_payload.Tpo $(DEPDIR)/ke_payload.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/ke_payload.Tpo $(DEPDIR)/ke_payload.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='encoding/payloads/ke_payload.c' object='ke_payload.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ke_payload.obj `if test -f 'encoding/payloads/ke_payload.c'; then $(CYGPATH_W) 'encoding/payloads/ke_payload.c'; else $(CYGPATH_W) '$(srcdir)/encoding/payloads/ke_payload.c'; fi`
nonce_payload.o: encoding/payloads/nonce_payload.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT nonce_payload.o -MD -MP -MF $(DEPDIR)/nonce_payload.Tpo -c -o nonce_payload.o `test -f 'encoding/payloads/nonce_payload.c' || echo '$(srcdir)/'`encoding/payloads/nonce_payload.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/nonce_payload.Tpo $(DEPDIR)/nonce_payload.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/nonce_payload.Tpo $(DEPDIR)/nonce_payload.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='encoding/payloads/nonce_payload.c' object='nonce_payload.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o nonce_payload.o `test -f 'encoding/payloads/nonce_payload.c' || echo '$(srcdir)/'`encoding/payloads/nonce_payload.c
nonce_payload.obj: encoding/payloads/nonce_payload.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT nonce_payload.obj -MD -MP -MF $(DEPDIR)/nonce_payload.Tpo -c -o nonce_payload.obj `if test -f 'encoding/payloads/nonce_payload.c'; then $(CYGPATH_W) 'encoding/payloads/nonce_payload.c'; else $(CYGPATH_W) '$(srcdir)/encoding/payloads/nonce_payload.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/nonce_payload.Tpo $(DEPDIR)/nonce_payload.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/nonce_payload.Tpo $(DEPDIR)/nonce_payload.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='encoding/payloads/nonce_payload.c' object='nonce_payload.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o nonce_payload.obj `if test -f 'encoding/payloads/nonce_payload.c'; then $(CYGPATH_W) 'encoding/payloads/nonce_payload.c'; else $(CYGPATH_W) '$(srcdir)/encoding/payloads/nonce_payload.c'; fi`
notify_payload.o: encoding/payloads/notify_payload.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT notify_payload.o -MD -MP -MF $(DEPDIR)/notify_payload.Tpo -c -o notify_payload.o `test -f 'encoding/payloads/notify_payload.c' || echo '$(srcdir)/'`encoding/payloads/notify_payload.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/notify_payload.Tpo $(DEPDIR)/notify_payload.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/notify_payload.Tpo $(DEPDIR)/notify_payload.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='encoding/payloads/notify_payload.c' object='notify_payload.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o notify_payload.o `test -f 'encoding/payloads/notify_payload.c' || echo '$(srcdir)/'`encoding/payloads/notify_payload.c
notify_payload.obj: encoding/payloads/notify_payload.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT notify_payload.obj -MD -MP -MF $(DEPDIR)/notify_payload.Tpo -c -o notify_payload.obj `if test -f 'encoding/payloads/notify_payload.c'; then $(CYGPATH_W) 'encoding/payloads/notify_payload.c'; else $(CYGPATH_W) '$(srcdir)/encoding/payloads/notify_payload.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/notify_payload.Tpo $(DEPDIR)/notify_payload.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/notify_payload.Tpo $(DEPDIR)/notify_payload.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='encoding/payloads/notify_payload.c' object='notify_payload.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o notify_payload.obj `if test -f 'encoding/payloads/notify_payload.c'; then $(CYGPATH_W) 'encoding/payloads/notify_payload.c'; else $(CYGPATH_W) '$(srcdir)/encoding/payloads/notify_payload.c'; fi`
payload.o: encoding/payloads/payload.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT payload.o -MD -MP -MF $(DEPDIR)/payload.Tpo -c -o payload.o `test -f 'encoding/payloads/payload.c' || echo '$(srcdir)/'`encoding/payloads/payload.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/payload.Tpo $(DEPDIR)/payload.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/payload.Tpo $(DEPDIR)/payload.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='encoding/payloads/payload.c' object='payload.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o payload.o `test -f 'encoding/payloads/payload.c' || echo '$(srcdir)/'`encoding/payloads/payload.c
payload.obj: encoding/payloads/payload.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT payload.obj -MD -MP -MF $(DEPDIR)/payload.Tpo -c -o payload.obj `if test -f 'encoding/payloads/payload.c'; then $(CYGPATH_W) 'encoding/payloads/payload.c'; else $(CYGPATH_W) '$(srcdir)/encoding/payloads/payload.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/payload.Tpo $(DEPDIR)/payload.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/payload.Tpo $(DEPDIR)/payload.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='encoding/payloads/payload.c' object='payload.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o payload.obj `if test -f 'encoding/payloads/payload.c'; then $(CYGPATH_W) 'encoding/payloads/payload.c'; else $(CYGPATH_W) '$(srcdir)/encoding/payloads/payload.c'; fi`
proposal_substructure.o: encoding/payloads/proposal_substructure.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT proposal_substructure.o -MD -MP -MF $(DEPDIR)/proposal_substructure.Tpo -c -o proposal_substructure.o `test -f 'encoding/payloads/proposal_substructure.c' || echo '$(srcdir)/'`encoding/payloads/proposal_substructure.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/proposal_substructure.Tpo $(DEPDIR)/proposal_substructure.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/proposal_substructure.Tpo $(DEPDIR)/proposal_substructure.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='encoding/payloads/proposal_substructure.c' object='proposal_substructure.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o proposal_substructure.o `test -f 'encoding/payloads/proposal_substructure.c' || echo '$(srcdir)/'`encoding/payloads/proposal_substructure.c
proposal_substructure.obj: encoding/payloads/proposal_substructure.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT proposal_substructure.obj -MD -MP -MF $(DEPDIR)/proposal_substructure.Tpo -c -o proposal_substructure.obj `if test -f 'encoding/payloads/proposal_substructure.c'; then $(CYGPATH_W) 'encoding/payloads/proposal_substructure.c'; else $(CYGPATH_W) '$(srcdir)/encoding/payloads/proposal_substructure.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/proposal_substructure.Tpo $(DEPDIR)/proposal_substructure.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/proposal_substructure.Tpo $(DEPDIR)/proposal_substructure.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='encoding/payloads/proposal_substructure.c' object='proposal_substructure.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o proposal_substructure.obj `if test -f 'encoding/payloads/proposal_substructure.c'; then $(CYGPATH_W) 'encoding/payloads/proposal_substructure.c'; else $(CYGPATH_W) '$(srcdir)/encoding/payloads/proposal_substructure.c'; fi`
sa_payload.o: encoding/payloads/sa_payload.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT sa_payload.o -MD -MP -MF $(DEPDIR)/sa_payload.Tpo -c -o sa_payload.o `test -f 'encoding/payloads/sa_payload.c' || echo '$(srcdir)/'`encoding/payloads/sa_payload.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/sa_payload.Tpo $(DEPDIR)/sa_payload.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/sa_payload.Tpo $(DEPDIR)/sa_payload.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='encoding/payloads/sa_payload.c' object='sa_payload.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o sa_payload.o `test -f 'encoding/payloads/sa_payload.c' || echo '$(srcdir)/'`encoding/payloads/sa_payload.c
sa_payload.obj: encoding/payloads/sa_payload.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT sa_payload.obj -MD -MP -MF $(DEPDIR)/sa_payload.Tpo -c -o sa_payload.obj `if test -f 'encoding/payloads/sa_payload.c'; then $(CYGPATH_W) 'encoding/payloads/sa_payload.c'; else $(CYGPATH_W) '$(srcdir)/encoding/payloads/sa_payload.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/sa_payload.Tpo $(DEPDIR)/sa_payload.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/sa_payload.Tpo $(DEPDIR)/sa_payload.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='encoding/payloads/sa_payload.c' object='sa_payload.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o sa_payload.obj `if test -f 'encoding/payloads/sa_payload.c'; then $(CYGPATH_W) 'encoding/payloads/sa_payload.c'; else $(CYGPATH_W) '$(srcdir)/encoding/payloads/sa_payload.c'; fi`
traffic_selector_substructure.o: encoding/payloads/traffic_selector_substructure.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT traffic_selector_substructure.o -MD -MP -MF $(DEPDIR)/traffic_selector_substructure.Tpo -c -o traffic_selector_substructure.o `test -f 'encoding/payloads/traffic_selector_substructure.c' || echo '$(srcdir)/'`encoding/payloads/traffic_selector_substructure.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/traffic_selector_substructure.Tpo $(DEPDIR)/traffic_selector_substructure.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/traffic_selector_substructure.Tpo $(DEPDIR)/traffic_selector_substructure.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='encoding/payloads/traffic_selector_substructure.c' object='traffic_selector_substructure.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o traffic_selector_substructure.o `test -f 'encoding/payloads/traffic_selector_substructure.c' || echo '$(srcdir)/'`encoding/payloads/traffic_selector_substructure.c
traffic_selector_substructure.obj: encoding/payloads/traffic_selector_substructure.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT traffic_selector_substructure.obj -MD -MP -MF $(DEPDIR)/traffic_selector_substructure.Tpo -c -o traffic_selector_substructure.obj `if test -f 'encoding/payloads/traffic_selector_substructure.c'; then $(CYGPATH_W) 'encoding/payloads/traffic_selector_substructure.c'; else $(CYGPATH_W) '$(srcdir)/encoding/payloads/traffic_selector_substructure.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/traffic_selector_substructure.Tpo $(DEPDIR)/traffic_selector_substructure.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/traffic_selector_substructure.Tpo $(DEPDIR)/traffic_selector_substructure.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='encoding/payloads/traffic_selector_substructure.c' object='traffic_selector_substructure.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o traffic_selector_substructure.obj `if test -f 'encoding/payloads/traffic_selector_substructure.c'; then $(CYGPATH_W) 'encoding/payloads/traffic_selector_substructure.c'; else $(CYGPATH_W) '$(srcdir)/encoding/payloads/traffic_selector_substructure.c'; fi`
transform_attribute.o: encoding/payloads/transform_attribute.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT transform_attribute.o -MD -MP -MF $(DEPDIR)/transform_attribute.Tpo -c -o transform_attribute.o `test -f 'encoding/payloads/transform_attribute.c' || echo '$(srcdir)/'`encoding/payloads/transform_attribute.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/transform_attribute.Tpo $(DEPDIR)/transform_attribute.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/transform_attribute.Tpo $(DEPDIR)/transform_attribute.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='encoding/payloads/transform_attribute.c' object='transform_attribute.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o transform_attribute.o `test -f 'encoding/payloads/transform_attribute.c' || echo '$(srcdir)/'`encoding/payloads/transform_attribute.c
transform_attribute.obj: encoding/payloads/transform_attribute.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT transform_attribute.obj -MD -MP -MF $(DEPDIR)/transform_attribute.Tpo -c -o transform_attribute.obj `if test -f 'encoding/payloads/transform_attribute.c'; then $(CYGPATH_W) 'encoding/payloads/transform_attribute.c'; else $(CYGPATH_W) '$(srcdir)/encoding/payloads/transform_attribute.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/transform_attribute.Tpo $(DEPDIR)/transform_attribute.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/transform_attribute.Tpo $(DEPDIR)/transform_attribute.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='encoding/payloads/transform_attribute.c' object='transform_attribute.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o transform_attribute.obj `if test -f 'encoding/payloads/transform_attribute.c'; then $(CYGPATH_W) 'encoding/payloads/transform_attribute.c'; else $(CYGPATH_W) '$(srcdir)/encoding/payloads/transform_attribute.c'; fi`
transform_substructure.o: encoding/payloads/transform_substructure.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT transform_substructure.o -MD -MP -MF $(DEPDIR)/transform_substructure.Tpo -c -o transform_substructure.o `test -f 'encoding/payloads/transform_substructure.c' || echo '$(srcdir)/'`encoding/payloads/transform_substructure.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/transform_substructure.Tpo $(DEPDIR)/transform_substructure.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/transform_substructure.Tpo $(DEPDIR)/transform_substructure.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='encoding/payloads/transform_substructure.c' object='transform_substructure.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o transform_substructure.o `test -f 'encoding/payloads/transform_substructure.c' || echo '$(srcdir)/'`encoding/payloads/transform_substructure.c
transform_substructure.obj: encoding/payloads/transform_substructure.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT transform_substructure.obj -MD -MP -MF $(DEPDIR)/transform_substructure.Tpo -c -o transform_substructure.obj `if test -f 'encoding/payloads/transform_substructure.c'; then $(CYGPATH_W) 'encoding/payloads/transform_substructure.c'; else $(CYGPATH_W) '$(srcdir)/encoding/payloads/transform_substructure.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/transform_substructure.Tpo $(DEPDIR)/transform_substructure.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/transform_substructure.Tpo $(DEPDIR)/transform_substructure.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='encoding/payloads/transform_substructure.c' object='transform_substructure.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o transform_substructure.obj `if test -f 'encoding/payloads/transform_substructure.c'; then $(CYGPATH_W) 'encoding/payloads/transform_substructure.c'; else $(CYGPATH_W) '$(srcdir)/encoding/payloads/transform_substructure.c'; fi`
ts_payload.o: encoding/payloads/ts_payload.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ts_payload.o -MD -MP -MF $(DEPDIR)/ts_payload.Tpo -c -o ts_payload.o `test -f 'encoding/payloads/ts_payload.c' || echo '$(srcdir)/'`encoding/payloads/ts_payload.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/ts_payload.Tpo $(DEPDIR)/ts_payload.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/ts_payload.Tpo $(DEPDIR)/ts_payload.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='encoding/payloads/ts_payload.c' object='ts_payload.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ts_payload.o `test -f 'encoding/payloads/ts_payload.c' || echo '$(srcdir)/'`encoding/payloads/ts_payload.c
ts_payload.obj: encoding/payloads/ts_payload.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ts_payload.obj -MD -MP -MF $(DEPDIR)/ts_payload.Tpo -c -o ts_payload.obj `if test -f 'encoding/payloads/ts_payload.c'; then $(CYGPATH_W) 'encoding/payloads/ts_payload.c'; else $(CYGPATH_W) '$(srcdir)/encoding/payloads/ts_payload.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/ts_payload.Tpo $(DEPDIR)/ts_payload.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/ts_payload.Tpo $(DEPDIR)/ts_payload.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='encoding/payloads/ts_payload.c' object='ts_payload.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ts_payload.obj `if test -f 'encoding/payloads/ts_payload.c'; then $(CYGPATH_W) 'encoding/payloads/ts_payload.c'; else $(CYGPATH_W) '$(srcdir)/encoding/payloads/ts_payload.c'; fi`
unknown_payload.o: encoding/payloads/unknown_payload.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT unknown_payload.o -MD -MP -MF $(DEPDIR)/unknown_payload.Tpo -c -o unknown_payload.o `test -f 'encoding/payloads/unknown_payload.c' || echo '$(srcdir)/'`encoding/payloads/unknown_payload.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/unknown_payload.Tpo $(DEPDIR)/unknown_payload.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/unknown_payload.Tpo $(DEPDIR)/unknown_payload.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='encoding/payloads/unknown_payload.c' object='unknown_payload.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o unknown_payload.o `test -f 'encoding/payloads/unknown_payload.c' || echo '$(srcdir)/'`encoding/payloads/unknown_payload.c
unknown_payload.obj: encoding/payloads/unknown_payload.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT unknown_payload.obj -MD -MP -MF $(DEPDIR)/unknown_payload.Tpo -c -o unknown_payload.obj `if test -f 'encoding/payloads/unknown_payload.c'; then $(CYGPATH_W) 'encoding/payloads/unknown_payload.c'; else $(CYGPATH_W) '$(srcdir)/encoding/payloads/unknown_payload.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/unknown_payload.Tpo $(DEPDIR)/unknown_payload.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/unknown_payload.Tpo $(DEPDIR)/unknown_payload.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='encoding/payloads/unknown_payload.c' object='unknown_payload.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o unknown_payload.obj `if test -f 'encoding/payloads/unknown_payload.c'; then $(CYGPATH_W) 'encoding/payloads/unknown_payload.c'; else $(CYGPATH_W) '$(srcdir)/encoding/payloads/unknown_payload.c'; fi`
vendor_id_payload.o: encoding/payloads/vendor_id_payload.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT vendor_id_payload.o -MD -MP -MF $(DEPDIR)/vendor_id_payload.Tpo -c -o vendor_id_payload.o `test -f 'encoding/payloads/vendor_id_payload.c' || echo '$(srcdir)/'`encoding/payloads/vendor_id_payload.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/vendor_id_payload.Tpo $(DEPDIR)/vendor_id_payload.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/vendor_id_payload.Tpo $(DEPDIR)/vendor_id_payload.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='encoding/payloads/vendor_id_payload.c' object='vendor_id_payload.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o vendor_id_payload.o `test -f 'encoding/payloads/vendor_id_payload.c' || echo '$(srcdir)/'`encoding/payloads/vendor_id_payload.c
vendor_id_payload.obj: encoding/payloads/vendor_id_payload.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT vendor_id_payload.obj -MD -MP -MF $(DEPDIR)/vendor_id_payload.Tpo -c -o vendor_id_payload.obj `if test -f 'encoding/payloads/vendor_id_payload.c'; then $(CYGPATH_W) 'encoding/payloads/vendor_id_payload.c'; else $(CYGPATH_W) '$(srcdir)/encoding/payloads/vendor_id_payload.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/vendor_id_payload.Tpo $(DEPDIR)/vendor_id_payload.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/vendor_id_payload.Tpo $(DEPDIR)/vendor_id_payload.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='encoding/payloads/vendor_id_payload.c' object='vendor_id_payload.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o vendor_id_payload.obj `if test -f 'encoding/payloads/vendor_id_payload.c'; then $(CYGPATH_W) 'encoding/payloads/vendor_id_payload.c'; else $(CYGPATH_W) '$(srcdir)/encoding/payloads/vendor_id_payload.c'; fi`
kernel_interface.o: kernel/kernel_interface.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT kernel_interface.o -MD -MP -MF $(DEPDIR)/kernel_interface.Tpo -c -o kernel_interface.o `test -f 'kernel/kernel_interface.c' || echo '$(srcdir)/'`kernel/kernel_interface.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/kernel_interface.Tpo $(DEPDIR)/kernel_interface.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/kernel_interface.Tpo $(DEPDIR)/kernel_interface.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='kernel/kernel_interface.c' object='kernel_interface.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o kernel_interface.o `test -f 'kernel/kernel_interface.c' || echo '$(srcdir)/'`kernel/kernel_interface.c
kernel_interface.obj: kernel/kernel_interface.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT kernel_interface.obj -MD -MP -MF $(DEPDIR)/kernel_interface.Tpo -c -o kernel_interface.obj `if test -f 'kernel/kernel_interface.c'; then $(CYGPATH_W) 'kernel/kernel_interface.c'; else $(CYGPATH_W) '$(srcdir)/kernel/kernel_interface.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/kernel_interface.Tpo $(DEPDIR)/kernel_interface.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/kernel_interface.Tpo $(DEPDIR)/kernel_interface.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='kernel/kernel_interface.c' object='kernel_interface.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o kernel_interface.obj `if test -f 'kernel/kernel_interface.c'; then $(CYGPATH_W) 'kernel/kernel_interface.c'; else $(CYGPATH_W) '$(srcdir)/kernel/kernel_interface.c'; fi`
kernel_ipsec.o: kernel/kernel_ipsec.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT kernel_ipsec.o -MD -MP -MF $(DEPDIR)/kernel_ipsec.Tpo -c -o kernel_ipsec.o `test -f 'kernel/kernel_ipsec.c' || echo '$(srcdir)/'`kernel/kernel_ipsec.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/kernel_ipsec.Tpo $(DEPDIR)/kernel_ipsec.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/kernel_ipsec.Tpo $(DEPDIR)/kernel_ipsec.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='kernel/kernel_ipsec.c' object='kernel_ipsec.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o kernel_ipsec.o `test -f 'kernel/kernel_ipsec.c' || echo '$(srcdir)/'`kernel/kernel_ipsec.c
kernel_ipsec.obj: kernel/kernel_ipsec.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT kernel_ipsec.obj -MD -MP -MF $(DEPDIR)/kernel_ipsec.Tpo -c -o kernel_ipsec.obj `if test -f 'kernel/kernel_ipsec.c'; then $(CYGPATH_W) 'kernel/kernel_ipsec.c'; else $(CYGPATH_W) '$(srcdir)/kernel/kernel_ipsec.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/kernel_ipsec.Tpo $(DEPDIR)/kernel_ipsec.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/kernel_ipsec.Tpo $(DEPDIR)/kernel_ipsec.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='kernel/kernel_ipsec.c' object='kernel_ipsec.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o kernel_ipsec.obj `if test -f 'kernel/kernel_ipsec.c'; then $(CYGPATH_W) 'kernel/kernel_ipsec.c'; else $(CYGPATH_W) '$(srcdir)/kernel/kernel_ipsec.c'; fi`
packet.o: network/packet.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT packet.o -MD -MP -MF $(DEPDIR)/packet.Tpo -c -o packet.o `test -f 'network/packet.c' || echo '$(srcdir)/'`network/packet.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/packet.Tpo $(DEPDIR)/packet.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/packet.Tpo $(DEPDIR)/packet.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='network/packet.c' object='packet.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o packet.o `test -f 'network/packet.c' || echo '$(srcdir)/'`network/packet.c
packet.obj: network/packet.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT packet.obj -MD -MP -MF $(DEPDIR)/packet.Tpo -c -o packet.obj `if test -f 'network/packet.c'; then $(CYGPATH_W) 'network/packet.c'; else $(CYGPATH_W) '$(srcdir)/network/packet.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/packet.Tpo $(DEPDIR)/packet.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/packet.Tpo $(DEPDIR)/packet.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='network/packet.c' object='packet.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o packet.obj `if test -f 'network/packet.c'; then $(CYGPATH_W) 'network/packet.c'; else $(CYGPATH_W) '$(srcdir)/network/packet.c'; fi`
receiver.o: network/receiver.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT receiver.o -MD -MP -MF $(DEPDIR)/receiver.Tpo -c -o receiver.o `test -f 'network/receiver.c' || echo '$(srcdir)/'`network/receiver.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/receiver.Tpo $(DEPDIR)/receiver.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/receiver.Tpo $(DEPDIR)/receiver.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='network/receiver.c' object='receiver.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o receiver.o `test -f 'network/receiver.c' || echo '$(srcdir)/'`network/receiver.c
receiver.obj: network/receiver.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT receiver.obj -MD -MP -MF $(DEPDIR)/receiver.Tpo -c -o receiver.obj `if test -f 'network/receiver.c'; then $(CYGPATH_W) 'network/receiver.c'; else $(CYGPATH_W) '$(srcdir)/network/receiver.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/receiver.Tpo $(DEPDIR)/receiver.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/receiver.Tpo $(DEPDIR)/receiver.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='network/receiver.c' object='receiver.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o receiver.obj `if test -f 'network/receiver.c'; then $(CYGPATH_W) 'network/receiver.c'; else $(CYGPATH_W) '$(srcdir)/network/receiver.c'; fi`
sender.o: network/sender.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT sender.o -MD -MP -MF $(DEPDIR)/sender.Tpo -c -o sender.o `test -f 'network/sender.c' || echo '$(srcdir)/'`network/sender.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/sender.Tpo $(DEPDIR)/sender.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/sender.Tpo $(DEPDIR)/sender.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='network/sender.c' object='sender.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o sender.o `test -f 'network/sender.c' || echo '$(srcdir)/'`network/sender.c
sender.obj: network/sender.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT sender.obj -MD -MP -MF $(DEPDIR)/sender.Tpo -c -o sender.obj `if test -f 'network/sender.c'; then $(CYGPATH_W) 'network/sender.c'; else $(CYGPATH_W) '$(srcdir)/network/sender.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/sender.Tpo $(DEPDIR)/sender.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/sender.Tpo $(DEPDIR)/sender.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='network/sender.c' object='sender.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o sender.obj `if test -f 'network/sender.c'; then $(CYGPATH_W) 'network/sender.c'; else $(CYGPATH_W) '$(srcdir)/network/sender.c'; fi`
acquire_job.o: processing/jobs/acquire_job.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT acquire_job.o -MD -MP -MF $(DEPDIR)/acquire_job.Tpo -c -o acquire_job.o `test -f 'processing/jobs/acquire_job.c' || echo '$(srcdir)/'`processing/jobs/acquire_job.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/acquire_job.Tpo $(DEPDIR)/acquire_job.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/acquire_job.Tpo $(DEPDIR)/acquire_job.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='processing/jobs/acquire_job.c' object='acquire_job.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o acquire_job.o `test -f 'processing/jobs/acquire_job.c' || echo '$(srcdir)/'`processing/jobs/acquire_job.c
acquire_job.obj: processing/jobs/acquire_job.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT acquire_job.obj -MD -MP -MF $(DEPDIR)/acquire_job.Tpo -c -o acquire_job.obj `if test -f 'processing/jobs/acquire_job.c'; then $(CYGPATH_W) 'processing/jobs/acquire_job.c'; else $(CYGPATH_W) '$(srcdir)/processing/jobs/acquire_job.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/acquire_job.Tpo $(DEPDIR)/acquire_job.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/acquire_job.Tpo $(DEPDIR)/acquire_job.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='processing/jobs/acquire_job.c' object='acquire_job.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o acquire_job.obj `if test -f 'processing/jobs/acquire_job.c'; then $(CYGPATH_W) 'processing/jobs/acquire_job.c'; else $(CYGPATH_W) '$(srcdir)/processing/jobs/acquire_job.c'; fi`
callback_job.o: processing/jobs/callback_job.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT callback_job.o -MD -MP -MF $(DEPDIR)/callback_job.Tpo -c -o callback_job.o `test -f 'processing/jobs/callback_job.c' || echo '$(srcdir)/'`processing/jobs/callback_job.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/callback_job.Tpo $(DEPDIR)/callback_job.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/callback_job.Tpo $(DEPDIR)/callback_job.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='processing/jobs/callback_job.c' object='callback_job.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o callback_job.o `test -f 'processing/jobs/callback_job.c' || echo '$(srcdir)/'`processing/jobs/callback_job.c
callback_job.obj: processing/jobs/callback_job.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT callback_job.obj -MD -MP -MF $(DEPDIR)/callback_job.Tpo -c -o callback_job.obj `if test -f 'processing/jobs/callback_job.c'; then $(CYGPATH_W) 'processing/jobs/callback_job.c'; else $(CYGPATH_W) '$(srcdir)/processing/jobs/callback_job.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/callback_job.Tpo $(DEPDIR)/callback_job.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/callback_job.Tpo $(DEPDIR)/callback_job.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='processing/jobs/callback_job.c' object='callback_job.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o callback_job.obj `if test -f 'processing/jobs/callback_job.c'; then $(CYGPATH_W) 'processing/jobs/callback_job.c'; else $(CYGPATH_W) '$(srcdir)/processing/jobs/callback_job.c'; fi`
delete_child_sa_job.o: processing/jobs/delete_child_sa_job.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT delete_child_sa_job.o -MD -MP -MF $(DEPDIR)/delete_child_sa_job.Tpo -c -o delete_child_sa_job.o `test -f 'processing/jobs/delete_child_sa_job.c' || echo '$(srcdir)/'`processing/jobs/delete_child_sa_job.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/delete_child_sa_job.Tpo $(DEPDIR)/delete_child_sa_job.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/delete_child_sa_job.Tpo $(DEPDIR)/delete_child_sa_job.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='processing/jobs/delete_child_sa_job.c' object='delete_child_sa_job.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o delete_child_sa_job.o `test -f 'processing/jobs/delete_child_sa_job.c' || echo '$(srcdir)/'`processing/jobs/delete_child_sa_job.c
delete_child_sa_job.obj: processing/jobs/delete_child_sa_job.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT delete_child_sa_job.obj -MD -MP -MF $(DEPDIR)/delete_child_sa_job.Tpo -c -o delete_child_sa_job.obj `if test -f 'processing/jobs/delete_child_sa_job.c'; then $(CYGPATH_W) 'processing/jobs/delete_child_sa_job.c'; else $(CYGPATH_W) '$(srcdir)/processing/jobs/delete_child_sa_job.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/delete_child_sa_job.Tpo $(DEPDIR)/delete_child_sa_job.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/delete_child_sa_job.Tpo $(DEPDIR)/delete_child_sa_job.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='processing/jobs/delete_child_sa_job.c' object='delete_child_sa_job.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o delete_child_sa_job.obj `if test -f 'processing/jobs/delete_child_sa_job.c'; then $(CYGPATH_W) 'processing/jobs/delete_child_sa_job.c'; else $(CYGPATH_W) '$(srcdir)/processing/jobs/delete_child_sa_job.c'; fi`
delete_ike_sa_job.o: processing/jobs/delete_ike_sa_job.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT delete_ike_sa_job.o -MD -MP -MF $(DEPDIR)/delete_ike_sa_job.Tpo -c -o delete_ike_sa_job.o `test -f 'processing/jobs/delete_ike_sa_job.c' || echo '$(srcdir)/'`processing/jobs/delete_ike_sa_job.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/delete_ike_sa_job.Tpo $(DEPDIR)/delete_ike_sa_job.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/delete_ike_sa_job.Tpo $(DEPDIR)/delete_ike_sa_job.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='processing/jobs/delete_ike_sa_job.c' object='delete_ike_sa_job.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o delete_ike_sa_job.o `test -f 'processing/jobs/delete_ike_sa_job.c' || echo '$(srcdir)/'`processing/jobs/delete_ike_sa_job.c
delete_ike_sa_job.obj: processing/jobs/delete_ike_sa_job.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT delete_ike_sa_job.obj -MD -MP -MF $(DEPDIR)/delete_ike_sa_job.Tpo -c -o delete_ike_sa_job.obj `if test -f 'processing/jobs/delete_ike_sa_job.c'; then $(CYGPATH_W) 'processing/jobs/delete_ike_sa_job.c'; else $(CYGPATH_W) '$(srcdir)/processing/jobs/delete_ike_sa_job.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/delete_ike_sa_job.Tpo $(DEPDIR)/delete_ike_sa_job.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/delete_ike_sa_job.Tpo $(DEPDIR)/delete_ike_sa_job.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='processing/jobs/delete_ike_sa_job.c' object='delete_ike_sa_job.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o delete_ike_sa_job.obj `if test -f 'processing/jobs/delete_ike_sa_job.c'; then $(CYGPATH_W) 'processing/jobs/delete_ike_sa_job.c'; else $(CYGPATH_W) '$(srcdir)/processing/jobs/delete_ike_sa_job.c'; fi`
migrate_job.o: processing/jobs/migrate_job.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT migrate_job.o -MD -MP -MF $(DEPDIR)/migrate_job.Tpo -c -o migrate_job.o `test -f 'processing/jobs/migrate_job.c' || echo '$(srcdir)/'`processing/jobs/migrate_job.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/migrate_job.Tpo $(DEPDIR)/migrate_job.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/migrate_job.Tpo $(DEPDIR)/migrate_job.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='processing/jobs/migrate_job.c' object='migrate_job.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o migrate_job.o `test -f 'processing/jobs/migrate_job.c' || echo '$(srcdir)/'`processing/jobs/migrate_job.c
migrate_job.obj: processing/jobs/migrate_job.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT migrate_job.obj -MD -MP -MF $(DEPDIR)/migrate_job.Tpo -c -o migrate_job.obj `if test -f 'processing/jobs/migrate_job.c'; then $(CYGPATH_W) 'processing/jobs/migrate_job.c'; else $(CYGPATH_W) '$(srcdir)/processing/jobs/migrate_job.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/migrate_job.Tpo $(DEPDIR)/migrate_job.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/migrate_job.Tpo $(DEPDIR)/migrate_job.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='processing/jobs/migrate_job.c' object='migrate_job.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o migrate_job.obj `if test -f 'processing/jobs/migrate_job.c'; then $(CYGPATH_W) 'processing/jobs/migrate_job.c'; else $(CYGPATH_W) '$(srcdir)/processing/jobs/migrate_job.c'; fi`
process_message_job.o: processing/jobs/process_message_job.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT process_message_job.o -MD -MP -MF $(DEPDIR)/process_message_job.Tpo -c -o process_message_job.o `test -f 'processing/jobs/process_message_job.c' || echo '$(srcdir)/'`processing/jobs/process_message_job.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/process_message_job.Tpo $(DEPDIR)/process_message_job.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/process_message_job.Tpo $(DEPDIR)/process_message_job.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='processing/jobs/process_message_job.c' object='process_message_job.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o process_message_job.o `test -f 'processing/jobs/process_message_job.c' || echo '$(srcdir)/'`processing/jobs/process_message_job.c
process_message_job.obj: processing/jobs/process_message_job.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT process_message_job.obj -MD -MP -MF $(DEPDIR)/process_message_job.Tpo -c -o process_message_job.obj `if test -f 'processing/jobs/process_message_job.c'; then $(CYGPATH_W) 'processing/jobs/process_message_job.c'; else $(CYGPATH_W) '$(srcdir)/processing/jobs/process_message_job.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/process_message_job.Tpo $(DEPDIR)/process_message_job.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/process_message_job.Tpo $(DEPDIR)/process_message_job.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='processing/jobs/process_message_job.c' object='process_message_job.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o process_message_job.obj `if test -f 'processing/jobs/process_message_job.c'; then $(CYGPATH_W) 'processing/jobs/process_message_job.c'; else $(CYGPATH_W) '$(srcdir)/processing/jobs/process_message_job.c'; fi`
rekey_child_sa_job.o: processing/jobs/rekey_child_sa_job.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT rekey_child_sa_job.o -MD -MP -MF $(DEPDIR)/rekey_child_sa_job.Tpo -c -o rekey_child_sa_job.o `test -f 'processing/jobs/rekey_child_sa_job.c' || echo '$(srcdir)/'`processing/jobs/rekey_child_sa_job.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/rekey_child_sa_job.Tpo $(DEPDIR)/rekey_child_sa_job.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/rekey_child_sa_job.Tpo $(DEPDIR)/rekey_child_sa_job.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='processing/jobs/rekey_child_sa_job.c' object='rekey_child_sa_job.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o rekey_child_sa_job.o `test -f 'processing/jobs/rekey_child_sa_job.c' || echo '$(srcdir)/'`processing/jobs/rekey_child_sa_job.c
rekey_child_sa_job.obj: processing/jobs/rekey_child_sa_job.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT rekey_child_sa_job.obj -MD -MP -MF $(DEPDIR)/rekey_child_sa_job.Tpo -c -o rekey_child_sa_job.obj `if test -f 'processing/jobs/rekey_child_sa_job.c'; then $(CYGPATH_W) 'processing/jobs/rekey_child_sa_job.c'; else $(CYGPATH_W) '$(srcdir)/processing/jobs/rekey_child_sa_job.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/rekey_child_sa_job.Tpo $(DEPDIR)/rekey_child_sa_job.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/rekey_child_sa_job.Tpo $(DEPDIR)/rekey_child_sa_job.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='processing/jobs/rekey_child_sa_job.c' object='rekey_child_sa_job.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o rekey_child_sa_job.obj `if test -f 'processing/jobs/rekey_child_sa_job.c'; then $(CYGPATH_W) 'processing/jobs/rekey_child_sa_job.c'; else $(CYGPATH_W) '$(srcdir)/processing/jobs/rekey_child_sa_job.c'; fi`
rekey_ike_sa_job.o: processing/jobs/rekey_ike_sa_job.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT rekey_ike_sa_job.o -MD -MP -MF $(DEPDIR)/rekey_ike_sa_job.Tpo -c -o rekey_ike_sa_job.o `test -f 'processing/jobs/rekey_ike_sa_job.c' || echo '$(srcdir)/'`processing/jobs/rekey_ike_sa_job.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/rekey_ike_sa_job.Tpo $(DEPDIR)/rekey_ike_sa_job.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/rekey_ike_sa_job.Tpo $(DEPDIR)/rekey_ike_sa_job.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='processing/jobs/rekey_ike_sa_job.c' object='rekey_ike_sa_job.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o rekey_ike_sa_job.o `test -f 'processing/jobs/rekey_ike_sa_job.c' || echo '$(srcdir)/'`processing/jobs/rekey_ike_sa_job.c
rekey_ike_sa_job.obj: processing/jobs/rekey_ike_sa_job.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT rekey_ike_sa_job.obj -MD -MP -MF $(DEPDIR)/rekey_ike_sa_job.Tpo -c -o rekey_ike_sa_job.obj `if test -f 'processing/jobs/rekey_ike_sa_job.c'; then $(CYGPATH_W) 'processing/jobs/rekey_ike_sa_job.c'; else $(CYGPATH_W) '$(srcdir)/processing/jobs/rekey_ike_sa_job.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/rekey_ike_sa_job.Tpo $(DEPDIR)/rekey_ike_sa_job.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/rekey_ike_sa_job.Tpo $(DEPDIR)/rekey_ike_sa_job.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='processing/jobs/rekey_ike_sa_job.c' object='rekey_ike_sa_job.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o rekey_ike_sa_job.obj `if test -f 'processing/jobs/rekey_ike_sa_job.c'; then $(CYGPATH_W) 'processing/jobs/rekey_ike_sa_job.c'; else $(CYGPATH_W) '$(srcdir)/processing/jobs/rekey_ike_sa_job.c'; fi`
retransmit_job.o: processing/jobs/retransmit_job.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT retransmit_job.o -MD -MP -MF $(DEPDIR)/retransmit_job.Tpo -c -o retransmit_job.o `test -f 'processing/jobs/retransmit_job.c' || echo '$(srcdir)/'`processing/jobs/retransmit_job.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/retransmit_job.Tpo $(DEPDIR)/retransmit_job.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/retransmit_job.Tpo $(DEPDIR)/retransmit_job.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='processing/jobs/retransmit_job.c' object='retransmit_job.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o retransmit_job.o `test -f 'processing/jobs/retransmit_job.c' || echo '$(srcdir)/'`processing/jobs/retransmit_job.c
retransmit_job.obj: processing/jobs/retransmit_job.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT retransmit_job.obj -MD -MP -MF $(DEPDIR)/retransmit_job.Tpo -c -o retransmit_job.obj `if test -f 'processing/jobs/retransmit_job.c'; then $(CYGPATH_W) 'processing/jobs/retransmit_job.c'; else $(CYGPATH_W) '$(srcdir)/processing/jobs/retransmit_job.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/retransmit_job.Tpo $(DEPDIR)/retransmit_job.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/retransmit_job.Tpo $(DEPDIR)/retransmit_job.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='processing/jobs/retransmit_job.c' object='retransmit_job.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o retransmit_job.obj `if test -f 'processing/jobs/retransmit_job.c'; then $(CYGPATH_W) 'processing/jobs/retransmit_job.c'; else $(CYGPATH_W) '$(srcdir)/processing/jobs/retransmit_job.c'; fi`
send_dpd_job.o: processing/jobs/send_dpd_job.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT send_dpd_job.o -MD -MP -MF $(DEPDIR)/send_dpd_job.Tpo -c -o send_dpd_job.o `test -f 'processing/jobs/send_dpd_job.c' || echo '$(srcdir)/'`processing/jobs/send_dpd_job.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/send_dpd_job.Tpo $(DEPDIR)/send_dpd_job.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/send_dpd_job.Tpo $(DEPDIR)/send_dpd_job.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='processing/jobs/send_dpd_job.c' object='send_dpd_job.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o send_dpd_job.o `test -f 'processing/jobs/send_dpd_job.c' || echo '$(srcdir)/'`processing/jobs/send_dpd_job.c
send_dpd_job.obj: processing/jobs/send_dpd_job.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT send_dpd_job.obj -MD -MP -MF $(DEPDIR)/send_dpd_job.Tpo -c -o send_dpd_job.obj `if test -f 'processing/jobs/send_dpd_job.c'; then $(CYGPATH_W) 'processing/jobs/send_dpd_job.c'; else $(CYGPATH_W) '$(srcdir)/processing/jobs/send_dpd_job.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/send_dpd_job.Tpo $(DEPDIR)/send_dpd_job.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/send_dpd_job.Tpo $(DEPDIR)/send_dpd_job.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='processing/jobs/send_dpd_job.c' object='send_dpd_job.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o send_dpd_job.obj `if test -f 'processing/jobs/send_dpd_job.c'; then $(CYGPATH_W) 'processing/jobs/send_dpd_job.c'; else $(CYGPATH_W) '$(srcdir)/processing/jobs/send_dpd_job.c'; fi`
send_keepalive_job.o: processing/jobs/send_keepalive_job.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT send_keepalive_job.o -MD -MP -MF $(DEPDIR)/send_keepalive_job.Tpo -c -o send_keepalive_job.o `test -f 'processing/jobs/send_keepalive_job.c' || echo '$(srcdir)/'`processing/jobs/send_keepalive_job.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/send_keepalive_job.Tpo $(DEPDIR)/send_keepalive_job.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/send_keepalive_job.Tpo $(DEPDIR)/send_keepalive_job.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='processing/jobs/send_keepalive_job.c' object='send_keepalive_job.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o send_keepalive_job.o `test -f 'processing/jobs/send_keepalive_job.c' || echo '$(srcdir)/'`processing/jobs/send_keepalive_job.c
send_keepalive_job.obj: processing/jobs/send_keepalive_job.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT send_keepalive_job.obj -MD -MP -MF $(DEPDIR)/send_keepalive_job.Tpo -c -o send_keepalive_job.obj `if test -f 'processing/jobs/send_keepalive_job.c'; then $(CYGPATH_W) 'processing/jobs/send_keepalive_job.c'; else $(CYGPATH_W) '$(srcdir)/processing/jobs/send_keepalive_job.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/send_keepalive_job.Tpo $(DEPDIR)/send_keepalive_job.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/send_keepalive_job.Tpo $(DEPDIR)/send_keepalive_job.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='processing/jobs/send_keepalive_job.c' object='send_keepalive_job.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o send_keepalive_job.obj `if test -f 'processing/jobs/send_keepalive_job.c'; then $(CYGPATH_W) 'processing/jobs/send_keepalive_job.c'; else $(CYGPATH_W) '$(srcdir)/processing/jobs/send_keepalive_job.c'; fi`
roam_job.o: processing/jobs/roam_job.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT roam_job.o -MD -MP -MF $(DEPDIR)/roam_job.Tpo -c -o roam_job.o `test -f 'processing/jobs/roam_job.c' || echo '$(srcdir)/'`processing/jobs/roam_job.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/roam_job.Tpo $(DEPDIR)/roam_job.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/roam_job.Tpo $(DEPDIR)/roam_job.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='processing/jobs/roam_job.c' object='roam_job.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o roam_job.o `test -f 'processing/jobs/roam_job.c' || echo '$(srcdir)/'`processing/jobs/roam_job.c
roam_job.obj: processing/jobs/roam_job.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT roam_job.obj -MD -MP -MF $(DEPDIR)/roam_job.Tpo -c -o roam_job.obj `if test -f 'processing/jobs/roam_job.c'; then $(CYGPATH_W) 'processing/jobs/roam_job.c'; else $(CYGPATH_W) '$(srcdir)/processing/jobs/roam_job.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/roam_job.Tpo $(DEPDIR)/roam_job.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/roam_job.Tpo $(DEPDIR)/roam_job.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='processing/jobs/roam_job.c' object='roam_job.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o roam_job.obj `if test -f 'processing/jobs/roam_job.c'; then $(CYGPATH_W) 'processing/jobs/roam_job.c'; else $(CYGPATH_W) '$(srcdir)/processing/jobs/roam_job.c'; fi`
update_sa_job.o: processing/jobs/update_sa_job.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT update_sa_job.o -MD -MP -MF $(DEPDIR)/update_sa_job.Tpo -c -o update_sa_job.o `test -f 'processing/jobs/update_sa_job.c' || echo '$(srcdir)/'`processing/jobs/update_sa_job.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/update_sa_job.Tpo $(DEPDIR)/update_sa_job.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/update_sa_job.Tpo $(DEPDIR)/update_sa_job.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='processing/jobs/update_sa_job.c' object='update_sa_job.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o update_sa_job.o `test -f 'processing/jobs/update_sa_job.c' || echo '$(srcdir)/'`processing/jobs/update_sa_job.c
update_sa_job.obj: processing/jobs/update_sa_job.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT update_sa_job.obj -MD -MP -MF $(DEPDIR)/update_sa_job.Tpo -c -o update_sa_job.obj `if test -f 'processing/jobs/update_sa_job.c'; then $(CYGPATH_W) 'processing/jobs/update_sa_job.c'; else $(CYGPATH_W) '$(srcdir)/processing/jobs/update_sa_job.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/update_sa_job.Tpo $(DEPDIR)/update_sa_job.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/update_sa_job.Tpo $(DEPDIR)/update_sa_job.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='processing/jobs/update_sa_job.c' object='update_sa_job.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o update_sa_job.obj `if test -f 'processing/jobs/update_sa_job.c'; then $(CYGPATH_W) 'processing/jobs/update_sa_job.c'; else $(CYGPATH_W) '$(srcdir)/processing/jobs/update_sa_job.c'; fi`
+inactivity_job.o: processing/jobs/inactivity_job.c
+@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT inactivity_job.o -MD -MP -MF $(DEPDIR)/inactivity_job.Tpo -c -o inactivity_job.o `test -f 'processing/jobs/inactivity_job.c' || echo '$(srcdir)/'`processing/jobs/inactivity_job.c
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/inactivity_job.Tpo $(DEPDIR)/inactivity_job.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='processing/jobs/inactivity_job.c' object='inactivity_job.o' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o inactivity_job.o `test -f 'processing/jobs/inactivity_job.c' || echo '$(srcdir)/'`processing/jobs/inactivity_job.c
+
+inactivity_job.obj: processing/jobs/inactivity_job.c
+@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT inactivity_job.obj -MD -MP -MF $(DEPDIR)/inactivity_job.Tpo -c -o inactivity_job.obj `if test -f 'processing/jobs/inactivity_job.c'; then $(CYGPATH_W) 'processing/jobs/inactivity_job.c'; else $(CYGPATH_W) '$(srcdir)/processing/jobs/inactivity_job.c'; fi`
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/inactivity_job.Tpo $(DEPDIR)/inactivity_job.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='processing/jobs/inactivity_job.c' object='inactivity_job.obj' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o inactivity_job.obj `if test -f 'processing/jobs/inactivity_job.c'; then $(CYGPATH_W) 'processing/jobs/inactivity_job.c'; else $(CYGPATH_W) '$(srcdir)/processing/jobs/inactivity_job.c'; fi`
+
scheduler.o: processing/scheduler.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT scheduler.o -MD -MP -MF $(DEPDIR)/scheduler.Tpo -c -o scheduler.o `test -f 'processing/scheduler.c' || echo '$(srcdir)/'`processing/scheduler.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/scheduler.Tpo $(DEPDIR)/scheduler.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/scheduler.Tpo $(DEPDIR)/scheduler.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='processing/scheduler.c' object='scheduler.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o scheduler.o `test -f 'processing/scheduler.c' || echo '$(srcdir)/'`processing/scheduler.c
scheduler.obj: processing/scheduler.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT scheduler.obj -MD -MP -MF $(DEPDIR)/scheduler.Tpo -c -o scheduler.obj `if test -f 'processing/scheduler.c'; then $(CYGPATH_W) 'processing/scheduler.c'; else $(CYGPATH_W) '$(srcdir)/processing/scheduler.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/scheduler.Tpo $(DEPDIR)/scheduler.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/scheduler.Tpo $(DEPDIR)/scheduler.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='processing/scheduler.c' object='scheduler.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o scheduler.obj `if test -f 'processing/scheduler.c'; then $(CYGPATH_W) 'processing/scheduler.c'; else $(CYGPATH_W) '$(srcdir)/processing/scheduler.c'; fi`
processor.o: processing/processor.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT processor.o -MD -MP -MF $(DEPDIR)/processor.Tpo -c -o processor.o `test -f 'processing/processor.c' || echo '$(srcdir)/'`processing/processor.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/processor.Tpo $(DEPDIR)/processor.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/processor.Tpo $(DEPDIR)/processor.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='processing/processor.c' object='processor.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o processor.o `test -f 'processing/processor.c' || echo '$(srcdir)/'`processing/processor.c
processor.obj: processing/processor.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT processor.obj -MD -MP -MF $(DEPDIR)/processor.Tpo -c -o processor.obj `if test -f 'processing/processor.c'; then $(CYGPATH_W) 'processing/processor.c'; else $(CYGPATH_W) '$(srcdir)/processing/processor.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/processor.Tpo $(DEPDIR)/processor.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/processor.Tpo $(DEPDIR)/processor.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='processing/processor.c' object='processor.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o processor.obj `if test -f 'processing/processor.c'; then $(CYGPATH_W) 'processing/processor.c'; else $(CYGPATH_W) '$(srcdir)/processing/processor.c'; fi`
authenticator.o: sa/authenticators/authenticator.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT authenticator.o -MD -MP -MF $(DEPDIR)/authenticator.Tpo -c -o authenticator.o `test -f 'sa/authenticators/authenticator.c' || echo '$(srcdir)/'`sa/authenticators/authenticator.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/authenticator.Tpo $(DEPDIR)/authenticator.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/authenticator.Tpo $(DEPDIR)/authenticator.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/authenticators/authenticator.c' object='authenticator.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o authenticator.o `test -f 'sa/authenticators/authenticator.c' || echo '$(srcdir)/'`sa/authenticators/authenticator.c
authenticator.obj: sa/authenticators/authenticator.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT authenticator.obj -MD -MP -MF $(DEPDIR)/authenticator.Tpo -c -o authenticator.obj `if test -f 'sa/authenticators/authenticator.c'; then $(CYGPATH_W) 'sa/authenticators/authenticator.c'; else $(CYGPATH_W) '$(srcdir)/sa/authenticators/authenticator.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/authenticator.Tpo $(DEPDIR)/authenticator.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/authenticator.Tpo $(DEPDIR)/authenticator.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/authenticators/authenticator.c' object='authenticator.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o authenticator.obj `if test -f 'sa/authenticators/authenticator.c'; then $(CYGPATH_W) 'sa/authenticators/authenticator.c'; else $(CYGPATH_W) '$(srcdir)/sa/authenticators/authenticator.c'; fi`
eap_authenticator.o: sa/authenticators/eap_authenticator.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT eap_authenticator.o -MD -MP -MF $(DEPDIR)/eap_authenticator.Tpo -c -o eap_authenticator.o `test -f 'sa/authenticators/eap_authenticator.c' || echo '$(srcdir)/'`sa/authenticators/eap_authenticator.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/eap_authenticator.Tpo $(DEPDIR)/eap_authenticator.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/eap_authenticator.Tpo $(DEPDIR)/eap_authenticator.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/authenticators/eap_authenticator.c' object='eap_authenticator.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o eap_authenticator.o `test -f 'sa/authenticators/eap_authenticator.c' || echo '$(srcdir)/'`sa/authenticators/eap_authenticator.c
eap_authenticator.obj: sa/authenticators/eap_authenticator.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT eap_authenticator.obj -MD -MP -MF $(DEPDIR)/eap_authenticator.Tpo -c -o eap_authenticator.obj `if test -f 'sa/authenticators/eap_authenticator.c'; then $(CYGPATH_W) 'sa/authenticators/eap_authenticator.c'; else $(CYGPATH_W) '$(srcdir)/sa/authenticators/eap_authenticator.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/eap_authenticator.Tpo $(DEPDIR)/eap_authenticator.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/eap_authenticator.Tpo $(DEPDIR)/eap_authenticator.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/authenticators/eap_authenticator.c' object='eap_authenticator.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o eap_authenticator.obj `if test -f 'sa/authenticators/eap_authenticator.c'; then $(CYGPATH_W) 'sa/authenticators/eap_authenticator.c'; else $(CYGPATH_W) '$(srcdir)/sa/authenticators/eap_authenticator.c'; fi`
eap_method.o: sa/authenticators/eap/eap_method.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT eap_method.o -MD -MP -MF $(DEPDIR)/eap_method.Tpo -c -o eap_method.o `test -f 'sa/authenticators/eap/eap_method.c' || echo '$(srcdir)/'`sa/authenticators/eap/eap_method.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/eap_method.Tpo $(DEPDIR)/eap_method.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/eap_method.Tpo $(DEPDIR)/eap_method.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/authenticators/eap/eap_method.c' object='eap_method.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o eap_method.o `test -f 'sa/authenticators/eap/eap_method.c' || echo '$(srcdir)/'`sa/authenticators/eap/eap_method.c
eap_method.obj: sa/authenticators/eap/eap_method.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT eap_method.obj -MD -MP -MF $(DEPDIR)/eap_method.Tpo -c -o eap_method.obj `if test -f 'sa/authenticators/eap/eap_method.c'; then $(CYGPATH_W) 'sa/authenticators/eap/eap_method.c'; else $(CYGPATH_W) '$(srcdir)/sa/authenticators/eap/eap_method.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/eap_method.Tpo $(DEPDIR)/eap_method.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/eap_method.Tpo $(DEPDIR)/eap_method.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/authenticators/eap/eap_method.c' object='eap_method.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o eap_method.obj `if test -f 'sa/authenticators/eap/eap_method.c'; then $(CYGPATH_W) 'sa/authenticators/eap/eap_method.c'; else $(CYGPATH_W) '$(srcdir)/sa/authenticators/eap/eap_method.c'; fi`
eap_manager.o: sa/authenticators/eap/eap_manager.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT eap_manager.o -MD -MP -MF $(DEPDIR)/eap_manager.Tpo -c -o eap_manager.o `test -f 'sa/authenticators/eap/eap_manager.c' || echo '$(srcdir)/'`sa/authenticators/eap/eap_manager.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/eap_manager.Tpo $(DEPDIR)/eap_manager.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/eap_manager.Tpo $(DEPDIR)/eap_manager.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/authenticators/eap/eap_manager.c' object='eap_manager.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o eap_manager.o `test -f 'sa/authenticators/eap/eap_manager.c' || echo '$(srcdir)/'`sa/authenticators/eap/eap_manager.c
eap_manager.obj: sa/authenticators/eap/eap_manager.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT eap_manager.obj -MD -MP -MF $(DEPDIR)/eap_manager.Tpo -c -o eap_manager.obj `if test -f 'sa/authenticators/eap/eap_manager.c'; then $(CYGPATH_W) 'sa/authenticators/eap/eap_manager.c'; else $(CYGPATH_W) '$(srcdir)/sa/authenticators/eap/eap_manager.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/eap_manager.Tpo $(DEPDIR)/eap_manager.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/eap_manager.Tpo $(DEPDIR)/eap_manager.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/authenticators/eap/eap_manager.c' object='eap_manager.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o eap_manager.obj `if test -f 'sa/authenticators/eap/eap_manager.c'; then $(CYGPATH_W) 'sa/authenticators/eap/eap_manager.c'; else $(CYGPATH_W) '$(srcdir)/sa/authenticators/eap/eap_manager.c'; fi`
sim_manager.o: sa/authenticators/eap/sim_manager.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT sim_manager.o -MD -MP -MF $(DEPDIR)/sim_manager.Tpo -c -o sim_manager.o `test -f 'sa/authenticators/eap/sim_manager.c' || echo '$(srcdir)/'`sa/authenticators/eap/sim_manager.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/sim_manager.Tpo $(DEPDIR)/sim_manager.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/sim_manager.Tpo $(DEPDIR)/sim_manager.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/authenticators/eap/sim_manager.c' object='sim_manager.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o sim_manager.o `test -f 'sa/authenticators/eap/sim_manager.c' || echo '$(srcdir)/'`sa/authenticators/eap/sim_manager.c
sim_manager.obj: sa/authenticators/eap/sim_manager.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT sim_manager.obj -MD -MP -MF $(DEPDIR)/sim_manager.Tpo -c -o sim_manager.obj `if test -f 'sa/authenticators/eap/sim_manager.c'; then $(CYGPATH_W) 'sa/authenticators/eap/sim_manager.c'; else $(CYGPATH_W) '$(srcdir)/sa/authenticators/eap/sim_manager.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/sim_manager.Tpo $(DEPDIR)/sim_manager.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/sim_manager.Tpo $(DEPDIR)/sim_manager.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/authenticators/eap/sim_manager.c' object='sim_manager.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o sim_manager.obj `if test -f 'sa/authenticators/eap/sim_manager.c'; then $(CYGPATH_W) 'sa/authenticators/eap/sim_manager.c'; else $(CYGPATH_W) '$(srcdir)/sa/authenticators/eap/sim_manager.c'; fi`
psk_authenticator.o: sa/authenticators/psk_authenticator.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT psk_authenticator.o -MD -MP -MF $(DEPDIR)/psk_authenticator.Tpo -c -o psk_authenticator.o `test -f 'sa/authenticators/psk_authenticator.c' || echo '$(srcdir)/'`sa/authenticators/psk_authenticator.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/psk_authenticator.Tpo $(DEPDIR)/psk_authenticator.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/psk_authenticator.Tpo $(DEPDIR)/psk_authenticator.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/authenticators/psk_authenticator.c' object='psk_authenticator.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o psk_authenticator.o `test -f 'sa/authenticators/psk_authenticator.c' || echo '$(srcdir)/'`sa/authenticators/psk_authenticator.c
psk_authenticator.obj: sa/authenticators/psk_authenticator.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT psk_authenticator.obj -MD -MP -MF $(DEPDIR)/psk_authenticator.Tpo -c -o psk_authenticator.obj `if test -f 'sa/authenticators/psk_authenticator.c'; then $(CYGPATH_W) 'sa/authenticators/psk_authenticator.c'; else $(CYGPATH_W) '$(srcdir)/sa/authenticators/psk_authenticator.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/psk_authenticator.Tpo $(DEPDIR)/psk_authenticator.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/psk_authenticator.Tpo $(DEPDIR)/psk_authenticator.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/authenticators/psk_authenticator.c' object='psk_authenticator.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o psk_authenticator.obj `if test -f 'sa/authenticators/psk_authenticator.c'; then $(CYGPATH_W) 'sa/authenticators/psk_authenticator.c'; else $(CYGPATH_W) '$(srcdir)/sa/authenticators/psk_authenticator.c'; fi`
pubkey_authenticator.o: sa/authenticators/pubkey_authenticator.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT pubkey_authenticator.o -MD -MP -MF $(DEPDIR)/pubkey_authenticator.Tpo -c -o pubkey_authenticator.o `test -f 'sa/authenticators/pubkey_authenticator.c' || echo '$(srcdir)/'`sa/authenticators/pubkey_authenticator.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/pubkey_authenticator.Tpo $(DEPDIR)/pubkey_authenticator.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/pubkey_authenticator.Tpo $(DEPDIR)/pubkey_authenticator.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/authenticators/pubkey_authenticator.c' object='pubkey_authenticator.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o pubkey_authenticator.o `test -f 'sa/authenticators/pubkey_authenticator.c' || echo '$(srcdir)/'`sa/authenticators/pubkey_authenticator.c
pubkey_authenticator.obj: sa/authenticators/pubkey_authenticator.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT pubkey_authenticator.obj -MD -MP -MF $(DEPDIR)/pubkey_authenticator.Tpo -c -o pubkey_authenticator.obj `if test -f 'sa/authenticators/pubkey_authenticator.c'; then $(CYGPATH_W) 'sa/authenticators/pubkey_authenticator.c'; else $(CYGPATH_W) '$(srcdir)/sa/authenticators/pubkey_authenticator.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/pubkey_authenticator.Tpo $(DEPDIR)/pubkey_authenticator.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/pubkey_authenticator.Tpo $(DEPDIR)/pubkey_authenticator.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/authenticators/pubkey_authenticator.c' object='pubkey_authenticator.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o pubkey_authenticator.obj `if test -f 'sa/authenticators/pubkey_authenticator.c'; then $(CYGPATH_W) 'sa/authenticators/pubkey_authenticator.c'; else $(CYGPATH_W) '$(srcdir)/sa/authenticators/pubkey_authenticator.c'; fi`
child_sa.o: sa/child_sa.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT child_sa.o -MD -MP -MF $(DEPDIR)/child_sa.Tpo -c -o child_sa.o `test -f 'sa/child_sa.c' || echo '$(srcdir)/'`sa/child_sa.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/child_sa.Tpo $(DEPDIR)/child_sa.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/child_sa.Tpo $(DEPDIR)/child_sa.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/child_sa.c' object='child_sa.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o child_sa.o `test -f 'sa/child_sa.c' || echo '$(srcdir)/'`sa/child_sa.c
child_sa.obj: sa/child_sa.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT child_sa.obj -MD -MP -MF $(DEPDIR)/child_sa.Tpo -c -o child_sa.obj `if test -f 'sa/child_sa.c'; then $(CYGPATH_W) 'sa/child_sa.c'; else $(CYGPATH_W) '$(srcdir)/sa/child_sa.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/child_sa.Tpo $(DEPDIR)/child_sa.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/child_sa.Tpo $(DEPDIR)/child_sa.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/child_sa.c' object='child_sa.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o child_sa.obj `if test -f 'sa/child_sa.c'; then $(CYGPATH_W) 'sa/child_sa.c'; else $(CYGPATH_W) '$(srcdir)/sa/child_sa.c'; fi`
ike_sa.o: sa/ike_sa.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ike_sa.o -MD -MP -MF $(DEPDIR)/ike_sa.Tpo -c -o ike_sa.o `test -f 'sa/ike_sa.c' || echo '$(srcdir)/'`sa/ike_sa.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/ike_sa.Tpo $(DEPDIR)/ike_sa.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/ike_sa.Tpo $(DEPDIR)/ike_sa.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/ike_sa.c' object='ike_sa.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ike_sa.o `test -f 'sa/ike_sa.c' || echo '$(srcdir)/'`sa/ike_sa.c
ike_sa.obj: sa/ike_sa.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ike_sa.obj -MD -MP -MF $(DEPDIR)/ike_sa.Tpo -c -o ike_sa.obj `if test -f 'sa/ike_sa.c'; then $(CYGPATH_W) 'sa/ike_sa.c'; else $(CYGPATH_W) '$(srcdir)/sa/ike_sa.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/ike_sa.Tpo $(DEPDIR)/ike_sa.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/ike_sa.Tpo $(DEPDIR)/ike_sa.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/ike_sa.c' object='ike_sa.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ike_sa.obj `if test -f 'sa/ike_sa.c'; then $(CYGPATH_W) 'sa/ike_sa.c'; else $(CYGPATH_W) '$(srcdir)/sa/ike_sa.c'; fi`
ike_sa_id.o: sa/ike_sa_id.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ike_sa_id.o -MD -MP -MF $(DEPDIR)/ike_sa_id.Tpo -c -o ike_sa_id.o `test -f 'sa/ike_sa_id.c' || echo '$(srcdir)/'`sa/ike_sa_id.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/ike_sa_id.Tpo $(DEPDIR)/ike_sa_id.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/ike_sa_id.Tpo $(DEPDIR)/ike_sa_id.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/ike_sa_id.c' object='ike_sa_id.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ike_sa_id.o `test -f 'sa/ike_sa_id.c' || echo '$(srcdir)/'`sa/ike_sa_id.c
ike_sa_id.obj: sa/ike_sa_id.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ike_sa_id.obj -MD -MP -MF $(DEPDIR)/ike_sa_id.Tpo -c -o ike_sa_id.obj `if test -f 'sa/ike_sa_id.c'; then $(CYGPATH_W) 'sa/ike_sa_id.c'; else $(CYGPATH_W) '$(srcdir)/sa/ike_sa_id.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/ike_sa_id.Tpo $(DEPDIR)/ike_sa_id.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/ike_sa_id.Tpo $(DEPDIR)/ike_sa_id.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/ike_sa_id.c' object='ike_sa_id.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ike_sa_id.obj `if test -f 'sa/ike_sa_id.c'; then $(CYGPATH_W) 'sa/ike_sa_id.c'; else $(CYGPATH_W) '$(srcdir)/sa/ike_sa_id.c'; fi`
ike_sa_manager.o: sa/ike_sa_manager.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ike_sa_manager.o -MD -MP -MF $(DEPDIR)/ike_sa_manager.Tpo -c -o ike_sa_manager.o `test -f 'sa/ike_sa_manager.c' || echo '$(srcdir)/'`sa/ike_sa_manager.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/ike_sa_manager.Tpo $(DEPDIR)/ike_sa_manager.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/ike_sa_manager.Tpo $(DEPDIR)/ike_sa_manager.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/ike_sa_manager.c' object='ike_sa_manager.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ike_sa_manager.o `test -f 'sa/ike_sa_manager.c' || echo '$(srcdir)/'`sa/ike_sa_manager.c
ike_sa_manager.obj: sa/ike_sa_manager.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ike_sa_manager.obj -MD -MP -MF $(DEPDIR)/ike_sa_manager.Tpo -c -o ike_sa_manager.obj `if test -f 'sa/ike_sa_manager.c'; then $(CYGPATH_W) 'sa/ike_sa_manager.c'; else $(CYGPATH_W) '$(srcdir)/sa/ike_sa_manager.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/ike_sa_manager.Tpo $(DEPDIR)/ike_sa_manager.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/ike_sa_manager.Tpo $(DEPDIR)/ike_sa_manager.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/ike_sa_manager.c' object='ike_sa_manager.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ike_sa_manager.obj `if test -f 'sa/ike_sa_manager.c'; then $(CYGPATH_W) 'sa/ike_sa_manager.c'; else $(CYGPATH_W) '$(srcdir)/sa/ike_sa_manager.c'; fi`
task_manager.o: sa/task_manager.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT task_manager.o -MD -MP -MF $(DEPDIR)/task_manager.Tpo -c -o task_manager.o `test -f 'sa/task_manager.c' || echo '$(srcdir)/'`sa/task_manager.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/task_manager.Tpo $(DEPDIR)/task_manager.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/task_manager.Tpo $(DEPDIR)/task_manager.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/task_manager.c' object='task_manager.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o task_manager.o `test -f 'sa/task_manager.c' || echo '$(srcdir)/'`sa/task_manager.c
task_manager.obj: sa/task_manager.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT task_manager.obj -MD -MP -MF $(DEPDIR)/task_manager.Tpo -c -o task_manager.obj `if test -f 'sa/task_manager.c'; then $(CYGPATH_W) 'sa/task_manager.c'; else $(CYGPATH_W) '$(srcdir)/sa/task_manager.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/task_manager.Tpo $(DEPDIR)/task_manager.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/task_manager.Tpo $(DEPDIR)/task_manager.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/task_manager.c' object='task_manager.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o task_manager.obj `if test -f 'sa/task_manager.c'; then $(CYGPATH_W) 'sa/task_manager.c'; else $(CYGPATH_W) '$(srcdir)/sa/task_manager.c'; fi`
keymat.o: sa/keymat.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT keymat.o -MD -MP -MF $(DEPDIR)/keymat.Tpo -c -o keymat.o `test -f 'sa/keymat.c' || echo '$(srcdir)/'`sa/keymat.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/keymat.Tpo $(DEPDIR)/keymat.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/keymat.Tpo $(DEPDIR)/keymat.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/keymat.c' object='keymat.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o keymat.o `test -f 'sa/keymat.c' || echo '$(srcdir)/'`sa/keymat.c
keymat.obj: sa/keymat.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT keymat.obj -MD -MP -MF $(DEPDIR)/keymat.Tpo -c -o keymat.obj `if test -f 'sa/keymat.c'; then $(CYGPATH_W) 'sa/keymat.c'; else $(CYGPATH_W) '$(srcdir)/sa/keymat.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/keymat.Tpo $(DEPDIR)/keymat.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/keymat.Tpo $(DEPDIR)/keymat.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/keymat.c' object='keymat.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o keymat.obj `if test -f 'sa/keymat.c'; then $(CYGPATH_W) 'sa/keymat.c'; else $(CYGPATH_W) '$(srcdir)/sa/keymat.c'; fi`
trap_manager.o: sa/trap_manager.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT trap_manager.o -MD -MP -MF $(DEPDIR)/trap_manager.Tpo -c -o trap_manager.o `test -f 'sa/trap_manager.c' || echo '$(srcdir)/'`sa/trap_manager.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/trap_manager.Tpo $(DEPDIR)/trap_manager.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/trap_manager.Tpo $(DEPDIR)/trap_manager.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/trap_manager.c' object='trap_manager.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o trap_manager.o `test -f 'sa/trap_manager.c' || echo '$(srcdir)/'`sa/trap_manager.c
trap_manager.obj: sa/trap_manager.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT trap_manager.obj -MD -MP -MF $(DEPDIR)/trap_manager.Tpo -c -o trap_manager.obj `if test -f 'sa/trap_manager.c'; then $(CYGPATH_W) 'sa/trap_manager.c'; else $(CYGPATH_W) '$(srcdir)/sa/trap_manager.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/trap_manager.Tpo $(DEPDIR)/trap_manager.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/trap_manager.Tpo $(DEPDIR)/trap_manager.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/trap_manager.c' object='trap_manager.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o trap_manager.obj `if test -f 'sa/trap_manager.c'; then $(CYGPATH_W) 'sa/trap_manager.c'; else $(CYGPATH_W) '$(srcdir)/sa/trap_manager.c'; fi`
child_create.o: sa/tasks/child_create.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT child_create.o -MD -MP -MF $(DEPDIR)/child_create.Tpo -c -o child_create.o `test -f 'sa/tasks/child_create.c' || echo '$(srcdir)/'`sa/tasks/child_create.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/child_create.Tpo $(DEPDIR)/child_create.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/child_create.Tpo $(DEPDIR)/child_create.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/tasks/child_create.c' object='child_create.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o child_create.o `test -f 'sa/tasks/child_create.c' || echo '$(srcdir)/'`sa/tasks/child_create.c
child_create.obj: sa/tasks/child_create.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT child_create.obj -MD -MP -MF $(DEPDIR)/child_create.Tpo -c -o child_create.obj `if test -f 'sa/tasks/child_create.c'; then $(CYGPATH_W) 'sa/tasks/child_create.c'; else $(CYGPATH_W) '$(srcdir)/sa/tasks/child_create.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/child_create.Tpo $(DEPDIR)/child_create.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/child_create.Tpo $(DEPDIR)/child_create.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/tasks/child_create.c' object='child_create.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o child_create.obj `if test -f 'sa/tasks/child_create.c'; then $(CYGPATH_W) 'sa/tasks/child_create.c'; else $(CYGPATH_W) '$(srcdir)/sa/tasks/child_create.c'; fi`
child_delete.o: sa/tasks/child_delete.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT child_delete.o -MD -MP -MF $(DEPDIR)/child_delete.Tpo -c -o child_delete.o `test -f 'sa/tasks/child_delete.c' || echo '$(srcdir)/'`sa/tasks/child_delete.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/child_delete.Tpo $(DEPDIR)/child_delete.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/child_delete.Tpo $(DEPDIR)/child_delete.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/tasks/child_delete.c' object='child_delete.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o child_delete.o `test -f 'sa/tasks/child_delete.c' || echo '$(srcdir)/'`sa/tasks/child_delete.c
child_delete.obj: sa/tasks/child_delete.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT child_delete.obj -MD -MP -MF $(DEPDIR)/child_delete.Tpo -c -o child_delete.obj `if test -f 'sa/tasks/child_delete.c'; then $(CYGPATH_W) 'sa/tasks/child_delete.c'; else $(CYGPATH_W) '$(srcdir)/sa/tasks/child_delete.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/child_delete.Tpo $(DEPDIR)/child_delete.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/child_delete.Tpo $(DEPDIR)/child_delete.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/tasks/child_delete.c' object='child_delete.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o child_delete.obj `if test -f 'sa/tasks/child_delete.c'; then $(CYGPATH_W) 'sa/tasks/child_delete.c'; else $(CYGPATH_W) '$(srcdir)/sa/tasks/child_delete.c'; fi`
child_rekey.o: sa/tasks/child_rekey.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT child_rekey.o -MD -MP -MF $(DEPDIR)/child_rekey.Tpo -c -o child_rekey.o `test -f 'sa/tasks/child_rekey.c' || echo '$(srcdir)/'`sa/tasks/child_rekey.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/child_rekey.Tpo $(DEPDIR)/child_rekey.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/child_rekey.Tpo $(DEPDIR)/child_rekey.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/tasks/child_rekey.c' object='child_rekey.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o child_rekey.o `test -f 'sa/tasks/child_rekey.c' || echo '$(srcdir)/'`sa/tasks/child_rekey.c
child_rekey.obj: sa/tasks/child_rekey.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT child_rekey.obj -MD -MP -MF $(DEPDIR)/child_rekey.Tpo -c -o child_rekey.obj `if test -f 'sa/tasks/child_rekey.c'; then $(CYGPATH_W) 'sa/tasks/child_rekey.c'; else $(CYGPATH_W) '$(srcdir)/sa/tasks/child_rekey.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/child_rekey.Tpo $(DEPDIR)/child_rekey.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/child_rekey.Tpo $(DEPDIR)/child_rekey.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/tasks/child_rekey.c' object='child_rekey.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o child_rekey.obj `if test -f 'sa/tasks/child_rekey.c'; then $(CYGPATH_W) 'sa/tasks/child_rekey.c'; else $(CYGPATH_W) '$(srcdir)/sa/tasks/child_rekey.c'; fi`
ike_auth.o: sa/tasks/ike_auth.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ike_auth.o -MD -MP -MF $(DEPDIR)/ike_auth.Tpo -c -o ike_auth.o `test -f 'sa/tasks/ike_auth.c' || echo '$(srcdir)/'`sa/tasks/ike_auth.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/ike_auth.Tpo $(DEPDIR)/ike_auth.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/ike_auth.Tpo $(DEPDIR)/ike_auth.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/tasks/ike_auth.c' object='ike_auth.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ike_auth.o `test -f 'sa/tasks/ike_auth.c' || echo '$(srcdir)/'`sa/tasks/ike_auth.c
ike_auth.obj: sa/tasks/ike_auth.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ike_auth.obj -MD -MP -MF $(DEPDIR)/ike_auth.Tpo -c -o ike_auth.obj `if test -f 'sa/tasks/ike_auth.c'; then $(CYGPATH_W) 'sa/tasks/ike_auth.c'; else $(CYGPATH_W) '$(srcdir)/sa/tasks/ike_auth.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/ike_auth.Tpo $(DEPDIR)/ike_auth.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/ike_auth.Tpo $(DEPDIR)/ike_auth.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/tasks/ike_auth.c' object='ike_auth.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ike_auth.obj `if test -f 'sa/tasks/ike_auth.c'; then $(CYGPATH_W) 'sa/tasks/ike_auth.c'; else $(CYGPATH_W) '$(srcdir)/sa/tasks/ike_auth.c'; fi`
ike_cert_pre.o: sa/tasks/ike_cert_pre.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ike_cert_pre.o -MD -MP -MF $(DEPDIR)/ike_cert_pre.Tpo -c -o ike_cert_pre.o `test -f 'sa/tasks/ike_cert_pre.c' || echo '$(srcdir)/'`sa/tasks/ike_cert_pre.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/ike_cert_pre.Tpo $(DEPDIR)/ike_cert_pre.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/ike_cert_pre.Tpo $(DEPDIR)/ike_cert_pre.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/tasks/ike_cert_pre.c' object='ike_cert_pre.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ike_cert_pre.o `test -f 'sa/tasks/ike_cert_pre.c' || echo '$(srcdir)/'`sa/tasks/ike_cert_pre.c
ike_cert_pre.obj: sa/tasks/ike_cert_pre.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ike_cert_pre.obj -MD -MP -MF $(DEPDIR)/ike_cert_pre.Tpo -c -o ike_cert_pre.obj `if test -f 'sa/tasks/ike_cert_pre.c'; then $(CYGPATH_W) 'sa/tasks/ike_cert_pre.c'; else $(CYGPATH_W) '$(srcdir)/sa/tasks/ike_cert_pre.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/ike_cert_pre.Tpo $(DEPDIR)/ike_cert_pre.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/ike_cert_pre.Tpo $(DEPDIR)/ike_cert_pre.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/tasks/ike_cert_pre.c' object='ike_cert_pre.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ike_cert_pre.obj `if test -f 'sa/tasks/ike_cert_pre.c'; then $(CYGPATH_W) 'sa/tasks/ike_cert_pre.c'; else $(CYGPATH_W) '$(srcdir)/sa/tasks/ike_cert_pre.c'; fi`
ike_cert_post.o: sa/tasks/ike_cert_post.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ike_cert_post.o -MD -MP -MF $(DEPDIR)/ike_cert_post.Tpo -c -o ike_cert_post.o `test -f 'sa/tasks/ike_cert_post.c' || echo '$(srcdir)/'`sa/tasks/ike_cert_post.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/ike_cert_post.Tpo $(DEPDIR)/ike_cert_post.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/ike_cert_post.Tpo $(DEPDIR)/ike_cert_post.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/tasks/ike_cert_post.c' object='ike_cert_post.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ike_cert_post.o `test -f 'sa/tasks/ike_cert_post.c' || echo '$(srcdir)/'`sa/tasks/ike_cert_post.c
ike_cert_post.obj: sa/tasks/ike_cert_post.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ike_cert_post.obj -MD -MP -MF $(DEPDIR)/ike_cert_post.Tpo -c -o ike_cert_post.obj `if test -f 'sa/tasks/ike_cert_post.c'; then $(CYGPATH_W) 'sa/tasks/ike_cert_post.c'; else $(CYGPATH_W) '$(srcdir)/sa/tasks/ike_cert_post.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/ike_cert_post.Tpo $(DEPDIR)/ike_cert_post.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/ike_cert_post.Tpo $(DEPDIR)/ike_cert_post.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/tasks/ike_cert_post.c' object='ike_cert_post.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ike_cert_post.obj `if test -f 'sa/tasks/ike_cert_post.c'; then $(CYGPATH_W) 'sa/tasks/ike_cert_post.c'; else $(CYGPATH_W) '$(srcdir)/sa/tasks/ike_cert_post.c'; fi`
ike_config.o: sa/tasks/ike_config.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ike_config.o -MD -MP -MF $(DEPDIR)/ike_config.Tpo -c -o ike_config.o `test -f 'sa/tasks/ike_config.c' || echo '$(srcdir)/'`sa/tasks/ike_config.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/ike_config.Tpo $(DEPDIR)/ike_config.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/ike_config.Tpo $(DEPDIR)/ike_config.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/tasks/ike_config.c' object='ike_config.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ike_config.o `test -f 'sa/tasks/ike_config.c' || echo '$(srcdir)/'`sa/tasks/ike_config.c
ike_config.obj: sa/tasks/ike_config.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ike_config.obj -MD -MP -MF $(DEPDIR)/ike_config.Tpo -c -o ike_config.obj `if test -f 'sa/tasks/ike_config.c'; then $(CYGPATH_W) 'sa/tasks/ike_config.c'; else $(CYGPATH_W) '$(srcdir)/sa/tasks/ike_config.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/ike_config.Tpo $(DEPDIR)/ike_config.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/ike_config.Tpo $(DEPDIR)/ike_config.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/tasks/ike_config.c' object='ike_config.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ike_config.obj `if test -f 'sa/tasks/ike_config.c'; then $(CYGPATH_W) 'sa/tasks/ike_config.c'; else $(CYGPATH_W) '$(srcdir)/sa/tasks/ike_config.c'; fi`
ike_delete.o: sa/tasks/ike_delete.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ike_delete.o -MD -MP -MF $(DEPDIR)/ike_delete.Tpo -c -o ike_delete.o `test -f 'sa/tasks/ike_delete.c' || echo '$(srcdir)/'`sa/tasks/ike_delete.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/ike_delete.Tpo $(DEPDIR)/ike_delete.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/ike_delete.Tpo $(DEPDIR)/ike_delete.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/tasks/ike_delete.c' object='ike_delete.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ike_delete.o `test -f 'sa/tasks/ike_delete.c' || echo '$(srcdir)/'`sa/tasks/ike_delete.c
ike_delete.obj: sa/tasks/ike_delete.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ike_delete.obj -MD -MP -MF $(DEPDIR)/ike_delete.Tpo -c -o ike_delete.obj `if test -f 'sa/tasks/ike_delete.c'; then $(CYGPATH_W) 'sa/tasks/ike_delete.c'; else $(CYGPATH_W) '$(srcdir)/sa/tasks/ike_delete.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/ike_delete.Tpo $(DEPDIR)/ike_delete.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/ike_delete.Tpo $(DEPDIR)/ike_delete.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/tasks/ike_delete.c' object='ike_delete.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ike_delete.obj `if test -f 'sa/tasks/ike_delete.c'; then $(CYGPATH_W) 'sa/tasks/ike_delete.c'; else $(CYGPATH_W) '$(srcdir)/sa/tasks/ike_delete.c'; fi`
ike_dpd.o: sa/tasks/ike_dpd.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ike_dpd.o -MD -MP -MF $(DEPDIR)/ike_dpd.Tpo -c -o ike_dpd.o `test -f 'sa/tasks/ike_dpd.c' || echo '$(srcdir)/'`sa/tasks/ike_dpd.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/ike_dpd.Tpo $(DEPDIR)/ike_dpd.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/ike_dpd.Tpo $(DEPDIR)/ike_dpd.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/tasks/ike_dpd.c' object='ike_dpd.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ike_dpd.o `test -f 'sa/tasks/ike_dpd.c' || echo '$(srcdir)/'`sa/tasks/ike_dpd.c
ike_dpd.obj: sa/tasks/ike_dpd.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ike_dpd.obj -MD -MP -MF $(DEPDIR)/ike_dpd.Tpo -c -o ike_dpd.obj `if test -f 'sa/tasks/ike_dpd.c'; then $(CYGPATH_W) 'sa/tasks/ike_dpd.c'; else $(CYGPATH_W) '$(srcdir)/sa/tasks/ike_dpd.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/ike_dpd.Tpo $(DEPDIR)/ike_dpd.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/ike_dpd.Tpo $(DEPDIR)/ike_dpd.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/tasks/ike_dpd.c' object='ike_dpd.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ike_dpd.obj `if test -f 'sa/tasks/ike_dpd.c'; then $(CYGPATH_W) 'sa/tasks/ike_dpd.c'; else $(CYGPATH_W) '$(srcdir)/sa/tasks/ike_dpd.c'; fi`
ike_init.o: sa/tasks/ike_init.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ike_init.o -MD -MP -MF $(DEPDIR)/ike_init.Tpo -c -o ike_init.o `test -f 'sa/tasks/ike_init.c' || echo '$(srcdir)/'`sa/tasks/ike_init.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/ike_init.Tpo $(DEPDIR)/ike_init.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/ike_init.Tpo $(DEPDIR)/ike_init.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/tasks/ike_init.c' object='ike_init.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ike_init.o `test -f 'sa/tasks/ike_init.c' || echo '$(srcdir)/'`sa/tasks/ike_init.c
ike_init.obj: sa/tasks/ike_init.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ike_init.obj -MD -MP -MF $(DEPDIR)/ike_init.Tpo -c -o ike_init.obj `if test -f 'sa/tasks/ike_init.c'; then $(CYGPATH_W) 'sa/tasks/ike_init.c'; else $(CYGPATH_W) '$(srcdir)/sa/tasks/ike_init.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/ike_init.Tpo $(DEPDIR)/ike_init.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/ike_init.Tpo $(DEPDIR)/ike_init.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/tasks/ike_init.c' object='ike_init.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ike_init.obj `if test -f 'sa/tasks/ike_init.c'; then $(CYGPATH_W) 'sa/tasks/ike_init.c'; else $(CYGPATH_W) '$(srcdir)/sa/tasks/ike_init.c'; fi`
ike_natd.o: sa/tasks/ike_natd.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ike_natd.o -MD -MP -MF $(DEPDIR)/ike_natd.Tpo -c -o ike_natd.o `test -f 'sa/tasks/ike_natd.c' || echo '$(srcdir)/'`sa/tasks/ike_natd.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/ike_natd.Tpo $(DEPDIR)/ike_natd.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/ike_natd.Tpo $(DEPDIR)/ike_natd.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/tasks/ike_natd.c' object='ike_natd.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ike_natd.o `test -f 'sa/tasks/ike_natd.c' || echo '$(srcdir)/'`sa/tasks/ike_natd.c
ike_natd.obj: sa/tasks/ike_natd.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ike_natd.obj -MD -MP -MF $(DEPDIR)/ike_natd.Tpo -c -o ike_natd.obj `if test -f 'sa/tasks/ike_natd.c'; then $(CYGPATH_W) 'sa/tasks/ike_natd.c'; else $(CYGPATH_W) '$(srcdir)/sa/tasks/ike_natd.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/ike_natd.Tpo $(DEPDIR)/ike_natd.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/ike_natd.Tpo $(DEPDIR)/ike_natd.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/tasks/ike_natd.c' object='ike_natd.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ike_natd.obj `if test -f 'sa/tasks/ike_natd.c'; then $(CYGPATH_W) 'sa/tasks/ike_natd.c'; else $(CYGPATH_W) '$(srcdir)/sa/tasks/ike_natd.c'; fi`
ike_mobike.o: sa/tasks/ike_mobike.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ike_mobike.o -MD -MP -MF $(DEPDIR)/ike_mobike.Tpo -c -o ike_mobike.o `test -f 'sa/tasks/ike_mobike.c' || echo '$(srcdir)/'`sa/tasks/ike_mobike.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/ike_mobike.Tpo $(DEPDIR)/ike_mobike.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/ike_mobike.Tpo $(DEPDIR)/ike_mobike.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/tasks/ike_mobike.c' object='ike_mobike.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ike_mobike.o `test -f 'sa/tasks/ike_mobike.c' || echo '$(srcdir)/'`sa/tasks/ike_mobike.c
ike_mobike.obj: sa/tasks/ike_mobike.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ike_mobike.obj -MD -MP -MF $(DEPDIR)/ike_mobike.Tpo -c -o ike_mobike.obj `if test -f 'sa/tasks/ike_mobike.c'; then $(CYGPATH_W) 'sa/tasks/ike_mobike.c'; else $(CYGPATH_W) '$(srcdir)/sa/tasks/ike_mobike.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/ike_mobike.Tpo $(DEPDIR)/ike_mobike.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/ike_mobike.Tpo $(DEPDIR)/ike_mobike.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/tasks/ike_mobike.c' object='ike_mobike.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ike_mobike.obj `if test -f 'sa/tasks/ike_mobike.c'; then $(CYGPATH_W) 'sa/tasks/ike_mobike.c'; else $(CYGPATH_W) '$(srcdir)/sa/tasks/ike_mobike.c'; fi`
ike_rekey.o: sa/tasks/ike_rekey.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ike_rekey.o -MD -MP -MF $(DEPDIR)/ike_rekey.Tpo -c -o ike_rekey.o `test -f 'sa/tasks/ike_rekey.c' || echo '$(srcdir)/'`sa/tasks/ike_rekey.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/ike_rekey.Tpo $(DEPDIR)/ike_rekey.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/ike_rekey.Tpo $(DEPDIR)/ike_rekey.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/tasks/ike_rekey.c' object='ike_rekey.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ike_rekey.o `test -f 'sa/tasks/ike_rekey.c' || echo '$(srcdir)/'`sa/tasks/ike_rekey.c
ike_rekey.obj: sa/tasks/ike_rekey.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ike_rekey.obj -MD -MP -MF $(DEPDIR)/ike_rekey.Tpo -c -o ike_rekey.obj `if test -f 'sa/tasks/ike_rekey.c'; then $(CYGPATH_W) 'sa/tasks/ike_rekey.c'; else $(CYGPATH_W) '$(srcdir)/sa/tasks/ike_rekey.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/ike_rekey.Tpo $(DEPDIR)/ike_rekey.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/ike_rekey.Tpo $(DEPDIR)/ike_rekey.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/tasks/ike_rekey.c' object='ike_rekey.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ike_rekey.obj `if test -f 'sa/tasks/ike_rekey.c'; then $(CYGPATH_W) 'sa/tasks/ike_rekey.c'; else $(CYGPATH_W) '$(srcdir)/sa/tasks/ike_rekey.c'; fi`
ike_reauth.o: sa/tasks/ike_reauth.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ike_reauth.o -MD -MP -MF $(DEPDIR)/ike_reauth.Tpo -c -o ike_reauth.o `test -f 'sa/tasks/ike_reauth.c' || echo '$(srcdir)/'`sa/tasks/ike_reauth.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/ike_reauth.Tpo $(DEPDIR)/ike_reauth.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/ike_reauth.Tpo $(DEPDIR)/ike_reauth.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/tasks/ike_reauth.c' object='ike_reauth.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ike_reauth.o `test -f 'sa/tasks/ike_reauth.c' || echo '$(srcdir)/'`sa/tasks/ike_reauth.c
ike_reauth.obj: sa/tasks/ike_reauth.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ike_reauth.obj -MD -MP -MF $(DEPDIR)/ike_reauth.Tpo -c -o ike_reauth.obj `if test -f 'sa/tasks/ike_reauth.c'; then $(CYGPATH_W) 'sa/tasks/ike_reauth.c'; else $(CYGPATH_W) '$(srcdir)/sa/tasks/ike_reauth.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/ike_reauth.Tpo $(DEPDIR)/ike_reauth.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/ike_reauth.Tpo $(DEPDIR)/ike_reauth.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/tasks/ike_reauth.c' object='ike_reauth.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ike_reauth.obj `if test -f 'sa/tasks/ike_reauth.c'; then $(CYGPATH_W) 'sa/tasks/ike_reauth.c'; else $(CYGPATH_W) '$(srcdir)/sa/tasks/ike_reauth.c'; fi`
ike_auth_lifetime.o: sa/tasks/ike_auth_lifetime.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ike_auth_lifetime.o -MD -MP -MF $(DEPDIR)/ike_auth_lifetime.Tpo -c -o ike_auth_lifetime.o `test -f 'sa/tasks/ike_auth_lifetime.c' || echo '$(srcdir)/'`sa/tasks/ike_auth_lifetime.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/ike_auth_lifetime.Tpo $(DEPDIR)/ike_auth_lifetime.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/ike_auth_lifetime.Tpo $(DEPDIR)/ike_auth_lifetime.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/tasks/ike_auth_lifetime.c' object='ike_auth_lifetime.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ike_auth_lifetime.o `test -f 'sa/tasks/ike_auth_lifetime.c' || echo '$(srcdir)/'`sa/tasks/ike_auth_lifetime.c
ike_auth_lifetime.obj: sa/tasks/ike_auth_lifetime.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ike_auth_lifetime.obj -MD -MP -MF $(DEPDIR)/ike_auth_lifetime.Tpo -c -o ike_auth_lifetime.obj `if test -f 'sa/tasks/ike_auth_lifetime.c'; then $(CYGPATH_W) 'sa/tasks/ike_auth_lifetime.c'; else $(CYGPATH_W) '$(srcdir)/sa/tasks/ike_auth_lifetime.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/ike_auth_lifetime.Tpo $(DEPDIR)/ike_auth_lifetime.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/ike_auth_lifetime.Tpo $(DEPDIR)/ike_auth_lifetime.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/tasks/ike_auth_lifetime.c' object='ike_auth_lifetime.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ike_auth_lifetime.obj `if test -f 'sa/tasks/ike_auth_lifetime.c'; then $(CYGPATH_W) 'sa/tasks/ike_auth_lifetime.c'; else $(CYGPATH_W) '$(srcdir)/sa/tasks/ike_auth_lifetime.c'; fi`
+ike_vendor.o: sa/tasks/ike_vendor.c
+@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ike_vendor.o -MD -MP -MF $(DEPDIR)/ike_vendor.Tpo -c -o ike_vendor.o `test -f 'sa/tasks/ike_vendor.c' || echo '$(srcdir)/'`sa/tasks/ike_vendor.c
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/ike_vendor.Tpo $(DEPDIR)/ike_vendor.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/tasks/ike_vendor.c' object='ike_vendor.o' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ike_vendor.o `test -f 'sa/tasks/ike_vendor.c' || echo '$(srcdir)/'`sa/tasks/ike_vendor.c
+
+ike_vendor.obj: sa/tasks/ike_vendor.c
+@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ike_vendor.obj -MD -MP -MF $(DEPDIR)/ike_vendor.Tpo -c -o ike_vendor.obj `if test -f 'sa/tasks/ike_vendor.c'; then $(CYGPATH_W) 'sa/tasks/ike_vendor.c'; else $(CYGPATH_W) '$(srcdir)/sa/tasks/ike_vendor.c'; fi`
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/ike_vendor.Tpo $(DEPDIR)/ike_vendor.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/tasks/ike_vendor.c' object='ike_vendor.obj' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ike_vendor.obj `if test -f 'sa/tasks/ike_vendor.c'; then $(CYGPATH_W) 'sa/tasks/ike_vendor.c'; else $(CYGPATH_W) '$(srcdir)/sa/tasks/ike_vendor.c'; fi`
+
task.o: sa/tasks/task.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT task.o -MD -MP -MF $(DEPDIR)/task.Tpo -c -o task.o `test -f 'sa/tasks/task.c' || echo '$(srcdir)/'`sa/tasks/task.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/task.Tpo $(DEPDIR)/task.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/task.Tpo $(DEPDIR)/task.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/tasks/task.c' object='task.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o task.o `test -f 'sa/tasks/task.c' || echo '$(srcdir)/'`sa/tasks/task.c
task.obj: sa/tasks/task.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT task.obj -MD -MP -MF $(DEPDIR)/task.Tpo -c -o task.obj `if test -f 'sa/tasks/task.c'; then $(CYGPATH_W) 'sa/tasks/task.c'; else $(CYGPATH_W) '$(srcdir)/sa/tasks/task.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/task.Tpo $(DEPDIR)/task.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/task.Tpo $(DEPDIR)/task.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/tasks/task.c' object='task.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o task.obj `if test -f 'sa/tasks/task.c'; then $(CYGPATH_W) 'sa/tasks/task.c'; else $(CYGPATH_W) '$(srcdir)/sa/tasks/task.c'; fi`
credential_manager.o: credentials/credential_manager.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT credential_manager.o -MD -MP -MF $(DEPDIR)/credential_manager.Tpo -c -o credential_manager.o `test -f 'credentials/credential_manager.c' || echo '$(srcdir)/'`credentials/credential_manager.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/credential_manager.Tpo $(DEPDIR)/credential_manager.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/credential_manager.Tpo $(DEPDIR)/credential_manager.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='credentials/credential_manager.c' object='credential_manager.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o credential_manager.o `test -f 'credentials/credential_manager.c' || echo '$(srcdir)/'`credentials/credential_manager.c
credential_manager.obj: credentials/credential_manager.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT credential_manager.obj -MD -MP -MF $(DEPDIR)/credential_manager.Tpo -c -o credential_manager.obj `if test -f 'credentials/credential_manager.c'; then $(CYGPATH_W) 'credentials/credential_manager.c'; else $(CYGPATH_W) '$(srcdir)/credentials/credential_manager.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/credential_manager.Tpo $(DEPDIR)/credential_manager.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/credential_manager.Tpo $(DEPDIR)/credential_manager.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='credentials/credential_manager.c' object='credential_manager.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o credential_manager.obj `if test -f 'credentials/credential_manager.c'; then $(CYGPATH_W) 'credentials/credential_manager.c'; else $(CYGPATH_W) '$(srcdir)/credentials/credential_manager.c'; fi`
auth_cfg_wrapper.o: credentials/sets/auth_cfg_wrapper.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT auth_cfg_wrapper.o -MD -MP -MF $(DEPDIR)/auth_cfg_wrapper.Tpo -c -o auth_cfg_wrapper.o `test -f 'credentials/sets/auth_cfg_wrapper.c' || echo '$(srcdir)/'`credentials/sets/auth_cfg_wrapper.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/auth_cfg_wrapper.Tpo $(DEPDIR)/auth_cfg_wrapper.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/auth_cfg_wrapper.Tpo $(DEPDIR)/auth_cfg_wrapper.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='credentials/sets/auth_cfg_wrapper.c' object='auth_cfg_wrapper.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o auth_cfg_wrapper.o `test -f 'credentials/sets/auth_cfg_wrapper.c' || echo '$(srcdir)/'`credentials/sets/auth_cfg_wrapper.c
auth_cfg_wrapper.obj: credentials/sets/auth_cfg_wrapper.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT auth_cfg_wrapper.obj -MD -MP -MF $(DEPDIR)/auth_cfg_wrapper.Tpo -c -o auth_cfg_wrapper.obj `if test -f 'credentials/sets/auth_cfg_wrapper.c'; then $(CYGPATH_W) 'credentials/sets/auth_cfg_wrapper.c'; else $(CYGPATH_W) '$(srcdir)/credentials/sets/auth_cfg_wrapper.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/auth_cfg_wrapper.Tpo $(DEPDIR)/auth_cfg_wrapper.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/auth_cfg_wrapper.Tpo $(DEPDIR)/auth_cfg_wrapper.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='credentials/sets/auth_cfg_wrapper.c' object='auth_cfg_wrapper.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o auth_cfg_wrapper.obj `if test -f 'credentials/sets/auth_cfg_wrapper.c'; then $(CYGPATH_W) 'credentials/sets/auth_cfg_wrapper.c'; else $(CYGPATH_W) '$(srcdir)/credentials/sets/auth_cfg_wrapper.c'; fi`
ocsp_response_wrapper.o: credentials/sets/ocsp_response_wrapper.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ocsp_response_wrapper.o -MD -MP -MF $(DEPDIR)/ocsp_response_wrapper.Tpo -c -o ocsp_response_wrapper.o `test -f 'credentials/sets/ocsp_response_wrapper.c' || echo '$(srcdir)/'`credentials/sets/ocsp_response_wrapper.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/ocsp_response_wrapper.Tpo $(DEPDIR)/ocsp_response_wrapper.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/ocsp_response_wrapper.Tpo $(DEPDIR)/ocsp_response_wrapper.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='credentials/sets/ocsp_response_wrapper.c' object='ocsp_response_wrapper.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ocsp_response_wrapper.o `test -f 'credentials/sets/ocsp_response_wrapper.c' || echo '$(srcdir)/'`credentials/sets/ocsp_response_wrapper.c
ocsp_response_wrapper.obj: credentials/sets/ocsp_response_wrapper.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ocsp_response_wrapper.obj -MD -MP -MF $(DEPDIR)/ocsp_response_wrapper.Tpo -c -o ocsp_response_wrapper.obj `if test -f 'credentials/sets/ocsp_response_wrapper.c'; then $(CYGPATH_W) 'credentials/sets/ocsp_response_wrapper.c'; else $(CYGPATH_W) '$(srcdir)/credentials/sets/ocsp_response_wrapper.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/ocsp_response_wrapper.Tpo $(DEPDIR)/ocsp_response_wrapper.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/ocsp_response_wrapper.Tpo $(DEPDIR)/ocsp_response_wrapper.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='credentials/sets/ocsp_response_wrapper.c' object='ocsp_response_wrapper.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ocsp_response_wrapper.obj `if test -f 'credentials/sets/ocsp_response_wrapper.c'; then $(CYGPATH_W) 'credentials/sets/ocsp_response_wrapper.c'; else $(CYGPATH_W) '$(srcdir)/credentials/sets/ocsp_response_wrapper.c'; fi`
cert_cache.o: credentials/sets/cert_cache.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT cert_cache.o -MD -MP -MF $(DEPDIR)/cert_cache.Tpo -c -o cert_cache.o `test -f 'credentials/sets/cert_cache.c' || echo '$(srcdir)/'`credentials/sets/cert_cache.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/cert_cache.Tpo $(DEPDIR)/cert_cache.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/cert_cache.Tpo $(DEPDIR)/cert_cache.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='credentials/sets/cert_cache.c' object='cert_cache.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o cert_cache.o `test -f 'credentials/sets/cert_cache.c' || echo '$(srcdir)/'`credentials/sets/cert_cache.c
cert_cache.obj: credentials/sets/cert_cache.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT cert_cache.obj -MD -MP -MF $(DEPDIR)/cert_cache.Tpo -c -o cert_cache.obj `if test -f 'credentials/sets/cert_cache.c'; then $(CYGPATH_W) 'credentials/sets/cert_cache.c'; else $(CYGPATH_W) '$(srcdir)/credentials/sets/cert_cache.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/cert_cache.Tpo $(DEPDIR)/cert_cache.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/cert_cache.Tpo $(DEPDIR)/cert_cache.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='credentials/sets/cert_cache.c' object='cert_cache.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o cert_cache.obj `if test -f 'credentials/sets/cert_cache.c'; then $(CYGPATH_W) 'credentials/sets/cert_cache.c'; else $(CYGPATH_W) '$(srcdir)/credentials/sets/cert_cache.c'; fi`
socket-raw.o: network/socket-raw.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT socket-raw.o -MD -MP -MF $(DEPDIR)/socket-raw.Tpo -c -o socket-raw.o `test -f 'network/socket-raw.c' || echo '$(srcdir)/'`network/socket-raw.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/socket-raw.Tpo $(DEPDIR)/socket-raw.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/socket-raw.Tpo $(DEPDIR)/socket-raw.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='network/socket-raw.c' object='socket-raw.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o socket-raw.o `test -f 'network/socket-raw.c' || echo '$(srcdir)/'`network/socket-raw.c
socket-raw.obj: network/socket-raw.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT socket-raw.obj -MD -MP -MF $(DEPDIR)/socket-raw.Tpo -c -o socket-raw.obj `if test -f 'network/socket-raw.c'; then $(CYGPATH_W) 'network/socket-raw.c'; else $(CYGPATH_W) '$(srcdir)/network/socket-raw.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/socket-raw.Tpo $(DEPDIR)/socket-raw.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/socket-raw.Tpo $(DEPDIR)/socket-raw.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='network/socket-raw.c' object='socket-raw.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o socket-raw.obj `if test -f 'network/socket-raw.c'; then $(CYGPATH_W) 'network/socket-raw.c'; else $(CYGPATH_W) '$(srcdir)/network/socket-raw.c'; fi`
socket.o: network/socket.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT socket.o -MD -MP -MF $(DEPDIR)/socket.Tpo -c -o socket.o `test -f 'network/socket.c' || echo '$(srcdir)/'`network/socket.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/socket.Tpo $(DEPDIR)/socket.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/socket.Tpo $(DEPDIR)/socket.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='network/socket.c' object='socket.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o socket.o `test -f 'network/socket.c' || echo '$(srcdir)/'`network/socket.c
socket.obj: network/socket.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT socket.obj -MD -MP -MF $(DEPDIR)/socket.Tpo -c -o socket.obj `if test -f 'network/socket.c'; then $(CYGPATH_W) 'network/socket.c'; else $(CYGPATH_W) '$(srcdir)/network/socket.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/socket.Tpo $(DEPDIR)/socket.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/socket.Tpo $(DEPDIR)/socket.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='network/socket.c' object='socket.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o socket.obj `if test -f 'network/socket.c'; then $(CYGPATH_W) 'network/socket.c'; else $(CYGPATH_W) '$(srcdir)/network/socket.c'; fi`
endpoint_notify.o: encoding/payloads/endpoint_notify.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT endpoint_notify.o -MD -MP -MF $(DEPDIR)/endpoint_notify.Tpo -c -o endpoint_notify.o `test -f 'encoding/payloads/endpoint_notify.c' || echo '$(srcdir)/'`encoding/payloads/endpoint_notify.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/endpoint_notify.Tpo $(DEPDIR)/endpoint_notify.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/endpoint_notify.Tpo $(DEPDIR)/endpoint_notify.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='encoding/payloads/endpoint_notify.c' object='endpoint_notify.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o endpoint_notify.o `test -f 'encoding/payloads/endpoint_notify.c' || echo '$(srcdir)/'`encoding/payloads/endpoint_notify.c
endpoint_notify.obj: encoding/payloads/endpoint_notify.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT endpoint_notify.obj -MD -MP -MF $(DEPDIR)/endpoint_notify.Tpo -c -o endpoint_notify.obj `if test -f 'encoding/payloads/endpoint_notify.c'; then $(CYGPATH_W) 'encoding/payloads/endpoint_notify.c'; else $(CYGPATH_W) '$(srcdir)/encoding/payloads/endpoint_notify.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/endpoint_notify.Tpo $(DEPDIR)/endpoint_notify.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/endpoint_notify.Tpo $(DEPDIR)/endpoint_notify.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='encoding/payloads/endpoint_notify.c' object='endpoint_notify.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o endpoint_notify.obj `if test -f 'encoding/payloads/endpoint_notify.c'; then $(CYGPATH_W) 'encoding/payloads/endpoint_notify.c'; else $(CYGPATH_W) '$(srcdir)/encoding/payloads/endpoint_notify.c'; fi`
initiate_mediation_job.o: processing/jobs/initiate_mediation_job.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT initiate_mediation_job.o -MD -MP -MF $(DEPDIR)/initiate_mediation_job.Tpo -c -o initiate_mediation_job.o `test -f 'processing/jobs/initiate_mediation_job.c' || echo '$(srcdir)/'`processing/jobs/initiate_mediation_job.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/initiate_mediation_job.Tpo $(DEPDIR)/initiate_mediation_job.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/initiate_mediation_job.Tpo $(DEPDIR)/initiate_mediation_job.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='processing/jobs/initiate_mediation_job.c' object='initiate_mediation_job.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o initiate_mediation_job.o `test -f 'processing/jobs/initiate_mediation_job.c' || echo '$(srcdir)/'`processing/jobs/initiate_mediation_job.c
initiate_mediation_job.obj: processing/jobs/initiate_mediation_job.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT initiate_mediation_job.obj -MD -MP -MF $(DEPDIR)/initiate_mediation_job.Tpo -c -o initiate_mediation_job.obj `if test -f 'processing/jobs/initiate_mediation_job.c'; then $(CYGPATH_W) 'processing/jobs/initiate_mediation_job.c'; else $(CYGPATH_W) '$(srcdir)/processing/jobs/initiate_mediation_job.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/initiate_mediation_job.Tpo $(DEPDIR)/initiate_mediation_job.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/initiate_mediation_job.Tpo $(DEPDIR)/initiate_mediation_job.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='processing/jobs/initiate_mediation_job.c' object='initiate_mediation_job.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o initiate_mediation_job.obj `if test -f 'processing/jobs/initiate_mediation_job.c'; then $(CYGPATH_W) 'processing/jobs/initiate_mediation_job.c'; else $(CYGPATH_W) '$(srcdir)/processing/jobs/initiate_mediation_job.c'; fi`
mediation_job.o: processing/jobs/mediation_job.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT mediation_job.o -MD -MP -MF $(DEPDIR)/mediation_job.Tpo -c -o mediation_job.o `test -f 'processing/jobs/mediation_job.c' || echo '$(srcdir)/'`processing/jobs/mediation_job.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/mediation_job.Tpo $(DEPDIR)/mediation_job.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/mediation_job.Tpo $(DEPDIR)/mediation_job.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='processing/jobs/mediation_job.c' object='mediation_job.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o mediation_job.o `test -f 'processing/jobs/mediation_job.c' || echo '$(srcdir)/'`processing/jobs/mediation_job.c
mediation_job.obj: processing/jobs/mediation_job.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT mediation_job.obj -MD -MP -MF $(DEPDIR)/mediation_job.Tpo -c -o mediation_job.obj `if test -f 'processing/jobs/mediation_job.c'; then $(CYGPATH_W) 'processing/jobs/mediation_job.c'; else $(CYGPATH_W) '$(srcdir)/processing/jobs/mediation_job.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/mediation_job.Tpo $(DEPDIR)/mediation_job.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/mediation_job.Tpo $(DEPDIR)/mediation_job.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='processing/jobs/mediation_job.c' object='mediation_job.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o mediation_job.obj `if test -f 'processing/jobs/mediation_job.c'; then $(CYGPATH_W) 'processing/jobs/mediation_job.c'; else $(CYGPATH_W) '$(srcdir)/processing/jobs/mediation_job.c'; fi`
connect_manager.o: sa/connect_manager.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT connect_manager.o -MD -MP -MF $(DEPDIR)/connect_manager.Tpo -c -o connect_manager.o `test -f 'sa/connect_manager.c' || echo '$(srcdir)/'`sa/connect_manager.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/connect_manager.Tpo $(DEPDIR)/connect_manager.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/connect_manager.Tpo $(DEPDIR)/connect_manager.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/connect_manager.c' object='connect_manager.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o connect_manager.o `test -f 'sa/connect_manager.c' || echo '$(srcdir)/'`sa/connect_manager.c
connect_manager.obj: sa/connect_manager.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT connect_manager.obj -MD -MP -MF $(DEPDIR)/connect_manager.Tpo -c -o connect_manager.obj `if test -f 'sa/connect_manager.c'; then $(CYGPATH_W) 'sa/connect_manager.c'; else $(CYGPATH_W) '$(srcdir)/sa/connect_manager.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/connect_manager.Tpo $(DEPDIR)/connect_manager.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/connect_manager.Tpo $(DEPDIR)/connect_manager.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/connect_manager.c' object='connect_manager.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o connect_manager.obj `if test -f 'sa/connect_manager.c'; then $(CYGPATH_W) 'sa/connect_manager.c'; else $(CYGPATH_W) '$(srcdir)/sa/connect_manager.c'; fi`
mediation_manager.o: sa/mediation_manager.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT mediation_manager.o -MD -MP -MF $(DEPDIR)/mediation_manager.Tpo -c -o mediation_manager.o `test -f 'sa/mediation_manager.c' || echo '$(srcdir)/'`sa/mediation_manager.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/mediation_manager.Tpo $(DEPDIR)/mediation_manager.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/mediation_manager.Tpo $(DEPDIR)/mediation_manager.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/mediation_manager.c' object='mediation_manager.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o mediation_manager.o `test -f 'sa/mediation_manager.c' || echo '$(srcdir)/'`sa/mediation_manager.c
mediation_manager.obj: sa/mediation_manager.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT mediation_manager.obj -MD -MP -MF $(DEPDIR)/mediation_manager.Tpo -c -o mediation_manager.obj `if test -f 'sa/mediation_manager.c'; then $(CYGPATH_W) 'sa/mediation_manager.c'; else $(CYGPATH_W) '$(srcdir)/sa/mediation_manager.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/mediation_manager.Tpo $(DEPDIR)/mediation_manager.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/mediation_manager.Tpo $(DEPDIR)/mediation_manager.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/mediation_manager.c' object='mediation_manager.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o mediation_manager.obj `if test -f 'sa/mediation_manager.c'; then $(CYGPATH_W) 'sa/mediation_manager.c'; else $(CYGPATH_W) '$(srcdir)/sa/mediation_manager.c'; fi`
ike_me.o: sa/tasks/ike_me.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ike_me.o -MD -MP -MF $(DEPDIR)/ike_me.Tpo -c -o ike_me.o `test -f 'sa/tasks/ike_me.c' || echo '$(srcdir)/'`sa/tasks/ike_me.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/ike_me.Tpo $(DEPDIR)/ike_me.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/ike_me.Tpo $(DEPDIR)/ike_me.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/tasks/ike_me.c' object='ike_me.o' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ike_me.o `test -f 'sa/tasks/ike_me.c' || echo '$(srcdir)/'`sa/tasks/ike_me.c
ike_me.obj: sa/tasks/ike_me.c
@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ike_me.obj -MD -MP -MF $(DEPDIR)/ike_me.Tpo -c -o ike_me.obj `if test -f 'sa/tasks/ike_me.c'; then $(CYGPATH_W) 'sa/tasks/ike_me.c'; else $(CYGPATH_W) '$(srcdir)/sa/tasks/ike_me.c'; fi`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/ike_me.Tpo $(DEPDIR)/ike_me.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/ike_me.Tpo $(DEPDIR)/ike_me.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='sa/tasks/ike_me.c' object='ike_me.obj' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ike_me.obj `if test -f 'sa/tasks/ike_me.c'; then $(CYGPATH_W) 'sa/tasks/ike_me.c'; else $(CYGPATH_W) '$(srcdir)/sa/tasks/ike_me.c'; fi`
@@ -2247,7 +2308,7 @@ $(RECURSIVE_TARGETS):
else \
local_target="$$target"; \
fi; \
- (cd $$subdir && $(MAKE) $(AM_MAKEFLAGS) $$local_target) \
+ ($(am__cd) $$subdir && $(MAKE) $(AM_MAKEFLAGS) $$local_target) \
|| eval $$failcom; \
done; \
if test "$$dot_seen" = "no"; then \
@@ -2281,16 +2342,16 @@ $(RECURSIVE_CLEAN_TARGETS):
else \
local_target="$$target"; \
fi; \
- (cd $$subdir && $(MAKE) $(AM_MAKEFLAGS) $$local_target) \
+ ($(am__cd) $$subdir && $(MAKE) $(AM_MAKEFLAGS) $$local_target) \
|| eval $$failcom; \
done && test -z "$$fail"
tags-recursive:
list='$(SUBDIRS)'; for subdir in $$list; do \
- test "$$subdir" = . || (cd $$subdir && $(MAKE) $(AM_MAKEFLAGS) tags); \
+ test "$$subdir" = . || ($(am__cd) $$subdir && $(MAKE) $(AM_MAKEFLAGS) tags); \
done
ctags-recursive:
list='$(SUBDIRS)'; for subdir in $$list; do \
- test "$$subdir" = . || (cd $$subdir && $(MAKE) $(AM_MAKEFLAGS) ctags); \
+ test "$$subdir" = . || ($(am__cd) $$subdir && $(MAKE) $(AM_MAKEFLAGS) ctags); \
done
ID: $(HEADERS) $(SOURCES) $(LISP) $(TAGS_FILES)
@@ -2305,7 +2366,7 @@ tags: TAGS
TAGS: tags-recursive $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
$(TAGS_FILES) $(LISP)
- tags=; \
+ set x; \
here=`pwd`; \
if ($(ETAGS) --etags-include --version) >/dev/null 2>&1; then \
include_option=--etags-include; \
@@ -2317,7 +2378,7 @@ TAGS: tags-recursive $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
list='$(SUBDIRS)'; for subdir in $$list; do \
if test "$$subdir" = .; then :; else \
test ! -f $$subdir/TAGS || \
- tags="$$tags $$include_option=$$here/$$subdir/TAGS"; \
+ set "$$@" "$$include_option=$$here/$$subdir/TAGS"; \
fi; \
done; \
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
@@ -2326,29 +2387,34 @@ TAGS: tags-recursive $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
- if test -z "$(ETAGS_ARGS)$$tags$$unique"; then :; else \
+ shift; \
+ if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
test -n "$$unique" || unique=$$empty_fix; \
- $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
- $$tags $$unique; \
+ if test $$# -gt 0; then \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ "$$@" $$unique; \
+ else \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ $$unique; \
+ fi; \
fi
ctags: CTAGS
CTAGS: ctags-recursive $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
$(TAGS_FILES) $(LISP)
- tags=; \
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
unique=`for i in $$list; do \
if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
- test -z "$(CTAGS_ARGS)$$tags$$unique" \
+ test -z "$(CTAGS_ARGS)$$unique" \
|| $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
- $$tags $$unique
+ $$unique
GTAGS:
here=`$(am__cd) $(top_builddir) && pwd` \
- && cd $(top_srcdir) \
- && gtags -i $(GTAGS_ARGS) $$here
+ && $(am__cd) $(top_srcdir) \
+ && gtags -i $(GTAGS_ARGS) "$$here"
distclean-tags:
-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
@@ -2369,29 +2435,44 @@ distdir: $(DISTFILES)
if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
if test -d $$d/$$file; then \
dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
+ if test -d "$(distdir)/$$file"; then \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+ fi; \
if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
- cp -pR $(srcdir)/$$file $(distdir)$$dir || exit 1; \
+ cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
fi; \
- cp -pR $$d/$$file $(distdir)$$dir || exit 1; \
+ cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
else \
- test -f $(distdir)/$$file \
- || cp -p $$d/$$file $(distdir)/$$file \
+ test -f "$(distdir)/$$file" \
+ || cp -p $$d/$$file "$(distdir)/$$file" \
|| exit 1; \
fi; \
done
- list='$(DIST_SUBDIRS)'; for subdir in $$list; do \
+ @list='$(DIST_SUBDIRS)'; for subdir in $$list; do \
if test "$$subdir" = .; then :; else \
test -d "$(distdir)/$$subdir" \
|| $(MKDIR_P) "$(distdir)/$$subdir" \
|| exit 1; \
- distdir=`$(am__cd) $(distdir) && pwd`; \
- top_distdir=`$(am__cd) $(top_distdir) && pwd`; \
- (cd $$subdir && \
+ fi; \
+ done
+ @list='$(DIST_SUBDIRS)'; for subdir in $$list; do \
+ if test "$$subdir" = .; then :; else \
+ dir1=$$subdir; dir2="$(distdir)/$$subdir"; \
+ $(am__relativize); \
+ new_distdir=$$reldir; \
+ dir1=$$subdir; dir2="$(top_distdir)"; \
+ $(am__relativize); \
+ new_top_distdir=$$reldir; \
+ echo " (cd $$subdir && $(MAKE) $(AM_MAKEFLAGS) top_distdir="$$new_top_distdir" distdir="$$new_distdir" \\"; \
+ echo " am__remove_distdir=: am__skip_length_check=: am__skip_mode_fix=: distdir)"; \
+ ($(am__cd) $$subdir && \
$(MAKE) $(AM_MAKEFLAGS) \
- top_distdir="$$top_distdir" \
- distdir="$$distdir/$$subdir" \
+ top_distdir="$$new_top_distdir" \
+ distdir="$$new_distdir" \
am__remove_distdir=: \
am__skip_length_check=: \
+ am__skip_mode_fix=: \
distdir) \
|| exit 1; \
fi; \
@@ -2424,6 +2505,7 @@ clean-generic:
distclean-generic:
-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+ -test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
maintainer-clean-generic:
@echo "This command is intended for maintainers to use"
@@ -2445,6 +2527,8 @@ dvi-am:
html: html-recursive
+html-am:
+
info: info-recursive
info-am:
@@ -2453,18 +2537,28 @@ install-data-am: install-ipsecPROGRAMS
install-dvi: install-dvi-recursive
+install-dvi-am:
+
install-exec-am:
install-html: install-html-recursive
+install-html-am:
+
install-info: install-info-recursive
+install-info-am:
+
install-man:
install-pdf: install-pdf-recursive
+install-pdf-am:
+
install-ps: install-ps-recursive
+install-ps-am:
+
installcheck-am:
maintainer-clean: maintainer-clean-recursive
@@ -2487,8 +2581,8 @@ ps-am:
uninstall-am: uninstall-ipsecPROGRAMS
-.MAKE: $(RECURSIVE_CLEAN_TARGETS) $(RECURSIVE_TARGETS) install-am \
- install-strip
+.MAKE: $(RECURSIVE_CLEAN_TARGETS) $(RECURSIVE_TARGETS) ctags-recursive \
+ install-am install-strip tags-recursive
.PHONY: $(RECURSIVE_CLEAN_TARGETS) $(RECURSIVE_TARGETS) CTAGS GTAGS \
all all-am check check-am clean clean-generic \
@@ -2506,6 +2600,7 @@ uninstall-am: uninstall-ipsecPROGRAMS
pdf pdf-am ps ps-am tags tags-recursive uninstall uninstall-am \
uninstall-ipsecPROGRAMS
+
# Tell versions [3.59,3.63) of GNU make to not export all variables.
# Otherwise a system limit (for SysV at least) may be exceeded.
.NOEXPORT:
diff --git a/src/charon/bus/bus.c b/src/charon/bus/bus.c
index 2671f848e..524a77682 100644
--- a/src/charon/bus/bus.c
+++ b/src/charon/bus/bus.c
@@ -15,11 +15,13 @@
#include "bus.h"
-#include <pthread.h>
#include <stdint.h>
#include <daemon.h>
-#include <utils/mutex.h>
+#include <threading/thread.h>
+#include <threading/thread_value.h>
+#include <threading/condvar.h>
+#include <threading/mutex.h>
ENUM(debug_names, DBG_DMN, DBG_LIB,
"DMN",
@@ -57,26 +59,21 @@ struct private_bus_t {
* Public part of a bus_t object.
*/
bus_t public;
-
+
/**
* List of registered listeners as entry_t's
*/
linked_list_t *listeners;
-
+
/**
* mutex to synchronize active listeners, recursively
*/
mutex_t *mutex;
-
- /**
- * Thread local storage for a unique, simple thread ID
- */
- pthread_key_t thread_id;
-
+
/**
* Thread local storage the threads IKE_SA
*/
- pthread_key_t thread_sa;
+ thread_value_t *thread_sa;
};
typedef struct entry_t entry_t;
@@ -90,17 +87,17 @@ struct entry_t {
* registered listener interface
*/
listener_t *listener;
-
+
/**
* is this a active listen() call with a blocking thread
*/
bool blocker;
-
+
/**
* are we currently calling this listener
*/
int calling;
-
+
/**
* condvar where active listeners wait
*/
@@ -113,12 +110,12 @@ struct entry_t {
static entry_t *entry_create(listener_t *listener, bool blocker)
{
entry_t *this = malloc_thing(entry_t);
-
+
this->listener = listener;
this->blocker = blocker;
this->calling = 0;
this->condvar = condvar_create(CONDVAR_TYPE_DEFAULT);
-
+
return this;
}
@@ -132,28 +129,6 @@ static void entry_destroy(entry_t *entry)
}
/**
- * Get a unique thread number for a calling thread. Since
- * pthread_self returns large and ugly numbers, use this function
- * for logging; these numbers are incremental starting at 1
- */
-static u_int get_thread_number(private_bus_t *this)
-{
- static uintptr_t current_num = 0;
- uintptr_t stored_num;
-
- stored_num = (uintptr_t)pthread_getspecific(this->thread_id);
- if (stored_num == 0)
- { /* first call of current thread */
- pthread_setspecific(this->thread_id, (void*)++current_num);
- return current_num;
- }
- else
- {
- return stored_num;
- }
-}
-
-/**
* Implementation of bus_t.add_listener.
*/
static void add_listener(private_bus_t *this, listener_t *listener)
@@ -189,7 +164,7 @@ static void remove_listener(private_bus_t *this, listener_t *listener)
typedef struct cleanup_data_t cleanup_data_t;
/**
- * data to remove a listener using pthread_cleanup handler
+ * data to remove a listener using thread_cleanup_t handler
*/
struct cleanup_data_t {
/** bus instance */
@@ -199,7 +174,7 @@ struct cleanup_data_t {
};
/**
- * pthread_cleanup handler to remove a listener
+ * thread_cleanup_t handler to remove a listener
*/
static void listener_cleanup(cleanup_data_t *data)
{
@@ -212,26 +187,26 @@ static void listener_cleanup(cleanup_data_t *data)
*/
static void listen_(private_bus_t *this, listener_t *listener, job_t *job)
{
- int old;
+ bool old;
cleanup_data_t data;
-
+
data.this = this;
data.entry = entry_create(listener, TRUE);
this->mutex->lock(this->mutex);
this->listeners->insert_last(this->listeners, data.entry);
charon->processor->queue_job(charon->processor, job);
- pthread_cleanup_push((void*)this->mutex->unlock, this->mutex);
- pthread_cleanup_push((void*)listener_cleanup, &data);
- pthread_setcancelstate(PTHREAD_CANCEL_ENABLE, &old);
+ thread_cleanup_push((thread_cleanup_t)this->mutex->unlock, this->mutex);
+ thread_cleanup_push((thread_cleanup_t)listener_cleanup, &data);
+ old = thread_cancelability(TRUE);
while (data.entry->blocker)
{
data.entry->condvar->wait(data.entry->condvar, this->mutex);
}
- pthread_setcancelstate(old, NULL);
- pthread_cleanup_pop(FALSE);
+ thread_cancelability(old);
+ thread_cleanup_pop(FALSE);
/* unlock mutex */
- pthread_cleanup_pop(TRUE);
+ thread_cleanup_pop(TRUE);
entry_destroy(data.entry);
}
@@ -240,7 +215,15 @@ static void listen_(private_bus_t *this, listener_t *listener, job_t *job)
*/
static void set_sa(private_bus_t *this, ike_sa_t *ike_sa)
{
- pthread_setspecific(this->thread_sa, ike_sa);
+ this->thread_sa->set(this->thread_sa, ike_sa);
+}
+
+/**
+ * Implementation of bus_t.get_sa
+ */
+static ike_sa_t* get_sa(private_bus_t *this)
+{
+ return this->thread_sa->get(this->thread_sa);
}
/**
@@ -302,20 +285,20 @@ static void vlog(private_bus_t *this, debug_t group, level_t level,
char* format, va_list args)
{
log_data_t data;
-
- data.ike_sa = pthread_getspecific(this->thread_sa);
- data.thread = get_thread_number(this);
+
+ data.ike_sa = this->thread_sa->get(this->thread_sa);
+ data.thread = thread_current_id();
data.group = group;
data.level = level;
data.format = format;
va_copy(data.args, args);
-
+
this->mutex->lock(this->mutex);
/* We use the remove() method to invoke all listeners. This is cheap and
* does not require an allocation for this performance critical function. */
this->listeners->remove(this->listeners, &data, (void*)log_cb);
this->mutex->unlock(this->mutex);
-
+
va_end(data.args);
}
@@ -326,7 +309,7 @@ static void log_(private_bus_t *this, debug_t group, level_t level,
char* format, ...)
{
va_list args;
-
+
va_start(args, format);
vlog(this, group, level, format, args);
va_end(args);
@@ -360,9 +343,9 @@ static void alert(private_bus_t *this, alert_t alert, ...)
entry_t *entry;
va_list args;
bool keep;
-
- ike_sa = pthread_getspecific(this->thread_sa);
-
+
+ ike_sa = this->thread_sa->get(this->thread_sa);
+
this->mutex->lock(this->mutex);
enumerator = this->listeners->create_enumerator(this->listeners);
while (enumerator->enumerate(enumerator, &entry))
@@ -394,7 +377,7 @@ static void ike_state_change(private_bus_t *this, ike_sa_t *ike_sa,
enumerator_t *enumerator;
entry_t *entry;
bool keep;
-
+
this->mutex->lock(this->mutex);
enumerator = this->listeners->create_enumerator(this->listeners);
while (enumerator->enumerate(enumerator, &entry))
@@ -425,9 +408,9 @@ static void child_state_change(private_bus_t *this, child_sa_t *child_sa,
ike_sa_t *ike_sa;
entry_t *entry;
bool keep;
-
- ike_sa = pthread_getspecific(this->thread_sa);
-
+
+ ike_sa = this->thread_sa->get(this->thread_sa);
+
this->mutex->lock(this->mutex);
enumerator = this->listeners->create_enumerator(this->listeners);
while (enumerator->enumerate(enumerator, &entry))
@@ -458,9 +441,9 @@ static void message(private_bus_t *this, message_t *message, bool incoming)
ike_sa_t *ike_sa;
entry_t *entry;
bool keep;
-
- ike_sa = pthread_getspecific(this->thread_sa);
-
+
+ ike_sa = this->thread_sa->get(this->thread_sa);
+
this->mutex->lock(this->mutex);
enumerator = this->listeners->create_enumerator(this->listeners);
while (enumerator->enumerate(enumerator, &entry))
@@ -492,7 +475,7 @@ static void ike_keys(private_bus_t *this, ike_sa_t *ike_sa,
enumerator_t *enumerator;
entry_t *entry;
bool keep;
-
+
this->mutex->lock(this->mutex);
enumerator = this->listeners->create_enumerator(this->listeners);
while (enumerator->enumerate(enumerator, &entry))
@@ -524,9 +507,9 @@ static void child_keys(private_bus_t *this, child_sa_t *child_sa,
ike_sa_t *ike_sa;
entry_t *entry;
bool keep;
-
- ike_sa = pthread_getspecific(this->thread_sa);
-
+
+ ike_sa = this->thread_sa->get(this->thread_sa);
+
this->mutex->lock(this->mutex);
enumerator = this->listeners->create_enumerator(this->listeners);
while (enumerator->enumerate(enumerator, &entry))
@@ -557,9 +540,9 @@ static void child_updown(private_bus_t *this, child_sa_t *child_sa, bool up)
ike_sa_t *ike_sa;
entry_t *entry;
bool keep;
-
- ike_sa = pthread_getspecific(this->thread_sa);
-
+
+ ike_sa = this->thread_sa->get(this->thread_sa);
+
this->mutex->lock(this->mutex);
enumerator = this->listeners->create_enumerator(this->listeners);
while (enumerator->enumerate(enumerator, &entry))
@@ -590,9 +573,9 @@ static void child_rekey(private_bus_t *this, child_sa_t *old, child_sa_t *new)
ike_sa_t *ike_sa;
entry_t *entry;
bool keep;
-
- ike_sa = pthread_getspecific(this->thread_sa);
-
+
+ ike_sa = this->thread_sa->get(this->thread_sa);
+
this->mutex->lock(this->mutex);
enumerator = this->listeners->create_enumerator(this->listeners);
while (enumerator->enumerate(enumerator, &entry))
@@ -621,7 +604,7 @@ static void ike_updown(private_bus_t *this, ike_sa_t *ike_sa, bool up)
enumerator_t *enumerator;
entry_t *entry;
bool keep;
-
+
this->mutex->lock(this->mutex);
enumerator = this->listeners->create_enumerator(this->listeners);
while (enumerator->enumerate(enumerator, &entry))
@@ -640,13 +623,13 @@ static void ike_updown(private_bus_t *this, ike_sa_t *ike_sa, bool up)
}
enumerator->destroy(enumerator);
this->mutex->unlock(this->mutex);
-
+
/* a down event for IKE_SA implicitly downs all CHILD_SAs */
if (!up)
{
iterator_t *iterator;
child_sa_t *child_sa;
-
+
iterator = ike_sa->create_child_sa_iterator(ike_sa);
while (iterator->iterate(iterator, (void**)&child_sa))
{
@@ -664,7 +647,7 @@ static void ike_rekey(private_bus_t *this, ike_sa_t *old, ike_sa_t *new)
enumerator_t *enumerator;
entry_t *entry;
bool keep;
-
+
this->mutex->lock(this->mutex);
enumerator = this->listeners->create_enumerator(this->listeners);
while (enumerator->enumerate(enumerator, &entry))
@@ -688,15 +671,15 @@ static void ike_rekey(private_bus_t *this, ike_sa_t *old, ike_sa_t *new)
/**
* Implementation of bus_t.authorize
*/
-static bool authorize(private_bus_t *this, linked_list_t *auth, bool final)
+static bool authorize(private_bus_t *this, bool final)
{
enumerator_t *enumerator;
ike_sa_t *ike_sa;
entry_t *entry;
bool keep, success = TRUE;
-
- ike_sa = pthread_getspecific(this->thread_sa);
-
+
+ ike_sa = this->thread_sa->get(this->thread_sa);
+
this->mutex->lock(this->mutex);
enumerator = this->listeners->create_enumerator(this->listeners);
while (enumerator->enumerate(enumerator, &entry))
@@ -707,7 +690,7 @@ static bool authorize(private_bus_t *this, linked_list_t *auth, bool final)
}
entry->calling++;
keep = entry->listener->authorize(entry->listener, ike_sa,
- auth, final, &success);
+ final, &success);
entry->calling--;
if (!keep)
{
@@ -728,6 +711,7 @@ static bool authorize(private_bus_t *this, linked_list_t *auth, bool final)
*/
static void destroy(private_bus_t *this)
{
+ this->thread_sa->destroy(this->thread_sa);
this->mutex->destroy(this->mutex);
this->listeners->destroy_function(this->listeners, (void*)entry_destroy);
free(this);
@@ -739,11 +723,12 @@ static void destroy(private_bus_t *this)
bus_t *bus_create()
{
private_bus_t *this = malloc_thing(private_bus_t);
-
+
this->public.add_listener = (void(*)(bus_t*,listener_t*))add_listener;
this->public.remove_listener = (void(*)(bus_t*,listener_t*))remove_listener;
this->public.listen = (void(*)(bus_t*, listener_t *listener, job_t *job))listen_;
this->public.set_sa = (void(*)(bus_t*,ike_sa_t*))set_sa;
+ this->public.get_sa = (ike_sa_t*(*)(bus_t*))get_sa;
this->public.log = (void(*)(bus_t*,debug_t,level_t,char*,...))log_;
this->public.vlog = (void(*)(bus_t*,debug_t,level_t,char*,va_list))vlog;
this->public.alert = (void(*)(bus_t*, alert_t alert, ...))alert;
@@ -756,14 +741,13 @@ bus_t *bus_create()
this->public.ike_rekey = (void(*)(bus_t*, ike_sa_t *old, ike_sa_t *new))ike_rekey;
this->public.child_updown = (void(*)(bus_t*, child_sa_t *child_sa, bool up))child_updown;
this->public.child_rekey = (void(*)(bus_t*, child_sa_t *old, child_sa_t *new))child_rekey;
- this->public.authorize = (bool(*)(bus_t*, linked_list_t *auth, bool final))authorize;
+ this->public.authorize = (bool(*)(bus_t*, bool final))authorize;
this->public.destroy = (void(*)(bus_t*)) destroy;
-
+
this->listeners = linked_list_create();
this->mutex = mutex_create(MUTEX_TYPE_RECURSIVE);
- pthread_key_create(&this->thread_id, NULL);
- pthread_key_create(&this->thread_sa, NULL);
-
+ this->thread_sa = thread_value_create(NULL);
+
return &this->public;
}
diff --git a/src/charon/bus/bus.h b/src/charon/bus/bus.h
index 9c90db6f9..af59a14a1 100644
--- a/src/charon/bus/bus.h
+++ b/src/charon/bus/bus.h
@@ -133,6 +133,8 @@ enum level_t {
enum alert_t {
/* a RADIUS server did not respond, no additional arguments */
ALERT_RADIUS_NOT_RESPONDING,
+ /* a shutdown signal has been received, argument is a int with the signal */
+ ALERT_SHUTDOWN_SIGNAL,
};
/**
@@ -142,7 +144,7 @@ enum alert_t {
* may wait actively to events using the blocking listen() call.
*/
struct bus_t {
-
+
/**
* Register a listener to the bus.
*
@@ -153,14 +155,14 @@ struct bus_t {
* @param listener listener to register.
*/
void (*add_listener) (bus_t *this, listener_t *listener);
-
+
/**
* Unregister a listener from the bus.
*
* @param listener listener to unregister.
*/
void (*remove_listener) (bus_t *this, listener_t *listener);
-
+
/**
* Register a listener and block the calling thread.
*
@@ -174,20 +176,30 @@ struct bus_t {
* @param job job to execute asynchronously when registered, or NULL
*/
void (*listen)(bus_t *this, listener_t *listener, job_t *job);
-
+
/**
* Set the IKE_SA the calling thread is using.
*
* To associate an received log message to an IKE_SA without passing it as
* parameter each time, the thread registers the currenlty used IKE_SA
- * during check-out. Before check-in, the thread unregisters the IKE_SA.
+ * during check-out. Before check-in, the thread unregisters the IKE_SA.
* This IKE_SA is stored per-thread, so each thread has its own IKE_SA
* registered.
- *
+ *
* @param ike_sa ike_sa to register, or NULL to unregister
*/
void (*set_sa) (bus_t *this, ike_sa_t *ike_sa);
-
+
+ /**
+ * Get the IKE_SA the calling thread is currently using.
+ *
+ * If a thread currently does not know what IKE_SA it is processing,
+ * it can call get_sa() to look up the SA set during checkout via set_sa().
+ *
+ * @return registered ike_sa, NULL if none registered
+ */
+ ike_sa_t* (*get_sa)(bus_t *this);
+
/**
* Send a log message to the bus.
*
@@ -202,7 +214,7 @@ struct bus_t {
* @param ... printf() style argument list
*/
void (*log)(bus_t *this, debug_t group, level_t level, char* format, ...);
-
+
/**
* Send a log message to the bus using va_list arguments.
*
@@ -215,7 +227,7 @@ struct bus_t {
*/
void (*vlog)(bus_t *this, debug_t group, level_t level,
char* format, va_list args);
-
+
/**
* Raise an alert over the bus.
*
@@ -223,7 +235,7 @@ struct bus_t {
* @param ... alert specific attributes
*/
void (*alert)(bus_t *this, alert_t alert, ...);
-
+
/**
* Send a IKE_SA state change event to the bus.
*
@@ -247,16 +259,15 @@ struct bus_t {
* @param incoming TRUE for incoming messages, FALSE for outgoing
*/
void (*message)(bus_t *this, message_t *message, bool incoming);
-
+
/**
* IKE_SA authorization hook.
*
- * @param auth list of auth_cfg_t, containing peers authentication info
* @param final TRUE if this is the final invocation
* @return TRUE to establish IKE_SA, FALSE to send AUTH_FAILED
*/
- bool (*authorize)(bus_t *this, linked_list_t *auth, bool final);
-
+ bool (*authorize)(bus_t *this, bool final);
+
/**
* IKE_SA keymat hook.
*
@@ -278,7 +289,7 @@ struct bus_t {
*/
void (*child_keys)(bus_t *this, child_sa_t *child_sa, diffie_hellman_t *dh,
chunk_t nonce_i, chunk_t nonce_r);
-
+
/**
* IKE_SA up/down hook.
*
@@ -286,7 +297,7 @@ struct bus_t {
* @param up TRUE for an up event, FALSE for a down event
*/
void (*ike_updown)(bus_t *this, ike_sa_t *ike_sa, bool up);
-
+
/**
* IKE_SA rekeying hook.
*
@@ -294,7 +305,7 @@ struct bus_t {
* @param new new IKE_SA replacing old
*/
void (*ike_rekey)(bus_t *this, ike_sa_t *old, ike_sa_t *new);
-
+
/**
* CHILD_SA up/down hook.
*
@@ -302,7 +313,7 @@ struct bus_t {
* @param up TRUE for an up event, FALSE for a down event
*/
void (*child_updown)(bus_t *this, child_sa_t *child_sa, bool up);
-
+
/**
* CHILD_SA rekeying hook.
*
@@ -310,7 +321,7 @@ struct bus_t {
* @param new new CHILD_SA replacing old
*/
void (*child_rekey)(bus_t *this, child_sa_t *old, child_sa_t *new);
-
+
/**
* Destroy the event bus.
*/
diff --git a/src/charon/bus/listeners/file_logger.c b/src/charon/bus/listeners/file_logger.c
index c3213f5f8..12587deaf 100644
--- a/src/charon/bus/listeners/file_logger.c
+++ b/src/charon/bus/listeners/file_logger.c
@@ -25,17 +25,17 @@ typedef struct private_file_logger_t private_file_logger_t;
* Private data of a file_logger_t object
*/
struct private_file_logger_t {
-
+
/**
* Public data.
*/
file_logger_t public;
-
+
/**
* output file
*/
FILE *out;
-
+
/**
* Maximum level to log, for each group
*/
@@ -52,10 +52,10 @@ static bool log_(private_file_logger_t *this, debug_t group, level_t level,
{
char buffer[8192];
char *current = buffer, *next;
-
+
/* write in memory buffer first */
vsnprintf(buffer, sizeof(buffer), format, args);
-
+
/* prepend a prefix in front of every line */
while (current)
{
@@ -109,17 +109,17 @@ static void destroy(private_file_logger_t *this)
file_logger_t *file_logger_create(FILE *out)
{
private_file_logger_t *this = malloc_thing(private_file_logger_t);
-
+
/* public functions */
memset(&this->public.listener, 0, sizeof(listener_t));
this->public.listener.log = (bool(*)(listener_t*,debug_t,level_t,int,ike_sa_t*,char*,va_list))log_;
this->public.set_level = (void(*)(file_logger_t*,debug_t,level_t))set_level;
this->public.destroy = (void(*)(file_logger_t*))destroy;
-
+
/* private variables */
this->out = out;
set_level(this, DBG_ANY, LEVEL_SILENT);
-
+
return &this->public;
}
diff --git a/src/charon/bus/listeners/file_logger.h b/src/charon/bus/listeners/file_logger.h
index a69374f23..bd443fdb8 100644
--- a/src/charon/bus/listeners/file_logger.h
+++ b/src/charon/bus/listeners/file_logger.h
@@ -29,12 +29,12 @@ typedef struct file_logger_t file_logger_t;
* Logger to files which implements listener_t.
*/
struct file_logger_t {
-
+
/**
* Implements the listener_t interface.
*/
listener_t listener;
-
+
/**
* Set the loglevel for a debug group.
*
@@ -42,7 +42,7 @@ struct file_logger_t {
* @param level max level to log (0..4)
*/
void (*set_level) (file_logger_t *this, debug_t group, level_t level);
-
+
/**
* Destroys a file_logger_t object.
*/
diff --git a/src/charon/bus/listeners/listener.h b/src/charon/bus/listeners/listener.h
index 578f08ebe..67e36beeb 100644
--- a/src/charon/bus/listeners/listener.h
+++ b/src/charon/bus/listeners/listener.h
@@ -29,7 +29,7 @@ typedef struct listener_t listener_t;
* Listener interface, listens to events if registered to the bus.
*/
struct listener_t {
-
+
/**
* Log a debugging message.
*
@@ -48,7 +48,7 @@ struct listener_t {
*/
bool (*log)(listener_t *this, debug_t group, level_t level, int thread,
ike_sa_t *ike_sa, char* format, va_list args);
-
+
/**
* Hook called if a critical alert is risen.
*
@@ -59,7 +59,7 @@ struct listener_t {
*/
bool (*alert)(listener_t *this, ike_sa_t *ike_sa,
alert_t alert, va_list args);
-
+
/**
* Handle state changes in an IKE_SA.
*
@@ -69,7 +69,7 @@ struct listener_t {
*/
bool (*ike_state_change)(listener_t *this, ike_sa_t *ike_sa,
ike_sa_state_t state);
-
+
/**
* Handle state changes in a CHILD_SA.
*
@@ -80,7 +80,7 @@ struct listener_t {
*/
bool (*child_state_change)(listener_t *this, ike_sa_t *ike_sa,
child_sa_t *child_sa, child_sa_state_t state);
-
+
/**
* Hook called for received/sent messages of an IKE_SA.
*
@@ -91,7 +91,7 @@ struct listener_t {
*/
bool (*message)(listener_t *this, ike_sa_t *ike_sa, message_t *message,
bool incoming);
-
+
/**
* Hook called with IKE_SA key material.
*
@@ -104,7 +104,7 @@ struct listener_t {
*/
bool (*ike_keys)(listener_t *this, ike_sa_t *ike_sa, diffie_hellman_t *dh,
chunk_t nonce_i, chunk_t nonce_r, ike_sa_t *rekey);
-
+
/**
* Hook called with CHILD_SA key material.
*
@@ -117,7 +117,7 @@ struct listener_t {
*/
bool (*child_keys)(listener_t *this, ike_sa_t *ike_sa, child_sa_t *child_sa,
diffie_hellman_t *dh, chunk_t nonce_i, chunk_t nonce_r);
-
+
/**
* Hook called if an IKE_SA gets up or down.
*
@@ -126,7 +126,7 @@ struct listener_t {
* @return TRUE to stay registered, FALSE to unregister
*/
bool (*ike_updown)(listener_t *this, ike_sa_t *ike_sa, bool up);
-
+
/**
* Hook called when an IKE_SA gets rekeyed.
*
@@ -135,7 +135,7 @@ struct listener_t {
* @return TRUE to stay registered, FALSE to unregister
*/
bool (*ike_rekey)(listener_t *this, ike_sa_t *old, ike_sa_t *new);
-
+
/**
* Hook called when a CHILD_SA gets up or down.
*
@@ -146,7 +146,7 @@ struct listener_t {
*/
bool (*child_updown)(listener_t *this, ike_sa_t *ike_sa,
child_sa_t *child_sa, bool up);
-
+
/**
* Hook called when an CHILD_SA gets rekeyed.
*
@@ -157,7 +157,7 @@ struct listener_t {
*/
bool (*child_rekey)(listener_t *this, ike_sa_t *ike_sa,
child_sa_t *old, child_sa_t *new);
-
+
/**
* Hook called to invoke additional authorization rules.
*
@@ -167,13 +167,12 @@ struct listener_t {
* it is invoked again, but with final = TRUE.
*
* @param ike_sa IKE_SA to authorize
- * @param auth list of auth_cfg_t, done in peers authentication rounds
* @param final TRUE if this is the final hook invocation
* @param success set to TRUE to complete IKE_SA, FALSE abort
* @return TRUE to stay registered, FALSE to unregister
*/
- bool (*authorize)(listener_t *this, ike_sa_t *ike_sa, linked_list_t *auth,
+ bool (*authorize)(listener_t *this, ike_sa_t *ike_sa,
bool final, bool *success);
};
-#endif /* LISTENER_ @}*/
+#endif /** LISTENER_H_ @}*/
diff --git a/src/charon/bus/listeners/sys_logger.c b/src/charon/bus/listeners/sys_logger.c
index 0b579ce92..11421ad05 100644
--- a/src/charon/bus/listeners/sys_logger.c
+++ b/src/charon/bus/listeners/sys_logger.c
@@ -25,17 +25,17 @@ typedef struct private_sys_logger_t private_sys_logger_t;
* Private data of a sys_logger_t object
*/
struct private_sys_logger_t {
-
+
/**
* Public data.
*/
sys_logger_t public;
-
+
/**
* syslog facility to use
*/
int facility;
-
+
/**
* Maximum level to log, for each group
*/
@@ -52,10 +52,10 @@ static bool log_(private_sys_logger_t *this, debug_t group, level_t level,
{
char buffer[8192];
char *current = buffer, *next;
-
+
/* write in memory buffer first */
vsnprintf(buffer, sizeof(buffer), format, args);
-
+
/* do a syslog with every line */
while (current)
{
@@ -106,16 +106,16 @@ static void destroy(private_sys_logger_t *this)
sys_logger_t *sys_logger_create(int facility)
{
private_sys_logger_t *this = malloc_thing(private_sys_logger_t);
-
+
/* public functions */
memset(&this->public.listener, 0, sizeof(listener_t));
this->public.listener.log = (bool(*)(listener_t*,debug_t,level_t,int,ike_sa_t*,char*,va_list))log_;
this->public.set_level = (void(*)(sys_logger_t*,debug_t,level_t))set_level;
this->public.destroy = (void(*)(sys_logger_t*))destroy;
-
+
/* private variables */
this->facility = facility;
set_level(this, DBG_ANY, LEVEL_SILENT);
-
+
return &this->public;
}
diff --git a/src/charon/bus/listeners/sys_logger.h b/src/charon/bus/listeners/sys_logger.h
index 3ed0f02fa..730890d68 100644
--- a/src/charon/bus/listeners/sys_logger.h
+++ b/src/charon/bus/listeners/sys_logger.h
@@ -31,12 +31,12 @@ typedef struct sys_logger_t sys_logger_t;
* Logger for syslog which implements listener_t.
*/
struct sys_logger_t {
-
+
/**
* Implements the listener_t interface.
*/
listener_t listener;
-
+
/**
* Set the loglevel for a debug group.
*
@@ -44,7 +44,7 @@ struct sys_logger_t {
* @param level max level to log (0..4)
*/
void (*set_level) (sys_logger_t *this, debug_t group, level_t level);
-
+
/**
* Destroys a sys_logger_t object.
*/
diff --git a/src/charon/config/attributes/attribute_handler.h b/src/charon/config/attributes/attribute_handler.h
deleted file mode 100644
index de1c4414d..000000000
--- a/src/charon/config/attributes/attribute_handler.h
+++ /dev/null
@@ -1,58 +0,0 @@
-/*
- * Copyright (C) 2009 Martin Willi
- * Hochschule fuer Technik Rapperswil
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
- * for more details.
- */
-
-/**
- * @defgroup attribute_handler attribute_handler
- * @{ @ingroup attributes
- */
-
-#ifndef ATTRIBUTE_HANDLER_H_
-#define ATTRIBUTE_HANDLER_H_
-
-#include <sa/ike_sa.h>
-#include <encoding/payloads/configuration_attribute.h>
-
-typedef struct attribute_handler_t attribute_handler_t;
-
-/**
- * Interface to handle configuration payload attributes.
- */
-struct attribute_handler_t {
-
- /**
- * Handle a configuration attribute.
- *
- * After receiving a configuration attriubte, it is passed to each
- * attribute handler until it is handled.
- *
- * @param type type of configuration attribute to handle
- * @param data associated attribute data
- * @return TRUE if attribute handled
- */
- bool (*handle)(attribute_handler_t *this, ike_sa_t *ike_sa,
- configuration_attribute_type_t type, chunk_t data);
-
- /**
- * Release an attribute handled during handle().
- *
- * A handler that handle()d an attribute gets a call to release() when the
- * IKE_SA gets closed. Depending on the implementation, this is required
- * to remove the attribute.
- */
- void (*release)(attribute_handler_t *this, ike_sa_t *ike_sa,
- configuration_attribute_type_t type, chunk_t data);
-};
-
-#endif /* ATTRIBUTE_HANDLER_ @}*/
diff --git a/src/charon/config/attributes/attribute_manager.c b/src/charon/config/attributes/attribute_manager.c
deleted file mode 100644
index bf45fdb42..000000000
--- a/src/charon/config/attributes/attribute_manager.c
+++ /dev/null
@@ -1,267 +0,0 @@
-/*
- * Copyright (C) 2008 Martin Willi
- * Hochschule fuer Technik Rapperswil
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
- * for more details.
- */
-
-#include "attribute_manager.h"
-
-#include <daemon.h>
-#include <utils/linked_list.h>
-#include <utils/mutex.h>
-
-typedef struct private_attribute_manager_t private_attribute_manager_t;
-
-/**
- * private data of attribute_manager
- */
-struct private_attribute_manager_t {
-
- /**
- * public functions
- */
- attribute_manager_t public;
-
- /**
- * list of registered providers
- */
- linked_list_t *providers;
-
- /**
- * list of registered handlers
- */
- linked_list_t *handlers;
-
- /**
- * rwlock provider list
- */
- rwlock_t *lock;
-};
-
-/**
- * Implementation of attribute_manager_t.acquire_address.
- */
-static host_t* acquire_address(private_attribute_manager_t *this,
- char *pool, identification_t *id,
- host_t *requested)
-{
- enumerator_t *enumerator;
- attribute_provider_t *current;
- host_t *host = NULL;
-
- this->lock->read_lock(this->lock);
- enumerator = this->providers->create_enumerator(this->providers);
- while (enumerator->enumerate(enumerator, &current))
- {
- host = current->acquire_address(current, pool, id, requested);
- if (host)
- {
- break;
- }
- }
- enumerator->destroy(enumerator);
- this->lock->unlock(this->lock);
-
- if (!host)
- {
- DBG1(DBG_CFG, "acquiring address from pool '%s' failed", pool);
- }
- return host;
-}
-
-/**
- * Implementation of attribute_manager_t.release_address.
- */
-static void release_address(private_attribute_manager_t *this,
- char *pool, host_t *address, identification_t *id)
-{
- enumerator_t *enumerator;
- attribute_provider_t *current;
- bool found = FALSE;
-
- this->lock->read_lock(this->lock);
- enumerator = this->providers->create_enumerator(this->providers);
- while (enumerator->enumerate(enumerator, &current))
- {
- if (current->release_address(current, pool, address, id))
- {
- found = TRUE;
- break;
- }
- }
- enumerator->destroy(enumerator);
- this->lock->unlock(this->lock);
-
- if (!found)
- {
- DBG1(DBG_CFG, "releasing address to pool '%s' failed", pool);
- }
-}
-
-/**
- * inner enumerator constructor for attributes
- */
-static enumerator_t *attrib_enum_create(attribute_provider_t *provider,
- identification_t *id)
-{
- return provider->create_attribute_enumerator(provider, id);
-}
-
-/**
- * Implementation of attribute_manager_t.create_attribute_enumerator
- */
-static enumerator_t* create_attribute_enumerator(
- private_attribute_manager_t *this, identification_t *id)
-{
- this->lock->read_lock(this->lock);
- return enumerator_create_cleaner(
- enumerator_create_nested(
- this->providers->create_enumerator(this->providers),
- (void*)attrib_enum_create, id, NULL),
- (void*)this->lock->unlock, this->lock);
-}
-
-/**
- * Implementation of attribute_manager_t.add_provider.
- */
-static void add_provider(private_attribute_manager_t *this,
- attribute_provider_t *provider)
-{
- this->lock->write_lock(this->lock);
- this->providers->insert_last(this->providers, provider);
- this->lock->unlock(this->lock);
-}
-
-/**
- * Implementation of attribute_manager_t.remove_provider.
- */
-static void remove_provider(private_attribute_manager_t *this,
- attribute_provider_t *provider)
-{
- this->lock->write_lock(this->lock);
- this->providers->remove(this->providers, provider, NULL);
- this->lock->unlock(this->lock);
-}
-
-/**
- * Implementation of attribute_manager_t.handle
- */
-static attribute_handler_t* handle(private_attribute_manager_t *this,
- ike_sa_t *ike_sa, configuration_attribute_type_t type,
- chunk_t data)
-{
- enumerator_t *enumerator;
- attribute_handler_t *current, *handled = NULL;
-
- this->lock->read_lock(this->lock);
- enumerator = this->handlers->create_enumerator(this->handlers);
- while (enumerator->enumerate(enumerator, &current))
- {
- if (current->handle(current, ike_sa, type, data))
- {
- handled = current;
- break;
- }
- }
- enumerator->destroy(enumerator);
- this->lock->unlock(this->lock);
-
- if (!handled)
- {
- DBG1(DBG_CFG, "handling %N attribute failed",
- configuration_attribute_type_names, type);
- }
- return handled;
-}
-
-/**
- * Implementation of attribute_manager_t.release
- */
-static void release(private_attribute_manager_t *this,
- attribute_handler_t *handler, ike_sa_t *ike_sa,
- configuration_attribute_type_t type, chunk_t data)
-{
- enumerator_t *enumerator;
- attribute_handler_t *current;
-
- this->lock->read_lock(this->lock);
- enumerator = this->handlers->create_enumerator(this->handlers);
- while (enumerator->enumerate(enumerator, &current))
- {
- if (current == handler)
- {
- current->release(current, ike_sa, type, data);
- break;
- }
- }
- enumerator->destroy(enumerator);
- this->lock->unlock(this->lock);
-}
-
-/**
- * Implementation of attribute_manager_t.add_handler
- */
-static void add_handler(private_attribute_manager_t *this,
- attribute_handler_t *handler)
-{
- this->lock->write_lock(this->lock);
- this->handlers->insert_last(this->handlers, handler);
- this->lock->unlock(this->lock);
-}
-
-/**
- * Implementation of attribute_manager_t.remove_handler
- */
-static void remove_handler(private_attribute_manager_t *this,
- attribute_handler_t *handler)
-{
- this->lock->write_lock(this->lock);
- this->handlers->remove(this->handlers, handler, NULL);
- this->lock->unlock(this->lock);
-}
-
-/**
- * Implementation of attribute_manager_t.destroy
- */
-static void destroy(private_attribute_manager_t *this)
-{
- this->providers->destroy(this->providers);
- this->handlers->destroy(this->handlers);
- this->lock->destroy(this->lock);
- free(this);
-}
-
-/*
- * see header file
- */
-attribute_manager_t *attribute_manager_create()
-{
- private_attribute_manager_t *this = malloc_thing(private_attribute_manager_t);
-
- this->public.acquire_address = (host_t*(*)(attribute_manager_t*, char*, identification_t*,host_t*))acquire_address;
- this->public.release_address = (void(*)(attribute_manager_t*, char *, host_t*, identification_t*))release_address;
- this->public.create_attribute_enumerator = (enumerator_t*(*)(attribute_manager_t*, identification_t *id))create_attribute_enumerator;
- this->public.add_provider = (void(*)(attribute_manager_t*, attribute_provider_t *provider))add_provider;
- this->public.remove_provider = (void(*)(attribute_manager_t*, attribute_provider_t *provider))remove_provider;
- this->public.handle = (attribute_handler_t*(*)(attribute_manager_t*, ike_sa_t *ike_sa, configuration_attribute_type_t type, chunk_t data))handle;
- this->public.release = (void(*)(attribute_manager_t*, attribute_handler_t *handler, ike_sa_t *ike_sa, configuration_attribute_type_t type, chunk_t data))release;
- this->public.add_handler = (void(*)(attribute_manager_t*, attribute_handler_t *handler))add_handler;
- this->public.remove_handler = (void(*)(attribute_manager_t*, attribute_handler_t *handler))remove_handler;
- this->public.destroy = (void(*)(attribute_manager_t*))destroy;
-
- this->providers = linked_list_create();
- this->handlers = linked_list_create();
- this->lock = rwlock_create(RWLOCK_TYPE_DEFAULT);
-
- return &this->public;
-}
-
diff --git a/src/charon/config/attributes/attribute_manager.h b/src/charon/config/attributes/attribute_manager.h
deleted file mode 100644
index ceea06581..000000000
--- a/src/charon/config/attributes/attribute_manager.h
+++ /dev/null
@@ -1,135 +0,0 @@
-/*
- * Copyright (C) 2008-2009 Martin Willi
- * Hochschule fuer Technik Rapperswil
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
- * for more details.
- */
-
-/**
- * @defgroup attribute_manager attribute_manager
- * @{ @ingroup attributes
- */
-
-#ifndef ATTRIBUTE_MANAGER_H_
-#define ATTRIBUTE_MANAGER_H_
-
-#include <config/attributes/attribute_provider.h>
-#include <config/attributes/attribute_handler.h>
-
-typedef struct attribute_manager_t attribute_manager_t;
-
-/**
- * The attribute manager hands out attributes or handles them.
- *
- * The attribute manager manages both, attribute providers and attribute
- * handlers. Attribute providers are responsible to hand out attributes if
- * a connecting peer requests them. Handlers handle such attributes if they
- * are received on the requesting peer.
- */
-struct attribute_manager_t {
-
- /**
- * Acquire a virtual IP address to assign to a peer.
- *
- * @param pool pool name to acquire address from
- * @param id peer identity to get address forua
- * @param requested IP in configuration request
- * @return allocated address, NULL to serve none
- */
- host_t* (*acquire_address)(attribute_manager_t *this,
- char *pool, identification_t *id,
- host_t *requested);
-
- /**
- * Release a previously acquired address.
- *
- * @param pool pool name from which the address was acquired
- * @param address address to release
- * @param id peer identity to get address for
- */
- void (*release_address)(attribute_manager_t *this,
- char *pool, host_t *address, identification_t *id);
-
- /**
- * Create an enumerator over attributes to hand out to a peer.
- *
- * @param id peer identity to hand out attributes to
- * @return enumerator (configuration_attribute_type_t, chunk_t)
- */
- enumerator_t* (*create_attribute_enumerator)(attribute_manager_t *this,
- identification_t *id);
-
- /**
- * Register an attribute provider to the manager.
- *
- * @param provider attribute provider to register
- */
- void (*add_provider)(attribute_manager_t *this,
- attribute_provider_t *provider);
- /**
- * Unregister an attribute provider from the manager.
- *
- * @param provider attribute provider to unregister
- */
- void (*remove_provider)(attribute_manager_t *this,
- attribute_provider_t *provider);
-
- /**
- * Handle a configuration attribute by passing them to the handlers.
- *
- * @param ike_sa IKE_SA where attribute was received
- * @param type type of configuration attribute
- * @param data associated attribute data
- * @return handler which handled this attribute, NULL if none
- */
- attribute_handler_t* (*handle)(attribute_manager_t *this, ike_sa_t *ike_sa,
- configuration_attribute_type_t type, chunk_t data);
-
- /**
- * Release an attribute previously handle()d by a handler.
- *
- * @param handler handler returned by handle() for this attribute
- * @param ike_sa IKE_SA owning the attribute
- * @param type type of attribute to release
- * @param data associated attribute data
- */
- void (*release)(attribute_manager_t *this, attribute_handler_t *handler,
- ike_sa_t *ike_sa, configuration_attribute_type_t type,
- chunk_t data);
-
- /**
- * Register an attribute handler to the manager.
- *
- * @param handler attribute handler to register
- */
- void (*add_handler)(attribute_manager_t *this,
- attribute_handler_t *handler);
-
- /**
- * Unregister an attribute handler from the manager.
- *
- * @param handler attribute handler to unregister
- */
- void (*remove_handler)(attribute_manager_t *this,
- attribute_handler_t *handler);
-
- /**
- * Destroy a attribute_manager instance.
- */
- void (*destroy)(attribute_manager_t *this);
-};
-
-/**
- * Create a attribute_manager instance.
- */
-attribute_manager_t *attribute_manager_create();
-
-#endif /** ATTRIBUTE_MANAGER_H_ @}*/
diff --git a/src/charon/config/attributes/attribute_provider.h b/src/charon/config/attributes/attribute_provider.h
deleted file mode 100644
index 0f1057af4..000000000
--- a/src/charon/config/attributes/attribute_provider.h
+++ /dev/null
@@ -1,67 +0,0 @@
-/*
- * Copyright (C) 2008 Martin Willi
- * Hochschule fuer Technik Rapperswil
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
- * for more details.
- */
-
-/**
- * @defgroup attribute_provider attribute_provider
- * @{ @ingroup attributes
- */
-
-#ifndef ATTRIBUTE_PROVIDER_H_
-#define ATTRIBUTE_PROVIDER_H_
-
-#include <library.h>
-#include <utils/host.h>
-#include <utils/identification.h>
-
-typedef struct attribute_provider_t attribute_provider_t;
-
-/**
- * Interface to provide attributes to peers through attribute manager.
- */
-struct attribute_provider_t {
-
- /**
- * Acquire a virtual IP address to assign to a peer.
- *
- * @param pool name of the pool to acquire address from
- * @param id peer ID
- * @param requested IP in configuration request
- * @return allocated address, NULL to serve none
- */
- host_t* (*acquire_address)(attribute_provider_t *this,
- char *pool, identification_t *id,
- host_t *requested);
- /**
- * Release a previously acquired address.
- *
- * @param pool name of the pool this address was acquired from
- * @param address address to release
- * @param id peer ID
- * @return TRUE if the address has been released by the provider
- */
- bool (*release_address)(attribute_provider_t *this,
- char *pool, host_t *address, identification_t *id);
-
- /**
- * Create an enumerator over attributes to hand out to a peer.
- *
- * @param id peer ID
- * @return enumerator (configuration_attribute_type_t, chunk_t)
- */
- enumerator_t* (*create_attribute_enumerator)(attribute_provider_t *this,
- identification_t *id);
-};
-
-#endif /** ATTRIBUTE_PROVIDER_H_ @}*/
diff --git a/src/charon/config/auth_cfg.c b/src/charon/config/auth_cfg.c
index e4501bc93..94362c756 100644
--- a/src/charon/config/auth_cfg.c
+++ b/src/charon/config/auth_cfg.c
@@ -45,12 +45,12 @@ typedef struct private_auth_cfg_t private_auth_cfg_t;
* private data of item_set
*/
struct private_auth_cfg_t {
-
+
/**
* public functions
*/
auth_cfg_t public;
-
+
/**
* list of entry_t
*/
@@ -84,7 +84,7 @@ typedef struct {
static bool enumerate(entry_enumerator_t *this, auth_rule_t *type, void **value)
{
entry_t *entry;
-
+
if (this->inner->enumerate(this->inner, &entry))
{
this->current = entry;
@@ -110,7 +110,7 @@ static void entry_enumerator_destroy(entry_enumerator_t *this)
static enumerator_t* create_enumerator(private_auth_cfg_t *this)
{
entry_enumerator_t *enumerator;
-
+
enumerator = malloc_thing(entry_enumerator_t);
enumerator->inner = this->entries->create_enumerator(this->entries);
enumerator->public.enumerate = (void*)enumerate;
@@ -168,9 +168,9 @@ static void replace(auth_cfg_t *this, entry_enumerator_t *enumerator,
if (enumerator->current)
{
va_list args;
-
+
va_start(args, type);
-
+
destroy_entry_value(enumerator->current);
enumerator->current->type = type;
switch (type)
@@ -210,7 +210,7 @@ static void* get(private_auth_cfg_t *this, auth_rule_t type)
void *current_value, *best_value = NULL;
auth_rule_t current_type;
bool found = FALSE;
-
+
enumerator = create_enumerator(this);
while (enumerator->enumerate(enumerator, &current_type, &current_value))
{
@@ -270,7 +270,7 @@ static void add(private_auth_cfg_t *this, auth_rule_t type, ...)
{
entry_t *entry = malloc_thing(entry_t);
va_list args;
-
+
va_start(args, type);
entry->type = type;
switch (type)
@@ -311,7 +311,7 @@ static bool complies(private_auth_cfg_t *this, auth_cfg_t *constraints,
bool success = TRUE;
auth_rule_t t1, t2;
void *value;
-
+
e1 = constraints->create_enumerator(constraints);
while (e1->enumerate(e1, &t1, &value))
{
@@ -321,9 +321,9 @@ static bool complies(private_auth_cfg_t *this, auth_cfg_t *constraints,
case AUTH_RULE_IM_CERT:
{
certificate_t *c1, *c2;
-
+
c1 = (certificate_t*)value;
-
+
success = FALSE;
e2 = create_enumerator(this);
while (e2->enumerate(e2, &t2, &c2))
@@ -345,7 +345,7 @@ static bool complies(private_auth_cfg_t *this, auth_cfg_t *constraints,
case AUTH_RULE_SUBJECT_CERT:
{
certificate_t *c1, *c2;
-
+
c1 = (certificate_t*)value;
c2 = get(this, AUTH_RULE_SUBJECT_CERT);
if (!c2 || !c1->equals(c1, c2))
@@ -364,7 +364,7 @@ static bool complies(private_auth_cfg_t *this, auth_cfg_t *constraints,
case AUTH_RULE_OCSP_VALIDATION:
{
cert_validation_t validated, required;
-
+
required = (uintptr_t)value;
validated = (uintptr_t)get(this, t1);
switch (required)
@@ -401,7 +401,7 @@ static bool complies(private_auth_cfg_t *this, auth_cfg_t *constraints,
case AUTH_RULE_EAP_IDENTITY:
{
identification_t *id1, *id2;
-
+
id1 = (identification_t*)value;
id2 = get(this, t1);
if (!id2 || !id2->matches(id2, id1))
@@ -499,7 +499,7 @@ static void merge(private_auth_cfg_t *this, private_auth_cfg_t *other, bool copy
enumerator_t *enumerator;
auth_rule_t type;
void *value;
-
+
enumerator = create_enumerator(other);
while (enumerator->enumerate(enumerator, &type, &value))
{
@@ -512,7 +512,7 @@ static void merge(private_auth_cfg_t *this, private_auth_cfg_t *other, bool copy
case AUTH_HELPER_SUBJECT_CERT:
{
certificate_t *cert = (certificate_t*)value;
-
+
add(this, type, cert->get_ref(cert));
break;
}
@@ -530,7 +530,7 @@ static void merge(private_auth_cfg_t *this, private_auth_cfg_t *other, bool copy
case AUTH_RULE_AC_GROUP:
{
identification_t *id = (identification_t*)value;
-
+
add(this, type, id->clone(id));
break;
}
@@ -547,7 +547,7 @@ static void merge(private_auth_cfg_t *this, private_auth_cfg_t *other, bool copy
else
{
entry_t *entry;
-
+
while (other->entries->remove_first(other->entries,
(void**)&entry) == SUCCESS)
{
@@ -564,7 +564,7 @@ static bool equals(private_auth_cfg_t *this, private_auth_cfg_t *other)
enumerator_t *e1, *e2;
entry_t *i1, *i2;
bool equal = TRUE, found;
-
+
if (this->entries->get_count(this->entries) !=
other->entries->get_count(other->entries))
{
@@ -601,10 +601,10 @@ static bool equals(private_auth_cfg_t *this, private_auth_cfg_t *other)
case AUTH_HELPER_SUBJECT_CERT:
{
certificate_t *c1, *c2;
-
+
c1 = (certificate_t*)i1->value;
c2 = (certificate_t*)i2->value;
-
+
if (c1->equals(c1, c2))
{
found = TRUE;
@@ -617,10 +617,10 @@ static bool equals(private_auth_cfg_t *this, private_auth_cfg_t *other)
case AUTH_RULE_AC_GROUP:
{
identification_t *id1, *id2;
-
+
id1 = (identification_t*)i1->value;
id2 = (identification_t*)i2->value;
-
+
if (id1->equals(id1, id2))
{
found = TRUE;
@@ -660,7 +660,7 @@ static void purge(private_auth_cfg_t *this, bool keep_ca)
{
entry_t *entry;
linked_list_t *cas;
-
+
cas = linked_list_create();
while (this->entries->remove_last(this->entries, (void**)&entry) == SUCCESS)
{
@@ -689,7 +689,7 @@ static auth_cfg_t* clone_(private_auth_cfg_t *this)
enumerator_t *enumerator;
auth_cfg_t *clone;
entry_t *entry;
-
+
clone = auth_cfg_create();
enumerator = this->entries->create_enumerator(this->entries);
while (enumerator->enumerate(enumerator, &entry))
@@ -749,7 +749,7 @@ static void destroy(private_auth_cfg_t *this)
auth_cfg_t *auth_cfg_create()
{
private_auth_cfg_t *this = malloc_thing(private_auth_cfg_t);
-
+
this->public.add = (void(*)(auth_cfg_t*, auth_rule_t type, ...))add;
this->public.get = (void*(*)(auth_cfg_t*, auth_rule_t type))get;
this->public.create_enumerator = (enumerator_t*(*)(auth_cfg_t*))create_enumerator;
@@ -760,9 +760,9 @@ auth_cfg_t *auth_cfg_create()
this->public.equals = (bool(*)(auth_cfg_t*, auth_cfg_t *other))equals;
this->public.clone = (auth_cfg_t*(*)(auth_cfg_t*))clone_;
this->public.destroy = (void(*)(auth_cfg_t*))destroy;
-
+
this->entries = linked_list_create();
-
+
return &this->public;
}
diff --git a/src/charon/config/auth_cfg.h b/src/charon/config/auth_cfg.h
index c6bc1959b..5e6215a4a 100644
--- a/src/charon/config/auth_cfg.h
+++ b/src/charon/config/auth_cfg.h
@@ -41,7 +41,7 @@ typedef enum auth_rule_t auth_rule_t;
* to transport credentials during the authentication process.
*/
enum auth_rule_t {
-
+
/** identity to use for IKEv2 authentication exchange, identification_t* */
AUTH_RULE_IDENTITY,
/** authentication class, auth_class_t */
@@ -64,7 +64,7 @@ enum auth_rule_t {
AUTH_RULE_OCSP_VALIDATION,
/** subject is in attribute certificate group, identification_t* */
AUTH_RULE_AC_GROUP,
-
+
/** intermediate certificate, certificate_t* */
AUTH_HELPER_IM_CERT,
/** subject certificate, certificate_t* */
@@ -86,7 +86,7 @@ extern enum_name_t *auth_rule_names;
* RFC4739 defines multiple authentication rounds. This class defines such
* a round from a configuration perspective, either for the local or the remote
* peer. Local config are called "rulesets", as they define how we authenticate.
- * Remote peer configs are called "constraits", they define what is needed to
+ * Remote peer configs are called "constraits", they define what is needed to
* complete the authentication round successfully.
*
* @verbatim
@@ -122,7 +122,7 @@ struct auth_cfg_t {
* @param ... associated value to rule
*/
void (*add)(auth_cfg_t *this, auth_rule_t rule, ...);
-
+
/**
* Get an rule value.
*
@@ -130,14 +130,14 @@ struct auth_cfg_t {
* @return bool if item has been found
*/
void* (*get)(auth_cfg_t *this, auth_rule_t rule);
-
+
/**
* Create an enumerator over added rules.
*
* @return enumerator over (auth_rule_t, union{void*,uintpr_t})
*/
enumerator_t* (*create_enumerator)(auth_cfg_t *this);
-
+
/**
* Replace an rule at enumerator position.
*
@@ -147,7 +147,7 @@ struct auth_cfg_t {
*/
void (*replace)(auth_cfg_t *this, enumerator_t *pos,
auth_rule_t rule, ...);
-
+
/**
* Check if a used config fulfills a set of configured constraints.
*
@@ -156,7 +156,7 @@ struct auth_cfg_t {
* @return TRUE if this complies with constraints
*/
bool (*complies)(auth_cfg_t *this, auth_cfg_t *constraints, bool log_error);
-
+
/**
* Merge items from other into this.
*
@@ -164,14 +164,14 @@ struct auth_cfg_t {
* @param copy TRUE to copy items, FALSE to move them
*/
void (*merge)(auth_cfg_t *this, auth_cfg_t *other, bool copy);
-
+
/**
* Purge all rules in a config.
*
* @param keep_ca wheter to keep AUTH_RULE_CA_CERT entries
*/
void (*purge)(auth_cfg_t *this, bool keep_ca);
-
+
/**
* Check two configs for equality.
*
@@ -179,14 +179,14 @@ struct auth_cfg_t {
* @return TRUE if auth infos identical
*/
bool (*equals)(auth_cfg_t *this, auth_cfg_t *other);
-
+
/**
* Clone a authentication config, including all rules.
*
* @return cloned configuration
*/
auth_cfg_t* (*clone)(auth_cfg_t *this);
-
+
/**
* Destroy a config with all associated rules/values.
*/
diff --git a/src/charon/config/backend_manager.c b/src/charon/config/backend_manager.c
index cfd611858..90ef58563 100644
--- a/src/charon/config/backend_manager.c
+++ b/src/charon/config/backend_manager.c
@@ -16,11 +16,10 @@
#include "backend_manager.h"
#include <sys/types.h>
-#include <pthread.h>
#include <daemon.h>
#include <utils/linked_list.h>
-#include <utils/mutex.h>
+#include <threading/rwlock.h>
typedef struct private_backend_manager_t private_backend_manager_t;
@@ -34,12 +33,12 @@ struct private_backend_manager_t {
* Public part of backend_manager_t object.
*/
backend_manager_t public;
-
+
/**
* list of registered backends
*/
linked_list_t *backends;
-
+
/**
* rwlock for backends
*/
@@ -52,7 +51,7 @@ struct private_backend_manager_t {
typedef enum ike_cfg_match_t {
MATCH_NONE = 0x00,
MATCH_ANY = 0x01,
- MATCH_ME = 0x04,
+ MATCH_ME = 0x04,
MATCH_OTHER = 0x08,
} ike_cfg_match_t;
@@ -80,7 +79,7 @@ static ike_cfg_match_t get_ike_match(ike_cfg_t *cand, host_t *me, host_t *other)
{
host_t *me_cand, *other_cand;
ike_cfg_match_t match = MATCH_NONE;
-
+
if (me)
{
me_cand = host_create_from_dns(cand->get_my_addr(cand),
@@ -103,7 +102,7 @@ static ike_cfg_match_t get_ike_match(ike_cfg_t *cand, host_t *me, host_t *other)
{
match += MATCH_ANY;
}
-
+
if (other)
{
other_cand = host_create_from_dns(cand->get_other_addr(cand),
@@ -132,21 +131,21 @@ static ike_cfg_match_t get_ike_match(ike_cfg_t *cand, host_t *me, host_t *other)
/**
* implements backend_manager_t.get_ike_cfg.
*/
-static ike_cfg_t *get_ike_cfg(private_backend_manager_t *this,
+static ike_cfg_t *get_ike_cfg(private_backend_manager_t *this,
host_t *me, host_t *other)
{
ike_cfg_t *current, *found = NULL;
enumerator_t *enumerator;
ike_cfg_match_t match, best = MATCH_ANY;
ike_data_t *data;
-
+
data = malloc_thing(ike_data_t);
data->this = this;
data->me = me;
data->other = other;
-
+
DBG2(DBG_CFG, "looking for an ike config for %H...%H", me, other);
-
+
this->lock->read_lock(this->lock);
enumerator = enumerator_create_nested(
this->backends->create_enumerator(this->backends),
@@ -154,11 +153,11 @@ static ike_cfg_t *get_ike_cfg(private_backend_manager_t *this,
while (enumerator->enumerate(enumerator, (void**)&current))
{
match = get_ike_match(current, me, other);
-
+
if (match)
{
- DBG2(DBG_CFG, " candidate: %s...%s, prio %d",
- current->get_my_addr(current),
+ DBG2(DBG_CFG, " candidate: %s...%s, prio %d",
+ current->get_my_addr(current),
current->get_other_addr(current), match);
if (match > best)
{
@@ -173,7 +172,7 @@ static ike_cfg_t *get_ike_cfg(private_backend_manager_t *this,
this->lock->unlock(this->lock);
if (found)
{
- DBG2(DBG_CFG, "found matching ike config: %s...%s with prio %d",
+ DBG2(DBG_CFG, "found matching ike config: %s...%s with prio %d",
found->get_my_addr(found), found->get_other_addr(found), best);
}
return found;
@@ -189,12 +188,12 @@ static id_match_t get_peer_match(identification_t *id,
auth_cfg_t *auth;
identification_t *candidate;
id_match_t match = ID_MATCH_NONE;
-
+
if (!id)
{
return ID_MATCH_ANY;
}
-
+
/* compare first auth config only */
enumerator = cfg->create_auth_cfg_enumerator(cfg, local);
if (enumerator->enumerate(enumerator, &auth))
@@ -269,7 +268,7 @@ static bool peer_enum_filter(linked_list_t *configs,
static void peer_enum_filter_destroy(linked_list_t *configs)
{
match_entry_t *entry;
-
+
while (configs->remove_last(configs, (void**)&entry) == SUCCESS)
{
entry->cfg->destroy(entry->cfg);
@@ -285,7 +284,7 @@ static void insert_sorted(match_entry_t *entry, linked_list_t *list,
linked_list_t *helper)
{
match_entry_t *current;
-
+
while (list->remove_first(list, (void**)&current) == SUCCESS)
{
helper->insert_last(helper, current);
@@ -311,7 +310,7 @@ static void insert_sorted(match_entry_t *entry, linked_list_t *list,
/**
* Implements backend_manager_t.create_peer_cfg_enumerator.
- */
+ */
static enumerator_t *create_peer_cfg_enumerator(private_backend_manager_t *this,
host_t *me, host_t *other, identification_t *my_id,
identification_t *other_id)
@@ -320,26 +319,26 @@ static enumerator_t *create_peer_cfg_enumerator(private_backend_manager_t *this,
peer_data_t *data;
peer_cfg_t *cfg;
linked_list_t *configs, *helper;
-
+
data = malloc_thing(peer_data_t);
data->lock = this->lock;
data->me = my_id;
data->other = other_id;
-
+
/* create a sorted list with all matches */
this->lock->read_lock(this->lock);
enumerator = enumerator_create_nested(
this->backends->create_enumerator(this->backends),
(void*)peer_enum_create, data, (void*)peer_enum_destroy);
-
+
if (!me && !other && !my_id && !other_id)
{ /* shortcut if we are doing a "listall" */
return enumerator;
}
-
+
DBG1(DBG_CFG, "looking for peer configs matching %H[%Y]...%H[%Y]",
me, my_id, other, other_id);
-
+
configs = linked_list_create();
/* only once allocated helper list for sorting */
helper = linked_list_create();
@@ -348,16 +347,16 @@ static enumerator_t *create_peer_cfg_enumerator(private_backend_manager_t *this,
id_match_t match_peer_me, match_peer_other;
ike_cfg_match_t match_ike;
match_entry_t *entry;
-
+
match_peer_me = get_peer_match(my_id, cfg, TRUE);
match_peer_other = get_peer_match(other_id, cfg, FALSE);
match_ike = get_ike_match(cfg->get_ike_cfg(cfg), me, other);
-
+
if (match_peer_me && match_peer_other && match_ike)
{
DBG2(DBG_CFG, " candidate \"%s\", match: %d/%d/%d (me/other/ike)",
cfg->get_name(cfg), match_peer_me, match_peer_other, match_ike);
-
+
entry = malloc_thing(match_entry_t);
entry->match_peer = match_peer_me + match_peer_other;
entry->match_ike = match_ike;
@@ -367,7 +366,7 @@ static enumerator_t *create_peer_cfg_enumerator(private_backend_manager_t *this,
}
enumerator->destroy(enumerator);
helper->destroy(helper);
-
+
return enumerator_create_filter(configs->create_enumerator(configs),
(void*)peer_enum_filter, configs,
(void*)peer_enum_filter_destroy);
@@ -375,13 +374,13 @@ static enumerator_t *create_peer_cfg_enumerator(private_backend_manager_t *this,
/**
* implements backend_manager_t.get_peer_cfg_by_name.
- */
+ */
static peer_cfg_t *get_peer_cfg_by_name(private_backend_manager_t *this, char *name)
{
backend_t *backend;
peer_cfg_t *config = NULL;
enumerator_t *enumerator;
-
+
this->lock->read_lock(this->lock);
enumerator = this->backends->create_enumerator(this->backends);
while (config == NULL && enumerator->enumerate(enumerator, (void**)&backend))
@@ -429,17 +428,17 @@ static void destroy(private_backend_manager_t *this)
backend_manager_t *backend_manager_create()
{
private_backend_manager_t *this = malloc_thing(private_backend_manager_t);
-
+
this->public.get_ike_cfg = (ike_cfg_t* (*)(backend_manager_t*, host_t*, host_t*))get_ike_cfg;
this->public.get_peer_cfg_by_name = (peer_cfg_t* (*)(backend_manager_t*,char*))get_peer_cfg_by_name;
this->public.create_peer_cfg_enumerator = (enumerator_t* (*)(backend_manager_t*,host_t*,host_t*,identification_t*,identification_t*))create_peer_cfg_enumerator;
this->public.add_backend = (void(*)(backend_manager_t*, backend_t *backend))add_backend;
this->public.remove_backend = (void(*)(backend_manager_t*, backend_t *backend))remove_backend;
this->public.destroy = (void (*)(backend_manager_t*))destroy;
-
+
this->backends = linked_list_create();
this->lock = rwlock_create(RWLOCK_TYPE_DEFAULT);
-
+
return &this->public;
}
diff --git a/src/charon/config/backend_manager.h b/src/charon/config/backend_manager.h
index 0b7d7d0f8..5b394f791 100644
--- a/src/charon/config/backend_manager.h
+++ b/src/charon/config/backend_manager.h
@@ -46,11 +46,11 @@ typedef struct backend_manager_t backend_manager_t;
| |----->| | +--------------+ |
| | | | |
+---------+ +-----------+ |
-
+
@endverbatim
*/
struct backend_manager_t {
-
+
/**
* Get an ike_config identified by two hosts.
*
@@ -58,9 +58,9 @@ struct backend_manager_t {
* @param other_host address of remote host
* @return matching ike_config, or NULL if none found
*/
- ike_cfg_t* (*get_ike_cfg)(backend_manager_t *this,
+ ike_cfg_t* (*get_ike_cfg)(backend_manager_t *this,
host_t *my_host, host_t *other_host);
-
+
/**
* Get a peer_config identified by it's name.
*
@@ -68,7 +68,7 @@ struct backend_manager_t {
* @return matching peer_config, or NULL if none found
*/
peer_cfg_t* (*get_peer_cfg_by_name)(backend_manager_t *this, char *name);
-
+
/**
* Create an enumerator over all matching peer configs.
*
@@ -90,14 +90,14 @@ struct backend_manager_t {
* @param backend backend to register
*/
void (*add_backend)(backend_manager_t *this, backend_t *backend);
-
+
/**
* Unregister a backend.
*
* @param backend backend to unregister
*/
void (*remove_backend)(backend_manager_t *this, backend_t *backend);
-
+
/**
* Destroys a backend_manager_t object.
*/
diff --git a/src/charon/config/child_cfg.c b/src/charon/config/child_cfg.c
index 990ee3fd6..8410b3fe5 100644
--- a/src/charon/config/child_cfg.c
+++ b/src/charon/config/child_cfg.c
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2008 Tobias Brunner
+ * Copyright (C) 2008-2009 Tobias Brunner
* Copyright (C) 2005-2007 Martin Willi
* Copyright (C) 2005 Jan Hutter
* Hochschule fuer Technik Rapperswil
@@ -25,7 +25,7 @@ ENUM(action_names, ACTION_NONE, ACTION_RESTART,
"restart",
);
-ENUM_BEGIN(ipcomp_transform_names, IPCOMP_NONE, IPCOMP_NONE,
+ENUM_BEGIN(ipcomp_transform_names, IPCOMP_NONE, IPCOMP_NONE,
"IPCOMP_NONE");
ENUM_NEXT(ipcomp_transform_names, IPCOMP_OUI, IPCOMP_LZJH, IPCOMP_NONE,
"IPCOMP_OUI",
@@ -45,79 +45,73 @@ struct private_child_cfg_t {
* Public part
*/
child_cfg_t public;
-
+
/**
* Number of references hold by others to this child_cfg
*/
refcount_t refcount;
-
+
/**
* Name of the child_cfg, used to query it
*/
char *name;
-
+
/**
* list for all proposals
*/
linked_list_t *proposals;
-
+
/**
* list for traffic selectors for my site
*/
linked_list_t *my_ts;
-
+
/**
* list for traffic selectors for others site
*/
linked_list_t *other_ts;
-
+
/**
* updown script
*/
char *updown;
-
+
/**
* allow host access
*/
bool hostaccess;
-
+
/**
* Mode to propose for a initiated CHILD: tunnel/transport
*/
ipsec_mode_t mode;
-
+
/**
* action to take on DPD
*/
action_t dpd_action;
-
+
/**
* action to take on CHILD_SA close
*/
action_t close_action;
-
- /**
- * Time before an SA gets invalid
- */
- u_int32_t lifetime;
-
- /**
- * Time before an SA gets rekeyed
- */
- u_int32_t rekeytime;
-
+
/**
- * Time, which specifies the range of a random value
- * substracted from rekeytime.
+ * CHILD_SA lifetime config
*/
- u_int32_t jitter;
-
+ lifetime_cfg_t lifetime;
+
/**
* enable IPComp
*/
bool use_ipcomp;
/**
+ * Inactivity timeout
+ */
+ u_int32_t inactivity;
+
+ /**
* set up IPsec transport SA in MIPv6 proxy mode
*/
bool proxy_mode;
@@ -152,7 +146,7 @@ static linked_list_t* get_proposals(private_child_cfg_t *this, bool strip_dh)
enumerator_t *enumerator;
proposal_t *current;
linked_list_t *proposals = linked_list_create();
-
+
enumerator = this->proposals->create_enumerator(this->proposals);
while (enumerator->enumerate(enumerator, &current))
{
@@ -164,7 +158,7 @@ static linked_list_t* get_proposals(private_child_cfg_t *this, bool strip_dh)
proposals->insert_last(proposals, current);
}
enumerator->destroy(enumerator);
-
+
return proposals;
}
@@ -172,14 +166,15 @@ static linked_list_t* get_proposals(private_child_cfg_t *this, bool strip_dh)
* Implementation of child_cfg_t.select_proposal.
*/
static proposal_t* select_proposal(private_child_cfg_t*this,
- linked_list_t *proposals, bool strip_dh)
+ linked_list_t *proposals, bool strip_dh,
+ bool private)
{
enumerator_t *stored_enum, *supplied_enum;
proposal_t *stored, *supplied, *selected = NULL;
-
+
stored_enum = this->proposals->create_enumerator(this->proposals);
supplied_enum = proposals->create_enumerator(proposals);
-
+
/* compare all stored proposals with all supplied. Stored ones are preferred. */
while (stored_enum->enumerate(stored_enum, &stored))
{
@@ -190,7 +185,7 @@ static proposal_t* select_proposal(private_child_cfg_t*this,
{
stored->strip_dh(stored);
}
- selected = stored->select(stored, supplied);
+ selected = stored->select(stored, supplied, private);
if (selected)
{
DBG2(DBG_CFG, "received proposals: %#P", proposals);
@@ -205,7 +200,7 @@ static proposal_t* select_proposal(private_child_cfg_t*this,
break;
}
supplied_enum->destroy(supplied_enum);
- supplied_enum = proposals->create_enumerator(proposals);
+ supplied_enum = proposals->create_enumerator(proposals);
}
stored_enum->destroy(stored_enum);
supplied_enum->destroy(supplied_enum);
@@ -243,7 +238,7 @@ static linked_list_t* get_traffic_selectors(private_child_cfg_t *this, bool loca
enumerator_t *e1, *e2;
traffic_selector_t *ts1, *ts2, *selected;
linked_list_t *result = linked_list_create();
-
+
if (local)
{
e1 = this->my_ts->create_enumerator(this->my_ts);
@@ -252,11 +247,11 @@ static linked_list_t* get_traffic_selectors(private_child_cfg_t *this, bool loca
{
e1 = this->other_ts->create_enumerator(this->other_ts);
}
-
+
/* no list supplied, just fetch the stored traffic selectors */
if (supplied == NULL)
{
- DBG2(DBG_CFG, "proposing traffic selectors for %s:",
+ DBG2(DBG_CFG, "proposing traffic selectors for %s:",
local ? "us" : "other");
while (e1->enumerate(e1, &ts1))
{
@@ -273,7 +268,7 @@ static linked_list_t* get_traffic_selectors(private_child_cfg_t *this, bool loca
}
else
{
- DBG2(DBG_CFG, "selecting traffic selectors for %s:",
+ DBG2(DBG_CFG, "selecting traffic selectors for %s:",
local ? "us" : "other");
e2 = supplied->create_enumerator(supplied);
/* iterate over all stored selectors */
@@ -285,7 +280,7 @@ static linked_list_t* get_traffic_selectors(private_child_cfg_t *this, bool loca
{
ts1->set_address(ts1, host);
}
-
+
/* iterate over all supplied traffic selectors */
while (e2->enumerate(e2, &ts2))
{
@@ -309,7 +304,7 @@ static linked_list_t* get_traffic_selectors(private_child_cfg_t *this, bool loca
e1->destroy(e1);
e2->destroy(e2);
}
-
+
/* remove any redundant traffic selectors in the list */
e1 = result->create_enumerator(result);
e2 = result->create_enumerator(result);
@@ -340,7 +335,7 @@ static linked_list_t* get_traffic_selectors(private_child_cfg_t *this, bool loca
}
e1->destroy(e1);
e2->destroy(e2);
-
+
return result;
}
@@ -361,19 +356,32 @@ static bool get_hostaccess(private_child_cfg_t *this)
}
/**
- * Implementation of child_cfg_t.get_lifetime.
+ * Applies jitter to the rekey value. Returns the new rekey value.
+ * Note: The distribution of random values is not perfect, but it
+ * should get the job done.
*/
-static u_int32_t get_lifetime(private_child_cfg_t *this, bool rekey)
+static u_int64_t apply_jitter(u_int64_t rekey, u_int64_t jitter)
{
- if (rekey)
+ if (jitter == 0)
{
- if (this->jitter == 0)
- {
- return this->rekeytime;
- }
- return this->rekeytime - (random() % this->jitter);
+ return rekey;
}
- return this->lifetime;
+ jitter = (jitter == UINT64_MAX) ? jitter : jitter + 1;
+ return rekey - jitter * (random() / (RAND_MAX + 1.0));
+}
+#define APPLY_JITTER(l) l.rekey = apply_jitter(l.rekey, l.jitter)
+
+/**
+ * Implementation of child_cfg_t.get_lifetime.
+ */
+static lifetime_cfg_t *get_lifetime(private_child_cfg_t *this)
+{
+ lifetime_cfg_t *lft = malloc_thing(lifetime_cfg_t);
+ memcpy(lft, &this->lifetime, sizeof(lifetime_cfg_t));
+ APPLY_JITTER(lft->time);
+ APPLY_JITTER(lft->bytes);
+ APPLY_JITTER(lft->packets);
+ return lft;
}
/**
@@ -408,7 +416,7 @@ static diffie_hellman_group_t get_dh_group(private_child_cfg_t *this)
enumerator_t *enumerator;
proposal_t *proposal;
u_int16_t dh_group = MODP_NONE;
-
+
enumerator = this->proposals->create_enumerator(this->proposals);
while (enumerator->enumerate(enumerator, &proposal))
{
@@ -430,6 +438,14 @@ static bool use_ipcomp(private_child_cfg_t *this)
}
/**
+ * Implementation of child_cfg_t.get_inactivity.
+ */
+static u_int32_t get_inactivity(private_child_cfg_t *this)
+{
+ return this->inactivity;
+}
+
+/**
* Implementation of child_cfg_t.set_mipv6_options.
*/
static void set_mipv6_options(private_child_cfg_t *this, bool proxy_mode,
@@ -486,10 +502,11 @@ static void destroy(private_child_cfg_t *this)
/*
* Described in header-file
*/
-child_cfg_t *child_cfg_create(char *name, u_int32_t lifetime,
- u_int32_t rekeytime, u_int32_t jitter,
- char *updown, bool hostaccess, ipsec_mode_t mode,
- action_t dpd_action, action_t close_action, bool ipcomp)
+child_cfg_t *child_cfg_create(char *name, lifetime_cfg_t *lifetime,
+ char *updown, bool hostaccess,
+ ipsec_mode_t mode, action_t dpd_action,
+ action_t close_action, bool ipcomp,
+ u_int32_t inactivity)
{
private_child_cfg_t *this = malloc_thing(private_child_cfg_t);
@@ -498,37 +515,37 @@ child_cfg_t *child_cfg_create(char *name, u_int32_t lifetime,
this->public.get_traffic_selectors = (linked_list_t*(*)(child_cfg_t*,bool,linked_list_t*,host_t*))get_traffic_selectors;
this->public.add_proposal = (void (*) (child_cfg_t*,proposal_t*))add_proposal;
this->public.get_proposals = (linked_list_t* (*) (child_cfg_t*,bool))get_proposals;
- this->public.select_proposal = (proposal_t* (*) (child_cfg_t*,linked_list_t*,bool))select_proposal;
+ this->public.select_proposal = (proposal_t* (*) (child_cfg_t*,linked_list_t*,bool,bool))select_proposal;
this->public.get_updown = (char* (*) (child_cfg_t*))get_updown;
this->public.get_hostaccess = (bool (*) (child_cfg_t*))get_hostaccess;
this->public.get_mode = (ipsec_mode_t (*) (child_cfg_t *))get_mode;
this->public.get_dpd_action = (action_t (*) (child_cfg_t *))get_dpd_action;
this->public.get_close_action = (action_t (*) (child_cfg_t *))get_close_action;
- this->public.get_lifetime = (u_int32_t (*) (child_cfg_t *,bool))get_lifetime;
+ this->public.get_lifetime = (lifetime_cfg_t* (*) (child_cfg_t *))get_lifetime;
this->public.get_dh_group = (diffie_hellman_group_t(*)(child_cfg_t*)) get_dh_group;
this->public.set_mipv6_options = (void (*) (child_cfg_t*,bool,bool))set_mipv6_options;
this->public.use_ipcomp = (bool (*) (child_cfg_t *))use_ipcomp;
+ this->public.get_inactivity = (u_int32_t (*) (child_cfg_t *))get_inactivity;
this->public.use_proxy_mode = (bool (*) (child_cfg_t *))use_proxy_mode;
this->public.install_policy = (bool (*) (child_cfg_t *))install_policy;
this->public.get_ref = (child_cfg_t* (*) (child_cfg_t*))get_ref;
this->public.destroy = (void (*) (child_cfg_t*))destroy;
-
+
this->name = strdup(name);
- this->lifetime = lifetime;
- this->rekeytime = rekeytime;
- this->jitter = jitter;
this->updown = updown ? strdup(updown) : NULL;
this->hostaccess = hostaccess;
this->mode = mode;
this->dpd_action = dpd_action;
this->close_action = close_action;
- this->use_ipcomp = ipcomp;
+ this->use_ipcomp = ipcomp;
+ this->inactivity = inactivity;
this->proxy_mode = FALSE;
- this->install_policy = TRUE;
+ this->install_policy = TRUE;
this->refcount = 1;
this->proposals = linked_list_create();
this->my_ts = linked_list_create();
this->other_ts = linked_list_create();
+ memcpy(&this->lifetime, lifetime, sizeof(lifetime_cfg_t));
return &this->public;
}
diff --git a/src/charon/config/child_cfg.h b/src/charon/config/child_cfg.h
index 33c75701c..c6186ea36 100644
--- a/src/charon/config/child_cfg.h
+++ b/src/charon/config/child_cfg.h
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2008 Tobias Brunner
+ * Copyright (C) 2008-2009 Tobias Brunner
* Copyright (C) 2005-2007 Martin Willi
* Copyright (C) 2005 Jan Hutter
* Hochschule fuer Technik Rapperswil
@@ -25,11 +25,12 @@
typedef enum action_t action_t;
typedef enum ipcomp_transform_t ipcomp_transform_t;
+typedef struct lifetime_cfg_t lifetime_cfg_t;
typedef struct child_cfg_t child_cfg_t;
#include <library.h>
+#include <selectors/traffic_selector.h>
#include <config/proposal.h>
-#include <config/traffic_selector.h>
#include <kernel/kernel_ipsec.h>
/**
@@ -66,73 +67,90 @@ enum ipcomp_transform_t {
extern enum_name_t *ipcomp_transform_names;
/**
+ * A lifetime_cfg_t defines the lifetime limits of a CHILD_SA.
+ *
+ * Set any of these values to 0 to ignore.
+ */
+struct lifetime_cfg_t {
+ struct {
+ /** Limit before the CHILD_SA gets invalid. */
+ u_int64_t life;
+ /** Limit before the CHILD_SA gets rekeyed. */
+ u_int64_t rekey;
+ /** The range of a random value subtracted from rekey. */
+ u_int64_t jitter;
+ } time, bytes, packets;
+};
+
+/**
* A child_cfg_t defines the config template for a CHILD_SA.
*
* After creation, proposals and traffic selectors may be added to the config.
* A child_cfg object is referenced multiple times, and is not thread save.
* Reading from the object is save, adding things is not allowed while other
- * threads may access the object.
+ * threads may access the object.
* A reference counter handles the number of references hold to this config.
*
* @see peer_cfg_t to get an overview over the configurations.
*/
struct child_cfg_t {
-
+
/**
* Get the name of the child_cfg.
- *
+ *
* @return child_cfg's name
*/
char *(*get_name) (child_cfg_t *this);
-
+
/**
- * Add a proposal to the list.
- *
+ * Add a proposal to the list.
+ *
* The proposals are stored by priority, first added
* is the most prefered.
* After add, proposal is owned by child_cfg.
- *
+ *
* @param proposal proposal to add
*/
void (*add_proposal) (child_cfg_t *this, proposal_t *proposal);
-
+
/**
* Get the list of proposals for the CHILD_SA.
*
* Resulting list and all of its proposals must be freed after use.
- *
+ *
* @param strip_dh TRUE strip out diffie hellman groups
* @return list of proposals
*/
linked_list_t* (*get_proposals)(child_cfg_t *this, bool strip_dh);
-
+
/**
* Select a proposal from a supplied list.
*
* Returned propsal is newly created and must be destroyed after usage.
- *
+ *
* @param proposals list from from wich proposals are selected
* @param strip_dh TRUE strip out diffie hellman groups
+ * @param private accept algorithms from a private range
* @return selected proposal, or NULL if nothing matches
*/
proposal_t* (*select_proposal)(child_cfg_t*this, linked_list_t *proposals,
- bool strip_dh);
-
+ bool strip_dh, bool private);
+
/**
* Add a traffic selector to the config.
- *
+ *
* Use the "local" parameter to add it for the local or the remote side.
* After add, traffic selector is owned by child_cfg.
- *
+ *
* @param local TRUE for local side, FALSE for remote
* @param ts traffic_selector to add
*/
void (*add_traffic_selector)(child_cfg_t *this, bool local,
traffic_selector_t *ts);
-
+
/**
* Get a list of traffic selectors to use for the CHILD_SA.
- *
+ *
* The config contains two set of traffic selectors, one for the local
* side, one for the remote side.
* If a list with traffic selectors is supplied, these are used to narrow
@@ -141,7 +159,7 @@ struct child_cfg_t {
* to a specific address (host-to-host or virtual-IP setups). Use
* the "host" parameter to narrow such traffic selectors to that address.
* Resulted list and its traffic selectors must be destroyed after use.
- *
+ *
* @param local TRUE for TS on local side, FALSE for remote
* @param supplied list with TS to select from, or NULL
* @param host address to use for narrowing "dynamic" TS', or NULL
@@ -152,74 +170,77 @@ struct child_cfg_t {
host_t *host);
/**
* Get the updown script to run for the CHILD_SA.
- *
+ *
* @return path to updown script
*/
char* (*get_updown)(child_cfg_t *this);
-
+
/**
* Should we allow access to the local host (gateway)?
- *
+ *
* @return value of hostaccess flag
*/
bool (*get_hostaccess) (child_cfg_t *this);
/**
- * Get the lifetime of a CHILD_SA.
+ * Get the lifetime configuration of a CHILD_SA.
+ *
+ * The rekey limits automatically contain a jitter to avoid simultaneous
+ * rekeying. These values will change with each call to this function.
*
- * If "rekey" is set to TRUE, a lifetime is returned before the first
- * rekeying should be started. If it is FALSE, the actual lifetime is
- * returned when the CHILD_SA must be deleted.
- * The rekey time automatically contains a jitter to avoid simlutaneous
- * rekeying.
- *
- * @param rekey TRUE to get rekey time
- * @return lifetime in seconds
+ * @return lifetime_cfg_t (has to be freed)
*/
- u_int32_t (*get_lifetime) (child_cfg_t *this, bool rekey);
-
+ lifetime_cfg_t* (*get_lifetime) (child_cfg_t *this);
+
/**
* Get the mode to use for the CHILD_SA.
*
* The mode is either tunnel, transport or BEET. The peer must agree
* on the method, fallback is tunnel mode.
- *
+ *
* @return ipsec mode
*/
ipsec_mode_t (*get_mode) (child_cfg_t *this);
-
+
/**
* Action to take on DPD.
*
* @return DPD action
- */
+ */
action_t (*get_dpd_action) (child_cfg_t *this);
-
+
/**
* Action to take if CHILD_SA gets closed.
*
* @return close action
- */
+ */
action_t (*get_close_action) (child_cfg_t *this);
-
+
/**
* Get the DH group to use for CHILD_SA setup.
- *
+ *
* @return dh group to use
*/
diffie_hellman_group_t (*get_dh_group)(child_cfg_t *this);
-
+
/**
* Check whether IPComp should be used, if the other peer supports it.
- *
+ *
* @return TRUE, if IPComp should be used
* FALSE, otherwise
*/
bool (*use_ipcomp)(child_cfg_t *this);
/**
+ * Get the inactivity timeout value.
+ *
+ * @return inactivity timeout in s
+ */
+ u_int32_t (*get_inactivity)(child_cfg_t *this);
+
+ /**
* Sets two options needed for Mobile IPv6 interoperability
- *
+ *
* @param proxy_mode use IPsec transport proxy mode (default FALSE)
* @param install_policy install IPsec kernel policies (default TRUE)
*/
@@ -228,27 +249,27 @@ struct child_cfg_t {
/**
* Check whether IPsec transport SA should be set up in proxy mode
- *
+ *
* @return TRUE, if proxy mode should be used
* FALSE, otherwise
*/
bool (*use_proxy_mode)(child_cfg_t *this);
-
+
/**
* Check whether IPsec policies should be installed in the kernel
- *
+ *
* @return TRUE, if IPsec kernel policies should be installed
* FALSE, otherwise
*/
bool (*install_policy)(child_cfg_t *this);
-
+
/**
* Increase the reference count.
*
* @return reference to this
*/
child_cfg_t* (*get_ref) (child_cfg_t *this);
-
+
/**
* Destroys the child_cfg object.
*
@@ -260,29 +281,30 @@ struct child_cfg_t {
/**
* Create a configuration template for CHILD_SA setup.
- *
+ *
* The "name" string gets cloned.
- * Lifetimes are in seconds. To prevent to peers to start rekeying at the
- * same time, a jitter may be specified. Rekeying of an SA starts at
- * (rekeytime - random(0, jitter)). You should specify
- * lifetime > rekeytime > jitter.
+ *
+ * The lifetime_cfg_t object gets cloned.
+ * To prevent two peers to start rekeying at the same time, a jitter may be
+ * specified. Rekeying of an SA starts at (x.rekey - random(0, x.jitter)).
+ *
* After a call to create, a reference is obtained (refcount = 1).
- *
+ *
* @param name name of the child_cfg
- * @param lifetime lifetime after CHILD_SA expires and gets deleted
- * @param rekeytime time when rekeying should be initiated
- * @param jitter range of randomization time to remove from rekeytime
+ * @param lifetime lifetime_cfg_t for this child_cfg
* @param updown updown script to execute on up/down event
* @param hostaccess TRUE to allow access to the local host
* @param mode mode to propose for CHILD_SA, transport, tunnel or BEET
* @param dpd_action DPD action
* @param close_action close action
* @param ipcomp use IPComp, if peer supports it
+ * @param inactivity inactivity timeout in s before closing a CHILD_SA
* @return child_cfg_t object
*/
-child_cfg_t *child_cfg_create(char *name, u_int32_t lifetime,
- u_int32_t rekeytime, u_int32_t jitter,
- char *updown, bool hostaccess, ipsec_mode_t mode,
- action_t dpd_action, action_t close_action, bool ipcomp);
+child_cfg_t *child_cfg_create(char *name, lifetime_cfg_t *lifetime,
+ char *updown, bool hostaccess,
+ ipsec_mode_t mode, action_t dpd_action,
+ action_t close_action, bool ipcomp,
+ u_int32_t inactivity);
#endif /** CHILD_CFG_H_ @}*/
diff --git a/src/charon/config/ike_cfg.c b/src/charon/config/ike_cfg.c
index e80ab577e..2e748f511 100644
--- a/src/charon/config/ike_cfg.c
+++ b/src/charon/config/ike_cfg.c
@@ -32,7 +32,7 @@ struct private_ike_cfg_t {
* Public part
*/
ike_cfg_t public;
-
+
/**
* Number of references hold by others to this ike_cfg
*/
@@ -45,19 +45,19 @@ struct private_ike_cfg_t {
/**
* Address of remote host
- */
+ */
char *other;
-
+
/**
* should we send a certificate request?
*/
bool certreq;
-
+
/**
* enforce UDP encapsulation
*/
bool force_encap;
-
+
/**
* List of proposals to use
*/
@@ -71,7 +71,7 @@ static bool send_certreq(private_ike_cfg_t *this)
{
return this->certreq;
}
-
+
/**
* Implementation of ike_cfg_t.force_encap.
*/
@@ -112,7 +112,7 @@ static linked_list_t* get_proposals(private_ike_cfg_t *this)
iterator_t *iterator;
proposal_t *current;
linked_list_t *proposals = linked_list_create();
-
+
iterator = this->proposals->create_iterator(this->proposals, TRUE);
while (iterator->iterate(iterator, (void**)&current))
{
@@ -120,31 +120,31 @@ static linked_list_t* get_proposals(private_ike_cfg_t *this)
proposals->insert_last(proposals, (void*)current);
}
iterator->destroy(iterator);
-
+
return proposals;
}
-
+
/**
* Implementation of ike_cfg_t.select_proposal.
*/
static proposal_t *select_proposal(private_ike_cfg_t *this,
- linked_list_t *proposals)
+ linked_list_t *proposals, bool private)
{
iterator_t *stored_iter, *supplied_iter;
proposal_t *stored, *supplied, *selected;
-
+
stored_iter = this->proposals->create_iterator(this->proposals, TRUE);
supplied_iter = proposals->create_iterator(proposals, TRUE);
-
-
+
+
/* compare all stored proposals with all supplied. Stored ones are preferred.*/
while (stored_iter->iterate(stored_iter, (void**)&stored))
{
supplied_iter->reset(supplied_iter);
-
+
while (supplied_iter->iterate(supplied_iter, (void**)&supplied))
{
- selected = stored->select(stored, supplied);
+ selected = stored->select(stored, supplied, private);
if (selected)
{
/* they match, return */
@@ -162,7 +162,7 @@ static proposal_t *select_proposal(private_ike_cfg_t *this,
supplied_iter->destroy(supplied_iter);
DBG1(DBG_CFG, "received proposals: %#P", proposals);
DBG1(DBG_CFG, "configured proposals: %#P", this->proposals);
-
+
return NULL;
}
@@ -174,7 +174,7 @@ static diffie_hellman_group_t get_dh_group(private_ike_cfg_t *this)
enumerator_t *enumerator;
proposal_t *proposal;
u_int16_t dh_group = MODP_NONE;
-
+
enumerator = this->proposals->create_enumerator(this->proposals);
while (enumerator->enumerate(enumerator, &proposal))
{
@@ -195,7 +195,7 @@ static bool equals(private_ike_cfg_t *this, private_ike_cfg_t *other)
enumerator_t *e1, *e2;
proposal_t *p1, *p2;
bool eq = TRUE;
-
+
if (this == other)
{
return TRUE;
@@ -260,7 +260,7 @@ ike_cfg_t *ike_cfg_create(bool certreq, bool force_encap,
char *me, char *other)
{
private_ike_cfg_t *this = malloc_thing(private_ike_cfg_t);
-
+
/* public functions */
this->public.send_certreq = (bool(*)(ike_cfg_t*))send_certreq;
this->public.force_encap = (bool (*) (ike_cfg_t *))force_encap_meth;
@@ -268,12 +268,12 @@ ike_cfg_t *ike_cfg_create(bool certreq, bool force_encap,
this->public.get_other_addr = (char*(*)(ike_cfg_t*))get_other_addr;
this->public.add_proposal = (void(*)(ike_cfg_t*, proposal_t*)) add_proposal;
this->public.get_proposals = (linked_list_t*(*)(ike_cfg_t*))get_proposals;
- this->public.select_proposal = (proposal_t*(*)(ike_cfg_t*,linked_list_t*))select_proposal;
+ this->public.select_proposal = (proposal_t*(*)(ike_cfg_t*,linked_list_t*,bool))select_proposal;
this->public.get_dh_group = (diffie_hellman_group_t(*)(ike_cfg_t*)) get_dh_group;
this->public.equals = (bool(*)(ike_cfg_t*,ike_cfg_t*)) equals;
this->public.get_ref = (ike_cfg_t*(*)(ike_cfg_t*))get_ref;
this->public.destroy = (void(*)(ike_cfg_t*))destroy;
-
+
/* private variables */
this->refcount = 1;
this->certreq = certreq;
@@ -281,6 +281,6 @@ ike_cfg_t *ike_cfg_create(bool certreq, bool force_encap,
this->me = strdup(me);
this->other = strdup(other);
this->proposals = linked_list_create();
-
+
return &this->public;
}
diff --git a/src/charon/config/ike_cfg.h b/src/charon/config/ike_cfg.h
index 064906423..eaac321b9 100644
--- a/src/charon/config/ike_cfg.h
+++ b/src/charon/config/ike_cfg.h
@@ -37,71 +37,73 @@ typedef struct ike_cfg_t ike_cfg_t;
* @see peer_cfg_t to get an overview over the configurations.
*/
struct ike_cfg_t {
-
+
/**
* Get own address.
- *
+ *
* @return string of address/DNS name
*/
char* (*get_my_addr) (ike_cfg_t *this);
/**
* Get peers address.
- *
+ *
* @return string of address/DNS name
*/
char* (*get_other_addr) (ike_cfg_t *this);
-
+
/**
* Adds a proposal to the list.
- *
+ *
* The first added proposal has the highest priority, the last
* added the lowest.
- *
+ *
* @param proposal proposal to add
*/
void (*add_proposal) (ike_cfg_t *this, proposal_t *proposal);
-
+
/**
* Returns a list of all supported proposals.
- *
+ *
* Returned list and its proposals must be destroyed after use.
- *
+ *
* @return list containing all the proposals
*/
linked_list_t* (*get_proposals) (ike_cfg_t *this);
-
+
/**
* Select a proposed from suggested proposals.
- *
+ *
* Returned proposal must be destroyed after use.
- *
+ *
* @param proposals list of proposals to select from
+ * @param private accept algorithms from a private range
* @return selected proposal, or NULL if none matches.
*/
- proposal_t *(*select_proposal) (ike_cfg_t *this, linked_list_t *proposals);
-
+ proposal_t *(*select_proposal) (ike_cfg_t *this, linked_list_t *proposals,
+ bool private);
+
/**
* Should we send a certificate request in IKE_SA_INIT?
*
* @return certificate request sending policy
*/
bool (*send_certreq) (ike_cfg_t *this);
-
+
/**
* Enforce UDP encapsulation by faking NATD notifies?
- *
+ *
* @return TRUE to enfoce UDP encapsulation
*/
bool (*force_encap) (ike_cfg_t *this);
-
+
/**
* Get the DH group to use for IKE_SA setup.
- *
+ *
* @return dh group to use for initialization
*/
diffie_hellman_group_t (*get_dh_group)(ike_cfg_t *this);
-
+
/**
* Check if two IKE configs are equal.
*
@@ -109,17 +111,17 @@ struct ike_cfg_t {
* @return TRUE if other equal to this
*/
bool (*equals)(ike_cfg_t *this, ike_cfg_t *other);
-
+
/**
* Increase reference count.
*
* @return reference to this
*/
ike_cfg_t* (*get_ref) (ike_cfg_t *this);
-
+
/**
* Destroys a ike_cfg_t object.
- *
+ *
* Decrements the internal reference counter and
* destroys the ike_cfg when it reaches zero.
*/
@@ -137,7 +139,7 @@ struct ike_cfg_t {
* @param other address/DNS name of remote peer
* @return ike_cfg_t object.
*/
-ike_cfg_t *ike_cfg_create(bool certreq, bool force_encap,
+ike_cfg_t *ike_cfg_create(bool certreq, bool force_encap,
char *me, char *other);
#endif /** IKE_CFG_H_ @}*/
diff --git a/src/charon/config/peer_cfg.c b/src/charon/config/peer_cfg.c
index f096f269e..9df14c9ae 100644
--- a/src/charon/config/peer_cfg.c
+++ b/src/charon/config/peer_cfg.c
@@ -21,7 +21,7 @@
#include <daemon.h>
-#include <utils/mutex.h>
+#include <threading/mutex.h>
#include <utils/linked_list.h>
#include <utils/identification.h>
@@ -48,113 +48,113 @@ struct private_peer_cfg_t {
* Public part
*/
peer_cfg_t public;
-
+
/**
* Number of references hold by others to this peer_cfg
*/
refcount_t refcount;
-
+
/**
* Name of the peer_cfg, used to query it
*/
char *name;
-
+
/**
* IKE version to use for initiation
*/
u_int ike_version;
-
+
/**
* IKE config associated to this peer config
*/
ike_cfg_t *ike_cfg;
-
+
/**
* list of child configs associated to this peer config
*/
linked_list_t *child_cfgs;
-
+
/**
* mutex to lock access to list of child_cfgs
*/
mutex_t *mutex;
-
+
/**
* should we send a certificate
*/
cert_policy_t cert_policy;
-
+
/**
* uniqueness of an IKE_SA
*/
unique_policy_t unique;
-
+
/**
* number of tries after giving up if peer does not respond
*/
u_int32_t keyingtries;
-
+
/**
* enable support for MOBIKE
*/
bool use_mobike;
-
+
/**
* Time before starting rekeying
*/
u_int32_t rekey_time;
-
+
/**
* Time before starting reauthentication
*/
u_int32_t reauth_time;
-
+
/**
* Time, which specifies the range of a random value substracted from above.
*/
u_int32_t jitter_time;
-
+
/**
* Delay before deleting a rekeying/reauthenticating SA
*/
u_int32_t over_time;
-
+
/**
* DPD check intervall
*/
u_int32_t dpd;
-
+
/**
* virtual IP to use locally
*/
host_t *virtual_ip;
-
+
/**
* pool to acquire configuration attributes from
*/
char *pool;
-
+
/**
* local authentication configs (rulesets)
*/
linked_list_t *local_auth;
-
+
/**
* remote authentication configs (constraints)
*/
linked_list_t *remote_auth;
-
-#ifdef ME
+
+#ifdef ME
/**
* Is this a mediation connection?
*/
bool mediation;
-
+
/**
* Name of the mediation connection to mediate through
*/
peer_cfg_t *mediated_by;
-
+
/**
* ID of our peer at the mediation server (= leftid of the peer's conn with
* the mediation server)
@@ -239,12 +239,12 @@ static bool child_cfg_enumerate(child_cfg_enumerator_t *this, child_cfg_t **chd)
static enumerator_t* create_child_cfg_enumerator(private_peer_cfg_t *this)
{
child_cfg_enumerator_t *enumerator = malloc_thing(child_cfg_enumerator_t);
-
+
enumerator->public.enumerate = (void*)child_cfg_enumerate;
enumerator->public.destroy = (void*)child_cfg_enumerator_destroy;
enumerator->mutex = this->mutex;
enumerator->wrapped = this->child_cfgs->create_enumerator(this->child_cfgs);
-
+
this->mutex->lock(this->mutex);
return &enumerator->public;
}
@@ -259,13 +259,13 @@ static int get_ts_match(child_cfg_t *cfg, bool local,
enumerator_t *sup_enum, *cfg_enum;
traffic_selector_t *sup_ts, *cfg_ts;
int match = 0, round;
-
+
/* fetch configured TS list, narrowing dynamic TS */
cfg_list = cfg->get_traffic_selectors(cfg, local, NULL, host);
-
+
/* use a round counter to rate leading TS with higher priority */
round = sup_list->get_count(sup_list);
-
+
sup_enum = sup_list->create_enumerator(sup_list);
while (sup_enum->enumerate(sup_enum, &sup_ts))
{
@@ -286,9 +286,9 @@ static int get_ts_match(child_cfg_t *cfg, bool local,
round--;
}
sup_enum->destroy(sup_enum);
-
+
cfg_list->destroy_offset(cfg_list, offsetof(traffic_selector_t, destroy));
-
+
return match;
}
@@ -303,16 +303,16 @@ static child_cfg_t* select_child_cfg(private_peer_cfg_t *this,
child_cfg_t *current, *found = NULL;
enumerator_t *enumerator;
int best = 0;
-
+
DBG2(DBG_CFG, "looking for a child config for %#R=== %#R", my_ts, other_ts);
enumerator = create_child_cfg_enumerator(this);
while (enumerator->enumerate(enumerator, &current))
{
int my_prio, other_prio;
-
+
my_prio = get_ts_match(current, TRUE, my_ts, my_host);
other_prio = get_ts_match(current, FALSE, other_ts, other_host);
-
+
if (my_prio && other_prio)
{
DBG2(DBG_CFG, " candidate \"%s\" with prio %d+%d",
@@ -421,7 +421,7 @@ static host_t* get_virtual_ip(private_peer_cfg_t *this)
{
return this->virtual_ip;
}
-
+
/**
* Implementation of peer_cfg_t.get_pool.
*/
@@ -493,7 +493,7 @@ static bool auth_cfg_equal(private_peer_cfg_t *this, private_peer_cfg_t *other)
enumerator_t *e1, *e2;
auth_cfg_t *cfg1, *cfg2;
bool equal = TRUE;
-
+
if (this->local_auth->get_count(this->local_auth) !=
other->local_auth->get_count(other->local_auth))
{
@@ -504,7 +504,7 @@ static bool auth_cfg_equal(private_peer_cfg_t *this, private_peer_cfg_t *other)
{
return FALSE;
}
-
+
e1 = this->local_auth->create_enumerator(this->local_auth);
e2 = other->local_auth->create_enumerator(other->local_auth);
while (e1->enumerate(e1, &cfg1) && e2->enumerate(e2, &cfg2))
@@ -517,12 +517,12 @@ static bool auth_cfg_equal(private_peer_cfg_t *this, private_peer_cfg_t *other)
}
e1->destroy(e1);
e2->destroy(e2);
-
+
if (!equal)
{
return FALSE;
}
-
+
e1 = this->remote_auth->create_enumerator(this->remote_auth);
e2 = other->remote_auth->create_enumerator(other->remote_auth);
while (e1->enumerate(e1, &cfg1) && e2->enumerate(e2, &cfg2))
@@ -535,7 +535,7 @@ static bool auth_cfg_equal(private_peer_cfg_t *this, private_peer_cfg_t *other)
}
e1->destroy(e1);
e2->destroy(e2);
-
+
return equal;
}
@@ -552,7 +552,7 @@ static bool equals(private_peer_cfg_t *this, private_peer_cfg_t *other)
{
return FALSE;
}
-
+
return (
this->ike_version == other->ike_version &&
this->cert_policy == other->cert_policy &&
@@ -567,7 +567,7 @@ static bool equals(private_peer_cfg_t *this, private_peer_cfg_t *other)
(this->virtual_ip == other->virtual_ip ||
(this->virtual_ip && other->virtual_ip &&
this->virtual_ip->equals(this->virtual_ip, other->virtual_ip))) &&
- (this->pool == other->pool ||
+ (this->pool == other->pool ||
(this->pool && other->pool && streq(this->pool, other->pool))) &&
auth_cfg_equal(this, other)
#ifdef ME
@@ -630,8 +630,8 @@ peer_cfg_t *peer_cfg_create(char *name, u_int ike_version, ike_cfg_t *ike_cfg,
private_peer_cfg_t *this = malloc_thing(private_peer_cfg_t);
/* public functions */
- this->public.get_name = (char* (*) (peer_cfg_t *))get_name;
- this->public.get_ike_version = (u_int(*) (peer_cfg_t *))get_ike_version;
+ this->public.get_name = (char* (*) (peer_cfg_t *))get_name;
+ this->public.get_ike_version = (u_int(*) (peer_cfg_t *))get_ike_version;
this->public.get_ike_cfg = (ike_cfg_t* (*) (peer_cfg_t *))get_ike_cfg;
this->public.add_child_cfg = (void (*) (peer_cfg_t *, child_cfg_t*))add_child_cfg;
this->public.remove_child_cfg = (void(*)(peer_cfg_t*, enumerator_t*))remove_child_cfg;
@@ -657,7 +657,7 @@ peer_cfg_t *peer_cfg_create(char *name, u_int ike_version, ike_cfg_t *ike_cfg,
this->public.get_mediated_by = (peer_cfg_t* (*) (peer_cfg_t *))get_mediated_by;
this->public.get_peer_id = (identification_t* (*) (peer_cfg_t *))get_peer_id;
#endif /* ME */
-
+
/* apply init values */
this->name = strdup(name);
this->ike_version = ike_version;
diff --git a/src/charon/config/peer_cfg.h b/src/charon/config/peer_cfg.h
index 3c095eff0..6855276f8 100644
--- a/src/charon/config/peer_cfg.h
+++ b/src/charon/config/peer_cfg.h
@@ -30,7 +30,7 @@ typedef struct peer_cfg_t peer_cfg_t;
#include <library.h>
#include <utils/identification.h>
#include <utils/enumerator.h>
-#include <config/traffic_selector.h>
+#include <selectors/traffic_selector.h>
#include <config/proposal.h>
#include <config/ike_cfg.h>
#include <config/child_cfg.h>
@@ -43,17 +43,17 @@ typedef struct peer_cfg_t peer_cfg_t;
* requests when using this definition for the other peer. If
* it is CERT_NEVER_SEND, a certreq is omitted, otherwise its
* included.
- *
+ *
* @warning These definitions must be the same as in pluto/starter,
* as they are sent over the stroke socket.
*/
enum cert_policy_t {
/** always send certificates, even when not requested */
- CERT_ALWAYS_SEND = 0,
+ CERT_ALWAYS_SEND = 0,
/** send certificate upon cert request */
- CERT_SEND_IF_ASKED = 1,
+ CERT_SEND_IF_ASKED = 1,
/** never send a certificate, even when requested */
- CERT_NEVER_SEND = 2,
+ CERT_NEVER_SEND = 2,
};
/**
@@ -108,60 +108,60 @@ extern enum_name_t *unique_policy_names;
* Each peer_cfg has two lists of authentication config attached. Local
* authentication configs define how to authenticate ourself against the remote
* peer. Each config is enforced using the multiple authentication extension
- * (RFC4739).
+ * (RFC4739).
* The remote authentication configs are handled as constraints. The peer has
* to fullfill each of these rules (using multiple authentication, in any order)
* to gain access to the configuration.
*/
struct peer_cfg_t {
-
+
/**
* Get the name of the peer_cfg.
- *
+ *
* Returned object is not getting cloned.
- *
+ *
* @return peer_cfg's name
*/
char* (*get_name) (peer_cfg_t *this);
-
+
/**
* Get the IKE version to use for initiating.
*
* @return IKE major version
*/
u_int (*get_ike_version)(peer_cfg_t *this);
-
+
/**
* Get the IKE config to use for initiaton.
- *
+ *
* @return the IKE config to use
*/
ike_cfg_t* (*get_ike_cfg) (peer_cfg_t *this);
-
+
/**
* Attach a CHILD config.
- *
+ *
* @param child_cfg CHILD config to add
*/
void (*add_child_cfg) (peer_cfg_t *this, child_cfg_t *child_cfg);
-
+
/**
* Detach a CHILD config, pointed to by an enumerator.
*
* @param enumerator enumerator indicating element position
*/
void (*remove_child_cfg)(peer_cfg_t *this, enumerator_t *enumerator);
-
+
/**
* Create an enumerator for all attached CHILD configs.
- *
+ *
* @return an enumerator over all CHILD configs.
*/
enumerator_t* (*create_child_cfg_enumerator) (peer_cfg_t *this);
-
+
/**
* Select a CHILD config from traffic selectors.
- *
+ *
* @param my_ts TS for local side
* @param other_ts TS for remote side
* @param my_host host to narrow down dynamic TS for local side
@@ -171,7 +171,7 @@ struct peer_cfg_t {
child_cfg_t* (*select_child_cfg) (peer_cfg_t *this, linked_list_t *my_ts,
linked_list_t *other_ts, host_t *my_host,
host_t *other_host);
-
+
/**
* Add an authentication config to the peer configuration.
*
@@ -179,7 +179,7 @@ struct peer_cfg_t {
* @param local TRUE for local rules, FALSE for remote constraints
*/
void (*add_auth_cfg)(peer_cfg_t *this, auth_cfg_t *cfg, bool local);
-
+
/**
* Create an enumerator over registered authentication configs.
*
@@ -201,49 +201,49 @@ struct peer_cfg_t {
* @return unique policy
*/
unique_policy_t (*get_unique_policy) (peer_cfg_t *this);
-
+
/**
* Get the max number of retries after timeout.
*
* @return max number retries
*/
u_int32_t (*get_keyingtries) (peer_cfg_t *this);
-
+
/**
* Get a time to start rekeying (is randomized with jitter).
*
* @return time in s when to start rekeying, 0 disables rekeying
*/
u_int32_t (*get_rekey_time)(peer_cfg_t *this);
-
+
/**
* Get a time to start reauthentication (is randomized with jitter).
*
* @return time in s when to start reauthentication, 0 disables it
*/
u_int32_t (*get_reauth_time)(peer_cfg_t *this);
-
+
/**
* Get the timeout of a rekeying/reauthenticating SA.
*
* @return timeout in s
*/
u_int32_t (*get_over_time)(peer_cfg_t *this);
-
+
/**
* Use MOBIKE (RFC4555) if peer supports it?
- *
+ *
* @return TRUE to enable MOBIKE support
*/
bool (*use_mobike) (peer_cfg_t *this);
-
+
/**
* Get the DPD check interval.
- *
+ *
* @return dpd_delay in seconds
*/
u_int32_t (*get_dpd) (peer_cfg_t *this);
-
+
/**
* Get a virtual IP for the local peer.
*
@@ -255,37 +255,37 @@ struct peer_cfg_t {
* @return virtual IP, %any or NULL
*/
host_t* (*get_virtual_ip) (peer_cfg_t *this);
-
+
/**
* Get the name of the pool to acquire configuration attributes from.
*
* @return pool name, NULL if none defined
*/
char* (*get_pool)(peer_cfg_t *this);
-
+
#ifdef ME
/**
* Is this a mediation connection?
- *
+ *
* @return TRUE, if this is a mediation connection
*/
bool (*is_mediation) (peer_cfg_t *this);
-
+
/**
* Get peer_cfg of the connection this one is mediated through.
- *
+ *
* @return the peer_cfg of the mediation connection
*/
peer_cfg_t* (*get_mediated_by) (peer_cfg_t *this);
-
+
/**
* Get the id of the other peer at the mediation server.
- *
+ *
* This is the leftid of the peer's connection with the mediation server.
- *
+ *
* If it is not configured, it is assumed to be the same as the right id
- * of this connection.
- *
+ * of this connection.
+ *
* @return the id of the other peer
*/
identification_t* (*get_peer_id) (peer_cfg_t *this);
@@ -300,14 +300,14 @@ struct peer_cfg_t {
* @return TRUE if peer_cfg and ike_cfg are equal
*/
bool (*equals)(peer_cfg_t *this, peer_cfg_t *other);
-
+
/**
* Increase reference count.
*
* @return reference to this
*/
peer_cfg_t* (*get_ref) (peer_cfg_t *this);
-
+
/**
* Destroys the peer_cfg object.
*
@@ -319,14 +319,14 @@ struct peer_cfg_t {
/**
* Create a configuration object for IKE_AUTH and later.
- *
+ *
* name-string gets cloned, ID's not.
* Virtual IPs are used if they are != NULL. A %any host means the virtual
* IP should be obtained from the other peer.
* Lifetimes are in seconds. To prevent to peers to start rekeying at the
* same time, a jitter may be specified. Rekeying of an SA starts at
- * (rekeylifetime - random(0, jitter)).
- *
+ * (rekeylifetime - random(0, jitter)).
+ *
* @param name name of the peer_cfg
* @param ike_version which IKE version we sould use for this peer
* @param ike_cfg IKE config to use when acting as initiator
diff --git a/src/charon/config/proposal.c b/src/charon/config/proposal.c
index cf7e19605..6b3500b6e 100644
--- a/src/charon/config/proposal.c
+++ b/src/charon/config/proposal.c
@@ -52,52 +52,52 @@ struct private_proposal_t {
* Public part
*/
proposal_t public;
-
+
/**
* protocol (ESP or AH)
*/
protocol_id_t protocol;
-
+
/**
* priority ordered list of encryption algorithms
*/
linked_list_t *encryption_algos;
-
+
/**
* priority ordered list of integrity algorithms
*/
linked_list_t *integrity_algos;
-
+
/**
* priority ordered list of pseudo random functions
*/
linked_list_t *prf_algos;
-
+
/**
* priority ordered list of dh groups
*/
linked_list_t *dh_groups;
-
+
/**
* priority ordered list of extended sequence number flags
*/
linked_list_t *esns;
-
- /**
+
+ /**
* senders SPI
*/
u_int64_t spi;
};
/**
- * Struct used to store different kinds of algorithms.
+ * Struct used to store different kinds of algorithms.
*/
struct algorithm_t {
/**
* Value from an encryption_algorithm_t/integrity_algorithm_t/...
*/
u_int16_t algorithm;
-
+
/**
* the associated key size in bits, or zero if not needed
*/
@@ -110,7 +110,7 @@ struct algorithm_t {
static void add_algo(linked_list_t *list, u_int16_t algo, u_int16_t key_size)
{
algorithm_t *algo_key;
-
+
algo_key = malloc_thing(algorithm_t);
algo_key->algorithm = algo;
algo_key->key_size = key_size;
@@ -200,7 +200,7 @@ static bool get_algorithm(private_proposal_t *this, transform_type_t type,
{
enumerator_t *enumerator;
bool found = FALSE;
-
+
enumerator = create_enumerator(this, type);
if (enumerator->enumerate(enumerator, alg, key_size))
{
@@ -216,12 +216,12 @@ static bool get_algorithm(private_proposal_t *this, transform_type_t type,
static bool has_dh_group(private_proposal_t *this, diffie_hellman_group_t group)
{
bool result = FALSE;
-
+
if (this->dh_groups->get_count(this->dh_groups))
{
algorithm_t *current;
enumerator_t *enumerator;
-
+
enumerator = this->dh_groups->create_enumerator(this->dh_groups);
while (enumerator->enumerate(enumerator, (void**)&current))
{
@@ -246,7 +246,7 @@ static bool has_dh_group(private_proposal_t *this, diffie_hellman_group_t group)
static void strip_dh(private_proposal_t *this)
{
algorithm_t *alg;
-
+
while (this->dh_groups->remove_last(this->dh_groups, (void**)&alg) == SUCCESS)
{
free(alg);
@@ -277,19 +277,19 @@ static bool is_authenticated_encryption(u_int16_t alg)
/**
* Find a matching alg/keysize in two linked lists
*/
-static bool select_algo(linked_list_t *first, linked_list_t *second, bool *add,
- u_int16_t *alg, size_t *key_size)
+static bool select_algo(linked_list_t *first, linked_list_t *second, bool priv,
+ bool *add, u_int16_t *alg, size_t *key_size)
{
enumerator_t *e1, *e2;
algorithm_t *alg1, *alg2;
-
+
/* if in both are zero algorithms specified, we HAVE a match */
if (first->get_count(first) == 0 && second->get_count(second) == 0)
{
*add = FALSE;
return TRUE;
}
-
+
e1 = first->create_enumerator(first);
e2 = second->create_enumerator(second);
/* compare algs, order of algs in "first" is preferred */
@@ -302,6 +302,13 @@ static bool select_algo(linked_list_t *first, linked_list_t *second, bool *add,
if (alg1->algorithm == alg2->algorithm &&
alg1->key_size == alg2->key_size)
{
+ if (!priv && alg1->algorithm >= 1024)
+ {
+ /* accept private use algorithms only if requested */
+ DBG1(DBG_CFG, "an algorithm from private space would match, "
+ "but peer implementation is unknown, skipped");
+ continue;
+ }
/* ok, we have an algorithm */
*alg = alg1->algorithm;
*key_size = alg1->key_size;
@@ -321,26 +328,27 @@ static bool select_algo(linked_list_t *first, linked_list_t *second, bool *add,
/**
* Implements proposal_t.select.
*/
-static proposal_t *select_proposal(private_proposal_t *this, private_proposal_t *other)
+static proposal_t *select_proposal(private_proposal_t *this,
+ private_proposal_t *other, bool private)
{
proposal_t *selected;
u_int16_t algo;
size_t key_size;
bool add;
-
+
DBG2(DBG_CFG, "selecting proposal:");
-
+
/* check protocol */
if (this->protocol != other->protocol)
{
DBG2(DBG_CFG, " protocol mismatch, skipping");
return NULL;
}
-
+
selected = proposal_create(this->protocol);
-
+
/* select encryption algorithm */
- if (select_algo(this->encryption_algos, other->encryption_algos,
+ if (select_algo(this->encryption_algos, other->encryption_algos, private,
&add, &algo, &key_size))
{
if (add)
@@ -359,7 +367,7 @@ static proposal_t *select_proposal(private_proposal_t *this, private_proposal_t
/* select integrity algorithm */
if (!is_authenticated_encryption(algo))
{
- if (select_algo(this->integrity_algos, other->integrity_algos,
+ if (select_algo(this->integrity_algos, other->integrity_algos, private,
&add, &algo, &key_size))
{
if (add)
@@ -377,7 +385,7 @@ static proposal_t *select_proposal(private_proposal_t *this, private_proposal_t
}
}
/* select prf algorithm */
- if (select_algo(this->prf_algos, other->prf_algos,
+ if (select_algo(this->prf_algos, other->prf_algos, private,
&add, &algo, &key_size))
{
if (add)
@@ -394,7 +402,8 @@ static proposal_t *select_proposal(private_proposal_t *this, private_proposal_t
return NULL;
}
/* select a DH-group */
- if (select_algo(this->dh_groups, other->dh_groups, &add, &algo, &key_size))
+ if (select_algo(this->dh_groups, other->dh_groups, private,
+ &add, &algo, &key_size))
{
if (add)
{
@@ -408,8 +417,8 @@ static proposal_t *select_proposal(private_proposal_t *this, private_proposal_t
transform_type_names, DIFFIE_HELLMAN_GROUP);
return NULL;
}
- /* select if we use ESNs */
- if (select_algo(this->esns, other->esns, &add, &algo, &key_size))
+ /* select if we use ESNs (has no private use space) */
+ if (select_algo(this->esns, other->esns, TRUE, &add, &algo, &key_size))
{
if (add)
{
@@ -424,10 +433,10 @@ static proposal_t *select_proposal(private_proposal_t *this, private_proposal_t
return NULL;
}
DBG2(DBG_CFG, " proposal matches");
-
+
/* apply SPI from "other" */
selected->set_spi(selected, other->spi);
-
+
/* everything matched, return new proposal */
return selected;
}
@@ -463,7 +472,7 @@ static void clone_algo_list(linked_list_t *list, linked_list_t *clone_list)
{
algorithm_t *algo, *clone_algo;
enumerator_t *enumerator;
-
+
enumerator = list->create_enumerator(list);
while (enumerator->enumerate(enumerator, &algo))
{
@@ -482,12 +491,12 @@ static bool algo_list_equals(linked_list_t *l1, linked_list_t *l2)
enumerator_t *e1, *e2;
algorithm_t *alg1, *alg2;
bool equals = TRUE;
-
+
if (l1->get_count(l1) != l2->get_count(l2))
{
return FALSE;
}
-
+
e1 = l1->create_enumerator(l1);
e2 = l2->create_enumerator(l2);
while (e1->enumerate(e1, &alg1) && e2->enumerate(e2, &alg2))
@@ -531,15 +540,15 @@ static bool equals(private_proposal_t *this, private_proposal_t *other)
static proposal_t *clone_(private_proposal_t *this)
{
private_proposal_t *clone = (private_proposal_t*)proposal_create(this->protocol);
-
+
clone_algo_list(this->encryption_algos, clone->encryption_algos);
clone_algo_list(this->integrity_algos, clone->integrity_algos);
clone_algo_list(this->prf_algos, clone->prf_algos);
clone_algo_list(this->dh_groups, clone->dh_groups);
clone_algo_list(this->esns, clone->esns);
-
+
clone->spi = this->spi;
-
+
return &clone->public;
}
@@ -551,7 +560,7 @@ static void check_proposal(private_proposal_t *this)
enumerator_t *e;
algorithm_t *alg;
bool all_aead = TRUE;
-
+
e = this->encryption_algos->create_enumerator(this->encryption_algos);
while (e->enumerate(e, &alg))
{
@@ -562,7 +571,7 @@ static void check_proposal(private_proposal_t *this)
}
}
e->destroy(e);
-
+
if (all_aead)
{
/* if all encryption algorithms in the proposal are authenticated encryption
@@ -613,7 +622,7 @@ static status_t add_string_algo(private_proposal_t *this, chunk_t alg)
case AUTH_AES_XCBC_96:
prf = PRF_AES128_XCBC;
break;
- default:
+ default:
prf = PRF_UNDEFINED;
}
if (prf != PRF_UNDEFINED)
@@ -633,7 +642,7 @@ static int print_alg(private_proposal_t *this, char **dst, size_t *len,
enumerator_t *enumerator;
size_t written = 0;
u_int16_t alg, size;
-
+
enumerator = create_enumerator(this, kind);
while (enumerator->enumerate(enumerator, &alg, &size))
{
@@ -666,12 +675,12 @@ int proposal_printf_hook(char *dst, size_t len, printf_hook_spec_t *spec,
enumerator_t *enumerator;
size_t written = 0;
bool first = TRUE;
-
+
if (this == NULL)
{
return print_in_hook(dst, len, "(null)");
}
-
+
if (spec->hash)
{
enumerator = list->create_enumerator(list);
@@ -690,7 +699,7 @@ int proposal_printf_hook(char *dst, size_t len, printf_hook_spec_t *spec,
enumerator->destroy(enumerator);
return written;
}
-
+
written = print_in_hook(dst, len, "%N:", protocol_id_names, this->protocol);
written += print_alg(this, &dst, &len, ENCRYPTION_ALGORITHM,
encryption_algorithm_names, &first);
@@ -724,29 +733,29 @@ static void destroy(private_proposal_t *this)
proposal_t *proposal_create(protocol_id_t protocol)
{
private_proposal_t *this = malloc_thing(private_proposal_t);
-
+
this->public.add_algorithm = (void (*)(proposal_t*,transform_type_t,u_int16_t,u_int16_t))add_algorithm;
this->public.create_enumerator = (enumerator_t* (*)(proposal_t*,transform_type_t))create_enumerator;
this->public.get_algorithm = (bool (*)(proposal_t*,transform_type_t,u_int16_t*,u_int16_t*))get_algorithm;
this->public.has_dh_group = (bool (*)(proposal_t*,diffie_hellman_group_t))has_dh_group;
this->public.strip_dh = (void(*)(proposal_t*))strip_dh;
- this->public.select = (proposal_t* (*)(proposal_t*,proposal_t*))select_proposal;
+ this->public.select = (proposal_t* (*)(proposal_t*,proposal_t*,bool))select_proposal;
this->public.get_protocol = (protocol_id_t(*)(proposal_t*))get_protocol;
this->public.set_spi = (void(*)(proposal_t*,u_int64_t))set_spi;
this->public.get_spi = (u_int64_t(*)(proposal_t*))get_spi;
this->public.equals = (bool(*)(proposal_t*, proposal_t *other))equals;
this->public.clone = (proposal_t*(*)(proposal_t*))clone_;
this->public.destroy = (void(*)(proposal_t*))destroy;
-
+
this->spi = 0;
this->protocol = protocol;
-
+
this->encryption_algos = linked_list_create();
this->integrity_algos = linked_list_create();
this->prf_algos = linked_list_create();
this->dh_groups = linked_list_create();
this->esns = linked_list_create();
-
+
return &this->public;
}
@@ -760,7 +769,7 @@ static void proposal_add_supported_ike(private_proposal_t *this)
integrity_algorithm_t integrity;
pseudo_random_function_t prf;
diffie_hellman_group_t group;
-
+
enumerator = lib->crypto->create_crypter_enumerator(lib->crypto);
while (enumerator->enumerate(enumerator, &encryption))
{
@@ -787,10 +796,10 @@ static void proposal_add_supported_ike(private_proposal_t *this)
break;
default:
break;
- }
+ }
}
enumerator->destroy(enumerator);
-
+
enumerator = lib->crypto->create_signer_enumerator(lib->crypto);
while (enumerator->enumerate(enumerator, &integrity))
{
@@ -806,10 +815,10 @@ static void proposal_add_supported_ike(private_proposal_t *this)
break;
default:
break;
- }
+ }
}
enumerator->destroy(enumerator);
-
+
enumerator = lib->crypto->create_prf_enumerator(lib->crypto);
while (enumerator->enumerate(enumerator, &prf))
{
@@ -828,7 +837,7 @@ static void proposal_add_supported_ike(private_proposal_t *this)
}
}
enumerator->destroy(enumerator);
-
+
enumerator = lib->crypto->create_dh_enumerator(lib->crypto);
while (enumerator->enumerate(enumerator, &group))
{
@@ -865,7 +874,7 @@ static void proposal_add_supported_ike(private_proposal_t *this)
proposal_t *proposal_create_default(protocol_id_t protocol)
{
private_proposal_t *this = (private_proposal_t*)proposal_create(protocol);
-
+
switch (protocol)
{
case PROTO_IKE:
@@ -903,14 +912,14 @@ proposal_t *proposal_create_from_string(protocol_id_t protocol, const char *algs
chunk_t string = {(void*)algs, strlen(algs)};
chunk_t alg;
status_t status = SUCCESS;
-
+
eat_whitespace(&string);
if (string.len < 1)
{
destroy(this);
return NULL;
}
-
+
/* get all tokens, separated by '-' */
while (extract_token(&alg, '-', &string))
{
@@ -925,9 +934,9 @@ proposal_t *proposal_create_from_string(protocol_id_t protocol, const char *algs
destroy(this);
return NULL;
}
-
+
check_proposal(this);
-
+
if (protocol == PROTO_AH || protocol == PROTO_ESP)
{
add_algorithm(this, EXTENDED_SEQUENCE_NUMBERS, NO_EXT_SEQ_NUMBERS, 0);
diff --git a/src/charon/config/proposal.h b/src/charon/config/proposal.h
index bc7a8c5e7..30f63b80d 100644
--- a/src/charon/config/proposal.h
+++ b/src/charon/config/proposal.h
@@ -33,7 +33,7 @@ typedef struct proposal_t proposal_t;
#include <crypto/crypters/crypter.h>
#include <crypto/signers/signer.h>
#include <crypto/diffie_hellman.h>
-#include <config/traffic_selector.h>
+#include <selectors/traffic_selector.h>
/**
* Protocol ID of a proposal.
@@ -65,17 +65,17 @@ extern enum_name_t *extended_sequence_numbers_names;
/**
* Stores a set of algorithms used for an SA.
- *
- * A proposal stores algorithms for a specific
+ *
+ * A proposal stores algorithms for a specific
* protocol. It can store algorithms for one protocol.
* Proposals with multiple protocols are not supported,
* as it's not specified in RFC4301 anymore.
*/
struct proposal_t {
-
+
/**
* Add an algorithm to the proposal.
- *
+ *
* The algorithms are stored by priority, first added
* is the most preferred.
* Key size is only needed for encryption algorithms
@@ -84,27 +84,27 @@ struct proposal_t {
* The alg parameter accepts encryption_algorithm_t,
* integrity_algorithm_t, dh_group_number_t and
* extended_sequence_numbers_t.
- *
+ *
* @param type kind of algorithm
* @param alg identifier for algorithm
* @param key_size key size to use
*/
void (*add_algorithm) (proposal_t *this, transform_type_t type,
u_int16_t alg, u_int16_t key_size);
-
+
/**
* Get an enumerator over algorithms for a specifc algo type.
- *
+ *
* @param type kind of algorithm
* @return enumerator over u_int16_t alg, u_int16_t key_size
*/
enumerator_t *(*create_enumerator) (proposal_t *this, transform_type_t type);
-
+
/**
* Get the algorithm for a type to use.
- *
+ *
* If there are multiple algorithms, only the first is returned.
- *
+ *
* @param type kind of algorithm
* @param alg pointer which receives algorithm
* @param key_size pointer which receives the key size
@@ -112,53 +112,54 @@ struct proposal_t {
*/
bool (*get_algorithm) (proposal_t *this, transform_type_t type,
u_int16_t *alg, u_int16_t *key_size);
-
+
/**
* Check if the proposal has a specific DH group.
- *
+ *
* @param group group to check for
* @return TRUE if algorithm included
*/
bool (*has_dh_group) (proposal_t *this, diffie_hellman_group_t group);
-
+
/**
* Strip DH groups from proposal to use it without PFS.
*/
- void (*strip_dh)(proposal_t *this);
+ void (*strip_dh)(proposal_t *this);
/**
* Compare two proposal, and select a matching subset.
- *
+ *
* If the proposals are for the same protocols (AH/ESP), they are
* compared. If they have at least one algorithm of each type
* in common, a resulting proposal of this kind is created.
- *
+ *
* @param other proposal to compair agains
+ * @param private accepts algorithms allocated in a private range
* @return selected proposal, NULL if proposals don't match
*/
- proposal_t *(*select) (proposal_t *this, proposal_t *other);
-
+ proposal_t *(*select) (proposal_t *this, proposal_t *other, bool private);
+
/**
* Get the protocol ID of the proposal.
*
* @return protocol of the proposal
*/
protocol_id_t (*get_protocol) (proposal_t *this);
-
+
/**
* Get the SPI of the proposal.
- *
+ *
* @return spi for proto
*/
u_int64_t (*get_spi) (proposal_t *this);
-
+
/**
* Set the SPI of the proposal.
- *
+ *
* @param spi spi to set for proto
*/
void (*set_spi) (proposal_t *this, u_int64_t spi);
-
+
/**
* Check for the eqality of two proposals.
*
@@ -166,14 +167,14 @@ struct proposal_t {
* @return TRUE if other equal to this
*/
bool (*equals)(proposal_t *this, proposal_t *other);
-
+
/**
* Clone a proposal.
- *
+ *
* @return clone of proposal
*/
proposal_t *(*clone) (proposal_t *this);
-
+
/**
* Destroys the proposal object.
*/
@@ -201,7 +202,7 @@ proposal_t *proposal_create_default(protocol_id_t protocol);
*
* The string is in the same form as a in the ipsec.conf file.
* E.g.: aes128-sha2_256-modp2048
- * 3des-md5
+ * 3des-md5
* An additional '!' at the end of the string forces this proposal,
* without it the peer may choose another algorithm we support.
*
@@ -214,10 +215,10 @@ proposal_t *proposal_create_from_string(protocol_id_t protocol, const char *algs
/**
* printf hook function for proposal_t.
*
- * Arguments are:
- * proposal_t *proposal
+ * Arguments are:
+ * proposal_t *proposal
* With the #-specifier, arguments are:
- * linked_list_t *list containing proposal_t*
+ * linked_list_t *list containing proposal_t*
*/
int proposal_printf_hook(char *dst, size_t len, printf_hook_spec_t *spec,
const void *const *args);
diff --git a/src/charon/config/traffic_selector.c b/src/charon/config/traffic_selector.c
deleted file mode 100644
index a8ea10008..000000000
--- a/src/charon/config/traffic_selector.c
+++ /dev/null
@@ -1,856 +0,0 @@
-/*
- * Copyright (C) 2007-2009 Tobias Brunner
- * Copyright (C) 2005-2007 Martin Willi
- * Copyright (C) 2005 Jan Hutter
- * Hochschule fuer Technik Rapperswil
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
- * for more details.
- */
-
-#include <arpa/inet.h>
-#include <string.h>
-#include <netdb.h>
-#include <stdio.h>
-
-#include "traffic_selector.h"
-
-#include <daemon.h>
-#include <utils/linked_list.h>
-#include <utils/identification.h>
-
-ENUM(ts_type_name, TS_IPV4_ADDR_RANGE, TS_IPV6_ADDR_RANGE,
- "TS_IPV4_ADDR_RANGE",
- "TS_IPV6_ADDR_RANGE",
-);
-
-typedef struct private_traffic_selector_t private_traffic_selector_t;
-
-/**
- * Private data of an traffic_selector_t object
- */
-struct private_traffic_selector_t {
-
- /**
- * Public part
- */
- traffic_selector_t public;
-
- /**
- * Type of address
- */
- ts_type_t type;
-
- /**
- * IP protocol (UDP, TCP, ICMP, ...)
- */
- u_int8_t protocol;
-
- /**
- * narrow this traffic selector to hosts external ip
- * if set, from and to have no meaning until set_address() is called
- */
- bool dynamic;
-
- /**
- * begin of address range, network order
- */
- union {
- /** dummy char for common address manipulation */
- char from[0];
- /** IPv4 address */
- u_int32_t from4[1];
- /** IPv6 address */
- u_int32_t from6[4];
- };
-
- /**
- * end of address range, network order
- */
- union {
- /** dummy char for common address manipulation */
- char to[0];
- /** IPv4 address */
- u_int32_t to4[1];
- /** IPv6 address */
- u_int32_t to6[4];
- };
-
- /**
- * begin of port range
- */
- u_int16_t from_port;
-
- /**
- * end of port range
- */
- u_int16_t to_port;
-};
-
-/**
- * calculate to "to"-address for the "from" address and a subnet size
- */
-static void calc_range(private_traffic_selector_t *this, u_int8_t netbits)
-{
- int byte;
- size_t size = (this->type == TS_IPV4_ADDR_RANGE) ? 4 : 16;
-
- /* go through the from address, starting at the tail. While we
- * have not processed the bits belonging to the host, set them to 1 on
- * the to address. If we reach the bits for the net, copy them from "from". */
- for (byte = size - 1; byte >=0; byte--)
- {
- u_char mask = 0x00;
- int shift;
-
- shift = (byte+1) * 8 - netbits;
- if (shift > 0)
- {
- mask = 1 << shift;
- if (mask != 0xFF)
- {
- mask--;
- }
- }
- this->to[byte] = this->from[byte] | mask;
- }
-}
-
-/**
- * calculate to subnet size from "to"- and "from"-address
- */
-static u_int8_t calc_netbits(private_traffic_selector_t *this)
-{
- int byte, bit;
- size_t size = (this->type == TS_IPV4_ADDR_RANGE) ? 4 : 16;
-
- /* go trough all bits of the addresses, beginning in the front.
- * as long as they are equal, the subnet gets larger
- */
- for (byte = 0; byte < size; byte++)
- {
- for (bit = 7; bit >= 0; bit--)
- {
- if ((1<<bit & this->from[byte]) != (1<<bit & this->to[byte]))
- {
- return ((7 - bit) + (byte * 8));
- }
- }
- }
- /* single host, netmask is 32/128 */
- return (size * 8);
-}
-
-/**
- * internal generic constructor
- */
-static private_traffic_selector_t *traffic_selector_create(u_int8_t protocol, ts_type_t type, u_int16_t from_port, u_int16_t to_port);
-
-/**
- * Described in header.
- */
-int traffic_selector_printf_hook(char *dst, size_t len, printf_hook_spec_t *spec,
- const void *const *args)
-{
- private_traffic_selector_t *this = *((private_traffic_selector_t**)(args[0]));
- linked_list_t *list = *((linked_list_t**)(args[0]));
- iterator_t *iterator;
- char addr_str[INET6_ADDRSTRLEN] = "";
- char *serv_proto = NULL;
- u_int8_t mask;
- bool has_proto;
- bool has_ports;
- size_t written = 0;
- u_int32_t from[4], to[4];
-
- if (this == NULL)
- {
- return print_in_hook(dst, len, "(null)");
- }
-
- if (spec->hash)
- {
- iterator = list->create_iterator(list, TRUE);
- while (iterator->iterate(iterator, (void**)&this))
- {
- /* call recursivly */
- written += print_in_hook(dst, len, "%R ", this);
- }
- iterator->destroy(iterator);
- return written;
- }
-
- memset(from, 0, sizeof(from));
- memset(to, 0xFF, sizeof(to));
- if (this->dynamic &&
- memeq(this->from, from, this->type == TS_IPV4_ADDR_RANGE ? 4 : 16) &&
- memeq(this->to, to, this->type == TS_IPV4_ADDR_RANGE ? 4 : 16))
- {
- written += print_in_hook(dst, len, "dynamic");
- }
- else
- {
- if (this->type == TS_IPV4_ADDR_RANGE)
- {
- inet_ntop(AF_INET, &this->from4, addr_str, sizeof(addr_str));
- }
- else
- {
- inet_ntop(AF_INET6, &this->from6, addr_str, sizeof(addr_str));
- }
- mask = calc_netbits(this);
- written += print_in_hook(dst, len, "%s/%d", addr_str, mask);
- }
-
- /* check if we have protocol and/or port selectors */
- has_proto = this->protocol != 0;
- has_ports = !(this->from_port == 0 && this->to_port == 0xFFFF);
-
- if (!has_proto && !has_ports)
- {
- return written;
- }
-
- written += print_in_hook(dst, len, "[");
-
- /* build protocol string */
- if (has_proto)
- {
- struct protoent *proto = getprotobynumber(this->protocol);
-
- if (proto)
- {
- written += print_in_hook(dst, len, "%s", proto->p_name);
- serv_proto = proto->p_name;
- }
- else
- {
- written += print_in_hook(dst, len, "%d", this->protocol);
- }
- }
-
- if (has_proto && has_ports)
- {
- written += print_in_hook(dst, len, "/");
- }
-
- /* build port string */
- if (has_ports)
- {
- if (this->from_port == this->to_port)
- {
- struct servent *serv = getservbyport(htons(this->from_port), serv_proto);
-
- if (serv)
- {
- written += print_in_hook(dst, len, "%s", serv->s_name);
- }
- else
- {
- written += print_in_hook(dst, len, "%d", this->from_port);
- }
- }
- else
- {
- written += print_in_hook(dst, len, "%d-%d", this->from_port, this->to_port);
- }
- }
-
- written += print_in_hook(dst, len, "]");
-
- return written;
-}
-
-/**
- * implements traffic_selector_t.get_subset
- */
-static traffic_selector_t *get_subset(private_traffic_selector_t *this, private_traffic_selector_t *other)
-{
- if (this->type == other->type && (this->protocol == other->protocol ||
- this->protocol == 0 || other->protocol == 0))
- {
- u_int16_t from_port, to_port;
- u_char *from, *to;
- u_int8_t protocol;
- size_t size;
- private_traffic_selector_t *new_ts;
-
- /* calculate the maximum port range allowed for both */
- from_port = max(this->from_port, other->from_port);
- to_port = min(this->to_port, other->to_port);
- if (from_port > to_port)
- {
- return NULL;
- }
- /* select protocol, which is not zero */
- protocol = max(this->protocol, other->protocol);
-
- switch (this->type)
- {
- case TS_IPV4_ADDR_RANGE:
- size = sizeof(this->from4);
- break;
- case TS_IPV6_ADDR_RANGE:
- size = sizeof(this->from6);
- break;
- default:
- return NULL;
- }
-
- /* get higher from-address */
- if (memcmp(this->from, other->from, size) > 0)
- {
- from = this->from;
- }
- else
- {
- from = other->from;
- }
- /* get lower to-address */
- if (memcmp(this->to, other->to, size) > 0)
- {
- to = other->to;
- }
- else
- {
- to = this->to;
- }
- /* if "from" > "to", we don't have a match */
- if (memcmp(from, to, size) > 0)
- {
- return NULL;
- }
-
- /* we have a match in protocol, port, and address: return it... */
- new_ts = traffic_selector_create(protocol, this->type, from_port, to_port);
- new_ts->type = this->type;
- new_ts->dynamic = this->dynamic || other->dynamic;
- memcpy(new_ts->from, from, size);
- memcpy(new_ts->to, to, size);
-
- return &new_ts->public;
- }
- return NULL;
-}
-
-/**
- * implements traffic_selector_t.equals
- */
-static bool equals(private_traffic_selector_t *this, private_traffic_selector_t *other)
-{
- if (this->type != other->type)
- {
- return FALSE;
- }
- if (!(this->from_port == other->from_port &&
- this->to_port == other->to_port &&
- this->protocol == other->protocol))
- {
- return FALSE;
- }
- switch (this->type)
- {
- case TS_IPV4_ADDR_RANGE:
- if (memeq(this->from4, other->from4, sizeof(this->from4)))
- {
- return TRUE;
- }
- break;
- case TS_IPV6_ADDR_RANGE:
- if (memeq(this->from6, other->from6, sizeof(this->from6)))
- {
- return TRUE;
- }
- break;
- default:
- break;
- }
- return FALSE;
-}
-
-/**
- * Implements traffic_selector_t.get_from_address.
- */
-static chunk_t get_from_address(private_traffic_selector_t *this)
-{
- switch (this->type)
- {
- case TS_IPV4_ADDR_RANGE:
- return chunk_create(this->from, sizeof(this->from4));
- case TS_IPV6_ADDR_RANGE:
- return chunk_create(this->from, sizeof(this->from6));
- default:
- return chunk_empty;
- }
-}
-
-/**
- * Implements traffic_selector_t.get_to_address.
- */
-static chunk_t get_to_address(private_traffic_selector_t *this)
-{
- switch (this->type)
- {
- case TS_IPV4_ADDR_RANGE:
- return chunk_create(this->to, sizeof(this->to4));
- case TS_IPV6_ADDR_RANGE:
- return chunk_create(this->to, sizeof(this->to6));
- default:
- return chunk_empty;
- }
-}
-
-/**
- * Implements traffic_selector_t.get_from_port.
- */
-static u_int16_t get_from_port(private_traffic_selector_t *this)
-{
- return this->from_port;
-}
-
-/**
- * Implements traffic_selector_t.get_to_port.
- */
-static u_int16_t get_to_port(private_traffic_selector_t *this)
-{
- return this->to_port;
-}
-
-/**
- * Implements traffic_selector_t.get_type.
- */
-static ts_type_t get_type(private_traffic_selector_t *this)
-{
- return this->type;
-}
-
-/**
- * Implements traffic_selector_t.get_protocol.
- */
-static u_int8_t get_protocol(private_traffic_selector_t *this)
-{
- return this->protocol;
-}
-
-/**
- * Implements traffic_selector_t.is_host.
- */
-static bool is_host(private_traffic_selector_t *this, host_t *host)
-{
- if (host)
- {
- chunk_t addr;
- int family = host->get_family(host);
-
- if ((family == AF_INET && this->type == TS_IPV4_ADDR_RANGE) ||
- (family == AF_INET6 && this->type == TS_IPV6_ADDR_RANGE))
- {
- addr = host->get_address(host);
- if (memeq(addr.ptr, this->from, addr.len) &&
- memeq(addr.ptr, this->to, addr.len))
- {
- return TRUE;
- }
- }
- }
- else
- {
- size_t length = (this->type == TS_IPV4_ADDR_RANGE) ? 4 : 16;
-
- if (this->dynamic)
- {
- return TRUE;
- }
-
- if (memeq(this->from, this->to, length))
- {
- return TRUE;
- }
- }
- return FALSE;
-}
-
-/**
- * Implementation of traffic_selector_t.is_dynamic
- */
-static bool is_dynamic(private_traffic_selector_t *this)
-{
- return this->dynamic;
-}
-
-/**
- * Implements traffic_selector_t.set_address.
- */
-static void set_address(private_traffic_selector_t *this, host_t *host)
-{
- if (this->dynamic)
- {
- this->type = host->get_family(host) == AF_INET ?
- TS_IPV4_ADDR_RANGE : TS_IPV6_ADDR_RANGE;
-
- if (host->is_anyaddr(host))
- {
- memset(this->from6, 0x00, sizeof(this->from6));
- memset(this->to6, 0xFF, sizeof(this->to6));
- }
- else
- {
- chunk_t from = host->get_address(host);
- memcpy(this->from, from.ptr, from.len);
- memcpy(this->to, from.ptr, from.len);
- }
- }
-}
-
-/**
- * Implements traffic_selector_t.is_contained_in.
- */
-static bool is_contained_in(private_traffic_selector_t *this,
- private_traffic_selector_t *other)
-{
- private_traffic_selector_t *subset;
- bool contained_in = FALSE;
-
- subset = (private_traffic_selector_t*)get_subset(this, other);
-
- if (subset)
- {
- if (equals(subset, this))
- {
- contained_in = TRUE;
- }
- free(subset);
- }
- return contained_in;
-}
-
-/**
- * Implements traffic_selector_t.includes.
- */
-static bool includes(private_traffic_selector_t *this, host_t *host)
-{
- chunk_t addr;
- int family = host->get_family(host);
-
- if ((family == AF_INET && this->type == TS_IPV4_ADDR_RANGE) ||
- (family == AF_INET6 && this->type == TS_IPV6_ADDR_RANGE))
- {
- addr = host->get_address(host);
-
- return memcmp(this->from, addr.ptr, addr.len) <= 0 &&
- memcmp(this->to, addr.ptr, addr.len) >= 0;
- }
-
- return FALSE;
-}
-
-/**
- * Implements traffic_selector_t.to_subnet.
- */
-static void to_subnet(private_traffic_selector_t *this, host_t **net, u_int8_t *mask)
-{
- /* there is no way to do this cleanly, as the address range may
- * be anything else but a subnet. We use from_addr as subnet
- * and try to calculate a usable subnet mask.
- */
- int family, byte;
- u_int16_t port = 0;
- chunk_t net_chunk;
-
- *mask = calc_netbits(this);
-
- switch (this->type)
- {
- case TS_IPV4_ADDR_RANGE:
- {
- family = AF_INET;
- net_chunk.len = sizeof(this->from4);
- break;
- }
- case TS_IPV6_ADDR_RANGE:
- {
- family = AF_INET6;
- net_chunk.len = sizeof(this->from6);
- break;
- }
- default:
- {
- /* unreachable */
- return;
- }
- }
-
- net_chunk.ptr = malloc(net_chunk.len);
- memcpy(net_chunk.ptr, this->from, net_chunk.len);
-
- for (byte = net_chunk.len - 1; byte >= (*mask / 8); --byte)
- {
- int shift = (byte + 1) * 8 - *mask;
- net_chunk.ptr[byte] = net_chunk.ptr[byte] & (0xFF << shift);
- }
-
- if (this->to_port == this->from_port)
- {
- port = this->to_port;
- }
-
- *net = host_create_from_chunk(family, net_chunk, port);
- chunk_free(&net_chunk);
-}
-
-/**
- * Implements traffic_selector_t.clone.
- */
-static traffic_selector_t *clone_(private_traffic_selector_t *this)
-{
- private_traffic_selector_t *clone;
-
- clone = traffic_selector_create(this->protocol, this->type,
- this->from_port, this->to_port);
-
- clone->dynamic = this->dynamic;
- switch (clone->type)
- {
- case TS_IPV4_ADDR_RANGE:
- {
- memcpy(clone->from4, this->from4, sizeof(this->from4));
- memcpy(clone->to4, this->to4, sizeof(this->to4));
- return &clone->public;
- }
- case TS_IPV6_ADDR_RANGE:
- {
- memcpy(clone->from6, this->from6, sizeof(this->from6));
- memcpy(clone->to6, this->to6, sizeof(this->to6));
- return &clone->public;
- }
- default:
- {
- /* unreachable */
- return &clone->public;
- }
- }
-}
-
-/**
- * Implements traffic_selector_t.destroy.
- */
-static void destroy(private_traffic_selector_t *this)
-{
- free(this);
-}
-
-/*
- * see header
- */
-traffic_selector_t *traffic_selector_create_from_bytes(u_int8_t protocol,
- ts_type_t type,
- chunk_t from, u_int16_t from_port,
- chunk_t to, u_int16_t to_port)
-{
- private_traffic_selector_t *this = traffic_selector_create(protocol, type,
- from_port, to_port);
-
- switch (type)
- {
- case TS_IPV4_ADDR_RANGE:
- {
- if (from.len != 4 || to.len != 4)
- {
- free(this);
- return NULL;
- }
- memcpy(this->from4, from.ptr, from.len);
- memcpy(this->to4, to.ptr, to.len);
- break;
- }
- case TS_IPV6_ADDR_RANGE:
- {
- if (from.len != 16 || to.len != 16)
- {
- free(this);
- return NULL;
- }
- memcpy(this->from6, from.ptr, from.len);
- memcpy(this->to6, to.ptr, to.len);
- break;
- }
- default:
- {
- free(this);
- return NULL;
- }
- }
- return (&this->public);
-}
-
-/*
- * see header
- */
-traffic_selector_t *traffic_selector_create_from_subnet(host_t *net,
- u_int8_t netbits, u_int8_t protocol, u_int16_t port)
-{
- private_traffic_selector_t *this = traffic_selector_create(protocol, 0, 0, 65535);
-
- switch (net->get_family(net))
- {
- case AF_INET:
- {
- chunk_t from;
-
- this->type = TS_IPV4_ADDR_RANGE;
- from = net->get_address(net);
- memcpy(this->from4, from.ptr, from.len);
- if (this->from4[0] == 0)
- {
- /* use /0 for 0.0.0.0 */
- this->to4[0] = ~0;
- }
- else
- {
- calc_range(this, netbits);
- }
- break;
- }
- case AF_INET6:
- {
- chunk_t from;
-
- this->type = TS_IPV6_ADDR_RANGE;
- from = net->get_address(net);
- memcpy(this->from6, from.ptr, from.len);
- if (this->from6[0] == 0 && this->from6[1] == 0 &&
- this->from6[2] == 0 && this->from6[3] == 0)
- {
- /* use /0 for ::0 */
- this->to6[0] = ~0;
- this->to6[1] = ~0;
- this->to6[2] = ~0;
- this->to6[3] = ~0;
- }
- else
- {
- calc_range(this, netbits);
- }
- break;
- }
- default:
- {
- net->destroy(net);
- free(this);
- return NULL;
- }
- }
- if (port)
- {
- this->from_port = port;
- this->to_port = port;
- }
- net->destroy(net);
- return (&this->public);
-}
-
-/*
- * see header
- */
-traffic_selector_t *traffic_selector_create_from_string(
- u_int8_t protocol, ts_type_t type,
- char *from_addr, u_int16_t from_port,
- char *to_addr, u_int16_t to_port)
-{
- private_traffic_selector_t *this = traffic_selector_create(protocol, type,
- from_port, to_port);
-
- this->type = type;
- switch (type)
- {
- case TS_IPV4_ADDR_RANGE:
- {
- if (inet_pton(AF_INET, from_addr, (struct in_addr*)this->from4) < 0)
- {
- free(this);
- return NULL;
- }
- if (inet_pton(AF_INET, to_addr, (struct in_addr*)this->to4) < 0)
- {
- free(this);
- return NULL;
- }
- break;
- }
- case TS_IPV6_ADDR_RANGE:
- {
- if (inet_pton(AF_INET6, from_addr, (struct in6_addr*)this->from6) < 0)
- {
- free(this);
- return NULL;
- }
- if (inet_pton(AF_INET6, to_addr, (struct in6_addr*)this->to6) < 0)
- {
- free(this);
- return NULL;
- }
- break;
- }
- }
- return (&this->public);
-}
-
-/*
- * see header
- */
-traffic_selector_t *traffic_selector_create_dynamic(u_int8_t protocol,
- u_int16_t from_port, u_int16_t to_port)
-{
- private_traffic_selector_t *this = traffic_selector_create(
- protocol, TS_IPV4_ADDR_RANGE, from_port, to_port);
-
- memset(this->from6, 0, sizeof(this->from6));
- memset(this->to6, 0xFF, sizeof(this->to6));
-
- this->dynamic = TRUE;
-
- return &this->public;
-}
-
-/*
- * see declaration
- */
-static private_traffic_selector_t *traffic_selector_create(u_int8_t protocol,
- ts_type_t type, u_int16_t from_port, u_int16_t to_port)
-{
- private_traffic_selector_t *this = malloc_thing(private_traffic_selector_t);
-
- /* public functions */
- this->public.get_subset = (traffic_selector_t*(*)(traffic_selector_t*,traffic_selector_t*))get_subset;
- this->public.equals = (bool(*)(traffic_selector_t*,traffic_selector_t*))equals;
- this->public.get_from_address = (chunk_t(*)(traffic_selector_t*))get_from_address;
- this->public.get_to_address = (chunk_t(*)(traffic_selector_t*))get_to_address;
- this->public.get_from_port = (u_int16_t(*)(traffic_selector_t*))get_from_port;
- this->public.get_to_port = (u_int16_t(*)(traffic_selector_t*))get_to_port;
- this->public.get_type = (ts_type_t(*)(traffic_selector_t*))get_type;
- this->public.get_protocol = (u_int8_t(*)(traffic_selector_t*))get_protocol;
- this->public.is_host = (bool(*)(traffic_selector_t*,host_t*))is_host;
- this->public.is_dynamic = (bool(*)(traffic_selector_t*))is_dynamic;
- this->public.is_contained_in = (bool(*)(traffic_selector_t*,traffic_selector_t*))is_contained_in;
- this->public.includes = (bool(*)(traffic_selector_t*,host_t*))includes;
- this->public.set_address = (void(*)(traffic_selector_t*,host_t*))set_address;
- this->public.to_subnet = (void(*)(traffic_selector_t*,host_t**,u_int8_t*))to_subnet;
- this->public.clone = (traffic_selector_t*(*)(traffic_selector_t*))clone_;
- this->public.destroy = (void(*)(traffic_selector_t*))destroy;
-
- this->from_port = from_port;
- this->to_port = to_port;
- this->protocol = protocol;
- this->type = type;
- this->dynamic = FALSE;
-
- return this;
-}
-
diff --git a/src/charon/config/traffic_selector.h b/src/charon/config/traffic_selector.h
deleted file mode 100644
index a57da43a8..000000000
--- a/src/charon/config/traffic_selector.h
+++ /dev/null
@@ -1,304 +0,0 @@
-/*
- * Copyright (C) 2007 Tobias Brunner
- * Copyright (C) 2005-2006 Martin Willi
- * Copyright (C) 2005 Jan Hutter
- * Hochschule fuer Technik Rapperswil
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
- * for more details.
- */
-
-/**
- * @defgroup traffic_selector traffic_selector
- * @{ @ingroup config
- */
-
-#ifndef TRAFFIC_SELECTOR_H_
-#define TRAFFIC_SELECTOR_H_
-
-typedef enum ts_type_t ts_type_t;
-typedef struct traffic_selector_t traffic_selector_t;
-
-#include <library.h>
-#include <utils/host.h>
-
-/**
- * Traffic selector types.
- */
-enum ts_type_t {
-
- /**
- * A range of IPv4 addresses, represented by two four (4) octet
- * values. The first value is the beginning IPv4 address
- * (inclusive) and the second value is the ending IPv4 address
- * (inclusive). All addresses falling between the two specified
- * addresses are considered to be within the list.
- */
- TS_IPV4_ADDR_RANGE = 7,
-
- /**
- * A range of IPv6 addresses, represented by two sixteen (16)
- * octet values. The first value is the beginning IPv6 address
- * (inclusive) and the second value is the ending IPv6 address
- * (inclusive). All addresses falling between the two specified
- * addresses are considered to be within the list.
- */
- TS_IPV6_ADDR_RANGE = 8
-};
-
-/**
- * enum names for ts_type_t
- */
-extern enum_name_t *ts_type_name;
-
-/**
- * Object representing a traffic selector entry.
- *
- * A traffic selector defines an range of addresses
- * and a range of ports. IPv6 is not fully supported yet.
- */
-struct traffic_selector_t {
-
- /**
- * Compare two traffic selectors, and create a new one
- * which is the largest subset of both (subnet & port).
- *
- * Resulting traffic_selector is newly created and must be destroyed.
- *
- * @param other traffic selector to compare
- * @return
- * - created subset of them
- * - or NULL if no match between this and other
- */
- traffic_selector_t *(*get_subset) (traffic_selector_t *this,
- traffic_selector_t *other);
-
- /**
- * Clone a traffic selector.
- *
- * @return clone of it
- */
- traffic_selector_t *(*clone) (traffic_selector_t *this);
-
- /**
- * Get starting address of this ts as a chunk.
- *
- * Chunk is in network order and points to internal data.
- *
- * @return chunk containing the address
- */
- chunk_t (*get_from_address) (traffic_selector_t *this);
-
- /**
- * Get ending address of this ts as a chunk.
- *
- * Chunk is in network order and points to internal data.
- *
- * @return chunk containing the address
- */
- chunk_t (*get_to_address) (traffic_selector_t *this);
-
- /**
- * Get starting port of this ts.
- *
- * Port is in host order, since the parser converts it.
- * Size depends on protocol.
- *
- * @return port
- */
- u_int16_t (*get_from_port) (traffic_selector_t *this);
-
- /**
- * Get ending port of this ts.
- *
- * Port is in host order, since the parser converts it.
- * Size depends on protocol.
- *
- * @return port
- */
- u_int16_t (*get_to_port) (traffic_selector_t *this);
-
- /**
- * Get the type of the traffic selector.
- *
- * @return ts_type_t specifying the type
- */
- ts_type_t (*get_type) (traffic_selector_t *this);
-
- /**
- * Get the protocol id of this ts.
- *
- * @return protocol id
- */
- u_int8_t (*get_protocol) (traffic_selector_t *this);
-
- /**
- * Check if the traffic selector is for a single host.
- *
- * Traffic selector may describe the end of *-to-host tunnel. In this
- * case, the address range is a single address equal to the hosts
- * peer address.
- * If host is NULL, the traffic selector is checked if it is a single host,
- * but not a specific one.
- *
- * @param host host_t specifying the address range
- */
- bool (*is_host) (traffic_selector_t *this, host_t* host);
-
- /**
- * Check if a traffic selector has been created by create_dynamic().
- *
- * @return TRUE if TS is dynamic
- */
- bool (*is_dynamic)(traffic_selector_t *this);
-
- /**
- * Update the address of a traffic selector.
- *
- * Update the address range of a traffic selector, if it is
- * constructed with the traffic_selector_create_dynamic().
- *
- * @param host host_t specifying the address
- */
- void (*set_address) (traffic_selector_t *this, host_t* host);
-
- /**
- * Compare two traffic selectors for equality.
- *
- * @param other ts to compare with this
- * @return TRUE if equal, FALSE otherwise
- */
- bool (*equals) (traffic_selector_t *this, traffic_selector_t *other);
-
- /**
- * Check if a traffic selector is contained completly in another.
- *
- * contains() allows to check if multiple traffic selectors are redundant.
- *
- * @param other ts that contains this
- * @return TRUE if other contains this completly, FALSE otherwise
- */
- bool (*is_contained_in) (traffic_selector_t *this, traffic_selector_t *other);
-
- /**
- * Check if a specific host is included in the address range of
- * this traffic selector.
- *
- * @param host the host to check
- */
- bool (*includes) (traffic_selector_t *this, host_t *host);
-
- /**
- * Convert a traffic selector address range to a subnet
- * and its net mask.
- * If from and to ports of this traffic selector are equal,
- * the port of the returned host_t is set to that port.
- *
- * @param net converted subnet (has to be freed)
- * @param mask converted net mask
- */
- void (*to_subnet) (traffic_selector_t *this, host_t **net, u_int8_t *mask);
-
- /**
- * Destroys the ts object
- */
- void (*destroy) (traffic_selector_t *this);
-};
-
-/**
- * Create a new traffic selector using human readable params.
- *
- * @param protocol protocol for this ts, such as TCP or UDP
- * @param type type of following addresses, such as TS_IPV4_ADDR_RANGE
- * @param from_addr start of address range as string
- * @param from_port port number in host order
- * @param to_addr end of address range as string
- * @param to_port port number in host order
- * @return
- * - traffic_selector_t object
- * - NULL if invalid address strings/protocol
- */
-traffic_selector_t *traffic_selector_create_from_string(
- u_int8_t protocol, ts_type_t type,
- char *from_addr, u_int16_t from_port,
- char *to_addr, u_int16_t to_port);
-
-/**
- * Create a new traffic selector using data read from the net.
- *
- * There exists a mix of network and host order in the params.
- * But the parser gives us this data in this format, so we
- * don't have to convert twice.
- *
- * @param protocol protocol for this ts, such as TCP or UDP
- * @param type type of following addresses, such as TS_IPV4_ADDR_RANGE
- * @param from_address start of address range, network order
- * @param from_port port number, host order
- * @param to_address end of address range, network order
- * @param to_port port number, host order
- * @return traffic_selector_t object
- */
-traffic_selector_t *traffic_selector_create_from_bytes(
- u_int8_t protocol, ts_type_t type,
- chunk_t from_address, u_int16_t from_port,
- chunk_t to_address, u_int16_t to_port);
-
-/**
- * Create a new traffic selector defining a whole subnet.
- *
- * In most cases, definition of a traffic selector for full subnets
- * is sufficient. This constructor creates a traffic selector for
- * all protocols, all ports and the address range specified by the
- * subnet.
- * Additionally, a protocol and a port may be specified. Port ranges
- * are not supported via this constructor.
- *
- * @param net subnet to use
- * @param netbits size of the subnet, as used in e.g. 192.168.0.0/24 notation
- * @param protocol protocol for this ts, such as TCP or UDP
- * @param port port number, host order
- * @return
- * - traffic_selector_t object
- * - NULL if address family of net not supported
- */
-traffic_selector_t *traffic_selector_create_from_subnet(
- host_t *net, u_int8_t netbits,
- u_int8_t protocol, u_int16_t port);
-
-/**
- * Create a traffic selector for host-to-host cases.
- *
- * For host2host or virtual IP setups, the traffic selectors gets
- * created at runtime using the external/virtual IP. Using this constructor,
- * a call to set_address() sets this traffic selector to the supplied host.
- *
- *
- * @param protocol upper layer protocl to allow
- * @param from_port start of allowed port range
- * @param to_port end of range
- * @return
- * - traffic_selector_t object
- * - NULL if type not supported
- */
-traffic_selector_t *traffic_selector_create_dynamic(u_int8_t protocol,
- u_int16_t from_port, u_int16_t to_port);
-
-/**
- * printf hook function for traffic_selector_t.
- *
- * Arguments are:
- * traffic_selector_t *ts
- * With the #-specifier, arguments are:
- * linked_list_t *list containing traffic_selector_t*
- */
-int traffic_selector_printf_hook(char *dst, size_t len, printf_hook_spec_t *spec,
- const void *const *args);
-
-#endif /** TRAFFIC_SELECTOR_H_ @}*/
diff --git a/src/charon/control/controller.c b/src/charon/control/controller.c
index 021cb4fdd..94c64028c 100644
--- a/src/charon/control/controller.c
+++ b/src/charon/control/controller.c
@@ -47,42 +47,42 @@ struct interface_listener_t {
* public bus listener interface
*/
listener_t public;
-
+
/**
* status of the operation, return to method callers
*/
status_t status;
-
+
/**
* interface callback (listener gets redirected to here)
*/
controller_cb_t callback;
-
+
/**
* user parameter to pass to callback
*/
void *param;
-
+
/**
* child configuration, used for initiate
*/
child_cfg_t *child_cfg;
-
+
/**
* peer configuration, used for initiate
*/
peer_cfg_t *peer_cfg;
-
+
/**
* IKE_SA to handle
*/
ike_sa_t *ike_sa;
-
+
/**
* CHILD_SA to handle
*/
child_sa_t *child_sa;
-
+
/**
* unique ID, used for various methods
*/
@@ -92,17 +92,17 @@ struct interface_listener_t {
typedef struct interface_job_t interface_job_t;
-/**
+/**
* job for asynchronous listen operations
*/
struct interface_job_t {
- /**
- * job interface
+ /**
+ * job interface
*/
job_t public;
-
- /**
- * associated listener
+
+ /**
+ * associated listener
*/
interface_listener_t listener;
};
@@ -138,7 +138,7 @@ static bool listener_ike_state(interface_listener_t *this, ike_sa_t *ike_sa,
case IKE_ESTABLISHED:
{ /* mediation connections are complete without CHILD_SA */
peer_cfg_t *peer_cfg = ike_sa->get_peer_cfg(ike_sa);
-
+
if (peer_cfg->is_mediation(peer_cfg))
{
this->status = SUCCESS;
@@ -219,17 +219,17 @@ static status_t initiate_execute(interface_job_t *job)
ike_sa_t *ike_sa;
interface_listener_t *listener = &job->listener;
peer_cfg_t *peer_cfg = listener->peer_cfg;
-
+
ike_sa = charon->ike_sa_manager->checkout_by_config(charon->ike_sa_manager,
peer_cfg);
listener->ike_sa = ike_sa;
-
+
if (ike_sa->get_peer_cfg(ike_sa) == NULL)
{
ike_sa->set_peer_cfg(ike_sa, peer_cfg);
}
peer_cfg->destroy(peer_cfg);
-
+
if (ike_sa->initiate(ike_sa, listener->child_cfg, 0, NULL, NULL) == SUCCESS)
{
charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
@@ -279,9 +279,9 @@ static status_t terminate_ike_execute(interface_job_t *job)
{
interface_listener_t *listener = &job->listener;
ike_sa_t *ike_sa = listener->ike_sa;
-
+
charon->bus->set_sa(charon->bus, ike_sa);
-
+
if (ike_sa->delete(ike_sa) != DESTROY_ME)
{
charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
@@ -295,7 +295,7 @@ static status_t terminate_ike_execute(interface_job_t *job)
/**
* Implementation of controller_t.terminate_ike.
*/
-static status_t terminate_ike(controller_t *this, u_int32_t unique_id,
+static status_t terminate_ike(controller_t *this, u_int32_t unique_id,
controller_cb_t callback, void *param)
{
ike_sa_t *ike_sa;
@@ -316,7 +316,7 @@ static status_t terminate_ike(controller_t *this, u_int32_t unique_id,
.destroy = (void*)recheckin,
},
};
-
+
ike_sa = charon->ike_sa_manager->checkout_by_id(charon->ike_sa_manager,
unique_id, FALSE);
if (ike_sa == NULL)
@@ -325,7 +325,7 @@ static status_t terminate_ike(controller_t *this, u_int32_t unique_id,
return NOT_FOUND;
}
job.listener.ike_sa = ike_sa;
-
+
if (callback == NULL)
{
return terminate_ike_execute(&job);
@@ -342,7 +342,7 @@ static status_t terminate_child_execute(interface_job_t *job)
interface_listener_t *listener = &job->listener;
ike_sa_t *ike_sa = listener->ike_sa;
child_sa_t *child_sa = listener->child_sa;
-
+
charon->bus->set_sa(charon->bus, ike_sa);
if (ike_sa->delete_child_sa(ike_sa, child_sa->get_protocol(child_sa),
child_sa->get_spi(child_sa, TRUE)) != DESTROY_ME)
@@ -357,7 +357,7 @@ static status_t terminate_child_execute(interface_job_t *job)
/**
* Implementation of controller_t.terminate_child.
*/
-static status_t terminate_child(controller_t *this, u_int32_t reqid,
+static status_t terminate_child(controller_t *this, u_int32_t reqid,
controller_cb_t callback, void *param)
{
ike_sa_t *ike_sa;
@@ -380,9 +380,9 @@ static status_t terminate_child(controller_t *this, u_int32_t reqid,
.destroy = (void*)recheckin,
},
};
-
+
ike_sa = charon->ike_sa_manager->checkout_by_id(charon->ike_sa_manager,
- reqid, TRUE);
+ reqid, TRUE);
if (ike_sa == NULL)
{
DBG1(DBG_IKE, "unable to terminate, CHILD_SA with ID %d not found",
@@ -390,7 +390,7 @@ static status_t terminate_child(controller_t *this, u_int32_t reqid,
return NOT_FOUND;
}
job.listener.ike_sa = ike_sa;
-
+
iterator = ike_sa->create_child_sa_iterator(ike_sa);
while (iterator->iterate(iterator, (void**)&child_sa))
{
@@ -402,7 +402,7 @@ static status_t terminate_child(controller_t *this, u_int32_t reqid,
child_sa = NULL;
}
iterator->destroy(iterator);
-
+
if (child_sa == NULL)
{
DBG1(DBG_IKE, "unable to terminate, established "
@@ -443,13 +443,13 @@ static void destroy(private_controller_t *this)
controller_t *controller_create(void)
{
private_controller_t *this = malloc_thing(private_controller_t);
-
+
this->public.create_ike_sa_enumerator = (enumerator_t*(*)(controller_t*))create_ike_sa_enumerator;
this->public.initiate = (status_t(*)(controller_t*,peer_cfg_t*,child_cfg_t*,controller_cb_t,void*))initiate;
this->public.terminate_ike = (status_t(*)(controller_t*,u_int32_t,controller_cb_t, void*))terminate_ike;
this->public.terminate_child = (status_t(*)(controller_t*,u_int32_t,controller_cb_t, void *param))terminate_child;
this->public.destroy = (void (*)(controller_t*))destroy;
-
+
return &this->public;
}
diff --git a/src/charon/control/controller.h b/src/charon/control/controller.h
index 3c928d2ea..31b69c78c 100644
--- a/src/charon/control/controller.h
+++ b/src/charon/control/controller.h
@@ -95,7 +95,7 @@ struct controller_t {
* Terminate an IKE_SA and all of its CHILD_SAs.
*
* The terminate() function is synchronous and thus blocks until the
- * IKE_SA is properly deleted, or the delete timed out.
+ * IKE_SA is properly deleted, or the delete timed out.
* The terminate() function contains a thread cancellation point.
*
* @param unique_id unique id of the IKE_SA to terminate.
@@ -106,9 +106,9 @@ struct controller_t {
* - NOT_FOUND, if no such CHILD_SA found
* - NEED_MORE, if callback returned FALSE
*/
- status_t (*terminate_ike)(controller_t *this, u_int32_t unique_id,
+ status_t (*terminate_ike)(controller_t *this, u_int32_t unique_id,
controller_cb_t callback, void *param);
-
+
/**
* Terminate a CHILD_SA.
*
@@ -120,9 +120,9 @@ struct controller_t {
* - NOT_FOUND, if no such CHILD_SA found
* - NEED_MORE, if callback returned FALSE
*/
- status_t (*terminate_child)(controller_t *this, u_int32_t reqid,
+ status_t (*terminate_child)(controller_t *this, u_int32_t reqid,
controller_cb_t callback, void *param);
-
+
/**
* Destroy a controller_t instance.
*/
@@ -132,7 +132,7 @@ struct controller_t {
/**
* Creates a controller instance.
- *
+ *
* @return controller_t object
*/
controller_t *controller_create(void);
diff --git a/src/charon/credentials/credential_manager.c b/src/charon/credentials/credential_manager.c
index 0967cbc81..adea0b4be 100644
--- a/src/charon/credentials/credential_manager.c
+++ b/src/charon/credentials/credential_manager.c
@@ -13,12 +13,12 @@
* for more details.
*/
-#include <pthread.h>
-
#include "credential_manager.h"
#include <daemon.h>
-#include <utils/mutex.h>
+#include <threading/thread_value.h>
+#include <threading/mutex.h>
+#include <threading/rwlock.h>
#include <utils/linked_list.h>
#include <credentials/sets/cert_cache.h>
#include <credentials/sets/auth_cfg_wrapper.h>
@@ -28,8 +28,6 @@
#include <credentials/certificates/ocsp_request.h>
#include <credentials/certificates/ocsp_response.h>
-#define MAX_CA_LEVELS 6
-
typedef struct private_credential_manager_t private_credential_manager_t;
/**
@@ -41,31 +39,36 @@ struct private_credential_manager_t {
* public functions
*/
credential_manager_t public;
-
+
/**
* list of credential sets
*/
linked_list_t *sets;
-
+
/**
* thread local set of credentials, linked_list_t with credential_set_t's
*/
- pthread_key_t local_sets;
-
+ thread_value_t *local_sets;
+
/**
* trust relationship and certificate cache
*/
cert_cache_t *cache;
-
+
/**
* certificates queued for persistent caching
*/
linked_list_t *cache_queue;
-
+
/**
* read-write lock to sets list
*/
rwlock_t *lock;
+
+ /**
+ * mutex for cache queue
+ */
+ mutex_t *queue_mutex;
};
/** data to pass to create_private_enumerator */
@@ -149,12 +152,12 @@ static enumerator_t *create_sets_enumerator(private_credential_manager_t *this)
{
linked_list_t *local;
sets_enumerator_t *enumerator = malloc_thing(sets_enumerator_t);
-
+
enumerator->public.enumerate = (void*)sets_enumerator_enumerate;
enumerator->public.destroy = (void*)sets_enumerator_destroy;
enumerator->global = this->sets->create_enumerator(this->sets);
enumerator->local = NULL;
- local = pthread_getspecific(this->local_sets);
+ local = this->local_sets->get(this->local_sets);
if (local)
{
enumerator->local = local->create_enumerator(local);
@@ -176,7 +179,7 @@ static void destroy_cert_data(cert_data_t *data)
*/
static enumerator_t *create_cert(credential_set_t *set, cert_data_t *data)
{
- return set->create_cert_enumerator(set, data->cert, data->key,
+ return set->create_cert_enumerator(set, data->cert, data->key,
data->id, data->trusted);
}
@@ -193,7 +196,7 @@ static enumerator_t *create_cert_enumerator(private_credential_manager_t *this,
data->key = key;
data->id = id;
data->trusted = trusted;
-
+
this->lock->read_lock(this->lock);
return enumerator_create_nested(create_sets_enumerator(this),
(void*)create_cert, data,
@@ -209,7 +212,7 @@ static certificate_t *get_cert(private_credential_manager_t *this,
{
certificate_t *current, *found = NULL;
enumerator_t *enumerator;
-
+
enumerator = create_cert_enumerator(this, cert, key, id, trusted);
if (enumerator->enumerate(enumerator, &current))
{
@@ -247,7 +250,7 @@ static enumerator_t * create_cdp_enumerator(private_credential_manager_t *this,
data->this = this;
data->type = type;
data->id = id;
-
+
this->lock->read_lock(this->lock);
return enumerator_create_nested(create_sets_enumerator(this),
(void*)create_cdp, data,
@@ -276,10 +279,10 @@ static enumerator_t *create_private(credential_set_t *set, private_data_t *data)
*/
static enumerator_t* create_private_enumerator(
private_credential_manager_t *this,
- key_type_t key, identification_t *keyid)
+ key_type_t key, identification_t *keyid)
{
private_data_t *data;
-
+
data = malloc_thing(private_data_t);
data->this = this;
data->type = key;
@@ -292,13 +295,13 @@ static enumerator_t* create_private_enumerator(
/**
* Implementation of credential_manager_t.get_private_by_keyid.
- */
+ */
static private_key_t *get_private_by_keyid(private_credential_manager_t *this,
- key_type_t key, identification_t *keyid)
+ key_type_t key, identification_t *keyid)
{
private_key_t *found = NULL;
enumerator_t *enumerator;
-
+
enumerator = create_private_enumerator(this, key, keyid);
if (enumerator->enumerate(enumerator, &found))
{
@@ -328,7 +331,7 @@ static enumerator_t *create_shared(credential_set_t *set, shared_data_t *data)
/**
* Implementation of credential_manager_t.create_shared_enumerator.
*/
-static enumerator_t *create_shared_enumerator(private_credential_manager_t *this,
+static enumerator_t *create_shared_enumerator(private_credential_manager_t *this,
shared_key_type_t type,
identification_t *me, identification_t *other)
{
@@ -337,16 +340,16 @@ static enumerator_t *create_shared_enumerator(private_credential_manager_t *this
data->type = type;
data->me = me;
data->other = other;
-
+
this->lock->read_lock(this->lock);
return enumerator_create_nested(create_sets_enumerator(this),
- (void*)create_shared, data,
+ (void*)create_shared, data,
(void*)destroy_shared_data);
}
/**
* Implementation of credential_manager_t.get_shared.
- */
+ */
static shared_key_t *get_shared(private_credential_manager_t *this,
shared_key_type_t type, identification_t *me,
identification_t *other)
@@ -355,7 +358,7 @@ static shared_key_t *get_shared(private_credential_manager_t *this,
id_match_t *best_me = ID_MATCH_NONE, *best_other = ID_MATCH_NONE;
id_match_t *match_me, *match_other;
enumerator_t *enumerator;
-
+
enumerator = create_shared_enumerator(this, type, me, other);
while (enumerator->enumerate(enumerator, &current, &match_me, &match_other))
{
@@ -380,11 +383,11 @@ static void add_local_set(private_credential_manager_t *this,
{
linked_list_t *sets;
- sets = pthread_getspecific(this->local_sets);
+ sets = this->local_sets->get(this->local_sets);
if (!sets)
{ /* first invocation */
sets = linked_list_create();
- pthread_setspecific(this->local_sets, sets);
+ this->local_sets->set(this->local_sets, sets);
}
sets->insert_last(sets, set);
}
@@ -396,8 +399,8 @@ static void remove_local_set(private_credential_manager_t *this,
credential_set_t *set)
{
linked_list_t *sets;
-
- sets = pthread_getspecific(this->local_sets);
+
+ sets = this->local_sets->get(this->local_sets);
sets->remove(sets, set, NULL);
}
@@ -408,7 +411,7 @@ static void cache_cert(private_credential_manager_t *this, certificate_t *cert)
{
credential_set_t *set;
enumerator_t *enumerator;
-
+
if (this->lock->try_write_lock(this->lock))
{
enumerator = this->sets->create_enumerator(this->sets);
@@ -417,13 +420,14 @@ static void cache_cert(private_credential_manager_t *this, certificate_t *cert)
set->cache_cert(set, cert);
}
enumerator->destroy(enumerator);
+ this->lock->unlock(this->lock);
}
else
{ /* we can't cache now as other threads are active, queue for later */
- this->lock->read_lock(this->lock);
+ this->queue_mutex->lock(this->queue_mutex);
this->cache_queue->insert_last(this->cache_queue, cert->get_ref(cert));
+ this->queue_mutex->unlock(this->queue_mutex);
}
- this->lock->unlock(this->lock);
}
/**
@@ -434,7 +438,8 @@ static void cache_queue(private_credential_manager_t *this)
credential_set_t *set;
certificate_t *cert;
enumerator_t *enumerator;
-
+
+ this->queue_mutex->lock(this->queue_mutex);
if (this->cache_queue->get_count(this->cache_queue) > 0 &&
this->lock->try_write_lock(this->lock))
{
@@ -451,10 +456,11 @@ static void cache_queue(private_credential_manager_t *this)
}
this->lock->unlock(this->lock);
}
+ this->queue_mutex->unlock(this->queue_mutex);
}
/**
- * forward declaration
+ * forward declaration
*/
static enumerator_t *create_trusted_enumerator(private_credential_manager_t *this,
key_type_t type, identification_t *id, bool crl, bool ocsp);
@@ -467,7 +473,7 @@ static certificate_t *fetch_ocsp(private_credential_manager_t *this, char *url,
{
certificate_t *request, *response;
chunk_t send, receive;
-
+
/* TODO: requestor name, signature */
request = lib->creds->create(lib->creds,
CRED_CERTIFICATE, CERT_X509_OCSP_REQUEST,
@@ -478,12 +484,12 @@ static certificate_t *fetch_ocsp(private_credential_manager_t *this, char *url,
DBG1(DBG_CFG, "generating ocsp request failed");
return NULL;
}
-
+
send = request->get_encoding(request);
request->destroy(request);
DBG1(DBG_CFG, " requesting ocsp status from '%s' ...", url);
- if (lib->fetcher->fetch(lib->fetcher, url, &receive,
+ if (lib->fetcher->fetch(lib->fetcher, url, &receive,
FETCH_REQUEST_DATA, send,
FETCH_REQUEST_TYPE, "application/ocsp-request",
FETCH_END) != SUCCESS)
@@ -493,7 +499,7 @@ static certificate_t *fetch_ocsp(private_credential_manager_t *this, char *url,
return NULL;
}
chunk_free(&send);
-
+
response = lib->creds->create(lib->creds,
CRED_CERTIFICATE, CERT_X509_OCSP_RESPONSE,
BUILD_BLOB_ASN1_DER, receive, BUILD_END);
@@ -507,9 +513,9 @@ static certificate_t *fetch_ocsp(private_credential_manager_t *this, char *url,
}
/**
- * check the signature of an OCSP response
+ * check the signature of an OCSP response
*/
-static bool verify_ocsp(private_credential_manager_t *this,
+static bool verify_ocsp(private_credential_manager_t *this,
ocsp_response_t *response)
{
certificate_t *issuer, *subject;
@@ -520,7 +526,7 @@ static bool verify_ocsp(private_credential_manager_t *this,
wrapper = ocsp_response_wrapper_create((ocsp_response_t*)response);
add_local_set(this, &wrapper->set);
-
+
subject = &response->certificate;
responder = subject->get_issuer(subject);
enumerator = create_trusted_enumerator(this, KEY_ANY, responder, FALSE, FALSE);
@@ -529,13 +535,13 @@ static bool verify_ocsp(private_credential_manager_t *this,
if (this->cache->issued_by(this->cache, subject, issuer))
{
DBG1(DBG_CFG, " ocsp response correctly signed by \"%Y\"",
- issuer->get_subject(issuer));
+ issuer->get_subject(issuer));
verified = TRUE;
break;
}
}
enumerator->destroy(enumerator);
-
+
remove_local_set(this, &wrapper->set);
wrapper->destroy(wrapper);
return verified;
@@ -553,7 +559,7 @@ static certificate_t *get_better_ocsp(private_credential_manager_t *this,
time_t revocation, this_update, next_update, valid_until;
crl_reason_t reason;
bool revoked = FALSE;
-
+
response = (ocsp_response_t*)cand;
/* check ocsp signature */
@@ -570,7 +576,7 @@ static certificate_t *get_better_ocsp(private_credential_manager_t *this,
case VALIDATION_REVOKED:
/* subject has been revoked by a valid OCSP response */
DBG1(DBG_CFG, "certificate was revoked on %T, reason: %N",
- &revocation, TRUE, crl_reason_names, reason);
+ &revocation, TRUE, crl_reason_names, reason);
revoked = TRUE;
break;
case VALIDATION_GOOD:
@@ -622,14 +628,15 @@ static certificate_t *get_better_ocsp(private_credential_manager_t *this,
* validate a x509 certificate using OCSP
*/
static cert_validation_t check_ocsp(private_credential_manager_t *this,
- x509_t *subject, x509_t *issuer,
- auth_cfg_t *auth)
+ x509_t *subject, x509_t *issuer,
+ auth_cfg_t *auth)
{
enumerator_t *enumerator;
cert_validation_t valid = VALIDATION_SKIPPED;
certificate_t *best = NULL, *current;
identification_t *keyid = NULL;
public_key_t *public;
+ chunk_t chunk;
char *uri = NULL;
/** lookup cache for valid OCSP responses */
@@ -651,9 +658,9 @@ static cert_validation_t check_ocsp(private_credential_manager_t *this,
/* derive the authorityKeyIdentifier from the issuer's public key */
current = &issuer->interface;
public = current->get_public_key(current);
- if (public)
+ if (public && public->get_fingerprint(public, KEY_ID_PUBKEY_SHA1, &chunk))
{
- keyid = public->get_id(public, ID_PUBKEY_SHA1);
+ keyid = identification_create_from_encoding(ID_KEY_ID, chunk);
}
/** fetch from configured OCSP responder URLs */
if (keyid && valid != VALIDATION_GOOD && valid != VALIDATION_REVOKED)
@@ -676,6 +683,7 @@ static cert_validation_t check_ocsp(private_credential_manager_t *this,
enumerator->destroy(enumerator);
}
DESTROY_IF(public);
+ DESTROY_IF(keyid);
/* fallback to URL fetching from subject certificate's URIs */
if (valid != VALIDATION_GOOD && valid != VALIDATION_REVOKED)
@@ -721,7 +729,7 @@ static certificate_t* fetch_crl(private_credential_manager_t *this, char *url)
{
certificate_t *crl;
chunk_t chunk;
-
+
DBG1(DBG_CFG, " fetching crl from '%s' ...", url);
if (lib->fetcher->fetch(lib->fetcher, url, &chunk, FETCH_END) != SUCCESS)
{
@@ -747,7 +755,7 @@ static bool verify_crl(private_credential_manager_t *this, certificate_t *crl)
certificate_t *issuer;
enumerator_t *enumerator;
bool verified = FALSE;
-
+
enumerator = create_trusted_enumerator(this, KEY_ANY, crl->get_issuer(crl),
FALSE, FALSE);
while (enumerator->enumerate(enumerator, &issuer, NULL))
@@ -761,7 +769,7 @@ static bool verify_crl(private_credential_manager_t *this, certificate_t *crl)
}
}
enumerator->destroy(enumerator);
-
+
return verified;
}
@@ -786,7 +794,7 @@ static certificate_t *get_better_crl(private_credential_manager_t *this,
cand->destroy(cand);
return best;
}
-
+
crl = (crl_t*)cand;
enumerator = crl->create_enumerator(crl);
while (enumerator->enumerate(enumerator, &serial, &revocation, &reason))
@@ -835,7 +843,7 @@ static certificate_t *get_better_crl(private_credential_manager_t *this,
* validate a x509 certificate using CRL
*/
static cert_validation_t check_crl(private_credential_manager_t *this,
- x509_t *subject, x509_t *issuer,
+ x509_t *subject, x509_t *issuer,
auth_cfg_t *auth)
{
cert_validation_t valid = VALIDATION_SKIPPED;
@@ -844,20 +852,18 @@ static cert_validation_t check_crl(private_credential_manager_t *this,
certificate_t *current;
public_key_t *public;
enumerator_t *enumerator;
+ chunk_t chunk;
char *uri = NULL;
-
+
/* derive the authorityKeyIdentifier from the issuer's public key */
current = &issuer->interface;
public = current->get_public_key(current);
- if (public)
- {
- keyid = public->get_id(public, ID_PUBKEY_SHA1);
- }
-
- /* find a cached crl by authorityKeyIdentifier */
- if (keyid)
+ if (public && public->get_fingerprint(public, KEY_ID_PUBKEY_SHA1, &chunk))
{
- enumerator = create_cert_enumerator(this, CERT_X509_CRL, KEY_ANY,
+ keyid = identification_create_from_encoding(ID_KEY_ID, chunk);
+
+ /* find a cached crl by authorityKeyIdentifier */
+ enumerator = create_cert_enumerator(this, CERT_X509_CRL, KEY_ANY,
keyid, FALSE);
while (enumerator->enumerate(enumerator, &current))
{
@@ -871,27 +877,28 @@ static cert_validation_t check_crl(private_credential_manager_t *this,
}
}
enumerator->destroy(enumerator);
- }
- /* fallback to fetching crls from credential sets cdps */
- if (keyid && valid != VALIDATION_GOOD && valid != VALIDATION_REVOKED)
- {
- enumerator = create_cdp_enumerator(this, CERT_X509_CRL, keyid);
-
- while (enumerator->enumerate(enumerator, &uri))
+ /* fallback to fetching crls from credential sets cdps */
+ if (valid != VALIDATION_GOOD && valid != VALIDATION_REVOKED)
{
- current = fetch_crl(this, uri);
- if (current)
+ enumerator = create_cdp_enumerator(this, CERT_X509_CRL, keyid);
+
+ while (enumerator->enumerate(enumerator, &uri))
{
- best = get_better_crl(this, current, best, subject, issuer,
- &valid, TRUE);
- if (best && valid != VALIDATION_STALE)
+ current = fetch_crl(this, uri);
+ if (current)
{
- break;
+ best = get_better_crl(this, current, best, subject, issuer,
+ &valid, TRUE);
+ if (best && valid != VALIDATION_STALE)
+ {
+ break;
+ }
}
}
+ enumerator->destroy(enumerator);
}
- enumerator->destroy(enumerator);
+ keyid->destroy(keyid);
}
DESTROY_IF(public);
@@ -915,7 +922,7 @@ static cert_validation_t check_crl(private_credential_manager_t *this,
}
enumerator->destroy(enumerator);
}
-
+
/* an uri was found, but no result. switch validation state to failed */
if (valid == VALIDATION_SKIPPED && uri)
{
@@ -939,6 +946,60 @@ static cert_validation_t check_crl(private_credential_manager_t *this,
}
/**
+ * check a certificate for optional IP address block constraints
+ */
+static bool check_ip_addr_block_constraints(x509_t *subject, x509_t *issuer)
+{
+ bool subject_constraint = subject->get_flags(subject) & X509_IP_ADDR_BLOCKS;
+ bool issuer_constraint = issuer->get_flags(issuer) & X509_IP_ADDR_BLOCKS;
+ bool contained = TRUE;
+
+ enumerator_t *subject_enumerator, *issuer_enumerator;
+ traffic_selector_t *subject_ts, *issuer_ts;
+
+ if (!subject_constraint && !issuer_constraint)
+ {
+ return TRUE;
+ }
+ if (!subject_constraint)
+ {
+ DBG1(DBG_CFG, "subject certficate lacks ipAddrBlocks extension");
+ return FALSE;
+ }
+ if (!issuer_constraint)
+ {
+ DBG1(DBG_CFG, "issuer certficate lacks ipAddrBlocks extension");
+ return FALSE;
+ }
+ subject_enumerator = subject->create_ipAddrBlock_enumerator(subject);
+ while (subject_enumerator->enumerate(subject_enumerator, &subject_ts))
+ {
+ contained = FALSE;
+
+ issuer_enumerator = issuer->create_ipAddrBlock_enumerator(issuer);
+ while (issuer_enumerator->enumerate(issuer_enumerator, &issuer_ts))
+ {
+ if (subject_ts->is_contained_in(subject_ts, issuer_ts))
+ {
+ DBG2(DBG_CFG, " subject address block %R is contained in "
+ "issuer address block %R", subject_ts, issuer_ts);
+ contained = TRUE;
+ break;
+ }
+ }
+ issuer_enumerator->destroy(issuer_enumerator);
+ if (!contained)
+ {
+ DBG1(DBG_CFG, "subject address block %R is not contained in any "
+ "issuer address block", subject_ts);
+ break;
+ }
+ }
+ subject_enumerator->destroy(subject_enumerator);
+ return contained;
+}
+
+/**
* check a certificate for its lifetime
*/
static bool check_certificate(private_credential_manager_t *this,
@@ -946,22 +1007,26 @@ static bool check_certificate(private_credential_manager_t *this,
bool crl, bool ocsp, auth_cfg_t *auth)
{
time_t not_before, not_after;
-
+
if (!subject->get_validity(subject, NULL, &not_before, &not_after))
{
DBG1(DBG_CFG, "subject certificate invalid (valid from %T to %T)",
- &not_before, TRUE, &not_after, TRUE);
+ &not_before, FALSE, &not_after, FALSE);
return FALSE;
}
if (!issuer->get_validity(issuer, NULL, &not_before, &not_after))
{
DBG1(DBG_CFG, "issuer certificate invalid (valid from %T to %T)",
- &not_before, TRUE, &not_after, TRUE);
+ &not_before, FALSE, &not_after, FALSE);
return FALSE;
}
if (issuer->get_type(issuer) == CERT_X509 &&
subject->get_type(subject) == CERT_X509)
{
+ if (!check_ip_addr_block_constraints((x509_t*)subject, (x509_t*)issuer))
+ {
+ return FALSE;
+ }
if (ocsp || crl)
{
DBG1(DBG_CFG, "checking certificate status of \"%Y\"",
@@ -1019,7 +1084,7 @@ static certificate_t *get_pretrusted_cert(private_credential_manager_t *this,
{
certificate_t *subject;
public_key_t *public;
-
+
subject = get_cert(this, CERT_ANY, type, id, TRUE);
if (!subject)
{
@@ -1043,8 +1108,8 @@ static certificate_t *get_issuer_cert(private_credential_manager_t *this,
{
enumerator_t *enumerator;
certificate_t *issuer = NULL, *candidate;
-
- enumerator = create_cert_enumerator(this, subject->get_type(subject), KEY_ANY,
+
+ enumerator = create_cert_enumerator(this, subject->get_type(subject), KEY_ANY,
subject->get_issuer(subject), trusted);
while (enumerator->enumerate(enumerator, &candidate))
{
@@ -1066,12 +1131,14 @@ static bool verify_trust_chain(private_credential_manager_t *this,
bool trusted, bool crl, bool ocsp)
{
certificate_t *current, *issuer;
+ x509_t *x509;
auth_cfg_t *auth;
- u_int level = 0;
-
+ int pathlen, pathlen_constraint;
+
auth = auth_cfg_create();
current = subject->get_ref(subject);
- while (level++ < MAX_CA_LEVELS)
+
+ for (pathlen = 0; pathlen <= X509_MAX_PATH_LEN; pathlen++)
{
issuer = get_issuer_cert(this, current, TRUE);
if (issuer)
@@ -1081,7 +1148,7 @@ static bool verify_trust_chain(private_credential_manager_t *this,
{
auth->add(auth, AUTH_RULE_CA_CERT, issuer->get_ref(issuer));
DBG1(DBG_CFG, " using trusted ca certificate \"%Y\"",
- issuer->get_subject(issuer));
+ issuer->get_subject(issuer));
trusted = TRUE;
}
else
@@ -1109,7 +1176,7 @@ static bool verify_trust_chain(private_credential_manager_t *this,
}
else
{
- DBG1(DBG_CFG, "no issuer certificate found for \"%Y\"",
+ DBG1(DBG_CFG, "no issuer certificate found for \"%Y\"",
current->get_subject(current));
break;
}
@@ -1121,17 +1188,32 @@ static bool verify_trust_chain(private_credential_manager_t *this,
issuer->destroy(issuer);
break;
}
+
+ /* check path length constraint */
+ x509 = (x509_t*)issuer;
+ pathlen_constraint = x509->get_pathLenConstraint(x509);
+ if (pathlen_constraint != X509_NO_PATH_LEN_CONSTRAINT &&
+ pathlen > pathlen_constraint)
+ {
+ DBG1(DBG_CFG, "path length of %d violates constraint of %d",
+ pathlen, pathlen_constraint);
+ trusted = FALSE;
+ issuer->destroy(issuer);
+ break;
+ }
current->destroy(current);
current = issuer;
if (trusted)
{
+ DBG1(DBG_CFG, " reached self-signed root ca with a path length of %d",
+ pathlen);
break;
}
}
current->destroy(current);
- if (level > MAX_CA_LEVELS)
+ if (pathlen > X509_MAX_PATH_LEN)
{
- DBG1(DBG_CFG, "maximum ca path length of %d levels reached", level);
+ DBG1(DBG_CFG, "maximum path length of %d exceeded", X509_MAX_PATH_LEN);
}
if (trusted)
{
@@ -1172,10 +1254,10 @@ static bool trusted_enumerate(trusted_enumerator_t *this,
certificate_t **cert, auth_cfg_t **auth)
{
certificate_t *current;
-
+
DESTROY_IF(this->auth);
this->auth = auth_cfg_create();
-
+
if (!this->candidates)
{
/* first invocation, build enumerator for next one */
@@ -1186,7 +1268,7 @@ static bool trusted_enumerate(trusted_enumerator_t *this,
if (this->pretrusted)
{
/* if we find a trusted self signed certificate, we just accept it.
- * However, in order to fulfill authorization rules, we try to build
+ * However, in order to fulfill authorization rules, we try to build
* the trust chain if it is not self signed */
if (this->this->cache->issued_by(this->this->cache,
this->pretrusted, this->pretrusted) ||
@@ -1214,7 +1296,7 @@ static bool trusted_enumerate(trusted_enumerator_t *this,
{ /* skip pretrusted certificate we already served */
continue;
}
-
+
DBG1(DBG_CFG, " using certificate \"%Y\"",
current->get_subject(current));
if (verify_trust_chain(this->this, current, this->auth, FALSE,
@@ -1249,10 +1331,10 @@ static enumerator_t *create_trusted_enumerator(private_credential_manager_t *thi
key_type_t type, identification_t *id, bool crl, bool ocsp)
{
trusted_enumerator_t *enumerator = malloc_thing(trusted_enumerator_t);
-
+
enumerator->public.enumerate = (void*)trusted_enumerate;
enumerator->public.destroy = (void*)trusted_destroy;
-
+
enumerator->candidates = NULL;
enumerator->this = this;
enumerator->type = type;
@@ -1261,7 +1343,7 @@ static enumerator_t *create_trusted_enumerator(private_credential_manager_t *thi
enumerator->ocsp = ocsp;
enumerator->pretrusted = NULL;
enumerator->auth = NULL;
-
+
return &enumerator->public;
}
@@ -1288,7 +1370,7 @@ static bool public_enumerate(public_enumerator_t *this,
public_key_t **key, auth_cfg_t **auth)
{
certificate_t *cert;
-
+
while (this->inner->enumerate(this->inner, &cert, auth))
{
DESTROY_IF(this->current);
@@ -1315,7 +1397,7 @@ static void public_destroy(public_enumerator_t *this)
this->wrapper->destroy(this->wrapper);
}
this->this->lock->unlock(this->this->lock);
-
+
/* check for delayed certificate cache queue */
cache_queue(this->this);
free(this);
@@ -1328,7 +1410,7 @@ static enumerator_t* create_public_enumerator(private_credential_manager_t *this
key_type_t type, identification_t *id, auth_cfg_t *auth)
{
public_enumerator_t *enumerator = malloc_thing(public_enumerator_t);
-
+
enumerator->public.enumerate = (void*)public_enumerate;
enumerator->public.destroy = (void*)public_destroy;
enumerator->inner = create_trusted_enumerator(this, type, id, TRUE, TRUE);
@@ -1373,13 +1455,13 @@ static bool auth_contains_cacert(auth_cfg_t *auth, certificate_t *cert)
*/
static auth_cfg_t *build_trustchain(private_credential_manager_t *this,
certificate_t *subject, auth_cfg_t *auth)
-{
+{
certificate_t *issuer, *current;
auth_cfg_t *trustchain;
- u_int level = 0;
-
+ int pathlen = 0;
+
trustchain = auth_cfg_create();
-
+
current = auth->get(auth, AUTH_RULE_CA_CERT);
if (!current)
{
@@ -1405,13 +1487,14 @@ static auth_cfg_t *build_trustchain(private_credential_manager_t *this,
trustchain->add(trustchain, AUTH_RULE_IM_CERT, current);
}
issuer = get_issuer_cert(this, current, FALSE);
- if (!issuer || issuer->equals(issuer, current) || level > MAX_CA_LEVELS)
+ if (!issuer || issuer->equals(issuer, current) ||
+ pathlen > X509_MAX_PATH_LEN)
{
DESTROY_IF(issuer);
break;
}
current = issuer;
- level++;
+ pathlen++;
}
trustchain->destroy(trustchain);
return NULL;
@@ -1424,16 +1507,18 @@ static private_key_t *get_private_by_cert(private_credential_manager_t *this,
certificate_t *cert, key_type_t type)
{
private_key_t *private = NULL;
- identification_t* keyid;
+ identification_t *keyid;
+ chunk_t chunk;
public_key_t *public;
public = cert->get_public_key(cert);
if (public)
{
- keyid = public->get_id(public, ID_PUBKEY_INFO_SHA1);
- if (keyid)
+ if (public->get_fingerprint(public, KEY_ID_PUBKEY_SHA1, &chunk))
{
+ keyid = identification_create_from_encoding(ID_KEY_ID, chunk);
private = get_private_by_keyid(this, type, keyid);
+ keyid->destroy(keyid);
}
public->destroy(public);
}
@@ -1451,18 +1536,14 @@ static private_key_t *get_private(private_credential_manager_t *this,
certificate_t *cert;
private_key_t *private = NULL;
auth_cfg_t *trustchain;
-
+
/* check if this is a lookup by key ID, and do it if so */
- if (id)
+ if (id && id->get_type(id) == ID_KEY_ID)
{
- switch (id->get_type(id))
+ private = get_private_by_keyid(this, type, id);
+ if (private)
{
- case ID_PUBKEY_SHA1:
- case ID_PUBKEY_INFO_SHA1:
- case ID_KEY_ID:
- return get_private_by_keyid(this, type, id);
- default:
- break;
+ return private;
}
}
@@ -1482,7 +1563,7 @@ static private_key_t *get_private(private_credential_manager_t *this,
return private;
}
}
-
+
/* try to build a trust chain for each certificate found */
enumerator = create_cert_enumerator(this, CERT_ANY, type, id, FALSE);
while (enumerator->enumerate(enumerator, &cert))
@@ -1560,9 +1641,10 @@ static void destroy(private_credential_manager_t *this)
this->cache_queue->destroy(this->cache_queue);
this->sets->remove(this->sets, this->cache, NULL);
this->sets->destroy(this->sets);
- pthread_key_delete(this->local_sets);
+ this->local_sets->destroy(this->local_sets);
this->cache->destroy(this->cache);
this->lock->destroy(this->lock);
+ this->queue_mutex->destroy(this->queue_mutex);
free(this);
}
@@ -1572,7 +1654,7 @@ static void destroy(private_credential_manager_t *this)
credential_manager_t *credential_manager_create()
{
private_credential_manager_t *this = malloc_thing(private_credential_manager_t);
-
+
this->public.create_cert_enumerator = (enumerator_t *(*)(credential_manager_t *this,certificate_type_t cert, key_type_t key,identification_t *id,bool))create_cert_enumerator;
this->public.create_shared_enumerator = (enumerator_t *(*)(credential_manager_t *this, shared_key_type_t type,identification_t *me, identification_t *other))create_shared_enumerator;
this->public.create_cdp_enumerator = (enumerator_t *(*)(credential_manager_t*, certificate_type_t type, identification_t *id))create_cdp_enumerator;
@@ -1585,14 +1667,15 @@ credential_manager_t *credential_manager_create()
this->public.add_set = (void(*)(credential_manager_t*, credential_set_t *set))add_set;
this->public.remove_set = (void(*)(credential_manager_t*, credential_set_t *set))remove_set;
this->public.destroy = (void(*)(credential_manager_t*))destroy;
-
+
this->sets = linked_list_create();
- pthread_key_create(&this->local_sets, (void*)this->sets->destroy);
+ this->local_sets = thread_value_create((thread_cleanup_t)this->sets->destroy);
this->cache = cert_cache_create();
this->cache_queue = linked_list_create();
this->sets->insert_first(this->sets, this->cache);
this->lock = rwlock_create(RWLOCK_TYPE_DEFAULT);
-
+ this->queue_mutex = mutex_create(MUTEX_TYPE_DEFAULT);
+
return &this->public;
}
diff --git a/src/charon/credentials/credential_manager.h b/src/charon/credentials/credential_manager.h
index 0af54c0b1..0448da992 100644
--- a/src/charon/credentials/credential_manager.h
+++ b/src/charon/credentials/credential_manager.h
@@ -36,11 +36,11 @@ typedef struct credential_manager_t credential_manager_t;
*
* The credential manager is the entry point of the credential framework. It
* uses so called "sets" to access credentials in a modular fashion, these
- * are implemented through the credential_set_t interface.
+ * are implemented through the credential_set_t interface.
* The manager additionally does trust chain verification and trust status
* chaching. A set may call the managers methods if it needs credentials itself,
* the manager uses recursive locking.
- *
+ *
* @verbatim
+-------+ +----------------+
@@ -58,14 +58,14 @@ typedef struct credential_manager_t credential_manager_t;
| o | may be recursive
| r |
+-------+
-
- @endverbatim
+
+ @endverbatim
*
* The credential manager uses rwlocks for performance reasons, credential
* sets must be fully thread save.
*/
struct credential_manager_t {
-
+
/**
* Create an enumerator over all certificates.
*
@@ -90,7 +90,7 @@ struct credential_manager_t {
* @param second second subject between key is shared
* @return enumerator over shared keys
*/
- enumerator_t *(*create_shared_enumerator)(credential_manager_t *this,
+ enumerator_t *(*create_shared_enumerator)(credential_manager_t *this,
shared_key_type_t type,
identification_t *first, identification_t *second);
/**
@@ -121,14 +121,14 @@ struct credential_manager_t {
* @param me own identity
* @param other peers identity
* @return shared_key_t, NULL if none found
- */
+ */
shared_key_t *(*get_shared)(credential_manager_t *this, shared_key_type_t type,
identification_t *me, identification_t *other);
/**
* Get a private key to create a signature.
*
* The get_private() method gets a secret private key identified by either
- * the keyid itself or an id the key belongs to.
+ * the keyid itself or an id the key belongs to.
* The auth parameter contains additional information, such as receipients
* trusted CA certs. Auth gets filled with subject and CA certificates
* needed to validate a created signature.
@@ -140,12 +140,12 @@ struct credential_manager_t {
*/
private_key_t* (*get_private)(credential_manager_t *this, key_type_t type,
identification_t *id, auth_cfg_t *auth);
-
+
/**
* Create an enumerator over trusted public keys.
*
* This method gets a an enumerator over trusted public keys to verify a
- * signature created by id. The auth parameter contains additional
+ * signature created by id. The auth parameter contains additional
* authentication infos, e.g. peer and intermediate certificates.
* The resulting enumerator enumerates over public_key_t *, auth_cfg_t *,
* where the auth config helper contains rules for constraint checks.
@@ -157,14 +157,14 @@ struct credential_manager_t {
*/
enumerator_t* (*create_public_enumerator)(credential_manager_t *this,
key_type_t type, identification_t *id, auth_cfg_t *auth);
-
+
/**
* Cache a certificate by invoking cache_cert() on all registerd sets.
*
* @param cert certificate to cache
*/
void (*cache_cert)(credential_manager_t *this, certificate_t *cert);
-
+
/**
* Flush the certificate cache.
*
@@ -174,25 +174,25 @@ struct credential_manager_t {
* @param type type of certificate to flush, or CERT_ANY
*/
void (*flush_cache)(credential_manager_t *this, certificate_type_t type);
-
+
/**
* Register a credential set to the manager.
*
* @param set set to register
*/
void (*add_set)(credential_manager_t *this, credential_set_t *set);
-
+
/**
* Unregister a credential set from the manager.
*
* @param set set to unregister
*/
void (*remove_set)(credential_manager_t *this, credential_set_t *set);
-
+
/**
- * Destroy a credential_manager instance.
- */
- void (*destroy)(credential_manager_t *this);
+ * Destroy a credential_manager instance.
+ */
+ void (*destroy)(credential_manager_t *this);
};
/**
diff --git a/src/charon/credentials/credential_set.h b/src/charon/credentials/credential_set.h
index e9ad99bfd..274eb3feb 100644
--- a/src/charon/credentials/credential_set.h
+++ b/src/charon/credentials/credential_set.h
@@ -43,12 +43,12 @@ typedef struct credential_set_t credential_set_t;
* enumerator is alive, so it is save to use a write lock there.
*/
struct credential_set_t {
-
+
/**
* Create an enumerator over private keys (private_key_t).
*
* The id is either a key identifier of the requested key, or an identity
- * of the key owner.
+ * of the key owner.
*
* @param type type of requested private key
* @param id key identifier/owner
@@ -80,10 +80,10 @@ struct credential_set_t {
* @param other other identity who owns that secret
* @return enumerator as described above
*/
- enumerator_t *(*create_shared_enumerator)(credential_set_t *this,
+ enumerator_t *(*create_shared_enumerator)(credential_set_t *this,
shared_key_type_t type,
identification_t *me, identification_t *other);
-
+
/**
* Create an enumerator over certificate distribution points.
*
@@ -93,7 +93,7 @@ struct credential_set_t {
*/
enumerator_t *(*create_cdp_enumerator)(credential_set_t *this,
certificate_type_t type, identification_t *id);
-
+
/**
* Cache a certificate in the credential set.
*
@@ -102,7 +102,7 @@ struct credential_set_t {
*
* @param cert certificate to cache
*/
- void (*cache_cert)(credential_set_t *this, certificate_t *cert);
+ void (*cache_cert)(credential_set_t *this, certificate_t *cert);
};
#endif /** CREDENTIAL_SET_H_ @}*/
diff --git a/src/charon/credentials/sets/auth_cfg_wrapper.c b/src/charon/credentials/sets/auth_cfg_wrapper.c
index b2cf5d960..82e33d283 100644
--- a/src/charon/credentials/sets/auth_cfg_wrapper.c
+++ b/src/charon/credentials/sets/auth_cfg_wrapper.c
@@ -29,7 +29,7 @@ struct private_auth_cfg_wrapper_t {
* public functions
*/
auth_cfg_wrapper_t public;
-
+
/**
* wrapped auth info
*/
@@ -67,10 +67,10 @@ static bool fetch_cert(wrapper_enumerator_t *enumerator,
/* fetching the certificate previously failed */
return FALSE;
}
-
+
chunk_t data;
certificate_t *cert;
-
+
DBG1(DBG_CFG, " fetching certificate from '%s' ...", url);
if (lib->fetcher->fetch(lib->fetcher, url, &data, FETCH_END) != SUCCESS)
{
@@ -80,11 +80,11 @@ static bool fetch_cert(wrapper_enumerator_t *enumerator,
*rule, NULL);
return FALSE;
}
-
+
cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
BUILD_BLOB_ASN1_DER, data, BUILD_END);
free(data.ptr);
-
+
if (!cert)
{
DBG1(DBG_CFG, " parsing fetched certificate failed");
@@ -93,10 +93,10 @@ static bool fetch_cert(wrapper_enumerator_t *enumerator,
*rule, NULL);
return FALSE;
}
-
+
DBG1(DBG_CFG, " fetched certificate \"%Y\"", cert->get_subject(cert));
charon->credentials->cache_cert(charon->credentials, cert);
-
+
if (*rule == AUTH_HELPER_IM_HASH_URL)
{
*rule = AUTH_HELPER_IM_CERT;
@@ -174,11 +174,11 @@ static void wrapper_enumerator_destroy(wrapper_enumerator_t *this)
* implementation of auth_cfg_wrapper_t.set.create_cert_enumerator
*/
static enumerator_t *create_enumerator(private_auth_cfg_wrapper_t *this,
- certificate_type_t cert, key_type_t key,
+ certificate_type_t cert, key_type_t key,
identification_t *id, bool trusted)
{
wrapper_enumerator_t *enumerator;
-
+
if (trusted)
{
return NULL;
@@ -208,16 +208,16 @@ static void destroy(private_auth_cfg_wrapper_t *this)
auth_cfg_wrapper_t *auth_cfg_wrapper_create(auth_cfg_t *auth)
{
private_auth_cfg_wrapper_t *this = malloc_thing(private_auth_cfg_wrapper_t);
-
+
this->public.set.create_private_enumerator = (void*)return_null;
this->public.set.create_cert_enumerator = (void*)create_enumerator;
this->public.set.create_shared_enumerator = (void*)return_null;
this->public.set.create_cdp_enumerator = (void*)return_null;
this->public.set.cache_cert = (void*)nop;
this->public.destroy = (void(*)(auth_cfg_wrapper_t*))destroy;
-
+
this->auth = auth;
-
+
return &this->public;
}
diff --git a/src/charon/credentials/sets/auth_cfg_wrapper.h b/src/charon/credentials/sets/auth_cfg_wrapper.h
index dd5e0fff6..7653fcdbf 100644
--- a/src/charon/credentials/sets/auth_cfg_wrapper.h
+++ b/src/charon/credentials/sets/auth_cfg_wrapper.h
@@ -35,11 +35,11 @@ struct auth_cfg_wrapper_t {
* implements credential_set_t
*/
credential_set_t set;
-
+
/**
- * Destroy a auth_cfg_wrapper instance.
- */
- void (*destroy)(auth_cfg_wrapper_t *this);
+ * Destroy a auth_cfg_wrapper instance.
+ */
+ void (*destroy)(auth_cfg_wrapper_t *this);
};
/**
diff --git a/src/charon/credentials/sets/cert_cache.c b/src/charon/credentials/sets/cert_cache.c
index dee0463e6..176accce2 100644
--- a/src/charon/credentials/sets/cert_cache.c
+++ b/src/charon/credentials/sets/cert_cache.c
@@ -19,7 +19,7 @@
#include <sched.h>
#include <daemon.h>
-#include <utils/mutex.h>
+#include <threading/rwlock.h>
#include <utils/linked_list.h>
/** cache size, a power of 2 for fast modulo */
@@ -35,22 +35,22 @@ typedef struct relation_t relation_t;
* A trusted relation between subject and issuer
*/
struct relation_t {
-
+
/**
* subject of this relation
*/
certificate_t *subject;
-
+
/**
* issuer of this relation
*/
certificate_t *issuer;
-
+
/**
* Cache hits
*/
u_int hits;
-
+
/**
* Lock for this relation
*/
@@ -61,12 +61,12 @@ struct relation_t {
* private data of cert_cache
*/
struct private_cert_cache_t {
-
+
/**
* public functions
*/
cert_cache_t public;
-
+
/**
* array of trusted subject-issuer relations
*/
@@ -82,12 +82,12 @@ static void cache(private_cert_cache_t *this,
relation_t *rel;
int i, offset, try;
u_int total_hits = 0;
-
+
/* check for a unused relation slot first */
for (i = 0; i < CACHE_SIZE; i++)
{
rel = &this->relations[i];
-
+
if (!rel->subject && rel->lock->try_write_lock(rel->lock))
{
/* double-check having lock */
@@ -109,7 +109,7 @@ static void cache(private_cert_cache_t *this,
for (i = 0; i < CACHE_SIZE; i++)
{
rel = &this->relations[(i + offset) % CACHE_SIZE];
-
+
if (rel->hits > total_hits / CACHE_SIZE)
{ /* skip often used slots */
continue;
@@ -140,11 +140,11 @@ static bool issued_by(private_cert_cache_t *this,
{
relation_t *found = NULL, *current;
int i;
-
+
for (i = 0; i < CACHE_SIZE; i++)
{
current = &this->relations[i];
-
+
current->lock->read_lock(current->lock);
if (current->subject)
{
@@ -203,14 +203,14 @@ static bool cert_enumerate(cert_enumerator_t *this, certificate_t **out)
{
public_key_t *public;
relation_t *rel;
-
+
if (this->locked >= 0)
{
rel = &this->relations[this->locked];
rel->lock->unlock(rel->lock);
this->locked = -1;
}
-
+
while (++this->index < CACHE_SIZE)
{
rel = &this->relations[this->index];
@@ -219,7 +219,7 @@ static bool cert_enumerate(cert_enumerator_t *this, certificate_t **out)
if (rel->subject)
{
/* CRL lookup is done using issuer/authkeyidentifier */
- if (this->key == KEY_ANY && this->id &&
+ if (this->key == KEY_ANY && this->id &&
(this->cert == CERT_ANY || this->cert == CERT_X509_CRL) &&
rel->subject->get_type(rel->subject) == CERT_X509_CRL &&
rel->subject->has_issuer(rel->subject, this->id))
@@ -261,7 +261,7 @@ static bool cert_enumerate(cert_enumerator_t *this, certificate_t **out)
static void cert_enumerator_destroy(cert_enumerator_t *this)
{
relation_t *rel;
-
+
if (this->locked >= 0)
{
rel = &this->relations[this->locked];
@@ -274,11 +274,11 @@ static void cert_enumerator_destroy(cert_enumerator_t *this)
* implementation of credential_set_t.create_cert_enumerator
*/
static enumerator_t *create_enumerator(private_cert_cache_t *this,
- certificate_type_t cert, key_type_t key,
+ certificate_type_t cert, key_type_t key,
identification_t *id, bool trusted)
{
cert_enumerator_t *enumerator;
-
+
if (trusted)
{
return NULL;
@@ -292,7 +292,7 @@ static enumerator_t *create_enumerator(private_cert_cache_t *this,
enumerator->relations = this->relations;
enumerator->index = -1;
enumerator->locked = -1;
-
+
return &enumerator->public;
}
@@ -303,7 +303,7 @@ static void flush(private_cert_cache_t *this, certificate_type_t type)
{
relation_t *rel;
int i;
-
+
for (i = 0; i < CACHE_SIZE; i++)
{
rel = &this->relations[i];
@@ -346,7 +346,7 @@ static void destroy(private_cert_cache_t *this)
{
relation_t *rel;
int i;
-
+
for (i = 0; i < CACHE_SIZE; i++)
{
rel = &this->relations[i];
@@ -367,7 +367,7 @@ cert_cache_t *cert_cache_create()
{
private_cert_cache_t *this;
int i;
-
+
this = malloc_thing(private_cert_cache_t);
this->public.set.create_private_enumerator = (void*)return_null;
this->public.set.create_cert_enumerator = (void*)create_enumerator;
@@ -377,7 +377,7 @@ cert_cache_t *cert_cache_create()
this->public.issued_by = (bool(*)(cert_cache_t*, certificate_t *subject, certificate_t *issuer))issued_by;
this->public.flush = (void(*)(cert_cache_t*, certificate_type_t type))flush;
this->public.destroy = (void(*)(cert_cache_t*))destroy;
-
+
for (i = 0; i < CACHE_SIZE; i++)
{
this->relations[i].subject = NULL;
diff --git a/src/charon/credentials/sets/cert_cache.h b/src/charon/credentials/sets/cert_cache.h
index a2cae367c..d2721866e 100644
--- a/src/charon/credentials/sets/cert_cache.h
+++ b/src/charon/credentials/sets/cert_cache.h
@@ -39,7 +39,7 @@ struct cert_cache_t {
* Implements credential_set_t.
*/
credential_set_t set;
-
+
/**
* Caching wrapper around certificate_t.issued_by.
*
@@ -49,14 +49,14 @@ struct cert_cache_t {
*/
bool (*issued_by)(cert_cache_t *this,
certificate_t *subject, certificate_t *issuer);
-
+
/**
* Flush the certificate cache.
*
* @param type type of certificate to flush, or CERT_ANY
*/
void (*flush)(cert_cache_t *this, certificate_type_t type);
-
+
/**
* Destroy a cert_cache instance.
*/
diff --git a/src/charon/credentials/sets/ocsp_response_wrapper.c b/src/charon/credentials/sets/ocsp_response_wrapper.c
index e9faec472..82079209a 100644
--- a/src/charon/credentials/sets/ocsp_response_wrapper.c
+++ b/src/charon/credentials/sets/ocsp_response_wrapper.c
@@ -26,7 +26,7 @@ struct private_ocsp_response_wrapper_t {
* public functions
*/
ocsp_response_wrapper_t public;
-
+
/**
* wrapped OCSP response
*/
@@ -98,16 +98,16 @@ static void enumerator_destroy(wrapper_enumerator_t *this)
* implementation of ocsp_response_wrapper_t.set.create_cert_enumerator
*/
static enumerator_t *create_enumerator(private_ocsp_response_wrapper_t *this,
- certificate_type_t cert, key_type_t key,
+ certificate_type_t cert, key_type_t key,
identification_t *id, bool trusted)
{
wrapper_enumerator_t *enumerator;
-
+
if (trusted)
{
return NULL;
}
-
+
enumerator = malloc_thing(wrapper_enumerator_t);
enumerator->cert = cert;
enumerator->key = key;
@@ -132,16 +132,16 @@ static void destroy(private_ocsp_response_wrapper_t *this)
ocsp_response_wrapper_t *ocsp_response_wrapper_create(ocsp_response_t *response)
{
private_ocsp_response_wrapper_t *this = malloc_thing(private_ocsp_response_wrapper_t);
-
+
this->public.set.create_private_enumerator = (void*)return_null;
this->public.set.create_cert_enumerator = (void*)create_enumerator;
this->public.set.create_shared_enumerator = (void*)return_null;
this->public.set.create_cdp_enumerator = (void*)return_null;
this->public.set.cache_cert = (void*)nop;
this->public.destroy = (void(*)(ocsp_response_wrapper_t*))destroy;
-
+
this->response = response;
-
+
return &this->public;
}
diff --git a/src/charon/credentials/sets/ocsp_response_wrapper.h b/src/charon/credentials/sets/ocsp_response_wrapper.h
index 8f141f7a1..dc4b451df 100644
--- a/src/charon/credentials/sets/ocsp_response_wrapper.h
+++ b/src/charon/credentials/sets/ocsp_response_wrapper.h
@@ -35,11 +35,11 @@ struct ocsp_response_wrapper_t {
* implements credential_set_t
*/
credential_set_t set;
-
+
/**
- * Destroy a ocsp_response_wrapper instance.
- */
- void (*destroy)(ocsp_response_wrapper_t *this);
+ * Destroy a ocsp_response_wrapper instance.
+ */
+ void (*destroy)(ocsp_response_wrapper_t *this);
};
/**
diff --git a/src/charon/daemon.c b/src/charon/daemon.c
index 0689c448e..e71225fd1 100644
--- a/src/charon/daemon.c
+++ b/src/charon/daemon.c
@@ -1,4 +1,4 @@
-/*
+/*
* Copyright (C) 2006-2009 Tobias Brunner
* Copyright (C) 2005-2009 Martin Willi
* Copyright (C) 2006 Daniel Roethlisberger
@@ -41,7 +41,8 @@
#include <library.h>
#include <utils/backtrace.h>
-#include <config/traffic_selector.h>
+#include <threading/thread.h>
+#include <selectors/traffic_selector.h>
#include <config/proposal.h>
#ifndef LOG_AUTHPRIV /* not defined on OpenSolaris */
@@ -58,12 +59,17 @@ struct private_daemon_t {
* Public members of daemon_t.
*/
daemon_t public;
-
+
/**
* Signal set used for signal handling.
*/
sigset_t signal_set;
+ /**
+ * Reference to main thread.
+ */
+ thread_t *main_thread;
+
#ifdef CAPABILITIES
/**
* capabilities to keep
@@ -88,7 +94,7 @@ extern void (*dbg) (int level, char *fmt, ...);
static void dbg_bus(int level, char *fmt, ...)
{
va_list args;
-
+
va_start(args, fmt);
charon->bus->vlog(charon->bus, DBG_LIB, level, fmt, args);
va_end(args);
@@ -100,7 +106,7 @@ static void dbg_bus(int level, char *fmt, ...)
static void dbg_stderr(int level, char *fmt, ...)
{
va_list args;
-
+
if (level <= 1)
{
va_start(args, fmt);
@@ -117,18 +123,19 @@ static void dbg_stderr(int level, char *fmt, ...)
static void run(private_daemon_t *this)
{
sigset_t set;
-
+
/* handle SIGINT, SIGHUP ans SIGTERM in this handler */
sigemptyset(&set);
- sigaddset(&set, SIGINT);
- sigaddset(&set, SIGHUP);
+ sigaddset(&set, SIGINT);
+ sigaddset(&set, SIGHUP);
sigaddset(&set, SIGTERM);
-
+ sigprocmask(SIG_BLOCK, &set, NULL);
+
while (TRUE)
{
int sig;
int error;
-
+
error = sigwait(&set, &sig);
if (error)
{
@@ -145,11 +152,13 @@ static void run(private_daemon_t *this)
case SIGINT:
{
DBG1(DBG_DMN, "signal of type SIGINT received. Shutting down");
+ charon->bus->alert(charon->bus, ALERT_SHUTDOWN_SIGNAL, sig);
return;
}
case SIGTERM:
{
DBG1(DBG_DMN, "signal of type SIGTERM received. Shutting down");
+ charon->bus->alert(charon->bus, ALERT_SHUTDOWN_SIGNAL, sig);
return;
}
default:
@@ -193,14 +202,13 @@ static void destroy(private_daemon_t *this)
DESTROY_IF(this->public.mediation_manager);
#endif /* ME */
DESTROY_IF(this->public.backends);
- DESTROY_IF(this->public.attributes);
DESTROY_IF(this->public.credentials);
DESTROY_IF(this->public.sender);
DESTROY_IF(this->public.receiver);
DESTROY_IF(this->public.socket);
/* wait until all threads are gone */
DESTROY_IF(this->public.processor);
-
+
/* rehook library logging, shutdown logging */
dbg = dbg_stderr;
DESTROY_IF(this->public.bus);
@@ -225,7 +233,7 @@ static void kill_daemon(private_daemon_t *this, char *reason)
{
fprintf(stderr, "killing daemon: %s\n", reason);
}
- if (this->public.main_thread_id == pthread_self())
+ if (this->main_thread == thread_current())
{
/* initialization failed, terminate daemon */
unlink(PID_FILE);
@@ -234,9 +242,9 @@ static void kill_daemon(private_daemon_t *this, char *reason)
else
{
DBG1(DBG_DMN, "sending SIGTERM to ourself");
- pthread_kill(this->public.main_thread_id, SIGTERM);
+ this->main_thread->kill(this->main_thread, SIGTERM);
/* thread must die, since he produced a ciritcal failure and can't continue */
- pthread_exit(NULL);
+ thread_exit(NULL);
}
}
@@ -246,18 +254,18 @@ static void kill_daemon(private_daemon_t *this, char *reason)
static void drop_capabilities(private_daemon_t *this)
{
#ifdef HAVE_PRCTL
- prctl(PR_SET_KEEPCAPS, 1);
+ prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0);
#endif
if (setgid(charon->gid) != 0)
{
- kill_daemon(this, "change to unprivileged group failed");
+ kill_daemon(this, "change to unprivileged group failed");
}
if (setuid(charon->uid) != 0)
{
- kill_daemon(this, "change to unprivileged user failed");
+ kill_daemon(this, "change to unprivileged user failed");
}
-
+
#ifdef CAPABILITIES
if (cap_set_proc(this->caps) != 0)
{
@@ -279,7 +287,7 @@ static void keep_cap(private_daemon_t *this, u_int cap)
}
/**
- * lookup UID and GID
+ * lookup UID and GID
*/
static void lookup_uid_gid(private_daemon_t *this)
{
@@ -287,7 +295,7 @@ static void lookup_uid_gid(private_daemon_t *this)
{
char buf[1024];
struct passwd passwd, *pwp;
-
+
if (getpwnam_r(IPSEC_USER, &passwd, buf, sizeof(buf), &pwp) != 0 ||
pwp == NULL)
{
@@ -300,7 +308,7 @@ static void lookup_uid_gid(private_daemon_t *this)
{
char buf[1024];
struct group group, *grp;
-
+
if (getgrnam_r(IPSEC_GROUP, &group, buf, sizeof(buf), &grp) != 0 ||
grp == NULL)
{
@@ -319,7 +327,7 @@ static void print_plugins()
char buf[512], *plugin;
int len = 0;
enumerator_t *enumerator;
-
+
buf[0] = '\0';
enumerator = lib->plugins->create_plugin_enumerator(lib->plugins);
while (len < sizeof(buf) && enumerator->enumerate(enumerator, &plugin))
@@ -345,7 +353,7 @@ static void initialize_loggers(private_daemon_t *this, bool use_stderr,
level_t def;
bool append;
FILE *file;
-
+
/* setup sysloggers */
enumerator = lib->settings->create_section_enumerator(lib->settings,
"charon.syslog");
@@ -378,7 +386,7 @@ static void initialize_loggers(private_daemon_t *this, bool use_stderr,
this->public.bus->add_listener(this->public.bus, &sys_logger->listener);
}
enumerator->destroy(enumerator);
-
+
/* and file loggers */
enumerator = lib->settings->create_section_enumerator(lib->settings,
"charon.filelog");
@@ -418,10 +426,10 @@ static void initialize_loggers(private_daemon_t *this, bool use_stderr,
this->public.file_loggers->insert_last(this->public.file_loggers,
file_logger);
this->public.bus->add_listener(this->public.bus, &file_logger->listener);
-
+
}
enumerator->destroy(enumerator);
-
+
/* set up legacy style default loggers provided via command-line */
if (!loggers_defined)
{
@@ -443,7 +451,7 @@ static void initialize_loggers(private_daemon_t *this, bool use_stderr,
file_logger->set_level(file_logger, group, levels[group]);
}
}
-
+
/* set up default auth sys_logger */
sys_logger = sys_logger_create(LOG_AUTHPRIV);
this->public.bus->add_listener(this->public.bus, &sys_logger->listener);
@@ -460,14 +468,14 @@ static bool initialize(private_daemon_t *this, bool syslog, level_t levels[])
{
/* for uncritical pseudo random numbers */
srandom(time(NULL) + getpid());
-
+
/* setup bus and it's listeners first to enable log output */
this->public.bus = bus_create();
/* set up hook to log dbg message in library via charons message bus */
dbg = dbg_bus;
-
+
initialize_loggers(this, !syslog, levels);
-
+
DBG1(DBG_DMN, "Starting IKEv2 charon daemon (strongSwan "VERSION")");
if (lib->integrity)
@@ -485,15 +493,17 @@ static bool initialize(private_daemon_t *this, bool syslog, level_t levels[])
this->public.eap = eap_manager_create();
this->public.sim = sim_manager_create();
this->public.backends = backend_manager_create();
- this->public.attributes = attribute_manager_create();
this->public.kernel_interface = kernel_interface_create();
this->public.socket = socket_create();
this->public.traps = trap_manager_create();
-
+
/* load plugins, further infrastructure may need it */
- lib->plugins->load(lib->plugins, IPSEC_PLUGINDIR,
- lib->settings->get_str(lib->settings, "charon.load", PLUGINS));
-
+ if (!lib->plugins->load(lib->plugins, NULL,
+ lib->settings->get_str(lib->settings, "charon.load", PLUGINS)))
+ {
+ return FALSE;
+ }
+
print_plugins();
this->public.ike_sa_manager = ike_sa_manager_create();
@@ -507,7 +517,7 @@ static bool initialize(private_daemon_t *this, bool syslog, level_t levels[])
{
return FALSE;
}
-
+
#ifdef ME
this->public.connect_manager = connect_manager_create();
if (this->public.connect_manager == NULL)
@@ -516,7 +526,7 @@ static bool initialize(private_daemon_t *this, bool syslog, level_t levels[])
}
this->public.mediation_manager = mediation_manager_create();
#endif /* ME */
-
+
return TRUE;
}
@@ -526,35 +536,34 @@ static bool initialize(private_daemon_t *this, bool syslog, level_t levels[])
static void segv_handler(int signal)
{
backtrace_t *backtrace;
-
- DBG1(DBG_DMN, "thread %u received %d", pthread_self(), signal);
+
+ DBG1(DBG_DMN, "thread %u received %d", thread_current_id(), signal);
backtrace = backtrace_create(2);
backtrace->log(backtrace, stderr);
backtrace->destroy(backtrace);
-
+
DBG1(DBG_DMN, "killing ourself, received critical signal");
- raise(SIGKILL);
+ abort();
}
/**
* Create the daemon.
*/
private_daemon_t *daemon_create(void)
-{
+{
struct sigaction action;
private_daemon_t *this = malloc_thing(private_daemon_t);
-
+
/* assign methods */
this->public.kill = (void (*) (daemon_t*,char*))kill_daemon;
this->public.keep_cap = (void(*)(daemon_t*, u_int cap))keep_cap;
-
+
/* NULL members for clean destruction */
this->public.socket = NULL;
this->public.ike_sa_manager = NULL;
this->public.traps = NULL;
this->public.credentials = NULL;
this->public.backends = NULL;
- this->public.attributes = NULL;
this->public.sender= NULL;
this->public.receiver = NULL;
this->public.scheduler = NULL;
@@ -572,8 +581,8 @@ private_daemon_t *daemon_create(void)
#endif /* ME */
this->public.uid = 0;
this->public.gid = 0;
-
- this->public.main_thread_id = pthread_self();
+
+ this->main_thread = thread_current();
#ifdef CAPABILITIES
this->caps = cap_init();
keep_cap(this, CAP_NET_ADMIN);
@@ -582,9 +591,8 @@ private_daemon_t *daemon_create(void)
keep_cap(this, CAP_SYS_NICE);
}
#endif /* CAPABILITIES */
-
+
/* add handler for SEGV and ILL,
- * add handler for USR1 (cancellation).
* INT, TERM and HUP are handled by sigwait() in run() */
action.sa_handler = segv_handler;
action.sa_flags = 0;
@@ -597,20 +605,20 @@ private_daemon_t *daemon_create(void)
sigaction(SIGBUS, &action, NULL);
action.sa_handler = SIG_IGN;
sigaction(SIGPIPE, &action, NULL);
-
- pthread_sigmask(SIG_SETMASK, &action.sa_mask, 0);
-
+
+ pthread_sigmask(SIG_SETMASK, &action.sa_mask, NULL);
+
return this;
}
/**
- * Check/create PID file, return TRUE if already running
+ * Check/create PID file, return TRUE if already running
*/
static bool check_pidfile()
{
struct stat stb;
FILE *file;
-
+
if (stat(PID_FILE, &stb) == 0)
{
file = fopen(PID_FILE, "r");
@@ -618,7 +626,7 @@ static bool check_pidfile()
{
char buf[64];
pid_t pid = 0;
-
+
memset(buf, 0, sizeof(buf));
if (fread(buf, 1, sizeof(buf), file))
{
@@ -633,7 +641,7 @@ static bool check_pidfile()
DBG1(DBG_DMN, "removing pidfile '"PID_FILE"', process not running");
unlink(PID_FILE);
}
-
+
/* create new pidfile */
file = fopen(PID_FILE, "w");
if (file)
@@ -676,17 +684,17 @@ int main(int argc, char *argv[])
private_daemon_t *private_charon;
level_t levels[DBG_MAX];
int group;
-
+
/* logging for library during initialization, as we have no bus yet */
dbg = dbg_stderr;
-
+
/* initialize library */
- if (!library_init(STRONGSWAN_CONF))
+ if (!library_init(NULL))
{
library_deinit();
exit(SS_RC_LIBSTRONGSWAN_INTEGRITY);
}
-
+
if (lib->integrity &&
!lib->integrity->check_file(lib->integrity, "charon", argv[0]))
{
@@ -694,7 +702,7 @@ int main(int argc, char *argv[])
library_deinit();
exit(SS_RC_DAEMON_INTEGRITY);
}
-
+
lib->printf_hook->add_handler(lib->printf_hook, 'R',
traffic_selector_printf_hook,
PRINTF_HOOK_ARGTYPE_POINTER,
@@ -705,15 +713,15 @@ int main(int argc, char *argv[])
PRINTF_HOOK_ARGTYPE_END);
private_charon = daemon_create();
charon = (daemon_t*)private_charon;
-
+
lookup_uid_gid(private_charon);
-
+
/* use CTRL loglevel for default */
for (group = 0; group < DBG_MAX; group++)
{
levels[group] = LEVEL_CTRL;
}
-
+
/* handle arguments */
for (;;)
{
@@ -734,12 +742,12 @@ int main(int argc, char *argv[])
{ "debug-lib", required_argument, &group, DBG_LIB },
{ 0,0,0,0 }
};
-
+
int c = getopt_long(argc, argv, "", long_opts, NULL);
switch (c)
{
case EOF:
- break;
+ break;
case 'h':
usage(NULL);
break;
@@ -759,39 +767,41 @@ int main(int argc, char *argv[])
}
break;
}
-
+
/* initialize daemon */
if (!initialize(private_charon, use_syslog, levels))
{
DBG1(DBG_DMN, "initialization failed - aborting charon");
destroy(private_charon);
+ library_deinit();
exit(SS_RC_INITIALIZATION_FAILED);
}
-
+
if (check_pidfile())
{
DBG1(DBG_DMN, "charon already running (\""PID_FILE"\" exists)");
destroy(private_charon);
+ library_deinit();
exit(-1);
}
-
+
/* drop the capabilities we won't need */
drop_capabilities(private_charon);
-
+
/* start the engine, go multithreaded */
charon->processor->set_threads(charon->processor,
lib->settings->get_int(lib->settings, "charon.threads",
DEFAULT_THREADS));
-
+
/* run daemon */
run(private_charon);
-
+
/* normal termination, cleanup and exit */
destroy(private_charon);
unlink(PID_FILE);
-
+
library_deinit();
-
+
return 0;
}
diff --git a/src/charon/daemon.h b/src/charon/daemon.h
index 023bae447..cb5946d5d 100644
--- a/src/charon/daemon.h
+++ b/src/charon/daemon.h
@@ -21,7 +21,7 @@
*
* @defgroup bus bus
* @ingroup charon
- *
+ *
* @defgroup listeners listeners
* @ingroup bus
*
@@ -84,13 +84,13 @@
* from the processor. Work is delegated to the processor by queueing jobs
* to it.
@verbatim
-
+
+---------------------------------+ +----------------------------+
| controller | | config |
- +---------------------------------+ +----------------------------+
- | | | ^ ^ ^
- V V V | | |
-
+ +---------------------------------+ +----------------------------+
+ | | | ^ ^ ^
+ V V V | | |
+
+----------+ +-----------+ +------+ +----------+ +----+
| receiver | | | | | +------+ | CHILD_SA | | K |
+---+------+ | Scheduler | | IKE- | | IKE- |--+----------+ | e |
@@ -100,43 +100,43 @@
+------+---+ +-----------+ | ager | +------+ +----------+ | l |
| | | | | | IKE- |--| CHILD_SA | | - |
+---+------+ | Processor |---| |--| SA | +----------+ | I |
- | sender | | | | | +------+ | f |
+ | sender | | | | | +------+ | f |
+----------+ +-----------+ +------+ +----+
-
- | | | | | |
- V V V V V V
- +---------------------------------+ +----------------------------+
- | Bus | | credentials |
- +---------------------------------+ +----------------------------+
+
+ | | | | | |
+ V V V V V V
+ +---------------------------------+ +----------------------------+
+ | Bus | | credentials |
+ +---------------------------------+ +----------------------------+
@endverbatim
- * The scheduler is responsible to execute timed events. Jobs may be queued to
- * the scheduler to get executed at a defined time (e.g. rekeying). The
+ * The scheduler is responsible to execute timed events. Jobs may be queued to
+ * the scheduler to get executed at a defined time (e.g. rekeying). The
* scheduler does not execute the jobs itself, it queues them to the processor.
- *
- * The IKE_SA manager managers all IKE_SA. It further handles the
+ *
+ * The IKE_SA manager managers all IKE_SA. It further handles the
* synchronization:
- * Each IKE_SA must be checked out strictly and checked in again after use. The
- * manager guarantees that only one thread may check out a single IKE_SA. This
+ * Each IKE_SA must be checked out strictly and checked in again after use. The
+ * manager guarantees that only one thread may check out a single IKE_SA. This
* allows us to write the (complex) IKE_SAs routines non-threadsave.
- * The IKE_SA contain the state and the logic of each IKE_SA and handle the
+ * The IKE_SA contain the state and the logic of each IKE_SA and handle the
* messages.
- *
+ *
* The CHILD_SA contains state about a IPsec security association and manages
- * them. An IKE_SA may have multiple CHILD_SAs. Communication to the kernel
+ * them. An IKE_SA may have multiple CHILD_SAs. Communication to the kernel
* takes place here through the kernel interface.
- *
+ *
* The kernel interface installs IPsec security associations, policies, routes
- * and virtual addresses. It further provides methods to enumerate interfaces
+ * and virtual addresses. It further provides methods to enumerate interfaces
* and may notify the daemon about state changes at lower layers.
- *
- * The bus receives signals from the different threads and relais them to interested
- * listeners. Debugging signals, but also important state changes or error
- * messages are sent over the bus.
- * It's listeners are not only for logging, but also to track the state of an
+ *
+ * The bus receives signals from the different threads and relays them to
+ * interested listeners. Debugging signals, but also important state changes or
+ * error messages are sent over the bus.
+ * Its listeners are not only for logging, but also to track the state of an
* IKE_SA.
*
- * The controller, credential_manager, bus and backend_manager (config) are
+ * The controller, credential_manager, bus and backend_manager (config) are
* places where a plugin ca register itself to privide information or observe
* and control the daemon.
*/
@@ -159,7 +159,6 @@ typedef struct daemon_t daemon_t;
#include <sa/ike_sa_manager.h>
#include <sa/trap_manager.h>
#include <config/backend_manager.h>
-#include <config/attributes/attribute_manager.h>
#include <credentials/credential_manager.h>
#include <sa/authenticators/eap/eap_manager.h>
#include <sa/authenticators/eap/sim_manager.h>
@@ -199,104 +198,99 @@ typedef struct daemon_t daemon_t;
* Main class of daemon, contains some globals.
*/
struct daemon_t {
-
+
/**
* A socket_t instance.
*/
socket_t *socket;
-
+
/**
* A ike_sa_manager_t instance.
*/
ike_sa_manager_t *ike_sa_manager;
-
+
/**
* Manager for triggering policies, called traps
*/
trap_manager_t *traps;
-
+
/**
* Manager for the different configuration backends.
*/
backend_manager_t *backends;
-
- /**
- * Manager for IKEv2 cfg payload attributes
- */
- attribute_manager_t *attributes;
-
+
/**
* Manager for the credential backends
*/
credential_manager_t *credentials;
-
+
/**
* The Sender-Thread.
- */
+ */
sender_t *sender;
-
+
/**
* The Receiver-Thread.
*/
receiver_t *receiver;
-
+
/**
* The Scheduler-Thread.
*/
scheduler_t *scheduler;
-
+
/**
* Job processing using a thread pool.
*/
processor_t *processor;
-
+
/**
* The signaling bus.
*/
bus_t *bus;
-
+
/**
* A list of installed file_logger_t's
*/
linked_list_t *file_loggers;
-
+
/**
* A list of installed sys_logger_t's
*/
linked_list_t *sys_loggers;
-
+
/**
* Kernel Interface to communicate with kernel
*/
kernel_interface_t *kernel_interface;
-
+
/**
* Controller to control the daemon
*/
controller_t *controller;
-
+
/**
* EAP manager to maintain registered EAP methods
*/
eap_manager_t *eap;
-
+
/**
- * SIM manager to maintain SIM cards/providers
+ * SIM manager to maintain (U)SIM cards/providers
*/
sim_manager_t *sim;
-
+
#ifdef ME
/**
* Connect manager
*/
connect_manager_t *connect_manager;
-
+
/**
* Mediation manager
*/
mediation_manager_t *mediation_manager;
#endif /* ME */
-
+
/**
* User ID the daemon will user after initialization
*/
@@ -306,12 +300,7 @@ struct daemon_t {
* Group ID the daemon will use after initialization
*/
gid_t gid;
-
- /**
- * The thread_id of main-thread.
- */
- pthread_t main_thread_id;
-
+
/**
* Do not drop a given capability after initialization.
*
@@ -320,10 +309,10 @@ struct daemon_t {
* drop these.
*/
void (*keep_cap)(daemon_t *this, u_int cap);
-
+
/**
* Shut down the daemon.
- *
+ *
* @param reason describtion why it will be killed
*/
void (*kill) (daemon_t *this, char *reason);
diff --git a/src/charon/encoding/generator.c b/src/charon/encoding/generator.c
index 406cfc688..6485da492 100644
--- a/src/charon/encoding/generator.c
+++ b/src/charon/encoding/generator.c
@@ -53,55 +53,55 @@ struct private_generator_t {
* Public part of a generator_t object.
*/
generator_t public;
-
+
/**
* Buffer used to generate the data into.
*/
u_int8_t *buffer;
-
+
/**
* Current write position in buffer (one byte aligned).
*/
u_int8_t *out_position;
-
+
/**
* Position of last byte in buffer.
*/
u_int8_t *roof_position;
-
+
/**
* Current bit writing to in current byte (between 0 and 7).
*/
u_int8_t current_bit;
-
+
/**
* Associated data struct to read informations from.
*/
void *data_struct;
-
+
/*
* Last payload length position offset in the buffer.
*/
u_int32_t last_payload_length_position_offset;
-
+
/**
* Offset of the header length field in the buffer.
*/
u_int32_t header_length_position_offset;
-
+
/**
* Last SPI size.
*/
u_int8_t last_spi_size;
-
+
/**
* Attribute format of the last generated transform attribute.
*
- * Used to check if a variable value field is used or not for
+ * Used to check if a variable value field is used or not for
* the transform attribute value.
*/
bool attribute_format;
-
+
/**
* Depending on the value of attribute_format this field is used
* to hold the length of the transform attribute in bytes.
@@ -149,14 +149,14 @@ static void make_space_available(private_generator_t *this, int bits)
while ((get_space(this) * 8 - this->current_bit) < bits)
{
int old_buffer_size, new_buffer_size, out_position_offset;
-
+
old_buffer_size = get_size(this);
new_buffer_size = old_buffer_size + GENERATOR_DATA_BUFFER_INCREASE_VALUE;
out_position_offset = this->out_position - this->buffer;
-
- DBG2(DBG_ENC, "increasing gen buffer from %d to %d byte",
+
+ DBG2(DBG_ENC, "increasing gen buffer from %d to %d byte",
old_buffer_size, new_buffer_size);
-
+
this->buffer = realloc(this->buffer,new_buffer_size);
this->out_position = (this->buffer + out_position_offset);
this->roof_position = (this->buffer + new_buffer_size);
@@ -171,9 +171,9 @@ static void write_bytes_to_buffer(private_generator_t *this, void *bytes,
{
int i;
u_int8_t *read_position = (u_int8_t *)bytes;
-
+
make_space_available(this, number_of_bytes * 8);
-
+
for (i = 0; i < number_of_bytes; i++)
{
*(this->out_position) = *(read_position);
@@ -192,14 +192,14 @@ static void write_bytes_to_buffer_at_offset(private_generator_t *this,
u_int8_t *read_position = (u_int8_t *)bytes;
u_int8_t *write_position;
u_int32_t free_space_after_offset = get_size(this) - offset;
-
- /* check first if enough space for new data is available */
+
+ /* check first if enough space for new data is available */
if (number_of_bytes > free_space_after_offset)
{
- make_space_available(this,
+ make_space_available(this,
(number_of_bytes - free_space_after_offset) * 8);
}
-
+
write_position = this->buffer + offset;
for (i = 0; i < number_of_bytes; i++)
{
@@ -216,7 +216,7 @@ static void generate_u_int_type(private_generator_t *this,
encoding_type_t int_type,u_int32_t offset)
{
int number_of_bits = 0;
-
+
/* find out number of bits of each U_INT type to check for enough space */
switch (int_type)
{
@@ -251,14 +251,14 @@ static void generate_u_int_type(private_generator_t *this,
encoding_type_names, int_type);
return;
}
-
+
make_space_available(this, number_of_bits);
switch (int_type)
{
case U_INT_4:
{
u_int8_t high, low;
-
+
if (this->current_bit == 0)
{
/* high of current byte in buffer has to be set to the new value*/
@@ -303,7 +303,7 @@ static void generate_u_int_type(private_generator_t *this,
{
u_int8_t attribute_format_flag;
u_int16_t val;
-
+
/* attribute type must not change first bit of current byte */
if (this->current_bit != 1)
{
@@ -325,7 +325,7 @@ static void generate_u_int_type(private_generator_t *this,
write_bytes_to_buffer(this, &val, sizeof(u_int16_t));
this->current_bit = 0;
break;
-
+
}
case U_INT_16:
case CONFIGURATION_ATTRIBUTE_LENGTH:
@@ -372,11 +372,11 @@ static void generate_reserved_field(private_generator_t *this, int bits)
return ;
}
make_space_available(this, bits);
-
+
if (bits == 1)
{
u_int8_t reserved_bit = ~(1 << (7 - this->current_bit));
-
+
*(this->out_position) = *(this->out_position) & reserved_bit;
if (this->current_bit == 0)
{
@@ -410,11 +410,11 @@ static void generate_flag(private_generator_t *this, u_int32_t offset)
{
u_int8_t flag_value;
u_int8_t flag;
-
+
flag_value = (*((bool *) (this->data_struct + offset))) ? 1 : 0;
/* get flag position */
flag = (flag_value << (7 - this->current_bit));
-
+
/* make sure one bit is available in buffer */
make_space_available(this, 1);
if (this->current_bit == 0)
@@ -422,10 +422,10 @@ static void generate_flag(private_generator_t *this, u_int32_t offset)
/* memory must be zero */
*(this->out_position) = 0x00;
}
-
+
*(this->out_position) = *(this->out_position) | flag;
DBG3(DBG_ENC, " => %d", *this->out_position);
-
+
this->current_bit++;
if (this->current_bit >= 8)
{
@@ -440,16 +440,16 @@ static void generate_flag(private_generator_t *this, u_int32_t offset)
static void generate_from_chunk(private_generator_t *this, u_int32_t offset)
{
chunk_t *value;
-
+
if (this->current_bit != 0)
{
DBG1(DBG_ENC, "can not generate a chunk at Bitpos %d", this->current_bit);
return ;
}
-
+
value = (chunk_t *)(this->data_struct + offset);
DBG3(DBG_ENC, " => %B", value);
-
+
write_bytes_to_buffer(this, value->ptr, value->len);
}
@@ -460,7 +460,7 @@ static void write_to_chunk(private_generator_t *this,chunk_t *data)
{
int data_length = get_length(this);
u_int32_t header_length_field = data_length;
-
+
/* write length into header length field */
if (this->header_length_position_offset > 0)
{
@@ -468,14 +468,14 @@ static void write_to_chunk(private_generator_t *this,chunk_t *data)
write_bytes_to_buffer_at_offset(this, &val, sizeof(u_int32_t),
this->header_length_position_offset);
}
-
+
if (this->current_bit > 0)
{
data_length++;
}
*data = chunk_alloc(data_length);
memcpy(data->ptr, this->buffer, data_length);
-
+
DBG3(DBG_ENC, "generated data of this generator %B", data);
}
@@ -488,20 +488,20 @@ static void generate_payload (private_generator_t *this,payload_t *payload)
size_t rule_count;
encoding_rule_t *rules;
payload_type_t payload_type;
-
+
this->data_struct = payload;
payload_type = payload->get_type(payload);
/* spi size has to get reseted */
this->last_spi_size = 0;
-
+
offset_start = this->out_position - this->buffer;
-
+
DBG2(DBG_ENC, "generating payload of type %N",
payload_type_names, payload_type);
-
+
/* each payload has its own encoding rules */
payload->get_encoding_rules(payload, &rules, &rule_count);
-
+
for (i = 0; i < rule_count;i++)
{
DBG2(DBG_ENC, " generating rule %d %N",
@@ -529,7 +529,7 @@ static void generate_payload (private_generator_t *this,payload_t *payload)
{
generate_reserved_field(this, 8);
break;
- }
+ }
case FLAG:
{
generate_flag(this, rules[i].offset);
@@ -578,7 +578,7 @@ static void generate_payload (private_generator_t *this,payload_t *payload)
u_int16_t length_of_payload;
u_int16_t header_length = 0;
u_int16_t length_in_network_order;
-
+
switch(rules[i].type)
{
case KEY_EXCHANGE_DATA:
@@ -619,13 +619,13 @@ static void generate_payload (private_generator_t *this,payload_t *payload)
break;
}
generate_from_chunk(this, rules[i].offset);
-
+
payload_length_position_offset =
this->last_payload_length_position_offset;
-
- length_of_payload = header_length +
+
+ length_of_payload = header_length +
((chunk_t *)(this->data_struct + rules[i].offset))->len;
-
+
length_in_network_order = htons(length_of_payload);
write_bytes_to_buffer_at_offset(this, &length_in_network_order,
sizeof(u_int16_t), payload_length_position_offset);
@@ -633,7 +633,7 @@ static void generate_payload (private_generator_t *this,payload_t *payload)
}
case PROPOSALS:
{
- u_int32_t payload_length_position_offset =
+ u_int32_t payload_length_position_offset =
this->last_payload_length_position_offset;
/* Length of SA_PAYLOAD is calculated */
u_int16_t length_of_sa_payload = SA_PAYLOAD_HEADER_LENGTH;
@@ -642,13 +642,13 @@ static void generate_payload (private_generator_t *this,payload_t *payload)
(this->data_struct + rules[i].offset));
iterator_t *iterator;
payload_t *current_proposal;
-
+
iterator = proposals->create_iterator(proposals,TRUE);
while (iterator->iterate(iterator, (void**)&current_proposal))
{
u_int32_t before_generate_position_offset;
u_int32_t after_generate_position_offset;
-
+
before_generate_position_offset = get_offset(this);
generate_payload(this, current_proposal);
after_generate_position_offset = get_offset(this);
@@ -656,7 +656,7 @@ static void generate_payload (private_generator_t *this,payload_t *payload)
before_generate_position_offset);
}
iterator->destroy(iterator);
-
+
int16_val = htons(length_of_sa_payload);
write_bytes_to_buffer_at_offset(this, &int16_val,
sizeof(u_int16_t),payload_length_position_offset);
@@ -664,36 +664,36 @@ static void generate_payload (private_generator_t *this,payload_t *payload)
}
case TRANSFORMS:
{
- u_int32_t payload_length_position_offset =
+ u_int32_t payload_length_position_offset =
this->last_payload_length_position_offset;
- u_int16_t length_of_proposal =
+ u_int16_t length_of_proposal =
PROPOSAL_SUBSTRUCTURE_HEADER_LENGTH + this->last_spi_size;
u_int16_t int16_val;
linked_list_t *transforms = *((linked_list_t **)
(this->data_struct + rules[i].offset));
iterator_t *iterator;
payload_t *current_transform;
-
+
iterator = transforms->create_iterator(transforms,TRUE);
while (iterator->iterate(iterator, (void**)&current_transform))
{
u_int32_t before_generate_position_offset;
u_int32_t after_generate_position_offset;
-
+
before_generate_position_offset = get_offset(this);
generate_payload(this, current_transform);
after_generate_position_offset = get_offset(this);
-
+
length_of_proposal += (after_generate_position_offset -
before_generate_position_offset);
}
iterator->destroy(iterator);
-
+
int16_val = htons(length_of_proposal);
write_bytes_to_buffer_at_offset(this, &int16_val,
sizeof(u_int16_t), payload_length_position_offset);
break;
- }
+ }
case TRANSFORM_ATTRIBUTES:
{
u_int32_t transform_length_position_offset =
@@ -705,32 +705,32 @@ static void generate_payload (private_generator_t *this,payload_t *payload)
(this->data_struct + rules[i].offset));
iterator_t *iterator;
payload_t *current_attribute;
-
+
iterator = transform_attributes->create_iterator(
transform_attributes, TRUE);
while (iterator->iterate(iterator, (void**)&current_attribute))
{
u_int32_t before_generate_position_offset;
u_int32_t after_generate_position_offset;
-
+
before_generate_position_offset = get_offset(this);
generate_payload(this, current_attribute);
after_generate_position_offset = get_offset(this);
-
+
length_of_transform += (after_generate_position_offset -
before_generate_position_offset);
}
-
+
iterator->destroy(iterator);
-
+
int16_val = htons(length_of_transform);
- write_bytes_to_buffer_at_offset(this, &int16_val,
+ write_bytes_to_buffer_at_offset(this, &int16_val,
sizeof(u_int16_t),transform_length_position_offset);
break;
}
case CONFIGURATION_ATTRIBUTES:
{
- u_int32_t configurations_length_position_offset =
+ u_int32_t configurations_length_position_offset =
this->last_payload_length_position_offset;
u_int16_t length_of_configurations = CP_PAYLOAD_HEADER_LENGTH;
u_int16_t int16_val;
@@ -738,29 +738,29 @@ static void generate_payload (private_generator_t *this,payload_t *payload)
(this->data_struct + rules[i].offset));
iterator_t *iterator;
payload_t *current_attribute;
-
+
iterator = configuration_attributes->create_iterator(
configuration_attributes,TRUE);
while (iterator->iterate(iterator, (void**)&current_attribute))
{
u_int32_t before_generate_position_offset;
u_int32_t after_generate_position_offset;
-
+
before_generate_position_offset = get_offset(this);
generate_payload(this, current_attribute);
after_generate_position_offset = get_offset(this);
-
+
length_of_configurations += after_generate_position_offset -
before_generate_position_offset;
}
-
+
iterator->destroy(iterator);
-
+
int16_val = htons(length_of_configurations);
- write_bytes_to_buffer_at_offset(this, &int16_val,
+ write_bytes_to_buffer_at_offset(this, &int16_val,
sizeof(u_int16_t),configurations_length_position_offset);
break;
- }
+ }
case ATTRIBUTE_FORMAT:
{
generate_flag(this, rules[i].offset);
@@ -768,7 +768,7 @@ static void generate_payload (private_generator_t *this,payload_t *payload)
this->attribute_format =
*((bool *)(this->data_struct + rules[i].offset));
break;
- }
+ }
case ATTRIBUTE_LENGTH_OR_VALUE:
{
@@ -797,7 +797,7 @@ static void generate_payload (private_generator_t *this,payload_t *payload)
}
case TRAFFIC_SELECTORS:
{
- u_int32_t payload_length_position_offset =
+ u_int32_t payload_length_position_offset =
this->last_payload_length_position_offset;
u_int16_t length_of_ts_payload = TS_PAYLOAD_HEADER_LENGTH;
u_int16_t int16_val;
@@ -805,29 +805,29 @@ static void generate_payload (private_generator_t *this,payload_t *payload)
(this->data_struct + rules[i].offset));
iterator_t *iterator;
payload_t *current_tss;
-
+
iterator = traffic_selectors->create_iterator(
traffic_selectors,TRUE);
while (iterator->iterate(iterator, (void **)&current_tss))
{
u_int32_t before_generate_position_offset;
u_int32_t after_generate_position_offset;
-
+
before_generate_position_offset = get_offset(this);
generate_payload(this, current_tss);
after_generate_position_offset = get_offset(this);
-
+
length_of_ts_payload += (after_generate_position_offset -
before_generate_position_offset);
}
iterator->destroy(iterator);
-
+
int16_val = htons(length_of_ts_payload);
write_bytes_to_buffer_at_offset(this, &int16_val,
sizeof(u_int16_t),payload_length_position_offset);
break;
- }
-
+ }
+
case ENCRYPTED_DATA:
{
generate_from_chunk(this, rules[i].offset);
@@ -869,10 +869,10 @@ generator_t *generator_create()
this->public.generate_payload = (void(*)(generator_t*, payload_t *))generate_payload;
this->public.destroy = (void(*)(generator_t*)) destroy;
this->public.write_to_chunk = (void (*) (generator_t *,chunk_t *))write_to_chunk;
-
+
/* allocate memory for buffer */
this->buffer = malloc(GENERATOR_DATA_BUFFER_SIZE);
-
+
/* initiate private variables */
this->out_position = this->buffer;
this->roof_position = this->buffer + GENERATOR_DATA_BUFFER_SIZE;
@@ -880,7 +880,9 @@ generator_t *generator_create()
this->current_bit = 0;
this->last_payload_length_position_offset = 0;
this->header_length_position_offset = 0;
-
+ this->attribute_format = FALSE;
+ this->attribute_length = 0;
+
return &(this->public);
}
diff --git a/src/charon/encoding/generator.h b/src/charon/encoding/generator.h
index f6fb8981c..2221c84af 100644
--- a/src/charon/encoding/generator.h
+++ b/src/charon/encoding/generator.h
@@ -44,7 +44,7 @@ typedef struct generator_t generator_t;
* A generator_t class used to generate IKEv2 payloads.
*
* After creation, multiple payloads can be generated with the generate_payload
- * method. The generated bytes are appended. After all payloads are added,
+ * method. The generated bytes are appended. After all payloads are added,
* the write_to_chunk method writes out all generated data since
* the creation of the generator. After that, the generator must be destroyed.
* The generater uses a set of encoding rules, which it can get from
@@ -52,7 +52,7 @@ typedef struct generator_t generator_t;
* the payload and all substructures automatically.
*/
struct generator_t {
-
+
/**
* Generates a specific payload from given payload object.
*
@@ -61,14 +61,14 @@ struct generator_t {
* @param payload interface payload_t implementing object
*/
void (*generate_payload) (generator_t *this,payload_t *payload);
-
+
/**
* Writes all generated data of the generator to a chunk.
*
* @param data chunk to write the data to
*/
void (*write_to_chunk) (generator_t *this,chunk_t *data);
-
+
/**
* Destroys a generator_t object.
*/
@@ -77,7 +77,7 @@ struct generator_t {
/**
* Constructor to create a generator.
- *
+ *
* @return generator_t object.
*/
generator_t *generator_create(void);
diff --git a/src/charon/encoding/message.c b/src/charon/encoding/message.c
index 7c6fdb499..397a3c609 100644
--- a/src/charon/encoding/message.c
+++ b/src/charon/encoding/message.c
@@ -47,7 +47,7 @@ typedef struct payload_rule_t payload_rule_t;
/**
* A payload rule defines the rules for a payload
- * in a specific message rule. It defines if and how
+ * in a specific message rule. It defines if and how
* many times a payload must/can occur in a message
* and if it must be encrypted.
*/
@@ -56,7 +56,7 @@ struct payload_rule_t {
* Payload type.
*/
payload_type_t payload_type;
-
+
/**
* Minimal occurence of this payload.
*/
@@ -66,15 +66,15 @@ struct payload_rule_t {
* Max occurence of this payload.
*/
size_t max_occurence;
-
+
/**
* TRUE if payload must be encrypted
*/
bool encrypted;
-
+
/**
* If this payload occurs, the message rule is
- * fullfilled in any case. This applies e.g. to
+ * fullfilled in any case. This applies e.g. to
* notify_payloads.
*/
bool sufficient;
@@ -88,11 +88,11 @@ typedef struct payload_order_t payload_order_t;
struct payload_order_t {
/**
- * payload type
+ * payload type
*/
payload_type_t type;
-
- /**
+
+ /**
* notify type, if payload == NOTIFY
*/
notify_type_t notify;
@@ -111,7 +111,7 @@ struct message_rule_t {
* Type of message.
*/
exchange_type_t exchange_type;
-
+
/**
* Is message a request or response.
*/
@@ -121,22 +121,22 @@ struct message_rule_t {
* Message contains encrypted content.
*/
bool encrypted_content;
-
+
/**
* Number of payload rules which will follow
*/
int payload_rule_count;
-
+
/**
* Pointer to first payload rule
*/
payload_rule_t *payload_rules;
-
+
/**
* Number of payload order rules
*/
int payload_order_count;
-
+
/**
* payload ordering rules
*/
@@ -161,9 +161,9 @@ static payload_rule_t ike_sa_init_i_payload_rules[] = {
static payload_order_t ike_sa_init_i_payload_order[] = {
/* payload type notify type */
{NOTIFY, COOKIE},
- {SECURITY_ASSOCIATION, 0},
- {KEY_EXCHANGE, 0},
- {NONCE, 0},
+ {SECURITY_ASSOCIATION, 0},
+ {KEY_EXCHANGE, 0},
+ {NONCE, 0},
{NOTIFY, NAT_DETECTION_SOURCE_IP},
{NOTIFY, NAT_DETECTION_DESTINATION_IP},
{NOTIFY, 0},
@@ -187,9 +187,9 @@ static payload_rule_t ike_sa_init_r_payload_rules[] = {
*/
static payload_order_t ike_sa_init_r_payload_order[] = {
/* payload type notify type */
- {SECURITY_ASSOCIATION, 0},
- {KEY_EXCHANGE, 0},
- {NONCE, 0},
+ {SECURITY_ASSOCIATION, 0},
+ {KEY_EXCHANGE, 0},
+ {NONCE, 0},
{NOTIFY, NAT_DETECTION_SOURCE_IP},
{NOTIFY, NAT_DETECTION_DESTINATION_IP},
{NOTIFY, HTTP_CERT_LOOKUP_SUPPORTED},
@@ -241,7 +241,7 @@ static payload_order_t ike_auth_i_payload_order[] = {
{NOTIFY, USE_TRANSPORT_MODE},
{NOTIFY, ESP_TFC_PADDING_NOT_SUPPORTED},
{NOTIFY, NON_FIRST_FRAGMENTS_ALSO},
- {SECURITY_ASSOCIATION, 0},
+ {SECURITY_ASSOCIATION, 0},
{TRAFFIC_SELECTOR_INITIATOR, 0},
{TRAFFIC_SELECTOR_RESPONDER, 0},
{NOTIFY, MOBIKE_SUPPORTED},
@@ -283,7 +283,7 @@ static payload_order_t ike_auth_r_payload_order[] = {
{NOTIFY, USE_TRANSPORT_MODE},
{NOTIFY, ESP_TFC_PADDING_NOT_SUPPORTED},
{NOTIFY, NON_FIRST_FRAGMENTS_ALSO},
- {SECURITY_ASSOCIATION, 0},
+ {SECURITY_ASSOCIATION, 0},
{TRAFFIC_SELECTOR_INITIATOR, 0},
{TRAFFIC_SELECTOR_RESPONDER, 0},
{NOTIFY, AUTH_LIFETIME},
@@ -370,9 +370,9 @@ static payload_order_t create_child_sa_i_payload_order[] = {
{NOTIFY, USE_TRANSPORT_MODE},
{NOTIFY, ESP_TFC_PADDING_NOT_SUPPORTED},
{NOTIFY, NON_FIRST_FRAGMENTS_ALSO},
- {SECURITY_ASSOCIATION, 0},
+ {SECURITY_ASSOCIATION, 0},
{NONCE, 0},
- {KEY_EXCHANGE, 0},
+ {KEY_EXCHANGE, 0},
{TRAFFIC_SELECTOR_INITIATOR, 0},
{TRAFFIC_SELECTOR_RESPONDER, 0},
{NOTIFY, 0},
@@ -402,9 +402,9 @@ static payload_order_t create_child_sa_r_payload_order[] = {
{NOTIFY, USE_TRANSPORT_MODE},
{NOTIFY, ESP_TFC_PADDING_NOT_SUPPORTED},
{NOTIFY, NON_FIRST_FRAGMENTS_ALSO},
- {SECURITY_ASSOCIATION, 0},
+ {SECURITY_ASSOCIATION, 0},
{NONCE, 0},
- {KEY_EXCHANGE, 0},
+ {KEY_EXCHANGE, 0},
{TRAFFIC_SELECTOR_INITIATOR, 0},
{TRAFFIC_SELECTOR_RESPONDER, 0},
{NOTIFY, ADDITIONAL_TS_POSSIBLE},
@@ -516,7 +516,7 @@ static message_rule_t message_rules[] = {
(sizeof(me_connect_r_payload_order)/sizeof(payload_order_t)),
me_connect_r_payload_order,
},
-#endif /* ME */
+#endif /* ME */
};
@@ -536,12 +536,12 @@ struct private_message_t {
* Minor version of message.
*/
u_int8_t major_version;
-
+
/**
* Major version of message.
*/
u_int8_t minor_version;
-
+
/**
* First Payload in message.
*/
@@ -556,32 +556,32 @@ struct private_message_t {
* TRUE if message is a request, FALSE if a reply.
*/
bool is_request;
-
+
/**
* Message ID of this message.
*/
u_int32_t message_id;
-
+
/**
* ID of assigned IKE_SA.
*/
ike_sa_id_t *ike_sa_id;
-
+
/**
* Assigned UDP packet, stores incoming packet or last generated one.
*/
packet_t *packet;
-
+
/**
* Linked List where payload data are stored in.
*/
linked_list_t *payloads;
-
+
/**
* Assigned parser to parse Header and Body of this message.
*/
parser_t *parser;
-
+
/**
* The message rule for this message instance
*/
@@ -594,7 +594,7 @@ struct private_message_t {
static status_t set_message_rule(private_message_t *this)
{
int i;
-
+
for (i = 0; i < (sizeof(message_rules) / sizeof(message_rule_t)); i++)
{
if ((this->exchange_type == message_rules[i].exchange_type) &&
@@ -612,10 +612,11 @@ static status_t set_message_rule(private_message_t *this)
/**
* Implementation of private_message_t.get_payload_rule.
*/
-static status_t get_payload_rule(private_message_t *this, payload_type_t payload_type, payload_rule_t **payload_rule)
+static status_t get_payload_rule(private_message_t *this,
+ payload_type_t payload_type, payload_rule_t **payload_rule)
{
int i;
-
+
for (i = 0; i < this->message_rule->payload_rule_count;i++)
{
if (this->message_rule->payload_rules[i].payload_type == payload_type)
@@ -624,7 +625,7 @@ static status_t get_payload_rule(private_message_t *this, payload_type_t payload
return SUCCESS;
}
}
-
+
*payload_rule = NULL;
return NOT_FOUND;
}
@@ -632,7 +633,7 @@ static status_t get_payload_rule(private_message_t *this, payload_type_t payload
/**
* Implementation of message_t.set_ike_sa_id.
*/
-static void set_ike_sa_id (private_message_t *this,ike_sa_id_t *ike_sa_id)
+static void set_ike_sa_id(private_message_t *this,ike_sa_id_t *ike_sa_id)
{
DESTROY_IF(this->ike_sa_id);
this->ike_sa_id = ike_sa_id->clone(ike_sa_id);
@@ -641,7 +642,7 @@ static void set_ike_sa_id (private_message_t *this,ike_sa_id_t *ike_sa_id)
/**
* Implementation of message_t.get_ike_sa_id.
*/
-static ike_sa_id_t* get_ike_sa_id (private_message_t *this)
+static ike_sa_id_t* get_ike_sa_id(private_message_t *this)
{
return this->ike_sa_id;
}
@@ -649,7 +650,7 @@ static ike_sa_id_t* get_ike_sa_id (private_message_t *this)
/**
* Implementation of message_t.set_message_id.
*/
-static void set_message_id (private_message_t *this,u_int32_t message_id)
+static void set_message_id(private_message_t *this,u_int32_t message_id)
{
this->message_id = message_id;
}
@@ -657,7 +658,7 @@ static void set_message_id (private_message_t *this,u_int32_t message_id)
/**
* Implementation of message_t.get_message_id.
*/
-static u_int32_t get_message_id (private_message_t *this)
+static u_int32_t get_message_id(private_message_t *this)
{
return this->message_id;
}
@@ -665,7 +666,7 @@ static u_int32_t get_message_id (private_message_t *this)
/**
* Implementation of message_t.get_initiator_spi.
*/
-static u_int64_t get_initiator_spi (private_message_t *this)
+static u_int64_t get_initiator_spi(private_message_t *this)
{
return (this->ike_sa_id->get_initiator_spi(this->ike_sa_id));
}
@@ -673,7 +674,7 @@ static u_int64_t get_initiator_spi (private_message_t *this)
/**
* Implementation of message_t.get_responder_spi.
*/
-static u_int64_t get_responder_spi (private_message_t *this)
+static u_int64_t get_responder_spi(private_message_t *this)
{
return (this->ike_sa_id->get_responder_spi(this->ike_sa_id));
}
@@ -681,16 +682,15 @@ static u_int64_t get_responder_spi (private_message_t *this)
/**
* Implementation of message_t.set_major_version.
*/
-static void set_major_version (private_message_t *this,u_int8_t major_version)
+static void set_major_version(private_message_t *this,u_int8_t major_version)
{
this->major_version = major_version;
}
-
/**
* Implementation of message_t.set_major_version.
*/
-static u_int8_t get_major_version (private_message_t *this)
+static u_int8_t get_major_version(private_message_t *this)
{
return this->major_version;
}
@@ -698,7 +698,7 @@ static u_int8_t get_major_version (private_message_t *this)
/**
* Implementation of message_t.set_minor_version.
*/
-static void set_minor_version (private_message_t *this,u_int8_t minor_version)
+static void set_minor_version(private_message_t *this,u_int8_t minor_version)
{
this->minor_version = minor_version;
}
@@ -706,7 +706,7 @@ static void set_minor_version (private_message_t *this,u_int8_t minor_version)
/**
* Implementation of message_t.get_minor_version.
*/
-static u_int8_t get_minor_version (private_message_t *this)
+static u_int8_t get_minor_version(private_message_t *this)
{
return this->minor_version;
}
@@ -714,7 +714,8 @@ static u_int8_t get_minor_version (private_message_t *this)
/**
* Implementation of message_t.set_exchange_type.
*/
-static void set_exchange_type (private_message_t *this,exchange_type_t exchange_type)
+static void set_exchange_type(private_message_t *this,
+ exchange_type_t exchange_type)
{
this->exchange_type = exchange_type;
}
@@ -722,7 +723,7 @@ static void set_exchange_type (private_message_t *this,exchange_type_t exchange_
/**
* Implementation of message_t.get_exchange_type.
*/
-static exchange_type_t get_exchange_type (private_message_t *this)
+static exchange_type_t get_exchange_type(private_message_t *this)
{
return this->exchange_type;
}
@@ -730,7 +731,7 @@ static exchange_type_t get_exchange_type (private_message_t *this)
/**
* Implementation of message_t.get_first_payload_type.
*/
-static payload_type_t get_first_payload_type (private_message_t *this)
+static payload_type_t get_first_payload_type(private_message_t *this)
{
return this->first_payload;
}
@@ -738,7 +739,7 @@ static payload_type_t get_first_payload_type (private_message_t *this)
/**
* Implementation of message_t.set_request.
*/
-static void set_request (private_message_t *this,bool request)
+static void set_request(private_message_t *this, bool request)
{
this->is_request = request;
}
@@ -746,7 +747,7 @@ static void set_request (private_message_t *this,bool request)
/**
* Implementation of message_t.get_request.
*/
-static exchange_type_t get_request (private_message_t *this)
+static exchange_type_t get_request(private_message_t *this)
{
return this->is_request;
}
@@ -757,7 +758,7 @@ static exchange_type_t get_request (private_message_t *this)
static bool is_encoded(private_message_t *this)
{
chunk_t data = this->packet->get_data(this->packet);
-
+
if (data.ptr == NULL)
{
return FALSE;
@@ -791,15 +792,15 @@ static void add_payload(private_message_t *this, payload_t *payload)
/**
* Implementation of message_t.add_notify.
*/
-static void add_notify(private_message_t *this, bool flush, notify_type_t type,
+static void add_notify(private_message_t *this, bool flush, notify_type_t type,
chunk_t data)
{
notify_payload_t *notify;
payload_t *payload;
-
+
if (flush)
{
- while (this->payloads->remove_last(this->payloads,
+ while (this->payloads->remove_last(this->payloads,
(void**)&payload) == SUCCESS)
{
payload->destroy(payload);
@@ -858,7 +859,7 @@ static payload_t *get_payload(private_message_t *this, payload_type_t type)
{
payload_t *current, *found = NULL;
enumerator_t *enumerator;
-
+
enumerator = create_payload_enumerator(this);
while (enumerator->enumerate(enumerator, &current))
{
@@ -880,7 +881,7 @@ static notify_payload_t* get_notify(private_message_t *this, notify_type_t type)
enumerator_t *enumerator;
notify_payload_t *notify = NULL;
payload_t *payload;
-
+
enumerator = create_payload_enumerator(this);
while (enumerator->enumerate(enumerator, &payload))
{
@@ -907,12 +908,12 @@ static char* get_string(private_message_t *this, char *buf, int len)
payload_t *payload;
int written;
char *pos = buf;
-
+
memset(buf, 0, len);
len--;
-
+
written = snprintf(pos, len, "%N %s %d [",
- exchange_type_names, this->exchange_type,
+ exchange_type_names, this->exchange_type,
this->is_request ? "request" : "response",
this->message_id);
if (written >= len || written < 0)
@@ -921,12 +922,12 @@ static char* get_string(private_message_t *this, char *buf, int len)
}
pos += written;
len -= written;
-
+
enumerator = create_payload_enumerator(this);
while (enumerator->enumerate(enumerator, &payload))
{
written = snprintf(pos, len, " %N", payload_type_short_names,
- payload->get_type(payload));
+ payload->get_type(payload));
if (written >= len || written < 0)
{
return buf;
@@ -937,7 +938,36 @@ static char* get_string(private_message_t *this, char *buf, int len)
{
notify_payload_t *notify = (notify_payload_t*)payload;
written = snprintf(pos, len, "(%N)", notify_type_short_names,
- notify->get_notify_type(notify));
+ notify->get_notify_type(notify));
+ if (written >= len || written < 0)
+ {
+ return buf;
+ }
+ pos += written;
+ len -= written;
+ }
+ if (payload->get_type(payload) == EXTENSIBLE_AUTHENTICATION)
+ {
+ eap_payload_t *eap = (eap_payload_t*)payload;
+ u_int32_t vendor;
+ eap_type_t type;
+ char method[64] = "";
+
+ type = eap->get_type(eap, &vendor);
+ if (type)
+ {
+ if (vendor)
+ {
+ snprintf(method, sizeof(method), "/%d-%d", type, vendor);
+ }
+ else
+ {
+ snprintf(method, sizeof(method), "/%N",
+ eap_type_short_names, type);
+ }
+ }
+ written = snprintf(pos, len, "/%N%s", eap_code_short_names,
+ eap->get_code(eap), method);
if (written >= len || written < 0)
{
return buf;
@@ -947,7 +977,7 @@ static char* get_string(private_message_t *this, char *buf, int len)
}
}
enumerator->destroy(enumerator);
-
+
/* remove last space */
snprintf(pos, len, " ]");
return buf;
@@ -961,7 +991,7 @@ static void order_payloads(private_message_t *this)
linked_list_t *list;
payload_t *payload;
int i;
-
+
/* move to temp list */
list = linked_list_create();
while (this->payloads->remove_last(this->payloads,
@@ -975,7 +1005,7 @@ static void order_payloads(private_message_t *this)
enumerator_t *enumerator;
notify_payload_t *notify;
payload_order_t order = this->message_rule->payload_order[i];
-
+
/* ... find all payload ... */
enumerator = list->create_enumerator(list);
while (enumerator->enumerate(enumerator, &payload))
@@ -984,7 +1014,7 @@ static void order_payloads(private_message_t *this)
if (payload->get_type(payload) == order.type)
{
notify = (notify_payload_t*)payload;
-
+
/**... and check notify for type. */
if (order.type != NOTIFY || order.notify == 0 ||
order.notify == notify->get_notify_type(notify))
@@ -992,17 +1022,21 @@ static void order_payloads(private_message_t *this)
list->remove_at(list, enumerator);
add_payload(this, payload);
}
- }
+ }
}
enumerator->destroy(enumerator);
}
/* append all payloads without a rule to the end */
while (list->remove_last(list, (void**)&payload) == SUCCESS)
{
- DBG1(DBG_ENC, "payload %N has no ordering rule in %N %s",
- payload_type_names, payload->get_type(payload),
- exchange_type_names, this->message_rule->exchange_type,
- this->message_rule->is_request ? "request" : "response");
+ /* do not complain about payloads in private use space */
+ if (payload->get_type(payload) < 128)
+ {
+ DBG1(DBG_ENC, "payload %N has no ordering rule in %N %s",
+ payload_type_names, payload->get_type(payload),
+ exchange_type_names, this->message_rule->exchange_type,
+ this->message_rule->is_request ? "request" : "response");
+ }
add_payload(this, payload);
}
list->destroy(list);
@@ -1014,80 +1048,73 @@ static void order_payloads(private_message_t *this)
static status_t encrypt_payloads(private_message_t *this,
crypter_t *crypter, signer_t* signer)
{
- encryption_payload_t *encryption_payload = NULL;
+ encryption_payload_t *encryption;
+ linked_list_t *payloads;
+ payload_t *current;
status_t status;
- linked_list_t *all_payloads;
-
+
if (!this->message_rule->encrypted_content)
{
DBG2(DBG_ENC, "message doesn't have to be encrypted");
/* message contains no content to encrypt */
return SUCCESS;
}
-
+
if (!crypter || !signer)
{
DBG2(DBG_ENC, "no crypter or signer specified, do not encrypt message");
/* message contains no content to encrypt */
return SUCCESS;
}
-
+
DBG2(DBG_ENC, "copy all payloads to a temporary list");
- all_payloads = linked_list_create();
-
+ payloads = linked_list_create();
+
/* first copy all payloads in a temporary list */
while (this->payloads->get_count(this->payloads) > 0)
{
- void *current_payload;
- this->payloads->remove_first(this->payloads,&current_payload);
- all_payloads->insert_last(all_payloads,current_payload);
+ this->payloads->remove_first(this->payloads, (void**)&current);
+ payloads->insert_last(payloads, current);
}
-
- encryption_payload = encryption_payload_create();
+
+ encryption = encryption_payload_create();
DBG2(DBG_ENC, "check each payloads if they have to get encrypted");
- while (all_payloads->get_count(all_payloads) > 0)
+ while (payloads->get_count(payloads) > 0)
{
- payload_rule_t *payload_rule;
- payload_t *current_payload;
- bool to_encrypt = FALSE;
-
- all_payloads->remove_first(all_payloads,(void **)&current_payload);
-
- status = get_payload_rule(this,
- current_payload->get_type(current_payload),&payload_rule);
- /* for payload types which are not found in supported payload list,
- * it is presumed that they don't have to be encrypted */
- if ((status == SUCCESS) && (payload_rule->encrypted))
+ payload_rule_t *rule;
+ payload_type_t type;
+ bool to_encrypt = TRUE;
+
+ payloads->remove_first(payloads, (void**)&current);
+
+ type = current->get_type(current);
+ if (get_payload_rule(this, type, &rule) == SUCCESS)
{
- DBG2(DBG_ENC, "payload %N gets encrypted",
- payload_type_names, current_payload->get_type(current_payload));
- to_encrypt = TRUE;
+ to_encrypt = rule->encrypted;
}
-
if (to_encrypt)
{
DBG2(DBG_ENC, "insert payload %N to encryption payload",
- payload_type_names, current_payload->get_type(current_payload));
- encryption_payload->add_payload(encryption_payload,current_payload);
+ payload_type_names, current->get_type(current));
+ encryption->add_payload(encryption, current);
}
else
{
DBG2(DBG_ENC, "insert payload %N unencrypted",
- payload_type_names ,current_payload->get_type(current_payload));
- add_payload(this, (payload_t*)encryption_payload);
+ payload_type_names, current->get_type(current));
+ add_payload(this, (payload_t*)current);
}
}
- status = SUCCESS;
DBG2(DBG_ENC, "encrypting encryption payload");
- encryption_payload->set_transforms(encryption_payload, crypter,signer);
- status = encryption_payload->encrypt(encryption_payload);
+ encryption->set_transforms(encryption, crypter, signer);
+ status = encryption->encrypt(encryption);
DBG2(DBG_ENC, "add encrypted payload to payload list");
- add_payload(this, (payload_t*)encryption_payload);
-
- all_payloads->destroy(all_payloads);
-
+ add_payload(this, (payload_t*)encryption);
+
+ payloads->destroy(payloads);
+
return status;
}
@@ -1104,28 +1131,28 @@ static status_t generate(private_message_t *this, crypter_t *crypter,
status_t status;
chunk_t packet_data;
char str[256];
-
+
if (is_encoded(this))
{
/* already generated, return a new packet clone */
*packet = this->packet->clone(this->packet);
return SUCCESS;
}
-
+
if (this->exchange_type == EXCHANGE_TYPE_UNDEFINED)
{
DBG1(DBG_ENC, "exchange type is not defined");
return INVALID_STATE;
}
-
+
if (this->packet->get_source(this->packet) == NULL ||
- this->packet->get_destination(this->packet) == NULL)
+ this->packet->get_destination(this->packet) == NULL)
{
DBG1(DBG_ENC, "%s not defined",
!this->packet->get_source(this->packet) ? "source" : "destination");
return INVALID_STATE;
}
-
+
/* set the rules for this messge */
status = set_message_rule(this);
if (status != SUCCESS)
@@ -1133,11 +1160,11 @@ static status_t generate(private_message_t *this, crypter_t *crypter,
DBG1(DBG_ENC, "no message rules specified for this message type");
return NOT_SUPPORTED;
}
-
+
order_payloads(this);
-
+
DBG1(DBG_ENC, "generating %s", get_string(this, str, sizeof(str)));
-
+
/* going to encrypt all content which have to be encrypted */
status = encrypt_payloads(this, crypter, signer);
if (status != SUCCESS)
@@ -1145,21 +1172,24 @@ static status_t generate(private_message_t *this, crypter_t *crypter,
DBG1(DBG_ENC, "payload encryption failed");
return status;
}
-
+
/* build ike header */
ike_header = ike_header_create();
-
+
ike_header->set_exchange_type(ike_header, this->exchange_type);
ike_header->set_message_id(ike_header, this->message_id);
ike_header->set_response_flag(ike_header, !this->is_request);
- ike_header->set_initiator_flag(ike_header, this->ike_sa_id->is_initiator(this->ike_sa_id));
- ike_header->set_initiator_spi(ike_header, this->ike_sa_id->get_initiator_spi(this->ike_sa_id));
- ike_header->set_responder_spi(ike_header, this->ike_sa_id->get_responder_spi(this->ike_sa_id));
-
+ ike_header->set_initiator_flag(ike_header,
+ this->ike_sa_id->is_initiator(this->ike_sa_id));
+ ike_header->set_initiator_spi(ike_header,
+ this->ike_sa_id->get_initiator_spi(this->ike_sa_id));
+ ike_header->set_responder_spi(ike_header,
+ this->ike_sa_id->get_responder_spi(this->ike_sa_id));
+
generator = generator_create();
-
+
payload = (payload_t*)ike_header;
-
+
/* generate every payload expect last one, this is done later*/
enumerator = create_payload_enumerator(this);
while (enumerator->enumerate(enumerator, &next_payload))
@@ -1169,18 +1199,18 @@ static status_t generate(private_message_t *this, crypter_t *crypter,
payload = next_payload;
}
enumerator->destroy(enumerator);
-
+
/* last payload has no next payload*/
payload->set_next_type(payload, NO_PAYLOAD);
generator->generate_payload(generator, payload);
ike_header->destroy(ike_header);
-
+
/* build packet */
generator->write_to_chunk(generator, &packet_data);
generator->destroy(generator);
-
+
/* if last payload is of type encrypted, integrity checksum if necessary */
if (payload->get_type(payload) == ENCRYPTED)
{
@@ -1192,12 +1222,12 @@ static status_t generate(private_message_t *this, crypter_t *crypter,
return status;
}
}
-
+
this->packet->set_data(this->packet, packet_data);
-
+
/* clone packet for caller */
*packet = this->packet->clone(this->packet);
-
+
DBG2(DBG_ENC, "message generated successfully");
return SUCCESS;
}
@@ -1205,7 +1235,7 @@ static status_t generate(private_message_t *this, crypter_t *crypter,
/**
* Implementation of message_t.get_packet.
*/
-static packet_t *get_packet (private_message_t *this)
+static packet_t *get_packet(private_message_t *this)
{
if (this->packet == NULL)
{
@@ -1217,7 +1247,7 @@ static packet_t *get_packet (private_message_t *this)
/**
* Implementation of message_t.get_packet_data.
*/
-static chunk_t get_packet_data (private_message_t *this)
+static chunk_t get_packet_data(private_message_t *this)
{
if (this->packet == NULL)
{
@@ -1233,48 +1263,51 @@ static status_t parse_header(private_message_t *this)
{
ike_header_t *ike_header;
status_t status;
-
+
DBG2(DBG_ENC, "parsing header of message");
-
+
this->parser->reset_context(this->parser);
- status = this->parser->parse_payload(this->parser,HEADER,(payload_t **) &ike_header);
+ status = this->parser->parse_payload(this->parser, HEADER,
+ (payload_t**)&ike_header);
if (status != SUCCESS)
{
DBG1(DBG_ENC, "header could not be parsed");
return status;
-
+
}
-
+
/* verify payload */
- status = ike_header->payload_interface.verify(&(ike_header->payload_interface));
+ status = ike_header->payload_interface.verify(
+ &ike_header->payload_interface);
if (status != SUCCESS)
{
DBG1(DBG_ENC, "header verification failed");
ike_header->destroy(ike_header);
return status;
}
-
+
if (this->ike_sa_id != NULL)
{
this->ike_sa_id->destroy(this->ike_sa_id);
}
-
+
this->ike_sa_id = ike_sa_id_create(ike_header->get_initiator_spi(ike_header),
- ike_header->get_responder_spi(ike_header),
- ike_header->get_initiator_flag(ike_header));
+ ike_header->get_responder_spi(ike_header),
+ ike_header->get_initiator_flag(ike_header));
this->exchange_type = ike_header->get_exchange_type(ike_header);
this->message_id = ike_header->get_message_id(ike_header);
this->is_request = (!(ike_header->get_response_flag(ike_header)));
this->major_version = ike_header->get_maj_version(ike_header);
this->minor_version = ike_header->get_min_version(ike_header);
- this->first_payload = ike_header->payload_interface.get_next_type(&(ike_header->payload_interface));
-
+ this->first_payload = ike_header->payload_interface.get_next_type(
+ &ike_header->payload_interface);
+
DBG2(DBG_ENC, "parsed a %N %s", exchange_type_names, this->exchange_type,
this->is_request ? "request" : "response");
-
+
ike_header->destroy(ike_header);
-
+
/* get the rules for this messge */
status = set_message_rule(this);
if (status != SUCCESS)
@@ -1283,14 +1316,15 @@ static status_t parse_header(private_message_t *this)
exchange_type_names, this->exchange_type,
this->is_request ? "request" : "response");
}
-
+
return status;
}
/**
* Implementation of private_message_t.decrypt_and_verify_payloads.
*/
-static status_t decrypt_payloads(private_message_t *this,crypter_t *crypter, signer_t* signer)
+static status_t decrypt_payloads(private_message_t *this, crypter_t *crypter,
+ signer_t* signer)
{
bool current_payload_was_encrypted = FALSE;
payload_t *previous_payload = NULL;
@@ -1306,20 +1340,20 @@ static status_t decrypt_payloads(private_message_t *this,crypter_t *crypter, sig
{
payload_rule_t *payload_rule;
payload_type_t current_payload_type;
-
+
/* needed to check */
current_payload_type = current_payload->get_type(current_payload);
-
+
DBG2(DBG_ENC, "process payload of type %N",
payload_type_names, current_payload_type);
-
+
if (current_payload_type == ENCRYPTED)
{
encryption_payload_t *encryption_payload;
payload_t *current_encrypted_payload;
-
+
encryption_payload = (encryption_payload_t*)current_payload;
-
+
DBG2(DBG_ENC, "found an encryption payload");
if (payload_number != this->payloads->get_count(this->payloads))
@@ -1330,7 +1364,8 @@ static status_t decrypt_payloads(private_message_t *this,crypter_t *crypter, sig
return VERIFY_ERROR;
}
/* decrypt */
- encryption_payload->set_transforms(encryption_payload, crypter, signer);
+ encryption_payload->set_transforms(encryption_payload,
+ crypter, signer);
DBG2(DBG_ENC, "verify signature of encryption payload");
status = encryption_payload->verify_signature(encryption_payload,
this->packet->get_data(this->packet));
@@ -1348,10 +1383,10 @@ static status_t decrypt_payloads(private_message_t *this,crypter_t *crypter, sig
iterator->destroy(iterator);
return PARSE_ERROR;
}
-
+
/* needed later to find out if a payload was encrypted */
current_payload_was_encrypted = TRUE;
-
+
/* check if there are payloads contained in the encryption payload */
if (encryption_payload->get_payload_count(encryption_payload) == 0)
{
@@ -1363,39 +1398,52 @@ static status_t decrypt_payloads(private_message_t *this,crypter_t *crypter, sig
}
else
{
- /* encryption_payload is replaced with first payload contained in encryption_payload */
- encryption_payload->remove_first_payload(encryption_payload, &current_encrypted_payload);
- iterator->replace(iterator,NULL,(void *) current_encrypted_payload);
- current_payload_type = current_encrypted_payload->get_type(current_encrypted_payload);
+ /* encryption_payload is replaced with first payload contained
+ * in encryption_payload */
+ encryption_payload->remove_first_payload(encryption_payload,
+ &current_encrypted_payload);
+ iterator->replace(iterator, NULL,
+ (void *)current_encrypted_payload);
+ current_payload_type = current_encrypted_payload->get_type(
+ current_encrypted_payload);
}
-
+
/* is the current paylad the first in the message? */
if (previous_payload == NULL)
{
- /* yes, set the first payload type of the message to the current type */
+ /* yes, set the first payload type of the message to the
+ * current type */
this->first_payload = current_payload_type;
}
else
{
- /* no, set the next_type of the previous payload to the current type */
- previous_payload->set_next_type(previous_payload, current_payload_type);
+ /* no, set the next_type of the previous payload to the
+ * current type */
+ previous_payload->set_next_type(previous_payload,
+ current_payload_type);
}
-
+
/* all encrypted payloads are added to the payload list */
while (encryption_payload->get_payload_count(encryption_payload) > 0)
{
- encryption_payload->remove_first_payload(encryption_payload, &current_encrypted_payload);
- DBG2(DBG_ENC, "insert unencrypted payload of type %N at end of list",
- payload_type_names, current_encrypted_payload->get_type(current_encrypted_payload));
- this->payloads->insert_last(this->payloads,current_encrypted_payload);
+ encryption_payload->remove_first_payload(encryption_payload,
+ &current_encrypted_payload);
+ DBG2(DBG_ENC, "insert unencrypted payload of type "
+ "%N at end of list", payload_type_names,
+ current_encrypted_payload->get_type(
+ current_encrypted_payload));
+ this->payloads->insert_last(this->payloads,
+ current_encrypted_payload);
}
-
+
/* encryption payload is processed, payloads are moved. Destroy it. */
- encryption_payload->destroy(encryption_payload);
+ encryption_payload->destroy(encryption_payload);
}
- /* we allow unknown payloads of any type and don't bother if it was encrypted. Not our problem. */
- if (current_payload_type != UNKNOWN_PAYLOAD && current_payload_type != NO_PAYLOAD)
+ /* we allow unknown payloads of any type and don't bother if it was
+ * encrypted. Not our problem. */
+ if (current_payload_type != UNKNOWN_PAYLOAD &&
+ current_payload_type != NO_PAYLOAD)
{
/* get the ruleset for found payload */
status = get_payload_rule(this, current_payload_type, &payload_rule);
@@ -1407,11 +1455,13 @@ static status_t decrypt_payloads(private_message_t *this,crypter_t *crypter, sig
iterator->destroy(iterator);
return VERIFY_ERROR;
}
-
- /* check if the payload was encrypted, and if it should been have encrypted */
+
+ /* check if the payload was encrypted, and if it should been have
+ * encrypted */
if (payload_rule->encrypted != current_payload_was_encrypted)
{
- /* payload was not encrypted, but should have been. or vice-versa */
+ /* payload was not encrypted, but should have been.
+ * or vice-versa */
DBG1(DBG_ENC, "payload type %N should be %s!",
payload_type_names, current_payload_type,
(payload_rule->encrypted) ? "encrypted" : "not encrypted");
@@ -1437,24 +1487,24 @@ static status_t verify(private_message_t *this)
enumerator_t *enumerator;
payload_t *current_payload;
size_t total_found_payloads = 0;
-
+
DBG2(DBG_ENC, "verifying message structure");
-
+
/* check for payloads with wrong count*/
for (i = 0; i < this->message_rule->payload_rule_count; i++)
{
size_t found_payloads = 0;
payload_rule_t *rule;
-
+
rule = &this->message_rule->payload_rules[i];
enumerator = create_payload_enumerator(this);
-
+
/* check all payloads for specific rule */
while (enumerator->enumerate(enumerator, &current_payload))
{
payload_type_t current_payload_type;
unknown_payload_t *unknown_payload;
-
+
current_payload_type = current_payload->get_type(current_payload);
if (current_payload_type == UNKNOWN_PAYLOAD)
{
@@ -1465,7 +1515,7 @@ static status_t verify(private_message_t *this)
DBG1(DBG_ENC, "%N is not supported, but its critical!",
payload_type_names, current_payload_type);
enumerator->destroy(enumerator);
- return NOT_SUPPORTED;
+ return NOT_SUPPORTED;
}
}
else if (current_payload_type == rule->payload_type)
@@ -1474,8 +1524,8 @@ static status_t verify(private_message_t *this)
total_found_payloads++;
DBG2(DBG_ENC, "found payload of type %N", payload_type_names,
rule->payload_type);
-
- /* as soon as ohe payload occures more then specified,
+
+ /* as soon as ohe payload occures more then specified,
* the verification fails */
if (found_payloads >
rule->max_occurence)
@@ -1489,7 +1539,7 @@ static status_t verify(private_message_t *this)
}
}
}
-
+
if (found_payloads < rule->min_occurence)
{
DBG1(DBG_ENC, "payload of type %N not occured %d times (%d)",
@@ -1502,7 +1552,7 @@ static status_t verify(private_message_t *this)
this->payloads->get_count(this->payloads) == total_found_payloads)
{
enumerator->destroy(enumerator);
- return SUCCESS;
+ return SUCCESS;
}
enumerator->destroy(enumerator);
}
@@ -1512,14 +1562,15 @@ static status_t verify(private_message_t *this)
/**
* Implementation of message_t.parse_body.
*/
-static status_t parse_body(private_message_t *this, crypter_t *crypter, signer_t *signer)
+static status_t parse_body(private_message_t *this, crypter_t *crypter,
+ signer_t *signer)
{
status_t status = SUCCESS;
payload_type_t current_payload_type;
char str[256];
-
- current_payload_type = this->first_payload;
-
+
+ current_payload_type = this->first_payload;
+
DBG2(DBG_ENC, "parsing body of message, first payload is %N",
payload_type_names, current_payload_type);
@@ -1527,13 +1578,13 @@ static status_t parse_body(private_message_t *this, crypter_t *crypter, signer_t
while ((current_payload_type != NO_PAYLOAD))
{
payload_t *current_payload;
-
- DBG2(DBG_ENC, "starting parsing a %N payload",
+
+ DBG2(DBG_ENC, "starting parsing a %N payload",
payload_type_names, current_payload_type);
-
+
/* parse current payload */
- status = this->parser->parse_payload(this->parser,current_payload_type,(payload_t **) &current_payload);
-
+ status = this->parser->parse_payload(this->parser, current_payload_type,
+ (payload_t**)&current_payload);
if (status != SUCCESS)
{
DBG1(DBG_ENC, "payload type %N could not be parsed",
@@ -1543,7 +1594,7 @@ static status_t parse_body(private_message_t *this, crypter_t *crypter, signer_t
DBG2(DBG_ENC, "verifying payload of type %N",
payload_type_names, current_payload_type);
-
+
/* verify it, stop parsig if its invalid */
status = current_payload->verify(current_payload);
if (status != SUCCESS)
@@ -1553,19 +1604,20 @@ static status_t parse_body(private_message_t *this, crypter_t *crypter, signer_t
current_payload->destroy(current_payload);
return VERIFY_ERROR;
}
-
+
DBG2(DBG_ENC, "%N payload verified. Adding to payload list",
payload_type_names, current_payload_type);
this->payloads->insert_last(this->payloads,current_payload);
-
- /* an encryption payload is the last one, so STOP here. decryption is done later */
+
+ /* an encryption payload is the last one, so STOP here. decryption is
+ * done later */
if (current_payload_type == ENCRYPTED)
{
DBG2(DBG_ENC, "%N payload found. Stop parsing",
payload_type_names, current_payload_type);
break;
}
-
+
/* get next payload type */
current_payload_type = current_payload->get_next_type(current_payload);
}
@@ -1579,15 +1631,15 @@ static status_t parse_body(private_message_t *this, crypter_t *crypter, signer_t
return status;
}
}
-
+
status = verify(this);
if (status != SUCCESS)
{
return status;
}
-
+
DBG1(DBG_ENC, "parsed %s", get_string(this, str, sizeof(str)));
-
+
return SUCCESS;
}
@@ -1641,26 +1693,26 @@ message_t *message_create_from_packet(packet_t *packet)
this->public.get_packet = (packet_t * (*) (message_t*)) get_packet;
this->public.get_packet_data = (chunk_t (*) (message_t *this)) get_packet_data;
this->public.destroy = (void(*)(message_t*))destroy;
-
+
/* private values */
this->exchange_type = EXCHANGE_TYPE_UNDEFINED;
this->is_request = TRUE;
this->ike_sa_id = NULL;
this->first_payload = NO_PAYLOAD;
this->message_id = 0;
-
+
/* private values */
if (packet == NULL)
{
- packet = packet_create();
+ packet = packet_create();
}
this->message_rule = NULL;
this->packet = packet;
this->payloads = linked_list_create();
-
+
/* parser is created from data of packet */
this->parser = parser_create(this->packet->get_data(this->packet));
-
+
return (&this->public);
}
diff --git a/src/charon/encoding/message.h b/src/charon/encoding/message.h
index 1db3ea0cc..2c7718f49 100644
--- a/src/charon/encoding/message.h
+++ b/src/charon/encoding/message.h
@@ -58,7 +58,7 @@ struct message_t {
* @return major version of the message
*/
u_int8_t (*get_major_version) (message_t *this);
-
+
/**
* Sets the IKE minor version of the message.
*
@@ -86,7 +86,7 @@ struct message_t {
* @return message_id type of the message
*/
u_int32_t (*get_message_id) (message_t *this);
-
+
/**
* Gets the initiator SPI of the message.
*
@@ -103,7 +103,7 @@ struct message_t {
/**
* Sets the IKE_SA ID of the message.
- *
+ *
* ike_sa_id gets cloned.
*
* @param ike_sa_id ike_sa_id to set
@@ -132,10 +132,10 @@ struct message_t {
* @return exchange type of the message
*/
exchange_type_t (*get_exchange_type) (message_t *this);
-
+
/**
* Gets the payload type of the first payload.
- *
+ *
* @return payload type of the first payload
*/
payload_type_t (*get_first_payload_type) (message_t *this);
@@ -156,20 +156,20 @@ struct message_t {
/**
* Append a payload to the message.
- *
+ *
* If the payload must be encrypted is not specified here. Encryption
* of payloads is evaluated via internal rules for the messages and
* is done before generation. The order of payloads may change, since
- * all payloads to encrypt are added to the encryption payload, which is
+ * all payloads to encrypt are added to the encryption payload, which is
* always the last one.
*
* @param payload payload to append
- */
+ */
void (*add_payload) (message_t *this, payload_t *payload);
/**
* Build a notify payload and add it to the message.
- *
+ *
* This is a helper method to create notify messages or add
* notify payload to messages. The flush parameter specifies if existing
* payloads should get removed before appending the notify.
@@ -177,13 +177,13 @@ struct message_t {
* @param flush TRUE to remove existing payloads
* @param type type of the notify
* @param data a chunk of data to add to the notify, gets cloned
- */
- void (*add_notify) (message_t *this, bool flush, notify_type_t type,
+ */
+ void (*add_notify) (message_t *this, bool flush, notify_type_t type,
chunk_t data);
/**
* Parses header of message.
- *
+ *
* Begins parisng of a message created via message_create_from_packet().
* The parsing context is stored, so a subsequent call to parse_body()
* will continue the parsing process.
@@ -194,17 +194,17 @@ struct message_t {
* - FAILED if consistence check of header failed
*/
status_t (*parse_header) (message_t *this);
-
+
/**
* Parses body of message.
- *
- * The body gets not only parsed, but rather it gets verified.
- * All payloads are verified if they are allowed to exist in the message
- * of this type and if their own structure is ok.
- * If there are encrypted payloads, they get decrypted via the supplied
+ *
+ * The body gets not only parsed, but rather it gets verified.
+ * All payloads are verified if they are allowed to exist in the message
+ * of this type and if their own structure is ok.
+ * If there are encrypted payloads, they get decrypted via the supplied
* crypter. Also the message integrity gets verified with the supplied
* signer.
- * Crypter/signer can be omitted (by passing NULL) when no encryption
+ * Crypter/signer can be omitted (by passing NULL) when no encryption
* payload is expected.
*
* @param crypter crypter to decrypt encryption payloads
@@ -222,13 +222,13 @@ struct message_t {
/**
* Generates the UDP packet of specific message.
- *
+ *
* Payloads which must be encrypted are generated first and added to
- * an encryption payload. This encryption payload will get encrypted via
+ * an encryption payload. This encryption payload will get encrypted via
* the supplied crypter. Then all other payloads and the header get generated.
- * After that, the checksum is added to the encryption payload over the full
+ * After that, the checksum is added to the encryption payload over the full
* message.
- * Crypter/signer can be omitted (by passing NULL) when no encryption
+ * Crypter/signer can be omitted (by passing NULL) when no encryption
* payload is expected.
* Generation is only done once, multiple calls will just return a packet copy.
*
@@ -240,66 +240,66 @@ struct message_t {
* - INVALID_STATE if exchange type is currently not set
* - NOT_FOUND if no rules found for message generation
* - INVALID_STATE if crypter/signer not supplied but needed.
- */
+ */
status_t (*generate) (message_t *this, crypter_t *crypter, signer_t *signer, packet_t **packet);
/**
- * Gets the source host informations.
- *
- * @warning Returned host_t object is not getting cloned,
+ * Gets the source host informations.
+ *
+ * @warning Returned host_t object is not getting cloned,
* do not destroy nor modify.
*
* @return host_t object representing source host
- */
+ */
host_t * (*get_source) (message_t *this);
-
+
/**
- * Sets the source host informations.
- *
+ * Sets the source host informations.
+ *
* @warning host_t object is not getting cloned and gets destroyed by
* message_t.destroy or next call of message_t.set_source.
*
* @param host host_t object representing source host
- */
+ */
void (*set_source) (message_t *this, host_t *host);
/**
- * Gets the destination host informations.
- *
- * @warning Returned host_t object is not getting cloned,
+ * Gets the destination host informations.
+ *
+ * @warning Returned host_t object is not getting cloned,
* do not destroy nor modify.
*
* @return host_t object representing destination host
- */
+ */
host_t * (*get_destination) (message_t *this);
/**
- * Sets the destination host informations.
- *
+ * Sets the destination host informations.
+ *
* @warning host_t object is not getting cloned and gets destroyed by
* message_t.destroy or next call of message_t.set_destination.
*
* @param host host_t object representing destination host
- */
+ */
void (*set_destination) (message_t *this, host_t *host);
-
+
/**
* Create an enumerator over all payloads.
*
* @return enumerator over payload_t
- */
+ */
enumerator_t * (*create_payload_enumerator) (message_t *this);
-
+
/**
* Find a payload of a specific type.
- *
- * Returns the first occurance.
+ *
+ * Returns the first occurance.
*
* @param type type of the payload to find
* @return payload, or NULL if no such payload found
- */
+ */
payload_t* (*get_payload) (message_t *this, payload_type_t type);
-
+
/**
* Get the first notify payload of a specific type.
*
@@ -307,21 +307,21 @@ struct message_t {
* @return notify payload, NULL if no such notify found
*/
notify_payload_t* (*get_notify)(message_t *this, notify_type_t type);
-
+
/**
* Returns a clone of the internal stored packet_t object.
*
* @return packet_t object as clone of internal one
- */
+ */
packet_t * (*get_packet) (message_t *this);
-
+
/**
* Returns a clone of the internal stored packet_t data.
*
* @return clone of the internal stored packet_t data.
- */
+ */
chunk_t (*get_packet_data) (message_t *this);
-
+
/**
* Destroys a message and all including objects.
*/
@@ -330,16 +330,16 @@ struct message_t {
/**
* Creates an message_t object from a incoming UDP Packet.
- *
- * @warning the given packet_t object is not copied and gets
+ *
+ * @warning the given packet_t object is not copied and gets
* destroyed in message_t's destroy call.
- *
+ *
* - exchange_type is set to NOT_SET
* - original_initiator is set to TRUE
* - is_request is set to TRUE
* Call message_t.parse_header afterwards.
- *
- * @param packet packet_t object which is assigned to message
+ *
+ * @param packet packet_t object which is assigned to message
* @return message_t object
*/
message_t * message_create_from_packet(packet_t *packet);
@@ -351,7 +351,7 @@ message_t * message_create_from_packet(packet_t *packet);
* - exchange_type is set to NOT_SET
* - original_initiator is set to TRUE
* - is_request is set to TRUE
- *
+ *
* @return message_t object
*/
message_t * message_create(void);
diff --git a/src/charon/encoding/parser.c b/src/charon/encoding/parser.c
index ac2b78c28..9aa34b1bc 100644
--- a/src/charon/encoding/parser.c
+++ b/src/charon/encoding/parser.c
@@ -50,7 +50,7 @@ typedef struct private_parser_t private_parser_t;
/**
* Private data stored in a context.
- *
+ *
* Contains pointers and counters to store current state.
*/
struct private_parser_t {
@@ -58,27 +58,27 @@ struct private_parser_t {
* Public members, see parser_t.
*/
parser_t public;
-
+
/**
* Current bit for reading in input data.
*/
u_int8_t bit_pos;
-
+
/**
* Current byte for reading in input data.
*/
u_int8_t *byte_pos;
-
+
/**
* Input data to parse.
*/
u_int8_t *input;
-
+
/**
* Roof of input, used for length-checking.
*/
u_int8_t *input_roof;
-
+
/**
* Set of encoding rules for this parsing session.
*/
@@ -277,11 +277,11 @@ static bool parse_bit(private_parser_t *this, int rule_number,
return short_input(this, rule_number);
}
if (output_pos)
- {
+ {
u_int8_t mask;
mask = 0x01 << (7 - this->bit_pos);
*output_pos = *this->byte_pos & mask;
-
+
if (*output_pos)
{ /* set to a "clean", comparable true */
*output_pos = TRUE;
@@ -303,7 +303,7 @@ static bool parse_list(private_parser_t *this, int rule_number,
linked_list_t **output_pos, payload_type_t payload_type, int length)
{
linked_list_t *list = *output_pos;
-
+
if (length < 0)
{
return short_input(this, rule_number);
@@ -316,10 +316,10 @@ static bool parse_list(private_parser_t *this, int rule_number,
{
u_int8_t *pos_before = this->byte_pos;
payload_t *payload;
-
+
DBG2(DBG_ENC, " %d bytes left, parsing recursively %N",
length, payload_type_names, payload_type);
-
+
if (parse_payload(this, payload_type, &payload) != SUCCESS)
{
DBG1(DBG_ENC, " parsing of a %N substructure failed",
@@ -377,25 +377,25 @@ static status_t parse_payload(private_parser_t *this,
bool attribute_format = FALSE;
int rule_number;
encoding_rule_t *rule;
-
+
/* create instance of the payload to parse */
pld = payload_create(payload_type);
-
+
DBG2(DBG_ENC, "parsing %N payload, %d bytes left",
payload_type_names, payload_type, this->input_roof - this->byte_pos);
-
+
DBG3(DBG_ENC, "parsing payload from %b",
this->byte_pos, this->input_roof - this->byte_pos);
-
+
if (pld->get_type(pld) == UNKNOWN_PAYLOAD)
{
DBG1(DBG_ENC, " payload type %d is unknown, handling as %N",
payload_type, payload_type_names, UNKNOWN_PAYLOAD);
}
-
+
/* base pointer for output, avoids casting in every rule */
output = pld;
-
+
/* parse the payload with its own rulse */
pld->get_encoding_rules(pld, &this->rules, &rule_count);
for (rule_number = 0; rule_number < rule_count; rule_number++)
@@ -765,7 +765,7 @@ static status_t parse_payload(private_parser_t *this,
case ADDRESS:
{
int address_length = (ts_type == TS_IPV4_ADDR_RANGE) ? 4 : 16;
-
+
if (!parse_chunk(this, rule_number, output + rule->offset,
address_length))
{
@@ -808,7 +808,7 @@ static status_t parse_payload(private_parser_t *this,
/* process next rulue */
rule++;
}
-
+
*payload = pld;
DBG2(DBG_ENC, "parsing %N payload finished",
payload_type_names, payload_type);
@@ -846,17 +846,17 @@ static void destroy(private_parser_t *this)
parser_t *parser_create(chunk_t data)
{
private_parser_t *this = malloc_thing(private_parser_t);
-
+
this->public.parse_payload = (status_t(*)(parser_t*,payload_type_t,payload_t**))parse_payload;
this->public.reset_context = (void(*)(parser_t*)) reset_context;
this->public.get_remaining_byte_count = (int (*) (parser_t *))get_remaining_byte_count;
this->public.destroy = (void(*)(parser_t*)) destroy;
-
+
this->input = data.ptr;
this->byte_pos = data.ptr;
this->bit_pos = 0;
this->input_roof = data.ptr + data.len;
-
+
return &this->public;
}
diff --git a/src/charon/encoding/parser.h b/src/charon/encoding/parser.h
index 230492438..27c5f03fe 100644
--- a/src/charon/encoding/parser.h
+++ b/src/charon/encoding/parser.h
@@ -36,32 +36,32 @@ typedef struct parser_t parser_t;
* The parser remains the state until destroyed.
*/
struct parser_t {
-
+
/**
* Parses the next payload.
- *
+ *
* @warning Caller is responsible for freeing allocated payload.
- *
+ *
* Rules for parsing are described in the payload definition.
*
* @param payload_type payload type to parse
* @param payload pointer where parsed payload was allocated
- * @return
+ * @return
* - SUCCESSFUL if succeeded,
* - PARSE_ERROR if corrupted/invalid data found
*/
status_t (*parse_payload) (parser_t *this, payload_type_t payload_type, payload_t **payload);
-
+
/**
* Gets the remaining byte count which is not currently parsed.
*/
int (*get_remaining_byte_count) (parser_t *this);
-
+
/**
* Resets the current parser context.
*/
void (*reset_context) (parser_t *this);
-
+
/**
* Destroys a parser_t object.
*/
@@ -70,7 +70,7 @@ struct parser_t {
/**
* Constructor to create a parser_t object.
- *
+ *
* @param data chunk of data to parse with this parser_t object
* @return parser_t object
*/
diff --git a/src/charon/encoding/payloads/auth_payload.c b/src/charon/encoding/payloads/auth_payload.c
index 53406f564..d31208abb 100644
--- a/src/charon/encoding/payloads/auth_payload.c
+++ b/src/charon/encoding/payloads/auth_payload.c
@@ -23,15 +23,15 @@ typedef struct private_auth_payload_t private_auth_payload_t;
/**
* Private data of an auth_payload_t object.
- *
+ *
*/
struct private_auth_payload_t {
-
+
/**
* Public auth_payload_t interface.
*/
auth_payload_t public;
-
+
/**
* Next payload type.
*/
@@ -41,17 +41,17 @@ struct private_auth_payload_t {
* Critical flag.
*/
bool critical;
-
+
/**
* Length of this payload.
*/
u_int16_t payload_length;
-
+
/**
* Method of the AUTH Data.
*/
u_int8_t auth_method;
-
+
/**
* The contained auth data value.
*/
@@ -60,16 +60,16 @@ struct private_auth_payload_t {
/**
* Encoding rules to parse or generate a AUTH payload
- *
- * The defined offsets are the positions in a object of type
+ *
+ * The defined offsets are the positions in a object of type
* private_auth_payload_t.
*/
encoding_rule_t auth_payload_encodings[] = {
- /* 1 Byte next payload type, stored in the field next_payload */
+ /* 1 Byte next payload type, stored in the field next_payload */
{ U_INT_8, offsetof(private_auth_payload_t, next_payload) },
/* the critical bit */
{ FLAG, offsetof(private_auth_payload_t, critical) },
- /* 7 Bit reserved bits, nowhere stored */
+ /* 7 Bit reserved bits, nowhere stored */
{ RESERVED_BIT, 0 },
{ RESERVED_BIT, 0 },
{ RESERVED_BIT, 0 },
@@ -79,7 +79,7 @@ encoding_rule_t auth_payload_encodings[] = {
{ RESERVED_BIT, 0 },
/* Length of the whole payload*/
{ PAYLOAD_LENGTH, offsetof(private_auth_payload_t, payload_length)},
- /* 1 Byte AUTH type*/
+ /* 1 Byte AUTH type*/
{ U_INT_8, offsetof(private_auth_payload_t, auth_method) },
/* 3 reserved bytes */
{ RESERVED_BYTE, 0 },
@@ -221,8 +221,8 @@ static void destroy(private_auth_payload_t *this)
{
chunk_free(&(this->auth_data));
}
-
- free(this);
+
+ free(this);
}
/*
@@ -240,7 +240,7 @@ auth_payload_t *auth_payload_create()
this->public.payload_interface.set_next_type = (void (*) (payload_t *,payload_type_t)) set_next_type;
this->public.payload_interface.get_type = (payload_type_t (*) (payload_t *)) get_payload_type;
this->public.payload_interface.destroy = (void (*) (payload_t *))destroy;
-
+
/* public functions */
this->public.destroy = (void (*) (auth_payload_t *)) destroy;
this->public.set_auth_method = (void (*) (auth_payload_t *,auth_method_t)) set_auth_method;
@@ -248,7 +248,7 @@ auth_payload_t *auth_payload_create()
this->public.set_data = (void (*) (auth_payload_t *,chunk_t)) set_data;
this->public.get_data_clone = (chunk_t (*) (auth_payload_t *)) get_data_clone;
this->public.get_data = (chunk_t (*) (auth_payload_t *)) get_data;
-
+
/* private variables */
this->critical = FALSE;
this->next_payload = NO_PAYLOAD;
diff --git a/src/charon/encoding/payloads/auth_payload.h b/src/charon/encoding/payloads/auth_payload.h
index 4287f14d9..37ee149db 100644
--- a/src/charon/encoding/payloads/auth_payload.h
+++ b/src/charon/encoding/payloads/auth_payload.h
@@ -39,7 +39,7 @@ typedef struct auth_payload_t auth_payload_t;
* The AUTH payload format is described in RFC section 3.8.
*/
struct auth_payload_t {
-
+
/**
* The payload_t interface.
*/
@@ -51,41 +51,41 @@ struct auth_payload_t {
* @param method auth_method_t to use
*/
void (*set_auth_method) (auth_payload_t *this, auth_method_t method);
-
+
/**
* Get the AUTH method.
*
* @return auth_method_t used
*/
auth_method_t (*get_auth_method) (auth_payload_t *this);
-
+
/**
* Set the AUTH data.
- *
+ *
* Data gets cloned.
*
* @param data AUTH data as chunk_t
*/
void (*set_data) (auth_payload_t *this, chunk_t data);
-
+
/**
* Get the AUTH data.
- *
+ *
* Returned data are a copy of the internal one.
*
* @return AUTH data as chunk_t
*/
chunk_t (*get_data_clone) (auth_payload_t *this);
-
+
/**
* Get the AUTH data.
- *
+ *
* Returned data are NOT copied
*
* @return AUTH data as chunk_t
*/
chunk_t (*get_data) (auth_payload_t *this);
-
+
/**
* Destroys an auth_payload_t object.
*/
@@ -94,7 +94,7 @@ struct auth_payload_t {
/**
* Creates an empty auth_payload_t object.
- *
+ *
* @return auth_payload_t object
*/
auth_payload_t *auth_payload_create(void);
diff --git a/src/charon/encoding/payloads/cert_payload.c b/src/charon/encoding/payloads/cert_payload.c
index 54a8c1392..6dd3141f0 100644
--- a/src/charon/encoding/payloads/cert_payload.c
+++ b/src/charon/encoding/payloads/cert_payload.c
@@ -43,14 +43,14 @@ typedef struct private_cert_payload_t private_cert_payload_t;
/**
* Private data of an cert_payload_t object.
- *
+ *
*/
struct private_cert_payload_t {
/**
* Public cert_payload_t interface.
*/
cert_payload_t public;
-
+
/**
* Next payload type.
*/
@@ -60,22 +60,22 @@ struct private_cert_payload_t {
* Critical flag.
*/
bool critical;
-
+
/**
* Length of this payload.
*/
u_int16_t payload_length;
-
+
/**
* Encoding of the CERT Data.
*/
u_int8_t encoding;
-
+
/**
* The contained cert data value.
*/
chunk_t data;
-
+
/**
* TRUE if the "Hash and URL" data is invalid
*/
@@ -84,17 +84,17 @@ struct private_cert_payload_t {
/**
* Encoding rules to parse or generate a CERT payload
- *
- * The defined offsets are the positions in a object of type
+ *
+ * The defined offsets are the positions in a object of type
* private_cert_payload_t.
- *
+ *
*/
encoding_rule_t cert_payload_encodings[] = {
- /* 1 Byte next payload type, stored in the field next_payload */
+ /* 1 Byte next payload type, stored in the field next_payload */
{ U_INT_8, offsetof(private_cert_payload_t, next_payload) },
/* the critical bit */
{ FLAG, offsetof(private_cert_payload_t, critical) },
- /* 7 Bit reserved bits, nowhere stored */
+ /* 7 Bit reserved bits, nowhere stored */
{ RESERVED_BIT, 0 },
{ RESERVED_BIT, 0 },
{ RESERVED_BIT, 0 },
@@ -104,7 +104,7 @@ encoding_rule_t cert_payload_encodings[] = {
{ RESERVED_BIT, 0 },
/* Length of the whole payload*/
{ PAYLOAD_LENGTH, offsetof(private_cert_payload_t, payload_length)},
- /* 1 Byte CERT type*/
+ /* 1 Byte CERT type*/
{ U_INT_8, offsetof(private_cert_payload_t, encoding) },
/* some cert data bytes, length is defined in PAYLOAD_LENGTH */
{ CERT_DATA, offsetof(private_cert_payload_t, data) }
@@ -139,7 +139,7 @@ static status_t verify(private_cert_payload_t *this)
this->invalid_hash_and_url = TRUE;
return SUCCESS;
}
-
+
int i = 20; /* skipping the hash */
for (; i < this->data.len; ++i)
{
@@ -156,7 +156,7 @@ static status_t verify(private_cert_payload_t *this)
return SUCCESS;
}
}
-
+
/* URL is not null terminated, correct that */
chunk_t data = chunk_alloc(this->data.len + 1);
memcpy(data.ptr, this->data.ptr, this->data.len);
@@ -268,7 +268,7 @@ static char *get_url(private_cert_payload_t *this)
static void destroy(private_cert_payload_t *this)
{
chunk_free(&this->data);
- free(this);
+ free(this);
}
/*
@@ -285,13 +285,13 @@ cert_payload_t *cert_payload_create()
this->public.payload_interface.set_next_type = (void (*) (payload_t*,payload_type_t))set_next_type;
this->public.payload_interface.get_type = (payload_type_t (*) (payload_t*))get_payload_type;
this->public.payload_interface.destroy = (void (*) (payload_t*))destroy;
-
+
this->public.destroy = (void (*) (cert_payload_t*))destroy;
this->public.get_cert = (certificate_t* (*) (cert_payload_t*))get_cert;
this->public.get_cert_encoding = (cert_encoding_t (*) (cert_payload_t*))get_cert_encoding;
this->public.get_hash = (chunk_t (*) (cert_payload_t*))get_hash;
this->public.get_url = (char* (*) (cert_payload_t*))get_url;
-
+
this->critical = FALSE;
this->next_payload = NO_PAYLOAD;
this->payload_length = CERT_PAYLOAD_HEADER_LENGTH;
@@ -331,14 +331,9 @@ cert_payload_t *cert_payload_create_from_cert(certificate_t *cert)
cert_payload_t *cert_payload_create_from_hash_and_url(chunk_t hash, char *url)
{
private_cert_payload_t *this = (private_cert_payload_t*)cert_payload_create();
- chunk_t url_chunk;
-
+
this->encoding = ENC_X509_HASH_AND_URL;
-
- url_chunk.ptr = url;
- url_chunk.len = strlen(url) + 1;
-
- this->data = chunk_cat("cc", hash, url_chunk);
+ this->data = chunk_cat("cc", hash, chunk_create(url, strlen(url)));
this->payload_length = CERT_PAYLOAD_HEADER_LENGTH + this->data.len;
return &this->public;
}
diff --git a/src/charon/encoding/payloads/cert_payload.h b/src/charon/encoding/payloads/cert_payload.h
index fba404ee2..aa1c7bf5a 100644
--- a/src/charon/encoding/payloads/cert_payload.h
+++ b/src/charon/encoding/payloads/cert_payload.h
@@ -65,45 +65,45 @@ extern enum_name_t *cert_encoding_names;
* The CERT payload format is described in RFC section 3.6.
*/
struct cert_payload_t {
-
+
/**
* The payload_t interface.
*/
payload_t payload_interface;
-
+
/**
* Get the playoads encoded certifcate.
*
* @return certifcate copy
*/
certificate_t *(*get_cert)(cert_payload_t *this);
-
+
/**
* Get the encoding of the certificate.
- *
+ *
* @return encoding
*/
cert_encoding_t (*get_cert_encoding)(cert_payload_t *this);
-
+
/**
* Get the hash if this is a hash and URL encoded certificate.
- *
+ *
* This function returns internal data, do not free.
- *
+ *
* @return hash
*/
chunk_t (*get_hash)(cert_payload_t *this);
-
+
/**
* Get the URL if this is a hash and URL encoded certificate.
- *
+ *
* This function returns internal data, do not free.
- *
+ *
* @return url
*/
char *(*get_url)(cert_payload_t *this);
-
-
+
+
/**
* Destroys the cert_payload object.
*/
@@ -112,14 +112,14 @@ struct cert_payload_t {
/**
* Creates an empty certificate payload.
- *
+ *
* @return cert_payload_t object
*/
cert_payload_t *cert_payload_create(void);
/**
* Creates a certificate payload with an embedded certificate.
- *
+ *
* @param cert certificate to embed
* @return cert_payload_t object
*/
@@ -127,7 +127,7 @@ cert_payload_t *cert_payload_create_from_cert(certificate_t *cert);
/**
* Creates a certificate payload with hash and URL encoding of a certificate.
- *
+ *
* @param hash hash of the DER encoded certificate (get's cloned)
* @param url the URL to locate the certificate (get's cloned)
* @return cert_payload_t object
diff --git a/src/charon/encoding/payloads/certreq_payload.c b/src/charon/encoding/payloads/certreq_payload.c
index 50adedb28..9ff0bdde0 100644
--- a/src/charon/encoding/payloads/certreq_payload.c
+++ b/src/charon/encoding/payloads/certreq_payload.c
@@ -27,14 +27,14 @@ typedef struct private_certreq_payload_t private_certreq_payload_t;
/**
* Private data of an certreq_payload_t object.
- *
+ *
*/
struct private_certreq_payload_t {
/**
* Public certreq_payload_t interface.
*/
certreq_payload_t public;
-
+
/**
* Next payload type.
*/
@@ -44,17 +44,17 @@ struct private_certreq_payload_t {
* Critical flag.
*/
bool critical;
-
+
/**
* Length of this payload.
*/
u_int16_t payload_length;
-
+
/**
* Encoding of the CERT Data.
*/
u_int8_t encoding;
-
+
/**
* The contained certreq data value.
*/
@@ -63,10 +63,10 @@ struct private_certreq_payload_t {
/**
* Encoding rules to parse or generate a CERTREQ payload
- *
- * The defined offsets are the positions in a object of type
+ *
+ * The defined offsets are the positions in a object of type
* private_certreq_payload_t.
- *
+ *
*/
encoding_rule_t certreq_payload_encodings[] = {
/* 1 Byte next payload type, stored in the field next_payload */
@@ -160,7 +160,7 @@ static size_t get_length(private_certreq_payload_t *this)
{
return this->payload_length;
}
-
+
/**
* Implementation of certreq_payload_t.add_keyid.
*/
@@ -240,7 +240,7 @@ static certificate_type_t get_cert_type(private_certreq_payload_t *this)
static void destroy(private_certreq_payload_t *this)
{
chunk_free(&this->data);
- free(this);
+ free(this);
}
/*
@@ -258,13 +258,13 @@ certreq_payload_t *certreq_payload_create()
this->public.payload_interface.set_next_type = (void (*) (payload_t*,payload_type_t))set_next_type;
this->public.payload_interface.get_type = (payload_type_t (*) (payload_t*))get_payload_type;
this->public.payload_interface.destroy = (void (*) (payload_t*))destroy;
-
+
/* public functions */
this->public.destroy = (void (*) (certreq_payload_t*)) destroy;
this->public.create_keyid_enumerator = (enumerator_t*(*)(certreq_payload_t*))create_keyid_enumerator;
this->public.get_cert_type = (certificate_type_t(*)(certreq_payload_t*))get_cert_type;
this->public.add_keyid = (void(*)(certreq_payload_t*, chunk_t keyid))add_keyid;
-
+
/* private variables */
this->critical = FALSE;
this->next_payload = NO_PAYLOAD;
@@ -281,7 +281,7 @@ certreq_payload_t *certreq_payload_create()
certreq_payload_t *certreq_payload_create_type(certificate_type_t type)
{
private_certreq_payload_t *this = (private_certreq_payload_t*)certreq_payload_create();
-
+
switch (type)
{
case CERT_X509:
diff --git a/src/charon/encoding/payloads/certreq_payload.h b/src/charon/encoding/payloads/certreq_payload.h
index ff9814f8a..914063628 100644
--- a/src/charon/encoding/payloads/certreq_payload.h
+++ b/src/charon/encoding/payloads/certreq_payload.h
@@ -50,14 +50,14 @@ struct certreq_payload_t {
* @return enumerator over chunk_t's.
*/
enumerator_t* (*create_keyid_enumerator)(certreq_payload_t *this);
-
+
/**
* Get the type of contained certificate keyids.
*
* @return certificate keyid type
*/
certificate_type_t (*get_cert_type)(certreq_payload_t *this);
-
+
/**
* Add a certificates keyid to the payload.
*
@@ -65,7 +65,7 @@ struct certreq_payload_t {
* @return
*/
void (*add_keyid)(certreq_payload_t *this, chunk_t keyid);
-
+
/**
* Destroys an certreq_payload_t object.
*/
@@ -74,14 +74,14 @@ struct certreq_payload_t {
/**
* Creates an empty certreq_payload_t object.
- *
+ *
* @return certreq payload
*/
certreq_payload_t *certreq_payload_create(void);
/**
* Creates an empty certreq_payload_t for a kind of certificates.
- *
+ *
* @param type type of the added keyids
* @return certreq payload
*/
diff --git a/src/charon/encoding/payloads/configuration_attribute.c b/src/charon/encoding/payloads/configuration_attribute.c
index 674feeddd..9094fd44d 100644
--- a/src/charon/encoding/payloads/configuration_attribute.c
+++ b/src/charon/encoding/payloads/configuration_attribute.c
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2005-2006 Martin Willi
+ * Copyright (C) 2005-2009 Martin Willi
* Copyright (C) 2005 Jan Hutter
* Hochschule fuer Technik Rapperswil
*
@@ -27,67 +27,45 @@ typedef struct private_configuration_attribute_t private_configuration_attribute
/**
* Private data of an configuration_attribute_t object.
- *
+ *
*/
struct private_configuration_attribute_t {
/**
* Public configuration_attribute_t interface.
*/
configuration_attribute_t public;
-
+
/**
* Type of the attribute.
*/
- u_int16_t attribute_type;
-
+ u_int16_t type;
+
/**
* Length of the attribute.
*/
- u_int16_t attribute_length;
+ u_int16_t length;
/**
* Attribute value as chunk.
*/
- chunk_t attribute_value;
+ chunk_t value;
};
-ENUM_BEGIN(configuration_attribute_type_names, INTERNAL_IP4_ADDRESS, INTERNAL_IP6_ADDRESS,
- "INTERNAL_IP4_ADDRESS",
- "INTERNAL_IP4_NETMASK",
- "INTERNAL_IP4_DNS",
- "INTERNAL_IP4_NBNS",
- "INTERNAL_ADDRESS_EXPIRY",
- "INTERNAL_IP4_DHCP",
- "APPLICATION_VERSION",
- "INTERNAL_IP6_ADDRESS");
-ENUM_NEXT(configuration_attribute_type_names, INTERNAL_IP6_DNS, INTERNAL_IP6_SUBNET, INTERNAL_IP6_ADDRESS,
- "INTERNAL_IP6_DNS",
- "INTERNAL_IP6_NBNS",
- "INTERNAL_IP6_DHCP",
- "INTERNAL_IP4_SUBNET",
- "SUPPORTED_ATTRIBUTES",
- "INTERNAL_IP6_SUBNET");
-ENUM_NEXT(configuration_attribute_type_names, INTERNAL_IP4_SERVER, INTERNAL_IP6_SERVER, INTERNAL_IP6_SUBNET,
- "INTERNAL_IP4_SERVER",
- "INTERNAL_IP6_SERVER");
-ENUM_END(configuration_attribute_type_names, INTERNAL_IP6_SERVER);
-
/**
* Encoding rules to parse or generate a configuration attribute.
- *
- * The defined offsets are the positions in a object of type
+ *
+ * The defined offsets are the positions in a object of type
* private_configuration_attribute_t.
- *
*/
encoding_rule_t configuration_attribute_encodings[] = {
- { RESERVED_BIT, 0 },
+ { RESERVED_BIT, 0 },
/* type of the attribute as 15 bit unsigned integer */
- { ATTRIBUTE_TYPE, offsetof(private_configuration_attribute_t, attribute_type) },
+ { ATTRIBUTE_TYPE, offsetof(private_configuration_attribute_t, type) },
/* Length of attribute value */
- { CONFIGURATION_ATTRIBUTE_LENGTH, offsetof(private_configuration_attribute_t, attribute_length)},
+ { CONFIGURATION_ATTRIBUTE_LENGTH, offsetof(private_configuration_attribute_t, length) },
/* Value of attribute if attribute format flag is zero */
- { CONFIGURATION_ATTRIBUTE_VALUE, offsetof(private_configuration_attribute_t, attribute_value)}
+ { CONFIGURATION_ATTRIBUTE_VALUE, offsetof(private_configuration_attribute_t, value) }
};
/*
@@ -109,66 +87,65 @@ static status_t verify(private_configuration_attribute_t *this)
{
bool failed = FALSE;
- if (this->attribute_length != this->attribute_value.len)
+ if (this->length != this->value.len)
{
DBG1(DBG_ENC, "invalid attribute length");
return FAILED;
}
- switch (this->attribute_type)
+ switch (this->type)
{
- case INTERNAL_IP4_ADDRESS:
- case INTERNAL_IP4_NETMASK:
+ case INTERNAL_IP4_ADDRESS:
+ case INTERNAL_IP4_NETMASK:
case INTERNAL_IP4_DNS:
case INTERNAL_IP4_NBNS:
case INTERNAL_ADDRESS_EXPIRY:
case INTERNAL_IP4_DHCP:
- if (this->attribute_length != 0 && this->attribute_length != 4)
- {
+ if (this->length != 0 && this->length != 4)
+ {
failed = TRUE;
- }
+ }
break;
case INTERNAL_IP4_SUBNET:
- if (this->attribute_length != 0 && this->attribute_length != 8)
- {
+ if (this->length != 0 && this->length != 8)
+ {
failed = TRUE;
- }
+ }
break;
case INTERNAL_IP6_ADDRESS:
case INTERNAL_IP6_SUBNET:
- if (this->attribute_length != 0 && this->attribute_length != 17)
- {
+ if (this->length != 0 && this->length != 17)
+ {
failed = TRUE;
- }
+ }
break;
case INTERNAL_IP6_DNS:
case INTERNAL_IP6_NBNS:
case INTERNAL_IP6_DHCP:
- if (this->attribute_length != 0 && this->attribute_length != 16)
- {
+ if (this->length != 0 && this->length != 16)
+ {
failed = TRUE;
- }
+ }
break;
case SUPPORTED_ATTRIBUTES:
- if (this->attribute_length % 2)
- {
+ if (this->length % 2)
+ {
failed = TRUE;
- }
+ }
break;
case APPLICATION_VERSION:
- /* any length acceptable */
- break;
+ /* any length acceptable */
+ break;
default:
- DBG1(DBG_ENC, "unknown attribute type %N",
- configuration_attribute_type_names, this->attribute_type);
- break;
+ DBG1(DBG_ENC, "unknown attribute type %N",
+ configuration_attribute_type_names, this->type);
+ break;
}
-
+
if (failed)
{
DBG1(DBG_ENC, "invalid attribute length %d for %N",
- this->attribute_length, configuration_attribute_type_names,
- this->attribute_type);
+ this->length, configuration_attribute_type_names, this->type);
return FAILED;
}
return SUCCESS;
@@ -177,7 +154,8 @@ static status_t verify(private_configuration_attribute_t *this)
/**
* Implementation of payload_t.get_encoding_rules.
*/
-static void get_encoding_rules(private_configuration_attribute_t *this, encoding_rule_t **rules, size_t *rule_count)
+static void get_encoding_rules(private_configuration_attribute_t *this,
+ encoding_rule_t **rules, size_t *rule_count)
{
*rules = configuration_attribute_encodings;
*rule_count = sizeof(configuration_attribute_encodings) / sizeof(encoding_rule_t);
@@ -196,13 +174,14 @@ static payload_type_t get_type(private_configuration_attribute_t *this)
*/
static payload_type_t get_next_type(private_configuration_attribute_t *this)
{
- return (NO_PAYLOAD);
+ return NO_PAYLOAD;
}
/**
* Implementation of payload_t.set_next_type.
*/
-static void set_next_type(private_configuration_attribute_t *this,payload_type_t type)
+static void set_next_type(private_configuration_attribute_t *this,
+ payload_type_t type)
{
}
@@ -211,99 +190,75 @@ static void set_next_type(private_configuration_attribute_t *this,payload_type_t
*/
static size_t get_length(private_configuration_attribute_t *this)
{
- return (this->attribute_value.len + CONFIGURATION_ATTRIBUTE_HEADER_LENGTH);
+ return this->value.len + CONFIGURATION_ATTRIBUTE_HEADER_LENGTH;
}
/**
- * Implementation of configuration_attribute_t.set_value.
+ * Implementation of configuration_attribute_t.get_type.
*/
-static void set_value(private_configuration_attribute_t *this, chunk_t value)
+static configuration_attribute_type_t get_configuration_attribute_type(
+ private_configuration_attribute_t *this)
{
- if (this->attribute_value.ptr != NULL)
- {
- /* free existing value */
- chunk_free(&(this->attribute_value));
- }
-
- this->attribute_value.ptr = clalloc(value.ptr,value.len);
- this->attribute_value.len = value.len;
-
- this->attribute_length = this->attribute_value.len;
+ return this->type;
}
/**
* Implementation of configuration_attribute_t.get_value.
*/
-static chunk_t get_value (private_configuration_attribute_t *this)
+static chunk_t get_value(private_configuration_attribute_t *this)
{
- return this->attribute_value;
+ return this->value;
}
/**
- * Implementation of configuration_attribute_t.set_type.
+ * Implementation of configuration_attribute_t.destroy and payload_t.destroy.
*/
-static void set_attribute_type (private_configuration_attribute_t *this, u_int16_t type)
+static void destroy(private_configuration_attribute_t *this)
{
- this->attribute_type = type & 0x7FFF;
+ free(this->value.ptr);
+ free(this);
}
-/**
- * Implementation of configuration_attribute_t.get_type.
+/*
+ * Described in header.
*/
-static u_int16_t get_attribute_type (private_configuration_attribute_t *this)
+configuration_attribute_t *configuration_attribute_create()
{
- return this->attribute_type;
-}
+ private_configuration_attribute_t *this;
-/**
- * Implementation of configuration_attribute_t.get_length.
- */
-static u_int16_t get_attribute_length (private_configuration_attribute_t *this)
-{
- return this->attribute_length;
-}
+ this = malloc_thing(private_configuration_attribute_t);
+ this->public.payload_interface.verify = (status_t(*)(payload_t *))verify;
+ this->public.payload_interface.get_encoding_rules = (void(*)(payload_t *, encoding_rule_t **, size_t *) )get_encoding_rules;
+ this->public.payload_interface.get_length = (size_t(*)(payload_t *))get_length;
+ this->public.payload_interface.get_next_type = (payload_type_t(*)(payload_t *))get_next_type;
+ this->public.payload_interface.set_next_type = (void(*)(payload_t *,payload_type_t))set_next_type;
+ this->public.payload_interface.get_type = (payload_type_t(*)(payload_t *))get_type;
+ this->public.payload_interface.destroy = (void(*)(payload_t*))destroy;
+ this->public.get_value = (chunk_t(*)(configuration_attribute_t *))get_value;
+ this->public.get_type = (configuration_attribute_type_t(*)(configuration_attribute_t *))get_configuration_attribute_type;
+ this->public.destroy = (void (*)(configuration_attribute_t*))destroy;
-/**
- * Implementation of configuration_attribute_t.destroy and payload_t.destroy.
- */
-static void destroy(private_configuration_attribute_t *this)
-{
- if (this->attribute_value.ptr != NULL)
- {
- free(this->attribute_value.ptr);
- }
- free(this);
+ this->type = 0;
+ this->value = chunk_empty;
+ this->length = 0;
+
+ return &this->public;
}
/*
* Described in header.
*/
-configuration_attribute_t *configuration_attribute_create()
+configuration_attribute_t *configuration_attribute_create_value(
+ configuration_attribute_type_t type, chunk_t value)
{
- private_configuration_attribute_t *this = malloc_thing(private_configuration_attribute_t);
-
- /* payload interface */
- this->public.payload_interface.verify = (status_t (*) (payload_t *))verify;
- this->public.payload_interface.get_encoding_rules = (void (*) (payload_t *, encoding_rule_t **, size_t *) ) get_encoding_rules;
- this->public.payload_interface.get_length = (size_t (*) (payload_t *)) get_length;
- this->public.payload_interface.get_next_type = (payload_type_t (*) (payload_t *)) get_next_type;
- this->public.payload_interface.set_next_type = (void (*) (payload_t *,payload_type_t)) set_next_type;
- this->public.payload_interface.get_type = (payload_type_t (*) (payload_t *)) get_type;
- this->public.payload_interface.destroy = (void (*) (payload_t *))destroy;
-
- /* public functions */
- this->public.set_value = (void (*) (configuration_attribute_t *,chunk_t)) set_value;
- this->public.get_value = (chunk_t (*) (configuration_attribute_t *)) get_value;
- this->public.set_type = (void (*) (configuration_attribute_t *,u_int16_t type)) set_attribute_type;
- this->public.get_type = (u_int16_t (*) (configuration_attribute_t *)) get_attribute_type;
- this->public.get_length = (u_int16_t (*) (configuration_attribute_t *)) get_attribute_length;
- this->public.destroy = (void (*) (configuration_attribute_t *)) destroy;
-
- /* set default values of the fields */
- this->attribute_type = 0;
- this->attribute_value = chunk_empty;
- this->attribute_length = 0;
-
- return (&(this->public));
+ private_configuration_attribute_t *this;
+
+ this = (private_configuration_attribute_t*)configuration_attribute_create();
+ this->type = ((u_int16_t)type) & 0x7FFF;
+ this->value = chunk_clone(value);
+ this->length = value.len;
+
+ return &this->public;
}
+
diff --git a/src/charon/encoding/payloads/configuration_attribute.h b/src/charon/encoding/payloads/configuration_attribute.h
index 404130114..6e4b018bb 100644
--- a/src/charon/encoding/payloads/configuration_attribute.h
+++ b/src/charon/encoding/payloads/configuration_attribute.h
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2005-2006 Martin Willi
+ * Copyright (C) 2005-2009 Martin Willi
* Copyright (C) 2005 Jan Hutter
* Hochschule fuer Technik Rapperswil
*
@@ -22,96 +22,43 @@
#ifndef CONFIGURATION_ATTRIBUTE_H_
#define CONFIGURATION_ATTRIBUTE_H_
-typedef enum configuration_attribute_type_t configuration_attribute_type_t;
typedef struct configuration_attribute_t configuration_attribute_t;
#include <library.h>
+#include <attributes/attributes.h>
#include <encoding/payloads/payload.h>
-
/**
* Configuration attribute header length in bytes.
*/
#define CONFIGURATION_ATTRIBUTE_HEADER_LENGTH 4
/**
- * Type of the attribute, as in IKEv2 RFC 3.15.1.
- */
-enum configuration_attribute_type_t {
- INTERNAL_IP4_ADDRESS = 1,
- INTERNAL_IP4_NETMASK = 2,
- INTERNAL_IP4_DNS = 3,
- INTERNAL_IP4_NBNS = 4,
- INTERNAL_ADDRESS_EXPIRY = 5,
- INTERNAL_IP4_DHCP = 6,
- APPLICATION_VERSION = 7,
- INTERNAL_IP6_ADDRESS = 8,
- INTERNAL_IP6_DNS = 10,
- INTERNAL_IP6_NBNS = 11,
- INTERNAL_IP6_DHCP = 12,
- INTERNAL_IP4_SUBNET = 13,
- SUPPORTED_ATTRIBUTES = 14,
- INTERNAL_IP6_SUBNET = 15,
- /* proprietary Microsoft attributes */
- INTERNAL_IP4_SERVER = 23456,
- INTERNAL_IP6_SERVER = 23457
-};
-
-/**
- * enum names for configuration_attribute_type_t.
- */
-extern enum_name_t *configuration_attribute_type_names;
-
-/**
* Class representing an IKEv2-CONFIGURATION Attribute.
- *
+ *
* The CONFIGURATION ATTRIBUTE format is described in RFC section 3.15.1.
*/
struct configuration_attribute_t {
+
/**
- * The payload_t interface.
+ * Implements payload_t interface.
*/
payload_t payload_interface;
/**
- * Returns the currently set value of the attribute.
- *
- * @warning Returned data are not copied.
- *
- * @return chunk_t pointing to the value
- */
- chunk_t (*get_value) (configuration_attribute_t *this);
-
- /**
- * Sets the value of the attribute.
- *
- * Value is getting copied.
- *
- * @param value chunk_t pointing to the value to set
+ * Get the type of the attribute.
+ *
+ * @return type of the configuration attribute
*/
- void (*set_value) (configuration_attribute_t *this, chunk_t value);
+ configuration_attribute_type_t (*get_type)(configuration_attribute_t *this);
/**
- * Sets the type of the attribute.
- *
- * @param type type to set (most significant bit is set to zero)
+ * Returns the value of the attribute.
+ *
+ * @return chunk_t pointing to the internal value
*/
- void (*set_type) (configuration_attribute_t *this, u_int16_t type);
-
- /**
- * get the type of the attribute.
- *
- * @return type of the value
- */
- u_int16_t (*get_type) (configuration_attribute_t *this);
-
- /**
- * get the length of an attribute.
- *
- * @return type of the value
- */
- u_int16_t (*get_length) (configuration_attribute_t *this);
-
+ chunk_t (*get_value) (configuration_attribute_t *this);
+
/**
* Destroys an configuration_attribute_t object.
*/
@@ -119,10 +66,20 @@ struct configuration_attribute_t {
};
/**
- * Creates an empty configuration_attribute_t object.
- *
- * @return created configuration_attribute_t object
+ * Creates an empty configuration attribute.
+ *
+ * @return created configuration attribute
+ */
+configuration_attribute_t *configuration_attribute_create();
+
+/**
+ * Creates a configuration attribute with type and value.
+ *
+ * @param type type of configuration attribute
+ * @param value value, gets cloned
+ * @return created configuration attribute
*/
-configuration_attribute_t *configuration_attribute_create(void);
+configuration_attribute_t *configuration_attribute_create_value(
+ configuration_attribute_type_t type, chunk_t value);
#endif /** CONFIGURATION_ATTRIBUTE_H_ @}*/
diff --git a/src/charon/encoding/payloads/cp_payload.c b/src/charon/encoding/payloads/cp_payload.c
index b5f1b35c7..f0a26eee2 100644
--- a/src/charon/encoding/payloads/cp_payload.c
+++ b/src/charon/encoding/payloads/cp_payload.c
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2005-2006 Martin Willi
+ * Copyright (C) 2005-2009 Martin Willi
* Copyright (C) 2005 Jan Hutter
* Hochschule fuer Technik Rapperswil
*
@@ -32,14 +32,14 @@ typedef struct private_cp_payload_t private_cp_payload_t;
/**
* Private data of an cp_payload_t object.
- *
+ *
*/
struct private_cp_payload_t {
/**
* Public cp_payload_t interface.
*/
cp_payload_t public;
-
+
/**
* Next payload type.
*/
@@ -49,51 +49,51 @@ struct private_cp_payload_t {
* Critical flag.
*/
bool critical;
-
+
/**
* Length of this payload.
*/
u_int16_t payload_length;
-
+
/**
- * Configuration Attributes in this payload are stored in a linked_list_t.
+ * List of attributes, as configuration_attribute_t
*/
- linked_list_t * attributes;
-
+ linked_list_t *attributes;
+
/**
* Config Type.
*/
- u_int8_t config_type;
+ u_int8_t type;
};
/**
* Encoding rules to parse or generate a IKEv2-CP Payload
- *
- * The defined offsets are the positions in a object of type
+ *
+ * The defined offsets are the positions in a object of type
* private_cp_payload_t.
- *
+ *
*/
encoding_rule_t cp_payload_encodings[] = {
- /* 1 Byte next payload type, stored in the field next_payload */
+ /* 1 Byte next payload type, stored in the field next_payload */
{ U_INT_8, offsetof(private_cp_payload_t, next_payload) },
/* the critical bit */
- { FLAG, offsetof(private_cp_payload_t, critical) },
- /* 7 Bit reserved bits, nowhere stored */
- { RESERVED_BIT, 0 },
- { RESERVED_BIT, 0 },
- { RESERVED_BIT, 0 },
- { RESERVED_BIT, 0 },
- { RESERVED_BIT, 0 },
- { RESERVED_BIT, 0 },
- { RESERVED_BIT, 0 },
+ { FLAG, offsetof(private_cp_payload_t, critical) },
+ /* 7 Bit reserved bits, nowhere stored */
+ { RESERVED_BIT, 0 },
+ { RESERVED_BIT, 0 },
+ { RESERVED_BIT, 0 },
+ { RESERVED_BIT, 0 },
+ { RESERVED_BIT, 0 },
+ { RESERVED_BIT, 0 },
+ { RESERVED_BIT, 0 },
/* Length of the whole CP payload*/
- { PAYLOAD_LENGTH, offsetof(private_cp_payload_t, payload_length) },
- /* Proposals are stored in a proposal substructure,
+ { PAYLOAD_LENGTH, offsetof(private_cp_payload_t, payload_length) },
+ /* Proposals are stored in a proposal substructure,
offset points to a linked_list_t pointer */
- { U_INT_8, offsetof(private_cp_payload_t, config_type) },
- { RESERVED_BYTE,0 },
- { RESERVED_BYTE,0 },
- { RESERVED_BYTE,0 },
+ { U_INT_8, offsetof(private_cp_payload_t, type) },
+ { RESERVED_BYTE,0 },
+ { RESERVED_BYTE,0 },
+ { RESERVED_BYTE,0 },
{ CONFIGURATION_ATTRIBUTES, offsetof(private_cp_payload_t, attributes) }
};
@@ -117,26 +117,27 @@ encoding_rule_t cp_payload_encodings[] = {
static status_t verify(private_cp_payload_t *this)
{
status_t status = SUCCESS;
- iterator_t *iterator;
- configuration_attribute_t *attribute;
-
- iterator = this->attributes->create_iterator(this->attributes,TRUE);
- while(iterator->iterate(iterator, (void**)&attribute))
+ enumerator_t *enumerator;
+ payload_t *attribute;
+
+ enumerator = this->attributes->create_enumerator(this->attributes);
+ while (enumerator->enumerate(enumerator, &attribute))
{
- status = attribute->payload_interface.verify(&attribute->payload_interface);
+ status = attribute->verify(attribute);
if (status != SUCCESS)
{
break;
}
}
- iterator->destroy(iterator);
+ enumerator->destroy(enumerator);
return status;
}
/**
* Implementation of payload_t.get_encoding_rules.
*/
-static void get_encoding_rules(private_cp_payload_t *this, encoding_rule_t **rules, size_t *rule_count)
+static void get_encoding_rules(private_cp_payload_t *this,
+ encoding_rule_t **rules, size_t *rule_count)
{
*rules = cp_payload_encodings;
*rule_count = sizeof(cp_payload_encodings) / sizeof(encoding_rule_t);
@@ -155,7 +156,7 @@ static payload_type_t get_type(private_cp_payload_t *this)
*/
static payload_type_t get_next_type(private_cp_payload_t *this)
{
- return (this->next_payload);
+ return this->next_payload;
}
/**
@@ -171,18 +172,17 @@ static void set_next_type(private_cp_payload_t *this,payload_type_t type)
*/
static void compute_length(private_cp_payload_t *this)
{
- iterator_t *iterator;
- payload_t *current_attribute;
- size_t length = CP_PAYLOAD_HEADER_LENGTH;
-
- iterator = this->attributes->create_iterator(this->attributes,TRUE);
- while (iterator->iterate(iterator, (void**)&current_attribute))
+ enumerator_t *enumerator;
+ payload_t *attribute;
+
+ this->payload_length = CP_PAYLOAD_HEADER_LENGTH;
+
+ enumerator = this->attributes->create_enumerator(this->attributes);
+ while (enumerator->enumerate(enumerator, &attribute))
{
- length += current_attribute->get_length(current_attribute);
+ this->payload_length += attribute->get_length(attribute);
}
- iterator->destroy(iterator);
-
- this->payload_length = length;
+ enumerator->destroy(enumerator);
}
/**
@@ -190,41 +190,33 @@ static void compute_length(private_cp_payload_t *this)
*/
static size_t get_length(private_cp_payload_t *this)
{
- compute_length(this);
return this->payload_length;
}
/**
- * Implementation of cp_payload_t.create_configuration_attribute_iterator.
+ * Implementation of cp_payload_t.create_attribute_enumerator.
*/
-static iterator_t *create_attribute_iterator (private_cp_payload_t *this)
+static enumerator_t *create_attribute_enumerator(private_cp_payload_t *this)
{
- return this->attributes->create_iterator(this->attributes, TRUE);
+ return this->attributes->create_enumerator(this->attributes);
}
/**
- * Implementation of cp_payload_t.add_proposal_substructure.
+ * Implementation of cp_payload_t.add_attribute.
*/
-static void add_configuration_attribute (private_cp_payload_t *this,configuration_attribute_t *attribute)
+static void add_attribute(private_cp_payload_t *this,
+ configuration_attribute_t *attribute)
{
- this->attributes->insert_last(this->attributes,(void *) attribute);
+ this->attributes->insert_last(this->attributes, attribute);
compute_length(this);
}
/**
- * Implementation of cp_payload_t.set_config_type.
+ * Implementation of cp_payload_t.get_type.
*/
-static void set_config_type (private_cp_payload_t *this,config_type_t config_type)
+static config_type_t get_config_type(private_cp_payload_t *this)
{
- this->config_type = config_type;
-}
-
-/**
- * Implementation of cp_payload_t.get_config_type.
- */
-static config_type_t get_config_type (private_cp_payload_t *this)
-{
- return this->config_type;
+ return this->type;
}
/**
@@ -233,7 +225,7 @@ static config_type_t get_config_type (private_cp_payload_t *this)
static void destroy(private_cp_payload_t *this)
{
this->attributes->destroy_offset(this->attributes,
- offsetof(configuration_attribute_t, destroy));
+ offsetof(configuration_attribute_t, destroy));
free(this);
}
@@ -243,8 +235,7 @@ static void destroy(private_cp_payload_t *this)
cp_payload_t *cp_payload_create()
{
private_cp_payload_t *this = malloc_thing(private_cp_payload_t);
-
- /* public interface */
+
this->public.payload_interface.verify = (status_t (*) (payload_t *))verify;
this->public.payload_interface.get_encoding_rules = (void (*) (payload_t *, encoding_rule_t **, size_t *) ) get_encoding_rules;
this->public.payload_interface.get_length = (size_t (*) (payload_t *)) get_length;
@@ -252,19 +243,31 @@ cp_payload_t *cp_payload_create()
this->public.payload_interface.set_next_type = (void (*) (payload_t *,payload_type_t)) set_next_type;
this->public.payload_interface.get_type = (payload_type_t (*) (payload_t *)) get_type;
this->public.payload_interface.destroy = (void (*) (payload_t *))destroy;
-
- /* public functions */
- this->public.create_attribute_iterator = (iterator_t* (*) (cp_payload_t *)) create_attribute_iterator;
- this->public.add_configuration_attribute = (void (*) (cp_payload_t *,configuration_attribute_t *)) add_configuration_attribute;
- this->public.set_config_type = (void (*) (cp_payload_t *, config_type_t)) set_config_type;
- this->public.get_config_type = (config_type_t (*) (cp_payload_t *)) get_config_type;
- this->public.destroy = (void (*) (cp_payload_t *)) destroy;
-
+
+ this->public.create_attribute_enumerator = (enumerator_t*(*)(cp_payload_t *))create_attribute_enumerator;
+ this->public.add_attribute = (void (*) (cp_payload_t *,configuration_attribute_t*))add_attribute;
+ this->public.get_type = (config_type_t (*) (cp_payload_t *))get_config_type;
+ this->public.destroy = (void (*)(cp_payload_t *))destroy;
+
/* set default values of the fields */
this->critical = FALSE;
this->next_payload = NO_PAYLOAD;
this->payload_length = CP_PAYLOAD_HEADER_LENGTH;
-
this->attributes = linked_list_create();
- return (&(this->public));
+ this->type = CFG_REQUEST;
+
+ return &this->public;
}
+
+/*
+ * Described in header.
+ */
+cp_payload_t *cp_payload_create_type(config_type_t type)
+{
+ private_cp_payload_t *this = (private_cp_payload_t*)cp_payload_create();
+
+ this->type = type;
+
+ return &this->public;
+}
+
diff --git a/src/charon/encoding/payloads/cp_payload.h b/src/charon/encoding/payloads/cp_payload.h
index 6ffcca708..c0760885a 100644
--- a/src/charon/encoding/payloads/cp_payload.h
+++ b/src/charon/encoding/payloads/cp_payload.h
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2005-2006 Martin Willi
+ * Copyright (C) 2005-2009 Martin Willi
* Copyright (C) 2005 Jan Hutter
* Hochschule fuer Technik Rapperswil
*
@@ -28,7 +28,7 @@ typedef struct cp_payload_t cp_payload_t;
#include <library.h>
#include <encoding/payloads/payload.h>
#include <encoding/payloads/configuration_attribute.h>
-#include <utils/linked_list.h>
+#include <utils/enumerator.h>
/**
* CP_PAYLOAD length in bytes without any proposal substructure.
@@ -52,49 +52,38 @@ extern enum_name_t *config_type_names;
/**
* Class representing an IKEv2-CP Payload.
- *
+ *
* The CP Payload format is described in RFC section 3.15.
*/
struct cp_payload_t {
+
/**
* The payload_t interface.
*/
payload_t payload_interface;
-
+
/**
* Creates an iterator of stored configuration_attribute_t objects.
- *
- * When deleting an attribute using this iterator, the length of this
- * configuration_attribute_t has to be refreshed by calling get_length()!
*
- * @return created iterator_t object
+ * @return enumerator over configration_attribute_T
*/
- iterator_t *(*create_attribute_iterator) (cp_payload_t *this);
-
- /**
- * Adds a configuration_attribute_t object to this object.
- *
- * The added configuration_attribute_t object is getting destroyed in
- * destroy function of cp_payload_t.
- *
- * @param attribute configuration_attribute_t object to add
- */
- void (*add_configuration_attribute) (cp_payload_t *this, configuration_attribute_t *attribute);
-
+ enumerator_t *(*create_attribute_enumerator) (cp_payload_t *this);
+
/**
- * Set the config type.
+ * Adds a configuration attribute to the configuration payload.
*
- * @param config_type config_type_t to set
+ * @param attribute attribute to add
*/
- void (*set_config_type) (cp_payload_t *this,config_type_t config_type);
-
+ void (*add_attribute)(cp_payload_t *this,
+ configuration_attribute_t *attribute);
+
/**
- * Get the config type.
+ * Get the configuration payload type.
*
- * @return config_type_t
+ * @return type of configuration payload
*/
- config_type_t (*get_config_type) (cp_payload_t *this);
-
+ config_type_t (*get_type) (cp_payload_t *this);
+
/**
* Destroys an cp_payload_t object.
*/
@@ -102,10 +91,18 @@ struct cp_payload_t {
};
/**
- * Creates an empty cp_payload_t object
- *
- * @return cp_payload_t object
+ * Creates an empty configuration payload
+ *
+ * @return empty configuration payload
+ */
+cp_payload_t *cp_payload_create();
+
+/**
+ * Creates an cp_payload_t with type and value
+ *
+ * @param type type of configuration payload to create
+ * @return created configuration payload
*/
-cp_payload_t *cp_payload_create(void);
+cp_payload_t *cp_payload_create_type(config_type_t config_type);
#endif /** CP_PAYLOAD_H_ @}*/
diff --git a/src/charon/encoding/payloads/delete_payload.c b/src/charon/encoding/payloads/delete_payload.c
index c2be1e8b5..97b4743b2 100644
--- a/src/charon/encoding/payloads/delete_payload.c
+++ b/src/charon/encoding/payloads/delete_payload.c
@@ -23,14 +23,14 @@ typedef struct private_delete_payload_t private_delete_payload_t;
/**
* Private data of an delete_payload_t object.
- *
+ *
*/
struct private_delete_payload_t {
/**
* Public delete_payload_t interface.
*/
delete_payload_t public;
-
+
/**
* Next payload type.
*/
@@ -40,12 +40,12 @@ struct private_delete_payload_t {
* Critical flag.
*/
bool critical;
-
+
/**
* Length of this payload.
*/
u_int16_t payload_length;
-
+
/**
* Protocol ID.
*/
@@ -55,36 +55,36 @@ struct private_delete_payload_t {
* SPI Size.
*/
u_int8_t spi_size;
-
+
/**
* Number of SPI's.
*/
u_int16_t spi_count;
-
+
/**
* The contained SPI's.
*/
chunk_t spis;
-
+
/**
- * List containing u_int32_t spis
+ * List containing u_int32_t spis
*/
linked_list_t *spi_list;
};
/**
* Encoding rules to parse or generate a DELETE payload
- *
- * The defined offsets are the positions in a object of type
+ *
+ * The defined offsets are the positions in a object of type
* private_delete_payload_t.
- *
+ *
*/
encoding_rule_t delete_payload_encodings[] = {
- /* 1 Byte next payload type, stored in the field next_payload */
+ /* 1 Byte next payload type, stored in the field next_payload */
{ U_INT_8, offsetof(private_delete_payload_t, next_payload) },
/* the critical bit */
{ FLAG, offsetof(private_delete_payload_t, critical) },
- /* 7 Bit reserved bits, nowhere stored */
+ /* 7 Bit reserved bits, nowhere stored */
{ RESERVED_BIT, 0 },
{ RESERVED_BIT, 0 },
{ RESERVED_BIT, 0 },
@@ -223,7 +223,7 @@ static void add_spi(private_delete_payload_t *this, u_int32_t spi)
static iterator_t* create_spi_iterator(private_delete_payload_t *this)
{
int i;
-
+
if (this->spi_list == NULL)
{
this->spi_list = linked_list_create();
@@ -253,7 +253,7 @@ static void destroy(private_delete_payload_t *this)
{
this->spi_list->destroy(this->spi_list);
}
- free(this);
+ free(this);
}
/*
@@ -271,13 +271,13 @@ delete_payload_t *delete_payload_create(protocol_id_t protocol_id)
this->public.payload_interface.set_next_type = (void (*) (payload_t *,payload_type_t)) set_next_type;
this->public.payload_interface.get_type = (payload_type_t (*) (payload_t *)) get_payload_type;
this->public.payload_interface.destroy = (void (*) (payload_t *))destroy;
-
+
/* public functions */
this->public.destroy = (void (*) (delete_payload_t *)) destroy;
this->public.get_protocol_id = (protocol_id_t (*) (delete_payload_t *)) get_protocol_id;
this->public.add_spi = (void (*) (delete_payload_t *,u_int32_t))add_spi;
this->public.create_spi_iterator = (iterator_t* (*) (delete_payload_t *)) create_spi_iterator;
-
+
/* private variables */
this->critical = FALSE;
this->next_payload = NO_PAYLOAD;
diff --git a/src/charon/encoding/payloads/delete_payload.h b/src/charon/encoding/payloads/delete_payload.h
index 58840741a..3b62c1af1 100644
--- a/src/charon/encoding/payloads/delete_payload.h
+++ b/src/charon/encoding/payloads/delete_payload.h
@@ -43,21 +43,21 @@ struct delete_payload_t {
* The payload_t interface.
*/
payload_t payload_interface;
-
+
/**
* Get the protocol ID.
*
* @return protocol ID
*/
protocol_id_t (*get_protocol_id) (delete_payload_t *this);
-
+
/**
* Add an SPI to the list of deleted SAs.
*
* @param spi spi to add
*/
void (*add_spi) (delete_payload_t *this, u_int32_t spi);
-
+
/**
* Get an iterator over the SPIs.
*
@@ -66,7 +66,7 @@ struct delete_payload_t {
* @return iterator over SPIs
*/
iterator_t *(*create_spi_iterator) (delete_payload_t *this);
-
+
/**
* Destroys an delete_payload_t object.
*/
@@ -75,7 +75,7 @@ struct delete_payload_t {
/**
* Creates an empty delete_payload_t object.
- *
+ *
* @param protocol_id protocol, such as AH|ESP
* @return delete_payload_t object
*/
diff --git a/src/charon/encoding/payloads/eap_payload.c b/src/charon/encoding/payloads/eap_payload.c
index 1199bac45..21f34a642 100644
--- a/src/charon/encoding/payloads/eap_payload.c
+++ b/src/charon/encoding/payloads/eap_payload.c
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2005-2006 Martin Willi
+ * Copyright (C) 2005-2010 Martin Willi
* Copyright (C) 2005 Jan Hutter
* Hochschule fuer Technik Rapperswil
*
@@ -24,14 +24,14 @@ typedef struct private_eap_payload_t private_eap_payload_t;
/**
* Private data of an eap_payload_t object.
- *
+ *
*/
struct private_eap_payload_t {
/**
* Public eap_payload_t interface.
*/
eap_payload_t public;
-
+
/**
* Next payload type.
*/
@@ -41,12 +41,12 @@ struct private_eap_payload_t {
* Critical flag.
*/
bool critical;
-
+
/**
* Length of this payload.
*/
u_int16_t payload_length;
-
+
/**
* EAP message data, if available
*/
@@ -55,17 +55,17 @@ struct private_eap_payload_t {
/**
* Encoding rules to parse or generate a EAP payload.
- *
- * The defined offsets are the positions in a object of type
+ *
+ * The defined offsets are the positions in a object of type
* private_eap_payload_t.
- *
+ *
*/
-encoding_rule_t eap_payload_encodings[] = {
- /* 1 Byte next payload type, stored in the field next_payload */
+static encoding_rule_t eap_payload_encodings[] = {
+ /* 1 Byte next payload type, stored in the field next_payload */
{ U_INT_8, offsetof(private_eap_payload_t, next_payload) },
/* the critical bit */
{ FLAG, offsetof(private_eap_payload_t, critical) },
- /* 7 Bit reserved bits, nowhere stored */
+ /* 7 Bit reserved bits, nowhere stored */
{ RESERVED_BIT, 0 },
{ RESERVED_BIT, 0 },
{ RESERVED_BIT, 0 },
@@ -91,27 +91,25 @@ encoding_rule_t eap_payload_encodings[] = {
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-
*/
-/**
- * Implementation of payload_t.verify.
- */
-static status_t verify(private_eap_payload_t *this)
+METHOD(payload_t, verify, status_t,
+ private_eap_payload_t *this)
{
u_int16_t length;
u_int8_t code;
-
+
if (this->data.len < 4)
{
DBG1(DBG_ENC, "EAP payloads EAP message too short (%d)", this->data.len);
return FAILED;
}
- code = *this->data.ptr;
- length = htons(*(u_int16_t*)(this->data.ptr + 2));
+ length = untoh16(this->data.ptr + 2);
if (this->data.len != length)
{
- DBG1(DBG_ENC, "EAP payload length (%d) does not match contained message length (%d)",
- this->data.len, length);
+ DBG1(DBG_ENC, "EAP payload length (%d) does not match contained "
+ "message length (%d)", this->data.len, length);
return FAILED;
}
+ code = this->data.ptr[0];
switch (code)
{
case EAP_REQUEST:
@@ -140,119 +138,97 @@ static status_t verify(private_eap_payload_t *this)
return SUCCESS;
}
-/**
- * Implementation of eap_payload_t.get_encoding_rules.
- */
-static void get_encoding_rules(private_eap_payload_t *this, encoding_rule_t **rules, size_t *rule_count)
+METHOD(payload_t, get_encoding_rules, void,
+ private_eap_payload_t *this, encoding_rule_t **rules, size_t *rule_count)
{
*rules = eap_payload_encodings;
*rule_count = sizeof(eap_payload_encodings) / sizeof(encoding_rule_t);
}
-/**
- * Implementation of payload_t.get_type.
- */
-static payload_type_t get_payload_type(private_eap_payload_t *this)
+METHOD(payload_t, get_payload_type, payload_type_t,
+ private_eap_payload_t *this)
{
return EXTENSIBLE_AUTHENTICATION;
}
-/**
- * Implementation of payload_t.get_next_type.
- */
-static payload_type_t get_next_type(private_eap_payload_t *this)
+METHOD(payload_t, get_next_type, payload_type_t,
+ private_eap_payload_t *this)
{
return (this->next_payload);
}
-/**
- * Implementation of payload_t.set_next_type.
- */
-static void set_next_type(private_eap_payload_t *this,payload_type_t type)
+METHOD(payload_t, set_next_type, void,
+ private_eap_payload_t *this, payload_type_t type)
{
this->next_payload = type;
}
-/**
- * Implementation of payload_t.get_length.
- */
-static size_t get_length(private_eap_payload_t *this)
+METHOD(payload_t, get_length, size_t,
+ private_eap_payload_t *this)
{
return this->payload_length;
}
-/**
- * Implementation of eap_payload_t.get_data.
- */
-static chunk_t get_data(private_eap_payload_t *this)
+METHOD(eap_payload_t, get_data, chunk_t,
+ private_eap_payload_t *this)
{
return this->data;
}
-/**
- * Implementation of eap_payload_t.set_data.
- */
-static void set_data(private_eap_payload_t *this, chunk_t data)
+METHOD(eap_payload_t, set_data, void,
+ private_eap_payload_t *this, chunk_t data)
{
- chunk_free(&this->data);
+ free(this->data.ptr);
this->data = chunk_clone(data);
this->payload_length = this->data.len + 4;
}
-/**
- * Implementation of eap_payload_t.get_code.
- */
-static eap_code_t get_code(private_eap_payload_t *this)
+METHOD(eap_payload_t, get_code, eap_code_t,
+ private_eap_payload_t *this)
{
if (this->data.len > 0)
{
- return *this->data.ptr;
+ return this->data.ptr[0];
}
/* should not happen, as it is verified */
return 0;
}
-/**
- * Implementation of eap_payload_t.get_identifier.
- */
-static u_int8_t get_identifier(private_eap_payload_t *this)
+METHOD(eap_payload_t, get_identifier, u_int8_t,
+ private_eap_payload_t *this)
{
if (this->data.len > 1)
{
- return *(this->data.ptr + 1);
+ return this->data.ptr[1];
}
/* should not happen, as it is verified */
return 0;
}
-/**
- * Implementation of eap_payload_t.get_type.
- */
-static eap_type_t get_type(private_eap_payload_t *this, u_int32_t *vendor)
+METHOD(eap_payload_t, get_type, eap_type_t,
+ private_eap_payload_t *this, u_int32_t *vendor)
{
eap_type_t type;
*vendor = 0;
if (this->data.len > 4)
{
- type = *(this->data.ptr + 4);
+ type = this->data.ptr[4];
if (type != EAP_EXPANDED)
{
return type;
}
if (this->data.len >= 12)
{
- *vendor = ntohl(*(u_int32_t*)(this->data.ptr + 4)) & 0x00FFFFFF;
- return ntohl(*(u_int32_t*)(this->data.ptr + 8));
+ *vendor = untoh32(this->data.ptr + 4) & 0x00FFFFFF;
+ return untoh32(this->data.ptr + 8);
}
}
return 0;
}
-/**
- * Implementation of payload_t.destroy and eap_payload_t.destroy.
- */
-static void destroy(private_eap_payload_t *this)
+METHOD2(payload_t, eap_payload_t, destroy, void,
+ private_eap_payload_t *this)
{
chunk_free(&this->data);
free(this);
@@ -263,32 +239,30 @@ static void destroy(private_eap_payload_t *this)
*/
eap_payload_t *eap_payload_create()
{
- private_eap_payload_t *this = malloc_thing(private_eap_payload_t);
-
- /* interface functions */
- this->public.payload_interface.verify = (status_t (*) (payload_t *))verify;
- this->public.payload_interface.get_encoding_rules = (void (*) (payload_t *, encoding_rule_t **, size_t *) ) get_encoding_rules;
- this->public.payload_interface.get_length = (size_t (*) (payload_t *)) get_length;
- this->public.payload_interface.get_next_type = (payload_type_t (*) (payload_t *)) get_next_type;
- this->public.payload_interface.set_next_type = (void (*) (payload_t *,payload_type_t)) set_next_type;
- this->public.payload_interface.get_type = (payload_type_t (*) (payload_t *)) get_payload_type;
- this->public.payload_interface.destroy = (void (*) (payload_t *))destroy;
-
- /* public functions */
- this->public.destroy = (void (*) (eap_payload_t *)) destroy;
- this->public.get_data = (chunk_t (*) (eap_payload_t*))get_data;
- this->public.set_data = (void (*) (eap_payload_t *,chunk_t))set_data;
- this->public.get_code = (eap_code_t (*) (eap_payload_t*))get_code;
- this->public.get_identifier = (u_int8_t (*) (eap_payload_t*))get_identifier;
- this->public.get_type = (eap_type_t (*) (eap_payload_t*,u_int32_t*))get_type;
-
- /* private variables */
- this->critical = FALSE;
- this->next_payload = NO_PAYLOAD;
- this->payload_length = EAP_PAYLOAD_HEADER_LENGTH;
- this->data = chunk_empty;
-
- return &(this->public);
+ private_eap_payload_t *this;
+
+ INIT(this,
+ .public = {
+ .payload_interface = {
+ .verify = _verify,
+ .get_encoding_rules = _get_encoding_rules,
+ .get_length = _get_length,
+ .get_next_type = _get_next_type,
+ .set_next_type = _set_next_type,
+ .get_type = _get_payload_type,
+ .destroy = _destroy,
+ },
+ .get_data = _get_data,
+ .set_data = _set_data,
+ .get_code = _get_code,
+ .get_identifier = _get_identifier,
+ .get_type = _get_type,
+ .destroy = _destroy,
+ },
+ .next_payload = NO_PAYLOAD,
+ .payload_length = EAP_PAYLOAD_HEADER_LENGTH,
+ );
+ return &this->public;
}
/*
@@ -297,7 +271,7 @@ eap_payload_t *eap_payload_create()
eap_payload_t *eap_payload_create_data(chunk_t data)
{
eap_payload_t *this = eap_payload_create();
-
+
this->set_data(this, data);
return this;
}
@@ -307,15 +281,11 @@ eap_payload_t *eap_payload_create_data(chunk_t data)
*/
eap_payload_t *eap_payload_create_code(eap_code_t code, u_int8_t identifier)
{
- eap_payload_t *this = eap_payload_create();
- chunk_t data = chunk_alloca(4);
-
- *(data.ptr + 0) = code;
- *(data.ptr + 1) = identifier;
- *(u_int16_t*)(data.ptr + 2) = htons(data.len);
-
- this->set_data(this, data);
- return this;
+ chunk_t data;
+
+ data = chunk_from_chars(code, identifier, 0, 0);
+ htoun16(data.ptr + 2, data.len);
+ return eap_payload_create_data(data);
}
/*
@@ -323,15 +293,10 @@ eap_payload_t *eap_payload_create_code(eap_code_t code, u_int8_t identifier)
*/
eap_payload_t *eap_payload_create_nak(u_int8_t identifier)
{
- eap_payload_t *this = eap_payload_create();
- chunk_t data = chunk_alloca(5);
-
- *(data.ptr + 0) = EAP_RESPONSE;
- *(data.ptr + 1) = identifier;
- *(u_int16_t*)(data.ptr + 2) = htons(data.len);
- *(data.ptr + 4) = EAP_NAK;
-
- this->set_data(this, data);
- return this;
+ chunk_t data;
+
+ data = chunk_from_chars(EAP_RESPONSE, identifier, 0, 0, EAP_NAK);
+ htoun16(data.ptr + 2, data.len);
+ return eap_payload_create_data(data);
}
diff --git a/src/charon/encoding/payloads/eap_payload.h b/src/charon/encoding/payloads/eap_payload.h
index a4d8a38c6..0bde4b15e 100644
--- a/src/charon/encoding/payloads/eap_payload.h
+++ b/src/charon/encoding/payloads/eap_payload.h
@@ -39,12 +39,12 @@ typedef struct eap_payload_t eap_payload_t;
* The EAP payload format is described in RFC section 3.16.
*/
struct eap_payload_t {
-
+
/**
* The payload_t interface.
*/
payload_t payload_interface;
-
+
/**
* Set the contained EAP data.
*
@@ -54,7 +54,7 @@ struct eap_payload_t {
* @param message EAP data
*/
void (*set_data) (eap_payload_t *this, chunk_t data);
-
+
/**
* Get the contained EAP data.
*
@@ -63,21 +63,21 @@ struct eap_payload_t {
* @return EAP data (pointer to internal data)
*/
chunk_t (*get_data) (eap_payload_t *this);
-
+
/**
* Get the EAP code.
*
* @return EAP message as chunk_t
*/
eap_code_t (*get_code) (eap_payload_t *this);
-
+
/**
* Get the EAP identifier.
*
* @return unique identifier
*/
u_int8_t (*get_identifier) (eap_payload_t *this);
-
+
/**
* Get the EAP method type.
*
@@ -85,7 +85,7 @@ struct eap_payload_t {
* @return EAP method type, vendor specific if vendor != 0
*/
eap_type_t (*get_type) (eap_payload_t *this, u_int32_t *vendor);
-
+
/**
* Destroys an eap_payload_t object.
*/
@@ -109,7 +109,7 @@ eap_payload_t *eap_payload_create_data(chunk_t data);
/**
* Creates an eap_payload_t object with a code.
*
- * Could should be either EAP_SUCCESS/EAP_FAILURE, use
+ * Could should be either EAP_SUCCESS/EAP_FAILURE, use
* constructor above otherwise.
*
* @param code EAP status code
diff --git a/src/charon/encoding/payloads/encodings.h b/src/charon/encoding/payloads/encodings.h
index 03554f0af..52af4a984 100644
--- a/src/charon/encoding/payloads/encodings.h
+++ b/src/charon/encoding/payloads/encodings.h
@@ -28,266 +28,266 @@ typedef struct encoding_rule_t encoding_rule_t;
#include <library.h>
/**
- * All different kinds of encoding types.
+ * All different kinds of encoding types.
*
- * Each field of an IKEv2-Message (in header or payload)
+ * Each field of an IKEv2-Message (in header or payload)
* which has to be parsed or generated differently has its own
* type defined here.
*
- * Header is parsed like a payload and gets its one payload_id
- * from PRIVATE USE space. Also the substructures
- * of specific payload types get their own payload_id
+ * Header is parsed like a payload and gets its one payload_id
+ * from PRIVATE USE space. Also the substructures
+ * of specific payload types get their own payload_id
* from PRIVATE_USE space. See IKEv2-Draft for more informations.
*/
enum encoding_type_t {
-
+
/**
* Representing a 4 Bit unsigned int value.
- *
- *
+ *
+ *
* When generating it must be changed from host to network order.
* The value is read from the associated data struct.
* The current write position is moved 4 bit forward afterwards.
- *
+ *
* When parsing it must be changed from network to host order.
* The value is written to the associated data struct.
* The current read pointer is moved 4 bit forward afterwards.
*/
U_INT_4,
-
+
/**
* Representing a 8 Bit unsigned int value.
- *
- *
+ *
+ *
* When generating it must be changed from host to network order.
* The value is read from the associated data struct.
* The current write position is moved 8 bit forward afterwards.
- *
+ *
* When parsing it must be changed from network to host order.
* The value is written to the associated data struct.
* The current read pointer is moved 8 bit forward afterwards.
*/
U_INT_8,
-
+
/**
* Representing a 16 Bit unsigned int value.
- *
- *
+ *
+ *
* When generating it must be changed from host to network order.
* The value is read from the associated data struct.
- * The current write position is moved 16 bit forward afterwards.
- *
+ * The current write position is moved 16 bit forward afterwards.
+ *
* When parsing it must be changed from network to host order.
* The value is written to the associated data struct.
* The current read pointer is moved 16 bit forward afterwards.
*/
U_INT_16,
-
+
/**
* Representing a 32 Bit unsigned int value.
- *
+ *
* When generating it must be changed from host to network order.
* The value is read from the associated data struct.
* The current write position is moved 32 bit forward afterwards.
- *
+ *
* When parsing it must be changed from network to host order.
* The value is written to the associated data struct.
* The current read pointer is moved 32 bit forward afterwards.
*/
U_INT_32,
-
+
/**
* represents a RESERVED_BIT used in FLAG-Bytes.
- *
- * When generating, the next bit is set to zero and the current write
+ *
+ * When generating, the next bit is set to zero and the current write
* position is moved one bit forward.
* No value is read from the associated data struct.
* The current write position is moved 1 bit forward afterwards.
- *
+ *
* When parsing, the current read pointer is moved one bit forward.
* No value is written to the associated data struct.
* The current read pointer is moved 1 bit forward afterwards.
*/
RESERVED_BIT,
-
+
/**
* represents a RESERVED_BYTE.
- *
- * When generating, the next byte is set to zero and the current write
+ *
+ * When generating, the next byte is set to zero and the current write
* position is moved one byte forward.
* No value is read from the associated data struct.
* The current write position is moved 1 byte forward afterwards.
- *
+ *
* When parsing, the current read pointer is moved one byte forward.
* No value is written to the associated data struct.
* The current read pointer is moved 1 byte forward afterwards.
*/
RESERVED_BYTE,
-
+
/**
* Representing a 1 Bit flag.
- *
- * When generation, the next bit is set to 1 if the associated value
- * in the data struct is TRUE, 0 otherwise. The current write position
+ *
+ * When generation, the next bit is set to 1 if the associated value
+ * in the data struct is TRUE, 0 otherwise. The current write position
* is moved 1 bit forward afterwards.
*
- * When parsing, the next bit is read and stored in the associated data
- * struct. 0 means FALSE, 1 means TRUE, The current read pointer
+ * When parsing, the next bit is read and stored in the associated data
+ * struct. 0 means FALSE, 1 means TRUE, The current read pointer
* is moved 1 bit forward afterwards
*/
FLAG,
-
+
/**
* Representating a length field of a payload.
- *
- * When generating it must be changed from host to network order.
+ *
+ * When generating it must be changed from host to network order.
* The value is read from the associated data struct.
* The current write position is moved 16 bit forward afterwards.
- *
+ *
* When parsing it must be changed from network to host order.
* The value is written to the associated data struct.
* The current read pointer is moved 16 bit forward afterwards.
*/
PAYLOAD_LENGTH,
-
+
/**
* Representating a length field of a header.
- *
- * When generating it must be changed from host to network order.
+ *
+ * When generating it must be changed from host to network order.
* The value is read from the associated data struct.
* The current write position is moved 32 bit forward afterwards.
- *
+ *
* When parsing it must be changed from network to host order.
* The value is written to the associated data struct.
* The current read pointer is moved 32 bit forward afterwards.
*/
HEADER_LENGTH,
-
+
/**
* Representating a spi size field.
- *
- * When generating it must be changed from host to network order.
+ *
+ * When generating it must be changed from host to network order.
* The value is read from the associated data struct.
* The current write position is moved 8 bit forward afterwards.
- *
+ *
* When parsing it must be changed from network to host order.
* The value is written to the associated data struct.
* The current read pointer is moved 8 bit forward afterwards.
*/
SPI_SIZE,
-
+
/**
* Representating a spi field.
- *
- * When generating the content of the chunkt pointing to
- * is written.
- *
+ *
+ * When generating the content of the chunkt pointing to
+ * is written.
+ *
* When parsing SPI_SIZE bytes are read and written into the chunk pointing to.
*/
SPI,
-
+
/**
* Representating a Key Exchange Data field.
- *
- * When generating the content of the chunkt pointing to
- * is written.
- *
+ *
+ * When generating the content of the chunkt pointing to
+ * is written.
+ *
* When parsing (Payload Length - 8) bytes are read and written into the chunk pointing to.
*/
KEY_EXCHANGE_DATA,
-
+
/**
* Representating a Notification field.
- *
- * When generating the content of the chunkt pointing to
- * is written.
- *
+ *
+ * When generating the content of the chunkt pointing to
+ * is written.
+ *
* When parsing (Payload Length - spi size - 8) bytes are read and written into the chunk pointing to.
*/
NOTIFICATION_DATA,
-
+
/**
* Representating one or more proposal substructures.
- *
+ *
* The offset points to a linked_list_t pointer.
- *
- * When generating the proposal_substructure_t objects are stored
+ *
+ * When generating the proposal_substructure_t objects are stored
* in the pointed linked_list.
- *
- * When parsing the parsed proposal_substructure_t objects have
+ *
+ * When parsing the parsed proposal_substructure_t objects have
* to be stored in the pointed linked_list.
- */
+ */
PROPOSALS,
-
+
/**
* Representating one or more transform substructures.
- *
+ *
* The offset points to a linked_list_t pointer.
- *
- * When generating the transform_substructure_t objects are stored
+ *
+ * When generating the transform_substructure_t objects are stored
* in the pointed linked_list.
- *
- * When parsing the parsed transform_substructure_t objects have
+ *
+ * When parsing the parsed transform_substructure_t objects have
* to be stored in the pointed linked_list.
- */
+ */
TRANSFORMS,
-
+
/**
* Representating one or more Attributes of a transform substructure.
- *
+ *
* The offset points to a linked_list_t pointer.
- *
- * When generating the transform_attribute_t objects are stored
+ *
+ * When generating the transform_attribute_t objects are stored
* in the pointed linked_list.
- *
- * When parsing the parsed transform_attribute_t objects have
+ *
+ * When parsing the parsed transform_attribute_t objects have
* to be stored in the pointed linked_list.
- */
+ */
TRANSFORM_ATTRIBUTES,
/**
* Representating one or more Attributes of a configuration payload.
- *
+ *
* The offset points to a linked_list_t pointer.
- *
- * When generating the configuration_attribute_t objects are stored
+ *
+ * When generating the configuration_attribute_t objects are stored
* in the pointed linked_list.
- *
- * When parsing the parsed configuration_attribute_t objects have
+ *
+ * When parsing the parsed configuration_attribute_t objects have
* to be stored in the pointed linked_list.
- */
+ */
CONFIGURATION_ATTRIBUTES,
-
+
/**
- *
- * When generating the content of the chunkt pointing to
- * is written.
- *
+ *
+ * When generating the content of the chunkt pointing to
+ * is written.
+ *
* When parsing (Payload Length - 4) bytes are read and written into the chunk pointing to.
*/
CONFIGURATION_ATTRIBUTE_VALUE,
-
+
/**
* Representing a 1 Bit flag specifying the format of a transform attribute.
- *
- * When generation, the next bit is set to 1 if the associated value
- * in the data struct is TRUE, 0 otherwise. The current write position
+ *
+ * When generation, the next bit is set to 1 if the associated value
+ * in the data struct is TRUE, 0 otherwise. The current write position
* is moved 1 bit forward afterwards.
*
- * When parsing, the next bit is read and stored in the associated data
- * struct. 0 means FALSE, 1 means TRUE, The current read pointer
+ * When parsing, the next bit is read and stored in the associated data
+ * struct. 0 means FALSE, 1 means TRUE, The current read pointer
* is moved 1 bit forward afterwards.
*/
ATTRIBUTE_FORMAT,
/**
- * Representing a 15 Bit unsigned int value used as attribute type
+ * Representing a 15 Bit unsigned int value used as attribute type
* in an attribute transform.
- *
- *
+ *
+ *
* When generating it must be changed from host to network order.
* The value is read from the associated data struct.
- * The current write position is moved 15 bit forward afterwards.
- *
+ * The current write position is moved 15 bit forward afterwards.
+ *
* When parsing it must be changed from network to host order.
* The value is written to the associated data struct.
* The current read pointer is moved 15 bit forward afterwards.
@@ -298,11 +298,11 @@ enum encoding_type_t {
* Depending on the field of type ATTRIBUTE_FORMAT
* this field contains the length or the value of an transform attribute.
* Its stored in a 16 unsigned integer field.
- *
+ *
* When generating it must be changed from host to network order.
* The value is read from the associated data struct.
- * The current write position is moved 16 bit forward afterwards.
- *
+ * The current write position is moved 16 bit forward afterwards.
+ *
* When parsing it must be changed from network to host order.
* The value is written to the associated data struct.
* The current read pointer is moved 16 bit forward afterwards.
@@ -312,11 +312,11 @@ enum encoding_type_t {
/**
* This field contains the length or the value of an configuration attribute.
* Its stored in a 16 unsigned integer field.
- *
+ *
* When generating it must be changed from host to network order.
* The value is read from the associated data struct.
- * The current write position is moved 16 bit forward afterwards.
- *
+ * The current write position is moved 16 bit forward afterwards.
+ *
* When parsing it must be changed from network to host order.
* The value is written to the associated data struct.
* The current read pointer is moved 16 bit forward afterwards.
@@ -325,155 +325,155 @@ enum encoding_type_t {
/**
* Depending on the field of type ATTRIBUTE_FORMAT
- * this field is available or missing and so parsed/generated
+ * this field is available or missing and so parsed/generated
* or not parsed/not generated.
- *
- * When generating the content of the chunkt pointing to
- * is written.
- *
+ *
+ * When generating the content of the chunkt pointing to
+ * is written.
+ *
* When parsing SPI_SIZE bytes are read and written into the chunk pointing to.
*/
ATTRIBUTE_VALUE,
-
+
/**
* Representating one or more Traffic selectors of a TS payload.
- *
+ *
* The offset points to a linked_list_t pointer.
- *
- * When generating the traffic_selector_substructure_t objects are stored
+ *
+ * When generating the traffic_selector_substructure_t objects are stored
* in the pointed linked_list.
- *
- * When parsing the parsed traffic_selector_substructure_t objects have
+ *
+ * When parsing the parsed traffic_selector_substructure_t objects have
* to be stored in the pointed linked_list.
- */
+ */
TRAFFIC_SELECTORS,
-
+
/**
* Representating a Traffic selector type field.
- *
+ *
* When generating it must be changed from host to network order.
* The value is read from the associated data struct.
- * The current write position is moved 16 bit forward afterwards.
- *
+ * The current write position is moved 16 bit forward afterwards.
+ *
* When parsing it must be changed from network to host order.
* The value is written to the associated data struct.
* The current read pointer is moved 16 bit forward afterwards.
*/
TS_TYPE,
-
+
/**
* Representating an address field in a traffic selector.
- *
+ *
* Depending on the last field of type TS_TYPE
* this field is either 4 or 16 byte long.
- *
- * When generating the content of the chunkt pointing to
- * is written.
- *
+ *
+ * When generating the content of the chunkt pointing to
+ * is written.
+ *
* When parsing 4 or 16 bytes are read and written into the chunk pointing to.
*/
ADDRESS,
/**
* Representating a Nonce Data field.
- *
- * When generating the content of the chunkt pointing to
- * is written.
- *
+ *
+ * When generating the content of the chunkt pointing to
+ * is written.
+ *
* When parsing (Payload Length - 4) bytes are read and written into the chunk pointing to.
*/
NONCE_DATA,
-
+
/**
* Representating a ID Data field.
- *
- * When generating the content of the chunkt pointing to
- * is written.
- *
+ *
+ * When generating the content of the chunkt pointing to
+ * is written.
+ *
* When parsing (Payload Length - 8) bytes are read and written into the chunk pointing to.
*/
ID_DATA,
-
+
/**
* Representating a AUTH Data field.
- *
- * When generating the content of the chunkt pointing to
- * is written.
- *
+ *
+ * When generating the content of the chunkt pointing to
+ * is written.
+ *
* When parsing (Payload Length - 8) bytes are read and written into the chunk pointing to.
*/
AUTH_DATA,
-
+
/**
* Representating a CERT Data field.
- *
- * When generating the content of the chunkt pointing to
- * is written.
- *
+ *
+ * When generating the content of the chunkt pointing to
+ * is written.
+ *
* When parsing (Payload Length - 5) bytes are read and written into the chunk pointing to.
*/
CERT_DATA,
/**
* Representating a CERTREQ Data field.
- *
- * When generating the content of the chunkt pointing to
- * is written.
- *
+ *
+ * When generating the content of the chunkt pointing to
+ * is written.
+ *
* When parsing (Payload Length - 5) bytes are read and written into the chunk pointing to.
*/
CERTREQ_DATA,
-
+
/**
* Representating an EAP message field.
- *
- * When generating the content of the chunkt pointing to
- * is written.
- *
+ *
+ * When generating the content of the chunkt pointing to
+ * is written.
+ *
* When parsing (Payload Length - 4) bytes are read and written into the chunk pointing to.
*/
EAP_DATA,
-
+
/**
* Representating the SPIS field in a DELETE payload.
- *
- * When generating the content of the chunkt pointing to
- * is written.
- *
+ *
+ * When generating the content of the chunkt pointing to
+ * is written.
+ *
* When parsing (Payload Length - 8) bytes are read and written into the chunk pointing to.
*/
SPIS,
-
+
/**
* Representating the VID DATA field in a VENDOR ID payload.
- *
- * When generating the content of the chunkt pointing to
- * is written.
- *
+ *
+ * When generating the content of the chunkt pointing to
+ * is written.
+ *
* When parsing (Payload Length - 4) bytes are read and written into the chunk pointing to.
*/
VID_DATA,
-
+
/**
* Representating the DATA of an unknown payload.
- *
- * When generating the content of the chunkt pointing to
- * is written.
- *
+ *
+ * When generating the content of the chunkt pointing to
+ * is written.
+ *
* When parsing (Payload Length - 4) bytes are read and written into the chunk pointing to.
*/
UNKNOWN_DATA,
-
+
/**
* Representating an IKE_SPI field in an IKEv2 Header.
- *
- * When generating the value of the u_int64_t pointing to
- * is written (host and networ order is not changed).
- *
+ *
+ * When generating the value of the u_int64_t pointing to
+ * is written (host and networ order is not changed).
+ *
* When parsing 8 bytes are read and written into the u_int64_t pointing to.
*/
IKE_SPI,
-
+
/**
* Representing the encrypted data body of a encryption payload.
*/
@@ -488,25 +488,25 @@ extern enum_name_t *encoding_type_names;
/**
* Rule how to en-/decode a payload field.
*
- * An encoding rule is a mapping of a specific encoding type to
+ * An encoding rule is a mapping of a specific encoding type to
* a location in the data struct where the current field is stored to
* or read from.
* This rules are used by parser and generator.
*/
struct encoding_rule_t {
-
+
/**
* Encoding type.
*/
encoding_type_t type;
-
+
/**
* Offset in the data struct.
- *
- * When parsing, data are written to this offset of the
+ *
+ * When parsing, data are written to this offset of the
* data struct.
- *
- * When generating, data are read from this offset in the
+ *
+ * When generating, data are read from this offset in the
* data struct.
*/
u_int32_t offset;
diff --git a/src/charon/encoding/payloads/encryption_payload.c b/src/charon/encoding/payloads/encryption_payload.c
index 55a37bb25..389ab09d7 100644
--- a/src/charon/encoding/payloads/encryption_payload.c
+++ b/src/charon/encoding/payloads/encryption_payload.c
@@ -32,19 +32,19 @@ typedef struct private_encryption_payload_t private_encryption_payload_t;
/**
* Private data of an encryption_payload_t' Object.
- *
+ *
*/
struct private_encryption_payload_t {
-
+
/**
* Public encryption_payload_t interface.
*/
encryption_payload_t public;
-
+
/**
- * There is no next payload for an encryption payload,
+ * There is no next payload for an encryption payload,
* since encryption payload MUST be the last one.
- * next_payload means here the first payload of the
+ * next_payload means here the first payload of the
* contained, encrypted payload.
*/
u_int8_t next_payload;
@@ -53,33 +53,33 @@ struct private_encryption_payload_t {
* Critical flag.
*/
bool critical;
-
+
/**
* Length of this payload
*/
u_int16_t payload_length;
-
+
/**
* Chunk containing the iv, data, padding,
* and (an eventually not calculated) signature.
*/
chunk_t encrypted;
-
+
/**
* Chunk containing the data in decrypted (unpadded) form.
*/
chunk_t decrypted;
-
+
/**
* Signer set by set_signer.
*/
signer_t *signer;
-
+
/**
* Crypter, supplied by encrypt/decrypt
*/
crypter_t *crypter;
-
+
/**
* Contained payloads of this encrpytion_payload.
*/
@@ -88,10 +88,10 @@ struct private_encryption_payload_t {
/**
* Encoding rules to parse or generate a IKEv2-Encryption Payload.
- *
- * The defined offsets are the positions in a object of type
+ *
+ * The defined offsets are the positions in a object of type
* private_encryption_payload_t.
- *
+ *
*/
encoding_rule_t encryption_payload_encodings[] = {
/* 1 Byte next payload type, stored in the field next_payload */
@@ -170,7 +170,7 @@ static payload_type_t get_next_type(private_encryption_payload_t *this)
*/
static void set_next_type(private_encryption_payload_t *this, payload_type_t type)
{
- /* set next type is not allowed, since this payload MUST be the last one
+ /* set next type is not allowed, since this payload MUST be the last one
* and so nothing is done in here*/
}
@@ -190,7 +190,7 @@ static void compute_length(private_encryption_payload_t *this)
length += current_payload->get_length(current_payload);
}
iterator->destroy(iterator);
-
+
if (this->crypter && this->signer)
{
/* append one byte for padding length */
@@ -268,13 +268,13 @@ static void generate(private_encryption_payload_t *this)
payload_t *current_payload, *next_payload;
generator_t *generator;
iterator_t *iterator;
-
+
/* recalculate length before generating */
compute_length(this);
-
+
/* create iterator */
iterator = this->payloads->create_iterator(this->payloads, TRUE);
-
+
/* get first payload */
if (iterator->iterate(iterator, (void**)&current_payload))
{
@@ -289,9 +289,9 @@ static void generate(private_encryption_payload_t *this)
iterator->destroy(iterator);
return;
}
-
+
generator = generator_create();
-
+
/* build all payload, except last */
while(iterator->iterate(iterator, (void**)&next_payload))
{
@@ -300,14 +300,14 @@ static void generate(private_encryption_payload_t *this)
current_payload = next_payload;
}
iterator->destroy(iterator);
-
+
/* build last payload */
current_payload->set_next_type(current_payload, NO_PAYLOAD);
generator->generate_payload(generator, current_payload);
-
+
/* free already generated data */
free(this->decrypted.ptr);
-
+
generator->write_to_chunk(generator, &(this->decrypted));
generator->destroy(generator);
DBG2(DBG_ENC, "successfully generated content in encryption payload");
@@ -321,13 +321,13 @@ static status_t encrypt(private_encryption_payload_t *this)
chunk_t iv, padding, to_crypt, result;
rng_t *rng;
size_t block_size;
-
+
if (this->signer == NULL || this->crypter == NULL)
{
DBG1(DBG_ENC, "could not encrypt, signer/crypter not set");
return INVALID_STATE;
}
-
+
/* for random data in iv and padding */
rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
if (!rng)
@@ -337,15 +337,15 @@ static status_t encrypt(private_encryption_payload_t *this)
}
/* build payload chunk */
generate(this);
-
+
DBG2(DBG_ENC, "encrypting payloads");
DBG3(DBG_ENC, "data to encrypt %B", &this->decrypted);
-
+
/* build padding */
block_size = this->crypter->get_block_size(this->crypter);
padding.len = block_size - ((this->decrypted.len + 1) % block_size);
rng->allocate_bytes(rng, padding.len, &padding);
-
+
/* concatenate payload data, padding, padding len */
to_crypt.len = this->decrypted.len + padding.len + 1;
to_crypt.ptr = malloc(to_crypt.len);
@@ -353,36 +353,36 @@ static status_t encrypt(private_encryption_payload_t *this)
memcpy(to_crypt.ptr, this->decrypted.ptr, this->decrypted.len);
memcpy(to_crypt.ptr + this->decrypted.len, padding.ptr, padding.len);
*(to_crypt.ptr + to_crypt.len - 1) = padding.len;
-
+
/* build iv */
iv.len = block_size;
rng->allocate_bytes(rng, iv.len, &iv);
rng->destroy(rng);
-
+
DBG3(DBG_ENC, "data before encryption with padding %B", &to_crypt);
-
+
/* encrypt to_crypt chunk */
free(this->encrypted.ptr);
this->crypter->encrypt(this->crypter, to_crypt, iv, &result);
free(padding.ptr);
free(to_crypt.ptr);
-
+
DBG3(DBG_ENC, "data after encryption %B", &result);
-
+
/* build encrypted result with iv and signature */
this->encrypted.len = iv.len + result.len + this->signer->get_block_size(this->signer);
free(this->encrypted.ptr);
this->encrypted.ptr = malloc(this->encrypted.len);
-
+
/* fill in result, signature is left out */
memcpy(this->encrypted.ptr, iv.ptr, iv.len);
memcpy(this->encrypted.ptr + iv.len, result.ptr, result.len);
-
+
free(result.ptr);
free(iv.ptr);
DBG3(DBG_ENC, "data after encryption with IV and (invalid) signature %B",
&this->encrypted);
-
+
return SUCCESS;
}
@@ -394,16 +394,16 @@ static status_t parse(private_encryption_payload_t *this)
parser_t *parser;
status_t status;
payload_type_t current_payload_type;
-
+
/* build a parser on the decrypted data */
parser = parser_create(this->decrypted);
-
+
current_payload_type = this->next_payload;
/* parse all payloads */
while (current_payload_type != NO_PAYLOAD)
{
- payload_t *current_payload;
-
+ payload_t *current_payload;
+
status = parser->parse_payload(parser, current_payload_type, (payload_t**)&current_payload);
if (status != SUCCESS)
{
@@ -423,7 +423,7 @@ static status_t parse(private_encryption_payload_t *this)
/* get next payload type */
current_payload_type = current_payload->get_next_type(current_payload);
-
+
this->payloads->insert_last(this->payloads,current_payload);
}
parser->destroy(parser);
@@ -438,50 +438,50 @@ static status_t decrypt(private_encryption_payload_t *this)
{
chunk_t iv, concatenated;
u_int8_t padding_length;
-
+
DBG2(DBG_ENC, "decrypting encryption payload");
DBG3(DBG_ENC, "data before decryption with IV and (invalid) signature %B",
&this->encrypted);
-
+
if (this->signer == NULL || this->crypter == NULL)
{
DBG1(DBG_ENC, "could not decrypt, no crypter/signer set");
return INVALID_STATE;
}
-
+
/* get IV */
iv.len = this->crypter->get_block_size(this->crypter);
-
+
iv.ptr = this->encrypted.ptr;
-
+
/* point concatenated to data + padding + padding_length*/
concatenated.ptr = this->encrypted.ptr + iv.len;
concatenated.len = this->encrypted.len - iv.len -
this->signer->get_block_size(this->signer);
-
+
/* concatenated must be a multiple of block_size of crypter */
if (concatenated.len < iv.len || concatenated.len % iv.len)
{
DBG1(DBG_ENC, "could not decrypt, invalid input");
return FAILED;
}
-
+
/* free previus data, if any */
free(this->decrypted.ptr);
-
+
DBG3(DBG_ENC, "data before decryption %B", &concatenated);
-
+
this->crypter->decrypt(this->crypter, concatenated, iv, &this->decrypted);
DBG3(DBG_ENC, "data after decryption with padding %B", &this->decrypted);
-
+
/* get padding length, sits just bevore signature */
padding_length = *(this->decrypted.ptr + this->decrypted.len - 1);
- /* add one byte to the padding length, since the padding_length field is
+ /* add one byte to the padding length, since the padding_length field is
* not included */
padding_length++;
this->decrypted.len -= padding_length;
-
+
/* check size again */
if (padding_length > concatenated.len || this->decrypted.len < 0)
{
@@ -489,7 +489,7 @@ static status_t decrypt(private_encryption_payload_t *this)
/* decryption failed :-/ */
return FAILED;
}
-
+
/* free padding */
this->decrypted.ptr = realloc(this->decrypted.ptr, this->decrypted.len);
DBG3(DBG_ENC, "data after decryption without padding %B", &this->decrypted);
@@ -513,13 +513,13 @@ static status_t build_signature(private_encryption_payload_t *this, chunk_t data
{
chunk_t data_without_sig = data;
chunk_t sig;
-
+
if (this->signer == NULL)
{
DBG1(DBG_ENC, "unable to build signature, no signer set");
return INVALID_STATE;
}
-
+
sig.len = this->signer->get_block_size(this->signer);
data_without_sig.len -= sig.len;
sig.ptr = data.ptr + data_without_sig.len;
@@ -535,7 +535,7 @@ static status_t verify_signature(private_encryption_payload_t *this, chunk_t dat
{
chunk_t sig, data_without_sig;
bool valid;
-
+
if (this->signer == NULL)
{
DBG1(DBG_ENC, "unable to verify signature, no signer set");
@@ -549,18 +549,18 @@ static status_t verify_signature(private_encryption_payload_t *this, chunk_t dat
return FAILED;
}
sig.ptr = data.ptr + data.len - sig.len;
-
+
/* verify it */
data_without_sig.len = data.len - sig.len;
data_without_sig.ptr = data.ptr;
valid = this->signer->verify_signature(this->signer, data_without_sig, sig);
-
+
if (!valid)
{
DBG1(DBG_ENC, "signature verification failed");
return FAILED;
}
-
+
DBG2(DBG_ENC, "signature verification successful");
return SUCCESS;
}
@@ -582,7 +582,7 @@ static void destroy(private_encryption_payload_t *this)
encryption_payload_t *encryption_payload_create()
{
private_encryption_payload_t *this = malloc_thing(private_encryption_payload_t);
-
+
/* payload_t interface functions */
this->public.payload_interface.verify = (status_t (*) (payload_t *))verify;
this->public.payload_interface.get_encoding_rules = (void (*) (payload_t *, encoding_rule_t **, size_t *) ) get_encoding_rules;
@@ -591,20 +591,20 @@ encryption_payload_t *encryption_payload_create()
this->public.payload_interface.set_next_type = (void (*) (payload_t *,payload_type_t)) set_next_type;
this->public.payload_interface.get_type = (payload_type_t (*) (payload_t *)) get_type;
this->public.payload_interface.destroy = (void (*) (payload_t *))destroy;
-
+
/* public functions */
this->public.create_payload_iterator = (iterator_t * (*) (encryption_payload_t *,bool)) create_payload_iterator;
this->public.add_payload = (void (*) (encryption_payload_t *,payload_t *)) add_payload;
this->public.remove_first_payload = (status_t (*)(encryption_payload_t*, payload_t **)) remove_first_payload;
this->public.get_payload_count = (size_t (*)(encryption_payload_t*)) get_payload_count;
-
+
this->public.encrypt = (status_t (*) (encryption_payload_t *)) encrypt;
this->public.decrypt = (status_t (*) (encryption_payload_t *)) decrypt;
this->public.set_transforms = (void (*) (encryption_payload_t*,crypter_t*,signer_t*)) set_transforms;
this->public.build_signature = (status_t (*) (encryption_payload_t*, chunk_t)) build_signature;
this->public.verify_signature = (status_t (*) (encryption_payload_t*, chunk_t)) verify_signature;
this->public.destroy = (void (*) (encryption_payload_t *)) destroy;
-
+
/* set default values of the fields */
this->critical = FALSE;
this->next_payload = NO_PAYLOAD;
@@ -614,6 +614,6 @@ encryption_payload_t *encryption_payload_create()
this->signer = NULL;
this->crypter = NULL;
this->payloads = linked_list_create();
-
+
return (&(this->public));
}
diff --git a/src/charon/encoding/payloads/encryption_payload.h b/src/charon/encoding/payloads/encryption_payload.h
index 3b94587ec..ac5326b87 100644
--- a/src/charon/encoding/payloads/encryption_payload.h
+++ b/src/charon/encoding/payloads/encryption_payload.h
@@ -39,7 +39,7 @@ typedef struct encryption_payload_t encryption_payload_t;
/**
* The encryption payload as described in RFC section 3.14.
*
- * Before any crypt/decrypt/sign/verify operation can occur,
+ * Before any crypt/decrypt/sign/verify operation can occur,
* the transforms must be set. After that, a parsed encryption payload
* can be decrypted, which also will parse the contained payloads.
* Encryption is done the same way, added payloads will get generated
@@ -54,24 +54,24 @@ struct encryption_payload_t {
* Implements payload_t interface.
*/
payload_t payload_interface;
-
+
/**
* Creates an iterator for all contained payloads.
- *
+ *
* iterator_t object has to get destroyed by the caller.
*
* @param forward iterator direction (TRUE: front to end)
* return created iterator_t object
*/
iterator_t *(*create_payload_iterator) (encryption_payload_t *this, bool forward);
-
+
/**
* Adds a payload to this encryption payload.
*
* @param payload payload_t object to add
*/
void (*add_payload) (encryption_payload_t *this, payload_t *payload);
-
+
/**
* Reove the last payload in the contained payload list.
*
@@ -81,20 +81,20 @@ struct encryption_payload_t {
* - NOT_FOUND if list empty
*/
status_t (*remove_first_payload) (encryption_payload_t *this, payload_t **payload);
-
+
/**
* Get the number of payloads.
*
* @return number of contained payloads
*/
size_t (*get_payload_count) (encryption_payload_t *this);
-
+
/**
* Set transforms to use.
- *
+ *
* To decryption, encryption, signature building and verifying,
* the payload needs a crypter and a signer object.
- *
+ *
* @warning Do NOT call this function again after encryption, since
* the signer must be the same while encrypting and signature building!
*
@@ -102,10 +102,10 @@ struct encryption_payload_t {
* @param signer signer_t to use for data signing/verifying
*/
void (*set_transforms) (encryption_payload_t *this, crypter_t *crypter, signer_t *signer);
-
+
/**
* Generate and encrypt contained payloads.
- *
+ *
* This function generates the content for added payloads
* and encrypts them. Signature is not built, since we need
* additional data (the full message).
@@ -113,11 +113,11 @@ struct encryption_payload_t {
* @return SUCCESS, or INVALID_STATE if transforms not set
*/
status_t (*encrypt) (encryption_payload_t *this);
-
+
/**
* Decrypt and parse contained payloads.
- *
- * This function decrypts the contained data. After,
+ *
+ * This function decrypts the contained data. After,
* the payloads are parsed internally and are accessible
* via the iterator.
*
@@ -127,29 +127,29 @@ struct encryption_payload_t {
* - FAILED if data is invalid
*/
status_t (*decrypt) (encryption_payload_t *this);
-
+
/**
* Build the signature.
- *
+ *
* The signature is built over the FULL message, so the header
* and every payload (inclusive this one) must already be generated.
* The generated message is supplied via the data paramater.
- *
+ *
* @param data chunk contains the already generated message
* @return
* - SUCCESS, or
* - INVALID_STATE if transforms not set
*/
status_t (*build_signature) (encryption_payload_t *this, chunk_t data);
-
+
/**
* Verify the signature.
- *
+ *
* Since the signature is built over the full message, we need
* this data to do the verification. The message data
* is supplied via the data argument.
- *
- * @param data chunk contains the message
+ *
+ * @param data chunk contains the message
* @return
* - SUCCESS, or
* - FAILED if signature invalid, or
@@ -165,7 +165,7 @@ struct encryption_payload_t {
/**
* Creates an empty encryption_payload_t object.
- *
+ *
* @return encryption_payload_t object
*/
encryption_payload_t *encryption_payload_create(void);
diff --git a/src/charon/encoding/payloads/endpoint_notify.c b/src/charon/encoding/payloads/endpoint_notify.c
index c30d29942..faec1ea71 100644
--- a/src/charon/encoding/payloads/endpoint_notify.c
+++ b/src/charon/encoding/payloads/endpoint_notify.c
@@ -23,34 +23,33 @@ typedef struct private_endpoint_notify_t private_endpoint_notify_t;
/**
* Private data of an notify_payload_t object.
- *
*/
struct private_endpoint_notify_t {
/**
* Public endpoint_notify_t interface.
*/
endpoint_notify_t public;
-
+
/**
* Priority
*/
u_int32_t priority;
-
+
/**
* Family
*/
me_endpoint_family_t family;
-
+
/**
* Endpoint type
*/
me_endpoint_type_t type;
-
+
/**
* Endpoint
*/
host_t *endpoint;
-
+
/**
* Base (used for server reflexive endpoints)
*/
@@ -65,7 +64,7 @@ struct private_endpoint_notify_t {
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
! Family ! Type ! Port !
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
- ! IP Address (variable)
+ ! IP Address (variable) !
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
*/
@@ -122,9 +121,9 @@ static status_t parse_notification_data(private_endpoint_notify_t *this, chunk_t
chunk_t addr;
u_int8_t *cur = data.ptr;
u_int8_t *top = data.ptr + data.len;
-
+
DBG3(DBG_IKE, "me_endpoint_data %B", &data);
-
+
if (parse_uint32(&cur, top, &this->priority) != SUCCESS)
{
DBG1(DBG_IKE, "failed to parse ME_ENDPOINT: invalid priority");
@@ -136,20 +135,19 @@ static status_t parse_notification_data(private_endpoint_notify_t *this, chunk_t
DBG1(DBG_IKE, "failed to parse ME_ENDPOINT: invalid family");
return FAILED;
}
-
this->family = (me_endpoint_family_t)family;
-
- if (parse_uint8(&cur, top, &type) != SUCCESS || type >= MAX_TYPE)
+
+ if (parse_uint8(&cur, top, &type) != SUCCESS ||
+ type == NO_TYPE || type >= MAX_TYPE)
{
DBG1(DBG_IKE, "failed to parse ME_ENDPOINT: invalid type");
return FAILED;
}
-
this->type = (me_endpoint_type_t)type;
-
+
addr_family = AF_INET;
addr.len = 4;
-
+
switch(this->family)
{
case IPv6:
@@ -160,24 +158,23 @@ static status_t parse_notification_data(private_endpoint_notify_t *this, chunk_t
if (parse_uint16(&cur, top, &port) != SUCCESS)
{
DBG1(DBG_IKE, "failed to parse ME_ENDPOINT: invalid port");
- return FAILED;
+ return FAILED;
}
-
+
if (cur + addr.len > top)
{
DBG1(DBG_IKE, "failed to parse ME_ENDPOINT: invalid IP address");
return FAILED;
}
-
+
addr.ptr = cur;
-
this->endpoint = host_create_from_chunk(addr_family, addr, port);
break;
case NO_FAMILY:
default:
this->endpoint = NULL;
break;
- }
+ }
return SUCCESS;
}
@@ -192,14 +189,14 @@ static chunk_t build_notification_data(private_endpoint_notify_t *this)
u_int32_t prio;
u_int16_t port;
u_int8_t family, type;
-
+
prio = htonl(this->priority);
prio_chunk = chunk_from_thing(prio);
family = this->family;
family_chunk = chunk_from_thing(family);
type = this->type;
type_chunk = chunk_from_thing(type);
-
+
if (this->endpoint)
{
port = htons(this->endpoint->get_port(this->endpoint));
@@ -208,15 +205,14 @@ static chunk_t build_notification_data(private_endpoint_notify_t *this)
else
{
port = 0;
- addr_chunk = chunk_empty;
+ addr_chunk = chunk_empty;
}
port_chunk = chunk_from_thing(port);
-
+
/* data = prio | family | type | port | addr */
data = chunk_cat("ccccc", prio_chunk, family_chunk, type_chunk,
- port_chunk, addr_chunk);
+ port_chunk, addr_chunk);
DBG3(DBG_IKE, "me_endpoint_data %B", &data);
-
return data;
}
@@ -226,14 +222,14 @@ static chunk_t build_notification_data(private_endpoint_notify_t *this)
static notify_payload_t *build_notify(private_endpoint_notify_t *this)
{
chunk_t data;
- notify_payload_t *notify;
-
+ notify_payload_t *notify;
+
notify = notify_payload_create();
notify->set_notify_type(notify, ME_ENDPOINT);
data = build_notification_data(this);
notify->set_notification_data(notify, data);
chunk_free(&data);
-
+
return notify;
}
@@ -291,7 +287,7 @@ static host_t *get_base(private_endpoint_notify_t *this)
static endpoint_notify_t *_clone(private_endpoint_notify_t *this)
{
private_endpoint_notify_t *clone = (private_endpoint_notify_t*)endpoint_notify_create();
-
+
clone->priority = this->priority;
clone->type = this->type;
clone->family = this->family;
@@ -299,12 +295,12 @@ static endpoint_notify_t *_clone(private_endpoint_notify_t *this)
{
clone->endpoint = this->endpoint->clone(this->endpoint);
}
-
+
if (this->base)
{
clone->base = this->base->clone(this->base);
}
-
+
return &clone->public;
}
@@ -336,14 +332,14 @@ endpoint_notify_t *endpoint_notify_create()
this->public.build_notify = (notify_payload_t *(*) (endpoint_notify_t *)) build_notify;
this->public.clone = (endpoint_notify_t *(*) (endpoint_notify_t *)) _clone;
this->public.destroy = (void (*) (endpoint_notify_t *)) destroy;
-
+
/* set default values of the fields */
this->priority = 0;
this->family = NO_FAMILY;
this->type = NO_TYPE;
this->endpoint = NULL;
this->base = NULL;
-
+
return &this->public;
}
@@ -353,34 +349,34 @@ endpoint_notify_t *endpoint_notify_create()
endpoint_notify_t *endpoint_notify_create_from_host(me_endpoint_type_t type, host_t *host, host_t *base)
{
private_endpoint_notify_t *this = (private_endpoint_notify_t*)endpoint_notify_create();
-
+
this->type = type;
-
+
switch(type)
{
case HOST:
- this->priority = pow(2, 16) * ME_PRIO_HOST;
+ this->priority = pow(2, 16) * ME_PRIO_HOST;
break;
case PEER_REFLEXIVE:
- this->priority = pow(2, 16) * ME_PRIO_PEER;
+ this->priority = pow(2, 16) * ME_PRIO_PEER;
break;
case SERVER_REFLEXIVE:
- this->priority = pow(2, 16) * ME_PRIO_SERVER;
+ this->priority = pow(2, 16) * ME_PRIO_SERVER;
break;
case RELAYED:
default:
- this->priority = pow(2, 16) * ME_PRIO_RELAY;
+ this->priority = pow(2, 16) * ME_PRIO_RELAY;
break;
}
-
+
/* FIXME: if there is more than one ip address we should vary this priority */
this->priority += 65535;
-
+
if (!host)
{
return &this->public;
}
-
+
switch(host->get_family(host))
{
case AF_INET:
@@ -394,14 +390,14 @@ endpoint_notify_t *endpoint_notify_create_from_host(me_endpoint_type_t type, hos
* (family is set to NO_FAMILY) */
return &this->public;
}
-
+
this->endpoint = host->clone(host);
-
+
if (base)
{
this->base = base->clone(base);
}
-
+
return &this->public;
}
@@ -414,7 +410,7 @@ endpoint_notify_t *endpoint_notify_create_from_payload(notify_payload_t *notify)
{
return NULL;
}
-
+
private_endpoint_notify_t *this = (private_endpoint_notify_t*)endpoint_notify_create();
chunk_t data = notify->get_notification_data(notify);
if (parse_notification_data(this, data) != SUCCESS)
diff --git a/src/charon/encoding/payloads/endpoint_notify.h b/src/charon/encoding/payloads/endpoint_notify.h
index 66aabc683..120eef49a 100644
--- a/src/charon/encoding/payloads/endpoint_notify.h
+++ b/src/charon/encoding/payloads/endpoint_notify.h
@@ -36,34 +36,34 @@ typedef struct endpoint_notify_t endpoint_notify_t;
* ME endpoint families.
*/
enum me_endpoint_family_t {
-
+
NO_FAMILY = 0,
-
+
IPv4 = 1,
-
+
IPv6 = 2,
-
+
MAX_FAMILY = 3
-
+
};
/**
* ME endpoint types.
*/
enum me_endpoint_type_t {
-
+
NO_TYPE = 0,
-
+
HOST = 1,
-
+
PEER_REFLEXIVE = 2,
-
+
SERVER_REFLEXIVE = 3,
-
+
RELAYED = 4,
-
+
MAX_TYPE = 5
-
+
};
/**
@@ -79,52 +79,52 @@ extern enum_name_t *me_endpoint_type_names;
struct endpoint_notify_t {
/**
* Returns the priority of this endpoint.
- *
+ *
* @return priority
*/
u_int32_t (*get_priority) (endpoint_notify_t *this);
-
+
/**
* Sets the priority of this endpoint.
- *
+ *
* @param priority priority
*/
void (*set_priority) (endpoint_notify_t *this, u_int32_t priority);
-
+
/**
* Returns the endpoint type of this endpoint.
- *
+ *
* @return endpoint type
*/
me_endpoint_type_t (*get_type) (endpoint_notify_t *this);
-
+
/**
* Returns the endpoint family of this endpoint.
- *
+ *
* @return endpoint family
*/
me_endpoint_family_t (*get_family) (endpoint_notify_t *this);
-
+
/**
* Returns the host of this endpoint.
- *
+ *
* @return host
*/
host_t *(*get_host) (endpoint_notify_t *this);
-
+
/**
* Returns the base of this endpoint.
- *
+ *
* If this is not a SERVER_REFLEXIVE endpoint, the returned host is the same
* as the one returned by get_host.
- *
+ *
* @return host
*/
host_t *(*get_base) (endpoint_notify_t *this);
-
+
/**
- * Generates a notification payload from this endpoint.
- *
+ * Generates a notification payload from this endpoint.
+ *
* @return built notify_payload_t
*/
notify_payload_t *(*build_notify) (endpoint_notify_t *this);
@@ -135,7 +135,7 @@ struct endpoint_notify_t {
* @return cloned object
*/
endpoint_notify_t *(*clone) (endpoint_notify_t *this);
-
+
/**
* Destroys an endpoint_notify_t object.
*/
@@ -144,7 +144,7 @@ struct endpoint_notify_t {
/**
* Creates an empty endpoint_notify_t object.
- *
+ *
* @return created endpoint_notify_t object
*/
endpoint_notify_t *endpoint_notify_create(void);
@@ -152,7 +152,7 @@ endpoint_notify_t *endpoint_notify_create(void);
/**
* Creates an endpoint_notify_t object from a host.
- *
+ *
* @param type the endpoint type
* @param host host to base the notify on (gets cloned)
* @param base base of the endpoint, applies only to reflexive endpoints (gets cloned)
@@ -163,7 +163,7 @@ endpoint_notify_t *endpoint_notify_create_from_host(me_endpoint_type_t type,
/**
* Creates an endpoint_notify_t object from a notify payload.
- *
+ *
* @param notify the notify payload
* @return - created endpoint_notify_t object
* - NULL if invalid payload
diff --git a/src/charon/encoding/payloads/id_payload.c b/src/charon/encoding/payloads/id_payload.c
index 4a527cb24..4158c3e07 100644
--- a/src/charon/encoding/payloads/id_payload.c
+++ b/src/charon/encoding/payloads/id_payload.c
@@ -27,19 +27,19 @@ typedef struct private_id_payload_t private_id_payload_t;
/**
* Private data of an id_payload_t object.
- *
+ *
*/
struct private_id_payload_t {
/**
* Public id_payload_t interface.
*/
id_payload_t public;
-
+
/**
* one of ID_INITIATOR, ID_RESPONDER
*/
payload_type_t payload_type;
-
+
/**
* Next payload type.
*/
@@ -49,17 +49,17 @@ struct private_id_payload_t {
* Critical flag.
*/
bool critical;
-
+
/**
* Length of this payload.
*/
u_int16_t payload_length;
-
+
/**
* Type of the ID Data.
*/
u_int8_t id_type;
-
+
/**
* The contained id data value.
*/
@@ -68,17 +68,17 @@ struct private_id_payload_t {
/**
* Encoding rules to parse or generate a ID payload
- *
- * The defined offsets are the positions in a object of type
+ *
+ * The defined offsets are the positions in a object of type
* private_id_payload_t.
- *
+ *
*/
encoding_rule_t id_payload_encodings[] = {
- /* 1 Byte next payload type, stored in the field next_payload */
+ /* 1 Byte next payload type, stored in the field next_payload */
{ U_INT_8, offsetof(private_id_payload_t, next_payload) },
/* the critical bit */
{ FLAG, offsetof(private_id_payload_t, critical) },
- /* 7 Bit reserved bits, nowhere stored */
+ /* 7 Bit reserved bits, nowhere stored */
{ RESERVED_BIT, 0 },
{ RESERVED_BIT, 0 },
{ RESERVED_BIT, 0 },
@@ -88,8 +88,8 @@ encoding_rule_t id_payload_encodings[] = {
{ RESERVED_BIT, 0 },
/* Length of the whole payload*/
{ PAYLOAD_LENGTH, offsetof(private_id_payload_t, payload_length) },
- /* 1 Byte ID type*/
- { U_INT_8, offsetof(private_id_payload_t, id_type) },
+ /* 1 Byte ID type*/
+ { U_INT_8, offsetof(private_id_payload_t, id_type) },
/* 3 reserved bytes */
{ RESERVED_BYTE, 0 },
{ RESERVED_BYTE, 0 },
@@ -126,7 +126,7 @@ static status_t verify(private_id_payload_t *this)
DBG1(DBG_ENC, "received ID with reserved type %d", this->id_type);
return FAILED;
}
-
+
return SUCCESS;
}
@@ -242,7 +242,7 @@ static void destroy(private_id_payload_t *this)
{
chunk_free(&(this->id_data));
}
- free(this);
+ free(this);
}
/*
@@ -260,7 +260,7 @@ id_payload_t *id_payload_create(payload_type_t payload_type)
this->public.payload_interface.set_next_type = (void (*) (payload_t *,payload_type_t)) set_next_type;
this->public.payload_interface.get_type = (payload_type_t (*) (payload_t *)) get_payload_type;
this->public.payload_interface.destroy = (void (*) (payload_t *))destroy;
-
+
/* public functions */
this->public.destroy = (void (*) (id_payload_t *)) destroy;
this->public.set_id_type = (void (*) (id_payload_t *,id_type_t)) set_id_type;
@@ -268,7 +268,7 @@ id_payload_t *id_payload_create(payload_type_t payload_type)
this->public.set_data = (void (*) (id_payload_t *,chunk_t)) set_data;
this->public.get_data = (chunk_t (*) (id_payload_t *)) get_data;
this->public.get_data_clone = (chunk_t (*) (id_payload_t *)) get_data_clone;
-
+
this->public.get_identification = (identification_t * (*) (id_payload_t *this)) get_identification;
/* private variables */
diff --git a/src/charon/encoding/payloads/id_payload.h b/src/charon/encoding/payloads/id_payload.h
index 555b1324b..5502dc961 100644
--- a/src/charon/encoding/payloads/id_payload.h
+++ b/src/charon/encoding/payloads/id_payload.h
@@ -51,35 +51,35 @@ struct id_payload_t {
* @param type Type of ID
*/
void (*set_id_type) (id_payload_t *this, id_type_t type);
-
+
/**
* Get the ID type.
*
- * @return type of the ID
+ * @return type of the ID
*/
id_type_t (*get_id_type) (id_payload_t *this);
-
+
/**
* Set the ID data.
- *
+ *
* Data are getting cloned.
*
* @param data ID data as chunk_t
*/
void (*set_data) (id_payload_t *this, chunk_t data);
-
+
/**
* Get the ID data.
- *
+ *
* Returned data are a copy of the internal one
*
* @return ID data as chunk_t
*/
chunk_t (*get_data_clone) (id_payload_t *this);
-
+
/**
* Get the ID data.
- *
+ *
* Returned data are NOT copied.
*
* @return ID data as chunk_t
@@ -88,13 +88,13 @@ struct id_payload_t {
/**
* Creates an identification object of this id payload.
- *
+ *
* Returned object has to get destroyed by the caller.
*
- * @return identification_t object
+ * @return identification_t object
*/
identification_t *(*get_identification) (id_payload_t *this);
-
+
/**
* Destroys an id_payload_t object.
*/
@@ -103,7 +103,7 @@ struct id_payload_t {
/**
* Creates an empty id_payload_t object.
- *
+ *
* @param payload_type one of ID_INITIATOR, ID_RESPONDER
* @return id_payload_t object
*/
@@ -111,7 +111,7 @@ id_payload_t *id_payload_create(payload_type_t payload_type);
/**
* Creates an id_payload_t from an existing identification_t object.
- *
+ *
* @param payload_type one of ID_INITIATOR, ID_RESPONDER
* @param identification identification_t object
* @return id_payload_t object
diff --git a/src/charon/encoding/payloads/ike_header.c b/src/charon/encoding/payloads/ike_header.c
index d27bfb82c..735f01304 100644
--- a/src/charon/encoding/payloads/ike_header.c
+++ b/src/charon/encoding/payloads/ike_header.c
@@ -27,14 +27,13 @@ typedef struct private_ike_header_t private_ike_header_t;
/**
* Private data of an ike_header_t object.
- *
*/
struct private_ike_header_t {
/**
* Public interface.
*/
ike_header_t public;
-
+
/**
* SPI of the initiator.
*/
@@ -56,19 +55,18 @@ struct private_ike_header_t {
/**
* IKE minor version.
- */
+ */
u_int8_t min_version;
/**
* Exchange type .
- */
+ */
u_int8_t exchange_type;
-
+
/**
* Flags of the Message.
- *
*/
- struct {
+ struct {
/**
* Sender is initiator of the associated IKE_SA_INIT-Exchange.
*/
@@ -89,11 +87,11 @@ struct private_ike_header_t {
* Associated Message-ID.
*/
u_int32_t message_id;
-
+
/**
* Length of the whole IKEv2-Message (header and all payloads).
*/
- u_int32_t length;
+ u_int32_t length;
};
ENUM_BEGIN(exchange_type_names, EXCHANGE_TYPE_UNDEFINED, EXCHANGE_TYPE_UNDEFINED,
@@ -113,38 +111,37 @@ ENUM_END(exchange_type_names, INFORMATIONAL);
/**
* Encoding rules to parse or generate a IKEv2-Header.
- *
- * The defined offsets are the positions in a object of type
+ *
+ * The defined offsets are the positions in a object of type
* ike_header_t.
- *
*/
encoding_rule_t ike_header_encodings[] = {
- /* 8 Byte SPI, stored in the field initiator_spi */
+ /* 8 Byte SPI, stored in the field initiator_spi */
{ IKE_SPI, offsetof(private_ike_header_t, initiator_spi) },
- /* 8 Byte SPI, stored in the field responder_spi */
+ /* 8 Byte SPI, stored in the field responder_spi */
{ IKE_SPI, offsetof(private_ike_header_t, responder_spi) },
- /* 1 Byte next payload type, stored in the field next_payload */
+ /* 1 Byte next payload type, stored in the field next_payload */
{ U_INT_8, offsetof(private_ike_header_t, next_payload) },
- /* 4 Bit major version, stored in the field maj_version */
+ /* 4 Bit major version, stored in the field maj_version */
{ U_INT_4, offsetof(private_ike_header_t, maj_version) },
- /* 4 Bit minor version, stored in the field min_version */
+ /* 4 Bit minor version, stored in the field min_version */
{ U_INT_4, offsetof(private_ike_header_t, min_version) },
/* 8 Bit for the exchange type */
{ U_INT_8, offsetof(private_ike_header_t, exchange_type) },
- /* 2 Bit reserved bits, nowhere stored */
- { RESERVED_BIT, 0 },
- { RESERVED_BIT, 0 },
- /* 3 Bit flags, stored in the fields response, version and initiator */
- { FLAG, offsetof(private_ike_header_t, flags.response) },
+ /* 2 Bit reserved bits, nowhere stored */
+ { RESERVED_BIT, 0 },
+ { RESERVED_BIT, 0 },
+ /* 3 Bit flags, stored in the fields response, version and initiator */
+ { FLAG, offsetof(private_ike_header_t, flags.response) },
{ FLAG, offsetof(private_ike_header_t, flags.version) },
{ FLAG, offsetof(private_ike_header_t, flags.initiator) },
- /* 3 Bit reserved bits, nowhere stored */
+ /* 3 Bit reserved bits, nowhere stored */
{ RESERVED_BIT, 0 },
{ RESERVED_BIT, 0 },
{ RESERVED_BIT, 0 },
- /* 4 Byte message id, stored in the field message_id */
+ /* 4 Byte message id, stored in the field message_id */
{ U_INT_32, offsetof(private_ike_header_t, message_id) },
- /* 4 Byte length fied, stored in the field length */
+ /* 4 Byte length fied, stored in the field length */
{ HEADER_LENGTH, offsetof(private_ike_header_t, length) }
};
@@ -194,9 +191,9 @@ static status_t verify(private_ike_header_t *this)
/* initiator spi not set */
return FAILED;
}
-
+
/* verification of version is not done in here */
-
+
return SUCCESS;
}
@@ -212,7 +209,7 @@ static void set_next_type(payload_t *this,payload_type_t type)
*/
static u_int64_t get_initiator_spi(private_ike_header_t *this)
{
- return this->initiator_spi;
+ return this->initiator_spi;
}
/**
@@ -228,7 +225,7 @@ static void set_initiator_spi(private_ike_header_t *this, u_int64_t initiator_sp
*/
static u_int64_t get_responder_spi(private_ike_header_t *this)
{
- return this->responder_spi;
+ return this->responder_spi;
}
/**
@@ -244,7 +241,7 @@ static void set_responder_spi(private_ike_header_t *this, u_int64_t responder_sp
*/
static u_int8_t get_maj_version(private_ike_header_t *this)
{
- return this->maj_version;
+ return this->maj_version;
}
/**
@@ -252,7 +249,7 @@ static u_int8_t get_maj_version(private_ike_header_t *this)
*/
static u_int8_t get_min_version(private_ike_header_t *this)
{
- return this->min_version;
+ return this->min_version;
}
/**
@@ -260,7 +257,7 @@ static u_int8_t get_min_version(private_ike_header_t *this)
*/
static bool get_response_flag(private_ike_header_t *this)
{
- return this->flags.response;
+ return this->flags.response;
}
/**
@@ -268,7 +265,7 @@ static bool get_response_flag(private_ike_header_t *this)
*/
static void set_response_flag(private_ike_header_t *this, bool response)
{
- this->flags.response = response;
+ this->flags.response = response;
}
/**
@@ -276,7 +273,7 @@ static void set_response_flag(private_ike_header_t *this, bool response)
*/
static bool get_version_flag(private_ike_header_t *this)
{
- return this->flags.version;
+ return this->flags.version;
}
/**
@@ -284,7 +281,7 @@ static bool get_version_flag(private_ike_header_t *this)
*/
static bool get_initiator_flag(private_ike_header_t *this)
{
- return this->flags.initiator;
+ return this->flags.initiator;
}
/**
@@ -292,7 +289,7 @@ static bool get_initiator_flag(private_ike_header_t *this)
*/
static void set_initiator_flag(private_ike_header_t *this, bool initiator)
{
- this->flags.initiator = initiator;
+ this->flags.initiator = initiator;
}
/**
@@ -300,7 +297,7 @@ static void set_initiator_flag(private_ike_header_t *this, bool initiator)
*/
static u_int8_t get_exchange_type(private_ike_header_t *this)
{
- return this->exchange_type;
+ return this->exchange_type;
}
/**
@@ -308,7 +305,7 @@ static u_int8_t get_exchange_type(private_ike_header_t *this)
*/
static void set_exchange_type(private_ike_header_t *this, u_int8_t exchange_type)
{
- this->exchange_type = exchange_type;
+ this->exchange_type = exchange_type;
}
/**
@@ -317,7 +314,7 @@ static void set_exchange_type(private_ike_header_t *this, u_int8_t exchange_type
*/
static u_int32_t get_message_id(private_ike_header_t *this)
{
- return this->message_id;
+ return this->message_id;
}
/**
@@ -375,7 +372,7 @@ static size_t get_length(payload_t *this)
ike_header_t *ike_header_create()
{
private_ike_header_t *this = malloc_thing(private_ike_header_t);
-
+
this->public.payload_interface.verify = (status_t (*) (payload_t *))verify;
this->public.payload_interface.get_encoding_rules = get_encoding_rules;
this->public.payload_interface.get_length = get_length;
@@ -384,7 +381,7 @@ ike_header_t *ike_header_create()
this->public.payload_interface.get_type = get_type;
this->public.payload_interface.destroy = (void (*) (payload_t *))destroy;
this->public.destroy = destroy;
-
+
this->public.get_initiator_spi = (u_int64_t (*) (ike_header_t*))get_initiator_spi;
this->public.set_initiator_spi = (void (*) (ike_header_t*,u_int64_t))set_initiator_spi;
this->public.get_responder_spi = (u_int64_t (*) (ike_header_t*))get_responder_spi;
@@ -400,7 +397,7 @@ ike_header_t *ike_header_create()
this->public.set_exchange_type = (void (*) (ike_header_t*,u_int8_t))set_exchange_type;
this->public.get_message_id = (u_int32_t (*) (ike_header_t*))get_message_id;
this->public.set_message_id = (void (*) (ike_header_t*,u_int32_t))set_message_id;
-
+
/* set default values of the fields */
this->initiator_spi = 0;
this->responder_spi = 0;
@@ -413,6 +410,6 @@ ike_header_t *ike_header_create()
this->flags.response = FALSE;
this->message_id = 0;
this->length = IKE_HEADER_LENGTH;
-
+
return (ike_header_t*)this;
}
diff --git a/src/charon/encoding/payloads/ike_header.h b/src/charon/encoding/payloads/ike_header.h
index 8de316d19..e63e8bf06 100644
--- a/src/charon/encoding/payloads/ike_header.h
+++ b/src/charon/encoding/payloads/ike_header.h
@@ -60,7 +60,7 @@ enum exchange_type_t{
* EXCHANGE_TYPE_UNDEFINED. In private space, since not a official message type.
*/
EXCHANGE_TYPE_UNDEFINED = 255,
-
+
/**
* IKE_SA_INIT.
*/
@@ -94,11 +94,11 @@ enum exchange_type_t{
extern enum_name_t *exchange_type_names;
/**
- * An object of this type represents an IKEv2 header and is used to
+ * An object of this type represents an IKEv2 header and is used to
* generate and parse IKEv2 headers.
- *
- * The header format of an IKEv2-Message is compatible to the
- * ISAKMP-Header format to allow implementations supporting
+ *
+ * The header format of an IKEv2-Message is compatible to the
+ * ISAKMP-Header format to allow implementations supporting
* both versions of the IKE-protocol.
*/
struct ike_header_t {
@@ -106,61 +106,60 @@ struct ike_header_t {
* The payload_t interface.
*/
payload_t payload_interface;
-
+
/**
* Get the initiator spi.
*
* @return initiator_spi
*/
u_int64_t (*get_initiator_spi) (ike_header_t *this);
-
+
/**
* Set the initiator spi.
*
* @param initiator_spi initiator_spi
*/
void (*set_initiator_spi) (ike_header_t *this, u_int64_t initiator_spi);
-
+
/**
* Get the responder spi.
*
* @return responder_spi
*/
u_int64_t (*get_responder_spi) (ike_header_t *this);
-
+
/**
* Set the responder spi.
*
* @param responder_spi responder_spi
*/
void (*set_responder_spi) (ike_header_t *this, u_int64_t responder_spi);
-
+
/**
* Get the major version.
*
* @return major version
*/
u_int8_t (*get_maj_version) (ike_header_t *this);
-
+
/**
* Get the minor version.
*
* @return minor version
*/
u_int8_t (*get_min_version) (ike_header_t *this);
-
+
/**
* Get the response flag.
*
* @return response flag
*/
bool (*get_response_flag) (ike_header_t *this);
-
+
/**
* Set the response flag-
*
* @param response response flag
- *
*/
void (*set_response_flag) (ike_header_t *this, bool response);
/**
@@ -169,14 +168,14 @@ struct ike_header_t {
* @return version flag
*/
bool (*get_version_flag) (ike_header_t *this);
-
+
/**
* Get the initiator flag.
*
* @return initiator flag
*/
bool (*get_initiator_flag) (ike_header_t *this);
-
+
/**
* Set the initiator flag.
*
@@ -190,28 +189,28 @@ struct ike_header_t {
* @return exchange type
*/
u_int8_t (*get_exchange_type) (ike_header_t *this);
-
+
/**
* Set the exchange type.
*
* @param exchange_type exchange type
*/
void (*set_exchange_type) (ike_header_t *this, u_int8_t exchange_type);
-
+
/**
* Get the message id.
*
* @return message id
*/
u_int32_t (*get_message_id) (ike_header_t *this);
-
+
/**
* Set the message id.
*
* @param initiator_spi message id
*/
void (*set_message_id) (ike_header_t *this, u_int32_t message_id);
-
+
/**
* Destroys a ike_header_t object.
*/
@@ -220,7 +219,7 @@ struct ike_header_t {
/**
* Create an ike_header_t object
- *
+ *
* @return ike_header_t object
*/
ike_header_t *ike_header_create(void);
diff --git a/src/charon/encoding/payloads/ke_payload.c b/src/charon/encoding/payloads/ke_payload.c
index aa3e075ca..1bc79f084 100644
--- a/src/charon/encoding/payloads/ke_payload.c
+++ b/src/charon/encoding/payloads/ke_payload.c
@@ -25,14 +25,14 @@ typedef struct private_ke_payload_t private_ke_payload_t;
/**
* Private data of an ke_payload_t object.
- *
+ *
*/
struct private_ke_payload_t {
/**
* Public ke_payload_t interface.
*/
ke_payload_t public;
-
+
/**
* Next payload type.
*/
@@ -42,17 +42,17 @@ struct private_ke_payload_t {
* Critical flag.
*/
bool critical;
-
+
/**
* Length of this payload.
*/
u_int16_t payload_length;
-
+
/**
* DH Group Number.
*/
u_int16_t dh_group_number;
-
+
/**
* Key Exchange Data of this KE payload.
*/
@@ -61,30 +61,30 @@ struct private_ke_payload_t {
/**
* Encoding rules to parse or generate a IKEv2-KE Payload.
- *
- * The defined offsets are the positions in a object of type
+ *
+ * The defined offsets are the positions in a object of type
* private_ke_payload_t.
- *
+ *
*/
encoding_rule_t ke_payload_encodings[] = {
- /* 1 Byte next payload type, stored in the field next_payload */
+ /* 1 Byte next payload type, stored in the field next_payload */
{ U_INT_8, offsetof(private_ke_payload_t, next_payload) },
/* the critical bit */
- { FLAG, offsetof(private_ke_payload_t, critical) },
- /* 7 Bit reserved bits, nowhere stored */
- { RESERVED_BIT, 0 },
- { RESERVED_BIT, 0 },
- { RESERVED_BIT, 0 },
- { RESERVED_BIT, 0 },
- { RESERVED_BIT, 0 },
- { RESERVED_BIT, 0 },
- { RESERVED_BIT, 0 },
+ { FLAG, offsetof(private_ke_payload_t, critical) },
+ /* 7 Bit reserved bits, nowhere stored */
+ { RESERVED_BIT, 0 },
+ { RESERVED_BIT, 0 },
+ { RESERVED_BIT, 0 },
+ { RESERVED_BIT, 0 },
+ { RESERVED_BIT, 0 },
+ { RESERVED_BIT, 0 },
+ { RESERVED_BIT, 0 },
/* Length of the whole payload*/
- { PAYLOAD_LENGTH, offsetof(private_ke_payload_t, payload_length) },
+ { PAYLOAD_LENGTH, offsetof(private_ke_payload_t, payload_length) },
/* DH Group number as 16 bit field*/
{ U_INT_16, offsetof(private_ke_payload_t, dh_group_number) },
- { RESERVED_BYTE, 0 },
- { RESERVED_BYTE, 0 },
+ { RESERVED_BYTE, 0 },
+ { RESERVED_BYTE, 0 },
/* Key Exchange Data is from variable size */
{ KEY_EXCHANGE_DATA, offsetof(private_ke_payload_t, key_exchange_data)}
};
@@ -166,7 +166,7 @@ static void compute_length(private_ke_payload_t *this)
if (this->key_exchange_data.ptr != NULL)
{
length += this->key_exchange_data.len;
- }
+ }
this->payload_length = length;
}
@@ -199,9 +199,9 @@ static void set_key_exchange_data(private_ke_payload_t *this, chunk_t key_exchan
free(this->key_exchange_data.ptr);
this->key_exchange_data.ptr = NULL;
this->key_exchange_data.len = 0;
-
+
}
-
+
this->key_exchange_data = chunk_clone(key_exchange_data);
compute_length(this);
}
@@ -244,7 +244,7 @@ ke_payload_t *ke_payload_create()
this->public.get_dh_group_number = (diffie_hellman_group_t (*) (ke_payload_t *)) get_dh_group_number;
this->public.set_dh_group_number =(void (*) (ke_payload_t *,diffie_hellman_group_t)) set_dh_group_number;
this->public.destroy = (void (*) (ke_payload_t *)) destroy;
-
+
/* set default values of the fields */
this->critical = FALSE;
this->next_payload = NO_PAYLOAD;
@@ -261,10 +261,10 @@ ke_payload_t *ke_payload_create()
ke_payload_t *ke_payload_create_from_diffie_hellman(diffie_hellman_t *dh)
{
private_ke_payload_t *this = (private_ke_payload_t*)ke_payload_create();
-
+
dh->get_my_public_value(dh, &this->key_exchange_data);
this->dh_group_number = dh->get_dh_group(dh);
compute_length(this);
-
+
return &this->public;
}
diff --git a/src/charon/encoding/payloads/ke_payload.h b/src/charon/encoding/payloads/ke_payload.h
index 7e182d970..3ca05009e 100644
--- a/src/charon/encoding/payloads/ke_payload.h
+++ b/src/charon/encoding/payloads/ke_payload.h
@@ -45,38 +45,38 @@ struct ke_payload_t {
* The payload_t interface.
*/
payload_t payload_interface;
-
+
/**
* Returns the currently set key exchange data of this KE payload.
- *
+ *
* @warning Returned data are not copied.
- *
+ *
* @return chunk_t pointing to the value
*/
chunk_t (*get_key_exchange_data) (ke_payload_t *this);
-
+
/**
* Sets the key exchange data of this KE payload.
- *
+ *
* Value is getting copied.
- *
+ *
* @param key_exchange_data chunk_t pointing to the value to set
*/
void (*set_key_exchange_data) (ke_payload_t *this, chunk_t key_exchange_data);
/**
* Gets the Diffie-Hellman Group Number of this KE payload.
- *
+ *
* @return DH Group Number of this payload
*/
diffie_hellman_group_t (*get_dh_group_number) (ke_payload_t *this);
/**
* Sets the Diffie-Hellman Group Number of this KE payload.
- *
+ *
* @param dh_group_number DH Group to set
*/
- void (*set_dh_group_number) (ke_payload_t *this,
+ void (*set_dh_group_number) (ke_payload_t *this,
diffie_hellman_group_t dh_group_number);
/**
@@ -87,14 +87,14 @@ struct ke_payload_t {
/**
* Creates an empty ke_payload_t object
- *
+ *
* @return ke_payload_t object
*/
ke_payload_t *ke_payload_create(void);
/**
* Creates a ke_payload_t from a diffie_hellman_t
- *
+ *
* @param diffie_hellman diffie hellman object containing group and key
* @return ke_payload_t object
*/
diff --git a/src/charon/encoding/payloads/nonce_payload.c b/src/charon/encoding/payloads/nonce_payload.c
index f9e075380..4ad5ce9dd 100644
--- a/src/charon/encoding/payloads/nonce_payload.c
+++ b/src/charon/encoding/payloads/nonce_payload.c
@@ -13,7 +13,7 @@
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
-
+
/* offsetof macro */
#include <stddef.h>
@@ -26,14 +26,14 @@ typedef struct private_nonce_payload_t private_nonce_payload_t;
/**
* Private data of an nonce_payload_t object.
- *
+ *
*/
struct private_nonce_payload_t {
/**
* Public nonce_payload_t interface.
*/
nonce_payload_t public;
-
+
/**
* Next payload type.
*/
@@ -43,12 +43,12 @@ struct private_nonce_payload_t {
* Critical flag.
*/
bool critical;
-
+
/**
* Length of this payload.
*/
u_int16_t payload_length;
-
+
/**
* The contained nonce value.
*/
@@ -57,26 +57,26 @@ struct private_nonce_payload_t {
/**
* Encoding rules to parse or generate a nonce payload
- *
- * The defined offsets are the positions in a object of type
+ *
+ * The defined offsets are the positions in a object of type
* private_nonce_payload_t.
- *
+ *
*/
encoding_rule_t nonce_payload_encodings[] = {
- /* 1 Byte next payload type, stored in the field next_payload */
+ /* 1 Byte next payload type, stored in the field next_payload */
{ U_INT_8, offsetof(private_nonce_payload_t, next_payload) },
/* the critical bit */
- { FLAG, offsetof(private_nonce_payload_t, critical) },
- /* 7 Bit reserved bits, nowhere stored */
- { RESERVED_BIT, 0 },
- { RESERVED_BIT, 0 },
- { RESERVED_BIT, 0 },
- { RESERVED_BIT, 0 },
- { RESERVED_BIT, 0 },
- { RESERVED_BIT, 0 },
- { RESERVED_BIT, 0 },
+ { FLAG, offsetof(private_nonce_payload_t, critical) },
+ /* 7 Bit reserved bits, nowhere stored */
+ { RESERVED_BIT, 0 },
+ { RESERVED_BIT, 0 },
+ { RESERVED_BIT, 0 },
+ { RESERVED_BIT, 0 },
+ { RESERVED_BIT, 0 },
+ { RESERVED_BIT, 0 },
+ { RESERVED_BIT, 0 },
/* Length of the whole nonce payload*/
- { PAYLOAD_LENGTH, offsetof(private_nonce_payload_t, payload_length) },
+ { PAYLOAD_LENGTH, offsetof(private_nonce_payload_t, payload_length) },
/* some nonce bytes, lenth is defined in PAYLOAD_LENGTH */
{ NONCE_DATA, offsetof(private_nonce_payload_t, nonce) }
};
@@ -102,7 +102,7 @@ static status_t verify(private_nonce_payload_t *this)
/* nonce length is wrong */
return FAILED;
}
-
+
return SUCCESS;
}
@@ -187,8 +187,8 @@ static void destroy(private_nonce_payload_t *this)
{
free(this->nonce.ptr);
}
-
- free(this);
+
+ free(this);
}
/*
@@ -206,12 +206,12 @@ nonce_payload_t *nonce_payload_create()
this->public.payload_interface.set_next_type = (void (*) (payload_t *,payload_type_t)) set_next_type;
this->public.payload_interface.get_type = (payload_type_t (*) (payload_t *)) get_type;
this->public.payload_interface.destroy = (void (*) (payload_t *))destroy;
-
+
/* public functions */
this->public.destroy = (void (*) (nonce_payload_t *)) destroy;
this->public.set_nonce = (void (*) (nonce_payload_t *,chunk_t)) set_nonce;
this->public.get_nonce = (chunk_t (*) (nonce_payload_t *)) get_nonce;
-
+
/* private variables */
this->critical = FALSE;
this->next_payload = NO_PAYLOAD;
diff --git a/src/charon/encoding/payloads/nonce_payload.h b/src/charon/encoding/payloads/nonce_payload.h
index 4adaba481..e9212202e 100644
--- a/src/charon/encoding/payloads/nonce_payload.h
+++ b/src/charon/encoding/payloads/nonce_payload.h
@@ -39,7 +39,7 @@ typedef struct nonce_payload_t nonce_payload_t;
/**
* Object representing an IKEv2 Nonce payload.
- *
+ *
* The Nonce payload format is described in RFC section 3.3.
*/
struct nonce_payload_t {
@@ -51,17 +51,17 @@ struct nonce_payload_t {
/**
* Set the nonce value.
*
- * @param nonce chunk containing the nonce, will be cloned
+ * @param nonce chunk containing the nonce, will be cloned
*/
void (*set_nonce) (nonce_payload_t *this, chunk_t nonce);
-
+
/**
* Get the nonce value.
*
* @return a chunk containing the cloned nonce
*/
chunk_t (*get_nonce) (nonce_payload_t *this);
-
+
/**
* Destroys an nonce_payload_t object.
*/
@@ -70,7 +70,7 @@ struct nonce_payload_t {
/**
* Creates an empty nonce_payload_t object
- *
+ *
* @return nonce_payload_t object
*/
nonce_payload_t *nonce_payload_create(void);
diff --git a/src/charon/encoding/payloads/notify_payload.c b/src/charon/encoding/payloads/notify_payload.c
index d2a995ace..469698ef5 100644
--- a/src/charon/encoding/payloads/notify_payload.c
+++ b/src/charon/encoding/payloads/notify_payload.c
@@ -41,7 +41,7 @@ ENUM_NEXT(notify_type_names, INVALID_KE_PAYLOAD, INVALID_KE_PAYLOAD, NO_PROPOSAL
"INVALID_KE_PAYLOAD");
ENUM_NEXT(notify_type_names, AUTHENTICATION_FAILED, AUTHENTICATION_FAILED, INVALID_KE_PAYLOAD,
"AUTHENTICATION_FAILED");
-ENUM_NEXT(notify_type_names, SINGLE_PAIR_REQUIRED, UNEXPECTED_NAT_DETECTED, AUTHENTICATION_FAILED,
+ENUM_NEXT(notify_type_names, SINGLE_PAIR_REQUIRED, USE_ASSIGNED_HoA, AUTHENTICATION_FAILED,
"SINGLE_PAIR_REQUIRED",
"NO_ADDITIONAL_SAS",
"INTERNAL_ADDRESS_FAILURE",
@@ -49,10 +49,11 @@ ENUM_NEXT(notify_type_names, SINGLE_PAIR_REQUIRED, UNEXPECTED_NAT_DETECTED, AUTH
"TS_UNACCEPTABLE",
"INVALID_SELECTORS",
"UNACCEPTABLE_ADDRESSES",
- "UNEXPECTED_NAT_DETECTED");
-ENUM_NEXT(notify_type_names, ME_CONNECT_FAILED, ME_CONNECT_FAILED, UNEXPECTED_NAT_DETECTED,
+ "UNEXPECTED_NAT_DETECTED",
+ "USE_ASSIGNED_HoA");
+ENUM_NEXT(notify_type_names, ME_CONNECT_FAILED, ME_CONNECT_FAILED, USE_ASSIGNED_HoA,
"ME_CONNECT_FAILED");
-ENUM_NEXT(notify_type_names, INITIAL_CONTACT, ANOTHER_AUTH_FOLLOWS, ME_CONNECT_FAILED,
+ENUM_NEXT(notify_type_names, INITIAL_CONTACT, LINK_ID, ME_CONNECT_FAILED,
"INITIAL_CONTACT",
"SET_WINDOW_SIZE",
"ADDITIONAL_TS_POSSIBLE",
@@ -74,8 +75,17 @@ ENUM_NEXT(notify_type_names, INITIAL_CONTACT, ANOTHER_AUTH_FOLLOWS, ME_CONNECT_F
"NO_NATS_ALLOWED",
"AUTH_LIFETIME",
"MULTIPLE_AUTH_SUPPORTED",
- "ANOTHER_AUTH_FOLLOWS");
-ENUM_NEXT(notify_type_names, EAP_ONLY_AUTHENTICATION, EAP_ONLY_AUTHENTICATION, ANOTHER_AUTH_FOLLOWS,
+ "ANOTHER_AUTH_FOLLOWS",
+ "REDIRECT_SUPPORTED",
+ "REDIRECT",
+ "REDIRECTED_FROM",
+ "TICKET_LT_OPAQUE",
+ "TICKET_REQUEST",
+ "TICKET_ACK",
+ "TICKET_NACK",
+ "TICKET_OPAQUE",
+ "LINK_ID");
+ENUM_NEXT(notify_type_names, EAP_ONLY_AUTHENTICATION, EAP_ONLY_AUTHENTICATION, LINK_ID,
"EAP_ONLY_AUTHENTICATION");
ENUM_NEXT(notify_type_names, USE_BEET_MODE, USE_BEET_MODE, EAP_ONLY_AUTHENTICATION,
"USE_BEET_MODE");
@@ -107,7 +117,7 @@ ENUM_NEXT(notify_type_short_names, INVALID_KE_PAYLOAD, INVALID_KE_PAYLOAD, NO_PR
"INVAL_KE");
ENUM_NEXT(notify_type_short_names, AUTHENTICATION_FAILED, AUTHENTICATION_FAILED, INVALID_KE_PAYLOAD,
"AUTH_FAILED");
-ENUM_NEXT(notify_type_short_names, SINGLE_PAIR_REQUIRED, UNEXPECTED_NAT_DETECTED, AUTHENTICATION_FAILED,
+ENUM_NEXT(notify_type_short_names, SINGLE_PAIR_REQUIRED, USE_ASSIGNED_HoA, AUTHENTICATION_FAILED,
"SINGLE_PAIR",
"NO_ADD_SAS",
"INT_ADDR_FAIL",
@@ -115,10 +125,11 @@ ENUM_NEXT(notify_type_short_names, SINGLE_PAIR_REQUIRED, UNEXPECTED_NAT_DETECTED
"TS_UNACCEPT",
"INVAL_SEL",
"UNACCEPT_ADDR",
- "UNEXPECT_NAT");
-ENUM_NEXT(notify_type_short_names, ME_CONNECT_FAILED, ME_CONNECT_FAILED, UNEXPECTED_NAT_DETECTED,
+ "UNEXPECT_NAT",
+ "ASSIGNED_HoA");
+ENUM_NEXT(notify_type_short_names, ME_CONNECT_FAILED, ME_CONNECT_FAILED, USE_ASSIGNED_HoA,
"ME_CONN_FAIL");
-ENUM_NEXT(notify_type_short_names, INITIAL_CONTACT, ANOTHER_AUTH_FOLLOWS, ME_CONNECT_FAILED,
+ENUM_NEXT(notify_type_short_names, INITIAL_CONTACT, LINK_ID, ME_CONNECT_FAILED,
"INIT_CONTACT",
"SET_WINSIZE",
"ADD_TS_POSS",
@@ -140,8 +151,17 @@ ENUM_NEXT(notify_type_short_names, INITIAL_CONTACT, ANOTHER_AUTH_FOLLOWS, ME_CON
"NO_NATS",
"AUTH_LFT",
"MULT_AUTH",
- "AUTH_FOLLOWS");
-ENUM_NEXT(notify_type_short_names, EAP_ONLY_AUTHENTICATION, EAP_ONLY_AUTHENTICATION, ANOTHER_AUTH_FOLLOWS,
+ "AUTH_FOLLOWS",
+ "REDIR_SUP",
+ "REDIR",
+ "REDIR_FROM",
+ "TKT_LT_OPAK",
+ "TKT_REQ",
+ "TKT_ACK",
+ "TKT_NACK",
+ "TKT_OPAK",
+ "LINK_ID");
+ENUM_NEXT(notify_type_short_names, EAP_ONLY_AUTHENTICATION, EAP_ONLY_AUTHENTICATION, LINK_ID,
"EAP_ONLY");
ENUM_NEXT(notify_type_short_names, USE_BEET_MODE, USE_BEET_MODE, EAP_ONLY_AUTHENTICATION,
"BEET_MODE");
@@ -160,14 +180,14 @@ typedef struct private_notify_payload_t private_notify_payload_t;
/**
* Private data of an notify_payload_t object.
- *
+ *
*/
struct private_notify_payload_t {
/**
* Public notify_payload_t interface.
*/
notify_payload_t public;
-
+
/**
* Next payload type.
*/
@@ -177,27 +197,27 @@ struct private_notify_payload_t {
* Critical flag.
*/
bool critical;
-
+
/**
* Length of this payload.
*/
u_int16_t payload_length;
-
+
/**
* Protocol id.
*/
u_int8_t protocol_id;
-
+
/**
* Spi size.
*/
u_int8_t spi_size;
-
+
/**
* Notify message type.
*/
u_int16_t notify_type;
-
+
/**
* Security parameter index (spi).
*/
@@ -211,26 +231,26 @@ struct private_notify_payload_t {
/**
* Encoding rules to parse or generate a IKEv2-Notify Payload.
- *
- * The defined offsets are the positions in a object of type
+ *
+ * The defined offsets are the positions in a object of type
* private_notify_payload_t.
- *
+ *
*/
encoding_rule_t notify_payload_encodings[] = {
- /* 1 Byte next payload type, stored in the field next_payload */
+ /* 1 Byte next payload type, stored in the field next_payload */
{ U_INT_8, offsetof(private_notify_payload_t, next_payload) },
/* the critical bit */
- { FLAG, offsetof(private_notify_payload_t, critical) },
- /* 7 Bit reserved bits, nowhere stored */
- { RESERVED_BIT, 0 },
- { RESERVED_BIT, 0 },
- { RESERVED_BIT, 0 },
- { RESERVED_BIT, 0 },
- { RESERVED_BIT, 0 },
- { RESERVED_BIT, 0 },
- { RESERVED_BIT, 0 },
+ { FLAG, offsetof(private_notify_payload_t, critical) },
+ /* 7 Bit reserved bits, nowhere stored */
+ { RESERVED_BIT, 0 },
+ { RESERVED_BIT, 0 },
+ { RESERVED_BIT, 0 },
+ { RESERVED_BIT, 0 },
+ { RESERVED_BIT, 0 },
+ { RESERVED_BIT, 0 },
+ { RESERVED_BIT, 0 },
/* Length of the whole payload*/
- { PAYLOAD_LENGTH, offsetof(private_notify_payload_t, payload_length) },
+ { PAYLOAD_LENGTH, offsetof(private_notify_payload_t, payload_length) },
/* Protocol ID as 8 bit field*/
{ U_INT_8, offsetof(private_notify_payload_t, protocol_id) },
/* SPI Size as 8 bit field*/
@@ -238,7 +258,7 @@ encoding_rule_t notify_payload_encodings[] = {
/* Notify message type as 16 bit field*/
{ U_INT_16, offsetof(private_notify_payload_t, notify_type) },
/* SPI as variable length field*/
- { SPI, offsetof(private_notify_payload_t, spi) },
+ { SPI, offsetof(private_notify_payload_t, spi) },
/* Key Exchange Data is from variable size */
{ NOTIFICATION_DATA, offsetof(private_notify_payload_t, notification_data) }
};
@@ -279,7 +299,7 @@ static status_t verify(private_notify_payload_t *this)
DBG1(DBG_ENC, "Unknown protocol (%d)", this->protocol_id);
return FAILED;
}
-
+
switch (this->notify_type)
{
case INVALID_KE_PAYLOAD:
@@ -567,7 +587,7 @@ notify_payload_t *notify_payload_create()
this->public.get_notification_data = (chunk_t (*) (notify_payload_t *)) get_notification_data;
this->public.set_notification_data = (void (*) (notify_payload_t *,chunk_t)) set_notification_data;
this->public.destroy = (void (*) (notify_payload_t *)) destroy;
-
+
/* set default values of the fields */
this->critical = FALSE;
this->next_payload = NO_PAYLOAD;
@@ -579,7 +599,7 @@ notify_payload_t *notify_payload_create()
this->spi_size = 0;
this->notification_data.ptr = NULL;
this->notification_data.len = 0;
-
+
return &this->public;
}
@@ -592,6 +612,6 @@ notify_payload_t *notify_payload_create_from_protocol_and_type(protocol_id_t pro
notify->set_notify_type(notify,notify_type);
notify->set_protocol_id(notify,protocol_id);
-
+
return notify;
}
diff --git a/src/charon/encoding/payloads/notify_payload.h b/src/charon/encoding/payloads/notify_payload.h
index a5f501dca..0e1bc23b8 100644
--- a/src/charon/encoding/payloads/notify_payload.h
+++ b/src/charon/encoding/payloads/notify_payload.h
@@ -59,11 +59,15 @@ enum notify_type_t {
FAILED_CP_REQUIRED = 37,
TS_UNACCEPTABLE = 38,
INVALID_SELECTORS = 39,
+ /* mobile extension, RFC 4555 */
UNACCEPTABLE_ADDRESSES = 40,
UNEXPECTED_NAT_DETECTED = 41,
+ /* mobile IPv6 bootstrapping, RFC 5026 */
+ USE_ASSIGNED_HoA = 42,
+
/* IKE-ME, private use */
ME_CONNECT_FAILED = 8192,
-
+
/* notify status messages */
INITIAL_CONTACT = 16384,
SET_WINDOW_SIZE = 16385,
@@ -87,9 +91,21 @@ enum notify_type_t {
NO_NATS_ALLOWED = 16402,
/* repeated authentication extension, RFC4478 */
AUTH_LIFETIME = 16403,
- /* multiple authentication exchanges, RFC 4739 */
+ /* multiple authentication exchanges, RFC 4739 */
MULTIPLE_AUTH_SUPPORTED = 16404,
ANOTHER_AUTH_FOLLOWS = 16405,
+ /* redirect mechanism, RFC 5685 */
+ REDIRECT_SUPPORTED = 16406,
+ REDIRECT = 16407,
+ REDIRECTED_FROM = 16408,
+ /* draft-ietf-ipsecme-ikev2-resumption, assigned by IANA */
+ TICKET_LT_OPAQUE = 16409,
+ TICKET_REQUEST = 16410,
+ TICKET_ACK = 16411,
+ TICKET_NACK = 16412,
+ TICKET_OPAQUE = 16413,
+ LINK_ID = 16414,
+
/* draft-eronen-ipsec-ikev2-eap-auth, not assigned by IANA yet */
EAP_ONLY_AUTHENTICATION = 40960,
/* BEET mode, not even a draft yet. private use */
@@ -116,7 +132,7 @@ extern enum_name_t *notify_type_short_names;
/**
* Class representing an IKEv2-Notify Payload.
- *
+ *
* The Notify Payload format is described in Draft section 3.10.
*/
struct notify_payload_t {
@@ -124,67 +140,67 @@ struct notify_payload_t {
* The payload_t interface.
*/
payload_t payload_interface;
-
+
/**
* Gets the protocol id of this payload.
- *
+ *
* @return protocol id of this payload
*/
u_int8_t (*get_protocol_id) (notify_payload_t *this);
/**
* Sets the protocol id of this payload.
- *
+ *
* @param protocol_id protocol id to set
*/
void (*set_protocol_id) (notify_payload_t *this, u_int8_t protocol_id);
/**
* Gets the notify message type of this payload.
- *
+ *
* @return notify message type of this payload
*/
notify_type_t (*get_notify_type) (notify_payload_t *this);
/**
* Sets notify message type of this payload.
- *
+ *
* @param type notify message type to set
*/
void (*set_notify_type) (notify_payload_t *this, notify_type_t type);
/**
* Returns the currently set spi of this payload.
- *
+ *
* This is only valid for notifys with protocol AH|ESP
*
* @return SPI value
*/
u_int32_t (*get_spi) (notify_payload_t *this);
-
+
/**
* Sets the spi of this payload.
- *
+ *
* This is only valid for notifys with protocol AH|ESP
- *
+ *
* @param spi SPI value
*/
void (*set_spi) (notify_payload_t *this, u_int32_t spi);
/**
* Returns the currently set notification data of payload.
- *
+ *
* Returned data are not copied.
- *
+ *
* @return chunk_t pointing to the value
*/
chunk_t (*get_notification_data) (notify_payload_t *this);
-
+
/**
* Sets the notification data of this payload.
- *
+ *
* @warning Value is getting copied.
- *
+ *
* @param notification_data chunk_t pointing to the value to set
*/
void (*set_notification_data) (notify_payload_t *this,
@@ -198,14 +214,14 @@ struct notify_payload_t {
/**
* Creates an empty notify_payload_t object
- *
+ *
* @return created notify_payload_t object
*/
notify_payload_t *notify_payload_create(void);
/**
* Creates an notify_payload_t object of specific type for specific protocol id.
- *
+ *
* @param protocol_id protocol id (IKE, AH or ESP)
* @param type notify type (see notify_type_t)
* @return notify_payload_t object
diff --git a/src/charon/encoding/payloads/payload.h b/src/charon/encoding/payloads/payload.h
index 78f5b7b97..2e783cb30 100644
--- a/src/charon/encoding/payloads/payload.h
+++ b/src/charon/encoding/payloads/payload.h
@@ -33,7 +33,7 @@ typedef struct payload_t payload_t;
/**
* Payload-Types of a IKEv2-Message.
*
- * Header and substructures are also defined as
+ * Header and substructures are also defined as
* payload types with values from PRIVATE USE space.
*/
enum payload_type_t{
@@ -42,7 +42,7 @@ enum payload_type_t{
* End of payload list in next_payload
*/
NO_PAYLOAD = 0,
-
+
/**
* The security association (SA) payload containing proposals.
*/
@@ -122,67 +122,67 @@ enum payload_type_t{
* Extensible authentication payload (EAP).
*/
EXTENSIBLE_AUTHENTICATION = 48,
-
+
#ifdef ME
/**
* Identification payload for peers has a value from
- * the PRIVATE USE space.
+ * the PRIVATE USE space.
*/
ID_PEER = 128,
#endif /* ME */
-
+
/**
* Header has a value of PRIVATE USE space.
- *
- * This payload type is not sent over wire and just
+ *
+ * This payload type is not sent over wire and just
* used internally to handle IKEv2-Header like a payload.
*/
HEADER = 140,
-
+
/**
* PROPOSAL_SUBSTRUCTURE has a value of PRIVATE USE space.
- *
- * This payload type is not sent over wire and just
+ *
+ * This payload type is not sent over wire and just
* used internally to handle a proposal substructure like a payload.
*/
PROPOSAL_SUBSTRUCTURE = 141,
/**
* TRANSFORM_SUBSTRUCTURE has a value of PRIVATE USE space.
- *
- * This payload type is not sent over wire and just
+ *
+ * This payload type is not sent over wire and just
* used internally to handle a transform substructure like a payload.
*/
TRANSFORM_SUBSTRUCTURE = 142,
-
+
/**
* TRANSFORM_ATTRIBUTE has a value of PRIVATE USE space.
- *
- * This payload type is not sent over wire and just
+ *
+ * This payload type is not sent over wire and just
* used internally to handle a transform attribute like a payload.
*/
TRANSFORM_ATTRIBUTE = 143,
/**
* TRAFFIC_SELECTOR_SUBSTRUCTURE has a value of PRIVATE USE space.
- *
- * This payload type is not sent over wire and just
+ *
+ * This payload type is not sent over wire and just
* used internally to handle a transform selector like a payload.
- */
+ */
TRAFFIC_SELECTOR_SUBSTRUCTURE = 144,
-
+
/**
* CONFIGURATION_ATTRIBUTE has a value of PRIVATE USE space.
- *
- * This payload type is not sent over wire and just
+ *
+ * This payload type is not sent over wire and just
* used internally to handle a transform attribute like a payload.
*/
CONFIGURATION_ATTRIBUTE = 145,
-
+
/**
* A unknown payload has a value of PRIVATE USE space.
- *
- * This payload type is not sent over wire and just
+ *
+ * This payload type is not sent over wire and just
* used internally to handle a unknown payload.
*/
UNKNOWN_PAYLOAD = 146,
@@ -201,13 +201,13 @@ extern enum_name_t *payload_type_short_names;
/**
* Generic interface for all payload types (incl.header and substructures).
- *
+ *
* To handle all kinds of payloads on a generic way, this interface must
* be implemented by every payload. This allows parser_t/generator_t a simple
* handling of all payloads.
*/
struct payload_t {
-
+
/**
* Get encoding rules for this payload.
*
@@ -229,7 +229,7 @@ struct payload_t {
* @return type of next payload
*/
payload_type_t (*get_next_type) (payload_t *this);
-
+
/**
* Set type of next payload.
*
@@ -243,14 +243,14 @@ struct payload_t {
* @return length of this payload
*/
size_t (*get_length) (payload_t *this);
-
+
/**
* Verifies payload structure and makes consistence check.
*
* @return SUCCESS, FAILED if consistence not given
*/
status_t (*verify) (payload_t *this);
-
+
/**
* Destroys a payload and all included substructures.
*/
@@ -259,11 +259,11 @@ struct payload_t {
/**
* Create an empty payload.
- *
+ *
* Useful for the parser, who wants a generic constructor for all payloads.
- * It supports all payload_t methods. If a payload type is not known,
+ * It supports all payload_t methods. If a payload type is not known,
* an unknwon_paylod is created with the chunk of data in it.
- *
+ *
* @param type type of the payload to create
* @return payload_t object
*/
diff --git a/src/charon/encoding/payloads/proposal_substructure.c b/src/charon/encoding/payloads/proposal_substructure.c
index a8166023c..c93f73a68 100644
--- a/src/charon/encoding/payloads/proposal_substructure.c
+++ b/src/charon/encoding/payloads/proposal_substructure.c
@@ -35,14 +35,14 @@ typedef struct private_proposal_substructure_t private_proposal_substructure_t;
/**
* Private data of an proposal_substructure_t object.
- *
+ *
*/
struct private_proposal_substructure_t {
/**
* Public proposal_substructure_t interface.
*/
proposal_substructure_t public;
-
+
/**
* Next payload type.
*/
@@ -52,12 +52,12 @@ struct private_proposal_substructure_t {
* Length of this payload.
*/
u_int16_t proposal_length;
-
+
/**
* Proposal number.
*/
u_int8_t proposal_number;
-
+
/**
* Protocol ID.
*/
@@ -66,32 +66,32 @@ struct private_proposal_substructure_t {
/**
* SPI size of the following SPI.
*/
- u_int8_t spi_size;
+ u_int8_t spi_size;
/**
* Number of transforms.
*/
- u_int8_t transforms_count;
-
- /**
- * SPI is stored as chunk.
- */
- chunk_t spi;
-
- /**
- * Transforms are stored in a linked_list_t.
- */
+ u_int8_t transforms_count;
+
+ /**
+ * SPI is stored as chunk.
+ */
+ chunk_t spi;
+
+ /**
+ * Transforms are stored in a linked_list_t.
+ */
linked_list_t * transforms;
};
/**
* Encoding rules to parse or generate a Proposal substructure.
*
- * The defined offsets are the positions in a object of type
+ * The defined offsets are the positions in a object of type
* private_proposal_substructure_t.
*/
encoding_rule_t proposal_substructure_encodings[] = {
- /* 1 Byte next payload type, stored in the field next_payload */
+ /* 1 Byte next payload type, stored in the field next_payload */
{ U_INT_8, offsetof(private_proposal_substructure_t, next_payload) },
/* Reserved Byte is skipped */
{ RESERVED_BYTE, 0 },
@@ -107,7 +107,7 @@ encoding_rule_t proposal_substructure_encodings[] = {
{ U_INT_8, offsetof(private_proposal_substructure_t, transforms_count) },
/* SPI is a chunk of variable size*/
{ SPI, offsetof(private_proposal_substructure_t, spi) },
- /* Transforms are stored in a transform substructure,
+ /* Transforms are stored in a transform substructure,
offset points to a linked_list_t pointer */
{ TRANSFORMS, offsetof(private_proposal_substructure_t, transforms) }
};
@@ -136,7 +136,7 @@ static status_t verify(private_proposal_substructure_t *this)
status_t status = SUCCESS;
iterator_t *iterator;
payload_t *current_transform;
-
+
if ((this->next_payload != NO_PAYLOAD) && (this->next_payload != 2))
{
/* must be 0 or 2 */
@@ -178,7 +178,7 @@ static status_t verify(private_proposal_substructure_t *this)
DBG1(DBG_ENC, "invalid protocol");
return FAILED;
}
-
+
iterator = this->transforms->create_iterator(this->transforms,TRUE);
while(iterator->iterate(iterator, (void**)&current_transform))
{
@@ -190,8 +190,8 @@ static status_t verify(private_proposal_substructure_t *this)
}
}
iterator->destroy(iterator);
-
- /* proposal number is checked in SA payload */
+
+ /* proposal number is checked in SA payload */
return status;
}
@@ -236,7 +236,7 @@ static void compute_length(private_proposal_substructure_t *this)
payload_t *current_transform;
size_t transforms_count = 0;
size_t length = PROPOSAL_SUBSTRUCTURE_HEADER_LENGTH;
-
+
iterator = this->transforms->create_iterator(this->transforms,TRUE);
while (iterator->iterate(iterator, (void**)&current_transform))
{
@@ -244,7 +244,7 @@ static void compute_length(private_proposal_substructure_t *this)
transforms_count++;
}
iterator->destroy(iterator);
-
+
length += this->spi.len;
this->transforms_count = transforms_count;
this->proposal_length = length;
@@ -282,7 +282,7 @@ static void add_transform_substructure (private_proposal_substructure_t *this,tr
}
transform->set_is_last_transform(transform,TRUE);
-
+
this->transforms->insert_last(this->transforms,(void *) transform);
compute_length(this);
}
@@ -340,7 +340,7 @@ static void set_spi(private_proposal_substructure_t *this, chunk_t spi)
this->spi.len = 0;
compute_length(this);
}
-
+
this->spi.ptr = clalloc(spi.ptr,spi.len);
this->spi.len = spi.len;
this->spi_size = spi.len;
@@ -355,7 +355,7 @@ static chunk_t get_spi(private_proposal_substructure_t *this)
chunk_t spi;
spi.ptr = this->spi.ptr;
spi.len = this->spi.len;
-
+
return spi;
}
@@ -384,24 +384,24 @@ proposal_t* get_proposal(private_proposal_substructure_t *this)
transform_substructure_t *transform;
proposal_t *proposal;
u_int64_t spi;
-
+
proposal = proposal_create(this->protocol_id);
-
+
iterator = this->transforms->create_iterator(this->transforms, TRUE);
while (iterator->iterate(iterator, (void**)&transform))
{
transform_type_t transform_type;
u_int16_t transform_id;
u_int16_t key_length = 0;
-
+
transform_type = transform->get_transform_type(transform);
transform_id = transform->get_transform_id(transform);
transform->get_key_length(transform, &key_length);
-
+
proposal->add_algorithm(proposal, transform_type, transform_id, key_length);
}
iterator->destroy(iterator);
-
+
switch (this->spi.len)
{
case 4:
@@ -414,7 +414,7 @@ proposal_t* get_proposal(private_proposal_substructure_t *this)
spi = 0;
}
proposal->set_spi(proposal, spi);
-
+
return proposal;
}
@@ -426,7 +426,7 @@ static private_proposal_substructure_t* clone_(private_proposal_substructure_t *
private_proposal_substructure_t *clone;
iterator_t *transforms;
transform_substructure_t *current_transform;
-
+
clone = (private_proposal_substructure_t *) proposal_substructure_create();
clone->next_payload = this->next_payload;
clone->proposal_number = this->proposal_number;
@@ -444,8 +444,8 @@ static private_proposal_substructure_t* clone_(private_proposal_substructure_t *
current_transform = current_transform->clone(current_transform);
clone->public.add_transform_substructure(&clone->public, current_transform);
}
- transforms->destroy(transforms);
-
+ transforms->destroy(transforms);
+
return clone;
}
@@ -468,16 +468,16 @@ proposal_substructure_t *proposal_substructure_create()
{
private_proposal_substructure_t *this = malloc_thing(private_proposal_substructure_t);
- /* interface functions */
+ /* interface functions */
this->public.payload_interface.verify = (status_t (*) (payload_t *))verify;
this->public.payload_interface.get_encoding_rules = (void (*) (payload_t *, encoding_rule_t **, size_t *) ) get_encoding_rules;
this->public.payload_interface.get_length = (size_t (*) (payload_t *)) get_length;
this->public.payload_interface.get_next_type = (payload_type_t (*) (payload_t *)) get_next_type;
- this->public.payload_interface.set_next_type = (void (*) (payload_t *,payload_type_t)) set_next_type;
+ this->public.payload_interface.set_next_type = (void (*) (payload_t *,payload_type_t)) set_next_type;
this->public.payload_interface.get_type = (payload_type_t (*) (payload_t *)) get_type;
this->public.payload_interface.destroy = (void (*) (payload_t *))destroy;
-
-
+
+
/* public functions */
this->public.create_transform_substructure_iterator = (iterator_t* (*) (proposal_substructure_t *,bool)) create_transform_substructure_iterator;
this->public.add_transform_substructure = (void (*) (proposal_substructure_t *,transform_substructure_t *)) add_transform_substructure;
@@ -490,10 +490,10 @@ proposal_substructure_t *proposal_substructure_create()
this->public.set_spi = (void (*) (proposal_substructure_t *,chunk_t))set_spi;
this->public.get_spi = (chunk_t (*) (proposal_substructure_t *)) get_spi;
this->public.get_transform_count = (size_t (*) (proposal_substructure_t *)) get_transform_count;
- this->public.get_spi_size = (size_t (*) (proposal_substructure_t *)) get_spi_size;
+ this->public.get_spi_size = (size_t (*) (proposal_substructure_t *)) get_spi_size;
this->public.clone = (proposal_substructure_t * (*) (proposal_substructure_t *)) clone_;
this->public.destroy = (void (*) (proposal_substructure_t *)) destroy;
-
+
/* set default values of the fields */
this->next_payload = NO_PAYLOAD;
this->proposal_length = 0;
@@ -503,9 +503,9 @@ proposal_substructure_t *proposal_substructure_create()
this->spi_size = 0;
this->spi.ptr = NULL;
this->spi.len = 0;
-
+
this->transforms = linked_list_create();
-
+
return (&(this->public));
}
@@ -518,9 +518,9 @@ proposal_substructure_t *proposal_substructure_create_from_proposal(proposal_t *
private_proposal_substructure_t *this;
u_int16_t alg, key_size;
enumerator_t *enumerator;
-
+
this = (private_proposal_substructure_t*)proposal_substructure_create();
-
+
/* encryption algorithm is only availble in ESP */
enumerator = proposal->create_enumerator(proposal, ENCRYPTION_ALGORITHM);
while (enumerator->enumerate(enumerator, &alg, &key_size))
@@ -530,7 +530,7 @@ proposal_substructure_t *proposal_substructure_create_from_proposal(proposal_t *
add_transform_substructure(this, transform);
}
enumerator->destroy(enumerator);
-
+
/* integrity algorithms */
enumerator = proposal->create_enumerator(proposal, INTEGRITY_ALGORITHM);
while (enumerator->enumerate(enumerator, &alg, &key_size))
@@ -540,7 +540,7 @@ proposal_substructure_t *proposal_substructure_create_from_proposal(proposal_t *
add_transform_substructure(this, transform);
}
enumerator->destroy(enumerator);
-
+
/* prf algorithms */
enumerator = proposal->create_enumerator(proposal, PSEUDO_RANDOM_FUNCTION);
while (enumerator->enumerate(enumerator, &alg, &key_size))
@@ -550,17 +550,17 @@ proposal_substructure_t *proposal_substructure_create_from_proposal(proposal_t *
add_transform_substructure(this, transform);
}
enumerator->destroy(enumerator);
-
+
/* dh groups */
enumerator = proposal->create_enumerator(proposal, DIFFIE_HELLMAN_GROUP);
while (enumerator->enumerate(enumerator, &alg, NULL))
{
- transform = transform_substructure_create_type(DIFFIE_HELLMAN_GROUP,
+ transform = transform_substructure_create_type(DIFFIE_HELLMAN_GROUP,
alg, 0);
add_transform_substructure(this, transform);
}
enumerator->destroy(enumerator);
-
+
/* extended sequence numbers */
enumerator = proposal->create_enumerator(proposal, EXTENDED_SEQUENCE_NUMBERS);
while (enumerator->enumerate(enumerator, &alg, NULL))
@@ -570,7 +570,7 @@ proposal_substructure_t *proposal_substructure_create_from_proposal(proposal_t *
add_transform_substructure(this, transform);
}
enumerator->destroy(enumerator);
-
+
/* add SPI, if necessary */
switch (proposal->get_protocol(proposal))
{
@@ -593,6 +593,6 @@ proposal_substructure_t *proposal_substructure_create_from_proposal(proposal_t *
}
this->proposal_number = 0;
this->protocol_id = proposal->get_protocol(proposal);
-
+
return &this->public;
}
diff --git a/src/charon/encoding/payloads/proposal_substructure.h b/src/charon/encoding/payloads/proposal_substructure.h
index 8ccb917d6..4934802af 100644
--- a/src/charon/encoding/payloads/proposal_substructure.h
+++ b/src/charon/encoding/payloads/proposal_substructure.h
@@ -38,7 +38,7 @@ typedef struct proposal_substructure_t proposal_substructure_t;
/**
* Class representing an IKEv2-PROPOSAL SUBSTRUCTURE.
- *
+ *
* The PROPOSAL SUBSTRUCTURE format is described in RFC section 3.3.1.
*/
struct proposal_substructure_t {
@@ -55,7 +55,7 @@ struct proposal_substructure_t {
*/
iterator_t *(*create_transform_substructure_iterator) (
proposal_substructure_t *this, bool forward);
-
+
/**
* Adds a transform_substructure_t object to this object.
*
@@ -63,7 +63,7 @@ struct proposal_substructure_t {
*/
void (*add_transform_substructure) (proposal_substructure_t *this,
transform_substructure_t *transform);
-
+
/**
* Sets the proposal number of current proposal.
*
@@ -71,24 +71,24 @@ struct proposal_substructure_t {
*/
void (*set_proposal_number) (proposal_substructure_t *this,
u_int8_t proposal_number);
-
+
/**
* get proposal number of current proposal.
- *
+ *
* @return proposal number of current proposal substructure.
*/
u_int8_t (*get_proposal_number) (proposal_substructure_t *this);
/**
* get the number of transforms in current proposal.
- *
+ *
* @return transform count in current proposal
*/
size_t (*get_transform_count) (proposal_substructure_t *this);
/**
* get size of the set spi in bytes.
- *
+ *
* @return size of the spi in bytes
*/
size_t (*get_spi_size) (proposal_substructure_t *this);
@@ -100,43 +100,43 @@ struct proposal_substructure_t {
*/
void (*set_protocol_id) (proposal_substructure_t *this,
u_int8_t protocol_id);
-
+
/**
* get protocol id of current proposal.
- *
+ *
* @return protocol id of current proposal substructure.
*/
u_int8_t (*get_protocol_id) (proposal_substructure_t *this);
-
+
/**
* Sets the next_payload field of this substructure
- *
+ *
* If this is the last proposal, next payload field is set to 0,
* otherwise to 2
*
* @param is_last When TRUE, next payload field is set to 0, otherwise to 2
*/
void (*set_is_last_proposal) (proposal_substructure_t *this, bool is_last);
-
+
/**
* Returns the currently set SPI of this proposal.
*
* @return chunk_t pointing to the value
*/
chunk_t (*get_spi) (proposal_substructure_t *this);
-
+
/**
* Sets the SPI of the current proposal.
- *
+ *
* @warning SPI is getting copied
- *
+ *
* @param spi chunk_t pointing to the value to set
*/
void (*set_spi) (proposal_substructure_t *this, chunk_t spi);
-
+
/**
* Get a proposal_t from the propsal_substructure_t.
- *
+ *
* @return proposal_t
*/
proposal_t * (*get_proposal) (proposal_substructure_t *this);
@@ -156,7 +156,7 @@ struct proposal_substructure_t {
/**
* Creates an empty proposal_substructure_t object
- *
+ *
* @return proposal_substructure_t object
*/
proposal_substructure_t *proposal_substructure_create(void);
diff --git a/src/charon/encoding/payloads/sa_payload.c b/src/charon/encoding/payloads/sa_payload.c
index 3ca2f08c8..187a8fee0 100644
--- a/src/charon/encoding/payloads/sa_payload.c
+++ b/src/charon/encoding/payloads/sa_payload.c
@@ -27,14 +27,14 @@ typedef struct private_sa_payload_t private_sa_payload_t;
/**
* Private data of an sa_payload_t object.
- *
+ *
*/
struct private_sa_payload_t {
/**
* Public sa_payload_t interface.
*/
sa_payload_t public;
-
+
/**
* Next payload type.
*/
@@ -44,12 +44,12 @@ struct private_sa_payload_t {
* Critical flag.
*/
bool critical;
-
+
/**
* Length of this payload.
*/
u_int16_t payload_length;
-
+
/**
* Proposals in this payload are stored in a linked_list_t.
*/
@@ -58,27 +58,27 @@ struct private_sa_payload_t {
/**
* Encoding rules to parse or generate a IKEv2-SA Payload
- *
- * The defined offsets are the positions in a object of type
+ *
+ * The defined offsets are the positions in a object of type
* private_sa_payload_t.
- *
+ *
*/
encoding_rule_t sa_payload_encodings[] = {
- /* 1 Byte next payload type, stored in the field next_payload */
+ /* 1 Byte next payload type, stored in the field next_payload */
{ U_INT_8, offsetof(private_sa_payload_t, next_payload) },
/* the critical bit */
- { FLAG, offsetof(private_sa_payload_t, critical) },
- /* 7 Bit reserved bits, nowhere stored */
- { RESERVED_BIT, 0 },
- { RESERVED_BIT, 0 },
- { RESERVED_BIT, 0 },
- { RESERVED_BIT, 0 },
- { RESERVED_BIT, 0 },
- { RESERVED_BIT, 0 },
- { RESERVED_BIT, 0 },
+ { FLAG, offsetof(private_sa_payload_t, critical) },
+ /* 7 Bit reserved bits, nowhere stored */
+ { RESERVED_BIT, 0 },
+ { RESERVED_BIT, 0 },
+ { RESERVED_BIT, 0 },
+ { RESERVED_BIT, 0 },
+ { RESERVED_BIT, 0 },
+ { RESERVED_BIT, 0 },
+ { RESERVED_BIT, 0 },
/* Length of the whole SA payload*/
- { PAYLOAD_LENGTH, offsetof(private_sa_payload_t, payload_length) },
- /* Proposals are stored in a proposal substructure,
+ { PAYLOAD_LENGTH, offsetof(private_sa_payload_t, payload_length) },
+ /* Proposals are stored in a proposal substructure,
offset points to a linked_list_t pointer */
{ PROPOSALS, offsetof(private_sa_payload_t, proposals) }
};
@@ -108,12 +108,12 @@ static status_t verify(private_sa_payload_t *this)
/* check proposal numbering */
iterator = this->proposals->create_iterator(this->proposals,TRUE);
-
+
while(iterator->iterate(iterator, (void**)&current_proposal))
{
current_number = current_proposal->get_proposal_number(current_proposal);
if (current_number < expected_number)
- {
+ {
if (current_number != (expected_number + 1))
{
DBG1(DBG_ENC, "proposal number is %d, expected %d or %d",
@@ -129,7 +129,7 @@ static status_t verify(private_sa_payload_t *this)
status = FAILED;
break;
}
-
+
status = current_proposal->payload_interface.verify(&(current_proposal->payload_interface));
if (status != SUCCESS)
{
@@ -139,7 +139,7 @@ static status_t verify(private_sa_payload_t *this)
first = FALSE;
expected_number = current_number;
}
-
+
iterator->destroy(iterator);
return status;
}
@@ -197,14 +197,14 @@ static void compute_length (private_sa_payload_t *this)
iterator_t *iterator;
payload_t *current_proposal;
size_t length = SA_PAYLOAD_HEADER_LENGTH;
-
+
iterator = this->proposals->create_iterator(this->proposals,TRUE);
while (iterator->iterate(iterator, (void **)&current_proposal))
{
length += current_proposal->get_length(current_proposal);
}
iterator->destroy(iterator);
-
+
this->payload_length = length;
}
@@ -232,7 +232,7 @@ static void add_proposal_substructure(private_sa_payload_t *this,proposal_substr
{
status_t status;
u_int proposal_count = this->proposals->get_count(this->proposals);
-
+
if (proposal_count > 0)
{
proposal_substructure_t *last_proposal;
@@ -252,7 +252,7 @@ static void add_proposal_substructure(private_sa_payload_t *this,proposal_substr
static void add_proposal(private_sa_payload_t *this, proposal_t *proposal)
{
proposal_substructure_t *substructure;
-
+
substructure = proposal_substructure_create_from_proposal(proposal);
add_proposal_substructure(this, substructure);
}
@@ -267,10 +267,10 @@ static linked_list_t *get_proposals(private_sa_payload_t *this)
iterator_t *iterator;
proposal_substructure_t *proposal_struct;
linked_list_t *proposal_list;
-
+
/* this list will hold our proposals */
proposal_list = linked_list_create();
-
+
/* we do not support proposals split up to two proposal substructures, as
* AH+ESP bundles are not supported in RFC4301 anymore.
* To handle such structures safely, we just skip proposals with multiple
@@ -280,7 +280,7 @@ static linked_list_t *get_proposals(private_sa_payload_t *this)
while (iterator->iterate(iterator, (void **)&proposal_struct))
{
proposal_t *proposal;
-
+
/* check if a proposal has a single protocol */
if (proposal_struct->get_proposal_number(proposal_struct) == struct_number)
{
@@ -310,7 +310,7 @@ static linked_list_t *get_proposals(private_sa_payload_t *this)
sa_payload_t *sa_payload_create()
{
private_sa_payload_t *this = malloc_thing(private_sa_payload_t);
-
+
/* public interface */
this->public.payload_interface.verify = (status_t (*) (payload_t *))verify;
this->public.payload_interface.get_encoding_rules = (void (*) (payload_t *, encoding_rule_t **, size_t *) ) get_encoding_rules;
@@ -319,14 +319,14 @@ sa_payload_t *sa_payload_create()
this->public.payload_interface.set_next_type = (void (*) (payload_t *,payload_type_t)) set_next_type;
this->public.payload_interface.get_type = (payload_type_t (*) (payload_t *)) get_type;
this->public.payload_interface.destroy = (void (*) (payload_t *))destroy;
-
+
/* public functions */
this->public.create_proposal_substructure_iterator = (iterator_t* (*) (sa_payload_t *,bool)) create_proposal_substructure_iterator;
this->public.add_proposal_substructure = (void (*) (sa_payload_t *,proposal_substructure_t *)) add_proposal_substructure;
this->public.add_proposal = (void (*) (sa_payload_t*,proposal_t*))add_proposal;
this->public.get_proposals = (linked_list_t* (*) (sa_payload_t *)) get_proposals;
this->public.destroy = (void (*) (sa_payload_t *)) destroy;
-
+
/* set default values of the fields */
this->critical = FALSE;
this->next_payload = NO_PAYLOAD;
@@ -343,7 +343,7 @@ sa_payload_t *sa_payload_create_from_proposal_list(linked_list_t *proposals)
iterator_t *iterator;
proposal_t *proposal;
sa_payload_t *sa_payload = sa_payload_create();
-
+
/* add every payload from the list */
iterator = proposals->create_iterator(proposals, TRUE);
while (iterator->iterate(iterator, (void**)&proposal))
@@ -351,7 +351,7 @@ sa_payload_t *sa_payload_create_from_proposal_list(linked_list_t *proposals)
add_proposal((private_sa_payload_t*)sa_payload, proposal);
}
iterator->destroy(iterator);
-
+
return sa_payload;
}
@@ -361,8 +361,8 @@ sa_payload_t *sa_payload_create_from_proposal_list(linked_list_t *proposals)
sa_payload_t *sa_payload_create_from_proposal(proposal_t *proposal)
{
sa_payload_t *sa_payload = sa_payload_create();
-
+
add_proposal((private_sa_payload_t*)sa_payload, proposal);
-
+
return sa_payload;
}
diff --git a/src/charon/encoding/payloads/sa_payload.h b/src/charon/encoding/payloads/sa_payload.h
index 58ae72544..25f5a2407 100644
--- a/src/charon/encoding/payloads/sa_payload.h
+++ b/src/charon/encoding/payloads/sa_payload.h
@@ -44,12 +44,12 @@ struct sa_payload_t {
* The payload_t interface.
*/
payload_t payload_interface;
-
+
/**
* Creates an iterator of stored proposal_substructure_t objects.
- *
- * When deleting an proposal using this iterator,
- * the length of this transform substructure has to be refreshed
+ *
+ * When deleting an proposal using this iterator,
+ * the length of this transform substructure has to be refreshed
* by calling get_length()!
*
* @param forward iterator direction (TRUE: front to end)
@@ -57,7 +57,7 @@ struct sa_payload_t {
*/
iterator_t *(*create_proposal_substructure_iterator) (sa_payload_t *this,
bool forward);
-
+
/**
* Adds a proposal_substructure_t object to this object.
*
@@ -68,18 +68,18 @@ struct sa_payload_t {
/**
* Gets the proposals in this payload as a list.
- *
+ *
* @return a list containing proposal_t s
*/
linked_list_t *(*get_proposals) (sa_payload_t *this);
-
+
/**
* Add a child proposal (AH/ESP) to the payload.
- *
+ *
* @param proposal child proposal to add to the payload
*/
void (*add_proposal) (sa_payload_t *this, proposal_t *proposal);
-
+
/**
* Destroys an sa_payload_t object.
*/
@@ -88,14 +88,14 @@ struct sa_payload_t {
/**
* Creates an empty sa_payload_t object
- *
+ *
* @return created sa_payload_t object
*/
sa_payload_t *sa_payload_create(void);
/**
* Creates a sa_payload_t object from a list of proposals.
- *
+ *
* @param proposals list of proposals to build the payload from
* @return sa_payload_t object
*/
@@ -103,10 +103,10 @@ sa_payload_t *sa_payload_create_from_proposal_list(linked_list_t *proposals);
/**
* Creates a sa_payload_t object from a single proposal.
- *
+ *
* This is only for convenience. Use sa_payload_create_from_proposal_list
* if you want to add more than one proposal.
- *
+ *
* @param proposal proposal from which the payload should be built.
* @return sa_payload_t object
*/
diff --git a/src/charon/encoding/payloads/traffic_selector_substructure.c b/src/charon/encoding/payloads/traffic_selector_substructure.c
index 7dcdce6aa..f24857591 100644
--- a/src/charon/encoding/payloads/traffic_selector_substructure.c
+++ b/src/charon/encoding/payloads/traffic_selector_substructure.c
@@ -24,19 +24,19 @@ typedef struct private_traffic_selector_substructure_t private_traffic_selector_
/**
* Private data of an traffic_selector_substructure_t object.
- *
+ *
*/
struct private_traffic_selector_substructure_t {
/**
* Public traffic_selector_substructure_t interface.
*/
traffic_selector_substructure_t public;
-
+
/**
* Type of traffic selector.
*/
u_int8_t ts_type;
-
+
/**
* IP Protocol ID.
*/
@@ -46,7 +46,7 @@ struct private_traffic_selector_substructure_t {
* Length of this payload.
*/
u_int16_t payload_length;
-
+
/**
* Start port number.
*/
@@ -56,7 +56,7 @@ struct private_traffic_selector_substructure_t {
* End port number.
*/
u_int16_t end_port;
-
+
/**
* Starting address.
*/
@@ -70,21 +70,21 @@ struct private_traffic_selector_substructure_t {
/**
* Encoding rules to parse or generate a TS payload
- *
- * The defined offsets are the positions in a object of type
+ *
+ * The defined offsets are the positions in a object of type
* private_traffic_selector_substructure_t.
- *
+ *
*/
encoding_rule_t traffic_selector_substructure_encodings[] = {
- /* 1 Byte next ts type*/
+ /* 1 Byte next ts type*/
{ TS_TYPE, offsetof(private_traffic_selector_substructure_t, ts_type) },
- /* 1 Byte IP protocol id*/
+ /* 1 Byte IP protocol id*/
{ U_INT_8, offsetof(private_traffic_selector_substructure_t, ip_protocol_id) },
- /* Length of the whole payload*/
+ /* Length of the whole payload*/
{ PAYLOAD_LENGTH, offsetof(private_traffic_selector_substructure_t, payload_length) },
- /* 2 Byte start port*/
+ /* 2 Byte start port*/
{ U_INT_16, offsetof(private_traffic_selector_substructure_t, start_port) },
- /* 2 Byte end port*/
+ /* 2 Byte end port*/
{ U_INT_16, offsetof(private_traffic_selector_substructure_t, end_port) },
/* starting address is either 4 or 16 byte */
{ ADDRESS, offsetof(private_traffic_selector_substructure_t, starting_address) },
@@ -124,7 +124,7 @@ static status_t verify(private_traffic_selector_substructure_t *this)
{
case TS_IPV4_ADDR_RANGE:
{
- if ((this->starting_address.len != 4) ||
+ if ((this->starting_address.len != 4) ||
(this->ending_address.len != 4))
{
/* ipv4 address must be 4 bytes long */
@@ -148,7 +148,7 @@ static status_t verify(private_traffic_selector_substructure_t *this)
return FAILED;
}
}
-
+
return SUCCESS;
}
@@ -182,7 +182,7 @@ static payload_type_t get_next_type(private_traffic_selector_substructure_t *thi
*/
static void set_next_type(private_traffic_selector_substructure_t *this,payload_type_t type)
{
-
+
}
/**
@@ -199,8 +199,8 @@ static size_t get_length(private_traffic_selector_substructure_t *this)
static traffic_selector_t *get_traffic_selector(private_traffic_selector_substructure_t *this)
{
traffic_selector_t *ts;
- ts = traffic_selector_create_from_bytes(this->ip_protocol_id, this->ts_type,
- this->starting_address, this->start_port,
+ ts = traffic_selector_create_from_bytes(this->ip_protocol_id, this->ts_type,
+ this->starting_address, this->start_port,
this->ending_address, this->end_port);
return ts;
}
@@ -221,7 +221,7 @@ static void destroy(private_traffic_selector_substructure_t *this)
{
free(this->starting_address.ptr);
free(this->ending_address.ptr);
- free(this);
+ free(this);
}
/*
@@ -239,11 +239,11 @@ traffic_selector_substructure_t *traffic_selector_substructure_create()
this->public.payload_interface.set_next_type = (void (*) (payload_t *,payload_type_t)) set_next_type;
this->public.payload_interface.get_type = (payload_type_t (*) (payload_t *)) get_payload_type;
this->public.payload_interface.destroy = (void (*) (payload_t *))destroy;
-
+
/* public functions */
this->public.get_traffic_selector = (traffic_selector_t* (*)(traffic_selector_substructure_t*))get_traffic_selector;
this->public.destroy = (void (*) (traffic_selector_substructure_t *)) destroy;
-
+
/* private variables */
this->payload_length = TRAFFIC_SELECTOR_HEADER_LENGTH;
this->start_port = 0;
@@ -269,8 +269,8 @@ traffic_selector_substructure_t *traffic_selector_substructure_create_from_traff
this->end_port = traffic_selector->get_to_port(traffic_selector);
this->starting_address = chunk_clone(traffic_selector->get_from_address(traffic_selector));
this->ending_address = chunk_clone(traffic_selector->get_to_address(traffic_selector));
-
+
compute_length(this);
-
+
return &(this->public);
}
diff --git a/src/charon/encoding/payloads/traffic_selector_substructure.h b/src/charon/encoding/payloads/traffic_selector_substructure.h
index ee3e204a0..0109fd7f5 100644
--- a/src/charon/encoding/payloads/traffic_selector_substructure.h
+++ b/src/charon/encoding/payloads/traffic_selector_substructure.h
@@ -25,9 +25,9 @@
typedef struct traffic_selector_substructure_t traffic_selector_substructure_t;
#include <library.h>
-#include <encoding/payloads/payload.h>
#include <utils/host.h>
-#include <config/traffic_selector.h>
+#include <selectors/traffic_selector.h>
+#include <encoding/payloads/payload.h>
/**
* Length of a TRAFFIC SELECTOR SUBSTRUCTURE without start and end address.
@@ -36,7 +36,7 @@ typedef struct traffic_selector_substructure_t traffic_selector_substructure_t;
/**
* Class representing an IKEv2 TRAFFIC SELECTOR.
- *
+ *
* The TRAFFIC SELECTOR format is described in RFC section 3.13.1.
*/
struct traffic_selector_substructure_t {
@@ -44,49 +44,49 @@ struct traffic_selector_substructure_t {
* The payload_t interface.
*/
payload_t payload_interface;
-
+
/**
* Get the type of Traffic selector.
*
* @return type of traffic selector
- *
+ *
*/
ts_type_t (*get_ts_type) (traffic_selector_substructure_t *this);
-
+
/**
* Set the type of Traffic selector.
*
- * @param ts_type type of traffic selector
+ * @param ts_type type of traffic selector
*/
void (*set_ts_type) (traffic_selector_substructure_t *this,
ts_type_t ts_type);
-
+
/**
* Get the IP protocol ID of Traffic selector.
*
* @return type of traffic selector
- *
+ *
*/
u_int8_t (*get_protocol_id) (traffic_selector_substructure_t *this);
-
+
/**
* Set the IP protocol ID of Traffic selector
*
- * @param protocol_id protocol ID of traffic selector
+ * @param protocol_id protocol ID of traffic selector
*/
void (*set_protocol_id) (traffic_selector_substructure_t *this,
u_int8_t protocol_id);
-
+
/**
* Get the start port and address as host_t object.
*
* Returned host_t object has to get destroyed by the caller.
- *
+ *
* @return start host as host_t object
- *
+ *
*/
host_t *(*get_start_host) (traffic_selector_substructure_t *this);
-
+
/**
* Set the start port and address as host_t object.
*
@@ -94,17 +94,17 @@ struct traffic_selector_substructure_t {
*/
void (*set_start_host) (traffic_selector_substructure_t *this,
host_t *start_host);
-
+
/**
* Get the end port and address as host_t object.
*
* Returned host_t object has to get destroyed by the caller.
- *
+ *
* @return end host as host_t object
- *
+ *
*/
host_t *(*get_end_host) (traffic_selector_substructure_t *this);
-
+
/**
* Set the end port and address as host_t object.
*
@@ -112,17 +112,17 @@ struct traffic_selector_substructure_t {
*/
void (*set_end_host) (traffic_selector_substructure_t *this,
host_t *end_host);
-
+
/**
* Get a traffic_selector_t from this substructure.
*
* @warning traffic_selector_t must be destroyed after usage.
- *
+ *
* @return contained traffic_selector_t
*/
traffic_selector_t *(*get_traffic_selector) (
traffic_selector_substructure_t *this);
-
+
/**
* Destroys an traffic_selector_substructure_t object.
*/
@@ -133,7 +133,7 @@ struct traffic_selector_substructure_t {
* Creates an empty traffic_selector_substructure_t object.
*
* TS type is set to default TS_IPV4_ADDR_RANGE!
- *
+ *
* @return traffic_selector_substructure_t object
*/
traffic_selector_substructure_t *traffic_selector_substructure_create(void);
@@ -141,7 +141,7 @@ traffic_selector_substructure_t *traffic_selector_substructure_create(void);
/**
* Creates an initialized traffif selector substructure using
* the values from a traffic_selector_t.
- *
+ *
* @param traffic_selector traffic_selector_t to use for initialization
* @return traffic_selector_substructure_t object
*/
diff --git a/src/charon/encoding/payloads/transform_attribute.c b/src/charon/encoding/payloads/transform_attribute.c
index 507d04a34..8bf2ddef4 100644
--- a/src/charon/encoding/payloads/transform_attribute.c
+++ b/src/charon/encoding/payloads/transform_attribute.c
@@ -26,32 +26,32 @@ typedef struct private_transform_attribute_t private_transform_attribute_t;
/**
* Private data of an transform_attribute_t object.
- *
+ *
*/
struct private_transform_attribute_t {
/**
* Public transform_attribute_t interface.
*/
transform_attribute_t public;
-
+
/**
* Attribute Format Flag.
- *
+ *
* - TRUE means value is stored in attribute_length_or_value
* - FALSE means value is stored in attribute_value
*/
bool attribute_format;
-
+
/**
* Type of the attribute.
*/
u_int16_t attribute_type;
-
+
/**
* Attribute Length if attribute_format is 0, attribute Value otherwise.
*/
u_int16_t attribute_length_or_value;
-
+
/**
* Attribute value as chunk if attribute_format is 0 (FALSE).
*/
@@ -67,16 +67,16 @@ ENUM_END(transform_attribute_type_name, KEY_LENGTH);
/**
* Encoding rules to parse or generate a Transform attribute.
- *
- * The defined offsets are the positions in a object of type
+ *
+ * The defined offsets are the positions in a object of type
* private_transform_attribute_t.
- *
+ *
*/
encoding_rule_t transform_attribute_encodings[] = {
/* Flag defining the format of this payload */
{ ATTRIBUTE_FORMAT, offsetof(private_transform_attribute_t, attribute_format) },
/* type of the attribute as 15 bit unsigned integer */
- { ATTRIBUTE_TYPE, offsetof(private_transform_attribute_t, attribute_type) },
+ { ATTRIBUTE_TYPE, offsetof(private_transform_attribute_t, attribute_type) },
/* Length or value, depending on the attribute format flag */
{ ATTRIBUTE_LENGTH_OR_VALUE, offsetof(private_transform_attribute_t, attribute_length_or_value) },
/* Value of attribute if attribute format flag is zero */
@@ -104,7 +104,7 @@ static status_t verify(private_transform_attribute_t *this)
{
return FAILED;
}
-
+
return SUCCESS;
}
@@ -164,16 +164,16 @@ static void set_value_chunk(private_transform_attribute_t *this, chunk_t value)
free(this->attribute_value.ptr);
this->attribute_value.ptr = NULL;
this->attribute_value.len = 0;
-
+
}
-
+
if (value.len > 2)
{
this->attribute_value.ptr = clalloc(value.ptr,value.len);
this->attribute_value.len = value.len;
this->attribute_length_or_value = value.len;
/* attribute has not a fixed length */
- this->attribute_format = FALSE;
+ this->attribute_format = FALSE;
}
else
{
@@ -192,7 +192,7 @@ static void set_value(private_transform_attribute_t *this, u_int16_t value)
free(this->attribute_value.ptr);
this->attribute_value.ptr = NULL;
this->attribute_value.len = 0;
-
+
}
this->attribute_length_or_value = value;
}
@@ -207,14 +207,14 @@ static chunk_t get_value_chunk (private_transform_attribute_t *this)
if (this->attribute_format == FALSE)
{
value.ptr = this->attribute_value.ptr;
- value.len = this->attribute_value.len;
+ value.len = this->attribute_value.len;
}
else
{
value.ptr = (void *) &(this->attribute_length_or_value);
value.len = 2;
}
-
+
return value;
}
@@ -249,19 +249,19 @@ static u_int16_t get_attribute_type (private_transform_attribute_t *this)
static transform_attribute_t * _clone(private_transform_attribute_t *this)
{
private_transform_attribute_t *new_clone;
-
+
new_clone = (private_transform_attribute_t *) transform_attribute_create();
-
+
new_clone->attribute_format = this->attribute_format;
new_clone->attribute_type = this->attribute_type;
new_clone->attribute_length_or_value = this->attribute_length_or_value;
-
+
if (!new_clone->attribute_format)
{
- new_clone->attribute_value.ptr = clalloc(this->attribute_value.ptr,this->attribute_value.len);
+ new_clone->attribute_value.ptr = clalloc(this->attribute_value.ptr,this->attribute_value.len);
new_clone->attribute_value.len = this->attribute_value.len;
}
-
+
return (transform_attribute_t *) new_clone;
}
@@ -273,7 +273,7 @@ static void destroy(private_transform_attribute_t *this)
if (this->attribute_value.ptr != NULL)
{
free(this->attribute_value.ptr);
- }
+ }
free(this);
}
@@ -292,7 +292,7 @@ transform_attribute_t *transform_attribute_create()
this->public.payload_interface.set_next_type = (void (*) (payload_t *,payload_type_t)) set_next_type;
this->public.payload_interface.get_type = (payload_type_t (*) (payload_t *)) get_type;
this->public.payload_interface.destroy = (void (*) (payload_t *))destroy;
-
+
/* public functions */
this->public.set_value_chunk = (void (*) (transform_attribute_t *,chunk_t)) set_value_chunk;
this->public.set_value = (void (*) (transform_attribute_t *,u_int16_t)) set_value;
@@ -302,7 +302,7 @@ transform_attribute_t *transform_attribute_create()
this->public.get_attribute_type = (u_int16_t (*) (transform_attribute_t *)) get_attribute_type;
this->public.clone = (transform_attribute_t * (*) (transform_attribute_t *)) _clone;
this->public.destroy = (void (*) (transform_attribute_t *)) destroy;
-
+
/* set default values of the fields */
this->attribute_format = TRUE;
this->attribute_type = 0;
diff --git a/src/charon/encoding/payloads/transform_attribute.h b/src/charon/encoding/payloads/transform_attribute.h
index f7d71a9df..a5fe0154b 100644
--- a/src/charon/encoding/payloads/transform_attribute.h
+++ b/src/charon/encoding/payloads/transform_attribute.h
@@ -37,14 +37,14 @@ enum transform_attribute_type_t {
KEY_LENGTH = 14
};
-/**
+/**
* enum name for transform_attribute_type_t.
*/
extern enum_name_t *transform_attribute_type_names;
/**
* Class representing an IKEv2- TRANSFORM Attribute.
- *
+ *
* The TRANSFORM ATTRIBUTE format is described in RFC section 3.3.5.
*/
struct transform_attribute_t {
@@ -55,52 +55,52 @@ struct transform_attribute_t {
/**
* Returns the currently set value of the attribute.
- *
+ *
* Returned data are not copied.
- *
+ *
* @return chunk_t pointing to the value
*/
chunk_t (*get_value_chunk) (transform_attribute_t *this);
-
+
/**
* Returns the currently set value of the attribute.
- *
+ *
* Returned data are not copied.
- *
+ *
* @return value
*/
u_int16_t (*get_value) (transform_attribute_t *this);
-
+
/**
* Sets the value of the attribute.
- *
+ *
* Value is getting copied.
- *
+ *
* @param value chunk_t pointing to the value to set
*/
void (*set_value_chunk) (transform_attribute_t *this, chunk_t value);
/**
* Sets the value of the attribute.
- *
+ *
* @param value value to set
*/
void (*set_value) (transform_attribute_t *this, u_int16_t value);
/**
* Sets the type of the attribute.
- *
+ *
* @param type type to set (most significant bit is set to zero)
*/
void (*set_attribute_type) (transform_attribute_t *this, u_int16_t type);
-
+
/**
* get the type of the attribute.
- *
+ *
* @return type of the value
*/
u_int16_t (*get_attribute_type) (transform_attribute_t *this);
-
+
/**
* Clones an transform_attribute_t object.
*
@@ -116,14 +116,14 @@ struct transform_attribute_t {
/**
* Creates an empty transform_attribute_t object.
- *
+ *
* @return transform_attribute_t object
*/
transform_attribute_t *transform_attribute_create(void);
/**
* Creates an transform_attribute_t of type KEY_LENGTH.
- *
+ *
* @param key_length key length in bytes
* @return transform_attribute_t object
*/
diff --git a/src/charon/encoding/payloads/transform_substructure.c b/src/charon/encoding/payloads/transform_substructure.c
index 497bd53b2..c94f6c1a2 100644
--- a/src/charon/encoding/payloads/transform_substructure.c
+++ b/src/charon/encoding/payloads/transform_substructure.c
@@ -29,37 +29,37 @@ typedef struct private_transform_substructure_t private_transform_substructure_t
/**
* Private data of an transform_substructure_t object.
- *
+ *
*/
struct private_transform_substructure_t {
/**
* Public transform_substructure_t interface.
*/
transform_substructure_t public;
-
+
/**
* Next payload type.
*/
u_int8_t next_payload;
-
+
/**
* Length of this payload.
*/
u_int16_t transform_length;
-
-
+
+
/**
* Type of the transform.
*/
u_int8_t transform_type;
-
+
/**
* Transform ID.
*/
u_int16_t transform_id;
-
- /**
+
+ /**
* Transforms Attributes are stored in a linked_list_t.
*/
linked_list_t *attributes;
@@ -68,25 +68,25 @@ struct private_transform_substructure_t {
/**
* Encoding rules to parse or generate a Transform substructure.
- *
- * The defined offsets are the positions in a object of type
+ *
+ * The defined offsets are the positions in a object of type
* private_transform_substructure_t.
- *
+ *
*/
encoding_rule_t transform_substructure_encodings[] = {
- /* 1 Byte next payload type, stored in the field next_payload */
+ /* 1 Byte next payload type, stored in the field next_payload */
{ U_INT_8, offsetof(private_transform_substructure_t, next_payload) },
/* Reserved Byte is skipped */
- { RESERVED_BYTE, 0 },
+ { RESERVED_BYTE, 0 },
/* Length of the whole transform substructure*/
- { PAYLOAD_LENGTH, offsetof(private_transform_substructure_t, transform_length) },
+ { PAYLOAD_LENGTH, offsetof(private_transform_substructure_t, transform_length) },
/* transform type is a number of 8 bit */
- { U_INT_8, offsetof(private_transform_substructure_t, transform_type) },
+ { U_INT_8, offsetof(private_transform_substructure_t, transform_type) },
/* Reserved Byte is skipped */
- { RESERVED_BYTE, 0 },
+ { RESERVED_BYTE, 0 },
/* tranform ID is a number of 8 bit */
- { U_INT_16, offsetof(private_transform_substructure_t, transform_id) },
- /* Attributes are stored in a transform attribute,
+ { U_INT_16, offsetof(private_transform_substructure_t, transform_id) },
+ /* Attributes are stored in a transform attribute,
offset points to a linked_list_t pointer */
{ TRANSFORM_ATTRIBUTES, offsetof(private_transform_substructure_t, attributes) }
};
@@ -114,7 +114,7 @@ static status_t verify(private_transform_substructure_t *this)
status_t status = SUCCESS;
iterator_t *iterator;
payload_t *current_attributes;
-
+
if ((this->next_payload != NO_PAYLOAD) && (this->next_payload != 3))
{
/* must be 0 or 3 */
@@ -139,7 +139,7 @@ static status_t verify(private_transform_substructure_t *this)
}
}
iterator = this->attributes->create_iterator(this->attributes,TRUE);
-
+
while(iterator->iterate(iterator, (void**)&current_attributes))
{
status = current_attributes->verify(current_attributes);
@@ -149,8 +149,8 @@ static status_t verify(private_transform_substructure_t *this)
}
}
iterator->destroy(iterator);
-
- /* proposal number is checked in SA payload */
+
+ /* proposal number is checked in SA payload */
return status;
}
@@ -187,14 +187,14 @@ static void compute_length (private_transform_substructure_t *this)
iterator_t *iterator;
payload_t *current_attribute;
size_t length = TRANSFORM_SUBSTRUCTURE_HEADER_LENGTH;
-
+
iterator = this->attributes->create_iterator(this->attributes,TRUE);
while (iterator->iterate(iterator, (void**)&current_attribute))
{
length += current_attribute->get_length(current_attribute);
}
iterator->destroy(iterator);
-
+
this->transform_length = length;
}
@@ -254,7 +254,7 @@ static void set_transform_type (private_transform_substructure_t *this,u_int8_t
{
this->transform_type = type;
}
-
+
/**
* Implementation of transform_substructure_t.get_transform_type.
*/
@@ -270,7 +270,7 @@ static void set_transform_id (private_transform_substructure_t *this,u_int16_t i
{
this->transform_id = id;
}
-
+
/**
* Implementation of transform_substructure_t.get_transform_id.
*/
@@ -287,20 +287,20 @@ static transform_substructure_t *clone_(private_transform_substructure_t *this)
private_transform_substructure_t *clone;
iterator_t *attributes;
transform_attribute_t *current_attribute;
-
+
clone = (private_transform_substructure_t *) transform_substructure_create();
clone->next_payload = this->next_payload;
clone->transform_type = this->transform_type;
clone->transform_id = this->transform_id;
-
+
attributes = this->attributes->create_iterator(this->attributes, FALSE);
while (attributes->iterate(attributes, (void**)&current_attribute))
{
current_attribute = current_attribute->clone(current_attribute);
clone->public.add_transform_attribute(&clone->public, current_attribute);
}
- attributes->destroy(attributes);
-
+ attributes->destroy(attributes);
+
return &clone->public;
}
@@ -312,14 +312,14 @@ static status_t get_key_length(private_transform_substructure_t *this, u_int16_t
{
iterator_t *attributes;
transform_attribute_t *current_attribute;
-
+
attributes = this->attributes->create_iterator(this->attributes, TRUE);
while (attributes->iterate(attributes, (void**)&current_attribute))
{
if (current_attribute->get_attribute_type(current_attribute) == KEY_LENGTH)
{
*key_length = current_attribute->get_value(current_attribute);
- attributes->destroy(attributes);
+ attributes->destroy(attributes);
return SUCCESS;
}
}
@@ -350,10 +350,10 @@ transform_substructure_t *transform_substructure_create()
this->public.payload_interface.get_encoding_rules = (void (*) (payload_t *, encoding_rule_t **, size_t *) ) get_encoding_rules;
this->public.payload_interface.get_length = (size_t (*) (payload_t *)) get_length;
this->public.payload_interface.get_next_type = (payload_type_t (*) (payload_t *)) get_next_type;
- this->public.payload_interface.set_next_type = (void (*) (payload_t *,payload_type_t)) set_next_type;
+ this->public.payload_interface.set_next_type = (void (*) (payload_t *,payload_type_t)) set_next_type;
this->public.payload_interface.get_type = (payload_type_t (*) (payload_t *)) get_type;
this->public.payload_interface.destroy = (void (*) (payload_t *))destroy;
-
+
/* public functions */
this->public.create_transform_attribute_iterator = (iterator_t * (*) (transform_substructure_t *,bool)) create_transform_attribute_iterator;
this->public.add_transform_attribute = (void (*) (transform_substructure_t *,transform_attribute_t *)) add_transform_attribute;
@@ -366,14 +366,14 @@ transform_substructure_t *transform_substructure_create()
this->public.get_key_length = (status_t (*) (transform_substructure_t *,u_int16_t *)) get_key_length;
this->public.clone = (transform_substructure_t* (*) (transform_substructure_t *)) clone_;
this->public.destroy = (void (*) (transform_substructure_t *)) destroy;
-
+
/* set default values of the fields */
this->next_payload = NO_PAYLOAD;
this->transform_length = TRANSFORM_SUBSTRUCTURE_HEADER_LENGTH;
this->transform_id = 0;
this->transform_type = 0;
this->attributes = linked_list_create();
-
+
return (&(this->public));
}
@@ -385,17 +385,17 @@ transform_substructure_t *transform_substructure_create_type(
u_int16_t transform_id, u_int16_t key_length)
{
transform_substructure_t *transform = transform_substructure_create();
-
+
transform->set_transform_type(transform,transform_type);
transform->set_transform_id(transform,transform_id);
-
+
if (key_length)
{
transform_attribute_t *attribute;
-
+
attribute = transform_attribute_create_key_length(key_length);
transform->add_transform_attribute(transform, attribute);
-
+
}
return transform;
}
diff --git a/src/charon/encoding/payloads/transform_substructure.h b/src/charon/encoding/payloads/transform_substructure.h
index b02a94a6c..5d31f8c0a 100644
--- a/src/charon/encoding/payloads/transform_substructure.h
+++ b/src/charon/encoding/payloads/transform_substructure.h
@@ -48,7 +48,7 @@ typedef struct transform_substructure_t transform_substructure_t;
/**
* Class representing an IKEv2- TRANSFORM SUBSTRUCTURE.
- *
+ *
* The TRANSFORM SUBSTRUCTURE format is described in RFC section 3.3.2.
*/
struct transform_substructure_t {
@@ -56,12 +56,12 @@ struct transform_substructure_t {
* The payload_t interface.
*/
payload_t payload_interface;
-
+
/**
* Creates an iterator of stored transform_attribute_t objects.
- *
- * When deleting an transform attribute using this iterator,
- * the length of this transform substructure has to be refreshed
+ *
+ * When deleting an transform attribute using this iterator,
+ * the length of this transform substructure has to be refreshed
* by calling get_length().
*
* @param forward iterator direction (TRUE: front to end)
@@ -69,7 +69,7 @@ struct transform_substructure_t {
*/
iterator_t * (*create_transform_attribute_iterator) (
transform_substructure_t *this, bool forward);
-
+
/**
* Adds a transform_attribute_t object to this object.
*
@@ -77,59 +77,59 @@ struct transform_substructure_t {
*/
void (*add_transform_attribute) (transform_substructure_t *this,
transform_attribute_t *attribute);
-
+
/**
* Sets the next_payload field of this substructure
- *
+ *
* If this is the last transform, next payload field is set to 0,
* otherwise to 3
*
* @param is_last When TRUE, next payload field is set to 0, otherwise to 3
*/
void (*set_is_last_transform) (transform_substructure_t *this, bool is_last);
-
+
/**
* Checks if this is the last transform.
- *
+ *
* @return TRUE if this is the last Transform, FALSE otherwise
*/
bool (*get_is_last_transform) (transform_substructure_t *this);
-
+
/**
* Sets transform type of the current transform substructure.
*
* @param type type value to set
*/
void (*set_transform_type) (transform_substructure_t *this, u_int8_t type);
-
+
/**
* get transform type of the current transform.
- *
+ *
* @return Transform type of current transform substructure.
*/
u_int8_t (*get_transform_type) (transform_substructure_t *this);
-
+
/**
* Sets transform id of the current transform substructure.
*
* @param id transform id to set
*/
void (*set_transform_id) (transform_substructure_t *this, u_int16_t id);
-
+
/**
* get transform id of the current transform.
- *
+ *
* @return Transform id of current transform substructure.
*/
u_int16_t (*get_transform_id) (transform_substructure_t *this);
-
+
/**
* get transform id of the current transform.
- *
- * @param key_length The key length is written to this location
- * @return
+ *
+ * @param key_length The key length is written to this location
+ * @return
* - SUCCESS if a key length attribute is contained
- * - FAILED if no key length attribute is part of this
+ * - FAILED if no key length attribute is part of this
* transform or key length uses more then 16 bit!
*/
status_t (*get_key_length) (transform_substructure_t *this,
@@ -150,18 +150,18 @@ struct transform_substructure_t {
/**
* Creates an empty transform_substructure_t object.
- *
+ *
* @return created transform_substructure_t object
*/
transform_substructure_t *transform_substructure_create(void);
/**
* Creates an empty transform_substructure_t object.
- *
+ *
* The key length is used for the transport types ENCRYPTION_ALGORITHM,
- * PSEUDO_RANDOM_FUNCTION, INTEGRITY_ALGORITHM. For all
+ * PSEUDO_RANDOM_FUNCTION, INTEGRITY_ALGORITHM. For all
* other transport types the key_length parameter is not used
- *
+ *
* @param transform_type type of transform to create
* @param transform_id transform id specifying the specific algorithm of a transform type
* @param key_length Key length for key lenght attribute
diff --git a/src/charon/encoding/payloads/ts_payload.c b/src/charon/encoding/payloads/ts_payload.c
index 92ddc380f..6bf3e4293 100644
--- a/src/charon/encoding/payloads/ts_payload.c
+++ b/src/charon/encoding/payloads/ts_payload.c
@@ -25,19 +25,19 @@ typedef struct private_ts_payload_t private_ts_payload_t;
/**
* Private data of an ts_payload_t object.
- *
+ *
*/
struct private_ts_payload_t {
/**
* Public ts_payload_t interface.
*/
ts_payload_t public;
-
+
/**
* TRUE if this TS payload is of type TSi, FALSE for TSr.
*/
bool is_initiator;
-
+
/**
* Next payload type.
*/
@@ -47,17 +47,17 @@ struct private_ts_payload_t {
* Critical flag.
*/
bool critical;
-
+
/**
* Length of this payload.
*/
u_int16_t payload_length;
-
+
/**
* Number of traffic selectors
*/
u_int8_t number_of_traffic_selectors;
-
+
/**
* Contains the traffic selectors of type traffic_selector_substructure_t.
*/
@@ -66,17 +66,17 @@ struct private_ts_payload_t {
/**
* Encoding rules to parse or generate a TS payload
- *
- * The defined offsets are the positions in a object of type
+ *
+ * The defined offsets are the positions in a object of type
* private_ts_payload_t.
- *
+ *
*/
encoding_rule_t ts_payload_encodings[] = {
- /* 1 Byte next payload type, stored in the field next_payload */
+ /* 1 Byte next payload type, stored in the field next_payload */
{ U_INT_8, offsetof(private_ts_payload_t, next_payload) },
/* the critical bit */
{ FLAG, offsetof(private_ts_payload_t, critical) },
- /* 7 Bit reserved bits, nowhere stored */
+ /* 7 Bit reserved bits, nowhere stored */
{ RESERVED_BIT, 0 },
{ RESERVED_BIT, 0 },
{ RESERVED_BIT, 0 },
@@ -84,9 +84,9 @@ encoding_rule_t ts_payload_encodings[] = {
{ RESERVED_BIT, 0 },
{ RESERVED_BIT, 0 },
{ RESERVED_BIT, 0 },
- /* Length of the whole payload*/
+ /* Length of the whole payload*/
{ PAYLOAD_LENGTH, offsetof(private_ts_payload_t, payload_length)},
- /* 1 Byte TS type*/
+ /* 1 Byte TS type*/
{ U_INT_8, offsetof(private_ts_payload_t, number_of_traffic_selectors) },
/* 3 reserved bytes */
{ RESERVED_BYTE, 0 },
@@ -118,13 +118,13 @@ static status_t verify(private_ts_payload_t *this)
iterator_t *iterator;
payload_t *current_traffic_selector;
status_t status = SUCCESS;
-
+
if (this->number_of_traffic_selectors != (this->traffic_selectors->get_count(this->traffic_selectors)))
{
/* must be the same */
return FAILED;
}
-
+
iterator = this->traffic_selectors->create_iterator(this->traffic_selectors,TRUE);
while(iterator->iterate(iterator, (void**)&current_traffic_selector))
{
@@ -135,7 +135,7 @@ static status_t verify(private_ts_payload_t *this)
}
}
iterator->destroy(iterator);
-
+
return status;
}
@@ -188,7 +188,7 @@ static void compute_length (private_ts_payload_t *this)
size_t ts_count = 0;
size_t length = TS_PAYLOAD_HEADER_LENGTH;
payload_t *current_traffic_selector;
-
+
iterator = this->traffic_selectors->create_iterator(this->traffic_selectors,TRUE);
while (iterator->iterate(iterator, (void**)&current_traffic_selector))
{
@@ -196,9 +196,9 @@ static void compute_length (private_ts_payload_t *this)
ts_count++;
}
iterator->destroy(iterator);
-
+
this->number_of_traffic_selectors= ts_count;
- this->payload_length = length;
+ this->payload_length = length;
}
/**
@@ -252,7 +252,7 @@ static linked_list_t *get_traffic_selectors(private_ts_payload_t *this)
iterator_t *iterator;
traffic_selector_substructure_t *ts_substructure;
linked_list_t *ts_list = linked_list_create();
-
+
iterator = this->traffic_selectors->create_iterator(this->traffic_selectors, TRUE);
while (iterator->iterate(iterator, (void**)&ts_substructure))
{
@@ -260,7 +260,7 @@ static linked_list_t *get_traffic_selectors(private_ts_payload_t *this)
ts_list->insert_last(ts_list, (void*)ts);
}
iterator->destroy(iterator);
-
+
return ts_list;
}
@@ -289,7 +289,7 @@ ts_payload_t *ts_payload_create(bool is_initiator)
this->public.payload_interface.set_next_type = (void (*) (payload_t *,payload_type_t)) set_next_type;
this->public.payload_interface.get_type = (payload_type_t (*) (payload_t *)) get_payload_type;
this->public.payload_interface.destroy = (void (*) (payload_t *))destroy;
-
+
/* public functions */
this->public.destroy = (void (*) (ts_payload_t *)) destroy;
this->public.get_initiator = (bool (*) (ts_payload_t *)) get_initiator;
@@ -297,14 +297,14 @@ ts_payload_t *ts_payload_create(bool is_initiator)
this->public.add_traffic_selector_substructure = (void (*) (ts_payload_t *,traffic_selector_substructure_t *)) add_traffic_selector_substructure;
this->public.create_traffic_selector_substructure_iterator = (iterator_t* (*) (ts_payload_t *,bool)) create_traffic_selector_substructure_iterator;
this->public.get_traffic_selectors = (linked_list_t *(*) (ts_payload_t *)) get_traffic_selectors;
-
+
/* private variables */
this->critical = FALSE;
this->next_payload = NO_PAYLOAD;
this->payload_length =TS_PAYLOAD_HEADER_LENGTH;
this->is_initiator = is_initiator;
this->number_of_traffic_selectors = 0;
- this->traffic_selectors = linked_list_create();
+ this->traffic_selectors = linked_list_create();
return &(this->public);
}
@@ -318,9 +318,9 @@ ts_payload_t *ts_payload_create_from_traffic_selectors(bool is_initiator, linked
traffic_selector_t *ts;
traffic_selector_substructure_t *ts_substructure;
private_ts_payload_t *this;
-
+
this = (private_ts_payload_t*)ts_payload_create(is_initiator);
-
+
iterator = traffic_selectors->create_iterator(traffic_selectors, TRUE);
while (iterator->iterate(iterator, (void**)&ts))
{
@@ -328,7 +328,7 @@ ts_payload_t *ts_payload_create_from_traffic_selectors(bool is_initiator, linked
this->public.add_traffic_selector_substructure(&(this->public), ts_substructure);
}
iterator->destroy(iterator);
-
+
return &(this->public);
}
diff --git a/src/charon/encoding/payloads/ts_payload.h b/src/charon/encoding/payloads/ts_payload.h
index 3c8a6d595..d322ff1a8 100644
--- a/src/charon/encoding/payloads/ts_payload.h
+++ b/src/charon/encoding/payloads/ts_payload.h
@@ -27,7 +27,7 @@ typedef struct ts_payload_t ts_payload_t;
#include <library.h>
#include <utils/linked_list.h>
-#include <config/traffic_selector.h>
+#include <selectors/traffic_selector.h>
#include <encoding/payloads/payload.h>
#include <encoding/payloads/traffic_selector_substructure.h>
@@ -47,7 +47,7 @@ struct ts_payload_t {
* The payload_t interface.
*/
payload_t payload_interface;
-
+
/**
* Get the type of TSpayload (TSi or TSr).
*
@@ -56,16 +56,16 @@ struct ts_payload_t {
* - FALSE if this payload is of type TSr
*/
bool (*get_initiator) (ts_payload_t *this);
-
+
/**
* Set the type of TS payload (TSi or TSr).
*
- * @param is_initiator
+ * @param is_initiator
* - TRUE if this payload is of type TSi
* - FALSE if this payload is of type TSr
*/
void (*set_initiator) (ts_payload_t *this,bool is_initiator);
-
+
/**
* Adds a traffic_selector_substructure_t object to this object.
*
@@ -73,12 +73,12 @@ struct ts_payload_t {
*/
void (*add_traffic_selector_substructure) (ts_payload_t *this,
traffic_selector_substructure_t *traffic_selector);
-
+
/**
* Creates an iterator of stored traffic_selector_substructure_t objects.
- *
- * When removing an traffic_selector_substructure_t object
- * using this iterator, the length of this payload
+ *
+ * When removing an traffic_selector_substructure_t object
+ * using this iterator, the length of this payload
* has to get refreshed by calling payload_t.get_length!
*
* @param forward iterator direction (TRUE: front to end)
@@ -86,10 +86,10 @@ struct ts_payload_t {
*/
iterator_t *(*create_traffic_selector_substructure_iterator) (
ts_payload_t *this, bool forward);
-
+
/**
* Get a list of nested traffic selectors as traffic_selector_t.
- *
+ *
* Resulting list and its traffic selectors must be destroyed after usage
*
* @return list of traffic selectors
@@ -104,8 +104,8 @@ struct ts_payload_t {
/**
* Creates an empty ts_payload_t object.
- *
- * @param is_initiator
+ *
+ * @param is_initiator
* - TRUE if this payload is of type TSi
* - FALSE if this payload is of type TSr
* @return ts_payload_t object
@@ -114,14 +114,14 @@ ts_payload_t *ts_payload_create(bool is_initiator);
/**
* Creates ts_payload with a list of traffic_selector_t
- *
- * @param is_initiator
+ *
+ * @param is_initiator
* - TRUE if this payload is of type TSi
* - FALSE if this payload is of type TSr
* @param traffic_selectors list of traffic selectors to include
* @return ts_payload_t object
*/
-ts_payload_t *ts_payload_create_from_traffic_selectors(bool is_initiator,
+ts_payload_t *ts_payload_create_from_traffic_selectors(bool is_initiator,
linked_list_t *traffic_selectors);
#endif /** TS_PAYLOAD_H_ @}*/
diff --git a/src/charon/encoding/payloads/unknown_payload.c b/src/charon/encoding/payloads/unknown_payload.c
index 309663233..dd5547dc3 100644
--- a/src/charon/encoding/payloads/unknown_payload.c
+++ b/src/charon/encoding/payloads/unknown_payload.c
@@ -26,12 +26,12 @@ typedef struct private_unknown_payload_t private_unknown_payload_t;
* Private data of an unknown_payload_t object.
*/
struct private_unknown_payload_t {
-
+
/**
* Public unknown_payload_t interface.
*/
unknown_payload_t public;
-
+
/**
* Next payload type.
*/
@@ -41,12 +41,12 @@ struct private_unknown_payload_t {
* Critical flag.
*/
bool critical;
-
+
/**
* Length of this payload.
*/
u_int16_t payload_length;
-
+
/**
* The contained data.
*/
@@ -55,17 +55,17 @@ struct private_unknown_payload_t {
/**
* Encoding rules to parse an payload which is not further specified.
- *
- * The defined offsets are the positions in a object of type
+ *
+ * The defined offsets are the positions in a object of type
* private_unknown_payload_t.
- *
+ *
*/
encoding_rule_t unknown_payload_encodings[] = {
- /* 1 Byte next payload type, stored in the field next_payload */
+ /* 1 Byte next payload type, stored in the field next_payload */
{ U_INT_8, offsetof(private_unknown_payload_t, next_payload)},
/* the critical bit */
{ FLAG, offsetof(private_unknown_payload_t, critical) },
- /* 7 Bit reserved bits, nowhere stored */
+ /* 7 Bit reserved bits, nowhere stored */
{ RESERVED_BIT, 0 },
{ RESERVED_BIT, 0 },
{ RESERVED_BIT, 0 },
@@ -146,7 +146,7 @@ static size_t get_length(private_unknown_payload_t *this)
*/
static bool is_critical(private_unknown_payload_t *this)
{
- return this->critical;
+ return this->critical;
}
/**
@@ -166,8 +166,8 @@ static void destroy(private_unknown_payload_t *this)
{
chunk_free(&(this->data));
}
-
- free(this);
+
+ free(this);
}
/*
@@ -185,12 +185,12 @@ unknown_payload_t *unknown_payload_create()
this->public.payload_interface.set_next_type = (void (*) (payload_t *,payload_type_t)) set_next_type;
this->public.payload_interface.get_type = (payload_type_t (*) (payload_t *)) get_payload_type;
this->public.payload_interface.destroy = (void (*) (payload_t *))destroy;
-
+
/* public functions */
this->public.destroy = (void (*) (unknown_payload_t *)) destroy;
this->public.is_critical = (bool (*) (unknown_payload_t *)) is_critical;
this->public.get_data = (chunk_t (*) (unknown_payload_t *)) get_data;
-
+
/* private variables */
this->critical = FALSE;
this->next_payload = NO_PAYLOAD;
diff --git a/src/charon/encoding/payloads/unknown_payload.h b/src/charon/encoding/payloads/unknown_payload.h
index 44b6e1a71..c761ed2b6 100644
--- a/src/charon/encoding/payloads/unknown_payload.h
+++ b/src/charon/encoding/payloads/unknown_payload.h
@@ -40,29 +40,29 @@ typedef struct unknown_payload_t unknown_payload_t;
* a check for the critical bit in the header.
*/
struct unknown_payload_t {
-
+
/**
* The payload_t interface.
*/
payload_t payload_interface;
-
+
/**
- * Get the raw data of this payload, without
+ * Get the raw data of this payload, without
* the generic payload header.
- *
+ *
* Returned data are NOT copied and must not be freed.
*
* @return data as chunk_t
*/
chunk_t (*get_data) (unknown_payload_t *this);
-
+
/**
* Get the critical flag.
*
* @return TRUE if payload is critical, FALSE if not
*/
bool (*is_critical) (unknown_payload_t *this);
-
+
/**
* Destroys an unknown_payload_t object.
*/
@@ -71,7 +71,7 @@ struct unknown_payload_t {
/**
* Creates an empty unknown_payload_t object.
- *
+ *
* @return unknown_payload_t object
*/
unknown_payload_t *unknown_payload_create(void);
diff --git a/src/charon/encoding/payloads/vendor_id_payload.c b/src/charon/encoding/payloads/vendor_id_payload.c
index 52d9e12a5..bf33d2418 100644
--- a/src/charon/encoding/payloads/vendor_id_payload.c
+++ b/src/charon/encoding/payloads/vendor_id_payload.c
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2005-2006 Martin Willi
+ * Copyright (C) 2005-2009 Martin Willi
* Copyright (C) 2005 Jan Hutter
* Hochschule fuer Technik Rapperswil
*
@@ -18,19 +18,18 @@
#include "vendor_id_payload.h"
-
typedef struct private_vendor_id_payload_t private_vendor_id_payload_t;
/**
* Private data of an vendor_id_payload_t object.
- *
*/
struct private_vendor_id_payload_t {
+
/**
* Public vendor_id_payload_t interface.
*/
vendor_id_payload_t public;
-
+
/**
* Next payload type.
*/
@@ -40,31 +39,30 @@ struct private_vendor_id_payload_t {
* Critical flag.
*/
bool critical;
-
+
/**
* Length of this payload.
*/
u_int16_t payload_length;
-
+
/**
- * The contained vendor_id data value.
+ * The contained data.
*/
- chunk_t vendor_id_data;
+ chunk_t data;
};
/**
* Encoding rules to parse or generate a VENDOR ID payload
- *
- * The defined offsets are the positions in a object of type
+ *
+ * The defined offsets are the positions in a object of type
* private_vendor_id_payload_t.
- *
*/
encoding_rule_t vendor_id_payload_encodings[] = {
- /* 1 Byte next payload type, stored in the field next_payload */
+ /* 1 Byte next payload type, stored in the field next_payload */
{ U_INT_8, offsetof(private_vendor_id_payload_t, next_payload) },
/* the critical bit */
{ FLAG, offsetof(private_vendor_id_payload_t, critical) },
- /* 7 Bit reserved bits, nowhere stored */
+ /* 7 Bit reserved bits, nowhere stored */
{ RESERVED_BIT, 0 },
{ RESERVED_BIT, 0 },
{ RESERVED_BIT, 0 },
@@ -75,7 +73,7 @@ encoding_rule_t vendor_id_payload_encodings[] = {
/* Length of the whole payload*/
{ PAYLOAD_LENGTH, offsetof(private_vendor_id_payload_t, payload_length)},
/* some vendor_id data bytes, length is defined in PAYLOAD_LENGTH */
- { VID_DATA, offsetof(private_vendor_id_payload_t, vendor_id_data) }
+ { VID_DATA, offsetof(private_vendor_id_payload_t, data) }
};
/*
@@ -101,7 +99,8 @@ static status_t verify(private_vendor_id_payload_t *this)
/**
* Implementation of vendor_id_payload_t.get_encoding_rules.
*/
-static void get_encoding_rules(private_vendor_id_payload_t *this, encoding_rule_t **rules, size_t *rule_count)
+static void get_encoding_rules(private_vendor_id_payload_t *this,
+ encoding_rule_t **rules, size_t *rule_count)
{
*rules = vendor_id_payload_encodings;
*rule_count = sizeof(vendor_id_payload_encodings) / sizeof(encoding_rule_t);
@@ -120,7 +119,7 @@ static payload_type_t get_payload_type(private_vendor_id_payload_t *this)
*/
static payload_type_t get_next_type(private_vendor_id_payload_t *this)
{
- return (this->next_payload);
+ return this->next_payload;
}
/**
@@ -140,40 +139,11 @@ static size_t get_length(private_vendor_id_payload_t *this)
}
/**
- * Implementation of vendor_id_payload_t.set_data.
- */
-static void set_data (private_vendor_id_payload_t *this, chunk_t data)
-{
- if (this->vendor_id_data.ptr != NULL)
- {
- chunk_free(&(this->vendor_id_data));
- }
- this->vendor_id_data.ptr = clalloc(data.ptr,data.len);
- this->vendor_id_data.len = data.len;
- this->payload_length = VENDOR_ID_PAYLOAD_HEADER_LENGTH + this->vendor_id_data.len;
-}
-
-/**
* Implementation of vendor_id_payload_t.get_data.
*/
-static chunk_t get_data (private_vendor_id_payload_t *this)
-{
- return (this->vendor_id_data);
-}
-
-/**
- * Implementation of vendor_id_payload_t.get_data_clone.
- */
-static chunk_t get_data_clone (private_vendor_id_payload_t *this)
+static chunk_t get_data(private_vendor_id_payload_t *this)
{
- chunk_t cloned_data;
- if (this->vendor_id_data.ptr == NULL)
- {
- return (this->vendor_id_data);
- }
- cloned_data.ptr = clalloc(this->vendor_id_data.ptr,this->vendor_id_data.len);
- cloned_data.len = this->vendor_id_data.len;
- return cloned_data;
+ return this->data;
}
/**
@@ -181,11 +151,8 @@ static chunk_t get_data_clone (private_vendor_id_payload_t *this)
*/
static void destroy(private_vendor_id_payload_t *this)
{
- if (this->vendor_id_data.ptr != NULL)
- {
- chunk_free(&(this->vendor_id_data));
- }
- free(this);
+ free(this->data.ptr);
+ free(this);
}
/*
@@ -195,7 +162,6 @@ vendor_id_payload_t *vendor_id_payload_create()
{
private_vendor_id_payload_t *this = malloc_thing(private_vendor_id_payload_t);
- /* interface functions */
this->public.payload_interface.verify = (status_t (*) (payload_t *))verify;
this->public.payload_interface.get_encoding_rules = (void (*) (payload_t *, encoding_rule_t **, size_t *) ) get_encoding_rules;
this->public.payload_interface.get_length = (size_t (*) (payload_t *)) get_length;
@@ -203,18 +169,27 @@ vendor_id_payload_t *vendor_id_payload_create()
this->public.payload_interface.set_next_type = (void (*) (payload_t *,payload_type_t)) set_next_type;
this->public.payload_interface.get_type = (payload_type_t (*) (payload_t *)) get_payload_type;
this->public.payload_interface.destroy = (void (*) (payload_t *))destroy;
-
- /* public functions */
- this->public.destroy = (void (*) (vendor_id_payload_t *)) destroy;
- this->public.set_data = (void (*) (vendor_id_payload_t *,chunk_t)) set_data;
- this->public.get_data_clone = (chunk_t (*) (vendor_id_payload_t *)) get_data_clone;
this->public.get_data = (chunk_t (*) (vendor_id_payload_t *)) get_data;
-
- /* private variables */
+
this->critical = FALSE;
this->next_payload = NO_PAYLOAD;
this->payload_length = VENDOR_ID_PAYLOAD_HEADER_LENGTH;
- this->vendor_id_data = chunk_empty;
+ this->data = chunk_empty;
- return (&(this->public));
+ return &this->public;
}
+
+/*
+ * Described in header
+ */
+vendor_id_payload_t *vendor_id_payload_create_data(chunk_t data)
+{
+ private_vendor_id_payload_t *this;
+
+ this = (private_vendor_id_payload_t*)vendor_id_payload_create();
+ this->payload_length += data.len;
+ this->data = data;
+
+ return &this->public;
+}
+
diff --git a/src/charon/encoding/payloads/vendor_id_payload.h b/src/charon/encoding/payloads/vendor_id_payload.h
index 9ee9ea1d4..241535cac 100644
--- a/src/charon/encoding/payloads/vendor_id_payload.h
+++ b/src/charon/encoding/payloads/vendor_id_payload.h
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2005-2006 Martin Willi
+ * Copyright (C) 2005-2009 Martin Willi
* Copyright (C) 2005 Jan Hutter
* Hochschule fuer Technik Rapperswil
*
@@ -32,56 +32,39 @@ typedef struct vendor_id_payload_t vendor_id_payload_t;
*/
#define VENDOR_ID_PAYLOAD_HEADER_LENGTH 4
-
/**
* Class representing an IKEv2 VENDOR ID payload.
*
* The VENDOR ID payload format is described in RFC section 3.12.
*/
struct vendor_id_payload_t {
+
/**
* The payload_t interface.
*/
payload_t payload_interface;
/**
- * Set the VID data.
- *
- * Data are getting cloned.
- *
- * @param data VID data as chunk_t
- */
- void (*set_data) (vendor_id_payload_t *this, chunk_t data);
-
- /**
- * Get the VID data.
- *
- * Returned data are a copy of the internal one.
- *
- * @return VID data as chunk_t
- */
- chunk_t (*get_data_clone) (vendor_id_payload_t *this);
-
- /**
* Get the VID data.
- *
- * Returned data are NOT copied.
*
- * @return VID data as chunk_t
- */
- chunk_t (*get_data) (vendor_id_payload_t *this);
-
- /**
- * Destroys an vendor_id_payload_t object.
+ * @return VID data, pointing to an internal chunk_t
*/
- void (*destroy) (vendor_id_payload_t *this);
+ chunk_t (*get_data)(vendor_id_payload_t *this);
};
/**
- * Creates an empty vendor_id_payload_t object.
- *
- * @return vendor_id_payload_t object
+ * Creates an empty Vendor ID payload.
+ *
+ * @return vendor ID payload
+ */
+vendor_id_payload_t *vendor_id_payload_create();
+
+/**
+ * Creates a vendor ID payload using a chunk of data
+ *
+ * @param data data to use in vendor ID payload, gets owned by payload
+ * @return vendor ID payload
*/
-vendor_id_payload_t *vendor_id_payload_create(void);
+vendor_id_payload_t *vendor_id_payload_create_data(chunk_t data);
#endif /** VENDOR_ID_PAYLOAD_H_ @}*/
diff --git a/src/charon/kernel/kernel_interface.c b/src/charon/kernel/kernel_interface.c
index 53ae1d200..99bf94e9b 100644
--- a/src/charon/kernel/kernel_interface.c
+++ b/src/charon/kernel/kernel_interface.c
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2008 Tobias Brunner
+ * Copyright (C) 2008-2009 Tobias Brunner
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
@@ -15,8 +15,6 @@
#include "kernel_interface.h"
-#include <pthread.h>
-
#include <daemon.h>
typedef struct private_kernel_interface_t private_kernel_interface_t;
@@ -30,12 +28,12 @@ struct private_kernel_interface_t {
* Public part of kernel_interface_t object.
*/
kernel_interface_t public;
-
+
/**
* ipsec interface
*/
kernel_ipsec_t *ipsec;
-
+
/**
* network interface
*/
@@ -45,7 +43,7 @@ struct private_kernel_interface_t {
/**
* Implementation of kernel_interface_t.get_spi
*/
-static status_t get_spi(private_kernel_interface_t *this, host_t *src, host_t *dst,
+static status_t get_spi(private_kernel_interface_t *this, host_t *src, host_t *dst,
protocol_id_t protocol, u_int32_t reqid, u_int32_t *spi)
{
if (!this->ipsec)
@@ -58,7 +56,7 @@ static status_t get_spi(private_kernel_interface_t *this, host_t *src, host_t *d
/**
* Implementation of kernel_interface_t.get_cpi
*/
-static status_t get_cpi(private_kernel_interface_t *this, host_t *src, host_t *dst,
+static status_t get_cpi(private_kernel_interface_t *this, host_t *src, host_t *dst,
u_int32_t reqid, u_int16_t *cpi)
{
if (!this->ipsec)
@@ -73,26 +71,27 @@ static status_t get_cpi(private_kernel_interface_t *this, host_t *src, host_t *d
*/
static status_t add_sa(private_kernel_interface_t *this, host_t *src, host_t *dst,
u_int32_t spi, protocol_id_t protocol, u_int32_t reqid,
- u_int64_t expire_soft, u_int64_t expire_hard,
+ lifetime_cfg_t *lifetime,
u_int16_t enc_alg, chunk_t enc_key,
u_int16_t int_alg, chunk_t int_key,
ipsec_mode_t mode, u_int16_t ipcomp, u_int16_t cpi, bool encap,
- bool inbound)
+ bool inbound, traffic_selector_t *src_ts,
+ traffic_selector_t *dst_ts)
{
if (!this->ipsec)
{
return NOT_SUPPORTED;
}
return this->ipsec->add_sa(this->ipsec, src, dst, spi, protocol, reqid,
- expire_soft, expire_hard, enc_alg, enc_key, int_alg, int_key,
- mode, ipcomp, cpi, encap, inbound);
+ lifetime, enc_alg, enc_key, int_alg, int_key, mode, ipcomp, cpi,
+ encap, inbound, src_ts, dst_ts);
}
/**
* Implementation of kernel_interface_t.update_sa
*/
static status_t update_sa(private_kernel_interface_t *this, u_int32_t spi,
- protocol_id_t protocol, u_int16_t cpi, host_t *src, host_t *dst,
+ protocol_id_t protocol, u_int16_t cpi, host_t *src, host_t *dst,
host_t *new_src, host_t *new_dst, bool encap, bool new_encap)
{
if (!this->ipsec)
@@ -289,13 +288,13 @@ static status_t get_address_by_ts(private_kernel_interface_t *this,
host_t *host;
int family;
bool found = FALSE;
-
+
DBG2(DBG_KNL, "getting a local address in traffic selector %R", ts);
-
+
/* if we have a family which includes localhost, we do not
* search for an IP, we use the default */
family = ts->get_type(ts) == TS_IPV4_ADDR_RANGE ? AF_INET : AF_INET6;
-
+
if (family == AF_INET)
{
host = host_create_from_string("127.0.0.1", 0);
@@ -304,7 +303,7 @@ static status_t get_address_by_ts(private_kernel_interface_t *this,
{
host = host_create_from_string("::1", 0);
}
-
+
if (ts->includes(ts, host))
{
*ip = host_create_any(family);
@@ -313,7 +312,7 @@ static status_t get_address_by_ts(private_kernel_interface_t *this,
return SUCCESS;
}
host->destroy(host);
-
+
addrs = create_address_enumerator(this, TRUE, TRUE);
while (addrs->enumerate(addrs, (void**)&host))
{
@@ -325,13 +324,13 @@ static status_t get_address_by_ts(private_kernel_interface_t *this,
}
}
addrs->destroy(addrs);
-
+
if (!found)
{
DBG1(DBG_KNL, "no local address found in traffic selector %R", ts);
return FAILED;
}
-
+
DBG2(DBG_KNL, "using host %H", *ip);
return SUCCESS;
}
@@ -395,17 +394,17 @@ static void destroy(private_kernel_interface_t *this)
kernel_interface_t *kernel_interface_create()
{
private_kernel_interface_t *this = malloc_thing(private_kernel_interface_t);
-
+
this->public.get_spi = (status_t(*)(kernel_interface_t*,host_t*,host_t*,protocol_id_t,u_int32_t,u_int32_t*))get_spi;
this->public.get_cpi = (status_t(*)(kernel_interface_t*,host_t*,host_t*,u_int32_t,u_int16_t*))get_cpi;
- this->public.add_sa = (status_t(*)(kernel_interface_t *,host_t*,host_t*,u_int32_t,protocol_id_t,u_int32_t,u_int64_t,u_int64_t,u_int16_t,chunk_t,u_int16_t,chunk_t,ipsec_mode_t,u_int16_t,u_int16_t,bool,bool))add_sa;
+ this->public.add_sa = (status_t(*)(kernel_interface_t *,host_t*,host_t*,u_int32_t,protocol_id_t,u_int32_t,lifetime_cfg_t*,u_int16_t,chunk_t,u_int16_t,chunk_t,ipsec_mode_t,u_int16_t,u_int16_t,bool,bool,traffic_selector_t*,traffic_selector_t*))add_sa;
this->public.update_sa = (status_t(*)(kernel_interface_t*,u_int32_t,protocol_id_t,u_int16_t,host_t*,host_t*,host_t*,host_t*,bool,bool))update_sa;
this->public.query_sa = (status_t(*)(kernel_interface_t*,host_t*,host_t*,u_int32_t,protocol_id_t,u_int64_t*))query_sa;
this->public.del_sa = (status_t(*)(kernel_interface_t*,host_t*,host_t*,u_int32_t,protocol_id_t,u_int16_t))del_sa;
this->public.add_policy = (status_t(*)(kernel_interface_t*,host_t*,host_t*,traffic_selector_t*,traffic_selector_t*,policy_dir_t,u_int32_t,protocol_id_t,u_int32_t,ipsec_mode_t,u_int16_t,u_int16_t,bool))add_policy;
this->public.query_policy = (status_t(*)(kernel_interface_t*,traffic_selector_t*,traffic_selector_t*,policy_dir_t,u_int32_t*))query_policy;
this->public.del_policy = (status_t(*)(kernel_interface_t*,traffic_selector_t*,traffic_selector_t*,policy_dir_t,bool))del_policy;
-
+
this->public.get_source_addr = (host_t*(*)(kernel_interface_t*, host_t *dest, host_t *src))get_source_addr;
this->public.get_nexthop = (host_t*(*)(kernel_interface_t*, host_t *dest))get_nexthop;
this->public.get_interface = (char*(*)(kernel_interface_t*,host_t*))get_interface;
@@ -414,18 +413,18 @@ kernel_interface_t *kernel_interface_create()
this->public.del_ip = (status_t(*)(kernel_interface_t*,host_t*)) del_ip;
this->public.add_route = (status_t(*)(kernel_interface_t*,chunk_t,u_int8_t,host_t*,host_t*,char*)) add_route;
this->public.del_route = (status_t(*)(kernel_interface_t*,chunk_t,u_int8_t,host_t*,host_t*,char*)) del_route;
-
+
this->public.get_address_by_ts = (status_t(*)(kernel_interface_t*,traffic_selector_t*,host_t**))get_address_by_ts;
-
+
this->public.add_ipsec_interface = (void(*)(kernel_interface_t*, kernel_ipsec_constructor_t))add_ipsec_interface;
this->public.remove_ipsec_interface = (void(*)(kernel_interface_t*, kernel_ipsec_constructor_t))remove_ipsec_interface;
this->public.add_net_interface = (void(*)(kernel_interface_t*, kernel_net_constructor_t))add_net_interface;
this->public.remove_net_interface = (void(*)(kernel_interface_t*, kernel_net_constructor_t))remove_net_interface;
-
+
this->public.destroy = (void (*)(kernel_interface_t*))destroy;
-
+
this->ipsec = NULL;
this->net = NULL;
-
+
return &this->public;
}
diff --git a/src/charon/kernel/kernel_interface.h b/src/charon/kernel/kernel_interface.h
index c4a273a34..c39246e72 100644
--- a/src/charon/kernel/kernel_interface.h
+++ b/src/charon/kernel/kernel_interface.h
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2006-2008 Tobias Brunner
+ * Copyright (C) 2006-2009 Tobias Brunner
* Copyright (C) 2006 Daniel Roethlisberger
* Copyright (C) 2005-2006 Martin Willi
* Copyright (C) 2005 Jan Hutter
@@ -45,7 +45,7 @@ typedef kernel_net_t* (*kernel_net_constructor_t)(void);
/**
* Manager and wrapper for different kernel interfaces.
- *
+ *
* The kernel interface handles the communication with the kernel
* for SA and policy management and interface and IP address management.
*/
@@ -61,39 +61,36 @@ struct kernel_interface_t {
* @param spi allocated spi
* @return SUCCESS if operation completed
*/
- status_t (*get_spi)(kernel_interface_t *this, host_t *src, host_t *dst,
+ status_t (*get_spi)(kernel_interface_t *this, host_t *src, host_t *dst,
protocol_id_t protocol, u_int32_t reqid, u_int32_t *spi);
-
+
/**
* Get a Compression Parameter Index (CPI) from the kernel.
- *
+ *
* @param src source address of SA
* @param dst destination address of SA
* @param reqid unique ID for the corresponding SA
* @param cpi allocated cpi
* @return SUCCESS if operation completed
*/
- status_t (*get_cpi)(kernel_interface_t *this, host_t *src, host_t *dst,
+ status_t (*get_cpi)(kernel_interface_t *this, host_t *src, host_t *dst,
u_int32_t reqid, u_int16_t *cpi);
-
+
/**
* Add an SA to the SAD.
- *
+ *
* add_sa() may update an already allocated
* SPI (via get_spi). In this case, the replace
* flag must be set.
* This function does install a single SA for a
- * single protocol in one direction. The kernel-interface
- * gets the keys itself from the PRF, as we don't know
- * his algorithms and key sizes.
- *
+ * single protocol in one direction.
+ *
* @param src source address for this SA
* @param dst destination address for this SA
* @param spi SPI allocated by us or remote peer
* @param protocol protocol for this SA (ESP/AH)
* @param reqid unique ID for this SA
- * @param expire_soft lifetime in seconds before rekeying
- * @param expire_hard lifetime in seconds before delete
+ * @param lifetime lifetime_cfg_t for this SA
* @param enc_alg Algorithm to use for encryption (ESP only)
* @param enc_key key to use for encryption
* @param int_alg Algorithm to use for integrity protection
@@ -103,17 +100,20 @@ struct kernel_interface_t {
* @param cpi CPI for IPComp
* @param encap enable UDP encapsulation for NAT traversal
* @param inbound TRUE if this is an inbound SA
+ * @param src_ts traffic selector with BEET source address
+ * @param dst_ts traffic selector with BEET destination address
* @return SUCCESS if operation completed
*/
status_t (*add_sa) (kernel_interface_t *this,
host_t *src, host_t *dst, u_int32_t spi,
protocol_id_t protocol, u_int32_t reqid,
- u_int64_t expire_soft, u_int64_t expire_hard,
- u_int16_t enc_alg, chunk_t enc_key,
- u_int16_t int_alg, chunk_t int_key,
+ lifetime_cfg_t *lifetime,
+ u_int16_t enc_alg, chunk_t enc_key,
+ u_int16_t int_alg, chunk_t int_key,
ipsec_mode_t mode, u_int16_t ipcomp, u_int16_t cpi,
- bool encap, bool inbound);
-
+ bool encap, bool inbound,
+ traffic_selector_t *src_ts, traffic_selector_t *dst_ts);
+
/**
* Update the hosts on an installed SA.
*
@@ -132,17 +132,17 @@ struct kernel_interface_t {
* @param encap current use of UDP encapsulation
* @param new_encap new use of UDP encapsulation
* @return SUCCESS if operation completed, NOT_SUPPORTED if
- * the kernel interface can't update the SA
+ * the kernel interface can't update the SA
*/
status_t (*update_sa)(kernel_interface_t *this,
u_int32_t spi, protocol_id_t protocol, u_int16_t cpi,
- host_t *src, host_t *dst,
+ host_t *src, host_t *dst,
host_t *new_src, host_t *new_dst,
bool encap, bool new_encap);
-
+
/**
* Query the number of bytes processed by an SA from the SAD.
- *
+ *
* @param src source address for this SA
* @param dst destination address for this SA
* @param spi SPI allocated by us or remote peer
@@ -152,10 +152,10 @@ struct kernel_interface_t {
*/
status_t (*query_sa) (kernel_interface_t *this, host_t *src, host_t *dst,
u_int32_t spi, protocol_id_t protocol, u_int64_t *bytes);
-
+
/**
* Delete a previously installed SA from the SAD.
- *
+ *
* @param src source address for this SA
* @param dst destination address for this SA
* @param spi SPI allocated by us or remote peer
@@ -165,13 +165,13 @@ struct kernel_interface_t {
*/
status_t (*del_sa) (kernel_interface_t *this, host_t *src, host_t *dst,
u_int32_t spi, protocol_id_t protocol, u_int16_t cpi);
-
+
/**
* Add a policy to the SPD.
- *
+ *
* A policy is always associated to an SA. Traffic which matches a
* policy is handled by the SA with the same reqid.
- *
+ *
* @param src source address of SA
* @param dst dest address of SA
* @param src_ts traffic selector to match traffic source
@@ -194,13 +194,13 @@ struct kernel_interface_t {
protocol_id_t protocol, u_int32_t reqid,
ipsec_mode_t mode, u_int16_t ipcomp, u_int16_t cpi,
bool routed);
-
+
/**
* Query the use time of a policy.
*
* The use time of a policy is the time the policy was used
* for the last time.
- *
+ *
* @param src_ts traffic selector to match traffic source
* @param dst_ts traffic selector to match traffic dest
* @param direction direction of traffic, POLICY_IN, POLICY_OUT, POLICY_FWD
@@ -208,10 +208,10 @@ struct kernel_interface_t {
* @return SUCCESS if operation completed
*/
status_t (*query_policy) (kernel_interface_t *this,
- traffic_selector_t *src_ts,
+ traffic_selector_t *src_ts,
traffic_selector_t *dst_ts,
policy_dir_t direction, u_int32_t *use_time);
-
+
/**
* Remove a policy from the SPD.
*
@@ -227,11 +227,11 @@ struct kernel_interface_t {
* @return SUCCESS if operation completed
*/
status_t (*del_policy) (kernel_interface_t *this,
- traffic_selector_t *src_ts,
+ traffic_selector_t *src_ts,
traffic_selector_t *dst_ts,
policy_dir_t direction,
bool unrouted);
-
+
/**
* Get our outgoing source address for a destination.
*
@@ -246,7 +246,7 @@ struct kernel_interface_t {
*/
host_t* (*get_source_addr)(kernel_interface_t *this,
host_t *dest, host_t *src);
-
+
/**
* Get the next hop for a destination.
*
@@ -257,7 +257,7 @@ struct kernel_interface_t {
* @return next hop address, NULL if unreachable
*/
host_t* (*get_nexthop)(kernel_interface_t *this, host_t *dest);
-
+
/**
* Get the interface name of a local address.
*
@@ -265,21 +265,21 @@ struct kernel_interface_t {
* @return allocated interface name, or NULL if not found
*/
char* (*get_interface) (kernel_interface_t *this, host_t *host);
-
+
/**
* Creates an enumerator over all local addresses.
- *
+ *
* This function blocks an internal cached address list until the
* enumerator gets destroyed.
* The hosts are read-only, do not modify of free.
- *
+ *
* @param include_down_ifaces TRUE to enumerate addresses from down interfaces
* @param include_virtual_ips TRUE to enumerate virtual ip addresses
* @return enumerator over host_t's
*/
enumerator_t *(*create_address_enumerator) (kernel_interface_t *this,
bool include_down_ifaces, bool include_virtual_ips);
-
+
/**
* Add a virtual IP to an interface.
*
@@ -294,7 +294,7 @@ struct kernel_interface_t {
*/
status_t (*add_ip) (kernel_interface_t *this, host_t *virtual_ip,
host_t *iface_ip);
-
+
/**
* Remove a virtual IP from an interface.
*
@@ -304,10 +304,10 @@ struct kernel_interface_t {
* @return SUCCESS if operation completed
*/
status_t (*del_ip) (kernel_interface_t *this, host_t *virtual_ip);
-
+
/**
* Add a route.
- *
+ *
* @param dst_net destination net
* @param prefixlen destination net prefix length
* @param gateway gateway for this route
@@ -318,10 +318,10 @@ struct kernel_interface_t {
*/
status_t (*add_route) (kernel_interface_t *this, chunk_t dst_net, u_int8_t prefixlen,
host_t *gateway, host_t *src_ip, char *if_name);
-
+
/**
* Delete a route.
- *
+ *
* @param dst_net destination net
* @param prefixlen destination net prefix length
* @param gateway gateway for this route
@@ -331,50 +331,50 @@ struct kernel_interface_t {
*/
status_t (*del_route) (kernel_interface_t *this, chunk_t dst_net, u_int8_t prefixlen,
host_t *gateway, host_t *src_ip, char *if_name);
-
+
/**
* manager methods
*/
-
+
/**
* Tries to find an ip address of a local interface that is included in the
* supplied traffic selector.
- *
+ *
* @param ts traffic selector
* @param ip returned ip (has to be destroyed)
* @return SUCCESS if address found
*/
status_t (*get_address_by_ts) (kernel_interface_t *this,
traffic_selector_t *ts, host_t **ip);
-
+
/**
* Register an ipsec kernel interface constructor on the manager.
*
* @param create constructor to register
*/
void (*add_ipsec_interface)(kernel_interface_t *this, kernel_ipsec_constructor_t create);
-
+
/**
* Unregister an ipsec kernel interface constructor.
*
* @param create constructor to unregister
*/
void (*remove_ipsec_interface)(kernel_interface_t *this, kernel_ipsec_constructor_t create);
-
+
/**
* Register a network kernel interface constructor on the manager.
*
* @param create constructor to register
*/
void (*add_net_interface)(kernel_interface_t *this, kernel_net_constructor_t create);
-
+
/**
* Unregister a network kernel interface constructor.
*
* @param create constructor to unregister
*/
void (*remove_net_interface)(kernel_interface_t *this, kernel_net_constructor_t create);
-
+
/**
* Destroys a kernel_interface_manager_t object.
*/
diff --git a/src/charon/kernel/kernel_ipsec.c b/src/charon/kernel/kernel_ipsec.c
index 45eef4907..5b0335b16 100644
--- a/src/charon/kernel/kernel_ipsec.c
+++ b/src/charon/kernel/kernel_ipsec.c
@@ -18,8 +18,6 @@
ENUM(ipsec_mode_names, MODE_TRANSPORT, MODE_BEET,
"TRANSPORT",
"TUNNEL",
- "2",
- "3",
"BEET",
);
diff --git a/src/charon/kernel/kernel_ipsec.h b/src/charon/kernel/kernel_ipsec.h
index d6438c197..73ad29b0e 100644
--- a/src/charon/kernel/kernel_ipsec.h
+++ b/src/charon/kernel/kernel_ipsec.h
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2006-2008 Tobias Brunner
+ * Copyright (C) 2006-2009 Tobias Brunner
* Copyright (C) 2006 Daniel Roethlisberger
* Copyright (C) 2005-2006 Martin Willi
* Copyright (C) 2005 Jan Hutter
@@ -30,7 +30,8 @@ typedef struct kernel_ipsec_t kernel_ipsec_t;
#include <utils/host.h>
#include <crypto/prf_plus.h>
-#include <encoding/payloads/proposal_substructure.h>
+#include <config/proposal.h>
+#include <config/child_cfg.h>
/**
* Mode of a CHILD_SA.
@@ -70,9 +71,9 @@ extern enum_name_t *policy_dir_names;
/**
* Interface to the ipsec subsystem of the kernel.
- *
+ *
* The kernel ipsec interface handles the communication with the kernel
- * for SA and policy management. It allows setup of these, and provides
+ * for SA and policy management. It allows setup of these, and provides
* further the handling of kernel events.
* Policy information are cached in the interface. This is necessary to do
* reference counting. The Linux kernel does not allow the same policy
@@ -80,7 +81,7 @@ extern enum_name_t *policy_dir_names;
* when rekeying. Thats why we do reference counting of policies.
*/
struct kernel_ipsec_t {
-
+
/**
* Get a SPI from the kernel.
*
@@ -91,39 +92,36 @@ struct kernel_ipsec_t {
* @param spi allocated spi
* @return SUCCESS if operation completed
*/
- status_t (*get_spi)(kernel_ipsec_t *this, host_t *src, host_t *dst,
+ status_t (*get_spi)(kernel_ipsec_t *this, host_t *src, host_t *dst,
protocol_id_t protocol, u_int32_t reqid, u_int32_t *spi);
-
+
/**
* Get a Compression Parameter Index (CPI) from the kernel.
- *
+ *
* @param src source address of SA
* @param dst destination address of SA
* @param reqid unique ID for the corresponding SA
* @param cpi allocated cpi
* @return SUCCESS if operation completed
*/
- status_t (*get_cpi)(kernel_ipsec_t *this, host_t *src, host_t *dst,
+ status_t (*get_cpi)(kernel_ipsec_t *this, host_t *src, host_t *dst,
u_int32_t reqid, u_int16_t *cpi);
-
+
/**
* Add an SA to the SAD.
- *
+ *
* add_sa() may update an already allocated
* SPI (via get_spi). In this case, the replace
* flag must be set.
* This function does install a single SA for a
- * single protocol in one direction. The kernel-interface
- * gets the keys itself from the PRF, as we don't know
- * his algorithms and key sizes.
- *
+ * single protocol in one direction.
+ *
* @param src source address for this SA
* @param dst destination address for this SA
* @param spi SPI allocated by us or remote peer
* @param protocol protocol for this SA (ESP/AH)
* @param reqid unique ID for this SA
- * @param expire_soft lifetime in seconds before rekeying
- * @param expire_hard lifetime in seconds before delete
+ * @param lifetime lifetime_cfg_t for this SA
* @param enc_alg Algorithm to use for encryption (ESP only)
* @param enc_key key to use for encryption
* @param int_alg Algorithm to use for integrity protection
@@ -133,17 +131,20 @@ struct kernel_ipsec_t {
* @param cpi CPI for IPComp
* @param encap enable UDP encapsulation for NAT traversal
* @param inbound TRUE if this is an inbound SA
+ * @param src_ts traffic selector with BEET source address
+ * @param dst_ts traffic selector with BEET destination address
* @return SUCCESS if operation completed
*/
status_t (*add_sa) (kernel_ipsec_t *this,
host_t *src, host_t *dst, u_int32_t spi,
protocol_id_t protocol, u_int32_t reqid,
- u_int64_t expire_soft, u_int64_t expire_hard,
- u_int16_t enc_alg, chunk_t enc_key,
- u_int16_t int_alg, chunk_t int_key,
+ lifetime_cfg_t *lifetime,
+ u_int16_t enc_alg, chunk_t enc_key,
+ u_int16_t int_alg, chunk_t int_key,
ipsec_mode_t mode, u_int16_t ipcomp, u_int16_t cpi,
- bool encap, bool inbound);
-
+ bool encap, bool inbound,
+ traffic_selector_t *src_ts, traffic_selector_t *dst_ts);
+
/**
* Update the hosts on an installed SA.
*
@@ -162,17 +163,17 @@ struct kernel_ipsec_t {
* @param encap current use of UDP encapsulation
* @param new_encap new use of UDP encapsulation
* @return SUCCESS if operation completed, NOT_SUPPORTED if
- * the kernel interface can't update the SA
+ * the kernel interface can't update the SA
*/
status_t (*update_sa)(kernel_ipsec_t *this,
u_int32_t spi, protocol_id_t protocol, u_int16_t cpi,
- host_t *src, host_t *dst,
+ host_t *src, host_t *dst,
host_t *new_src, host_t *new_dst,
bool encap, bool new_encap);
-
+
/**
* Query the number of bytes processed by an SA from the SAD.
- *
+ *
* @param src source address for this SA
* @param dst destination address for this SA
* @param spi SPI allocated by us or remote peer
@@ -182,10 +183,10 @@ struct kernel_ipsec_t {
*/
status_t (*query_sa) (kernel_ipsec_t *this, host_t *src, host_t *dst,
u_int32_t spi, protocol_id_t protocol, u_int64_t *bytes);
-
+
/**
* Delete a previusly installed SA from the SAD.
- *
+ *
* @param src source address for this SA
* @param dst destination address for this SA
* @param spi SPI allocated by us or remote peer
@@ -195,13 +196,13 @@ struct kernel_ipsec_t {
*/
status_t (*del_sa) (kernel_ipsec_t *this, host_t *src, host_t *dst,
u_int32_t spi, protocol_id_t protocol, u_int16_t cpi);
-
+
/**
* Add a policy to the SPD.
- *
+ *
* A policy is always associated to an SA. Traffic which matches a
* policy is handled by the SA with the same reqid.
- *
+ *
* @param src source address of SA
* @param dst dest address of SA
* @param src_ts traffic selector to match traffic source
@@ -224,24 +225,25 @@ struct kernel_ipsec_t {
protocol_id_t protocol, u_int32_t reqid,
ipsec_mode_t mode, u_int16_t ipcomp, u_int16_t cpi,
bool routed);
-
+
/**
* Query the use time of a policy.
*
- * The use time of a policy is the time the policy was used
- * for the last time.
- *
+ * The use time of a policy is the time the policy was used for the last
+ * time. It is not the system time, but a monotonic timestamp as returned
+ * by time_monotonic.
+ *
* @param src_ts traffic selector to match traffic source
* @param dst_ts traffic selector to match traffic dest
* @param direction direction of traffic, POLICY_IN, POLICY_OUT, POLICY_FWD
- * @param[out] use_time the time of this SA's last use
+ * @param[out] use_time the monotonic timestamp of this SA's last use
* @return SUCCESS if operation completed
*/
status_t (*query_policy) (kernel_ipsec_t *this,
- traffic_selector_t *src_ts,
+ traffic_selector_t *src_ts,
traffic_selector_t *dst_ts,
policy_dir_t direction, u_int32_t *use_time);
-
+
/**
* Remove a policy from the SPD.
*
@@ -257,11 +259,11 @@ struct kernel_ipsec_t {
* @return SUCCESS if operation completed
*/
status_t (*del_policy) (kernel_ipsec_t *this,
- traffic_selector_t *src_ts,
+ traffic_selector_t *src_ts,
traffic_selector_t *dst_ts,
policy_dir_t direction,
bool unrouted);
-
+
/**
* Destroy the implementation.
*/
diff --git a/src/charon/kernel/kernel_net.h b/src/charon/kernel/kernel_net.h
index 02242f3a8..efb221f88 100644
--- a/src/charon/kernel/kernel_net.h
+++ b/src/charon/kernel/kernel_net.h
@@ -29,7 +29,7 @@ typedef struct kernel_net_t kernel_net_t;
/**
* Interface to the network subsystem of the kernel.
- *
+ *
* The kernel network interface handles the communication with the kernel
* for interface and IP address management.
*/
@@ -48,7 +48,7 @@ struct kernel_net_t {
* @return outgoing source address, NULL if unreachable
*/
host_t* (*get_source_addr)(kernel_net_t *this, host_t *dest, host_t *src);
-
+
/**
* Get the next hop for a destination.
*
@@ -59,7 +59,7 @@ struct kernel_net_t {
* @return next hop address, NULL if unreachable
*/
host_t* (*get_nexthop)(kernel_net_t *this, host_t *dest);
-
+
/**
* Get the interface name of a local address.
*
@@ -67,21 +67,21 @@ struct kernel_net_t {
* @return allocated interface name, or NULL if not found
*/
char* (*get_interface) (kernel_net_t *this, host_t *host);
-
+
/**
* Creates an enumerator over all local addresses.
- *
+ *
* This function blocks an internal cached address list until the
* enumerator gets destroyed.
* The hosts are read-only, do not modify of free.
- *
+ *
* @param include_down_ifaces TRUE to enumerate addresses from down interfaces
* @param include_virtual_ips TRUE to enumerate virtual ip addresses
* @return enumerator over host_t's
*/
enumerator_t *(*create_address_enumerator) (kernel_net_t *this,
bool include_down_ifaces, bool include_virtual_ips);
-
+
/**
* Add a virtual IP to an interface.
*
@@ -96,7 +96,7 @@ struct kernel_net_t {
*/
status_t (*add_ip) (kernel_net_t *this, host_t *virtual_ip,
host_t *iface_ip);
-
+
/**
* Remove a virtual IP from an interface.
*
@@ -106,10 +106,10 @@ struct kernel_net_t {
* @return SUCCESS if operation completed
*/
status_t (*del_ip) (kernel_net_t *this, host_t *virtual_ip);
-
+
/**
* Add a route.
- *
+ *
* @param dst_net destination net
* @param prefixlen destination net prefix length
* @param gateway gateway for this route
@@ -120,10 +120,10 @@ struct kernel_net_t {
*/
status_t (*add_route) (kernel_net_t *this, chunk_t dst_net, u_int8_t prefixlen,
host_t *gateway, host_t *src_ip, char *if_name);
-
+
/**
* Delete a route.
- *
+ *
* @param dst_net destination net
* @param prefixlen destination net prefix length
* @param gateway gateway for this route
@@ -133,7 +133,7 @@ struct kernel_net_t {
*/
status_t (*del_route) (kernel_net_t *this, chunk_t dst_net, u_int8_t prefixlen,
host_t *gateway, host_t *src_ip, char *if_name);
-
+
/**
* Destroy the implementation.
*/
diff --git a/src/charon/network/packet.c b/src/charon/network/packet.c
index fd3a274bd..19a62603d 100644
--- a/src/charon/network/packet.c
+++ b/src/charon/network/packet.c
@@ -27,17 +27,17 @@ struct private_packet_t {
* Public part of a packet_t object.
*/
packet_t public;
-
+
/**
* source address
*/
host_t *source;
-
+
/**
* destination address
*/
host_t *destination;
-
+
/**
* message data
*/
@@ -77,7 +77,7 @@ static host_t *get_destination(private_packet_t *this)
{
return this->destination;
}
-
+
/**
* Implements packet_t.get_data
*/
@@ -103,7 +103,7 @@ static void destroy(private_packet_t *this)
if (this->source != NULL)
{
this->source->destroy(this->source);
- }
+ }
if (this->destination != NULL)
{
this->destination->destroy(this->destination);
@@ -118,7 +118,7 @@ static void destroy(private_packet_t *this)
static packet_t *clone_(private_packet_t *this)
{
private_packet_t *other = (private_packet_t*)packet_create();
-
+
if (this->destination != NULL)
{
other->destination = this->destination->clone(this->destination);
@@ -150,10 +150,10 @@ packet_t *packet_create(void)
this->public.get_destination = (host_t*(*) (packet_t *)) get_destination;
this->public.clone = (packet_t*(*) (packet_t *))clone_;
this->public.destroy = (void(*) (packet_t *)) destroy;
-
+
this->destination = NULL;
this->source = NULL;
this->data = chunk_empty;
-
+
return &(this->public);
}
diff --git a/src/charon/network/packet.h b/src/charon/network/packet.h
index aacb203e9..18d82c6fc 100644
--- a/src/charon/network/packet.h
+++ b/src/charon/network/packet.h
@@ -34,71 +34,71 @@ struct packet_t {
/**
* Set the source address.
- *
+ *
* Set host_t is now owned by packet_t, it will destroy
* it if necessary.
- *
+ *
* @param source address to set as source
*/
void (*set_source) (packet_t *packet, host_t *source);
-
+
/**
* Set the destination address.
- *
+ *
* Set host_t is now owned by packet_t, it will destroy
* it if necessary.
- *
+ *
* @param source address to set as destination
*/
void (*set_destination) (packet_t *packet, host_t *destination);
-
+
/**
* Get the source address.
- *
+ *
* Set host_t is still owned by packet_t, clone it
* if needed.
- *
+ *
* @return source address
*/
host_t *(*get_source) (packet_t *packet);
-
+
/**
* Get the destination address.
- *
+ *
* Set host_t is still owned by packet_t, clone it
* if needed.
- *
+ *
* @return destination address
*/
host_t *(*get_destination) (packet_t *packet);
-
+
/**
* Get the data from the packet.
- *
- * The data pointed by the chunk is still owned
+ *
+ * The data pointed by the chunk is still owned
* by the packet. Clone it if needed.
- *
+ *
* @return chunk containing the data
*/
chunk_t (*get_data) (packet_t *packet);
-
+
/**
* Set the data in the packet.
- *
- * Supplied chunk data is now owned by the
+ *
+ * Supplied chunk data is now owned by the
* packet. It will free it.
- *
+ *
* @param data chunk with data to set
*/
void (*set_data) (packet_t *packet, chunk_t data);
-
+
/**
* Clones a packet_t object.
- *
+ *
* @param clone clone of the packet
*/
packet_t* (*clone) (packet_t *packet);
-
+
/**
* Destroy the packet, freeing contained data.
*/
@@ -107,7 +107,7 @@ struct packet_t {
/**
* create an empty packet
- *
+ *
* @return packet_t object
*/
packet_t *packet_create(void);
diff --git a/src/charon/network/receiver.c b/src/charon/network/receiver.c
index ab4d6d592..6cd99439b 100644
--- a/src/charon/network/receiver.c
+++ b/src/charon/network/receiver.c
@@ -17,7 +17,6 @@
#include <stdlib.h>
#include <unistd.h>
-#include <pthread.h>
#include "receiver.h"
@@ -50,57 +49,52 @@ struct private_receiver_t {
* Public part of a receiver_t object.
*/
receiver_t public;
-
+
/**
* Threads job receiving packets
*/
callback_job_t *job;
-
- /**
- * Assigned thread.
- */
- pthread_t assigned_thread;
-
+
/**
* current secret to use for cookie calculation
*/
char secret[SECRET_LENGTH];
-
+
/**
* previous secret used to verify older cookies
*/
char secret_old[SECRET_LENGTH];
-
+
/**
* how many times we have used "secret" so far
*/
u_int32_t secret_used;
-
+
/**
* time we did the cookie switch
*/
u_int32_t secret_switch;
-
+
/**
* time offset to use, hides our system time
*/
u_int32_t secret_offset;
-
+
/**
* the RNG to use for secret generation
*/
rng_t *rng;
-
+
/**
* hasher to use for cookie calculation
*/
hasher_t *hasher;
-
+
/**
* require cookies after this many half open IKE_SAs
*/
u_int32_t cookie_threshold;
-
+
/**
* how many half open IKE_SAs per peer before blocking
*/
@@ -119,7 +113,7 @@ static void send_notify(message_t *request, notify_type_t type, chunk_t data)
host_t *src, *dst;
packet_t *packet;
ike_sa_id_t *ike_sa_id;
-
+
response = message_create();
dst = request->get_source(request);
src = request->get_destination(request);
@@ -149,7 +143,7 @@ static chunk_t cookie_build(private_receiver_t *this, message_t *message,
u_int64_t spi = message->get_initiator_spi(message);
host_t *ip = message->get_source(message);
chunk_t input, hash;
-
+
/* COOKIE = t | sha1( IPi | SPIi | t | secret ) */
input = chunk_cata("cccc", ip->get_address(ip), chunk_from_thing(spi),
chunk_from_thing(t), secret);
@@ -167,18 +161,18 @@ static bool cookie_verify(private_receiver_t *this, message_t *message,
u_int32_t t, now;
chunk_t reference;
chunk_t secret;
-
- now = time(NULL);
+
+ now = time_monotonic(NULL);
t = *(u_int32_t*)cookie.ptr;
-
+
if (cookie.len != sizeof(u_int32_t) +
- this->hasher->get_hash_size(this->hasher) ||
+ this->hasher->get_hash_size(this->hasher) ||
t < now - this->secret_offset - COOKIE_LIFETIME)
{
DBG2(DBG_NET, "received cookie lifetime expired, rejecting");
- return FALSE;
+ return FALSE;
}
-
+
/* check if cookie is derived from old_secret */
if (t + this->secret_offset > this->secret_switch)
{
@@ -188,7 +182,7 @@ static bool cookie_verify(private_receiver_t *this, message_t *message,
{
secret = chunk_from_thing(this->secret_old);
}
-
+
/* compare own calculation against received */
reference = cookie_build(this, message, t, secret);
if (chunk_equals(reference, cookie))
@@ -206,20 +200,20 @@ static bool cookie_verify(private_receiver_t *this, message_t *message,
static bool cookie_required(private_receiver_t *this, message_t *message)
{
bool failed = FALSE;
-
+
if (charon->ike_sa_manager->get_half_open_count(charon->ike_sa_manager,
NULL) >= this->cookie_threshold)
{
/* check for a cookie. We don't use our parser here and do it
- * quick and dirty for performance reasons.
- * we assume the cookie is the first payload (which is a MUST), and
+ * quick and dirty for performance reasons.
+ * we assume the cookie is the first payload (which is a MUST), and
* the cookie's SPI length is zero. */
packet_t *packet = message->get_packet(message);
chunk_t data = packet->get_data(packet);
- if (data.len <
+ if (data.len <
IKE_HEADER_LENGTH + NOTIFY_PAYLOAD_HEADER_LENGTH +
sizeof(u_int32_t) + this->hasher->get_hash_size(this->hasher) ||
- *(data.ptr + 16) != NOTIFY ||
+ *(data.ptr + 16) != NOTIFY ||
*(u_int16_t*)(data.ptr + IKE_HEADER_LENGTH + 6) != htons(COOKIE))
{
/* no cookie found */
@@ -261,14 +255,14 @@ static job_requeue_t receive_packets(private_receiver_t *this)
packet_t *packet;
message_t *message;
job_t *job;
-
+
/* read in a packet */
if (charon->socket->receive(charon->socket, &packet) != SUCCESS)
{
DBG2(DBG_NET, "receiving from socket failed!");
return JOB_REQUEUE_FAIR;
}
-
+
/* parse message header */
message = message_create_from_packet(packet);
if (message->parse_header(message) != SUCCESS)
@@ -278,28 +272,28 @@ static job_requeue_t receive_packets(private_receiver_t *this)
message->destroy(message);
return JOB_REQUEUE_DIRECT;
}
-
+
/* check IKE major version */
if (message->get_major_version(message) != IKE_MAJOR_VERSION)
{
DBG1(DBG_NET, "received unsupported IKE version %d.%d from %H, "
- "sending INVALID_MAJOR_VERSION", message->get_major_version(message),
+ "sending INVALID_MAJOR_VERSION", message->get_major_version(message),
message->get_minor_version(message), packet->get_source(packet));
send_notify(message, INVALID_MAJOR_VERSION, chunk_empty);
message->destroy(message);
return JOB_REQUEUE_DIRECT;
}
-
+
if (message->get_request(message) &&
message->get_exchange_type(message) == IKE_SA_INIT)
{
/* check for cookies */
if (this->cookie_threshold && cookie_required(this, message))
{
- u_int32_t now = time(NULL);
+ u_int32_t now = time_monotonic(NULL);
chunk_t cookie = cookie_build(this, message, now - this->secret_offset,
- chunk_from_thing(this->secret));
-
+ chunk_from_thing(this->secret));
+
DBG2(DBG_NET, "received packet from: %#H to %#H",
message->get_source(message),
message->get_destination(message));
@@ -312,7 +306,7 @@ static job_requeue_t receive_packets(private_receiver_t *this)
/* create new cookie */
DBG1(DBG_NET, "generating new cookie secret after %d uses",
this->secret_used);
- memcpy(this->secret_old, this->secret, SECRET_LENGTH);
+ memcpy(this->secret_old, this->secret, SECRET_LENGTH);
this->rng->get_bytes(this->rng, SECRET_LENGTH, this->secret);
this->secret_switch = now;
this->secret_used = 0;
@@ -320,7 +314,7 @@ static job_requeue_t receive_packets(private_receiver_t *this)
message->destroy(message);
return JOB_REQUEUE_DIRECT;
}
-
+
/* check if peer has not too many IKE_SAs half open */
if (this->block_threshold && peer_to_aggressive(this, message))
{
@@ -352,10 +346,10 @@ static void destroy(private_receiver_t *this)
receiver_t *receiver_create()
{
private_receiver_t *this = malloc_thing(private_receiver_t);
- u_int32_t now = time(NULL);
-
+ u_int32_t now = time_monotonic(NULL);
+
this->public.destroy = (void(*)(receiver_t*)) destroy;
-
+
this->hasher = lib->crypto->create_hasher(lib->crypto, HASH_PREFERRED);
if (this->hasher == NULL)
{
@@ -385,11 +379,11 @@ receiver_t *receiver_create()
this->cookie_threshold = 0;
this->block_threshold = 0;
}
-
+
this->job = callback_job_create((callback_job_cb_t)receive_packets,
this, NULL, NULL);
charon->processor->queue_job(charon->processor, (job_t*)this->job);
-
+
return &this->public;
}
diff --git a/src/charon/network/receiver.h b/src/charon/network/receiver.h
index 87797634e..690d8dbab 100644
--- a/src/charon/network/receiver.h
+++ b/src/charon/network/receiver.h
@@ -29,7 +29,7 @@ typedef struct receiver_t receiver_t;
/**
* Receives packets from the socket and adds them to the job queue.
- *
+ *
* The receiver starts a thread, wich reads on the blocking socket. A received
* packet is preparsed and a process_message_job is queued in the job queue.
*
@@ -41,16 +41,16 @@ typedef struct receiver_t receiver_t;
* find out wich key was used for cookie creation. Further, we can set a
* lifetime for the cookie, which allows us to reuse the secret for a longer
* time.
- * COOKIE = time | sha1( IPi | SPIi | time | secret )
+ * COOKIE = time | sha1( IPi | SPIi | time | secret )
*
* The secret is changed after a certain amount of cookies sent. The old
* secret is stored to allow a clean migration between secret changes.
- *
+ *
* Further, the number of half-initiated IKE_SAs is limited per peer. This
* mades it impossible for a peer to flood the server with its real IP address.
*/
struct receiver_t {
-
+
/**
* Destroys a receiver_t object.
*/
@@ -59,10 +59,10 @@ struct receiver_t {
/**
* Create a receiver_t object.
- *
+ *
* The receiver thread will start working, get data
* from the socket and add those packets to the job queue.
- *
+ *
* @return receiver_t object, NULL if initialization fails
*/
receiver_t * receiver_create(void);
diff --git a/src/charon/network/sender.c b/src/charon/network/sender.c
index 19f589115..3be5861dd 100644
--- a/src/charon/network/sender.c
+++ b/src/charon/network/sender.c
@@ -15,14 +15,15 @@
*/
#include <stdlib.h>
-#include <pthread.h>
#include "sender.h"
#include <daemon.h>
#include <network/socket.h>
#include <processing/jobs/callback_job.h>
-#include <utils/mutex.h>
+#include <threading/thread.h>
+#include <threading/condvar.h>
+#include <threading/mutex.h>
typedef struct private_sender_t private_sender_t;
@@ -40,7 +41,7 @@ struct private_sender_t {
* Sender threads job.
*/
callback_job_t *job;
-
+
/**
* The packets are stored in a linked list
*/
@@ -55,7 +56,7 @@ struct private_sender_t {
* condvar to signal for packets added to list
*/
condvar_t *got;
-
+
/**
* condvar to signal for packets sent
*/
@@ -68,11 +69,11 @@ struct private_sender_t {
static void send_(private_sender_t *this, packet_t *packet)
{
host_t *src, *dst;
-
+
src = packet->get_source(packet);
dst = packet->get_destination(packet);
DBG1(DBG_NET, "sending packet: from %#H to %#H", src, dst);
-
+
this->mutex->lock(this->mutex);
this->list->insert_last(this->list, packet);
this->got->signal(this->got);
@@ -85,24 +86,24 @@ static void send_(private_sender_t *this, packet_t *packet)
static job_requeue_t send_packets(private_sender_t * this)
{
packet_t *packet;
- int oldstate;
-
+ bool oldstate;
+
this->mutex->lock(this->mutex);
while (this->list->get_count(this->list) == 0)
{
/* add cleanup handler, wait for packet, remove cleanup handler */
- pthread_cleanup_push((void(*)(void*))this->mutex->unlock, this->mutex);
- pthread_setcancelstate(PTHREAD_CANCEL_ENABLE, &oldstate);
-
+ thread_cleanup_push((thread_cleanup_t)this->mutex->unlock, this->mutex);
+ oldstate = thread_cancelability(TRUE);
+
this->got->wait(this->got, this->mutex);
-
- pthread_setcancelstate(oldstate, NULL);
- pthread_cleanup_pop(0);
+
+ thread_cancelability(oldstate);
+ thread_cleanup_pop(FALSE);
}
this->list->remove_first(this->list, (void**)&packet);
this->sent->signal(this->sent);
this->mutex->unlock(this->mutex);
-
+
charon->socket->send(charon->socket, packet);
packet->destroy(packet);
return JOB_REQUEUE_DIRECT;
@@ -134,19 +135,19 @@ static void destroy(private_sender_t *this)
sender_t * sender_create()
{
private_sender_t *this = malloc_thing(private_sender_t);
-
+
this->public.send = (void(*)(sender_t*,packet_t*))send_;
this->public.destroy = (void(*)(sender_t*)) destroy;
-
+
this->list = linked_list_create();
this->mutex = mutex_create(MUTEX_TYPE_DEFAULT);
this->got = condvar_create(CONDVAR_TYPE_DEFAULT);
this->sent = condvar_create(CONDVAR_TYPE_DEFAULT);
-
+
this->job = callback_job_create((callback_job_cb_t)send_packets,
this, NULL, NULL);
charon->processor->queue_job(charon->processor, (job_t*)this->job);
-
+
return &this->public;
}
diff --git a/src/charon/network/sender.h b/src/charon/network/sender.h
index 55f67af70..f77fadab2 100644
--- a/src/charon/network/sender.h
+++ b/src/charon/network/sender.h
@@ -31,7 +31,7 @@ typedef struct sender_t sender_t;
* Thread responsible for sending packets over the socket.
*/
struct sender_t {
-
+
/**
* Send a packet over the network.
*
@@ -39,10 +39,10 @@ struct sender_t {
* Whenever the sender thread thinks it's good to send the packet,
* it'll do so.
*
- * @param packet packet to send
+ * @param packet packet to send
*/
void (*send) (sender_t *this, packet_t *packet);
-
+
/**
* Destroys a sender object.
*/
@@ -51,10 +51,10 @@ struct sender_t {
/**
* Create the sender thread.
- *
+ *
* The thread will start to work, getting packets
* from its queue and sends them out.
- *
+ *
* @return created sender object
*/
sender_t * sender_create(void);
diff --git a/src/charon/network/socket-raw.c b/src/charon/network/socket-raw.c
index 148be486c..6cc0463b2 100644
--- a/src/charon/network/socket-raw.c
+++ b/src/charon/network/socket-raw.c
@@ -18,7 +18,6 @@
/* for struct in6_pktinfo */
#define _GNU_SOURCE
-#include <pthread.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <string.h>
@@ -38,6 +37,7 @@
#include "socket.h"
#include <daemon.h>
+#include <threading/thread.h>
/* constants for packet handling */
#define IP_LEN sizeof(struct iphdr)
@@ -85,12 +85,12 @@ struct private_socket_t{
* port used for nat-t
*/
int natt_port;
-
+
/**
* raw receiver socket for IPv4
*/
int recv4;
-
+
/**
* raw receiver socket for IPv6
*/
@@ -127,12 +127,12 @@ static status_t receiver(private_socket_t *this, packet_t **packet)
packet_t *pkt;
struct udphdr *udp;
host_t *source = NULL, *dest = NULL;
- int bytes_read = 0;
- int data_offset, oldstate;
+ int bytes_read = 0, data_offset;
+ bool oldstate;
fd_set rfds;
FD_ZERO(&rfds);
-
+
if (this->recv4)
{
FD_SET(this->recv4, &rfds);
@@ -141,24 +141,24 @@ static status_t receiver(private_socket_t *this, packet_t **packet)
{
FD_SET(this->recv6, &rfds);
}
-
+
DBG2(DBG_NET, "waiting for data on raw sockets");
-
- pthread_setcancelstate(PTHREAD_CANCEL_ENABLE, &oldstate);
+
+ oldstate = thread_cancelability(TRUE);
if (select(max(this->recv4, this->recv6) + 1, &rfds, NULL, NULL, NULL) <= 0)
{
- pthread_setcancelstate(oldstate, NULL);
+ thread_cancelability(oldstate);
return FAILED;
}
- pthread_setcancelstate(oldstate, NULL);
-
+ thread_cancelability(oldstate);
+
if (this->recv4 && FD_ISSET(this->recv4, &rfds))
{
/* IPv4 raw sockets return the IP header. We read src/dest
* information directly from the raw header */
struct iphdr *ip;
struct sockaddr_in src, dst;
-
+
bytes_read = recv(this->recv4, buffer, MAX_PACKET, 0);
if (bytes_read < 0)
{
@@ -166,7 +166,7 @@ static status_t receiver(private_socket_t *this, packet_t **packet)
return FAILED;
}
DBG3(DBG_NET, "received IPv4 packet %b", buffer, bytes_read);
-
+
/* read source/dest from raw IP/UDP header */
if (bytes_read < IP_LEN + UDP_LEN + MARKER_LEN)
{
@@ -184,13 +184,13 @@ static status_t receiver(private_socket_t *this, packet_t **packet)
dst.sin_port = udp->dest;
source = host_create_from_sockaddr((sockaddr_t*)&src);
dest = host_create_from_sockaddr((sockaddr_t*)&dst);
-
+
pkt = packet_create();
pkt->set_source(pkt, source);
pkt->set_destination(pkt, dest);
DBG2(DBG_NET, "received packet: from %#H to %#H", source, dest);
data_offset = IP_LEN + UDP_LEN;
- /* remove non esp marker */
+ /* remove non esp marker */
if (dest->get_port(dest) == IKEV2_NATT_PORT)
{
data_offset += MARKER_LEN;
@@ -210,7 +210,7 @@ static status_t receiver(private_socket_t *this, packet_t **packet)
struct sockaddr_in6 src, dst;
struct iovec iov;
char ancillary[64];
-
+
msg.msg_name = &src;
msg.msg_namelen = sizeof(src);
iov.iov_base = buffer;
@@ -220,7 +220,7 @@ static status_t receiver(private_socket_t *this, packet_t **packet)
msg.msg_control = ancillary;
msg.msg_controllen = sizeof(ancillary);
msg.msg_flags = 0;
-
+
bytes_read = recvmsg(this->recv6, &msg, 0);
if (bytes_read < 0)
{
@@ -228,14 +228,14 @@ static status_t receiver(private_socket_t *this, packet_t **packet)
return FAILED;
}
DBG3(DBG_NET, "received IPv6 packet %b", buffer, bytes_read);
-
+
if (bytes_read < IP_LEN + UDP_LEN + MARKER_LEN)
{
DBG3(DBG_NET, "received IPv6 packet too short (%d bytes)",
bytes_read);
return FAILED;
}
-
+
/* read ancillary data to get destination address */
for (cmsgptr = CMSG_FIRSTHDR(&msg); cmsgptr != NULL;
cmsgptr = CMSG_NXTHDR(&msg, cmsgptr))
@@ -244,13 +244,13 @@ static status_t receiver(private_socket_t *this, packet_t **packet)
{
DBG1(DBG_NET, "error reading IPv6 ancillary data");
return FAILED;
- }
+ }
if (cmsgptr->cmsg_level == SOL_IPV6 &&
cmsgptr->cmsg_type == IPV6_2292PKTINFO)
{
struct in6_pktinfo *pktinfo;
pktinfo = (struct in6_pktinfo*)CMSG_DATA(cmsgptr);
-
+
memset(&dst, 0, sizeof(dst));
memcpy(&dst.sin6_addr, &pktinfo->ipi6_addr, sizeof(dst.sin6_addr));
dst.sin6_family = AF_INET6;
@@ -266,15 +266,15 @@ static status_t receiver(private_socket_t *this, packet_t **packet)
DBG1(DBG_NET, "error reading IPv6 packet header");
return FAILED;
}
-
+
source = host_create_from_sockaddr((sockaddr_t*)&src);
-
+
pkt = packet_create();
pkt->set_source(pkt, source);
pkt->set_destination(pkt, dest);
DBG2(DBG_NET, "received packet: from %#H to %#H", source, dest);
data_offset = UDP_LEN;
- /* remove non esp marker */
+ /* remove non esp marker */
if (dest->get_port(dest) == IKEV2_NATT_PORT)
{
data_offset += MARKER_LEN;
@@ -290,7 +290,7 @@ static status_t receiver(private_socket_t *this, packet_t **packet)
/* oops, shouldn't happen */
return FAILED;
}
-
+
/* return packet */
*packet = pkt;
return SUCCESS;
@@ -308,13 +308,13 @@ status_t sender(private_socket_t *this, packet_t *packet)
struct msghdr msg;
struct cmsghdr *cmsg;
struct iovec iov;
-
+
src = packet->get_source(packet);
dst = packet->get_destination(packet);
data = packet->get_data(packet);
DBG2(DBG_NET, "sending packet: from %#H to %#H", src, dst);
-
+
/* send data */
sport = src->get_port(src);
family = dst->get_family(dst);
@@ -362,7 +362,7 @@ status_t sender(private_socket_t *this, packet_t *packet)
DBG1(DBG_NET, "unable to locate a send socket for port %d", sport);
return FAILED;
}
-
+
memset(&msg, 0, sizeof(struct msghdr));
msg.msg_name = dst->get_sockaddr(dst);;
msg.msg_namelen = *dst->get_sockaddr_len(dst);
@@ -371,7 +371,7 @@ status_t sender(private_socket_t *this, packet_t *packet)
msg.msg_iov = &iov;
msg.msg_iovlen = 1;
msg.msg_flags = 0;
-
+
if (!src->is_anyaddr(src))
{
if (family == AF_INET)
@@ -379,7 +379,7 @@ status_t sender(private_socket_t *this, packet_t *packet)
char buf[CMSG_SPACE(sizeof(struct in_pktinfo))];
struct in_pktinfo *pktinfo;
struct sockaddr_in *sin;
-
+
msg.msg_control = buf;
msg.msg_controllen = sizeof(buf);
cmsg = CMSG_FIRSTHDR(&msg);
@@ -396,7 +396,7 @@ status_t sender(private_socket_t *this, packet_t *packet)
char buf[CMSG_SPACE(sizeof(struct in6_pktinfo))];
struct in6_pktinfo *pktinfo;
struct sockaddr_in6 *sin;
-
+
msg.msg_control = buf;
msg.msg_controllen = sizeof(buf);
cmsg = CMSG_FIRSTHDR(&msg);
@@ -409,7 +409,7 @@ status_t sender(private_socket_t *this, packet_t *packet)
memcpy(&pktinfo->ipi6_addr, &sin->sin6_addr, sizeof(struct in6_addr));
}
}
-
+
bytes_sent = sendmsg(skt, &msg, 0);
if (bytes_sent != data.len)
@@ -430,7 +430,7 @@ static int open_send_socket(private_socket_t *this, int family, u_int16_t port)
struct sockaddr_storage addr;
u_int sol;
int skt;
-
+
memset(&addr, 0, sizeof(addr));
/* precalculate constants depending on address family */
switch (family)
@@ -456,14 +456,14 @@ static int open_send_socket(private_socket_t *this, int family, u_int16_t port)
default:
return 0;
}
-
+
skt = socket(family, SOCK_DGRAM, IPPROTO_UDP);
if (skt < 0)
{
DBG1(DBG_NET, "could not open send socket: %s", strerror(errno));
return 0;
}
-
+
if (setsockopt(skt, SOL_SOCKET, SO_REUSEADDR, (void*)&on, sizeof(on)) < 0)
{
DBG1(DBG_NET, "unable to set SO_REUSEADDR on send socket: %s",
@@ -471,7 +471,7 @@ static int open_send_socket(private_socket_t *this, int family, u_int16_t port)
close(skt);
return 0;
}
-
+
/* bind the send socket */
if (bind(skt, (struct sockaddr *)&addr, sizeof(addr)) < 0)
{
@@ -480,7 +480,7 @@ static int open_send_socket(private_socket_t *this, int family, u_int16_t port)
close(skt);
return 0;
}
-
+
if (family == AF_INET)
{
/* enable UDP decapsulation globally, only for one socket needed */
@@ -490,7 +490,7 @@ static int open_send_socket(private_socket_t *this, int family, u_int16_t port)
strerror(errno));
}
}
-
+
return skt;
}
@@ -502,7 +502,7 @@ static int open_recv_socket(private_socket_t *this, int family)
int skt;
int on = TRUE;
u_int proto_offset, ip_len, sol, udp_header, ike_header;
-
+
/* precalculate constants depending on address family */
switch (family)
{
@@ -521,7 +521,7 @@ static int open_recv_socket(private_socket_t *this, int family)
}
udp_header = ip_len;
ike_header = ip_len + UDP_LEN;
-
+
/* This filter code filters out all non-IKEv2 traffic on
* a SOCK_RAW IP_PROTP_UDP socket. Handling of other
* IKE versions is done in pluto.
@@ -560,7 +560,7 @@ static int open_recv_socket(private_socket_t *this, int family)
sizeof(ikev2_filter_code) / sizeof(struct sock_filter),
ikev2_filter_code
};
-
+
/* set up a raw socket */
skt = socket(family, SOCK_RAW, IPPROTO_UDP);
if (skt < 0)
@@ -568,7 +568,7 @@ static int open_recv_socket(private_socket_t *this, int family)
DBG1(DBG_NET, "unable to create raw socket: %s", strerror(errno));
return 0;
}
-
+
if (setsockopt(skt, SOL_SOCKET, SO_ATTACH_FILTER,
&ikev2_filter, sizeof(ikev2_filter)) < 0)
{
@@ -577,7 +577,7 @@ static int open_recv_socket(private_socket_t *this, int family)
close(skt);
return 0;
}
-
+
if (family == AF_INET6 &&
/* we use IPV6_2292PKTINFO, as IPV6_PKTINFO is defined as
* 2 or 50 depending on kernel header version */
@@ -588,7 +588,7 @@ static int open_recv_socket(private_socket_t *this, int family)
close(skt);
return 0;
}
-
+
return skt;
}
@@ -621,7 +621,7 @@ static bool enumerate(socket_enumerator_t *this, int *fd, int *family, int *port
{ offsetof(private_socket_t, send4_natt), AF_INET, IKEV2_NATT_PORT },
{ offsetof(private_socket_t, send6_natt), AF_INET6, IKEV2_NATT_PORT }
};
-
+
while(++this->index < countof(sockets))
{
int sock = *(int*)((char*)this->socket + sockets[this->index].fd_offset);
@@ -643,7 +643,7 @@ static bool enumerate(socket_enumerator_t *this, int *fd, int *family, int *port
static enumerator_t *create_enumerator(private_socket_t *this)
{
socket_enumerator_t *enumerator;
-
+
enumerator = malloc_thing(socket_enumerator_t);
enumerator->index = -1;
enumerator->socket = this;
@@ -690,20 +690,20 @@ static void destroy(private_socket_t *this)
socket_t *socket_create()
{
private_socket_t *this = malloc_thing(private_socket_t);
-
+
/* public functions */
this->public.send = (status_t(*)(socket_t*, packet_t*))sender;
this->public.receive = (status_t(*)(socket_t*, packet_t**))receiver;
this->public.create_enumerator = (enumerator_t*(*)(socket_t*))create_enumerator;
this->public.destroy = (void(*)(socket_t*)) destroy;
-
+
this->recv4 = 0;
this->recv6 = 0;
this->send4 = 0;
this->send6 = 0;
this->send4_natt = 0;
this->send6_natt = 0;
-
+
this->recv4 = open_recv_socket(this, AF_INET);
if (this->recv4 == 0)
{
@@ -726,7 +726,7 @@ socket_t *socket_create()
}
}
}
-
+
this->recv6 = open_recv_socket(this, AF_INET6);
if (this->recv6 == 0)
{
@@ -749,13 +749,13 @@ socket_t *socket_create()
}
}
}
-
+
if (!(this->send4 || this->send6) || !(this->recv4 || this->recv6))
{
DBG1(DBG_NET, "could not create any sockets");
destroy(this);
charon->kill(charon, "socket initialization failed");
}
-
+
return (socket_t*)this;
}
diff --git a/src/charon/network/socket.c b/src/charon/network/socket.c
index 97c88be79..81f860b15 100644
--- a/src/charon/network/socket.c
+++ b/src/charon/network/socket.c
@@ -23,7 +23,6 @@
#define __EXTENSIONS__
#endif
-#include <pthread.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <string.h>
@@ -35,7 +34,6 @@
#include <netinet/in_systm.h>
#include <netinet/in.h>
#include <netinet/ip.h>
-#include <netinet/ip6.h>
#include <netinet/udp.h>
#include <net/if.h>
#ifdef __APPLE__
@@ -45,6 +43,7 @@
#include "socket.h"
#include <daemon.h>
+#include <threading/thread.h>
/* length of non-esp marker */
#define MARKER_LEN sizeof(u_int32_t)
@@ -72,9 +71,16 @@
/* IPV6_RECVPKTINFO is defined in RFC 3542 which obsoletes RFC 2292 that
* previously defined IPV6_PKTINFO */
#ifndef IPV6_RECVPKTINFO
-#define IPV6_RECVPKTINFO IPV6_PKTINFO;
+#define IPV6_RECVPKTINFO IPV6_PKTINFO
#endif
+#ifndef IN6ADDR_ANY_INIT
+#define IN6ADDR_ANY_INIT {{{0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}}}
+#endif
+
+#ifndef HAVE_IN6ADDR_ANY
+static const struct in6_addr in6addr_any = IN6ADDR_ANY_INIT;
+#endif
typedef struct private_socket_t private_socket_t;
@@ -86,22 +92,22 @@ struct private_socket_t {
* public functions
*/
socket_t public;
-
+
/**
* IPv4 socket (500)
*/
int ipv4;
-
+
/**
* IPv4 socket for NATT (4500)
*/
int ipv4_natt;
-
+
/**
* IPv6 socket (500)
*/
int ipv6;
-
+
/**
* IPv6 socket for NATT (4500)
*/
@@ -117,14 +123,15 @@ static status_t receiver(private_socket_t *this, packet_t **packet)
chunk_t data;
packet_t *pkt;
host_t *source = NULL, *dest = NULL;
- int bytes_read = 0;
- int data_offset, oldstate;
+ int bytes_read = 0, data_offset;
+ bool oldstate;
+
fd_set rfds;
int max_fd = 0, selected = 0;
u_int16_t port = 0;
-
+
FD_ZERO(&rfds);
-
+
if (this->ipv4)
{
FD_SET(this->ipv4, &rfds);
@@ -142,16 +149,16 @@ static status_t receiver(private_socket_t *this, packet_t **packet)
FD_SET(this->ipv6_natt, &rfds);
}
max_fd = max(max(this->ipv4, this->ipv4_natt), max(this->ipv6, this->ipv6_natt));
-
+
DBG2(DBG_NET, "waiting for data on sockets");
- pthread_setcancelstate(PTHREAD_CANCEL_ENABLE, &oldstate);
+ oldstate = thread_cancelability(TRUE);
if (select(max_fd + 1, &rfds, NULL, NULL, NULL) <= 0)
{
- pthread_setcancelstate(oldstate, NULL);
+ thread_cancelability(oldstate);
return FAILED;
}
- pthread_setcancelstate(oldstate, NULL);
-
+ thread_cancelability(oldstate);
+
if (FD_ISSET(this->ipv4, &rfds))
{
port = IKEV2_UDP_PORT;
@@ -182,7 +189,7 @@ static status_t receiver(private_socket_t *this, packet_t **packet)
struct sockaddr_in in4;
struct sockaddr_in6 in6;
} src;
-
+
msg.msg_name = &src;
msg.msg_namelen = sizeof(src);
iov.iov_base = buffer;
@@ -199,14 +206,14 @@ static status_t receiver(private_socket_t *this, packet_t **packet)
return FAILED;
}
DBG3(DBG_NET, "received packet %b", buffer, bytes_read);
-
+
if (bytes_read < MARKER_LEN)
{
DBG3(DBG_NET, "received packet too short (%d bytes)",
bytes_read);
return FAILED;
}
-
+
/* read ancillary data to get destination address */
for (cmsgptr = CMSG_FIRSTHDR(&msg); cmsgptr != NULL;
cmsgptr = CMSG_NXTHDR(&msg, cmsgptr))
@@ -216,20 +223,22 @@ static status_t receiver(private_socket_t *this, packet_t **packet)
DBG1(DBG_NET, "error reading ancillary data");
return FAILED;
}
-
+
+#ifdef HAVE_IN6_PKTINFO
if (cmsgptr->cmsg_level == SOL_IPV6 &&
cmsgptr->cmsg_type == IPV6_PKTINFO)
{
struct in6_pktinfo *pktinfo;
pktinfo = (struct in6_pktinfo*)CMSG_DATA(cmsgptr);
struct sockaddr_in6 dst;
-
+
memset(&dst, 0, sizeof(dst));
memcpy(&dst.sin6_addr, &pktinfo->ipi6_addr, sizeof(dst.sin6_addr));
dst.sin6_family = AF_INET6;
dst.sin6_port = htons(port);
dest = host_create_from_sockaddr((sockaddr_t*)&dst);
}
+#endif /* HAVE_IN6_PKTINFO */
if (cmsgptr->cmsg_level == SOL_IP &&
#ifdef IP_PKTINFO
cmsgptr->cmsg_type == IP_PKTINFO
@@ -252,7 +261,7 @@ static status_t receiver(private_socket_t *this, packet_t **packet)
#endif
memset(&dst, 0, sizeof(dst));
memcpy(&dst.sin_addr, addr, sizeof(dst.sin_addr));
-
+
dst.sin_family = AF_INET;
dst.sin_port = htons(port);
dest = host_create_from_sockaddr((sockaddr_t*)&dst);
@@ -268,13 +277,13 @@ static status_t receiver(private_socket_t *this, packet_t **packet)
return FAILED;
}
source = host_create_from_sockaddr((sockaddr_t*)&src);
-
+
pkt = packet_create();
pkt->set_source(pkt, source);
pkt->set_destination(pkt, dest);
DBG2(DBG_NET, "received packet: from %#H to %#H", source, dest);
data_offset = 0;
- /* remove non esp marker */
+ /* remove non esp marker */
if (dest->get_port(dest) == IKEV2_NATT_PORT)
{
data_offset += MARKER_LEN;
@@ -307,13 +316,13 @@ status_t sender(private_socket_t *this, packet_t *packet)
struct msghdr msg;
struct cmsghdr *cmsg;
struct iovec iov;
-
+
src = packet->get_source(packet);
dst = packet->get_destination(packet);
data = packet->get_data(packet);
DBG2(DBG_NET, "sending packet: from %#H to %#H", src, dst);
-
+
/* send data */
sport = src->get_port(src);
family = dst->get_family(dst);
@@ -361,7 +370,7 @@ status_t sender(private_socket_t *this, packet_t *packet)
DBG1(DBG_NET, "unable to locate a send socket for port %d", sport);
return FAILED;
}
-
+
memset(&msg, 0, sizeof(struct msghdr));
msg.msg_name = dst->get_sockaddr(dst);;
msg.msg_namelen = *dst->get_sockaddr_len(dst);
@@ -370,7 +379,7 @@ status_t sender(private_socket_t *this, packet_t *packet)
msg.msg_iov = &iov;
msg.msg_iovlen = 1;
msg.msg_flags = 0;
-
+
if (!src->is_anyaddr(src))
{
if (family == AF_INET)
@@ -403,12 +412,13 @@ status_t sender(private_socket_t *this, packet_t *packet)
memcpy(addr, &sin->sin_addr, sizeof(struct in_addr));
#endif /* IP_PKTINFO || IP_SENDSRCADDR */
}
+#ifdef HAVE_IN6_PKTINFO
else
{
char buf[CMSG_SPACE(sizeof(struct in6_pktinfo))];
struct in6_pktinfo *pktinfo;
struct sockaddr_in6 *sin;
-
+
msg.msg_control = buf;
msg.msg_controllen = sizeof(buf);
cmsg = CMSG_FIRSTHDR(&msg);
@@ -420,8 +430,9 @@ status_t sender(private_socket_t *this, packet_t *packet)
sin = (struct sockaddr_in6*)src->get_sockaddr(src);
memcpy(&pktinfo->ipi6_addr, &sin->sin6_addr, sizeof(struct in6_addr));
}
+#endif /* HAVE_IN6_PKTINFO */
}
-
+
bytes_sent = sendmsg(skt, &msg, 0);
if (bytes_sent != data.len)
@@ -442,7 +453,7 @@ static int open_socket(private_socket_t *this, int family, u_int16_t port)
socklen_t addrlen;
u_int sol, pktinfo = 0;
int skt;
-
+
memset(&addr, 0, sizeof(addr));
/* precalculate constants depending on address family */
switch (family)
@@ -476,7 +487,7 @@ static int open_socket(private_socket_t *this, int family, u_int16_t port)
default:
return 0;
}
-
+
skt = socket(family, SOCK_DGRAM, IPPROTO_UDP);
if (skt < 0)
{
@@ -489,7 +500,7 @@ static int open_socket(private_socket_t *this, int family, u_int16_t port)
close(skt);
return 0;
}
-
+
/* bind the socket */
if (bind(skt, (struct sockaddr *)&addr, addrlen) < 0)
{
@@ -497,7 +508,7 @@ static int open_socket(private_socket_t *this, int family, u_int16_t port)
close(skt);
return 0;
}
-
+
/* get additional packet info on receive */
if (pktinfo > 0)
{
@@ -550,7 +561,7 @@ static bool enumerate(socket_enumerator_t *this, int *fd, int *family, int *port
{ offsetof(private_socket_t, ipv4_natt), AF_INET, IKEV2_NATT_PORT },
{ offsetof(private_socket_t, ipv6_natt), AF_INET6, IKEV2_NATT_PORT }
};
-
+
while(++this->index < countof(sockets))
{
int sock = *(int*)((char*)this->socket + sockets[this->index].fd_offset);
@@ -572,7 +583,7 @@ static bool enumerate(socket_enumerator_t *this, int *fd, int *family, int *port
static enumerator_t *create_enumerator(private_socket_t *this)
{
socket_enumerator_t *enumerator;
-
+
enumerator = malloc_thing(socket_enumerator_t);
enumerator->index = -1;
enumerator->socket = this;
@@ -617,7 +628,7 @@ socket_t *socket_create()
this->public.receive = (status_t(*)(socket_t*, packet_t**))receiver;
this->public.create_enumerator = (enumerator_t*(*)(socket_t*))create_enumerator;
this->public.destroy = (void(*)(socket_t*)) destroy;
-
+
this->ipv4 = 0;
this->ipv6 = 0;
this->ipv4_natt = 0;
@@ -634,7 +645,7 @@ socket_t *socket_create()
}
}
#endif
-
+
this->ipv4 = open_socket(this, AF_INET, IKEV2_UDP_PORT);
if (this->ipv4 == 0)
{
@@ -648,7 +659,7 @@ socket_t *socket_create()
DBG1(DBG_NET, "could not open IPv4 NAT-T socket");
}
}
-
+
this->ipv6 = open_socket(this, AF_INET6, IKEV2_UDP_PORT);
if (this->ipv6 == 0)
{
@@ -662,13 +673,13 @@ socket_t *socket_create()
DBG1(DBG_NET, "could not open IPv6 NAT-T socket");
}
}
-
+
if (!this->ipv4 && !this->ipv6)
{
DBG1(DBG_NET, "could not create any sockets");
destroy(this);
charon->kill(charon, "socket initialization failed");
- }
+ }
return (socket_t*)this;
}
diff --git a/src/charon/network/socket.h b/src/charon/network/socket.h
index 81f2ec5fe..83bb9d4c9 100644
--- a/src/charon/network/socket.h
+++ b/src/charon/network/socket.h
@@ -44,48 +44,48 @@ typedef struct socket_t socket_t;
* All available sockets are bound and the receive function
* reads from them. There are actually two implementations:
* The first uses raw sockets to allow binding of other daemons (pluto) to
- * UDP/500. An installed "Linux socket filter" filters out all non-IKEv2
- * traffic and handles just IKEv2 messages. An other daemon (pluto) must
- * handle all traffic separately, e.g. ignore IKEv2 traffic, since charon
+ * UDP/500. An installed "Linux socket filter" filters out all non-IKEv2
+ * traffic and handles just IKEv2 messages. An other daemon (pluto) must
+ * handle all traffic separately, e.g. ignore IKEv2 traffic, since charon
* handles that.
* The other implementation uses normal sockets and is built if
* --disable-pluto is given to the configure script.
*/
struct socket_t {
-
+
/**
* Receive a packet.
- *
+ *
* Reads a packet from the socket and sets source/dest
* appropriately.
- *
+ *
* @param packet pinter gets address from allocated packet_t
- * @return
+ * @return
* - SUCCESS when packet successfully received
* - FAILED when unable to receive
*/
status_t (*receive) (socket_t *this, packet_t **packet);
-
+
/**
* Send a packet.
- *
+ *
* Sends a packet to the net using source and destination addresses of
* the packet.
- *
+ *
* @param packet packet_t to send
- * @return
+ * @return
* - SUCCESS when packet successfully sent
* - FAILED when unable to send
*/
status_t (*send) (socket_t *this, packet_t *packet);
-
+
/**
* Enumerate all underlying socket file descriptors.
- *
+ *
* @return enumerator over (int fd, int family, int port)
*/
enumerator_t *(*create_enumerator) (socket_t *this);
-
+
/**
* Destroy socket.
*/
diff --git a/src/charon/plugins/attr/Makefile.in b/src/charon/plugins/attr/Makefile.in
index 5c94771e1..689bb3244 100644
--- a/src/charon/plugins/attr/Makefile.in
+++ b/src/charon/plugins/attr/Makefile.in
@@ -1,8 +1,9 @@
-# Makefile.in generated by automake 1.10.2 from Makefile.am.
+# Makefile.in generated by automake 1.11 from Makefile.am.
# @configure_input@
# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,
-# 2003, 2004, 2005, 2006, 2007, 2008 Free Software Foundation, Inc.
+# 2003, 2004, 2005, 2006, 2007, 2008, 2009 Free Software Foundation,
+# Inc.
# This Makefile.in is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.
@@ -16,8 +17,9 @@
VPATH = @srcdir@
pkgdatadir = $(datadir)/@PACKAGE@
-pkglibdir = $(libdir)/@PACKAGE@
pkgincludedir = $(includedir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkglibexecdir = $(libexecdir)/@PACKAGE@
am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
install_sh_DATA = $(install_sh) -c -m 644
install_sh_PROGRAM = $(install_sh) -c
@@ -35,19 +37,41 @@ host_triplet = @host@
subdir = src/charon/plugins/attr
DIST_COMMON = $(srcdir)/Makefile.am $(srcdir)/Makefile.in
ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
-am__aclocal_m4_deps = $(top_srcdir)/configure.in
+am__aclocal_m4_deps = $(top_srcdir)/m4/config/libtool.m4 \
+ $(top_srcdir)/m4/config/ltoptions.m4 \
+ $(top_srcdir)/m4/config/ltsugar.m4 \
+ $(top_srcdir)/m4/config/ltversion.m4 \
+ $(top_srcdir)/m4/config/lt~obsolete.m4 \
+ $(top_srcdir)/m4/macros/with.m4 \
+ $(top_srcdir)/m4/macros/enable-disable.m4 \
+ $(top_srcdir)/configure.in
am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
$(ACLOCAL_M4)
mkinstalldirs = $(install_sh) -d
CONFIG_CLEAN_FILES =
+CONFIG_CLEAN_VPATH_FILES =
am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
am__vpath_adj = case $$p in \
$(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
*) f=$$p;; \
esac;
-am__strip_dir = `echo $$p | sed -e 's|^.*/||'`;
+am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
+am__install_max = 40
+am__nobase_strip_setup = \
+ srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
+am__nobase_strip = \
+ for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
+am__nobase_list = $(am__nobase_strip_setup); \
+ for p in $$list; do echo "$$p $$p"; done | \
+ sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
+ $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
+ if (++n[$$2] == $(am__install_max)) \
+ { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
+ END { for (dir in files) print dir, files[dir] }'
+am__base_list = \
+ sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
+ sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
am__installdirs = "$(DESTDIR)$(plugindir)"
-pluginLTLIBRARIES_INSTALL = $(INSTALL)
LTLIBRARIES = $(plugin_LTLIBRARIES)
libstrongswan_attr_la_LIBADD =
am_libstrongswan_attr_la_OBJECTS = attr_plugin.lo attr_provider.lo
@@ -58,6 +82,7 @@ libstrongswan_attr_la_LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) \
DEFAULT_INCLUDES = -I.@am__isrc@
depcomp = $(SHELL) $(top_srcdir)/depcomp
am__depfiles_maybe = depfiles
+am__mv = mv -f
COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
LTCOMPILE = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
@@ -105,25 +130,22 @@ INSTALL_DATA = @INSTALL_DATA@
INSTALL_PROGRAM = @INSTALL_PROGRAM@
INSTALL_SCRIPT = @INSTALL_SCRIPT@
INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
-IPSEC_ROUTING_TABLE = @IPSEC_ROUTING_TABLE@
-IPSEC_ROUTING_TABLE_PRIO = @IPSEC_ROUTING_TABLE_PRIO@
LD = @LD@
LDFLAGS = @LDFLAGS@
LEX = @LEX@
LEXLIB = @LEXLIB@
LEX_OUTPUT_ROOT = @LEX_OUTPUT_ROOT@
-LIBGCRYPT_CFLAGS = @LIBGCRYPT_CFLAGS@
-LIBGCRYPT_CONFIG = @LIBGCRYPT_CONFIG@
-LIBGCRYPT_LIBS = @LIBGCRYPT_LIBS@
LIBOBJS = @LIBOBJS@
LIBS = @LIBS@
LIBTOOL = @LIBTOOL@
-LINUX_HEADERS = @LINUX_HEADERS@
LIPO = @LIPO@
LN_S = @LN_S@
LTLIBOBJS = @LTLIBOBJS@
MAKEINFO = @MAKEINFO@
MKDIR_P = @MKDIR_P@
+MYSQLCFLAG = @MYSQLCFLAG@
+MYSQLCONFIG = @MYSQLCONFIG@
+MYSQLLIB = @MYSQLLIB@
NM = @NM@
NMEDIT = @NMEDIT@
OBJDUMP = @OBJDUMP@
@@ -135,11 +157,14 @@ PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
PACKAGE_NAME = @PACKAGE_NAME@
PACKAGE_STRING = @PACKAGE_STRING@
PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_URL = @PACKAGE_URL@
PACKAGE_VERSION = @PACKAGE_VERSION@
PATH_SEPARATOR = @PATH_SEPARATOR@
PERL = @PERL@
PKG_CONFIG = @PKG_CONFIG@
+PTHREADLIB = @PTHREADLIB@
RANLIB = @RANLIB@
+RTLIB = @RTLIB@
RUBY = @RUBY@
RUBYINCLUDE = @RUBYINCLUDE@
SED = @SED@
@@ -168,9 +193,9 @@ build_cpu = @build_cpu@
build_os = @build_os@
build_vendor = @build_vendor@
builddir = @builddir@
-confdir = @confdir@
datadir = @datadir@
datarootdir = @datarootdir@
+default_pkcs11 = @default_pkcs11@
docdir = @docdir@
dvidir = @dvidir@
exec_prefix = @exec_prefix@
@@ -193,7 +218,7 @@ ipsecuser = @ipsecuser@
libdir = @libdir@
libexecdir = @libexecdir@
libstrongswan_plugins = @libstrongswan_plugins@
-linuxdir = @linuxdir@
+linux_headers = @linux_headers@
localedir = @localedir@
localstatedir = @localstatedir@
lt_ECHO = @lt_ECHO@
@@ -201,6 +226,7 @@ mandir = @mandir@
mkdir_p = @mkdir_p@
nm_CFLAGS = @nm_CFLAGS@
nm_LIBS = @nm_LIBS@
+nm_ca_dir = @nm_ca_dir@
oldincludedir = @oldincludedir@
pdfdir = @pdfdir@
piddir = @piddir@
@@ -209,10 +235,12 @@ pluto_plugins = @pluto_plugins@
prefix = @prefix@
program_transform_name = @program_transform_name@
psdir = @psdir@
+random_device = @random_device@
resolv_conf = @resolv_conf@
+routing_table = @routing_table@
+routing_table_prio = @routing_table_prio@
sbindir = @sbindir@
sharedstatedir = @sharedstatedir@
-simreader = @simreader@
srcdir = @srcdir@
strongswan_conf = @strongswan_conf@
sysconfdir = @sysconfdir@
@@ -220,6 +248,7 @@ target_alias = @target_alias@
top_build_prefix = @top_build_prefix@
top_builddir = @top_builddir@
top_srcdir = @top_srcdir@
+urandom_device = @urandom_device@
xml_CFLAGS = @xml_CFLAGS@
xml_LIBS = @xml_LIBS@
INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
@@ -242,9 +271,9 @@ $(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps)
exit 1;; \
esac; \
done; \
- echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/charon/plugins/attr/Makefile'; \
- cd $(top_srcdir) && \
- $(AUTOMAKE) --gnu src/charon/plugins/attr/Makefile
+ echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/charon/plugins/attr/Makefile'; \
+ $(am__cd) $(top_srcdir) && \
+ $(AUTOMAKE) --gnu src/charon/plugins/attr/Makefile
.PRECIOUS: Makefile
Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
@case '$?' in \
@@ -262,23 +291,28 @@ $(top_srcdir)/configure: $(am__configure_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
$(ACLOCAL_M4): $(am__aclocal_m4_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(am__aclocal_m4_deps):
install-pluginLTLIBRARIES: $(plugin_LTLIBRARIES)
@$(NORMAL_INSTALL)
test -z "$(plugindir)" || $(MKDIR_P) "$(DESTDIR)$(plugindir)"
- @list='$(plugin_LTLIBRARIES)'; for p in $$list; do \
+ @list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+ list2=; for p in $$list; do \
if test -f $$p; then \
- f=$(am__strip_dir) \
- echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(pluginLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) '$$p' '$(DESTDIR)$(plugindir)/$$f'"; \
- $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(pluginLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) "$$p" "$(DESTDIR)$(plugindir)/$$f"; \
+ list2="$$list2 $$p"; \
else :; fi; \
- done
+ done; \
+ test -z "$$list2" || { \
+ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(plugindir)'"; \
+ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(plugindir)"; \
+ }
uninstall-pluginLTLIBRARIES:
@$(NORMAL_UNINSTALL)
- @list='$(plugin_LTLIBRARIES)'; for p in $$list; do \
- p=$(am__strip_dir) \
- echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$p'"; \
- $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$p"; \
+ @list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+ for p in $$list; do \
+ $(am__strip_dir) \
+ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$f'"; \
+ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$f"; \
done
clean-pluginLTLIBRARIES:
@@ -303,21 +337,21 @@ distclean-compile:
.c.o:
@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(COMPILE) -c $<
.c.obj:
@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(COMPILE) -c `$(CYGPATH_W) '$<'`
.c.lo:
@am__fastdepCC_TRUE@ $(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(LTCOMPILE) -c -o $@ $<
@@ -340,7 +374,7 @@ tags: TAGS
TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
$(TAGS_FILES) $(LISP)
- tags=; \
+ set x; \
here=`pwd`; \
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
unique=`for i in $$list; do \
@@ -348,29 +382,34 @@ TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
- if test -z "$(ETAGS_ARGS)$$tags$$unique"; then :; else \
+ shift; \
+ if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
test -n "$$unique" || unique=$$empty_fix; \
- $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
- $$tags $$unique; \
+ if test $$# -gt 0; then \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ "$$@" $$unique; \
+ else \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ $$unique; \
+ fi; \
fi
ctags: CTAGS
CTAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
$(TAGS_FILES) $(LISP)
- tags=; \
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
unique=`for i in $$list; do \
if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
- test -z "$(CTAGS_ARGS)$$tags$$unique" \
+ test -z "$(CTAGS_ARGS)$$unique" \
|| $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
- $$tags $$unique
+ $$unique
GTAGS:
here=`$(am__cd) $(top_builddir) && pwd` \
- && cd $(top_srcdir) \
- && gtags -i $(GTAGS_ARGS) $$here
+ && $(am__cd) $(top_srcdir) \
+ && gtags -i $(GTAGS_ARGS) "$$here"
distclean-tags:
-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
@@ -391,13 +430,17 @@ distdir: $(DISTFILES)
if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
if test -d $$d/$$file; then \
dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
+ if test -d "$(distdir)/$$file"; then \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+ fi; \
if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
- cp -pR $(srcdir)/$$file $(distdir)$$dir || exit 1; \
+ cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
fi; \
- cp -pR $$d/$$file $(distdir)$$dir || exit 1; \
+ cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
else \
- test -f $(distdir)/$$file \
- || cp -p $$d/$$file $(distdir)/$$file \
+ test -f "$(distdir)/$$file" \
+ || cp -p $$d/$$file "$(distdir)/$$file" \
|| exit 1; \
fi; \
done
@@ -428,6 +471,7 @@ clean-generic:
distclean-generic:
-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+ -test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
maintainer-clean-generic:
@echo "This command is intended for maintainers to use"
@@ -449,6 +493,8 @@ dvi-am:
html: html-am
+html-am:
+
info: info-am
info-am:
@@ -457,18 +503,28 @@ install-data-am: install-pluginLTLIBRARIES
install-dvi: install-dvi-am
+install-dvi-am:
+
install-exec-am:
install-html: install-html-am
+install-html-am:
+
install-info: install-info-am
+install-info-am:
+
install-man:
install-pdf: install-pdf-am
+install-pdf-am:
+
install-ps: install-ps-am
+install-ps-am:
+
installcheck-am:
maintainer-clean: maintainer-clean-am
@@ -507,6 +563,7 @@ uninstall-am: uninstall-pluginLTLIBRARIES
mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \
tags uninstall uninstall-am uninstall-pluginLTLIBRARIES
+
# Tell versions [3.59,3.63) of GNU make to not export all variables.
# Otherwise a system limit (for SysV at least) may be exceeded.
.NOEXPORT:
diff --git a/src/charon/plugins/attr/attr_plugin.c b/src/charon/plugins/attr/attr_plugin.c
index 9d5532310..6dfb10271 100644
--- a/src/charon/plugins/attr/attr_plugin.c
+++ b/src/charon/plugins/attr/attr_plugin.c
@@ -24,12 +24,12 @@ typedef struct private_attr_plugin_t private_attr_plugin_t;
* private data of attr plugin
*/
struct private_attr_plugin_t {
-
+
/**
* implements plugin interface
*/
attr_plugin_t public;
-
+
/**
* CFG attributes provider
*/
@@ -41,7 +41,7 @@ struct private_attr_plugin_t {
*/
static void destroy(private_attr_plugin_t *this)
{
- charon->attributes->remove_provider(charon->attributes, &this->provider->provider);
+ lib->attributes->remove_provider(lib->attributes, &this->provider->provider);
this->provider->destroy(this->provider);
free(this);
}
@@ -52,12 +52,12 @@ static void destroy(private_attr_plugin_t *this)
plugin_t *plugin_create()
{
private_attr_plugin_t *this = malloc_thing(private_attr_plugin_t);
-
+
this->public.plugin.destroy = (void(*)(plugin_t*))destroy;
-
+
this->provider = attr_provider_create();
- charon->attributes->add_provider(charon->attributes, &this->provider->provider);
-
+ lib->attributes->add_provider(lib->attributes, &this->provider->provider);
+
return &this->public.plugin;
}
diff --git a/src/charon/plugins/attr/attr_plugin.h b/src/charon/plugins/attr/attr_plugin.h
index 9cbbd8bf5..9f31b60e1 100644
--- a/src/charon/plugins/attr/attr_plugin.h
+++ b/src/charon/plugins/attr/attr_plugin.h
@@ -32,7 +32,7 @@ typedef struct attr_plugin_t attr_plugin_t;
* Plugin providing configuration attribute through strongswan.conf.
*/
struct attr_plugin_t {
-
+
/**
* implements plugin interface
*/
diff --git a/src/charon/plugins/attr/attr_provider.c b/src/charon/plugins/attr/attr_provider.c
index 02fa11327..548896f56 100644
--- a/src/charon/plugins/attr/attr_provider.c
+++ b/src/charon/plugins/attr/attr_provider.c
@@ -28,12 +28,12 @@ typedef struct attribute_entry_t attribute_entry_t;
* private data of attr_provider
*/
struct private_attr_provider_t {
-
+
/**
* public functions
*/
attr_provider_t public;
-
+
/**
* List of attributes, attribute_entry_t
*/
@@ -61,12 +61,16 @@ static bool attr_enum_filter(void *null, attribute_entry_t **in,
/**
* Implementation of attribute_provider_t.create_attribute_enumerator
*/
-static enumerator_t* create_attribute_enumerator(
- private_attr_provider_t *this, identification_t *id)
+static enumerator_t* create_attribute_enumerator(private_attr_provider_t *this,
+ identification_t *id, host_t *vip)
{
- return enumerator_create_filter(
+ if (vip)
+ {
+ return enumerator_create_filter(
this->attributes->create_enumerator(this->attributes),
(void*)attr_enum_filter, NULL, NULL);
+ }
+ return enumerator_create_empty();
}
/**
@@ -75,7 +79,7 @@ static enumerator_t* create_attribute_enumerator(
static void destroy(private_attr_provider_t *this)
{
attribute_entry_t *entry;
-
+
while (this->attributes->remove_last(this->attributes,
(void**)&entry) == SUCCESS)
{
@@ -89,13 +93,13 @@ static void destroy(private_attr_provider_t *this)
/**
* Add an attribute entry to the list
*/
-static void add_entry(private_attr_provider_t *this, char *key, int nr,
- configuration_attribute_type_t type)
+static void add_legacy_entry(private_attr_provider_t *this, char *key, int nr,
+ configuration_attribute_type_t type)
{
attribute_entry_t *entry;
host_t *host;
char *str;
-
+
str = lib->settings->get_str(lib->settings, "charon.%s%d", NULL, key, nr);
if (str)
{
@@ -103,7 +107,7 @@ static void add_entry(private_attr_provider_t *this, char *key, int nr,
if (host)
{
entry = malloc_thing(attribute_entry_t);
-
+
if (host->get_family(host) == AF_INET6)
{
switch (type)
@@ -126,6 +130,82 @@ static void add_entry(private_attr_provider_t *this, char *key, int nr,
}
}
+/**
+ * Key to attribute type mappings, for v4 and v6 attributes
+ */
+static struct {
+ char *name;
+ configuration_attribute_type_t v4;
+ configuration_attribute_type_t v6;
+} keys[] = {
+ {"address", INTERNAL_IP4_ADDRESS, INTERNAL_IP6_ADDRESS},
+ {"dns", INTERNAL_IP4_DNS, INTERNAL_IP6_DNS},
+ {"nbns", INTERNAL_IP4_NBNS, INTERNAL_IP6_NBNS},
+ {"dhcp", INTERNAL_IP4_DHCP, INTERNAL_IP6_DHCP},
+ {"netmask", INTERNAL_IP4_NETMASK, INTERNAL_IP6_NETMASK},
+ {"server", INTERNAL_IP4_SERVER, INTERNAL_IP6_SERVER},
+};
+
+/**
+ * Load (numerical) entries from the plugins.attr namespace
+ */
+static void load_entries(private_attr_provider_t *this)
+{
+ enumerator_t *enumerator, *tokens;
+ char *key, *value, *token;
+
+ enumerator = lib->settings->create_key_value_enumerator(lib->settings,
+ "charon.plugins.attr");
+ while (enumerator->enumerate(enumerator, &key, &value))
+ {
+ configuration_attribute_type_t type;
+ attribute_entry_t *entry;
+ host_t *host;
+ int i;
+
+ type = atoi(key);
+ tokens = enumerator_create_token(value, ",", " ");
+ while (tokens->enumerate(tokens, &token))
+ {
+ host = host_create_from_string(token, 0);
+ if (!host)
+ {
+ DBG1(DBG_CFG, "invalid host in key %s: %s", key, token);
+ continue;
+ }
+ if (!type)
+ {
+ for (i = 0; i < countof(keys); i++)
+ {
+ if (streq(key, keys[i].name))
+ {
+ if (host->get_family(host) == AF_INET)
+ {
+ type = keys[i].v4;
+ }
+ else
+ {
+ type = keys[i].v6;
+ }
+ }
+ }
+ if (!type)
+ {
+ DBG1(DBG_CFG, "mapping attribute type %s failed", key);
+ break;
+ }
+ }
+ entry = malloc_thing(attribute_entry_t);
+ entry->type = type;
+ entry->value = chunk_clone(host->get_address(host));
+ host->destroy(host);
+ this->attributes->insert_last(this->attributes, entry);
+ }
+ tokens->destroy(tokens);
+ }
+ enumerator->destroy(enumerator);
+}
+
/*
* see header file
*/
@@ -133,22 +213,24 @@ attr_provider_t *attr_provider_create(database_t *db)
{
private_attr_provider_t *this;
int i;
-
+
this = malloc_thing(private_attr_provider_t);
-
+
this->public.provider.acquire_address = (host_t*(*)(attribute_provider_t *this, char*, identification_t *, host_t *))return_null;
this->public.provider.release_address = (bool(*)(attribute_provider_t *this, char*,host_t *, identification_t*))return_false;
- this->public.provider.create_attribute_enumerator = (enumerator_t*(*)(attribute_provider_t*, identification_t *id))create_attribute_enumerator;
+ this->public.provider.create_attribute_enumerator = (enumerator_t*(*)(attribute_provider_t*, identification_t *id, host_t *vip))create_attribute_enumerator;
this->public.destroy = (void(*)(attr_provider_t*))destroy;
-
+
this->attributes = linked_list_create();
-
+
for (i = 1; i <= SERVER_MAX; i++)
{
- add_entry(this, "dns", i, INTERNAL_IP4_DNS);
- add_entry(this, "nbns", i, INTERNAL_IP4_NBNS);
+ add_legacy_entry(this, "dns", i, INTERNAL_IP4_DNS);
+ add_legacy_entry(this, "nbns", i, INTERNAL_IP4_NBNS);
}
-
+
+ load_entries(this);
+
return &this->public;
}
diff --git a/src/charon/plugins/attr/attr_provider.h b/src/charon/plugins/attr/attr_provider.h
index 03cbadb4e..a41466718 100644
--- a/src/charon/plugins/attr/attr_provider.h
+++ b/src/charon/plugins/attr/attr_provider.h
@@ -21,7 +21,7 @@
#ifndef ATTR_PROVIDER_H_
#define ATTR_PROVIDER_H_
-#include <config/attributes/attribute_provider.h>
+#include <attributes/attribute_provider.h>
typedef struct attr_provider_t attr_provider_t;
@@ -29,12 +29,12 @@ typedef struct attr_provider_t attr_provider_t;
* Provide configuration attributes through static strongswan.conf definition.
*/
struct attr_provider_t {
-
+
/**
* Implements attribute provider interface
*/
attribute_provider_t provider;
-
+
/**
* Destroy a attr_provider instance.
*/
diff --git a/src/charon/plugins/eap_aka/Makefile.am b/src/charon/plugins/eap_aka/Makefile.am
index 1a3ea1857..e007f5f00 100644
--- a/src/charon/plugins/eap_aka/Makefile.am
+++ b/src/charon/plugins/eap_aka/Makefile.am
@@ -1,11 +1,14 @@
-INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
+INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon \
+ -I$(top_srcdir)/src/libsimaka
AM_CFLAGS = -rdynamic
-plugin_LTLIBRARIES = libstrongswan-eapaka.la
+plugin_LTLIBRARIES = libstrongswan-eap-aka.la
-libstrongswan_eapaka_la_SOURCES = eap_aka_plugin.h eap_aka_plugin.c eap_aka.h eap_aka.c
-libstrongswan_eapaka_la_LDFLAGS = -module -avoid-version
-libstrongswan_eapaka_la_LIBADD = -lgmp
+libstrongswan_eap_aka_la_SOURCES = eap_aka_plugin.h eap_aka_plugin.c \
+ eap_aka_peer.h eap_aka_peer.c \
+ eap_aka_server.h eap_aka_server.c
+libstrongswan_eap_aka_la_LIBADD = $(top_builddir)/src/libsimaka/libsimaka.la
+libstrongswan_eap_aka_la_LDFLAGS = -module -avoid-version
diff --git a/src/charon/plugins/eap_aka/Makefile.in b/src/charon/plugins/eap_aka/Makefile.in
index 2d2405379..d241e1ad0 100644
--- a/src/charon/plugins/eap_aka/Makefile.in
+++ b/src/charon/plugins/eap_aka/Makefile.in
@@ -1,8 +1,9 @@
-# Makefile.in generated by automake 1.10.2 from Makefile.am.
+# Makefile.in generated by automake 1.11 from Makefile.am.
# @configure_input@
# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,
-# 2003, 2004, 2005, 2006, 2007, 2008 Free Software Foundation, Inc.
+# 2003, 2004, 2005, 2006, 2007, 2008, 2009 Free Software Foundation,
+# Inc.
# This Makefile.in is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.
@@ -16,8 +17,9 @@
VPATH = @srcdir@
pkgdatadir = $(datadir)/@PACKAGE@
-pkglibdir = $(libdir)/@PACKAGE@
pkgincludedir = $(includedir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkglibexecdir = $(libexecdir)/@PACKAGE@
am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
install_sh_DATA = $(install_sh) -c -m 644
install_sh_PROGRAM = $(install_sh) -c
@@ -35,30 +37,55 @@ host_triplet = @host@
subdir = src/charon/plugins/eap_aka
DIST_COMMON = $(srcdir)/Makefile.am $(srcdir)/Makefile.in
ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
-am__aclocal_m4_deps = $(top_srcdir)/configure.in
+am__aclocal_m4_deps = $(top_srcdir)/m4/config/libtool.m4 \
+ $(top_srcdir)/m4/config/ltoptions.m4 \
+ $(top_srcdir)/m4/config/ltsugar.m4 \
+ $(top_srcdir)/m4/config/ltversion.m4 \
+ $(top_srcdir)/m4/config/lt~obsolete.m4 \
+ $(top_srcdir)/m4/macros/with.m4 \
+ $(top_srcdir)/m4/macros/enable-disable.m4 \
+ $(top_srcdir)/configure.in
am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
$(ACLOCAL_M4)
mkinstalldirs = $(install_sh) -d
CONFIG_CLEAN_FILES =
+CONFIG_CLEAN_VPATH_FILES =
am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
am__vpath_adj = case $$p in \
$(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
*) f=$$p;; \
esac;
-am__strip_dir = `echo $$p | sed -e 's|^.*/||'`;
+am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
+am__install_max = 40
+am__nobase_strip_setup = \
+ srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
+am__nobase_strip = \
+ for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
+am__nobase_list = $(am__nobase_strip_setup); \
+ for p in $$list; do echo "$$p $$p"; done | \
+ sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
+ $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
+ if (++n[$$2] == $(am__install_max)) \
+ { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
+ END { for (dir in files) print dir, files[dir] }'
+am__base_list = \
+ sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
+ sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
am__installdirs = "$(DESTDIR)$(plugindir)"
-pluginLTLIBRARIES_INSTALL = $(INSTALL)
LTLIBRARIES = $(plugin_LTLIBRARIES)
-libstrongswan_eapaka_la_DEPENDENCIES =
-am_libstrongswan_eapaka_la_OBJECTS = eap_aka_plugin.lo eap_aka.lo
-libstrongswan_eapaka_la_OBJECTS = \
- $(am_libstrongswan_eapaka_la_OBJECTS)
-libstrongswan_eapaka_la_LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) \
+libstrongswan_eap_aka_la_DEPENDENCIES = \
+ $(top_builddir)/src/libsimaka/libsimaka.la
+am_libstrongswan_eap_aka_la_OBJECTS = eap_aka_plugin.lo \
+ eap_aka_peer.lo eap_aka_server.lo
+libstrongswan_eap_aka_la_OBJECTS = \
+ $(am_libstrongswan_eap_aka_la_OBJECTS)
+libstrongswan_eap_aka_la_LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) \
$(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \
- $(libstrongswan_eapaka_la_LDFLAGS) $(LDFLAGS) -o $@
+ $(libstrongswan_eap_aka_la_LDFLAGS) $(LDFLAGS) -o $@
DEFAULT_INCLUDES = -I.@am__isrc@
depcomp = $(SHELL) $(top_srcdir)/depcomp
am__depfiles_maybe = depfiles
+am__mv = mv -f
COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
LTCOMPILE = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
@@ -68,8 +95,8 @@ CCLD = $(CC)
LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
--mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) $(AM_LDFLAGS) \
$(LDFLAGS) -o $@
-SOURCES = $(libstrongswan_eapaka_la_SOURCES)
-DIST_SOURCES = $(libstrongswan_eapaka_la_SOURCES)
+SOURCES = $(libstrongswan_eap_aka_la_SOURCES)
+DIST_SOURCES = $(libstrongswan_eap_aka_la_SOURCES)
ETAGS = etags
CTAGS = ctags
DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
@@ -106,25 +133,22 @@ INSTALL_DATA = @INSTALL_DATA@
INSTALL_PROGRAM = @INSTALL_PROGRAM@
INSTALL_SCRIPT = @INSTALL_SCRIPT@
INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
-IPSEC_ROUTING_TABLE = @IPSEC_ROUTING_TABLE@
-IPSEC_ROUTING_TABLE_PRIO = @IPSEC_ROUTING_TABLE_PRIO@
LD = @LD@
LDFLAGS = @LDFLAGS@
LEX = @LEX@
LEXLIB = @LEXLIB@
LEX_OUTPUT_ROOT = @LEX_OUTPUT_ROOT@
-LIBGCRYPT_CFLAGS = @LIBGCRYPT_CFLAGS@
-LIBGCRYPT_CONFIG = @LIBGCRYPT_CONFIG@
-LIBGCRYPT_LIBS = @LIBGCRYPT_LIBS@
LIBOBJS = @LIBOBJS@
LIBS = @LIBS@
LIBTOOL = @LIBTOOL@
-LINUX_HEADERS = @LINUX_HEADERS@
LIPO = @LIPO@
LN_S = @LN_S@
LTLIBOBJS = @LTLIBOBJS@
MAKEINFO = @MAKEINFO@
MKDIR_P = @MKDIR_P@
+MYSQLCFLAG = @MYSQLCFLAG@
+MYSQLCONFIG = @MYSQLCONFIG@
+MYSQLLIB = @MYSQLLIB@
NM = @NM@
NMEDIT = @NMEDIT@
OBJDUMP = @OBJDUMP@
@@ -136,11 +160,14 @@ PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
PACKAGE_NAME = @PACKAGE_NAME@
PACKAGE_STRING = @PACKAGE_STRING@
PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_URL = @PACKAGE_URL@
PACKAGE_VERSION = @PACKAGE_VERSION@
PATH_SEPARATOR = @PATH_SEPARATOR@
PERL = @PERL@
PKG_CONFIG = @PKG_CONFIG@
+PTHREADLIB = @PTHREADLIB@
RANLIB = @RANLIB@
+RTLIB = @RTLIB@
RUBY = @RUBY@
RUBYINCLUDE = @RUBYINCLUDE@
SED = @SED@
@@ -169,9 +196,9 @@ build_cpu = @build_cpu@
build_os = @build_os@
build_vendor = @build_vendor@
builddir = @builddir@
-confdir = @confdir@
datadir = @datadir@
datarootdir = @datarootdir@
+default_pkcs11 = @default_pkcs11@
docdir = @docdir@
dvidir = @dvidir@
exec_prefix = @exec_prefix@
@@ -194,7 +221,7 @@ ipsecuser = @ipsecuser@
libdir = @libdir@
libexecdir = @libexecdir@
libstrongswan_plugins = @libstrongswan_plugins@
-linuxdir = @linuxdir@
+linux_headers = @linux_headers@
localedir = @localedir@
localstatedir = @localstatedir@
lt_ECHO = @lt_ECHO@
@@ -202,6 +229,7 @@ mandir = @mandir@
mkdir_p = @mkdir_p@
nm_CFLAGS = @nm_CFLAGS@
nm_LIBS = @nm_LIBS@
+nm_ca_dir = @nm_ca_dir@
oldincludedir = @oldincludedir@
pdfdir = @pdfdir@
piddir = @piddir@
@@ -210,10 +238,12 @@ pluto_plugins = @pluto_plugins@
prefix = @prefix@
program_transform_name = @program_transform_name@
psdir = @psdir@
+random_device = @random_device@
resolv_conf = @resolv_conf@
+routing_table = @routing_table@
+routing_table_prio = @routing_table_prio@
sbindir = @sbindir@
sharedstatedir = @sharedstatedir@
-simreader = @simreader@
srcdir = @srcdir@
strongswan_conf = @strongswan_conf@
sysconfdir = @sysconfdir@
@@ -221,14 +251,20 @@ target_alias = @target_alias@
top_build_prefix = @top_build_prefix@
top_builddir = @top_builddir@
top_srcdir = @top_srcdir@
+urandom_device = @urandom_device@
xml_CFLAGS = @xml_CFLAGS@
xml_LIBS = @xml_LIBS@
-INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
+INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon \
+ -I$(top_srcdir)/src/libsimaka
+
AM_CFLAGS = -rdynamic
-plugin_LTLIBRARIES = libstrongswan-eapaka.la
-libstrongswan_eapaka_la_SOURCES = eap_aka_plugin.h eap_aka_plugin.c eap_aka.h eap_aka.c
-libstrongswan_eapaka_la_LDFLAGS = -module -avoid-version
-libstrongswan_eapaka_la_LIBADD = -lgmp
+plugin_LTLIBRARIES = libstrongswan-eap-aka.la
+libstrongswan_eap_aka_la_SOURCES = eap_aka_plugin.h eap_aka_plugin.c \
+ eap_aka_peer.h eap_aka_peer.c \
+ eap_aka_server.h eap_aka_server.c
+
+libstrongswan_eap_aka_la_LIBADD = $(top_builddir)/src/libsimaka/libsimaka.la
+libstrongswan_eap_aka_la_LDFLAGS = -module -avoid-version
all: all-am
.SUFFIXES:
@@ -242,9 +278,9 @@ $(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps)
exit 1;; \
esac; \
done; \
- echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/charon/plugins/eap_aka/Makefile'; \
- cd $(top_srcdir) && \
- $(AUTOMAKE) --gnu src/charon/plugins/eap_aka/Makefile
+ echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/charon/plugins/eap_aka/Makefile'; \
+ $(am__cd) $(top_srcdir) && \
+ $(AUTOMAKE) --gnu src/charon/plugins/eap_aka/Makefile
.PRECIOUS: Makefile
Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
@case '$?' in \
@@ -262,23 +298,28 @@ $(top_srcdir)/configure: $(am__configure_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
$(ACLOCAL_M4): $(am__aclocal_m4_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(am__aclocal_m4_deps):
install-pluginLTLIBRARIES: $(plugin_LTLIBRARIES)
@$(NORMAL_INSTALL)
test -z "$(plugindir)" || $(MKDIR_P) "$(DESTDIR)$(plugindir)"
- @list='$(plugin_LTLIBRARIES)'; for p in $$list; do \
+ @list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+ list2=; for p in $$list; do \
if test -f $$p; then \
- f=$(am__strip_dir) \
- echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(pluginLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) '$$p' '$(DESTDIR)$(plugindir)/$$f'"; \
- $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(pluginLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) "$$p" "$(DESTDIR)$(plugindir)/$$f"; \
+ list2="$$list2 $$p"; \
else :; fi; \
- done
+ done; \
+ test -z "$$list2" || { \
+ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(plugindir)'"; \
+ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(plugindir)"; \
+ }
uninstall-pluginLTLIBRARIES:
@$(NORMAL_UNINSTALL)
- @list='$(plugin_LTLIBRARIES)'; for p in $$list; do \
- p=$(am__strip_dir) \
- echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$p'"; \
- $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$p"; \
+ @list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+ for p in $$list; do \
+ $(am__strip_dir) \
+ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$f'"; \
+ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$f"; \
done
clean-pluginLTLIBRARIES:
@@ -289,8 +330,8 @@ clean-pluginLTLIBRARIES:
echo "rm -f \"$${dir}/so_locations\""; \
rm -f "$${dir}/so_locations"; \
done
-libstrongswan-eapaka.la: $(libstrongswan_eapaka_la_OBJECTS) $(libstrongswan_eapaka_la_DEPENDENCIES)
- $(libstrongswan_eapaka_la_LINK) -rpath $(plugindir) $(libstrongswan_eapaka_la_OBJECTS) $(libstrongswan_eapaka_la_LIBADD) $(LIBS)
+libstrongswan-eap-aka.la: $(libstrongswan_eap_aka_la_OBJECTS) $(libstrongswan_eap_aka_la_DEPENDENCIES)
+ $(libstrongswan_eap_aka_la_LINK) -rpath $(plugindir) $(libstrongswan_eap_aka_la_OBJECTS) $(libstrongswan_eap_aka_la_LIBADD) $(LIBS)
mostlyclean-compile:
-rm -f *.$(OBJEXT)
@@ -298,26 +339,27 @@ mostlyclean-compile:
distclean-compile:
-rm -f *.tab.c
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/eap_aka.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/eap_aka_peer.Plo@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/eap_aka_plugin.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/eap_aka_server.Plo@am__quote@
.c.o:
@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(COMPILE) -c $<
.c.obj:
@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(COMPILE) -c `$(CYGPATH_W) '$<'`
.c.lo:
@am__fastdepCC_TRUE@ $(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(LTCOMPILE) -c -o $@ $<
@@ -340,7 +382,7 @@ tags: TAGS
TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
$(TAGS_FILES) $(LISP)
- tags=; \
+ set x; \
here=`pwd`; \
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
unique=`for i in $$list; do \
@@ -348,29 +390,34 @@ TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
- if test -z "$(ETAGS_ARGS)$$tags$$unique"; then :; else \
+ shift; \
+ if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
test -n "$$unique" || unique=$$empty_fix; \
- $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
- $$tags $$unique; \
+ if test $$# -gt 0; then \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ "$$@" $$unique; \
+ else \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ $$unique; \
+ fi; \
fi
ctags: CTAGS
CTAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
$(TAGS_FILES) $(LISP)
- tags=; \
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
unique=`for i in $$list; do \
if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
- test -z "$(CTAGS_ARGS)$$tags$$unique" \
+ test -z "$(CTAGS_ARGS)$$unique" \
|| $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
- $$tags $$unique
+ $$unique
GTAGS:
here=`$(am__cd) $(top_builddir) && pwd` \
- && cd $(top_srcdir) \
- && gtags -i $(GTAGS_ARGS) $$here
+ && $(am__cd) $(top_srcdir) \
+ && gtags -i $(GTAGS_ARGS) "$$here"
distclean-tags:
-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
@@ -391,13 +438,17 @@ distdir: $(DISTFILES)
if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
if test -d $$d/$$file; then \
dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
+ if test -d "$(distdir)/$$file"; then \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+ fi; \
if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
- cp -pR $(srcdir)/$$file $(distdir)$$dir || exit 1; \
+ cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
fi; \
- cp -pR $$d/$$file $(distdir)$$dir || exit 1; \
+ cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
else \
- test -f $(distdir)/$$file \
- || cp -p $$d/$$file $(distdir)/$$file \
+ test -f "$(distdir)/$$file" \
+ || cp -p $$d/$$file "$(distdir)/$$file" \
|| exit 1; \
fi; \
done
@@ -428,6 +479,7 @@ clean-generic:
distclean-generic:
-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+ -test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
maintainer-clean-generic:
@echo "This command is intended for maintainers to use"
@@ -449,6 +501,8 @@ dvi-am:
html: html-am
+html-am:
+
info: info-am
info-am:
@@ -457,18 +511,28 @@ install-data-am: install-pluginLTLIBRARIES
install-dvi: install-dvi-am
+install-dvi-am:
+
install-exec-am:
install-html: install-html-am
+install-html-am:
+
install-info: install-info-am
+install-info-am:
+
install-man:
install-pdf: install-pdf-am
+install-pdf-am:
+
install-ps: install-ps-am
+install-ps-am:
+
installcheck-am:
maintainer-clean: maintainer-clean-am
@@ -507,6 +571,7 @@ uninstall-am: uninstall-pluginLTLIBRARIES
mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \
tags uninstall uninstall-am uninstall-pluginLTLIBRARIES
+
# Tell versions [3.59,3.63) of GNU make to not export all variables.
# Otherwise a system limit (for SysV at least) may be exceeded.
.NOEXPORT:
diff --git a/src/charon/plugins/eap_aka/eap_aka.c b/src/charon/plugins/eap_aka/eap_aka.c
deleted file mode 100644
index 82ee6c3f0..000000000
--- a/src/charon/plugins/eap_aka/eap_aka.c
+++ /dev/null
@@ -1,1553 +0,0 @@
-/*
- * Copyright (C) 2006 Martin Willi
- * Hochschule fuer Technik Rapperswil
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
- * for more details.
- */
-
-
-/* The EAP-AKA method uses it's own simple parser for processing EAP-AKA
- * payloads, as the IKEv2 parser is not suitable for that job. There are
- * two simple methods for parsing payloads, read_header() and read_attribute().
- * Every EAP-AKA payload consists of a header and a list of attributes. Those
- * functions mentioned read the data and return the type of the found
- * attribute/EAP-AKA-type. For generating a EAP-AKA message, we have a
- * build_aka_payload(), which builds the whole message from a variable
- * argument list containing its attributes.
- * The processing of messages is split up in various functions:
- * - peer_process() - General processing multiplexer for the peer
- * - peer_process_challenge() - Specific AKA-Challenge processor
- * - peer_process_notification() - Processing of AKA-Notification
- * - server_process() - General processing multiplexer for the server
- * - peer_process_challenge() - Processing of a received Challenge response
- * - peer_process_synchronize() - Process a sequence number synchronization
- * - server_initiate() - Initiation method for the server, calls
- * - server_initiate_challenge() - Initiation of AKA-Challenge
- */
-
-#include <limits.h>
-#include <string.h>
-#include <unistd.h>
-#include <sys/time.h>
-#include <time.h>
-#include <gmp.h>
-
-#include "eap_aka.h"
-
-#include <daemon.h>
-#include <library.h>
-#include <crypto/hashers/hasher.h>
-
-/* Use test vectors specified in S.S0055
-#define TEST_VECTORS */
-
-#define RAND_LENGTH 16
-#define RES_LENGTH 16
-#define SQN_LENGTH 6
-#define K_LENGTH 16
-#define MAC_LENGTH 8
-#define CK_LENGTH 16
-#define IK_LENGTH 16
-#define AK_LENGTH 6
-#define AMF_LENGTH 2
-#define FMK_LENGTH 4
-#define AUTN_LENGTH (SQN_LENGTH + AMF_LENGTH + MAC_LENGTH)
-#define AUTS_LENGTH (SQN_LENGTH + MAC_LENGTH)
-#define PAYLOAD_LENGTH 64
-#define MK_LENGTH 20
-#define MSK_LENGTH 64
-#define EMSK_LENGTH 64
-#define KAUTH_LENGTH 16
-#define KENCR_LENGTH 16
-#define AT_MAC_LENGTH 16
-
-#define F1 0x42
-#define F1STAR 0x43
-#define F2 0x44
-#define F3 0x45
-#define F4 0x46
-#define F5 0x47
-#define F5STAR 0x48
-
-typedef enum aka_subtype_t aka_subtype_t;
-typedef enum aka_attribute_t aka_attribute_t;
-
-/**
- * Subtypes of AKA messages
- */
-enum aka_subtype_t {
- AKA_CHALLENGE = 1,
- AKA_AUTHENTICATION_REJECT = 2,
- AKA_SYNCHRONIZATION_FAILURE = 4,
- AKA_IDENTITY = 5,
- AKA_NOTIFICATION = 12,
- AKA_REAUTHENTICATION = 13,
- AKA_CLIENT_ERROR = 14,
-};
-
-/**
- * Attribute types in AKA messages
- */
-enum aka_attribute_t {
- /** defines the end of attribute list */
- AT_END = -1,
- AT_RAND = 1,
- AT_AUTN = 2,
- AT_RES = 3,
- AT_AUTS = 4,
- AT_PADDING = 6,
- AT_NONCE_MT = 7,
- AT_PERMANENT_ID_REQ = 10,
- AT_MAC = 11,
- AT_NOTIFICATION = 12,
- AT_ANY_ID_REQ = 13,
- AT_IDENTITY = 14,
- AT_VERSION_LIST = 15,
- AT_SELECTED_VERSION = 16,
- AT_FULLAUTH_ID_REQ = 17,
- AT_COUNTER = 19,
- AT_COUNTER_TOO_SMALL = 20,
- AT_NONCE_S = 21,
- AT_CLIENT_ERROR_CODE = 22,
- AT_IV = 129,
- AT_ENCR_DATA = 130,
- AT_NEXT_PSEUDONYM = 132,
- AT_NEXT_REAUTH_ID = 133,
- AT_CHECKCODE = 134,
- AT_RESULT_IND = 135,
-};
-
-ENUM_BEGIN(aka_subtype_names, AKA_CHALLENGE, AKA_IDENTITY,
- "AKA_CHALLENGE",
- "AKA_AUTHENTICATION_REJECT",
- "AKA_3",
- "AKA_SYNCHRONIZATION_FAILURE",
- "AKA_IDENTITY");
-ENUM_NEXT(aka_subtype_names, AKA_NOTIFICATION, AKA_CLIENT_ERROR, AKA_IDENTITY,
- "AKA_NOTIFICATION",
- "AKA_REAUTHENTICATION",
- "AKA_CLIENT_ERROR");
-ENUM_END(aka_subtype_names, AKA_CLIENT_ERROR);
-
-
-ENUM_BEGIN(aka_attribute_names, AT_END, AT_CLIENT_ERROR_CODE,
- "AT_END",
- "AT_0",
- "AT_RAND",
- "AT_AUTN",
- "AT_RES",
- "AT_AUTS",
- "AT_5",
- "AT_PADDING",
- "AT_NONCE_MT",
- "AT_8",
- "AT_9",
- "AT_PERMANENT_ID_REQ",
- "AT_MAC",
- "AT_NOTIFICATION",
- "AT_ANY_ID_REQ",
- "AT_IDENTITY",
- "AT_VERSION_LIST",
- "AT_SELECTED_VERSION",
- "AT_FULLAUTH_ID_REQ",
- "AT_18",
- "AT_COUNTER",
- "AT_COUNTER_TOO_SMALL",
- "AT_NONCE_S",
- "AT_CLIENT_ERROR_CODE");
-ENUM_NEXT(aka_attribute_names, AT_IV, AT_RESULT_IND, AT_CLIENT_ERROR_CODE,
- "AT_IV",
- "AT_ENCR_DATA",
- "AT_131",
- "AT_NEXT_PSEUDONYM",
- "AT_NEXT_REAUTH_ID",
- "AT_CHECKCODE",
- "AT_RESULT_IND");
-ENUM_END(aka_attribute_names, AT_RESULT_IND);
-
-
-typedef struct private_eap_aka_t private_eap_aka_t;
-
-/**
- * Private data of an eap_aka_t object.
- */
-struct private_eap_aka_t {
-
- /**
- * Public authenticator_t interface.
- */
- eap_aka_t public;
-
- /**
- * ID of the server
- */
- identification_t *server;
-
- /**
- * ID of the peer
- */
- identification_t *peer;
-
- /**
- * SHA11 hasher
- */
- hasher_t *sha1;
-
- /**
- * MAC function used in EAP-AKA
- */
- signer_t *signer;
-
- /**
- * pseudo random function used in EAP-aka
- */
- prf_t *prf;
-
- /**
- * Special keyed SHA1 hasher used in EAP-AKA, implemented as PRF
- */
- prf_t *keyed_prf;
-
- /**
- * Key for EAP MAC
- */
- chunk_t k_auth;
-
- /**
- * Key for EAP encryption
- */
- chunk_t k_encr;
-
- /**
- * MSK
- */
- chunk_t msk;
-
- /**
- * Extendend MSK
- */
- chunk_t emsk;
-
- /**
- * Expected result from client XRES
- */
- chunk_t xres;
-
- /**
- * Shared secret K from ipsec.conf (padded)
- */
- chunk_t k;
-
- /**
- * random value RAND generated by server
- */
- chunk_t rand;
-};
-
-/** Family key, as proposed in S.S0055 */
-static u_int8_t fmk_buf[] = {0x41, 0x48, 0x41, 0x47};
-static chunk_t fmk = chunk_from_buf(fmk_buf);
-
-/** Authentication management field */
-static u_int8_t amf_buf[] = {0x00, 0x01};
-static chunk_t amf = chunk_from_buf(amf_buf);
-
-/** AT_CLIENT_ERROR_CODE AKA attribute */
-static u_int8_t client_error_code_buf[] = {0, 0};
-static chunk_t client_error_code = chunk_from_buf(client_error_code_buf);
-
-/** previously used sqn by peer, next one must be greater */
-static u_int8_t peer_sqn_buf[6];
-static chunk_t peer_sqn = chunk_from_buf(peer_sqn_buf);
-
-/** set SQN to the current time */
-static void update_sqn(u_int8_t *sqn, time_t offset)
-{
- timeval_t time;
- gettimeofday(&time, NULL);
- /* set sqb_sqn to an integer containing seconds followed by most
- * significant useconds */
- time.tv_sec = htonl(time.tv_sec + offset);
- /* usec's are never larger than 0x000f423f, so we shift the 12 first bits */
- time.tv_usec <<= 12;
- time.tv_usec = htonl(time.tv_usec);
- memcpy(sqn, &time.tv_sec, 4);
- memcpy(sqn + 4, &time.tv_usec, 2);
-}
-
-/** initialize peers SQN to the current system time at startup */
-static void __attribute__ ((constructor))init_sqn(void)
-{
- update_sqn(peer_sqn_buf, 0);
-}
-
-/**
- * Binary represnation of the polynom T^160 + T^5 + T^3 + T^2 + 1
- */
-static u_int8_t g[] = {
- 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
- 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
- 0x00, 0x00, 0x00, 0x00, 0x2d
-};
-
-/**
- * Predefined random bits from the RAND Corporation book
- */
-static u_int8_t a[] = {
- 0x9d, 0xe9, 0xc9, 0xc8, 0xef, 0xd5, 0x78, 0x11,
- 0x48, 0x23, 0x14, 0x01, 0x90, 0x1f, 0x2d, 0x49,
- 0x3f, 0x4c, 0x63, 0x65
-};
-
-/**
- * Predefined random bits from the RAND Corporation book
- */
-static u_int8_t b[] = {
- 0x75, 0xef, 0xd1, 0x5c, 0x4b, 0x8f, 0x8f, 0x51,
- 0x4e, 0xf3, 0xbc, 0xc3, 0x79, 0x4a, 0x76, 0x5e,
- 0x7e, 0xec, 0x45, 0xe0
-};
-
-/**
- * Multiplicate two mpz_t with bits interpreted as polynoms.
- */
-static void mpz_mul_poly(mpz_t r, mpz_t a, mpz_t b)
-{
- mpz_t bm, rm;
- int current = 0, shifted = 0, shift;
-
- mpz_init_set(bm, b);
- mpz_init_set_ui(rm, 0);
- /* scan through a, for each found bit: */
- while ((current = mpz_scan1(a, current)) != ULONG_MAX)
- {
- /* XOR shifted b into r */
- shift = current - shifted;
- mpz_mul_2exp(bm, bm, shift);
- shifted += shift;
- mpz_xor(rm, rm, bm);
- current++;
- }
-
- mpz_swap(r, rm);
- mpz_clear(rm);
- mpz_clear(bm);
-}
-
-/**
- * Calculate the sum of a + b interpreted as polynoms.
- */
-static void mpz_add_poly(mpz_t res, mpz_t a, mpz_t b)
-{
- /* addition of polynominals is just the XOR */
- mpz_xor(res, a, b);
-}
-
-/**
- * Calculate the remainder of a/b interpreted as polynoms.
- */
-static void mpz_mod_poly(mpz_t r, mpz_t a, mpz_t b)
-{
- /* Example:
- * a = 10001010
- * b = 00000101
- */
- int a_bit, b_bit, diff;
- mpz_t bm, am;
-
- mpz_init_set(am, a);
- mpz_init(bm);
-
- a_bit = mpz_sizeinbase(a, 2);
- b_bit = mpz_sizeinbase(b, 2);
-
- /* don't do anything if b > a */
- if (a_bit >= b_bit)
- {
- /* shift b left to align up most signaficant "1" to a:
- * a = 10001010
- * b = 10100000
- */
- mpz_mul_2exp(bm, b, a_bit - b_bit);
- do
- {
- /* XOR b into a, this kills the most significant "1":
- * a = 00101010
- */
- mpz_xor(am, am, bm);
- /* find the next most significant "1" in a, and align up b:
- * a = 00101010
- * b = 00101000
- */
- diff = a_bit - mpz_sizeinbase(am, 2);
- mpz_div_2exp(bm, bm, diff);
- a_bit -= diff;
- }
- while (b_bit <= mpz_sizeinbase(bm, 2));
- /* While b is not shifted to its original value */
- }
- /* after another iteration:
- * a = 00000010
- * which is the polynomial modulo
- */
-
- mpz_swap(r, am);
- mpz_clear(am);
- mpz_clear(bm);
-}
-
-/**
- * Step 4 of the various fx() functions:
- * Polynomial whiten calculations
- */
-static void step4(private_eap_aka_t *this, u_int8_t x[])
-{
- mpz_t xm, am, bm, gm;
-
- mpz_init(xm);
- mpz_init(am);
- mpz_init(bm);
- mpz_init(gm);
-
- mpz_import(xm, HASH_SIZE_SHA1, 1, 1, 1, 0, x);
- mpz_import(am, sizeof(a), 1, 1, 1, 0, a);
- mpz_import(bm, sizeof(b), 1, 1, 1, 0, b);
- mpz_import(gm, sizeof(g), 1, 1, 1, 0, g);
-
- mpz_mul_poly(xm, am, xm);
- mpz_add_poly(xm, bm, xm);
- mpz_mod_poly(xm, xm, gm);
-
- mpz_export(x, NULL, 1, HASH_SIZE_SHA1, 1, 0, xm);
-
- mpz_clear(xm);
- mpz_clear(am);
- mpz_clear(bm);
- mpz_clear(gm);
-}
-
-/**
- * Step 3 of the various fx() functions:
- * XOR the key into the SHA1 IV
- */
-static void step3(private_eap_aka_t *this,
- chunk_t k, chunk_t payload, u_int8_t h[])
-{
- u_int8_t buf[64];
-
- if (payload.len < sizeof(buf))
- {
- /* pad c with zeros */
- memset(buf, 0, sizeof(buf));
- memcpy(buf, payload.ptr, payload.len);
- payload.ptr = buf;
- payload.len = sizeof(buf);
- }
- else
- {
- /* not more than 512 bits can be G()-ed */
- payload.len = sizeof(buf);
- }
-
- /* use the keyed hasher to build the hash */
- this->keyed_prf->set_key(this->keyed_prf, k);
- this->keyed_prf->get_bytes(this->keyed_prf, payload, h);
-}
-
-/**
- * Calculation function for f2(), f3(), f4()
- */
-static void fx(private_eap_aka_t *this,
- u_int8_t f, chunk_t k, chunk_t rand, u_int8_t out[])
-{
- chunk_t payload = chunk_alloca(PAYLOAD_LENGTH);
- u_int8_t h[HASH_SIZE_SHA1];
- u_int8_t i;
-
- for (i = 0; i < 2; i++)
- {
- memset(payload.ptr, 0x5c, payload.len);
- payload.ptr[11] ^= f;
- memxor(payload.ptr + 12, fmk.ptr, fmk.len);
- memxor(payload.ptr + 24, rand.ptr, rand.len);
-
- payload.ptr[3] ^= i;
- payload.ptr[19] ^= i;
- payload.ptr[35] ^= i;
- payload.ptr[51] ^= i;
-
- step3(this, k, payload, h);
- step4(this, h);
- memcpy(out + i * 8, h, 8);
- }
-}
-
-/**
- * Calculation function of f1() and f1star()
- */
-static void f1x(private_eap_aka_t *this,
- u_int8_t f, chunk_t k, chunk_t rand, chunk_t sqn,
- chunk_t amf, u_int8_t mac[])
-{
- /* generate MAC = f1(FMK, SQN, RAND, AMF)
- * K is loaded into hashers IV; FMK, RAND, SQN, AMF are XORed in a 512-bit
- * payload which gets hashed
- */
- chunk_t payload = chunk_alloca(PAYLOAD_LENGTH);
- u_int8_t h[HASH_SIZE_SHA1];
-
- memset(payload.ptr, 0x5c, PAYLOAD_LENGTH);
- payload.ptr[11] ^= f;
- memxor(payload.ptr + 12, fmk.ptr, fmk.len);
- memxor(payload.ptr + 16, rand.ptr, rand.len);
- memxor(payload.ptr + 34, sqn.ptr, sqn.len);
- memxor(payload.ptr + 42, amf.ptr, amf.len);
-
- step3(this, k, payload, h);
- step4(this, h);
- memcpy(mac, h, MAC_LENGTH);
-}
-
-/**
- * Calculation function of f5() and f5star()
- */
-static void f5x(private_eap_aka_t *this,
- u_int8_t f, chunk_t k, chunk_t rand, u_int8_t ak[])
-{
- chunk_t payload = chunk_alloca(PAYLOAD_LENGTH);
- u_int8_t h[HASH_SIZE_SHA1];
-
- memset(payload.ptr, 0x5c, payload.len);
- payload.ptr[11] ^= f;
- memxor(payload.ptr + 12, fmk.ptr, fmk.len);
- memxor(payload.ptr + 16, rand.ptr, rand.len);
-
- step3(this, k, payload, h);
- step4(this, h);
- memcpy(ak, h, AK_LENGTH);
-}
-
-/**
- * Calculate the MAC from a RAND, SQN, AMF value using K
- */
-static void f1(private_eap_aka_t *this, chunk_t k, chunk_t rand, chunk_t sqn,
- chunk_t amf, u_int8_t mac[])
-{
- f1x(this, F1, k, rand, sqn, amf, mac);
- DBG3(DBG_IKE, "MAC %b", mac, MAC_LENGTH);
-}
-
-/**
- * Calculate the MACS from a RAND, SQN, AMF value using K
- */
-static void f1star(private_eap_aka_t *this, chunk_t k, chunk_t rand,
- chunk_t sqn, chunk_t amf, u_int8_t macs[])
-{
- f1x(this, F1STAR, k, rand, sqn, amf, macs);
- DBG3(DBG_IKE, "MACS %b", macs, MAC_LENGTH);
-}
-
-/**
- * Calculate RES from RAND using K
- */
-static void f2(private_eap_aka_t *this, chunk_t k, chunk_t rand, u_int8_t res[])
-{
- fx(this, F2, k, rand, res);
- DBG3(DBG_IKE, "RES %b", res, RES_LENGTH);
-}
-
-/**
- * Calculate CK from RAND using K
- */
-static void f3(private_eap_aka_t *this, chunk_t k, chunk_t rand, u_int8_t ck[])
-{
- fx(this, F3, k, rand, ck);
- DBG3(DBG_IKE, "CK %b", ck, CK_LENGTH);
-}
-
-/**
- * Calculate IK from RAND using K
- */
-static void f4(private_eap_aka_t *this, chunk_t k, chunk_t rand, u_int8_t ik[])
-{
- fx(this, F4, k, rand, ik);
- DBG3(DBG_IKE, "IK %b", ik, IK_LENGTH);
-}
-
-/**
- * Calculate AK from a RAND using K
- */
-static void f5(private_eap_aka_t *this, chunk_t k, chunk_t rand, u_int8_t ak[])
-{
- f5x(this, F5, k, rand, ak);
- DBG3(DBG_IKE, "AK %b", ak, AK_LENGTH);
-}
-
-/**
- * Calculate AKS from a RAND using K
- */
-static void f5star(private_eap_aka_t *this, chunk_t k, chunk_t rand, u_int8_t aks[])
-{
- f5x(this, F5STAR, k, rand, aks);
- DBG3(DBG_IKE, "AKS %b", aks, AK_LENGTH);
-}
-
-/**
- * derive the keys needed for EAP_AKA
- */
-static bool derive_keys(private_eap_aka_t *this, identification_t *id)
-{
- chunk_t ck, ik, mk, identity, tmp;
-
- ck = chunk_alloca(CK_LENGTH);
- ik = chunk_alloca(IK_LENGTH);
- mk = chunk_alloca(MK_LENGTH);
- identity = id->get_encoding(id);
-
- /* MK = SHA1( Identity | IK | CK ) */
- f3(this, this->k, this->rand, ck.ptr);
- f4(this, this->k, this->rand, ik.ptr);
- DBG3(DBG_IKE, "Identity %B", &identity);
- tmp = chunk_cata("ccc", identity, ik, ck);
- DBG3(DBG_IKE, "Identity|IK|CK %B", &tmp);
- this->sha1->get_hash(this->sha1, tmp, mk.ptr);
-
- /* K_encr | K_auth | MSK | EMSK = prf(0) | prf(0)
- * FIPS PRF has 320 bit block size, we need 160 byte for keys
- * => run prf four times */
- this->prf->set_key(this->prf, mk);
- tmp = chunk_alloca(this->prf->get_block_size(this->prf) * 4);
- this->prf->get_bytes(this->prf, chunk_empty, tmp.ptr);
- this->prf->get_bytes(this->prf, chunk_empty, tmp.ptr + tmp.len / 4 * 1);
- this->prf->get_bytes(this->prf, chunk_empty, tmp.ptr + tmp.len / 4 * 2);
- this->prf->get_bytes(this->prf, chunk_empty, tmp.ptr + tmp.len / 4 * 3);
- chunk_free(&this->k_encr);
- chunk_free(&this->k_auth);
- chunk_free(&this->msk);
- chunk_free(&this->emsk);
- chunk_split(tmp, "aaaa", 16, &this->k_encr, 16, &this->k_auth,
- 64, &this->msk, 64, &this->emsk);
- DBG3(DBG_IKE, "MK %B", &mk);
- DBG3(DBG_IKE, "PRF res %B", &tmp);
- DBG3(DBG_IKE, "K_encr %B", &this->k_encr);
- DBG3(DBG_IKE, "K_auth %B", &this->k_auth);
- DBG3(DBG_IKE, "MSK %B", &this->msk);
- DBG3(DBG_IKE, "EMSK %B", &this->emsk);
- return TRUE;
-}
-
-/*
- * Get a shared key from ipsec.secrets.
- * We use the standard keys as used in preshared key authentication. As
- * these keys have an undefined length, we:
- * - strip them if they are longer
- * - fill them up with '\0' if they are shorter
- */
-static status_t load_key(identification_t *me, identification_t *other, chunk_t *k)
-{
- shared_key_t *shared;
- chunk_t key;
-
- shared = charon->credentials->get_shared(charon->credentials, SHARED_EAP,
- me, other);
- if (shared == NULL)
- {
- return NOT_FOUND;
- }
- key = shared->get_key(shared);
- chunk_free(k);
- *k = chunk_alloc(K_LENGTH);
- memset(k->ptr, '\0', k->len);
- memcpy(k->ptr, key.ptr, min(key.len, k->len));
- shared->destroy(shared);
- return SUCCESS;
-}
-
-/**
- * skip EAP_AKA header in message and returns its AKA subtype
- */
-static aka_subtype_t read_header(chunk_t *message)
-{
- aka_subtype_t type;
-
- if (message->len < 8)
- {
- *message = chunk_empty;
- return 0;
- }
- type = *(message->ptr + 5);
- *message = chunk_skip(*message, 8);
- return type;
-}
-
-/**
- * read the next attribute from the chunk data
- */
-static aka_attribute_t read_attribute(chunk_t *data, chunk_t *attr_data)
-{
- aka_attribute_t attribute;
- size_t length;
-
- DBG3(DBG_IKE, "reading attribute from %B", data);
-
- if (data->len < 2)
- {
- return AT_END;
- }
- /* read attribute and length */
- attribute = *data->ptr++;
- length = *data->ptr++ * 4 - 2;
- data->len -= 2;
- DBG3(DBG_IKE, "found attribute %N with length %d",
- aka_attribute_names, attribute, length);
- if (length > data->len)
- {
- return AT_END;
- }
- /* apply attribute value to attr_data */
- attr_data->len = length;
- attr_data->ptr = data->ptr;
- /* update data to point to next attribute */
- *data = chunk_skip(*data, length);
- return attribute;
-}
-
-/**
- * Build an AKA payload from different attributes.
- * The variable argument takes an aka_attribute_t
- * followed by its data in a chunk.
- */
-static eap_payload_t *build_aka_payload(private_eap_aka_t *this, eap_code_t code,
- u_int8_t identifier, aka_subtype_t type, ...)
-{
- chunk_t message = chunk_alloca(512); /* is enought for all current messages */
- chunk_t pos = message;
- eap_payload_t *payload;
- va_list args;
- aka_attribute_t attr;
- u_int8_t *mac_pos = NULL;
-
- /* write EAP header, skip length bytes */
- *pos.ptr++ = code;
- *pos.ptr++ = identifier;
- pos.ptr += 2;
- pos.len -= 4;
- /* write AKA header with type and subtype, null reserved bytes */
- *pos.ptr++ = EAP_AKA;
- *pos.ptr++ = type;
- *pos.ptr++ = 0;
- *pos.ptr++ = 0;
- pos.len -= 4;
-
- va_start(args, type);
- while ((attr = va_arg(args, aka_attribute_t)) != AT_END)
- {
- chunk_t data = va_arg(args, chunk_t);
-
- DBG3(DBG_IKE, "building %N %B", aka_attribute_names, attr, &data);
-
- /* write attribute header */
- *pos.ptr++ = attr;
- pos.len--;
-
- switch (attr)
- {
- case AT_RES:
- {
- /* attribute length in 4byte words */
- *pos.ptr = data.len/4 + 1;
- pos = chunk_skip(pos, 1);
- /* RES length in bits */
- *(u_int16_t*)pos.ptr = htons(data.len * 8);
- pos = chunk_skip(pos, sizeof(u_int16_t));
- memcpy(pos.ptr, data.ptr, data.len);
- pos = chunk_skip(pos, data.len);
- break;
- }
- case AT_AUTN:
- case AT_RAND:
- {
- *pos.ptr++ = data.len/4 + 1; pos.len--;
- *pos.ptr++ = 0; pos.len--;
- *pos.ptr++ = 0; pos.len--;
- memcpy(pos.ptr, data.ptr, data.len);
- pos = chunk_skip(pos, data.len);
- break;
- }
- case AT_MAC:
- {
- *pos.ptr++ = 5; pos.len--;
- *pos.ptr++ = 0; pos.len--;
- *pos.ptr++ = 0; pos.len--;
- mac_pos = pos.ptr;
- /* MAC is calculated over message including zeroed AT_MAC attribute */
- memset(mac_pos, 0, AT_MAC_LENGTH);
- pos.ptr += AT_MAC_LENGTH;
- pos.len -= AT_MAC_LENGTH;
- break;
- }
- default:
- {
- /* length is data length in 4-bytes + 1 for header */
- *pos.ptr = data.len/4 + 1;
- pos = chunk_skip(pos, 1);
- memcpy(pos.ptr, data.ptr, data.len);
- pos = chunk_skip(pos, data.len);
- }
- }
- }
- va_end(args);
-
- /* calculate message length, write into header */
- message.len = pos.ptr - message.ptr;
- *(u_int16_t*)(message.ptr + 2) = htons(message.len);
-
- /* create MAC if AT_MAC attribte was included */
- if (mac_pos)
- {
- this->signer->set_key(this->signer, this->k_auth);
- DBG3(DBG_IKE, "AT_MAC signature of %B", &message);
- DBG3(DBG_IKE, "using key %B", &this->k_auth);
- this->signer->get_signature(this->signer, message, mac_pos);
- DBG3(DBG_IKE, "is %b", mac_pos, AT_MAC_LENGTH);
- }
-
- /* payload constructor takes data with some bytes skipped */
- payload = eap_payload_create_data(message);
-
- DBG3(DBG_IKE, "created EAP message %B", &message);
- return payload;
-}
-
-/**
- * generate a new non-zero identifier
- */
-static u_char get_identifier()
-{
- u_char id;
-
- do {
- id = random();
- } while (!id);
- return id;
-}
-
-/**
- * Initiate a AKA-Challenge using SQN
- */
-static status_t server_initiate_challenge(private_eap_aka_t *this, chunk_t sqn,
- eap_payload_t **out)
-{
- rng_t *rng;
- chunk_t mac, ak, autn;
-
- mac = chunk_alloca(MAC_LENGTH);
- ak = chunk_alloca(AK_LENGTH);
- chunk_free(&this->rand);
- chunk_free(&this->xres);
-
- /* generate RAND:
- * we use a registered RNG, not f0() proposed in S.S0055
- */
- rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
- if (!rng)
- {
- DBG1(DBG_IKE, "generating RAND for EAP-AKA authentication failed");
- return FAILED;
- }
- rng->allocate_bytes(rng, RAND_LENGTH, &this->rand);
- rng->destroy(rng);
-
-# ifdef TEST_VECTORS
- /* Test vector for RAND */
- u_int8_t test_rand[] = {
- 0x4b,0x05,0x2b,0x20,0xe2,0xa0,0x6c,0x8f,
- 0xf7,0x00,0xda,0x51,0x2b,0x4e,0x11,0x1e,
- };
- memcpy(this->rand.ptr, test_rand, this->rand.len);
-# endif /* TEST_VECTORS */
-
- /* Get the shared key K: */
- if (load_key(this->server, this->peer, &this->k) != SUCCESS)
- {
- DBG1(DBG_IKE, "no shared key found for IDs '%Y' - '%Y' to authenticate "
- "with EAP-AKA", this->server, this->peer);
- return FAILED;
- }
-
-# ifdef TEST_VECTORS
- /* Test vector for K */
- u_int8_t test_k[] = {
- 0xad,0x1b,0x5a,0x15,0x9b,0xe8,0x6b,0x2c,
- 0xa6,0x6c,0x7a,0xe4,0x0b,0xba,0x9b,0x9d,
- };
- memcpy(this->k.ptr, test_k, this->k.len);
-# endif /* TEST_VECTORS */
-
- /* generate MAC */
- f1(this, this->k, this->rand, sqn, amf, mac.ptr);
-
- /* generate AK */
- f5(this, this->k, this->rand, ak.ptr);
-
- /* precalculate XRES as expected from client */
- this->xres = chunk_alloc(RES_LENGTH);
- f2(this, this->k, this->rand, this->xres.ptr);
-
- /* calculate AUTN = (SQN xor AK) || AMF || MAC */
- autn = chunk_cata("ccc", sqn, amf, mac);
- memxor(autn.ptr, ak.ptr, ak.len);
- DBG3(DBG_IKE, "AUTN %B", &autn);
-
-
- /* derive K_encr, K_auth, MSK, EMSK */
- derive_keys(this, this->peer);
-
- /* build payload */
- *out = build_aka_payload(this, EAP_REQUEST, get_identifier(), AKA_CHALLENGE,
- AT_RAND, this->rand, AT_AUTN, autn, AT_MAC,
- chunk_empty, AT_END);
- return NEED_MORE;
-}
-
-/**
- * Implementation of eap_method_t.initiate for an EAP_AKA server
- */
-static status_t server_initiate(private_eap_aka_t *this, eap_payload_t **out)
-{
- chunk_t sqn = chunk_alloca(SQN_LENGTH);
-
- /* we use an offset of 3 minutes to tolerate clock inaccuracy
- * without the need to synchronize sequence numbers */
- update_sqn(sqn.ptr, 180);
-
-# ifdef TEST_VECTORS
- /* Test vector for SQN */
- u_int8_t test_sqn[] = {0x00,0x00,0x00,0x00,0x00,0x01};
- memcpy(sqn.ptr, test_sqn, sqn.len);
-# endif /* TEST_VECTORS */
-
- return server_initiate_challenge(this, sqn, out);
-}
-
-static status_t server_process_synchronize(private_eap_aka_t *this,
- eap_payload_t *in, eap_payload_t **out)
-{
- chunk_t attr, auts = chunk_empty, pos, message, macs, xmacs, sqn, aks, amf;
- u_int i;
-
- message = in->get_data(in);
- pos = message;
- read_header(&pos);
-
- /* iterate over attributes */
- while (TRUE)
- {
- aka_attribute_t attribute = read_attribute(&pos, &attr);
- switch (attribute)
- {
- case AT_END:
- break;
- case AT_AUTS:
- auts = attr;
- continue;
- default:
- if (attribute >= 0 && attribute <= 127)
- {
- DBG1(DBG_IKE, "found non skippable attribute %N",
- aka_attribute_names, attribute);
- return FAILED;
- }
- DBG1(DBG_IKE, "ignoring skippable attribute %N",
- aka_attribute_names, attribute);
- continue;
- }
- break;
- }
-
- if (auts.len != AUTS_LENGTH)
- {
- DBG1(DBG_IKE, "synchronization request didn't contain useable AUTS");
- return FAILED;
- }
-
- chunk_split(auts, "mm", SQN_LENGTH, &sqn, MAC_LENGTH, &macs);
- aks = chunk_alloca(AK_LENGTH);
- f5star(this, this->k, this->rand, aks.ptr);
- /* decrypt serial number by XORing AKS */
- memxor(sqn.ptr, aks.ptr, aks.len);
-
- /* verify MACS */
- xmacs = chunk_alloca(MAC_LENGTH);
- amf = chunk_alloca(AMF_LENGTH);
- /* an AMF of zero is used for MACS calculation */
- memset(amf.ptr, 0, amf.len);
- f1star(this, this->k, this->rand, sqn, amf, xmacs.ptr);
- if (!chunk_equals(macs, xmacs))
- {
- DBG1(DBG_IKE, "received MACS does not match XMACS");
- DBG3(DBG_IKE, "MACS %B XMACS %B", &macs, &xmacs);
- return FAILED;
- }
-
- /* retry the challenge with the received SQN + 1*/
- for (i = SQN_LENGTH - 1; i >= 0; i--)
- {
- if (++sqn.ptr[i] != 0)
- {
- break;
- }
- }
- return server_initiate_challenge(this, sqn, out);
-}
-
-/**
- * process an AKA_Challenge response
- */
-static status_t server_process_challenge(private_eap_aka_t *this, eap_payload_t *in)
-{
- chunk_t attr, res = chunk_empty, at_mac = chunk_empty, pos, message;
-
- message = in->get_data(in);
- pos = message;
- read_header(&pos);
-
- /* iterate over attributes */
- while (TRUE)
- {
- aka_attribute_t attribute = read_attribute(&pos, &attr);
- switch (attribute)
- {
- case AT_END:
- break;
- case AT_RES:
- res = attr;
- if (attr.len == 2 + RES_LENGTH &&
- *(u_int16_t*)attr.ptr == htons(RES_LENGTH * 8))
- {
- res = chunk_skip(attr, 2);
- }
- continue;
-
- case AT_MAC:
- attr = chunk_skip(attr, 2);
- at_mac = chunk_clonea(attr);
- /* zero MAC in message for MAC verification */
- memset(attr.ptr, 0, attr.len);
- continue;
- default:
- if (attribute >= 0 && attribute <= 127)
- {
- DBG1(DBG_IKE, "found non skippable attribute %N",
- aka_attribute_names, attribute);
- return FAILED;
- }
- DBG1(DBG_IKE, "ignoring skippable attribute %N",
- aka_attribute_names, attribute);
- continue;
- }
- break;
- }
-
- /* verify EAP message MAC AT_MAC */
- {
- this->signer->set_key(this->signer, this->k_auth);
- DBG3(DBG_IKE, "verifying AT_MAC signature of %B", &message);
- DBG3(DBG_IKE, "using key %B", &this->k_auth);
- if (!this->signer->verify_signature(this->signer, message, at_mac))
- {
- DBG1(DBG_IKE, "MAC in AT_MAC attribute verification failed");
- return FAILED;
- }
- }
-
- /* compare received RES against stored precalculated XRES */
- if (!chunk_equals(res, this->xres))
- {
- DBG1(DBG_IKE, "received RES does not match XRES");
- DBG3(DBG_IKE, "RES %Bb XRES %B", &res, &this->xres);
- return FAILED;
- }
- return SUCCESS;
-}
-
-/**
- * Implementation of eap_method_t.process for EAP_AKA servers
- */
-static status_t server_process(private_eap_aka_t *this,
- eap_payload_t *in, eap_payload_t **out)
-{
- chunk_t message;
- aka_subtype_t type;
-
- message = in->get_data(in);
- type = read_header(&message);
-
- DBG3(DBG_IKE, "received EAP message %B", &message);
-
- switch (type)
- {
- case AKA_CHALLENGE:
- {
- return server_process_challenge(this, in);
- }
- case AKA_AUTHENTICATION_REJECT:
- case AKA_CLIENT_ERROR:
- {
- DBG1(DBG_IKE, "received %N, authentication failed",
- aka_subtype_names, type);
- return FAILED;
- }
- case AKA_SYNCHRONIZATION_FAILURE:
- {
- DBG1(DBG_IKE, "received %N, retrying with received SQN",
- aka_subtype_names, type);
- return server_process_synchronize(this, in, out);
- }
- default:
- DBG1(DBG_IKE, "received unknown AKA subtype %N, authentication failed",
- aka_subtype_names, type);
- return FAILED;
- }
-}
-
-/**
- * Process an incoming AKA-Challenge client side
- */
-static status_t peer_process_challenge(private_eap_aka_t *this,
- eap_payload_t *in, eap_payload_t **out)
-{
- chunk_t attr = chunk_empty;
- chunk_t autn = chunk_empty, at_mac = chunk_empty;
- chunk_t ak, sqn, sqn_ak, mac, xmac, res, amf, message, pos;
- u_int8_t identifier;
-
- ak = chunk_alloca(AK_LENGTH);
- xmac = chunk_alloca(MAC_LENGTH);
- res = chunk_alloca(RES_LENGTH);
- chunk_free(&this->rand);
-
- message = in->get_data(in);
- pos = message;
- read_header(&pos);
- identifier = in->get_identifier(in);
-
- DBG3(DBG_IKE, "reading attributes from %B", &pos);
-
- /* iterate over attributes */
- while (TRUE)
- {
- aka_attribute_t attribute = read_attribute(&pos, &attr);
- switch (attribute)
- {
- case AT_END:
- break;
- case AT_RAND:
- this->rand = chunk_clone(chunk_skip(attr, 2));
- continue;
- case AT_AUTN:
- autn = chunk_skip(attr, 2);
- continue;
- case AT_MAC:
- attr = chunk_skip(attr, 2);
- at_mac = chunk_clonea(attr);
- /* set MAC in message to zero for own MAC verification */
- memset(attr.ptr, 0, attr.len);
- continue;
- default:
- if (attribute >= 0 && attribute <= 127)
- {
- /* non skippable attribute, abort */
- *out = build_aka_payload(this, EAP_RESPONSE, identifier, AKA_CLIENT_ERROR,
- AT_CLIENT_ERROR_CODE, client_error_code, AT_END);
- DBG1(DBG_IKE, "found non skippable attribute %N, sending %N %d",
- aka_attribute_names, attribute,
- aka_attribute_names, AT_CLIENT_ERROR_CODE, 0);
- return NEED_MORE;
- }
- DBG1(DBG_IKE, "ignoring skippable attribute %N",
- aka_attribute_names, attribute);
- continue;
- }
- break;
- }
-
- if (this->rand.len != RAND_LENGTH || autn.len != AUTN_LENGTH)
- {
- /* required attributes wrong/not found, abort */
- *out = build_aka_payload(this, EAP_RESPONSE, identifier, AKA_CLIENT_ERROR,
- AT_CLIENT_ERROR_CODE, client_error_code, AT_END);
- DBG1(DBG_IKE, "could not find valid RAND/AUTN attribute, sending %N %d",
- aka_attribute_names, AT_CLIENT_ERROR_CODE, 0);
- return NEED_MORE;
- }
-
- DBG3(DBG_IKE, "using autn %B", &autn);
- /* split up AUTN = SQN xor AK | AMF | MAC */
- chunk_split(autn, "mmm", SQN_LENGTH, &sqn_ak, AMF_LENGTH, &amf, MAC_LENGTH, &mac);
-
- /* Get the shared key K: */
- chunk_free(&this->k);
- if (load_key(this->peer, this->server, &this->k) != SUCCESS)
- {
- *out = build_aka_payload(this, EAP_RESPONSE, identifier,
- AKA_AUTHENTICATION_REJECT, AT_END);
- DBG3(DBG_IKE, "no shared key found for IDs '%Y' - '%Y' to authenticate "
- "with EAP-AKA, sending %N", this->peer, this->server,
- aka_subtype_names, AKA_AUTHENTICATION_REJECT);
- return NEED_MORE;
- }
- DBG3(DBG_IKE, "using K %B", &this->k);
-# ifdef TEST_VECTORS
- /* Test vector for K */
- u_int8_t test_k[] = {
- 0xad,0x1b,0x5a,0x15,0x9b,0xe8,0x6b,0x2c,
- 0xa6,0x6c,0x7a,0xe4,0x0b,0xba,0x9b,0x9d,
- };
- memcpy(this->k.ptr, test_k, this->k.len);
-# endif /* TEST_VECTORS */
-
- /* calculate anonymity key AK */
- f5(this, this->k, this->rand, ak.ptr);
- DBG3(DBG_IKE, "using rand %B", &this->rand);
- DBG3(DBG_IKE, "using ak %B", &ak);
- /* XOR AK into SQN to decrypt it */
-
- sqn = chunk_clonea(sqn_ak);
-
- DBG3(DBG_IKE, "using ak xor sqn %B", &sqn_ak);
- memxor(sqn.ptr, ak.ptr, sqn.len);
- DBG3(DBG_IKE, "using sqn %B", &sqn);
-
- /* calculate expected MAC and compare against received one */
- f1(this, this->k, this->rand, sqn, amf, xmac.ptr);
- if (!chunk_equals(mac, xmac))
- {
- *out = build_aka_payload(this, EAP_RESPONSE, identifier,
- AKA_AUTHENTICATION_REJECT, AT_END);
- DBG1(DBG_IKE, "received MAC does not match XMAC, sending %N",
- aka_subtype_names, AKA_AUTHENTICATION_REJECT);
- DBG3(DBG_IKE, "MAC %B\nXMAC %B", &mac, &xmac);
- return NEED_MORE;
- }
-
-#if SEQ_CHECK
- if (memcmp(peer_sqn.ptr, sqn.ptr, sqn.len) >= 0)
- {
- /* sequence number invalid. send AUTS */
- chunk_t auts, macs, aks, amf;
-
- macs = chunk_alloca(MAC_LENGTH);
- aks = chunk_alloca(AK_LENGTH);
- amf = chunk_alloca(AMF_LENGTH);
-
- /* AMF is set to zero in AKA_SYNCHRONIZATION_FAILURE */
- memset(amf.ptr, 0, amf.len);
- /* AKS = f5*(RAND) */
- f5star(this, this->k, this->rand, aks.ptr);
- /* MACS = f1*(RAND) */
- f1star(this, this->k, this->rand, peer_sqn, amf, macs.ptr);
- /* AUTS = SQN xor AKS | MACS */
- memxor(aks.ptr, peer_sqn.ptr, aks.len);
- auts = chunk_cata("cc", aks, macs);
-
- *out = build_aka_payload(this, EAP_RESPONSE, identifier,
- AKA_SYNCHRONIZATION_FAILURE,
- AT_AUTS, auts, AT_END);
- DBG1(DBG_IKE, "received SQN invalid, sending %N",
- aka_subtype_names, AKA_SYNCHRONIZATION_FAILURE);
- DBG3(DBG_IKE, "received SQN %B\ncurrent SQN %B", &sqn, &peer_sqn);
- return NEED_MORE;
- }
-#endif /* SEQ_CHECK */
-
- /* derive K_encr, K_auth, MSK, EMSK */
- derive_keys(this, this->peer);
-
- /* verify EAP message MAC AT_MAC */
- DBG3(DBG_IKE, "verifying AT_MAC signature of %B", &message);
- DBG3(DBG_IKE, "using key %B", &this->k_auth);
- this->signer->set_key(this->signer, this->k_auth);
- if (!this->signer->verify_signature(this->signer, message, at_mac))
- {
- *out = build_aka_payload(this, EAP_RESPONSE, identifier, AKA_CLIENT_ERROR,
- AT_CLIENT_ERROR_CODE, client_error_code, AT_END);
- DBG1(DBG_IKE, "MAC in AT_MAC attribute verification "
- "failed, sending %N %d", aka_attribute_names,
- AT_CLIENT_ERROR_CODE, 0);
- return NEED_MORE;
- }
-
- /* update stored SQN to the received one */
- memcpy(peer_sqn.ptr, sqn.ptr, sqn.len);
-
- /* calculate RES */
- f2(this, this->k, this->rand, res.ptr);
-
- /* build response */
- *out = build_aka_payload(this, EAP_RESPONSE, identifier, AKA_CHALLENGE,
- AT_RES, res, AT_MAC, chunk_empty, AT_END);
- return NEED_MORE;
-}
-
-/**
- * Process an incoming AKA-Notification as client
- */
-static status_t peer_process_notification(private_eap_aka_t *this,
- eap_payload_t *in, eap_payload_t **out)
-{
- chunk_t message, pos, attr;
- u_int8_t identifier;
-
- message = in->get_data(in);
- pos = message;
- read_header(&pos);
- identifier = in->get_identifier(in);
-
- DBG3(DBG_IKE, "reading attributes from %B", &pos);
-
- /* iterate over attributes */
- while (TRUE)
- {
- aka_attribute_t attribute = read_attribute(&pos, &attr);
- switch (attribute)
- {
- case AT_END:
- break;
- case AT_NOTIFICATION:
- {
- u_int16_t code;
-
- if (attr.len != 2)
- {
- DBG1(DBG_IKE, "received invalid AKA notification, ignored");
- continue;
- }
- code = ntohs(*(u_int16_t*)attr.ptr);
- switch (code)
- {
- case 0:
- DBG1(DBG_IKE, "received AKA notification 'general "
- "failure after authentication' (%d)", code);
- return FAILED;
- case 16384:
- DBG1(DBG_IKE, "received AKA notification 'general "
- "failure' (%d)", code);
- return FAILED;
- case 32768:
- DBG1(DBG_IKE, "received AKA notification 'successfully "
- "authenticated' (%d)", code);
- continue;
- case 1026:
- DBG1(DBG_IKE, "received AKA notification 'access "
- "temporarily denied' (%d)", code);
- return FAILED;
- case 1031:
- DBG1(DBG_IKE, "received AKA notification 'not "
- "subscribed to service' (%d)", code);
- return FAILED;
- default:
- DBG1(DBG_IKE, "received AKA notification code %d, "
- "ignored", code);
- continue;
- }
- }
- default:
- if (attribute >= 0 && attribute <= 127)
- {
- DBG1(DBG_IKE, "ignoring non-skippable attribute %N in %N",
- aka_attribute_names, attribute, aka_subtype_names,
- AKA_NOTIFICATION);
- }
- else
- {
- DBG1(DBG_IKE, "ignoring skippable attribute %N",
- aka_attribute_names, attribute);
- }
- continue;
- }
- break;
- }
- return NEED_MORE;
-}
-
-/**
- * Implementation of eap_method_t.process for an EAP_AKA peer
- */
-static status_t peer_process(private_eap_aka_t *this,
- eap_payload_t *in, eap_payload_t **out)
-{
- aka_subtype_t type;
- chunk_t message;
- u_int8_t identifier;
-
- message = in->get_data(in);
- type = read_header(&message);
- identifier = in->get_identifier(in);
-
- DBG3(DBG_IKE, "received EAP message %B", &message);
-
- switch (type)
- {
- case AKA_CHALLENGE:
- {
- return peer_process_challenge(this, in, out);
- }
- case AKA_NOTIFICATION:
- {
- return peer_process_notification(this, in, out);
- }
- default:
- {
- *out = build_aka_payload(this, EAP_RESPONSE, identifier, AKA_CLIENT_ERROR,
- AT_CLIENT_ERROR_CODE, client_error_code, AT_END);
- DBG1(DBG_IKE, "received unsupported %N request, sending %N %d",
- aka_subtype_names, type,
- aka_attribute_names, AT_CLIENT_ERROR_CODE, 0);
- return NEED_MORE;
- }
- }
-}
-
-/**
- * Implementation of eap_method_t.initiate for an EAP AKA peer
- */
-static status_t peer_initiate(private_eap_aka_t *this, eap_payload_t **out)
-{
- /* peer never initiates */
- return FAILED;
-}
-
-/**
- * Implementation of eap_method_t.get_type.
- */
-static eap_type_t get_type(private_eap_aka_t *this, u_int32_t *vendor)
-{
- *vendor = 0;
- return EAP_AKA;
-}
-
-/**
- * Implementation of eap_method_t.get_msk.
- */
-static status_t get_msk(private_eap_aka_t *this, chunk_t *msk)
-{
- if (this->msk.ptr)
- {
- *msk = this->msk;
- return SUCCESS;
- }
- return FAILED;
-}
-
-/**
- * Implementation of eap_method_t.is_mutual.
- */
-static bool is_mutual(private_eap_aka_t *this)
-{
- return TRUE;
-}
-
-/**
- * Implementation of eap_method_t.destroy.
- */
-static void destroy(private_eap_aka_t *this)
-{
- this->server->destroy(this->server);
- this->peer->destroy(this->peer);
- DESTROY_IF(this->sha1);
- DESTROY_IF(this->signer);
- DESTROY_IF(this->prf);
- DESTROY_IF(this->keyed_prf);
- chunk_free(&this->k_encr);
- chunk_free(&this->k_auth);
- chunk_free(&this->msk);
- chunk_free(&this->emsk);
- chunk_free(&this->xres);
- chunk_free(&this->k);
- chunk_free(&this->rand);
- free(this);
-}
-
-/**
- * generic constructor used by client & server
- */
-static private_eap_aka_t *eap_aka_create_generic(identification_t *server,
- identification_t *peer)
-{
- private_eap_aka_t *this = malloc_thing(private_eap_aka_t);
-
- this->public.eap_method_interface.initiate = NULL;
- this->public.eap_method_interface.process = NULL;
- this->public.eap_method_interface.get_type = (eap_type_t(*)(eap_method_t*,u_int32_t*))get_type;
- this->public.eap_method_interface.is_mutual = (bool(*)(eap_method_t*))is_mutual;
- this->public.eap_method_interface.get_msk = (status_t(*)(eap_method_t*,chunk_t*))get_msk;
- this->public.eap_method_interface.destroy = (void(*)(eap_method_t*))destroy;
-
- /* private data */
- this->server = server->clone(server);
- this->peer = peer->clone(peer);
- this->k_encr = chunk_empty;
- this->k_auth = chunk_empty;
- this->msk = chunk_empty;
- this->emsk = chunk_empty;
- this->xres = chunk_empty;
- this->k = chunk_empty;
- this->rand = chunk_empty;
-
- this->sha1 = lib->crypto->create_hasher(lib->crypto, HASH_SHA1);
- this->signer = lib->crypto->create_signer(lib->crypto, AUTH_HMAC_SHA1_128);
- this->prf = lib->crypto->create_prf(lib->crypto, PRF_FIPS_SHA1_160);
- this->keyed_prf = lib->crypto->create_prf(lib->crypto, PRF_KEYED_SHA1);
-
- if (!this->sha1 || !this->signer || !this->prf || !this->keyed_prf)
- {
- DBG1(DBG_IKE, "unable to initiate EAP-AKA, FIPS-PRF/SHA1 not supported");
- DESTROY_IF(this->sha1);
- DESTROY_IF(this->signer);
- DESTROY_IF(this->prf);
- DESTROY_IF(this->keyed_prf);
- destroy(this);
- return NULL;
- }
- return this;
-}
-
-/*
- * Described in header.
- */
-eap_aka_t *eap_aka_create_server(identification_t *server, identification_t *peer)
-{
- private_eap_aka_t *this = eap_aka_create_generic(server, peer);
-
- if (this)
- {
- this->public.eap_method_interface.initiate = (status_t(*)(eap_method_t*,eap_payload_t**))server_initiate;
- this->public.eap_method_interface.process = (status_t(*)(eap_method_t*,eap_payload_t*,eap_payload_t**))server_process;
- }
- return (eap_aka_t*)this;
-}
-
-/*
- * Described in header.
- */
-eap_aka_t *eap_aka_create_peer(identification_t *server, identification_t *peer)
-{
- private_eap_aka_t *this = eap_aka_create_generic(server, peer);
-
- if (this)
- {
- this->public.eap_method_interface.initiate = (status_t(*)(eap_method_t*,eap_payload_t**))peer_initiate;
- this->public.eap_method_interface.process = (status_t(*)(eap_method_t*,eap_payload_t*,eap_payload_t**))peer_process;
- }
- return (eap_aka_t*)this;
-}
-
diff --git a/src/charon/plugins/eap_aka/eap_aka.h b/src/charon/plugins/eap_aka/eap_aka.h
deleted file mode 100644
index 7686802cf..000000000
--- a/src/charon/plugins/eap_aka/eap_aka.h
+++ /dev/null
@@ -1,81 +0,0 @@
-/*
- * Copyright (C) 2008 Martin Willi
- * Hochschule fuer Technik Rapperswil
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
- * for more details.
- */
-
-/**
- * @defgroup eap_aka_i eap_aka
- * @{ @ingroup eap_aka
- */
-
-#ifndef EAP_AKA_H_
-#define EAP_AKA_H_
-
-typedef struct eap_aka_t eap_aka_t;
-
-#include <sa/authenticators/eap/eap_method.h>
-
-/** check SEQ values as client for validity, disabled by default */
-#ifndef SEQ_CHECK
-# define SEQ_CHECK 0
-#endif
-
-/**
- * Implementation of the eap_method_t interface using EAP-AKA.
- *
- * EAP-AKA uses 3rd generation mobile phone standard authentication
- * mechanism for authentication. It is a mutual authentication
- * mechanism which establishs a shared key and therefore supports EAP_ONLY
- * authentication. This implementation follows the standard of the
- * 3GPP2 (S.S0055) and not the one of 3GGP.
- * The shared key used for authentication is from ipsec.secrets. The
- * peers ID is used to query it.
- * The AKA mechanism uses sequence numbers to detect replay attacks. The
- * peer stores the sequence number normally in a USIM and accepts
- * incremental sequence numbers (incremental for lifetime of the USIM). To
- * prevent a complex sequence number management, this implementation uses
- * a sequence number derived from time. It is initialized to the startup
- * time of the daemon. As long as the (UTC) time of the system is not
- * turned back while the daemon is not running, this method is secure.
- * To enable time based SEQs, define SEQ_CHECK as 1. Default is to accept
- * any SEQ numbers. This allows an attacker to do replay attacks. But since
- * the server has proven his identity via IKE, such an attack is only
- * possible between server and AAA (if any).
- */
-struct eap_aka_t {
-
- /**
- * Implemented eap_method_t interface.
- */
- eap_method_t eap_method_interface;
-};
-
-/**
- * Creates the server implementation of the EAP method EAP-AKA.
- *
- * @param server ID of the EAP server
- * @param peer ID of the EAP client
- * @return eap_aka_t object
- */
-eap_aka_t *eap_aka_create_server(identification_t *server, identification_t *peer);
-
-/**
- * Creates the peer implementation of the EAP method EAP-AKA.
- *
- * @param server ID of the EAP server
- * @param peer ID of the EAP client
- * @return eap_aka_t object
- */
-eap_aka_t *eap_aka_create_peer(identification_t *server, identification_t *peer);
-
-#endif /** EAP_AKA_H_ @}*/
diff --git a/src/charon/plugins/eap_aka/eap_aka_peer.c b/src/charon/plugins/eap_aka/eap_aka_peer.c
new file mode 100644
index 000000000..26546809d
--- /dev/null
+++ b/src/charon/plugins/eap_aka/eap_aka_peer.c
@@ -0,0 +1,583 @@
+/*
+ * Copyright (C) 2006-2009 Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+
+#include "eap_aka_peer.h"
+
+#include <library.h>
+#include <daemon.h>
+
+#include <simaka_message.h>
+#include <simaka_crypto.h>
+
+typedef struct private_eap_aka_peer_t private_eap_aka_peer_t;
+
+/**
+ * Private data of an eap_aka_peer_t object.
+ */
+struct private_eap_aka_peer_t {
+
+ /**
+ * Public authenticator_t interface.
+ */
+ eap_aka_peer_t public;
+
+ /**
+ * EAP-AKA crypto helper
+ */
+ simaka_crypto_t *crypto;
+
+ /**
+ * permanent ID of peer
+ */
+ identification_t *permanent;
+
+ /**
+ * Pseudonym identity the peer uses
+ */
+ identification_t *pseudonym;
+
+ /**
+ * Reauthentication identity the peer uses
+ */
+ identification_t *reauth;
+
+ /**
+ * MSK
+ */
+ chunk_t msk;
+
+ /**
+ * Master key, if reauthentication is used
+ */
+ char mk[HASH_SIZE_SHA1];
+
+ /**
+ * Counter value if reauthentication is used
+ */
+ u_int16_t counter;
+};
+
+/**
+ * Create a AKA_CLIENT_ERROR: "Unable to process"
+ */
+static eap_payload_t* create_client_error(private_eap_aka_peer_t *this,
+ u_int8_t identifier)
+{
+ simaka_message_t *message;
+ eap_payload_t *out;
+ u_int16_t encoded;
+
+ DBG1(DBG_IKE, "sending client error '%N'",
+ simaka_client_error_names, AKA_UNABLE_TO_PROCESS);
+
+ message = simaka_message_create(FALSE, identifier, EAP_AKA,
+ AKA_CLIENT_ERROR, this->crypto);
+ encoded = htons(AKA_UNABLE_TO_PROCESS);
+ message->add_attribute(message, AT_CLIENT_ERROR_CODE,
+ chunk_create((char*)&encoded, sizeof(encoded)));
+ out = message->generate(message, chunk_empty);
+ message->destroy(message);
+ return out;
+}
+
+/**
+ * process an EAP-AKA/Request/Identity message
+ */
+static status_t process_identity(private_eap_aka_peer_t *this,
+ simaka_message_t *in, eap_payload_t **out)
+{
+ simaka_message_t *message;
+ enumerator_t *enumerator;
+ simaka_attribute_t type;
+ chunk_t data, id = chunk_empty;
+ simaka_attribute_t id_req = 0;
+
+ /* reset previously uses reauthentication/pseudonym data */
+ this->crypto->clear_keys(this->crypto);
+ DESTROY_IF(this->pseudonym);
+ this->pseudonym = NULL;
+ DESTROY_IF(this->reauth);
+ this->reauth = NULL;
+
+ enumerator = in->create_attribute_enumerator(in);
+ while (enumerator->enumerate(enumerator, &type, &data))
+ {
+ switch (type)
+ {
+ case AT_ANY_ID_REQ:
+ case AT_FULLAUTH_ID_REQ:
+ case AT_PERMANENT_ID_REQ:
+ id_req = type;
+ break;
+ default:
+ if (!simaka_attribute_skippable(type))
+ {
+ *out = create_client_error(this, in->get_identifier(in));
+ enumerator->destroy(enumerator);
+ return NEED_MORE;
+ }
+ break;
+ }
+ }
+ enumerator->destroy(enumerator);
+
+ switch (id_req)
+ {
+ case AT_ANY_ID_REQ:
+ this->reauth = charon->sim->card_get_reauth(charon->sim,
+ this->permanent, this->mk, &this->counter);
+ if (this->reauth)
+ {
+ id = this->reauth->get_encoding(this->reauth);
+ break;
+ }
+ /* FALL */
+ case AT_FULLAUTH_ID_REQ:
+ this->pseudonym = charon->sim->card_get_pseudonym(charon->sim,
+ this->permanent);
+ if (this->pseudonym)
+ {
+ id = this->pseudonym->get_encoding(this->pseudonym);
+ break;
+ }
+ /* FALL */
+ case AT_PERMANENT_ID_REQ:
+ id = this->permanent->get_encoding(this->permanent);
+ break;
+ default:
+ break;
+ }
+ message = simaka_message_create(FALSE, in->get_identifier(in), EAP_AKA,
+ AKA_IDENTITY, this->crypto);
+ if (id.len)
+ {
+ message->add_attribute(message, AT_IDENTITY, id);
+ }
+ *out = message->generate(message, chunk_empty);
+ message->destroy(message);
+
+ return NEED_MORE;
+}
+
+/**
+ * Process an EAP-AKA/Request/Challenge message
+ */
+static status_t process_challenge(private_eap_aka_peer_t *this,
+ simaka_message_t *in, eap_payload_t **out)
+{
+ simaka_message_t *message;
+ enumerator_t *enumerator;
+ simaka_attribute_t type;
+ chunk_t data, rand = chunk_empty, autn = chunk_empty, mk;
+ u_char res[AKA_RES_MAX], ck[AKA_CK_LEN], ik[AKA_IK_LEN], auts[AKA_AUTS_LEN];
+ int res_len;
+ identification_t *id;
+ status_t status;
+
+ enumerator = in->create_attribute_enumerator(in);
+ while (enumerator->enumerate(enumerator, &type, &data))
+ {
+ switch (type)
+ {
+ case AT_RAND:
+ rand = data;
+ break;
+ case AT_AUTN:
+ autn = data;
+ break;
+ default:
+ if (!simaka_attribute_skippable(type))
+ {
+ *out = create_client_error(this, in->get_identifier(in));
+ enumerator->destroy(enumerator);
+ return NEED_MORE;
+ }
+ break;
+ }
+ }
+ enumerator->destroy(enumerator);
+
+ if (!rand.len || !autn.len)
+ {
+ DBG1(DBG_IKE, "received invalid EAP-AKA challenge message");
+ *out = create_client_error(this, in->get_identifier(in));
+ return NEED_MORE;
+ }
+
+ status = charon->sim->card_get_quintuplet(charon->sim, this->permanent,
+ rand.ptr, autn.ptr, ck, ik, res, &res_len);
+ if (status == INVALID_STATE &&
+ charon->sim->card_resync(charon->sim, this->permanent, rand.ptr, auts))
+ {
+ DBG1(DBG_IKE, "received SQN invalid, sending %N",
+ simaka_subtype_names, AKA_SYNCHRONIZATION_FAILURE);
+ message = simaka_message_create(FALSE, in->get_identifier(in), EAP_AKA,
+ AKA_SYNCHRONIZATION_FAILURE, this->crypto);
+ message->add_attribute(message, AT_AUTS,
+ chunk_create(auts, AKA_AUTS_LEN));
+ *out = message->generate(message, chunk_empty);
+ message->destroy(message);
+ return NEED_MORE;
+ }
+ if (status != SUCCESS)
+ {
+ DBG1(DBG_IKE, "no USIM found with quintuplets for '%Y', sending %N",
+ this->permanent, simaka_subtype_names, AKA_AUTHENTICATION_REJECT);
+ message = simaka_message_create(FALSE, in->get_identifier(in), EAP_AKA,
+ AKA_AUTHENTICATION_REJECT, this->crypto);
+ *out = message->generate(message, chunk_empty);
+ message->destroy(message);
+ return NEED_MORE;
+ }
+
+ id = this->permanent;
+ if (this->pseudonym)
+ {
+ id = this->pseudonym;
+ }
+ data = chunk_cata("cc", chunk_create(ik, AKA_IK_LEN),
+ chunk_create(ck, AKA_CK_LEN));
+ free(this->msk.ptr);
+ this->msk = this->crypto->derive_keys_full(this->crypto, id, data, &mk);
+ memcpy(this->mk, mk.ptr, mk.len);
+ free(mk.ptr);
+
+ /* Verify AT_MAC attribute and parse() again after key derivation,
+ * reading encrypted attributes */
+ if (!in->verify(in, chunk_empty) || !in->parse(in))
+ {
+ *out = create_client_error(this, in->get_identifier(in));
+ return NEED_MORE;
+ }
+
+ enumerator = in->create_attribute_enumerator(in);
+ while (enumerator->enumerate(enumerator, &type, &data))
+ {
+ switch (type)
+ {
+ case AT_NEXT_REAUTH_ID:
+ this->counter = 0;
+ id = identification_create_from_data(data);
+ charon->sim->card_set_reauth(charon->sim, this->permanent, id,
+ this->mk, this->counter);
+ id->destroy(id);
+ break;
+ case AT_NEXT_PSEUDONYM:
+ id = identification_create_from_data(data);
+ charon->sim->card_set_pseudonym(charon->sim, this->permanent, id);
+ id->destroy(id);
+ break;
+ default:
+ break;
+ }
+ }
+ enumerator->destroy(enumerator);
+
+ message = simaka_message_create(FALSE, in->get_identifier(in), EAP_AKA,
+ AKA_CHALLENGE, this->crypto);
+ message->add_attribute(message, AT_RES, chunk_create(res, res_len));
+ *out = message->generate(message, chunk_empty);
+ message->destroy(message);
+ return NEED_MORE;
+}
+
+/**
+ * Check if a received counter value is acceptable
+ */
+static bool counter_too_small(private_eap_aka_peer_t *this, chunk_t chunk)
+{
+ u_int16_t counter;
+
+ memcpy(&counter, chunk.ptr, sizeof(counter));
+ counter = htons(counter);
+ return counter < this->counter;
+}
+
+/**
+ * process an EAP-AKA/Request/Reauthentication message
+ */
+static status_t process_reauthentication(private_eap_aka_peer_t *this,
+ simaka_message_t *in, eap_payload_t **out)
+{
+ simaka_message_t *message;
+ enumerator_t *enumerator;
+ simaka_attribute_t type;
+ chunk_t data, counter = chunk_empty, nonce = chunk_empty, id = chunk_empty;
+
+ if (!this->reauth)
+ {
+ DBG1(DBG_IKE, "received %N, but not expected",
+ simaka_subtype_names, AKA_REAUTHENTICATION);
+ *out = create_client_error(this, in->get_identifier(in));
+ return NEED_MORE;
+ }
+
+ this->crypto->derive_keys_reauth(this->crypto,
+ chunk_create(this->mk, HASH_SIZE_SHA1));
+
+ /* verify MAC and parse again with decryption key */
+ if (!in->verify(in, chunk_empty) || !in->parse(in))
+ {
+ *out = create_client_error(this, in->get_identifier(in));
+ return NEED_MORE;
+ }
+
+ enumerator = in->create_attribute_enumerator(in);
+ while (enumerator->enumerate(enumerator, &type, &data))
+ {
+ switch (type)
+ {
+ case AT_COUNTER:
+ counter = data;
+ break;
+ case AT_NONCE_S:
+ nonce = data;
+ break;
+ case AT_NEXT_REAUTH_ID:
+ id = data;
+ break;
+ default:
+ if (!simaka_attribute_skippable(type))
+ {
+ *out = create_client_error(this, in->get_identifier(in));
+ enumerator->destroy(enumerator);
+ return NEED_MORE;
+ }
+ break;
+ }
+ }
+ enumerator->destroy(enumerator);
+
+ if (!nonce.len || !counter.len)
+ {
+ DBG1(DBG_IKE, "EAP-AKA/Request/Reauthentication message incomplete");
+ *out = create_client_error(this, in->get_identifier(in));
+ return NEED_MORE;
+ }
+
+ message = simaka_message_create(FALSE, in->get_identifier(in), EAP_AKA,
+ AKA_REAUTHENTICATION, this->crypto);
+ if (counter_too_small(this, counter))
+ {
+ DBG1(DBG_IKE, "reauthentication counter too small");
+ message->add_attribute(message, AT_COUNTER_TOO_SMALL, chunk_empty);
+ }
+ else
+ {
+ free(this->msk.ptr);
+ this->msk = this->crypto->derive_keys_reauth_msk(this->crypto,
+ this->reauth, counter, nonce,
+ chunk_create(this->mk, HASH_SIZE_SHA1));
+ if (id.len)
+ {
+ identification_t *reauth;
+
+ reauth = identification_create_from_data(data);
+ charon->sim->card_set_reauth(charon->sim, this->permanent, reauth,
+ this->mk, this->counter);
+ reauth->destroy(reauth);
+ }
+ }
+ message->add_attribute(message, AT_COUNTER, counter);
+ *out = message->generate(message, nonce);
+ message->destroy(message);
+ return NEED_MORE;
+}
+
+/**
+ * Process an EAP-AKA/Request/Notification message
+ */
+static status_t process_notification(private_eap_aka_peer_t *this,
+ simaka_message_t *in, eap_payload_t **out)
+{
+ simaka_message_t *message;
+ enumerator_t *enumerator;
+ simaka_attribute_t type;
+ chunk_t data;
+ bool success = TRUE;
+
+ enumerator = in->create_attribute_enumerator(in);
+ while (enumerator->enumerate(enumerator, &type, &data))
+ {
+ if (type == AT_NOTIFICATION)
+ {
+ u_int16_t code;
+
+ memcpy(&code, data.ptr, sizeof(code));
+ code = ntohs(code);
+
+ /* test success bit */
+ if (!(data.ptr[0] & 0x80))
+ {
+ success = FALSE;
+ DBG1(DBG_IKE, "received EAP-AKA notification error '%N'",
+ simaka_notification_names, code);
+ }
+ else
+ {
+ DBG1(DBG_IKE, "received EAP-AKA notification '%N'",
+ simaka_notification_names, code);
+ }
+ }
+ else if (!simaka_attribute_skippable(type))
+ {
+ success = FALSE;
+ break;
+ }
+ }
+ enumerator->destroy(enumerator);
+
+ if (success)
+ { /* empty notification reply */
+ message = simaka_message_create(FALSE, in->get_identifier(in), EAP_AKA,
+ AKA_NOTIFICATION, this->crypto);
+ *out = message->generate(message, chunk_empty);
+ message->destroy(message);
+ }
+ else
+ {
+ *out = create_client_error(this, in->get_identifier(in));
+ }
+ return NEED_MORE;
+}
+
+
+/**
+ * Implementation of eap_method_t.process
+ */
+static status_t process(private_eap_aka_peer_t *this,
+ eap_payload_t *in, eap_payload_t **out)
+{
+ simaka_message_t *message;
+ status_t status;
+
+ message = simaka_message_create_from_payload(in, this->crypto);
+ if (!message)
+ {
+ *out = create_client_error(this, in->get_identifier(in));
+ return NEED_MORE;
+ }
+ if (!message->parse(message))
+ {
+ message->destroy(message);
+ *out = create_client_error(this, in->get_identifier(in));
+ return NEED_MORE;
+ }
+ switch (message->get_subtype(message))
+ {
+ case AKA_IDENTITY:
+ status = process_identity(this, message, out);
+ break;
+ case AKA_CHALLENGE:
+ status = process_challenge(this, message, out);
+ break;
+ case AKA_REAUTHENTICATION:
+ status = process_reauthentication(this, message, out);
+ break;
+ case AKA_NOTIFICATION:
+ status = process_notification(this, message, out);
+ break;
+ default:
+ DBG1(DBG_IKE, "unable to process EAP-AKA subtype %N",
+ simaka_subtype_names, message->get_subtype(message));
+ *out = create_client_error(this, in->get_identifier(in));
+ status = NEED_MORE;
+ break;
+ }
+ message->destroy(message);
+ return status;
+}
+
+/**
+ * Implementation of eap_method_t.initiate
+ */
+static status_t initiate(private_eap_aka_peer_t *this, eap_payload_t **out)
+{
+ /* peer never initiates */
+ return FAILED;
+}
+
+/**
+ * Implementation of eap_method_t.get_type.
+ */
+static eap_type_t get_type(private_eap_aka_peer_t *this, u_int32_t *vendor)
+{
+ *vendor = 0;
+ return EAP_AKA;
+}
+
+/**
+ * Implementation of eap_method_t.get_msk.
+ */
+static status_t get_msk(private_eap_aka_peer_t *this, chunk_t *msk)
+{
+ if (this->msk.ptr)
+ {
+ *msk = this->msk;
+ return SUCCESS;
+ }
+ return FAILED;
+}
+
+/**
+ * Implementation of eap_method_t.is_mutual.
+ */
+static bool is_mutual(private_eap_aka_peer_t *this)
+{
+ return TRUE;
+}
+
+/**
+ * Implementation of eap_method_t.destroy.
+ */
+static void destroy(private_eap_aka_peer_t *this)
+{
+ this->crypto->destroy(this->crypto);
+ this->permanent->destroy(this->permanent);
+ DESTROY_IF(this->pseudonym);
+ DESTROY_IF(this->reauth);
+ free(this->msk.ptr);
+ free(this);
+}
+
+/*
+ * Described in header.
+ */
+eap_aka_peer_t *eap_aka_peer_create(identification_t *server,
+ identification_t *peer)
+{
+ private_eap_aka_peer_t *this = malloc_thing(private_eap_aka_peer_t);
+
+ this->public.interface.initiate = (status_t(*)(eap_method_t*,eap_payload_t**))initiate;
+ this->public.interface.process = (status_t(*)(eap_method_t*,eap_payload_t*,eap_payload_t**))process;
+ this->public.interface.get_type = (eap_type_t(*)(eap_method_t*,u_int32_t*))get_type;
+ this->public.interface.is_mutual = (bool(*)(eap_method_t*))is_mutual;
+ this->public.interface.get_msk = (status_t(*)(eap_method_t*,chunk_t*))get_msk;
+ this->public.interface.destroy = (void(*)(eap_method_t*))destroy;
+
+ this->crypto = simaka_crypto_create();
+ if (!this->crypto)
+ {
+ free(this);
+ return NULL;
+ }
+ this->permanent = peer->clone(peer);
+ this->pseudonym = NULL;
+ this->reauth = NULL;
+ this->msk = chunk_empty;
+
+ return &this->public;
+}
+
diff --git a/src/charon/plugins/eap_aka/eap_aka_peer.h b/src/charon/plugins/eap_aka/eap_aka_peer.h
new file mode 100644
index 000000000..65a210406
--- /dev/null
+++ b/src/charon/plugins/eap_aka/eap_aka_peer.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2008-2009 Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+
+/**
+ * @defgroup eap_aka_peer eap_aka_peer
+ * @{ @ingroup eap_aka
+ */
+
+#ifndef EAP_AKA_PEER_H_
+#define EAP_AKA_PEER_H_
+
+typedef struct eap_aka_peer_t eap_aka_peer_t;
+
+#include <sa/authenticators/eap/eap_method.h>
+
+/**
+ * Implementation of the eap_method_t interface using EAP-AKA as a client.
+ */
+struct eap_aka_peer_t {
+
+ /**
+ * Implemented eap_method_t interface.
+ */
+ eap_method_t interface;
+};
+
+/**
+ * Creates the peer implementation of the EAP method EAP-AKA.
+ *
+ * @param server ID of the EAP server
+ * @param peer ID of the EAP client
+ * @return eap_aka_peer_t object
+ */
+eap_aka_peer_t *eap_aka_peer_create(identification_t *server,
+ identification_t *peer);
+
+#endif /** EAP_AKA_PEER_H_ @}*/
diff --git a/src/charon/plugins/eap_aka/eap_aka_plugin.c b/src/charon/plugins/eap_aka/eap_aka_plugin.c
index e4a5326fe..c44a08966 100644
--- a/src/charon/plugins/eap_aka/eap_aka_plugin.c
+++ b/src/charon/plugins/eap_aka/eap_aka_plugin.c
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2008 Martin Willi
+ * Copyright (C) 2008-2009 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
@@ -15,7 +15,8 @@
#include "eap_aka_plugin.h"
-#include "eap_aka.h"
+#include "eap_aka_peer.h"
+#include "eap_aka_server.h"
#include <daemon.h>
@@ -25,9 +26,9 @@
static void destroy(eap_aka_plugin_t *this)
{
charon->eap->remove_method(charon->eap,
- (eap_constructor_t)eap_aka_create_server);
+ (eap_constructor_t)eap_aka_server_create);
charon->eap->remove_method(charon->eap,
- (eap_constructor_t)eap_aka_create_peer);
+ (eap_constructor_t)eap_aka_peer_create);
free(this);
}
@@ -37,14 +38,14 @@ static void destroy(eap_aka_plugin_t *this)
plugin_t *plugin_create()
{
eap_aka_plugin_t *this = malloc_thing(eap_aka_plugin_t);
-
+
this->plugin.destroy = (void(*)(plugin_t*))destroy;
-
+
charon->eap->add_method(charon->eap, EAP_AKA, 0, EAP_SERVER,
- (eap_constructor_t)eap_aka_create_server);
+ (eap_constructor_t)eap_aka_server_create);
charon->eap->add_method(charon->eap, EAP_AKA, 0, EAP_PEER,
- (eap_constructor_t)eap_aka_create_peer);
-
+ (eap_constructor_t)eap_aka_peer_create);
+
return &this->plugin;
}
diff --git a/src/charon/plugins/eap_aka/eap_aka_plugin.h b/src/charon/plugins/eap_aka/eap_aka_plugin.h
index 2c086ca80..938e5ecbd 100644
--- a/src/charon/plugins/eap_aka/eap_aka_plugin.h
+++ b/src/charon/plugins/eap_aka/eap_aka_plugin.h
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2008 Martin Willi
+ * Copyright (C) 2008-2009 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
@@ -29,7 +29,10 @@
typedef struct eap_aka_plugin_t eap_aka_plugin_t;
/**
- * EAP-AKA plugin
+ * EAP-AKA plugin.
+ *
+ * EAP-AKA uses 3rd generation mobile phone standard authentication
+ * mechanism for authentication, as defined RFC4187.
*/
struct eap_aka_plugin_t {
diff --git a/src/charon/plugins/eap_aka/eap_aka_server.c b/src/charon/plugins/eap_aka/eap_aka_server.c
new file mode 100644
index 000000000..9baff3e23
--- /dev/null
+++ b/src/charon/plugins/eap_aka/eap_aka_server.c
@@ -0,0 +1,700 @@
+/*
+ * Copyright (C) 2006-2009 Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+
+#include "eap_aka_server.h"
+
+#include <daemon.h>
+#include <library.h>
+
+#include <simaka_message.h>
+#include <simaka_crypto.h>
+
+/** length of the AT_NONCE_S value */
+#define NONCE_LEN 16
+
+typedef struct private_eap_aka_server_t private_eap_aka_server_t;
+
+/**
+ * Private data of an eap_aka_server_t object.
+ */
+struct private_eap_aka_server_t {
+
+ /**
+ * Public authenticator_t interface.
+ */
+ eap_aka_server_t public;
+
+ /**
+ * EAP-AKA crypto helper
+ */
+ simaka_crypto_t *crypto;
+
+ /**
+ * permanent ID of the peer
+ */
+ identification_t *permanent;
+
+ /**
+ * pseudonym ID of peer
+ */
+ identification_t *pseudonym;
+
+ /**
+ * reauthentication ID of peer
+ */
+ identification_t *reauth;
+
+ /**
+ * EAP identifier value
+ */
+ u_int8_t identifier;
+
+ /**
+ * Expected Result XRES
+ */
+ chunk_t xres;
+
+ /**
+ * Random value RAND
+ */
+ chunk_t rand;
+
+ /**
+ * MSK
+ */
+ chunk_t msk;
+
+ /**
+ * Nonce value used in AT_NONCE_S
+ */
+ chunk_t nonce;
+
+ /**
+ * Counter value negotiated, network order
+ */
+ chunk_t counter;
+
+ /**
+ * Do we request fast reauthentication?
+ */
+ bool use_reauth;
+
+ /**
+ * Do we request pseudonym identities?
+ */
+ bool use_pseudonym;
+
+ /**
+ * Do we request permanent identities?
+ */
+ bool use_permanent;
+
+ /**
+ * EAP-AKA message we have initiated
+ */
+ simaka_subtype_t pending;
+
+ /**
+ * Did the client send a synchronize request?
+ */
+ bool synchronized;
+};
+
+/**
+ * Create EAP-AKA/Request/Identity message
+ */
+static status_t identity(private_eap_aka_server_t *this, eap_payload_t **out)
+{
+ simaka_message_t *message;
+
+ message = simaka_message_create(TRUE, this->identifier++, EAP_AKA,
+ AKA_IDENTITY, this->crypto);
+ if (this->use_reauth)
+ {
+ message->add_attribute(message, AT_ANY_ID_REQ, chunk_empty);
+ }
+ else if (this->use_pseudonym)
+ {
+ message->add_attribute(message, AT_FULLAUTH_ID_REQ, chunk_empty);
+ }
+ else if (this->use_permanent)
+ {
+ message->add_attribute(message, AT_PERMANENT_ID_REQ, chunk_empty);
+ }
+ *out = message->generate(message, chunk_empty);
+ message->destroy(message);
+
+ this->pending = AKA_IDENTITY;
+ return NEED_MORE;
+}
+
+/**
+ * Create EAP-AKA/Request/Challenge message
+ */
+static status_t challenge(private_eap_aka_server_t *this, eap_payload_t **out)
+{
+ simaka_message_t *message;
+ char rand[AKA_RAND_LEN], xres[AKA_RES_MAX];
+ char ck[AKA_CK_LEN], ik[AKA_IK_LEN], autn[AKA_AUTN_LEN];
+ int xres_len;
+ chunk_t data, mk;
+ identification_t *id;
+
+ if (!charon->sim->provider_get_quintuplet(charon->sim, this->permanent,
+ rand, xres, &xres_len, ck, ik, autn))
+ {
+ if (this->use_pseudonym)
+ {
+ /* probably received a pseudonym/reauth id we couldn't map */
+ DBG1(DBG_IKE, "failed to map pseudonym/reauth identity '%Y', "
+ "fallback to permanent identity request", this->permanent);
+ this->use_pseudonym = FALSE;
+ DESTROY_IF(this->pseudonym);
+ this->pseudonym = NULL;
+ return identity(this, out);
+ }
+ return FAILED;
+ }
+ id = this->permanent;
+ if (this->pseudonym)
+ {
+ id = this->pseudonym;
+ }
+ data = chunk_cata("cc", chunk_create(ik, AKA_IK_LEN),
+ chunk_create(ck, AKA_CK_LEN));
+ free(this->msk.ptr);
+ this->msk = this->crypto->derive_keys_full(this->crypto, id, data, &mk);
+ this->rand = chunk_clone(chunk_create(rand, AKA_RAND_LEN));
+ this->xres = chunk_clone(chunk_create(xres, xres_len));
+
+ message = simaka_message_create(TRUE, this->identifier++, EAP_AKA,
+ AKA_CHALLENGE, this->crypto);
+ message->add_attribute(message, AT_RAND, this->rand);
+ message->add_attribute(message, AT_AUTN, chunk_create(autn, AKA_AUTN_LEN));
+ id = charon->sim->provider_gen_reauth(charon->sim, this->permanent, mk.ptr);
+ if (id)
+ {
+ message->add_attribute(message, AT_NEXT_REAUTH_ID,
+ id->get_encoding(id));
+ id->destroy(id);
+ }
+ else
+ {
+ id = charon->sim->provider_gen_pseudonym(charon->sim, this->permanent);
+ if (id)
+ {
+ message->add_attribute(message, AT_NEXT_PSEUDONYM,
+ id->get_encoding(id));
+ id->destroy(id);
+ }
+ }
+ *out = message->generate(message, chunk_empty);
+ message->destroy(message);
+
+ free(mk.ptr);
+ this->pending = AKA_CHALLENGE;
+ return NEED_MORE;
+}
+
+/**
+ * Initiate EAP-AKA/Request/Re-authentication message
+ */
+static status_t reauthenticate(private_eap_aka_server_t *this,
+ char mk[HASH_SIZE_SHA1], u_int16_t counter,
+ eap_payload_t **out)
+{
+ simaka_message_t *message;
+ identification_t *next;
+ chunk_t mkc;
+ rng_t *rng;
+
+ DBG1(DBG_IKE, "initiating EAP-AKA reauthentication");
+
+ rng = this->crypto->get_rng(this->crypto);
+ rng->allocate_bytes(rng, NONCE_LEN, &this->nonce);
+
+ mkc = chunk_create(mk, HASH_SIZE_SHA1);
+ counter = htons(counter);
+ this->counter = chunk_clone(chunk_create((char*)&counter, sizeof(counter)));
+
+ this->crypto->derive_keys_reauth(this->crypto, mkc);
+ this->msk = this->crypto->derive_keys_reauth_msk(this->crypto,
+ this->reauth, this->counter, this->nonce, mkc);
+
+ message = simaka_message_create(TRUE, this->identifier++, EAP_AKA,
+ AKA_REAUTHENTICATION, this->crypto);
+ message->add_attribute(message, AT_COUNTER, this->counter);
+ message->add_attribute(message, AT_NONCE_S, this->nonce);
+ next = charon->sim->provider_gen_reauth(charon->sim, this->permanent, mk);
+ if (next)
+ {
+ message->add_attribute(message, AT_NEXT_REAUTH_ID,
+ next->get_encoding(next));
+ next->destroy(next);
+ }
+ *out = message->generate(message, chunk_empty);
+ message->destroy(message);
+
+ this->pending = SIM_REAUTHENTICATION;
+ return NEED_MORE;
+}
+
+/**
+ * Implementation of eap_method_t.initiate
+ */
+static status_t initiate(private_eap_aka_server_t *this, eap_payload_t **out)
+{
+ if (this->use_permanent || this->use_pseudonym || this->use_reauth)
+ {
+ return identity(this, out);
+ }
+ return challenge(this, out);
+}
+
+/**
+ * Process EAP-AKA/Response/Identity message
+ */
+static status_t process_identity(private_eap_aka_server_t *this,
+ simaka_message_t *in, eap_payload_t **out)
+{
+ identification_t *permanent, *id;
+ enumerator_t *enumerator;
+ simaka_attribute_t type;
+ chunk_t data, identity = chunk_empty;
+
+ if (this->pending != AKA_IDENTITY)
+ {
+ DBG1(DBG_IKE, "received %N, but not expected",
+ simaka_subtype_names, AKA_IDENTITY);
+ return FAILED;
+ }
+
+ enumerator = in->create_attribute_enumerator(in);
+ while (enumerator->enumerate(enumerator, &type, &data))
+ {
+ switch (type)
+ {
+ case AT_IDENTITY:
+ identity = data;
+ break;
+ default:
+ if (!simaka_attribute_skippable(type))
+ {
+ enumerator->destroy(enumerator);
+ return FAILED;
+ }
+ break;
+ }
+ }
+ enumerator->destroy(enumerator);
+
+ if (!identity.len)
+ {
+ DBG1(DBG_IKE, "received incomplete Identity response");
+ return FAILED;
+ }
+
+ id = identification_create_from_data(identity);
+ if (this->use_reauth)
+ {
+ char mk[HASH_SIZE_SHA1];
+ u_int16_t counter;
+
+ permanent = charon->sim->provider_is_reauth(charon->sim, id,
+ mk, &counter);
+ if (permanent)
+ {
+ this->permanent->destroy(this->permanent);
+ this->permanent = permanent;
+ this->reauth = id;
+ return reauthenticate(this, mk, counter, out);
+ }
+ /* unable to map, maybe a pseudonym? */
+ DBG1(DBG_IKE, "'%Y' is not a reauth identity", id);
+ this->use_reauth = FALSE;
+ }
+ if (this->use_pseudonym)
+ {
+ permanent = charon->sim->provider_is_pseudonym(charon->sim, id);
+ if (permanent)
+ {
+ this->permanent->destroy(this->permanent);
+ this->permanent = permanent;
+ this->pseudonym = id->clone(id);
+ /* we already have a new permanent identity now */
+ this->use_permanent = FALSE;
+ }
+ else
+ {
+ DBG1(DBG_IKE, "'%Y' is not a pseudonym", id);
+ }
+ }
+ if (!this->pseudonym && this->use_permanent)
+ {
+ /* got a permanent identity or a pseudonym reauth id wou couldn't map,
+ * try to get quintuplets */
+ DBG1(DBG_IKE, "received identity '%Y'", id);
+ this->permanent->destroy(this->permanent);
+ this->permanent = id->clone(id);
+ }
+ id->destroy(id);
+
+ return challenge(this, out);
+}
+
+/**
+ * Process EAP-AKA/Response/Challenge message
+ */
+static status_t process_challenge(private_eap_aka_server_t *this,
+ simaka_message_t *in)
+{
+ enumerator_t *enumerator;
+ simaka_attribute_t type;
+ chunk_t data, res = chunk_empty;
+
+ if (this->pending != AKA_CHALLENGE)
+ {
+ DBG1(DBG_IKE, "received %N, but not expected",
+ simaka_subtype_names, AKA_CHALLENGE);
+ return FAILED;
+ }
+ /* verify MAC of EAP message, AT_MAC */
+ if (!in->verify(in, chunk_empty))
+ {
+ return FAILED;
+ }
+ enumerator = in->create_attribute_enumerator(in);
+ while (enumerator->enumerate(enumerator, &type, &data))
+ {
+ switch (type)
+ {
+ case AT_RES:
+ res = data;
+ break;
+ default:
+ if (!simaka_attribute_skippable(type))
+ {
+ enumerator->destroy(enumerator);
+ return FAILED;
+ }
+ break;
+ }
+ }
+ enumerator->destroy(enumerator);
+
+ /* compare received RES against stored XRES */
+ if (!chunk_equals(res, this->xres))
+ {
+ DBG1(DBG_IKE, "received RES does not match XRES");
+ return FAILED;
+ }
+ return SUCCESS;
+}
+
+/**
+ * process an EAP-AKA/Response/Reauthentication message
+ */
+static status_t process_reauthentication(private_eap_aka_server_t *this,
+ simaka_message_t *in, eap_payload_t **out)
+{
+ enumerator_t *enumerator;
+ simaka_attribute_t type;
+ chunk_t data, counter = chunk_empty;
+ bool too_small = FALSE;
+
+ if (this->pending != AKA_REAUTHENTICATION)
+ {
+ DBG1(DBG_IKE, "received %N, but not expected",
+ simaka_subtype_names, AKA_REAUTHENTICATION);
+ return FAILED;
+ }
+ /* verify AT_MAC attribute, signature is over "EAP packet | NONCE_S" */
+ if (!in->verify(in, this->nonce))
+ {
+ return FAILED;
+ }
+
+ enumerator = in->create_attribute_enumerator(in);
+ while (enumerator->enumerate(enumerator, &type, &data))
+ {
+ switch (type)
+ {
+ case AT_COUNTER:
+ counter = data;
+ break;
+ case AT_COUNTER_TOO_SMALL:
+ too_small = TRUE;
+ break;
+ default:
+ if (!simaka_attribute_skippable(type))
+ {
+ enumerator->destroy(enumerator);
+ return FAILED;
+ }
+ break;
+ }
+ }
+ enumerator->destroy(enumerator);
+
+ if (too_small)
+ {
+ DBG1(DBG_IKE, "received %N, initiating full authentication",
+ simaka_attribute_names, AT_COUNTER_TOO_SMALL);
+ this->use_reauth = FALSE;
+ this->crypto->clear_keys(this->crypto);
+ return challenge(this, out);
+ }
+ if (!chunk_equals(counter, this->counter))
+ {
+ DBG1(DBG_IKE, "received counter does not match");
+ return FAILED;
+ }
+ return SUCCESS;
+}
+
+/**
+ * Process EAP-AKA/Response/SynchronizationFailure message
+ */
+static status_t process_synchronize(private_eap_aka_server_t *this,
+ simaka_message_t *in, eap_payload_t **out)
+{
+ enumerator_t *enumerator;
+ simaka_attribute_t type;
+ chunk_t data, auts = chunk_empty;
+
+ if (this->synchronized)
+ {
+ DBG1(DBG_IKE, "received %N, but peer did already resynchronize",
+ simaka_subtype_names, AKA_SYNCHRONIZATION_FAILURE);
+ return FAILED;
+ }
+
+ DBG1(DBG_IKE, "received synchronization request, retrying...");
+
+ enumerator = in->create_attribute_enumerator(in);
+ while (enumerator->enumerate(enumerator, &type, &data))
+ {
+ switch (type)
+ {
+ case AT_AUTS:
+ auts = data;
+ break;
+ default:
+ if (!simaka_attribute_skippable(type))
+ {
+ enumerator->destroy(enumerator);
+ return FAILED;
+ }
+ break;
+ }
+ }
+ enumerator->destroy(enumerator);
+
+ if (!auts.len)
+ {
+ DBG1(DBG_IKE, "synchronization request didn't contain usable AUTS");
+ return FAILED;
+ }
+
+ if (!charon->sim->provider_resync(charon->sim, this->permanent,
+ this->rand.ptr, auts.ptr))
+ {
+ DBG1(DBG_IKE, "no AKA provider found supporting "
+ "resynchronization for '%Y'", this->permanent);
+ return FAILED;
+ }
+ this->synchronized = TRUE;
+ return challenge(this, out);
+}
+
+/**
+ * Process EAP-AKA/Response/ClientErrorCode message
+ */
+static status_t process_client_error(private_eap_aka_server_t *this,
+ simaka_message_t *in)
+{
+ enumerator_t *enumerator;
+ simaka_attribute_t type;
+ chunk_t data;
+
+ enumerator = in->create_attribute_enumerator(in);
+ while (enumerator->enumerate(enumerator, &type, &data))
+ {
+ if (type == AT_CLIENT_ERROR_CODE)
+ {
+ u_int16_t code;
+
+ memcpy(&code, data.ptr, sizeof(code));
+ DBG1(DBG_IKE, "received EAP-AKA client error '%N'",
+ simaka_client_error_names, ntohs(code));
+ }
+ else if (!simaka_attribute_skippable(type))
+ {
+ break;
+ }
+ }
+ enumerator->destroy(enumerator);
+ return FAILED;
+}
+
+/**
+ * Process EAP-AKA/Response/AuthenticationReject message
+ */
+static status_t process_authentication_reject(private_eap_aka_server_t *this,
+ simaka_message_t *in)
+{
+ DBG1(DBG_IKE, "received %N, authentication failed",
+ simaka_subtype_names, in->get_subtype(in));
+ return FAILED;
+}
+
+/**
+ * Implementation of eap_method_t.process
+ */
+static status_t process(private_eap_aka_server_t *this,
+ eap_payload_t *in, eap_payload_t **out)
+{
+ simaka_message_t *message;
+ status_t status;
+
+ message = simaka_message_create_from_payload(in, this->crypto);
+ if (!message)
+ {
+ return FAILED;
+ }
+ if (!message->parse(message))
+ {
+ message->destroy(message);
+ return FAILED;
+ }
+ switch (message->get_subtype(message))
+ {
+ case AKA_IDENTITY:
+ status = process_identity(this, message, out);
+ break;
+ case AKA_CHALLENGE:
+ status = process_challenge(this, message);
+ break;
+ case AKA_REAUTHENTICATION:
+ status = process_reauthentication(this, message, out);
+ break;
+ case AKA_SYNCHRONIZATION_FAILURE:
+ status = process_synchronize(this, message, out);
+ break;
+ case AKA_CLIENT_ERROR:
+ status = process_client_error(this, message);
+ break;
+ case AKA_AUTHENTICATION_REJECT:
+ status = process_authentication_reject(this, message);
+ break;
+ default:
+ DBG1(DBG_IKE, "unable to process EAP-AKA subtype %N",
+ simaka_subtype_names, message->get_subtype(message));
+ status = FAILED;
+ break;
+ }
+ message->destroy(message);
+ return status;
+}
+
+/**
+ * Implementation of eap_method_t.get_type.
+ */
+static eap_type_t get_type(private_eap_aka_server_t *this, u_int32_t *vendor)
+{
+ *vendor = 0;
+ return EAP_AKA;
+}
+
+/**
+ * Implementation of eap_method_t.get_msk.
+ */
+static status_t get_msk(private_eap_aka_server_t *this, chunk_t *msk)
+{
+ if (this->msk.ptr)
+ {
+ *msk = this->msk;
+ return SUCCESS;
+ }
+ return FAILED;
+}
+
+/**
+ * Implementation of eap_method_t.is_mutual.
+ */
+static bool is_mutual(private_eap_aka_server_t *this)
+{
+ return TRUE;
+}
+
+/**
+ * Implementation of eap_method_t.destroy.
+ */
+static void destroy(private_eap_aka_server_t *this)
+{
+ this->crypto->destroy(this->crypto);
+ this->permanent->destroy(this->permanent);
+ DESTROY_IF(this->pseudonym);
+ DESTROY_IF(this->reauth);
+ free(this->xres.ptr);
+ free(this->rand.ptr);
+ free(this->nonce.ptr);
+ free(this->msk.ptr);
+ free(this->counter.ptr);
+ free(this);
+}
+
+/*
+ * Described in header.
+ */
+eap_aka_server_t *eap_aka_server_create(identification_t *server,
+ identification_t *peer)
+{
+ private_eap_aka_server_t *this = malloc_thing(private_eap_aka_server_t);
+
+ this->public.interface.initiate = (status_t(*)(eap_method_t*,eap_payload_t**))initiate;
+ this->public.interface.process = (status_t(*)(eap_method_t*,eap_payload_t*,eap_payload_t**))process;
+ this->public.interface.get_type = (eap_type_t(*)(eap_method_t*,u_int32_t*))get_type;
+ this->public.interface.is_mutual = (bool(*)(eap_method_t*))is_mutual;
+ this->public.interface.get_msk = (status_t(*)(eap_method_t*,chunk_t*))get_msk;
+ this->public.interface.destroy = (void(*)(eap_method_t*))destroy;
+
+ this->crypto = simaka_crypto_create();
+ if (!this->crypto)
+ {
+ free(this);
+ return NULL;
+ }
+ this->permanent = peer->clone(peer);
+ this->pseudonym = NULL;
+ this->reauth = NULL;
+ this->xres = chunk_empty;
+ this->rand = chunk_empty;
+ this->nonce = chunk_empty;
+ this->msk = chunk_empty;
+ this->counter = chunk_empty;
+ this->pending = 0;
+ this->synchronized = FALSE;
+ this->use_reauth = this->use_pseudonym = this->use_permanent =
+ lib->settings->get_bool(lib->settings,
+ "charon.plugins.eap-aka.request_identity", TRUE);
+ /* generate a non-zero identifier */
+ do {
+ this->identifier = random();
+ } while (!this->identifier);
+
+ return &this->public;
+}
+
diff --git a/src/charon/plugins/eap_aka/eap_aka_server.h b/src/charon/plugins/eap_aka/eap_aka_server.h
new file mode 100644
index 000000000..d48fc4c34
--- /dev/null
+++ b/src/charon/plugins/eap_aka/eap_aka_server.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2008-2009 Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+
+/**
+ * @defgroup eap_aka_server eap_aka_server
+ * @{ @ingroup eap_aka
+ */
+
+#ifndef EAP_AKA_SERVER_H_
+#define EAP_AKA_SERVER_H_
+
+typedef struct eap_aka_server_t eap_aka_server_t;
+
+#include <sa/authenticators/eap/eap_method.h>
+
+/**
+ * Implementation of the eap_method_t interface using EAP-AKA as server.
+ */
+struct eap_aka_server_t {
+
+ /**
+ * Implemented eap_method_t interface.
+ */
+ eap_method_t interface;
+};
+
+/**
+ * Creates the server implementation of the EAP method EAP-AKA.
+ *
+ * @param server ID of the EAP server
+ * @param peer ID of the EAP client
+ * @return eap_aka_server_t object
+ */
+eap_aka_server_t *eap_aka_server_create(identification_t *server,
+ identification_t *peer);
+
+#endif /** EAP_AKA_SERVER_H_ @}*/
diff --git a/src/charon/plugins/eap_aka_3gpp2/Makefile.am b/src/charon/plugins/eap_aka_3gpp2/Makefile.am
new file mode 100644
index 000000000..1a4a3765b
--- /dev/null
+++ b/src/charon/plugins/eap_aka_3gpp2/Makefile.am
@@ -0,0 +1,15 @@
+
+INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
+
+AM_CFLAGS = -rdynamic
+
+plugin_LTLIBRARIES = libstrongswan-eap-aka-3gpp2.la
+
+libstrongswan_eap_aka_3gpp2_la_SOURCES = \
+ eap_aka_3gpp2_plugin.h eap_aka_3gpp2_plugin.c \
+ eap_aka_3gpp2_card.h eap_aka_3gpp2_card.c \
+ eap_aka_3gpp2_provider.h eap_aka_3gpp2_provider.c \
+ eap_aka_3gpp2_functions.h eap_aka_3gpp2_functions.c
+libstrongswan_eap_aka_3gpp2_la_LDFLAGS = -module -avoid-version
+libstrongswan_eap_aka_3gpp2_la_LIBADD = -lgmp
+
diff --git a/src/charon/plugins/eap_aka_3gpp2/Makefile.in b/src/charon/plugins/eap_aka_3gpp2/Makefile.in
new file mode 100644
index 000000000..b80f97f95
--- /dev/null
+++ b/src/charon/plugins/eap_aka_3gpp2/Makefile.in
@@ -0,0 +1,579 @@
+# Makefile.in generated by automake 1.11 from Makefile.am.
+# @configure_input@
+
+# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,
+# 2003, 2004, 2005, 2006, 2007, 2008, 2009 Free Software Foundation,
+# Inc.
+# This Makefile.in is free software; the Free Software Foundation
+# gives unlimited permission to copy and/or distribute it,
+# with or without modifications, as long as this notice is preserved.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY, to the extent permitted by law; without
+# even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+# PARTICULAR PURPOSE.
+
+@SET_MAKE@
+
+VPATH = @srcdir@
+pkgdatadir = $(datadir)/@PACKAGE@
+pkgincludedir = $(includedir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkglibexecdir = $(libexecdir)/@PACKAGE@
+am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
+install_sh_DATA = $(install_sh) -c -m 644
+install_sh_PROGRAM = $(install_sh) -c
+install_sh_SCRIPT = $(install_sh) -c
+INSTALL_HEADER = $(INSTALL_DATA)
+transform = $(program_transform_name)
+NORMAL_INSTALL = :
+PRE_INSTALL = :
+POST_INSTALL = :
+NORMAL_UNINSTALL = :
+PRE_UNINSTALL = :
+POST_UNINSTALL = :
+build_triplet = @build@
+host_triplet = @host@
+subdir = src/charon/plugins/eap_aka_3gpp2
+DIST_COMMON = $(srcdir)/Makefile.am $(srcdir)/Makefile.in
+ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
+am__aclocal_m4_deps = $(top_srcdir)/m4/config/libtool.m4 \
+ $(top_srcdir)/m4/config/ltoptions.m4 \
+ $(top_srcdir)/m4/config/ltsugar.m4 \
+ $(top_srcdir)/m4/config/ltversion.m4 \
+ $(top_srcdir)/m4/config/lt~obsolete.m4 \
+ $(top_srcdir)/m4/macros/with.m4 \
+ $(top_srcdir)/m4/macros/enable-disable.m4 \
+ $(top_srcdir)/configure.in
+am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
+ $(ACLOCAL_M4)
+mkinstalldirs = $(install_sh) -d
+CONFIG_CLEAN_FILES =
+CONFIG_CLEAN_VPATH_FILES =
+am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
+am__vpath_adj = case $$p in \
+ $(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
+ *) f=$$p;; \
+ esac;
+am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
+am__install_max = 40
+am__nobase_strip_setup = \
+ srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
+am__nobase_strip = \
+ for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
+am__nobase_list = $(am__nobase_strip_setup); \
+ for p in $$list; do echo "$$p $$p"; done | \
+ sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
+ $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
+ if (++n[$$2] == $(am__install_max)) \
+ { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
+ END { for (dir in files) print dir, files[dir] }'
+am__base_list = \
+ sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
+ sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
+am__installdirs = "$(DESTDIR)$(plugindir)"
+LTLIBRARIES = $(plugin_LTLIBRARIES)
+libstrongswan_eap_aka_3gpp2_la_DEPENDENCIES =
+am_libstrongswan_eap_aka_3gpp2_la_OBJECTS = eap_aka_3gpp2_plugin.lo \
+ eap_aka_3gpp2_card.lo eap_aka_3gpp2_provider.lo \
+ eap_aka_3gpp2_functions.lo
+libstrongswan_eap_aka_3gpp2_la_OBJECTS = \
+ $(am_libstrongswan_eap_aka_3gpp2_la_OBJECTS)
+libstrongswan_eap_aka_3gpp2_la_LINK = $(LIBTOOL) --tag=CC \
+ $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \
+ $(AM_CFLAGS) $(CFLAGS) \
+ $(libstrongswan_eap_aka_3gpp2_la_LDFLAGS) $(LDFLAGS) -o $@
+DEFAULT_INCLUDES = -I.@am__isrc@
+depcomp = $(SHELL) $(top_srcdir)/depcomp
+am__depfiles_maybe = depfiles
+am__mv = mv -f
+COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
+ $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
+LTCOMPILE = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
+ --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) \
+ $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
+CCLD = $(CC)
+LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
+ --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) $(AM_LDFLAGS) \
+ $(LDFLAGS) -o $@
+SOURCES = $(libstrongswan_eap_aka_3gpp2_la_SOURCES)
+DIST_SOURCES = $(libstrongswan_eap_aka_3gpp2_la_SOURCES)
+ETAGS = etags
+CTAGS = ctags
+DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
+ACLOCAL = @ACLOCAL@
+ALLOCA = @ALLOCA@
+AMTAR = @AMTAR@
+AR = @AR@
+AUTOCONF = @AUTOCONF@
+AUTOHEADER = @AUTOHEADER@
+AUTOMAKE = @AUTOMAKE@
+AWK = @AWK@
+BTLIB = @BTLIB@
+CC = @CC@
+CCDEPMODE = @CCDEPMODE@
+CFLAGS = @CFLAGS@
+CPP = @CPP@
+CPPFLAGS = @CPPFLAGS@
+CYGPATH_W = @CYGPATH_W@
+DEFS = @DEFS@
+DEPDIR = @DEPDIR@
+DLLIB = @DLLIB@
+DSYMUTIL = @DSYMUTIL@
+DUMPBIN = @DUMPBIN@
+ECHO_C = @ECHO_C@
+ECHO_N = @ECHO_N@
+ECHO_T = @ECHO_T@
+EGREP = @EGREP@
+EXEEXT = @EXEEXT@
+FGREP = @FGREP@
+GPERF = @GPERF@
+GREP = @GREP@
+INSTALL = @INSTALL@
+INSTALL_DATA = @INSTALL_DATA@
+INSTALL_PROGRAM = @INSTALL_PROGRAM@
+INSTALL_SCRIPT = @INSTALL_SCRIPT@
+INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
+LD = @LD@
+LDFLAGS = @LDFLAGS@
+LEX = @LEX@
+LEXLIB = @LEXLIB@
+LEX_OUTPUT_ROOT = @LEX_OUTPUT_ROOT@
+LIBOBJS = @LIBOBJS@
+LIBS = @LIBS@
+LIBTOOL = @LIBTOOL@
+LIPO = @LIPO@
+LN_S = @LN_S@
+LTLIBOBJS = @LTLIBOBJS@
+MAKEINFO = @MAKEINFO@
+MKDIR_P = @MKDIR_P@
+MYSQLCFLAG = @MYSQLCFLAG@
+MYSQLCONFIG = @MYSQLCONFIG@
+MYSQLLIB = @MYSQLLIB@
+NM = @NM@
+NMEDIT = @NMEDIT@
+OBJDUMP = @OBJDUMP@
+OBJEXT = @OBJEXT@
+OTOOL = @OTOOL@
+OTOOL64 = @OTOOL64@
+PACKAGE = @PACKAGE@
+PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
+PACKAGE_NAME = @PACKAGE_NAME@
+PACKAGE_STRING = @PACKAGE_STRING@
+PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_URL = @PACKAGE_URL@
+PACKAGE_VERSION = @PACKAGE_VERSION@
+PATH_SEPARATOR = @PATH_SEPARATOR@
+PERL = @PERL@
+PKG_CONFIG = @PKG_CONFIG@
+PTHREADLIB = @PTHREADLIB@
+RANLIB = @RANLIB@
+RTLIB = @RTLIB@
+RUBY = @RUBY@
+RUBYINCLUDE = @RUBYINCLUDE@
+SED = @SED@
+SET_MAKE = @SET_MAKE@
+SHELL = @SHELL@
+SOCKLIB = @SOCKLIB@
+STRIP = @STRIP@
+VERSION = @VERSION@
+YACC = @YACC@
+YFLAGS = @YFLAGS@
+abs_builddir = @abs_builddir@
+abs_srcdir = @abs_srcdir@
+abs_top_builddir = @abs_top_builddir@
+abs_top_srcdir = @abs_top_srcdir@
+ac_ct_CC = @ac_ct_CC@
+ac_ct_DUMPBIN = @ac_ct_DUMPBIN@
+am__include = @am__include@
+am__leading_dot = @am__leading_dot@
+am__quote = @am__quote@
+am__tar = @am__tar@
+am__untar = @am__untar@
+bindir = @bindir@
+build = @build@
+build_alias = @build_alias@
+build_cpu = @build_cpu@
+build_os = @build_os@
+build_vendor = @build_vendor@
+builddir = @builddir@
+datadir = @datadir@
+datarootdir = @datarootdir@
+default_pkcs11 = @default_pkcs11@
+docdir = @docdir@
+dvidir = @dvidir@
+exec_prefix = @exec_prefix@
+gtk_CFLAGS = @gtk_CFLAGS@
+gtk_LIBS = @gtk_LIBS@
+host = @host@
+host_alias = @host_alias@
+host_cpu = @host_cpu@
+host_os = @host_os@
+host_vendor = @host_vendor@
+htmldir = @htmldir@
+includedir = @includedir@
+infodir = @infodir@
+install_sh = @install_sh@
+ipsecdir = @ipsecdir@
+ipsecgid = @ipsecgid@
+ipsecgroup = @ipsecgroup@
+ipsecuid = @ipsecuid@
+ipsecuser = @ipsecuser@
+libdir = @libdir@
+libexecdir = @libexecdir@
+libstrongswan_plugins = @libstrongswan_plugins@
+linux_headers = @linux_headers@
+localedir = @localedir@
+localstatedir = @localstatedir@
+lt_ECHO = @lt_ECHO@
+mandir = @mandir@
+mkdir_p = @mkdir_p@
+nm_CFLAGS = @nm_CFLAGS@
+nm_LIBS = @nm_LIBS@
+nm_ca_dir = @nm_ca_dir@
+oldincludedir = @oldincludedir@
+pdfdir = @pdfdir@
+piddir = @piddir@
+plugindir = @plugindir@
+pluto_plugins = @pluto_plugins@
+prefix = @prefix@
+program_transform_name = @program_transform_name@
+psdir = @psdir@
+random_device = @random_device@
+resolv_conf = @resolv_conf@
+routing_table = @routing_table@
+routing_table_prio = @routing_table_prio@
+sbindir = @sbindir@
+sharedstatedir = @sharedstatedir@
+srcdir = @srcdir@
+strongswan_conf = @strongswan_conf@
+sysconfdir = @sysconfdir@
+target_alias = @target_alias@
+top_build_prefix = @top_build_prefix@
+top_builddir = @top_builddir@
+top_srcdir = @top_srcdir@
+urandom_device = @urandom_device@
+xml_CFLAGS = @xml_CFLAGS@
+xml_LIBS = @xml_LIBS@
+INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
+AM_CFLAGS = -rdynamic
+plugin_LTLIBRARIES = libstrongswan-eap-aka-3gpp2.la
+libstrongswan_eap_aka_3gpp2_la_SOURCES = \
+ eap_aka_3gpp2_plugin.h eap_aka_3gpp2_plugin.c \
+ eap_aka_3gpp2_card.h eap_aka_3gpp2_card.c \
+ eap_aka_3gpp2_provider.h eap_aka_3gpp2_provider.c \
+ eap_aka_3gpp2_functions.h eap_aka_3gpp2_functions.c
+
+libstrongswan_eap_aka_3gpp2_la_LDFLAGS = -module -avoid-version
+libstrongswan_eap_aka_3gpp2_la_LIBADD = -lgmp
+all: all-am
+
+.SUFFIXES:
+.SUFFIXES: .c .lo .o .obj
+$(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps)
+ @for dep in $?; do \
+ case '$(am__configure_deps)' in \
+ *$$dep*) \
+ ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \
+ && { if test -f $@; then exit 0; else break; fi; }; \
+ exit 1;; \
+ esac; \
+ done; \
+ echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/charon/plugins/eap_aka_3gpp2/Makefile'; \
+ $(am__cd) $(top_srcdir) && \
+ $(AUTOMAKE) --gnu src/charon/plugins/eap_aka_3gpp2/Makefile
+.PRECIOUS: Makefile
+Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
+ @case '$?' in \
+ *config.status*) \
+ cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
+ *) \
+ echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \
+ cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \
+ esac;
+
+$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
+ cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+
+$(top_srcdir)/configure: $(am__configure_deps)
+ cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(ACLOCAL_M4): $(am__aclocal_m4_deps)
+ cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(am__aclocal_m4_deps):
+install-pluginLTLIBRARIES: $(plugin_LTLIBRARIES)
+ @$(NORMAL_INSTALL)
+ test -z "$(plugindir)" || $(MKDIR_P) "$(DESTDIR)$(plugindir)"
+ @list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+ list2=; for p in $$list; do \
+ if test -f $$p; then \
+ list2="$$list2 $$p"; \
+ else :; fi; \
+ done; \
+ test -z "$$list2" || { \
+ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(plugindir)'"; \
+ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(plugindir)"; \
+ }
+
+uninstall-pluginLTLIBRARIES:
+ @$(NORMAL_UNINSTALL)
+ @list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+ for p in $$list; do \
+ $(am__strip_dir) \
+ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$f'"; \
+ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$f"; \
+ done
+
+clean-pluginLTLIBRARIES:
+ -test -z "$(plugin_LTLIBRARIES)" || rm -f $(plugin_LTLIBRARIES)
+ @list='$(plugin_LTLIBRARIES)'; for p in $$list; do \
+ dir="`echo $$p | sed -e 's|/[^/]*$$||'`"; \
+ test "$$dir" != "$$p" || dir=.; \
+ echo "rm -f \"$${dir}/so_locations\""; \
+ rm -f "$${dir}/so_locations"; \
+ done
+libstrongswan-eap-aka-3gpp2.la: $(libstrongswan_eap_aka_3gpp2_la_OBJECTS) $(libstrongswan_eap_aka_3gpp2_la_DEPENDENCIES)
+ $(libstrongswan_eap_aka_3gpp2_la_LINK) -rpath $(plugindir) $(libstrongswan_eap_aka_3gpp2_la_OBJECTS) $(libstrongswan_eap_aka_3gpp2_la_LIBADD) $(LIBS)
+
+mostlyclean-compile:
+ -rm -f *.$(OBJEXT)
+
+distclean-compile:
+ -rm -f *.tab.c
+
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/eap_aka_3gpp2_card.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/eap_aka_3gpp2_functions.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/eap_aka_3gpp2_plugin.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/eap_aka_3gpp2_provider.Plo@am__quote@
+
+.c.o:
+@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@ $(COMPILE) -c $<
+
+.c.obj:
+@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@ $(COMPILE) -c `$(CYGPATH_W) '$<'`
+
+.c.lo:
+@am__fastdepCC_TRUE@ $(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@ $(LTCOMPILE) -c -o $@ $<
+
+mostlyclean-libtool:
+ -rm -f *.lo
+
+clean-libtool:
+ -rm -rf .libs _libs
+
+ID: $(HEADERS) $(SOURCES) $(LISP) $(TAGS_FILES)
+ list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
+ unique=`for i in $$list; do \
+ if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
+ done | \
+ $(AWK) '{ files[$$0] = 1; nonempty = 1; } \
+ END { if (nonempty) { for (i in files) print i; }; }'`; \
+ mkid -fID $$unique
+tags: TAGS
+
+TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
+ $(TAGS_FILES) $(LISP)
+ set x; \
+ here=`pwd`; \
+ list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
+ unique=`for i in $$list; do \
+ if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
+ done | \
+ $(AWK) '{ files[$$0] = 1; nonempty = 1; } \
+ END { if (nonempty) { for (i in files) print i; }; }'`; \
+ shift; \
+ if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
+ test -n "$$unique" || unique=$$empty_fix; \
+ if test $$# -gt 0; then \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ "$$@" $$unique; \
+ else \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ $$unique; \
+ fi; \
+ fi
+ctags: CTAGS
+CTAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
+ $(TAGS_FILES) $(LISP)
+ list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
+ unique=`for i in $$list; do \
+ if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
+ done | \
+ $(AWK) '{ files[$$0] = 1; nonempty = 1; } \
+ END { if (nonempty) { for (i in files) print i; }; }'`; \
+ test -z "$(CTAGS_ARGS)$$unique" \
+ || $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
+ $$unique
+
+GTAGS:
+ here=`$(am__cd) $(top_builddir) && pwd` \
+ && $(am__cd) $(top_srcdir) \
+ && gtags -i $(GTAGS_ARGS) "$$here"
+
+distclean-tags:
+ -rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
+
+distdir: $(DISTFILES)
+ @srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
+ topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
+ list='$(DISTFILES)'; \
+ dist_files=`for file in $$list; do echo $$file; done | \
+ sed -e "s|^$$srcdirstrip/||;t" \
+ -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \
+ case $$dist_files in \
+ */*) $(MKDIR_P) `echo "$$dist_files" | \
+ sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \
+ sort -u` ;; \
+ esac; \
+ for file in $$dist_files; do \
+ if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
+ if test -d $$d/$$file; then \
+ dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
+ if test -d "$(distdir)/$$file"; then \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+ fi; \
+ if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
+ cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+ fi; \
+ cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
+ else \
+ test -f "$(distdir)/$$file" \
+ || cp -p $$d/$$file "$(distdir)/$$file" \
+ || exit 1; \
+ fi; \
+ done
+check-am: all-am
+check: check-am
+all-am: Makefile $(LTLIBRARIES)
+installdirs:
+ for dir in "$(DESTDIR)$(plugindir)"; do \
+ test -z "$$dir" || $(MKDIR_P) "$$dir"; \
+ done
+install: install-am
+install-exec: install-exec-am
+install-data: install-data-am
+uninstall: uninstall-am
+
+install-am: all-am
+ @$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am
+
+installcheck: installcheck-am
+install-strip:
+ $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
+ install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
+ `test -z '$(STRIP)' || \
+ echo "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'"` install
+mostlyclean-generic:
+
+clean-generic:
+
+distclean-generic:
+ -test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+ -test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
+
+maintainer-clean-generic:
+ @echo "This command is intended for maintainers to use"
+ @echo "it deletes files that may require special tools to rebuild."
+clean: clean-am
+
+clean-am: clean-generic clean-libtool clean-pluginLTLIBRARIES \
+ mostlyclean-am
+
+distclean: distclean-am
+ -rm -rf ./$(DEPDIR)
+ -rm -f Makefile
+distclean-am: clean-am distclean-compile distclean-generic \
+ distclean-tags
+
+dvi: dvi-am
+
+dvi-am:
+
+html: html-am
+
+html-am:
+
+info: info-am
+
+info-am:
+
+install-data-am: install-pluginLTLIBRARIES
+
+install-dvi: install-dvi-am
+
+install-dvi-am:
+
+install-exec-am:
+
+install-html: install-html-am
+
+install-html-am:
+
+install-info: install-info-am
+
+install-info-am:
+
+install-man:
+
+install-pdf: install-pdf-am
+
+install-pdf-am:
+
+install-ps: install-ps-am
+
+install-ps-am:
+
+installcheck-am:
+
+maintainer-clean: maintainer-clean-am
+ -rm -rf ./$(DEPDIR)
+ -rm -f Makefile
+maintainer-clean-am: distclean-am maintainer-clean-generic
+
+mostlyclean: mostlyclean-am
+
+mostlyclean-am: mostlyclean-compile mostlyclean-generic \
+ mostlyclean-libtool
+
+pdf: pdf-am
+
+pdf-am:
+
+ps: ps-am
+
+ps-am:
+
+uninstall-am: uninstall-pluginLTLIBRARIES
+
+.MAKE: install-am install-strip
+
+.PHONY: CTAGS GTAGS all all-am check check-am clean clean-generic \
+ clean-libtool clean-pluginLTLIBRARIES ctags distclean \
+ distclean-compile distclean-generic distclean-libtool \
+ distclean-tags distdir dvi dvi-am html html-am info info-am \
+ install install-am install-data install-data-am install-dvi \
+ install-dvi-am install-exec install-exec-am install-html \
+ install-html-am install-info install-info-am install-man \
+ install-pdf install-pdf-am install-pluginLTLIBRARIES \
+ install-ps install-ps-am install-strip installcheck \
+ installcheck-am installdirs maintainer-clean \
+ maintainer-clean-generic mostlyclean mostlyclean-compile \
+ mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \
+ tags uninstall uninstall-am uninstall-pluginLTLIBRARIES
+
+
+# Tell versions [3.59,3.63) of GNU make to not export all variables.
+# Otherwise a system limit (for SysV at least) may be exceeded.
+.NOEXPORT:
diff --git a/src/charon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_card.c b/src/charon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_card.c
new file mode 100644
index 000000000..5c0fe38ad
--- /dev/null
+++ b/src/charon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_card.c
@@ -0,0 +1,178 @@
+/*
+ * Copyright (C) 2008-2009 Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+
+#include "eap_aka_3gpp2_card.h"
+
+#include <daemon.h>
+
+typedef struct private_eap_aka_3gpp2_card_t private_eap_aka_3gpp2_card_t;
+
+/**
+ * Private data of an eap_aka_3gpp2_card_t object.
+ */
+struct private_eap_aka_3gpp2_card_t {
+
+ /**
+ * Public eap_aka_3gpp2_card_t interface.
+ */
+ eap_aka_3gpp2_card_t public;
+
+ /**
+ * AKA functions
+ */
+ eap_aka_3gpp2_functions_t *f;
+
+ /**
+ * do sequence number checking?
+ */
+ bool seq_check;
+
+ /**
+ * SQN stored in this pseudo-USIM
+ */
+ char sqn[AKA_SQN_LEN];
+};
+
+/**
+ * Functions from eap_aka_3gpp2_provider.c
+ */
+bool eap_aka_3gpp2_get_k(identification_t *id, char k[AKA_K_LEN]);
+void eap_aka_3gpp2_get_sqn(char sqn[AKA_SQN_LEN], int offset);
+
+/**
+ * Implementation of sim_card_t.get_quintuplet
+ */
+static status_t get_quintuplet(private_eap_aka_3gpp2_card_t *this,
+ identification_t *id, char rand[AKA_RAND_LEN],
+ char autn[AKA_AUTN_LEN], char ck[AKA_CK_LEN],
+ char ik[AKA_IK_LEN], char res[AKA_RES_MAX],
+ int *res_len)
+{
+ char *amf, *mac;
+ char k[AKA_K_LEN], ak[AKA_AK_LEN], sqn[AKA_SQN_LEN], xmac[AKA_MAC_LEN];
+
+ if (!eap_aka_3gpp2_get_k(id, k))
+ {
+ DBG1(DBG_IKE, "no EAP key found for %Y to authenticate with AKA", id);
+ return FAILED;
+ }
+
+ /* AUTN = SQN xor AK | AMF | MAC */
+ DBG3(DBG_IKE, "received autn %b", autn, AKA_AUTN_LEN);
+ DBG3(DBG_IKE, "using K %b", k, AKA_K_LEN);
+ DBG3(DBG_IKE, "using rand %b", rand, AKA_RAND_LEN);
+ memcpy(sqn, autn, AKA_SQN_LEN);
+ amf = autn + AKA_SQN_LEN;
+ mac = autn + AKA_SQN_LEN + AKA_AMF_LEN;
+
+ /* XOR anonymity key AK into SQN to decrypt it */
+ this->f->f5(this->f, k, rand, ak);
+ DBG3(DBG_IKE, "using ak %b", ak, AKA_AK_LEN);
+ memxor(sqn, ak, AKA_SQN_LEN);
+ DBG3(DBG_IKE, "using sqn %b", sqn, AKA_SQN_LEN);
+
+ /* calculate expected MAC and compare against received one */
+ this->f->f1(this->f, k, rand, sqn, amf, xmac);
+ if (!memeq(mac, xmac, AKA_MAC_LEN))
+ {
+ DBG1(DBG_IKE, "received MAC does not match XMAC");
+ DBG3(DBG_IKE, "MAC %b\nXMAC %b", mac, AKA_MAC_LEN, xmac, AKA_MAC_LEN);
+ return FAILED;
+ }
+
+ if (this->seq_check && memcmp(this->sqn, sqn, AKA_SQN_LEN) >= 0)
+ {
+ DBG3(DBG_IKE, "received SQN %b\ncurrent SQN %b",
+ sqn, AKA_SQN_LEN, this->sqn, AKA_SQN_LEN);
+ return INVALID_STATE;
+ }
+
+ /* update stored SQN to the received one */
+ memcpy(this->sqn, sqn, AKA_SQN_LEN);
+
+ /* CK/IK */
+ this->f->f3(this->f, k, rand, ck);
+ this->f->f4(this->f, k, rand, ik);
+ /* calculate RES */
+ this->f->f2(this->f, k, rand, res);
+ *res_len = AKA_RES_MAX;
+
+ return SUCCESS;
+}
+
+/**
+ * Implementation of sim_card_t.resync
+ */
+static bool resync(private_eap_aka_3gpp2_card_t *this, identification_t *id,
+ char rand[AKA_RAND_LEN], char auts[AKA_AUTS_LEN])
+{
+ char amf[AKA_AMF_LEN], k[AKA_K_LEN], aks[AKA_AK_LEN], macs[AKA_MAC_LEN];
+
+ if (!eap_aka_3gpp2_get_k(id, k))
+ {
+ DBG1(DBG_IKE, "no EAP key found for %Y to resync AKA", id);
+ return FALSE;
+ }
+
+ /* AMF is set to zero in resync */
+ memset(amf, 0, AKA_AMF_LEN);
+ this->f->f5star(this->f, k, rand, aks);
+ this->f->f1star(this->f, k, rand, this->sqn, amf, macs);
+ /* AUTS = SQN xor AKS | MACS */
+ memcpy(auts, this->sqn, AKA_SQN_LEN);
+ memxor(auts, aks, AKA_AK_LEN);
+ memcpy(auts + AKA_AK_LEN, macs, AKA_MAC_LEN);
+
+ return TRUE;
+}
+
+/**
+ * Implementation of eap_aka_3gpp2_card_t.destroy.
+ */
+static void destroy(private_eap_aka_3gpp2_card_t *this)
+{
+ free(this);
+}
+
+/**
+ * See header
+ */
+eap_aka_3gpp2_card_t *eap_aka_3gpp2_card_create(eap_aka_3gpp2_functions_t *f)
+{
+ private_eap_aka_3gpp2_card_t *this = malloc_thing(private_eap_aka_3gpp2_card_t);
+
+ this->public.card.get_triplet = (bool(*)(sim_card_t*, identification_t *id, char rand[SIM_RAND_LEN], char sres[SIM_SRES_LEN], char kc[SIM_KC_LEN]))return_false;
+ this->public.card.get_quintuplet = (status_t(*)(sim_card_t*, identification_t *id, char rand[AKA_RAND_LEN], char autn[AKA_AUTN_LEN], char ck[AKA_CK_LEN], char ik[AKA_IK_LEN], char res[AKA_RES_MAX], int *res_len))get_quintuplet;
+ this->public.card.resync = (bool(*)(sim_card_t*, identification_t *id, char rand[AKA_RAND_LEN], char auts[AKA_AUTS_LEN]))resync;
+ this->public.card.get_pseudonym = (identification_t*(*)(sim_card_t*, identification_t *id))return_null;
+ this->public.card.set_pseudonym = (void(*)(sim_card_t*, identification_t *id, identification_t *pseudonym))nop;
+ this->public.card.get_reauth = (identification_t*(*)(sim_card_t*, identification_t *id, char mk[HASH_SIZE_SHA1], u_int16_t *counter))return_null;
+ this->public.card.set_reauth = (void(*)(sim_card_t*, identification_t *id, identification_t* next, char mk[HASH_SIZE_SHA1], u_int16_t counter))nop;
+ this->public.destroy = (void(*)(eap_aka_3gpp2_card_t*))destroy;
+
+ this->f = f;
+ this->seq_check = lib->settings->get_bool(lib->settings,
+ "charon.plugins.eap-aka-3gpp2.seq_check",
+#ifdef SEQ_CHECK /* handle legacy compile time configuration as default */
+ TRUE);
+#else /* !SEQ_CHECK */
+ FALSE);
+#endif /* SEQ_CHECK */
+
+ eap_aka_3gpp2_get_sqn(this->sqn, 0);
+
+ return &this->public;
+}
+
diff --git a/src/charon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_card.h b/src/charon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_card.h
new file mode 100644
index 000000000..b95bc52af
--- /dev/null
+++ b/src/charon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_card.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2008-2009 Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+
+/**
+ * @defgroup eap_aka_3gpp2_card eap_aka_3gpp2_card
+ * @{ @ingroup eap_aka_3gpp2
+ */
+
+#ifndef EAP_AKA_3GPP2_CARD_H_
+#define EAP_AKA_3GPP2_CARD_H_
+
+#include "eap_aka_3gpp2_functions.h"
+
+#include <sa/authenticators/eap/sim_manager.h>
+
+typedef struct eap_aka_3gpp2_card_t eap_aka_3gpp2_card_t;
+
+/**
+ * SIM card implementation using a set of AKA functions.
+ */
+struct eap_aka_3gpp2_card_t {
+
+ /**
+ * Implements sim_card_t interface
+ */
+ sim_card_t card;
+
+ /**
+ * Destroy a eap_aka_3gpp2_card_t.
+ */
+ void (*destroy)(eap_aka_3gpp2_card_t *this);
+};
+
+/**
+ * Create a eap_aka_3gpp2_card instance.
+ *
+ * @param f AKA functions
+ */
+eap_aka_3gpp2_card_t *eap_aka_3gpp2_card_create(eap_aka_3gpp2_functions_t *f);
+
+#endif /** EAP_AKA_3GPP2_CARD_H_ @}*/
diff --git a/src/charon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_functions.c b/src/charon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_functions.c
new file mode 100644
index 000000000..1d3d246d1
--- /dev/null
+++ b/src/charon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_functions.c
@@ -0,0 +1,394 @@
+/*
+ * Copyright (C) 2008-2009 Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+
+#include "eap_aka_3gpp2_functions.h"
+
+#include <gmp.h>
+#include <limits.h>
+
+#include <daemon.h>
+
+typedef struct private_eap_aka_3gpp2_functions_t private_eap_aka_3gpp2_functions_t;
+
+/**
+ * Private data of an eap_aka_3gpp2_functions_t object.
+ */
+struct private_eap_aka_3gpp2_functions_t {
+
+ /**
+ * Public eap_aka_3gpp2_functions_t interface.
+ */
+ eap_aka_3gpp2_functions_t public;
+
+ /**
+ * Used keyed SHA1 function, as PRF
+ */
+ prf_t *prf;
+};
+
+#define AKA_PAYLOAD_LEN 64
+
+#define F1 0x42
+#define F1STAR 0x43
+#define F2 0x44
+#define F3 0x45
+#define F4 0x46
+#define F5 0x47
+#define F5STAR 0x48
+
+/** Family key, as proposed in S.S0055 */
+static chunk_t fmk = chunk_from_chars(0x41, 0x48, 0x41, 0x47);
+
+/**
+ * Binary represnation of the polynom T^160 + T^5 + T^3 + T^2 + 1
+ */
+static u_int8_t g[] = {
+ 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x2d
+};
+
+/**
+ * Predefined random bits from the RAND Corporation book
+ */
+static u_int8_t a[] = {
+ 0x9d, 0xe9, 0xc9, 0xc8, 0xef, 0xd5, 0x78, 0x11,
+ 0x48, 0x23, 0x14, 0x01, 0x90, 0x1f, 0x2d, 0x49,
+ 0x3f, 0x4c, 0x63, 0x65
+};
+
+/**
+ * Predefined random bits from the RAND Corporation book
+ */
+static u_int8_t b[] = {
+ 0x75, 0xef, 0xd1, 0x5c, 0x4b, 0x8f, 0x8f, 0x51,
+ 0x4e, 0xf3, 0xbc, 0xc3, 0x79, 0x4a, 0x76, 0x5e,
+ 0x7e, 0xec, 0x45, 0xe0
+};
+
+/**
+ * Multiplicate two mpz_t with bits interpreted as polynoms.
+ */
+static void mpz_mul_poly(mpz_t r, mpz_t a, mpz_t b)
+{
+ mpz_t bm, rm;
+ int current = 0, shifted = 0, shift;
+
+ mpz_init_set(bm, b);
+ mpz_init_set_ui(rm, 0);
+ /* scan through a, for each found bit: */
+ while ((current = mpz_scan1(a, current)) != ULONG_MAX)
+ {
+ /* XOR shifted b into r */
+ shift = current - shifted;
+ mpz_mul_2exp(bm, bm, shift);
+ shifted += shift;
+ mpz_xor(rm, rm, bm);
+ current++;
+ }
+
+ mpz_swap(r, rm);
+ mpz_clear(rm);
+ mpz_clear(bm);
+}
+
+/**
+ * Calculate the sum of a + b interpreted as polynoms.
+ */
+static void mpz_add_poly(mpz_t res, mpz_t a, mpz_t b)
+{
+ /* addition of polynominals is just the XOR */
+ mpz_xor(res, a, b);
+}
+
+/**
+ * Calculate the remainder of a/b interpreted as polynoms.
+ */
+static void mpz_mod_poly(mpz_t r, mpz_t a, mpz_t b)
+{
+ /* Example:
+ * a = 10001010
+ * b = 00000101
+ */
+ int a_bit, b_bit, diff;
+ mpz_t bm, am;
+
+ mpz_init_set(am, a);
+ mpz_init(bm);
+
+ a_bit = mpz_sizeinbase(a, 2);
+ b_bit = mpz_sizeinbase(b, 2);
+
+ /* don't do anything if b > a */
+ if (a_bit >= b_bit)
+ {
+ /* shift b left to align up most signaficant "1" to a:
+ * a = 10001010
+ * b = 10100000
+ */
+ mpz_mul_2exp(bm, b, a_bit - b_bit);
+ do
+ {
+ /* XOR b into a, this kills the most significant "1":
+ * a = 00101010
+ */
+ mpz_xor(am, am, bm);
+ /* find the next most significant "1" in a, and align up b:
+ * a = 00101010
+ * b = 00101000
+ */
+ diff = a_bit - mpz_sizeinbase(am, 2);
+ mpz_div_2exp(bm, bm, diff);
+ a_bit -= diff;
+ }
+ while (b_bit <= mpz_sizeinbase(bm, 2));
+ /* While b is not shifted to its original value */
+ }
+ /* after another iteration:
+ * a = 00000010
+ * which is the polynomial modulo
+ */
+
+ mpz_swap(r, am);
+ mpz_clear(am);
+ mpz_clear(bm);
+}
+
+/**
+ * Step 3 of the various fx() functions:
+ * XOR the key into the SHA1 IV
+ */
+static void step3(prf_t *prf, u_char k[AKA_K_LEN],
+ u_char payload[AKA_PAYLOAD_LEN], u_int8_t h[HASH_SIZE_SHA1])
+{
+ /* use the keyed hasher to build the hash */
+ prf->set_key(prf, chunk_create(k, AKA_K_LEN));
+ prf->get_bytes(prf, chunk_create(payload, AKA_PAYLOAD_LEN), h);
+}
+
+/**
+ * Step 4 of the various fx() functions:
+ * Polynomial whiten calculations
+ */
+static void step4(u_char x[HASH_SIZE_SHA1])
+{
+ mpz_t xm, am, bm, gm;
+
+ mpz_init(xm);
+ mpz_init(am);
+ mpz_init(bm);
+ mpz_init(gm);
+
+ mpz_import(xm, HASH_SIZE_SHA1, 1, 1, 1, 0, x);
+ mpz_import(am, sizeof(a), 1, 1, 1, 0, a);
+ mpz_import(bm, sizeof(b), 1, 1, 1, 0, b);
+ mpz_import(gm, sizeof(g), 1, 1, 1, 0, g);
+
+ mpz_mul_poly(xm, am, xm);
+ mpz_add_poly(xm, bm, xm);
+ mpz_mod_poly(xm, xm, gm);
+
+ mpz_export(x, NULL, 1, HASH_SIZE_SHA1, 1, 0, xm);
+
+ mpz_clear(xm);
+ mpz_clear(am);
+ mpz_clear(bm);
+ mpz_clear(gm);
+}
+
+/**
+ * Calculation function for f2(), f3(), f4()
+ */
+static void fx(prf_t *prf, u_char f, u_char k[AKA_K_LEN],
+ u_char rand[AKA_RAND_LEN], u_char out[AKA_MAC_LEN])
+{
+ u_char payload[AKA_PAYLOAD_LEN];
+ u_char h[HASH_SIZE_SHA1];
+ u_char i;
+
+ for (i = 0; i < 2; i++)
+ {
+ memset(payload, 0x5c, AKA_PAYLOAD_LEN);
+ payload[11] ^= f;
+ memxor(payload + 12, fmk.ptr, fmk.len);
+ memxor(payload + 24, rand, AKA_RAND_LEN);
+
+ payload[3] ^= i;
+ payload[19] ^= i;
+ payload[35] ^= i;
+ payload[51] ^= i;
+
+ step3(prf, k, payload, h);
+ step4(h);
+ memcpy(out + i * 8, h, 8);
+ }
+}
+
+/**
+ * Calculation function of f1() and f1star()
+ */
+static void f1x(prf_t *prf, u_int8_t f, u_char k[AKA_K_LEN],
+ u_char rand[AKA_RAND_LEN], u_char sqn[AKA_SQN_LEN],
+ u_char amf[AKA_AMF_LEN], u_char mac[AKA_MAC_LEN])
+{
+ /* generate MAC = f1(FMK, SQN, RAND, AMF)
+ * K is loaded into hashers IV; FMK, RAND, SQN, AMF are XORed in a 512-bit
+ * payload which gets hashed
+ */
+ u_char payload[AKA_PAYLOAD_LEN];
+ u_char h[HASH_SIZE_SHA1];
+
+ memset(payload, 0x5c, AKA_PAYLOAD_LEN);
+ payload[11] ^= f;
+ memxor(payload + 12, fmk.ptr, fmk.len);
+ memxor(payload + 16, rand, AKA_RAND_LEN);
+ memxor(payload + 34, sqn, AKA_SQN_LEN);
+ memxor(payload + 42, amf, AKA_AMF_LEN);
+
+ step3(prf, k, payload, h);
+ step4(h);
+ memcpy(mac, h, AKA_MAC_LEN);
+}
+
+/**
+ * Calculation function of f5() and f5star()
+ */
+static void f5x(prf_t *prf, u_char f, u_char k[AKA_K_LEN],
+ u_char rand[AKA_RAND_LEN], u_char ak[AKA_AK_LEN])
+{
+ u_char payload[AKA_PAYLOAD_LEN];
+ u_char h[HASH_SIZE_SHA1];
+
+ memset(payload, 0x5c, AKA_PAYLOAD_LEN);
+ payload[11] ^= f;
+ memxor(payload + 12, fmk.ptr, fmk.len);
+ memxor(payload + 16, rand, AKA_RAND_LEN);
+
+ step3(prf, k, payload, h);
+ step4(h);
+ memcpy(ak, h, AKA_AK_LEN);
+}
+
+/**
+ * Calculate MAC from RAND, SQN, AMF using K
+ */
+static void f1(private_eap_aka_3gpp2_functions_t *this, u_char k[AKA_K_LEN],
+ u_char rand[AKA_RAND_LEN], u_char sqn[AKA_SQN_LEN],
+ u_char amf[AKA_AMF_LEN], u_char mac[AKA_MAC_LEN])
+{
+ f1x(this->prf, F1, k, rand, sqn, amf, mac);
+ DBG3(DBG_IKE, "MAC %b", mac, AKA_MAC_LEN);
+}
+
+/**
+ * Calculate MACS from RAND, SQN, AMF using K
+ */
+static void f1star(private_eap_aka_3gpp2_functions_t *this, u_char k[AKA_K_LEN],
+ u_char rand[AKA_RAND_LEN], u_char sqn[AKA_SQN_LEN],
+ u_char amf[AKA_AMF_LEN], u_char macs[AKA_MAC_LEN])
+{
+ f1x(this->prf, F1STAR, k, rand, sqn, amf, macs);
+ DBG3(DBG_IKE, "MACS %b", macs, AKA_MAC_LEN);
+}
+
+/**
+ * Calculate RES from RAND using K
+ */
+static void f2(private_eap_aka_3gpp2_functions_t *this, u_char k[AKA_K_LEN],
+ u_char rand[AKA_RAND_LEN], u_char res[AKA_RES_MAX])
+{
+ fx(this->prf, F2, k, rand, res);
+ DBG3(DBG_IKE, "RES %b", res, AKA_RES_MAX);
+}
+
+/**
+ * Calculate CK from RAND using K
+ */
+static void f3(private_eap_aka_3gpp2_functions_t *this, u_char k[AKA_K_LEN],
+ u_char rand[AKA_RAND_LEN], u_char ck[AKA_CK_LEN])
+{
+ fx(this->prf, F3, k, rand, ck);
+ DBG3(DBG_IKE, "CK %b", ck, AKA_CK_LEN);
+}
+
+/**
+ * Calculate IK from RAND using K
+ */
+static void f4(private_eap_aka_3gpp2_functions_t *this, u_char k[AKA_K_LEN],
+ u_char rand[AKA_RAND_LEN], u_char ik[AKA_IK_LEN])
+{
+ fx(this->prf, F4, k, rand, ik);
+ DBG3(DBG_IKE, "IK %b", ik, AKA_IK_LEN);
+}
+
+/**
+ * Calculate AK from a RAND using K
+ */
+static void f5(private_eap_aka_3gpp2_functions_t *this, u_char k[AKA_K_LEN],
+ u_char rand[AKA_RAND_LEN], u_char ak[AKA_AK_LEN])
+{
+ f5x(this->prf, F5, k, rand, ak);
+ DBG3(DBG_IKE, "AK %b", ak, AKA_AK_LEN);
+}
+
+/**
+ * Calculate AKS from a RAND using K
+ */
+static void f5star(private_eap_aka_3gpp2_functions_t *this, u_char k[AKA_K_LEN],
+ u_char rand[AKA_RAND_LEN], u_char aks[AKA_AK_LEN])
+{
+ f5x(this->prf, F5STAR, k, rand, aks);
+ DBG3(DBG_IKE, "AKS %b", aks, AKA_AK_LEN);
+}
+
+
+/**
+ * Implementation of eap_aka_3gpp2_functions_t.destroy.
+ */
+static void destroy(private_eap_aka_3gpp2_functions_t *this)
+{
+ this->prf->destroy(this->prf);
+ free(this);
+}
+
+/**
+ * See header
+ */
+eap_aka_3gpp2_functions_t *eap_aka_3gpp2_functions_create()
+{
+ private_eap_aka_3gpp2_functions_t *this;
+
+ this = malloc_thing(private_eap_aka_3gpp2_functions_t);
+
+ this->public.f1 = (void(*)(eap_aka_3gpp2_functions_t *this, u_char k[AKA_K_LEN], u_char rand[AKA_RAND_LEN], u_char sqn[AKA_SQN_LEN], u_char amf[AKA_AMF_LEN], u_char mac[AKA_MAC_LEN]))f1;
+ this->public.f1star = (void(*)(eap_aka_3gpp2_functions_t *this, u_char k[AKA_K_LEN], u_char rand[AKA_RAND_LEN], u_char sqn[AKA_SQN_LEN], u_char amf[AKA_AMF_LEN], u_char macs[AKA_MAC_LEN]))f1star;
+ this->public.f2 = (void(*)(eap_aka_3gpp2_functions_t *this, u_char k[AKA_K_LEN], u_char rand[AKA_RAND_LEN], u_char res[AKA_RES_MAX]))f2;
+ this->public.f3 = (void(*)(eap_aka_3gpp2_functions_t *this, u_char k[AKA_K_LEN], u_char rand[AKA_RAND_LEN], u_char ck[AKA_CK_LEN]))f3;
+ this->public.f4 = (void(*)(eap_aka_3gpp2_functions_t *this, u_char k[AKA_K_LEN], u_char rand[AKA_RAND_LEN], u_char ik[AKA_IK_LEN]))f4;
+ this->public.f5 = (void(*)(eap_aka_3gpp2_functions_t *this, u_char k[AKA_K_LEN], u_char rand[AKA_RAND_LEN], u_char ak[AKA_AK_LEN]))f5;
+ this->public.f5star = (void(*)(eap_aka_3gpp2_functions_t *this, u_char k[AKA_K_LEN], u_char rand[AKA_RAND_LEN], u_char aks[AKA_AK_LEN]))f5star;
+ this->public.destroy = (void(*)(eap_aka_3gpp2_functions_t*))destroy;
+
+ this->prf = lib->crypto->create_prf(lib->crypto, PRF_KEYED_SHA1);
+ if (!this->prf)
+ {
+ DBG1(DBG_CFG, "%N not supported, unable to use 3GPP2 algorithm",
+ pseudo_random_function_names, PRF_KEYED_SHA1);
+ free(this);
+ return NULL;
+ }
+ return &this->public;
+}
+
diff --git a/src/charon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_functions.h b/src/charon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_functions.h
new file mode 100644
index 000000000..95c6da6a9
--- /dev/null
+++ b/src/charon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_functions.h
@@ -0,0 +1,125 @@
+/*
+ * Copyright (C) 2008-2009 Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+
+/**
+ * @defgroup eap_aka_3gpp2_functions eap_aka_3gpp2_functions
+ * @{ @ingroup eap_aka_3gpp2
+ */
+
+#ifndef EAP_AKA_3GPP2_FUNCTIONS_H_
+#define EAP_AKA_3GPP2_FUNCTIONS_H_
+
+#include <sa/authenticators/eap/sim_manager.h>
+
+#define AKA_SQN_LEN 6
+#define AKA_K_LEN 16
+#define AKA_MAC_LEN 8
+#define AKA_AK_LEN 6
+#define AKA_AMF_LEN 2
+#define AKA_FMK_LEN 4
+
+typedef struct eap_aka_3gpp2_functions_t eap_aka_3gpp2_functions_t;
+
+/**
+ * f1-f5(), f1*() and f5*() functions from the 3GPP2 (S.S0055) standard.
+ */
+struct eap_aka_3gpp2_functions_t {
+
+ /**
+ * Calculate MAC from RAND, SQN, AMF using K.
+ *
+ * @param k secret key K
+ * @param rand random value rand
+ * @param sqn sequence number
+ * @param amf authentication management field
+ * @param mac buffer receiving mac MAC
+ */
+ void (*f1)(eap_aka_3gpp2_functions_t *this, u_char k[AKA_K_LEN],
+ u_char rand[AKA_RAND_LEN], u_char sqn[AKA_SQN_LEN],
+ u_char amf[AKA_AMF_LEN], u_char mac[AKA_MAC_LEN]);
+
+ /**
+ * Calculate MACS from RAND, SQN, AMF using K
+ *
+ * @param k secret key K
+ * @param rand random value RAND
+ * @param sqn sequence number
+ * @param amf authentication management field
+ * @param macs buffer receiving resynchronization mac MACS
+ */
+ void (*f1star)(eap_aka_3gpp2_functions_t *this, u_char k[AKA_K_LEN],
+ u_char rand[AKA_RAND_LEN], u_char sqn[AKA_SQN_LEN],
+ u_char amf[AKA_AMF_LEN], u_char macs[AKA_MAC_LEN]);
+
+ /**
+ * Calculate RES from RAND using K
+ *
+ * @param k secret key K
+ * @param rand random value RAND
+ * @param res buffer receiving result RES, uses full 128 bit
+ */
+ void (*f2)(eap_aka_3gpp2_functions_t *this, u_char k[AKA_K_LEN],
+ u_char rand[AKA_RAND_LEN], u_char res[AKA_RES_MAX]);
+ /**
+ * Calculate CK from RAND using K
+ *
+ * @param k secret key K
+ * @param rand random value RAND
+ * @param macs buffer receiving encryption key CK
+ */
+ void (*f3)(eap_aka_3gpp2_functions_t *this, u_char k[AKA_K_LEN],
+ u_char rand[AKA_RAND_LEN], u_char ck[AKA_CK_LEN]);
+ /**
+ * Calculate IK from RAND using K
+ *
+ * @param k secret key K
+ * @param rand random value RAND
+ * @param macs buffer receiving integrity key IK
+ */
+ void (*f4)(eap_aka_3gpp2_functions_t *this, u_char k[AKA_K_LEN],
+ u_char rand[AKA_RAND_LEN], u_char ik[AKA_IK_LEN]);
+ /**
+ * Calculate AK from a RAND using K
+ *
+ * @param k secret key K
+ * @param rand random value RAND
+ * @param macs buffer receiving anonymity key AK
+ */
+ void (*f5)(eap_aka_3gpp2_functions_t *this, u_char k[AKA_K_LEN],
+ u_char rand[AKA_RAND_LEN], u_char ak[AKA_AK_LEN]);
+ /**
+ * Calculate AKS from a RAND using K
+ *
+ * @param k secret key K
+ * @param rand random value RAND
+ * @param macs buffer receiving resynchronization anonymity key AKS
+ */
+ void (*f5star)(eap_aka_3gpp2_functions_t *this, u_char k[AKA_K_LEN],
+ u_char rand[AKA_RAND_LEN], u_char aks[AKA_AK_LEN]);
+
+ /**
+ * Destroy a eap_aka_3gpp2_functions_t.
+ */
+ void (*destroy)(eap_aka_3gpp2_functions_t *this);
+};
+
+/**
+ * Create a eap_aka_3gpp2_functions instance.
+ *
+ * @return function set, NULL on error
+ */
+eap_aka_3gpp2_functions_t *eap_aka_3gpp2_functions_create();
+
+#endif /** EAP_AKA_3GPP2_FUNCTIONS_H_ @}*/
diff --git a/src/charon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_plugin.c b/src/charon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_plugin.c
new file mode 100644
index 000000000..5286e0986
--- /dev/null
+++ b/src/charon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_plugin.c
@@ -0,0 +1,87 @@
+/*
+ * Copyright (C) 2008-2009 Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+
+#include "eap_aka_3gpp2_plugin.h"
+#include "eap_aka_3gpp2_card.h"
+#include "eap_aka_3gpp2_provider.h"
+#include "eap_aka_3gpp2_functions.h"
+
+#include <daemon.h>
+
+typedef struct private_eap_aka_3gpp2_t private_eap_aka_3gpp2_t;
+
+/**
+ * Private data of an eap_aka_3gpp2_t object.
+ */
+struct private_eap_aka_3gpp2_t {
+
+ /**
+ * Public eap_aka_3gpp2_plugin_t interface.
+ */
+ eap_aka_3gpp2_plugin_t public;
+
+ /**
+ * SIM card
+ */
+ eap_aka_3gpp2_card_t *card;
+
+ /**
+ * SIM provider
+ */
+ eap_aka_3gpp2_provider_t *provider;
+
+ /**
+ * AKA functions
+ */
+ eap_aka_3gpp2_functions_t *functions;
+};
+
+/**
+ * Implementation of eap_aka_3gpp2_t.destroy.
+ */
+static void destroy(private_eap_aka_3gpp2_t *this)
+{
+ charon->sim->remove_card(charon->sim, &this->card->card);
+ charon->sim->remove_provider(charon->sim, &this->provider->provider);
+ this->card->destroy(this->card);
+ this->provider->destroy(this->provider);
+ this->functions->destroy(this->functions);
+ free(this);
+}
+
+/**
+ * See header
+ */
+plugin_t *plugin_create()
+{
+ private_eap_aka_3gpp2_t *this = malloc_thing(private_eap_aka_3gpp2_t);
+
+ this->public.plugin.destroy = (void(*)(plugin_t*))destroy;
+
+ this->functions = eap_aka_3gpp2_functions_create();
+ if (!this->functions)
+ {
+ free(this);
+ return NULL;
+ }
+ this->card = eap_aka_3gpp2_card_create(this->functions);
+ this->provider = eap_aka_3gpp2_provider_create(this->functions);
+
+ charon->sim->add_card(charon->sim, &this->card->card);
+ charon->sim->add_provider(charon->sim, &this->provider->provider);
+
+ return &this->public.plugin;
+}
+
diff --git a/src/charon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_plugin.h b/src/charon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_plugin.h
new file mode 100644
index 000000000..ed5c4cf3e
--- /dev/null
+++ b/src/charon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_plugin.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2008-2009 Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+
+/**
+ * @defgroup eap_aka_3gpp2 eap_aka_3gpp2
+ * @ingroup cplugins
+ *
+ * @defgroup eap_aka_3gpp2_plugin eap_aka_3gpp2_plugin
+ * @{ @ingroup eap_aka_3gpp2
+ */
+
+#ifndef EAP_AKA_3GPP2_PLUGIN_H_
+#define EAP_AKA_3GPP2_PLUGIN_H_
+
+#include <plugins/plugin.h>
+
+typedef struct eap_aka_3gpp2_plugin_t eap_aka_3gpp2_plugin_t;
+
+/**
+ * Plugin to provide a SIM card/provider using the 3GPP2 (S.S0055) standard.
+ *
+ * This plugin implements the standard of the 3GPP2 (S.S0055) and not the one
+ * of 3GGP, completely in software using the libgmp library..
+ * The shared key used for authentication is from ipsec.secrets. The
+ * peers ID is used to query it.
+ * The AKA mechanism uses sequence numbers to detect replay attacks. The
+ * peer stores the sequence number normally in a USIM and accepts
+ * incremental sequence numbers (incremental for lifetime of the USIM). To
+ * prevent a complex sequence number management, this implementation uses
+ * a sequence number derived from time. It is initialized to the startup
+ * time of the daemon.
+ * To enable time based SEQs, define SEQ_CHECK as 1. Default is to accept
+ * any SEQ numbers. This allows an attacker to do replay attacks. But since
+ * the server has proven his identity via IKE, such an attack is only
+ * possible between server and AAA (if any).
+ */
+struct eap_aka_3gpp2_plugin_t {
+
+ /**
+ * implements plugin interface
+ */
+ plugin_t plugin;
+};
+
+/**
+ * Create a eap_aka_3gpp2_plugin instance.
+ */
+plugin_t *plugin_create();
+
+#endif /** EAP_AKA_3GPP2_PLUGIN_H_ @}*/
diff --git a/src/charon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_provider.c b/src/charon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_provider.c
new file mode 100644
index 000000000..9817fff8f
--- /dev/null
+++ b/src/charon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_provider.c
@@ -0,0 +1,204 @@
+/*
+ * Copyright (C) 2008-2009 Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+
+#include "eap_aka_3gpp2_provider.h"
+
+#include <daemon.h>
+#include <credentials/keys/shared_key.h>
+
+typedef struct private_eap_aka_3gpp2_provider_t private_eap_aka_3gpp2_provider_t;
+
+/**
+ * Private data of an eap_aka_3gpp2_provider_t object.
+ */
+struct private_eap_aka_3gpp2_provider_t {
+
+ /**
+ * Public eap_aka_3gpp2_provider_t interface.
+ */
+ eap_aka_3gpp2_provider_t public;
+
+ /**
+ * AKA functions
+ */
+ eap_aka_3gpp2_functions_t *f;
+
+ /**
+ * time based SQN, we use the same for all peers
+ */
+ char sqn[AKA_SQN_LEN];
+};
+
+/** Authentication management field */
+static char amf[AKA_AMF_LEN] = {0x00, 0x01};
+
+/**
+ * Get a shared key K from the credential database
+ */
+bool eap_aka_3gpp2_get_k(identification_t *id, char k[AKA_K_LEN])
+{
+ shared_key_t *shared;
+ chunk_t key;
+
+ shared = charon->credentials->get_shared(charon->credentials,
+ SHARED_EAP, id, NULL);
+ if (shared == NULL)
+ {
+ return FALSE;
+ }
+ key = shared->get_key(shared);
+ memset(k, '\0', AKA_K_LEN);
+ memcpy(k, key.ptr, min(key.len, AKA_K_LEN));
+ shared->destroy(shared);
+ return TRUE;
+}
+
+/**
+ * get SQN using current time
+ */
+void eap_aka_3gpp2_get_sqn(char sqn[AKA_SQN_LEN], int offset)
+{
+ timeval_t time;
+
+ gettimeofday(&time, NULL);
+ /* set sqn to an integer containing 4 bytes seconds + 2 bytes usecs */
+ time.tv_sec = htonl(time.tv_sec + offset);
+ /* usec's are never larger than 0x000f423f, so we shift the 12 first bits */
+ time.tv_usec = htonl(time.tv_usec << 12);
+ memcpy(sqn, (char*)&time.tv_sec + sizeof(time_t) - 4, 4);
+ memcpy(sqn + 4, &time.tv_usec, 2);
+}
+
+/**
+ * Implementation of usim_provider_t.get_quintuplet
+ */
+static bool get_quintuplet(private_eap_aka_3gpp2_provider_t *this,
+ identification_t *id, char rand[AKA_RAND_LEN],
+ char xres[AKA_RES_MAX], int *xres_len,
+ char ck[AKA_CK_LEN], char ik[AKA_IK_LEN],
+ char autn[AKA_AUTN_LEN])
+{
+ rng_t *rng;
+ char mac[AKA_MAC_LEN], ak[AKA_AK_LEN], k[AKA_K_LEN];
+
+ /* generate RAND: we use a registered RNG, not f0() proposed in S.S0055 */
+ rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
+ if (!rng)
+ {
+ DBG1(DBG_IKE, "generating RAND for AKA failed");
+ return FALSE;
+ }
+ rng->get_bytes(rng, AKA_RAND_LEN, rand);
+ rng->destroy(rng);
+
+ if (!eap_aka_3gpp2_get_k(id, k))
+ {
+ DBG1(DBG_IKE, "no EAP key found for %Y to authenticate with AKA", id);
+ return FALSE;
+ }
+
+ DBG3(DBG_IKE, "generated rand %b", rand, AKA_RAND_LEN);
+ DBG3(DBG_IKE, "using K %b", k, AKA_K_LEN);
+
+ /* MAC */
+ this->f->f1(this->f, k, rand, this->sqn, amf, mac);
+ /* AK */
+ this->f->f5(this->f, k, rand, ak);
+ /* XRES as expected from client */
+ this->f->f2(this->f, k, rand, xres);
+ *xres_len = AKA_RES_MAX;
+ /* AUTN = (SQN xor AK) || AMF || MAC */
+ memcpy(autn, this->sqn, AKA_SQN_LEN);
+ memxor(autn, ak, AKA_AK_LEN);
+ memcpy(autn + AKA_SQN_LEN, amf, AKA_AMF_LEN);
+ memcpy(autn + AKA_SQN_LEN + AKA_AMF_LEN, mac, AKA_MAC_LEN);
+ DBG3(DBG_IKE, "AUTN %b", autn, AKA_AUTN_LEN);
+ /* CK/IK */
+ this->f->f3(this->f, k, rand, ck);
+ this->f->f4(this->f, k, rand, ik);
+
+ return TRUE;
+}
+
+/**
+ * Implementation of usim_provider_t.resync
+ */
+static bool resync(private_eap_aka_3gpp2_provider_t *this,
+ identification_t *id, char rand[AKA_RAND_LEN],
+ char auts[AKA_AUTS_LEN])
+{
+ char *sqn, *macs;
+ char aks[AKA_AK_LEN], k[AKA_K_LEN], amf[AKA_AMF_LEN], xmacs[AKA_MAC_LEN];
+
+ if (!eap_aka_3gpp2_get_k(id, k))
+ {
+ DBG1(DBG_IKE, "no EAP key found for %Y to authenticate with AKA", id);
+ return FALSE;
+ }
+
+ /* AUTHS = (AK xor SQN) | MAC */
+ sqn = auts;
+ macs = auts + AKA_SQN_LEN;
+ this->f->f5star(this->f, k, rand, aks);
+ memxor(sqn, aks, AKA_AK_LEN);
+
+ /* verify XMACS, AMF of zero is used in resynchronization */
+ memset(amf, 0, AKA_AMF_LEN);
+ this->f->f1star(this->f, k, rand, sqn, amf, xmacs);
+ if (!memeq(macs, xmacs, AKA_MAC_LEN))
+ {
+ DBG1(DBG_IKE, "received MACS does not match XMACS");
+ DBG3(DBG_IKE, "MACS %b XMACS %b",
+ macs, AKA_MAC_LEN, xmacs, AKA_MAC_LEN);
+ return FALSE;
+ }
+ /* update stored SQN to received SQN + 1 */
+ memcpy(this->sqn, sqn, AKA_SQN_LEN);
+ chunk_increment(chunk_create(this->sqn, AKA_SQN_LEN));
+ return TRUE;
+}
+
+/**
+ * Implementation of eap_aka_3gpp2_provider_t.destroy.
+ */
+static void destroy(private_eap_aka_3gpp2_provider_t *this)
+{
+ free(this);
+}
+
+/**
+ * See header
+ */
+eap_aka_3gpp2_provider_t *eap_aka_3gpp2_provider_create(
+ eap_aka_3gpp2_functions_t *f)
+{
+ private_eap_aka_3gpp2_provider_t *this = malloc_thing(private_eap_aka_3gpp2_provider_t);
+
+ this->public.provider.get_triplet = (bool(*)(sim_provider_t*, identification_t *id, char rand[SIM_RAND_LEN], char sres[SIM_SRES_LEN], char kc[SIM_KC_LEN]))return_false;
+ this->public.provider.get_quintuplet = (bool(*)(sim_provider_t*, identification_t *id, char rand[AKA_RAND_LEN], char xres[AKA_RES_MAX], int *xres_len, char ck[AKA_CK_LEN], char ik[AKA_IK_LEN], char autn[AKA_AUTN_LEN]))get_quintuplet;
+ this->public.provider.resync = (bool(*)(sim_provider_t*, identification_t *id, char rand[AKA_RAND_LEN], char auts[AKA_AUTS_LEN]))resync;
+ this->public.provider.is_pseudonym = (identification_t*(*)(sim_provider_t*, identification_t *id))return_null;
+ this->public.provider.gen_pseudonym = (identification_t*(*)(sim_provider_t*, identification_t *id))return_null;
+ this->public.provider.is_reauth = (identification_t*(*)(sim_provider_t*, identification_t *id, char [HASH_SIZE_SHA1], u_int16_t *counter))return_null;
+ this->public.provider.gen_reauth = (identification_t*(*)(sim_provider_t*, identification_t *id, char mk[HASH_SIZE_SHA1]))return_null;
+ this->public.destroy = (void(*)(eap_aka_3gpp2_provider_t*))destroy;
+
+ this->f = f;
+ /* use an offset to accept clock skew between client/server without resync */
+ eap_aka_3gpp2_get_sqn(this->sqn, 180);
+
+ return &this->public;
+}
+
diff --git a/src/charon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_provider.h b/src/charon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_provider.h
new file mode 100644
index 000000000..22ac0a96e
--- /dev/null
+++ b/src/charon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_provider.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2008-2009 Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+
+/**
+ * @defgroup eap_aka_3gpp2_provider eap_aka_3gpp2_provider
+ * @{ @ingroup eap_aka_3gpp2
+ */
+
+#ifndef EAP_AKA_3GPP2_PROVIDER_H_
+#define EAP_AKA_3GPP2_PROVIDER_H_
+
+#include "eap_aka_3gpp2_functions.h"
+
+#include <sa/authenticators/eap/sim_manager.h>
+
+typedef struct eap_aka_3gpp2_provider_t eap_aka_3gpp2_provider_t;
+
+/**
+ * SIM provider implementation using a set of AKA functions.
+ */
+struct eap_aka_3gpp2_provider_t {
+
+ /**
+ * Implements sim_provider_t interface.
+ */
+ sim_provider_t provider;
+
+ /**
+ * Destroy a eap_aka_3gpp2_provider_t.
+ */
+ void (*destroy)(eap_aka_3gpp2_provider_t *this);
+};
+
+/**
+ * Create a eap_aka_3gpp2_provider instance.
+ */
+eap_aka_3gpp2_provider_t *eap_aka_3gpp2_provider_create(
+ eap_aka_3gpp2_functions_t *f);
+
+#endif /** EAP_AKA_3GPP2_PROVIDER_H_ @}*/
diff --git a/src/charon/plugins/eap_gtc/Makefile.am b/src/charon/plugins/eap_gtc/Makefile.am
index 547a8dfc5..0d938cacd 100644
--- a/src/charon/plugins/eap_gtc/Makefile.am
+++ b/src/charon/plugins/eap_gtc/Makefile.am
@@ -3,8 +3,8 @@ INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
AM_CFLAGS = -rdynamic
-plugin_LTLIBRARIES = libstrongswan-eapgtc.la
+plugin_LTLIBRARIES = libstrongswan-eap-gtc.la
-libstrongswan_eapgtc_la_SOURCES = eap_gtc_plugin.h eap_gtc_plugin.c eap_gtc.h eap_gtc.c
-libstrongswan_eapgtc_la_LDFLAGS = -module -avoid-version -lpam
+libstrongswan_eap_gtc_la_SOURCES = eap_gtc_plugin.h eap_gtc_plugin.c eap_gtc.h eap_gtc.c
+libstrongswan_eap_gtc_la_LDFLAGS = -module -avoid-version -lpam
diff --git a/src/charon/plugins/eap_gtc/Makefile.in b/src/charon/plugins/eap_gtc/Makefile.in
index 46d438a97..f3662e1cd 100644
--- a/src/charon/plugins/eap_gtc/Makefile.in
+++ b/src/charon/plugins/eap_gtc/Makefile.in
@@ -1,8 +1,9 @@
-# Makefile.in generated by automake 1.10.2 from Makefile.am.
+# Makefile.in generated by automake 1.11 from Makefile.am.
# @configure_input@
# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,
-# 2003, 2004, 2005, 2006, 2007, 2008 Free Software Foundation, Inc.
+# 2003, 2004, 2005, 2006, 2007, 2008, 2009 Free Software Foundation,
+# Inc.
# This Makefile.in is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.
@@ -16,8 +17,9 @@
VPATH = @srcdir@
pkgdatadir = $(datadir)/@PACKAGE@
-pkglibdir = $(libdir)/@PACKAGE@
pkgincludedir = $(includedir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkglibexecdir = $(libexecdir)/@PACKAGE@
am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
install_sh_DATA = $(install_sh) -c -m 644
install_sh_PROGRAM = $(install_sh) -c
@@ -35,30 +37,53 @@ host_triplet = @host@
subdir = src/charon/plugins/eap_gtc
DIST_COMMON = $(srcdir)/Makefile.am $(srcdir)/Makefile.in
ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
-am__aclocal_m4_deps = $(top_srcdir)/configure.in
+am__aclocal_m4_deps = $(top_srcdir)/m4/config/libtool.m4 \
+ $(top_srcdir)/m4/config/ltoptions.m4 \
+ $(top_srcdir)/m4/config/ltsugar.m4 \
+ $(top_srcdir)/m4/config/ltversion.m4 \
+ $(top_srcdir)/m4/config/lt~obsolete.m4 \
+ $(top_srcdir)/m4/macros/with.m4 \
+ $(top_srcdir)/m4/macros/enable-disable.m4 \
+ $(top_srcdir)/configure.in
am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
$(ACLOCAL_M4)
mkinstalldirs = $(install_sh) -d
CONFIG_CLEAN_FILES =
+CONFIG_CLEAN_VPATH_FILES =
am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
am__vpath_adj = case $$p in \
$(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
*) f=$$p;; \
esac;
-am__strip_dir = `echo $$p | sed -e 's|^.*/||'`;
+am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
+am__install_max = 40
+am__nobase_strip_setup = \
+ srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
+am__nobase_strip = \
+ for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
+am__nobase_list = $(am__nobase_strip_setup); \
+ for p in $$list; do echo "$$p $$p"; done | \
+ sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
+ $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
+ if (++n[$$2] == $(am__install_max)) \
+ { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
+ END { for (dir in files) print dir, files[dir] }'
+am__base_list = \
+ sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
+ sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
am__installdirs = "$(DESTDIR)$(plugindir)"
-pluginLTLIBRARIES_INSTALL = $(INSTALL)
LTLIBRARIES = $(plugin_LTLIBRARIES)
-libstrongswan_eapgtc_la_LIBADD =
-am_libstrongswan_eapgtc_la_OBJECTS = eap_gtc_plugin.lo eap_gtc.lo
-libstrongswan_eapgtc_la_OBJECTS = \
- $(am_libstrongswan_eapgtc_la_OBJECTS)
-libstrongswan_eapgtc_la_LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) \
+libstrongswan_eap_gtc_la_LIBADD =
+am_libstrongswan_eap_gtc_la_OBJECTS = eap_gtc_plugin.lo eap_gtc.lo
+libstrongswan_eap_gtc_la_OBJECTS = \
+ $(am_libstrongswan_eap_gtc_la_OBJECTS)
+libstrongswan_eap_gtc_la_LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) \
$(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \
- $(libstrongswan_eapgtc_la_LDFLAGS) $(LDFLAGS) -o $@
+ $(libstrongswan_eap_gtc_la_LDFLAGS) $(LDFLAGS) -o $@
DEFAULT_INCLUDES = -I.@am__isrc@
depcomp = $(SHELL) $(top_srcdir)/depcomp
am__depfiles_maybe = depfiles
+am__mv = mv -f
COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
LTCOMPILE = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
@@ -68,8 +93,8 @@ CCLD = $(CC)
LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
--mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) $(AM_LDFLAGS) \
$(LDFLAGS) -o $@
-SOURCES = $(libstrongswan_eapgtc_la_SOURCES)
-DIST_SOURCES = $(libstrongswan_eapgtc_la_SOURCES)
+SOURCES = $(libstrongswan_eap_gtc_la_SOURCES)
+DIST_SOURCES = $(libstrongswan_eap_gtc_la_SOURCES)
ETAGS = etags
CTAGS = ctags
DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
@@ -106,25 +131,22 @@ INSTALL_DATA = @INSTALL_DATA@
INSTALL_PROGRAM = @INSTALL_PROGRAM@
INSTALL_SCRIPT = @INSTALL_SCRIPT@
INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
-IPSEC_ROUTING_TABLE = @IPSEC_ROUTING_TABLE@
-IPSEC_ROUTING_TABLE_PRIO = @IPSEC_ROUTING_TABLE_PRIO@
LD = @LD@
LDFLAGS = @LDFLAGS@
LEX = @LEX@
LEXLIB = @LEXLIB@
LEX_OUTPUT_ROOT = @LEX_OUTPUT_ROOT@
-LIBGCRYPT_CFLAGS = @LIBGCRYPT_CFLAGS@
-LIBGCRYPT_CONFIG = @LIBGCRYPT_CONFIG@
-LIBGCRYPT_LIBS = @LIBGCRYPT_LIBS@
LIBOBJS = @LIBOBJS@
LIBS = @LIBS@
LIBTOOL = @LIBTOOL@
-LINUX_HEADERS = @LINUX_HEADERS@
LIPO = @LIPO@
LN_S = @LN_S@
LTLIBOBJS = @LTLIBOBJS@
MAKEINFO = @MAKEINFO@
MKDIR_P = @MKDIR_P@
+MYSQLCFLAG = @MYSQLCFLAG@
+MYSQLCONFIG = @MYSQLCONFIG@
+MYSQLLIB = @MYSQLLIB@
NM = @NM@
NMEDIT = @NMEDIT@
OBJDUMP = @OBJDUMP@
@@ -136,11 +158,14 @@ PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
PACKAGE_NAME = @PACKAGE_NAME@
PACKAGE_STRING = @PACKAGE_STRING@
PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_URL = @PACKAGE_URL@
PACKAGE_VERSION = @PACKAGE_VERSION@
PATH_SEPARATOR = @PATH_SEPARATOR@
PERL = @PERL@
PKG_CONFIG = @PKG_CONFIG@
+PTHREADLIB = @PTHREADLIB@
RANLIB = @RANLIB@
+RTLIB = @RTLIB@
RUBY = @RUBY@
RUBYINCLUDE = @RUBYINCLUDE@
SED = @SED@
@@ -169,9 +194,9 @@ build_cpu = @build_cpu@
build_os = @build_os@
build_vendor = @build_vendor@
builddir = @builddir@
-confdir = @confdir@
datadir = @datadir@
datarootdir = @datarootdir@
+default_pkcs11 = @default_pkcs11@
docdir = @docdir@
dvidir = @dvidir@
exec_prefix = @exec_prefix@
@@ -194,7 +219,7 @@ ipsecuser = @ipsecuser@
libdir = @libdir@
libexecdir = @libexecdir@
libstrongswan_plugins = @libstrongswan_plugins@
-linuxdir = @linuxdir@
+linux_headers = @linux_headers@
localedir = @localedir@
localstatedir = @localstatedir@
lt_ECHO = @lt_ECHO@
@@ -202,6 +227,7 @@ mandir = @mandir@
mkdir_p = @mkdir_p@
nm_CFLAGS = @nm_CFLAGS@
nm_LIBS = @nm_LIBS@
+nm_ca_dir = @nm_ca_dir@
oldincludedir = @oldincludedir@
pdfdir = @pdfdir@
piddir = @piddir@
@@ -210,10 +236,12 @@ pluto_plugins = @pluto_plugins@
prefix = @prefix@
program_transform_name = @program_transform_name@
psdir = @psdir@
+random_device = @random_device@
resolv_conf = @resolv_conf@
+routing_table = @routing_table@
+routing_table_prio = @routing_table_prio@
sbindir = @sbindir@
sharedstatedir = @sharedstatedir@
-simreader = @simreader@
srcdir = @srcdir@
strongswan_conf = @strongswan_conf@
sysconfdir = @sysconfdir@
@@ -221,13 +249,14 @@ target_alias = @target_alias@
top_build_prefix = @top_build_prefix@
top_builddir = @top_builddir@
top_srcdir = @top_srcdir@
+urandom_device = @urandom_device@
xml_CFLAGS = @xml_CFLAGS@
xml_LIBS = @xml_LIBS@
INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
AM_CFLAGS = -rdynamic
-plugin_LTLIBRARIES = libstrongswan-eapgtc.la
-libstrongswan_eapgtc_la_SOURCES = eap_gtc_plugin.h eap_gtc_plugin.c eap_gtc.h eap_gtc.c
-libstrongswan_eapgtc_la_LDFLAGS = -module -avoid-version -lpam
+plugin_LTLIBRARIES = libstrongswan-eap-gtc.la
+libstrongswan_eap_gtc_la_SOURCES = eap_gtc_plugin.h eap_gtc_plugin.c eap_gtc.h eap_gtc.c
+libstrongswan_eap_gtc_la_LDFLAGS = -module -avoid-version -lpam
all: all-am
.SUFFIXES:
@@ -241,9 +270,9 @@ $(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps)
exit 1;; \
esac; \
done; \
- echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/charon/plugins/eap_gtc/Makefile'; \
- cd $(top_srcdir) && \
- $(AUTOMAKE) --gnu src/charon/plugins/eap_gtc/Makefile
+ echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/charon/plugins/eap_gtc/Makefile'; \
+ $(am__cd) $(top_srcdir) && \
+ $(AUTOMAKE) --gnu src/charon/plugins/eap_gtc/Makefile
.PRECIOUS: Makefile
Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
@case '$?' in \
@@ -261,23 +290,28 @@ $(top_srcdir)/configure: $(am__configure_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
$(ACLOCAL_M4): $(am__aclocal_m4_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(am__aclocal_m4_deps):
install-pluginLTLIBRARIES: $(plugin_LTLIBRARIES)
@$(NORMAL_INSTALL)
test -z "$(plugindir)" || $(MKDIR_P) "$(DESTDIR)$(plugindir)"
- @list='$(plugin_LTLIBRARIES)'; for p in $$list; do \
+ @list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+ list2=; for p in $$list; do \
if test -f $$p; then \
- f=$(am__strip_dir) \
- echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(pluginLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) '$$p' '$(DESTDIR)$(plugindir)/$$f'"; \
- $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(pluginLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) "$$p" "$(DESTDIR)$(plugindir)/$$f"; \
+ list2="$$list2 $$p"; \
else :; fi; \
- done
+ done; \
+ test -z "$$list2" || { \
+ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(plugindir)'"; \
+ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(plugindir)"; \
+ }
uninstall-pluginLTLIBRARIES:
@$(NORMAL_UNINSTALL)
- @list='$(plugin_LTLIBRARIES)'; for p in $$list; do \
- p=$(am__strip_dir) \
- echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$p'"; \
- $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$p"; \
+ @list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+ for p in $$list; do \
+ $(am__strip_dir) \
+ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$f'"; \
+ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$f"; \
done
clean-pluginLTLIBRARIES:
@@ -288,8 +322,8 @@ clean-pluginLTLIBRARIES:
echo "rm -f \"$${dir}/so_locations\""; \
rm -f "$${dir}/so_locations"; \
done
-libstrongswan-eapgtc.la: $(libstrongswan_eapgtc_la_OBJECTS) $(libstrongswan_eapgtc_la_DEPENDENCIES)
- $(libstrongswan_eapgtc_la_LINK) -rpath $(plugindir) $(libstrongswan_eapgtc_la_OBJECTS) $(libstrongswan_eapgtc_la_LIBADD) $(LIBS)
+libstrongswan-eap-gtc.la: $(libstrongswan_eap_gtc_la_OBJECTS) $(libstrongswan_eap_gtc_la_DEPENDENCIES)
+ $(libstrongswan_eap_gtc_la_LINK) -rpath $(plugindir) $(libstrongswan_eap_gtc_la_OBJECTS) $(libstrongswan_eap_gtc_la_LIBADD) $(LIBS)
mostlyclean-compile:
-rm -f *.$(OBJEXT)
@@ -302,21 +336,21 @@ distclean-compile:
.c.o:
@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(COMPILE) -c $<
.c.obj:
@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(COMPILE) -c `$(CYGPATH_W) '$<'`
.c.lo:
@am__fastdepCC_TRUE@ $(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(LTCOMPILE) -c -o $@ $<
@@ -339,7 +373,7 @@ tags: TAGS
TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
$(TAGS_FILES) $(LISP)
- tags=; \
+ set x; \
here=`pwd`; \
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
unique=`for i in $$list; do \
@@ -347,29 +381,34 @@ TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
- if test -z "$(ETAGS_ARGS)$$tags$$unique"; then :; else \
+ shift; \
+ if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
test -n "$$unique" || unique=$$empty_fix; \
- $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
- $$tags $$unique; \
+ if test $$# -gt 0; then \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ "$$@" $$unique; \
+ else \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ $$unique; \
+ fi; \
fi
ctags: CTAGS
CTAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
$(TAGS_FILES) $(LISP)
- tags=; \
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
unique=`for i in $$list; do \
if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
- test -z "$(CTAGS_ARGS)$$tags$$unique" \
+ test -z "$(CTAGS_ARGS)$$unique" \
|| $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
- $$tags $$unique
+ $$unique
GTAGS:
here=`$(am__cd) $(top_builddir) && pwd` \
- && cd $(top_srcdir) \
- && gtags -i $(GTAGS_ARGS) $$here
+ && $(am__cd) $(top_srcdir) \
+ && gtags -i $(GTAGS_ARGS) "$$here"
distclean-tags:
-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
@@ -390,13 +429,17 @@ distdir: $(DISTFILES)
if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
if test -d $$d/$$file; then \
dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
+ if test -d "$(distdir)/$$file"; then \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+ fi; \
if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
- cp -pR $(srcdir)/$$file $(distdir)$$dir || exit 1; \
+ cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
fi; \
- cp -pR $$d/$$file $(distdir)$$dir || exit 1; \
+ cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
else \
- test -f $(distdir)/$$file \
- || cp -p $$d/$$file $(distdir)/$$file \
+ test -f "$(distdir)/$$file" \
+ || cp -p $$d/$$file "$(distdir)/$$file" \
|| exit 1; \
fi; \
done
@@ -427,6 +470,7 @@ clean-generic:
distclean-generic:
-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+ -test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
maintainer-clean-generic:
@echo "This command is intended for maintainers to use"
@@ -448,6 +492,8 @@ dvi-am:
html: html-am
+html-am:
+
info: info-am
info-am:
@@ -456,18 +502,28 @@ install-data-am: install-pluginLTLIBRARIES
install-dvi: install-dvi-am
+install-dvi-am:
+
install-exec-am:
install-html: install-html-am
+install-html-am:
+
install-info: install-info-am
+install-info-am:
+
install-man:
install-pdf: install-pdf-am
+install-pdf-am:
+
install-ps: install-ps-am
+install-ps-am:
+
installcheck-am:
maintainer-clean: maintainer-clean-am
@@ -506,6 +562,7 @@ uninstall-am: uninstall-pluginLTLIBRARIES
mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \
tags uninstall uninstall-am uninstall-pluginLTLIBRARIES
+
# Tell versions [3.59,3.63) of GNU make to not export all variables.
# Otherwise a system limit (for SysV at least) may be exceeded.
.NOEXPORT:
diff --git a/src/charon/plugins/eap_gtc/eap_gtc.c b/src/charon/plugins/eap_gtc/eap_gtc.c
index cb4ab2e59..c7f55fa70 100644
--- a/src/charon/plugins/eap_gtc/eap_gtc.c
+++ b/src/charon/plugins/eap_gtc/eap_gtc.c
@@ -12,7 +12,7 @@
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
-
+
#include "eap_gtc.h"
#include <daemon.h>
@@ -30,22 +30,22 @@ typedef struct private_eap_gtc_t private_eap_gtc_t;
* Private data of an eap_gtc_t object.
*/
struct private_eap_gtc_t {
-
+
/**
* Public authenticator_t interface.
*/
eap_gtc_t public;
-
+
/**
* ID of the server
*/
identification_t *server;
-
+
/**
* ID of the peer
*/
identification_t *peer;
-
+
/**
* EAP message identififier
*/
@@ -83,10 +83,10 @@ static status_t initiate_peer(private_eap_gtc_t *this, eap_payload_t **out)
* PAM conv callback function
*/
static int auth_conv(int num_msg, const struct pam_message **msg,
- struct pam_response **resp, char *password)
+ struct pam_response **resp, char *password)
{
struct pam_response *response;
-
+
if (num_msg != 1)
{
return PAM_CONV_ERR;
@@ -103,13 +103,13 @@ static int auth_conv(int num_msg, const struct pam_message **msg,
*/
static bool authenticate(char *service, char *user, char *password)
{
- pam_handle_t *pamh = NULL;
+ pam_handle_t *pamh = NULL;
static struct pam_conv conv;
- int ret;
-
+ int ret;
+
conv.conv = (void*)auth_conv;
conv.appdata_ptr = password;
-
+
ret = pam_start(service, user, &conv, &pamh);
if (ret != PAM_SUCCESS)
{
@@ -143,7 +143,7 @@ static status_t initiate_server(private_eap_gtc_t *this, eap_payload_t **out)
{
eap_gtc_header_t *req;
size_t len;
-
+
len = strlen(GTC_REQUEST_MSG);
req = alloca(sizeof(eap_gtc_header_t) + len);
req->length = htons(sizeof(eap_gtc_header_t) + len);
@@ -151,7 +151,7 @@ static status_t initiate_server(private_eap_gtc_t *this, eap_payload_t **out)
req->identifier = this->identifier;
req->type = EAP_GTC;
memcpy(req->data, GTC_REQUEST_MSG, len);
-
+
*out = eap_payload_create_data(chunk_create((void*)req,
sizeof(eap_gtc_header_t) + len));
return NEED_MORE;
@@ -178,7 +178,7 @@ static status_t process_peer(private_eap_gtc_t *this,
}
key = shared->get_key(shared);
len = key.len;
-
+
/* TODO: According to the draft we should "SASLprep" password, RFC4013. */
res = alloca(sizeof(eap_gtc_header_t) + len);
@@ -187,9 +187,9 @@ static status_t process_peer(private_eap_gtc_t *this,
res->identifier = in->get_identifier(in);
res->type = EAP_GTC;
memcpy(res->data, key.ptr, len);
-
+
shared->destroy(shared);
-
+
*out = eap_payload_create_data(chunk_create((void*)res,
sizeof(eap_gtc_header_t) + len));
return NEED_MORE;
@@ -203,14 +203,14 @@ static status_t process_server(private_eap_gtc_t *this,
{
chunk_t data, encoding;
char *user, *password, *service, *pos;
-
+
data = chunk_skip(in->get_data(in), 5);
if (this->identifier != in->get_identifier(in) || !data.len)
{
DBG1(DBG_IKE, "received invalid EAP-GTC message");
return FAILED;
}
-
+
encoding = this->peer->get_encoding(this->peer);
/* if a RFC822_ADDR id is provided, we use the username part only */
pos = memchr(encoding.ptr, '@', encoding.len);
@@ -221,14 +221,14 @@ static status_t process_server(private_eap_gtc_t *this,
user = alloca(encoding.len + 1);
memcpy(user, encoding.ptr, encoding.len);
user[encoding.len] = '\0';
-
+
password = alloca(data.len + 1);
memcpy(password, data.ptr, data.len);
password[data.len] = '\0';
-
+
service = lib->settings->get_str(lib->settings,
- "charon.plugins.eap_gtc.pam_service", GTC_PAM_SERVICE);
-
+ "charon.plugins.eap-gtc.pam_service", GTC_PAM_SERVICE);
+
if (!authenticate(service, user, password))
{
return FAILED;
@@ -278,19 +278,19 @@ static private_eap_gtc_t *eap_gtc_create_generic(identification_t *server,
identification_t *peer)
{
private_eap_gtc_t *this = malloc_thing(private_eap_gtc_t);
-
+
this->public.eap_method_interface.initiate = NULL;
this->public.eap_method_interface.process = NULL;
this->public.eap_method_interface.get_type = (eap_type_t(*)(eap_method_t*,u_int32_t*))get_type;
this->public.eap_method_interface.is_mutual = (bool(*)(eap_method_t*))is_mutual;
this->public.eap_method_interface.get_msk = (status_t(*)(eap_method_t*,chunk_t*))get_msk;
this->public.eap_method_interface.destroy = (void(*)(eap_method_t*))destroy;
-
+
/* private data */
this->peer = peer->clone(peer);
this->server = server->clone(server);
this->identifier = 0;
-
+
return this;
}
@@ -300,7 +300,7 @@ static private_eap_gtc_t *eap_gtc_create_generic(identification_t *server,
eap_gtc_t *eap_gtc_create_server(identification_t *server, identification_t *peer)
{
private_eap_gtc_t *this = eap_gtc_create_generic(server, peer);
-
+
this->public.eap_method_interface.initiate = (status_t(*)(eap_method_t*,eap_payload_t**))initiate_server;
this->public.eap_method_interface.process = (status_t(*)(eap_method_t*,eap_payload_t*,eap_payload_t**))process_server;
@@ -318,7 +318,7 @@ eap_gtc_t *eap_gtc_create_server(identification_t *server, identification_t *pee
eap_gtc_t *eap_gtc_create_peer(identification_t *server, identification_t *peer)
{
private_eap_gtc_t *this = eap_gtc_create_generic(server, peer);
-
+
this->public.eap_method_interface.initiate = (status_t(*)(eap_method_t*,eap_payload_t**))initiate_peer;
this->public.eap_method_interface.process = (status_t(*)(eap_method_t*,eap_payload_t*,eap_payload_t**))process_peer;
diff --git a/src/charon/plugins/eap_gtc/eap_gtc_plugin.c b/src/charon/plugins/eap_gtc/eap_gtc_plugin.c
index fda6c744a..8550c254c 100644
--- a/src/charon/plugins/eap_gtc/eap_gtc_plugin.c
+++ b/src/charon/plugins/eap_gtc/eap_gtc_plugin.c
@@ -40,17 +40,17 @@ static void destroy(eap_gtc_plugin_t *this)
plugin_t *plugin_create()
{
eap_gtc_plugin_t *this = malloc_thing(eap_gtc_plugin_t);
-
+
this->plugin.destroy = (void(*)(plugin_t*))destroy;
-
+
/* required for PAM authentication */
charon->keep_cap(charon, CAP_AUDIT_WRITE);
-
+
charon->eap->add_method(charon->eap, EAP_GTC, 0, EAP_SERVER,
(eap_constructor_t)eap_gtc_create_server);
charon->eap->add_method(charon->eap, EAP_GTC, 0, EAP_PEER,
(eap_constructor_t)eap_gtc_create_peer);
-
+
return &this->plugin;
}
diff --git a/src/charon/plugins/eap_identity/Makefile.am b/src/charon/plugins/eap_identity/Makefile.am
index 79ddee3e8..992eb43f7 100644
--- a/src/charon/plugins/eap_identity/Makefile.am
+++ b/src/charon/plugins/eap_identity/Makefile.am
@@ -3,8 +3,8 @@ INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
AM_CFLAGS = -rdynamic
-plugin_LTLIBRARIES = libstrongswan-eapidentity.la
-libstrongswan_eapidentity_la_SOURCES = \
+plugin_LTLIBRARIES = libstrongswan-eap-identity.la
+libstrongswan_eap_identity_la_SOURCES = \
eap_identity_plugin.h eap_identity_plugin.c eap_identity.h eap_identity.c
-libstrongswan_eapidentity_la_LDFLAGS = -module -avoid-version
+libstrongswan_eap_identity_la_LDFLAGS = -module -avoid-version
diff --git a/src/charon/plugins/eap_identity/Makefile.in b/src/charon/plugins/eap_identity/Makefile.in
index 0adb9ce10..80709246f 100644
--- a/src/charon/plugins/eap_identity/Makefile.in
+++ b/src/charon/plugins/eap_identity/Makefile.in
@@ -1,8 +1,9 @@
-# Makefile.in generated by automake 1.10.2 from Makefile.am.
+# Makefile.in generated by automake 1.11 from Makefile.am.
# @configure_input@
# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,
-# 2003, 2004, 2005, 2006, 2007, 2008 Free Software Foundation, Inc.
+# 2003, 2004, 2005, 2006, 2007, 2008, 2009 Free Software Foundation,
+# Inc.
# This Makefile.in is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.
@@ -16,8 +17,9 @@
VPATH = @srcdir@
pkgdatadir = $(datadir)/@PACKAGE@
-pkglibdir = $(libdir)/@PACKAGE@
pkgincludedir = $(includedir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkglibexecdir = $(libexecdir)/@PACKAGE@
am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
install_sh_DATA = $(install_sh) -c -m 644
install_sh_PROGRAM = $(install_sh) -c
@@ -35,32 +37,55 @@ host_triplet = @host@
subdir = src/charon/plugins/eap_identity
DIST_COMMON = $(srcdir)/Makefile.am $(srcdir)/Makefile.in
ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
-am__aclocal_m4_deps = $(top_srcdir)/configure.in
+am__aclocal_m4_deps = $(top_srcdir)/m4/config/libtool.m4 \
+ $(top_srcdir)/m4/config/ltoptions.m4 \
+ $(top_srcdir)/m4/config/ltsugar.m4 \
+ $(top_srcdir)/m4/config/ltversion.m4 \
+ $(top_srcdir)/m4/config/lt~obsolete.m4 \
+ $(top_srcdir)/m4/macros/with.m4 \
+ $(top_srcdir)/m4/macros/enable-disable.m4 \
+ $(top_srcdir)/configure.in
am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
$(ACLOCAL_M4)
mkinstalldirs = $(install_sh) -d
CONFIG_CLEAN_FILES =
+CONFIG_CLEAN_VPATH_FILES =
am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
am__vpath_adj = case $$p in \
$(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
*) f=$$p;; \
esac;
-am__strip_dir = `echo $$p | sed -e 's|^.*/||'`;
+am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
+am__install_max = 40
+am__nobase_strip_setup = \
+ srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
+am__nobase_strip = \
+ for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
+am__nobase_list = $(am__nobase_strip_setup); \
+ for p in $$list; do echo "$$p $$p"; done | \
+ sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
+ $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
+ if (++n[$$2] == $(am__install_max)) \
+ { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
+ END { for (dir in files) print dir, files[dir] }'
+am__base_list = \
+ sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
+ sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
am__installdirs = "$(DESTDIR)$(plugindir)"
-pluginLTLIBRARIES_INSTALL = $(INSTALL)
LTLIBRARIES = $(plugin_LTLIBRARIES)
-libstrongswan_eapidentity_la_LIBADD =
-am_libstrongswan_eapidentity_la_OBJECTS = eap_identity_plugin.lo \
+libstrongswan_eap_identity_la_LIBADD =
+am_libstrongswan_eap_identity_la_OBJECTS = eap_identity_plugin.lo \
eap_identity.lo
-libstrongswan_eapidentity_la_OBJECTS = \
- $(am_libstrongswan_eapidentity_la_OBJECTS)
-libstrongswan_eapidentity_la_LINK = $(LIBTOOL) --tag=CC \
+libstrongswan_eap_identity_la_OBJECTS = \
+ $(am_libstrongswan_eap_identity_la_OBJECTS)
+libstrongswan_eap_identity_la_LINK = $(LIBTOOL) --tag=CC \
$(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \
- $(AM_CFLAGS) $(CFLAGS) $(libstrongswan_eapidentity_la_LDFLAGS) \
- $(LDFLAGS) -o $@
+ $(AM_CFLAGS) $(CFLAGS) \
+ $(libstrongswan_eap_identity_la_LDFLAGS) $(LDFLAGS) -o $@
DEFAULT_INCLUDES = -I.@am__isrc@
depcomp = $(SHELL) $(top_srcdir)/depcomp
am__depfiles_maybe = depfiles
+am__mv = mv -f
COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
LTCOMPILE = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
@@ -70,8 +95,8 @@ CCLD = $(CC)
LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
--mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) $(AM_LDFLAGS) \
$(LDFLAGS) -o $@
-SOURCES = $(libstrongswan_eapidentity_la_SOURCES)
-DIST_SOURCES = $(libstrongswan_eapidentity_la_SOURCES)
+SOURCES = $(libstrongswan_eap_identity_la_SOURCES)
+DIST_SOURCES = $(libstrongswan_eap_identity_la_SOURCES)
ETAGS = etags
CTAGS = ctags
DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
@@ -108,25 +133,22 @@ INSTALL_DATA = @INSTALL_DATA@
INSTALL_PROGRAM = @INSTALL_PROGRAM@
INSTALL_SCRIPT = @INSTALL_SCRIPT@
INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
-IPSEC_ROUTING_TABLE = @IPSEC_ROUTING_TABLE@
-IPSEC_ROUTING_TABLE_PRIO = @IPSEC_ROUTING_TABLE_PRIO@
LD = @LD@
LDFLAGS = @LDFLAGS@
LEX = @LEX@
LEXLIB = @LEXLIB@
LEX_OUTPUT_ROOT = @LEX_OUTPUT_ROOT@
-LIBGCRYPT_CFLAGS = @LIBGCRYPT_CFLAGS@
-LIBGCRYPT_CONFIG = @LIBGCRYPT_CONFIG@
-LIBGCRYPT_LIBS = @LIBGCRYPT_LIBS@
LIBOBJS = @LIBOBJS@
LIBS = @LIBS@
LIBTOOL = @LIBTOOL@
-LINUX_HEADERS = @LINUX_HEADERS@
LIPO = @LIPO@
LN_S = @LN_S@
LTLIBOBJS = @LTLIBOBJS@
MAKEINFO = @MAKEINFO@
MKDIR_P = @MKDIR_P@
+MYSQLCFLAG = @MYSQLCFLAG@
+MYSQLCONFIG = @MYSQLCONFIG@
+MYSQLLIB = @MYSQLLIB@
NM = @NM@
NMEDIT = @NMEDIT@
OBJDUMP = @OBJDUMP@
@@ -138,11 +160,14 @@ PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
PACKAGE_NAME = @PACKAGE_NAME@
PACKAGE_STRING = @PACKAGE_STRING@
PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_URL = @PACKAGE_URL@
PACKAGE_VERSION = @PACKAGE_VERSION@
PATH_SEPARATOR = @PATH_SEPARATOR@
PERL = @PERL@
PKG_CONFIG = @PKG_CONFIG@
+PTHREADLIB = @PTHREADLIB@
RANLIB = @RANLIB@
+RTLIB = @RTLIB@
RUBY = @RUBY@
RUBYINCLUDE = @RUBYINCLUDE@
SED = @SED@
@@ -171,9 +196,9 @@ build_cpu = @build_cpu@
build_os = @build_os@
build_vendor = @build_vendor@
builddir = @builddir@
-confdir = @confdir@
datadir = @datadir@
datarootdir = @datarootdir@
+default_pkcs11 = @default_pkcs11@
docdir = @docdir@
dvidir = @dvidir@
exec_prefix = @exec_prefix@
@@ -196,7 +221,7 @@ ipsecuser = @ipsecuser@
libdir = @libdir@
libexecdir = @libexecdir@
libstrongswan_plugins = @libstrongswan_plugins@
-linuxdir = @linuxdir@
+linux_headers = @linux_headers@
localedir = @localedir@
localstatedir = @localstatedir@
lt_ECHO = @lt_ECHO@
@@ -204,6 +229,7 @@ mandir = @mandir@
mkdir_p = @mkdir_p@
nm_CFLAGS = @nm_CFLAGS@
nm_LIBS = @nm_LIBS@
+nm_ca_dir = @nm_ca_dir@
oldincludedir = @oldincludedir@
pdfdir = @pdfdir@
piddir = @piddir@
@@ -212,10 +238,12 @@ pluto_plugins = @pluto_plugins@
prefix = @prefix@
program_transform_name = @program_transform_name@
psdir = @psdir@
+random_device = @random_device@
resolv_conf = @resolv_conf@
+routing_table = @routing_table@
+routing_table_prio = @routing_table_prio@
sbindir = @sbindir@
sharedstatedir = @sharedstatedir@
-simreader = @simreader@
srcdir = @srcdir@
strongswan_conf = @strongswan_conf@
sysconfdir = @sysconfdir@
@@ -223,15 +251,16 @@ target_alias = @target_alias@
top_build_prefix = @top_build_prefix@
top_builddir = @top_builddir@
top_srcdir = @top_srcdir@
+urandom_device = @urandom_device@
xml_CFLAGS = @xml_CFLAGS@
xml_LIBS = @xml_LIBS@
INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
AM_CFLAGS = -rdynamic
-plugin_LTLIBRARIES = libstrongswan-eapidentity.la
-libstrongswan_eapidentity_la_SOURCES = \
+plugin_LTLIBRARIES = libstrongswan-eap-identity.la
+libstrongswan_eap_identity_la_SOURCES = \
eap_identity_plugin.h eap_identity_plugin.c eap_identity.h eap_identity.c
-libstrongswan_eapidentity_la_LDFLAGS = -module -avoid-version
+libstrongswan_eap_identity_la_LDFLAGS = -module -avoid-version
all: all-am
.SUFFIXES:
@@ -245,9 +274,9 @@ $(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps)
exit 1;; \
esac; \
done; \
- echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/charon/plugins/eap_identity/Makefile'; \
- cd $(top_srcdir) && \
- $(AUTOMAKE) --gnu src/charon/plugins/eap_identity/Makefile
+ echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/charon/plugins/eap_identity/Makefile'; \
+ $(am__cd) $(top_srcdir) && \
+ $(AUTOMAKE) --gnu src/charon/plugins/eap_identity/Makefile
.PRECIOUS: Makefile
Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
@case '$?' in \
@@ -265,23 +294,28 @@ $(top_srcdir)/configure: $(am__configure_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
$(ACLOCAL_M4): $(am__aclocal_m4_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(am__aclocal_m4_deps):
install-pluginLTLIBRARIES: $(plugin_LTLIBRARIES)
@$(NORMAL_INSTALL)
test -z "$(plugindir)" || $(MKDIR_P) "$(DESTDIR)$(plugindir)"
- @list='$(plugin_LTLIBRARIES)'; for p in $$list; do \
+ @list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+ list2=; for p in $$list; do \
if test -f $$p; then \
- f=$(am__strip_dir) \
- echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(pluginLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) '$$p' '$(DESTDIR)$(plugindir)/$$f'"; \
- $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(pluginLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) "$$p" "$(DESTDIR)$(plugindir)/$$f"; \
+ list2="$$list2 $$p"; \
else :; fi; \
- done
+ done; \
+ test -z "$$list2" || { \
+ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(plugindir)'"; \
+ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(plugindir)"; \
+ }
uninstall-pluginLTLIBRARIES:
@$(NORMAL_UNINSTALL)
- @list='$(plugin_LTLIBRARIES)'; for p in $$list; do \
- p=$(am__strip_dir) \
- echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$p'"; \
- $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$p"; \
+ @list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+ for p in $$list; do \
+ $(am__strip_dir) \
+ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$f'"; \
+ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$f"; \
done
clean-pluginLTLIBRARIES:
@@ -292,8 +326,8 @@ clean-pluginLTLIBRARIES:
echo "rm -f \"$${dir}/so_locations\""; \
rm -f "$${dir}/so_locations"; \
done
-libstrongswan-eapidentity.la: $(libstrongswan_eapidentity_la_OBJECTS) $(libstrongswan_eapidentity_la_DEPENDENCIES)
- $(libstrongswan_eapidentity_la_LINK) -rpath $(plugindir) $(libstrongswan_eapidentity_la_OBJECTS) $(libstrongswan_eapidentity_la_LIBADD) $(LIBS)
+libstrongswan-eap-identity.la: $(libstrongswan_eap_identity_la_OBJECTS) $(libstrongswan_eap_identity_la_DEPENDENCIES)
+ $(libstrongswan_eap_identity_la_LINK) -rpath $(plugindir) $(libstrongswan_eap_identity_la_OBJECTS) $(libstrongswan_eap_identity_la_LIBADD) $(LIBS)
mostlyclean-compile:
-rm -f *.$(OBJEXT)
@@ -306,21 +340,21 @@ distclean-compile:
.c.o:
@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(COMPILE) -c $<
.c.obj:
@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(COMPILE) -c `$(CYGPATH_W) '$<'`
.c.lo:
@am__fastdepCC_TRUE@ $(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(LTCOMPILE) -c -o $@ $<
@@ -343,7 +377,7 @@ tags: TAGS
TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
$(TAGS_FILES) $(LISP)
- tags=; \
+ set x; \
here=`pwd`; \
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
unique=`for i in $$list; do \
@@ -351,29 +385,34 @@ TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
- if test -z "$(ETAGS_ARGS)$$tags$$unique"; then :; else \
+ shift; \
+ if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
test -n "$$unique" || unique=$$empty_fix; \
- $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
- $$tags $$unique; \
+ if test $$# -gt 0; then \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ "$$@" $$unique; \
+ else \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ $$unique; \
+ fi; \
fi
ctags: CTAGS
CTAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
$(TAGS_FILES) $(LISP)
- tags=; \
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
unique=`for i in $$list; do \
if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
- test -z "$(CTAGS_ARGS)$$tags$$unique" \
+ test -z "$(CTAGS_ARGS)$$unique" \
|| $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
- $$tags $$unique
+ $$unique
GTAGS:
here=`$(am__cd) $(top_builddir) && pwd` \
- && cd $(top_srcdir) \
- && gtags -i $(GTAGS_ARGS) $$here
+ && $(am__cd) $(top_srcdir) \
+ && gtags -i $(GTAGS_ARGS) "$$here"
distclean-tags:
-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
@@ -394,13 +433,17 @@ distdir: $(DISTFILES)
if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
if test -d $$d/$$file; then \
dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
+ if test -d "$(distdir)/$$file"; then \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+ fi; \
if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
- cp -pR $(srcdir)/$$file $(distdir)$$dir || exit 1; \
+ cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
fi; \
- cp -pR $$d/$$file $(distdir)$$dir || exit 1; \
+ cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
else \
- test -f $(distdir)/$$file \
- || cp -p $$d/$$file $(distdir)/$$file \
+ test -f "$(distdir)/$$file" \
+ || cp -p $$d/$$file "$(distdir)/$$file" \
|| exit 1; \
fi; \
done
@@ -431,6 +474,7 @@ clean-generic:
distclean-generic:
-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+ -test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
maintainer-clean-generic:
@echo "This command is intended for maintainers to use"
@@ -452,6 +496,8 @@ dvi-am:
html: html-am
+html-am:
+
info: info-am
info-am:
@@ -460,18 +506,28 @@ install-data-am: install-pluginLTLIBRARIES
install-dvi: install-dvi-am
+install-dvi-am:
+
install-exec-am:
install-html: install-html-am
+install-html-am:
+
install-info: install-info-am
+install-info-am:
+
install-man:
install-pdf: install-pdf-am
+install-pdf-am:
+
install-ps: install-ps-am
+install-ps-am:
+
installcheck-am:
maintainer-clean: maintainer-clean-am
@@ -510,6 +566,7 @@ uninstall-am: uninstall-pluginLTLIBRARIES
mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \
tags uninstall uninstall-am uninstall-pluginLTLIBRARIES
+
# Tell versions [3.59,3.63) of GNU make to not export all variables.
# Otherwise a system limit (for SysV at least) may be exceeded.
.NOEXPORT:
diff --git a/src/charon/plugins/eap_identity/eap_identity.c b/src/charon/plugins/eap_identity/eap_identity.c
index e43c50c50..ab082a955 100644
--- a/src/charon/plugins/eap_identity/eap_identity.c
+++ b/src/charon/plugins/eap_identity/eap_identity.c
@@ -24,17 +24,17 @@ typedef struct private_eap_identity_t private_eap_identity_t;
* Private data of an eap_identity_t object.
*/
struct private_eap_identity_t {
-
+
/**
* Public authenticator_t interface.
*/
eap_identity_t public;
-
+
/**
* ID of the peer
*/
identification_t *peer;
-
+
/**
* received identity chunk
*/
@@ -68,17 +68,17 @@ static status_t process_peer(private_eap_identity_t *this,
chunk_t id;
eap_identity_header_t *hdr;
size_t len;
-
+
id = this->peer->get_encoding(this->peer);
len = sizeof(eap_identity_header_t) + id.len;
-
+
hdr = alloca(len);
hdr->code = EAP_RESPONSE;
hdr->identifier = in->get_identifier(in);
hdr->length = htons(len);
hdr->type = EAP_IDENTITY;
memcpy(hdr->data, id.ptr, id.len);
-
+
*out = eap_payload_create_data(chunk_create((u_char*)hdr, len));
return SUCCESS;
}
@@ -99,7 +99,7 @@ static status_t process_server(private_eap_identity_t *this,
eap_payload_t *in, eap_payload_t **out)
{
chunk_t data;
-
+
data = chunk_skip(in->get_data(in), 5);
if (data.len)
{
@@ -114,12 +114,12 @@ static status_t process_server(private_eap_identity_t *this,
static status_t initiate_server(private_eap_identity_t *this, eap_payload_t **out)
{
eap_identity_header_t hdr;
-
+
hdr.code = EAP_REQUEST;
hdr.identifier = 0;
hdr.length = htons(sizeof(eap_identity_header_t));
hdr.type = EAP_IDENTITY;
-
+
*out = eap_payload_create_data(chunk_create((u_char*)&hdr,
sizeof(eap_identity_header_t)));
return NEED_MORE;
@@ -172,17 +172,17 @@ static private_eap_identity_t *eap_identity_create(identification_t *server,
identification_t *peer)
{
private_eap_identity_t *this = malloc_thing(private_eap_identity_t);
-
+
this->public.eap_method_interface.initiate = NULL;
this->public.eap_method_interface.process = NULL;
this->public.eap_method_interface.get_type = (eap_type_t(*)(eap_method_t*,u_int32_t*))get_type;
this->public.eap_method_interface.is_mutual = (bool(*)(eap_method_t*))is_mutual;
this->public.eap_method_interface.get_msk = (status_t(*)(eap_method_t*,chunk_t*))get_msk;
this->public.eap_method_interface.destroy = (void(*)(eap_method_t*))destroy;
-
+
this->peer = peer->clone(peer);
this->identity = chunk_empty;
-
+
return this;
}
@@ -193,11 +193,11 @@ eap_identity_t *eap_identity_create_peer(identification_t *server,
identification_t *peer)
{
private_eap_identity_t *this = eap_identity_create(server, peer);
-
+
/* public functions */
this->public.eap_method_interface.initiate = (status_t(*)(eap_method_t*,eap_payload_t**))initiate_peer;
this->public.eap_method_interface.process = (status_t(*)(eap_method_t*,eap_payload_t*,eap_payload_t**))process_peer;
-
+
return &this->public;
}
@@ -208,11 +208,11 @@ eap_identity_t *eap_identity_create_server(identification_t *server,
identification_t *peer)
{
private_eap_identity_t *this = eap_identity_create(server, peer);
-
+
/* public functions */
this->public.eap_method_interface.initiate = (status_t(*)(eap_method_t*,eap_payload_t**))initiate_server;
this->public.eap_method_interface.process = (status_t(*)(eap_method_t*,eap_payload_t*,eap_payload_t**))process_server;
-
+
return &this->public;
}
diff --git a/src/charon/plugins/eap_identity/eap_identity_plugin.c b/src/charon/plugins/eap_identity/eap_identity_plugin.c
index 809254ccb..a623e1951 100644
--- a/src/charon/plugins/eap_identity/eap_identity_plugin.c
+++ b/src/charon/plugins/eap_identity/eap_identity_plugin.c
@@ -37,14 +37,14 @@ static void destroy(eap_identity_plugin_t *this)
plugin_t *plugin_create()
{
eap_identity_plugin_t *this = malloc_thing(eap_identity_plugin_t);
-
+
this->plugin.destroy = (void(*)(plugin_t*))destroy;
-
+
charon->eap->add_method(charon->eap, EAP_IDENTITY, 0, EAP_SERVER,
(eap_constructor_t)eap_identity_create_server);
charon->eap->add_method(charon->eap, EAP_IDENTITY, 0, EAP_PEER,
(eap_constructor_t)eap_identity_create_peer);
-
+
return &this->plugin;
}
diff --git a/src/charon/plugins/eap_md5/Makefile.am b/src/charon/plugins/eap_md5/Makefile.am
index 8bad64368..f49928cd2 100644
--- a/src/charon/plugins/eap_md5/Makefile.am
+++ b/src/charon/plugins/eap_md5/Makefile.am
@@ -3,8 +3,8 @@ INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
AM_CFLAGS = -rdynamic
-plugin_LTLIBRARIES = libstrongswan-eapmd5.la
+plugin_LTLIBRARIES = libstrongswan-eap-md5.la
-libstrongswan_eapmd5_la_SOURCES = eap_md5_plugin.h eap_md5_plugin.c eap_md5.h eap_md5.c
-libstrongswan_eapmd5_la_LDFLAGS = -module -avoid-version
+libstrongswan_eap_md5_la_SOURCES = eap_md5_plugin.h eap_md5_plugin.c eap_md5.h eap_md5.c
+libstrongswan_eap_md5_la_LDFLAGS = -module -avoid-version
diff --git a/src/charon/plugins/eap_md5/Makefile.in b/src/charon/plugins/eap_md5/Makefile.in
index c11837b91..21ac7fa92 100644
--- a/src/charon/plugins/eap_md5/Makefile.in
+++ b/src/charon/plugins/eap_md5/Makefile.in
@@ -1,8 +1,9 @@
-# Makefile.in generated by automake 1.10.2 from Makefile.am.
+# Makefile.in generated by automake 1.11 from Makefile.am.
# @configure_input@
# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,
-# 2003, 2004, 2005, 2006, 2007, 2008 Free Software Foundation, Inc.
+# 2003, 2004, 2005, 2006, 2007, 2008, 2009 Free Software Foundation,
+# Inc.
# This Makefile.in is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.
@@ -16,8 +17,9 @@
VPATH = @srcdir@
pkgdatadir = $(datadir)/@PACKAGE@
-pkglibdir = $(libdir)/@PACKAGE@
pkgincludedir = $(includedir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkglibexecdir = $(libexecdir)/@PACKAGE@
am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
install_sh_DATA = $(install_sh) -c -m 644
install_sh_PROGRAM = $(install_sh) -c
@@ -35,30 +37,53 @@ host_triplet = @host@
subdir = src/charon/plugins/eap_md5
DIST_COMMON = $(srcdir)/Makefile.am $(srcdir)/Makefile.in
ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
-am__aclocal_m4_deps = $(top_srcdir)/configure.in
+am__aclocal_m4_deps = $(top_srcdir)/m4/config/libtool.m4 \
+ $(top_srcdir)/m4/config/ltoptions.m4 \
+ $(top_srcdir)/m4/config/ltsugar.m4 \
+ $(top_srcdir)/m4/config/ltversion.m4 \
+ $(top_srcdir)/m4/config/lt~obsolete.m4 \
+ $(top_srcdir)/m4/macros/with.m4 \
+ $(top_srcdir)/m4/macros/enable-disable.m4 \
+ $(top_srcdir)/configure.in
am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
$(ACLOCAL_M4)
mkinstalldirs = $(install_sh) -d
CONFIG_CLEAN_FILES =
+CONFIG_CLEAN_VPATH_FILES =
am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
am__vpath_adj = case $$p in \
$(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
*) f=$$p;; \
esac;
-am__strip_dir = `echo $$p | sed -e 's|^.*/||'`;
+am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
+am__install_max = 40
+am__nobase_strip_setup = \
+ srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
+am__nobase_strip = \
+ for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
+am__nobase_list = $(am__nobase_strip_setup); \
+ for p in $$list; do echo "$$p $$p"; done | \
+ sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
+ $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
+ if (++n[$$2] == $(am__install_max)) \
+ { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
+ END { for (dir in files) print dir, files[dir] }'
+am__base_list = \
+ sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
+ sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
am__installdirs = "$(DESTDIR)$(plugindir)"
-pluginLTLIBRARIES_INSTALL = $(INSTALL)
LTLIBRARIES = $(plugin_LTLIBRARIES)
-libstrongswan_eapmd5_la_LIBADD =
-am_libstrongswan_eapmd5_la_OBJECTS = eap_md5_plugin.lo eap_md5.lo
-libstrongswan_eapmd5_la_OBJECTS = \
- $(am_libstrongswan_eapmd5_la_OBJECTS)
-libstrongswan_eapmd5_la_LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) \
+libstrongswan_eap_md5_la_LIBADD =
+am_libstrongswan_eap_md5_la_OBJECTS = eap_md5_plugin.lo eap_md5.lo
+libstrongswan_eap_md5_la_OBJECTS = \
+ $(am_libstrongswan_eap_md5_la_OBJECTS)
+libstrongswan_eap_md5_la_LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) \
$(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \
- $(libstrongswan_eapmd5_la_LDFLAGS) $(LDFLAGS) -o $@
+ $(libstrongswan_eap_md5_la_LDFLAGS) $(LDFLAGS) -o $@
DEFAULT_INCLUDES = -I.@am__isrc@
depcomp = $(SHELL) $(top_srcdir)/depcomp
am__depfiles_maybe = depfiles
+am__mv = mv -f
COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
LTCOMPILE = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
@@ -68,8 +93,8 @@ CCLD = $(CC)
LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
--mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) $(AM_LDFLAGS) \
$(LDFLAGS) -o $@
-SOURCES = $(libstrongswan_eapmd5_la_SOURCES)
-DIST_SOURCES = $(libstrongswan_eapmd5_la_SOURCES)
+SOURCES = $(libstrongswan_eap_md5_la_SOURCES)
+DIST_SOURCES = $(libstrongswan_eap_md5_la_SOURCES)
ETAGS = etags
CTAGS = ctags
DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
@@ -106,25 +131,22 @@ INSTALL_DATA = @INSTALL_DATA@
INSTALL_PROGRAM = @INSTALL_PROGRAM@
INSTALL_SCRIPT = @INSTALL_SCRIPT@
INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
-IPSEC_ROUTING_TABLE = @IPSEC_ROUTING_TABLE@
-IPSEC_ROUTING_TABLE_PRIO = @IPSEC_ROUTING_TABLE_PRIO@
LD = @LD@
LDFLAGS = @LDFLAGS@
LEX = @LEX@
LEXLIB = @LEXLIB@
LEX_OUTPUT_ROOT = @LEX_OUTPUT_ROOT@
-LIBGCRYPT_CFLAGS = @LIBGCRYPT_CFLAGS@
-LIBGCRYPT_CONFIG = @LIBGCRYPT_CONFIG@
-LIBGCRYPT_LIBS = @LIBGCRYPT_LIBS@
LIBOBJS = @LIBOBJS@
LIBS = @LIBS@
LIBTOOL = @LIBTOOL@
-LINUX_HEADERS = @LINUX_HEADERS@
LIPO = @LIPO@
LN_S = @LN_S@
LTLIBOBJS = @LTLIBOBJS@
MAKEINFO = @MAKEINFO@
MKDIR_P = @MKDIR_P@
+MYSQLCFLAG = @MYSQLCFLAG@
+MYSQLCONFIG = @MYSQLCONFIG@
+MYSQLLIB = @MYSQLLIB@
NM = @NM@
NMEDIT = @NMEDIT@
OBJDUMP = @OBJDUMP@
@@ -136,11 +158,14 @@ PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
PACKAGE_NAME = @PACKAGE_NAME@
PACKAGE_STRING = @PACKAGE_STRING@
PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_URL = @PACKAGE_URL@
PACKAGE_VERSION = @PACKAGE_VERSION@
PATH_SEPARATOR = @PATH_SEPARATOR@
PERL = @PERL@
PKG_CONFIG = @PKG_CONFIG@
+PTHREADLIB = @PTHREADLIB@
RANLIB = @RANLIB@
+RTLIB = @RTLIB@
RUBY = @RUBY@
RUBYINCLUDE = @RUBYINCLUDE@
SED = @SED@
@@ -169,9 +194,9 @@ build_cpu = @build_cpu@
build_os = @build_os@
build_vendor = @build_vendor@
builddir = @builddir@
-confdir = @confdir@
datadir = @datadir@
datarootdir = @datarootdir@
+default_pkcs11 = @default_pkcs11@
docdir = @docdir@
dvidir = @dvidir@
exec_prefix = @exec_prefix@
@@ -194,7 +219,7 @@ ipsecuser = @ipsecuser@
libdir = @libdir@
libexecdir = @libexecdir@
libstrongswan_plugins = @libstrongswan_plugins@
-linuxdir = @linuxdir@
+linux_headers = @linux_headers@
localedir = @localedir@
localstatedir = @localstatedir@
lt_ECHO = @lt_ECHO@
@@ -202,6 +227,7 @@ mandir = @mandir@
mkdir_p = @mkdir_p@
nm_CFLAGS = @nm_CFLAGS@
nm_LIBS = @nm_LIBS@
+nm_ca_dir = @nm_ca_dir@
oldincludedir = @oldincludedir@
pdfdir = @pdfdir@
piddir = @piddir@
@@ -210,10 +236,12 @@ pluto_plugins = @pluto_plugins@
prefix = @prefix@
program_transform_name = @program_transform_name@
psdir = @psdir@
+random_device = @random_device@
resolv_conf = @resolv_conf@
+routing_table = @routing_table@
+routing_table_prio = @routing_table_prio@
sbindir = @sbindir@
sharedstatedir = @sharedstatedir@
-simreader = @simreader@
srcdir = @srcdir@
strongswan_conf = @strongswan_conf@
sysconfdir = @sysconfdir@
@@ -221,13 +249,14 @@ target_alias = @target_alias@
top_build_prefix = @top_build_prefix@
top_builddir = @top_builddir@
top_srcdir = @top_srcdir@
+urandom_device = @urandom_device@
xml_CFLAGS = @xml_CFLAGS@
xml_LIBS = @xml_LIBS@
INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
AM_CFLAGS = -rdynamic
-plugin_LTLIBRARIES = libstrongswan-eapmd5.la
-libstrongswan_eapmd5_la_SOURCES = eap_md5_plugin.h eap_md5_plugin.c eap_md5.h eap_md5.c
-libstrongswan_eapmd5_la_LDFLAGS = -module -avoid-version
+plugin_LTLIBRARIES = libstrongswan-eap-md5.la
+libstrongswan_eap_md5_la_SOURCES = eap_md5_plugin.h eap_md5_plugin.c eap_md5.h eap_md5.c
+libstrongswan_eap_md5_la_LDFLAGS = -module -avoid-version
all: all-am
.SUFFIXES:
@@ -241,9 +270,9 @@ $(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps)
exit 1;; \
esac; \
done; \
- echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/charon/plugins/eap_md5/Makefile'; \
- cd $(top_srcdir) && \
- $(AUTOMAKE) --gnu src/charon/plugins/eap_md5/Makefile
+ echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/charon/plugins/eap_md5/Makefile'; \
+ $(am__cd) $(top_srcdir) && \
+ $(AUTOMAKE) --gnu src/charon/plugins/eap_md5/Makefile
.PRECIOUS: Makefile
Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
@case '$?' in \
@@ -261,23 +290,28 @@ $(top_srcdir)/configure: $(am__configure_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
$(ACLOCAL_M4): $(am__aclocal_m4_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(am__aclocal_m4_deps):
install-pluginLTLIBRARIES: $(plugin_LTLIBRARIES)
@$(NORMAL_INSTALL)
test -z "$(plugindir)" || $(MKDIR_P) "$(DESTDIR)$(plugindir)"
- @list='$(plugin_LTLIBRARIES)'; for p in $$list; do \
+ @list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+ list2=; for p in $$list; do \
if test -f $$p; then \
- f=$(am__strip_dir) \
- echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(pluginLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) '$$p' '$(DESTDIR)$(plugindir)/$$f'"; \
- $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(pluginLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) "$$p" "$(DESTDIR)$(plugindir)/$$f"; \
+ list2="$$list2 $$p"; \
else :; fi; \
- done
+ done; \
+ test -z "$$list2" || { \
+ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(plugindir)'"; \
+ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(plugindir)"; \
+ }
uninstall-pluginLTLIBRARIES:
@$(NORMAL_UNINSTALL)
- @list='$(plugin_LTLIBRARIES)'; for p in $$list; do \
- p=$(am__strip_dir) \
- echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$p'"; \
- $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$p"; \
+ @list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+ for p in $$list; do \
+ $(am__strip_dir) \
+ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$f'"; \
+ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$f"; \
done
clean-pluginLTLIBRARIES:
@@ -288,8 +322,8 @@ clean-pluginLTLIBRARIES:
echo "rm -f \"$${dir}/so_locations\""; \
rm -f "$${dir}/so_locations"; \
done
-libstrongswan-eapmd5.la: $(libstrongswan_eapmd5_la_OBJECTS) $(libstrongswan_eapmd5_la_DEPENDENCIES)
- $(libstrongswan_eapmd5_la_LINK) -rpath $(plugindir) $(libstrongswan_eapmd5_la_OBJECTS) $(libstrongswan_eapmd5_la_LIBADD) $(LIBS)
+libstrongswan-eap-md5.la: $(libstrongswan_eap_md5_la_OBJECTS) $(libstrongswan_eap_md5_la_DEPENDENCIES)
+ $(libstrongswan_eap_md5_la_LINK) -rpath $(plugindir) $(libstrongswan_eap_md5_la_OBJECTS) $(libstrongswan_eap_md5_la_LIBADD) $(LIBS)
mostlyclean-compile:
-rm -f *.$(OBJEXT)
@@ -302,21 +336,21 @@ distclean-compile:
.c.o:
@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(COMPILE) -c $<
.c.obj:
@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(COMPILE) -c `$(CYGPATH_W) '$<'`
.c.lo:
@am__fastdepCC_TRUE@ $(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(LTCOMPILE) -c -o $@ $<
@@ -339,7 +373,7 @@ tags: TAGS
TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
$(TAGS_FILES) $(LISP)
- tags=; \
+ set x; \
here=`pwd`; \
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
unique=`for i in $$list; do \
@@ -347,29 +381,34 @@ TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
- if test -z "$(ETAGS_ARGS)$$tags$$unique"; then :; else \
+ shift; \
+ if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
test -n "$$unique" || unique=$$empty_fix; \
- $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
- $$tags $$unique; \
+ if test $$# -gt 0; then \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ "$$@" $$unique; \
+ else \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ $$unique; \
+ fi; \
fi
ctags: CTAGS
CTAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
$(TAGS_FILES) $(LISP)
- tags=; \
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
unique=`for i in $$list; do \
if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
- test -z "$(CTAGS_ARGS)$$tags$$unique" \
+ test -z "$(CTAGS_ARGS)$$unique" \
|| $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
- $$tags $$unique
+ $$unique
GTAGS:
here=`$(am__cd) $(top_builddir) && pwd` \
- && cd $(top_srcdir) \
- && gtags -i $(GTAGS_ARGS) $$here
+ && $(am__cd) $(top_srcdir) \
+ && gtags -i $(GTAGS_ARGS) "$$here"
distclean-tags:
-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
@@ -390,13 +429,17 @@ distdir: $(DISTFILES)
if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
if test -d $$d/$$file; then \
dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
+ if test -d "$(distdir)/$$file"; then \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+ fi; \
if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
- cp -pR $(srcdir)/$$file $(distdir)$$dir || exit 1; \
+ cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
fi; \
- cp -pR $$d/$$file $(distdir)$$dir || exit 1; \
+ cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
else \
- test -f $(distdir)/$$file \
- || cp -p $$d/$$file $(distdir)/$$file \
+ test -f "$(distdir)/$$file" \
+ || cp -p $$d/$$file "$(distdir)/$$file" \
|| exit 1; \
fi; \
done
@@ -427,6 +470,7 @@ clean-generic:
distclean-generic:
-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+ -test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
maintainer-clean-generic:
@echo "This command is intended for maintainers to use"
@@ -448,6 +492,8 @@ dvi-am:
html: html-am
+html-am:
+
info: info-am
info-am:
@@ -456,18 +502,28 @@ install-data-am: install-pluginLTLIBRARIES
install-dvi: install-dvi-am
+install-dvi-am:
+
install-exec-am:
install-html: install-html-am
+install-html-am:
+
install-info: install-info-am
+install-info-am:
+
install-man:
install-pdf: install-pdf-am
+install-pdf-am:
+
install-ps: install-ps-am
+install-ps-am:
+
installcheck-am:
maintainer-clean: maintainer-clean-am
@@ -506,6 +562,7 @@ uninstall-am: uninstall-pluginLTLIBRARIES
mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \
tags uninstall uninstall-am uninstall-pluginLTLIBRARIES
+
# Tell versions [3.59,3.63) of GNU make to not export all variables.
# Otherwise a system limit (for SysV at least) may be exceeded.
.NOEXPORT:
diff --git a/src/charon/plugins/eap_md5/eap_md5.c b/src/charon/plugins/eap_md5/eap_md5.c
index 36d726947..0eda8f755 100644
--- a/src/charon/plugins/eap_md5/eap_md5.c
+++ b/src/charon/plugins/eap_md5/eap_md5.c
@@ -12,7 +12,7 @@
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
-
+
#include "eap_md5.h"
#include <daemon.h>
@@ -25,27 +25,27 @@ typedef struct private_eap_md5_t private_eap_md5_t;
* Private data of an eap_md5_t object.
*/
struct private_eap_md5_t {
-
+
/**
* Public authenticator_t interface.
*/
eap_md5_t public;
-
+
/**
* ID of the server
*/
identification_t *server;
-
+
/**
* ID of the peer
*/
identification_t *peer;
-
+
/**
* challenge sent by the server
*/
chunk_t challenge;
-
+
/**
* EAP message identififier
*/
@@ -78,21 +78,21 @@ struct eap_md5_header_t {
/**
* Hash the challenge string, create response
*/
-static status_t hash_challenge(private_eap_md5_t *this, chunk_t *response)
-{
+static status_t hash_challenge(private_eap_md5_t *this, chunk_t *response,
+ identification_t *me, identification_t *other)
+{
shared_key_t *shared;
chunk_t concat;
hasher_t *hasher;
shared = charon->credentials->get_shared(charon->credentials, SHARED_EAP,
- this->server, this->peer);
+ me, other);
if (shared == NULL)
{
- DBG1(DBG_IKE, "no EAP key found for hosts '%Y' - '%Y'",
- this->server, this->peer);
+ DBG1(DBG_IKE, "no EAP key found for hosts '%Y' - '%Y'", me, other);
return NOT_FOUND;
}
- concat = chunk_cata("ccc", chunk_from_thing(this->identifier),
+ concat = chunk_cata("ccc", chunk_from_thing(this->identifier),
shared->get_key(shared), this->challenge);
shared->destroy(shared);
hasher = lib->crypto->create_hasher(lib->crypto, HASH_MD5);
@@ -122,7 +122,7 @@ static status_t initiate_server(private_eap_md5_t *this, eap_payload_t **out)
{
rng_t *rng;
eap_md5_header_t *req;
-
+
rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
if (!rng)
{
@@ -130,7 +130,7 @@ static status_t initiate_server(private_eap_md5_t *this, eap_payload_t **out)
}
rng->allocate_bytes(rng, CHALLENGE_LEN, &this->challenge);
rng->destroy(rng);
-
+
req = alloca(PAYLOAD_LEN);
req->length = htons(PAYLOAD_LEN);
req->code = EAP_REQUEST;
@@ -138,7 +138,7 @@ static status_t initiate_server(private_eap_md5_t *this, eap_payload_t **out)
req->type = EAP_MD5;
req->value_size = this->challenge.len;
memcpy(req->value, this->challenge.ptr, this->challenge.len);
-
+
*out = eap_payload_create_data(chunk_create((void*)req, PAYLOAD_LEN));
return NEED_MORE;
}
@@ -152,7 +152,7 @@ static status_t process_peer(private_eap_md5_t *this,
chunk_t response;
chunk_t data;
eap_md5_header_t *req;
-
+
this->identifier = in->get_identifier(in);
data = in->get_data(in);
this->challenge = chunk_clone(chunk_skip(data, 6));
@@ -161,7 +161,7 @@ static status_t process_peer(private_eap_md5_t *this,
DBG1(DBG_IKE, "received invalid EAP-MD5 message");
return FAILED;
}
- if (hash_challenge(this, &response) != SUCCESS)
+ if (hash_challenge(this, &response, this->peer, this->server) != SUCCESS)
{
return FAILED;
}
@@ -173,7 +173,7 @@ static status_t process_peer(private_eap_md5_t *this,
req->value_size = response.len;
memcpy(req->value, response.ptr, response.len);
chunk_free(&response);
-
+
*out = eap_payload_create_data(chunk_create((void*)req, PAYLOAD_LEN));
return NEED_MORE;
}
@@ -186,19 +186,19 @@ static status_t process_server(private_eap_md5_t *this,
{
chunk_t response, expected;
chunk_t data;
-
+
if (this->identifier != in->get_identifier(in))
{
DBG1(DBG_IKE, "received invalid EAP-MD5 message");
return FAILED;
}
- if (hash_challenge(this, &expected) != SUCCESS)
+ if (hash_challenge(this, &expected, this->server, this->peer) != SUCCESS)
{
return FAILED;
}
data = in->get_data(in);
response = chunk_skip(data, 6);
-
+
if (response.len < expected.len ||
!memeq(response.ptr, expected.ptr, expected.len))
{
@@ -253,20 +253,20 @@ static private_eap_md5_t *eap_md5_create_generic(identification_t *server,
identification_t *peer)
{
private_eap_md5_t *this = malloc_thing(private_eap_md5_t);
-
+
this->public.eap_method_interface.initiate = NULL;
this->public.eap_method_interface.process = NULL;
this->public.eap_method_interface.get_type = (eap_type_t(*)(eap_method_t*,u_int32_t*))get_type;
this->public.eap_method_interface.is_mutual = (bool(*)(eap_method_t*))is_mutual;
this->public.eap_method_interface.get_msk = (status_t(*)(eap_method_t*,chunk_t*))get_msk;
this->public.eap_method_interface.destroy = (void(*)(eap_method_t*))destroy;
-
+
/* private data */
this->peer = peer->clone(peer);
this->server = server->clone(server);
this->challenge = chunk_empty;
this->identifier = 0;
-
+
return this;
}
@@ -276,7 +276,7 @@ static private_eap_md5_t *eap_md5_create_generic(identification_t *server,
eap_md5_t *eap_md5_create_server(identification_t *server, identification_t *peer)
{
private_eap_md5_t *this = eap_md5_create_generic(server, peer);
-
+
this->public.eap_method_interface.initiate = (status_t(*)(eap_method_t*,eap_payload_t**))initiate_server;
this->public.eap_method_interface.process = (status_t(*)(eap_method_t*,eap_payload_t*,eap_payload_t**))process_server;
@@ -294,7 +294,7 @@ eap_md5_t *eap_md5_create_server(identification_t *server, identification_t *pee
eap_md5_t *eap_md5_create_peer(identification_t *server, identification_t *peer)
{
private_eap_md5_t *this = eap_md5_create_generic(server, peer);
-
+
this->public.eap_method_interface.initiate = (status_t(*)(eap_method_t*,eap_payload_t**))initiate_peer;
this->public.eap_method_interface.process = (status_t(*)(eap_method_t*,eap_payload_t*,eap_payload_t**))process_peer;
diff --git a/src/charon/plugins/eap_md5/eap_md5_plugin.c b/src/charon/plugins/eap_md5/eap_md5_plugin.c
index e30152fc5..629255ebf 100644
--- a/src/charon/plugins/eap_md5/eap_md5_plugin.c
+++ b/src/charon/plugins/eap_md5/eap_md5_plugin.c
@@ -37,14 +37,14 @@ static void destroy(eap_md5_plugin_t *this)
plugin_t *plugin_create()
{
eap_md5_plugin_t *this = malloc_thing(eap_md5_plugin_t);
-
+
this->plugin.destroy = (void(*)(plugin_t*))destroy;
-
+
charon->eap->add_method(charon->eap, EAP_MD5, 0, EAP_SERVER,
(eap_constructor_t)eap_md5_create_server);
charon->eap->add_method(charon->eap, EAP_MD5, 0, EAP_PEER,
(eap_constructor_t)eap_md5_create_peer);
-
+
return &this->plugin;
}
diff --git a/src/charon/plugins/eap_mschapv2/Makefile.am b/src/charon/plugins/eap_mschapv2/Makefile.am
index 179da70fc..4758ad5f3 100644
--- a/src/charon/plugins/eap_mschapv2/Makefile.am
+++ b/src/charon/plugins/eap_mschapv2/Makefile.am
@@ -3,10 +3,10 @@ INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
AM_CFLAGS = -rdynamic
-plugin_LTLIBRARIES = libstrongswan-eapmschapv2.la
+plugin_LTLIBRARIES = libstrongswan-eap-mschapv2.la
-libstrongswan_eapmschapv2_la_SOURCES = \
+libstrongswan_eap_mschapv2_la_SOURCES = \
eap_mschapv2_plugin.h eap_mschapv2_plugin.c \
eap_mschapv2.h eap_mschapv2.c
-libstrongswan_eapmschapv2_la_LDFLAGS = -module -avoid-version
+libstrongswan_eap_mschapv2_la_LDFLAGS = -module -avoid-version
diff --git a/src/charon/plugins/eap_mschapv2/Makefile.in b/src/charon/plugins/eap_mschapv2/Makefile.in
index d6dd74b88..001818481 100644
--- a/src/charon/plugins/eap_mschapv2/Makefile.in
+++ b/src/charon/plugins/eap_mschapv2/Makefile.in
@@ -1,8 +1,9 @@
-# Makefile.in generated by automake 1.10.2 from Makefile.am.
+# Makefile.in generated by automake 1.11 from Makefile.am.
# @configure_input@
# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,
-# 2003, 2004, 2005, 2006, 2007, 2008 Free Software Foundation, Inc.
+# 2003, 2004, 2005, 2006, 2007, 2008, 2009 Free Software Foundation,
+# Inc.
# This Makefile.in is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.
@@ -16,8 +17,9 @@
VPATH = @srcdir@
pkgdatadir = $(datadir)/@PACKAGE@
-pkglibdir = $(libdir)/@PACKAGE@
pkgincludedir = $(includedir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkglibexecdir = $(libexecdir)/@PACKAGE@
am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
install_sh_DATA = $(install_sh) -c -m 644
install_sh_PROGRAM = $(install_sh) -c
@@ -35,32 +37,55 @@ host_triplet = @host@
subdir = src/charon/plugins/eap_mschapv2
DIST_COMMON = $(srcdir)/Makefile.am $(srcdir)/Makefile.in
ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
-am__aclocal_m4_deps = $(top_srcdir)/configure.in
+am__aclocal_m4_deps = $(top_srcdir)/m4/config/libtool.m4 \
+ $(top_srcdir)/m4/config/ltoptions.m4 \
+ $(top_srcdir)/m4/config/ltsugar.m4 \
+ $(top_srcdir)/m4/config/ltversion.m4 \
+ $(top_srcdir)/m4/config/lt~obsolete.m4 \
+ $(top_srcdir)/m4/macros/with.m4 \
+ $(top_srcdir)/m4/macros/enable-disable.m4 \
+ $(top_srcdir)/configure.in
am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
$(ACLOCAL_M4)
mkinstalldirs = $(install_sh) -d
CONFIG_CLEAN_FILES =
+CONFIG_CLEAN_VPATH_FILES =
am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
am__vpath_adj = case $$p in \
$(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
*) f=$$p;; \
esac;
-am__strip_dir = `echo $$p | sed -e 's|^.*/||'`;
+am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
+am__install_max = 40
+am__nobase_strip_setup = \
+ srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
+am__nobase_strip = \
+ for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
+am__nobase_list = $(am__nobase_strip_setup); \
+ for p in $$list; do echo "$$p $$p"; done | \
+ sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
+ $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
+ if (++n[$$2] == $(am__install_max)) \
+ { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
+ END { for (dir in files) print dir, files[dir] }'
+am__base_list = \
+ sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
+ sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
am__installdirs = "$(DESTDIR)$(plugindir)"
-pluginLTLIBRARIES_INSTALL = $(INSTALL)
LTLIBRARIES = $(plugin_LTLIBRARIES)
-libstrongswan_eapmschapv2_la_LIBADD =
-am_libstrongswan_eapmschapv2_la_OBJECTS = eap_mschapv2_plugin.lo \
+libstrongswan_eap_mschapv2_la_LIBADD =
+am_libstrongswan_eap_mschapv2_la_OBJECTS = eap_mschapv2_plugin.lo \
eap_mschapv2.lo
-libstrongswan_eapmschapv2_la_OBJECTS = \
- $(am_libstrongswan_eapmschapv2_la_OBJECTS)
-libstrongswan_eapmschapv2_la_LINK = $(LIBTOOL) --tag=CC \
+libstrongswan_eap_mschapv2_la_OBJECTS = \
+ $(am_libstrongswan_eap_mschapv2_la_OBJECTS)
+libstrongswan_eap_mschapv2_la_LINK = $(LIBTOOL) --tag=CC \
$(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \
- $(AM_CFLAGS) $(CFLAGS) $(libstrongswan_eapmschapv2_la_LDFLAGS) \
- $(LDFLAGS) -o $@
+ $(AM_CFLAGS) $(CFLAGS) \
+ $(libstrongswan_eap_mschapv2_la_LDFLAGS) $(LDFLAGS) -o $@
DEFAULT_INCLUDES = -I.@am__isrc@
depcomp = $(SHELL) $(top_srcdir)/depcomp
am__depfiles_maybe = depfiles
+am__mv = mv -f
COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
LTCOMPILE = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
@@ -70,8 +95,8 @@ CCLD = $(CC)
LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
--mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) $(AM_LDFLAGS) \
$(LDFLAGS) -o $@
-SOURCES = $(libstrongswan_eapmschapv2_la_SOURCES)
-DIST_SOURCES = $(libstrongswan_eapmschapv2_la_SOURCES)
+SOURCES = $(libstrongswan_eap_mschapv2_la_SOURCES)
+DIST_SOURCES = $(libstrongswan_eap_mschapv2_la_SOURCES)
ETAGS = etags
CTAGS = ctags
DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
@@ -108,25 +133,22 @@ INSTALL_DATA = @INSTALL_DATA@
INSTALL_PROGRAM = @INSTALL_PROGRAM@
INSTALL_SCRIPT = @INSTALL_SCRIPT@
INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
-IPSEC_ROUTING_TABLE = @IPSEC_ROUTING_TABLE@
-IPSEC_ROUTING_TABLE_PRIO = @IPSEC_ROUTING_TABLE_PRIO@
LD = @LD@
LDFLAGS = @LDFLAGS@
LEX = @LEX@
LEXLIB = @LEXLIB@
LEX_OUTPUT_ROOT = @LEX_OUTPUT_ROOT@
-LIBGCRYPT_CFLAGS = @LIBGCRYPT_CFLAGS@
-LIBGCRYPT_CONFIG = @LIBGCRYPT_CONFIG@
-LIBGCRYPT_LIBS = @LIBGCRYPT_LIBS@
LIBOBJS = @LIBOBJS@
LIBS = @LIBS@
LIBTOOL = @LIBTOOL@
-LINUX_HEADERS = @LINUX_HEADERS@
LIPO = @LIPO@
LN_S = @LN_S@
LTLIBOBJS = @LTLIBOBJS@
MAKEINFO = @MAKEINFO@
MKDIR_P = @MKDIR_P@
+MYSQLCFLAG = @MYSQLCFLAG@
+MYSQLCONFIG = @MYSQLCONFIG@
+MYSQLLIB = @MYSQLLIB@
NM = @NM@
NMEDIT = @NMEDIT@
OBJDUMP = @OBJDUMP@
@@ -138,11 +160,14 @@ PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
PACKAGE_NAME = @PACKAGE_NAME@
PACKAGE_STRING = @PACKAGE_STRING@
PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_URL = @PACKAGE_URL@
PACKAGE_VERSION = @PACKAGE_VERSION@
PATH_SEPARATOR = @PATH_SEPARATOR@
PERL = @PERL@
PKG_CONFIG = @PKG_CONFIG@
+PTHREADLIB = @PTHREADLIB@
RANLIB = @RANLIB@
+RTLIB = @RTLIB@
RUBY = @RUBY@
RUBYINCLUDE = @RUBYINCLUDE@
SED = @SED@
@@ -171,9 +196,9 @@ build_cpu = @build_cpu@
build_os = @build_os@
build_vendor = @build_vendor@
builddir = @builddir@
-confdir = @confdir@
datadir = @datadir@
datarootdir = @datarootdir@
+default_pkcs11 = @default_pkcs11@
docdir = @docdir@
dvidir = @dvidir@
exec_prefix = @exec_prefix@
@@ -196,7 +221,7 @@ ipsecuser = @ipsecuser@
libdir = @libdir@
libexecdir = @libexecdir@
libstrongswan_plugins = @libstrongswan_plugins@
-linuxdir = @linuxdir@
+linux_headers = @linux_headers@
localedir = @localedir@
localstatedir = @localstatedir@
lt_ECHO = @lt_ECHO@
@@ -204,6 +229,7 @@ mandir = @mandir@
mkdir_p = @mkdir_p@
nm_CFLAGS = @nm_CFLAGS@
nm_LIBS = @nm_LIBS@
+nm_ca_dir = @nm_ca_dir@
oldincludedir = @oldincludedir@
pdfdir = @pdfdir@
piddir = @piddir@
@@ -212,10 +238,12 @@ pluto_plugins = @pluto_plugins@
prefix = @prefix@
program_transform_name = @program_transform_name@
psdir = @psdir@
+random_device = @random_device@
resolv_conf = @resolv_conf@
+routing_table = @routing_table@
+routing_table_prio = @routing_table_prio@
sbindir = @sbindir@
sharedstatedir = @sharedstatedir@
-simreader = @simreader@
srcdir = @srcdir@
strongswan_conf = @strongswan_conf@
sysconfdir = @sysconfdir@
@@ -223,16 +251,17 @@ target_alias = @target_alias@
top_build_prefix = @top_build_prefix@
top_builddir = @top_builddir@
top_srcdir = @top_srcdir@
+urandom_device = @urandom_device@
xml_CFLAGS = @xml_CFLAGS@
xml_LIBS = @xml_LIBS@
INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
AM_CFLAGS = -rdynamic
-plugin_LTLIBRARIES = libstrongswan-eapmschapv2.la
-libstrongswan_eapmschapv2_la_SOURCES = \
+plugin_LTLIBRARIES = libstrongswan-eap-mschapv2.la
+libstrongswan_eap_mschapv2_la_SOURCES = \
eap_mschapv2_plugin.h eap_mschapv2_plugin.c \
eap_mschapv2.h eap_mschapv2.c
-libstrongswan_eapmschapv2_la_LDFLAGS = -module -avoid-version
+libstrongswan_eap_mschapv2_la_LDFLAGS = -module -avoid-version
all: all-am
.SUFFIXES:
@@ -246,9 +275,9 @@ $(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps)
exit 1;; \
esac; \
done; \
- echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/charon/plugins/eap_mschapv2/Makefile'; \
- cd $(top_srcdir) && \
- $(AUTOMAKE) --gnu src/charon/plugins/eap_mschapv2/Makefile
+ echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/charon/plugins/eap_mschapv2/Makefile'; \
+ $(am__cd) $(top_srcdir) && \
+ $(AUTOMAKE) --gnu src/charon/plugins/eap_mschapv2/Makefile
.PRECIOUS: Makefile
Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
@case '$?' in \
@@ -266,23 +295,28 @@ $(top_srcdir)/configure: $(am__configure_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
$(ACLOCAL_M4): $(am__aclocal_m4_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(am__aclocal_m4_deps):
install-pluginLTLIBRARIES: $(plugin_LTLIBRARIES)
@$(NORMAL_INSTALL)
test -z "$(plugindir)" || $(MKDIR_P) "$(DESTDIR)$(plugindir)"
- @list='$(plugin_LTLIBRARIES)'; for p in $$list; do \
+ @list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+ list2=; for p in $$list; do \
if test -f $$p; then \
- f=$(am__strip_dir) \
- echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(pluginLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) '$$p' '$(DESTDIR)$(plugindir)/$$f'"; \
- $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(pluginLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) "$$p" "$(DESTDIR)$(plugindir)/$$f"; \
+ list2="$$list2 $$p"; \
else :; fi; \
- done
+ done; \
+ test -z "$$list2" || { \
+ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(plugindir)'"; \
+ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(plugindir)"; \
+ }
uninstall-pluginLTLIBRARIES:
@$(NORMAL_UNINSTALL)
- @list='$(plugin_LTLIBRARIES)'; for p in $$list; do \
- p=$(am__strip_dir) \
- echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$p'"; \
- $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$p"; \
+ @list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+ for p in $$list; do \
+ $(am__strip_dir) \
+ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$f'"; \
+ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$f"; \
done
clean-pluginLTLIBRARIES:
@@ -293,8 +327,8 @@ clean-pluginLTLIBRARIES:
echo "rm -f \"$${dir}/so_locations\""; \
rm -f "$${dir}/so_locations"; \
done
-libstrongswan-eapmschapv2.la: $(libstrongswan_eapmschapv2_la_OBJECTS) $(libstrongswan_eapmschapv2_la_DEPENDENCIES)
- $(libstrongswan_eapmschapv2_la_LINK) -rpath $(plugindir) $(libstrongswan_eapmschapv2_la_OBJECTS) $(libstrongswan_eapmschapv2_la_LIBADD) $(LIBS)
+libstrongswan-eap-mschapv2.la: $(libstrongswan_eap_mschapv2_la_OBJECTS) $(libstrongswan_eap_mschapv2_la_DEPENDENCIES)
+ $(libstrongswan_eap_mschapv2_la_LINK) -rpath $(plugindir) $(libstrongswan_eap_mschapv2_la_OBJECTS) $(libstrongswan_eap_mschapv2_la_LIBADD) $(LIBS)
mostlyclean-compile:
-rm -f *.$(OBJEXT)
@@ -307,21 +341,21 @@ distclean-compile:
.c.o:
@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(COMPILE) -c $<
.c.obj:
@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(COMPILE) -c `$(CYGPATH_W) '$<'`
.c.lo:
@am__fastdepCC_TRUE@ $(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(LTCOMPILE) -c -o $@ $<
@@ -344,7 +378,7 @@ tags: TAGS
TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
$(TAGS_FILES) $(LISP)
- tags=; \
+ set x; \
here=`pwd`; \
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
unique=`for i in $$list; do \
@@ -352,29 +386,34 @@ TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
- if test -z "$(ETAGS_ARGS)$$tags$$unique"; then :; else \
+ shift; \
+ if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
test -n "$$unique" || unique=$$empty_fix; \
- $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
- $$tags $$unique; \
+ if test $$# -gt 0; then \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ "$$@" $$unique; \
+ else \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ $$unique; \
+ fi; \
fi
ctags: CTAGS
CTAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
$(TAGS_FILES) $(LISP)
- tags=; \
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
unique=`for i in $$list; do \
if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
- test -z "$(CTAGS_ARGS)$$tags$$unique" \
+ test -z "$(CTAGS_ARGS)$$unique" \
|| $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
- $$tags $$unique
+ $$unique
GTAGS:
here=`$(am__cd) $(top_builddir) && pwd` \
- && cd $(top_srcdir) \
- && gtags -i $(GTAGS_ARGS) $$here
+ && $(am__cd) $(top_srcdir) \
+ && gtags -i $(GTAGS_ARGS) "$$here"
distclean-tags:
-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
@@ -395,13 +434,17 @@ distdir: $(DISTFILES)
if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
if test -d $$d/$$file; then \
dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
+ if test -d "$(distdir)/$$file"; then \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+ fi; \
if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
- cp -pR $(srcdir)/$$file $(distdir)$$dir || exit 1; \
+ cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
fi; \
- cp -pR $$d/$$file $(distdir)$$dir || exit 1; \
+ cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
else \
- test -f $(distdir)/$$file \
- || cp -p $$d/$$file $(distdir)/$$file \
+ test -f "$(distdir)/$$file" \
+ || cp -p $$d/$$file "$(distdir)/$$file" \
|| exit 1; \
fi; \
done
@@ -432,6 +475,7 @@ clean-generic:
distclean-generic:
-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+ -test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
maintainer-clean-generic:
@echo "This command is intended for maintainers to use"
@@ -453,6 +497,8 @@ dvi-am:
html: html-am
+html-am:
+
info: info-am
info-am:
@@ -461,18 +507,28 @@ install-data-am: install-pluginLTLIBRARIES
install-dvi: install-dvi-am
+install-dvi-am:
+
install-exec-am:
install-html: install-html-am
+install-html-am:
+
install-info: install-info-am
+install-info-am:
+
install-man:
install-pdf: install-pdf-am
+install-pdf-am:
+
install-ps: install-ps-am
+install-ps-am:
+
installcheck-am:
maintainer-clean: maintainer-clean-am
@@ -511,6 +567,7 @@ uninstall-am: uninstall-pluginLTLIBRARIES
mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \
tags uninstall uninstall-am uninstall-pluginLTLIBRARIES
+
# Tell versions [3.59,3.63) of GNU make to not export all variables.
# Otherwise a system limit (for SysV at least) may be exceeded.
.NOEXPORT:
diff --git a/src/charon/plugins/eap_mschapv2/eap_mschapv2.c b/src/charon/plugins/eap_mschapv2/eap_mschapv2.c
index 0e3fac780..f0222840d 100644
--- a/src/charon/plugins/eap_mschapv2/eap_mschapv2.c
+++ b/src/charon/plugins/eap_mschapv2/eap_mschapv2.c
@@ -35,47 +35,47 @@ struct private_eap_mschapv2_t
* Public authenticator_t interface.
*/
eap_mschapv2_t public;
-
+
/**
* ID of the server
*/
identification_t *server;
-
+
/**
* ID of the peer
*/
identification_t *peer;
-
+
/**
* challenge sent by the server
*/
chunk_t challenge;
-
+
/**
* generated NT-Response
*/
chunk_t nt_response;
-
+
/**
* generated Authenticator Response
*/
chunk_t auth_response;
-
+
/**
* generated MSK
*/
chunk_t msk;
-
+
/**
* EAP message identifier
*/
u_int8_t identifier;
-
+
/**
* MS-CHAPv2-ID (session ID, increases with each retry)
*/
u_int8_t mschapv2id;
-
+
/**
* Number of retries
*/
@@ -248,7 +248,7 @@ static chunk_t ExpandDESKey(chunk_t key)
int i;
u_char carry = 0;
chunk_t expanded;
-
+
/* expand the 7 octets to 8 octets */
expanded = chunk_alloc(8);
for (i = 0; i < 7; i++)
@@ -257,7 +257,7 @@ static chunk_t ExpandDESKey(chunk_t key)
carry = key.ptr[i] & ~bitmask[i];
}
expanded.ptr[7] = carry << 1;
-
+
/* add parity bits to each octet */
for (i = 0; i < 8; i++)
{
@@ -269,7 +269,7 @@ static chunk_t ExpandDESKey(chunk_t key)
}
/**
- * Calculate the NT password hash (i.e. hash the (unicode) password with MD4)
+ * Calculate the NT password hash (i.e. hash the (unicode) password with MD4)
*/
static status_t NtPasswordHash(chunk_t password, chunk_t *password_hash)
{
@@ -277,7 +277,7 @@ static status_t NtPasswordHash(chunk_t password, chunk_t *password_hash)
hasher = lib->crypto->create_hasher(lib->crypto, HASH_MD4);
if (hasher == NULL)
{
- DBG1(DBG_IKE, "EAP-MS-CHAPv2 failed, MD4 not supported");
+ DBG1(DBG_IKE, "EAP-MS-CHAPv2 failed, no MD4 hasher available");
return FAILED;
}
hasher->allocate_hash(hasher, password, password_hash);
@@ -287,7 +287,7 @@ static status_t NtPasswordHash(chunk_t password, chunk_t *password_hash)
/**
* Calculate the challenge hash (i.e. hash [peer_challenge | server_challenge |
- * username (without domain part)] with SHA1)
+ * username (without domain part)] with SHA1)
*/
static status_t ChallengeHash(chunk_t peer_challenge, chunk_t server_challenge,
chunk_t username, chunk_t *challenge_hash)
@@ -331,7 +331,7 @@ static status_t ChallengeResponse(chunk_t challenge_hash, chunk_t password_hash,
memset(z_password_hash.ptr, 0, z_password_hash.len);
memcpy(z_password_hash.ptr, password_hash.ptr, password_hash.len);
chunk_split(z_password_hash, "mmm", 7, &keys[0], 7, &keys[1], 7, &keys[2]);
-
+
*response = chunk_alloc(24);
for (i = 0; i < 3; i++)
{
@@ -353,35 +353,32 @@ static status_t ChallengeResponse(chunk_t challenge_hash, chunk_t password_hash,
static status_t AuthenticatorResponse(chunk_t password_hash_hash,
chunk_t challenge_hash, chunk_t nt_response, chunk_t *response)
{
- static u_int8_t magic1_data[] =
- { 0x4D, 0x61, 0x67, 0x69, 0x63, 0x20, 0x73, 0x65, 0x72, 0x76,
- 0x65, 0x72, 0x20, 0x74, 0x6F, 0x20, 0x63, 0x6C, 0x69, 0x65,
- 0x6E, 0x74, 0x20, 0x73, 0x69, 0x67, 0x6E, 0x69, 0x6E, 0x67,
- 0x20, 0x63, 0x6F, 0x6E, 0x73, 0x74, 0x61, 0x6E, 0x74 };
- static u_int8_t magic2_data[] =
- { 0x50, 0x61, 0x64, 0x20, 0x74, 0x6F, 0x20, 0x6D, 0x61, 0x6B,
- 0x65, 0x20, 0x69, 0x74, 0x20, 0x64, 0x6F, 0x20, 0x6D, 0x6F,
- 0x72, 0x65, 0x20, 0x74, 0x68, 0x61, 0x6E, 0x20, 0x6F, 0x6E,
- 0x65, 0x20, 0x69, 0x74, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6F,
- 0x6E };
- static const chunk_t magic1 = chunk_from_buf(magic1_data);
- static const chunk_t magic2 = chunk_from_buf(magic2_data);
-
+ chunk_t magic1 = chunk_from_chars(
+ 0x4D, 0x61, 0x67, 0x69, 0x63, 0x20, 0x73, 0x65, 0x72, 0x76,
+ 0x65, 0x72, 0x20, 0x74, 0x6F, 0x20, 0x63, 0x6C, 0x69, 0x65,
+ 0x6E, 0x74, 0x20, 0x73, 0x69, 0x67, 0x6E, 0x69, 0x6E, 0x67,
+ 0x20, 0x63, 0x6F, 0x6E, 0x73, 0x74, 0x61, 0x6E, 0x74);
+ chunk_t magic2 = chunk_from_chars(
+ 0x50, 0x61, 0x64, 0x20, 0x74, 0x6F, 0x20, 0x6D, 0x61, 0x6B,
+ 0x65, 0x20, 0x69, 0x74, 0x20, 0x64, 0x6F, 0x20, 0x6D, 0x6F,
+ 0x72, 0x65, 0x20, 0x74, 0x68, 0x61, 0x6E, 0x20, 0x6F, 0x6E,
+ 0x65, 0x20, 0x69, 0x74, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6F,
+ 0x6E);
chunk_t digest = chunk_empty, concat;
hasher_t *hasher;
-
+
hasher = lib->crypto->create_hasher(lib->crypto, HASH_SHA1);
if (hasher == NULL)
{
DBG1(DBG_IKE, "EAP-MS-CHAPv2 failed, SHA1 not supported");
return FAILED;
}
-
+
concat = chunk_cata("ccc", password_hash_hash, nt_response, magic1);
hasher->allocate_hash(hasher, concat, &digest);
concat = chunk_cata("ccc", digest, challenge_hash, magic2);
hasher->allocate_hash(hasher, concat, response);
-
+
hasher->destroy(hasher);
chunk_free(&digest);
return SUCCESS;
@@ -393,71 +390,67 @@ static status_t AuthenticatorResponse(chunk_t password_hash_hash,
static status_t GenerateMSK(chunk_t password_hash_hash,
chunk_t nt_response, chunk_t *msk)
{
- static u_int8_t magic1_data[] =
- { 0x54, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74,
- 0x68, 0x65, 0x20, 0x4d, 0x50, 0x50, 0x45, 0x20, 0x4d,
- 0x61, 0x73, 0x74, 0x65, 0x72, 0x20, 0x4b, 0x65, 0x79 };
- static u_int8_t magic2_data[] =
- { 0x4f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x63, 0x6c, 0x69,
- 0x65, 0x6e, 0x74, 0x20, 0x73, 0x69, 0x64, 0x65, 0x2c, 0x20,
- 0x74, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68,
- 0x65, 0x20, 0x73, 0x65, 0x6e, 0x64, 0x20, 0x6b, 0x65, 0x79,
- 0x3b, 0x20, 0x6f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x73,
- 0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x73, 0x69, 0x64, 0x65,
- 0x2c, 0x20, 0x69, 0x74, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68,
- 0x65, 0x20, 0x72, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x20,
- 0x6b, 0x65, 0x79, 0x2e };
- static u_int8_t magic3_data[] =
- { 0x4f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x63, 0x6c, 0x69,
- 0x65, 0x6e, 0x74, 0x20, 0x73, 0x69, 0x64, 0x65, 0x2c, 0x20,
- 0x74, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68,
- 0x65, 0x20, 0x72, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x20,
- 0x6b, 0x65, 0x79, 0x3b, 0x20, 0x6f, 0x6e, 0x20, 0x74, 0x68,
- 0x65, 0x20, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x73,
- 0x69, 0x64, 0x65, 0x2c, 0x20, 0x69, 0x74, 0x20, 0x69, 0x73,
- 0x20, 0x74, 0x68, 0x65, 0x20, 0x73, 0x65, 0x6e, 0x64, 0x20,
- 0x6b, 0x65, 0x79, 0x2e };
- static u_int8_t shapad1_data[] =
- { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
- 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
- 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
- 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
- static u_int8_t shapad2_data[] =
- { 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2,
- 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2,
- 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2,
- 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2 };
- static const chunk_t magic1 = chunk_from_buf(magic1_data);
- static const chunk_t magic2 = chunk_from_buf(magic2_data);
- static const chunk_t magic3 = chunk_from_buf(magic3_data);
- static const chunk_t shapad1 = chunk_from_buf(shapad1_data);
- static const chunk_t shapad2 = chunk_from_buf(shapad2_data);
- static const chunk_t keypad = { shapad1_data, 16 };
-
+ chunk_t magic1 = chunk_from_chars(
+ 0x54, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74,
+ 0x68, 0x65, 0x20, 0x4d, 0x50, 0x50, 0x45, 0x20, 0x4d,
+ 0x61, 0x73, 0x74, 0x65, 0x72, 0x20, 0x4b, 0x65, 0x79);
+ chunk_t magic2 = chunk_from_chars(
+ 0x4f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x63, 0x6c, 0x69,
+ 0x65, 0x6e, 0x74, 0x20, 0x73, 0x69, 0x64, 0x65, 0x2c, 0x20,
+ 0x74, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68,
+ 0x65, 0x20, 0x73, 0x65, 0x6e, 0x64, 0x20, 0x6b, 0x65, 0x79,
+ 0x3b, 0x20, 0x6f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x73,
+ 0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x73, 0x69, 0x64, 0x65,
+ 0x2c, 0x20, 0x69, 0x74, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68,
+ 0x65, 0x20, 0x72, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x20,
+ 0x6b, 0x65, 0x79, 0x2e);
+ chunk_t magic3 = chunk_from_chars(
+ 0x4f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x63, 0x6c, 0x69,
+ 0x65, 0x6e, 0x74, 0x20, 0x73, 0x69, 0x64, 0x65, 0x2c, 0x20,
+ 0x74, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68,
+ 0x65, 0x20, 0x72, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x20,
+ 0x6b, 0x65, 0x79, 0x3b, 0x20, 0x6f, 0x6e, 0x20, 0x74, 0x68,
+ 0x65, 0x20, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x73,
+ 0x69, 0x64, 0x65, 0x2c, 0x20, 0x69, 0x74, 0x20, 0x69, 0x73,
+ 0x20, 0x74, 0x68, 0x65, 0x20, 0x73, 0x65, 0x6e, 0x64, 0x20,
+ 0x6b, 0x65, 0x79, 0x2e);
+ chunk_t shapad1 = chunk_from_chars(
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00);
+ chunk_t shapad2 = chunk_from_chars(
+ 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2,
+ 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2,
+ 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2,
+ 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2);
+ chunk_t keypad = chunk_from_chars(
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00);
chunk_t concat, master_key, master_receive_key, master_send_key;
hasher_t *hasher;
-
+
hasher = lib->crypto->create_hasher(lib->crypto, HASH_SHA1);
if (hasher == NULL)
{
DBG1(DBG_IKE, "EAP-MS-CHAPv2 failed, SHA1 not supported");
return FAILED;
}
-
+
concat = chunk_cata("ccc", password_hash_hash, nt_response, magic1);
hasher->allocate_hash(hasher, concat, &master_key);
master_key.len = 16;
-
+
concat = chunk_cata("cccc", master_key, shapad1, magic2, shapad2);
hasher->allocate_hash(hasher, concat, &master_receive_key);
master_receive_key.len = 16;
-
+
concat = chunk_cata("cccc", master_key, shapad1, magic3, shapad2);
hasher->allocate_hash(hasher, concat, &master_send_key);
master_send_key.len = 16;
-
+
*msk = chunk_cat("cccc", master_receive_key, master_send_key, keypad, keypad);
-
+
hasher->destroy(hasher);
chunk_free(&master_key);
chunk_free(&master_receive_key);
@@ -472,7 +465,7 @@ static status_t GenerateStuff(private_eap_mschapv2_t *this,
status_t status = FAILED;
chunk_t password_hash = chunk_empty, password_hash_hash = chunk_empty,
challenge_hash = chunk_empty;
-
+
if (NtPasswordHash(password, &password_hash) != SUCCESS)
{
goto error;
@@ -486,7 +479,7 @@ static status_t GenerateStuff(private_eap_mschapv2_t *this,
{
goto error;
}
-
+
if (ChallengeResponse(challenge_hash, password_hash,
&this->nt_response) != SUCCESS)
{
@@ -501,9 +494,9 @@ static status_t GenerateStuff(private_eap_mschapv2_t *this,
{
goto error;
}
-
+
status = SUCCESS;
-
+
error:
chunk_free(&password_hash);
chunk_free(&password_hash_hash);
@@ -532,7 +525,7 @@ static chunk_t ascii_to_unicode(chunk_t ascii)
static char* sanitize(char *str)
{
char *pos = str;
-
+
while (pos && *pos)
{
if (!isprint(*pos))
@@ -592,7 +585,7 @@ static status_t initiate_server(private_eap_mschapv2_t *this, eap_payload_t **ou
eap_mschapv2_challenge_t *cha;
const char *name = MSCHAPV2_HOST_NAME;
u_int16_t len = CHALLENGE_PAYLOAD_LEN + sizeof(MSCHAPV2_HOST_NAME) - 1;
-
+
rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
if (!rng)
{
@@ -601,7 +594,7 @@ static status_t initiate_server(private_eap_mschapv2_t *this, eap_payload_t **ou
}
rng->allocate_bytes(rng, CHALLENGE_LEN, &this->challenge);
rng->destroy(rng);
-
+
eap = alloca(len);
eap->code = EAP_REQUEST;
eap->identifier = this->identifier;
@@ -610,12 +603,12 @@ static status_t initiate_server(private_eap_mschapv2_t *this, eap_payload_t **ou
eap->opcode = MSCHAPV2_CHALLENGE;
eap->ms_chapv2_id = this->mschapv2id;
set_ms_length(eap, len);
-
+
cha = (eap_mschapv2_challenge_t*)eap->data;
cha->value_size = CHALLENGE_LEN;
memcpy(cha->challenge, this->challenge.ptr, this->challenge.len);
memcpy(cha->name, name, sizeof(MSCHAPV2_HOST_NAME) - 1);
-
+
*out = eap_payload_create_data(chunk_create((void*) eap, len));
return NEED_MORE;
}
@@ -634,29 +627,29 @@ static status_t process_peer_challenge(private_eap_mschapv2_t *this,
shared_key_t *shared;
chunk_t data, peer_challenge, username, password;
u_int16_t len = RESPONSE_PAYLOAD_LEN;
-
+
data = in->get_data(in);
eap = (eap_mschapv2_header_t*)data.ptr;
-
+
/* the name MUST be at least one octet long */
if (data.len < CHALLENGE_PAYLOAD_LEN + 1)
{
DBG1(DBG_IKE, "received invalid EAP-MS-CHAPv2 message: too short");
return FAILED;
}
-
+
cha = (eap_mschapv2_challenge_t*)eap->data;
-
+
if (cha->value_size != CHALLENGE_LEN)
{
DBG1(DBG_IKE, "received invalid EAP-MS-CHAPv2 message: "
"invalid challenge size");
return FAILED;
}
-
+
this->mschapv2id = eap->ms_chapv2_id;
this->challenge = chunk_clone(chunk_create(cha->challenge, CHALLENGE_LEN));
-
+
rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
if (!rng)
{
@@ -666,7 +659,7 @@ static status_t process_peer_challenge(private_eap_mschapv2_t *this,
peer_challenge = chunk_alloca(CHALLENGE_LEN);
rng->get_bytes(rng, CHALLENGE_LEN, peer_challenge.ptr);
rng->destroy(rng);
-
+
shared = charon->credentials->get_shared(charon->credentials,
SHARED_EAP, this->peer, this->server);
if (shared == NULL)
@@ -675,13 +668,13 @@ static status_t process_peer_challenge(private_eap_mschapv2_t *this,
this->server, this->peer);
return NOT_FOUND;
}
-
+
password = ascii_to_unicode(shared->get_key(shared));
shared->destroy(shared);
-
+
username = extract_username(this->peer);
len += username.len;
-
+
if (GenerateStuff(this, this->challenge, peer_challenge, username, password) != SUCCESS)
{
DBG1(DBG_IKE, "EAP-MS-CHAPv2 generating NT-Response failed");
@@ -689,7 +682,7 @@ static status_t process_peer_challenge(private_eap_mschapv2_t *this,
return FAILED;
}
chunk_clear(&password);
-
+
eap = alloca(len);
eap->code = EAP_RESPONSE;
eap->identifier = this->identifier;
@@ -698,16 +691,16 @@ static status_t process_peer_challenge(private_eap_mschapv2_t *this,
eap->opcode = MSCHAPV2_RESPONSE;
eap->ms_chapv2_id = this->mschapv2id;
set_ms_length(eap, len);
-
+
res = (eap_mschapv2_response_t*)eap->data;
res->value_size = RESPONSE_LEN;
memset(&res->response, 0, RESPONSE_LEN);
memcpy(res->response.peer_challenge, peer_challenge.ptr, peer_challenge.len);
memcpy(res->response.nt_response, this->nt_response.ptr, this->nt_response.len);
-
+
username = this->peer->get_encoding(this->peer);
memcpy(res->name, username.ptr, username.len);
-
+
*out = eap_payload_create_data(chunk_create((void*) eap, len));
return NEED_MORE;
}
@@ -725,21 +718,21 @@ static status_t process_peer_success(private_eap_mschapv2_t *this,
char *message, *token, *msg = NULL;
int message_len;
u_int16_t len = SHORT_HEADER_LEN;
-
+
data = in->get_data(in);
eap = (eap_mschapv2_header_t*)data.ptr;
-
+
if (data.len < AUTH_RESPONSE_LEN)
{
DBG1(DBG_IKE, "received invalid EAP-MS-CHAPv2 message: too short");
return FAILED;
}
-
+
message_len = data.len - HEADER_LEN;
message = malloc(message_len + 1);
memcpy(message, eap->data, message_len);
message[message_len] = '\0';
-
+
/* S=<auth_string> M=<msg> */
enumerator = enumerator_create_token(message, " ", " ");
while (enumerator->enumerate(enumerator, &token))
@@ -764,32 +757,32 @@ static status_t process_peer_success(private_eap_mschapv2_t *this,
}
}
enumerator->destroy(enumerator);
-
- if (auth_string.ptr == NULL)
+
+ if (auth_string.ptr == NULL)
{
DBG1(DBG_IKE, "received invalid EAP-MS-CHAPv2 message: "
"auth string missing");
goto error;
}
-
+
if (!chunk_equals(this->auth_response, auth_string))
{
DBG1(DBG_IKE, "EAP-MS-CHAPv2 verification failed");
goto error;
}
-
+
DBG1(DBG_IKE, "EAP-MS-CHAPv2 succeeded: '%s'", sanitize(msg));
-
+
eap = alloca(len);
eap->code = EAP_RESPONSE;
eap->identifier = this->identifier;
eap->length = htons(len);
eap->type = EAP_MSCHAPV2;
eap->opcode = MSCHAPV2_SUCCESS;
-
+
*out = eap_payload_create_data(chunk_create((void*) eap, len));
status = NEED_MORE;
-
+
error:
chunk_free(&auth_string);
free(message);
@@ -807,21 +800,21 @@ static status_t process_peer_failure(private_eap_mschapv2_t *this,
char *message, *token, *msg = NULL;
int message_len, error, retryable;
chunk_t challenge = chunk_empty;
-
+
data = in->get_data(in);
eap = (eap_mschapv2_header_t*)data.ptr;
-
+
if (data.len < 3) /* we want at least an error code: E=e */
{
DBG1(DBG_IKE, "received invalid EAP-MS-CHAPv2 message: too short");
return FAILED;
}
-
+
message_len = data.len - HEADER_LEN;
message = malloc(message_len + 1);
memcpy(message, eap->data, message_len);
message[message_len] = '\0';
-
+
/* E=eeeeeeeeee R=r C=cccccccccccccccccccccccccccccccc V=vvvvvvvvvv M=<msg> */
enumerator = enumerator_create_token(message, " ", " ");
while (enumerator->enumerate(enumerator, &token))
@@ -862,28 +855,28 @@ static status_t process_peer_failure(private_eap_mschapv2_t *this,
}
}
enumerator->destroy(enumerator);
-
+
DBG1(DBG_IKE, "EAP-MS-CHAPv2 failed with error %N: '%s'",
mschapv2_error_names, error, sanitize(msg));
-
+
/**
* at this point, if the error is retryable, we MAY retry the authentication
* or MAY send a Change Password packet.
- *
+ *
* if the error is not retryable (or if we do neither of the above), we
* SHOULD send a Failure Response packet.
* windows clients don't do that, and since windows server 2008 r2 behaves
* pretty odd if we do send a Failure Response, we just don't send one
* either. windows 7 actually sends a delete notify (which, according to the
- * logs, results in an error on windows server 2008 r2).
- *
+ * logs, results in an error on windows server 2008 r2).
+ *
* btw, windows server 2008 r2 does not send non-retryable errors for e.g.
* a disabled account but returns the windows error code in a notify payload
* of type 12345.
*/
-
+
status = FAILED;
-
+
error:
chunk_free(&challenge);
free(message);
@@ -899,7 +892,7 @@ static status_t process_peer(private_eap_mschapv2_t *this, eap_payload_t *in,
{
chunk_t data;
eap_mschapv2_header_t *eap;
-
+
this->identifier = in->get_identifier(in);
data = in->get_data(in);
if (data.len < SHORT_HEADER_LEN)
@@ -907,9 +900,9 @@ static status_t process_peer(private_eap_mschapv2_t *this, eap_payload_t *in,
DBG1(DBG_IKE, "received invalid EAP-MS-CHAPv2 message");
return FAILED;
}
-
+
eap = (eap_mschapv2_header_t*)data.ptr;
-
+
switch (eap->opcode)
{
case MSCHAPV2_CHALLENGE:
@@ -945,7 +938,7 @@ static status_t process_server_retry(private_eap_mschapv2_t *this,
chunk_t hex;
char msg[FAILURE_MESSAGE_LEN];
u_int16_t len = HEADER_LEN + FAILURE_MESSAGE_LEN - 1; /* no null byte */
-
+
if (++this->retries > MAX_RETRIES)
{
/* we MAY send a Failure Request with R=0, but windows 7 does not
@@ -957,9 +950,9 @@ static status_t process_server_retry(private_eap_mschapv2_t *this,
"maximum number of retries reached");
return FAILED;
}
-
+
DBG1(DBG_IKE, "EAP-MS-CHAPv2 verification failed, retry (%d)", this->retries);
-
+
rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
if (!rng)
{
@@ -968,11 +961,11 @@ static status_t process_server_retry(private_eap_mschapv2_t *this,
}
rng->get_bytes(rng, CHALLENGE_LEN, this->challenge.ptr);
rng->destroy(rng);
-
+
chunk_free(&this->nt_response);
chunk_free(&this->auth_response);
chunk_free(&this->msk);
-
+
eap = alloca(len);
eap->code = EAP_REQUEST;
eap->identifier = ++this->identifier;
@@ -981,16 +974,16 @@ static status_t process_server_retry(private_eap_mschapv2_t *this,
eap->opcode = MSCHAPV2_FAILURE;
eap->ms_chapv2_id = this->mschapv2id++; /* increase for each retry */
set_ms_length(eap, len);
-
+
hex = chunk_to_hex(this->challenge, NULL, TRUE);
snprintf(msg, FAILURE_MESSAGE_LEN, "%s%s", FAILURE_MESSAGE, hex.ptr);
chunk_free(&hex);
memcpy(eap->data, msg, FAILURE_MESSAGE_LEN - 1); /* no null byte */
*out = eap_payload_create_data(chunk_create((void*) eap, len));
-
+
/* delay the response for some time to make brute-force attacks harder */
sleep(RETRY_DELAY);
-
+
return NEED_MORE;
}
@@ -1007,25 +1000,25 @@ static status_t process_server_response(private_eap_mschapv2_t *this,
shared_key_t *shared;
int name_len;
char buf[256];
-
+
data = in->get_data(in);
eap = (eap_mschapv2_header_t*)data.ptr;
-
+
if (data.len < RESPONSE_PAYLOAD_LEN)
{
DBG1(DBG_IKE, "received invalid EAP-MS-CHAPv2 message: too short");
return FAILED;
}
-
+
res = (eap_mschapv2_response_t*)eap->data;
peer_challenge = chunk_create(res->response.peer_challenge, CHALLENGE_LEN);
-
+
name_len = min(data.len - RESPONSE_PAYLOAD_LEN, 255);
snprintf(buf, sizeof(buf), "%.*s", name_len, res->name);
userid = identification_create_from_string(buf);
DBG2(DBG_IKE, "EAP-MS-CHAPv2 username: '%Y'", userid);
username = extract_username(userid);
-
+
shared = charon->credentials->get_shared(charon->credentials,
SHARED_EAP, this->server, userid);
if (shared == NULL)
@@ -1035,33 +1028,33 @@ static status_t process_server_response(private_eap_mschapv2_t *this,
/* FIXME: windows 7 always sends the username that is first entered in
* the username box, even, if the user changes it during retries (probably
* to keep consistent with the EAP-Identity).
- * thus, we could actually fail here, because retries do not make much
- * sense. on the other hand, an attacker could guess usernames, if the
- * error messages were different. */
+ * thus, we could actually fail here, because retries do not make much
+ * sense. on the other hand, an attacker could guess usernames, if the
+ * error messages were different. */
userid->destroy(userid);
return process_server_retry(this, out);
}
-
+
password = ascii_to_unicode(shared->get_key(shared));
shared->destroy(shared);
-
+
if (GenerateStuff(this, this->challenge, peer_challenge,
username, password) != SUCCESS)
{
- DBG1(DBG_IKE, "EAP-MS-CHAPv2 verification failed");
+ DBG1(DBG_IKE, "EAP-MS-CHAPv2 verification failed");
userid->destroy(userid);
chunk_clear(&password);
return FAILED;
}
userid->destroy(userid);
chunk_clear(&password);
-
+
if (memeq(res->response.nt_response, this->nt_response.ptr, this->nt_response.len))
{
chunk_t hex;
char msg[AUTH_RESPONSE_LEN + sizeof(SUCCESS_MESSAGE)];
u_int16_t len = HEADER_LEN + AUTH_RESPONSE_LEN + sizeof(SUCCESS_MESSAGE);
-
+
eap = alloca(len);
eap->code = EAP_REQUEST;
eap->identifier = ++this->identifier;
@@ -1070,7 +1063,7 @@ static status_t process_server_response(private_eap_mschapv2_t *this,
eap->opcode = MSCHAPV2_SUCCESS;
eap->ms_chapv2_id = this->mschapv2id;
set_ms_length(eap, len);
-
+
hex = chunk_to_hex(this->auth_response, NULL, TRUE);
snprintf(msg, AUTH_RESPONSE_LEN + sizeof(SUCCESS_MESSAGE),
"S=%s%s", hex.ptr, SUCCESS_MESSAGE);
@@ -1091,23 +1084,23 @@ static status_t process_server(private_eap_mschapv2_t *this, eap_payload_t *in,
{
eap_mschapv2_header_t *eap;
chunk_t data;
-
+
if (this->identifier != in->get_identifier(in))
{
DBG1(DBG_IKE, "received invalid EAP-MS-CHAPv2 message: "
"unexpected identifier");
return FAILED;
}
-
+
data = in->get_data(in);
if (data.len < SHORT_HEADER_LEN)
{
DBG1(DBG_IKE, "received invalid EAP-MS-CHAPv2 message: too short");
return FAILED;
}
-
+
eap = (eap_mschapv2_header_t*)data.ptr;
-
+
switch (eap->opcode)
{
case MSCHAPV2_RESPONSE:
@@ -1159,7 +1152,7 @@ static status_t get_msk(private_eap_mschapv2_t *this, chunk_t *msk)
*/
static bool is_mutual(private_eap_mschapv2_t *this)
{
- return TRUE;
+ return FALSE;
}
/**
@@ -1182,14 +1175,14 @@ static void destroy(private_eap_mschapv2_t *this)
static private_eap_mschapv2_t *eap_mschapv2_create_generic(identification_t *server, identification_t *peer)
{
private_eap_mschapv2_t *this = malloc_thing(private_eap_mschapv2_t);
-
+
this->public.eap_method_interface.initiate = NULL;
this->public.eap_method_interface.process = NULL;
this->public.eap_method_interface.get_type = (eap_type_t(*)(eap_method_t*,u_int32_t*))get_type;
this->public.eap_method_interface.is_mutual = (bool(*)(eap_method_t*))is_mutual;
this->public.eap_method_interface.get_msk = (status_t(*)(eap_method_t*,chunk_t*))get_msk;
this->public.eap_method_interface.destroy = (void(*)(eap_method_t*))destroy;
-
+
/* private data */
this->peer = peer->clone(peer);
this->server = server->clone(server);
@@ -1200,7 +1193,7 @@ static private_eap_mschapv2_t *eap_mschapv2_create_generic(identification_t *ser
this->identifier = 0;
this->mschapv2id = 0;
this->retries = 0;
-
+
return this;
}
@@ -1210,7 +1203,7 @@ static private_eap_mschapv2_t *eap_mschapv2_create_generic(identification_t *ser
eap_mschapv2_t *eap_mschapv2_create_server(identification_t *server, identification_t *peer)
{
private_eap_mschapv2_t *this = eap_mschapv2_create_generic(server, peer);
-
+
this->public.eap_method_interface.initiate = (status_t(*)(eap_method_t*,eap_payload_t**))initiate_server;
this->public.eap_method_interface.process = (status_t(*)(eap_method_t*,eap_payload_t*, eap_payload_t**))process_server;
@@ -1219,9 +1212,9 @@ eap_mschapv2_t *eap_mschapv2_create_server(identification_t *server, identificat
{
this->identifier = random();
} while (!this->identifier);
-
+
this->mschapv2id = this->identifier;
-
+
return &this->public;
}
@@ -1231,10 +1224,10 @@ eap_mschapv2_t *eap_mschapv2_create_server(identification_t *server, identificat
eap_mschapv2_t *eap_mschapv2_create_peer(identification_t *server, identification_t *peer)
{
private_eap_mschapv2_t *this = eap_mschapv2_create_generic(server, peer);
-
+
this->public.eap_method_interface.initiate = (status_t(*)(eap_method_t*,eap_payload_t**))initiate_peer;
this->public.eap_method_interface.process = (status_t(*)(eap_method_t*,eap_payload_t*, eap_payload_t**))process_peer;
-
+
return &this->public;
}
diff --git a/src/charon/plugins/eap_mschapv2/eap_mschapv2_plugin.c b/src/charon/plugins/eap_mschapv2/eap_mschapv2_plugin.c
index d0995c477..404cecb20 100644
--- a/src/charon/plugins/eap_mschapv2/eap_mschapv2_plugin.c
+++ b/src/charon/plugins/eap_mschapv2/eap_mschapv2_plugin.c
@@ -37,14 +37,14 @@ static void destroy(eap_mschapv2_plugin_t *this)
plugin_t *plugin_create()
{
eap_mschapv2_plugin_t *this = malloc_thing(eap_mschapv2_plugin_t);
-
+
this->plugin.destroy = (void(*)(plugin_t*))destroy;
-
+
charon->eap->add_method(charon->eap, EAP_MSCHAPV2, 0, EAP_SERVER,
(eap_constructor_t)eap_mschapv2_create_server);
charon->eap->add_method(charon->eap, EAP_MSCHAPV2, 0, EAP_PEER,
(eap_constructor_t)eap_mschapv2_create_peer);
-
+
return &this->plugin;
}
diff --git a/src/charon/plugins/eap_radius/Makefile.am b/src/charon/plugins/eap_radius/Makefile.am
index df5c94656..e476fbed6 100644
--- a/src/charon/plugins/eap_radius/Makefile.am
+++ b/src/charon/plugins/eap_radius/Makefile.am
@@ -3,12 +3,12 @@ INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
AM_CFLAGS = -rdynamic
-plugin_LTLIBRARIES = libstrongswan-eapradius.la
+plugin_LTLIBRARIES = libstrongswan-eap-radius.la
-libstrongswan_eapradius_la_SOURCES = \
+libstrongswan_eap_radius_la_SOURCES = \
eap_radius_plugin.h eap_radius_plugin.c \
eap_radius.h eap_radius.c \
radius_client.h radius_client.c \
radius_message.h radius_message.c
-libstrongswan_eapradius_la_LDFLAGS = -module -avoid-version
+libstrongswan_eap_radius_la_LDFLAGS = -module -avoid-version
diff --git a/src/charon/plugins/eap_radius/Makefile.in b/src/charon/plugins/eap_radius/Makefile.in
index c30111fad..eb135e750 100644
--- a/src/charon/plugins/eap_radius/Makefile.in
+++ b/src/charon/plugins/eap_radius/Makefile.in
@@ -1,8 +1,9 @@
-# Makefile.in generated by automake 1.10.2 from Makefile.am.
+# Makefile.in generated by automake 1.11 from Makefile.am.
# @configure_input@
# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,
-# 2003, 2004, 2005, 2006, 2007, 2008 Free Software Foundation, Inc.
+# 2003, 2004, 2005, 2006, 2007, 2008, 2009 Free Software Foundation,
+# Inc.
# This Makefile.in is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.
@@ -16,8 +17,9 @@
VPATH = @srcdir@
pkgdatadir = $(datadir)/@PACKAGE@
-pkglibdir = $(libdir)/@PACKAGE@
pkgincludedir = $(includedir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkglibexecdir = $(libexecdir)/@PACKAGE@
am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
install_sh_DATA = $(install_sh) -c -m 644
install_sh_PROGRAM = $(install_sh) -c
@@ -35,32 +37,55 @@ host_triplet = @host@
subdir = src/charon/plugins/eap_radius
DIST_COMMON = $(srcdir)/Makefile.am $(srcdir)/Makefile.in
ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
-am__aclocal_m4_deps = $(top_srcdir)/configure.in
+am__aclocal_m4_deps = $(top_srcdir)/m4/config/libtool.m4 \
+ $(top_srcdir)/m4/config/ltoptions.m4 \
+ $(top_srcdir)/m4/config/ltsugar.m4 \
+ $(top_srcdir)/m4/config/ltversion.m4 \
+ $(top_srcdir)/m4/config/lt~obsolete.m4 \
+ $(top_srcdir)/m4/macros/with.m4 \
+ $(top_srcdir)/m4/macros/enable-disable.m4 \
+ $(top_srcdir)/configure.in
am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
$(ACLOCAL_M4)
mkinstalldirs = $(install_sh) -d
CONFIG_CLEAN_FILES =
+CONFIG_CLEAN_VPATH_FILES =
am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
am__vpath_adj = case $$p in \
$(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
*) f=$$p;; \
esac;
-am__strip_dir = `echo $$p | sed -e 's|^.*/||'`;
+am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
+am__install_max = 40
+am__nobase_strip_setup = \
+ srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
+am__nobase_strip = \
+ for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
+am__nobase_list = $(am__nobase_strip_setup); \
+ for p in $$list; do echo "$$p $$p"; done | \
+ sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
+ $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
+ if (++n[$$2] == $(am__install_max)) \
+ { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
+ END { for (dir in files) print dir, files[dir] }'
+am__base_list = \
+ sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
+ sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
am__installdirs = "$(DESTDIR)$(plugindir)"
-pluginLTLIBRARIES_INSTALL = $(INSTALL)
LTLIBRARIES = $(plugin_LTLIBRARIES)
-libstrongswan_eapradius_la_LIBADD =
-am_libstrongswan_eapradius_la_OBJECTS = eap_radius_plugin.lo \
+libstrongswan_eap_radius_la_LIBADD =
+am_libstrongswan_eap_radius_la_OBJECTS = eap_radius_plugin.lo \
eap_radius.lo radius_client.lo radius_message.lo
-libstrongswan_eapradius_la_OBJECTS = \
- $(am_libstrongswan_eapradius_la_OBJECTS)
-libstrongswan_eapradius_la_LINK = $(LIBTOOL) --tag=CC \
+libstrongswan_eap_radius_la_OBJECTS = \
+ $(am_libstrongswan_eap_radius_la_OBJECTS)
+libstrongswan_eap_radius_la_LINK = $(LIBTOOL) --tag=CC \
$(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \
- $(AM_CFLAGS) $(CFLAGS) $(libstrongswan_eapradius_la_LDFLAGS) \
+ $(AM_CFLAGS) $(CFLAGS) $(libstrongswan_eap_radius_la_LDFLAGS) \
$(LDFLAGS) -o $@
DEFAULT_INCLUDES = -I.@am__isrc@
depcomp = $(SHELL) $(top_srcdir)/depcomp
am__depfiles_maybe = depfiles
+am__mv = mv -f
COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
LTCOMPILE = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
@@ -70,8 +95,8 @@ CCLD = $(CC)
LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
--mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) $(AM_LDFLAGS) \
$(LDFLAGS) -o $@
-SOURCES = $(libstrongswan_eapradius_la_SOURCES)
-DIST_SOURCES = $(libstrongswan_eapradius_la_SOURCES)
+SOURCES = $(libstrongswan_eap_radius_la_SOURCES)
+DIST_SOURCES = $(libstrongswan_eap_radius_la_SOURCES)
ETAGS = etags
CTAGS = ctags
DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
@@ -108,25 +133,22 @@ INSTALL_DATA = @INSTALL_DATA@
INSTALL_PROGRAM = @INSTALL_PROGRAM@
INSTALL_SCRIPT = @INSTALL_SCRIPT@
INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
-IPSEC_ROUTING_TABLE = @IPSEC_ROUTING_TABLE@
-IPSEC_ROUTING_TABLE_PRIO = @IPSEC_ROUTING_TABLE_PRIO@
LD = @LD@
LDFLAGS = @LDFLAGS@
LEX = @LEX@
LEXLIB = @LEXLIB@
LEX_OUTPUT_ROOT = @LEX_OUTPUT_ROOT@
-LIBGCRYPT_CFLAGS = @LIBGCRYPT_CFLAGS@
-LIBGCRYPT_CONFIG = @LIBGCRYPT_CONFIG@
-LIBGCRYPT_LIBS = @LIBGCRYPT_LIBS@
LIBOBJS = @LIBOBJS@
LIBS = @LIBS@
LIBTOOL = @LIBTOOL@
-LINUX_HEADERS = @LINUX_HEADERS@
LIPO = @LIPO@
LN_S = @LN_S@
LTLIBOBJS = @LTLIBOBJS@
MAKEINFO = @MAKEINFO@
MKDIR_P = @MKDIR_P@
+MYSQLCFLAG = @MYSQLCFLAG@
+MYSQLCONFIG = @MYSQLCONFIG@
+MYSQLLIB = @MYSQLLIB@
NM = @NM@
NMEDIT = @NMEDIT@
OBJDUMP = @OBJDUMP@
@@ -138,11 +160,14 @@ PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
PACKAGE_NAME = @PACKAGE_NAME@
PACKAGE_STRING = @PACKAGE_STRING@
PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_URL = @PACKAGE_URL@
PACKAGE_VERSION = @PACKAGE_VERSION@
PATH_SEPARATOR = @PATH_SEPARATOR@
PERL = @PERL@
PKG_CONFIG = @PKG_CONFIG@
+PTHREADLIB = @PTHREADLIB@
RANLIB = @RANLIB@
+RTLIB = @RTLIB@
RUBY = @RUBY@
RUBYINCLUDE = @RUBYINCLUDE@
SED = @SED@
@@ -171,9 +196,9 @@ build_cpu = @build_cpu@
build_os = @build_os@
build_vendor = @build_vendor@
builddir = @builddir@
-confdir = @confdir@
datadir = @datadir@
datarootdir = @datarootdir@
+default_pkcs11 = @default_pkcs11@
docdir = @docdir@
dvidir = @dvidir@
exec_prefix = @exec_prefix@
@@ -196,7 +221,7 @@ ipsecuser = @ipsecuser@
libdir = @libdir@
libexecdir = @libexecdir@
libstrongswan_plugins = @libstrongswan_plugins@
-linuxdir = @linuxdir@
+linux_headers = @linux_headers@
localedir = @localedir@
localstatedir = @localstatedir@
lt_ECHO = @lt_ECHO@
@@ -204,6 +229,7 @@ mandir = @mandir@
mkdir_p = @mkdir_p@
nm_CFLAGS = @nm_CFLAGS@
nm_LIBS = @nm_LIBS@
+nm_ca_dir = @nm_ca_dir@
oldincludedir = @oldincludedir@
pdfdir = @pdfdir@
piddir = @piddir@
@@ -212,10 +238,12 @@ pluto_plugins = @pluto_plugins@
prefix = @prefix@
program_transform_name = @program_transform_name@
psdir = @psdir@
+random_device = @random_device@
resolv_conf = @resolv_conf@
+routing_table = @routing_table@
+routing_table_prio = @routing_table_prio@
sbindir = @sbindir@
sharedstatedir = @sharedstatedir@
-simreader = @simreader@
srcdir = @srcdir@
strongswan_conf = @strongswan_conf@
sysconfdir = @sysconfdir@
@@ -223,18 +251,19 @@ target_alias = @target_alias@
top_build_prefix = @top_build_prefix@
top_builddir = @top_builddir@
top_srcdir = @top_srcdir@
+urandom_device = @urandom_device@
xml_CFLAGS = @xml_CFLAGS@
xml_LIBS = @xml_LIBS@
INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
AM_CFLAGS = -rdynamic
-plugin_LTLIBRARIES = libstrongswan-eapradius.la
-libstrongswan_eapradius_la_SOURCES = \
+plugin_LTLIBRARIES = libstrongswan-eap-radius.la
+libstrongswan_eap_radius_la_SOURCES = \
eap_radius_plugin.h eap_radius_plugin.c \
eap_radius.h eap_radius.c \
radius_client.h radius_client.c \
radius_message.h radius_message.c
-libstrongswan_eapradius_la_LDFLAGS = -module -avoid-version
+libstrongswan_eap_radius_la_LDFLAGS = -module -avoid-version
all: all-am
.SUFFIXES:
@@ -248,9 +277,9 @@ $(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps)
exit 1;; \
esac; \
done; \
- echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/charon/plugins/eap_radius/Makefile'; \
- cd $(top_srcdir) && \
- $(AUTOMAKE) --gnu src/charon/plugins/eap_radius/Makefile
+ echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/charon/plugins/eap_radius/Makefile'; \
+ $(am__cd) $(top_srcdir) && \
+ $(AUTOMAKE) --gnu src/charon/plugins/eap_radius/Makefile
.PRECIOUS: Makefile
Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
@case '$?' in \
@@ -268,23 +297,28 @@ $(top_srcdir)/configure: $(am__configure_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
$(ACLOCAL_M4): $(am__aclocal_m4_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(am__aclocal_m4_deps):
install-pluginLTLIBRARIES: $(plugin_LTLIBRARIES)
@$(NORMAL_INSTALL)
test -z "$(plugindir)" || $(MKDIR_P) "$(DESTDIR)$(plugindir)"
- @list='$(plugin_LTLIBRARIES)'; for p in $$list; do \
+ @list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+ list2=; for p in $$list; do \
if test -f $$p; then \
- f=$(am__strip_dir) \
- echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(pluginLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) '$$p' '$(DESTDIR)$(plugindir)/$$f'"; \
- $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(pluginLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) "$$p" "$(DESTDIR)$(plugindir)/$$f"; \
+ list2="$$list2 $$p"; \
else :; fi; \
- done
+ done; \
+ test -z "$$list2" || { \
+ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(plugindir)'"; \
+ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(plugindir)"; \
+ }
uninstall-pluginLTLIBRARIES:
@$(NORMAL_UNINSTALL)
- @list='$(plugin_LTLIBRARIES)'; for p in $$list; do \
- p=$(am__strip_dir) \
- echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$p'"; \
- $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$p"; \
+ @list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+ for p in $$list; do \
+ $(am__strip_dir) \
+ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$f'"; \
+ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$f"; \
done
clean-pluginLTLIBRARIES:
@@ -295,8 +329,8 @@ clean-pluginLTLIBRARIES:
echo "rm -f \"$${dir}/so_locations\""; \
rm -f "$${dir}/so_locations"; \
done
-libstrongswan-eapradius.la: $(libstrongswan_eapradius_la_OBJECTS) $(libstrongswan_eapradius_la_DEPENDENCIES)
- $(libstrongswan_eapradius_la_LINK) -rpath $(plugindir) $(libstrongswan_eapradius_la_OBJECTS) $(libstrongswan_eapradius_la_LIBADD) $(LIBS)
+libstrongswan-eap-radius.la: $(libstrongswan_eap_radius_la_OBJECTS) $(libstrongswan_eap_radius_la_DEPENDENCIES)
+ $(libstrongswan_eap_radius_la_LINK) -rpath $(plugindir) $(libstrongswan_eap_radius_la_OBJECTS) $(libstrongswan_eap_radius_la_LIBADD) $(LIBS)
mostlyclean-compile:
-rm -f *.$(OBJEXT)
@@ -311,21 +345,21 @@ distclean-compile:
.c.o:
@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(COMPILE) -c $<
.c.obj:
@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(COMPILE) -c `$(CYGPATH_W) '$<'`
.c.lo:
@am__fastdepCC_TRUE@ $(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(LTCOMPILE) -c -o $@ $<
@@ -348,7 +382,7 @@ tags: TAGS
TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
$(TAGS_FILES) $(LISP)
- tags=; \
+ set x; \
here=`pwd`; \
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
unique=`for i in $$list; do \
@@ -356,29 +390,34 @@ TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
- if test -z "$(ETAGS_ARGS)$$tags$$unique"; then :; else \
+ shift; \
+ if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
test -n "$$unique" || unique=$$empty_fix; \
- $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
- $$tags $$unique; \
+ if test $$# -gt 0; then \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ "$$@" $$unique; \
+ else \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ $$unique; \
+ fi; \
fi
ctags: CTAGS
CTAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
$(TAGS_FILES) $(LISP)
- tags=; \
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
unique=`for i in $$list; do \
if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
- test -z "$(CTAGS_ARGS)$$tags$$unique" \
+ test -z "$(CTAGS_ARGS)$$unique" \
|| $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
- $$tags $$unique
+ $$unique
GTAGS:
here=`$(am__cd) $(top_builddir) && pwd` \
- && cd $(top_srcdir) \
- && gtags -i $(GTAGS_ARGS) $$here
+ && $(am__cd) $(top_srcdir) \
+ && gtags -i $(GTAGS_ARGS) "$$here"
distclean-tags:
-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
@@ -399,13 +438,17 @@ distdir: $(DISTFILES)
if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
if test -d $$d/$$file; then \
dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
+ if test -d "$(distdir)/$$file"; then \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+ fi; \
if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
- cp -pR $(srcdir)/$$file $(distdir)$$dir || exit 1; \
+ cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
fi; \
- cp -pR $$d/$$file $(distdir)$$dir || exit 1; \
+ cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
else \
- test -f $(distdir)/$$file \
- || cp -p $$d/$$file $(distdir)/$$file \
+ test -f "$(distdir)/$$file" \
+ || cp -p $$d/$$file "$(distdir)/$$file" \
|| exit 1; \
fi; \
done
@@ -436,6 +479,7 @@ clean-generic:
distclean-generic:
-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+ -test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
maintainer-clean-generic:
@echo "This command is intended for maintainers to use"
@@ -457,6 +501,8 @@ dvi-am:
html: html-am
+html-am:
+
info: info-am
info-am:
@@ -465,18 +511,28 @@ install-data-am: install-pluginLTLIBRARIES
install-dvi: install-dvi-am
+install-dvi-am:
+
install-exec-am:
install-html: install-html-am
+install-html-am:
+
install-info: install-info-am
+install-info-am:
+
install-man:
install-pdf: install-pdf-am
+install-pdf-am:
+
install-ps: install-ps-am
+install-ps-am:
+
installcheck-am:
maintainer-clean: maintainer-clean-am
@@ -515,6 +571,7 @@ uninstall-am: uninstall-pluginLTLIBRARIES
mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \
tags uninstall uninstall-am uninstall-pluginLTLIBRARIES
+
# Tell versions [3.59,3.63) of GNU make to not export all variables.
# Otherwise a system limit (for SysV at least) may be exceeded.
.NOEXPORT:
diff --git a/src/charon/plugins/eap_radius/eap_radius.c b/src/charon/plugins/eap_radius/eap_radius.c
index deb3b648b..f041fda54 100644
--- a/src/charon/plugins/eap_radius/eap_radius.c
+++ b/src/charon/plugins/eap_radius/eap_radius.c
@@ -12,7 +12,7 @@
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
-
+
#include "eap_radius.h"
#include "radius_message.h"
@@ -26,47 +26,47 @@ typedef struct private_eap_radius_t private_eap_radius_t;
* Private data of an eap_radius_t object.
*/
struct private_eap_radius_t {
-
+
/**
* Public authenticator_t interface.
*/
eap_radius_t public;
-
+
/**
* ID of the server
*/
identification_t *server;
-
+
/**
* ID of the peer
*/
identification_t *peer;
-
+
/**
* EAP method type we are proxying
*/
eap_type_t type;
-
+
/**
* EAP vendor, if any
*/
u_int32_t vendor;
-
+
/**
* EAP MSK, if method established one
*/
chunk_t msk;
-
+
/**
* RADIUS client instance
*/
radius_client_t *client;
-
+
/**
* TRUE to use EAP-Start, FALSE to send EAP-Identity Response directly
*/
bool eap_start;
-
+
/**
* Prefix to prepend to EAP identity
*/
@@ -93,11 +93,11 @@ static void add_eap_identity(private_eap_radius_t *this,
} __attribute__((__packed__)) *hdr;
chunk_t id, prefix;
size_t len;
-
+
id = this->peer->get_encoding(this->peer);
prefix = chunk_create(this->id_prefix, strlen(this->id_prefix));
len = sizeof(*hdr) + prefix.len + id.len;
-
+
hdr = alloca(len);
hdr->code = EAP_RESPONSE;
hdr->identifier = 0;
@@ -105,7 +105,7 @@ static void add_eap_identity(private_eap_radius_t *this,
hdr->type = EAP_IDENTITY;
memcpy(hdr->data, prefix.ptr, prefix.len);
memcpy(hdr->data + prefix.len, id.ptr, id.len);
-
+
request->add(request, RAT_EAP_MESSAGE, chunk_create((u_char*)hdr, len));
}
@@ -117,22 +117,26 @@ static bool radius2ike(private_eap_radius_t *this,
{
enumerator_t *enumerator;
eap_payload_t *payload;
- chunk_t data;
+ chunk_t data, message = chunk_empty;
int type;
-
+
enumerator = msg->create_enumerator(msg);
while (enumerator->enumerate(enumerator, &type, &data))
{
- if (type == RAT_EAP_MESSAGE)
+ if (type == RAT_EAP_MESSAGE && data.len)
{
- *out = payload = eap_payload_create_data(data);
- /* apply EAP method selected by RADIUS server */
- this->type = payload->get_type(payload, &this->vendor);
- enumerator->destroy(enumerator);
- return TRUE;
+ message = chunk_cat("mc", message, data);
}
}
enumerator->destroy(enumerator);
+ if (message.len)
+ {
+ *out = payload = eap_payload_create_data(message);
+ free(message.ptr);
+ /* apply EAP method selected by RADIUS server */
+ this->type = payload->get_type(payload, &this->vendor);
+ return TRUE;
+ }
return FALSE;
}
@@ -144,12 +148,12 @@ static status_t initiate(private_eap_radius_t *this, eap_payload_t **out)
radius_message_t *request, *response;
status_t status = FAILED;
chunk_t username;
-
+
request = radius_message_create_request();
username = chunk_create(this->id_prefix, strlen(this->id_prefix));
username = chunk_cata("cc", username, this->peer->get_encoding(this->peer));
request->add(request, RAT_USER_NAME, username);
-
+
if (this->eap_start)
{
request->add(request, RAT_EAP_MESSAGE, chunk_empty);
@@ -158,7 +162,7 @@ static status_t initiate(private_eap_radius_t *this, eap_payload_t **out)
{
add_eap_identity(this, request);
}
-
+
response = this->client->request(this->client, request);
if (response)
{
@@ -180,11 +184,19 @@ static status_t process(private_eap_radius_t *this,
{
radius_message_t *request, *response;
status_t status = FAILED;
-
+ chunk_t data;
+
request = radius_message_create_request();
request->add(request, RAT_USER_NAME, this->peer->get_encoding(this->peer));
- request->add(request, RAT_EAP_MESSAGE, in->get_data(in));
-
+ data = in->get_data(in);
+ /* fragment data suitable for RADIUS (not more than 253 bytes) */
+ while (data.len > 253)
+ {
+ request->add(request, RAT_EAP_MESSAGE, chunk_create(data.ptr, 253));
+ data = chunk_skip(data, 253);
+ }
+ request->add(request, RAT_EAP_MESSAGE, data);
+
response = this->client->request(this->client, request);
if (response)
{
@@ -271,14 +283,14 @@ static void destroy(private_eap_radius_t *this)
eap_radius_t *eap_radius_create(identification_t *server, identification_t *peer)
{
private_eap_radius_t *this = malloc_thing(private_eap_radius_t);
-
+
this->public.eap_method_interface.initiate = (status_t(*)(eap_method_t*,eap_payload_t**))initiate;
this->public.eap_method_interface.process = (status_t(*)(eap_method_t*,eap_payload_t*,eap_payload_t**))process;
this->public.eap_method_interface.get_type = (eap_type_t(*)(eap_method_t*,u_int32_t*))get_type;
this->public.eap_method_interface.is_mutual = (bool(*)(eap_method_t*))is_mutual;
this->public.eap_method_interface.get_msk = (status_t(*)(eap_method_t*,chunk_t*))get_msk;
this->public.eap_method_interface.destroy = (void(*)(eap_method_t*))destroy;
-
+
this->client = radius_client_create();
if (!this->client)
{
@@ -291,10 +303,10 @@ eap_radius_t *eap_radius_create(identification_t *server, identification_t *peer
this->type = EAP_RADIUS;
this->vendor = 0;
this->msk = chunk_empty;
- this->eap_start = lib->settings->get_bool(lib->settings,
- "charon.plugins.eap_radius.eap_start", FALSE);
+ this->eap_start = lib->settings->get_bool(lib->settings,
+ "charon.plugins.eap-radius.eap_start", FALSE);
this->id_prefix = lib->settings->get_str(lib->settings,
- "charon.plugins.eap_radius.id_prefix", "");
+ "charon.plugins.eap-radius.id_prefix", "");
return &this->public;
}
diff --git a/src/charon/plugins/eap_radius/eap_radius_plugin.c b/src/charon/plugins/eap_radius/eap_radius_plugin.c
index 7c6a3c9ff..51e6a69c8 100644
--- a/src/charon/plugins/eap_radius/eap_radius_plugin.c
+++ b/src/charon/plugins/eap_radius/eap_radius_plugin.c
@@ -36,19 +36,19 @@ static void destroy(eap_radius_plugin_t *this)
plugin_t *plugin_create()
{
eap_radius_plugin_t *this;
-
+
if (!radius_client_init())
{
DBG1(DBG_CFG, "RADIUS plugin initialization failed");
return NULL;
}
-
+
this = malloc_thing(eap_radius_plugin_t);
this->plugin.destroy = (void(*)(plugin_t*))destroy;
-
+
charon->eap->add_method(charon->eap, EAP_RADIUS, 0,
EAP_SERVER, (eap_constructor_t)eap_radius_create);
-
+
return &this->plugin;
}
diff --git a/src/charon/plugins/eap_radius/radius_client.c b/src/charon/plugins/eap_radius/radius_client.c
index de1bafc6d..1d1f21742 100644
--- a/src/charon/plugins/eap_radius/radius_client.c
+++ b/src/charon/plugins/eap_radius/radius_client.c
@@ -21,7 +21,8 @@
#include <daemon.h>
#include <utils/host.h>
#include <utils/linked_list.h>
-#include <utils/mutex.h>
+#include <threading/condvar.h>
+#include <threading/mutex.h>
/**
* Default RADIUS server port, when not configured
@@ -63,12 +64,12 @@ struct entry_t {
* Private data of an radius_client_t object.
*/
struct private_radius_client_t {
-
+
/**
* Public radius_client_t interface.
*/
radius_client_t public;
-
+
/**
* RADIUS servers State attribute
*/
@@ -106,7 +107,7 @@ static chunk_t nas_identifier;
void radius_client_cleanup()
{
entry_t *entry;
-
+
mutex->destroy(mutex);
condvar->destroy(condvar);
while (sockets->remove_last(sockets, (void**)&entry) == SUCCESS)
@@ -130,13 +131,13 @@ bool radius_client_init()
entry_t *entry;
host_t *host;
char *server;
-
+
nas_identifier.ptr = lib->settings->get_str(lib->settings,
- "charon.plugins.eap_radius.nas_identifier", "strongSwan");
+ "charon.plugins.eap-radius.nas_identifier", "strongSwan");
nas_identifier.len = strlen(nas_identifier.ptr);
-
+
secret.ptr = lib->settings->get_str(lib->settings,
- "charon.plugins.eap_radius.secret", NULL);
+ "charon.plugins.eap-radius.secret", NULL);
if (!secret.ptr)
{
DBG1(DBG_CFG, "no RADUIS secret defined");
@@ -144,22 +145,22 @@ bool radius_client_init()
}
secret.len = strlen(secret.ptr);
server = lib->settings->get_str(lib->settings,
- "charon.plugins.eap_radius.server", NULL);
+ "charon.plugins.eap-radius.server", NULL);
if (!server)
{
DBG1(DBG_CFG, "no RADUIS server defined");
return FALSE;
}
port = lib->settings->get_int(lib->settings,
- "charon.plugins.eap_radius.port", RADIUS_PORT);
+ "charon.plugins.eap-radius.port", RADIUS_PORT);
host = host_create_from_dns(server, 0, port);
if (!host)
{
return FALSE;
}
count = lib->settings->get_int(lib->settings,
- "charon.plugins.eap_radius.sockets", 1);
-
+ "charon.plugins.eap-radius.sockets", 1);
+
sockets = linked_list_create();
mutex = mutex_create(MUTEX_TYPE_DEFAULT);
condvar = condvar_create(CONDVAR_TYPE_DEFAULT);
@@ -214,7 +215,7 @@ bool radius_client_init()
static entry_t* get_socket()
{
entry_t *entry;
-
+
mutex->lock(mutex);
while (sockets->remove_first(sockets, (void**)&entry) != SUCCESS)
{
@@ -243,7 +244,7 @@ static void save_state(private_radius_client_t *this, radius_message_t *msg)
enumerator_t *enumerator;
int type;
chunk_t data;
-
+
enumerator = msg->create_enumerator(msg);
while (enumerator->enumerate(enumerator, &type, &data))
{
@@ -270,9 +271,9 @@ static radius_message_t* request(private_radius_client_t *this,
entry_t *socket;
chunk_t data;
int i;
-
+
socket = get_socket();
-
+
/* set Message Identifier */
req->set_identifier(req, socket->identifier++);
/* we add the "Virtual" NAS-Port-Type, as we SHOULD include one */
@@ -286,7 +287,7 @@ static radius_message_t* request(private_radius_client_t *this,
}
/* sign the request */
req->sign(req, socket->rng, socket->signer);
-
+
data = req->get_encoding(req);
/* timeout after 2, 3, 4, 5 seconds */
for (i = 2; i <= 5; i++)
@@ -294,10 +295,10 @@ static radius_message_t* request(private_radius_client_t *this,
radius_message_t *response;
bool retransmit = FALSE;
struct timeval tv;
- char buf[1024];
+ char buf[4096];
fd_set fds;
int res;
-
+
if (send(socket->fd, data.ptr, data.len, 0) != data.len)
{
DBG1(DBG_CFG, "sending RADIUS message failed: %s", strerror(errno));
@@ -306,7 +307,7 @@ static radius_message_t* request(private_radius_client_t *this,
}
tv.tv_sec = i;
tv.tv_usec = 0;
-
+
while (TRUE)
{
FD_ZERO(&fds);
@@ -334,7 +335,7 @@ static radius_message_t* request(private_radius_client_t *this,
}
response = radius_message_parse_response(chunk_create(buf, res));
if (response)
- {
+ {
if (response->verify(response, req->get_authenticator(req),
secret, socket->hasher, socket->signer))
{
@@ -366,7 +367,7 @@ static chunk_t decrypt_mppe_key(private_radius_client_t *this, u_int16_t salt,
chunk_t A, R, P, seed;
u_char *c, *p;
hasher_t *hasher;
-
+
/**
* From RFC2548 (encryption):
* b(1) = MD5(S + R + A) c(1) = p(1) xor b(1) C = c(1)
@@ -374,42 +375,42 @@ static chunk_t decrypt_mppe_key(private_radius_client_t *this, u_int16_t salt,
* . . .
* b(i) = MD5(S + c(i-1)) c(i) = p(i) xor b(i) C = C + c(i)
*/
-
+
if (C.len % HASH_SIZE_MD5 || C.len < HASH_SIZE_MD5)
{
return chunk_empty;
}
-
+
hasher = lib->crypto->create_hasher(lib->crypto, HASH_MD5);
if (!hasher)
{
return chunk_empty;
}
-
+
A = chunk_create((u_char*)&salt, sizeof(salt));
R = chunk_create(request->get_authenticator(request), HASH_SIZE_MD5);
P = chunk_alloca(C.len);
p = P.ptr;
c = C.ptr;
-
+
seed = chunk_cata("cc", R, A);
-
+
while (c < C.ptr + C.len)
{
/* b(i) = MD5(S + c(i-1)) */
hasher->get_hash(hasher, secret, NULL);
hasher->get_hash(hasher, seed, p);
-
+
/* p(i) = b(i) xor c(1) */
memxor(p, c, HASH_SIZE_MD5);
-
+
/* prepare next round */
seed = chunk_create(c, HASH_SIZE_MD5);
c += HASH_SIZE_MD5;
p += HASH_SIZE_MD5;
}
hasher->destroy(hasher);
-
+
/* remove truncation, first byte is key length */
if (*P.ptr >= P.len)
{ /* decryption failed? */
@@ -434,7 +435,7 @@ static chunk_t decrypt_msk(private_radius_client_t *this,
enumerator_t *enumerator;
chunk_t data, send = chunk_empty, recv = chunk_empty;
int type;
-
+
enumerator = response->create_enumerator(response);
while (enumerator->enumerate(enumerator, &type, &data))
{
@@ -482,13 +483,13 @@ static void destroy(private_radius_client_t *this)
radius_client_t *radius_client_create()
{
private_radius_client_t *this = malloc_thing(private_radius_client_t);
-
+
this->public.request = (radius_message_t*(*)(radius_client_t*, radius_message_t *msg))request;
this->public.decrypt_msk = (chunk_t(*)(radius_client_t*, radius_message_t *, radius_message_t *))decrypt_msk;
this->public.destroy = (void(*)(radius_client_t*))destroy;
-
+
this->state = chunk_empty;
-
+
return &this->public;
}
diff --git a/src/charon/plugins/eap_radius/radius_client.h b/src/charon/plugins/eap_radius/radius_client.h
index 889861a16..77ba94807 100644
--- a/src/charon/plugins/eap_radius/radius_client.h
+++ b/src/charon/plugins/eap_radius/radius_client.h
@@ -33,11 +33,11 @@ typedef struct radius_client_t radius_client_t;
* a socket during request() and releases it afterwards.
*/
struct radius_client_t {
-
+
/**
* Send a RADIUS request and wait for the response.
*
- * The client fills in RADIUS Message identifier, NAS-Identifier,
+ * The client fills in RADIUS Message identifier, NAS-Identifier,
* NAS-Port-Type, builds a Request-Authenticator and calculates the
* Message-Authenticator attribute.
* The received response gets verified using the Response-Identifier
@@ -47,7 +47,7 @@ struct radius_client_t {
* @return response, NULL if timed out/verification failed
*/
radius_message_t* (*request)(radius_client_t *this, radius_message_t *msg);
-
+
/**
* Decrypt the MSK encoded in a messages MS-MPPE-Send/Recv-Key.
*
@@ -57,7 +57,7 @@ struct radius_client_t {
*/
chunk_t (*decrypt_msk)(radius_client_t *this, radius_message_t *response,
radius_message_t *request);
-
+
/**
* Destroy the client, release the socket.
*/
diff --git a/src/charon/plugins/eap_radius/radius_message.c b/src/charon/plugins/eap_radius/radius_message.c
index 59a639f31..11a1d8dfc 100644
--- a/src/charon/plugins/eap_radius/radius_message.c
+++ b/src/charon/plugins/eap_radius/radius_message.c
@@ -54,12 +54,12 @@ struct rattr_t {
* Private data of an radius_message_t object.
*/
struct private_radius_message_t {
-
+
/**
* Public radius_message_t interface.
*/
radius_message_t public;
-
+
/**
* message data, allocated
*/
@@ -247,12 +247,12 @@ static bool attribute_enumerate(attribute_enumerator_t *this,
static enumerator_t* create_enumerator(private_radius_message_t *this)
{
attribute_enumerator_t *e;
-
+
if (ntohs(this->msg->length) < sizeof(rmsg_t) + sizeof(rattr_t))
{
return enumerator_create_empty();
}
-
+
e = malloc_thing(attribute_enumerator_t);
e->public.enumerate = (void*)attribute_enumerate;
e->public.destroy = (void*)free;
@@ -268,7 +268,8 @@ static void add(private_radius_message_t *this, radius_attribute_type_t type,
chunk_t data)
{
rattr_t *attribute;
-
+
+ data.len = min(data.len, 253);
this->msg = realloc(this->msg,
ntohs(this->msg->length) + sizeof(rattr_t) + data.len);
attribute = ((void*)this->msg) + ntohs(this->msg->length);
@@ -284,10 +285,10 @@ static void add(private_radius_message_t *this, radius_attribute_type_t type,
static void sign(private_radius_message_t *this, rng_t *rng, signer_t *signer)
{
char buf[HASH_SIZE_MD5];
-
+
/* build Request-Authenticator */
rng->get_bytes(rng, HASH_SIZE_MD5, this->msg->authenticator);
-
+
/* build Message-Authenticator attribute, using 16 null bytes */
memset(buf, 0, sizeof(buf));
add(this, RAT_MESSAGE_AUTHENTICATOR, chunk_create(buf, sizeof(buf)));
@@ -307,12 +308,12 @@ static bool verify(private_radius_message_t *this, u_int8_t *req_auth,
int type;
chunk_t data, msg;
bool has_eap = FALSE, has_auth = FALSE;
-
+
/* replace Response by Request Authenticator for verification */
memcpy(res_auth, this->msg->authenticator, HASH_SIZE_MD5);
memcpy(this->msg->authenticator, req_auth, HASH_SIZE_MD5);
msg = chunk_create((u_char*)this->msg, ntohs(this->msg->length));
-
+
/* verify Response-Authenticator */
hasher->get_hash(hasher, msg, NULL);
hasher->get_hash(hasher, secret, buf);
@@ -321,7 +322,7 @@ static bool verify(private_radius_message_t *this, u_int8_t *req_auth,
DBG1(DBG_CFG, "RADIUS Response-Authenticator verification failed");
return FALSE;
}
-
+
/* verify Message-Authenticator attribute */
enumerator = create_enumerator(this);
while (enumerator->enumerate(enumerator, &type, &data))
@@ -359,7 +360,7 @@ static bool verify(private_radius_message_t *this, u_int8_t *req_auth,
enumerator->destroy(enumerator);
/* restore Response-Authenticator */
memcpy(this->msg->authenticator, res_auth, HASH_SIZE_MD5);
-
+
if (has_eap && !has_auth)
{ /* Message-Authenticator is required if we have an EAP-Message */
DBG1(DBG_CFG, "RADIUS Message-Authenticator attribute missing");
@@ -424,7 +425,7 @@ static void destroy(private_radius_message_t *this)
static private_radius_message_t *radius_message_create()
{
private_radius_message_t *this = malloc_thing(private_radius_message_t);
-
+
this->public.create_enumerator = (enumerator_t*(*)(radius_message_t*))create_enumerator;
this->public.add = (void(*)(radius_message_t*, radius_attribute_type_t,chunk_t))add;
this->public.get_code = (radius_message_code_t(*)(radius_message_t*))get_code;
@@ -435,7 +436,7 @@ static private_radius_message_t *radius_message_create()
this->public.sign = (void(*)(radius_message_t*, rng_t *rng, signer_t *signer))sign;
this->public.verify = (bool(*)(radius_message_t*, u_int8_t *req_auth, chunk_t secret, hasher_t *hasher, signer_t *signer))verify;
this->public.destroy = (void(*)(radius_message_t*))destroy;
-
+
return this;
}
@@ -445,12 +446,12 @@ static private_radius_message_t *radius_message_create()
radius_message_t *radius_message_create_request()
{
private_radius_message_t *this = radius_message_create();
-
+
this->msg = malloc_thing(rmsg_t);
this->msg->code = RMC_ACCESS_REQUEST;
this->msg->identifier = 0;
this->msg->length = htons(sizeof(rmsg_t));
-
+
return &this->public;
}
@@ -460,7 +461,7 @@ radius_message_t *radius_message_create_request()
radius_message_t *radius_message_parse_response(chunk_t data)
{
private_radius_message_t *this = radius_message_create();
-
+
this->msg = malloc(data.len);
memcpy(this->msg, data.ptr, data.len);
if (data.len < sizeof(rmsg_t) ||
diff --git a/src/charon/plugins/eap_radius/radius_message.h b/src/charon/plugins/eap_radius/radius_message.h
index d4eec8590..266839d3b 100644
--- a/src/charon/plugins/eap_radius/radius_message.h
+++ b/src/charon/plugins/eap_radius/radius_message.h
@@ -181,14 +181,14 @@ extern enum_name_t *radius_attribute_type_names;
* A RADIUS message, contains attributes.
*/
struct radius_message_t {
-
+
/**
* Create an enumerator over contained RADIUS attributes.
*
* @return enumerator over (int type, chunk_t data)
*/
enumerator_t* (*create_enumerator)(radius_message_t *this);
-
+
/**
* Add a RADIUS attribute to the message.
*
@@ -197,42 +197,42 @@ struct radius_message_t {
*/
void (*add)(radius_message_t *this, radius_attribute_type_t type,
chunk_t data);
-
+
/**
* Get the message type (code).
*
* @return message code
*/
radius_message_code_t (*get_code)(radius_message_t *this);
-
+
/**
* Get the message identifier.
*
* @return message identifier
*/
u_int8_t (*get_identifier)(radius_message_t *this);
-
+
/**
* Set the message identifier.
*
* @param identifier message identifier
*/
void (*set_identifier)(radius_message_t *this, u_int8_t identifier);
-
+
/**
* Get the 16 byte authenticator.
*
* @return pointer to the Authenticator field
*/
u_int8_t* (*get_authenticator)(radius_message_t *this);
-
+
/**
* Get the RADIUS message in its encoded form.
*
* @return chunk pointing to internal RADIUS message.
*/
chunk_t (*get_encoding)(radius_message_t *this);
-
+
/**
* Calculate and add the Message-Authenticator attribute to the message.
*
@@ -240,7 +240,7 @@ struct radius_message_t {
* @param signer HMAC-MD5 signer with secret set
*/
void (*sign)(radius_message_t *this, rng_t *rng, signer_t *signer);
-
+
/**
* Verify the integrity of a received RADIUS response.
*
@@ -251,7 +251,7 @@ struct radius_message_t {
*/
bool (*verify)(radius_message_t *this, u_int8_t *req_auth, chunk_t secret,
hasher_t *hasher, signer_t *signer);
-
+
/**
* Destroy the message.
*/
diff --git a/src/charon/plugins/eap_sim/Makefile.am b/src/charon/plugins/eap_sim/Makefile.am
index e503bddab..74b9bb4e8 100644
--- a/src/charon/plugins/eap_sim/Makefile.am
+++ b/src/charon/plugins/eap_sim/Makefile.am
@@ -1,11 +1,14 @@
-INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
+INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon \
+ -I$(top_srcdir)/src/libsimaka
-AM_CFLAGS = -rdynamic -DIPSEC_CONFDIR=\"${confdir}\" -DSIM_READER_LIB=\"${simreader}\"
+AM_CFLAGS = -rdynamic
-plugin_LTLIBRARIES = libstrongswan-eapsim.la
+plugin_LTLIBRARIES = libstrongswan-eap-sim.la
-libstrongswan_eapsim_la_SOURCES = eap_sim.h eap_sim.c \
- eap_sim_plugin.h eap_sim_plugin.c
-libstrongswan_eapsim_la_LDFLAGS = -module -avoid-version
+libstrongswan_eap_sim_la_SOURCES = eap_sim_plugin.h eap_sim_plugin.c \
+ eap_sim_peer.h eap_sim_peer.c \
+ eap_sim_server.h eap_sim_server.c
+libstrongswan_eap_sim_la_LIBADD = $(top_builddir)/src/libsimaka/libsimaka.la
+libstrongswan_eap_sim_la_LDFLAGS = -module -avoid-version
diff --git a/src/charon/plugins/eap_sim/Makefile.in b/src/charon/plugins/eap_sim/Makefile.in
index 8f6daacad..d9b568a42 100644
--- a/src/charon/plugins/eap_sim/Makefile.in
+++ b/src/charon/plugins/eap_sim/Makefile.in
@@ -1,8 +1,9 @@
-# Makefile.in generated by automake 1.10.2 from Makefile.am.
+# Makefile.in generated by automake 1.11 from Makefile.am.
# @configure_input@
# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,
-# 2003, 2004, 2005, 2006, 2007, 2008 Free Software Foundation, Inc.
+# 2003, 2004, 2005, 2006, 2007, 2008, 2009 Free Software Foundation,
+# Inc.
# This Makefile.in is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.
@@ -16,8 +17,9 @@
VPATH = @srcdir@
pkgdatadir = $(datadir)/@PACKAGE@
-pkglibdir = $(libdir)/@PACKAGE@
pkgincludedir = $(includedir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkglibexecdir = $(libexecdir)/@PACKAGE@
am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
install_sh_DATA = $(install_sh) -c -m 644
install_sh_PROGRAM = $(install_sh) -c
@@ -35,30 +37,55 @@ host_triplet = @host@
subdir = src/charon/plugins/eap_sim
DIST_COMMON = $(srcdir)/Makefile.am $(srcdir)/Makefile.in
ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
-am__aclocal_m4_deps = $(top_srcdir)/configure.in
+am__aclocal_m4_deps = $(top_srcdir)/m4/config/libtool.m4 \
+ $(top_srcdir)/m4/config/ltoptions.m4 \
+ $(top_srcdir)/m4/config/ltsugar.m4 \
+ $(top_srcdir)/m4/config/ltversion.m4 \
+ $(top_srcdir)/m4/config/lt~obsolete.m4 \
+ $(top_srcdir)/m4/macros/with.m4 \
+ $(top_srcdir)/m4/macros/enable-disable.m4 \
+ $(top_srcdir)/configure.in
am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
$(ACLOCAL_M4)
mkinstalldirs = $(install_sh) -d
CONFIG_CLEAN_FILES =
+CONFIG_CLEAN_VPATH_FILES =
am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
am__vpath_adj = case $$p in \
$(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
*) f=$$p;; \
esac;
-am__strip_dir = `echo $$p | sed -e 's|^.*/||'`;
+am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
+am__install_max = 40
+am__nobase_strip_setup = \
+ srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
+am__nobase_strip = \
+ for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
+am__nobase_list = $(am__nobase_strip_setup); \
+ for p in $$list; do echo "$$p $$p"; done | \
+ sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
+ $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
+ if (++n[$$2] == $(am__install_max)) \
+ { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
+ END { for (dir in files) print dir, files[dir] }'
+am__base_list = \
+ sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
+ sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
am__installdirs = "$(DESTDIR)$(plugindir)"
-pluginLTLIBRARIES_INSTALL = $(INSTALL)
LTLIBRARIES = $(plugin_LTLIBRARIES)
-libstrongswan_eapsim_la_LIBADD =
-am_libstrongswan_eapsim_la_OBJECTS = eap_sim.lo eap_sim_plugin.lo
-libstrongswan_eapsim_la_OBJECTS = \
- $(am_libstrongswan_eapsim_la_OBJECTS)
-libstrongswan_eapsim_la_LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) \
+libstrongswan_eap_sim_la_DEPENDENCIES = \
+ $(top_builddir)/src/libsimaka/libsimaka.la
+am_libstrongswan_eap_sim_la_OBJECTS = eap_sim_plugin.lo \
+ eap_sim_peer.lo eap_sim_server.lo
+libstrongswan_eap_sim_la_OBJECTS = \
+ $(am_libstrongswan_eap_sim_la_OBJECTS)
+libstrongswan_eap_sim_la_LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) \
$(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \
- $(libstrongswan_eapsim_la_LDFLAGS) $(LDFLAGS) -o $@
+ $(libstrongswan_eap_sim_la_LDFLAGS) $(LDFLAGS) -o $@
DEFAULT_INCLUDES = -I.@am__isrc@
depcomp = $(SHELL) $(top_srcdir)/depcomp
am__depfiles_maybe = depfiles
+am__mv = mv -f
COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
LTCOMPILE = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
@@ -68,8 +95,8 @@ CCLD = $(CC)
LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
--mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) $(AM_LDFLAGS) \
$(LDFLAGS) -o $@
-SOURCES = $(libstrongswan_eapsim_la_SOURCES)
-DIST_SOURCES = $(libstrongswan_eapsim_la_SOURCES)
+SOURCES = $(libstrongswan_eap_sim_la_SOURCES)
+DIST_SOURCES = $(libstrongswan_eap_sim_la_SOURCES)
ETAGS = etags
CTAGS = ctags
DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
@@ -106,25 +133,22 @@ INSTALL_DATA = @INSTALL_DATA@
INSTALL_PROGRAM = @INSTALL_PROGRAM@
INSTALL_SCRIPT = @INSTALL_SCRIPT@
INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
-IPSEC_ROUTING_TABLE = @IPSEC_ROUTING_TABLE@
-IPSEC_ROUTING_TABLE_PRIO = @IPSEC_ROUTING_TABLE_PRIO@
LD = @LD@
LDFLAGS = @LDFLAGS@
LEX = @LEX@
LEXLIB = @LEXLIB@
LEX_OUTPUT_ROOT = @LEX_OUTPUT_ROOT@
-LIBGCRYPT_CFLAGS = @LIBGCRYPT_CFLAGS@
-LIBGCRYPT_CONFIG = @LIBGCRYPT_CONFIG@
-LIBGCRYPT_LIBS = @LIBGCRYPT_LIBS@
LIBOBJS = @LIBOBJS@
LIBS = @LIBS@
LIBTOOL = @LIBTOOL@
-LINUX_HEADERS = @LINUX_HEADERS@
LIPO = @LIPO@
LN_S = @LN_S@
LTLIBOBJS = @LTLIBOBJS@
MAKEINFO = @MAKEINFO@
MKDIR_P = @MKDIR_P@
+MYSQLCFLAG = @MYSQLCFLAG@
+MYSQLCONFIG = @MYSQLCONFIG@
+MYSQLLIB = @MYSQLLIB@
NM = @NM@
NMEDIT = @NMEDIT@
OBJDUMP = @OBJDUMP@
@@ -136,11 +160,14 @@ PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
PACKAGE_NAME = @PACKAGE_NAME@
PACKAGE_STRING = @PACKAGE_STRING@
PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_URL = @PACKAGE_URL@
PACKAGE_VERSION = @PACKAGE_VERSION@
PATH_SEPARATOR = @PATH_SEPARATOR@
PERL = @PERL@
PKG_CONFIG = @PKG_CONFIG@
+PTHREADLIB = @PTHREADLIB@
RANLIB = @RANLIB@
+RTLIB = @RTLIB@
RUBY = @RUBY@
RUBYINCLUDE = @RUBYINCLUDE@
SED = @SED@
@@ -169,9 +196,9 @@ build_cpu = @build_cpu@
build_os = @build_os@
build_vendor = @build_vendor@
builddir = @builddir@
-confdir = @confdir@
datadir = @datadir@
datarootdir = @datarootdir@
+default_pkcs11 = @default_pkcs11@
docdir = @docdir@
dvidir = @dvidir@
exec_prefix = @exec_prefix@
@@ -194,7 +221,7 @@ ipsecuser = @ipsecuser@
libdir = @libdir@
libexecdir = @libexecdir@
libstrongswan_plugins = @libstrongswan_plugins@
-linuxdir = @linuxdir@
+linux_headers = @linux_headers@
localedir = @localedir@
localstatedir = @localstatedir@
lt_ECHO = @lt_ECHO@
@@ -202,6 +229,7 @@ mandir = @mandir@
mkdir_p = @mkdir_p@
nm_CFLAGS = @nm_CFLAGS@
nm_LIBS = @nm_LIBS@
+nm_ca_dir = @nm_ca_dir@
oldincludedir = @oldincludedir@
pdfdir = @pdfdir@
piddir = @piddir@
@@ -210,10 +238,12 @@ pluto_plugins = @pluto_plugins@
prefix = @prefix@
program_transform_name = @program_transform_name@
psdir = @psdir@
+random_device = @random_device@
resolv_conf = @resolv_conf@
+routing_table = @routing_table@
+routing_table_prio = @routing_table_prio@
sbindir = @sbindir@
sharedstatedir = @sharedstatedir@
-simreader = @simreader@
srcdir = @srcdir@
strongswan_conf = @strongswan_conf@
sysconfdir = @sysconfdir@
@@ -221,15 +251,20 @@ target_alias = @target_alias@
top_build_prefix = @top_build_prefix@
top_builddir = @top_builddir@
top_srcdir = @top_srcdir@
+urandom_device = @urandom_device@
xml_CFLAGS = @xml_CFLAGS@
xml_LIBS = @xml_LIBS@
-INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
-AM_CFLAGS = -rdynamic -DIPSEC_CONFDIR=\"${confdir}\" -DSIM_READER_LIB=\"${simreader}\"
-plugin_LTLIBRARIES = libstrongswan-eapsim.la
-libstrongswan_eapsim_la_SOURCES = eap_sim.h eap_sim.c \
- eap_sim_plugin.h eap_sim_plugin.c
+INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon \
+ -I$(top_srcdir)/src/libsimaka
+
+AM_CFLAGS = -rdynamic
+plugin_LTLIBRARIES = libstrongswan-eap-sim.la
+libstrongswan_eap_sim_la_SOURCES = eap_sim_plugin.h eap_sim_plugin.c \
+ eap_sim_peer.h eap_sim_peer.c \
+ eap_sim_server.h eap_sim_server.c
-libstrongswan_eapsim_la_LDFLAGS = -module -avoid-version
+libstrongswan_eap_sim_la_LIBADD = $(top_builddir)/src/libsimaka/libsimaka.la
+libstrongswan_eap_sim_la_LDFLAGS = -module -avoid-version
all: all-am
.SUFFIXES:
@@ -243,9 +278,9 @@ $(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps)
exit 1;; \
esac; \
done; \
- echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/charon/plugins/eap_sim/Makefile'; \
- cd $(top_srcdir) && \
- $(AUTOMAKE) --gnu src/charon/plugins/eap_sim/Makefile
+ echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/charon/plugins/eap_sim/Makefile'; \
+ $(am__cd) $(top_srcdir) && \
+ $(AUTOMAKE) --gnu src/charon/plugins/eap_sim/Makefile
.PRECIOUS: Makefile
Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
@case '$?' in \
@@ -263,23 +298,28 @@ $(top_srcdir)/configure: $(am__configure_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
$(ACLOCAL_M4): $(am__aclocal_m4_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(am__aclocal_m4_deps):
install-pluginLTLIBRARIES: $(plugin_LTLIBRARIES)
@$(NORMAL_INSTALL)
test -z "$(plugindir)" || $(MKDIR_P) "$(DESTDIR)$(plugindir)"
- @list='$(plugin_LTLIBRARIES)'; for p in $$list; do \
+ @list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+ list2=; for p in $$list; do \
if test -f $$p; then \
- f=$(am__strip_dir) \
- echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(pluginLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) '$$p' '$(DESTDIR)$(plugindir)/$$f'"; \
- $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(pluginLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) "$$p" "$(DESTDIR)$(plugindir)/$$f"; \
+ list2="$$list2 $$p"; \
else :; fi; \
- done
+ done; \
+ test -z "$$list2" || { \
+ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(plugindir)'"; \
+ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(plugindir)"; \
+ }
uninstall-pluginLTLIBRARIES:
@$(NORMAL_UNINSTALL)
- @list='$(plugin_LTLIBRARIES)'; for p in $$list; do \
- p=$(am__strip_dir) \
- echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$p'"; \
- $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$p"; \
+ @list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+ for p in $$list; do \
+ $(am__strip_dir) \
+ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$f'"; \
+ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$f"; \
done
clean-pluginLTLIBRARIES:
@@ -290,8 +330,8 @@ clean-pluginLTLIBRARIES:
echo "rm -f \"$${dir}/so_locations\""; \
rm -f "$${dir}/so_locations"; \
done
-libstrongswan-eapsim.la: $(libstrongswan_eapsim_la_OBJECTS) $(libstrongswan_eapsim_la_DEPENDENCIES)
- $(libstrongswan_eapsim_la_LINK) -rpath $(plugindir) $(libstrongswan_eapsim_la_OBJECTS) $(libstrongswan_eapsim_la_LIBADD) $(LIBS)
+libstrongswan-eap-sim.la: $(libstrongswan_eap_sim_la_OBJECTS) $(libstrongswan_eap_sim_la_DEPENDENCIES)
+ $(libstrongswan_eap_sim_la_LINK) -rpath $(plugindir) $(libstrongswan_eap_sim_la_OBJECTS) $(libstrongswan_eap_sim_la_LIBADD) $(LIBS)
mostlyclean-compile:
-rm -f *.$(OBJEXT)
@@ -299,26 +339,27 @@ mostlyclean-compile:
distclean-compile:
-rm -f *.tab.c
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/eap_sim.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/eap_sim_peer.Plo@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/eap_sim_plugin.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/eap_sim_server.Plo@am__quote@
.c.o:
@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(COMPILE) -c $<
.c.obj:
@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(COMPILE) -c `$(CYGPATH_W) '$<'`
.c.lo:
@am__fastdepCC_TRUE@ $(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(LTCOMPILE) -c -o $@ $<
@@ -341,7 +382,7 @@ tags: TAGS
TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
$(TAGS_FILES) $(LISP)
- tags=; \
+ set x; \
here=`pwd`; \
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
unique=`for i in $$list; do \
@@ -349,29 +390,34 @@ TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
- if test -z "$(ETAGS_ARGS)$$tags$$unique"; then :; else \
+ shift; \
+ if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
test -n "$$unique" || unique=$$empty_fix; \
- $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
- $$tags $$unique; \
+ if test $$# -gt 0; then \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ "$$@" $$unique; \
+ else \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ $$unique; \
+ fi; \
fi
ctags: CTAGS
CTAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
$(TAGS_FILES) $(LISP)
- tags=; \
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
unique=`for i in $$list; do \
if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
- test -z "$(CTAGS_ARGS)$$tags$$unique" \
+ test -z "$(CTAGS_ARGS)$$unique" \
|| $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
- $$tags $$unique
+ $$unique
GTAGS:
here=`$(am__cd) $(top_builddir) && pwd` \
- && cd $(top_srcdir) \
- && gtags -i $(GTAGS_ARGS) $$here
+ && $(am__cd) $(top_srcdir) \
+ && gtags -i $(GTAGS_ARGS) "$$here"
distclean-tags:
-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
@@ -392,13 +438,17 @@ distdir: $(DISTFILES)
if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
if test -d $$d/$$file; then \
dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
+ if test -d "$(distdir)/$$file"; then \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+ fi; \
if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
- cp -pR $(srcdir)/$$file $(distdir)$$dir || exit 1; \
+ cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
fi; \
- cp -pR $$d/$$file $(distdir)$$dir || exit 1; \
+ cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
else \
- test -f $(distdir)/$$file \
- || cp -p $$d/$$file $(distdir)/$$file \
+ test -f "$(distdir)/$$file" \
+ || cp -p $$d/$$file "$(distdir)/$$file" \
|| exit 1; \
fi; \
done
@@ -429,6 +479,7 @@ clean-generic:
distclean-generic:
-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+ -test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
maintainer-clean-generic:
@echo "This command is intended for maintainers to use"
@@ -450,6 +501,8 @@ dvi-am:
html: html-am
+html-am:
+
info: info-am
info-am:
@@ -458,18 +511,28 @@ install-data-am: install-pluginLTLIBRARIES
install-dvi: install-dvi-am
+install-dvi-am:
+
install-exec-am:
install-html: install-html-am
+install-html-am:
+
install-info: install-info-am
+install-info-am:
+
install-man:
install-pdf: install-pdf-am
+install-pdf-am:
+
install-ps: install-ps-am
+install-ps-am:
+
installcheck-am:
maintainer-clean: maintainer-clean-am
@@ -508,6 +571,7 @@ uninstall-am: uninstall-pluginLTLIBRARIES
mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \
tags uninstall uninstall-am uninstall-pluginLTLIBRARIES
+
# Tell versions [3.59,3.63) of GNU make to not export all variables.
# Otherwise a system limit (for SysV at least) may be exceeded.
.NOEXPORT:
diff --git a/src/charon/plugins/eap_sim/eap_sim.c b/src/charon/plugins/eap_sim/eap_sim.c
deleted file mode 100644
index 2dd6e534b..000000000
--- a/src/charon/plugins/eap_sim/eap_sim.c
+++ /dev/null
@@ -1,1149 +0,0 @@
-/*
- * Copyright (C) 2007 Martin Willi
- * Hochschule fuer Technik Rapperswil
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
- * for more details.
- */
-
-#include "eap_sim.h"
-
-#include <dlfcn.h>
-
-#include <daemon.h>
-#include <library.h>
-
-#define MAX_TRIES 3
-
-/* number of triplets for one authentication */
-#define TRIPLET_COUNT 3
-
-typedef enum sim_subtype_t sim_subtype_t;
-
-/**
- * Subtypes of SIM messages
- */
-enum sim_subtype_t {
- SIM_START = 10,
- SIM_CHALLENGE = 11,
- SIM_NOTIFICATION = 12,
- SIM_CLIENT_ERROR = 14,
-};
-
-ENUM(sim_subtype_names, SIM_START, SIM_CLIENT_ERROR,
- "SIM_START",
- "SIM_CHALLENGE",
- "SIM_NOTIFICATION",
- "SIM_13",
- "SIM_CLIENT_ERROR",
-);
-
-typedef enum sim_attribute_t sim_attribute_t;
-
-/**
- * Attributes in SIM messages
- */
-enum sim_attribute_t {
- /** defines the end of attribute list */
- AT_END = -1,
- AT_RAND = 1,
- AT_AUTN = 2,
- AT_RES = 3,
- AT_AUTS = 4,
- AT_PADDING = 6,
- AT_NONCE_MT = 7,
- AT_PERMANENT_ID_REQ = 10,
- AT_MAC = 11,
- AT_NOTIFICATION = 12,
- AT_ANY_ID_REQ = 13,
- AT_IDENTITY = 14,
- AT_VERSION_LIST = 15,
- AT_SELECTED_VERSION = 16,
- AT_FULLAUTH_ID_REQ = 17,
- AT_COUNTER = 19,
- AT_COUNTER_TOO_SMALL = 20,
- AT_NONCE_S = 21,
- AT_CLIENT_ERROR_CODE = 22,
- AT_IV = 129,
- AT_ENCR_DATA = 130,
- AT_NEXT_PSEUDONYM = 132,
- AT_NEXT_REAUTH_ID = 133,
- AT_CHECKCODE = 134,
- AT_RESULT_IND = 135,
-};
-
-ENUM_BEGIN(sim_attribute_names, AT_END, AT_CLIENT_ERROR_CODE,
- "AT_END",
- "AT_0",
- "AT_RAND",
- "AT_AUTN",
- "AT_RES",
- "AT_AUTS",
- "AT_5",
- "AT_PADDING",
- "AT_NONCE_MT",
- "AT_8",
- "AT_9",
- "AT_PERMANENT_ID_REQ",
- "AT_MAC",
- "AT_NOTIFICATION",
- "AT_ANY_ID_REQ",
- "AT_IDENTITY",
- "AT_VERSION_LIST",
- "AT_SELECTED_VERSION",
- "AT_FULLAUTH_ID_REQ",
- "AT_18",
- "AT_COUNTER",
- "AT_COUNTER_TOO_SMALL",
- "AT_NONCE_S",
- "AT_CLIENT_ERROR_CODE");
-ENUM_NEXT(sim_attribute_names, AT_IV, AT_RESULT_IND, AT_CLIENT_ERROR_CODE,
- "AT_IV",
- "AT_ENCR_DATA",
- "AT_131",
- "AT_NEXT_PSEUDONYM",
- "AT_NEXT_REAUTH_ID",
- "AT_CHECKCODE",
- "AT_RESULT_IND");
-ENUM_END(sim_attribute_names, AT_RESULT_IND);
-
-
-typedef struct private_eap_sim_t private_eap_sim_t;
-
-/**
- * Private data of an eap_sim_t object.
- */
-struct private_eap_sim_t {
-
- /**
- * Public authenticator_t interface.
- */
- eap_sim_t public;
-
- /**
- * ID of ourself
- */
- identification_t *peer;
-
- /**
- * hashing function
- */
- hasher_t *hasher;
-
- /**
- * prf
- */
- prf_t *prf;
-
- /**
- * MAC function
- */
- signer_t *signer;
-
- /**
- * how many times we try to authenticate
- */
- int tries;
-
- /**
- * unique EAP identifier
- */
- u_int8_t identifier;
-
- /**
- * EAP message type this role sends
- */
- u_int8_t type;
-
- /**
- * version this implementation uses
- */
- chunk_t version;
-
- /**
- * version list received from server
- */
- chunk_t version_list;
-
- /**
- * Nonce value used in AT_NONCE_MT
- */
- chunk_t nonce;
-
- /**
- * concatenated SRES values
- */
- chunk_t sreses;
-
- /**
- * k_encr key derived from MK
- */
- chunk_t k_encr;
-
- /**
- * k_auth key derived from MK, used for AT_MAC verification
- */
- chunk_t k_auth;
-
- /**
- * MSK, used for EAP-SIM based IKEv2 authentication
- */
- chunk_t msk;
-
- /**
- * EMSK, extended MSK for further uses
- */
- chunk_t emsk;
-};
-
-/** length of the AT_NONCE_MT nonce value */
-#define NONCE_LEN 16
-/** length of the AT_MAC value */
-#define MAC_LEN 16
-/** length of the AT_RAND value */
-#define RAND_LEN 16
-/** length of Kc */
-#define KC_LEN 8
-/** length of SRES */
-#define SRES_LEN 4
-/** length of the k_encr key */
-#define KENCR_LEN 16
-/** length of the k_auth key */
-#define KAUTH_LEN 16
-/** length of the MSK */
-#define MSK_LEN 64
-/** length of the EMSK */
-#define EMSK_LEN 64
-
-static char version[] = {0x00,0x01};
-/* client error codes used in AT_CLIENT_ERROR_CODE */
-char client_error_general_buf[] = {0x00, 0x01};
-char client_error_unsupported_buf[] = {0x00, 0x02};
-char client_error_insufficient_buf[] = {0x00, 0x03};
-char client_error_notfresh_buf[] = {0x00, 0x04};
-chunk_t client_error_general = chunk_from_buf(client_error_general_buf);
-chunk_t client_error_unsupported = chunk_from_buf(client_error_unsupported_buf);
-chunk_t client_error_insufficient = chunk_from_buf(client_error_insufficient_buf);
-chunk_t client_error_notfresh = chunk_from_buf(client_error_notfresh_buf);
-
-/**
- * Read EAP and EAP-SIM header, return SIM type
- */
-static sim_subtype_t read_header(chunk_t *message)
-{
- sim_subtype_t type;
-
- if (message->len < 8)
- {
- *message = chunk_empty;
- return 0;
- }
- type = *(message->ptr + 5);
- *message = chunk_skip(*message, 8);
- return type;
-}
-
-/**
- * read the next attribute from the chunk data
- */
-static sim_attribute_t read_attribute(chunk_t *message, chunk_t *data)
-{
- sim_attribute_t attribute;
- size_t length;
-
- DBG3(DBG_IKE, "reading attribute from %B", message);
-
- if (message->len < 2)
- {
- return AT_END;
- }
- attribute = *message->ptr++;
- length = *message->ptr++ * 4 - 2;
- message->len -= 2;
- DBG3(DBG_IKE, "found attribute %N with length %d",
- sim_attribute_names, attribute, length);
-
- if (length > message->len)
- {
- return AT_END;
- }
- data->len = length;
- data->ptr = message->ptr;
- *message = chunk_skip(*message, length);
- return attribute;
-}
-
-/**
- * Build an EAP-SIM payload using a variable length attribute list.
- * The variable argument takes a sim_attribute_t followed by its data in a chunk.
- */
-static eap_payload_t *build_payload(private_eap_sim_t *this, u_int8_t identifier,
- sim_subtype_t type, ...)
-{
- chunk_t message = chunk_alloca(512);
- chunk_t pos = message;
- eap_payload_t *payload;
- va_list args;
- sim_attribute_t attr;
- u_int8_t *mac_pos = NULL;
- chunk_t mac_data = chunk_empty;
-
- /* write EAP header, skip length bytes */
- *pos.ptr++ = this->type;
- *pos.ptr++ = identifier;
- pos.ptr += 2;
- pos.len -= 4;
- /* write SIM header with type and subtype, zero reserved bytes */
- *pos.ptr++ = EAP_SIM;
- *pos.ptr++ = type;
- *pos.ptr++ = 0;
- *pos.ptr++ = 0;
- pos.len -= 4;
-
- va_start(args, type);
- while ((attr = va_arg(args, sim_attribute_t)) != AT_END)
- {
- chunk_t data = va_arg(args, chunk_t);
-
- DBG3(DBG_IKE, "building %N %B", sim_attribute_names, attr, &data);
-
- /* write attribute header */
- *pos.ptr++ = attr;
- pos.len--;
-
- switch (attr)
- {
- case AT_CLIENT_ERROR_CODE:
- case AT_SELECTED_VERSION:
- {
- *pos.ptr = data.len/4 + 1;
- pos = chunk_skip(pos, 1);
- memcpy(pos.ptr, data.ptr, data.len);
- pos = chunk_skip(pos, data.len);
- break;
- }
- case AT_IDENTITY:
- case AT_VERSION_LIST:
- {
- u_int16_t act_len = data.len;
- /* align up to four byte */
- if (data.len % 4)
- {
- chunk_t tmp = chunk_alloca((data.len/4)*4 + 4);
- memset(tmp.ptr, 0, tmp.len);
- memcpy(tmp.ptr, data.ptr, data.len);
- data = tmp;
- }
- *pos.ptr = data.len/4 + 1;
- pos = chunk_skip(pos, 1);
- /* actual length in bytes */
- *(u_int16_t*)pos.ptr = htons(act_len);
- pos = chunk_skip(pos, sizeof(u_int16_t));
- memcpy(pos.ptr, data.ptr, data.len);
- pos = chunk_skip(pos, data.len);
- break;
- }
- case AT_NONCE_MT:
- {
- *pos.ptr = data.len/4 + 1;
- pos = chunk_skip(pos, 1);
- memset(pos.ptr, 0, 2);
- pos = chunk_skip(pos, 2);
- memcpy(pos.ptr, data.ptr, data.len);
- pos = chunk_skip(pos, data.len);
- break;
- }
- case AT_MAC:
- {
- *pos.ptr++ = 5; pos.len--;
- *pos.ptr++ = 0; pos.len--;
- *pos.ptr++ = 0; pos.len--;
- mac_pos = pos.ptr;
- memset(mac_pos, 0, MAC_LEN);
- pos = chunk_skip(pos, MAC_LEN);
- mac_data = data;
- break;
- }
- case AT_RAND:
- {
- *pos.ptr++ = data.len/4 + 1; pos.len--;
- *pos.ptr++ = 0; pos.len--;
- *pos.ptr++ = 0; pos.len--;
- memcpy(pos.ptr, data.ptr, data.len);
- pos = chunk_skip(pos, data.len);
- break;
- }
- default:
- DBG1(DBG_IKE, "no rule to build EAP_SIM attribute %N, skipped",
- sim_attribute_names, attr);
- break;
- }
- }
- va_end(args);
-
- /* calculate message length, write into header */
- message.len = pos.ptr - message.ptr;
- *(u_int16_t*)(message.ptr + 2) = htons(message.len);
-
- /* create MAC if AT_MAC attribte was included. Append supplied va_arg
- * chunk mac_data to "to-sign" chunk */
- if (mac_pos)
- {
- this->signer->set_key(this->signer, this->k_auth);
- mac_data = chunk_cata("cc", message, mac_data);
- this->signer->get_signature(this->signer, mac_data, mac_pos);
- DBG3(DBG_IKE, "AT_MAC signature of %B\n is %b",
- &mac_data, mac_pos, MAC_LEN);
- }
-
- payload = eap_payload_create_data(message);
-
- DBG3(DBG_IKE, "created EAP message %B", &message);
- return payload;
-}
-
-/**
- * process an EAP-SIM/Request/Start message
- */
-static status_t peer_process_start(private_eap_sim_t *this, eap_payload_t *in,
- eap_payload_t **out)
-{
- chunk_t message, data;
- sim_attribute_t attribute, include_id = AT_END;
- u_int8_t identifier;
-
- identifier = in->get_identifier(in);
- message = in->get_data(in);
- read_header(&message);
-
- while ((attribute = read_attribute(&message, &data)) != AT_END)
- {
- switch (attribute)
- {
- case AT_VERSION_LIST:
- {
- /* check if server supports our implementation */
- bool found = FALSE;
- if (data.len > 2)
- {
- /* read actual length first */
- data.len = min(data.len, ntohs(*(u_int16_t*)data.ptr) + 2);
- data = chunk_skip(data, 2);
- chunk_free(&this->version_list);
- this->version_list = chunk_clone(data);
- while (data.len >= this->version.len)
- {
- if (memeq(data.ptr, this->version.ptr, this->version.len))
- {
- found = TRUE;
- break;
- }
- data = chunk_skip(data, this->version.len);
- }
- }
- if (!found)
- {
- DBG1(DBG_IKE, "server does not support EAP_SIM "
- "version number %#B", &this->version);
- *out = build_payload(this, identifier, SIM_CLIENT_ERROR,
- AT_CLIENT_ERROR_CODE, client_error_unsupported,
- AT_END);
- return NEED_MORE;
- }
- break;
- }
- case AT_PERMANENT_ID_REQ:
- case AT_FULLAUTH_ID_REQ:
- case AT_ANY_ID_REQ:
- /* only include AT_IDENTITY if requested */
- include_id = AT_IDENTITY;
- break;
- case AT_NOTIFICATION:
- {
- u_int16_t code = 0;
- if (data.len == 2)
- {
- code = ntohs(*(u_int16_t*)data.ptr);
- }
- if (code <= 32767) /* no success bit */
- {
- DBG1(DBG_IKE, "received %N error %d",
- sim_attribute_names, attribute, code);
- *out = build_payload(this,
- in->get_identifier(in), SIM_CLIENT_ERROR,
- AT_CLIENT_ERROR_CODE, client_error_general,
- AT_END);
- return NEED_MORE;
- }
- else
- {
- DBG1(DBG_IKE, "received %N code %d",
- sim_attribute_names, attribute, code);
- }
- break;
- }
- default:
- DBG1(DBG_IKE, "ignoring EAP_SIM attribute %N",
- sim_attribute_names, attribute);
- break;
- }
- }
-
- /* build payload. If "include_id" is AT_END, AT_IDENTITY is ommited */
- *out = build_payload(this, identifier, SIM_START,
- AT_SELECTED_VERSION, this->version,
- AT_NONCE_MT, this->nonce,
- include_id, this->peer->get_encoding(this->peer),
- AT_END);
- return NEED_MORE;
-}
-
-/**
- * derive EAP keys from kc
- */
-static void derive_keys(private_eap_sim_t *this, chunk_t kcs)
-{
- chunk_t tmp, mk;
- int i;
-
- /* build MK = SHA1(Identity|n*Kc|NONCE_MT|Version List|Selected Version) */
- tmp = chunk_cata("ccccc", this->peer->get_encoding(this->peer), kcs,
- this->nonce, this->version_list, this->version);
- mk = chunk_alloca(this->hasher->get_hash_size(this->hasher));
- this->hasher->get_hash(this->hasher, tmp, mk.ptr);
- DBG3(DBG_IKE, "MK = SHA1(%B\n) = %B", &tmp, &mk);
-
- /* K_encr | K_auth | MSK | EMSK = prf() | prf() | prf() | prf()
- * FIPS PRF has 320 bit block size, we need 160 byte for keys
- * => run prf four times */
- this->prf->set_key(this->prf, mk);
- tmp = chunk_alloca(this->prf->get_block_size(this->prf) * 4);
- for (i = 0; i < 4; i++)
- {
- this->prf->get_bytes(this->prf, chunk_empty, tmp.ptr + tmp.len / 4 * i);
- }
- chunk_free(&this->k_encr);
- chunk_free(&this->k_auth);
- chunk_free(&this->msk);
- chunk_free(&this->emsk);
- chunk_split(tmp, "aaaa", KENCR_LEN, &this->k_encr, KAUTH_LEN, &this->k_auth,
- MSK_LEN, &this->msk, EMSK_LEN, &this->emsk);
- DBG3(DBG_IKE, "K_encr %B\nK_auth %B\nMSK %B\nEMSK %B",
- &this->k_encr, &this->k_auth, &this->msk, &this->emsk);
-}
-
-/**
- * Read a triplet from the SIM card
- */
-static bool get_card_triplet(private_eap_sim_t *this,
- char *rand, char *sres, char *kc)
-{
- enumerator_t *enumerator;
- sim_card_t *card = NULL, *current;
- id_match_t match, best = ID_MATCH_NONE;
- bool success = FALSE;
-
- /* find the best matching SIM */
- enumerator = charon->sim->create_card_enumerator(charon->sim);
- while (enumerator->enumerate(enumerator, &current))
- {
- match = this->peer->matches(this->peer, current->get_imsi(current));
- if (match > best)
- {
- card = current;
- best = match;
- break;
- }
- }
- if (card)
- {
- success = card->get_triplet(card, rand, sres, kc);
- }
- enumerator->destroy(enumerator);
- if (!card)
- {
- DBG1(DBG_IKE, "no SIM card found matching '%Y'", this->peer);
- }
- return success;
-}
-
-/**
- * process an EAP-SIM/Request/Challenge message
- */
-static status_t peer_process_challenge(private_eap_sim_t *this,
- eap_payload_t *in, eap_payload_t **out)
-{
- chunk_t message, data, tmp, kcs, kc, sreses, sres;
- sim_attribute_t attribute;
- u_int8_t identifier;
- chunk_t mac = chunk_empty, rands = chunk_empty;
-
- if (this->tries-- <= 0)
- {
- /* give up without notification. This hack is required as some buggy
- * server implementations won't respect our client-error. */
- return FAILED;
- }
-
- identifier = in->get_identifier(in);
- message = in->get_data(in);
- read_header(&message);
-
- while ((attribute = read_attribute(&message, &data)) != AT_END)
- {
- switch (attribute)
- {
- case AT_RAND:
- {
- rands = chunk_skip(data, 2);
- break;
- }
- case AT_MAC:
- {
- /* backup MAC, zero it inline for later verification */
- data = chunk_skip(data, 2);
- mac = chunk_clonea(data);
- memset(data.ptr, 0, data.len);
- break;
- }
- case AT_NOTIFICATION:
- {
- u_int16_t code = 0;
- if (data.len == 2)
- {
- code = ntohs(*(u_int16_t*)data.ptr);
- }
- if (code <= 32767) /* no success bit */
- {
- DBG1(DBG_IKE, "received %N error %d",
- sim_attribute_names, attribute, code);
- *out = build_payload(this,
- in->get_identifier(in), SIM_CLIENT_ERROR,
- AT_CLIENT_ERROR_CODE, client_error_general,
- AT_END);
- return NEED_MORE;
- }
- else
- {
- DBG1(DBG_IKE, "received %N code %d",
- sim_attribute_names, attribute, code);
- }
- break;
- }
- default:
- DBG1(DBG_IKE, "ignoring EAP_SIM attribute %N",
- sim_attribute_names, attribute);
- break;
- }
- }
-
- /* excepting two or three RAND, each 16 bytes. We require two valid
- * and different RANDs */
- if ((rands.len != 2 * RAND_LEN && rands.len != 3 * RAND_LEN) ||
- memeq(rands.ptr, rands.ptr + RAND_LEN, RAND_LEN))
- {
- DBG1(DBG_IKE, "no valid AT_RAND received");
- *out = build_payload(this, identifier, SIM_CLIENT_ERROR,
- AT_CLIENT_ERROR_CODE, client_error_insufficient,
- AT_END);
- return NEED_MORE;
- }
- if (mac.len != MAC_LEN)
- {
- DBG1(DBG_IKE, "no valid AT_MAC received");
- *out = build_payload(this, identifier, SIM_CLIENT_ERROR,
- AT_CLIENT_ERROR_CODE, client_error_general,
- AT_END);
- return NEED_MORE;
- }
-
- /* get two or three KCs/SRESes from SIM using RANDs */
- kcs = kc = chunk_alloca(rands.len / 2);
- sreses = sres = chunk_alloca(rands.len / 4);
- while (rands.len >= RAND_LEN)
- {
- if (!get_card_triplet(this, rands.ptr, sres.ptr, kc.ptr))
- {
- DBG1(DBG_IKE, "unable to get EAP-SIM triplet");
- *out = build_payload(this, identifier, SIM_CLIENT_ERROR,
- AT_CLIENT_ERROR_CODE, client_error_general,
- AT_END);
- return NEED_MORE;
- }
- DBG3(DBG_IKE, "got triplet for RAND %b\n Kc %b\n SRES %b",
- rands.ptr, RAND_LEN, sres.ptr, SRES_LEN, kc.ptr, KC_LEN);
- kc = chunk_skip(kc, KC_LEN);
- sres = chunk_skip(sres, SRES_LEN);
- rands = chunk_skip(rands, RAND_LEN);
- }
-
- derive_keys(this, kcs);
-
- /* verify AT_MAC attribute, signature is over "EAP packet | NONCE_MT" */
- this->signer->set_key(this->signer, this->k_auth);
- tmp = chunk_cata("cc", in->get_data(in), this->nonce);
- if (!this->signer->verify_signature(this->signer, tmp, mac))
- {
- DBG1(DBG_IKE, "AT_MAC verification failed");
- *out = build_payload(this, identifier, SIM_CLIENT_ERROR,
- AT_CLIENT_ERROR_CODE, client_error_general,
- AT_END);
- return NEED_MORE;
- }
-
- /* build response, AT_MAC is built over "EAP packet | n*SRES" */
- *out = build_payload(this, identifier, SIM_CHALLENGE,
- AT_MAC, sreses,
- AT_END);
- return NEED_MORE;
-}
-
-/**
- * process an EAP-SIM/Response/Challenge message
- */
-static status_t server_process_challenge(private_eap_sim_t *this,
- eap_payload_t *in, eap_payload_t **out)
-{
- chunk_t message, data;
- sim_attribute_t attribute;
- chunk_t mac = chunk_empty, tmp;
-
- message = in->get_data(in);
- read_header(&message);
-
- while ((attribute = read_attribute(&message, &data)) != AT_END)
- {
- switch (attribute)
- {
- case AT_MAC:
- /* MAC has two reserved bytes */
- if (data.len == MAC_LEN + 2)
- { /* clone and zero MAC for verification */
- mac = chunk_clonea(chunk_skip(data, 2));
- memset(data.ptr, 0, data.len);
- }
- break;
- default:
- DBG1(DBG_IKE, "ignoring EAP_SIM attribute %N",
- sim_attribute_names, attribute);
- break;
- }
- }
- if (!mac.ptr)
- {
- DBG1(DBG_IKE, "no valid AT_MAC attribute received");
- return FAILED;
- }
- /* verify AT_MAC attribute, signature is over "EAP packet | n*SRES" */
- this->signer->set_key(this->signer, this->k_auth);
- tmp = chunk_cata("cc", in->get_data(in), this->sreses);
- if (!this->signer->verify_signature(this->signer, tmp, mac))
- {
- DBG1(DBG_IKE, "AT_MAC verification failed");
- return FAILED;
- }
- return SUCCESS;
-}
-
-/**
- * Fetch a triplet from a provider
- */
-static bool get_provider_triplet(private_eap_sim_t *this,
- char *rand, char *sres, char *kc)
-{
- enumerator_t *enumerator;
- sim_provider_t *provider;
- int tried = 0;
-
- enumerator = charon->sim->create_provider_enumerator(charon->sim);
- while (enumerator->enumerate(enumerator, &provider))
- {
- if (provider->get_triplet(provider, this->peer, rand, sres, kc))
- {
- enumerator->destroy(enumerator);
- return TRUE;
- }
- tried++;
- }
- enumerator->destroy(enumerator);
- DBG1(DBG_IKE, "tried %d SIM providers, but none had a triplet for '%Y'",
- tried, this->peer);
- return FALSE;
-}
-
-/**
- * process an EAP-SIM/Response/Start message
- */
-static status_t server_process_start(private_eap_sim_t *this,
- eap_payload_t *in, eap_payload_t **out)
-{
- chunk_t message, data;
- sim_attribute_t attribute;
- bool supported = FALSE;
- chunk_t rands, rand, kcs, kc, sreses, sres;
- int i;
-
- message = in->get_data(in);
- read_header(&message);
-
- while ((attribute = read_attribute(&message, &data)) != AT_END)
- {
- switch (attribute)
- {
- case AT_NONCE_MT:
- if (data.len == NONCE_LEN + 2)
- {
- this->nonce = chunk_clone(chunk_skip(data, 2));
- }
- break;
- case AT_SELECTED_VERSION:
- if (chunk_equals(data, this->version))
- {
- supported = TRUE;
- }
- break;
- default:
- DBG1(DBG_IKE, "ignoring EAP_SIM attribute %N",
- sim_attribute_names, attribute);
- break;
- }
- }
- if (!supported || !this->nonce.ptr)
- {
- DBG1(DBG_IKE, "received incomplete EAP-SIM/Response/Start");
- return FAILED;
- }
-
- /* read triplets from provider */
- rand = rands = chunk_alloca(RAND_LEN * TRIPLET_COUNT);
- kc = kcs = chunk_alloca(KC_LEN * TRIPLET_COUNT);
- sres = sreses = chunk_alloca(SRES_LEN * TRIPLET_COUNT);
- rands.len = 0;
- kcs.len = 0;
- sreses.len = 0;
- for (i = 0; i < TRIPLET_COUNT; i++)
- {
- if (!get_provider_triplet(this, rand.ptr, sres.ptr, kc.ptr))
- {
- DBG1(DBG_IKE, "getting EAP-SIM triplet %d failed", i);
- return FAILED;
- }
- rands.len += RAND_LEN;
- sreses.len += SRES_LEN;
- kcs.len += KC_LEN;
- rand = chunk_skip(rand, RAND_LEN);
- sres = chunk_skip(sres, SRES_LEN);
- kc = chunk_skip(kc, KC_LEN);
- }
- derive_keys(this, kcs);
-
- /* build MAC over "EAP packet | NONCE_MT" */
- *out = build_payload(this, this->identifier++, SIM_CHALLENGE, AT_RAND,
- rands, AT_MAC, this->nonce, AT_END);
- this->sreses = chunk_clone(sreses);
- return NEED_MORE;
-}
-
-/**
- * process an EAP-SIM/Request/Notification message
- */
-static status_t peer_process_notification(private_eap_sim_t *this,
- eap_payload_t *in, eap_payload_t **out)
-{
- chunk_t message, data;
- sim_attribute_t attribute;
-
- message = in->get_data(in);
- read_header(&message);
-
- while ((attribute = read_attribute(&message, &data)) != AT_END)
- {
- switch (attribute)
- {
- case AT_NOTIFICATION:
- {
- u_int16_t code = 0;
- if (data.len == 2)
- {
- code = ntohs(*(u_int16_t*)data.ptr);
- }
- if (code <= 32767) /* no success bit */
- {
- DBG1(DBG_IKE, "received %N error %d",
- sim_attribute_names, attribute, code);
- *out = build_payload(this,
- in->get_identifier(in), SIM_CLIENT_ERROR,
- AT_CLIENT_ERROR_CODE, client_error_general,
- AT_END);
- return NEED_MORE;
- }
- else
- {
- DBG1(DBG_IKE, "received %N code %d",
- sim_attribute_names, attribute, code);
- }
- break;
- }
- default:
- DBG1(DBG_IKE, "ignoring EAP_SIM attribute %N",
- sim_attribute_names, attribute);
- break;
- }
- }
- /* reply with empty notification */
- *out = build_payload(this, in->get_identifier(in), SIM_NOTIFICATION, AT_END);
- return NEED_MORE;
-}
-
-/**
- * Process a client error
- */
-static status_t server_process_client_error(private_eap_sim_t *this,
- eap_payload_t *in, eap_payload_t **out)
-{
- chunk_t message, data;
- sim_attribute_t attribute;
-
- message = in->get_data(in);
- read_header(&message);
-
- while ((attribute = read_attribute(&message, &data)) != AT_END)
- {
- if (attribute == AT_CLIENT_ERROR_CODE)
- {
- u_int16_t code = 0;
- if (data.len == 2)
- {
- code = ntohs(*(u_int16_t*)data.ptr);
- }
- DBG1(DBG_IKE, "received %N error %d",
- sim_attribute_names, attribute, code);
- }
- else
- {
- DBG1(DBG_IKE, "ignoring EAP_SIM attribute %N",
- sim_attribute_names, attribute);
- }
- }
- return FAILED;
-}
-
-/**
- * Implementation of eap_method_t.process for the peer
- */
-static status_t peer_process(private_eap_sim_t *this,
- eap_payload_t *in, eap_payload_t **out)
-{
- sim_subtype_t type;
- chunk_t message;
-
- message = in->get_data(in);
- type = read_header(&message);
-
- switch (type)
- {
- case SIM_START:
- return peer_process_start(this, in, out);
- case SIM_CHALLENGE:
- return peer_process_challenge(this, in, out);
- case SIM_NOTIFICATION:
- return peer_process_notification(this, in, out);
- default:
- DBG1(DBG_IKE, "unable to process EAP_SIM subtype %N",
- sim_subtype_names, type);
- *out = build_payload(this, in->get_identifier(in), SIM_CLIENT_ERROR,
- AT_CLIENT_ERROR_CODE, client_error_general, AT_END);
- return NEED_MORE;
- }
-}
-
-/**
- * Implementation of eap_method_t.process for the server
- */
-static status_t server_process(private_eap_sim_t *this,
- eap_payload_t *in, eap_payload_t **out)
-{
- sim_subtype_t type;
- chunk_t message;
-
- message = in->get_data(in);
- type = read_header(&message);
-
- switch (type)
- {
- case SIM_START:
- return server_process_start(this, in, out);
- case SIM_CHALLENGE:
- return server_process_challenge(this, in, out);
- case SIM_CLIENT_ERROR:
- return server_process_client_error(this, in, out);
- default:
- DBG1(DBG_IKE, "unable to process EAP_SIM subtype %N",
- sim_subtype_names, type);
- return FAILED;
- }
-}
-
-/**
- * Implementation of eap_method_t.initiate for the peer
- */
-static status_t peer_initiate(private_eap_sim_t *this, eap_payload_t **out)
-{
- /* peer never initiates */
- return FAILED;
-}
-
-/**
- * Implementation of eap_method_t.initiate for the server
- */
-static status_t server_initiate(private_eap_sim_t *this, eap_payload_t **out)
-{
- /* version_list to derive MK, no padding */
- this->version_list = chunk_clone(this->version);
- /* build_payloads adds padding itself */
- *out = build_payload(this, this->identifier++, SIM_START,
- AT_VERSION_LIST, this->version, AT_END);
- return NEED_MORE;
-}
-
-/**
- * Implementation of eap_method_t.get_type.
- */
-static eap_type_t get_type(private_eap_sim_t *this, u_int32_t *vendor)
-{
- *vendor = 0;
- return EAP_SIM;
-}
-
-/**
- * Implementation of eap_method_t.get_msk.
- */
-static status_t get_msk(private_eap_sim_t *this, chunk_t *msk)
-{
- if (this->msk.ptr)
- {
- *msk = this->msk;
- return SUCCESS;
- }
- return FAILED;
-}
-
-/**
- * Implementation of eap_method_t.is_mutual.
- */
-static bool is_mutual(private_eap_sim_t *this)
-{
- return TRUE;
-}
-
-/**
- * Implementation of eap_method_t.destroy.
- */
-static void destroy(private_eap_sim_t *this)
-{
- this->peer->destroy(this->peer);
- DESTROY_IF(this->hasher);
- DESTROY_IF(this->prf);
- DESTROY_IF(this->signer);
- chunk_free(&this->nonce);
- chunk_free(&this->sreses);
- chunk_free(&this->version_list);
- chunk_free(&this->k_auth);
- chunk_free(&this->k_encr);
- chunk_free(&this->msk);
- chunk_free(&this->emsk);
- free(this);
-}
-
-/**
- * Generic constructor for both roles
- */
-eap_sim_t *eap_sim_create_generic(eap_role_t role, identification_t *server,
- identification_t *peer)
-{
- private_eap_sim_t *this = malloc_thing(private_eap_sim_t);
- rng_t *rng;
-
- this->nonce = chunk_empty;
- this->sreses = chunk_empty;
- this->peer = peer->clone(peer);
- this->tries = MAX_TRIES;
- this->version.ptr = version;
- this->version.len = sizeof(version);
- this->version_list = chunk_empty;
- this->k_auth = chunk_empty;
- this->k_encr = chunk_empty;
- this->msk = chunk_empty;
- this->emsk = chunk_empty;
- /* generate a non-zero identifier */
- do {
- this->identifier = random();
- } while (!this->identifier);
-
- switch (role)
- {
- case EAP_SERVER:
- this->public.eap_method_interface.initiate = (status_t(*)(eap_method_t*,eap_payload_t**))server_initiate;
- this->public.eap_method_interface.process = (status_t(*)(eap_method_t*,eap_payload_t*,eap_payload_t**))server_process;
- this->type = EAP_REQUEST;
- break;
- case EAP_PEER:
- this->public.eap_method_interface.initiate = (status_t(*)(eap_method_t*,eap_payload_t**))peer_initiate;
- this->public.eap_method_interface.process = (status_t(*)(eap_method_t*,eap_payload_t*,eap_payload_t**))peer_process;
- this->type = EAP_RESPONSE;
- rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
- if (!rng)
- {
- DBG1(DBG_IKE, "unable to generate NONCE for EAP_SIM");
- free(this);
- return NULL;
- }
- rng->allocate_bytes(rng, NONCE_LEN, &this->nonce);
- rng->destroy(rng);
- break;
- default:
- free(this);
- return NULL;
- }
- this->public.eap_method_interface.get_type = (eap_type_t(*)(eap_method_t*,u_int32_t*))get_type;
- this->public.eap_method_interface.is_mutual = (bool(*)(eap_method_t*))is_mutual;
- this->public.eap_method_interface.get_msk = (status_t(*)(eap_method_t*,chunk_t*))get_msk;
- this->public.eap_method_interface.destroy = (void(*)(eap_method_t*))destroy;
-
- this->hasher = lib->crypto->create_hasher(lib->crypto, HASH_SHA1);
- this->prf = lib->crypto->create_prf(lib->crypto, PRF_FIPS_SHA1_160);
- this->signer = lib->crypto->create_signer(lib->crypto, AUTH_HMAC_SHA1_128);
- if (!this->hasher || !this->prf || !this->signer)
- {
- DBG1(DBG_IKE, "initiating EAP-SIM failed, FIPS-PRF/SHA1 not supported");
- destroy(this);
- return NULL;
- }
- return &this->public;
-}
-
-/*
- * Described in header.
- */
-eap_sim_t *eap_sim_create_server(identification_t *server,
- identification_t *peer)
-{
- return eap_sim_create_generic(EAP_SERVER, server, peer);
-}
-
-/*
- * Described in header.
- */
-eap_sim_t *eap_sim_create_peer(identification_t *server,
- identification_t *peer)
-{
- return eap_sim_create_generic(EAP_PEER, server, peer);
-}
-
diff --git a/src/charon/plugins/eap_sim/eap_sim_peer.c b/src/charon/plugins/eap_sim/eap_sim_peer.c
new file mode 100644
index 000000000..961cfd30d
--- /dev/null
+++ b/src/charon/plugins/eap_sim/eap_sim_peer.c
@@ -0,0 +1,654 @@
+/*
+ * Copyright (C) 2007-2009 Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+
+#include "eap_sim_peer.h"
+
+#include <daemon.h>
+
+#include <simaka_message.h>
+
+/* number of tries we do authenticate */
+#define MAX_TRIES 3
+
+/* number of triplets for one authentication */
+#define TRIPLET_COUNT 3
+
+/** length of the AT_NONCE_MT nonce value */
+#define NONCE_LEN 16
+
+typedef struct private_eap_sim_peer_t private_eap_sim_peer_t;
+
+/**
+ * Private data of an eap_sim_peer_t object.
+ */
+struct private_eap_sim_peer_t {
+
+ /**
+ * Public authenticator_t interface.
+ */
+ eap_sim_peer_t public;
+
+ /**
+ * permanent ID of peer
+ */
+ identification_t *permanent;
+
+ /**
+ * Pseudonym identity the peer uses
+ */
+ identification_t *pseudonym;
+
+ /**
+ * Reauthentication identity the peer uses
+ */
+ identification_t *reauth;
+
+ /**
+ * EAP-SIM crypto helper
+ */
+ simaka_crypto_t *crypto;
+
+ /**
+ * how many times we try to authenticate
+ */
+ int tries;
+
+ /**
+ * version list received from server
+ */
+ chunk_t version_list;
+
+ /**
+ * Nonce value used in AT_NONCE_MT/AT_NONCE_S
+ */
+ chunk_t nonce;
+
+ /**
+ * MSK, used for EAP-SIM based IKEv2 authentication
+ */
+ chunk_t msk;
+
+ /**
+ * Master key, if reauthentication is used
+ */
+ char mk[HASH_SIZE_SHA1];
+
+ /**
+ * Counter value if reauthentication is used
+ */
+ u_int16_t counter;
+};
+
+/* version of SIM protocol we speak */
+static chunk_t version = chunk_from_chars(0x00,0x01);
+
+/**
+ * Create a SIM_CLIENT_ERROR
+ */
+static eap_payload_t* create_client_error(private_eap_sim_peer_t *this,
+ u_int8_t identifier, simaka_client_error_t code)
+{
+ simaka_message_t *message;
+ eap_payload_t *out;
+ u_int16_t encoded;
+
+ DBG1(DBG_IKE, "sending client error '%N'", simaka_client_error_names, code);
+
+ message = simaka_message_create(FALSE, identifier, EAP_SIM,
+ SIM_CLIENT_ERROR, this->crypto);
+ encoded = htons(code);
+ message->add_attribute(message, AT_CLIENT_ERROR_CODE,
+ chunk_create((char*)&encoded, sizeof(encoded)));
+ out = message->generate(message, chunk_empty);
+ message->destroy(message);
+ return out;
+}
+
+/**
+ * process an EAP-SIM/Request/Start message
+ */
+static status_t process_start(private_eap_sim_peer_t *this,
+ simaka_message_t *in, eap_payload_t **out)
+{
+ simaka_message_t *message;
+ enumerator_t *enumerator;
+ simaka_attribute_t type;
+ chunk_t data, id = chunk_empty;
+ rng_t *rng;
+ bool supported = FALSE;
+ simaka_attribute_t id_req = 0;
+
+ /* reset previously uses reauthentication/pseudonym data */
+ this->crypto->clear_keys(this->crypto);
+ DESTROY_IF(this->pseudonym);
+ this->pseudonym = NULL;
+ DESTROY_IF(this->reauth);
+ this->reauth = NULL;
+
+ enumerator = in->create_attribute_enumerator(in);
+ while (enumerator->enumerate(enumerator, &type, &data))
+ {
+ switch (type)
+ {
+ case AT_VERSION_LIST:
+ {
+ free(this->version_list.ptr);
+ this->version_list = chunk_clone(data);
+ while (data.len >= version.len)
+ {
+ if (memeq(data.ptr, version.ptr, version.len))
+ {
+ supported = TRUE;
+ break;
+ }
+ }
+ break;
+ }
+ case AT_ANY_ID_REQ:
+ case AT_FULLAUTH_ID_REQ:
+ case AT_PERMANENT_ID_REQ:
+ id_req = type;
+ break;
+ default:
+ if (!simaka_attribute_skippable(type))
+ {
+ *out = create_client_error(this, in->get_identifier(in),
+ SIM_UNABLE_TO_PROCESS);
+ enumerator->destroy(enumerator);
+ return NEED_MORE;
+ }
+ break;
+ }
+ }
+ enumerator->destroy(enumerator);
+
+ if (!supported)
+ {
+ DBG1(DBG_IKE, "server does not support EAP-SIM version number 1");
+ *out = create_client_error(this, in->get_identifier(in),
+ SIM_UNSUPPORTED_VERSION);
+ return NEED_MORE;
+ }
+
+ switch (id_req)
+ {
+ case AT_ANY_ID_REQ:
+ this->reauth = charon->sim->card_get_reauth(charon->sim,
+ this->permanent, this->mk, &this->counter);
+ if (this->reauth)
+ {
+ id = this->reauth->get_encoding(this->reauth);
+ break;
+ }
+ /* FALL */
+ case AT_FULLAUTH_ID_REQ:
+ this->pseudonym = charon->sim->card_get_pseudonym(charon->sim,
+ this->permanent);
+ if (this->pseudonym)
+ {
+ id = this->pseudonym->get_encoding(this->pseudonym);
+ break;
+ }
+ /* FALL */
+ case AT_PERMANENT_ID_REQ:
+ id = this->permanent->get_encoding(this->permanent);
+ break;
+ default:
+ break;
+ }
+
+ /* generate AT_NONCE_MT value */
+ rng = this->crypto->get_rng(this->crypto);
+ free(this->nonce.ptr);
+ rng->allocate_bytes(rng, NONCE_LEN, &this->nonce);
+
+ message = simaka_message_create(FALSE, in->get_identifier(in), EAP_SIM,
+ SIM_START, this->crypto);
+ if (!this->reauth)
+ {
+ message->add_attribute(message, AT_SELECTED_VERSION, version);
+ message->add_attribute(message, AT_NONCE_MT, this->nonce);
+ }
+ if (id.len)
+ {
+ message->add_attribute(message, AT_IDENTITY, id);
+ }
+ *out = message->generate(message, chunk_empty);
+ message->destroy(message);
+
+ return NEED_MORE;
+}
+
+/**
+ * process an EAP-SIM/Request/Challenge message
+ */
+static status_t process_challenge(private_eap_sim_peer_t *this,
+ simaka_message_t *in, eap_payload_t **out)
+{
+ simaka_message_t *message;
+ enumerator_t *enumerator;
+ simaka_attribute_t type;
+ chunk_t data, rands = chunk_empty, kcs, kc, sreses, sres, mk;
+ identification_t *id;
+
+ if (this->tries-- <= 0)
+ {
+ /* give up without notification. This hack is required as some buggy
+ * server implementations won't respect our client-error. */
+ return FAILED;
+ }
+
+ enumerator = in->create_attribute_enumerator(in);
+ while (enumerator->enumerate(enumerator, &type, &data))
+ {
+ switch (type)
+ {
+ case AT_RAND:
+ rands = data;
+ break;
+ default:
+ if (!simaka_attribute_skippable(type))
+ {
+ *out = create_client_error(this, in->get_identifier(in),
+ SIM_UNABLE_TO_PROCESS);
+ enumerator->destroy(enumerator);
+ return NEED_MORE;
+ }
+ break;
+ }
+ }
+ enumerator->destroy(enumerator);
+
+ /* excepting two or three RAND, each 16 bytes. We require two valid
+ * and different RANDs */
+ if ((rands.len != 2 * SIM_RAND_LEN && rands.len != 3 * SIM_RAND_LEN) ||
+ memeq(rands.ptr, rands.ptr + SIM_RAND_LEN, SIM_RAND_LEN))
+ {
+ DBG1(DBG_IKE, "no valid AT_RAND received");
+ *out = create_client_error(this, in->get_identifier(in),
+ SIM_INSUFFICIENT_CHALLENGES);
+ return NEED_MORE;
+ }
+ /* get two or three KCs/SRESes from SIM using RANDs */
+ kcs = kc = chunk_alloca(rands.len / 2);
+ sreses = sres = chunk_alloca(rands.len / 4);
+ while (rands.len >= SIM_RAND_LEN)
+ {
+ if (!charon->sim->card_get_triplet(charon->sim, this->permanent,
+ rands.ptr, sres.ptr, kc.ptr))
+ {
+ DBG1(DBG_IKE, "unable to get EAP-SIM triplet");
+ *out = create_client_error(this, in->get_identifier(in),
+ SIM_UNABLE_TO_PROCESS);
+ return NEED_MORE;
+ }
+ DBG3(DBG_IKE, "got triplet for RAND %b\n Kc %b\n SRES %b",
+ rands.ptr, SIM_RAND_LEN, sres.ptr, SIM_SRES_LEN, kc.ptr, SIM_KC_LEN);
+ kc = chunk_skip(kc, SIM_KC_LEN);
+ sres = chunk_skip(sres, SIM_SRES_LEN);
+ rands = chunk_skip(rands, SIM_RAND_LEN);
+ }
+
+ id = this->permanent;
+ if (this->pseudonym)
+ {
+ id = this->pseudonym;
+ }
+ data = chunk_cata("cccc", kcs, this->nonce, this->version_list, version);
+ free(this->msk.ptr);
+ this->msk = this->crypto->derive_keys_full(this->crypto, id, data, &mk);
+ memcpy(this->mk, mk.ptr, mk.len);
+ free(mk.ptr);
+
+ /* Verify AT_MAC attribute, signature is over "EAP packet | NONCE_MT", and
+ * parse() again after key derivation, reading encrypted attributes */
+ if (!in->verify(in, this->nonce) || !in->parse(in))
+ {
+ *out = create_client_error(this, in->get_identifier(in),
+ SIM_UNABLE_TO_PROCESS);
+ return NEED_MORE;
+ }
+
+ enumerator = in->create_attribute_enumerator(in);
+ while (enumerator->enumerate(enumerator, &type, &data))
+ {
+ switch (type)
+ {
+ case AT_NEXT_REAUTH_ID:
+ this->counter = 0;
+ id = identification_create_from_data(data);
+ charon->sim->card_set_reauth(charon->sim, this->permanent, id,
+ this->mk, this->counter);
+ id->destroy(id);
+ break;
+ case AT_NEXT_PSEUDONYM:
+ id = identification_create_from_data(data);
+ charon->sim->card_set_pseudonym(charon->sim, this->permanent, id);
+ id->destroy(id);
+ break;
+ default:
+ break;
+ }
+ }
+ enumerator->destroy(enumerator);
+
+ /* build response with AT_MAC, built over "EAP packet | n*SRES" */
+ message = simaka_message_create(FALSE, in->get_identifier(in), EAP_SIM,
+ SIM_CHALLENGE, this->crypto);
+ *out = message->generate(message, sreses);
+ message->destroy(message);
+ return NEED_MORE;
+}
+
+/**
+ * Check if a received counter value is acceptable
+ */
+static bool counter_too_small(private_eap_sim_peer_t *this, chunk_t chunk)
+{
+ u_int16_t counter;
+
+ memcpy(&counter, chunk.ptr, sizeof(counter));
+ counter = htons(counter);
+ return counter < this->counter;
+}
+
+/**
+ * process an EAP-SIM/Request/Re-Authentication message
+ */
+static status_t process_reauthentication(private_eap_sim_peer_t *this,
+ simaka_message_t *in, eap_payload_t **out)
+{
+ simaka_message_t *message;
+ enumerator_t *enumerator;
+ simaka_attribute_t type;
+ chunk_t data, counter = chunk_empty, nonce = chunk_empty, id = chunk_empty;
+
+ if (!this->reauth)
+ {
+ DBG1(DBG_IKE, "received %N, but not expected",
+ simaka_subtype_names, SIM_REAUTHENTICATION);
+ *out = create_client_error(this, in->get_identifier(in),
+ SIM_UNABLE_TO_PROCESS);
+ return NEED_MORE;
+ }
+
+ this->crypto->derive_keys_reauth(this->crypto,
+ chunk_create(this->mk, HASH_SIZE_SHA1));
+
+ /* verify MAC and parse again with decryption key */
+ if (!in->verify(in, chunk_empty) || !in->parse(in))
+ {
+ *out = create_client_error(this, in->get_identifier(in),
+ SIM_UNABLE_TO_PROCESS);
+ return NEED_MORE;
+ }
+
+ enumerator = in->create_attribute_enumerator(in);
+ while (enumerator->enumerate(enumerator, &type, &data))
+ {
+ switch (type)
+ {
+ case AT_COUNTER:
+ counter = data;
+ break;
+ case AT_NONCE_S:
+ nonce = data;
+ break;
+ case AT_NEXT_REAUTH_ID:
+ id = data;
+ break;
+ default:
+ if (!simaka_attribute_skippable(type))
+ {
+ *out = create_client_error(this, in->get_identifier(in),
+ SIM_UNABLE_TO_PROCESS);
+ enumerator->destroy(enumerator);
+ return NEED_MORE;
+ }
+ break;
+ }
+ }
+ enumerator->destroy(enumerator);
+
+ if (!nonce.len || !counter.len)
+ {
+ DBG1(DBG_IKE, "EAP-SIM/Request/Re-Authentication message incomplete");
+ *out = create_client_error(this, in->get_identifier(in),
+ SIM_UNABLE_TO_PROCESS);
+ return NEED_MORE;
+ }
+
+ message = simaka_message_create(FALSE, in->get_identifier(in), EAP_SIM,
+ SIM_REAUTHENTICATION, this->crypto);
+ if (counter_too_small(this, counter))
+ {
+ DBG1(DBG_IKE, "reauthentication counter too small");
+ message->add_attribute(message, AT_COUNTER_TOO_SMALL, chunk_empty);
+ }
+ else
+ {
+ free(this->msk.ptr);
+ this->msk = this->crypto->derive_keys_reauth_msk(this->crypto,
+ this->reauth, counter, nonce,
+ chunk_create(this->mk, HASH_SIZE_SHA1));
+ if (id.len)
+ {
+ identification_t *reauth;
+
+ reauth = identification_create_from_data(data);
+ charon->sim->card_set_reauth(charon->sim, this->permanent, reauth,
+ this->mk, this->counter);
+ reauth->destroy(reauth);
+ }
+ }
+ message->add_attribute(message, AT_COUNTER, counter);
+ *out = message->generate(message, nonce);
+ message->destroy(message);
+ return NEED_MORE;
+}
+
+/**
+ * process an EAP-SIM/Request/Notification message
+ */
+static status_t process_notification(private_eap_sim_peer_t *this,
+ simaka_message_t *in, eap_payload_t **out)
+{
+ simaka_message_t *message;
+ enumerator_t *enumerator;
+ simaka_attribute_t type;
+ chunk_t data;
+ bool success = TRUE;
+
+ enumerator = in->create_attribute_enumerator(in);
+ while (enumerator->enumerate(enumerator, &type, &data))
+ {
+ if (type == AT_NOTIFICATION)
+ {
+ u_int16_t code;
+
+ memcpy(&code, data.ptr, sizeof(code));
+ code = ntohs(code);
+
+ /* test success bit */
+ if (!(data.ptr[0] & 0x80))
+ {
+ success = FALSE;
+ DBG1(DBG_IKE, "received EAP-SIM notification error '%N'",
+ simaka_notification_names, code);
+ }
+ else
+ {
+ DBG1(DBG_IKE, "received EAP-SIM notification '%N'",
+ simaka_notification_names, code);
+ }
+ }
+ else if (!simaka_attribute_skippable(type))
+ {
+ success = FALSE;
+ break;
+ }
+ }
+ enumerator->destroy(enumerator);
+
+ if (success)
+ { /* empty notification reply */
+ message = simaka_message_create(FALSE, in->get_identifier(in), EAP_SIM,
+ SIM_NOTIFICATION, this->crypto);
+ *out = message->generate(message, chunk_empty);
+ message->destroy(message);
+ }
+ else
+ {
+ *out = create_client_error(this, in->get_identifier(in),
+ SIM_UNABLE_TO_PROCESS);
+ }
+ return NEED_MORE;
+}
+
+/**
+ * Implementation of eap_method_t.process
+ */
+static status_t process(private_eap_sim_peer_t *this,
+ eap_payload_t *in, eap_payload_t **out)
+{
+ simaka_message_t *message;
+ status_t status;
+
+ message = simaka_message_create_from_payload(in, this->crypto);
+ if (!message)
+ {
+ *out = create_client_error(this, in->get_identifier(in),
+ SIM_UNABLE_TO_PROCESS);
+ return NEED_MORE;
+ }
+ if (!message->parse(message))
+ {
+ message->destroy(message);
+ *out = create_client_error(this, in->get_identifier(in),
+ SIM_UNABLE_TO_PROCESS);
+ return NEED_MORE;
+ }
+ switch (message->get_subtype(message))
+ {
+ case SIM_START:
+ status = process_start(this, message, out);
+ break;
+ case SIM_CHALLENGE:
+ status = process_challenge(this, message, out);
+ break;
+ case SIM_REAUTHENTICATION:
+ status = process_reauthentication(this, message, out);
+ break;
+ case SIM_NOTIFICATION:
+ status = process_notification(this, message, out);
+ break;
+ default:
+ DBG1(DBG_IKE, "unable to process EAP-SIM subtype %N",
+ simaka_subtype_names, message->get_subtype(message));
+ *out = create_client_error(this, in->get_identifier(in),
+ SIM_UNABLE_TO_PROCESS);
+ status = NEED_MORE;
+ break;
+ }
+ message->destroy(message);
+ return status;
+}
+
+/**
+ * Implementation of eap_method_t.initiate
+ */
+static status_t initiate(private_eap_sim_peer_t *this, eap_payload_t **out)
+{
+ /* peer never initiates */
+ return FAILED;
+}
+
+/**
+ * Implementation of eap_method_t.get_type.
+ */
+static eap_type_t get_type(private_eap_sim_peer_t *this, u_int32_t *vendor)
+{
+ *vendor = 0;
+ return EAP_SIM;
+}
+
+/**
+ * Implementation of eap_method_t.get_msk.
+ */
+static status_t get_msk(private_eap_sim_peer_t *this, chunk_t *msk)
+{
+ if (this->msk.ptr)
+ {
+ *msk = this->msk;
+ return SUCCESS;
+ }
+ return FAILED;
+}
+
+/**
+ * Implementation of eap_method_t.is_mutual.
+ */
+static bool is_mutual(private_eap_sim_peer_t *this)
+{
+ return TRUE;
+}
+
+/**
+ * Implementation of eap_method_t.destroy.
+ */
+static void destroy(private_eap_sim_peer_t *this)
+{
+ this->permanent->destroy(this->permanent);
+ DESTROY_IF(this->pseudonym);
+ DESTROY_IF(this->reauth);
+ this->crypto->destroy(this->crypto);
+ free(this->version_list.ptr);
+ free(this->nonce.ptr);
+ free(this->msk.ptr);
+ free(this);
+}
+
+/*
+ * Described in header.
+ */
+eap_sim_peer_t *eap_sim_peer_create(identification_t *server,
+ identification_t *peer)
+{
+ private_eap_sim_peer_t *this = malloc_thing(private_eap_sim_peer_t);
+
+ this->public.interface.initiate = (status_t(*)(eap_method_t*,eap_payload_t**))initiate;
+ this->public.interface.process = (status_t(*)(eap_method_t*,eap_payload_t*,eap_payload_t**))process;
+ this->public.interface.get_type = (eap_type_t(*)(eap_method_t*,u_int32_t*))get_type;
+ this->public.interface.is_mutual = (bool(*)(eap_method_t*))is_mutual;
+ this->public.interface.get_msk = (status_t(*)(eap_method_t*,chunk_t*))get_msk;
+ this->public.interface.destroy = (void(*)(eap_method_t*))destroy;
+
+ this->crypto = simaka_crypto_create();
+ if (!this->crypto)
+ {
+ free(this);
+ return NULL;
+ }
+ this->permanent = peer->clone(peer);
+ this->pseudonym = NULL;
+ this->reauth = NULL;
+ this->tries = MAX_TRIES;
+ this->version_list = chunk_empty;
+ this->nonce = chunk_empty;
+ this->msk = chunk_empty;
+
+ return &this->public;
+}
+
diff --git a/src/charon/plugins/eap_sim/eap_sim_peer.h b/src/charon/plugins/eap_sim/eap_sim_peer.h
new file mode 100644
index 000000000..89f81301e
--- /dev/null
+++ b/src/charon/plugins/eap_sim/eap_sim_peer.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2009 Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+
+/**
+ * @defgroup eap_sim_peer eap_sim_peer
+ * @{ @ingroup eap_sim
+ */
+
+#ifndef EAP_SIM_PEER_H_
+#define EAP_SIM_PEER_H_
+
+#include <sa/authenticators/eap/eap_method.h>
+
+typedef struct eap_sim_peer_t eap_sim_peer_t;
+
+/**
+ * EAP-SIM peer implementation.
+ *
+ * This EAP-SIM module uses sim_card_t implementations for triplet calculation,
+ * found via the eap_sim_manager_t.
+ */
+struct eap_sim_peer_t {
+
+ /**
+ * Implemented eap_method_t interface.
+ */
+ eap_method_t interface;
+
+ /**
+ * Destroy a eap_sim_peer_t.
+ */
+ void (*destroy)(eap_sim_peer_t *this);
+};
+
+/**
+ * Creates the EAP method EAP-SIM acting as peer.
+ *
+ * @param server ID of the EAP server
+ * @param peer ID of the EAP peer
+ * @return eap_sim_t object
+ */
+eap_sim_peer_t *eap_sim_peer_create(identification_t *server,
+ identification_t *peer);
+
+#endif /** EAP_SIM_PEER_H_ @}*/
diff --git a/src/charon/plugins/eap_sim/eap_sim_plugin.c b/src/charon/plugins/eap_sim/eap_sim_plugin.c
index cf18007c0..1d2b9cf4f 100644
--- a/src/charon/plugins/eap_sim/eap_sim_plugin.c
+++ b/src/charon/plugins/eap_sim/eap_sim_plugin.c
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2008 Martin Willi
+ * Copyright (C) 2008-2009 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
@@ -15,7 +15,8 @@
#include "eap_sim_plugin.h"
-#include "eap_sim.h"
+#include "eap_sim_server.h"
+#include "eap_sim_peer.h"
#include <daemon.h>
@@ -25,9 +26,9 @@
static void destroy(eap_sim_plugin_t *this)
{
charon->eap->remove_method(charon->eap,
- (eap_constructor_t)eap_sim_create_server);
+ (eap_constructor_t)eap_sim_server_create);
charon->eap->remove_method(charon->eap,
- (eap_constructor_t)eap_sim_create_peer);
+ (eap_constructor_t)eap_sim_peer_create);
free(this);
}
@@ -37,14 +38,14 @@ static void destroy(eap_sim_plugin_t *this)
plugin_t *plugin_create()
{
eap_sim_plugin_t *this = malloc_thing(eap_sim_plugin_t);
-
+
this->plugin.destroy = (void(*)(plugin_t*))destroy;
-
+
charon->eap->add_method(charon->eap, EAP_SIM, 0, EAP_SERVER,
- (eap_constructor_t)eap_sim_create_server);
+ (eap_constructor_t)eap_sim_server_create);
charon->eap->add_method(charon->eap, EAP_SIM, 0, EAP_PEER,
- (eap_constructor_t)eap_sim_create_peer);
-
+ (eap_constructor_t)eap_sim_peer_create);
+
return &this->plugin;
}
diff --git a/src/charon/plugins/eap_sim/eap_sim_server.c b/src/charon/plugins/eap_sim/eap_sim_server.c
new file mode 100644
index 000000000..f6d5df09b
--- /dev/null
+++ b/src/charon/plugins/eap_sim/eap_sim_server.c
@@ -0,0 +1,611 @@
+/*
+ * Copyright (C) 2007-2009 Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+
+#include "eap_sim_server.h"
+
+#include <daemon.h>
+
+#include <simaka_message.h>
+#include <simaka_crypto.h>
+
+/* number of triplets for one authentication */
+#define TRIPLET_COUNT 3
+
+/** length of the AT_NONCE_S value */
+#define NONCE_LEN 16
+
+typedef struct private_eap_sim_server_t private_eap_sim_server_t;
+
+/**
+ * Private data of an eap_sim_server_t object.
+ */
+struct private_eap_sim_server_t {
+
+ /**
+ * Public authenticator_t interface.
+ */
+ eap_sim_server_t public;
+
+ /**
+ * permanent ID of peer
+ */
+ identification_t *permanent;
+
+ /**
+ * pseudonym ID of peer
+ */
+ identification_t *pseudonym;
+
+ /**
+ * reauthentication ID of peer
+ */
+ identification_t *reauth;
+
+ /**
+ * EAP-SIM/AKA crypto helper
+ */
+ simaka_crypto_t *crypto;
+
+ /**
+ * unique EAP identifier
+ */
+ u_int8_t identifier;
+
+ /**
+ * concatenated SRES values
+ */
+ chunk_t sreses;
+
+ /**
+ * Nonce value used in AT_NONCE_S
+ */
+ chunk_t nonce;
+
+ /**
+ * Counter value negotiated, network order
+ */
+ chunk_t counter;
+
+ /**
+ * MSK, used for EAP-SIM based IKEv2 authentication
+ */
+ chunk_t msk;
+
+ /**
+ * Do we request fast reauthentication?
+ */
+ bool use_reauth;
+
+ /**
+ * Do we request pseudonym identities?
+ */
+ bool use_pseudonym;
+
+ /**
+ * Do we request permanent identities?
+ */
+ bool use_permanent;
+
+ /**
+ * EAP-SIM message we have initiated
+ */
+ simaka_subtype_t pending;
+};
+
+/* version of SIM protocol we speak */
+static chunk_t version = chunk_from_chars(0x00,0x01);
+
+/**
+ * Implementation of eap_method_t.initiate
+ */
+static status_t initiate(private_eap_sim_server_t *this, eap_payload_t **out)
+{
+ simaka_message_t *message;
+
+ message = simaka_message_create(TRUE, this->identifier++, EAP_SIM,
+ SIM_START, this->crypto);
+ message->add_attribute(message, AT_VERSION_LIST, version);
+ if (this->use_reauth)
+ {
+ message->add_attribute(message, AT_ANY_ID_REQ, chunk_empty);
+ }
+ else if (this->use_pseudonym)
+ {
+ message->add_attribute(message, AT_FULLAUTH_ID_REQ, chunk_empty);
+ }
+ else if (this->use_permanent)
+ {
+ message->add_attribute(message, AT_PERMANENT_ID_REQ, chunk_empty);
+ }
+ *out = message->generate(message, chunk_empty);
+ message->destroy(message);
+
+ this->pending = SIM_START;
+ return NEED_MORE;
+}
+
+/**
+ * Initiate EAP-SIM/Request/Re-authentication message
+ */
+static status_t reauthenticate(private_eap_sim_server_t *this,
+ char mk[HASH_SIZE_SHA1], u_int16_t counter,
+ eap_payload_t **out)
+{
+ simaka_message_t *message;
+ identification_t *next;
+ chunk_t mkc;
+ rng_t *rng;
+
+ DBG1(DBG_IKE, "initiating EAP-SIM reauthentication");
+
+ rng = this->crypto->get_rng(this->crypto);
+ rng->allocate_bytes(rng, NONCE_LEN, &this->nonce);
+
+ mkc = chunk_create(mk, HASH_SIZE_SHA1);
+ counter = htons(counter);
+ this->counter = chunk_clone(chunk_create((char*)&counter, sizeof(counter)));
+
+ this->crypto->derive_keys_reauth(this->crypto, mkc);
+ this->msk = this->crypto->derive_keys_reauth_msk(this->crypto,
+ this->reauth, this->counter, this->nonce, mkc);
+
+ message = simaka_message_create(TRUE, this->identifier++, EAP_SIM,
+ SIM_REAUTHENTICATION, this->crypto);
+ message->add_attribute(message, AT_COUNTER, this->counter);
+ message->add_attribute(message, AT_NONCE_S, this->nonce);
+ next = charon->sim->provider_gen_reauth(charon->sim, this->permanent, mk);
+ if (next)
+ {
+ message->add_attribute(message, AT_NEXT_REAUTH_ID,
+ next->get_encoding(next));
+ next->destroy(next);
+ }
+ *out = message->generate(message, chunk_empty);
+ message->destroy(message);
+
+ this->pending = SIM_REAUTHENTICATION;
+ return NEED_MORE;
+}
+
+/**
+ * process an EAP-SIM/Response/Reauthentication message
+ */
+static status_t process_reauthentication(private_eap_sim_server_t *this,
+ simaka_message_t *in, eap_payload_t **out)
+{
+ enumerator_t *enumerator;
+ simaka_attribute_t type;
+ chunk_t data, counter = chunk_empty;
+ bool too_small = FALSE;
+
+ if (this->pending != SIM_REAUTHENTICATION)
+ {
+ DBG1(DBG_IKE, "received %N, but not expected",
+ simaka_subtype_names, SIM_REAUTHENTICATION);
+ return FAILED;
+ }
+ /* verify AT_MAC attribute, signature is over "EAP packet | NONCE_S" */
+ if (!in->verify(in, this->nonce))
+ {
+ return FAILED;
+ }
+
+ enumerator = in->create_attribute_enumerator(in);
+ while (enumerator->enumerate(enumerator, &type, &data))
+ {
+ switch (type)
+ {
+ case AT_COUNTER:
+ counter = data;
+ break;
+ case AT_COUNTER_TOO_SMALL:
+ too_small = TRUE;
+ break;
+ default:
+ if (!simaka_attribute_skippable(type))
+ {
+ enumerator->destroy(enumerator);
+ return FAILED;
+ }
+ break;
+ }
+ }
+ enumerator->destroy(enumerator);
+
+ if (too_small)
+ {
+ DBG1(DBG_IKE, "received %N, initiating full authentication",
+ simaka_attribute_names, AT_COUNTER_TOO_SMALL);
+ this->use_reauth = FALSE;
+ this->crypto->clear_keys(this->crypto);
+ return initiate(this, out);
+ }
+ if (!chunk_equals(counter, this->counter))
+ {
+ DBG1(DBG_IKE, "received counter does not match");
+ return FAILED;
+ }
+ return SUCCESS;
+}
+
+/**
+ * process an EAP-SIM/Response/Start message
+ */
+static status_t process_start(private_eap_sim_server_t *this,
+ simaka_message_t *in, eap_payload_t **out)
+{
+ simaka_message_t *message;
+ enumerator_t *enumerator;
+ simaka_attribute_t type;
+ chunk_t data, identity = chunk_empty, nonce = chunk_empty, mk;
+ chunk_t rands, rand, kcs, kc, sreses, sres;
+ bool supported = FALSE;
+ identification_t *id;
+ int i;
+
+ if (this->pending != SIM_START)
+ {
+ DBG1(DBG_IKE, "received %N, but not expected",
+ simaka_subtype_names, SIM_START);
+ return FAILED;
+ }
+
+ enumerator = in->create_attribute_enumerator(in);
+ while (enumerator->enumerate(enumerator, &type, &data))
+ {
+ switch (type)
+ {
+ case AT_NONCE_MT:
+ nonce = data;
+ break;
+ case AT_SELECTED_VERSION:
+ if (chunk_equals(data, version))
+ {
+ supported = TRUE;
+ }
+ break;
+ case AT_IDENTITY:
+ identity = data;
+ break;
+ default:
+ if (!simaka_attribute_skippable(type))
+ {
+ enumerator->destroy(enumerator);
+ return FAILED;
+ }
+ break;
+ }
+ }
+ enumerator->destroy(enumerator);
+
+ if (identity.len)
+ {
+ identification_t *permanent;
+
+ id = identification_create_from_data(identity);
+ if (this->use_reauth && !nonce.len)
+ {
+ char mk[HASH_SIZE_SHA1];
+ u_int16_t counter;
+
+ permanent = charon->sim->provider_is_reauth(charon->sim, id,
+ mk, &counter);
+ if (permanent)
+ {
+ this->permanent->destroy(this->permanent);
+ this->permanent = permanent;
+ this->reauth = id;
+ return reauthenticate(this, mk, counter, out);
+ }
+ DBG1(DBG_IKE, "received unknown reauthentication identity '%Y', "
+ "initiating full authentication", id);
+ this->use_reauth = FALSE;
+ id->destroy(id);
+ return initiate(this, out);
+ }
+ if (this->use_pseudonym)
+ {
+ permanent = charon->sim->provider_is_pseudonym(charon->sim, id);
+ if (permanent)
+ {
+ this->permanent->destroy(this->permanent);
+ this->permanent = permanent;
+ this->pseudonym = id->clone(id);
+ /* we already have a new permanent identity now */
+ this->use_permanent = FALSE;
+ }
+ }
+ if (!this->pseudonym && this->use_permanent)
+ {
+ DBG1(DBG_IKE, "received %spermanent identity '%Y'",
+ this->use_pseudonym ? "pseudonym or " : "", id);
+ this->permanent->destroy(this->permanent);
+ this->permanent = id->clone(id);
+ }
+ id->destroy(id);
+ }
+
+ if (!supported || !nonce.len)
+ {
+ DBG1(DBG_IKE, "received incomplete EAP-SIM/Response/Start");
+ return FAILED;
+ }
+
+ /* read triplets from provider */
+ rand = rands = chunk_alloca(SIM_RAND_LEN * TRIPLET_COUNT);
+ kc = kcs = chunk_alloca(SIM_KC_LEN * TRIPLET_COUNT);
+ sres = sreses = chunk_alloca(SIM_SRES_LEN * TRIPLET_COUNT);
+ rands.len = kcs.len = sreses.len = 0;
+ for (i = 0; i < TRIPLET_COUNT; i++)
+ {
+ if (!charon->sim->provider_get_triplet(charon->sim, this->permanent,
+ rand.ptr, sres.ptr, kc.ptr))
+ {
+ if (this->use_pseudonym)
+ {
+ /* probably received a pseudonym we couldn't map */
+ DBG1(DBG_IKE, "failed to map pseudonym identity '%Y', "
+ "fallback to permanent identity request", this->permanent);
+ this->use_pseudonym = FALSE;
+ DESTROY_IF(this->pseudonym);
+ this->pseudonym = NULL;
+ return initiate(this, out);
+ }
+ return FAILED;
+ }
+ rands.len += SIM_RAND_LEN;
+ sreses.len += SIM_SRES_LEN;
+ kcs.len += SIM_KC_LEN;
+ rand = chunk_skip(rand, SIM_RAND_LEN);
+ sres = chunk_skip(sres, SIM_SRES_LEN);
+ kc = chunk_skip(kc, SIM_KC_LEN);
+ }
+ free(this->sreses.ptr);
+ this->sreses = chunk_clone(sreses);
+
+ data = chunk_cata("cccc", kcs, nonce, version, version);
+ free(this->msk.ptr);
+ id = this->permanent;
+ if (this->pseudonym)
+ {
+ id = this->pseudonym;
+ }
+ this->msk = this->crypto->derive_keys_full(this->crypto, id, data, &mk);
+
+ /* build response with AT_MAC, built over "EAP packet | NONCE_MT" */
+ message = simaka_message_create(TRUE, this->identifier++, EAP_SIM,
+ SIM_CHALLENGE, this->crypto);
+ message->add_attribute(message, AT_RAND, rands);
+ id = charon->sim->provider_gen_reauth(charon->sim, this->permanent, mk.ptr);
+ if (id)
+ {
+ message->add_attribute(message, AT_NEXT_REAUTH_ID,
+ id->get_encoding(id));
+ id->destroy(id);
+ }
+ else
+ {
+ id = charon->sim->provider_gen_pseudonym(charon->sim, this->permanent);
+ if (id)
+ {
+ message->add_attribute(message, AT_NEXT_PSEUDONYM,
+ id->get_encoding(id));
+ id->destroy(id);
+ }
+ }
+ *out = message->generate(message, nonce);
+ message->destroy(message);
+
+ free(mk.ptr);
+ this->pending = SIM_CHALLENGE;
+ return NEED_MORE;
+}
+
+/**
+ * process an EAP-SIM/Response/Challenge message
+ */
+static status_t process_challenge(private_eap_sim_server_t *this,
+ simaka_message_t *in, eap_payload_t **out)
+{
+ enumerator_t *enumerator;
+ simaka_attribute_t type;
+ chunk_t data;
+
+ if (this->pending != SIM_CHALLENGE)
+ {
+ DBG1(DBG_IKE, "received %N, but not expected",
+ simaka_subtype_names, SIM_CHALLENGE);
+ return FAILED;
+ }
+ /* verify AT_MAC attribute, signature is over "EAP packet | n*SRES" */
+ if (!in->verify(in, this->sreses))
+ {
+ return FAILED;
+ }
+
+ enumerator = in->create_attribute_enumerator(in);
+ while (enumerator->enumerate(enumerator, &type, &data))
+ {
+ if (!simaka_attribute_skippable(type))
+ {
+ enumerator->destroy(enumerator);
+ return FAILED;
+ }
+ }
+ enumerator->destroy(enumerator);
+
+ return SUCCESS;
+}
+
+/**
+ * EAP-SIM/Response/ClientErrorCode message
+ */
+static status_t process_client_error(private_eap_sim_server_t *this,
+ simaka_message_t *in)
+{
+ enumerator_t *enumerator;
+ simaka_attribute_t type;
+ chunk_t data;
+
+ enumerator = in->create_attribute_enumerator(in);
+ while (enumerator->enumerate(enumerator, &type, &data))
+ {
+ if (type == AT_CLIENT_ERROR_CODE)
+ {
+ u_int16_t code;
+
+ memcpy(&code, data.ptr, sizeof(code));
+ DBG1(DBG_IKE, "received EAP-SIM client error '%N'",
+ simaka_client_error_names, ntohs(code));
+ }
+ else if (!simaka_attribute_skippable(type))
+ {
+ break;
+ }
+ }
+ enumerator->destroy(enumerator);
+ return FAILED;
+}
+
+/**
+ * Implementation of eap_method_t.process
+ */
+static status_t process(private_eap_sim_server_t *this,
+ eap_payload_t *in, eap_payload_t **out)
+{
+ simaka_message_t *message;
+ status_t status;
+
+ message = simaka_message_create_from_payload(in, this->crypto);
+ if (!message)
+ {
+ return FAILED;
+ }
+ if (!message->parse(message))
+ {
+ message->destroy(message);
+ return FAILED;
+ }
+ switch (message->get_subtype(message))
+ {
+ case SIM_START:
+ status = process_start(this, message, out);
+ break;
+ case SIM_CHALLENGE:
+ status = process_challenge(this, message, out);
+ break;
+ case SIM_REAUTHENTICATION:
+ status = process_reauthentication(this, message, out);
+ break;
+ case SIM_CLIENT_ERROR:
+ status = process_client_error(this, message);
+ break;
+ default:
+ DBG1(DBG_IKE, "unable to process EAP-SIM subtype %N",
+ simaka_subtype_names, message->get_subtype(message));
+ status = FAILED;
+ break;
+ }
+ message->destroy(message);
+ return status;
+}
+
+/**
+ * Implementation of eap_method_t.get_type.
+ */
+static eap_type_t get_type(private_eap_sim_server_t *this, u_int32_t *vendor)
+{
+ *vendor = 0;
+ return EAP_SIM;
+}
+
+/**
+ * Implementation of eap_method_t.get_msk.
+ */
+static status_t get_msk(private_eap_sim_server_t *this, chunk_t *msk)
+{
+ if (this->msk.ptr)
+ {
+ *msk = this->msk;
+ return SUCCESS;
+ }
+ return FAILED;
+}
+
+/**
+ * Implementation of eap_method_t.is_mutual.
+ */
+static bool is_mutual(private_eap_sim_server_t *this)
+{
+ return TRUE;
+}
+
+/**
+ * Implementation of eap_method_t.destroy.
+ */
+static void destroy(private_eap_sim_server_t *this)
+{
+ this->crypto->destroy(this->crypto);
+ this->permanent->destroy(this->permanent);
+ DESTROY_IF(this->pseudonym);
+ DESTROY_IF(this->reauth);
+ free(this->sreses.ptr);
+ free(this->nonce.ptr);
+ free(this->msk.ptr);
+ free(this->counter.ptr);
+ free(this);
+}
+
+/*
+ * Described in header.
+ */
+eap_sim_server_t *eap_sim_server_create(identification_t *server,
+ identification_t *peer)
+{
+ private_eap_sim_server_t *this = malloc_thing(private_eap_sim_server_t);
+
+ this->public.interface.initiate = (status_t(*)(eap_method_t*,eap_payload_t**))initiate;
+ this->public.interface.process = (status_t(*)(eap_method_t*,eap_payload_t*,eap_payload_t**))process;
+ this->public.interface.get_type = (eap_type_t(*)(eap_method_t*,u_int32_t*))get_type;
+ this->public.interface.is_mutual = (bool(*)(eap_method_t*))is_mutual;
+ this->public.interface.get_msk = (status_t(*)(eap_method_t*,chunk_t*))get_msk;
+ this->public.interface.destroy = (void(*)(eap_method_t*))destroy;
+
+ this->crypto = simaka_crypto_create();
+ if (!this->crypto)
+ {
+ free(this);
+ return NULL;
+ }
+ this->permanent = peer->clone(peer);
+ this->pseudonym = NULL;
+ this->reauth = NULL;
+ this->sreses = chunk_empty;
+ this->nonce = chunk_empty;
+ this->msk = chunk_empty;
+ this->counter = chunk_empty;
+ this->pending = 0;
+ this->use_reauth = this->use_pseudonym = this->use_permanent =
+ lib->settings->get_bool(lib->settings,
+ "charon.plugins.eap-sim.request_identity", TRUE);
+
+ /* generate a non-zero identifier */
+ do {
+ this->identifier = random();
+ } while (!this->identifier);
+
+ return &this->public;
+}
+
diff --git a/src/charon/plugins/eap_sim/eap_sim.h b/src/charon/plugins/eap_sim/eap_sim_server.h
index af1aa2aa5..978e1e1e9 100644
--- a/src/charon/plugins/eap_sim/eap_sim.h
+++ b/src/charon/plugins/eap_sim/eap_sim_server.h
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2007-2008 Martin Willi
+ * Copyright (C) 2009 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
@@ -14,48 +14,44 @@
*/
/**
- * @defgroup eap_sim_i eap_sim
+ * @defgroup eap_sim_server eap_sim_server
* @{ @ingroup eap_sim
*/
-#ifndef EAP_SIM_H_
-#define EAP_SIM_H_
-
-typedef struct eap_sim_t eap_sim_t;
+#ifndef EAP_SIM_SERVER_H_
+#define EAP_SIM_SERVER_H_
#include <sa/authenticators/eap/eap_method.h>
+typedef struct eap_sim_server_t eap_sim_server_t;
+
/**
- * Implementation of the eap_method_t interface using EAP-SIM.
+ * EAP-SIM server implementation.
*
- * This EAP-SIM client implementation handles the protocol level of EAP-SIM
- * only, it does not provide triplet calculation/fetching. Other plugins may
- * provide these services using the sim_manager_t of charon.
+ * This EAP-SIM module uses sim_provider_t implementations for triplet
+ * calculation, found via the eap_sim_manager_t.
*/
-struct eap_sim_t {
+struct eap_sim_server_t {
/**
* Implemented eap_method_t interface.
*/
- eap_method_t eap_method_interface;
+ eap_method_t interface;
+
+ /**
+ * Destroy a eap_sim_server_t.
+ */
+ void (*destroy)(eap_sim_server_t *this);
};
/**
* Creates the EAP method EAP-SIM acting as server.
*
* @param server ID of the EAP server
- * @param peer ID of the EAP client
- * @return eap_sim_t object
- */
-eap_sim_t *eap_sim_create_server(identification_t *server, identification_t *peer);
-
-/**
- * Creates the EAP method EAP-SIM acting as peer.
- *
- * @param server ID of the EAP server
- * @param peer ID of the EAP client
+ * @param peer ID of the EAP peer
* @return eap_sim_t object
*/
-eap_sim_t *eap_sim_create_peer(identification_t *server, identification_t *peer);
+eap_sim_server_t *eap_sim_server_create(identification_t *server,
+ identification_t *peer);
-#endif /** EAP_SIM_H_ @}*/
+#endif /** EAP_SIM_SERVER_H_ @}*/
diff --git a/src/charon/plugins/eap_sim_file/Makefile.am b/src/charon/plugins/eap_sim_file/Makefile.am
index 1cd1dd9e2..350d4244f 100644
--- a/src/charon/plugins/eap_sim_file/Makefile.am
+++ b/src/charon/plugins/eap_sim_file/Makefile.am
@@ -1,14 +1,14 @@
INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
-AM_CFLAGS = -rdynamic -DIPSEC_CONFDIR=\"${confdir}\"
+AM_CFLAGS = -rdynamic -DIPSEC_CONFDIR=\"${sysconfdir}\"
-plugin_LTLIBRARIES = libstrongswan-eapsim-file.la
+plugin_LTLIBRARIES = libstrongswan-eap-sim-file.la
-libstrongswan_eapsim_file_la_SOURCES = \
+libstrongswan_eap_sim_file_la_SOURCES = \
eap_sim_file_plugin.h eap_sim_file_plugin.c \
eap_sim_file_card.h eap_sim_file_card.c \
eap_sim_file_provider.h eap_sim_file_provider.c \
eap_sim_file_triplets.h eap_sim_file_triplets.c
-libstrongswan_eapsim_file_la_LDFLAGS = -module -avoid-version
+libstrongswan_eap_sim_file_la_LDFLAGS = -module -avoid-version
diff --git a/src/charon/plugins/eap_sim_file/Makefile.in b/src/charon/plugins/eap_sim_file/Makefile.in
index b19cc839f..232c2a133 100644
--- a/src/charon/plugins/eap_sim_file/Makefile.in
+++ b/src/charon/plugins/eap_sim_file/Makefile.in
@@ -1,8 +1,9 @@
-# Makefile.in generated by automake 1.10.2 from Makefile.am.
+# Makefile.in generated by automake 1.11 from Makefile.am.
# @configure_input@
# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,
-# 2003, 2004, 2005, 2006, 2007, 2008 Free Software Foundation, Inc.
+# 2003, 2004, 2005, 2006, 2007, 2008, 2009 Free Software Foundation,
+# Inc.
# This Makefile.in is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.
@@ -16,8 +17,9 @@
VPATH = @srcdir@
pkgdatadir = $(datadir)/@PACKAGE@
-pkglibdir = $(libdir)/@PACKAGE@
pkgincludedir = $(includedir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkglibexecdir = $(libexecdir)/@PACKAGE@
am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
install_sh_DATA = $(install_sh) -c -m 644
install_sh_PROGRAM = $(install_sh) -c
@@ -35,33 +37,56 @@ host_triplet = @host@
subdir = src/charon/plugins/eap_sim_file
DIST_COMMON = $(srcdir)/Makefile.am $(srcdir)/Makefile.in
ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
-am__aclocal_m4_deps = $(top_srcdir)/configure.in
+am__aclocal_m4_deps = $(top_srcdir)/m4/config/libtool.m4 \
+ $(top_srcdir)/m4/config/ltoptions.m4 \
+ $(top_srcdir)/m4/config/ltsugar.m4 \
+ $(top_srcdir)/m4/config/ltversion.m4 \
+ $(top_srcdir)/m4/config/lt~obsolete.m4 \
+ $(top_srcdir)/m4/macros/with.m4 \
+ $(top_srcdir)/m4/macros/enable-disable.m4 \
+ $(top_srcdir)/configure.in
am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
$(ACLOCAL_M4)
mkinstalldirs = $(install_sh) -d
CONFIG_CLEAN_FILES =
+CONFIG_CLEAN_VPATH_FILES =
am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
am__vpath_adj = case $$p in \
$(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
*) f=$$p;; \
esac;
-am__strip_dir = `echo $$p | sed -e 's|^.*/||'`;
+am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
+am__install_max = 40
+am__nobase_strip_setup = \
+ srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
+am__nobase_strip = \
+ for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
+am__nobase_list = $(am__nobase_strip_setup); \
+ for p in $$list; do echo "$$p $$p"; done | \
+ sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
+ $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
+ if (++n[$$2] == $(am__install_max)) \
+ { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
+ END { for (dir in files) print dir, files[dir] }'
+am__base_list = \
+ sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
+ sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
am__installdirs = "$(DESTDIR)$(plugindir)"
-pluginLTLIBRARIES_INSTALL = $(INSTALL)
LTLIBRARIES = $(plugin_LTLIBRARIES)
-libstrongswan_eapsim_file_la_LIBADD =
-am_libstrongswan_eapsim_file_la_OBJECTS = eap_sim_file_plugin.lo \
+libstrongswan_eap_sim_file_la_LIBADD =
+am_libstrongswan_eap_sim_file_la_OBJECTS = eap_sim_file_plugin.lo \
eap_sim_file_card.lo eap_sim_file_provider.lo \
eap_sim_file_triplets.lo
-libstrongswan_eapsim_file_la_OBJECTS = \
- $(am_libstrongswan_eapsim_file_la_OBJECTS)
-libstrongswan_eapsim_file_la_LINK = $(LIBTOOL) --tag=CC \
+libstrongswan_eap_sim_file_la_OBJECTS = \
+ $(am_libstrongswan_eap_sim_file_la_OBJECTS)
+libstrongswan_eap_sim_file_la_LINK = $(LIBTOOL) --tag=CC \
$(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \
- $(AM_CFLAGS) $(CFLAGS) $(libstrongswan_eapsim_file_la_LDFLAGS) \
- $(LDFLAGS) -o $@
+ $(AM_CFLAGS) $(CFLAGS) \
+ $(libstrongswan_eap_sim_file_la_LDFLAGS) $(LDFLAGS) -o $@
DEFAULT_INCLUDES = -I.@am__isrc@
depcomp = $(SHELL) $(top_srcdir)/depcomp
am__depfiles_maybe = depfiles
+am__mv = mv -f
COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
LTCOMPILE = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
@@ -71,8 +96,8 @@ CCLD = $(CC)
LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
--mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) $(AM_LDFLAGS) \
$(LDFLAGS) -o $@
-SOURCES = $(libstrongswan_eapsim_file_la_SOURCES)
-DIST_SOURCES = $(libstrongswan_eapsim_file_la_SOURCES)
+SOURCES = $(libstrongswan_eap_sim_file_la_SOURCES)
+DIST_SOURCES = $(libstrongswan_eap_sim_file_la_SOURCES)
ETAGS = etags
CTAGS = ctags
DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
@@ -109,25 +134,22 @@ INSTALL_DATA = @INSTALL_DATA@
INSTALL_PROGRAM = @INSTALL_PROGRAM@
INSTALL_SCRIPT = @INSTALL_SCRIPT@
INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
-IPSEC_ROUTING_TABLE = @IPSEC_ROUTING_TABLE@
-IPSEC_ROUTING_TABLE_PRIO = @IPSEC_ROUTING_TABLE_PRIO@
LD = @LD@
LDFLAGS = @LDFLAGS@
LEX = @LEX@
LEXLIB = @LEXLIB@
LEX_OUTPUT_ROOT = @LEX_OUTPUT_ROOT@
-LIBGCRYPT_CFLAGS = @LIBGCRYPT_CFLAGS@
-LIBGCRYPT_CONFIG = @LIBGCRYPT_CONFIG@
-LIBGCRYPT_LIBS = @LIBGCRYPT_LIBS@
LIBOBJS = @LIBOBJS@
LIBS = @LIBS@
LIBTOOL = @LIBTOOL@
-LINUX_HEADERS = @LINUX_HEADERS@
LIPO = @LIPO@
LN_S = @LN_S@
LTLIBOBJS = @LTLIBOBJS@
MAKEINFO = @MAKEINFO@
MKDIR_P = @MKDIR_P@
+MYSQLCFLAG = @MYSQLCFLAG@
+MYSQLCONFIG = @MYSQLCONFIG@
+MYSQLLIB = @MYSQLLIB@
NM = @NM@
NMEDIT = @NMEDIT@
OBJDUMP = @OBJDUMP@
@@ -139,11 +161,14 @@ PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
PACKAGE_NAME = @PACKAGE_NAME@
PACKAGE_STRING = @PACKAGE_STRING@
PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_URL = @PACKAGE_URL@
PACKAGE_VERSION = @PACKAGE_VERSION@
PATH_SEPARATOR = @PATH_SEPARATOR@
PERL = @PERL@
PKG_CONFIG = @PKG_CONFIG@
+PTHREADLIB = @PTHREADLIB@
RANLIB = @RANLIB@
+RTLIB = @RTLIB@
RUBY = @RUBY@
RUBYINCLUDE = @RUBYINCLUDE@
SED = @SED@
@@ -172,9 +197,9 @@ build_cpu = @build_cpu@
build_os = @build_os@
build_vendor = @build_vendor@
builddir = @builddir@
-confdir = @confdir@
datadir = @datadir@
datarootdir = @datarootdir@
+default_pkcs11 = @default_pkcs11@
docdir = @docdir@
dvidir = @dvidir@
exec_prefix = @exec_prefix@
@@ -197,7 +222,7 @@ ipsecuser = @ipsecuser@
libdir = @libdir@
libexecdir = @libexecdir@
libstrongswan_plugins = @libstrongswan_plugins@
-linuxdir = @linuxdir@
+linux_headers = @linux_headers@
localedir = @localedir@
localstatedir = @localstatedir@
lt_ECHO = @lt_ECHO@
@@ -205,6 +230,7 @@ mandir = @mandir@
mkdir_p = @mkdir_p@
nm_CFLAGS = @nm_CFLAGS@
nm_LIBS = @nm_LIBS@
+nm_ca_dir = @nm_ca_dir@
oldincludedir = @oldincludedir@
pdfdir = @pdfdir@
piddir = @piddir@
@@ -213,10 +239,12 @@ pluto_plugins = @pluto_plugins@
prefix = @prefix@
program_transform_name = @program_transform_name@
psdir = @psdir@
+random_device = @random_device@
resolv_conf = @resolv_conf@
+routing_table = @routing_table@
+routing_table_prio = @routing_table_prio@
sbindir = @sbindir@
sharedstatedir = @sharedstatedir@
-simreader = @simreader@
srcdir = @srcdir@
strongswan_conf = @strongswan_conf@
sysconfdir = @sysconfdir@
@@ -224,18 +252,19 @@ target_alias = @target_alias@
top_build_prefix = @top_build_prefix@
top_builddir = @top_builddir@
top_srcdir = @top_srcdir@
+urandom_device = @urandom_device@
xml_CFLAGS = @xml_CFLAGS@
xml_LIBS = @xml_LIBS@
INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
-AM_CFLAGS = -rdynamic -DIPSEC_CONFDIR=\"${confdir}\"
-plugin_LTLIBRARIES = libstrongswan-eapsim-file.la
-libstrongswan_eapsim_file_la_SOURCES = \
+AM_CFLAGS = -rdynamic -DIPSEC_CONFDIR=\"${sysconfdir}\"
+plugin_LTLIBRARIES = libstrongswan-eap-sim-file.la
+libstrongswan_eap_sim_file_la_SOURCES = \
eap_sim_file_plugin.h eap_sim_file_plugin.c \
eap_sim_file_card.h eap_sim_file_card.c \
eap_sim_file_provider.h eap_sim_file_provider.c \
eap_sim_file_triplets.h eap_sim_file_triplets.c
-libstrongswan_eapsim_file_la_LDFLAGS = -module -avoid-version
+libstrongswan_eap_sim_file_la_LDFLAGS = -module -avoid-version
all: all-am
.SUFFIXES:
@@ -249,9 +278,9 @@ $(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps)
exit 1;; \
esac; \
done; \
- echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/charon/plugins/eap_sim_file/Makefile'; \
- cd $(top_srcdir) && \
- $(AUTOMAKE) --gnu src/charon/plugins/eap_sim_file/Makefile
+ echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/charon/plugins/eap_sim_file/Makefile'; \
+ $(am__cd) $(top_srcdir) && \
+ $(AUTOMAKE) --gnu src/charon/plugins/eap_sim_file/Makefile
.PRECIOUS: Makefile
Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
@case '$?' in \
@@ -269,23 +298,28 @@ $(top_srcdir)/configure: $(am__configure_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
$(ACLOCAL_M4): $(am__aclocal_m4_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(am__aclocal_m4_deps):
install-pluginLTLIBRARIES: $(plugin_LTLIBRARIES)
@$(NORMAL_INSTALL)
test -z "$(plugindir)" || $(MKDIR_P) "$(DESTDIR)$(plugindir)"
- @list='$(plugin_LTLIBRARIES)'; for p in $$list; do \
+ @list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+ list2=; for p in $$list; do \
if test -f $$p; then \
- f=$(am__strip_dir) \
- echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(pluginLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) '$$p' '$(DESTDIR)$(plugindir)/$$f'"; \
- $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(pluginLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) "$$p" "$(DESTDIR)$(plugindir)/$$f"; \
+ list2="$$list2 $$p"; \
else :; fi; \
- done
+ done; \
+ test -z "$$list2" || { \
+ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(plugindir)'"; \
+ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(plugindir)"; \
+ }
uninstall-pluginLTLIBRARIES:
@$(NORMAL_UNINSTALL)
- @list='$(plugin_LTLIBRARIES)'; for p in $$list; do \
- p=$(am__strip_dir) \
- echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$p'"; \
- $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$p"; \
+ @list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+ for p in $$list; do \
+ $(am__strip_dir) \
+ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$f'"; \
+ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$f"; \
done
clean-pluginLTLIBRARIES:
@@ -296,8 +330,8 @@ clean-pluginLTLIBRARIES:
echo "rm -f \"$${dir}/so_locations\""; \
rm -f "$${dir}/so_locations"; \
done
-libstrongswan-eapsim-file.la: $(libstrongswan_eapsim_file_la_OBJECTS) $(libstrongswan_eapsim_file_la_DEPENDENCIES)
- $(libstrongswan_eapsim_file_la_LINK) -rpath $(plugindir) $(libstrongswan_eapsim_file_la_OBJECTS) $(libstrongswan_eapsim_file_la_LIBADD) $(LIBS)
+libstrongswan-eap-sim-file.la: $(libstrongswan_eap_sim_file_la_OBJECTS) $(libstrongswan_eap_sim_file_la_DEPENDENCIES)
+ $(libstrongswan_eap_sim_file_la_LINK) -rpath $(plugindir) $(libstrongswan_eap_sim_file_la_OBJECTS) $(libstrongswan_eap_sim_file_la_LIBADD) $(LIBS)
mostlyclean-compile:
-rm -f *.$(OBJEXT)
@@ -312,21 +346,21 @@ distclean-compile:
.c.o:
@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(COMPILE) -c $<
.c.obj:
@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(COMPILE) -c `$(CYGPATH_W) '$<'`
.c.lo:
@am__fastdepCC_TRUE@ $(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(LTCOMPILE) -c -o $@ $<
@@ -349,7 +383,7 @@ tags: TAGS
TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
$(TAGS_FILES) $(LISP)
- tags=; \
+ set x; \
here=`pwd`; \
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
unique=`for i in $$list; do \
@@ -357,29 +391,34 @@ TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
- if test -z "$(ETAGS_ARGS)$$tags$$unique"; then :; else \
+ shift; \
+ if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
test -n "$$unique" || unique=$$empty_fix; \
- $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
- $$tags $$unique; \
+ if test $$# -gt 0; then \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ "$$@" $$unique; \
+ else \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ $$unique; \
+ fi; \
fi
ctags: CTAGS
CTAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
$(TAGS_FILES) $(LISP)
- tags=; \
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
unique=`for i in $$list; do \
if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
- test -z "$(CTAGS_ARGS)$$tags$$unique" \
+ test -z "$(CTAGS_ARGS)$$unique" \
|| $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
- $$tags $$unique
+ $$unique
GTAGS:
here=`$(am__cd) $(top_builddir) && pwd` \
- && cd $(top_srcdir) \
- && gtags -i $(GTAGS_ARGS) $$here
+ && $(am__cd) $(top_srcdir) \
+ && gtags -i $(GTAGS_ARGS) "$$here"
distclean-tags:
-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
@@ -400,13 +439,17 @@ distdir: $(DISTFILES)
if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
if test -d $$d/$$file; then \
dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
+ if test -d "$(distdir)/$$file"; then \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+ fi; \
if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
- cp -pR $(srcdir)/$$file $(distdir)$$dir || exit 1; \
+ cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
fi; \
- cp -pR $$d/$$file $(distdir)$$dir || exit 1; \
+ cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
else \
- test -f $(distdir)/$$file \
- || cp -p $$d/$$file $(distdir)/$$file \
+ test -f "$(distdir)/$$file" \
+ || cp -p $$d/$$file "$(distdir)/$$file" \
|| exit 1; \
fi; \
done
@@ -437,6 +480,7 @@ clean-generic:
distclean-generic:
-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+ -test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
maintainer-clean-generic:
@echo "This command is intended for maintainers to use"
@@ -458,6 +502,8 @@ dvi-am:
html: html-am
+html-am:
+
info: info-am
info-am:
@@ -466,18 +512,28 @@ install-data-am: install-pluginLTLIBRARIES
install-dvi: install-dvi-am
+install-dvi-am:
+
install-exec-am:
install-html: install-html-am
+install-html-am:
+
install-info: install-info-am
+install-info-am:
+
install-man:
install-pdf: install-pdf-am
+install-pdf-am:
+
install-ps: install-ps-am
+install-ps-am:
+
installcheck-am:
maintainer-clean: maintainer-clean-am
@@ -516,6 +572,7 @@ uninstall-am: uninstall-pluginLTLIBRARIES
mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \
tags uninstall uninstall-am uninstall-pluginLTLIBRARIES
+
# Tell versions [3.59,3.63) of GNU make to not export all variables.
# Otherwise a system limit (for SysV at least) may be exceeded.
.NOEXPORT:
diff --git a/src/charon/plugins/eap_sim_file/eap_sim_file_card.c b/src/charon/plugins/eap_sim_file/eap_sim_file_card.c
index 7d441ffb2..d132a38f6 100644
--- a/src/charon/plugins/eap_sim_file/eap_sim_file_card.c
+++ b/src/charon/plugins/eap_sim_file/eap_sim_file_card.c
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2008 Martin Willi
+ * Copyright (C) 2008-2009 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
@@ -15,54 +15,53 @@
#include "eap_sim_file_card.h"
+#include <daemon.h>
+
typedef struct private_eap_sim_file_card_t private_eap_sim_file_card_t;
/**
* Private data of an eap_sim_file_card_t object.
*/
struct private_eap_sim_file_card_t {
-
+
/**
* Public eap_sim_file_card_t interface.
*/
eap_sim_file_card_t public;
-
+
/**
- * IMSI, is ID_ANY for file implementation
+ * source of triplets
*/
- identification_t *imsi;
-
- /**
- * source of triplets
- */
eap_sim_file_triplets_t *triplets;
};
-#include <daemon.h>
-
/**
* Implementation of sim_card_t.get_triplet
*/
static bool get_triplet(private_eap_sim_file_card_t *this,
- char *rand, char *sres, char *kc)
+ identification_t *id, char *rand, char *sres, char *kc)
{
enumerator_t *enumerator;
- identification_t *id;
+ identification_t *cand;
char *c_rand, *c_sres, *c_kc;
-
- DBG2(DBG_CFG, "looking for rand: %b", rand, RAND_LEN);
-
+
+ DBG2(DBG_CFG, "looking for triplet: %Y rand %b", id, rand, SIM_RAND_LEN);
+
enumerator = this->triplets->create_enumerator(this->triplets);
- while (enumerator->enumerate(enumerator, &id, &c_rand, &c_sres, &c_kc))
+ while (enumerator->enumerate(enumerator, &cand, &c_rand, &c_sres, &c_kc))
{
- DBG2(DBG_CFG, "found triplet: rand %b\nsres %b\n kc %b",
- c_rand, RAND_LEN, c_sres, SRES_LEN, c_kc, KC_LEN);
- if (memeq(c_rand, rand, RAND_LEN))
+ DBG2(DBG_CFG, "got a triplet: %Y rand %b\nsres %b\n kc %b", cand,
+ c_rand, SIM_RAND_LEN, c_sres, SIM_SRES_LEN, c_kc, SIM_KC_LEN);
+ if (id->matches(id, cand))
{
- memcpy(sres, c_sres, SRES_LEN);
- memcpy(kc, c_kc, KC_LEN);
- enumerator->destroy(enumerator);
- return TRUE;
+ if (memeq(c_rand, rand, SIM_RAND_LEN))
+ {
+ DBG2(DBG_CFG, " => triplet matches");
+ memcpy(sres, c_sres, SIM_SRES_LEN);
+ memcpy(kc, c_kc, SIM_KC_LEN);
+ enumerator->destroy(enumerator);
+ return TRUE;
+ }
}
}
enumerator->destroy(enumerator);
@@ -70,11 +69,11 @@ static bool get_triplet(private_eap_sim_file_card_t *this,
}
/**
- * Implementation of sim_card_t.get_imsi
+ * Implementation of sim_card_t.get_quintuplet
*/
-static identification_t* get_imsi(private_eap_sim_file_card_t *this)
+static status_t get_quintuplet()
{
- return this->imsi;
+ return NOT_SUPPORTED;
}
/**
@@ -82,7 +81,6 @@ static identification_t* get_imsi(private_eap_sim_file_card_t *this)
*/
static void destroy(private_eap_sim_file_card_t *this)
{
- this->imsi->destroy(this->imsi);
free(this);
}
@@ -92,15 +90,18 @@ static void destroy(private_eap_sim_file_card_t *this)
eap_sim_file_card_t *eap_sim_file_card_create(eap_sim_file_triplets_t *triplets)
{
private_eap_sim_file_card_t *this = malloc_thing(private_eap_sim_file_card_t);
-
- this->public.card.get_triplet = (bool(*)(sim_card_t*, char *rand, char *sres, char *kc))get_triplet;
- this->public.card.get_imsi = (identification_t*(*)(sim_card_t*))get_imsi;
+
+ this->public.card.get_triplet = (bool(*)(sim_card_t*, identification_t *id, char rand[SIM_RAND_LEN], char sres[SIM_SRES_LEN], char kc[SIM_KC_LEN]))get_triplet;
+ this->public.card.get_quintuplet = (status_t(*)(sim_card_t*, identification_t *id, char rand[AKA_RAND_LEN], char autn[AKA_AUTN_LEN], char ck[AKA_CK_LEN], char ik[AKA_IK_LEN], char res[AKA_RES_MAX], int *res_len))get_quintuplet;
+ this->public.card.resync = (bool(*)(sim_card_t*, identification_t *id, char rand[AKA_RAND_LEN], char auts[AKA_AUTS_LEN]))return_false;
+ this->public.card.get_pseudonym = (identification_t*(*)(sim_card_t*, identification_t *perm))return_null;
+ this->public.card.set_pseudonym = (void(*)(sim_card_t*, identification_t *id, identification_t *pseudonym))nop;
+ this->public.card.get_reauth = (identification_t*(*)(sim_card_t*, identification_t *id, char mk[HASH_SIZE_SHA1], u_int16_t *counter))return_null;
+ this->public.card.set_reauth = (void(*)(sim_card_t*, identification_t *id, identification_t* next, char mk[HASH_SIZE_SHA1], u_int16_t counter))nop;
this->public.destroy = (void(*)(eap_sim_file_card_t*))destroy;
-
- /* this SIM card implementation does not have an ID, serve ID_ANY */
- this->imsi = identification_create_from_encoding(ID_ANY, chunk_empty);
+
this->triplets = triplets;
-
+
return &this->public;
}
diff --git a/src/charon/plugins/eap_sim_file/eap_sim_file_card.h b/src/charon/plugins/eap_sim_file/eap_sim_file_card.h
index e7160a33b..1a5470968 100644
--- a/src/charon/plugins/eap_sim_file/eap_sim_file_card.h
+++ b/src/charon/plugins/eap_sim_file/eap_sim_file_card.h
@@ -36,7 +36,7 @@ struct eap_sim_file_card_t {
* Implements sim_card_t interface
*/
sim_card_t card;
-
+
/**
* Destroy a eap_sim_file_card_t.
*/
@@ -50,4 +50,4 @@ struct eap_sim_file_card_t {
*/
eap_sim_file_card_t *eap_sim_file_card_create(eap_sim_file_triplets_t *triplets);
-#endif /** EAP_SIM_FILE_CARD_ @}*/
+#endif /** EAP_SIM_FILE_CARD_H_ @}*/
diff --git a/src/charon/plugins/eap_sim_file/eap_sim_file_plugin.c b/src/charon/plugins/eap_sim_file/eap_sim_file_plugin.c
index eb6fb4c9c..22ad31703 100644
--- a/src/charon/plugins/eap_sim_file/eap_sim_file_plugin.c
+++ b/src/charon/plugins/eap_sim_file/eap_sim_file_plugin.c
@@ -28,22 +28,22 @@ typedef struct private_eap_sim_file_t private_eap_sim_file_t;
* Private data of an eap_sim_file_t object.
*/
struct private_eap_sim_file_t {
-
+
/**
* Public eap_sim_file_plugin_t interface.
*/
eap_sim_file_plugin_t public;
-
+
/**
* SIM card
*/
eap_sim_file_card_t *card;
-
+
/**
* SIM provider
*/
eap_sim_file_provider_t *provider;
-
+
/**
* Triplet source
*/
@@ -69,16 +69,22 @@ static void destroy(private_eap_sim_file_t *this)
plugin_t *plugin_create()
{
private_eap_sim_file_t *this = malloc_thing(private_eap_sim_file_t);
-
+
this->public.plugin.destroy = (void(*)(plugin_t*))destroy;
-
+
this->triplets = eap_sim_file_triplets_create(TRIPLET_FILE);
- this->card = eap_sim_file_card_create(this->triplets);
this->provider = eap_sim_file_provider_create(this->triplets);
-
+ if (!this->provider)
+ {
+ this->triplets->destroy(this->triplets);
+ free(this);
+ return NULL;
+ }
+ this->card = eap_sim_file_card_create(this->triplets);
+
charon->sim->add_card(charon->sim, &this->card->card);
charon->sim->add_provider(charon->sim, &this->provider->provider);
-
+
return &this->public.plugin;
}
diff --git a/src/charon/plugins/eap_sim_file/eap_sim_file_provider.c b/src/charon/plugins/eap_sim_file/eap_sim_file_provider.c
index 89866ade6..9bee31fc3 100644
--- a/src/charon/plugins/eap_sim_file/eap_sim_file_provider.c
+++ b/src/charon/plugins/eap_sim_file/eap_sim_file_provider.c
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2008 Martin Willi
+ * Copyright (C) 2008-2009 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
@@ -15,21 +15,23 @@
#include "eap_sim_file_provider.h"
+#include <daemon.h>
+
typedef struct private_eap_sim_file_provider_t private_eap_sim_file_provider_t;
/**
* Private data of an eap_sim_file_provider_t object.
*/
struct private_eap_sim_file_provider_t {
-
+
/**
* Public eap_sim_file_provider_t interface.
*/
eap_sim_file_provider_t public;
-
+
/**
- * source of triplets
- */
+ * source of triplets
+ */
eap_sim_file_triplets_t *triplets;
};
@@ -37,21 +39,20 @@ struct private_eap_sim_file_provider_t {
* Implementation of sim_provider_t.get_triplet
*/
static bool get_triplet(private_eap_sim_file_provider_t *this,
- identification_t *imsi,
- char *rand, char *sres, char *kc)
+ identification_t *id, char *rand, char *sres, char *kc)
{
enumerator_t *enumerator;
- identification_t *id;
+ identification_t *cand;
char *c_rand, *c_sres, *c_kc;
-
+
enumerator = this->triplets->create_enumerator(this->triplets);
- while (enumerator->enumerate(enumerator, &id, &c_rand, &c_sres, &c_kc))
+ while (enumerator->enumerate(enumerator, &cand, &c_rand, &c_sres, &c_kc))
{
- if (imsi->matches(imsi, id))
+ if (id->matches(id, cand))
{
- memcpy(rand, c_rand, RAND_LEN);
- memcpy(sres, c_sres, SRES_LEN);
- memcpy(kc, c_kc, KC_LEN);
+ memcpy(rand, c_rand, SIM_RAND_LEN);
+ memcpy(sres, c_sres, SIM_SRES_LEN);
+ memcpy(kc, c_kc, SIM_KC_LEN);
enumerator->destroy(enumerator);
return TRUE;
}
@@ -75,12 +76,18 @@ eap_sim_file_provider_t *eap_sim_file_provider_create(
eap_sim_file_triplets_t *triplets)
{
private_eap_sim_file_provider_t *this = malloc_thing(private_eap_sim_file_provider_t);
-
- this->public.provider.get_triplet = (bool(*)(sim_provider_t*, identification_t *imsi, char rand[16], char sres[4], char kc[8]))get_triplet;
+
+ this->public.provider.get_triplet = (bool(*)(sim_provider_t*, identification_t *id, char rand[SIM_RAND_LEN], char sres[SIM_SRES_LEN], char kc[SIM_KC_LEN]))get_triplet;
+ this->public.provider.get_quintuplet = (bool(*)(sim_provider_t*, identification_t *id, char rand[AKA_RAND_LEN], char xres[AKA_RES_MAX], int *xres_len, char ck[AKA_CK_LEN], char ik[AKA_IK_LEN], char autn[AKA_AUTN_LEN]))return_false;
+ this->public.provider.resync = (bool(*)(sim_provider_t*, identification_t *id, char rand[AKA_RAND_LEN], char auts[AKA_AUTS_LEN]))return_false;
+ this->public.provider.is_pseudonym = (identification_t*(*)(sim_provider_t*, identification_t *id))return_null;
+ this->public.provider.gen_pseudonym = (identification_t*(*)(sim_provider_t*, identification_t *id))return_null;
+ this->public.provider.is_reauth = (identification_t*(*)(sim_provider_t*, identification_t *id, char [HASH_SIZE_SHA1], u_int16_t *counter))return_null;
+ this->public.provider.gen_reauth = (identification_t*(*)(sim_provider_t*, identification_t *id, char mk[HASH_SIZE_SHA1]))return_null;
this->public.destroy = (void(*)(eap_sim_file_provider_t*))destroy;
-
+
this->triplets = triplets;
-
+
return &this->public;
}
diff --git a/src/charon/plugins/eap_sim_file/eap_sim_file_provider.h b/src/charon/plugins/eap_sim_file/eap_sim_file_provider.h
index ec3bfb469..10fda282a 100644
--- a/src/charon/plugins/eap_sim_file/eap_sim_file_provider.h
+++ b/src/charon/plugins/eap_sim_file/eap_sim_file_provider.h
@@ -23,8 +23,6 @@
#include "eap_sim_file_triplets.h"
-#include <sa/authenticators/eap/sim_manager.h>
-
typedef struct eap_sim_file_provider_t eap_sim_file_provider_t;
/**
@@ -36,7 +34,7 @@ struct eap_sim_file_provider_t {
* Implements sim_provider_t interface.
*/
sim_provider_t provider;
-
+
/**
* Destroy a eap_sim_file_provider_t.
*/
@@ -49,4 +47,4 @@ struct eap_sim_file_provider_t {
eap_sim_file_provider_t *eap_sim_file_provider_create(
eap_sim_file_triplets_t *triplets);
-#endif /** EAP_SIM_FILE_PROVIDER_ @}*/
+#endif /** EAP_SIM_FILE_PROVIDER_H_ @}*/
diff --git a/src/charon/plugins/eap_sim_file/eap_sim_file_triplets.c b/src/charon/plugins/eap_sim_file/eap_sim_file_triplets.c
index e27ed6860..6b7d99fb7 100644
--- a/src/charon/plugins/eap_sim_file/eap_sim_file_triplets.c
+++ b/src/charon/plugins/eap_sim_file/eap_sim_file_triplets.c
@@ -20,7 +20,7 @@
#include <daemon.h>
#include <utils/linked_list.h>
-#include <utils/mutex.h>
+#include <threading/mutex.h>
typedef struct private_eap_sim_file_triplets_t private_eap_sim_file_triplets_t;
@@ -28,17 +28,17 @@ typedef struct private_eap_sim_file_triplets_t private_eap_sim_file_triplets_t;
* Private data of an eap_sim_file_triplets_t object.
*/
struct private_eap_sim_file_triplets_t {
-
+
/**
* Public eap_sim_file_triplets_t interface.
*/
eap_sim_file_triplets_t public;
-
+
/**
* List of triplets, as triplet_t
*/
linked_list_t *triplets;
-
+
/**
* mutex to lock triplets list
*/
@@ -50,9 +50,9 @@ struct private_eap_sim_file_triplets_t {
*/
typedef struct {
identification_t *imsi;
- char rand[RAND_LEN];
- char sres[SRES_LEN];
- char kc[KC_LEN];
+ char rand[SIM_RAND_LEN];
+ char sres[SIM_SRES_LEN];
+ char kc[SIM_KC_LEN];
} triplet_t;
/**
@@ -60,7 +60,7 @@ typedef struct {
*/
static void triplet_destroy(triplet_t *this)
{
- this->imsi->destroy(this->imsi);
+ DESTROY_IF(this->imsi);
free(this);
}
@@ -103,7 +103,7 @@ static bool enumerator_enumerate(triplet_enumerator_t *e, identification_t **ims
char **rand, char **sres, char **kc)
{
triplet_t *triplet;
-
+
if (e->inner->enumerate(e->inner, &triplet))
{
e->current = triplet;
@@ -123,14 +123,14 @@ static bool enumerator_enumerate(triplet_enumerator_t *e, identification_t **ims
static enumerator_t* create_enumerator(private_eap_sim_file_triplets_t *this)
{
triplet_enumerator_t *enumerator = malloc_thing(triplet_enumerator_t);
-
+
this->mutex->lock(this->mutex);
enumerator->public.enumerate = (void*)enumerator_enumerate;
enumerator->public.destroy = (void*)enumerator_destroy;
enumerator->inner = this->triplets->create_enumerator(this->triplets);
enumerator->current = NULL;
enumerator->this = this;
-
+
return &enumerator->public;
}
@@ -140,7 +140,7 @@ static enumerator_t* create_enumerator(private_eap_sim_file_triplets_t *this)
static void parse_token(char *to, char *from, size_t len)
{
chunk_t chunk;
-
+
chunk = chunk_create(from, min(strlen(from), len * 2));
chunk = chunk_from_hex(chunk, NULL);
memset(to, 0, len);
@@ -156,22 +156,22 @@ static void read_triplets(private_eap_sim_file_triplets_t *this, char *path)
char line[512];
FILE *file;
int i, nr = 0;
-
+
file = fopen(path, "r");
if (file == NULL)
{
- DBG1(DBG_CFG, "opening triplet file %s failed: %s",
+ DBG1(DBG_CFG, "opening triplet file %s failed: %s",
path, strerror(errno));
return;
}
-
+
/* read line by line */
while (fgets(line, sizeof(line), file))
{
triplet_t *triplet;
enumerator_t *enumerator;
char *token;
-
+
nr++;
/* skip comments, empty lines */
switch (line[0])
@@ -186,7 +186,7 @@ static void read_triplets(private_eap_sim_file_triplets_t *this, char *path)
}
triplet = malloc_thing(triplet_t);
memset(triplet, 0, sizeof(triplet_t));
-
+
i = 0;
enumerator = enumerator_create_token(line, ",", " \n\r#");
while (enumerator->enumerate(enumerator, &token))
@@ -197,13 +197,13 @@ static void read_triplets(private_eap_sim_file_triplets_t *this, char *path)
triplet->imsi = identification_create_from_string(token);
continue;
case 1: /* rand */
- parse_token(triplet->rand, token, RAND_LEN);
+ parse_token(triplet->rand, token, SIM_RAND_LEN);
continue;
case 2: /* sres */
- parse_token(triplet->sres, token, SRES_LEN);
+ parse_token(triplet->sres, token, SIM_SRES_LEN);
continue;
case 3: /* kc */
- parse_token(triplet->kc, token, KC_LEN);
+ parse_token(triplet->kc, token, SIM_KC_LEN);
continue;
default:
break;;
@@ -217,15 +217,15 @@ static void read_triplets(private_eap_sim_file_triplets_t *this, char *path)
triplet_destroy(triplet);
continue;
}
-
+
DBG2(DBG_CFG, "triplet: imsi %Y\nrand %b\nsres %b\nkc %b",
- triplet->imsi, triplet->rand, RAND_LEN,
- triplet->sres, SRES_LEN, triplet->kc, KC_LEN);
-
+ triplet->imsi, triplet->rand, SIM_RAND_LEN,
+ triplet->sres, SIM_SRES_LEN, triplet->kc, SIM_KC_LEN);
+
this->triplets->insert_last(this->triplets, triplet);
}
fclose(file);
-
+
DBG1(DBG_CFG, "read %d triplets from %s",
this->triplets->get_count(this->triplets), path);
}
@@ -246,15 +246,15 @@ static void destroy(private_eap_sim_file_triplets_t *this)
eap_sim_file_triplets_t *eap_sim_file_triplets_create(char *file)
{
private_eap_sim_file_triplets_t *this = malloc_thing(private_eap_sim_file_triplets_t);
-
+
this->public.create_enumerator = (enumerator_t*(*)(eap_sim_file_triplets_t*))create_enumerator;
this->public.destroy = (void(*)(eap_sim_file_triplets_t*))destroy;
-
+
this->triplets = linked_list_create();
this->mutex = mutex_create(MUTEX_TYPE_DEFAULT);
-
+
read_triplets(this, file);
-
+
return &this->public;
}
diff --git a/src/charon/plugins/eap_sim_file/eap_sim_file_triplets.h b/src/charon/plugins/eap_sim_file/eap_sim_file_triplets.h
index d4ff2a781..8f8130810 100644
--- a/src/charon/plugins/eap_sim_file/eap_sim_file_triplets.h
+++ b/src/charon/plugins/eap_sim_file/eap_sim_file_triplets.h
@@ -21,23 +21,7 @@
#ifndef EAP_SIM_FILE_TRIPLETS_H_
#define EAP_SIM_FILE_TRIPLETS_H_
-#include <utils/enumerator.h>
-#include <utils/identification.h>
-
-/**
- * size of RAND value
- */
-#define RAND_LEN 16
-
-/**
- * size of SRES value
- */
-#define SRES_LEN 4
-
-/**
- * size of KC value
- */
-#define KC_LEN 8
+#include <sa/authenticators/eap/sim_manager.h>
typedef struct eap_sim_file_triplets_t eap_sim_file_triplets_t;
@@ -69,4 +53,4 @@ struct eap_sim_file_triplets_t {
*/
eap_sim_file_triplets_t *eap_sim_file_triplets_create(char *file);
-#endif /** EAP_SIM_FILE_TRIPLETS_ @}*/
+#endif /** EAP_SIM_FILE_TRIPLETS_H_ @}*/
diff --git a/src/charon/plugins/eap_simaka_pseudonym/Makefile.am b/src/charon/plugins/eap_simaka_pseudonym/Makefile.am
new file mode 100644
index 000000000..fe87d6d62
--- /dev/null
+++ b/src/charon/plugins/eap_simaka_pseudonym/Makefile.am
@@ -0,0 +1,13 @@
+
+INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
+
+AM_CFLAGS = -rdynamic
+
+plugin_LTLIBRARIES = libstrongswan-eap-simaka-pseudonym.la
+
+libstrongswan_eap_simaka_pseudonym_la_SOURCES = \
+ eap_simaka_pseudonym_plugin.h eap_simaka_pseudonym_plugin.c \
+ eap_simaka_pseudonym_card.h eap_simaka_pseudonym_card.c \
+ eap_simaka_pseudonym_provider.h eap_simaka_pseudonym_provider.c
+libstrongswan_eap_simaka_pseudonym_la_LDFLAGS = -module -avoid-version
+
diff --git a/src/charon/plugins/eap_simaka_pseudonym/Makefile.in b/src/charon/plugins/eap_simaka_pseudonym/Makefile.in
new file mode 100644
index 000000000..392331fb1
--- /dev/null
+++ b/src/charon/plugins/eap_simaka_pseudonym/Makefile.in
@@ -0,0 +1,577 @@
+# Makefile.in generated by automake 1.11 from Makefile.am.
+# @configure_input@
+
+# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,
+# 2003, 2004, 2005, 2006, 2007, 2008, 2009 Free Software Foundation,
+# Inc.
+# This Makefile.in is free software; the Free Software Foundation
+# gives unlimited permission to copy and/or distribute it,
+# with or without modifications, as long as this notice is preserved.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY, to the extent permitted by law; without
+# even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+# PARTICULAR PURPOSE.
+
+@SET_MAKE@
+
+VPATH = @srcdir@
+pkgdatadir = $(datadir)/@PACKAGE@
+pkgincludedir = $(includedir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkglibexecdir = $(libexecdir)/@PACKAGE@
+am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
+install_sh_DATA = $(install_sh) -c -m 644
+install_sh_PROGRAM = $(install_sh) -c
+install_sh_SCRIPT = $(install_sh) -c
+INSTALL_HEADER = $(INSTALL_DATA)
+transform = $(program_transform_name)
+NORMAL_INSTALL = :
+PRE_INSTALL = :
+POST_INSTALL = :
+NORMAL_UNINSTALL = :
+PRE_UNINSTALL = :
+POST_UNINSTALL = :
+build_triplet = @build@
+host_triplet = @host@
+subdir = src/charon/plugins/eap_simaka_pseudonym
+DIST_COMMON = $(srcdir)/Makefile.am $(srcdir)/Makefile.in
+ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
+am__aclocal_m4_deps = $(top_srcdir)/m4/config/libtool.m4 \
+ $(top_srcdir)/m4/config/ltoptions.m4 \
+ $(top_srcdir)/m4/config/ltsugar.m4 \
+ $(top_srcdir)/m4/config/ltversion.m4 \
+ $(top_srcdir)/m4/config/lt~obsolete.m4 \
+ $(top_srcdir)/m4/macros/with.m4 \
+ $(top_srcdir)/m4/macros/enable-disable.m4 \
+ $(top_srcdir)/configure.in
+am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
+ $(ACLOCAL_M4)
+mkinstalldirs = $(install_sh) -d
+CONFIG_CLEAN_FILES =
+CONFIG_CLEAN_VPATH_FILES =
+am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
+am__vpath_adj = case $$p in \
+ $(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
+ *) f=$$p;; \
+ esac;
+am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
+am__install_max = 40
+am__nobase_strip_setup = \
+ srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
+am__nobase_strip = \
+ for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
+am__nobase_list = $(am__nobase_strip_setup); \
+ for p in $$list; do echo "$$p $$p"; done | \
+ sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
+ $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
+ if (++n[$$2] == $(am__install_max)) \
+ { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
+ END { for (dir in files) print dir, files[dir] }'
+am__base_list = \
+ sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
+ sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
+am__installdirs = "$(DESTDIR)$(plugindir)"
+LTLIBRARIES = $(plugin_LTLIBRARIES)
+libstrongswan_eap_simaka_pseudonym_la_LIBADD =
+am_libstrongswan_eap_simaka_pseudonym_la_OBJECTS = \
+ eap_simaka_pseudonym_plugin.lo eap_simaka_pseudonym_card.lo \
+ eap_simaka_pseudonym_provider.lo
+libstrongswan_eap_simaka_pseudonym_la_OBJECTS = \
+ $(am_libstrongswan_eap_simaka_pseudonym_la_OBJECTS)
+libstrongswan_eap_simaka_pseudonym_la_LINK = $(LIBTOOL) --tag=CC \
+ $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \
+ $(AM_CFLAGS) $(CFLAGS) \
+ $(libstrongswan_eap_simaka_pseudonym_la_LDFLAGS) $(LDFLAGS) -o \
+ $@
+DEFAULT_INCLUDES = -I.@am__isrc@
+depcomp = $(SHELL) $(top_srcdir)/depcomp
+am__depfiles_maybe = depfiles
+am__mv = mv -f
+COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
+ $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
+LTCOMPILE = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
+ --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) \
+ $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
+CCLD = $(CC)
+LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
+ --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) $(AM_LDFLAGS) \
+ $(LDFLAGS) -o $@
+SOURCES = $(libstrongswan_eap_simaka_pseudonym_la_SOURCES)
+DIST_SOURCES = $(libstrongswan_eap_simaka_pseudonym_la_SOURCES)
+ETAGS = etags
+CTAGS = ctags
+DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
+ACLOCAL = @ACLOCAL@
+ALLOCA = @ALLOCA@
+AMTAR = @AMTAR@
+AR = @AR@
+AUTOCONF = @AUTOCONF@
+AUTOHEADER = @AUTOHEADER@
+AUTOMAKE = @AUTOMAKE@
+AWK = @AWK@
+BTLIB = @BTLIB@
+CC = @CC@
+CCDEPMODE = @CCDEPMODE@
+CFLAGS = @CFLAGS@
+CPP = @CPP@
+CPPFLAGS = @CPPFLAGS@
+CYGPATH_W = @CYGPATH_W@
+DEFS = @DEFS@
+DEPDIR = @DEPDIR@
+DLLIB = @DLLIB@
+DSYMUTIL = @DSYMUTIL@
+DUMPBIN = @DUMPBIN@
+ECHO_C = @ECHO_C@
+ECHO_N = @ECHO_N@
+ECHO_T = @ECHO_T@
+EGREP = @EGREP@
+EXEEXT = @EXEEXT@
+FGREP = @FGREP@
+GPERF = @GPERF@
+GREP = @GREP@
+INSTALL = @INSTALL@
+INSTALL_DATA = @INSTALL_DATA@
+INSTALL_PROGRAM = @INSTALL_PROGRAM@
+INSTALL_SCRIPT = @INSTALL_SCRIPT@
+INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
+LD = @LD@
+LDFLAGS = @LDFLAGS@
+LEX = @LEX@
+LEXLIB = @LEXLIB@
+LEX_OUTPUT_ROOT = @LEX_OUTPUT_ROOT@
+LIBOBJS = @LIBOBJS@
+LIBS = @LIBS@
+LIBTOOL = @LIBTOOL@
+LIPO = @LIPO@
+LN_S = @LN_S@
+LTLIBOBJS = @LTLIBOBJS@
+MAKEINFO = @MAKEINFO@
+MKDIR_P = @MKDIR_P@
+MYSQLCFLAG = @MYSQLCFLAG@
+MYSQLCONFIG = @MYSQLCONFIG@
+MYSQLLIB = @MYSQLLIB@
+NM = @NM@
+NMEDIT = @NMEDIT@
+OBJDUMP = @OBJDUMP@
+OBJEXT = @OBJEXT@
+OTOOL = @OTOOL@
+OTOOL64 = @OTOOL64@
+PACKAGE = @PACKAGE@
+PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
+PACKAGE_NAME = @PACKAGE_NAME@
+PACKAGE_STRING = @PACKAGE_STRING@
+PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_URL = @PACKAGE_URL@
+PACKAGE_VERSION = @PACKAGE_VERSION@
+PATH_SEPARATOR = @PATH_SEPARATOR@
+PERL = @PERL@
+PKG_CONFIG = @PKG_CONFIG@
+PTHREADLIB = @PTHREADLIB@
+RANLIB = @RANLIB@
+RTLIB = @RTLIB@
+RUBY = @RUBY@
+RUBYINCLUDE = @RUBYINCLUDE@
+SED = @SED@
+SET_MAKE = @SET_MAKE@
+SHELL = @SHELL@
+SOCKLIB = @SOCKLIB@
+STRIP = @STRIP@
+VERSION = @VERSION@
+YACC = @YACC@
+YFLAGS = @YFLAGS@
+abs_builddir = @abs_builddir@
+abs_srcdir = @abs_srcdir@
+abs_top_builddir = @abs_top_builddir@
+abs_top_srcdir = @abs_top_srcdir@
+ac_ct_CC = @ac_ct_CC@
+ac_ct_DUMPBIN = @ac_ct_DUMPBIN@
+am__include = @am__include@
+am__leading_dot = @am__leading_dot@
+am__quote = @am__quote@
+am__tar = @am__tar@
+am__untar = @am__untar@
+bindir = @bindir@
+build = @build@
+build_alias = @build_alias@
+build_cpu = @build_cpu@
+build_os = @build_os@
+build_vendor = @build_vendor@
+builddir = @builddir@
+datadir = @datadir@
+datarootdir = @datarootdir@
+default_pkcs11 = @default_pkcs11@
+docdir = @docdir@
+dvidir = @dvidir@
+exec_prefix = @exec_prefix@
+gtk_CFLAGS = @gtk_CFLAGS@
+gtk_LIBS = @gtk_LIBS@
+host = @host@
+host_alias = @host_alias@
+host_cpu = @host_cpu@
+host_os = @host_os@
+host_vendor = @host_vendor@
+htmldir = @htmldir@
+includedir = @includedir@
+infodir = @infodir@
+install_sh = @install_sh@
+ipsecdir = @ipsecdir@
+ipsecgid = @ipsecgid@
+ipsecgroup = @ipsecgroup@
+ipsecuid = @ipsecuid@
+ipsecuser = @ipsecuser@
+libdir = @libdir@
+libexecdir = @libexecdir@
+libstrongswan_plugins = @libstrongswan_plugins@
+linux_headers = @linux_headers@
+localedir = @localedir@
+localstatedir = @localstatedir@
+lt_ECHO = @lt_ECHO@
+mandir = @mandir@
+mkdir_p = @mkdir_p@
+nm_CFLAGS = @nm_CFLAGS@
+nm_LIBS = @nm_LIBS@
+nm_ca_dir = @nm_ca_dir@
+oldincludedir = @oldincludedir@
+pdfdir = @pdfdir@
+piddir = @piddir@
+plugindir = @plugindir@
+pluto_plugins = @pluto_plugins@
+prefix = @prefix@
+program_transform_name = @program_transform_name@
+psdir = @psdir@
+random_device = @random_device@
+resolv_conf = @resolv_conf@
+routing_table = @routing_table@
+routing_table_prio = @routing_table_prio@
+sbindir = @sbindir@
+sharedstatedir = @sharedstatedir@
+srcdir = @srcdir@
+strongswan_conf = @strongswan_conf@
+sysconfdir = @sysconfdir@
+target_alias = @target_alias@
+top_build_prefix = @top_build_prefix@
+top_builddir = @top_builddir@
+top_srcdir = @top_srcdir@
+urandom_device = @urandom_device@
+xml_CFLAGS = @xml_CFLAGS@
+xml_LIBS = @xml_LIBS@
+INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
+AM_CFLAGS = -rdynamic
+plugin_LTLIBRARIES = libstrongswan-eap-simaka-pseudonym.la
+libstrongswan_eap_simaka_pseudonym_la_SOURCES = \
+ eap_simaka_pseudonym_plugin.h eap_simaka_pseudonym_plugin.c \
+ eap_simaka_pseudonym_card.h eap_simaka_pseudonym_card.c \
+ eap_simaka_pseudonym_provider.h eap_simaka_pseudonym_provider.c
+
+libstrongswan_eap_simaka_pseudonym_la_LDFLAGS = -module -avoid-version
+all: all-am
+
+.SUFFIXES:
+.SUFFIXES: .c .lo .o .obj
+$(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps)
+ @for dep in $?; do \
+ case '$(am__configure_deps)' in \
+ *$$dep*) \
+ ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \
+ && { if test -f $@; then exit 0; else break; fi; }; \
+ exit 1;; \
+ esac; \
+ done; \
+ echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/charon/plugins/eap_simaka_pseudonym/Makefile'; \
+ $(am__cd) $(top_srcdir) && \
+ $(AUTOMAKE) --gnu src/charon/plugins/eap_simaka_pseudonym/Makefile
+.PRECIOUS: Makefile
+Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
+ @case '$?' in \
+ *config.status*) \
+ cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
+ *) \
+ echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \
+ cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \
+ esac;
+
+$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
+ cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+
+$(top_srcdir)/configure: $(am__configure_deps)
+ cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(ACLOCAL_M4): $(am__aclocal_m4_deps)
+ cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(am__aclocal_m4_deps):
+install-pluginLTLIBRARIES: $(plugin_LTLIBRARIES)
+ @$(NORMAL_INSTALL)
+ test -z "$(plugindir)" || $(MKDIR_P) "$(DESTDIR)$(plugindir)"
+ @list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+ list2=; for p in $$list; do \
+ if test -f $$p; then \
+ list2="$$list2 $$p"; \
+ else :; fi; \
+ done; \
+ test -z "$$list2" || { \
+ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(plugindir)'"; \
+ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(plugindir)"; \
+ }
+
+uninstall-pluginLTLIBRARIES:
+ @$(NORMAL_UNINSTALL)
+ @list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+ for p in $$list; do \
+ $(am__strip_dir) \
+ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$f'"; \
+ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$f"; \
+ done
+
+clean-pluginLTLIBRARIES:
+ -test -z "$(plugin_LTLIBRARIES)" || rm -f $(plugin_LTLIBRARIES)
+ @list='$(plugin_LTLIBRARIES)'; for p in $$list; do \
+ dir="`echo $$p | sed -e 's|/[^/]*$$||'`"; \
+ test "$$dir" != "$$p" || dir=.; \
+ echo "rm -f \"$${dir}/so_locations\""; \
+ rm -f "$${dir}/so_locations"; \
+ done
+libstrongswan-eap-simaka-pseudonym.la: $(libstrongswan_eap_simaka_pseudonym_la_OBJECTS) $(libstrongswan_eap_simaka_pseudonym_la_DEPENDENCIES)
+ $(libstrongswan_eap_simaka_pseudonym_la_LINK) -rpath $(plugindir) $(libstrongswan_eap_simaka_pseudonym_la_OBJECTS) $(libstrongswan_eap_simaka_pseudonym_la_LIBADD) $(LIBS)
+
+mostlyclean-compile:
+ -rm -f *.$(OBJEXT)
+
+distclean-compile:
+ -rm -f *.tab.c
+
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/eap_simaka_pseudonym_card.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/eap_simaka_pseudonym_plugin.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/eap_simaka_pseudonym_provider.Plo@am__quote@
+
+.c.o:
+@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@ $(COMPILE) -c $<
+
+.c.obj:
+@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@ $(COMPILE) -c `$(CYGPATH_W) '$<'`
+
+.c.lo:
+@am__fastdepCC_TRUE@ $(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@ $(LTCOMPILE) -c -o $@ $<
+
+mostlyclean-libtool:
+ -rm -f *.lo
+
+clean-libtool:
+ -rm -rf .libs _libs
+
+ID: $(HEADERS) $(SOURCES) $(LISP) $(TAGS_FILES)
+ list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
+ unique=`for i in $$list; do \
+ if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
+ done | \
+ $(AWK) '{ files[$$0] = 1; nonempty = 1; } \
+ END { if (nonempty) { for (i in files) print i; }; }'`; \
+ mkid -fID $$unique
+tags: TAGS
+
+TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
+ $(TAGS_FILES) $(LISP)
+ set x; \
+ here=`pwd`; \
+ list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
+ unique=`for i in $$list; do \
+ if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
+ done | \
+ $(AWK) '{ files[$$0] = 1; nonempty = 1; } \
+ END { if (nonempty) { for (i in files) print i; }; }'`; \
+ shift; \
+ if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
+ test -n "$$unique" || unique=$$empty_fix; \
+ if test $$# -gt 0; then \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ "$$@" $$unique; \
+ else \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ $$unique; \
+ fi; \
+ fi
+ctags: CTAGS
+CTAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
+ $(TAGS_FILES) $(LISP)
+ list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
+ unique=`for i in $$list; do \
+ if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
+ done | \
+ $(AWK) '{ files[$$0] = 1; nonempty = 1; } \
+ END { if (nonempty) { for (i in files) print i; }; }'`; \
+ test -z "$(CTAGS_ARGS)$$unique" \
+ || $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
+ $$unique
+
+GTAGS:
+ here=`$(am__cd) $(top_builddir) && pwd` \
+ && $(am__cd) $(top_srcdir) \
+ && gtags -i $(GTAGS_ARGS) "$$here"
+
+distclean-tags:
+ -rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
+
+distdir: $(DISTFILES)
+ @srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
+ topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
+ list='$(DISTFILES)'; \
+ dist_files=`for file in $$list; do echo $$file; done | \
+ sed -e "s|^$$srcdirstrip/||;t" \
+ -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \
+ case $$dist_files in \
+ */*) $(MKDIR_P) `echo "$$dist_files" | \
+ sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \
+ sort -u` ;; \
+ esac; \
+ for file in $$dist_files; do \
+ if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
+ if test -d $$d/$$file; then \
+ dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
+ if test -d "$(distdir)/$$file"; then \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+ fi; \
+ if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
+ cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+ fi; \
+ cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
+ else \
+ test -f "$(distdir)/$$file" \
+ || cp -p $$d/$$file "$(distdir)/$$file" \
+ || exit 1; \
+ fi; \
+ done
+check-am: all-am
+check: check-am
+all-am: Makefile $(LTLIBRARIES)
+installdirs:
+ for dir in "$(DESTDIR)$(plugindir)"; do \
+ test -z "$$dir" || $(MKDIR_P) "$$dir"; \
+ done
+install: install-am
+install-exec: install-exec-am
+install-data: install-data-am
+uninstall: uninstall-am
+
+install-am: all-am
+ @$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am
+
+installcheck: installcheck-am
+install-strip:
+ $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
+ install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
+ `test -z '$(STRIP)' || \
+ echo "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'"` install
+mostlyclean-generic:
+
+clean-generic:
+
+distclean-generic:
+ -test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+ -test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
+
+maintainer-clean-generic:
+ @echo "This command is intended for maintainers to use"
+ @echo "it deletes files that may require special tools to rebuild."
+clean: clean-am
+
+clean-am: clean-generic clean-libtool clean-pluginLTLIBRARIES \
+ mostlyclean-am
+
+distclean: distclean-am
+ -rm -rf ./$(DEPDIR)
+ -rm -f Makefile
+distclean-am: clean-am distclean-compile distclean-generic \
+ distclean-tags
+
+dvi: dvi-am
+
+dvi-am:
+
+html: html-am
+
+html-am:
+
+info: info-am
+
+info-am:
+
+install-data-am: install-pluginLTLIBRARIES
+
+install-dvi: install-dvi-am
+
+install-dvi-am:
+
+install-exec-am:
+
+install-html: install-html-am
+
+install-html-am:
+
+install-info: install-info-am
+
+install-info-am:
+
+install-man:
+
+install-pdf: install-pdf-am
+
+install-pdf-am:
+
+install-ps: install-ps-am
+
+install-ps-am:
+
+installcheck-am:
+
+maintainer-clean: maintainer-clean-am
+ -rm -rf ./$(DEPDIR)
+ -rm -f Makefile
+maintainer-clean-am: distclean-am maintainer-clean-generic
+
+mostlyclean: mostlyclean-am
+
+mostlyclean-am: mostlyclean-compile mostlyclean-generic \
+ mostlyclean-libtool
+
+pdf: pdf-am
+
+pdf-am:
+
+ps: ps-am
+
+ps-am:
+
+uninstall-am: uninstall-pluginLTLIBRARIES
+
+.MAKE: install-am install-strip
+
+.PHONY: CTAGS GTAGS all all-am check check-am clean clean-generic \
+ clean-libtool clean-pluginLTLIBRARIES ctags distclean \
+ distclean-compile distclean-generic distclean-libtool \
+ distclean-tags distdir dvi dvi-am html html-am info info-am \
+ install install-am install-data install-data-am install-dvi \
+ install-dvi-am install-exec install-exec-am install-html \
+ install-html-am install-info install-info-am install-man \
+ install-pdf install-pdf-am install-pluginLTLIBRARIES \
+ install-ps install-ps-am install-strip installcheck \
+ installcheck-am installdirs maintainer-clean \
+ maintainer-clean-generic mostlyclean mostlyclean-compile \
+ mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \
+ tags uninstall uninstall-am uninstall-pluginLTLIBRARIES
+
+
+# Tell versions [3.59,3.63) of GNU make to not export all variables.
+# Otherwise a system limit (for SysV at least) may be exceeded.
+.NOEXPORT:
diff --git a/src/charon/plugins/eap_simaka_pseudonym/eap_simaka_pseudonym_card.c b/src/charon/plugins/eap_simaka_pseudonym/eap_simaka_pseudonym_card.c
new file mode 100644
index 000000000..9b0f1bc71
--- /dev/null
+++ b/src/charon/plugins/eap_simaka_pseudonym/eap_simaka_pseudonym_card.c
@@ -0,0 +1,154 @@
+/*
+ * Copyright (C) 2009 Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+
+#include "eap_simaka_pseudonym_card.h"
+
+#include <daemon.h>
+#include <utils/hashtable.h>
+
+typedef struct private_eap_simaka_pseudonym_card_t private_eap_simaka_pseudonym_card_t;
+
+/**
+ * Private data of an eap_simaka_pseudonym_card_t object.
+ */
+struct private_eap_simaka_pseudonym_card_t {
+
+ /**
+ * Public eap_simaka_pseudonym_card_t interface.
+ */
+ eap_simaka_pseudonym_card_t public;
+
+ /**
+ * Permanent -> pseudonym mappings
+ */
+ hashtable_t *pseudonym;
+
+ /**
+ * Reverse pseudonym -> permanent mappings
+ */
+ hashtable_t *permanent;
+};
+
+/**
+ * hashtable hash function
+ */
+static u_int hash(identification_t *key)
+{
+ return chunk_hash(key->get_encoding(key));
+}
+
+/**
+ * hashtable equals function
+ */
+static bool equals(identification_t *key1, identification_t *key2)
+{
+ return key1->equals(key1, key2);
+}
+
+/**
+ * Implementation of sim_card_t.get_pseudonym
+ */
+static identification_t *get_pseudonym(private_eap_simaka_pseudonym_card_t *this,
+ identification_t *id)
+{
+ identification_t *pseudonym;
+
+ pseudonym = this->pseudonym->get(this->pseudonym, id);
+ if (pseudonym)
+ {
+ return pseudonym->clone(pseudonym);
+ }
+ return NULL;
+}
+
+/**
+ * Implementation of sim_card_t.set_pseudonym
+ */
+static void set_pseudonym(private_eap_simaka_pseudonym_card_t *this,
+ identification_t *id, identification_t *pseudonym)
+{
+ identification_t *permanent;
+
+ /* create new entries */
+ id = id->clone(id);
+ pseudonym = pseudonym->clone(pseudonym);
+ permanent = this->permanent->put(this->permanent, pseudonym, id);
+ pseudonym = this->pseudonym->put(this->pseudonym, id, pseudonym);
+
+ /* delete old entries */
+ DESTROY_IF(permanent);
+ DESTROY_IF(pseudonym);
+}
+
+/**
+ * Implementation of sim_card_t.get_quintuplet
+ */
+static status_t get_quintuplet()
+{
+ return NOT_SUPPORTED;
+}
+
+/**
+ * Implementation of eap_simaka_pseudonym_card_t.destroy.
+ */
+static void destroy(private_eap_simaka_pseudonym_card_t *this)
+{
+ enumerator_t *enumerator;
+ identification_t *id;
+ void *key;
+
+ enumerator = this->pseudonym->create_enumerator(this->pseudonym);
+ while (enumerator->enumerate(enumerator, &key, &id))
+ {
+ id->destroy(id);
+ }
+ enumerator->destroy(enumerator);
+
+ enumerator = this->permanent->create_enumerator(this->permanent);
+ while (enumerator->enumerate(enumerator, &key, &id))
+ {
+ id->destroy(id);
+ }
+ enumerator->destroy(enumerator);
+
+ this->pseudonym->destroy(this->pseudonym);
+ this->permanent->destroy(this->permanent);
+ free(this);
+}
+
+/**
+ * See header
+ */
+eap_simaka_pseudonym_card_t *eap_simaka_pseudonym_card_create()
+{
+ private_eap_simaka_pseudonym_card_t *this;
+
+ this = malloc_thing(private_eap_simaka_pseudonym_card_t);
+
+ this->public.card.get_triplet = (bool(*)(sim_card_t*, identification_t *id, char rand[SIM_RAND_LEN], char sres[SIM_SRES_LEN], char kc[SIM_KC_LEN]))return_false;
+ this->public.card.get_quintuplet = (status_t(*)(sim_card_t*, identification_t *id, char rand[AKA_RAND_LEN], char autn[AKA_AUTN_LEN], char ck[AKA_CK_LEN], char ik[AKA_IK_LEN], char res[AKA_RES_MAX], int *res_len))get_quintuplet;
+ this->public.card.resync = (bool(*)(sim_card_t*, identification_t *id, char rand[AKA_RAND_LEN], char auts[AKA_AUTS_LEN]))return_false;
+ this->public.card.get_pseudonym = (identification_t*(*)(sim_card_t*, identification_t *perm))get_pseudonym;
+ this->public.card.set_pseudonym = (void(*)(sim_card_t*, identification_t *id, identification_t *pseudonym))set_pseudonym;
+ this->public.card.get_reauth = (identification_t*(*)(sim_card_t*, identification_t *id, char mk[HASH_SIZE_SHA1], u_int16_t *counter))return_null;
+ this->public.card.set_reauth = (void(*)(sim_card_t*, identification_t *id, identification_t* next, char mk[HASH_SIZE_SHA1], u_int16_t counter))nop;
+ this->public.destroy = (void(*)(eap_simaka_pseudonym_card_t*))destroy;
+
+ this->pseudonym = hashtable_create((void*)hash, (void*)equals, 0);
+ this->permanent = hashtable_create((void*)hash, (void*)equals, 0);
+
+ return &this->public;
+}
+
diff --git a/src/charon/plugins/eap_simaka_pseudonym/eap_simaka_pseudonym_card.h b/src/charon/plugins/eap_simaka_pseudonym/eap_simaka_pseudonym_card.h
new file mode 100644
index 000000000..1b5940fdc
--- /dev/null
+++ b/src/charon/plugins/eap_simaka_pseudonym/eap_simaka_pseudonym_card.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2009 Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+
+/**
+ * @defgroup eap_simaka_pseudonym_card eap_simaka_pseudonym_card
+ * @{ @ingroup eap_simaka_pseudonym
+ */
+
+#ifndef EAP_SIMAKA_PSEUDONYM_CARD_H_
+#define EAP_SIMAKA_PSEUDONYM_CARD_H_
+
+#include <sa/authenticators/eap/sim_manager.h>
+
+typedef struct eap_simaka_pseudonym_card_t eap_simaka_pseudonym_card_t;
+
+/**
+ * SIM card implementing volatile in-memory pseudonym storage.
+ */
+struct eap_simaka_pseudonym_card_t {
+
+ /**
+ * Implements sim_card_t interface
+ */
+ sim_card_t card;
+
+ /**
+ * Destroy a eap_simaka_pseudonym_card_t.
+ */
+ void (*destroy)(eap_simaka_pseudonym_card_t *this);
+};
+
+/**
+ * Create a eap_simaka_pseudonym_card instance.
+ */
+eap_simaka_pseudonym_card_t *eap_simaka_pseudonym_card_create();
+
+#endif /** EAP_SIMAKA_PSEUDONYM_CARD_H_ @}*/
diff --git a/src/charon/plugins/eap_simaka_pseudonym/eap_simaka_pseudonym_plugin.c b/src/charon/plugins/eap_simaka_pseudonym/eap_simaka_pseudonym_plugin.c
new file mode 100644
index 000000000..e4e179a7d
--- /dev/null
+++ b/src/charon/plugins/eap_simaka_pseudonym/eap_simaka_pseudonym_plugin.c
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2009 Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+
+#include "eap_simaka_pseudonym_plugin.h"
+#include "eap_simaka_pseudonym_card.h"
+#include "eap_simaka_pseudonym_provider.h"
+
+#include <daemon.h>
+
+typedef struct private_eap_simaka_pseudonym_t private_eap_simaka_pseudonym_t;
+
+/**
+ * Private data of an eap_simaka_pseudonym_t object.
+ */
+struct private_eap_simaka_pseudonym_t {
+
+ /**
+ * Public eap_simaka_pseudonym_plugin_t interface.
+ */
+ eap_simaka_pseudonym_plugin_t public;
+
+ /**
+ * SIM card
+ */
+ eap_simaka_pseudonym_card_t *card;
+
+ /**
+ * SIM provider
+ */
+ eap_simaka_pseudonym_provider_t *provider;
+};
+
+/**
+ * Implementation of eap_simaka_pseudonym_t.destroy.
+ */
+static void destroy(private_eap_simaka_pseudonym_t *this)
+{
+ charon->sim->remove_card(charon->sim, &this->card->card);
+ charon->sim->remove_provider(charon->sim, &this->provider->provider);
+ this->card->destroy(this->card);
+ this->provider->destroy(this->provider);
+ free(this);
+}
+
+/**
+ * See header
+ */
+plugin_t *plugin_create()
+{
+ private_eap_simaka_pseudonym_t *this;
+
+ this = malloc_thing(private_eap_simaka_pseudonym_t);
+
+ this->public.plugin.destroy = (void(*)(plugin_t*))destroy;
+
+ this->provider = eap_simaka_pseudonym_provider_create();
+ if (!this->provider)
+ {
+ free(this);
+ return NULL;
+ }
+ this->card = eap_simaka_pseudonym_card_create();
+
+ charon->sim->add_card(charon->sim, &this->card->card);
+ charon->sim->add_provider(charon->sim, &this->provider->provider);
+
+ return &this->public.plugin;
+}
+
diff --git a/src/charon/plugins/eap_simaka_pseudonym/eap_simaka_pseudonym_plugin.h b/src/charon/plugins/eap_simaka_pseudonym/eap_simaka_pseudonym_plugin.h
new file mode 100644
index 000000000..032604eb1
--- /dev/null
+++ b/src/charon/plugins/eap_simaka_pseudonym/eap_simaka_pseudonym_plugin.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2009 Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+
+/**
+ * @defgroup eap_simaka_pseudonym eap_simaka_pseudonym
+ * @ingroup cplugins
+ *
+ * @defgroup eap_simaka_pseudonym_plugin eap_simaka_pseudonym_plugin
+ * @{ @ingroup eap_simaka_pseudonym
+ */
+
+#ifndef EAP_SIMAKA_PSEUDONYM_PLUGIN_H_
+#define EAP_SIMAKA_PSEUDONYM_PLUGIN_H_
+
+#include <plugins/plugin.h>
+
+typedef struct eap_simaka_pseudonym_plugin_t eap_simaka_pseudonym_plugin_t;
+
+/**
+ * Plugin to provide in-memory storage of EAP-SIM/AKA pseudonyms.
+ */
+struct eap_simaka_pseudonym_plugin_t {
+
+ /**
+ * implements plugin interface
+ */
+ plugin_t plugin;
+};
+
+/**
+ * Create a eap_simaka_pseudonym_plugin instance.
+ */
+plugin_t *plugin_create();
+
+#endif /** EAP_SIMAKA_PSEUDONYM_PLUGIN_H_ @}*/
diff --git a/src/charon/plugins/eap_simaka_pseudonym/eap_simaka_pseudonym_provider.c b/src/charon/plugins/eap_simaka_pseudonym/eap_simaka_pseudonym_provider.c
new file mode 100644
index 000000000..0613b8807
--- /dev/null
+++ b/src/charon/plugins/eap_simaka_pseudonym/eap_simaka_pseudonym_provider.c
@@ -0,0 +1,182 @@
+/*
+ * Copyright (C) 2009 Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+
+#include "eap_simaka_pseudonym_provider.h"
+
+#include <utils/hashtable.h>
+
+typedef struct private_eap_simaka_pseudonym_provider_t private_eap_simaka_pseudonym_provider_t;
+
+/**
+ * Private data of an eap_simaka_pseudonym_provider_t object.
+ */
+struct private_eap_simaka_pseudonym_provider_t {
+
+ /**
+ * Public eap_simaka_pseudonym_provider_t interface.
+ */
+ eap_simaka_pseudonym_provider_t public;
+
+ /**
+ * Permanent -> pseudonym mappings
+ */
+ hashtable_t *pseudonym;
+
+ /**
+ * Reverse pseudonym -> permanent mappings
+ */
+ hashtable_t *permanent;
+
+ /**
+ * RNG for pseudonyms/reauth identities
+ */
+ rng_t *rng;
+};
+
+/**
+ * hashtable hash function
+ */
+static u_int hash(identification_t *key)
+{
+ return chunk_hash(key->get_encoding(key));
+}
+
+/**
+ * hashtable equals function
+ */
+static bool equals(identification_t *key1, identification_t *key2)
+{
+ return key1->equals(key1, key2);
+}
+
+/**
+ * Implementation of sim_provider_t.is_pseudonym
+ */
+static identification_t* is_pseudonym(
+ private_eap_simaka_pseudonym_provider_t *this, identification_t *id)
+{
+ identification_t *permanent;
+
+ permanent = this->permanent->get(this->permanent, id);
+ if (permanent)
+ {
+ return permanent->clone(permanent);
+ }
+ return NULL;
+}
+
+/**
+ * Generate a random identity
+ */
+static identification_t *gen_identity(
+ private_eap_simaka_pseudonym_provider_t *this)
+{
+ char buf[8], hex[sizeof(buf) * 2 + 1];
+
+ this->rng->get_bytes(this->rng, sizeof(buf), buf);
+ chunk_to_hex(chunk_create(buf, sizeof(buf)), hex, FALSE);
+
+ return identification_create_from_string(hex);
+}
+
+/**
+ * Implementation of sim_provider_t.get_pseudonym
+ */
+static identification_t* gen_pseudonym(
+ private_eap_simaka_pseudonym_provider_t *this, identification_t *id)
+{
+ identification_t *pseudonym, *permanent;
+
+ /* remove old entry */
+ pseudonym = this->pseudonym->remove(this->pseudonym, id);
+ if (pseudonym)
+ {
+ permanent = this->permanent->remove(this->permanent, pseudonym);
+ if (permanent)
+ {
+ permanent->destroy(permanent);
+ }
+ pseudonym->destroy(pseudonym);
+ }
+
+ pseudonym = gen_identity(this);
+
+ /* create new entries */
+ id = id->clone(id);
+ this->pseudonym->put(this->pseudonym, id, pseudonym);
+ this->permanent->put(this->permanent, pseudonym, id);
+
+ return pseudonym->clone(pseudonym);
+}
+
+/**
+ * Implementation of eap_simaka_pseudonym_provider_t.destroy.
+ */
+static void destroy(private_eap_simaka_pseudonym_provider_t *this)
+{
+ enumerator_t *enumerator;
+ identification_t *id;
+ void *key;
+
+ enumerator = this->pseudonym->create_enumerator(this->pseudonym);
+ while (enumerator->enumerate(enumerator, &key, &id))
+ {
+ id->destroy(id);
+ }
+ enumerator->destroy(enumerator);
+
+ enumerator = this->permanent->create_enumerator(this->permanent);
+ while (enumerator->enumerate(enumerator, &key, &id))
+ {
+ id->destroy(id);
+ }
+ enumerator->destroy(enumerator);
+
+ this->pseudonym->destroy(this->pseudonym);
+ this->permanent->destroy(this->permanent);
+ this->rng->destroy(this->rng);
+ free(this);
+}
+
+/**
+ * See header
+ */
+eap_simaka_pseudonym_provider_t *eap_simaka_pseudonym_provider_create()
+{
+ private_eap_simaka_pseudonym_provider_t *this;
+
+ this = malloc_thing(private_eap_simaka_pseudonym_provider_t);
+
+ this->public.provider.get_triplet = (bool(*)(sim_provider_t*, identification_t *id, char rand[SIM_RAND_LEN], char sres[SIM_SRES_LEN], char kc[SIM_KC_LEN]))return_false;
+ this->public.provider.get_quintuplet = (bool(*)(sim_provider_t*, identification_t *id, char rand[AKA_RAND_LEN], char xres[AKA_RES_MAX], int *xres_len, char ck[AKA_CK_LEN], char ik[AKA_IK_LEN], char autn[AKA_AUTN_LEN]))return_false;
+ this->public.provider.resync = (bool(*)(sim_provider_t*, identification_t *id, char rand[AKA_RAND_LEN], char auts[AKA_AUTS_LEN]))return_false;
+ this->public.provider.is_pseudonym = (identification_t*(*)(sim_provider_t*, identification_t *id))is_pseudonym;
+ this->public.provider.gen_pseudonym = (identification_t*(*)(sim_provider_t*, identification_t *id))gen_pseudonym;
+ this->public.provider.is_reauth = (identification_t*(*)(sim_provider_t*, identification_t *id, char [HASH_SIZE_SHA1], u_int16_t *counter))return_null;
+ this->public.provider.gen_reauth = (identification_t*(*)(sim_provider_t*, identification_t *id, char mk[HASH_SIZE_SHA1]))return_null;
+ this->public.destroy = (void(*)(eap_simaka_pseudonym_provider_t*))destroy;
+
+ this->rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
+ if (!this->rng)
+ {
+ free(this);
+ return NULL;
+ }
+ this->pseudonym = hashtable_create((void*)hash, (void*)equals, 0);
+ this->permanent = hashtable_create((void*)hash, (void*)equals, 0);
+
+ return &this->public;
+}
+
diff --git a/src/charon/plugins/eap_simaka_pseudonym/eap_simaka_pseudonym_provider.h b/src/charon/plugins/eap_simaka_pseudonym/eap_simaka_pseudonym_provider.h
new file mode 100644
index 000000000..5d8e6d221
--- /dev/null
+++ b/src/charon/plugins/eap_simaka_pseudonym/eap_simaka_pseudonym_provider.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2009 Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+
+/**
+ * @defgroup eap_simaka_pseudonym_provider eap_simaka_pseudonym_provider
+ * @{ @ingroup eap_simaka_pseudonym
+ */
+
+#ifndef EAP_SIMAKA_PSEDUONYM_PROVIDER_H_
+#define EAP_SIMAKA_PSEDUONYM_PROVIDER_H_
+
+#include <sa/authenticators/eap/sim_manager.h>
+
+typedef struct eap_simaka_pseudonym_provider_t eap_simaka_pseudonym_provider_t;
+
+/**
+ * SIM provider implementing volatile in-memory pseudonym storage.
+ */
+struct eap_simaka_pseudonym_provider_t {
+
+ /**
+ * Implements sim_provider_t interface.
+ */
+ sim_provider_t provider;
+
+ /**
+ * Destroy a eap_simaka_pseudonym_provider_t.
+ */
+ void (*destroy)(eap_simaka_pseudonym_provider_t *this);
+};
+
+/**
+ * Create a eap_simaka_pseudonym_provider instance.
+ */
+eap_simaka_pseudonym_provider_t *eap_simaka_pseudonym_provider_create();
+
+#endif /** EAP_SIMAKA_PSEDUONYM_PROVIDER_H_ @}*/
diff --git a/src/charon/plugins/eap_simaka_reauth/Makefile.am b/src/charon/plugins/eap_simaka_reauth/Makefile.am
new file mode 100644
index 000000000..0ba727136
--- /dev/null
+++ b/src/charon/plugins/eap_simaka_reauth/Makefile.am
@@ -0,0 +1,13 @@
+
+INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
+
+AM_CFLAGS = -rdynamic
+
+plugin_LTLIBRARIES = libstrongswan-eap-simaka-reauth.la
+
+libstrongswan_eap_simaka_reauth_la_SOURCES = \
+ eap_simaka_reauth_plugin.h eap_simaka_reauth_plugin.c \
+ eap_simaka_reauth_card.h eap_simaka_reauth_card.c \
+ eap_simaka_reauth_provider.h eap_simaka_reauth_provider.c
+libstrongswan_eap_simaka_reauth_la_LDFLAGS = -module -avoid-version
+
diff --git a/src/charon/plugins/eap_simaka_reauth/Makefile.in b/src/charon/plugins/eap_simaka_reauth/Makefile.in
new file mode 100644
index 000000000..d709acb70
--- /dev/null
+++ b/src/charon/plugins/eap_simaka_reauth/Makefile.in
@@ -0,0 +1,576 @@
+# Makefile.in generated by automake 1.11 from Makefile.am.
+# @configure_input@
+
+# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,
+# 2003, 2004, 2005, 2006, 2007, 2008, 2009 Free Software Foundation,
+# Inc.
+# This Makefile.in is free software; the Free Software Foundation
+# gives unlimited permission to copy and/or distribute it,
+# with or without modifications, as long as this notice is preserved.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY, to the extent permitted by law; without
+# even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+# PARTICULAR PURPOSE.
+
+@SET_MAKE@
+
+VPATH = @srcdir@
+pkgdatadir = $(datadir)/@PACKAGE@
+pkgincludedir = $(includedir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkglibexecdir = $(libexecdir)/@PACKAGE@
+am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
+install_sh_DATA = $(install_sh) -c -m 644
+install_sh_PROGRAM = $(install_sh) -c
+install_sh_SCRIPT = $(install_sh) -c
+INSTALL_HEADER = $(INSTALL_DATA)
+transform = $(program_transform_name)
+NORMAL_INSTALL = :
+PRE_INSTALL = :
+POST_INSTALL = :
+NORMAL_UNINSTALL = :
+PRE_UNINSTALL = :
+POST_UNINSTALL = :
+build_triplet = @build@
+host_triplet = @host@
+subdir = src/charon/plugins/eap_simaka_reauth
+DIST_COMMON = $(srcdir)/Makefile.am $(srcdir)/Makefile.in
+ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
+am__aclocal_m4_deps = $(top_srcdir)/m4/config/libtool.m4 \
+ $(top_srcdir)/m4/config/ltoptions.m4 \
+ $(top_srcdir)/m4/config/ltsugar.m4 \
+ $(top_srcdir)/m4/config/ltversion.m4 \
+ $(top_srcdir)/m4/config/lt~obsolete.m4 \
+ $(top_srcdir)/m4/macros/with.m4 \
+ $(top_srcdir)/m4/macros/enable-disable.m4 \
+ $(top_srcdir)/configure.in
+am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
+ $(ACLOCAL_M4)
+mkinstalldirs = $(install_sh) -d
+CONFIG_CLEAN_FILES =
+CONFIG_CLEAN_VPATH_FILES =
+am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
+am__vpath_adj = case $$p in \
+ $(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
+ *) f=$$p;; \
+ esac;
+am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
+am__install_max = 40
+am__nobase_strip_setup = \
+ srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
+am__nobase_strip = \
+ for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
+am__nobase_list = $(am__nobase_strip_setup); \
+ for p in $$list; do echo "$$p $$p"; done | \
+ sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
+ $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
+ if (++n[$$2] == $(am__install_max)) \
+ { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
+ END { for (dir in files) print dir, files[dir] }'
+am__base_list = \
+ sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
+ sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
+am__installdirs = "$(DESTDIR)$(plugindir)"
+LTLIBRARIES = $(plugin_LTLIBRARIES)
+libstrongswan_eap_simaka_reauth_la_LIBADD =
+am_libstrongswan_eap_simaka_reauth_la_OBJECTS = \
+ eap_simaka_reauth_plugin.lo eap_simaka_reauth_card.lo \
+ eap_simaka_reauth_provider.lo
+libstrongswan_eap_simaka_reauth_la_OBJECTS = \
+ $(am_libstrongswan_eap_simaka_reauth_la_OBJECTS)
+libstrongswan_eap_simaka_reauth_la_LINK = $(LIBTOOL) --tag=CC \
+ $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \
+ $(AM_CFLAGS) $(CFLAGS) \
+ $(libstrongswan_eap_simaka_reauth_la_LDFLAGS) $(LDFLAGS) -o $@
+DEFAULT_INCLUDES = -I.@am__isrc@
+depcomp = $(SHELL) $(top_srcdir)/depcomp
+am__depfiles_maybe = depfiles
+am__mv = mv -f
+COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
+ $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
+LTCOMPILE = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
+ --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) \
+ $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
+CCLD = $(CC)
+LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
+ --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) $(AM_LDFLAGS) \
+ $(LDFLAGS) -o $@
+SOURCES = $(libstrongswan_eap_simaka_reauth_la_SOURCES)
+DIST_SOURCES = $(libstrongswan_eap_simaka_reauth_la_SOURCES)
+ETAGS = etags
+CTAGS = ctags
+DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
+ACLOCAL = @ACLOCAL@
+ALLOCA = @ALLOCA@
+AMTAR = @AMTAR@
+AR = @AR@
+AUTOCONF = @AUTOCONF@
+AUTOHEADER = @AUTOHEADER@
+AUTOMAKE = @AUTOMAKE@
+AWK = @AWK@
+BTLIB = @BTLIB@
+CC = @CC@
+CCDEPMODE = @CCDEPMODE@
+CFLAGS = @CFLAGS@
+CPP = @CPP@
+CPPFLAGS = @CPPFLAGS@
+CYGPATH_W = @CYGPATH_W@
+DEFS = @DEFS@
+DEPDIR = @DEPDIR@
+DLLIB = @DLLIB@
+DSYMUTIL = @DSYMUTIL@
+DUMPBIN = @DUMPBIN@
+ECHO_C = @ECHO_C@
+ECHO_N = @ECHO_N@
+ECHO_T = @ECHO_T@
+EGREP = @EGREP@
+EXEEXT = @EXEEXT@
+FGREP = @FGREP@
+GPERF = @GPERF@
+GREP = @GREP@
+INSTALL = @INSTALL@
+INSTALL_DATA = @INSTALL_DATA@
+INSTALL_PROGRAM = @INSTALL_PROGRAM@
+INSTALL_SCRIPT = @INSTALL_SCRIPT@
+INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
+LD = @LD@
+LDFLAGS = @LDFLAGS@
+LEX = @LEX@
+LEXLIB = @LEXLIB@
+LEX_OUTPUT_ROOT = @LEX_OUTPUT_ROOT@
+LIBOBJS = @LIBOBJS@
+LIBS = @LIBS@
+LIBTOOL = @LIBTOOL@
+LIPO = @LIPO@
+LN_S = @LN_S@
+LTLIBOBJS = @LTLIBOBJS@
+MAKEINFO = @MAKEINFO@
+MKDIR_P = @MKDIR_P@
+MYSQLCFLAG = @MYSQLCFLAG@
+MYSQLCONFIG = @MYSQLCONFIG@
+MYSQLLIB = @MYSQLLIB@
+NM = @NM@
+NMEDIT = @NMEDIT@
+OBJDUMP = @OBJDUMP@
+OBJEXT = @OBJEXT@
+OTOOL = @OTOOL@
+OTOOL64 = @OTOOL64@
+PACKAGE = @PACKAGE@
+PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
+PACKAGE_NAME = @PACKAGE_NAME@
+PACKAGE_STRING = @PACKAGE_STRING@
+PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_URL = @PACKAGE_URL@
+PACKAGE_VERSION = @PACKAGE_VERSION@
+PATH_SEPARATOR = @PATH_SEPARATOR@
+PERL = @PERL@
+PKG_CONFIG = @PKG_CONFIG@
+PTHREADLIB = @PTHREADLIB@
+RANLIB = @RANLIB@
+RTLIB = @RTLIB@
+RUBY = @RUBY@
+RUBYINCLUDE = @RUBYINCLUDE@
+SED = @SED@
+SET_MAKE = @SET_MAKE@
+SHELL = @SHELL@
+SOCKLIB = @SOCKLIB@
+STRIP = @STRIP@
+VERSION = @VERSION@
+YACC = @YACC@
+YFLAGS = @YFLAGS@
+abs_builddir = @abs_builddir@
+abs_srcdir = @abs_srcdir@
+abs_top_builddir = @abs_top_builddir@
+abs_top_srcdir = @abs_top_srcdir@
+ac_ct_CC = @ac_ct_CC@
+ac_ct_DUMPBIN = @ac_ct_DUMPBIN@
+am__include = @am__include@
+am__leading_dot = @am__leading_dot@
+am__quote = @am__quote@
+am__tar = @am__tar@
+am__untar = @am__untar@
+bindir = @bindir@
+build = @build@
+build_alias = @build_alias@
+build_cpu = @build_cpu@
+build_os = @build_os@
+build_vendor = @build_vendor@
+builddir = @builddir@
+datadir = @datadir@
+datarootdir = @datarootdir@
+default_pkcs11 = @default_pkcs11@
+docdir = @docdir@
+dvidir = @dvidir@
+exec_prefix = @exec_prefix@
+gtk_CFLAGS = @gtk_CFLAGS@
+gtk_LIBS = @gtk_LIBS@
+host = @host@
+host_alias = @host_alias@
+host_cpu = @host_cpu@
+host_os = @host_os@
+host_vendor = @host_vendor@
+htmldir = @htmldir@
+includedir = @includedir@
+infodir = @infodir@
+install_sh = @install_sh@
+ipsecdir = @ipsecdir@
+ipsecgid = @ipsecgid@
+ipsecgroup = @ipsecgroup@
+ipsecuid = @ipsecuid@
+ipsecuser = @ipsecuser@
+libdir = @libdir@
+libexecdir = @libexecdir@
+libstrongswan_plugins = @libstrongswan_plugins@
+linux_headers = @linux_headers@
+localedir = @localedir@
+localstatedir = @localstatedir@
+lt_ECHO = @lt_ECHO@
+mandir = @mandir@
+mkdir_p = @mkdir_p@
+nm_CFLAGS = @nm_CFLAGS@
+nm_LIBS = @nm_LIBS@
+nm_ca_dir = @nm_ca_dir@
+oldincludedir = @oldincludedir@
+pdfdir = @pdfdir@
+piddir = @piddir@
+plugindir = @plugindir@
+pluto_plugins = @pluto_plugins@
+prefix = @prefix@
+program_transform_name = @program_transform_name@
+psdir = @psdir@
+random_device = @random_device@
+resolv_conf = @resolv_conf@
+routing_table = @routing_table@
+routing_table_prio = @routing_table_prio@
+sbindir = @sbindir@
+sharedstatedir = @sharedstatedir@
+srcdir = @srcdir@
+strongswan_conf = @strongswan_conf@
+sysconfdir = @sysconfdir@
+target_alias = @target_alias@
+top_build_prefix = @top_build_prefix@
+top_builddir = @top_builddir@
+top_srcdir = @top_srcdir@
+urandom_device = @urandom_device@
+xml_CFLAGS = @xml_CFLAGS@
+xml_LIBS = @xml_LIBS@
+INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
+AM_CFLAGS = -rdynamic
+plugin_LTLIBRARIES = libstrongswan-eap-simaka-reauth.la
+libstrongswan_eap_simaka_reauth_la_SOURCES = \
+ eap_simaka_reauth_plugin.h eap_simaka_reauth_plugin.c \
+ eap_simaka_reauth_card.h eap_simaka_reauth_card.c \
+ eap_simaka_reauth_provider.h eap_simaka_reauth_provider.c
+
+libstrongswan_eap_simaka_reauth_la_LDFLAGS = -module -avoid-version
+all: all-am
+
+.SUFFIXES:
+.SUFFIXES: .c .lo .o .obj
+$(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps)
+ @for dep in $?; do \
+ case '$(am__configure_deps)' in \
+ *$$dep*) \
+ ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \
+ && { if test -f $@; then exit 0; else break; fi; }; \
+ exit 1;; \
+ esac; \
+ done; \
+ echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/charon/plugins/eap_simaka_reauth/Makefile'; \
+ $(am__cd) $(top_srcdir) && \
+ $(AUTOMAKE) --gnu src/charon/plugins/eap_simaka_reauth/Makefile
+.PRECIOUS: Makefile
+Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
+ @case '$?' in \
+ *config.status*) \
+ cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
+ *) \
+ echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \
+ cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \
+ esac;
+
+$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
+ cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+
+$(top_srcdir)/configure: $(am__configure_deps)
+ cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(ACLOCAL_M4): $(am__aclocal_m4_deps)
+ cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(am__aclocal_m4_deps):
+install-pluginLTLIBRARIES: $(plugin_LTLIBRARIES)
+ @$(NORMAL_INSTALL)
+ test -z "$(plugindir)" || $(MKDIR_P) "$(DESTDIR)$(plugindir)"
+ @list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+ list2=; for p in $$list; do \
+ if test -f $$p; then \
+ list2="$$list2 $$p"; \
+ else :; fi; \
+ done; \
+ test -z "$$list2" || { \
+ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(plugindir)'"; \
+ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(plugindir)"; \
+ }
+
+uninstall-pluginLTLIBRARIES:
+ @$(NORMAL_UNINSTALL)
+ @list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+ for p in $$list; do \
+ $(am__strip_dir) \
+ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$f'"; \
+ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$f"; \
+ done
+
+clean-pluginLTLIBRARIES:
+ -test -z "$(plugin_LTLIBRARIES)" || rm -f $(plugin_LTLIBRARIES)
+ @list='$(plugin_LTLIBRARIES)'; for p in $$list; do \
+ dir="`echo $$p | sed -e 's|/[^/]*$$||'`"; \
+ test "$$dir" != "$$p" || dir=.; \
+ echo "rm -f \"$${dir}/so_locations\""; \
+ rm -f "$${dir}/so_locations"; \
+ done
+libstrongswan-eap-simaka-reauth.la: $(libstrongswan_eap_simaka_reauth_la_OBJECTS) $(libstrongswan_eap_simaka_reauth_la_DEPENDENCIES)
+ $(libstrongswan_eap_simaka_reauth_la_LINK) -rpath $(plugindir) $(libstrongswan_eap_simaka_reauth_la_OBJECTS) $(libstrongswan_eap_simaka_reauth_la_LIBADD) $(LIBS)
+
+mostlyclean-compile:
+ -rm -f *.$(OBJEXT)
+
+distclean-compile:
+ -rm -f *.tab.c
+
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/eap_simaka_reauth_card.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/eap_simaka_reauth_plugin.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/eap_simaka_reauth_provider.Plo@am__quote@
+
+.c.o:
+@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@ $(COMPILE) -c $<
+
+.c.obj:
+@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@ $(COMPILE) -c `$(CYGPATH_W) '$<'`
+
+.c.lo:
+@am__fastdepCC_TRUE@ $(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@ $(LTCOMPILE) -c -o $@ $<
+
+mostlyclean-libtool:
+ -rm -f *.lo
+
+clean-libtool:
+ -rm -rf .libs _libs
+
+ID: $(HEADERS) $(SOURCES) $(LISP) $(TAGS_FILES)
+ list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
+ unique=`for i in $$list; do \
+ if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
+ done | \
+ $(AWK) '{ files[$$0] = 1; nonempty = 1; } \
+ END { if (nonempty) { for (i in files) print i; }; }'`; \
+ mkid -fID $$unique
+tags: TAGS
+
+TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
+ $(TAGS_FILES) $(LISP)
+ set x; \
+ here=`pwd`; \
+ list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
+ unique=`for i in $$list; do \
+ if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
+ done | \
+ $(AWK) '{ files[$$0] = 1; nonempty = 1; } \
+ END { if (nonempty) { for (i in files) print i; }; }'`; \
+ shift; \
+ if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
+ test -n "$$unique" || unique=$$empty_fix; \
+ if test $$# -gt 0; then \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ "$$@" $$unique; \
+ else \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ $$unique; \
+ fi; \
+ fi
+ctags: CTAGS
+CTAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
+ $(TAGS_FILES) $(LISP)
+ list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
+ unique=`for i in $$list; do \
+ if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
+ done | \
+ $(AWK) '{ files[$$0] = 1; nonempty = 1; } \
+ END { if (nonempty) { for (i in files) print i; }; }'`; \
+ test -z "$(CTAGS_ARGS)$$unique" \
+ || $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
+ $$unique
+
+GTAGS:
+ here=`$(am__cd) $(top_builddir) && pwd` \
+ && $(am__cd) $(top_srcdir) \
+ && gtags -i $(GTAGS_ARGS) "$$here"
+
+distclean-tags:
+ -rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
+
+distdir: $(DISTFILES)
+ @srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
+ topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
+ list='$(DISTFILES)'; \
+ dist_files=`for file in $$list; do echo $$file; done | \
+ sed -e "s|^$$srcdirstrip/||;t" \
+ -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \
+ case $$dist_files in \
+ */*) $(MKDIR_P) `echo "$$dist_files" | \
+ sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \
+ sort -u` ;; \
+ esac; \
+ for file in $$dist_files; do \
+ if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
+ if test -d $$d/$$file; then \
+ dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
+ if test -d "$(distdir)/$$file"; then \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+ fi; \
+ if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
+ cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+ fi; \
+ cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
+ else \
+ test -f "$(distdir)/$$file" \
+ || cp -p $$d/$$file "$(distdir)/$$file" \
+ || exit 1; \
+ fi; \
+ done
+check-am: all-am
+check: check-am
+all-am: Makefile $(LTLIBRARIES)
+installdirs:
+ for dir in "$(DESTDIR)$(plugindir)"; do \
+ test -z "$$dir" || $(MKDIR_P) "$$dir"; \
+ done
+install: install-am
+install-exec: install-exec-am
+install-data: install-data-am
+uninstall: uninstall-am
+
+install-am: all-am
+ @$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am
+
+installcheck: installcheck-am
+install-strip:
+ $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
+ install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
+ `test -z '$(STRIP)' || \
+ echo "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'"` install
+mostlyclean-generic:
+
+clean-generic:
+
+distclean-generic:
+ -test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+ -test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
+
+maintainer-clean-generic:
+ @echo "This command is intended for maintainers to use"
+ @echo "it deletes files that may require special tools to rebuild."
+clean: clean-am
+
+clean-am: clean-generic clean-libtool clean-pluginLTLIBRARIES \
+ mostlyclean-am
+
+distclean: distclean-am
+ -rm -rf ./$(DEPDIR)
+ -rm -f Makefile
+distclean-am: clean-am distclean-compile distclean-generic \
+ distclean-tags
+
+dvi: dvi-am
+
+dvi-am:
+
+html: html-am
+
+html-am:
+
+info: info-am
+
+info-am:
+
+install-data-am: install-pluginLTLIBRARIES
+
+install-dvi: install-dvi-am
+
+install-dvi-am:
+
+install-exec-am:
+
+install-html: install-html-am
+
+install-html-am:
+
+install-info: install-info-am
+
+install-info-am:
+
+install-man:
+
+install-pdf: install-pdf-am
+
+install-pdf-am:
+
+install-ps: install-ps-am
+
+install-ps-am:
+
+installcheck-am:
+
+maintainer-clean: maintainer-clean-am
+ -rm -rf ./$(DEPDIR)
+ -rm -f Makefile
+maintainer-clean-am: distclean-am maintainer-clean-generic
+
+mostlyclean: mostlyclean-am
+
+mostlyclean-am: mostlyclean-compile mostlyclean-generic \
+ mostlyclean-libtool
+
+pdf: pdf-am
+
+pdf-am:
+
+ps: ps-am
+
+ps-am:
+
+uninstall-am: uninstall-pluginLTLIBRARIES
+
+.MAKE: install-am install-strip
+
+.PHONY: CTAGS GTAGS all all-am check check-am clean clean-generic \
+ clean-libtool clean-pluginLTLIBRARIES ctags distclean \
+ distclean-compile distclean-generic distclean-libtool \
+ distclean-tags distdir dvi dvi-am html html-am info info-am \
+ install install-am install-data install-data-am install-dvi \
+ install-dvi-am install-exec install-exec-am install-html \
+ install-html-am install-info install-info-am install-man \
+ install-pdf install-pdf-am install-pluginLTLIBRARIES \
+ install-ps install-ps-am install-strip installcheck \
+ installcheck-am installdirs maintainer-clean \
+ maintainer-clean-generic mostlyclean mostlyclean-compile \
+ mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \
+ tags uninstall uninstall-am uninstall-pluginLTLIBRARIES
+
+
+# Tell versions [3.59,3.63) of GNU make to not export all variables.
+# Otherwise a system limit (for SysV at least) may be exceeded.
+.NOEXPORT:
diff --git a/src/charon/plugins/eap_simaka_reauth/eap_simaka_reauth_card.c b/src/charon/plugins/eap_simaka_reauth/eap_simaka_reauth_card.c
new file mode 100644
index 000000000..14d0416d9
--- /dev/null
+++ b/src/charon/plugins/eap_simaka_reauth/eap_simaka_reauth_card.c
@@ -0,0 +1,170 @@
+/*
+ * Copyright (C) 2009 Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+
+#include "eap_simaka_reauth_card.h"
+
+#include <daemon.h>
+#include <utils/hashtable.h>
+
+typedef struct private_eap_simaka_reauth_card_t private_eap_simaka_reauth_card_t;
+
+/**
+ * Private data of an eap_simaka_reauth_card_t object.
+ */
+struct private_eap_simaka_reauth_card_t {
+
+ /**
+ * Public eap_simaka_reauth_card_t interface.
+ */
+ eap_simaka_reauth_card_t public;
+
+ /**
+ * Permanent -> reauth_data_t mappings
+ */
+ hashtable_t *reauth;
+};
+
+/**
+ * Data associated to a reauthentication identity
+ */
+typedef struct {
+ /** currently used reauthentication identity */
+ identification_t *id;
+ /** associated permanent identity */
+ identification_t *permanent;
+ /** counter value */
+ u_int16_t counter;
+ /** master key */
+ char mk[HASH_SIZE_SHA1];
+} reauth_data_t;
+
+/**
+ * hashtable hash function
+ */
+static u_int hash(identification_t *key)
+{
+ return chunk_hash(key->get_encoding(key));
+}
+
+/**
+ * hashtable equals function
+ */
+static bool equals(identification_t *key1, identification_t *key2)
+{
+ return key1->equals(key1, key2);
+}
+
+/**
+ * Implementation of sim_card_t.get_reauth
+ */
+static identification_t *get_reauth(private_eap_simaka_reauth_card_t *this,
+ identification_t *id, char mk[HASH_SIZE_SHA1],
+ u_int16_t *counter)
+{
+ reauth_data_t *data;
+ identification_t *reauth;
+
+ /* look up reauthentication data */
+ data = this->reauth->remove(this->reauth, id);
+ if (!data)
+ {
+ return NULL;
+ }
+ *counter = ++data->counter;
+ memcpy(mk, data->mk, HASH_SIZE_SHA1);
+ reauth = data->id;
+ data->permanent->destroy(data->permanent);
+ free(data);
+ return reauth;
+}
+
+/**
+ * Implementation of sim_card_t.set_reauth
+ */
+static void set_reauth(private_eap_simaka_reauth_card_t *this,
+ identification_t *id, identification_t* next,
+ char mk[HASH_SIZE_SHA1], u_int16_t counter)
+{
+ reauth_data_t *data;
+
+ data = this->reauth->get(this->reauth, id);
+ if (data)
+ {
+ data->id->destroy(data->id);
+ }
+ else
+ {
+ data = malloc_thing(reauth_data_t);
+ data->permanent = id->clone(id);
+ this->reauth->put(this->reauth, data->permanent, data);
+ }
+ data->counter = counter;
+ data->id = next->clone(next);
+ memcpy(data->mk, mk, HASH_SIZE_SHA1);
+}
+
+/**
+ * Implementation of sim_card_t.get_quintuplet
+ */
+static status_t get_quintuplet()
+{
+ return NOT_SUPPORTED;
+}
+
+/**
+ * Implementation of eap_simaka_reauth_card_t.destroy.
+ */
+static void destroy(private_eap_simaka_reauth_card_t *this)
+{
+ enumerator_t *enumerator;
+ reauth_data_t *data;
+ void *key;
+
+ enumerator = this->reauth->create_enumerator(this->reauth);
+ while (enumerator->enumerate(enumerator, &key, &data))
+ {
+ data->id->destroy(data->id);
+ data->permanent->destroy(data->permanent);
+ free(data);
+ }
+ enumerator->destroy(enumerator);
+
+ this->reauth->destroy(this->reauth);
+ free(this);
+}
+
+/**
+ * See header
+ */
+eap_simaka_reauth_card_t *eap_simaka_reauth_card_create()
+{
+ private_eap_simaka_reauth_card_t *this;
+
+ this = malloc_thing(private_eap_simaka_reauth_card_t);
+
+ this->public.card.get_triplet = (bool(*)(sim_card_t*, identification_t *id, char rand[SIM_RAND_LEN], char sres[SIM_SRES_LEN], char kc[SIM_KC_LEN]))return_null;
+ this->public.card.get_quintuplet = (status_t(*)(sim_card_t*, identification_t *id, char rand[AKA_RAND_LEN], char autn[AKA_AUTN_LEN], char ck[AKA_CK_LEN], char ik[AKA_IK_LEN], char res[AKA_RES_MAX], int *res_len))get_quintuplet;
+ this->public.card.resync = (bool(*)(sim_card_t*, identification_t *id, char rand[AKA_RAND_LEN], char auts[AKA_AUTS_LEN]))return_false;
+ this->public.card.get_pseudonym = (identification_t*(*)(sim_card_t*, identification_t *perm))return_null;
+ this->public.card.set_pseudonym = (void(*)(sim_card_t*, identification_t *id, identification_t *pseudonym))nop;
+ this->public.card.get_reauth = (identification_t*(*)(sim_card_t*, identification_t *id, char mk[HASH_SIZE_SHA1], u_int16_t *counter))get_reauth;
+ this->public.card.set_reauth = (void(*)(sim_card_t*, identification_t *id, identification_t* next, char mk[HASH_SIZE_SHA1], u_int16_t counter))set_reauth;
+ this->public.destroy = (void(*)(eap_simaka_reauth_card_t*))destroy;
+
+ this->reauth = hashtable_create((void*)hash, (void*)equals, 0);
+
+ return &this->public;
+}
+
diff --git a/src/charon/plugins/eap_simaka_reauth/eap_simaka_reauth_card.h b/src/charon/plugins/eap_simaka_reauth/eap_simaka_reauth_card.h
new file mode 100644
index 000000000..f24dc8a15
--- /dev/null
+++ b/src/charon/plugins/eap_simaka_reauth/eap_simaka_reauth_card.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2009 Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+
+/**
+ * @defgroup eap_simaka_reauth_card eap_simaka_reauth_card
+ * @{ @ingroup eap_simaka_reauth
+ */
+
+#ifndef EAP_SIMAKA_REAUTH_CARD_H_
+#define EAP_SIMAKA_REAUTH_CARD_H_
+
+#include <sa/authenticators/eap/sim_manager.h>
+
+typedef struct eap_simaka_reauth_card_t eap_simaka_reauth_card_t;
+
+/**
+ * SIM card implementing volatile in-memory reauthentication data storage.
+ */
+struct eap_simaka_reauth_card_t {
+
+ /**
+ * Implements sim_card_t interface
+ */
+ sim_card_t card;
+
+ /**
+ * Destroy a eap_simaka_reauth_card_t.
+ */
+ void (*destroy)(eap_simaka_reauth_card_t *this);
+};
+
+/**
+ * Create a eap_simaka_reauth_card instance.
+ */
+eap_simaka_reauth_card_t *eap_simaka_reauth_card_create();
+
+#endif /** EAP_SIMAKA_REAUTH_CARD_H_ @}*/
diff --git a/src/charon/plugins/eap_simaka_reauth/eap_simaka_reauth_plugin.c b/src/charon/plugins/eap_simaka_reauth/eap_simaka_reauth_plugin.c
new file mode 100644
index 000000000..b2e853e21
--- /dev/null
+++ b/src/charon/plugins/eap_simaka_reauth/eap_simaka_reauth_plugin.c
@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) 2009 Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+
+#include "eap_simaka_reauth_plugin.h"
+#include "eap_simaka_reauth_card.h"
+#include "eap_simaka_reauth_provider.h"
+
+#include <daemon.h>
+
+typedef struct private_eap_simaka_reauth_t private_eap_simaka_reauth_t;
+
+/**
+ * Private data of an eap_simaka_reauth_t object.
+ */
+struct private_eap_simaka_reauth_t {
+
+ /**
+ * Public eap_simaka_reauth_plugin_t interface.
+ */
+ eap_simaka_reauth_plugin_t public;
+
+ /**
+ * SIM card
+ */
+ eap_simaka_reauth_card_t *card;
+
+ /**
+ * SIM provider
+ */
+ eap_simaka_reauth_provider_t *provider;
+};
+
+/**
+ * Implementation of eap_simaka_reauth_t.destroy.
+ */
+static void destroy(private_eap_simaka_reauth_t *this)
+{
+ charon->sim->remove_card(charon->sim, &this->card->card);
+ charon->sim->remove_provider(charon->sim, &this->provider->provider);
+ this->card->destroy(this->card);
+ this->provider->destroy(this->provider);
+ free(this);
+}
+
+/**
+ * See header
+ */
+plugin_t *plugin_create()
+{
+ private_eap_simaka_reauth_t *this = malloc_thing(private_eap_simaka_reauth_t);
+
+ this->public.plugin.destroy = (void(*)(plugin_t*))destroy;
+
+ this->provider = eap_simaka_reauth_provider_create();
+ if (!this->provider)
+ {
+ free(this);
+ return NULL;
+ }
+ this->card = eap_simaka_reauth_card_create();
+
+ charon->sim->add_card(charon->sim, &this->card->card);
+ charon->sim->add_provider(charon->sim, &this->provider->provider);
+
+ return &this->public.plugin;
+}
+
diff --git a/src/charon/plugins/eap_simaka_reauth/eap_simaka_reauth_plugin.h b/src/charon/plugins/eap_simaka_reauth/eap_simaka_reauth_plugin.h
new file mode 100644
index 000000000..e86832c0e
--- /dev/null
+++ b/src/charon/plugins/eap_simaka_reauth/eap_simaka_reauth_plugin.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2009 Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+
+/**
+ * @defgroup eap_simaka_reauth eap_simaka_reauth
+ * @ingroup cplugins
+ *
+ * @defgroup eap_simaka_reauth_plugin eap_simaka_reauth_plugin
+ * @{ @ingroup eap_simaka_reauth
+ */
+
+#ifndef EAP_SIMAKA_REAUTH_PLUGIN_H_
+#define EAP_SIMAKA_REAUTH_PLUGIN_H_
+
+#include <plugins/plugin.h>
+
+typedef struct eap_simaka_reauth_plugin_t eap_simaka_reauth_plugin_t;
+
+/**
+ * Plugin to provide in-memory EAP-SIM/AKA reauthentication data storage.
+ */
+struct eap_simaka_reauth_plugin_t {
+
+ /**
+ * implements plugin interface
+ */
+ plugin_t plugin;
+};
+
+/**
+ * Create a eap_simaka_reauth_plugin instance.
+ */
+plugin_t *plugin_create();
+
+#endif /** EAP_SIMAKA_REAUTH_PLUGIN_H_ @}*/
diff --git a/src/charon/plugins/eap_simaka_reauth/eap_simaka_reauth_provider.c b/src/charon/plugins/eap_simaka_reauth/eap_simaka_reauth_provider.c
new file mode 100644
index 000000000..f962b2d84
--- /dev/null
+++ b/src/charon/plugins/eap_simaka_reauth/eap_simaka_reauth_provider.c
@@ -0,0 +1,209 @@
+/*
+ * Copyright (C) 2009 Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+
+#include "eap_simaka_reauth_provider.h"
+
+#include <daemon.h>
+#include <utils/hashtable.h>
+
+typedef struct private_eap_simaka_reauth_provider_t private_eap_simaka_reauth_provider_t;
+
+/**
+ * Private data of an eap_simaka_reauth_provider_t object.
+ */
+struct private_eap_simaka_reauth_provider_t {
+
+ /**
+ * Public eap_simaka_reauth_provider_t interface.
+ */
+ eap_simaka_reauth_provider_t public;
+
+ /**
+ * Permanent -> reauth_data_t mappings
+ */
+ hashtable_t *reauth;
+
+ /**
+ * Reverse reauth -> permanent mappings
+ */
+ hashtable_t *permanent;
+
+ /**
+ * RNG for pseudonyms/reauth identities
+ */
+ rng_t *rng;
+};
+
+/**
+ * Data associated to a reauthentication identity
+ */
+typedef struct {
+ /** currently used reauthentication identity */
+ identification_t *id;
+ /** counter value */
+ u_int16_t counter;
+ /** master key */
+ char mk[HASH_SIZE_SHA1];
+} reauth_data_t;
+
+/**
+ * hashtable hash function
+ */
+static u_int hash(identification_t *key)
+{
+ return chunk_hash(key->get_encoding(key));
+}
+
+/**
+ * hashtable equals function
+ */
+static bool equals(identification_t *key1, identification_t *key2)
+{
+ return key1->equals(key1, key2);
+}
+
+/**
+ * Generate a random identity
+ */
+static identification_t *gen_identity(private_eap_simaka_reauth_provider_t *this)
+{
+ char buf[8], hex[sizeof(buf) * 2 + 1];
+
+ this->rng->get_bytes(this->rng, sizeof(buf), buf);
+ chunk_to_hex(chunk_create(buf, sizeof(buf)), hex, FALSE);
+
+ return identification_create_from_string(hex);
+}
+
+/**
+ * Implementation of sim_provider_t.is_reauth
+ */
+static identification_t *is_reauth(private_eap_simaka_reauth_provider_t *this,
+ identification_t *id, char mk[HASH_SIZE_SHA1],
+ u_int16_t *counter)
+{
+ identification_t *permanent;
+ reauth_data_t *data;
+
+ /* look up permanent identity */
+ permanent = this->permanent->get(this->permanent, id);
+ if (!permanent)
+ {
+ return NULL;
+ }
+ /* look up reauthentication data */
+ data = this->reauth->get(this->reauth, permanent);
+ if (!data)
+ {
+ return NULL;
+ }
+ *counter = ++data->counter;
+ memcpy(mk, data->mk, HASH_SIZE_SHA1);
+ return permanent->clone(permanent);
+}
+
+/**
+ * Implementation of sim_provider_t.gen_reauth
+ */
+static identification_t *gen_reauth(private_eap_simaka_reauth_provider_t *this,
+ identification_t *id, char mk[HASH_SIZE_SHA1])
+{
+ reauth_data_t *data;
+ identification_t *permanent;
+
+ data = this->reauth->get(this->reauth, id);
+ if (data)
+ { /* update existing entry */
+ permanent = this->permanent->remove(this->permanent, data->id);
+ if (permanent)
+ {
+ data->id->destroy(data->id);
+ data->id = gen_identity(this);
+ this->permanent->put(this->permanent, data->id, permanent);
+ }
+ }
+ else
+ { /* generate new entry */
+ data = malloc_thing(reauth_data_t);
+ data->counter = 0;
+ data->id = gen_identity(this);
+ id = id->clone(id);
+ this->reauth->put(this->reauth, id, data);
+ this->permanent->put(this->permanent, data->id, id);
+ }
+ memcpy(data->mk, mk, HASH_SIZE_SHA1);
+
+ return data->id->clone(data->id);
+}
+
+/**
+ * Implementation of eap_simaka_reauth_provider_t.destroy.
+ */
+static void destroy(private_eap_simaka_reauth_provider_t *this)
+{
+ enumerator_t *enumerator;
+ identification_t *id;
+ reauth_data_t *data;
+ void *key;
+
+ enumerator = this->permanent->create_enumerator(this->permanent);
+ while (enumerator->enumerate(enumerator, &key, &id))
+ {
+ id->destroy(id);
+ }
+ enumerator->destroy(enumerator);
+
+ enumerator = this->reauth->create_enumerator(this->reauth);
+ while (enumerator->enumerate(enumerator, &key, &data))
+ {
+ data->id->destroy(data->id);
+ free(data);
+ }
+ enumerator->destroy(enumerator);
+
+ this->permanent->destroy(this->permanent);
+ this->reauth->destroy(this->reauth);
+ this->rng->destroy(this->rng);
+ free(this);
+}
+
+/**
+ * See header
+ */
+eap_simaka_reauth_provider_t *eap_simaka_reauth_provider_create()
+{
+ private_eap_simaka_reauth_provider_t *this = malloc_thing(private_eap_simaka_reauth_provider_t);
+
+ this->public.provider.get_triplet = (bool(*)(sim_provider_t*, identification_t *id, char rand[SIM_RAND_LEN], char sres[SIM_SRES_LEN], char kc[SIM_KC_LEN]))return_false;
+ this->public.provider.get_quintuplet = (bool(*)(sim_provider_t*, identification_t *id, char rand[AKA_RAND_LEN], char xres[AKA_RES_MAX], int *xres_len, char ck[AKA_CK_LEN], char ik[AKA_IK_LEN], char autn[AKA_AUTN_LEN]))return_false;
+ this->public.provider.resync = (bool(*)(sim_provider_t*, identification_t *id, char rand[AKA_RAND_LEN], char auts[AKA_AUTS_LEN]))return_false;
+ this->public.provider.is_pseudonym = (identification_t*(*)(sim_provider_t*, identification_t *id))return_null;
+ this->public.provider.gen_pseudonym = (identification_t*(*)(sim_provider_t*, identification_t *id))return_null;
+ this->public.provider.is_reauth = (identification_t*(*)(sim_provider_t*, identification_t *id, char [HASH_SIZE_SHA1], u_int16_t *counter))is_reauth;
+ this->public.provider.gen_reauth = (identification_t*(*)(sim_provider_t*, identification_t *id, char mk[HASH_SIZE_SHA1]))gen_reauth;
+ this->public.destroy = (void(*)(eap_simaka_reauth_provider_t*))destroy;
+
+ this->rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
+ if (!this->rng)
+ {
+ free(this);
+ return NULL;
+ }
+ this->permanent = hashtable_create((void*)hash, (void*)equals, 0);
+ this->reauth = hashtable_create((void*)hash, (void*)equals, 0);
+
+ return &this->public;
+}
+
diff --git a/src/charon/plugins/eap_simaka_reauth/eap_simaka_reauth_provider.h b/src/charon/plugins/eap_simaka_reauth/eap_simaka_reauth_provider.h
new file mode 100644
index 000000000..7ae151a27
--- /dev/null
+++ b/src/charon/plugins/eap_simaka_reauth/eap_simaka_reauth_provider.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2009 Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+
+/**
+ * @defgroup eap_simaka_reauth_provider eap_simaka_reauth_provider
+ * @{ @ingroup eap_simaka_reauth
+ */
+
+#ifndef EAP_SIMAKA_REAUTH_PROVIDER_H_
+#define EAP_SIMAKA_REAUTH_PROVIDER_H_
+
+#include <sa/authenticators/eap/sim_manager.h>
+
+typedef struct eap_simaka_reauth_provider_t eap_simaka_reauth_provider_t;
+
+/**
+ * SIM provider implementing volatile in-memory reauthentication data storage.
+ */
+struct eap_simaka_reauth_provider_t {
+
+ /**
+ * Implements sim_provider_t interface.
+ */
+ sim_provider_t provider;
+
+ /**
+ * Destroy a eap_simaka_reauth_provider_t.
+ */
+ void (*destroy)(eap_simaka_reauth_provider_t *this);
+};
+
+/**
+ * Create a eap_simaka_reauth_provider instance.
+ */
+eap_simaka_reauth_provider_t *eap_simaka_reauth_provider_create();
+
+#endif /** EAP_SIMAKA_REAUTH_PROVIDER_H_ @}*/
diff --git a/src/charon/plugins/kernel_klips/Makefile.am b/src/charon/plugins/kernel_klips/Makefile.am
index 0c0987cca..a7ae06df1 100644
--- a/src/charon/plugins/kernel_klips/Makefile.am
+++ b/src/charon/plugins/kernel_klips/Makefile.am
@@ -1,5 +1,5 @@
-INCLUDES = -I${linuxdir} -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
+INCLUDES = -I${linux_headers} -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
AM_CFLAGS = -rdynamic
diff --git a/src/charon/plugins/kernel_klips/Makefile.in b/src/charon/plugins/kernel_klips/Makefile.in
index 4b1c27352..bf194ae16 100644
--- a/src/charon/plugins/kernel_klips/Makefile.in
+++ b/src/charon/plugins/kernel_klips/Makefile.in
@@ -1,8 +1,9 @@
-# Makefile.in generated by automake 1.10.2 from Makefile.am.
+# Makefile.in generated by automake 1.11 from Makefile.am.
# @configure_input@
# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,
-# 2003, 2004, 2005, 2006, 2007, 2008 Free Software Foundation, Inc.
+# 2003, 2004, 2005, 2006, 2007, 2008, 2009 Free Software Foundation,
+# Inc.
# This Makefile.in is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.
@@ -16,8 +17,9 @@
VPATH = @srcdir@
pkgdatadir = $(datadir)/@PACKAGE@
-pkglibdir = $(libdir)/@PACKAGE@
pkgincludedir = $(includedir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkglibexecdir = $(libexecdir)/@PACKAGE@
am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
install_sh_DATA = $(install_sh) -c -m 644
install_sh_PROGRAM = $(install_sh) -c
@@ -35,19 +37,41 @@ host_triplet = @host@
subdir = src/charon/plugins/kernel_klips
DIST_COMMON = $(srcdir)/Makefile.am $(srcdir)/Makefile.in
ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
-am__aclocal_m4_deps = $(top_srcdir)/configure.in
+am__aclocal_m4_deps = $(top_srcdir)/m4/config/libtool.m4 \
+ $(top_srcdir)/m4/config/ltoptions.m4 \
+ $(top_srcdir)/m4/config/ltsugar.m4 \
+ $(top_srcdir)/m4/config/ltversion.m4 \
+ $(top_srcdir)/m4/config/lt~obsolete.m4 \
+ $(top_srcdir)/m4/macros/with.m4 \
+ $(top_srcdir)/m4/macros/enable-disable.m4 \
+ $(top_srcdir)/configure.in
am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
$(ACLOCAL_M4)
mkinstalldirs = $(install_sh) -d
CONFIG_CLEAN_FILES =
+CONFIG_CLEAN_VPATH_FILES =
am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
am__vpath_adj = case $$p in \
$(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
*) f=$$p;; \
esac;
-am__strip_dir = `echo $$p | sed -e 's|^.*/||'`;
+am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
+am__install_max = 40
+am__nobase_strip_setup = \
+ srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
+am__nobase_strip = \
+ for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
+am__nobase_list = $(am__nobase_strip_setup); \
+ for p in $$list; do echo "$$p $$p"; done | \
+ sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
+ $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
+ if (++n[$$2] == $(am__install_max)) \
+ { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
+ END { for (dir in files) print dir, files[dir] }'
+am__base_list = \
+ sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
+ sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
am__installdirs = "$(DESTDIR)$(plugindir)"
-pluginLTLIBRARIES_INSTALL = $(INSTALL)
LTLIBRARIES = $(plugin_LTLIBRARIES)
libstrongswan_kernel_klips_la_LIBADD =
am_libstrongswan_kernel_klips_la_OBJECTS = kernel_klips_plugin.lo \
@@ -61,6 +85,7 @@ libstrongswan_kernel_klips_la_LINK = $(LIBTOOL) --tag=CC \
DEFAULT_INCLUDES = -I.@am__isrc@
depcomp = $(SHELL) $(top_srcdir)/depcomp
am__depfiles_maybe = depfiles
+am__mv = mv -f
COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
LTCOMPILE = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
@@ -108,25 +133,22 @@ INSTALL_DATA = @INSTALL_DATA@
INSTALL_PROGRAM = @INSTALL_PROGRAM@
INSTALL_SCRIPT = @INSTALL_SCRIPT@
INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
-IPSEC_ROUTING_TABLE = @IPSEC_ROUTING_TABLE@
-IPSEC_ROUTING_TABLE_PRIO = @IPSEC_ROUTING_TABLE_PRIO@
LD = @LD@
LDFLAGS = @LDFLAGS@
LEX = @LEX@
LEXLIB = @LEXLIB@
LEX_OUTPUT_ROOT = @LEX_OUTPUT_ROOT@
-LIBGCRYPT_CFLAGS = @LIBGCRYPT_CFLAGS@
-LIBGCRYPT_CONFIG = @LIBGCRYPT_CONFIG@
-LIBGCRYPT_LIBS = @LIBGCRYPT_LIBS@
LIBOBJS = @LIBOBJS@
LIBS = @LIBS@
LIBTOOL = @LIBTOOL@
-LINUX_HEADERS = @LINUX_HEADERS@
LIPO = @LIPO@
LN_S = @LN_S@
LTLIBOBJS = @LTLIBOBJS@
MAKEINFO = @MAKEINFO@
MKDIR_P = @MKDIR_P@
+MYSQLCFLAG = @MYSQLCFLAG@
+MYSQLCONFIG = @MYSQLCONFIG@
+MYSQLLIB = @MYSQLLIB@
NM = @NM@
NMEDIT = @NMEDIT@
OBJDUMP = @OBJDUMP@
@@ -138,11 +160,14 @@ PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
PACKAGE_NAME = @PACKAGE_NAME@
PACKAGE_STRING = @PACKAGE_STRING@
PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_URL = @PACKAGE_URL@
PACKAGE_VERSION = @PACKAGE_VERSION@
PATH_SEPARATOR = @PATH_SEPARATOR@
PERL = @PERL@
PKG_CONFIG = @PKG_CONFIG@
+PTHREADLIB = @PTHREADLIB@
RANLIB = @RANLIB@
+RTLIB = @RTLIB@
RUBY = @RUBY@
RUBYINCLUDE = @RUBYINCLUDE@
SED = @SED@
@@ -171,9 +196,9 @@ build_cpu = @build_cpu@
build_os = @build_os@
build_vendor = @build_vendor@
builddir = @builddir@
-confdir = @confdir@
datadir = @datadir@
datarootdir = @datarootdir@
+default_pkcs11 = @default_pkcs11@
docdir = @docdir@
dvidir = @dvidir@
exec_prefix = @exec_prefix@
@@ -196,7 +221,7 @@ ipsecuser = @ipsecuser@
libdir = @libdir@
libexecdir = @libexecdir@
libstrongswan_plugins = @libstrongswan_plugins@
-linuxdir = @linuxdir@
+linux_headers = @linux_headers@
localedir = @localedir@
localstatedir = @localstatedir@
lt_ECHO = @lt_ECHO@
@@ -204,6 +229,7 @@ mandir = @mandir@
mkdir_p = @mkdir_p@
nm_CFLAGS = @nm_CFLAGS@
nm_LIBS = @nm_LIBS@
+nm_ca_dir = @nm_ca_dir@
oldincludedir = @oldincludedir@
pdfdir = @pdfdir@
piddir = @piddir@
@@ -212,10 +238,12 @@ pluto_plugins = @pluto_plugins@
prefix = @prefix@
program_transform_name = @program_transform_name@
psdir = @psdir@
+random_device = @random_device@
resolv_conf = @resolv_conf@
+routing_table = @routing_table@
+routing_table_prio = @routing_table_prio@
sbindir = @sbindir@
sharedstatedir = @sharedstatedir@
-simreader = @simreader@
srcdir = @srcdir@
strongswan_conf = @strongswan_conf@
sysconfdir = @sysconfdir@
@@ -223,9 +251,10 @@ target_alias = @target_alias@
top_build_prefix = @top_build_prefix@
top_builddir = @top_builddir@
top_srcdir = @top_srcdir@
+urandom_device = @urandom_device@
xml_CFLAGS = @xml_CFLAGS@
xml_LIBS = @xml_LIBS@
-INCLUDES = -I${linuxdir} -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
+INCLUDES = -I${linux_headers} -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
AM_CFLAGS = -rdynamic
plugin_LTLIBRARIES = libstrongswan-kernel-klips.la
libstrongswan_kernel_klips_la_SOURCES = kernel_klips_plugin.h kernel_klips_plugin.c \
@@ -245,9 +274,9 @@ $(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps)
exit 1;; \
esac; \
done; \
- echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/charon/plugins/kernel_klips/Makefile'; \
- cd $(top_srcdir) && \
- $(AUTOMAKE) --gnu src/charon/plugins/kernel_klips/Makefile
+ echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/charon/plugins/kernel_klips/Makefile'; \
+ $(am__cd) $(top_srcdir) && \
+ $(AUTOMAKE) --gnu src/charon/plugins/kernel_klips/Makefile
.PRECIOUS: Makefile
Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
@case '$?' in \
@@ -265,23 +294,28 @@ $(top_srcdir)/configure: $(am__configure_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
$(ACLOCAL_M4): $(am__aclocal_m4_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(am__aclocal_m4_deps):
install-pluginLTLIBRARIES: $(plugin_LTLIBRARIES)
@$(NORMAL_INSTALL)
test -z "$(plugindir)" || $(MKDIR_P) "$(DESTDIR)$(plugindir)"
- @list='$(plugin_LTLIBRARIES)'; for p in $$list; do \
+ @list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+ list2=; for p in $$list; do \
if test -f $$p; then \
- f=$(am__strip_dir) \
- echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(pluginLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) '$$p' '$(DESTDIR)$(plugindir)/$$f'"; \
- $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(pluginLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) "$$p" "$(DESTDIR)$(plugindir)/$$f"; \
+ list2="$$list2 $$p"; \
else :; fi; \
- done
+ done; \
+ test -z "$$list2" || { \
+ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(plugindir)'"; \
+ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(plugindir)"; \
+ }
uninstall-pluginLTLIBRARIES:
@$(NORMAL_UNINSTALL)
- @list='$(plugin_LTLIBRARIES)'; for p in $$list; do \
- p=$(am__strip_dir) \
- echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$p'"; \
- $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$p"; \
+ @list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+ for p in $$list; do \
+ $(am__strip_dir) \
+ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$f'"; \
+ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$f"; \
done
clean-pluginLTLIBRARIES:
@@ -306,21 +340,21 @@ distclean-compile:
.c.o:
@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(COMPILE) -c $<
.c.obj:
@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(COMPILE) -c `$(CYGPATH_W) '$<'`
.c.lo:
@am__fastdepCC_TRUE@ $(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(LTCOMPILE) -c -o $@ $<
@@ -343,7 +377,7 @@ tags: TAGS
TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
$(TAGS_FILES) $(LISP)
- tags=; \
+ set x; \
here=`pwd`; \
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
unique=`for i in $$list; do \
@@ -351,29 +385,34 @@ TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
- if test -z "$(ETAGS_ARGS)$$tags$$unique"; then :; else \
+ shift; \
+ if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
test -n "$$unique" || unique=$$empty_fix; \
- $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
- $$tags $$unique; \
+ if test $$# -gt 0; then \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ "$$@" $$unique; \
+ else \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ $$unique; \
+ fi; \
fi
ctags: CTAGS
CTAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
$(TAGS_FILES) $(LISP)
- tags=; \
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
unique=`for i in $$list; do \
if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
- test -z "$(CTAGS_ARGS)$$tags$$unique" \
+ test -z "$(CTAGS_ARGS)$$unique" \
|| $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
- $$tags $$unique
+ $$unique
GTAGS:
here=`$(am__cd) $(top_builddir) && pwd` \
- && cd $(top_srcdir) \
- && gtags -i $(GTAGS_ARGS) $$here
+ && $(am__cd) $(top_srcdir) \
+ && gtags -i $(GTAGS_ARGS) "$$here"
distclean-tags:
-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
@@ -394,13 +433,17 @@ distdir: $(DISTFILES)
if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
if test -d $$d/$$file; then \
dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
+ if test -d "$(distdir)/$$file"; then \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+ fi; \
if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
- cp -pR $(srcdir)/$$file $(distdir)$$dir || exit 1; \
+ cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
fi; \
- cp -pR $$d/$$file $(distdir)$$dir || exit 1; \
+ cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
else \
- test -f $(distdir)/$$file \
- || cp -p $$d/$$file $(distdir)/$$file \
+ test -f "$(distdir)/$$file" \
+ || cp -p $$d/$$file "$(distdir)/$$file" \
|| exit 1; \
fi; \
done
@@ -431,6 +474,7 @@ clean-generic:
distclean-generic:
-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+ -test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
maintainer-clean-generic:
@echo "This command is intended for maintainers to use"
@@ -452,6 +496,8 @@ dvi-am:
html: html-am
+html-am:
+
info: info-am
info-am:
@@ -460,18 +506,28 @@ install-data-am: install-pluginLTLIBRARIES
install-dvi: install-dvi-am
+install-dvi-am:
+
install-exec-am:
install-html: install-html-am
+install-html-am:
+
install-info: install-info-am
+install-info-am:
+
install-man:
install-pdf: install-pdf-am
+install-pdf-am:
+
install-ps: install-ps-am
+install-ps-am:
+
installcheck-am:
maintainer-clean: maintainer-clean-am
@@ -510,6 +566,7 @@ uninstall-am: uninstall-pluginLTLIBRARIES
mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \
tags uninstall uninstall-am uninstall-pluginLTLIBRARIES
+
# Tell versions [3.59,3.63) of GNU make to not export all variables.
# Otherwise a system limit (for SysV at least) may be exceeded.
.NOEXPORT:
diff --git a/src/charon/plugins/kernel_klips/kernel_klips_ipsec.c b/src/charon/plugins/kernel_klips/kernel_klips_ipsec.c
index 9a903d027..fea1b83a1 100644
--- a/src/charon/plugins/kernel_klips/kernel_klips_ipsec.c
+++ b/src/charon/plugins/kernel_klips/kernel_klips_ipsec.c
@@ -21,7 +21,6 @@
#include <linux/udp.h>
#include <net/if.h>
#include <unistd.h>
-#include <pthread.h>
#include <stdio.h>
#include <string.h>
#include <time.h>
@@ -30,7 +29,8 @@
#include "kernel_klips_ipsec.h"
#include <daemon.h>
-#include <utils/mutex.h>
+#include <threading/thread.h>
+#include <threading/mutex.h>
#include <processing/jobs/callback_job.h>
#include <processing/jobs/acquire_job.h>
#include <processing/jobs/rekey_child_sa_job.h>
@@ -78,7 +78,7 @@
/** the prefix of the name of KLIPS ipsec devices */
#define IPSEC_DEV_PREFIX "ipsec"
/** this is the default number of ipsec devices */
-#define DEFAULT_IPSEC_DEV_COUNT 4
+#define DEFAULT_IPSEC_DEV_COUNT 4
/** TRUE if the given name matches an ipsec device */
#define IS_IPSEC_DEV(name) (strneq((name), IPSEC_DEV_PREFIX, sizeof(IPSEC_DEV_PREFIX) - 1))
@@ -88,7 +88,7 @@ struct ipsectunnelconf
__u32 cf_cmd;
union
{
- char cfu_name[12];
+ char cfu_name[12];
} cf_u;
#define cf_name cf_u.cfu_name
};
@@ -108,62 +108,62 @@ struct private_kernel_klips_ipsec_t
* Public part of the kernel_klips_t object.
*/
kernel_klips_ipsec_t public;
-
+
/**
* mutex to lock access to various lists
*/
mutex_t *mutex;
-
+
/**
* List of installed policies (policy_entry_t)
*/
linked_list_t *policies;
-
+
/**
* List of allocated SPIs without installed SA (sa_entry_t)
*/
linked_list_t *allocated_spis;
-
+
/**
* List of installed SAs (sa_entry_t)
*/
linked_list_t *installed_sas;
-
+
/**
* whether to install routes along policies
*/
bool install_routes;
-
+
/**
* List of ipsec devices (ipsec_dev_t)
*/
linked_list_t *ipsec_devices;
-
+
/**
* job receiving PF_KEY events
*/
callback_job_t *job;
-
+
/**
* mutex to lock access to the PF_KEY socket
*/
mutex_t *mutex_pfkey;
-
+
/**
* PF_KEY socket to communicate with the kernel
*/
int socket;
-
+
/**
* PF_KEY socket to receive acquire and expire events
*/
int socket_events;
-
+
/**
* sequence number for messages sent to the kernel
*/
int seq;
-
+
};
@@ -175,10 +175,10 @@ typedef struct ipsec_dev_t ipsec_dev_t;
struct ipsec_dev_t {
/** name of the virtual ipsec interface */
char name[IFNAMSIZ];
-
+
/** name of the physical interface */
char phys_name[IFNAMSIZ];
-
+
/** by how many CHILD_SA's this ipsec device is used */
u_int refcount;
};
@@ -229,14 +229,14 @@ static status_t attach_ipsec_dev(char* name, char *phys_name)
struct ipsectunnelconf *itc = (struct ipsectunnelconf*)&req.ifr_data;
short phys_flags;
int mtu;
-
+
DBG2(DBG_KNL, "attaching virtual interface %s to %s", name, phys_name);
-
+
if ((sock = socket(AF_INET, SOCK_DGRAM, 0)) <= 0)
{
return FAILED;
}
-
+
strncpy(req.ifr_name, phys_name, IFNAMSIZ);
if (ioctl(sock, SIOCGIFFLAGS, &req) < 0)
{
@@ -251,18 +251,18 @@ static status_t attach_ipsec_dev(char* name, char *phys_name)
close(sock);
return FAILED;
}
-
+
if (req.ifr_flags & IFF_UP)
{
/* if it's already up, it is already attached, detach it first */
ioctl(sock, IPSEC_DEL_DEV, &req);
}
-
+
/* attach it */
strncpy(req.ifr_name, name, IFNAMSIZ);
strncpy(itc->cf_name, phys_name, sizeof(itc->cf_name));
ioctl(sock, IPSEC_SET_DEV, &req);
-
+
/* copy address from physical to virtual */
strncpy(req.ifr_name, phys_name, IFNAMSIZ);
if (ioctl(sock, SIOCGIFADDR, &req) == 0)
@@ -270,7 +270,7 @@ static status_t attach_ipsec_dev(char* name, char *phys_name)
strncpy(req.ifr_name, name, IFNAMSIZ);
ioctl(sock, SIOCSIFADDR, &req);
}
-
+
/* copy net mask from physical to virtual */
strncpy(req.ifr_name, phys_name, IFNAMSIZ);
if (ioctl(sock, SIOCGIFNETMASK, &req) == 0)
@@ -278,7 +278,7 @@ static status_t attach_ipsec_dev(char* name, char *phys_name)
strncpy(req.ifr_name, name, IFNAMSIZ);
ioctl(sock, SIOCSIFNETMASK, &req);
}
-
+
/* copy other flags and addresses */
strncpy(req.ifr_name, name, IFNAMSIZ);
if (ioctl(sock, SIOCGIFFLAGS, &req) == 0)
@@ -288,7 +288,7 @@ static status_t attach_ipsec_dev(char* name, char *phys_name)
req.ifr_flags |= IFF_POINTOPOINT;
req.ifr_flags &= ~IFF_BROADCAST;
ioctl(sock, SIOCSIFFLAGS, &req);
-
+
strncpy(req.ifr_name, phys_name, IFNAMSIZ);
if (ioctl(sock, SIOCGIFDSTADDR, &req) == 0)
{
@@ -301,7 +301,7 @@ static status_t attach_ipsec_dev(char* name, char *phys_name)
req.ifr_flags &= ~IFF_POINTOPOINT;
req.ifr_flags |= IFF_BROADCAST;
ioctl(sock, SIOCSIFFLAGS, &req);
-
+
strncpy(req.ifr_name, phys_name, IFNAMSIZ);
if (ioctl(sock, SIOCGIFBRDADDR, &req)==0)
{
@@ -318,13 +318,13 @@ static status_t attach_ipsec_dev(char* name, char *phys_name)
}
mtu = lib->settings->get_int(lib->settings,
- "charon.plugins.kernel_klips.ipsec_dev_mtu", 0);
+ "charon.plugins.kernel-klips.ipsec_dev_mtu", 0);
if (mtu <= 0)
{
/* guess MTU as physical MTU - ESP overhead [- NAT-T overhead]
* ESP overhead : 73 bytes
* NAT-T overhead : 8 bytes ==> 81 bytes
- *
+ *
* assuming tunnel mode with AES encryption and integrity
* outer IP header : 20 bytes
* (NAT-T UDP header: 8 bytes)
@@ -338,19 +338,19 @@ static status_t attach_ipsec_dev(char* name, char *phys_name)
ioctl(sock, SIOCGIFMTU, &req);
mtu = req.ifr_mtu - 81;
}
-
+
/* set MTU */
strncpy(req.ifr_name, name, IFNAMSIZ);
req.ifr_mtu = mtu;
ioctl(sock, SIOCSIFMTU, &req);
-
+
/* bring ipsec device UP */
if (ioctl(sock, SIOCGIFFLAGS, &req) == 0)
{
req.ifr_flags |= IFF_UP;
ioctl(sock, SIOCSIFFLAGS, &req);
}
-
+
close(sock);
return SUCCESS;
}
@@ -362,37 +362,37 @@ static status_t detach_ipsec_dev(char* name, char *phys_name)
{
int sock;
struct ifreq req;
-
+
DBG2(DBG_KNL, "detaching virtual interface %s from %s", name,
strlen(phys_name) ? phys_name : "any physical interface");
-
+
if ((sock = socket(AF_INET, SOCK_DGRAM, 0)) <= 0)
{
return FAILED;
}
-
+
strncpy(req.ifr_name, name, IFNAMSIZ);
if (ioctl(sock, SIOCGIFFLAGS, &req) < 0)
{
close(sock);
return FAILED;
}
-
+
/* shutting interface down */
if (req.ifr_flags & IFF_UP)
{
req.ifr_flags &= ~IFF_UP;
ioctl(sock, SIOCSIFFLAGS, &req);
}
-
+
/* unset address */
memset(&req.ifr_addr, 0, sizeof(req.ifr_addr));
req.ifr_addr.sa_family = AF_INET;
ioctl(sock, SIOCSIFADDR, &req);
-
+
/* detach interface */
ioctl(sock, IPSEC_DEL_DEV, &req);
-
+
close(sock);
return SUCCESS;
}
@@ -415,10 +415,10 @@ typedef struct route_entry_t route_entry_t;
struct route_entry_t {
/** Name of the interface the route is bound to */
char *if_name;
-
+
/** Source ip of the route */
host_t *src_ip;
-
+
/** Gateway for this route */
host_t *gateway;
@@ -447,13 +447,13 @@ typedef struct policy_entry_t policy_entry_t;
* installed kernel policy.
*/
struct policy_entry_t {
-
+
/** reqid of this policy, if setup as trap */
u_int32_t reqid;
-
+
/** direction of this policy: in, out, forward */
u_int8_t direction;
-
+
/** parameters of installed policy */
struct {
/** subnet and port */
@@ -463,13 +463,13 @@ struct policy_entry_t {
/** protocol */
u_int8_t proto;
} src, dst;
-
+
/** associated route installed for this policy */
route_entry_t *route;
-
+
/** by how many CHILD_SA's this policy is actively used */
u_int activecount;
-
+
/** by how many CHILD_SA's this policy is trapped */
u_int trapcount;
};
@@ -499,22 +499,22 @@ static bool is_host_in_net(host_t *host, host_t *net, u_int8_t mask)
static const u_char bitmask[] = { 0x00, 0x80, 0xc0, 0xe0, 0xf0, 0xf8, 0xfc, 0xfe };
chunk_t host_chunk, net_chunk;
int bytes = mask / 8, bits = mask % 8;
-
+
host_chunk = host->get_address(host);
net_chunk = net->get_address(net);
-
+
if (host_chunk.len != net_chunk.len)
{
return FALSE;
}
-
+
if (memeq(host_chunk.ptr, net_chunk.ptr, bytes))
{
return (bits == 0) ||
- (host_chunk.ptr[bytes] & bitmask[bits]) ==
+ (host_chunk.ptr[bytes] & bitmask[bits]) ==
(net_chunk.ptr[bytes] & bitmask[bits]);
}
-
+
return FALSE;
}
@@ -530,15 +530,15 @@ static policy_entry_t *create_policy_entry(traffic_selector_t *src_ts,
policy->route = NULL;
policy->activecount = 0;
policy->trapcount = 0;
-
+
src_ts->to_subnet(src_ts, &policy->src.net, &policy->src.mask);
dst_ts->to_subnet(dst_ts, &policy->dst.net, &policy->dst.mask);
-
+
/* src or dest proto may be "any" (0), use more restrictive one */
policy->src.proto = max(src_ts->get_protocol(src_ts), dst_ts->get_protocol(dst_ts));
- policy->src.proto = policy->src.proto ? policy->src.proto : 0;
+ policy->src.proto = policy->src.proto ? policy->src.proto : 0;
policy->dst.proto = policy->src.proto;
-
+
return policy;
}
@@ -585,25 +585,25 @@ typedef struct sa_entry_t sa_entry_t;
* - installed inbound SAs with enabled UDP encapsulation
*/
struct sa_entry_t {
-
+
/** protocol of this SA */
protocol_id_t protocol;
-
+
/** reqid of this SA */
u_int32_t reqid;
-
+
/** SPI of this SA */
u_int32_t spi;
-
+
/** src address of this SA */
host_t *src;
-
+
/** dst address of this SA */
host_t *dst;
-
+
/** TRUE if this SA uses UDP encapsulation */
bool encap;
-
+
/** TRUE if this SA is inbound */
bool inbound;
};
@@ -672,8 +672,8 @@ struct pfkey_msg_t
* PF_KEY message base
*/
struct sadb_msg *msg;
-
-
+
+
/**
* PF_KEY message extensions
*/
@@ -761,7 +761,7 @@ struct kernel_algorithm_t {
* Identifier specified in IKEv2
*/
int ikev2;
-
+
/**
* Identifier as defined in pfkeyv2.h
*/
@@ -774,32 +774,32 @@ struct kernel_algorithm_t {
* Algorithms for encryption
*/
static kernel_algorithm_t encryption_algs[] = {
-/* {ENCR_DES_IV64, 0 }, */
- {ENCR_DES, SADB_EALG_DESCBC },
- {ENCR_3DES, SADB_EALG_3DESCBC },
-/* {ENCR_RC5, 0 }, */
-/* {ENCR_IDEA, 0 }, */
-/* {ENCR_CAST, 0 }, */
- {ENCR_BLOWFISH, SADB_EALG_BFCBC },
-/* {ENCR_3IDEA, 0 }, */
-/* {ENCR_DES_IV32, 0 }, */
- {ENCR_NULL, SADB_EALG_NULL },
- {ENCR_AES_CBC, SADB_EALG_AESCBC },
-/* {ENCR_AES_CTR, 0 }, */
+/* {ENCR_DES_IV64, 0 }, */
+ {ENCR_DES, SADB_EALG_DESCBC },
+ {ENCR_3DES, SADB_EALG_3DESCBC },
+/* {ENCR_RC5, 0 }, */
+/* {ENCR_IDEA, 0 }, */
+/* {ENCR_CAST, 0 }, */
+ {ENCR_BLOWFISH, SADB_EALG_BFCBC },
+/* {ENCR_3IDEA, 0 }, */
+/* {ENCR_DES_IV32, 0 }, */
+ {ENCR_NULL, SADB_EALG_NULL },
+ {ENCR_AES_CBC, SADB_EALG_AESCBC },
+/* {ENCR_AES_CTR, 0 }, */
/* {ENCR_AES_CCM_ICV8, 0 }, */
/* {ENCR_AES_CCM_ICV12, 0 }, */
/* {ENCR_AES_CCM_ICV16, 0 }, */
/* {ENCR_AES_GCM_ICV8, 0 }, */
/* {ENCR_AES_GCM_ICV12, 0 }, */
/* {ENCR_AES_GCM_ICV16, 0 }, */
- {END_OF_LIST, 0 },
+ {END_OF_LIST, 0 },
};
/**
* Algorithms for integrity protection
*/
static kernel_algorithm_t integrity_algs[] = {
- {AUTH_HMAC_MD5_96, SADB_AALG_MD5HMAC },
+ {AUTH_HMAC_MD5_96, SADB_AALG_MD5HMAC },
{AUTH_HMAC_SHA1_96, SADB_AALG_SHA1HMAC },
{AUTH_HMAC_SHA2_256_128, SADB_AALG_SHA256_HMAC },
{AUTH_HMAC_SHA2_384_192, SADB_AALG_SHA384_HMAC },
@@ -807,7 +807,7 @@ static kernel_algorithm_t integrity_algs[] = {
/* {AUTH_DES_MAC, 0, }, */
/* {AUTH_KPDK_MD5, 0, }, */
/* {AUTH_AES_XCBC_96, 0, }, */
- {END_OF_LIST, 0, },
+ {END_OF_LIST, 0, },
};
#if 0
@@ -815,11 +815,11 @@ static kernel_algorithm_t integrity_algs[] = {
* Algorithms for IPComp, unused yet
*/
static kernel_algorithm_t compression_algs[] = {
-/* {IPCOMP_OUI, 0 }, */
+/* {IPCOMP_OUI, 0 }, */
{IPCOMP_DEFLATE, SADB_X_CALG_DEFLATE },
{IPCOMP_LZS, SADB_X_CALG_LZS },
/* {IPCOMP_LZJH, 0 }, */
- {END_OF_LIST, 0 },
+ {END_OF_LIST, 0 },
};
#endif
@@ -846,8 +846,8 @@ static void host2ext(host_t *host, struct sadb_address *ext)
{
sockaddr_t *host_addr = host->get_sockaddr(host);
socklen_t *len = host->get_sockaddr_len(host);
- memcpy((char*)(ext + 1), host_addr, *len);
- ext->sadb_address_len = PFKEY_LEN(sizeof(*ext) + *len);
+ memcpy((char*)(ext + 1), host_addr, *len);
+ ext->sadb_address_len = PFKEY_LEN(sizeof(*ext) + *len);
}
/**
@@ -872,7 +872,7 @@ static void add_anyaddr_ext(struct sadb_msg *msg, int family, u_int8_t type)
addr->sadb_address_exttype = type;
sockaddr_t *saddr = (sockaddr_t*)(addr + 1);
saddr->sa_family = family;
- addr->sadb_address_len = PFKEY_LEN(sizeof(*addr) + len);
+ addr->sadb_address_len = PFKEY_LEN(sizeof(*addr) + len);
PFKEY_EXT_ADD(msg, addr);
}
@@ -884,7 +884,7 @@ static void add_encap_ext(struct sadb_msg *msg, host_t *src, host_t *dst,
{
struct sadb_x_nat_t_type* nat_type;
struct sadb_x_nat_t_port* nat_port;
-
+
if (!ports_only)
{
nat_type = (struct sadb_x_nat_t_type*)PFKEY_EXT_ADD_NEXT(msg);
@@ -893,13 +893,13 @@ static void add_encap_ext(struct sadb_msg *msg, host_t *src, host_t *dst,
nat_type->sadb_x_nat_t_type_type = UDP_ENCAP_ESPINUDP;
PFKEY_EXT_ADD(msg, nat_type);
}
-
+
nat_port = (struct sadb_x_nat_t_port*)PFKEY_EXT_ADD_NEXT(msg);
nat_port->sadb_x_nat_t_port_exttype = SADB_X_EXT_NAT_T_SPORT;
nat_port->sadb_x_nat_t_port_len = PFKEY_LEN(sizeof(struct sadb_x_nat_t_port));
nat_port->sadb_x_nat_t_port_port = src->get_port(src);
PFKEY_EXT_ADD(msg, nat_port);
-
+
nat_port = (struct sadb_x_nat_t_port*)PFKEY_EXT_ADD_NEXT(msg);
nat_port->sadb_x_nat_t_port_exttype = SADB_X_EXT_NAT_T_DPORT;
nat_port->sadb_x_nat_t_port_len = PFKEY_LEN(sizeof(struct sadb_x_nat_t_port));
@@ -917,19 +917,19 @@ static void build_addflow(struct sadb_msg *msg, u_int8_t satype, u_int32_t spi,
struct sadb_sa *sa;
struct sadb_protocol *proto;
host_t *host;
-
+
msg->sadb_msg_version = PF_KEY_V2;
msg->sadb_msg_type = SADB_X_ADDFLOW;
msg->sadb_msg_satype = satype;
msg->sadb_msg_len = PFKEY_LEN(sizeof(struct sadb_msg));
-
+
sa = (struct sadb_sa*)PFKEY_EXT_ADD_NEXT(msg);
sa->sadb_sa_exttype = SADB_EXT_SA;
sa->sadb_sa_spi = spi;
sa->sadb_sa_len = PFKEY_LEN(sizeof(struct sadb_sa));
sa->sadb_sa_flags = replace ? SADB_X_SAFLAGS_REPLACEFLOW : 0;
PFKEY_EXT_ADD(msg, sa);
-
+
if (!src)
{
add_anyaddr_ext(msg, src_net->get_family(src_net), SADB_EXT_ADDRESS_SRC);
@@ -938,7 +938,7 @@ static void build_addflow(struct sadb_msg *msg, u_int8_t satype, u_int32_t spi,
{
add_addr_ext(msg, src, SADB_EXT_ADDRESS_SRC);
}
-
+
if (!dst)
{
add_anyaddr_ext(msg, dst_net->get_family(dst_net), SADB_EXT_ADDRESS_DST);
@@ -947,18 +947,18 @@ static void build_addflow(struct sadb_msg *msg, u_int8_t satype, u_int32_t spi,
{
add_addr_ext(msg, dst, SADB_EXT_ADDRESS_DST);
}
-
+
add_addr_ext(msg, src_net, SADB_X_EXT_ADDRESS_SRC_FLOW);
add_addr_ext(msg, dst_net, SADB_X_EXT_ADDRESS_DST_FLOW);
-
+
host = mask2host(src_net->get_family(src_net), src_mask);
add_addr_ext(msg, host, SADB_X_EXT_ADDRESS_SRC_MASK);
host->destroy(host);
-
+
host = mask2host(dst_net->get_family(dst_net), dst_mask);
add_addr_ext(msg, host, SADB_X_EXT_ADDRESS_DST_MASK);
host->destroy(host);
-
+
proto = (struct sadb_protocol*)PFKEY_EXT_ADD_NEXT(msg);
proto->sadb_protocol_exttype = SADB_X_EXT_PROTOCOL;
proto->sadb_protocol_len = PFKEY_LEN(sizeof(struct sadb_protocol));
@@ -975,25 +975,25 @@ static void build_delflow(struct sadb_msg *msg, u_int8_t satype,
{
struct sadb_protocol *proto;
host_t *host;
-
+
msg->sadb_msg_version = PF_KEY_V2;
msg->sadb_msg_type = SADB_X_DELFLOW;
msg->sadb_msg_satype = satype;
msg->sadb_msg_len = PFKEY_LEN(sizeof(struct sadb_msg));
-
+
add_addr_ext(msg, src_net, SADB_X_EXT_ADDRESS_SRC_FLOW);
add_addr_ext(msg, dst_net, SADB_X_EXT_ADDRESS_DST_FLOW);
-
+
host = mask2host(src_net->get_family(src_net),
src_mask);
add_addr_ext(msg, host, SADB_X_EXT_ADDRESS_SRC_MASK);
host->destroy(host);
-
+
host = mask2host(dst_net->get_family(dst_net),
dst_mask);
add_addr_ext(msg, host, SADB_X_EXT_ADDRESS_DST_MASK);
host->destroy(host);
-
+
proto = (struct sadb_protocol*)PFKEY_EXT_ADD_NEXT(msg);
proto->sadb_protocol_exttype = SADB_X_EXT_PROTOCOL;
proto->sadb_protocol_len = PFKEY_LEN(sizeof(struct sadb_protocol));
@@ -1008,15 +1008,15 @@ static status_t parse_pfkey_message(struct sadb_msg *msg, pfkey_msg_t *out)
{
struct sadb_ext* ext;
size_t len;
-
+
memset(out, 0, sizeof(pfkey_msg_t));
out->msg = msg;
-
+
len = msg->sadb_msg_len;
len -= PFKEY_LEN(sizeof(struct sadb_msg));
-
+
ext = (struct sadb_ext*)(((char*)msg) + sizeof(struct sadb_msg));
-
+
while (len >= PFKEY_LEN(sizeof(struct sadb_ext)))
{
if (ext->sadb_ext_len < PFKEY_LEN(sizeof(struct sadb_ext)) ||
@@ -1025,19 +1025,19 @@ static status_t parse_pfkey_message(struct sadb_msg *msg, pfkey_msg_t *out)
DBG1(DBG_KNL, "length of PF_KEY extension (%d) is invalid", ext->sadb_ext_type);
break;
}
-
+
if ((ext->sadb_ext_type > SADB_EXT_MAX) || (!ext->sadb_ext_type))
{
DBG1(DBG_KNL, "type of PF_KEY extension (%d) is invalid", ext->sadb_ext_type);
break;
}
-
+
if (out->ext[ext->sadb_ext_type])
{
- DBG1(DBG_KNL, "duplicate PF_KEY extension of type (%d)", ext->sadb_ext_type);
+ DBG1(DBG_KNL, "duplicate PF_KEY extension of type (%d)", ext->sadb_ext_type);
break;
}
-
+
out->ext[ext->sadb_ext_type] = ext;
ext = PFKEY_EXT_NEXT_LEN(ext, len);
}
@@ -1047,7 +1047,7 @@ static status_t parse_pfkey_message(struct sadb_msg *msg, pfkey_msg_t *out)
DBG1(DBG_KNL, "PF_KEY message length is invalid");
return FAILED;
}
-
+
return SUCCESS;
}
@@ -1060,7 +1060,7 @@ static status_t pfkey_send_socket(private_kernel_klips_ipsec_t *this, int socket
unsigned char buf[PFKEY_BUFFER_SIZE];
struct sadb_msg *msg;
int in_len, len;
-
+
this->mutex_pfkey->lock(this->mutex_pfkey);
in->sadb_msg_seq = ++this->seq;
@@ -1093,13 +1093,13 @@ static status_t pfkey_send_socket(private_kernel_klips_ipsec_t *this, int socket
}
break;
}
-
+
while (TRUE)
- {
+ {
msg = (struct sadb_msg*)buf;
-
+
len = recv(socket, buf, sizeof(buf), 0);
-
+
if (len < 0)
{
if (errno == EINTR)
@@ -1149,13 +1149,13 @@ static status_t pfkey_send_socket(private_kernel_klips_ipsec_t *this, int socket
}
break;
}
-
+
*out_len = len;
*out = (struct sadb_msg*)malloc(len);
memcpy(*out, buf, len);
-
+
this->mutex_pfkey->unlock(this->mutex_pfkey);
-
+
return SUCCESS;
}
@@ -1175,7 +1175,7 @@ static status_t pfkey_send_ack(private_kernel_klips_ipsec_t *this, struct sadb_m
{
struct sadb_msg *out;
size_t len;
-
+
if (pfkey_send(this, in, &out, &len) != SUCCESS)
{
return FAILED;
@@ -1200,12 +1200,12 @@ static status_t add_eroute(private_kernel_klips_ipsec_t *this, u_int8_t satype,
{
unsigned char request[PFKEY_BUFFER_SIZE];
struct sadb_msg *msg = (struct sadb_msg*)request;
-
+
memset(&request, 0, sizeof(request));
-
+
build_addflow(msg, satype, spi, src, dst, src_net, src_mask,
dst_net, dst_mask, protocol, replace);
-
+
return pfkey_send_ack(this, msg);
}
@@ -1218,11 +1218,11 @@ static status_t del_eroute(private_kernel_klips_ipsec_t *this, u_int8_t satype,
{
unsigned char request[PFKEY_BUFFER_SIZE];
struct sadb_msg *msg = (struct sadb_msg*)request;
-
+
memset(&request, 0, sizeof(request));
-
+
build_delflow(msg, satype, src_net, src_mask, dst_net, dst_mask, protocol);
-
+
return pfkey_send_ack(this, msg);
}
@@ -1237,7 +1237,7 @@ static void process_acquire(private_kernel_klips_ipsec_t *this, struct sadb_msg*
u_int8_t proto;
policy_entry_t *policy;
job_t *job;
-
+
switch (msg->sadb_msg_satype)
{
case SADB_SATYPE_UNSPEC:
@@ -1248,13 +1248,13 @@ static void process_acquire(private_kernel_klips_ipsec_t *this, struct sadb_msg*
/* acquire for AH/ESP only */
return;
}
-
+
if (parse_pfkey_message(msg, &response) != SUCCESS)
{
DBG1(DBG_KNL, "parsing SADB_ACQUIRE from kernel failed");
return;
}
-
+
/* KLIPS provides us only with the source and destination address,
* and the transport protocol of the packet that triggered the policy.
* we use this information to find a matching policy in our cache.
@@ -1269,7 +1269,7 @@ static void process_acquire(private_kernel_klips_ipsec_t *this, struct sadb_msg*
DBG1(DBG_KNL, "received an SADB_ACQUIRE with invalid hosts");
return;
}
-
+
DBG2(DBG_KNL, "received an SADB_ACQUIRE for %H == %H : %d", src, dst, proto);
this->mutex->lock(this->mutex);
if (this->policies->find_first(this->policies,
@@ -1286,17 +1286,17 @@ static void process_acquire(private_kernel_klips_ipsec_t *this, struct sadb_msg*
DBG1(DBG_KNL, "received an SADB_ACQUIRE, but policy is not routed anymore");
return;
}
-
+
/* add a broad %hold eroute that replaces the %trap eroute */
add_eroute(this, SADB_X_SATYPE_INT, htonl(SPI_HOLD), NULL, NULL,
policy->src.net, policy->src.mask, policy->dst.net, policy->dst.mask,
policy->src.proto, TRUE);
-
+
/* remove the narrow %hold eroute installed by KLIPS */
del_eroute(this, SADB_X_SATYPE_INT, src, 32, dst, 32, proto);
-
+
this->mutex->unlock(this->mutex);
-
+
DBG2(DBG_KNL, "received an SADB_ACQUIRE");
DBG1(DBG_KNL, "creating acquire job for CHILD_SA with reqid {%d}", reqid);
job = (job_t*)acquire_job_create(reqid, NULL, NULL);
@@ -1312,23 +1312,23 @@ static void process_mapping(private_kernel_klips_ipsec_t *this, struct sadb_msg*
u_int32_t spi, reqid;
host_t *old_src, *new_src;
job_t *job;
-
+
DBG2(DBG_KNL, "received an SADB_X_NAT_T_NEW_MAPPING");
-
+
if (parse_pfkey_message(msg, &response) != SUCCESS)
{
DBG1(DBG_KNL, "parsing SADB_X_NAT_T_NEW_MAPPING from kernel failed");
return;
}
-
+
spi = response.sa->sadb_sa_spi;
-
+
if (proto_satype2ike(msg->sadb_msg_satype) == PROTO_ESP)
{
sa_entry_t *sa;
sockaddr_t *addr = (sockaddr_t*)(response.src + 1);
old_src = host_create_from_sockaddr(addr);
-
+
this->mutex->lock(this->mutex);
if (!old_src || this->installed_sas->find_first(this->installed_sas,
(linked_list_match_t)sa_entry_match_encapbysrc,
@@ -1340,7 +1340,7 @@ static void process_mapping(private_kernel_klips_ipsec_t *this, struct sadb_msg*
}
reqid = sa->reqid;
this->mutex->unlock(this->mutex);
-
+
addr = (sockaddr_t*)(response.dst + 1);
switch (addr->sa_family)
{
@@ -1352,7 +1352,7 @@ static void process_mapping(private_kernel_klips_ipsec_t *this, struct sadb_msg*
case AF_INET6:
{
struct sockaddr_in6 *sin6 = (struct sockaddr_in6*)addr;
- sin6->sin6_port = htons(response.x_natt_dport->sadb_x_nat_t_port_port);
+ sin6->sin6_port = htons(response.x_natt_dport->sadb_x_nat_t_port_port);
}
default:
break;
@@ -1375,12 +1375,13 @@ static job_requeue_t receive_events(private_kernel_klips_ipsec_t *this)
{
unsigned char buf[PFKEY_BUFFER_SIZE];
struct sadb_msg *msg = (struct sadb_msg*)buf;
- int len, oldstate;
-
- pthread_setcancelstate(PTHREAD_CANCEL_ENABLE, &oldstate);
+ int len;
+ bool oldstate;
+
+ oldstate = thread_cancelability(TRUE);
len = recv(this->socket_events, buf, sizeof(buf), 0);
- pthread_setcancelstate(oldstate, NULL);
-
+ thread_cancelability(oldstate);
+
if (len < 0)
{
switch (errno)
@@ -1397,7 +1398,7 @@ static job_requeue_t receive_events(private_kernel_klips_ipsec_t *this)
return JOB_REQUEUE_FAIR;
}
}
-
+
if (len < sizeof(struct sadb_msg) ||
msg->sadb_msg_len < PFKEY_LEN(sizeof(struct sadb_msg)))
{
@@ -1413,7 +1414,7 @@ static job_requeue_t receive_events(private_kernel_klips_ipsec_t *this)
DBG1(DBG_KNL, "buffer was too small to receive the complete PF_KEY message");
return JOB_REQUEUE_DIRECT;
}
-
+
switch (msg->sadb_msg_type)
{
case SADB_ACQUIRE:
@@ -1433,7 +1434,7 @@ static job_requeue_t receive_events(private_kernel_klips_ipsec_t *this)
default:
break;
}
-
+
return JOB_REQUEUE_DIRECT;
}
@@ -1473,11 +1474,11 @@ static job_requeue_t sa_expires(sa_expire_t *expire)
sa_entry_t *cached_sa;
linked_list_t *list;
job_t *job;
-
+
/* for an expired SPI we first check whether the CHILD_SA got installed
* in the meantime, for expired SAs we check whether they are still installed */
list = expire->type == EXPIRE_TYPE_SPI ? this->allocated_spis : this->installed_sas;
-
+
this->mutex->lock(this->mutex);
if (list->find_first(list, (linked_list_match_t)sa_entry_match_byid,
(void**)&cached_sa, &protocol, &spi, &reqid) != SUCCESS)
@@ -1494,10 +1495,10 @@ static job_requeue_t sa_expires(sa_expire_t *expire)
sa_entry_destroy(cached_sa);
}
this->mutex->unlock(this->mutex);
-
+
DBG2(DBG_KNL, "%N CHILD_SA with SPI %.8x and reqid {%d} expired",
protocol_id_names, protocol, ntohl(spi), reqid);
-
+
DBG1(DBG_KNL, "creating %s job for %N CHILD_SA with SPI %.8x and reqid {%d}",
hard ? "delete" : "rekey", protocol_id_names,
protocol, ntohl(spi), reqid);
@@ -1514,7 +1515,7 @@ static job_requeue_t sa_expires(sa_expire_t *expire)
}
/**
- * Schedule an expire job for an SA. Time is in seconds.
+ * Schedule an expire job for an SA. Time is in seconds.
*/
static void schedule_expire(private_kernel_klips_ipsec_t *this,
protocol_id_t protocol, u_int32_t spi,
@@ -1534,8 +1535,8 @@ static void schedule_expire(private_kernel_klips_ipsec_t *this,
/**
* Implementation of kernel_interface_t.get_spi.
*/
-static status_t get_spi(private_kernel_klips_ipsec_t *this,
- host_t *src, host_t *dst,
+static status_t get_spi(private_kernel_klips_ipsec_t *this,
+ host_t *src, host_t *dst,
protocol_id_t protocol, u_int32_t reqid,
u_int32_t *spi)
{
@@ -1545,7 +1546,7 @@ static status_t get_spi(private_kernel_klips_ipsec_t *this,
*/
rng_t *rng;
u_int32_t spi_gen;
-
+
rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
if (!rng)
{
@@ -1554,29 +1555,29 @@ static status_t get_spi(private_kernel_klips_ipsec_t *this,
}
rng->get_bytes(rng, sizeof(spi_gen), (void*)&spi_gen);
rng->destroy(rng);
-
+
/* charon's SPIs lie within the range from 0xc0000000 to 0xcFFFFFFF */
spi_gen = 0xc0000000 | (spi_gen & 0x0FFFFFFF);
-
+
DBG2(DBG_KNL, "allocated SPI %.8x for %N SA between %#H..%#H",
spi_gen, protocol_id_names, protocol, src, dst);
-
+
*spi = htonl(spi_gen);
-
+
this->mutex->lock(this->mutex);
this->allocated_spis->insert_last(this->allocated_spis,
create_sa_entry(protocol, *spi, reqid, NULL, NULL, FALSE, TRUE));
this->mutex->unlock(this->mutex);
schedule_expire(this, protocol, *spi, reqid, EXPIRE_TYPE_SPI, SPI_TIMEOUT);
-
+
return SUCCESS;
}
/**
* Implementation of kernel_interface_t.get_cpi.
*/
-static status_t get_cpi(private_kernel_klips_ipsec_t *this,
- host_t *src, host_t *dst,
+static status_t get_cpi(private_kernel_klips_ipsec_t *this,
+ host_t *src, host_t *dst,
u_int32_t reqid, u_int16_t *cpi)
{
return FAILED;
@@ -1592,27 +1593,27 @@ static status_t add_ipip_sa(private_kernel_klips_ipsec_t *this,
struct sadb_msg *msg, *out;
struct sadb_sa *sa;
size_t len;
-
+
memset(&request, 0, sizeof(request));
-
+
DBG2(DBG_KNL, "adding pseudo IPIP SA with SPI %.8x and reqid {%d}", ntohl(spi), reqid);
-
+
msg = (struct sadb_msg*)request;
msg->sadb_msg_version = PF_KEY_V2;
msg->sadb_msg_type = SADB_ADD;
msg->sadb_msg_satype = SADB_X_SATYPE_IPIP;
msg->sadb_msg_len = PFKEY_LEN(sizeof(struct sadb_msg));
-
+
sa = (struct sadb_sa*)PFKEY_EXT_ADD_NEXT(msg);
sa->sadb_sa_exttype = SADB_EXT_SA;
sa->sadb_sa_len = PFKEY_LEN(sizeof(struct sadb_sa));
sa->sadb_sa_spi = spi;
sa->sadb_sa_state = SADB_SASTATE_MATURE;
PFKEY_EXT_ADD(msg, sa);
-
+
add_addr_ext(msg, src, SADB_EXT_ADDRESS_SRC);
add_addr_ext(msg, dst, SADB_EXT_ADDRESS_DST);
-
+
if (pfkey_send(this, msg, &out, &len) != SUCCESS)
{
DBG1(DBG_KNL, "unable to add pseudo IPIP SA with SPI %.8x", ntohl(spi));
@@ -1625,7 +1626,7 @@ static status_t add_ipip_sa(private_kernel_klips_ipsec_t *this,
free(out);
return FAILED;
}
-
+
free(out);
return SUCCESS;
}
@@ -1642,41 +1643,41 @@ static status_t group_ipip_sa(private_kernel_klips_ipsec_t *this,
struct sadb_sa *sa;
struct sadb_x_satype *satype;
size_t len;
-
+
memset(&request, 0, sizeof(request));
-
+
DBG2(DBG_KNL, "grouping SAs with SPI %.8x and reqid {%d}", ntohl(spi), reqid);
-
+
msg = (struct sadb_msg*)request;
msg->sadb_msg_version = PF_KEY_V2;
msg->sadb_msg_type = SADB_X_GRPSA;
msg->sadb_msg_satype = SADB_X_SATYPE_IPIP;
msg->sadb_msg_len = PFKEY_LEN(sizeof(struct sadb_msg));
-
+
sa = (struct sadb_sa*)PFKEY_EXT_ADD_NEXT(msg);
sa->sadb_sa_exttype = SADB_EXT_SA;
sa->sadb_sa_len = PFKEY_LEN(sizeof(struct sadb_sa));
sa->sadb_sa_spi = spi;
sa->sadb_sa_state = SADB_SASTATE_MATURE;
PFKEY_EXT_ADD(msg, sa);
-
+
add_addr_ext(msg, dst, SADB_EXT_ADDRESS_DST);
-
+
satype = (struct sadb_x_satype*)PFKEY_EXT_ADD_NEXT(msg);
satype->sadb_x_satype_exttype = SADB_X_EXT_SATYPE2;
satype->sadb_x_satype_len = PFKEY_LEN(sizeof(struct sadb_x_satype));
satype->sadb_x_satype_satype = proto_ike2satype(protocol);
PFKEY_EXT_ADD(msg, satype);
-
+
sa = (struct sadb_sa*)PFKEY_EXT_ADD_NEXT(msg);
sa->sadb_sa_exttype = SADB_X_EXT_SA2;
sa->sadb_sa_len = PFKEY_LEN(sizeof(struct sadb_sa));
sa->sadb_sa_spi = spi;
sa->sadb_sa_state = SADB_SASTATE_MATURE;
PFKEY_EXT_ADD(msg, sa);
-
+
add_addr_ext(msg, dst, SADB_X_EXT_ADDRESS_DST2);
-
+
if (pfkey_send(this, msg, &out, &len) != SUCCESS)
{
DBG1(DBG_KNL, "unable to group SAs with SPI %.8x", ntohl(spi));
@@ -1689,7 +1690,7 @@ static status_t group_ipip_sa(private_kernel_klips_ipsec_t *this,
free(out);
return FAILED;
}
-
+
free(out);
return SUCCESS;
}
@@ -1700,18 +1701,19 @@ static status_t group_ipip_sa(private_kernel_klips_ipsec_t *this,
static status_t add_sa(private_kernel_klips_ipsec_t *this,
host_t *src, host_t *dst, u_int32_t spi,
protocol_id_t protocol, u_int32_t reqid,
- u_int64_t expire_soft, u_int64_t expire_hard,
+ lifetime_cfg_t *lifetime,
u_int16_t enc_alg, chunk_t enc_key,
u_int16_t int_alg, chunk_t int_key,
ipsec_mode_t mode, u_int16_t ipcomp, u_int16_t cpi,
- bool encap, bool inbound)
+ bool encap, bool inbound, traffic_selector_t *src_ts,
+ traffic_selector_t *dst_ts)
{
unsigned char request[PFKEY_BUFFER_SIZE];
struct sadb_msg *msg, *out;
struct sadb_sa *sa;
struct sadb_key *key;
size_t len;
-
+
if (inbound)
{
/* for inbound SAs we allocated an SPI via get_spi, so we first check
@@ -1733,17 +1735,17 @@ static status_t add_sa(private_kernel_klips_ipsec_t *this,
}
this->mutex->unlock(this->mutex);
}
-
+
memset(&request, 0, sizeof(request));
-
+
DBG2(DBG_KNL, "adding SAD entry with SPI %.8x and reqid {%d}", ntohl(spi), reqid);
-
+
msg = (struct sadb_msg*)request;
msg->sadb_msg_version = PF_KEY_V2;
msg->sadb_msg_type = SADB_ADD;
msg->sadb_msg_satype = proto_ike2satype(protocol);
msg->sadb_msg_len = PFKEY_LEN(sizeof(struct sadb_msg));
-
+
sa = (struct sadb_sa*)PFKEY_EXT_ADD_NEXT(msg);
sa->sadb_sa_exttype = SADB_EXT_SA;
sa->sadb_sa_len = PFKEY_LEN(sizeof(struct sadb_sa));
@@ -1753,10 +1755,10 @@ static status_t add_sa(private_kernel_klips_ipsec_t *this,
sa->sadb_sa_auth = lookup_algorithm(integrity_algs, int_alg);
sa->sadb_sa_encrypt = lookup_algorithm(encryption_algs, enc_alg);
PFKEY_EXT_ADD(msg, sa);
-
+
add_addr_ext(msg, src, SADB_EXT_ADDRESS_SRC);
add_addr_ext(msg, dst, SADB_EXT_ADDRESS_DST);
-
+
if (enc_alg != ENCR_UNDEFINED)
{
if (!sa->sadb_sa_encrypt)
@@ -1767,16 +1769,16 @@ static status_t add_sa(private_kernel_klips_ipsec_t *this,
}
DBG2(DBG_KNL, " using encryption algorithm %N with key size %d",
encryption_algorithm_names, enc_alg, enc_key.len * 8);
-
+
key = (struct sadb_key*)PFKEY_EXT_ADD_NEXT(msg);
key->sadb_key_exttype = SADB_EXT_KEY_ENCRYPT;
key->sadb_key_bits = enc_key.len * 8;
key->sadb_key_len = PFKEY_LEN(sizeof(struct sadb_key) + enc_key.len);
memcpy(key + 1, enc_key.ptr, enc_key.len);
-
+
PFKEY_EXT_ADD(msg, key);
}
-
+
if (int_alg != AUTH_UNDEFINED)
{
if (!sa->sadb_sa_auth)
@@ -1787,26 +1789,26 @@ static status_t add_sa(private_kernel_klips_ipsec_t *this,
}
DBG2(DBG_KNL, " using integrity algorithm %N with key size %d",
integrity_algorithm_names, int_alg, int_key.len * 8);
-
+
key = (struct sadb_key*)PFKEY_EXT_ADD_NEXT(msg);
key->sadb_key_exttype = SADB_EXT_KEY_AUTH;
key->sadb_key_bits = int_key.len * 8;
key->sadb_key_len = PFKEY_LEN(sizeof(struct sadb_key) + int_key.len);
memcpy(key + 1, int_key.ptr, int_key.len);
-
+
PFKEY_EXT_ADD(msg, key);
}
-
+
if (ipcomp != IPCOMP_NONE)
{
/*TODO*/
}
-
+
if (encap)
{
add_encap_ext(msg, src, dst, FALSE);
}
-
+
if (pfkey_send(this, msg, &out, &len) != SUCCESS)
{
DBG1(DBG_KNL, "unable to add SAD entry with SPI %.8x", ntohl(spi));
@@ -1820,7 +1822,7 @@ static status_t add_sa(private_kernel_klips_ipsec_t *this,
return FAILED;
}
free(out);
-
+
/* for tunnel mode SAs we have to install an additional IPIP SA and
* group the two SAs together */
if (mode == MODE_TUNNEL)
@@ -1832,7 +1834,7 @@ static status_t add_sa(private_kernel_klips_ipsec_t *this,
return FAILED;
}
}
-
+
this->mutex->lock(this->mutex);
/* we cache this SA for two reasons:
* - in case an SADB_X_NAT_T_MAPPING_NEW event occurs (we need to find the reqid then)
@@ -1840,20 +1842,20 @@ static status_t add_sa(private_kernel_klips_ipsec_t *this,
this->installed_sas->insert_last(this->installed_sas,
create_sa_entry(protocol, spi, reqid, src, dst, encap, inbound));
this->mutex->unlock(this->mutex);
-
+
/* Although KLIPS supports SADB_EXT_LIFETIME_SOFT/HARD, we handle the lifetime
* of SAs manually in the plugin. Refer to the comments in receive_events()
* for details. */
- if (expire_soft)
+ if (lifetime->time.rekey)
{
- schedule_expire(this, protocol, spi, reqid, EXPIRE_TYPE_SOFT, expire_soft);
+ schedule_expire(this, protocol, spi, reqid, EXPIRE_TYPE_SOFT, lifetime->time.rekey);
}
-
- if (expire_hard)
+
+ if (lifetime->time.life)
{
- schedule_expire(this, protocol, spi, reqid, EXPIRE_TYPE_HARD, expire_hard);
+ schedule_expire(this, protocol, spi, reqid, EXPIRE_TYPE_HARD, lifetime->time.life);
}
-
+
return SUCCESS;
}
@@ -1870,7 +1872,7 @@ static status_t update_sa(private_kernel_klips_ipsec_t *this,
struct sadb_msg *msg, *out;
struct sadb_sa *sa;
size_t len;
-
+
/* we can't update the SA if any of the ip addresses have changed.
* that's because we can't use SADB_UPDATE and by deleting and readding the
* SA the sequence numbers would get lost */
@@ -1881,7 +1883,7 @@ static status_t update_sa(private_kernel_klips_ipsec_t *this,
" are not supported", ntohl(spi));
return NOT_SUPPORTED;
}
-
+
/* because KLIPS does not allow us to change the NAT-T type in an SADB_UPDATE,
* we can't update the SA if the encap flag has changed since installing it */
if (encap != new_encap)
@@ -1890,18 +1892,18 @@ static status_t update_sa(private_kernel_klips_ipsec_t *this,
" encapsulation is not supported", ntohl(spi));
return NOT_SUPPORTED;
}
-
+
DBG2(DBG_KNL, "updating SAD entry with SPI %.8x from %#H..%#H to %#H..%#H",
ntohl(spi), src, dst, new_src, new_dst);
-
+
memset(&request, 0, sizeof(request));
-
+
msg = (struct sadb_msg*)request;
msg->sadb_msg_version = PF_KEY_V2;
msg->sadb_msg_type = SADB_UPDATE;
msg->sadb_msg_satype = proto_ike2satype(protocol);
msg->sadb_msg_len = PFKEY_LEN(sizeof(struct sadb_msg));
-
+
sa = (struct sadb_sa*)PFKEY_EXT_ADD_NEXT(msg);
sa->sadb_sa_exttype = SADB_EXT_SA;
sa->sadb_sa_len = PFKEY_LEN(sizeof(struct sadb_sa));
@@ -1910,12 +1912,12 @@ static status_t update_sa(private_kernel_klips_ipsec_t *this,
sa->sadb_sa_auth = SADB_AALG_SHA1HMAC; /* ignored */
sa->sadb_sa_state = SADB_SASTATE_MATURE;
PFKEY_EXT_ADD(msg, sa);
-
+
add_addr_ext(msg, src, SADB_EXT_ADDRESS_SRC);
add_addr_ext(msg, dst, SADB_EXT_ADDRESS_DST);
-
+
add_encap_ext(msg, new_src, new_dst, TRUE);
-
+
if (pfkey_send(this, msg, &out, &len) != SUCCESS)
{
DBG1(DBG_KNL, "unable to update SAD entry with SPI %.8x", ntohl(spi));
@@ -1929,7 +1931,7 @@ static status_t update_sa(private_kernel_klips_ipsec_t *this,
return FAILED;
}
free(out);
-
+
return SUCCESS;
}
@@ -1955,13 +1957,13 @@ static status_t del_sa(private_kernel_klips_ipsec_t *this, host_t *src,
struct sadb_sa *sa;
sa_entry_t *cached_sa;
size_t len;
-
+
memset(&request, 0, sizeof(request));
-
+
/* all grouped SAs are automatically deleted by KLIPS as soon as
* one of them is deleted, therefore we delete only the main one */
DBG2(DBG_KNL, "deleting SAD entry with SPI %.8x", ntohl(spi));
-
+
this->mutex->lock(this->mutex);
/* this should not fail, but we don't care if it does, let the kernel decide
* whether this SA exists or not */
@@ -1973,24 +1975,24 @@ static status_t del_sa(private_kernel_klips_ipsec_t *this, host_t *src,
sa_entry_destroy(cached_sa);
}
this->mutex->unlock(this->mutex);
-
+
msg = (struct sadb_msg*)request;
msg->sadb_msg_version = PF_KEY_V2;
msg->sadb_msg_type = SADB_DELETE;
msg->sadb_msg_satype = proto_ike2satype(protocol);
msg->sadb_msg_len = PFKEY_LEN(sizeof(struct sadb_msg));
-
+
sa = (struct sadb_sa*)PFKEY_EXT_ADD_NEXT(msg);
sa->sadb_sa_exttype = SADB_EXT_SA;
sa->sadb_sa_len = PFKEY_LEN(sizeof(struct sadb_sa));
sa->sadb_sa_spi = spi;
PFKEY_EXT_ADD(msg, sa);
-
+
/* the kernel wants an SADB_EXT_ADDRESS_SRC to be present even though
* it is not used for anything. */
add_anyaddr_ext(msg, dst->get_family(dst), SADB_EXT_ADDRESS_SRC);
add_addr_ext(msg, dst, SADB_EXT_ADDRESS_DST);
-
+
if (pfkey_send(this, msg, &out, &len) != SUCCESS)
{
DBG1(DBG_KNL, "unable to delete SAD entry with SPI %.8x", ntohl(spi));
@@ -2003,7 +2005,7 @@ static status_t del_sa(private_kernel_klips_ipsec_t *this, host_t *src,
free(out);
return FAILED;
}
-
+
DBG2(DBG_KNL, "deleted SAD entry with SPI %.8x", ntohl(spi));
free(out);
return SUCCESS;
@@ -2012,7 +2014,7 @@ static status_t del_sa(private_kernel_klips_ipsec_t *this, host_t *src,
/**
* Implementation of kernel_interface_t.add_policy.
*/
-static status_t add_policy(private_kernel_klips_ipsec_t *this,
+static status_t add_policy(private_kernel_klips_ipsec_t *this,
host_t *src, host_t *dst,
traffic_selector_t *src_ts,
traffic_selector_t *dst_ts,
@@ -2025,21 +2027,21 @@ static status_t add_policy(private_kernel_klips_ipsec_t *this,
struct sadb_msg *msg, *out;
policy_entry_t *policy, *found = NULL;
u_int8_t satype;
- size_t len;
-
+ size_t len;
+
if (direction == POLICY_FWD)
{
/* no forward policies for KLIPS */
return SUCCESS;
}
-
+
/* tunnel mode policies direct the packets into the pseudo IPIP SA */
satype = (mode == MODE_TUNNEL) ? SADB_X_SATYPE_IPIP :
proto_ike2satype(protocol);
-
+
/* create a policy */
policy = create_policy_entry(src_ts, dst_ts, direction);
-
+
/* find a matching policy */
this->mutex->lock(this->mutex);
if (this->policies->find_first(this->policies,
@@ -2057,21 +2059,21 @@ static status_t add_policy(private_kernel_klips_ipsec_t *this,
/* apply the new one, if we have no such policy */
this->policies->insert_last(this->policies, policy);
}
-
+
if (routed)
{
/* we install this as a %trap eroute in the kernel, later to be
* triggered by packets matching the policy (-> ACQUIRE). */
spi = htonl(SPI_TRAP);
satype = SADB_X_SATYPE_INT;
-
+
/* the reqid is always set to the latest child SA that trapped this
* policy. we will need this reqid upon receiving an acquire. */
policy->reqid = reqid;
-
+
/* increase the trap counter */
policy->trapcount++;
-
+
if (policy->activecount)
{
/* we do not replace the current policy in the kernel while a
@@ -2085,21 +2087,21 @@ static status_t add_policy(private_kernel_klips_ipsec_t *this,
/* increase the reference counter */
policy->activecount++;
}
-
+
DBG2(DBG_KNL, "adding policy %R === %R %N", src_ts, dst_ts,
policy_dir_names, direction);
-
+
memset(&request, 0, sizeof(request));
-
+
msg = (struct sadb_msg*)request;
-
+
/* FIXME: SADB_X_SAFLAGS_INFLOW may be required, if we add an inbound policy for an IPIP SA */
build_addflow(msg, satype, spi, routed ? NULL : src, routed ? NULL : dst,
policy->src.net, policy->src.mask, policy->dst.net, policy->dst.mask,
policy->src.proto, found != NULL);
-
+
this->mutex->unlock(this->mutex);
-
+
if (pfkey_send(this, msg, &out, &len) != SUCCESS)
{
DBG1(DBG_KNL, "unable to add policy %R === %R %N", src_ts, dst_ts,
@@ -2115,9 +2117,9 @@ static status_t add_policy(private_kernel_klips_ipsec_t *this,
return FAILED;
}
free(out);
-
+
this->mutex->lock(this->mutex);
-
+
/* we try to find the policy again and install the route if needed */
if (this->policies->find_last(this->policies, NULL, (void**)&policy) != SUCCESS)
{
@@ -2126,7 +2128,7 @@ static status_t add_policy(private_kernel_klips_ipsec_t *this,
src_ts, dst_ts, policy_dir_names, direction);
return SUCCESS;
}
-
+
/* KLIPS requires a special route that directs traffic that matches this
* policy to one of the virtual ipsec interfaces. The virtual interface
* has to be attached to the physical one the traffic runs over.
@@ -2144,19 +2146,19 @@ static status_t add_policy(private_kernel_klips_ipsec_t *this,
ipsec_dev_t *dev;
route_entry_t *route = malloc_thing(route_entry_t);
route->src_ip = NULL;
-
+
if (mode != MODE_TRANSPORT && src->get_family(src) != AF_INET6 &&
this->install_routes)
{
charon->kernel_interface->get_address_by_ts(charon->kernel_interface,
src_ts, &route->src_ip);
}
-
+
if (!route->src_ip)
{
route->src_ip = host_create_any(src->get_family(src));
}
-
+
/* find the virtual interface */
iface = charon->kernel_interface->get_interface(charon->kernel_interface,
src);
@@ -2203,13 +2205,13 @@ static status_t add_policy(private_kernel_klips_ipsec_t *this,
}
free(iface);
route->if_name = strdup(dev->name);
-
+
/* get the nexthop to dst */
route->gateway = charon->kernel_interface->get_nexthop(
charon->kernel_interface, dst);
route->dst_net = chunk_clone(policy->dst.net->get_address(policy->dst.net));
route->prefixlen = policy->dst.mask;
-
+
switch (charon->kernel_interface->add_route(charon->kernel_interface,
route->dst_net, route->prefixlen, route->gateway,
route->src_ip, route->if_name))
@@ -2227,10 +2229,10 @@ static status_t add_policy(private_kernel_klips_ipsec_t *this,
policy->route = route;
break;
}
- }
-
- this->mutex->unlock(this->mutex);
-
+ }
+
+ this->mutex->unlock(this->mutex);
+
return SUCCESS;
}
@@ -2238,7 +2240,7 @@ static status_t add_policy(private_kernel_klips_ipsec_t *this,
* Implementation of kernel_interface_t.query_policy.
*/
static status_t query_policy(private_kernel_klips_ipsec_t *this,
- traffic_selector_t *src_ts,
+ traffic_selector_t *src_ts,
traffic_selector_t *dst_ts,
policy_dir_t direction, u_int32_t *use_time)
{
@@ -2250,19 +2252,19 @@ static status_t query_policy(private_kernel_klips_ipsec_t *this,
char *said = NULL, *pos;
policy_entry_t *policy, *found = NULL;
status_t status = FAILED;
-
+
if (direction == POLICY_FWD)
{
/* we do not install forward policies */
return FAILED;
}
-
+
DBG2(DBG_KNL, "querying policy %R === %R %N", src_ts, dst_ts,
policy_dir_names, direction);
-
+
/* create a policy */
policy = create_policy_entry(src_ts, dst_ts, direction);
-
+
/* find a matching policy */
this->mutex->lock(this->mutex);
if (this->policies->find_first(this->policies,
@@ -2276,7 +2278,7 @@ static status_t query_policy(private_kernel_klips_ipsec_t *this,
}
policy_entry_destroy(policy);
policy = found;
-
+
/* src and dst selectors in KLIPS are of the form NET_ADDR/NETBITS:PROTO */
snprintf(src, sizeof(src), "%H/%d:%d", policy->src.net, policy->src.mask,
policy->src.proto);
@@ -2284,9 +2286,9 @@ static status_t query_policy(private_kernel_klips_ipsec_t *this,
snprintf(dst, sizeof(dst), "%H/%d:%d", policy->dst.net, policy->dst.mask,
policy->dst.proto);
dst[sizeof(dst) - 1] = '\0';
-
+
this->mutex->unlock(this->mutex);
-
+
/* we try to find the matching eroute first */
file = fopen(path_eroute, "r");
if (file == NULL)
@@ -2295,7 +2297,7 @@ static status_t query_policy(private_kernel_klips_ipsec_t *this,
dst_ts, policy_dir_names, direction, strerror(errno), errno);
return FAILED;
}
-
+
/* read line by line where each line looks like:
* packets src -> dst => said */
while (fgets(line, sizeof(line), file))
@@ -2303,7 +2305,7 @@ static status_t query_policy(private_kernel_klips_ipsec_t *this,
enumerator_t *enumerator;
char *token;
int i = 0;
-
+
enumerator = enumerator_create_token(line, " \t", " \t\n");
while (enumerator->enumerate(enumerator, &token))
{
@@ -2334,7 +2336,7 @@ static status_t query_policy(private_kernel_klips_ipsec_t *this,
break;
}
enumerator->destroy(enumerator);
-
+
if (i == 5)
{
/* eroute matched */
@@ -2342,19 +2344,19 @@ static status_t query_policy(private_kernel_klips_ipsec_t *this,
}
}
fclose(file);
-
+
if (said == NULL)
{
DBG1(DBG_KNL, "unable to query policy %R === %R %N: found no matching"
" eroute", src_ts, dst_ts, policy_dir_names, direction);
return FAILED;
}
-
+
/* compared with the one in the spi entry the SA ID from the eroute entry
* has an additional ":PROTO" appended, which we need to cut off */
pos = strrchr(said, ':');
*pos = '\0';
-
+
/* now we try to find the matching spi entry */
file = fopen(path_spi, "r");
if (file == NULL)
@@ -2363,7 +2365,7 @@ static status_t query_policy(private_kernel_klips_ipsec_t *this,
dst_ts, policy_dir_names, direction, strerror(errno), errno);
return FAILED;
}
-
+
while (fgets(line, sizeof(line), file))
{
if (strneq(line, said, strlen(said)))
@@ -2381,15 +2383,15 @@ static status_t query_policy(private_kernel_klips_ipsec_t *this,
/* idle time not valid */
break;
}
-
- *use_time = time(NULL) - idle_time;
+
+ *use_time = time_monotonic(NULL) - idle_time;
status = SUCCESS;
break;
}
}
fclose(file);
free(said);
-
+
return status;
}
@@ -2397,7 +2399,7 @@ static status_t query_policy(private_kernel_klips_ipsec_t *this,
* Implementation of kernel_interface_t.del_policy.
*/
static status_t del_policy(private_kernel_klips_ipsec_t *this,
- traffic_selector_t *src_ts,
+ traffic_selector_t *src_ts,
traffic_selector_t *dst_ts,
policy_dir_t direction, bool unrouted)
{
@@ -2406,19 +2408,19 @@ static status_t del_policy(private_kernel_klips_ipsec_t *this,
policy_entry_t *policy, *found = NULL;
route_entry_t *route;
size_t len;
-
+
if (direction == POLICY_FWD)
{
/* no forward policies for KLIPS */
return SUCCESS;
}
-
+
DBG2(DBG_KNL, "deleting policy %R === %R %N", src_ts, dst_ts,
policy_dir_names, direction);
-
+
/* create a policy */
policy = create_policy_entry(src_ts, dst_ts, direction);
-
+
/* find a matching policy */
this->mutex->lock(this->mutex);
if (this->policies->find_first(this->policies,
@@ -2431,10 +2433,10 @@ static status_t del_policy(private_kernel_klips_ipsec_t *this,
return NOT_FOUND;
}
policy_entry_destroy(policy);
-
+
/* decrease appropriate counter */
unrouted ? found->trapcount-- : found->activecount--;
-
+
if (found->trapcount == 0)
{
/* if this policy is finally unrouted, we reset the reqid because it
@@ -2442,7 +2444,7 @@ static status_t del_policy(private_kernel_klips_ipsec_t *this,
* this policy. */
found->reqid = 0;
}
-
+
if (found->activecount > 0)
{
/* is still used by SAs, keep in kernel */
@@ -2462,22 +2464,22 @@ static status_t del_policy(private_kernel_klips_ipsec_t *this,
this->mutex->unlock(this->mutex);
return pfkey_send_ack(this, msg);
}
-
+
/* remove if last reference */
this->policies->remove(this->policies, found, NULL);
policy = found;
-
+
this->mutex->unlock(this->mutex);
-
+
memset(&request, 0, sizeof(request));
-
+
build_delflow(msg, 0, policy->src.net, policy->src.mask, policy->dst.net,
policy->dst.mask, policy->src.proto);
-
+
route = policy->route;
policy->route = NULL;
policy_entry_destroy(policy);
-
+
if (pfkey_send(this, msg, &out, &len) != SUCCESS)
{
DBG1(DBG_KNL, "unable to delete policy %R === %R %N", src_ts, dst_ts,
@@ -2493,11 +2495,11 @@ static status_t del_policy(private_kernel_klips_ipsec_t *this,
return FAILED;
}
free(out);
-
+
if (route)
{
ipsec_dev_t *dev;
-
+
if (charon->kernel_interface->del_route(charon->kernel_interface,
route->dst_net, route->prefixlen, route->gateway,
route->src_ip, route->if_name) != SUCCESS)
@@ -2506,11 +2508,11 @@ static status_t del_policy(private_kernel_klips_ipsec_t *this,
" policy %R === %R %N", src_ts, dst_ts,
policy_dir_names, direction);
}
-
+
/* we have to detach the ipsec interface from the physical one over which
* this SA ran (if it is not used by any other) */
this->mutex->lock(this->mutex);
-
+
if (find_ipsec_dev(this, route->if_name, &dev) == SUCCESS)
{
/* fine, we found a matching device object, let's check if we have
@@ -2525,12 +2527,12 @@ static status_t del_policy(private_kernel_klips_ipsec_t *this,
dev->phys_name[0] = '\0';
}
}
-
+
this->mutex->unlock(this->mutex);
-
+
route_entry_destroy(route);
}
-
+
return SUCCESS;
}
@@ -2540,9 +2542,9 @@ static status_t del_policy(private_kernel_klips_ipsec_t *this,
static void init_ipsec_devices(private_kernel_klips_ipsec_t *this)
{
int i, count = lib->settings->get_int(lib->settings,
- "charon.plugins.kernel_klips.ipsec_dev_count",
+ "charon.plugins.kernel-klips.ipsec_dev_count",
DEFAULT_IPSEC_DEV_COUNT);
-
+
for (i = 0; i < count; ++i)
{
ipsec_dev_t *dev = malloc_thing(ipsec_dev_t);
@@ -2551,7 +2553,7 @@ static void init_ipsec_devices(private_kernel_klips_ipsec_t *this)
dev->phys_name[0] = '\0';
dev->refcount = 0;
this->ipsec_devices->insert_last(this->ipsec_devices, dev);
-
+
/* detach any previously attached ipsec device */
detach_ipsec_dev(dev->name, dev->phys_name);
}
@@ -2565,15 +2567,15 @@ static status_t register_pfkey_socket(private_kernel_klips_ipsec_t *this, u_int8
unsigned char request[PFKEY_BUFFER_SIZE];
struct sadb_msg *msg, *out;
size_t len;
-
+
memset(&request, 0, sizeof(request));
-
+
msg = (struct sadb_msg*)request;
msg->sadb_msg_version = PF_KEY_V2;
msg->sadb_msg_type = SADB_REGISTER;
msg->sadb_msg_satype = satype;
msg->sadb_msg_len = PFKEY_LEN(sizeof(struct sadb_msg));
-
+
if (pfkey_send_socket(this, this->socket_events, msg, &out, &len) != SUCCESS)
{
DBG1(DBG_KNL, "unable to register PF_KEY socket");
@@ -2613,18 +2615,18 @@ static void destroy(private_kernel_klips_ipsec_t *this)
kernel_klips_ipsec_t *kernel_klips_ipsec_create()
{
private_kernel_klips_ipsec_t *this = malloc_thing(private_kernel_klips_ipsec_t);
-
+
/* public functions */
this->public.interface.get_spi = (status_t(*)(kernel_ipsec_t*,host_t*,host_t*,protocol_id_t,u_int32_t,u_int32_t*))get_spi;
this->public.interface.get_cpi = (status_t(*)(kernel_ipsec_t*,host_t*,host_t*,u_int32_t,u_int16_t*))get_cpi;
- this->public.interface.add_sa = (status_t(*)(kernel_ipsec_t *,host_t*,host_t*,u_int32_t,protocol_id_t,u_int32_t,u_int64_t,u_int64_t,u_int16_t,chunk_t,u_int16_t,chunk_t,ipsec_mode_t,u_int16_t,u_int16_t,bool,bool))add_sa;
+ this->public.interface.add_sa = (status_t(*)(kernel_ipsec_t *,host_t*,host_t*,u_int32_t,protocol_id_t,u_int32_t,lifetime_cfg_t*,u_int16_t,chunk_t,u_int16_t,chunk_t,ipsec_mode_t,u_int16_t,u_int16_t,bool,bool,traffic_selector_t*,traffic_selector_t*))add_sa;
this->public.interface.update_sa = (status_t(*)(kernel_ipsec_t*,u_int32_t,protocol_id_t,u_int16_t,host_t*,host_t*,host_t*,host_t*,bool,bool))update_sa;
this->public.interface.query_sa = (status_t(*)(kernel_ipsec_t*,host_t*,host_t*,u_int32_t,protocol_id_t,u_int64_t*))query_sa;
this->public.interface.del_sa = (status_t(*)(kernel_ipsec_t*,host_t*,host_t*,u_int32_t,protocol_id_t,u_int16_t))del_sa;
this->public.interface.add_policy = (status_t(*)(kernel_ipsec_t*,host_t*,host_t*,traffic_selector_t*,traffic_selector_t*,policy_dir_t,u_int32_t,protocol_id_t,u_int32_t,ipsec_mode_t,u_int16_t,u_int16_t,bool))add_policy;
this->public.interface.query_policy = (status_t(*)(kernel_ipsec_t*,traffic_selector_t*,traffic_selector_t*,policy_dir_t,u_int32_t*))query_policy;
this->public.interface.del_policy = (status_t(*)(kernel_ipsec_t*,traffic_selector_t*,traffic_selector_t*,policy_dir_t,bool))del_policy;
-
+
this->public.interface.destroy = (void(*)(kernel_ipsec_t*)) destroy;
/* private members */
@@ -2636,34 +2638,34 @@ kernel_klips_ipsec_t *kernel_klips_ipsec_create()
this->mutex_pfkey = mutex_create(MUTEX_TYPE_DEFAULT);
this->install_routes = lib->settings->get_bool(lib->settings, "charon.install_routes", TRUE);
this->seq = 0;
-
+
/* initialize ipsec devices */
init_ipsec_devices(this);
-
+
/* create a PF_KEY socket to communicate with the kernel */
this->socket = socket(PF_KEY, SOCK_RAW, PF_KEY_V2);
if (this->socket <= 0)
{
charon->kill(charon, "unable to create PF_KEY socket");
}
-
+
/* create a PF_KEY socket for ACQUIRE & EXPIRE */
this->socket_events = socket(PF_KEY, SOCK_RAW, PF_KEY_V2);
if (this->socket_events <= 0)
{
charon->kill(charon, "unable to create PF_KEY event socket");
}
-
+
/* register the event socket */
if (register_pfkey_socket(this, SADB_SATYPE_ESP) != SUCCESS ||
register_pfkey_socket(this, SADB_SATYPE_AH) != SUCCESS)
{
charon->kill(charon, "unable to register PF_KEY event socket");
}
-
+
this->job = callback_job_create((callback_job_cb_t)receive_events,
this, NULL, NULL);
charon->processor->queue_job(charon->processor, (job_t*)this->job);
-
+
return &this->public;
}
diff --git a/src/charon/plugins/kernel_klips/kernel_klips_plugin.c b/src/charon/plugins/kernel_klips/kernel_klips_plugin.c
index d153ea8af..b0117c10c 100644
--- a/src/charon/plugins/kernel_klips/kernel_klips_plugin.c
+++ b/src/charon/plugins/kernel_klips/kernel_klips_plugin.c
@@ -47,10 +47,10 @@ static void destroy(private_kernel_klips_plugin_t *this)
plugin_t *plugin_create()
{
private_kernel_klips_plugin_t *this = malloc_thing(private_kernel_klips_plugin_t);
-
+
this->public.plugin.destroy = (void(*)(plugin_t*))destroy;
-
+
charon->kernel_interface->add_ipsec_interface(charon->kernel_interface, (kernel_ipsec_constructor_t)kernel_klips_ipsec_create);
-
+
return &this->public.plugin;
}
diff --git a/src/charon/plugins/kernel_klips/pfkeyv2.h b/src/charon/plugins/kernel_klips/pfkeyv2.h
index 78d3dfa91..20d1c298d 100644
--- a/src/charon/plugins/kernel_klips/pfkeyv2.h
+++ b/src/charon/plugins/kernel_klips/pfkeyv2.h
@@ -169,7 +169,7 @@ struct sadb_x_satype {
uint8_t sadb_x_satype_satype;
uint8_t sadb_x_satype_reserved[3];
};
-
+
struct sadb_x_debug {
uint16_t sadb_x_debug_len;
uint16_t sadb_x_debug_exttype;
@@ -200,7 +200,7 @@ struct sadb_x_nat_t_port {
uint16_t sadb_x_nat_t_port_port;
uint16_t sadb_x_nat_t_port_reserved;
};
-
+
/*
* A protocol structure for passing through the transport level
* protocol. It contains more fields than are actually used/needed
diff --git a/src/charon/plugins/kernel_netlink/Makefile.am b/src/charon/plugins/kernel_netlink/Makefile.am
index 6351280d6..31d9c6d5c 100644
--- a/src/charon/plugins/kernel_netlink/Makefile.am
+++ b/src/charon/plugins/kernel_netlink/Makefile.am
@@ -1,7 +1,9 @@
-INCLUDES = -I${linuxdir} -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
+INCLUDES = -I${linux_headers} -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
-AM_CFLAGS = -rdynamic
+AM_CFLAGS = -rdynamic \
+-DROUTING_TABLE=${routing_table} \
+-DROUTING_TABLE_PRIO=${routing_table_prio}
plugin_LTLIBRARIES = libstrongswan-kernel-netlink.la
diff --git a/src/charon/plugins/kernel_netlink/Makefile.in b/src/charon/plugins/kernel_netlink/Makefile.in
index 46d2a1c65..09be50587 100644
--- a/src/charon/plugins/kernel_netlink/Makefile.in
+++ b/src/charon/plugins/kernel_netlink/Makefile.in
@@ -1,8 +1,9 @@
-# Makefile.in generated by automake 1.10.2 from Makefile.am.
+# Makefile.in generated by automake 1.11 from Makefile.am.
# @configure_input@
# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,
-# 2003, 2004, 2005, 2006, 2007, 2008 Free Software Foundation, Inc.
+# 2003, 2004, 2005, 2006, 2007, 2008, 2009 Free Software Foundation,
+# Inc.
# This Makefile.in is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.
@@ -16,8 +17,9 @@
VPATH = @srcdir@
pkgdatadir = $(datadir)/@PACKAGE@
-pkglibdir = $(libdir)/@PACKAGE@
pkgincludedir = $(includedir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkglibexecdir = $(libexecdir)/@PACKAGE@
am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
install_sh_DATA = $(install_sh) -c -m 644
install_sh_PROGRAM = $(install_sh) -c
@@ -35,19 +37,41 @@ host_triplet = @host@
subdir = src/charon/plugins/kernel_netlink
DIST_COMMON = $(srcdir)/Makefile.am $(srcdir)/Makefile.in
ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
-am__aclocal_m4_deps = $(top_srcdir)/configure.in
+am__aclocal_m4_deps = $(top_srcdir)/m4/config/libtool.m4 \
+ $(top_srcdir)/m4/config/ltoptions.m4 \
+ $(top_srcdir)/m4/config/ltsugar.m4 \
+ $(top_srcdir)/m4/config/ltversion.m4 \
+ $(top_srcdir)/m4/config/lt~obsolete.m4 \
+ $(top_srcdir)/m4/macros/with.m4 \
+ $(top_srcdir)/m4/macros/enable-disable.m4 \
+ $(top_srcdir)/configure.in
am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
$(ACLOCAL_M4)
mkinstalldirs = $(install_sh) -d
CONFIG_CLEAN_FILES =
+CONFIG_CLEAN_VPATH_FILES =
am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
am__vpath_adj = case $$p in \
$(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
*) f=$$p;; \
esac;
-am__strip_dir = `echo $$p | sed -e 's|^.*/||'`;
+am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
+am__install_max = 40
+am__nobase_strip_setup = \
+ srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
+am__nobase_strip = \
+ for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
+am__nobase_list = $(am__nobase_strip_setup); \
+ for p in $$list; do echo "$$p $$p"; done | \
+ sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
+ $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
+ if (++n[$$2] == $(am__install_max)) \
+ { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
+ END { for (dir in files) print dir, files[dir] }'
+am__base_list = \
+ sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
+ sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
am__installdirs = "$(DESTDIR)$(plugindir)"
-pluginLTLIBRARIES_INSTALL = $(INSTALL)
LTLIBRARIES = $(plugin_LTLIBRARIES)
libstrongswan_kernel_netlink_la_LIBADD =
am_libstrongswan_kernel_netlink_la_OBJECTS = kernel_netlink_plugin.lo \
@@ -62,6 +86,7 @@ libstrongswan_kernel_netlink_la_LINK = $(LIBTOOL) --tag=CC \
DEFAULT_INCLUDES = -I.@am__isrc@
depcomp = $(SHELL) $(top_srcdir)/depcomp
am__depfiles_maybe = depfiles
+am__mv = mv -f
COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
LTCOMPILE = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
@@ -109,25 +134,22 @@ INSTALL_DATA = @INSTALL_DATA@
INSTALL_PROGRAM = @INSTALL_PROGRAM@
INSTALL_SCRIPT = @INSTALL_SCRIPT@
INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
-IPSEC_ROUTING_TABLE = @IPSEC_ROUTING_TABLE@
-IPSEC_ROUTING_TABLE_PRIO = @IPSEC_ROUTING_TABLE_PRIO@
LD = @LD@
LDFLAGS = @LDFLAGS@
LEX = @LEX@
LEXLIB = @LEXLIB@
LEX_OUTPUT_ROOT = @LEX_OUTPUT_ROOT@
-LIBGCRYPT_CFLAGS = @LIBGCRYPT_CFLAGS@
-LIBGCRYPT_CONFIG = @LIBGCRYPT_CONFIG@
-LIBGCRYPT_LIBS = @LIBGCRYPT_LIBS@
LIBOBJS = @LIBOBJS@
LIBS = @LIBS@
LIBTOOL = @LIBTOOL@
-LINUX_HEADERS = @LINUX_HEADERS@
LIPO = @LIPO@
LN_S = @LN_S@
LTLIBOBJS = @LTLIBOBJS@
MAKEINFO = @MAKEINFO@
MKDIR_P = @MKDIR_P@
+MYSQLCFLAG = @MYSQLCFLAG@
+MYSQLCONFIG = @MYSQLCONFIG@
+MYSQLLIB = @MYSQLLIB@
NM = @NM@
NMEDIT = @NMEDIT@
OBJDUMP = @OBJDUMP@
@@ -139,11 +161,14 @@ PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
PACKAGE_NAME = @PACKAGE_NAME@
PACKAGE_STRING = @PACKAGE_STRING@
PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_URL = @PACKAGE_URL@
PACKAGE_VERSION = @PACKAGE_VERSION@
PATH_SEPARATOR = @PATH_SEPARATOR@
PERL = @PERL@
PKG_CONFIG = @PKG_CONFIG@
+PTHREADLIB = @PTHREADLIB@
RANLIB = @RANLIB@
+RTLIB = @RTLIB@
RUBY = @RUBY@
RUBYINCLUDE = @RUBYINCLUDE@
SED = @SED@
@@ -172,9 +197,9 @@ build_cpu = @build_cpu@
build_os = @build_os@
build_vendor = @build_vendor@
builddir = @builddir@
-confdir = @confdir@
datadir = @datadir@
datarootdir = @datarootdir@
+default_pkcs11 = @default_pkcs11@
docdir = @docdir@
dvidir = @dvidir@
exec_prefix = @exec_prefix@
@@ -197,7 +222,7 @@ ipsecuser = @ipsecuser@
libdir = @libdir@
libexecdir = @libexecdir@
libstrongswan_plugins = @libstrongswan_plugins@
-linuxdir = @linuxdir@
+linux_headers = @linux_headers@
localedir = @localedir@
localstatedir = @localstatedir@
lt_ECHO = @lt_ECHO@
@@ -205,6 +230,7 @@ mandir = @mandir@
mkdir_p = @mkdir_p@
nm_CFLAGS = @nm_CFLAGS@
nm_LIBS = @nm_LIBS@
+nm_ca_dir = @nm_ca_dir@
oldincludedir = @oldincludedir@
pdfdir = @pdfdir@
piddir = @piddir@
@@ -213,10 +239,12 @@ pluto_plugins = @pluto_plugins@
prefix = @prefix@
program_transform_name = @program_transform_name@
psdir = @psdir@
+random_device = @random_device@
resolv_conf = @resolv_conf@
+routing_table = @routing_table@
+routing_table_prio = @routing_table_prio@
sbindir = @sbindir@
sharedstatedir = @sharedstatedir@
-simreader = @simreader@
srcdir = @srcdir@
strongswan_conf = @strongswan_conf@
sysconfdir = @sysconfdir@
@@ -224,10 +252,14 @@ target_alias = @target_alias@
top_build_prefix = @top_build_prefix@
top_builddir = @top_builddir@
top_srcdir = @top_srcdir@
+urandom_device = @urandom_device@
xml_CFLAGS = @xml_CFLAGS@
xml_LIBS = @xml_LIBS@
-INCLUDES = -I${linuxdir} -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
-AM_CFLAGS = -rdynamic
+INCLUDES = -I${linux_headers} -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
+AM_CFLAGS = -rdynamic \
+-DROUTING_TABLE=${routing_table} \
+-DROUTING_TABLE_PRIO=${routing_table_prio}
+
plugin_LTLIBRARIES = libstrongswan-kernel-netlink.la
libstrongswan_kernel_netlink_la_SOURCES = kernel_netlink_plugin.h kernel_netlink_plugin.c \
kernel_netlink_ipsec.h kernel_netlink_ipsec.c kernel_netlink_net.h kernel_netlink_net.c \
@@ -247,9 +279,9 @@ $(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps)
exit 1;; \
esac; \
done; \
- echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/charon/plugins/kernel_netlink/Makefile'; \
- cd $(top_srcdir) && \
- $(AUTOMAKE) --gnu src/charon/plugins/kernel_netlink/Makefile
+ echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/charon/plugins/kernel_netlink/Makefile'; \
+ $(am__cd) $(top_srcdir) && \
+ $(AUTOMAKE) --gnu src/charon/plugins/kernel_netlink/Makefile
.PRECIOUS: Makefile
Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
@case '$?' in \
@@ -267,23 +299,28 @@ $(top_srcdir)/configure: $(am__configure_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
$(ACLOCAL_M4): $(am__aclocal_m4_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(am__aclocal_m4_deps):
install-pluginLTLIBRARIES: $(plugin_LTLIBRARIES)
@$(NORMAL_INSTALL)
test -z "$(plugindir)" || $(MKDIR_P) "$(DESTDIR)$(plugindir)"
- @list='$(plugin_LTLIBRARIES)'; for p in $$list; do \
+ @list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+ list2=; for p in $$list; do \
if test -f $$p; then \
- f=$(am__strip_dir) \
- echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(pluginLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) '$$p' '$(DESTDIR)$(plugindir)/$$f'"; \
- $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(pluginLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) "$$p" "$(DESTDIR)$(plugindir)/$$f"; \
+ list2="$$list2 $$p"; \
else :; fi; \
- done
+ done; \
+ test -z "$$list2" || { \
+ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(plugindir)'"; \
+ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(plugindir)"; \
+ }
uninstall-pluginLTLIBRARIES:
@$(NORMAL_UNINSTALL)
- @list='$(plugin_LTLIBRARIES)'; for p in $$list; do \
- p=$(am__strip_dir) \
- echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$p'"; \
- $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$p"; \
+ @list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+ for p in $$list; do \
+ $(am__strip_dir) \
+ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$f'"; \
+ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$f"; \
done
clean-pluginLTLIBRARIES:
@@ -310,21 +347,21 @@ distclean-compile:
.c.o:
@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(COMPILE) -c $<
.c.obj:
@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(COMPILE) -c `$(CYGPATH_W) '$<'`
.c.lo:
@am__fastdepCC_TRUE@ $(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(LTCOMPILE) -c -o $@ $<
@@ -347,7 +384,7 @@ tags: TAGS
TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
$(TAGS_FILES) $(LISP)
- tags=; \
+ set x; \
here=`pwd`; \
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
unique=`for i in $$list; do \
@@ -355,29 +392,34 @@ TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
- if test -z "$(ETAGS_ARGS)$$tags$$unique"; then :; else \
+ shift; \
+ if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
test -n "$$unique" || unique=$$empty_fix; \
- $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
- $$tags $$unique; \
+ if test $$# -gt 0; then \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ "$$@" $$unique; \
+ else \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ $$unique; \
+ fi; \
fi
ctags: CTAGS
CTAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
$(TAGS_FILES) $(LISP)
- tags=; \
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
unique=`for i in $$list; do \
if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
- test -z "$(CTAGS_ARGS)$$tags$$unique" \
+ test -z "$(CTAGS_ARGS)$$unique" \
|| $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
- $$tags $$unique
+ $$unique
GTAGS:
here=`$(am__cd) $(top_builddir) && pwd` \
- && cd $(top_srcdir) \
- && gtags -i $(GTAGS_ARGS) $$here
+ && $(am__cd) $(top_srcdir) \
+ && gtags -i $(GTAGS_ARGS) "$$here"
distclean-tags:
-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
@@ -398,13 +440,17 @@ distdir: $(DISTFILES)
if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
if test -d $$d/$$file; then \
dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
+ if test -d "$(distdir)/$$file"; then \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+ fi; \
if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
- cp -pR $(srcdir)/$$file $(distdir)$$dir || exit 1; \
+ cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
fi; \
- cp -pR $$d/$$file $(distdir)$$dir || exit 1; \
+ cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
else \
- test -f $(distdir)/$$file \
- || cp -p $$d/$$file $(distdir)/$$file \
+ test -f "$(distdir)/$$file" \
+ || cp -p $$d/$$file "$(distdir)/$$file" \
|| exit 1; \
fi; \
done
@@ -435,6 +481,7 @@ clean-generic:
distclean-generic:
-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+ -test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
maintainer-clean-generic:
@echo "This command is intended for maintainers to use"
@@ -456,6 +503,8 @@ dvi-am:
html: html-am
+html-am:
+
info: info-am
info-am:
@@ -464,18 +513,28 @@ install-data-am: install-pluginLTLIBRARIES
install-dvi: install-dvi-am
+install-dvi-am:
+
install-exec-am:
install-html: install-html-am
+install-html-am:
+
install-info: install-info-am
+install-info-am:
+
install-man:
install-pdf: install-pdf-am
+install-pdf-am:
+
install-ps: install-ps-am
+install-ps-am:
+
installcheck-am:
maintainer-clean: maintainer-clean-am
@@ -514,6 +573,7 @@ uninstall-am: uninstall-pluginLTLIBRARIES
mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \
tags uninstall uninstall-am uninstall-pluginLTLIBRARIES
+
# Tell versions [3.59,3.63) of GNU make to not export all variables.
# Otherwise a system limit (for SysV at least) may be exceeded.
.NOEXPORT:
diff --git a/src/charon/plugins/kernel_netlink/kernel_netlink_ipsec.c b/src/charon/plugins/kernel_netlink/kernel_netlink_ipsec.c
index 2051316f6..850876b9d 100644
--- a/src/charon/plugins/kernel_netlink/kernel_netlink_ipsec.c
+++ b/src/charon/plugins/kernel_netlink/kernel_netlink_ipsec.c
@@ -1,6 +1,6 @@
/*
- * Copyright (C) 2006-2008 Tobias Brunner
- * Copyright (C) 2005-2008 Martin Willi
+ * Copyright (C) 2006-2009 Tobias Brunner
+ * Copyright (C) 2005-2009 Martin Willi
* Copyright (C) 2008 Andreas Steffen
* Copyright (C) 2006-2007 Fabian Hartmann, Noah Heusser
* Copyright (C) 2006 Daniel Roethlisberger
@@ -20,23 +20,24 @@
#include <sys/types.h>
#include <sys/socket.h>
-#include <sys/time.h>
#include <stdint.h>
#include <linux/ipsec.h>
#include <linux/netlink.h>
#include <linux/rtnetlink.h>
#include <linux/xfrm.h>
#include <linux/udp.h>
-#include <pthread.h>
#include <unistd.h>
+#include <time.h>
#include <errno.h>
#include <string.h>
+#include <fcntl.h>
#include "kernel_netlink_ipsec.h"
#include "kernel_netlink_shared.h"
#include <daemon.h>
-#include <utils/mutex.h>
+#include <threading/thread.h>
+#include <threading/mutex.h>
#include <utils/hashtable.h>
#include <processing/jobs/callback_job.h>
#include <processing/jobs/acquire_job.h>
@@ -51,27 +52,32 @@
#endif
/** from linux/in.h */
-#ifndef IP_IPSEC_POLICY
-#define IP_IPSEC_POLICY 16
+#ifndef IP_XFRM_POLICY
+#define IP_XFRM_POLICY 17
#endif
/* missing on uclibc */
-#ifndef IPV6_IPSEC_POLICY
-#define IPV6_IPSEC_POLICY 34
-#endif /*IPV6_IPSEC_POLICY*/
+#ifndef IPV6_XFRM_POLICY
+#define IPV6_XFRM_POLICY 34
+#endif /*IPV6_XFRM_POLICY*/
/** default priority of installed policies */
#define PRIO_LOW 3000
#define PRIO_HIGH 2000
/**
+ * map the limit for bytes and packets to XFRM_INF per default
+ */
+#define XFRM_LIMIT(x) ((x) == 0 ? XFRM_INF : (x))
+
+/**
* Create ORable bitfield of XFRM NL groups
*/
#define XFRMNLGRP(x) (1<<(XFRMNLGRP_##x-1))
/**
- * returns a pointer to the first rtattr following the nlmsghdr *nlh and the
- * 'usual' netlink data x like 'struct xfrm_usersa_info'
+ * returns a pointer to the first rtattr following the nlmsghdr *nlh and the
+ * 'usual' netlink data x like 'struct xfrm_usersa_info'
*/
#define XFRM_RTA(nlh, x) ((struct rtattr*)(NLMSG_DATA(nlh) + NLMSG_ALIGN(sizeof(x))))
/**
@@ -80,8 +86,8 @@
*/
#define XFRM_RTA_NEXT(rta) ((struct rtattr*)(((char*)(rta)) + RTA_ALIGN((rta)->rta_len)))
/**
- * returns the total size of attached rta data
- * (after 'usual' netlink data x like 'struct xfrm_usersa_info')
+ * returns the total size of attached rta data
+ * (after 'usual' netlink data x like 'struct xfrm_usersa_info')
*/
#define XFRM_PAYLOAD(nlh, x) NLMSG_PAYLOAD(nlh, sizeof(x))
@@ -95,7 +101,7 @@ struct kernel_algorithm_t {
* Identifier specified in IKEv2
*/
int ikev2;
-
+
/**
* Name of the algorithm in linux crypto API
*/
@@ -157,18 +163,18 @@ ENUM(xfrm_attr_type_names, XFRMA_UNSPEC, XFRMA_KMADDRESS,
* Algorithms for encryption
*/
static kernel_algorithm_t encryption_algs[] = {
-/* {ENCR_DES_IV64, "***" }, */
- {ENCR_DES, "des" },
- {ENCR_3DES, "des3_ede" },
-/* {ENCR_RC5, "***" }, */
-/* {ENCR_IDEA, "***" }, */
- {ENCR_CAST, "cast128" },
- {ENCR_BLOWFISH, "blowfish" },
-/* {ENCR_3IDEA, "***" }, */
-/* {ENCR_DES_IV32, "***" }, */
- {ENCR_NULL, "cipher_null" },
- {ENCR_AES_CBC, "aes" },
- {ENCR_AES_CTR, "rfc3686(ctr(aes))" },
+/* {ENCR_DES_IV64, "***" }, */
+ {ENCR_DES, "des" },
+ {ENCR_3DES, "des3_ede" },
+/* {ENCR_RC5, "***" }, */
+/* {ENCR_IDEA, "***" }, */
+ {ENCR_CAST, "cast128" },
+ {ENCR_BLOWFISH, "blowfish" },
+/* {ENCR_3IDEA, "***" }, */
+/* {ENCR_DES_IV32, "***" }, */
+ {ENCR_NULL, "cipher_null" },
+ {ENCR_AES_CBC, "aes" },
+ {ENCR_AES_CTR, "rfc3686(ctr(aes))" },
{ENCR_AES_CCM_ICV8, "rfc4309(ccm(aes))" },
{ENCR_AES_CCM_ICV12, "rfc4309(ccm(aes))" },
{ENCR_AES_CCM_ICV16, "rfc4309(ccm(aes))" },
@@ -181,33 +187,34 @@ static kernel_algorithm_t encryption_algs[] = {
/* {ENCR_CAMELLIA_CCM_ICV8, "***" }, */
/* {ENCR_CAMELLIA_CCM_ICV12, "***" }, */
/* {ENCR_CAMELLIA_CCM_ICV16, "***" }, */
- {END_OF_LIST, NULL }
+ {END_OF_LIST, NULL }
};
/**
* Algorithms for integrity protection
*/
static kernel_algorithm_t integrity_algs[] = {
- {AUTH_HMAC_MD5_96, "md5" },
+ {AUTH_HMAC_MD5_96, "md5" },
{AUTH_HMAC_SHA1_96, "sha1" },
- {AUTH_HMAC_SHA2_256_128, "sha256" },
- {AUTH_HMAC_SHA2_384_192, "sha384" },
- {AUTH_HMAC_SHA2_512_256, "sha512" },
+ {AUTH_HMAC_SHA2_256_96, "sha256" },
+ {AUTH_HMAC_SHA2_256_128, "hmac(sha256)" },
+ {AUTH_HMAC_SHA2_384_192, "hmac(sha384)" },
+ {AUTH_HMAC_SHA2_512_256, "hmac(sha512)" },
/* {AUTH_DES_MAC, "***" }, */
/* {AUTH_KPDK_MD5, "***" }, */
{AUTH_AES_XCBC_96, "xcbc(aes)" },
- {END_OF_LIST, NULL }
+ {END_OF_LIST, NULL }
};
/**
* Algorithms for IPComp
*/
static kernel_algorithm_t compression_algs[] = {
-/* {IPCOMP_OUI, "***" }, */
+/* {IPCOMP_OUI, "***" }, */
{IPCOMP_DEFLATE, "deflate" },
{IPCOMP_LZS, "lzs" },
{IPCOMP_LZJH, "lzjh" },
- {END_OF_LIST, NULL }
+ {END_OF_LIST, NULL }
};
/**
@@ -234,10 +241,10 @@ typedef struct route_entry_t route_entry_t;
struct route_entry_t {
/** Name of the interface the route is bound to */
char *if_name;
-
+
/** Source ip of the route */
host_t *src_ip;
-
+
/** gateway for this route */
host_t *gateway;
@@ -255,7 +262,7 @@ static void route_entry_destroy(route_entry_t *this)
{
free(this->if_name);
this->src_ip->destroy(this->src_ip);
- this->gateway->destroy(this->gateway);
+ DESTROY_IF(this->gateway);
chunk_free(&this->dst_net);
free(this);
}
@@ -266,16 +273,16 @@ typedef struct policy_entry_t policy_entry_t;
* installed kernel policy.
*/
struct policy_entry_t {
-
+
/** direction of this policy: in, out, forward */
u_int8_t direction;
-
+
/** parameters of installed policy */
struct xfrm_selector sel;
-
+
/** associated route installed for this policy */
route_entry_t *route;
-
+
/** by how many CHILD_SA's this policy is used */
u_int refcount;
};
@@ -308,32 +315,32 @@ struct private_kernel_netlink_ipsec_t {
* Public part of the kernel_netlink_t object.
*/
kernel_netlink_ipsec_t public;
-
+
/**
* mutex to lock access to various lists
*/
mutex_t *mutex;
-
+
/**
* Hash table of installed policies (policy_entry_t)
*/
hashtable_t *policies;
-
+
/**
* job receiving netlink events
*/
callback_job_t *job;
-
+
/**
* Netlink xfrm socket (IPsec)
*/
netlink_socket_t *socket_xfrm;
-
+
/**
* netlink xfrm socket to receive acquire and expire events
*/
int socket_xfrm_events;
-
+
/**
* whether to install routes along policies
*/
@@ -396,7 +403,7 @@ static u_int8_t mode2kernel(ipsec_mode_t mode)
static void host2xfrm(host_t *host, xfrm_address_t *xfrm)
{
chunk_t chunk = host->get_address(host);
- memcpy(xfrm, chunk.ptr, min(chunk.len, sizeof(xfrm_address_t)));
+ memcpy(xfrm, chunk.ptr, min(chunk.len, sizeof(xfrm_address_t)));
}
/**
@@ -405,7 +412,7 @@ static void host2xfrm(host_t *host, xfrm_address_t *xfrm)
static host_t* xfrm2host(int family, xfrm_address_t *xfrm, u_int16_t port)
{
chunk_t chunk;
-
+
switch (family)
{
case AF_INET:
@@ -423,12 +430,12 @@ static host_t* xfrm2host(int family, xfrm_address_t *xfrm, u_int16_t port)
/**
* convert a traffic selector address range to subnet and its mask.
*/
-static void ts2subnet(traffic_selector_t* ts,
+static void ts2subnet(traffic_selector_t* ts,
xfrm_address_t *net, u_int8_t *mask)
{
host_t *net_host;
chunk_t net_chunk;
-
+
ts->to_subnet(ts, &net_host, mask);
net_chunk = net_host->get_address(net_host);
memcpy(net, net_chunk.ptr, net_chunk.len);
@@ -438,7 +445,7 @@ static void ts2subnet(traffic_selector_t* ts,
/**
* convert a traffic selector port range to port/portmask
*/
-static void ts2ports(traffic_selector_t* ts,
+static void ts2ports(traffic_selector_t* ts,
u_int16_t *port, u_int16_t *mask)
{
/* linux does not seem to accept complex portmasks. Only
@@ -446,10 +453,10 @@ static void ts2ports(traffic_selector_t* ts,
* a port range, or to a specific, if we have one port only.
*/
u_int16_t from, to;
-
+
from = ts->get_from_port(ts);
to = ts->get_to_port(ts);
-
+
if (from == to)
{
*port = htons(from);
@@ -465,7 +472,7 @@ static void ts2ports(traffic_selector_t* ts,
/**
* convert a pair of traffic_selectors to a xfrm_selector
*/
-static struct xfrm_selector ts2selector(traffic_selector_t *src,
+static struct xfrm_selector ts2selector(traffic_selector_t *src,
traffic_selector_t *dst)
{
struct xfrm_selector sel;
@@ -480,12 +487,12 @@ static struct xfrm_selector ts2selector(traffic_selector_t *src,
ts2ports(src, &sel.sport, &sel.sport_mask);
sel.ifindex = 0;
sel.user = 0;
-
+
return sel;
}
/**
- * convert a xfrm_selector to a src|dst traffic_selector
+ * convert a xfrm_selector to a src|dst traffic_selector
*/
static traffic_selector_t* selector2ts(struct xfrm_selector *sel, bool src)
{
@@ -493,7 +500,7 @@ static traffic_selector_t* selector2ts(struct xfrm_selector *sel, bool src)
u_int8_t prefixlen;
u_int16_t port = 0;
host_t *host = NULL;
-
+
if (src)
{
addr = (u_char*)&sel->saddr;
@@ -512,9 +519,9 @@ static traffic_selector_t* selector2ts(struct xfrm_selector *sel, bool src)
port = htons(sel->dport);
}
}
-
+
/* The Linux 2.6 kernel does not set the selector's family field,
- * so as a kludge we additionally test the prefix length.
+ * so as a kludge we additionally test the prefix length.
*/
if (sel->family == AF_INET || sel->prefixlen_s == 32)
{
@@ -524,7 +531,7 @@ static traffic_selector_t* selector2ts(struct xfrm_selector *sel, bool src)
{
host = host_create_from_chunk(AF_INET6, chunk_create(addr, 16), 0);
}
-
+
if (host)
{
return traffic_selector_create_from_subnet(host, prefixlen,
@@ -545,7 +552,7 @@ static void process_acquire(private_kernel_netlink_ipsec_t *this, struct nlmsghd
struct rtattr *rta;
size_t rtasize;
job_t *job;
-
+
acquire = (struct xfrm_user_acquire*)NLMSG_DATA(hdr);
rta = XFRM_RTA(hdr, struct xfrm_user_acquire);
rtasize = XFRM_PAYLOAD(hdr, struct xfrm_user_acquire);
@@ -593,21 +600,21 @@ static void process_expire(private_kernel_netlink_ipsec_t *this, struct nlmsghdr
protocol_id_t protocol;
u_int32_t spi, reqid;
struct xfrm_user_expire *expire;
-
+
expire = (struct xfrm_user_expire*)NLMSG_DATA(hdr);
protocol = proto_kernel2ike(expire->state.id.proto);
spi = expire->state.id.spi;
reqid = expire->state.reqid;
-
+
DBG2(DBG_KNL, "received a XFRM_MSG_EXPIRE");
-
+
if (protocol != PROTO_ESP && protocol != PROTO_AH)
{
DBG2(DBG_KNL, "ignoring XFRM_MSG_EXPIRE for SA with SPI %.8x and reqid {%u} "
"which is not a CHILD_SA", ntohl(spi), reqid);
return;
}
-
+
DBG1(DBG_KNL, "creating %s job for %N CHILD_SA with SPI %.8x and reqid {%d}",
expire->hard ? "delete" : "rekey", protocol_id_names,
protocol, ntohl(spi), reqid);
@@ -643,7 +650,7 @@ static void process_migrate(private_kernel_netlink_ipsec_t *this, struct nlmsghd
rtasize = XFRM_PAYLOAD(hdr, struct xfrm_userpolicy_id);
DBG2(DBG_KNL, "received a XFRM_MSG_MIGRATE");
-
+
src_ts = selector2ts(&policy_id->sel, TRUE);
dst_ts = selector2ts(&policy_id->sel, FALSE);
dir = (policy_dir_t)policy_id->dir;
@@ -712,13 +719,13 @@ static void process_mapping(private_kernel_netlink_ipsec_t *this,
u_int32_t spi, reqid;
struct xfrm_user_mapping *mapping;
host_t *host;
-
+
mapping = (struct xfrm_user_mapping*)NLMSG_DATA(hdr);
spi = mapping->id.spi;
reqid = mapping->reqid;
-
+
DBG2(DBG_KNL, "received a XFRM_MSG_MAPPING");
-
+
if (proto_kernel2ike(mapping->id.proto) == PROTO_ESP)
{
host = xfrm2host(mapping->id.family, &mapping->new_saddr,
@@ -742,13 +749,14 @@ static job_requeue_t receive_events(private_kernel_netlink_ipsec_t *this)
struct nlmsghdr *hdr = (struct nlmsghdr*)response;
struct sockaddr_nl addr;
socklen_t addr_len = sizeof(addr);
- int len, oldstate;
+ int len;
+ bool oldstate;
- pthread_setcancelstate(PTHREAD_CANCEL_ENABLE, &oldstate);
+ oldstate = thread_cancelability(TRUE);
len = recvfrom(this->socket_xfrm_events, response, sizeof(response), 0,
(struct sockaddr*)&addr, &addr_len);
- pthread_setcancelstate(oldstate, NULL);
-
+ thread_cancelability(oldstate);
+
if (len < 0)
{
switch (errno)
@@ -765,12 +773,12 @@ static job_requeue_t receive_events(private_kernel_netlink_ipsec_t *this)
return JOB_REQUEUE_FAIR;
}
}
-
+
if (addr.nl_pid != 0)
{ /* not from kernel. not interested, try another one */
return JOB_REQUEUE_DIRECT;
}
-
+
while (NLMSG_OK(hdr, len))
{
switch (hdr->nlmsg_type)
@@ -788,6 +796,7 @@ static job_requeue_t receive_events(private_kernel_netlink_ipsec_t *this)
process_mapping(this, hdr);
break;
default:
+ DBG1(DBG_KNL, "received unknown event from xfrm event socket: %d", hdr->nlmsg_type);
break;
}
hdr = NLMSG_NEXT(hdr, len);
@@ -807,9 +816,9 @@ static status_t get_spi_internal(private_kernel_netlink_ipsec_t *this,
struct xfrm_userspi_info *userspi;
u_int32_t received_spi = 0;
size_t len;
-
+
memset(&request, 0, sizeof(request));
-
+
hdr = (struct nlmsghdr*)request;
hdr->nlmsg_flags = NLM_F_REQUEST;
hdr->nlmsg_type = XFRM_MSG_ALLOCSPI;
@@ -824,7 +833,7 @@ static status_t get_spi_internal(private_kernel_netlink_ipsec_t *this,
userspi->info.family = src->get_family(src);
userspi->min = min;
userspi->max = max;
-
+
if (this->socket_xfrm->send(this->socket_xfrm, hdr, &out, &len) == SUCCESS)
{
hdr = out;
@@ -841,7 +850,7 @@ static status_t get_spi_internal(private_kernel_netlink_ipsec_t *this,
case NLMSG_ERROR:
{
struct nlmsgerr *err = NLMSG_DATA(hdr);
-
+
DBG1(DBG_KNL, "allocating SPI failed: %s (%d)",
strerror(-err->error), -err->error);
break;
@@ -856,12 +865,12 @@ static status_t get_spi_internal(private_kernel_netlink_ipsec_t *this,
}
free(out);
}
-
+
if (received_spi == 0)
{
return FAILED;
}
-
+
*spi = received_spi;
return SUCCESS;
}
@@ -869,47 +878,47 @@ static status_t get_spi_internal(private_kernel_netlink_ipsec_t *this,
/**
* Implementation of kernel_interface_t.get_spi.
*/
-static status_t get_spi(private_kernel_netlink_ipsec_t *this,
- host_t *src, host_t *dst,
+static status_t get_spi(private_kernel_netlink_ipsec_t *this,
+ host_t *src, host_t *dst,
protocol_id_t protocol, u_int32_t reqid,
u_int32_t *spi)
{
DBG2(DBG_KNL, "getting SPI for reqid {%u}", reqid);
-
+
if (get_spi_internal(this, src, dst, proto_ike2kernel(protocol),
0xc0000000, 0xcFFFFFFF, reqid, spi) != SUCCESS)
{
DBG1(DBG_KNL, "unable to get SPI for reqid {%u}", reqid);
return FAILED;
}
-
+
DBG2(DBG_KNL, "got SPI %.8x for reqid {%u}", ntohl(*spi), reqid);
-
+
return SUCCESS;
}
/**
* Implementation of kernel_interface_t.get_cpi.
*/
-static status_t get_cpi(private_kernel_netlink_ipsec_t *this,
- host_t *src, host_t *dst,
+static status_t get_cpi(private_kernel_netlink_ipsec_t *this,
+ host_t *src, host_t *dst,
u_int32_t reqid, u_int16_t *cpi)
{
u_int32_t received_spi = 0;
DBG2(DBG_KNL, "getting CPI for reqid {%u}", reqid);
-
+
if (get_spi_internal(this, src, dst,
IPPROTO_COMP, 0x100, 0xEFFF, reqid, &received_spi) != SUCCESS)
{
DBG1(DBG_KNL, "unable to get CPI for reqid {%u}", reqid);
return FAILED;
}
-
+
*cpi = htons((u_int16_t)ntohl(received_spi));
-
+
DBG2(DBG_KNL, "got CPI %.4x for reqid {%u}", ntohs(*cpi), reqid);
-
+
return SUCCESS;
}
@@ -919,38 +928,42 @@ static status_t get_cpi(private_kernel_netlink_ipsec_t *this,
static status_t add_sa(private_kernel_netlink_ipsec_t *this,
host_t *src, host_t *dst, u_int32_t spi,
protocol_id_t protocol, u_int32_t reqid,
- u_int64_t expire_soft, u_int64_t expire_hard,
+ lifetime_cfg_t *lifetime,
u_int16_t enc_alg, chunk_t enc_key,
u_int16_t int_alg, chunk_t int_key,
ipsec_mode_t mode, u_int16_t ipcomp, u_int16_t cpi,
- bool encap, bool inbound)
+ bool encap, bool inbound,
+ traffic_selector_t* src_ts, traffic_selector_t* dst_ts)
{
netlink_buf_t request;
char *alg_name;
struct nlmsghdr *hdr;
struct xfrm_usersa_info *sa;
- u_int16_t icv_size = 64;
-
+ u_int16_t icv_size = 64;
+
/* if IPComp is used, we install an additional IPComp SA. if the cpi is 0
* we are in the recursive call below */
if (ipcomp != IPCOMP_NONE && cpi != 0)
{
- add_sa(this, src, dst, htonl(ntohs(cpi)), IPPROTO_COMP, reqid, 0, 0,
- ENCR_UNDEFINED, chunk_empty, AUTH_UNDEFINED, chunk_empty,
- mode, ipcomp, 0, FALSE, inbound);
+ lifetime_cfg_t lft = {{0,0,0},{0,0,0},{0,0,0}};
+ add_sa(this, src, dst, htonl(ntohs(cpi)), IPPROTO_COMP, reqid, &lft,
+ ENCR_UNDEFINED, chunk_empty, AUTH_UNDEFINED, chunk_empty,
+ mode, ipcomp, 0, FALSE, inbound, NULL, NULL);
ipcomp = IPCOMP_NONE;
+ /* use transport mode ESP SA, IPComp uses tunnel mode */
+ mode = MODE_TRANSPORT;
}
-
+
memset(&request, 0, sizeof(request));
-
+
DBG2(DBG_KNL, "adding SAD entry with SPI %.8x and reqid {%u}",
ntohl(spi), reqid);
-
+
hdr = (struct nlmsghdr*)request;
hdr->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK;
hdr->nlmsg_type = inbound ? XFRM_MSG_UPDSA : XFRM_MSG_NEWSA;
hdr->nlmsg_len = NLMSG_LENGTH(sizeof(struct xfrm_usersa_info));
-
+
sa = (struct xfrm_usersa_info*)NLMSG_DATA(hdr);
host2xfrm(src, &sa->saddr);
host2xfrm(dst, &sa->id.daddr);
@@ -958,25 +971,35 @@ static status_t add_sa(private_kernel_netlink_ipsec_t *this,
sa->id.proto = proto_ike2kernel(protocol);
sa->family = src->get_family(src);
sa->mode = mode2kernel(mode);
- if (mode == MODE_TUNNEL)
+ switch (mode)
{
- sa->flags |= XFRM_STATE_AF_UNSPEC;
+ case MODE_TUNNEL:
+ sa->flags |= XFRM_STATE_AF_UNSPEC;
+ break;
+ case MODE_BEET:
+ if(src_ts && dst_ts)
+ {
+ sa->sel = ts2selector(src_ts, dst_ts);
+ }
+ break;
+ default:
+ break;
}
+
sa->replay_window = (protocol == IPPROTO_COMP) ? 0 : 32;
sa->reqid = reqid;
- /* we currently do not expire SAs by volume/packet count */
- sa->lft.soft_byte_limit = XFRM_INF;
- sa->lft.hard_byte_limit = XFRM_INF;
- sa->lft.soft_packet_limit = XFRM_INF;
- sa->lft.hard_packet_limit = XFRM_INF;
+ sa->lft.soft_byte_limit = XFRM_LIMIT(lifetime->bytes.rekey);
+ sa->lft.hard_byte_limit = XFRM_LIMIT(lifetime->bytes.life);
+ sa->lft.soft_packet_limit = XFRM_LIMIT(lifetime->packets.rekey);
+ sa->lft.hard_packet_limit = XFRM_LIMIT(lifetime->packets.life);
/* we use lifetimes since added, not since used */
- sa->lft.soft_add_expires_seconds = expire_soft;
- sa->lft.hard_add_expires_seconds = expire_hard;
+ sa->lft.soft_add_expires_seconds = lifetime->time.rekey;
+ sa->lft.hard_add_expires_seconds = lifetime->time.life;
sa->lft.soft_use_expires_seconds = 0;
sa->lft.hard_use_expires_seconds = 0;
-
+
struct rtattr *rthdr = XFRM_RTA(hdr, struct xfrm_usersa_info);
-
+
switch (enc_alg)
{
case ENCR_UNDEFINED:
@@ -1007,7 +1030,7 @@ static status_t add_sa(private_kernel_netlink_ipsec_t *this,
}
DBG2(DBG_KNL, " using encryption algorithm %N with key size %d",
encryption_algorithm_names, enc_alg, enc_key.len * 8);
-
+
rthdr->rta_type = XFRMA_ALG_AEAD;
rthdr->rta_len = RTA_LENGTH(sizeof(struct xfrm_algo_aead) + enc_key.len);
hdr->nlmsg_len += rthdr->rta_len;
@@ -1015,13 +1038,13 @@ static status_t add_sa(private_kernel_netlink_ipsec_t *this,
{
return FAILED;
}
-
+
algo = (struct xfrm_algo_aead*)RTA_DATA(rthdr);
algo->alg_key_len = enc_key.len * 8;
algo->alg_icv_len = icv_size;
strcpy(algo->alg_name, alg_name);
memcpy(algo->alg_key, enc_key.ptr, enc_key.len);
-
+
rthdr = XFRM_RTA_NEXT(rthdr);
break;
}
@@ -1038,7 +1061,7 @@ static status_t add_sa(private_kernel_netlink_ipsec_t *this,
}
DBG2(DBG_KNL, " using encryption algorithm %N with key size %d",
encryption_algorithm_names, enc_alg, enc_key.len * 8);
-
+
rthdr->rta_type = XFRMA_ALG_CRYPT;
rthdr->rta_len = RTA_LENGTH(sizeof(struct xfrm_algo) + enc_key.len);
hdr->nlmsg_len += rthdr->rta_len;
@@ -1046,71 +1069,97 @@ static status_t add_sa(private_kernel_netlink_ipsec_t *this,
{
return FAILED;
}
-
+
algo = (struct xfrm_algo*)RTA_DATA(rthdr);
algo->alg_key_len = enc_key.len * 8;
strcpy(algo->alg_name, alg_name);
memcpy(algo->alg_key, enc_key.ptr, enc_key.len);
-
+
rthdr = XFRM_RTA_NEXT(rthdr);
}
}
-
+
if (int_alg != AUTH_UNDEFINED)
{
- rthdr->rta_type = XFRMA_ALG_AUTH;
alg_name = lookup_algorithm(integrity_algs, int_alg);
if (alg_name == NULL)
{
- DBG1(DBG_KNL, "algorithm %N not supported by kernel!",
+ DBG1(DBG_KNL, "algorithm %N not supported by kernel!",
integrity_algorithm_names, int_alg);
return FAILED;
}
DBG2(DBG_KNL, " using integrity algorithm %N with key size %d",
integrity_algorithm_names, int_alg, int_key.len * 8);
-
- rthdr->rta_len = RTA_LENGTH(sizeof(struct xfrm_algo) + int_key.len);
- hdr->nlmsg_len += rthdr->rta_len;
- if (hdr->nlmsg_len > sizeof(request))
+
+ if (int_alg == AUTH_HMAC_SHA2_256_128)
{
- return FAILED;
+ struct xfrm_algo_auth* algo;
+
+ /* the kernel uses SHA256 with 96 bit truncation by default,
+ * use specified truncation size supported by newer kernels */
+ rthdr->rta_type = XFRMA_ALG_AUTH_TRUNC;
+ rthdr->rta_len = RTA_LENGTH(sizeof(struct xfrm_algo_auth) + int_key.len);
+
+ hdr->nlmsg_len += rthdr->rta_len;
+ if (hdr->nlmsg_len > sizeof(request))
+ {
+ return FAILED;
+ }
+
+ algo = (struct xfrm_algo_auth*)RTA_DATA(rthdr);
+ algo->alg_key_len = int_key.len * 8;
+ algo->alg_trunc_len = 128;
+ strcpy(algo->alg_name, alg_name);
+ memcpy(algo->alg_key, int_key.ptr, int_key.len);
+ }
+ else
+ {
+ struct xfrm_algo* algo;
+
+ rthdr->rta_type = XFRMA_ALG_AUTH;
+ rthdr->rta_len = RTA_LENGTH(sizeof(struct xfrm_algo) + int_key.len);
+
+ hdr->nlmsg_len += rthdr->rta_len;
+ if (hdr->nlmsg_len > sizeof(request))
+ {
+ return FAILED;
+ }
+
+ algo = (struct xfrm_algo*)RTA_DATA(rthdr);
+ algo->alg_key_len = int_key.len * 8;
+ strcpy(algo->alg_name, alg_name);
+ memcpy(algo->alg_key, int_key.ptr, int_key.len);
}
-
- struct xfrm_algo* algo = (struct xfrm_algo*)RTA_DATA(rthdr);
- algo->alg_key_len = int_key.len * 8;
- strcpy(algo->alg_name, alg_name);
- memcpy(algo->alg_key, int_key.ptr, int_key.len);
-
rthdr = XFRM_RTA_NEXT(rthdr);
}
-
+
if (ipcomp != IPCOMP_NONE)
{
rthdr->rta_type = XFRMA_ALG_COMP;
alg_name = lookup_algorithm(compression_algs, ipcomp);
if (alg_name == NULL)
{
- DBG1(DBG_KNL, "algorithm %N not supported by kernel!",
+ DBG1(DBG_KNL, "algorithm %N not supported by kernel!",
ipcomp_transform_names, ipcomp);
return FAILED;
}
DBG2(DBG_KNL, " using compression algorithm %N",
ipcomp_transform_names, ipcomp);
-
+
rthdr->rta_len = RTA_LENGTH(sizeof(struct xfrm_algo));
hdr->nlmsg_len += rthdr->rta_len;
if (hdr->nlmsg_len > sizeof(request))
{
return FAILED;
}
-
+
struct xfrm_algo* algo = (struct xfrm_algo*)RTA_DATA(rthdr);
algo->alg_key_len = 0;
strcpy(algo->alg_name, alg_name);
-
+
rthdr = XFRM_RTA_NEXT(rthdr);
}
-
+
if (encap)
{
rthdr->rta_type = XFRMA_ENCAP;
@@ -1127,13 +1176,13 @@ static status_t add_sa(private_kernel_netlink_ipsec_t *this,
tmpl->encap_sport = htons(src->get_port(src));
tmpl->encap_dport = htons(dst->get_port(dst));
memset(&tmpl->encap_oa, 0, sizeof (xfrm_address_t));
- /* encap_oa could probably be derived from the
- * traffic selectors [rfc4306, p39]. In the netlink kernel implementation
- * pluto does the same as we do here but it uses encap_oa in the
- * pfkey implementation. BUT as /usr/src/linux/net/key/af_key.c indicates
+ /* encap_oa could probably be derived from the
+ * traffic selectors [rfc4306, p39]. In the netlink kernel implementation
+ * pluto does the same as we do here but it uses encap_oa in the
+ * pfkey implementation. BUT as /usr/src/linux/net/key/af_key.c indicates
* the kernel ignores it anyway
* -> does that mean that NAT-T encap doesn't work in transport mode?
- * No. The reason the kernel ignores NAT-OA is that it recomputes
+ * No. The reason the kernel ignores NAT-OA is that it recomputes
* (or, rather, just ignores) the checksum. If packets pass
* the IPsec checks it marks them "checksum ok" so OA isn't needed. */
rthdr = XFRM_RTA_NEXT(rthdr);
@@ -1160,24 +1209,24 @@ static status_t get_replay_state(private_kernel_netlink_ipsec_t *this,
size_t len;
struct rtattr *rta;
size_t rtasize;
-
+
memset(&request, 0, sizeof(request));
-
+
DBG2(DBG_KNL, "querying replay state from SAD entry with SPI %.8x", ntohl(spi));
hdr = (struct nlmsghdr*)request;
hdr->nlmsg_flags = NLM_F_REQUEST;
hdr->nlmsg_type = XFRM_MSG_GETAE;
hdr->nlmsg_len = NLMSG_LENGTH(sizeof(struct xfrm_aevent_id));
-
+
aevent_id = (struct xfrm_aevent_id*)NLMSG_DATA(hdr);
aevent_id->flags = XFRM_AE_RVAL;
-
+
host2xfrm(dst, &aevent_id->sa_id.daddr);
aevent_id->sa_id.spi = spi;
aevent_id->sa_id.proto = proto_ike2kernel(protocol);
aevent_id->sa_id.family = dst->get_family(dst);
-
+
if (this->socket_xfrm->send(this->socket_xfrm, hdr, &out, &len) == SUCCESS)
{
hdr = out;
@@ -1206,7 +1255,7 @@ static status_t get_replay_state(private_kernel_netlink_ipsec_t *this,
break;
}
}
-
+
if (out_aevent == NULL)
{
DBG1(DBG_KNL, "unable to query replay state from SAD entry with SPI %.8x",
@@ -1214,7 +1263,7 @@ static status_t get_replay_state(private_kernel_netlink_ipsec_t *this,
free(out);
return FAILED;
}
-
+
rta = XFRM_RTA(out, struct xfrm_aevent_id);
rtasize = XFRM_PAYLOAD(out, struct xfrm_aevent_id);
while(RTA_OK(rta, rtasize))
@@ -1228,7 +1277,7 @@ static status_t get_replay_state(private_kernel_netlink_ipsec_t *this,
}
rta = RTA_NEXT(rta, rtasize);
}
-
+
DBG1(DBG_KNL, "unable to query replay state from SAD entry with SPI %.8x",
ntohl(spi));
free(out);
@@ -1247,7 +1296,7 @@ static status_t query_sa(private_kernel_netlink_ipsec_t *this, host_t *src,
struct xfrm_usersa_id *sa_id;
struct xfrm_usersa_info *sa = NULL;
size_t len;
-
+
memset(&request, 0, sizeof(request));
DBG2(DBG_KNL, "querying SAD entry with SPI %.8x", ntohl(spi));
@@ -1262,7 +1311,7 @@ static status_t query_sa(private_kernel_netlink_ipsec_t *this, host_t *src,
sa_id->spi = spi;
sa_id->proto = proto_ike2kernel(protocol);
sa_id->family = dst->get_family(dst);
-
+
if (this->socket_xfrm->send(this->socket_xfrm, hdr, &out, &len) == SUCCESS)
{
hdr = out;
@@ -1291,7 +1340,7 @@ static status_t query_sa(private_kernel_netlink_ipsec_t *this, host_t *src,
break;
}
}
-
+
if (sa == NULL)
{
DBG2(DBG_KNL, "unable to query SAD entry with SPI %.8x", ntohl(spi));
@@ -1299,7 +1348,7 @@ static status_t query_sa(private_kernel_netlink_ipsec_t *this, host_t *src,
return FAILED;
}
*bytes = sa->curlft.bytes;
-
+
free(out);
return SUCCESS;
}
@@ -1313,28 +1362,28 @@ static status_t del_sa(private_kernel_netlink_ipsec_t *this, host_t *src,
netlink_buf_t request;
struct nlmsghdr *hdr;
struct xfrm_usersa_id *sa_id;
-
+
/* if IPComp was used, we first delete the additional IPComp SA */
if (cpi)
{
del_sa(this, src, dst, htonl(ntohs(cpi)), IPPROTO_COMP, 0);
}
-
+
memset(&request, 0, sizeof(request));
-
+
DBG2(DBG_KNL, "deleting SAD entry with SPI %.8x", ntohl(spi));
-
+
hdr = (struct nlmsghdr*)request;
hdr->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK;
hdr->nlmsg_type = XFRM_MSG_DELSA;
hdr->nlmsg_len = NLMSG_LENGTH(sizeof(struct xfrm_usersa_id));
-
+
sa_id = (struct xfrm_usersa_id*)NLMSG_DATA(hdr);
host2xfrm(dst, &sa_id->daddr);
sa_id->spi = spi;
sa_id->proto = proto_ike2kernel(protocol);
sa_id->family = dst->get_family(dst);
-
+
if (this->socket_xfrm->send_ack(this->socket_xfrm, hdr) != SUCCESS)
{
DBG1(DBG_KNL, "unable to delete SAD entry with SPI %.8x", ntohl(spi));
@@ -1364,30 +1413,30 @@ static status_t update_sa(private_kernel_netlink_ipsec_t *this,
struct xfrm_encap_tmpl* tmpl = NULL;
bool got_replay_state = FALSE;
struct xfrm_replay_state replay;
-
+
/* if IPComp is used, we first update the IPComp SA */
if (cpi)
{
update_sa(this, htonl(ntohs(cpi)), IPPROTO_COMP, 0,
src, dst, new_src, new_dst, FALSE, FALSE);
}
-
+
memset(&request, 0, sizeof(request));
-
+
DBG2(DBG_KNL, "querying SAD entry with SPI %.8x for update", ntohl(spi));
-
+
/* query the existing SA first */
hdr = (struct nlmsghdr*)request;
hdr->nlmsg_flags = NLM_F_REQUEST;
hdr->nlmsg_type = XFRM_MSG_GETSA;
hdr->nlmsg_len = NLMSG_LENGTH(sizeof(struct xfrm_usersa_id));
-
+
sa_id = (struct xfrm_usersa_id*)NLMSG_DATA(hdr);
host2xfrm(dst, &sa_id->daddr);
sa_id->spi = spi;
sa_id->proto = proto_ike2kernel(protocol);
sa_id->family = dst->get_family(dst);
-
+
if (this->socket_xfrm->send(this->socket_xfrm, hdr, &out, &len) == SUCCESS)
{
hdr = out;
@@ -1422,13 +1471,13 @@ static status_t update_sa(private_kernel_netlink_ipsec_t *this,
free(out);
return FAILED;
}
-
+
/* try to get the replay state */
if (get_replay_state(this, spi, protocol, dst, &replay) == SUCCESS)
{
got_replay_state = TRUE;
}
-
+
/* delete the old SA (without affecting the IPComp SA) */
if (del_sa(this, src, dst, spi, protocol, 0) != SUCCESS)
{
@@ -1436,18 +1485,18 @@ static status_t update_sa(private_kernel_netlink_ipsec_t *this,
free(out);
return FAILED;
}
-
+
DBG2(DBG_KNL, "updating SAD entry with SPI %.8x from %#H..%#H to %#H..%#H",
ntohl(spi), src, dst, new_src, new_dst);
/* copy over the SA from out to request */
hdr = (struct nlmsghdr*)request;
memcpy(hdr, out, min(out->nlmsg_len, sizeof(request)));
- hdr->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK;
+ hdr->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK;
hdr->nlmsg_type = XFRM_MSG_NEWSA;
hdr->nlmsg_len = NLMSG_LENGTH(sizeof(struct xfrm_usersa_info));
sa = NLMSG_DATA(hdr);
sa->family = new_dst->get_family(new_dst);
-
+
if (!src->ip_equals(src, new_src))
{
host2xfrm(new_src, &sa->saddr);
@@ -1456,7 +1505,7 @@ static status_t update_sa(private_kernel_netlink_ipsec_t *this,
{
host2xfrm(new_dst, &sa->id.daddr);
}
-
+
rta = XFRM_RTA(out, struct xfrm_usersa_info);
rtasize = XFRM_PAYLOAD(out, struct xfrm_usersa_info);
pos = (u_char*)XFRM_RTA(hdr, struct xfrm_usersa_info);
@@ -1470,47 +1519,47 @@ static status_t update_sa(private_kernel_netlink_ipsec_t *this,
tmpl = (struct xfrm_encap_tmpl*)RTA_DATA(rta);
tmpl->encap_sport = ntohs(new_src->get_port(new_src));
tmpl->encap_dport = ntohs(new_dst->get_port(new_dst));
- }
+ }
memcpy(pos, rta, rta->rta_len);
pos += RTA_ALIGN(rta->rta_len);
hdr->nlmsg_len += RTA_ALIGN(rta->rta_len);
}
rta = RTA_NEXT(rta, rtasize);
}
-
+
rta = (struct rtattr*)pos;
if (tmpl == NULL && new_encap)
{ /* add tmpl if we are enabling it */
rta->rta_type = XFRMA_ENCAP;
rta->rta_len = RTA_LENGTH(sizeof(struct xfrm_encap_tmpl));
-
+
hdr->nlmsg_len += rta->rta_len;
if (hdr->nlmsg_len > sizeof(request))
{
return FAILED;
}
-
+
tmpl = (struct xfrm_encap_tmpl*)RTA_DATA(rta);
tmpl->encap_type = UDP_ENCAP_ESPINUDP;
tmpl->encap_sport = ntohs(new_src->get_port(new_src));
tmpl->encap_dport = ntohs(new_dst->get_port(new_dst));
memset(&tmpl->encap_oa, 0, sizeof (xfrm_address_t));
-
+
rta = XFRM_RTA_NEXT(rta);
}
-
+
if (got_replay_state)
{ /* copy the replay data if available */
rta->rta_type = XFRMA_REPLAY_VAL;
rta->rta_len = RTA_LENGTH(sizeof(struct xfrm_replay_state));
-
+
hdr->nlmsg_len += rta->rta_len;
if (hdr->nlmsg_len > sizeof(request))
{
return FAILED;
}
memcpy(RTA_DATA(rta), &replay, sizeof(replay));
-
+
rta = XFRM_RTA_NEXT(rta);
}
@@ -1521,14 +1570,14 @@ static status_t update_sa(private_kernel_netlink_ipsec_t *this,
return FAILED;
}
free(out);
-
+
return SUCCESS;
}
/**
* Implementation of kernel_interface_t.add_policy.
*/
-static status_t add_policy(private_kernel_netlink_ipsec_t *this,
+static status_t add_policy(private_kernel_netlink_ipsec_t *this,
host_t *src, host_t *dst,
traffic_selector_t *src_ts,
traffic_selector_t *dst_ts,
@@ -1542,13 +1591,13 @@ static status_t add_policy(private_kernel_netlink_ipsec_t *this,
netlink_buf_t request;
struct xfrm_userpolicy_info *policy_info;
struct nlmsghdr *hdr;
-
+
/* create a policy */
policy = malloc_thing(policy_entry_t);
memset(policy, 0, sizeof(policy_entry_t));
policy->sel = ts2selector(src_ts, dst_ts);
policy->direction = direction;
-
+
/* find the policy, which matches EXACTLY */
this->mutex->lock(this->mutex);
current = this->policies->get(this->policies, policy);
@@ -1568,10 +1617,10 @@ static status_t add_policy(private_kernel_netlink_ipsec_t *this,
this->policies->put(this->policies, policy, policy);
policy->refcount = 1;
}
-
+
DBG2(DBG_KNL, "adding policy %R === %R %N", src_ts, dst_ts,
policy_dir_names, direction);
-
+
memset(&request, 0, sizeof(request));
hdr = (struct nlmsghdr*)request;
hdr->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK;
@@ -1589,7 +1638,7 @@ static status_t add_policy(private_kernel_netlink_ipsec_t *this,
policy_info->action = XFRM_POLICY_ALLOW;
policy_info->share = XFRM_SHARE_ANY;
this->mutex->unlock(this->mutex);
-
+
/* policies don't expire */
policy_info->lft.soft_byte_limit = XFRM_INF;
policy_info->lft.soft_packet_limit = XFRM_INF;
@@ -1599,19 +1648,19 @@ static status_t add_policy(private_kernel_netlink_ipsec_t *this,
policy_info->lft.hard_add_expires_seconds = 0;
policy_info->lft.soft_use_expires_seconds = 0;
policy_info->lft.hard_use_expires_seconds = 0;
-
+
struct rtattr *rthdr = XFRM_RTA(hdr, struct xfrm_userpolicy_info);
rthdr->rta_type = XFRMA_TMPL;
rthdr->rta_len = RTA_LENGTH(sizeof(struct xfrm_user_tmpl));
-
+
hdr->nlmsg_len += rthdr->rta_len;
if (hdr->nlmsg_len > sizeof(request))
{
return FAILED;
}
-
+
struct xfrm_user_tmpl *tmpl = (struct xfrm_user_tmpl*)RTA_DATA(rthdr);
-
+
if (ipcomp != IPCOMP_NONE)
{
tmpl->reqid = reqid;
@@ -1620,10 +1669,10 @@ static status_t add_policy(private_kernel_netlink_ipsec_t *this,
tmpl->mode = mode2kernel(mode);
tmpl->optional = direction != POLICY_OUT;
tmpl->family = src->get_family(src);
-
+
host2xfrm(src, &tmpl->saddr);
host2xfrm(dst, &tmpl->id.daddr);
-
+
/* add an additional xfrm_user_tmpl */
rthdr->rta_len += RTA_LENGTH(sizeof(struct xfrm_user_tmpl));
hdr->nlmsg_len += RTA_LENGTH(sizeof(struct xfrm_user_tmpl));
@@ -1631,53 +1680,58 @@ static status_t add_policy(private_kernel_netlink_ipsec_t *this,
{
return FAILED;
}
-
+
tmpl++;
+
+ /* use transport mode for ESP if we have a tunnel mode IPcomp SA */
+ mode = MODE_TRANSPORT;
+ }
+ else
+ {
+ /* when using IPcomp, only the IPcomp SA uses tmp src/dst addresses */
+ host2xfrm(src, &tmpl->saddr);
+ host2xfrm(dst, &tmpl->id.daddr);
}
-
+
tmpl->reqid = reqid;
tmpl->id.proto = proto_ike2kernel(protocol);
tmpl->aalgos = tmpl->ealgos = tmpl->calgos = ~0;
tmpl->mode = mode2kernel(mode);
tmpl->family = src->get_family(src);
-
- host2xfrm(src, &tmpl->saddr);
- host2xfrm(dst, &tmpl->id.daddr);
-
+
if (this->socket_xfrm->send_ack(this->socket_xfrm, hdr) != SUCCESS)
{
DBG1(DBG_KNL, "unable to add policy %R === %R %N", src_ts, dst_ts,
policy_dir_names, direction);
return FAILED;
}
-
+
/* install a route, if:
* - we are NOT updating a policy
* - this is a forward policy (to just get one for each child)
- * - we are in tunnel mode
- * - we are not using IPv6 (does not work correctly yet!)
+ * - we are in tunnel/BEET mode
* - routing is not disabled via strongswan.conf
*/
if (policy->route == NULL && direction == POLICY_FWD &&
- mode != MODE_TRANSPORT && src->get_family(src) != AF_INET6 &&
- this->install_routes)
+ mode != MODE_TRANSPORT && this->install_routes)
{
route_entry_t *route = malloc_thing(route_entry_t);
-
+
if (charon->kernel_interface->get_address_by_ts(charon->kernel_interface,
dst_ts, &route->src_ip) == SUCCESS)
{
/* get the nexthop to src (src as we are in POLICY_FWD).*/
route->gateway = charon->kernel_interface->get_nexthop(
- charon->kernel_interface, src);
+ charon->kernel_interface, src);
+ /* install route via outgoing interface */
route->if_name = charon->kernel_interface->get_interface(
- charon->kernel_interface, dst);
+ charon->kernel_interface, dst);
route->dst_net = chunk_alloc(policy->sel.family == AF_INET ? 4 : 16);
memcpy(route->dst_net.ptr, &policy->sel.saddr, route->dst_net.len);
route->prefixlen = policy->sel.prefixlen_s;
-
+
if (route->if_name)
- {
+ {
switch (charon->kernel_interface->add_route(
charon->kernel_interface, route->dst_net,
route->prefixlen, route->gateway,
@@ -1714,7 +1768,7 @@ static status_t add_policy(private_kernel_netlink_ipsec_t *this,
* Implementation of kernel_interface_t.query_policy.
*/
static status_t query_policy(private_kernel_netlink_ipsec_t *this,
- traffic_selector_t *src_ts,
+ traffic_selector_t *src_ts,
traffic_selector_t *dst_ts,
policy_dir_t direction, u_int32_t *use_time)
{
@@ -1723,9 +1777,9 @@ static status_t query_policy(private_kernel_netlink_ipsec_t *this,
struct xfrm_userpolicy_id *policy_id;
struct xfrm_userpolicy_info *policy = NULL;
size_t len;
-
+
memset(&request, 0, sizeof(request));
-
+
DBG2(DBG_KNL, "querying policy %R === %R %N", src_ts, dst_ts,
policy_dir_names, direction);
@@ -1737,7 +1791,7 @@ static status_t query_policy(private_kernel_netlink_ipsec_t *this,
policy_id = (struct xfrm_userpolicy_id*)NLMSG_DATA(hdr);
policy_id->sel = ts2selector(src_ts, dst_ts);
policy_id->dir = direction;
-
+
if (this->socket_xfrm->send(this->socket_xfrm, hdr, &out, &len) == SUCCESS)
{
hdr = out;
@@ -1766,7 +1820,7 @@ static status_t query_policy(private_kernel_netlink_ipsec_t *this,
break;
}
}
-
+
if (policy == NULL)
{
DBG2(DBG_KNL, "unable to query policy %R === %R %N", src_ts, dst_ts,
@@ -1774,8 +1828,17 @@ static status_t query_policy(private_kernel_netlink_ipsec_t *this,
free(out);
return FAILED;
}
- *use_time = (time_t)policy->curlft.use_time;
-
+
+ if (policy->curlft.use_time)
+ {
+ /* we need the monotonic time, but the kernel returns system time. */
+ *use_time = time_monotonic(NULL) - (time(NULL) - policy->curlft.use_time);
+ }
+ else
+ {
+ *use_time = 0;
+ }
+
free(out);
return SUCCESS;
}
@@ -1784,7 +1847,7 @@ static status_t query_policy(private_kernel_netlink_ipsec_t *this,
* Implementation of kernel_interface_t.del_policy.
*/
static status_t del_policy(private_kernel_netlink_ipsec_t *this,
- traffic_selector_t *src_ts,
+ traffic_selector_t *src_ts,
traffic_selector_t *dst_ts,
policy_dir_t direction, bool unrouted)
{
@@ -1793,15 +1856,15 @@ static status_t del_policy(private_kernel_netlink_ipsec_t *this,
netlink_buf_t request;
struct nlmsghdr *hdr;
struct xfrm_userpolicy_id *policy_id;
-
+
DBG2(DBG_KNL, "deleting policy %R === %R %N", src_ts, dst_ts,
policy_dir_names, direction);
-
+
/* create a policy */
memset(&policy, 0, sizeof(policy_entry_t));
policy.sel = ts2selector(src_ts, dst_ts);
policy.direction = direction;
-
+
/* find the policy */
this->mutex->lock(this->mutex);
current = this->policies->get(this->policies, &policy);
@@ -1825,9 +1888,9 @@ static status_t del_policy(private_kernel_netlink_ipsec_t *this,
dst_ts, policy_dir_names, direction);
return NOT_FOUND;
}
-
+
memset(&request, 0, sizeof(request));
-
+
hdr = (struct nlmsghdr*)request;
hdr->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK;
hdr->nlmsg_type = XFRM_MSG_DELPOLICY;
@@ -1836,10 +1899,10 @@ static status_t del_policy(private_kernel_netlink_ipsec_t *this,
policy_id = (struct xfrm_userpolicy_id*)NLMSG_DATA(hdr);
policy_id->sel = to_delete->sel;
policy_id->dir = direction;
-
+
route = to_delete->route;
free(to_delete);
-
+
if (this->socket_xfrm->send_ack(this->socket_xfrm, hdr) != SUCCESS)
{
DBG1(DBG_KNL, "unable to delete policy %R === %R %N", src_ts, dst_ts,
@@ -1856,7 +1919,7 @@ static status_t del_policy(private_kernel_netlink_ipsec_t *this,
DBG1(DBG_KNL, "error uninstalling route installed with "
"policy %R === %R %N", src_ts, dst_ts,
policy_dir_names, direction);
- }
+ }
route_entry_destroy(route);
}
return SUCCESS;
@@ -1869,7 +1932,7 @@ static void destroy(private_kernel_netlink_ipsec_t *this)
{
enumerator_t *enumerator;
policy_entry_t *policy;
-
+
this->job->cancel(this->job);
close(this->socket_xfrm_events);
this->socket_xfrm->destroy(this->socket_xfrm);
@@ -1892,43 +1955,32 @@ static bool add_bypass_policies()
int fd, family, port;
enumerator_t *sockets;
bool status = TRUE;
-
- /* we open an AF_KEY socket to autoload the af_key module. Otherwise
- * setsockopt(IPSEC_POLICY) won't work. */
- fd = socket(AF_KEY, SOCK_RAW, PF_KEY_V2);
- if (fd == 0)
- {
- DBG1(DBG_KNL, "could not open AF_KEY socket");
- return FALSE;
- }
- close(fd);
-
+
sockets = charon->socket->create_enumerator(charon->socket);
while (sockets->enumerate(sockets, &fd, &family, &port))
{
- struct sadb_x_policy policy;
+ struct xfrm_userpolicy_info policy;
u_int sol, ipsec_policy;
-
+
switch (family)
{
case AF_INET:
sol = SOL_IP;
- ipsec_policy = IP_IPSEC_POLICY;
+ ipsec_policy = IP_XFRM_POLICY;
break;
case AF_INET6:
sol = SOL_IPV6;
- ipsec_policy = IPV6_IPSEC_POLICY;
+ ipsec_policy = IPV6_XFRM_POLICY;
break;
default:
continue;
}
-
+
memset(&policy, 0, sizeof(policy));
- policy.sadb_x_policy_len = sizeof(policy) / sizeof(u_int64_t);
- policy.sadb_x_policy_exttype = SADB_X_EXT_POLICY;
- policy.sadb_x_policy_type = IPSEC_POLICY_BYPASS;
-
- policy.sadb_x_policy_dir = IPSEC_DIR_OUTBOUND;
+ policy.action = XFRM_POLICY_ALLOW;
+ policy.sel.family = family;
+
+ policy.dir = XFRM_POLICY_OUT;
if (setsockopt(fd, sol, ipsec_policy, &policy, sizeof(policy)) < 0)
{
DBG1(DBG_KNL, "unable to set IPSEC_POLICY on socket: %s",
@@ -1936,10 +1988,10 @@ static bool add_bypass_policies()
status = FALSE;
break;
}
- policy.sadb_x_policy_dir = IPSEC_DIR_INBOUND;
+ policy.dir = XFRM_POLICY_IN;
if (setsockopt(fd, sol, ipsec_policy, &policy, sizeof(policy)) < 0)
{
- DBG1(DBG_KNL, "unable to set IPSEC_POLICY on socket: %s",
+ DBG1(DBG_KNL, "unable to set IPSEC_POLICY on socket: %s",
strerror(errno));
status = FALSE;
break;
@@ -1956,11 +2008,12 @@ kernel_netlink_ipsec_t *kernel_netlink_ipsec_create()
{
private_kernel_netlink_ipsec_t *this = malloc_thing(private_kernel_netlink_ipsec_t);
struct sockaddr_nl addr;
-
+ int fd;
+
/* public functions */
this->public.interface.get_spi = (status_t(*)(kernel_ipsec_t*,host_t*,host_t*,protocol_id_t,u_int32_t,u_int32_t*))get_spi;
this->public.interface.get_cpi = (status_t(*)(kernel_ipsec_t*,host_t*,host_t*,u_int32_t,u_int16_t*))get_cpi;
- this->public.interface.add_sa = (status_t(*)(kernel_ipsec_t *,host_t*,host_t*,u_int32_t,protocol_id_t,u_int32_t,u_int64_t,u_int64_t,u_int16_t,chunk_t,u_int16_t,chunk_t,ipsec_mode_t,u_int16_t,u_int16_t,bool,bool))add_sa;
+ this->public.interface.add_sa = (status_t(*)(kernel_ipsec_t *,host_t*,host_t*,u_int32_t,protocol_id_t,u_int32_t,lifetime_cfg_t*,u_int16_t,chunk_t,u_int16_t,chunk_t,ipsec_mode_t,u_int16_t,u_int16_t,bool,bool,traffic_selector_t*,traffic_selector_t*))add_sa;
this->public.interface.update_sa = (status_t(*)(kernel_ipsec_t*,u_int32_t,protocol_id_t,u_int16_t,host_t*,host_t*,host_t*,host_t*,bool,bool))update_sa;
this->public.interface.query_sa = (status_t(*)(kernel_ipsec_t*,host_t*,host_t*,u_int32_t,protocol_id_t,u_int64_t*))query_sa;
this->public.interface.del_sa = (status_t(*)(kernel_ipsec_t*,host_t*,host_t*,u_int32_t,protocol_id_t,u_int16_t))del_sa;
@@ -1975,18 +2028,20 @@ kernel_netlink_ipsec_t *kernel_netlink_ipsec_create()
this->mutex = mutex_create(MUTEX_TYPE_DEFAULT);
this->install_routes = lib->settings->get_bool(lib->settings,
"charon.install_routes", TRUE);
-
- /* add bypass policies on the sockets used by charon */
- if (!add_bypass_policies())
+
+ /* disable lifetimes for allocated SPIs in kernel */
+ fd = open("/proc/sys/net/core/xfrm_acq_expires", O_WRONLY);
+ if (fd)
{
- charon->kill(charon, "unable to add bypass policies on sockets");
+ ignore_result(write(fd, "165", 3));
+ close(fd);
}
-
+
this->socket_xfrm = netlink_socket_create(NETLINK_XFRM);
-
+
memset(&addr, 0, sizeof(addr));
addr.nl_family = AF_NETLINK;
-
+
/* create and bind XFRM socket for ACQUIRE, EXPIRE, MIGRATE & MAPPING */
this->socket_xfrm_events = socket(AF_NETLINK, SOCK_RAW, NETLINK_XFRM);
if (this->socket_xfrm_events <= 0)
@@ -1999,10 +2054,16 @@ kernel_netlink_ipsec_t *kernel_netlink_ipsec_create()
{
charon->kill(charon, "unable to bind XFRM event socket");
}
-
+
+ /* add bypass policies on the sockets used by charon */
+ if (!add_bypass_policies())
+ {
+ charon->kill(charon, "unable to add bypass policies on sockets");
+ }
+
this->job = callback_job_create((callback_job_cb_t)receive_events,
this, NULL, NULL);
charon->processor->queue_job(charon->processor, (job_t*)this->job);
-
+
return &this->public;
}
diff --git a/src/charon/plugins/kernel_netlink/kernel_netlink_net.c b/src/charon/plugins/kernel_netlink/kernel_netlink_net.c
index e5c0b5da7..4a9fdf69a 100644
--- a/src/charon/plugins/kernel_netlink/kernel_netlink_net.c
+++ b/src/charon/plugins/kernel_netlink/kernel_netlink_net.c
@@ -17,8 +17,6 @@
#include <sys/socket.h>
#include <linux/netlink.h>
#include <linux/rtnetlink.h>
-#include <sys/time.h>
-#include <pthread.h>
#include <unistd.h>
#include <errno.h>
#include <net/if.h>
@@ -27,7 +25,9 @@
#include "kernel_netlink_shared.h"
#include <daemon.h>
-#include <utils/mutex.h>
+#include <threading/thread.h>
+#include <threading/condvar.h>
+#include <threading/mutex.h>
#include <utils/linked_list.h>
#include <processing/jobs/callback_job.h>
#include <processing/jobs/roam_job.h>
@@ -35,30 +35,22 @@
/** delay before firing roam jobs (ms) */
#define ROAM_DELAY 100
-/** routing table for routes installed by us */
-#ifndef IPSEC_ROUTING_TABLE
-#define IPSEC_ROUTING_TABLE 100
-#endif
-#ifndef IPSEC_ROUTING_TABLE_PRIO
-#define IPSEC_ROUTING_TABLE_PRIO 100
-#endif
-
typedef struct addr_entry_t addr_entry_t;
/**
* IP address in an inface_entry_t
*/
struct addr_entry_t {
-
+
/** The ip address */
host_t *ip;
-
+
/** virtual IP managed by us */
bool virtual;
-
+
/** scope of the address */
u_char scope;
-
+
/** Number of times this IP is used, if virtual */
u_int refcount;
};
@@ -78,16 +70,16 @@ typedef struct iface_entry_t iface_entry_t;
* A network interface on this system, containing addr_entry_t's
*/
struct iface_entry_t {
-
+
/** interface index */
int ifindex;
-
+
/** name of the interface */
char ifname[IFNAMSIZ];
-
+
/** interface flags, as in netdevice(7) SIOCGIFFLAGS */
u_int flags;
-
+
/** list of addresses as host_t */
linked_list_t *addrs;
};
@@ -111,57 +103,57 @@ struct private_kernel_netlink_net_t {
* Public part of the kernel_netlink_net_t object.
*/
kernel_netlink_net_t public;
-
+
/**
* mutex to lock access to various lists
*/
mutex_t *mutex;
-
+
/**
* condition variable to signal virtual IP add/removal
*/
condvar_t *condvar;
-
+
/**
* Cached list of interfaces and its addresses (iface_entry_t)
*/
linked_list_t *ifaces;
-
+
/**
* job receiving netlink events
*/
callback_job_t *job;
-
+
/**
* netlink rt socket (routing)
*/
netlink_socket_t *socket;
-
+
/**
* Netlink rt socket to receive address change events
*/
int socket_events;
-
+
/**
* time of the last roam_job
*/
- struct timeval last_roam;
-
+ timeval_t last_roam;
+
/**
* routing table to install routes
*/
int routing_table;
-
+
/**
* priority of used routing table
*/
int routing_table_prio;
-
+
/**
* whether to react to RTM_NEWROUTE or RTM_DELROUTE events
*/
bool process_route;
-
+
/**
* whether to actually install virtual IPs
*/
@@ -177,7 +169,7 @@ static int get_vip_refcount(private_kernel_netlink_net_t *this, host_t* ip)
iface_entry_t *iface;
addr_entry_t *addr;
int refcount = 0;
-
+
ifaces = this->ifaces->create_iterator(this->ifaces, TRUE);
while (ifaces->iterate(ifaces, (void**)&iface))
{
@@ -198,7 +190,7 @@ static int get_vip_refcount(private_kernel_netlink_net_t *this, host_t* ip)
}
}
ifaces->destroy(ifaces);
-
+
return refcount;
}
@@ -208,22 +200,20 @@ static int get_vip_refcount(private_kernel_netlink_net_t *this, host_t* ip)
*/
static void fire_roam_job(private_kernel_netlink_net_t *this, bool address)
{
- struct timeval now;
-
- if (gettimeofday(&now, NULL) == 0)
+ timeval_t now;
+
+ time_monotonic(&now);
+ if (timercmp(&now, &this->last_roam, >))
{
- if (timercmp(&now, &this->last_roam, >))
+ now.tv_usec += ROAM_DELAY * 1000;
+ while (now.tv_usec > 1000000)
{
- now.tv_usec += ROAM_DELAY * 1000;
- while (now.tv_usec > 1000000)
- {
- now.tv_sec++;
- now.tv_usec -= 1000000;
- }
- this->last_roam = now;
- charon->scheduler->schedule_job_ms(charon->scheduler,
- (job_t*)roam_job_create(address), ROAM_DELAY);
+ now.tv_sec++;
+ now.tv_usec -= 1000000;
}
+ this->last_roam = now;
+ charon->scheduler->schedule_job_ms(charon->scheduler,
+ (job_t*)roam_job_create(address), ROAM_DELAY);
}
}
@@ -240,7 +230,7 @@ static void process_link(private_kernel_netlink_net_t *this,
iface_entry_t *current, *entry = NULL;
char *name = NULL;
bool update = FALSE;
-
+
while(RTA_OK(rta, rtasize))
{
switch (rta->rta_type)
@@ -255,7 +245,7 @@ static void process_link(private_kernel_netlink_net_t *this,
{
name = "(unknown)";
}
-
+
this->mutex->lock(this->mutex);
switch (hdr->nlmsg_type)
{
@@ -308,7 +298,7 @@ static void process_link(private_kernel_netlink_net_t *this,
{
if (current->ifindex == msg->ifi_index)
{
- /* we do not remove it, as an address may be added to a
+ /* we do not remove it, as an address may be added to a
* "down" interface and we wan't to know that. */
current->flags = msg->ifi_flags;
break;
@@ -319,7 +309,7 @@ static void process_link(private_kernel_netlink_net_t *this,
}
}
this->mutex->unlock(this->mutex);
-
+
/* send an update to all IKE_SAs */
if (update && event)
{
@@ -342,7 +332,7 @@ static void process_addr(private_kernel_netlink_net_t *this,
addr_entry_t *addr;
chunk_t local = chunk_empty, address = chunk_empty;
bool update = FALSE, found = FALSE, changed = FALSE;
-
+
while(RTA_OK(rta, rtasize))
{
switch (rta->rta_type)
@@ -358,7 +348,7 @@ static void process_addr(private_kernel_netlink_net_t *this,
}
rta = RTA_NEXT(rta, rtasize);
}
-
+
/* For PPP interfaces, we need the IFA_LOCAL address,
* IFA_ADDRESS is the peers address. But IFA_LOCAL is
* not included in all cases (IPv6?), so fallback to IFA_ADDRESS. */
@@ -370,12 +360,12 @@ static void process_addr(private_kernel_netlink_net_t *this,
{
host = host_create_from_chunk(msg->ifa_family, address, 0);
}
-
+
if (host == NULL)
{ /* bad family? */
return;
}
-
+
this->mutex->lock(this->mutex);
ifaces = this->ifaces->create_enumerator(this->ifaces);
while (ifaces->enumerate(ifaces, &iface))
@@ -406,7 +396,7 @@ static void process_addr(private_kernel_netlink_net_t *this,
}
}
addrs->destroy(addrs);
-
+
if (hdr->nlmsg_type == RTM_NEWADDR)
{
if (!found)
@@ -418,7 +408,7 @@ static void process_addr(private_kernel_netlink_net_t *this,
addr->virtual = FALSE;
addr->refcount = 1;
addr->scope = msg->ifa_scope;
-
+
iface->addrs->insert_last(iface->addrs, addr);
if (event)
{
@@ -436,7 +426,7 @@ static void process_addr(private_kernel_netlink_net_t *this,
ifaces->destroy(ifaces);
this->mutex->unlock(this->mutex);
host->destroy(host);
-
+
/* send an update to all IKE_SAs */
if (update && event && changed)
{
@@ -453,13 +443,13 @@ static void process_route(private_kernel_netlink_net_t *this, struct nlmsghdr *h
struct rtattr *rta = RTM_RTA(msg);
size_t rtasize = RTM_PAYLOAD(hdr);
host_t *host = NULL;
-
+
/* ignore routes added by us */
if (msg->rtm_table && msg->rtm_table == this->routing_table)
{
return;
}
-
+
while (RTA_OK(rta, rtasize))
{
switch (rta->rta_type)
@@ -492,13 +482,14 @@ static job_requeue_t receive_events(private_kernel_netlink_net_t *this)
struct nlmsghdr *hdr = (struct nlmsghdr*)response;
struct sockaddr_nl addr;
socklen_t addr_len = sizeof(addr);
- int len, oldstate;
+ int len;
+ bool oldstate;
- pthread_setcancelstate(PTHREAD_CANCEL_ENABLE, &oldstate);
+ oldstate = thread_cancelability(TRUE);
len = recvfrom(this->socket_events, response, sizeof(response), 0,
(struct sockaddr*)&addr, &addr_len);
- pthread_setcancelstate(oldstate, NULL);
-
+ thread_cancelability(oldstate);
+
if (len < 0)
{
switch (errno)
@@ -515,12 +506,12 @@ static job_requeue_t receive_events(private_kernel_netlink_net_t *this)
return JOB_REQUEUE_FAIR;
}
}
-
+
if (addr.nl_pid != 0)
{ /* not from kernel. not interested, try another one */
return JOB_REQUEUE_DIRECT;
}
-
+
while (NLMSG_OK(hdr, len))
{
/* looks good so far, dispatch netlink message */
@@ -556,7 +547,7 @@ typedef struct {
private_kernel_netlink_net_t* this;
/** whether to enumerate down interfaces */
bool include_down_ifaces;
- /** whether to enumerate virtual ip addresses */
+ /** whether to enumerate virtual ip addresses */
bool include_virtual_ips;
} address_enumerator_t;
@@ -618,7 +609,7 @@ static enumerator_t *create_address_enumerator(private_kernel_netlink_net_t *thi
data->this = this;
data->include_down_ifaces = include_down_ifaces;
data->include_virtual_ips = include_virtual_ips;
-
+
this->mutex->lock(this->mutex);
return enumerator_create_nested(
enumerator_create_filter(this->ifaces->create_enumerator(this->ifaces),
@@ -635,9 +626,9 @@ static char *get_interface_name(private_kernel_netlink_net_t *this, host_t* ip)
iface_entry_t *iface;
addr_entry_t *addr;
char *name = NULL;
-
+
DBG2(DBG_KNL, "getting interface name for %H", ip);
-
+
this->mutex->lock(this->mutex);
ifaces = this->ifaces->create_enumerator(this->ifaces);
while (ifaces->enumerate(ifaces, &iface))
@@ -659,7 +650,7 @@ static char *get_interface_name(private_kernel_netlink_net_t *this, host_t* ip)
}
ifaces->destroy(ifaces);
this->mutex->unlock(this->mutex);
-
+
if (name)
{
DBG2(DBG_KNL, "%H is on interface %s", ip, name);
@@ -679,9 +670,9 @@ static int get_interface_index(private_kernel_netlink_net_t *this, char* name)
enumerator_t *ifaces;
iface_entry_t *iface;
int ifindex = 0;
-
+
DBG2(DBG_KNL, "getting iface index for %s", name);
-
+
this->mutex->lock(this->mutex);
ifaces = this->ifaces->create_enumerator(this->ifaces);
while (ifaces->enumerate(ifaces, &iface))
@@ -711,7 +702,7 @@ static bool is_interface_up(private_kernel_netlink_net_t *this, int index)
iface_entry_t *iface;
/* default to TRUE for interface we do not monitor (e.g. lo) */
bool up = TRUE;
-
+
ifaces = this->ifaces->create_enumerator(this->ifaces);
while (ifaces->enumerate(ifaces, &iface))
{
@@ -733,11 +724,14 @@ static bool addr_in_subnet(chunk_t addr, chunk_t net, int net_len)
static const u_char mask[] = { 0x00, 0x80, 0xc0, 0xe0, 0xf0, 0xf8, 0xfc, 0xfe };
int byte = 0;
+ if (net_len == 0)
+ { /* any address matches a /0 network */
+ return TRUE;
+ }
if (addr.len != net.len || net_len > 8 * net.len )
{
return FALSE;
}
-
/* scan through all bytes in network order */
while (net_len > 0)
{
@@ -771,35 +765,42 @@ static host_t *get_route(private_kernel_netlink_net_t *this, host_t *dest,
size_t len;
int best = -1;
host_t *src = NULL, *gtw = NULL;
-
+
DBG2(DBG_KNL, "getting address to reach %H", dest);
-
+
memset(&request, 0, sizeof(request));
hdr = (struct nlmsghdr*)request;
- hdr->nlmsg_flags = NLM_F_REQUEST | NLM_F_DUMP | NLM_F_ROOT;
+ hdr->nlmsg_flags = NLM_F_REQUEST;
+ if (dest->get_family(dest) == AF_INET)
+ {
+ /* We dump all addresses for IPv4, as we want to ignore IPsec specific
+ * routes installed by us. But the kernel does not return source
+ * addresses in a IPv6 dump, so fall back to get() for v6 routes. */
+ hdr->nlmsg_flags |= NLM_F_ROOT | NLM_F_DUMP;
+ }
hdr->nlmsg_type = RTM_GETROUTE;
hdr->nlmsg_len = NLMSG_LENGTH(sizeof(struct rtmsg));
msg = (struct rtmsg*)NLMSG_DATA(hdr);
msg->rtm_family = dest->get_family(dest);
-
- chunk = dest->get_address(dest);
- netlink_add_attribute(hdr, RTA_DST, chunk, sizeof(request));
if (candidate)
{
chunk = candidate->get_address(candidate);
netlink_add_attribute(hdr, RTA_PREFSRC, chunk, sizeof(request));
}
-
+ chunk = dest->get_address(dest);
+ netlink_add_attribute(hdr, RTA_DST, chunk, sizeof(request));
+
if (this->socket->send(this->socket, hdr, &out, &len) != SUCCESS)
{
DBG1(DBG_KNL, "getting address to %H failed", dest);
return NULL;
}
this->mutex->lock(this->mutex);
- current = out;
- while (NLMSG_OK(current, len))
+
+ for (current = out; NLMSG_OK(current, len);
+ current = NLMSG_NEXT(current, len))
{
switch (current->nlmsg_type)
{
@@ -811,10 +812,8 @@ static host_t *get_route(private_kernel_netlink_net_t *this, host_t *dest,
size_t rtasize;
chunk_t rta_gtw, rta_src, rta_dst;
u_int32_t rta_oif = 0;
- enumerator_t *ifaces, *addrs;
- iface_entry_t *iface;
- addr_entry_t *addr;
-
+ host_t *new_src, *new_gtw;
+
rta_gtw = rta_src = rta_dst = chunk_empty;
msg = (struct rtmsg*)(NLMSG_DATA(current));
rta = RTM_RTA(msg);
@@ -841,81 +840,74 @@ static host_t *get_route(private_kernel_netlink_net_t *this, host_t *dest,
}
rta = RTA_NEXT(rta, rtasize);
}
- if (rta_oif && !is_interface_up(this, rta_oif))
- { /* interface is down */
- goto next;
+ if (msg->rtm_dst_len <= best)
+ { /* not better than a previous one */
+ continue;
}
if (this->routing_table != 0 &&
msg->rtm_table == this->routing_table)
{ /* route is from our own ipsec routing table */
- goto next;
+ continue;
}
- if (msg->rtm_dst_len <= best)
- { /* not better than a previous one */
- goto next;
+ if (rta_oif && !is_interface_up(this, rta_oif))
+ { /* interface is down */
+ continue;
}
- if (msg->rtm_dst_len != 0 &&
- (!rta_dst.ptr ||
- !addr_in_subnet(chunk, rta_dst, msg->rtm_dst_len)))
- { /* is not the default route and not contained in our dst */
- goto next;
+ if (!addr_in_subnet(chunk, rta_dst, msg->rtm_dst_len))
+ { /* route destination does not contain dest */
+ continue;
}
-
- best = msg->rtm_dst_len;
+
if (nexthop)
{
+ /* nexthop lookup, return gateway if any */
DESTROY_IF(gtw);
gtw = host_create_from_chunk(msg->rtm_family, rta_gtw, 0);
- goto next;
+ best = msg->rtm_dst_len;
+ continue;
}
if (rta_src.ptr)
{
- DESTROY_IF(src);
- src = host_create_from_chunk(msg->rtm_family, rta_src, 0);
- if (get_vip_refcount(this, src))
- { /* skip source address if it is installed by us */
- DESTROY_IF(src);
- src = NULL;
- }
- goto next;
- }
- /* no source addr, get one from the interfaces */
- ifaces = this->ifaces->create_enumerator(this->ifaces);
- while (ifaces->enumerate(ifaces, &iface))
- {
- if (iface->ifindex == rta_oif &&
- iface->flags & IFF_UP)
+ /* got a source address */
+ new_src = host_create_from_chunk(msg->rtm_family, rta_src, 0);
+ if (new_src)
{
- addrs = iface->addrs->create_enumerator(iface->addrs);
- while (addrs->enumerate(addrs, &addr))
+ if (get_vip_refcount(this, new_src))
+ { /* skip source address if it is installed by us */
+ new_src->destroy(new_src);
+ }
+ else
{
- chunk_t ip = addr->ip->get_address(addr->ip);
- if ((msg->rtm_dst_len == 0 &&
- addr->ip->get_family(addr->ip) ==
- dest->get_family(dest)) ||
- addr_in_subnet(ip, rta_dst, msg->rtm_dst_len))
- {
- DESTROY_IF(src);
- src = addr->ip->clone(addr->ip);
- break;
- }
+ DESTROY_IF(src);
+ src = new_src;
+ best = msg->rtm_dst_len;
}
- addrs->destroy(addrs);
}
+ continue;
}
- ifaces->destroy(ifaces);
- goto next;
+ if (rta_gtw.ptr)
+ { /* no source, but a gateway. Lookup source to reach gtw. */
+ new_gtw = host_create_from_chunk(msg->rtm_family, rta_gtw, 0);
+ new_src = get_route(this, new_gtw, FALSE, candidate);
+ new_gtw->destroy(new_gtw);
+ if (new_src)
+ {
+ DESTROY_IF(src);
+ src = new_src;
+ best = msg->rtm_dst_len;
+ }
+ continue;
+ }
+ continue;
}
default:
- next:
- current = NLMSG_NEXT(current, len);
continue;
}
break;
}
free(out);
this->mutex->unlock(this->mutex);
-
+
if (nexthop)
{
if (gtw)
@@ -955,23 +947,23 @@ static status_t manage_ipaddr(private_kernel_netlink_net_t *this, int nlmsg_type
struct nlmsghdr *hdr;
struct ifaddrmsg *msg;
chunk_t chunk;
-
+
memset(&request, 0, sizeof(request));
-
+
chunk = ip->get_address(ip);
-
- hdr = (struct nlmsghdr*)request;
+
+ hdr = (struct nlmsghdr*)request;
hdr->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK | flags;
- hdr->nlmsg_type = nlmsg_type;
+ hdr->nlmsg_type = nlmsg_type;
hdr->nlmsg_len = NLMSG_LENGTH(sizeof(struct ifaddrmsg));
-
+
msg = (struct ifaddrmsg*)NLMSG_DATA(hdr);
- msg->ifa_family = ip->get_family(ip);
- msg->ifa_flags = 0;
- msg->ifa_prefixlen = 8 * chunk.len;
- msg->ifa_scope = RT_SCOPE_UNIVERSE;
- msg->ifa_index = if_index;
-
+ msg->ifa_family = ip->get_family(ip);
+ msg->ifa_flags = 0;
+ msg->ifa_prefixlen = 8 * chunk.len;
+ msg->ifa_scope = RT_SCOPE_UNIVERSE;
+ msg->ifa_index = if_index;
+
netlink_add_attribute(hdr, IFA_LOCAL, chunk, sizeof(request));
return this->socket->send_ack(this->socket, hdr);
@@ -980,27 +972,27 @@ static status_t manage_ipaddr(private_kernel_netlink_net_t *this, int nlmsg_type
/**
* Implementation of kernel_net_t.add_ip.
*/
-static status_t add_ip(private_kernel_netlink_net_t *this,
+static status_t add_ip(private_kernel_netlink_net_t *this,
host_t *virtual_ip, host_t *iface_ip)
{
iface_entry_t *iface;
addr_entry_t *addr;
enumerator_t *addrs, *ifaces;
int ifindex;
-
+
if (!this->install_virtual_ip)
{ /* disabled by config */
return SUCCESS;
}
-
+
DBG2(DBG_KNL, "adding virtual IP %H", virtual_ip);
-
+
this->mutex->lock(this->mutex);
ifaces = this->ifaces->create_enumerator(this->ifaces);
while (ifaces->enumerate(ifaces, &iface))
{
bool iface_found = FALSE;
-
+
addrs = iface->addrs->create_enumerator(iface->addrs);
while (addrs->enumerate(addrs, &addr))
{
@@ -1020,7 +1012,7 @@ static status_t add_ip(private_kernel_netlink_net_t *this,
}
}
addrs->destroy(addrs);
-
+
if (iface_found)
{
ifindex = iface->ifindex;
@@ -1030,7 +1022,7 @@ static status_t add_ip(private_kernel_netlink_net_t *this,
addr->virtual = TRUE;
addr->scope = RT_SCOPE_UNIVERSE;
iface->addrs->insert_last(iface->addrs, addr);
-
+
if (manage_ipaddr(this, RTM_NEWADDR, NLM_F_CREATE | NLM_F_EXCL,
ifindex, virtual_ip) == SUCCESS)
{
@@ -1050,7 +1042,7 @@ static status_t add_ip(private_kernel_netlink_net_t *this,
}
ifaces->destroy(ifaces);
this->mutex->unlock(this->mutex);
-
+
DBG1(DBG_KNL, "interface address %H not found, unable to install"
"virtual IP %H", iface_ip, virtual_ip);
return FAILED;
@@ -1066,14 +1058,14 @@ static status_t del_ip(private_kernel_netlink_net_t *this, host_t *virtual_ip)
enumerator_t *addrs, *ifaces;
status_t status;
int ifindex;
-
+
if (!this->install_virtual_ip)
{ /* disabled by config */
return SUCCESS;
}
-
+
DBG2(DBG_KNL, "deleting virtual IP %H", virtual_ip);
-
+
this->mutex->lock(this->mutex);
ifaces = this->ifaces->create_enumerator(this->ifaces);
while (ifaces->enumerate(ifaces, &iface))
@@ -1087,7 +1079,7 @@ static status_t del_ip(private_kernel_netlink_net_t *this, host_t *virtual_ip)
if (addr->refcount == 1)
{
status = manage_ipaddr(this, RTM_DELADDR, 0,
- ifindex, virtual_ip);
+ ifindex, virtual_ip);
if (status == SUCCESS)
{ /* wait until the address is really gone */
while (get_vip_refcount(this, virtual_ip) > 0)
@@ -1116,7 +1108,7 @@ static status_t del_ip(private_kernel_netlink_net_t *this, host_t *virtual_ip)
}
ifaces->destroy(ifaces);
this->mutex->unlock(this->mutex);
-
+
DBG2(DBG_KNL, "virtual IP %H not cached, unable to delete", virtual_ip);
return FAILED;
}
@@ -1143,11 +1135,11 @@ static status_t manage_srcroute(private_kernel_netlink_net_t *this, int nlmsg_ty
chunk_t half_net;
u_int8_t half_prefixlen;
status_t status;
-
+
half_net = chunk_alloca(dst_net.len);
memset(half_net.ptr, 0, half_net.len);
half_prefixlen = 1;
-
+
status = manage_srcroute(this, nlmsg_type, flags, half_net, half_prefixlen,
gateway, src_ip, if_name);
half_net.ptr[0] |= 0x80;
@@ -1155,7 +1147,7 @@ static status_t manage_srcroute(private_kernel_netlink_net_t *this, int nlmsg_ty
gateway, src_ip, if_name);
return status;
}
-
+
memset(&request, 0, sizeof(request));
hdr = (struct nlmsghdr*)request;
@@ -1170,12 +1162,15 @@ static status_t manage_srcroute(private_kernel_netlink_net_t *this, int nlmsg_ty
msg->rtm_protocol = RTPROT_STATIC;
msg->rtm_type = RTN_UNICAST;
msg->rtm_scope = RT_SCOPE_UNIVERSE;
-
+
netlink_add_attribute(hdr, RTA_DST, dst_net, sizeof(request));
chunk = src_ip->get_address(src_ip);
netlink_add_attribute(hdr, RTA_PREFSRC, chunk, sizeof(request));
- chunk = gateway->get_address(gateway);
- netlink_add_attribute(hdr, RTA_GATEWAY, chunk, sizeof(request));
+ if (gateway && gateway->get_family(gateway) == src_ip->get_family(src_ip))
+ {
+ chunk = gateway->get_address(gateway);
+ netlink_add_attribute(hdr, RTA_GATEWAY, chunk, sizeof(request));
+ }
ifindex = get_interface_index(this, if_name);
chunk.ptr = (char*)&ifindex;
chunk.len = sizeof(ifindex);
@@ -1193,7 +1188,7 @@ static status_t add_route(private_kernel_netlink_net_t *this, chunk_t dst_net,
return manage_srcroute(this, RTM_NEWROUTE, NLM_F_CREATE | NLM_F_EXCL,
dst_net, prefixlen, gateway, src_ip, if_name);
}
-
+
/**
* Implementation of kernel_net_t.del_route.
*/
@@ -1216,9 +1211,9 @@ static status_t init_address_list(private_kernel_netlink_net_t *this)
enumerator_t *ifaces, *addrs;
iface_entry_t *iface;
addr_entry_t *addr;
-
+
DBG1(DBG_KNL, "listening on interfaces:");
-
+
memset(&request, 0, sizeof(request));
in = (struct nlmsghdr*)&request;
@@ -1226,7 +1221,7 @@ static status_t init_address_list(private_kernel_netlink_net_t *this)
in->nlmsg_flags = NLM_F_REQUEST | NLM_F_MATCH | NLM_F_ROOT;
msg = (struct rtgenmsg*)NLMSG_DATA(in);
msg->rtgen_family = AF_UNSPEC;
-
+
/* get all links */
in->nlmsg_type = RTM_GETLINK;
if (this->socket->send(this->socket, in, &out, &len) != SUCCESS)
@@ -1250,7 +1245,7 @@ static status_t init_address_list(private_kernel_netlink_net_t *this)
break;
}
free(out);
-
+
/* get all interface addresses */
in->nlmsg_type = RTM_GETADDR;
if (this->socket->send(this->socket, in, &out, &len) != SUCCESS)
@@ -1274,7 +1269,7 @@ static status_t init_address_list(private_kernel_netlink_net_t *this)
break;
}
free(out);
-
+
this->mutex->lock(this->mutex);
ifaces = this->ifaces->create_enumerator(this->ifaces);
while (ifaces->enumerate(ifaces, &iface))
@@ -1299,17 +1294,17 @@ static status_t init_address_list(private_kernel_netlink_net_t *this)
* create or delete a rule to use our routing table
*/
static status_t manage_rule(private_kernel_netlink_net_t *this, int nlmsg_type,
- u_int32_t table, u_int32_t prio)
+ int family, u_int32_t table, u_int32_t prio)
{
netlink_buf_t request;
struct nlmsghdr *hdr;
struct rtmsg *msg;
chunk_t chunk;
- memset(&request, 0, sizeof(request));
+ memset(&request, 0, sizeof(request));
hdr = (struct nlmsghdr*)request;
hdr->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK;
- hdr->nlmsg_type = nlmsg_type;
+ hdr->nlmsg_type = nlmsg_type;
if (nlmsg_type == RTM_NEWRULE)
{
hdr->nlmsg_flags |= NLM_F_CREATE | NLM_F_EXCL;
@@ -1318,7 +1313,7 @@ static status_t manage_rule(private_kernel_netlink_net_t *this, int nlmsg_type,
msg = (struct rtmsg*)NLMSG_DATA(hdr);
msg->rtm_table = table;
- msg->rtm_family = AF_INET;
+ msg->rtm_family = family;
msg->rtm_protocol = RTPROT_BOOT;
msg->rtm_scope = RT_SCOPE_UNIVERSE;
msg->rtm_type = RTN_UNICAST;
@@ -1336,7 +1331,9 @@ static void destroy(private_kernel_netlink_net_t *this)
{
if (this->routing_table)
{
- manage_rule(this, RTM_DELRULE, this->routing_table,
+ manage_rule(this, RTM_DELRULE, AF_INET, this->routing_table,
+ this->routing_table_prio);
+ manage_rule(this, RTM_DELRULE, AF_INET6, this->routing_table,
this->routing_table_prio);
}
@@ -1356,7 +1353,7 @@ kernel_netlink_net_t *kernel_netlink_net_create()
{
private_kernel_netlink_net_t *this = malloc_thing(private_kernel_netlink_net_t);
struct sockaddr_nl addr;
-
+
/* public functions */
this->public.interface.get_interface = (char*(*)(kernel_net_t*,host_t*))get_interface_name;
this->public.interface.create_address_enumerator = (enumerator_t*(*)(kernel_net_t*,bool,bool))create_address_enumerator;
@@ -1370,53 +1367,58 @@ kernel_netlink_net_t *kernel_netlink_net_create()
/* private members */
this->ifaces = linked_list_create();
- this->mutex = mutex_create(MUTEX_TYPE_DEFAULT);
+ this->mutex = mutex_create(MUTEX_TYPE_RECURSIVE);
this->condvar = condvar_create(CONDVAR_TYPE_DEFAULT);
timerclear(&this->last_roam);
this->routing_table = lib->settings->get_int(lib->settings,
- "charon.routing_table", IPSEC_ROUTING_TABLE);
+ "charon.routing_table", ROUTING_TABLE);
this->routing_table_prio = lib->settings->get_int(lib->settings,
- "charon.routing_table_prio", IPSEC_ROUTING_TABLE_PRIO);
+ "charon.routing_table_prio", ROUTING_TABLE_PRIO);
this->process_route = lib->settings->get_bool(lib->settings,
"charon.process_route", TRUE);
this->install_virtual_ip = lib->settings->get_bool(lib->settings,
"charon.install_virtual_ip", TRUE);
-
+
this->socket = netlink_socket_create(NETLINK_ROUTE);
-
+
memset(&addr, 0, sizeof(addr));
addr.nl_family = AF_NETLINK;
-
+
/* create and bind RT socket for events (address/interface/route changes) */
this->socket_events = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
if (this->socket_events <= 0)
{
charon->kill(charon, "unable to create RT event socket");
}
- addr.nl_groups = RTMGRP_IPV4_IFADDR | RTMGRP_IPV6_IFADDR |
+ addr.nl_groups = RTMGRP_IPV4_IFADDR | RTMGRP_IPV6_IFADDR |
RTMGRP_IPV4_ROUTE | RTMGRP_IPV4_ROUTE | RTMGRP_LINK;
if (bind(this->socket_events, (struct sockaddr*)&addr, sizeof(addr)))
{
charon->kill(charon, "unable to bind RT event socket");
}
-
+
this->job = callback_job_create((callback_job_cb_t)receive_events,
this, NULL, NULL);
charon->processor->queue_job(charon->processor, (job_t*)this->job);
-
+
if (init_address_list(this) != SUCCESS)
{
charon->kill(charon, "unable to get interface list");
}
-
+
if (this->routing_table)
{
- if (manage_rule(this, RTM_NEWRULE, this->routing_table,
+ if (manage_rule(this, RTM_NEWRULE, AF_INET, this->routing_table,
this->routing_table_prio) != SUCCESS)
{
- DBG1(DBG_KNL, "unable to create routing table rule");
+ DBG1(DBG_KNL, "unable to create IPv4 routing table rule");
+ }
+ if (manage_rule(this, RTM_NEWRULE, AF_INET6, this->routing_table,
+ this->routing_table_prio) != SUCCESS)
+ {
+ DBG1(DBG_KNL, "unable to create IPv6 routing table rule");
}
}
-
+
return &this->public;
}
diff --git a/src/charon/plugins/kernel_netlink/kernel_netlink_plugin.c b/src/charon/plugins/kernel_netlink/kernel_netlink_plugin.c
index 77005e871..cdf20f14a 100644
--- a/src/charon/plugins/kernel_netlink/kernel_netlink_plugin.c
+++ b/src/charon/plugins/kernel_netlink/kernel_netlink_plugin.c
@@ -49,11 +49,11 @@ static void destroy(private_kernel_netlink_plugin_t *this)
plugin_t *plugin_create()
{
private_kernel_netlink_plugin_t *this = malloc_thing(private_kernel_netlink_plugin_t);
-
+
this->public.plugin.destroy = (void(*)(plugin_t*))destroy;
-
+
charon->kernel_interface->add_ipsec_interface(charon->kernel_interface, (kernel_ipsec_constructor_t)kernel_netlink_ipsec_create);
charon->kernel_interface->add_net_interface(charon->kernel_interface, (kernel_net_constructor_t)kernel_netlink_net_create);
-
+
return &this->public.plugin;
}
diff --git a/src/charon/plugins/kernel_netlink/kernel_netlink_shared.c b/src/charon/plugins/kernel_netlink/kernel_netlink_shared.c
index ec1187083..b96186a3a 100644
--- a/src/charon/plugins/kernel_netlink/kernel_netlink_shared.c
+++ b/src/charon/plugins/kernel_netlink/kernel_netlink_shared.c
@@ -22,7 +22,7 @@
#include "kernel_netlink_shared.h"
#include <daemon.h>
-#include <utils/mutex.h>
+#include <threading/mutex.h>
typedef struct private_netlink_socket_t private_netlink_socket_t;
@@ -34,7 +34,7 @@ struct private_netlink_socket_t {
* public part of the netlink_socket_t object.
*/
netlink_socket_t public;
-
+
/**
* mutex to lock access to netlink socket
*/
@@ -46,12 +46,12 @@ struct private_netlink_socket_t {
int seq;
/**
- * netlink socket protocol
+ * netlink socket protocol
*/
int protocol;
/**
- * netlink socket
+ * netlink socket
*/
int socket;
};
@@ -71,12 +71,12 @@ static status_t netlink_send(private_netlink_socket_t *this, struct nlmsghdr *in
struct sockaddr_nl addr;
chunk_t result = chunk_empty, tmp;
struct nlmsghdr *msg, peek;
-
+
this->mutex->lock(this->mutex);
-
+
in->nlmsg_seq = ++this->seq;
in->nlmsg_pid = getpid();
-
+
memset(&addr, 0, sizeof(addr));
addr.nl_family = AF_NETLINK;
addr.nl_pid = 0;
@@ -91,11 +91,11 @@ static status_t netlink_send(private_netlink_socket_t *this, struct nlmsghdr *in
while (TRUE)
{
- len = sendto(this->socket, in, in->nlmsg_len, 0,
+ len = sendto(this->socket, in, in->nlmsg_len, 0,
(struct sockaddr*)&addr, sizeof(addr));
-
+
if (len != in->nlmsg_len)
- {
+ {
if (errno == EINTR)
{
/* interrupted, try again */
@@ -107,23 +107,23 @@ static status_t netlink_send(private_netlink_socket_t *this, struct nlmsghdr *in
}
break;
}
-
+
while (TRUE)
- {
+ {
char buf[4096];
tmp.len = sizeof(buf);
tmp.ptr = buf;
msg = (struct nlmsghdr*)tmp.ptr;
-
+
memset(&addr, 0, sizeof(addr));
addr.nl_family = AF_NETLINK;
addr.nl_pid = getpid();
addr.nl_groups = 0;
addr_len = sizeof(addr);
-
+
len = recvfrom(this->socket, tmp.ptr, tmp.len, 0,
(struct sockaddr*)&addr, &addr_len);
-
+
if (len < 0)
{
if (errno == EINTR)
@@ -155,17 +155,17 @@ static status_t netlink_send(private_netlink_socket_t *this, struct nlmsghdr *in
free(result.ptr);
return FAILED;
}
-
+
tmp.len = len;
result.ptr = realloc(result.ptr, result.len + tmp.len);
memcpy(result.ptr + result.len, tmp.ptr, tmp.len);
result.len += tmp.len;
-
+
/* NLM_F_MULTI flag does not seem to be set correctly, we use sequence
* numbers to detect multi header messages */
len = recvfrom(this->socket, &peek, sizeof(peek), MSG_PEEK | MSG_DONTWAIT,
(struct sockaddr*)&addr, &addr_len);
-
+
if (len == sizeof(peek) && peek.nlmsg_seq == this->seq)
{
/* seems to be multipart */
@@ -173,12 +173,12 @@ static status_t netlink_send(private_netlink_socket_t *this, struct nlmsghdr *in
}
break;
}
-
+
*out_len = result.len;
*out = (struct nlmsghdr*)result.ptr;
-
+
this->mutex->unlock(this->mutex);
-
+
return SUCCESS;
}
@@ -202,7 +202,7 @@ static status_t netlink_send_ack(private_netlink_socket_t *this, struct nlmsghdr
case NLMSG_ERROR:
{
struct nlmsgerr* err = (struct nlmsgerr*)NLMSG_DATA(hdr);
-
+
if (err->error)
{
if (-err->error == EEXIST)
@@ -247,7 +247,7 @@ static void destroy(private_netlink_socket_t *this)
netlink_socket_t *netlink_socket_create(int protocol) {
private_netlink_socket_t *this = malloc_thing(private_netlink_socket_t);
struct sockaddr_nl addr;
-
+
/* public functions */
this->public.send = (status_t(*)(netlink_socket_t*,struct nlmsghdr*, struct nlmsghdr**, size_t*))netlink_send;
this->public.send_ack = (status_t(*)(netlink_socket_t*,struct nlmsghdr*))netlink_send_ack;
@@ -256,23 +256,23 @@ netlink_socket_t *netlink_socket_create(int protocol) {
/* private members */
this->seq = 200;
this->mutex = mutex_create(MUTEX_TYPE_DEFAULT);
-
+
memset(&addr, 0, sizeof(addr));
addr.nl_family = AF_NETLINK;
-
+
this->protocol = protocol;
this->socket = socket(AF_NETLINK, SOCK_RAW, protocol);
if (this->socket <= 0)
{
charon->kill(charon, "unable to create netlink socket");
}
-
+
addr.nl_groups = 0;
if (bind(this->socket, (struct sockaddr*)&addr, sizeof(addr)))
{
charon->kill(charon, "unable to bind netlink socket");
}
-
+
return &this->public;
}
@@ -283,13 +283,13 @@ void netlink_add_attribute(struct nlmsghdr *hdr, int rta_type, chunk_t data,
size_t buflen)
{
struct rtattr *rta;
-
+
if (NLMSG_ALIGN(hdr->nlmsg_len) + RTA_ALIGN(data.len) > buflen)
{
DBG1(DBG_KNL, "unable to add attribute, buffer too small");
return;
}
-
+
rta = (struct rtattr*)(((char*)hdr) + NLMSG_ALIGN(hdr->nlmsg_len));
rta->rta_type = rta_type;
rta->rta_len = RTA_LENGTH(data.len);
diff --git a/src/charon/plugins/kernel_netlink/kernel_netlink_shared.h b/src/charon/plugins/kernel_netlink/kernel_netlink_shared.h
index 5a70e4d9b..dfd27a21a 100644
--- a/src/charon/plugins/kernel_netlink/kernel_netlink_shared.h
+++ b/src/charon/plugins/kernel_netlink/kernel_netlink_shared.h
@@ -37,20 +37,20 @@ struct netlink_socket_t {
/**
* Send a netlink message and wait for a reply.
- *
+ *
* @param in netlink message to send
* @param out received netlink message
* @param out_len length of the received message
*/
status_t (*send)(netlink_socket_t *this, struct nlmsghdr *in, struct nlmsghdr **out, size_t *out_len);
-
+
/**
* Send a netlink message and wait for its acknowledge.
- *
+ *
* @param in netlink message to send
*/
status_t (*send_ack)(netlink_socket_t *this, struct nlmsghdr *in);
-
+
/**
* Destroy the socket.
*/
@@ -59,14 +59,14 @@ struct netlink_socket_t {
/**
* Create a netlink_socket_t object.
- *
+ *
* @param protocol protocol type (e.g. NETLINK_XFRM or NETLINK_ROUTE)
*/
netlink_socket_t *netlink_socket_create(int protocol);
/**
* Creates an rtattr and adds it to the given netlink message.
- *
+ *
* @param hdr netlink message
* @param rta_type type of the rtattr
* @param data data to add to the rtattr
diff --git a/src/charon/plugins/kernel_pfkey/Makefile.am b/src/charon/plugins/kernel_pfkey/Makefile.am
index e03a0ca02..a72c6a999 100644
--- a/src/charon/plugins/kernel_pfkey/Makefile.am
+++ b/src/charon/plugins/kernel_pfkey/Makefile.am
@@ -1,5 +1,5 @@
-INCLUDES = -I${linuxdir} -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
+INCLUDES = -I${linux_headers} -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
AM_CFLAGS = -rdynamic
diff --git a/src/charon/plugins/kernel_pfkey/Makefile.in b/src/charon/plugins/kernel_pfkey/Makefile.in
index e01510127..8a0961a7d 100644
--- a/src/charon/plugins/kernel_pfkey/Makefile.in
+++ b/src/charon/plugins/kernel_pfkey/Makefile.in
@@ -1,8 +1,9 @@
-# Makefile.in generated by automake 1.10.2 from Makefile.am.
+# Makefile.in generated by automake 1.11 from Makefile.am.
# @configure_input@
# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,
-# 2003, 2004, 2005, 2006, 2007, 2008 Free Software Foundation, Inc.
+# 2003, 2004, 2005, 2006, 2007, 2008, 2009 Free Software Foundation,
+# Inc.
# This Makefile.in is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.
@@ -16,8 +17,9 @@
VPATH = @srcdir@
pkgdatadir = $(datadir)/@PACKAGE@
-pkglibdir = $(libdir)/@PACKAGE@
pkgincludedir = $(includedir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkglibexecdir = $(libexecdir)/@PACKAGE@
am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
install_sh_DATA = $(install_sh) -c -m 644
install_sh_PROGRAM = $(install_sh) -c
@@ -35,19 +37,41 @@ host_triplet = @host@
subdir = src/charon/plugins/kernel_pfkey
DIST_COMMON = $(srcdir)/Makefile.am $(srcdir)/Makefile.in
ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
-am__aclocal_m4_deps = $(top_srcdir)/configure.in
+am__aclocal_m4_deps = $(top_srcdir)/m4/config/libtool.m4 \
+ $(top_srcdir)/m4/config/ltoptions.m4 \
+ $(top_srcdir)/m4/config/ltsugar.m4 \
+ $(top_srcdir)/m4/config/ltversion.m4 \
+ $(top_srcdir)/m4/config/lt~obsolete.m4 \
+ $(top_srcdir)/m4/macros/with.m4 \
+ $(top_srcdir)/m4/macros/enable-disable.m4 \
+ $(top_srcdir)/configure.in
am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
$(ACLOCAL_M4)
mkinstalldirs = $(install_sh) -d
CONFIG_CLEAN_FILES =
+CONFIG_CLEAN_VPATH_FILES =
am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
am__vpath_adj = case $$p in \
$(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
*) f=$$p;; \
esac;
-am__strip_dir = `echo $$p | sed -e 's|^.*/||'`;
+am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
+am__install_max = 40
+am__nobase_strip_setup = \
+ srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
+am__nobase_strip = \
+ for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
+am__nobase_list = $(am__nobase_strip_setup); \
+ for p in $$list; do echo "$$p $$p"; done | \
+ sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
+ $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
+ if (++n[$$2] == $(am__install_max)) \
+ { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
+ END { for (dir in files) print dir, files[dir] }'
+am__base_list = \
+ sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
+ sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
am__installdirs = "$(DESTDIR)$(plugindir)"
-pluginLTLIBRARIES_INSTALL = $(INSTALL)
LTLIBRARIES = $(plugin_LTLIBRARIES)
libstrongswan_kernel_pfkey_la_LIBADD =
am_libstrongswan_kernel_pfkey_la_OBJECTS = kernel_pfkey_plugin.lo \
@@ -61,6 +85,7 @@ libstrongswan_kernel_pfkey_la_LINK = $(LIBTOOL) --tag=CC \
DEFAULT_INCLUDES = -I.@am__isrc@
depcomp = $(SHELL) $(top_srcdir)/depcomp
am__depfiles_maybe = depfiles
+am__mv = mv -f
COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
LTCOMPILE = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
@@ -108,25 +133,22 @@ INSTALL_DATA = @INSTALL_DATA@
INSTALL_PROGRAM = @INSTALL_PROGRAM@
INSTALL_SCRIPT = @INSTALL_SCRIPT@
INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
-IPSEC_ROUTING_TABLE = @IPSEC_ROUTING_TABLE@
-IPSEC_ROUTING_TABLE_PRIO = @IPSEC_ROUTING_TABLE_PRIO@
LD = @LD@
LDFLAGS = @LDFLAGS@
LEX = @LEX@
LEXLIB = @LEXLIB@
LEX_OUTPUT_ROOT = @LEX_OUTPUT_ROOT@
-LIBGCRYPT_CFLAGS = @LIBGCRYPT_CFLAGS@
-LIBGCRYPT_CONFIG = @LIBGCRYPT_CONFIG@
-LIBGCRYPT_LIBS = @LIBGCRYPT_LIBS@
LIBOBJS = @LIBOBJS@
LIBS = @LIBS@
LIBTOOL = @LIBTOOL@
-LINUX_HEADERS = @LINUX_HEADERS@
LIPO = @LIPO@
LN_S = @LN_S@
LTLIBOBJS = @LTLIBOBJS@
MAKEINFO = @MAKEINFO@
MKDIR_P = @MKDIR_P@
+MYSQLCFLAG = @MYSQLCFLAG@
+MYSQLCONFIG = @MYSQLCONFIG@
+MYSQLLIB = @MYSQLLIB@
NM = @NM@
NMEDIT = @NMEDIT@
OBJDUMP = @OBJDUMP@
@@ -138,11 +160,14 @@ PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
PACKAGE_NAME = @PACKAGE_NAME@
PACKAGE_STRING = @PACKAGE_STRING@
PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_URL = @PACKAGE_URL@
PACKAGE_VERSION = @PACKAGE_VERSION@
PATH_SEPARATOR = @PATH_SEPARATOR@
PERL = @PERL@
PKG_CONFIG = @PKG_CONFIG@
+PTHREADLIB = @PTHREADLIB@
RANLIB = @RANLIB@
+RTLIB = @RTLIB@
RUBY = @RUBY@
RUBYINCLUDE = @RUBYINCLUDE@
SED = @SED@
@@ -171,9 +196,9 @@ build_cpu = @build_cpu@
build_os = @build_os@
build_vendor = @build_vendor@
builddir = @builddir@
-confdir = @confdir@
datadir = @datadir@
datarootdir = @datarootdir@
+default_pkcs11 = @default_pkcs11@
docdir = @docdir@
dvidir = @dvidir@
exec_prefix = @exec_prefix@
@@ -196,7 +221,7 @@ ipsecuser = @ipsecuser@
libdir = @libdir@
libexecdir = @libexecdir@
libstrongswan_plugins = @libstrongswan_plugins@
-linuxdir = @linuxdir@
+linux_headers = @linux_headers@
localedir = @localedir@
localstatedir = @localstatedir@
lt_ECHO = @lt_ECHO@
@@ -204,6 +229,7 @@ mandir = @mandir@
mkdir_p = @mkdir_p@
nm_CFLAGS = @nm_CFLAGS@
nm_LIBS = @nm_LIBS@
+nm_ca_dir = @nm_ca_dir@
oldincludedir = @oldincludedir@
pdfdir = @pdfdir@
piddir = @piddir@
@@ -212,10 +238,12 @@ pluto_plugins = @pluto_plugins@
prefix = @prefix@
program_transform_name = @program_transform_name@
psdir = @psdir@
+random_device = @random_device@
resolv_conf = @resolv_conf@
+routing_table = @routing_table@
+routing_table_prio = @routing_table_prio@
sbindir = @sbindir@
sharedstatedir = @sharedstatedir@
-simreader = @simreader@
srcdir = @srcdir@
strongswan_conf = @strongswan_conf@
sysconfdir = @sysconfdir@
@@ -223,9 +251,10 @@ target_alias = @target_alias@
top_build_prefix = @top_build_prefix@
top_builddir = @top_builddir@
top_srcdir = @top_srcdir@
+urandom_device = @urandom_device@
xml_CFLAGS = @xml_CFLAGS@
xml_LIBS = @xml_LIBS@
-INCLUDES = -I${linuxdir} -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
+INCLUDES = -I${linux_headers} -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
AM_CFLAGS = -rdynamic
plugin_LTLIBRARIES = libstrongswan-kernel-pfkey.la
libstrongswan_kernel_pfkey_la_SOURCES = kernel_pfkey_plugin.h kernel_pfkey_plugin.c \
@@ -245,9 +274,9 @@ $(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps)
exit 1;; \
esac; \
done; \
- echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/charon/plugins/kernel_pfkey/Makefile'; \
- cd $(top_srcdir) && \
- $(AUTOMAKE) --gnu src/charon/plugins/kernel_pfkey/Makefile
+ echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/charon/plugins/kernel_pfkey/Makefile'; \
+ $(am__cd) $(top_srcdir) && \
+ $(AUTOMAKE) --gnu src/charon/plugins/kernel_pfkey/Makefile
.PRECIOUS: Makefile
Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
@case '$?' in \
@@ -265,23 +294,28 @@ $(top_srcdir)/configure: $(am__configure_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
$(ACLOCAL_M4): $(am__aclocal_m4_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(am__aclocal_m4_deps):
install-pluginLTLIBRARIES: $(plugin_LTLIBRARIES)
@$(NORMAL_INSTALL)
test -z "$(plugindir)" || $(MKDIR_P) "$(DESTDIR)$(plugindir)"
- @list='$(plugin_LTLIBRARIES)'; for p in $$list; do \
+ @list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+ list2=; for p in $$list; do \
if test -f $$p; then \
- f=$(am__strip_dir) \
- echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(pluginLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) '$$p' '$(DESTDIR)$(plugindir)/$$f'"; \
- $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(pluginLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) "$$p" "$(DESTDIR)$(plugindir)/$$f"; \
+ list2="$$list2 $$p"; \
else :; fi; \
- done
+ done; \
+ test -z "$$list2" || { \
+ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(plugindir)'"; \
+ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(plugindir)"; \
+ }
uninstall-pluginLTLIBRARIES:
@$(NORMAL_UNINSTALL)
- @list='$(plugin_LTLIBRARIES)'; for p in $$list; do \
- p=$(am__strip_dir) \
- echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$p'"; \
- $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$p"; \
+ @list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+ for p in $$list; do \
+ $(am__strip_dir) \
+ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$f'"; \
+ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$f"; \
done
clean-pluginLTLIBRARIES:
@@ -306,21 +340,21 @@ distclean-compile:
.c.o:
@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(COMPILE) -c $<
.c.obj:
@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(COMPILE) -c `$(CYGPATH_W) '$<'`
.c.lo:
@am__fastdepCC_TRUE@ $(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(LTCOMPILE) -c -o $@ $<
@@ -343,7 +377,7 @@ tags: TAGS
TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
$(TAGS_FILES) $(LISP)
- tags=; \
+ set x; \
here=`pwd`; \
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
unique=`for i in $$list; do \
@@ -351,29 +385,34 @@ TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
- if test -z "$(ETAGS_ARGS)$$tags$$unique"; then :; else \
+ shift; \
+ if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
test -n "$$unique" || unique=$$empty_fix; \
- $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
- $$tags $$unique; \
+ if test $$# -gt 0; then \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ "$$@" $$unique; \
+ else \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ $$unique; \
+ fi; \
fi
ctags: CTAGS
CTAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
$(TAGS_FILES) $(LISP)
- tags=; \
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
unique=`for i in $$list; do \
if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
- test -z "$(CTAGS_ARGS)$$tags$$unique" \
+ test -z "$(CTAGS_ARGS)$$unique" \
|| $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
- $$tags $$unique
+ $$unique
GTAGS:
here=`$(am__cd) $(top_builddir) && pwd` \
- && cd $(top_srcdir) \
- && gtags -i $(GTAGS_ARGS) $$here
+ && $(am__cd) $(top_srcdir) \
+ && gtags -i $(GTAGS_ARGS) "$$here"
distclean-tags:
-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
@@ -394,13 +433,17 @@ distdir: $(DISTFILES)
if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
if test -d $$d/$$file; then \
dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
+ if test -d "$(distdir)/$$file"; then \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+ fi; \
if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
- cp -pR $(srcdir)/$$file $(distdir)$$dir || exit 1; \
+ cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
fi; \
- cp -pR $$d/$$file $(distdir)$$dir || exit 1; \
+ cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
else \
- test -f $(distdir)/$$file \
- || cp -p $$d/$$file $(distdir)/$$file \
+ test -f "$(distdir)/$$file" \
+ || cp -p $$d/$$file "$(distdir)/$$file" \
|| exit 1; \
fi; \
done
@@ -431,6 +474,7 @@ clean-generic:
distclean-generic:
-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+ -test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
maintainer-clean-generic:
@echo "This command is intended for maintainers to use"
@@ -452,6 +496,8 @@ dvi-am:
html: html-am
+html-am:
+
info: info-am
info-am:
@@ -460,18 +506,28 @@ install-data-am: install-pluginLTLIBRARIES
install-dvi: install-dvi-am
+install-dvi-am:
+
install-exec-am:
install-html: install-html-am
+install-html-am:
+
install-info: install-info-am
+install-info-am:
+
install-man:
install-pdf: install-pdf-am
+install-pdf-am:
+
install-ps: install-ps-am
+install-ps-am:
+
installcheck-am:
maintainer-clean: maintainer-clean-am
@@ -510,6 +566,7 @@ uninstall-am: uninstall-pluginLTLIBRARIES
mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \
tags uninstall uninstall-am uninstall-pluginLTLIBRARIES
+
# Tell versions [3.59,3.63) of GNU make to not export all variables.
# Otherwise a system limit (for SysV at least) may be exceeded.
.NOEXPORT:
diff --git a/src/charon/plugins/kernel_pfkey/kernel_pfkey_ipsec.c b/src/charon/plugins/kernel_pfkey/kernel_pfkey_ipsec.c
index 1f83e8f39..9c50746ac 100644
--- a/src/charon/plugins/kernel_pfkey/kernel_pfkey_ipsec.c
+++ b/src/charon/plugins/kernel_pfkey/kernel_pfkey_ipsec.c
@@ -49,14 +49,15 @@
#endif /*HAVE_NATT*/
#include <unistd.h>
-#include <pthread.h>
+#include <time.h>
#include <errno.h>
#include "kernel_pfkey_ipsec.h"
#include <daemon.h>
#include <utils/host.h>
-#include <utils/mutex.h>
+#include <threading/thread.h>
+#include <threading/mutex.h>
#include <processing/jobs/callback_job.h>
#include <processing/jobs/acquire_job.h>
#include <processing/jobs/migrate_job.h>
@@ -151,42 +152,42 @@ struct private_kernel_pfkey_ipsec_t
* Public part of the kernel_pfkey_t object.
*/
kernel_pfkey_ipsec_t public;
-
+
/**
* mutex to lock access to various lists
*/
mutex_t *mutex;
-
+
/**
* List of installed policies (policy_entry_t)
*/
linked_list_t *policies;
-
+
/**
* whether to install routes along policies
*/
bool install_routes;
-
+
/**
* job receiving PF_KEY events
*/
callback_job_t *job;
-
+
/**
* mutex to lock access to the PF_KEY socket
*/
mutex_t *mutex_pfkey;
-
+
/**
* PF_KEY socket to communicate with the kernel
*/
int socket;
-
+
/**
* PF_KEY socket to receive acquire and expire events
*/
int socket_events;
-
+
/**
* sequence number for messages sent to the kernel
*/
@@ -201,10 +202,10 @@ typedef struct route_entry_t route_entry_t;
struct route_entry_t {
/** Name of the interface the route is bound to */
char *if_name;
-
+
/** Source ip of the route */
host_t *src_ip;
-
+
/** gateway for this route */
host_t *gateway;
@@ -233,16 +234,16 @@ typedef struct policy_entry_t policy_entry_t;
* installed kernel policy.
*/
struct policy_entry_t {
-
+
/** reqid of this policy */
u_int32_t reqid;
-
+
/** index assigned by the kernel */
u_int32_t index;
-
+
/** direction of this policy: in, out, forward */
u_int8_t direction;
-
+
/** parameters of installed policy */
struct {
/** subnet and port */
@@ -252,10 +253,10 @@ struct policy_entry_t {
/** protocol */
u_int8_t proto;
} src, dst;
-
+
/** associated route installed for this policy */
route_entry_t *route;
-
+
/** by how many CHILD_SA's this policy is used */
u_int refcount;
};
@@ -272,15 +273,15 @@ static policy_entry_t *create_policy_entry(traffic_selector_t *src_ts,
policy->direction = dir;
policy->route = NULL;
policy->refcount = 0;
-
+
src_ts->to_subnet(src_ts, &policy->src.net, &policy->src.mask);
dst_ts->to_subnet(dst_ts, &policy->dst.net, &policy->dst.mask);
-
+
/* src or dest proto may be "any" (0), use more restrictive one */
policy->src.proto = max(src_ts->get_protocol(src_ts), dst_ts->get_protocol(dst_ts));
policy->src.proto = policy->src.proto ? policy->src.proto : IPSEC_PROTO_ANY;
policy->dst.proto = policy->src.proto;
-
+
return policy;
}
@@ -328,7 +329,7 @@ struct pfkey_msg_t
* PF_KEY message base
*/
struct sadb_msg *msg;
-
+
/**
* PF_KEY message extensions
*/
@@ -518,7 +519,7 @@ struct kernel_algorithm_t {
* Identifier specified in IKEv2
*/
int ikev2;
-
+
/**
* Identifier as defined in pfkeyv2.h
*/
@@ -652,19 +653,19 @@ static void add_encap_ext(struct sadb_msg *msg, host_t *src, host_t *dst)
{
struct sadb_x_nat_t_type* nat_type;
struct sadb_x_nat_t_port* nat_port;
-
+
nat_type = (struct sadb_x_nat_t_type*)PFKEY_EXT_ADD_NEXT(msg);
nat_type->sadb_x_nat_t_type_exttype = SADB_X_EXT_NAT_T_TYPE;
nat_type->sadb_x_nat_t_type_len = PFKEY_LEN(sizeof(struct sadb_x_nat_t_type));
nat_type->sadb_x_nat_t_type_type = UDP_ENCAP_ESPINUDP;
PFKEY_EXT_ADD(msg, nat_type);
-
+
nat_port = (struct sadb_x_nat_t_port*)PFKEY_EXT_ADD_NEXT(msg);
nat_port->sadb_x_nat_t_port_exttype = SADB_X_EXT_NAT_T_SPORT;
nat_port->sadb_x_nat_t_port_len = PFKEY_LEN(sizeof(struct sadb_x_nat_t_port));
nat_port->sadb_x_nat_t_port_port = htons(src->get_port(src));
PFKEY_EXT_ADD(msg, nat_port);
-
+
nat_port = (struct sadb_x_nat_t_port*)PFKEY_EXT_ADD_NEXT(msg);
nat_port->sadb_x_nat_t_port_exttype = SADB_X_EXT_NAT_T_DPORT;
nat_port->sadb_x_nat_t_port_len = PFKEY_LEN(sizeof(struct sadb_x_nat_t_port));
@@ -682,8 +683,8 @@ static traffic_selector_t* sadb_address2ts(struct sadb_address *address)
host_t *host;
/* The Linux 2.6 kernel does not set the protocol and port information
- * in the src and dst sadb_address extensions of the SADB_ACQUIRE message.
- */
+ * in the src and dst sadb_address extensions of the SADB_ACQUIRE message.
+ */
host = host_create_from_sockaddr((sockaddr_t*)&address[1]) ;
ts = traffic_selector_create_from_subnet(host, address->sadb_address_prefixlen,
address->sadb_address_proto, host->get_port(host));
@@ -697,15 +698,15 @@ static status_t parse_pfkey_message(struct sadb_msg *msg, pfkey_msg_t *out)
{
struct sadb_ext* ext;
size_t len;
-
+
memset(out, 0, sizeof(pfkey_msg_t));
out->msg = msg;
-
+
len = msg->sadb_msg_len;
len -= PFKEY_LEN(sizeof(struct sadb_msg));
-
+
ext = (struct sadb_ext*)(((char*)msg) + sizeof(struct sadb_msg));
-
+
while (len >= PFKEY_LEN(sizeof(struct sadb_ext)))
{
DBG3(DBG_KNL, " %N", sadb_ext_type_names, ext->sadb_ext_type);
@@ -716,20 +717,20 @@ static status_t parse_pfkey_message(struct sadb_msg *msg, pfkey_msg_t *out)
sadb_ext_type_names, ext->sadb_ext_type);
break;
}
-
+
if ((ext->sadb_ext_type > SADB_EXT_MAX) || (!ext->sadb_ext_type))
{
DBG1(DBG_KNL, "type of PF_KEY extension (%d) is invalid", ext->sadb_ext_type);
break;
}
-
+
if (out->ext[ext->sadb_ext_type])
{
DBG1(DBG_KNL, "duplicate %N extension",
sadb_ext_type_names, ext->sadb_ext_type);
break;
}
-
+
out->ext[ext->sadb_ext_type] = ext;
ext = PFKEY_EXT_NEXT_LEN(ext, len);
}
@@ -739,7 +740,7 @@ static status_t parse_pfkey_message(struct sadb_msg *msg, pfkey_msg_t *out)
DBG1(DBG_KNL, "PF_KEY message length is invalid");
return FAILED;
}
-
+
return SUCCESS;
}
@@ -752,7 +753,7 @@ static status_t pfkey_send_socket(private_kernel_pfkey_ipsec_t *this, int socket
unsigned char buf[PFKEY_BUFFER_SIZE];
struct sadb_msg *msg;
int in_len, len;
-
+
this->mutex_pfkey->lock(this->mutex_pfkey);
/* FIXME: our usage of sequence numbers is probably wrong. check RFC 2367,
@@ -779,13 +780,13 @@ static status_t pfkey_send_socket(private_kernel_pfkey_ipsec_t *this, int socket
}
break;
}
-
+
while (TRUE)
{
msg = (struct sadb_msg*)buf;
-
+
len = recv(socket, buf, sizeof(buf), 0);
-
+
if (len < 0)
{
if (errno == EINTR)
@@ -844,13 +845,13 @@ static status_t pfkey_send_socket(private_kernel_pfkey_ipsec_t *this, int socket
}
break;
}
-
+
*out_len = len;
*out = (struct sadb_msg*)malloc(len);
memcpy(*out, buf, len);
-
+
this->mutex_pfkey->unlock(this->mutex_pfkey);
-
+
return SUCCESS;
}
@@ -873,7 +874,7 @@ static void process_acquire(private_kernel_pfkey_ipsec_t *this, struct sadb_msg*
traffic_selector_t *src_ts, *dst_ts;
policy_entry_t *policy;
job_t *job;
-
+
switch (msg->sadb_msg_satype)
{
case SADB_SATYPE_UNSPEC:
@@ -885,13 +886,13 @@ static void process_acquire(private_kernel_pfkey_ipsec_t *this, struct sadb_msg*
return;
}
DBG2(DBG_KNL, "received an SADB_ACQUIRE");
-
+
if (parse_pfkey_message(msg, &response) != SUCCESS)
{
DBG1(DBG_KNL, "parsing SADB_ACQUIRE from kernel failed");
return;
}
-
+
index = response.x_policy->sadb_x_policy_id;
this->mutex->lock(this->mutex);
if (this->policies->find_first(this->policies,
@@ -907,7 +908,7 @@ static void process_acquire(private_kernel_pfkey_ipsec_t *this, struct sadb_msg*
src_ts = sadb_address2ts(response.src);
dst_ts = sadb_address2ts(response.dst);
this->mutex->unlock(this->mutex);
-
+
DBG1(DBG_KNL, "creating acquire job for policy %R === %R with reqid {%u}",
src_ts, dst_ts, reqid);
job = (job_t*)acquire_job_create(reqid, src_ts, dst_ts);
@@ -924,27 +925,27 @@ static void process_expire(private_kernel_pfkey_ipsec_t *this, struct sadb_msg*
u_int32_t spi, reqid;
bool hard;
job_t *job;
-
+
DBG2(DBG_KNL, "received an SADB_EXPIRE");
-
+
if (parse_pfkey_message(msg, &response) != SUCCESS)
{
DBG1(DBG_KNL, "parsing SADB_EXPIRE from kernel failed");
return;
}
-
+
protocol = proto_satype2ike(msg->sadb_msg_satype);
spi = response.sa->sadb_sa_spi;
reqid = response.x_sa2->sadb_x_sa2_reqid;
hard = response.lft_hard != NULL;
-
+
if (protocol != PROTO_ESP && protocol != PROTO_AH)
{
DBG2(DBG_KNL, "ignoring SADB_EXPIRE for SA with SPI %.8x and reqid {%u} "
"which is not a CHILD_SA", ntohl(spi), reqid);
return;
}
-
+
DBG1(DBG_KNL, "creating %s job for %N CHILD_SA with SPI %.8x and reqid {%u}",
hard ? "delete" : "rekey", protocol_id_names,
protocol, ntohl(spi), reqid);
@@ -984,7 +985,7 @@ static void process_migrate(private_kernel_pfkey_ipsec_t *this, struct sadb_msg*
dir = kernel2dir(response.x_policy->sadb_x_policy_dir);
DBG2(DBG_KNL, " policy %R === %R %N, id %u", src_ts, dst_ts,
policy_dir_names, dir);
-
+
/* SADB_X_EXT_KMADDRESS is not present in unpatched kernels < 2.6.28 */
if (response.x_kmaddress)
{
@@ -999,7 +1000,7 @@ static void process_migrate(private_kernel_pfkey_ipsec_t *this, struct sadb_msg*
remote = host_create_from_sockaddr(remote_addr);
DBG2(DBG_KNL, " kmaddress: %H...%H", local, remote);
}
-
+
if (src_ts && dst_ts && local && remote)
{
DBG1(DBG_KNL, "creating migrate job for policy %R === %R %N with reqid {%u}",
@@ -1028,24 +1029,24 @@ static void process_mapping(private_kernel_pfkey_ipsec_t *this, struct sadb_msg*
u_int32_t spi, reqid;
host_t *host;
job_t *job;
-
+
DBG2(DBG_KNL, "received an SADB_X_NAT_T_NEW_MAPPING");
-
+
if (parse_pfkey_message(msg, &response) != SUCCESS)
{
DBG1(DBG_KNL, "parsing SADB_X_NAT_T_NEW_MAPPING from kernel failed");
return;
}
-
+
if (!response.x_sa2)
{
DBG1(DBG_KNL, "received SADB_X_NAT_T_NEW_MAPPING is missing required information");
return;
}
-
+
spi = response.sa->sadb_sa_spi;
reqid = response.x_sa2->sadb_x_sa2_reqid;
-
+
if (proto_satype2ike(msg->sadb_msg_satype) == PROTO_ESP)
{
sockaddr_t *sa = (sockaddr_t*)(response.dst + 1);
@@ -1083,12 +1084,13 @@ static job_requeue_t receive_events(private_kernel_pfkey_ipsec_t *this)
{
unsigned char buf[PFKEY_BUFFER_SIZE];
struct sadb_msg *msg = (struct sadb_msg*)buf;
- int len, oldstate;
-
- pthread_setcancelstate(PTHREAD_CANCEL_ENABLE, &oldstate);
+ int len;
+ bool oldstate;
+
+ oldstate = thread_cancelability(TRUE);
len = recvfrom(this->socket_events, buf, sizeof(buf), 0, NULL, 0);
- pthread_setcancelstate(oldstate, NULL);
-
+ thread_cancelability(oldstate);
+
if (len < 0)
{
switch (errno)
@@ -1105,7 +1107,7 @@ static job_requeue_t receive_events(private_kernel_pfkey_ipsec_t *this)
return JOB_REQUEUE_FAIR;
}
}
-
+
if (len < sizeof(struct sadb_msg) ||
msg->sadb_msg_len < PFKEY_LEN(sizeof(struct sadb_msg)))
{
@@ -1121,7 +1123,7 @@ static job_requeue_t receive_events(private_kernel_pfkey_ipsec_t *this)
DBG1(DBG_KNL, "buffer was too small to receive the complete PF_KEY message");
return JOB_REQUEUE_DIRECT;
}
-
+
switch (msg->sadb_msg_type)
{
case SADB_ACQUIRE:
@@ -1143,7 +1145,7 @@ static job_requeue_t receive_events(private_kernel_pfkey_ipsec_t *this)
default:
break;
}
-
+
return JOB_REQUEUE_DIRECT;
}
@@ -1162,31 +1164,31 @@ static status_t get_spi(private_kernel_pfkey_ipsec_t *this,
pfkey_msg_t response;
u_int32_t received_spi = 0;
size_t len;
-
+
memset(&request, 0, sizeof(request));
-
+
msg = (struct sadb_msg*)request;
msg->sadb_msg_version = PF_KEY_V2;
msg->sadb_msg_type = SADB_GETSPI;
msg->sadb_msg_satype = proto_ike2satype(protocol);
msg->sadb_msg_len = PFKEY_LEN(sizeof(struct sadb_msg));
-
+
sa2 = (struct sadb_x_sa2*)PFKEY_EXT_ADD_NEXT(msg);
sa2->sadb_x_sa2_exttype = SADB_X_EXT_SA2;
sa2->sadb_x_sa2_len = PFKEY_LEN(sizeof(struct sadb_spirange));
sa2->sadb_x_sa2_reqid = reqid;
PFKEY_EXT_ADD(msg, sa2);
-
+
add_addr_ext(msg, src, SADB_EXT_ADDRESS_SRC, 0, 0);
add_addr_ext(msg, dst, SADB_EXT_ADDRESS_DST, 0, 0);
-
+
range = (struct sadb_spirange*)PFKEY_EXT_ADD_NEXT(msg);
range->sadb_spirange_exttype = SADB_EXT_SPIRANGE;
range->sadb_spirange_len = PFKEY_LEN(sizeof(struct sadb_spirange));
range->sadb_spirange_min = 0xc0000000;
range->sadb_spirange_max = 0xcFFFFFFF;
PFKEY_EXT_ADD(msg, range);
-
+
if (pfkey_send(this, msg, &out, &len) == SUCCESS)
{
if (out->sadb_msg_errno)
@@ -1200,12 +1202,12 @@ static status_t get_spi(private_kernel_pfkey_ipsec_t *this,
}
free(out);
}
-
+
if (received_spi == 0)
{
return FAILED;
}
-
+
*spi = received_spi;
return SUCCESS;
}
@@ -1226,11 +1228,12 @@ static status_t get_cpi(private_kernel_pfkey_ipsec_t *this,
static status_t add_sa(private_kernel_pfkey_ipsec_t *this,
host_t *src, host_t *dst, u_int32_t spi,
protocol_id_t protocol, u_int32_t reqid,
- u_int64_t expire_soft, u_int64_t expire_hard,
+ lifetime_cfg_t *lifetime,
u_int16_t enc_alg, chunk_t enc_key,
u_int16_t int_alg, chunk_t int_key,
ipsec_mode_t mode, u_int16_t ipcomp, u_int16_t cpi,
- bool encap, bool inbound)
+ bool encap, bool inbound, traffic_selector_t *src_ts,
+ traffic_selector_t *dst_ts)
{
unsigned char request[PFKEY_BUFFER_SIZE];
struct sadb_msg *msg, *out;
@@ -1239,11 +1242,11 @@ static status_t add_sa(private_kernel_pfkey_ipsec_t *this,
struct sadb_lifetime *lft;
struct sadb_key *key;
size_t len;
-
+
memset(&request, 0, sizeof(request));
-
+
DBG2(DBG_KNL, "adding SAD entry with SPI %.8x and reqid {%u}", ntohl(spi), reqid);
-
+
msg = (struct sadb_msg*)request;
msg->sadb_msg_version = PF_KEY_V2;
msg->sadb_msg_type = inbound ? SADB_UPDATE : SADB_ADD;
@@ -1273,29 +1276,35 @@ static status_t add_sa(private_kernel_pfkey_ipsec_t *this,
sa->sadb_sa_auth = lookup_algorithm(integrity_algs, int_alg);
sa->sadb_sa_encrypt = lookup_algorithm(encryption_algs, enc_alg);
PFKEY_EXT_ADD(msg, sa);
-
+
sa2 = (struct sadb_x_sa2*)PFKEY_EXT_ADD_NEXT(msg);
sa2->sadb_x_sa2_exttype = SADB_X_EXT_SA2;
sa2->sadb_x_sa2_len = PFKEY_LEN(sizeof(struct sadb_spirange));
sa2->sadb_x_sa2_mode = mode2kernel(mode);
sa2->sadb_x_sa2_reqid = reqid;
PFKEY_EXT_ADD(msg, sa2);
-
+
add_addr_ext(msg, src, SADB_EXT_ADDRESS_SRC, 0, 0);
add_addr_ext(msg, dst, SADB_EXT_ADDRESS_DST, 0, 0);
-
+
lft = (struct sadb_lifetime*)PFKEY_EXT_ADD_NEXT(msg);
lft->sadb_lifetime_exttype = SADB_EXT_LIFETIME_SOFT;
lft->sadb_lifetime_len = PFKEY_LEN(sizeof(struct sadb_lifetime));
- lft->sadb_lifetime_addtime = expire_soft;
+ lft->sadb_lifetime_allocations = lifetime->packets.rekey;
+ lft->sadb_lifetime_bytes = lifetime->bytes.rekey;
+ lft->sadb_lifetime_addtime = lifetime->time.rekey;
+ lft->sadb_lifetime_usetime = 0; /* we only use addtime */
PFKEY_EXT_ADD(msg, lft);
-
+
lft = (struct sadb_lifetime*)PFKEY_EXT_ADD_NEXT(msg);
lft->sadb_lifetime_exttype = SADB_EXT_LIFETIME_HARD;
lft->sadb_lifetime_len = PFKEY_LEN(sizeof(struct sadb_lifetime));
- lft->sadb_lifetime_addtime = expire_hard;
+ lft->sadb_lifetime_allocations = lifetime->packets.life;
+ lft->sadb_lifetime_bytes = lifetime->bytes.life;
+ lft->sadb_lifetime_addtime = lifetime->time.life;
+ lft->sadb_lifetime_usetime = 0; /* we only use addtime */
PFKEY_EXT_ADD(msg, lft);
-
+
if (enc_alg != ENCR_UNDEFINED)
{
if (!sa->sadb_sa_encrypt)
@@ -1306,16 +1315,16 @@ static status_t add_sa(private_kernel_pfkey_ipsec_t *this,
}
DBG2(DBG_KNL, " using encryption algorithm %N with key size %d",
encryption_algorithm_names, enc_alg, enc_key.len * 8);
-
+
key = (struct sadb_key*)PFKEY_EXT_ADD_NEXT(msg);
key->sadb_key_exttype = SADB_EXT_KEY_ENCRYPT;
key->sadb_key_bits = enc_key.len * 8;
key->sadb_key_len = PFKEY_LEN(sizeof(struct sadb_key) + enc_key.len);
memcpy(key + 1, enc_key.ptr, enc_key.len);
-
+
PFKEY_EXT_ADD(msg, key);
}
-
+
if (int_alg != AUTH_UNDEFINED)
{
if (!sa->sadb_sa_auth)
@@ -1326,16 +1335,16 @@ static status_t add_sa(private_kernel_pfkey_ipsec_t *this,
}
DBG2(DBG_KNL, " using integrity algorithm %N with key size %d",
integrity_algorithm_names, int_alg, int_key.len * 8);
-
+
key = (struct sadb_key*)PFKEY_EXT_ADD_NEXT(msg);
key->sadb_key_exttype = SADB_EXT_KEY_AUTH;
key->sadb_key_bits = int_key.len * 8;
key->sadb_key_len = PFKEY_LEN(sizeof(struct sadb_key) + int_key.len);
memcpy(key + 1, int_key.ptr, int_key.len);
-
+
PFKEY_EXT_ADD(msg, key);
}
-
+
if (ipcomp != IPCOMP_NONE)
{
/*TODO*/
@@ -1347,7 +1356,7 @@ static status_t add_sa(private_kernel_pfkey_ipsec_t *this,
add_encap_ext(msg, src, dst);
}
#endif /*HAVE_NATT*/
-
+
if (pfkey_send(this, msg, &out, &len) != SUCCESS)
{
DBG1(DBG_KNL, "unable to add SAD entry with SPI %.8x", ntohl(spi));
@@ -1360,7 +1369,7 @@ static status_t add_sa(private_kernel_pfkey_ipsec_t *this,
free(out);
return FAILED;
}
-
+
free(out);
return SUCCESS;
}
@@ -1379,7 +1388,7 @@ static status_t update_sa(private_kernel_pfkey_ipsec_t *this,
struct sadb_sa *sa;
pfkey_msg_t response;
size_t len;
-
+
/* we can't update the SA if any of the ip addresses have changed.
* that's because we can't use SADB_UPDATE and by deleting and readding the
* SA the sequence numbers would get lost */
@@ -1390,28 +1399,28 @@ static status_t update_sa(private_kernel_pfkey_ipsec_t *this,
" are not supported", ntohl(spi));
return NOT_SUPPORTED;
}
-
+
memset(&request, 0, sizeof(request));
-
+
DBG2(DBG_KNL, "querying SAD entry with SPI %.8x", ntohl(spi));
-
+
msg = (struct sadb_msg*)request;
msg->sadb_msg_version = PF_KEY_V2;
msg->sadb_msg_type = SADB_GET;
msg->sadb_msg_satype = proto_ike2satype(protocol);
msg->sadb_msg_len = PFKEY_LEN(sizeof(struct sadb_msg));
-
+
sa = (struct sadb_sa*)PFKEY_EXT_ADD_NEXT(msg);
sa->sadb_sa_exttype = SADB_EXT_SA;
sa->sadb_sa_len = PFKEY_LEN(sizeof(struct sadb_sa));
sa->sadb_sa_spi = spi;
PFKEY_EXT_ADD(msg, sa);
-
+
/* the kernel wants a SADB_EXT_ADDRESS_SRC to be present even though
* it is not used for anything. */
add_anyaddr_ext(msg, dst->get_family(dst), SADB_EXT_ADDRESS_SRC);
add_addr_ext(msg, dst, SADB_EXT_ADDRESS_DST, 0, 0);
-
+
if (pfkey_send(this, msg, &out, &len) != SUCCESS)
{
DBG1(DBG_KNL, "unable to query SAD entry with SPI %.8x",
@@ -1432,18 +1441,18 @@ static status_t update_sa(private_kernel_pfkey_ipsec_t *this,
free(out);
return FAILED;
}
-
+
DBG2(DBG_KNL, "updating SAD entry with SPI %.8x from %#H..%#H to %#H..%#H",
ntohl(spi), src, dst, new_src, new_dst);
-
+
memset(&request, 0, sizeof(request));
-
+
msg = (struct sadb_msg*)request;
msg->sadb_msg_version = PF_KEY_V2;
msg->sadb_msg_type = SADB_UPDATE;
msg->sadb_msg_satype = proto_ike2satype(protocol);
msg->sadb_msg_len = PFKEY_LEN(sizeof(struct sadb_msg));
-
+
#ifdef __APPLE__
{
struct sadb_sa_2 *sa_2;
@@ -1460,32 +1469,32 @@ static status_t update_sa(private_kernel_pfkey_ipsec_t *this,
PFKEY_EXT_COPY(msg, response.sa);
#endif
PFKEY_EXT_COPY(msg, response.x_sa2);
-
+
PFKEY_EXT_COPY(msg, response.src);
PFKEY_EXT_COPY(msg, response.dst);
-
+
PFKEY_EXT_COPY(msg, response.lft_soft);
PFKEY_EXT_COPY(msg, response.lft_hard);
-
+
if (response.key_encr)
{
PFKEY_EXT_COPY(msg, response.key_encr);
}
-
+
if (response.key_auth)
{
PFKEY_EXT_COPY(msg, response.key_auth);
}
-
+
#ifdef HAVE_NATT
if (new_encap)
{
add_encap_ext(msg, new_src, new_dst);
}
#endif /*HAVE_NATT*/
-
+
free(out);
-
+
if (pfkey_send(this, msg, &out, &len) != SUCCESS)
{
DBG1(DBG_KNL, "unable to update SAD entry with SPI %.8x", ntohl(spi));
@@ -1499,7 +1508,7 @@ static status_t update_sa(private_kernel_pfkey_ipsec_t *this,
return FAILED;
}
free(out);
-
+
return SUCCESS;
}
@@ -1515,29 +1524,29 @@ static status_t query_sa(private_kernel_pfkey_ipsec_t *this, host_t *src,
struct sadb_sa *sa;
pfkey_msg_t response;
size_t len;
-
+
memset(&request, 0, sizeof(request));
-
+
DBG2(DBG_KNL, "querying SAD entry with SPI %.8x", ntohl(spi));
-
+
msg = (struct sadb_msg*)request;
msg->sadb_msg_version = PF_KEY_V2;
msg->sadb_msg_type = SADB_GET;
msg->sadb_msg_satype = proto_ike2satype(protocol);
msg->sadb_msg_len = PFKEY_LEN(sizeof(struct sadb_msg));
-
+
sa = (struct sadb_sa*)PFKEY_EXT_ADD_NEXT(msg);
sa->sadb_sa_exttype = SADB_EXT_SA;
sa->sadb_sa_len = PFKEY_LEN(sizeof(struct sadb_sa));
sa->sadb_sa_spi = spi;
PFKEY_EXT_ADD(msg, sa);
-
+
/* the Linux Kernel doesn't care for the src address, but other systems do
* (e.g. FreeBSD)
*/
add_addr_ext(msg, src, SADB_EXT_ADDRESS_SRC, 0, 0);
add_addr_ext(msg, dst, SADB_EXT_ADDRESS_DST, 0, 0);
-
+
if (pfkey_send(this, msg, &out, &len) != SUCCESS)
{
DBG1(DBG_KNL, "unable to query SAD entry with SPI %.8x", ntohl(spi));
@@ -1573,29 +1582,29 @@ static status_t del_sa(private_kernel_pfkey_ipsec_t *this, host_t *src,
struct sadb_msg *msg, *out;
struct sadb_sa *sa;
size_t len;
-
+
memset(&request, 0, sizeof(request));
-
+
DBG2(DBG_KNL, "deleting SAD entry with SPI %.8x", ntohl(spi));
-
+
msg = (struct sadb_msg*)request;
msg->sadb_msg_version = PF_KEY_V2;
msg->sadb_msg_type = SADB_DELETE;
msg->sadb_msg_satype = proto_ike2satype(protocol);
msg->sadb_msg_len = PFKEY_LEN(sizeof(struct sadb_msg));
-
+
sa = (struct sadb_sa*)PFKEY_EXT_ADD_NEXT(msg);
sa->sadb_sa_exttype = SADB_EXT_SA;
sa->sadb_sa_len = PFKEY_LEN(sizeof(struct sadb_sa));
sa->sadb_sa_spi = spi;
PFKEY_EXT_ADD(msg, sa);
-
+
/* the Linux Kernel doesn't care for the src address, but other systems do
* (e.g. FreeBSD)
*/
add_addr_ext(msg, src, SADB_EXT_ADDRESS_SRC, 0, 0);
add_addr_ext(msg, dst, SADB_EXT_ADDRESS_DST, 0, 0);
-
+
if (pfkey_send(this, msg, &out, &len) != SUCCESS)
{
DBG1(DBG_KNL, "unable to delete SAD entry with SPI %.8x", ntohl(spi));
@@ -1608,7 +1617,7 @@ static status_t del_sa(private_kernel_pfkey_ipsec_t *this, host_t *src,
free(out);
return FAILED;
}
-
+
DBG2(DBG_KNL, "deleted SAD entry with SPI %.8x", ntohl(spi));
free(out);
return SUCCESS;
@@ -1633,16 +1642,16 @@ static status_t add_policy(private_kernel_pfkey_ipsec_t *this,
policy_entry_t *policy, *found = NULL;
pfkey_msg_t response;
size_t len;
-
+
if (dir2kernel(direction) == IPSEC_DIR_INVALID)
{
/* FWD policies are not supported on all platforms */
return SUCCESS;
}
-
+
/* create a policy */
policy = create_policy_entry(src_ts, dst_ts, direction, reqid);
-
+
/* find a matching policy */
this->mutex->lock(this->mutex);
if (this->policies->find_first(this->policies,
@@ -1662,18 +1671,18 @@ static status_t add_policy(private_kernel_pfkey_ipsec_t *this,
this->policies->insert_last(this->policies, policy);
policy->refcount = 1;
}
-
+
memset(&request, 0, sizeof(request));
-
+
DBG2(DBG_KNL, "adding policy %R === %R %N", src_ts, dst_ts,
policy_dir_names, direction);
-
+
msg = (struct sadb_msg*)request;
msg->sadb_msg_version = PF_KEY_V2;
msg->sadb_msg_type = found ? SADB_X_SPDUPDATE : SADB_X_SPDADD;
msg->sadb_msg_satype = 0;
msg->sadb_msg_len = PFKEY_LEN(sizeof(struct sadb_msg));
-
+
pol = (struct sadb_x_policy*)PFKEY_EXT_ADD_NEXT(msg);
pol->sadb_x_policy_exttype = SADB_X_EXT_POLICY;
pol->sadb_x_policy_len = PFKEY_LEN(sizeof(struct sadb_x_policy));
@@ -1687,7 +1696,7 @@ static status_t add_policy(private_kernel_pfkey_ipsec_t *this,
pol->sadb_x_policy_priority -= policy->src.proto != IPSEC_PROTO_ANY ? 2 : 0;
pol->sadb_x_policy_priority -= policy->src.net->get_port(policy->src.net) ? 1 : 0;
#endif
-
+
/* one or more sadb_x_ipsecrequest extensions are added to the sadb_x_policy extension */
req = (struct sadb_x_ipsecrequest*)(pol + 1);
req->sadb_x_ipsecrequest_proto = proto_ike2ip(protocol);
@@ -1707,15 +1716,15 @@ static status_t add_policy(private_kernel_pfkey_ipsec_t *this,
memcpy((u_int8_t*)(req + 1) + sl, sa, sl);
req->sadb_x_ipsecrequest_len += sl * 2;
}
-
+
pol->sadb_x_policy_len += PFKEY_LEN(req->sadb_x_ipsecrequest_len);
PFKEY_EXT_ADD(msg, pol);
-
+
add_addr_ext(msg, policy->src.net, SADB_EXT_ADDRESS_SRC, policy->src.proto,
policy->src.mask);
add_addr_ext(msg, policy->dst.net, SADB_EXT_ADDRESS_DST, policy->dst.proto,
policy->dst.mask);
-
+
#ifdef __FreeBSD__
{ /* on FreeBSD a lifetime has to be defined to be able to later query
* the current use time. */
@@ -1727,9 +1736,9 @@ static status_t add_policy(private_kernel_pfkey_ipsec_t *this,
PFKEY_EXT_ADD(msg, lft);
}
#endif
-
+
this->mutex->unlock(this->mutex);
-
+
if (pfkey_send(this, msg, &out, &len) != SUCCESS)
{
DBG1(DBG_KNL, "unable to add policy %R === %R %N", src_ts, dst_ts,
@@ -1751,9 +1760,9 @@ static status_t add_policy(private_kernel_pfkey_ipsec_t *this,
free(out);
return FAILED;
}
-
+
this->mutex->lock(this->mutex);
-
+
/* we try to find the policy again and update the kernel index */
if (this->policies->find_last(this->policies, NULL, (void**)&policy) != SUCCESS)
{
@@ -1765,7 +1774,7 @@ static status_t add_policy(private_kernel_pfkey_ipsec_t *this,
}
policy->index = response.x_policy->sadb_x_policy_id;
free(out);
-
+
/* install a route, if:
* - we are NOT updating a policy
* - this is a forward policy (to just get one for each child)
@@ -1778,7 +1787,7 @@ static status_t add_policy(private_kernel_pfkey_ipsec_t *this,
this->install_routes)
{
route_entry_t *route = malloc_thing(route_entry_t);
-
+
if (charon->kernel_interface->get_address_by_ts(charon->kernel_interface,
dst_ts, &route->src_ip) == SUCCESS)
{
@@ -1789,7 +1798,7 @@ static status_t add_policy(private_kernel_pfkey_ipsec_t *this,
charon->kernel_interface, dst);
route->dst_net = chunk_clone(policy->src.net->get_address(policy->src.net));
route->prefixlen = policy->src.mask;
-
+
switch (charon->kernel_interface->add_route(charon->kernel_interface,
route->dst_net, route->prefixlen, route->gateway,
route->src_ip, route->if_name))
@@ -1813,9 +1822,9 @@ static status_t add_policy(private_kernel_pfkey_ipsec_t *this,
free(route);
}
}
-
+
this->mutex->unlock(this->mutex);
-
+
return SUCCESS;
}
@@ -1833,19 +1842,19 @@ static status_t query_policy(private_kernel_pfkey_ipsec_t *this,
policy_entry_t *policy, *found = NULL;
pfkey_msg_t response;
size_t len;
-
+
if (dir2kernel(direction) == IPSEC_DIR_INVALID)
{
/* FWD policies are not supported on all platforms */
return NOT_FOUND;
}
-
+
DBG2(DBG_KNL, "querying policy %R === %R %N", src_ts, dst_ts,
policy_dir_names, direction);
/* create a policy */
policy = create_policy_entry(src_ts, dst_ts, direction, 0);
-
+
/* find a matching policy */
this->mutex->lock(this->mutex);
if (this->policies->find_first(this->policies,
@@ -1859,15 +1868,15 @@ static status_t query_policy(private_kernel_pfkey_ipsec_t *this,
}
policy_entry_destroy(policy);
policy = found;
-
+
memset(&request, 0, sizeof(request));
-
+
msg = (struct sadb_msg*)request;
msg->sadb_msg_version = PF_KEY_V2;
msg->sadb_msg_type = SADB_X_SPDGET;
msg->sadb_msg_satype = 0;
msg->sadb_msg_len = PFKEY_LEN(sizeof(struct sadb_msg));
-
+
pol = (struct sadb_x_policy*)PFKEY_EXT_ADD_NEXT(msg);
pol->sadb_x_policy_exttype = SADB_X_EXT_POLICY;
pol->sadb_x_policy_id = policy->index;
@@ -1875,14 +1884,14 @@ static status_t query_policy(private_kernel_pfkey_ipsec_t *this,
pol->sadb_x_policy_dir = dir2kernel(direction);
pol->sadb_x_policy_type = IPSEC_POLICY_IPSEC;
PFKEY_EXT_ADD(msg, pol);
-
+
add_addr_ext(msg, policy->src.net, SADB_EXT_ADDRESS_SRC, policy->src.proto,
policy->src.mask);
add_addr_ext(msg, policy->dst.net, SADB_EXT_ADDRESS_DST, policy->dst.proto,
policy->dst.mask);
-
+
this->mutex->unlock(this->mutex);
-
+
if (pfkey_send(this, msg, &out, &len) != SUCCESS)
{
DBG1(DBG_KNL, "unable to query policy %R === %R %N", src_ts, dst_ts,
@@ -1911,11 +1920,18 @@ static status_t query_policy(private_kernel_pfkey_ipsec_t *this,
free(out);
return FAILED;
}
-
- *use_time = response.lft_current->sadb_lifetime_usetime;
-
+ /* we need the monotonic time, but the kernel returns system time. */
+ if (response.lft_current->sadb_lifetime_usetime)
+ {
+ *use_time = time_monotonic(NULL) -
+ (time(NULL) - response.lft_current->sadb_lifetime_usetime);
+ }
+ else
+ {
+ *use_time = 0;
+ }
free(out);
-
+
return SUCCESS;
}
@@ -1933,19 +1949,19 @@ static status_t del_policy(private_kernel_pfkey_ipsec_t *this,
policy_entry_t *policy, *found = NULL;
route_entry_t *route;
size_t len;
-
+
if (dir2kernel(direction) == IPSEC_DIR_INVALID)
{
/* FWD policies are not supported on all platforms */
return SUCCESS;
}
-
+
DBG2(DBG_KNL, "deleting policy %R === %R %N", src_ts, dst_ts,
policy_dir_names, direction);
-
+
/* create a policy */
policy = create_policy_entry(src_ts, dst_ts, direction, 0);
-
+
/* find a matching policy */
this->mutex->lock(this->mutex);
if (this->policies->find_first(this->policies,
@@ -1973,31 +1989,31 @@ static status_t del_policy(private_kernel_pfkey_ipsec_t *this,
return NOT_FOUND;
}
this->mutex->unlock(this->mutex);
-
+
memset(&request, 0, sizeof(request));
-
+
msg = (struct sadb_msg*)request;
msg->sadb_msg_version = PF_KEY_V2;
msg->sadb_msg_type = SADB_X_SPDDELETE;
msg->sadb_msg_satype = 0;
msg->sadb_msg_len = PFKEY_LEN(sizeof(struct sadb_msg));
-
+
pol = (struct sadb_x_policy*)PFKEY_EXT_ADD_NEXT(msg);
pol->sadb_x_policy_exttype = SADB_X_EXT_POLICY;
pol->sadb_x_policy_len = PFKEY_LEN(sizeof(struct sadb_x_policy));
pol->sadb_x_policy_dir = dir2kernel(direction);
pol->sadb_x_policy_type = IPSEC_POLICY_IPSEC;
PFKEY_EXT_ADD(msg, pol);
-
+
add_addr_ext(msg, policy->src.net, SADB_EXT_ADDRESS_SRC, policy->src.proto,
policy->src.mask);
add_addr_ext(msg, policy->dst.net, SADB_EXT_ADDRESS_DST, policy->dst.proto,
policy->dst.mask);
-
+
route = policy->route;
policy->route = NULL;
policy_entry_destroy(policy);
-
+
if (pfkey_send(this, msg, &out, &len) != SUCCESS)
{
DBG1(DBG_KNL, "unable to delete policy %R === %R %N", src_ts, dst_ts,
@@ -2013,7 +2029,7 @@ static status_t del_policy(private_kernel_pfkey_ipsec_t *this,
return FAILED;
}
free(out);
-
+
if (route)
{
if (charon->kernel_interface->del_route(charon->kernel_interface,
@@ -2026,7 +2042,7 @@ static status_t del_policy(private_kernel_pfkey_ipsec_t *this,
}
route_entry_destroy(route);
}
-
+
return SUCCESS;
}
@@ -2038,15 +2054,15 @@ static status_t register_pfkey_socket(private_kernel_pfkey_ipsec_t *this, u_int8
unsigned char request[PFKEY_BUFFER_SIZE];
struct sadb_msg *msg, *out;
size_t len;
-
+
memset(&request, 0, sizeof(request));
-
+
msg = (struct sadb_msg*)request;
msg->sadb_msg_version = PF_KEY_V2;
msg->sadb_msg_type = SADB_REGISTER;
msg->sadb_msg_satype = satype;
msg->sadb_msg_len = PFKEY_LEN(sizeof(struct sadb_msg));
-
+
if (pfkey_send_socket(this, this->socket_events, msg, &out, &len) != SUCCESS)
{
DBG1(DBG_KNL, "unable to register PF_KEY socket");
@@ -2085,13 +2101,13 @@ static bool add_bypass_policies(private_kernel_pfkey_ipsec_t *this)
int fd, family, port;
enumerator_t *sockets;
bool status = TRUE;
-
+
sockets = charon->socket->create_enumerator(charon->socket);
while (sockets->enumerate(sockets, &fd, &family, &port))
{
struct sadb_x_policy policy;
u_int sol, ipsec_policy;
-
+
switch (family)
{
case AF_INET:
@@ -2109,12 +2125,12 @@ static bool add_bypass_policies(private_kernel_pfkey_ipsec_t *this)
default:
continue;
}
-
+
memset(&policy, 0, sizeof(policy));
policy.sadb_x_policy_len = sizeof(policy) / sizeof(u_int64_t);
policy.sadb_x_policy_exttype = SADB_X_EXT_POLICY;
policy.sadb_x_policy_type = IPSEC_POLICY_BYPASS;
-
+
policy.sadb_x_policy_dir = IPSEC_DIR_OUTBOUND;
if (setsockopt(fd, sol, ipsec_policy, &policy, sizeof(policy)) < 0)
{
@@ -2142,18 +2158,18 @@ static bool add_bypass_policies(private_kernel_pfkey_ipsec_t *this)
kernel_pfkey_ipsec_t *kernel_pfkey_ipsec_create()
{
private_kernel_pfkey_ipsec_t *this = malloc_thing(private_kernel_pfkey_ipsec_t);
-
+
/* public functions */
this->public.interface.get_spi = (status_t(*)(kernel_ipsec_t*,host_t*,host_t*,protocol_id_t,u_int32_t,u_int32_t*))get_spi;
this->public.interface.get_cpi = (status_t(*)(kernel_ipsec_t*,host_t*,host_t*,u_int32_t,u_int16_t*))get_cpi;
- this->public.interface.add_sa = (status_t(*)(kernel_ipsec_t *,host_t*,host_t*,u_int32_t,protocol_id_t,u_int32_t,u_int64_t,u_int64_t,u_int16_t,chunk_t,u_int16_t,chunk_t,ipsec_mode_t,u_int16_t,u_int16_t,bool,bool))add_sa;
+ this->public.interface.add_sa = (status_t(*)(kernel_ipsec_t *,host_t*,host_t*,u_int32_t,protocol_id_t,u_int32_t,lifetime_cfg_t*,u_int16_t,chunk_t,u_int16_t,chunk_t,ipsec_mode_t,u_int16_t,u_int16_t,bool,bool,traffic_selector_t*,traffic_selector_t*))add_sa;
this->public.interface.update_sa = (status_t(*)(kernel_ipsec_t*,u_int32_t,protocol_id_t,u_int16_t,host_t*,host_t*,host_t*,host_t*,bool,bool))update_sa;
this->public.interface.query_sa = (status_t(*)(kernel_ipsec_t*,host_t*,host_t*,u_int32_t,protocol_id_t,u_int64_t*))query_sa;
this->public.interface.del_sa = (status_t(*)(kernel_ipsec_t*,host_t*,host_t*,u_int32_t,protocol_id_t,u_int16_t))del_sa;
this->public.interface.add_policy = (status_t(*)(kernel_ipsec_t*,host_t*,host_t*,traffic_selector_t*,traffic_selector_t*,policy_dir_t,u_int32_t,protocol_id_t,u_int32_t,ipsec_mode_t,u_int16_t,u_int16_t,bool))add_policy;
this->public.interface.query_policy = (status_t(*)(kernel_ipsec_t*,traffic_selector_t*,traffic_selector_t*,policy_dir_t,u_int32_t*))query_policy;
this->public.interface.del_policy = (status_t(*)(kernel_ipsec_t*,traffic_selector_t*,traffic_selector_t*,policy_dir_t,bool))del_policy;
-
+
this->public.interface.destroy = (void(*)(kernel_ipsec_t*)) destroy;
/* private members */
@@ -2163,37 +2179,37 @@ kernel_pfkey_ipsec_t *kernel_pfkey_ipsec_create()
this->install_routes = lib->settings->get_bool(lib->settings,
"charon.install_routes", TRUE);
this->seq = 0;
-
+
/* create a PF_KEY socket to communicate with the kernel */
this->socket = socket(PF_KEY, SOCK_RAW, PF_KEY_V2);
if (this->socket <= 0)
{
charon->kill(charon, "unable to create PF_KEY socket");
}
-
+
/* create a PF_KEY socket for ACQUIRE & EXPIRE */
this->socket_events = socket(PF_KEY, SOCK_RAW, PF_KEY_V2);
if (this->socket_events <= 0)
{
charon->kill(charon, "unable to create PF_KEY event socket");
}
-
+
/* add bypass policies on the sockets used by charon */
if (!add_bypass_policies(this))
{
charon->kill(charon, "unable to add bypass policies on sockets");
}
-
+
/* register the event socket */
if (register_pfkey_socket(this, SADB_SATYPE_ESP) != SUCCESS ||
register_pfkey_socket(this, SADB_SATYPE_AH) != SUCCESS)
{
charon->kill(charon, "unable to register PF_KEY event socket");
}
-
+
this->job = callback_job_create((callback_job_cb_t)receive_events,
this, NULL, NULL);
charon->processor->queue_job(charon->processor, (job_t*)this->job);
-
+
return &this->public;
}
diff --git a/src/charon/plugins/kernel_pfkey/kernel_pfkey_plugin.c b/src/charon/plugins/kernel_pfkey/kernel_pfkey_plugin.c
index 09dc4780d..3380c328c 100644
--- a/src/charon/plugins/kernel_pfkey/kernel_pfkey_plugin.c
+++ b/src/charon/plugins/kernel_pfkey/kernel_pfkey_plugin.c
@@ -47,10 +47,10 @@ static void destroy(private_kernel_pfkey_plugin_t *this)
plugin_t *plugin_create()
{
private_kernel_pfkey_plugin_t *this = malloc_thing(private_kernel_pfkey_plugin_t);
-
+
this->public.plugin.destroy = (void(*)(plugin_t*))destroy;
-
+
charon->kernel_interface->add_ipsec_interface(charon->kernel_interface, (kernel_ipsec_constructor_t)kernel_pfkey_ipsec_create);
-
+
return &this->public.plugin;
}
diff --git a/src/charon/plugins/kernel_pfroute/Makefile.am b/src/charon/plugins/kernel_pfroute/Makefile.am
index b6e6587a7..0065d9b0a 100644
--- a/src/charon/plugins/kernel_pfroute/Makefile.am
+++ b/src/charon/plugins/kernel_pfroute/Makefile.am
@@ -1,5 +1,5 @@
-INCLUDES = -I${linuxdir} -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
+INCLUDES = -I${linux_headers} -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
AM_CFLAGS = -rdynamic
diff --git a/src/charon/plugins/kernel_pfroute/Makefile.in b/src/charon/plugins/kernel_pfroute/Makefile.in
index 05da8e271..da8c7585f 100644
--- a/src/charon/plugins/kernel_pfroute/Makefile.in
+++ b/src/charon/plugins/kernel_pfroute/Makefile.in
@@ -1,8 +1,9 @@
-# Makefile.in generated by automake 1.10.2 from Makefile.am.
+# Makefile.in generated by automake 1.11 from Makefile.am.
# @configure_input@
# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,
-# 2003, 2004, 2005, 2006, 2007, 2008 Free Software Foundation, Inc.
+# 2003, 2004, 2005, 2006, 2007, 2008, 2009 Free Software Foundation,
+# Inc.
# This Makefile.in is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.
@@ -16,8 +17,9 @@
VPATH = @srcdir@
pkgdatadir = $(datadir)/@PACKAGE@
-pkglibdir = $(libdir)/@PACKAGE@
pkgincludedir = $(includedir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkglibexecdir = $(libexecdir)/@PACKAGE@
am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
install_sh_DATA = $(install_sh) -c -m 644
install_sh_PROGRAM = $(install_sh) -c
@@ -35,19 +37,41 @@ host_triplet = @host@
subdir = src/charon/plugins/kernel_pfroute
DIST_COMMON = $(srcdir)/Makefile.am $(srcdir)/Makefile.in
ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
-am__aclocal_m4_deps = $(top_srcdir)/configure.in
+am__aclocal_m4_deps = $(top_srcdir)/m4/config/libtool.m4 \
+ $(top_srcdir)/m4/config/ltoptions.m4 \
+ $(top_srcdir)/m4/config/ltsugar.m4 \
+ $(top_srcdir)/m4/config/ltversion.m4 \
+ $(top_srcdir)/m4/config/lt~obsolete.m4 \
+ $(top_srcdir)/m4/macros/with.m4 \
+ $(top_srcdir)/m4/macros/enable-disable.m4 \
+ $(top_srcdir)/configure.in
am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
$(ACLOCAL_M4)
mkinstalldirs = $(install_sh) -d
CONFIG_CLEAN_FILES =
+CONFIG_CLEAN_VPATH_FILES =
am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
am__vpath_adj = case $$p in \
$(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
*) f=$$p;; \
esac;
-am__strip_dir = `echo $$p | sed -e 's|^.*/||'`;
+am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
+am__install_max = 40
+am__nobase_strip_setup = \
+ srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
+am__nobase_strip = \
+ for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
+am__nobase_list = $(am__nobase_strip_setup); \
+ for p in $$list; do echo "$$p $$p"; done | \
+ sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
+ $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
+ if (++n[$$2] == $(am__install_max)) \
+ { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
+ END { for (dir in files) print dir, files[dir] }'
+am__base_list = \
+ sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
+ sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
am__installdirs = "$(DESTDIR)$(plugindir)"
-pluginLTLIBRARIES_INSTALL = $(INSTALL)
LTLIBRARIES = $(plugin_LTLIBRARIES)
libstrongswan_kernel_pfroute_la_LIBADD =
am_libstrongswan_kernel_pfroute_la_OBJECTS = kernel_pfroute_plugin.lo \
@@ -61,6 +85,7 @@ libstrongswan_kernel_pfroute_la_LINK = $(LIBTOOL) --tag=CC \
DEFAULT_INCLUDES = -I.@am__isrc@
depcomp = $(SHELL) $(top_srcdir)/depcomp
am__depfiles_maybe = depfiles
+am__mv = mv -f
COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
LTCOMPILE = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
@@ -108,25 +133,22 @@ INSTALL_DATA = @INSTALL_DATA@
INSTALL_PROGRAM = @INSTALL_PROGRAM@
INSTALL_SCRIPT = @INSTALL_SCRIPT@
INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
-IPSEC_ROUTING_TABLE = @IPSEC_ROUTING_TABLE@
-IPSEC_ROUTING_TABLE_PRIO = @IPSEC_ROUTING_TABLE_PRIO@
LD = @LD@
LDFLAGS = @LDFLAGS@
LEX = @LEX@
LEXLIB = @LEXLIB@
LEX_OUTPUT_ROOT = @LEX_OUTPUT_ROOT@
-LIBGCRYPT_CFLAGS = @LIBGCRYPT_CFLAGS@
-LIBGCRYPT_CONFIG = @LIBGCRYPT_CONFIG@
-LIBGCRYPT_LIBS = @LIBGCRYPT_LIBS@
LIBOBJS = @LIBOBJS@
LIBS = @LIBS@
LIBTOOL = @LIBTOOL@
-LINUX_HEADERS = @LINUX_HEADERS@
LIPO = @LIPO@
LN_S = @LN_S@
LTLIBOBJS = @LTLIBOBJS@
MAKEINFO = @MAKEINFO@
MKDIR_P = @MKDIR_P@
+MYSQLCFLAG = @MYSQLCFLAG@
+MYSQLCONFIG = @MYSQLCONFIG@
+MYSQLLIB = @MYSQLLIB@
NM = @NM@
NMEDIT = @NMEDIT@
OBJDUMP = @OBJDUMP@
@@ -138,11 +160,14 @@ PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
PACKAGE_NAME = @PACKAGE_NAME@
PACKAGE_STRING = @PACKAGE_STRING@
PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_URL = @PACKAGE_URL@
PACKAGE_VERSION = @PACKAGE_VERSION@
PATH_SEPARATOR = @PATH_SEPARATOR@
PERL = @PERL@
PKG_CONFIG = @PKG_CONFIG@
+PTHREADLIB = @PTHREADLIB@
RANLIB = @RANLIB@
+RTLIB = @RTLIB@
RUBY = @RUBY@
RUBYINCLUDE = @RUBYINCLUDE@
SED = @SED@
@@ -171,9 +196,9 @@ build_cpu = @build_cpu@
build_os = @build_os@
build_vendor = @build_vendor@
builddir = @builddir@
-confdir = @confdir@
datadir = @datadir@
datarootdir = @datarootdir@
+default_pkcs11 = @default_pkcs11@
docdir = @docdir@
dvidir = @dvidir@
exec_prefix = @exec_prefix@
@@ -196,7 +221,7 @@ ipsecuser = @ipsecuser@
libdir = @libdir@
libexecdir = @libexecdir@
libstrongswan_plugins = @libstrongswan_plugins@
-linuxdir = @linuxdir@
+linux_headers = @linux_headers@
localedir = @localedir@
localstatedir = @localstatedir@
lt_ECHO = @lt_ECHO@
@@ -204,6 +229,7 @@ mandir = @mandir@
mkdir_p = @mkdir_p@
nm_CFLAGS = @nm_CFLAGS@
nm_LIBS = @nm_LIBS@
+nm_ca_dir = @nm_ca_dir@
oldincludedir = @oldincludedir@
pdfdir = @pdfdir@
piddir = @piddir@
@@ -212,10 +238,12 @@ pluto_plugins = @pluto_plugins@
prefix = @prefix@
program_transform_name = @program_transform_name@
psdir = @psdir@
+random_device = @random_device@
resolv_conf = @resolv_conf@
+routing_table = @routing_table@
+routing_table_prio = @routing_table_prio@
sbindir = @sbindir@
sharedstatedir = @sharedstatedir@
-simreader = @simreader@
srcdir = @srcdir@
strongswan_conf = @strongswan_conf@
sysconfdir = @sysconfdir@
@@ -223,9 +251,10 @@ target_alias = @target_alias@
top_build_prefix = @top_build_prefix@
top_builddir = @top_builddir@
top_srcdir = @top_srcdir@
+urandom_device = @urandom_device@
xml_CFLAGS = @xml_CFLAGS@
xml_LIBS = @xml_LIBS@
-INCLUDES = -I${linuxdir} -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
+INCLUDES = -I${linux_headers} -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
AM_CFLAGS = -rdynamic
plugin_LTLIBRARIES = libstrongswan-kernel-pfroute.la
libstrongswan_kernel_pfroute_la_SOURCES = kernel_pfroute_plugin.h kernel_pfroute_plugin.c \
@@ -245,9 +274,9 @@ $(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps)
exit 1;; \
esac; \
done; \
- echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/charon/plugins/kernel_pfroute/Makefile'; \
- cd $(top_srcdir) && \
- $(AUTOMAKE) --gnu src/charon/plugins/kernel_pfroute/Makefile
+ echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/charon/plugins/kernel_pfroute/Makefile'; \
+ $(am__cd) $(top_srcdir) && \
+ $(AUTOMAKE) --gnu src/charon/plugins/kernel_pfroute/Makefile
.PRECIOUS: Makefile
Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
@case '$?' in \
@@ -265,23 +294,28 @@ $(top_srcdir)/configure: $(am__configure_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
$(ACLOCAL_M4): $(am__aclocal_m4_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(am__aclocal_m4_deps):
install-pluginLTLIBRARIES: $(plugin_LTLIBRARIES)
@$(NORMAL_INSTALL)
test -z "$(plugindir)" || $(MKDIR_P) "$(DESTDIR)$(plugindir)"
- @list='$(plugin_LTLIBRARIES)'; for p in $$list; do \
+ @list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+ list2=; for p in $$list; do \
if test -f $$p; then \
- f=$(am__strip_dir) \
- echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(pluginLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) '$$p' '$(DESTDIR)$(plugindir)/$$f'"; \
- $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(pluginLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) "$$p" "$(DESTDIR)$(plugindir)/$$f"; \
+ list2="$$list2 $$p"; \
else :; fi; \
- done
+ done; \
+ test -z "$$list2" || { \
+ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(plugindir)'"; \
+ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(plugindir)"; \
+ }
uninstall-pluginLTLIBRARIES:
@$(NORMAL_UNINSTALL)
- @list='$(plugin_LTLIBRARIES)'; for p in $$list; do \
- p=$(am__strip_dir) \
- echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$p'"; \
- $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$p"; \
+ @list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+ for p in $$list; do \
+ $(am__strip_dir) \
+ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$f'"; \
+ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$f"; \
done
clean-pluginLTLIBRARIES:
@@ -306,21 +340,21 @@ distclean-compile:
.c.o:
@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(COMPILE) -c $<
.c.obj:
@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(COMPILE) -c `$(CYGPATH_W) '$<'`
.c.lo:
@am__fastdepCC_TRUE@ $(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(LTCOMPILE) -c -o $@ $<
@@ -343,7 +377,7 @@ tags: TAGS
TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
$(TAGS_FILES) $(LISP)
- tags=; \
+ set x; \
here=`pwd`; \
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
unique=`for i in $$list; do \
@@ -351,29 +385,34 @@ TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
- if test -z "$(ETAGS_ARGS)$$tags$$unique"; then :; else \
+ shift; \
+ if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
test -n "$$unique" || unique=$$empty_fix; \
- $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
- $$tags $$unique; \
+ if test $$# -gt 0; then \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ "$$@" $$unique; \
+ else \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ $$unique; \
+ fi; \
fi
ctags: CTAGS
CTAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
$(TAGS_FILES) $(LISP)
- tags=; \
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
unique=`for i in $$list; do \
if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
- test -z "$(CTAGS_ARGS)$$tags$$unique" \
+ test -z "$(CTAGS_ARGS)$$unique" \
|| $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
- $$tags $$unique
+ $$unique
GTAGS:
here=`$(am__cd) $(top_builddir) && pwd` \
- && cd $(top_srcdir) \
- && gtags -i $(GTAGS_ARGS) $$here
+ && $(am__cd) $(top_srcdir) \
+ && gtags -i $(GTAGS_ARGS) "$$here"
distclean-tags:
-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
@@ -394,13 +433,17 @@ distdir: $(DISTFILES)
if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
if test -d $$d/$$file; then \
dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
+ if test -d "$(distdir)/$$file"; then \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+ fi; \
if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
- cp -pR $(srcdir)/$$file $(distdir)$$dir || exit 1; \
+ cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
fi; \
- cp -pR $$d/$$file $(distdir)$$dir || exit 1; \
+ cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
else \
- test -f $(distdir)/$$file \
- || cp -p $$d/$$file $(distdir)/$$file \
+ test -f "$(distdir)/$$file" \
+ || cp -p $$d/$$file "$(distdir)/$$file" \
|| exit 1; \
fi; \
done
@@ -431,6 +474,7 @@ clean-generic:
distclean-generic:
-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+ -test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
maintainer-clean-generic:
@echo "This command is intended for maintainers to use"
@@ -452,6 +496,8 @@ dvi-am:
html: html-am
+html-am:
+
info: info-am
info-am:
@@ -460,18 +506,28 @@ install-data-am: install-pluginLTLIBRARIES
install-dvi: install-dvi-am
+install-dvi-am:
+
install-exec-am:
install-html: install-html-am
+install-html-am:
+
install-info: install-info-am
+install-info-am:
+
install-man:
install-pdf: install-pdf-am
+install-pdf-am:
+
install-ps: install-ps-am
+install-ps-am:
+
installcheck-am:
maintainer-clean: maintainer-clean-am
@@ -510,6 +566,7 @@ uninstall-am: uninstall-pluginLTLIBRARIES
mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \
tags uninstall uninstall-am uninstall-pluginLTLIBRARIES
+
# Tell versions [3.59,3.63) of GNU make to not export all variables.
# Otherwise a system limit (for SysV at least) may be exceeded.
.NOEXPORT:
diff --git a/src/charon/plugins/kernel_pfroute/kernel_pfroute_net.c b/src/charon/plugins/kernel_pfroute/kernel_pfroute_net.c
index d5a864b1c..9f1baf5b5 100644
--- a/src/charon/plugins/kernel_pfroute/kernel_pfroute_net.c
+++ b/src/charon/plugins/kernel_pfroute/kernel_pfroute_net.c
@@ -19,14 +19,14 @@
#include <ifaddrs.h>
#include <net/route.h>
#include <unistd.h>
-#include <pthread.h>
#include <errno.h>
#include "kernel_pfroute_net.h"
#include <daemon.h>
#include <utils/host.h>
-#include <utils/mutex.h>
+#include <threading/thread.h>
+#include <threading/mutex.h>
#include <utils/linked_list.h>
#include <processing/jobs/callback_job.h>
#include <processing/jobs/roam_job.h>
@@ -47,13 +47,13 @@ typedef struct addr_entry_t addr_entry_t;
* IP address in an inface_entry_t
*/
struct addr_entry_t {
-
+
/** The ip address */
host_t *ip;
-
+
/** virtual IP managed by us */
bool virtual;
-
+
/** Number of times this IP is used, if virtual */
u_int refcount;
};
@@ -73,16 +73,16 @@ typedef struct iface_entry_t iface_entry_t;
* A network interface on this system, containing addr_entry_t's
*/
struct iface_entry_t {
-
+
/** interface index */
int ifindex;
-
+
/** name of the interface */
char ifname[IFNAMSIZ];
-
+
/** interface flags, as in netdevice(7) SIOCGIFFLAGS */
u_int flags;
-
+
/** list of addresses as host_t */
linked_list_t *addrs;
};
@@ -108,46 +108,46 @@ struct private_kernel_pfroute_net_t
* Public part of the kernel_pfroute_t object.
*/
kernel_pfroute_net_t public;
-
+
/**
* mutex to lock access to various lists
*/
mutex_t *mutex;
-
+
/**
* Cached list of interfaces and their addresses (iface_entry_t)
*/
linked_list_t *ifaces;
-
+
/**
* job receiving PF_ROUTE events
*/
callback_job_t *job;
-
+
/**
* mutex to lock access to the PF_ROUTE socket
*/
mutex_t *mutex_pfroute;
-
+
/**
* PF_ROUTE socket to communicate with the kernel
*/
int socket;
-
+
/**
* PF_ROUTE socket to receive events
*/
int socket_events;
-
+
/**
* sequence number for messages sent to the kernel
*/
int seq;
-
+
/**
* time of last roam job
*/
- struct timeval last_roam;
+ timeval_t last_roam;
};
/**
@@ -156,22 +156,20 @@ struct private_kernel_pfroute_net_t
*/
static void fire_roam_job(private_kernel_pfroute_net_t *this, bool address)
{
- struct timeval now;
-
- if (gettimeofday(&now, NULL) == 0)
+ timeval_t now;
+
+ time_monotonic(&now);
+ if (timercmp(&now, &this->last_roam, >))
{
- if (timercmp(&now, &this->last_roam, >))
+ now.tv_usec += ROAM_DELAY * 1000;
+ while (now.tv_usec > 1000000)
{
- now.tv_usec += ROAM_DELAY * 1000;
- while (now.tv_usec > 1000000)
- {
- now.tv_sec++;
- now.tv_usec -= 1000000;
- }
- this->last_roam = now;
- charon->scheduler->schedule_job_ms(charon->scheduler,
- (job_t*)roam_job_create(address), ROAM_DELAY);
+ now.tv_sec++;
+ now.tv_usec -= 1000000;
}
+ this->last_roam = now;
+ charon->scheduler->schedule_job_ms(charon->scheduler,
+ (job_t*)roam_job_create(address), ROAM_DELAY);
}
}
@@ -189,7 +187,7 @@ static void process_addr(private_kernel_pfroute_net_t *this,
addr_entry_t *addr;
bool found = FALSE, changed = FALSE, roam = FALSE;
int i;
-
+
for (i = 1; i < (1 << RTAX_MAX); i <<= 1)
{
if (ifa->ifam_addrs & i)
@@ -202,12 +200,12 @@ static void process_addr(private_kernel_pfroute_net_t *this,
sockaddr = (sockaddr_t*)((char*)sockaddr + sockaddr->sa_len);
}
}
-
+
if (!host)
{
return;
}
-
+
this->mutex->lock(this->mutex);
ifaces = this->ifaces->create_enumerator(this->ifaces);
while (ifaces->enumerate(ifaces, &iface))
@@ -238,7 +236,7 @@ static void process_addr(private_kernel_pfroute_net_t *this,
}
}
addrs->destroy(addrs);
-
+
if (!found && ifa->ifam_type == RTM_NEWADDR)
{
changed = TRUE;
@@ -249,7 +247,7 @@ static void process_addr(private_kernel_pfroute_net_t *this,
iface->addrs->insert_last(iface->addrs, addr);
DBG1(DBG_KNL, "%H appeared on %s", host, iface->ifname);
}
-
+
if (changed && (iface->flags & IFF_UP))
{
roam = TRUE;
@@ -260,7 +258,7 @@ static void process_addr(private_kernel_pfroute_net_t *this,
ifaces->destroy(ifaces);
this->mutex->unlock(this->mutex);
host->destroy(host);
-
+
if (roam)
{
fire_roam_job(this, TRUE);
@@ -277,12 +275,12 @@ static void process_link(private_kernel_pfroute_net_t *this,
enumerator_t *enumerator;
iface_entry_t *iface;
bool roam = FALSE;
-
+
if (msg->ifm_flags & IFF_LOOPBACK)
{ /* ignore loopback interfaces */
return;
}
-
+
this->mutex->lock(this->mutex);
enumerator = this->ifaces->create_enumerator(this->ifaces);
while (enumerator->enumerate(enumerator, &iface))
@@ -305,7 +303,7 @@ static void process_link(private_kernel_pfroute_net_t *this,
}
enumerator->destroy(enumerator);
this->mutex->unlock(this->mutex);
-
+
if (roam)
{
fire_roam_job(this, TRUE);
@@ -328,12 +326,13 @@ static job_requeue_t receive_events(private_kernel_pfroute_net_t *this)
{
unsigned char buf[PFROUTE_BUFFER_SIZE];
struct rt_msghdr *msg = (struct rt_msghdr*)buf;
- int len, oldstate;
-
- pthread_setcancelstate(PTHREAD_CANCEL_ENABLE, &oldstate);
+ int len;
+ bool oldstate;
+
+ oldstate = thread_cancelability(TRUE);
len = recvfrom(this->socket_events, buf, sizeof(buf), 0, NULL, 0);
- pthread_setcancelstate(oldstate, NULL);
-
+ thread_cancelability(oldstate);
+
if (len < 0)
{
switch (errno)
@@ -350,14 +349,14 @@ static job_requeue_t receive_events(private_kernel_pfroute_net_t *this)
return JOB_REQUEUE_FAIR;
}
}
-
+
if (len < sizeof(msg->rtm_msglen) || len < msg->rtm_msglen ||
msg->rtm_version != RTM_VERSION)
{
DBG2(DBG_KNL, "received corrupted PF_ROUTE message");
return JOB_REQUEUE_DIRECT;
}
-
+
switch (msg->rtm_type)
{
case RTM_NEWADDR:
@@ -374,7 +373,7 @@ static job_requeue_t receive_events(private_kernel_pfroute_net_t *this)
default:
break;
}
-
+
return JOB_REQUEUE_DIRECT;
}
@@ -493,7 +492,7 @@ static char *get_interface_name(private_kernel_pfroute_net_t *this, host_t* ip)
}
ifaces->destroy(ifaces);
this->mutex->unlock(this->mutex);
-
+
if (name)
{
DBG2(DBG_KNL, "%H is on interface %s", ip, name);
@@ -566,15 +565,15 @@ static status_t init_address_list(private_kernel_pfroute_net_t *this)
iface_entry_t *iface, *current;
addr_entry_t *addr;
enumerator_t *ifaces, *addrs;
-
+
DBG1(DBG_KNL, "listening on interfaces:");
-
+
if (getifaddrs(&ifap) < 0)
{
DBG1(DBG_KNL, " failed to get interfaces!");
return FAILED;
}
-
+
for (ifa = ifap; ifa != NULL; ifa = ifa->ifa_next)
{
if (ifa->ifa_addr == NULL)
@@ -591,7 +590,7 @@ static status_t init_address_list(private_kernel_pfroute_net_t *this)
{ /* ignore loopback interfaces */
continue;
}
-
+
iface = NULL;
ifaces = this->ifaces->create_enumerator(this->ifaces);
while (ifaces->enumerate(ifaces, &current))
@@ -603,7 +602,7 @@ static status_t init_address_list(private_kernel_pfroute_net_t *this)
}
}
ifaces->destroy(ifaces);
-
+
if (!iface)
{
iface = malloc_thing(iface_entry_t);
@@ -613,7 +612,7 @@ static status_t init_address_list(private_kernel_pfroute_net_t *this)
iface->addrs = linked_list_create();
this->ifaces->insert_last(this->ifaces, iface);
}
-
+
if (ifa->ifa_addr->sa_family != AF_LINK)
{
addr = malloc_thing(addr_entry_t);
@@ -626,7 +625,7 @@ static status_t init_address_list(private_kernel_pfroute_net_t *this)
}
}
freeifaddrs(ifap);
-
+
ifaces = this->ifaces->create_enumerator(this->ifaces);
while (ifaces->enumerate(ifaces, &iface))
{
@@ -642,7 +641,7 @@ static status_t init_address_list(private_kernel_pfroute_net_t *this)
}
}
ifaces->destroy(ifaces);
-
+
return SUCCESS;
}
@@ -666,7 +665,7 @@ static void destroy(private_kernel_pfroute_net_t *this)
kernel_pfroute_net_t *kernel_pfroute_net_create()
{
private_kernel_pfroute_net_t *this = malloc_thing(private_kernel_pfroute_net_t);
-
+
/* public functions */
this->public.interface.get_interface = (char*(*)(kernel_net_t*,host_t*))get_interface_name;
this->public.interface.create_address_enumerator = (enumerator_t*(*)(kernel_net_t*,bool,bool))create_address_enumerator;
@@ -676,38 +675,38 @@ kernel_pfroute_net_t *kernel_pfroute_net_create()
this->public.interface.del_ip = (status_t(*)(kernel_net_t*,host_t*)) del_ip;
this->public.interface.add_route = (status_t(*)(kernel_net_t*,chunk_t,u_int8_t,host_t*,host_t*,char*)) add_route;
this->public.interface.del_route = (status_t(*)(kernel_net_t*,chunk_t,u_int8_t,host_t*,host_t*,char*)) del_route;
-
+
this->public.interface.destroy = (void(*)(kernel_net_t*)) destroy;
-
+
/* private members */
this->ifaces = linked_list_create();
this->mutex = mutex_create(MUTEX_TYPE_DEFAULT);
this->mutex_pfroute = mutex_create(MUTEX_TYPE_DEFAULT);
-
+
this->seq = 0;
-
+
/* create a PF_ROUTE socket to communicate with the kernel */
this->socket = socket(PF_ROUTE, SOCK_RAW, AF_UNSPEC);
if (this->socket <= 0)
{
charon->kill(charon, "unable to create PF_ROUTE socket");
}
-
+
/* create a PF_ROUTE socket to receive events */
this->socket_events = socket(PF_ROUTE, SOCK_RAW, AF_UNSPEC);
if (this->socket_events <= 0)
{
charon->kill(charon, "unable to create PF_ROUTE event socket");
}
-
+
this->job = callback_job_create((callback_job_cb_t)receive_events,
this, NULL, NULL);
charon->processor->queue_job(charon->processor, (job_t*)this->job);
-
+
if (init_address_list(this) != SUCCESS)
{
charon->kill(charon, "unable to get interface list");
}
-
+
return &this->public;
}
diff --git a/src/charon/plugins/kernel_pfroute/kernel_pfroute_plugin.c b/src/charon/plugins/kernel_pfroute/kernel_pfroute_plugin.c
index 767049bb0..e73cbeafb 100644
--- a/src/charon/plugins/kernel_pfroute/kernel_pfroute_plugin.c
+++ b/src/charon/plugins/kernel_pfroute/kernel_pfroute_plugin.c
@@ -48,11 +48,11 @@ static void destroy(private_kernel_pfroute_plugin_t *this)
plugin_t *plugin_create()
{
private_kernel_pfroute_plugin_t *this = malloc_thing(private_kernel_pfroute_plugin_t);
-
+
this->public.plugin.destroy = (void(*)(plugin_t*))destroy;
-
+
charon->kernel_interface->add_net_interface(charon->kernel_interface,
(kernel_net_constructor_t)kernel_pfroute_net_create);
-
+
return &this->public.plugin;
}
diff --git a/src/charon/plugins/load_tester/Makefile.in b/src/charon/plugins/load_tester/Makefile.in
index 3b494cea2..70c7d3c99 100644
--- a/src/charon/plugins/load_tester/Makefile.in
+++ b/src/charon/plugins/load_tester/Makefile.in
@@ -1,8 +1,9 @@
-# Makefile.in generated by automake 1.10.2 from Makefile.am.
+# Makefile.in generated by automake 1.11 from Makefile.am.
# @configure_input@
# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,
-# 2003, 2004, 2005, 2006, 2007, 2008 Free Software Foundation, Inc.
+# 2003, 2004, 2005, 2006, 2007, 2008, 2009 Free Software Foundation,
+# Inc.
# This Makefile.in is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.
@@ -16,8 +17,9 @@
VPATH = @srcdir@
pkgdatadir = $(datadir)/@PACKAGE@
-pkglibdir = $(libdir)/@PACKAGE@
pkgincludedir = $(includedir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkglibexecdir = $(libexecdir)/@PACKAGE@
am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
install_sh_DATA = $(install_sh) -c -m 644
install_sh_PROGRAM = $(install_sh) -c
@@ -35,19 +37,41 @@ host_triplet = @host@
subdir = src/charon/plugins/load_tester
DIST_COMMON = $(srcdir)/Makefile.am $(srcdir)/Makefile.in
ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
-am__aclocal_m4_deps = $(top_srcdir)/configure.in
+am__aclocal_m4_deps = $(top_srcdir)/m4/config/libtool.m4 \
+ $(top_srcdir)/m4/config/ltoptions.m4 \
+ $(top_srcdir)/m4/config/ltsugar.m4 \
+ $(top_srcdir)/m4/config/ltversion.m4 \
+ $(top_srcdir)/m4/config/lt~obsolete.m4 \
+ $(top_srcdir)/m4/macros/with.m4 \
+ $(top_srcdir)/m4/macros/enable-disable.m4 \
+ $(top_srcdir)/configure.in
am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
$(ACLOCAL_M4)
mkinstalldirs = $(install_sh) -d
CONFIG_CLEAN_FILES =
+CONFIG_CLEAN_VPATH_FILES =
am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
am__vpath_adj = case $$p in \
$(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
*) f=$$p;; \
esac;
-am__strip_dir = `echo $$p | sed -e 's|^.*/||'`;
+am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
+am__install_max = 40
+am__nobase_strip_setup = \
+ srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
+am__nobase_strip = \
+ for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
+am__nobase_list = $(am__nobase_strip_setup); \
+ for p in $$list; do echo "$$p $$p"; done | \
+ sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
+ $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
+ if (++n[$$2] == $(am__install_max)) \
+ { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
+ END { for (dir in files) print dir, files[dir] }'
+am__base_list = \
+ sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
+ sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
am__installdirs = "$(DESTDIR)$(plugindir)"
-pluginLTLIBRARIES_INSTALL = $(INSTALL)
LTLIBRARIES = $(plugin_LTLIBRARIES)
libstrongswan_load_tester_la_LIBADD =
am_libstrongswan_load_tester_la_OBJECTS = load_tester_plugin.lo \
@@ -63,6 +87,7 @@ libstrongswan_load_tester_la_LINK = $(LIBTOOL) --tag=CC \
DEFAULT_INCLUDES = -I.@am__isrc@
depcomp = $(SHELL) $(top_srcdir)/depcomp
am__depfiles_maybe = depfiles
+am__mv = mv -f
COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
LTCOMPILE = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
@@ -110,25 +135,22 @@ INSTALL_DATA = @INSTALL_DATA@
INSTALL_PROGRAM = @INSTALL_PROGRAM@
INSTALL_SCRIPT = @INSTALL_SCRIPT@
INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
-IPSEC_ROUTING_TABLE = @IPSEC_ROUTING_TABLE@
-IPSEC_ROUTING_TABLE_PRIO = @IPSEC_ROUTING_TABLE_PRIO@
LD = @LD@
LDFLAGS = @LDFLAGS@
LEX = @LEX@
LEXLIB = @LEXLIB@
LEX_OUTPUT_ROOT = @LEX_OUTPUT_ROOT@
-LIBGCRYPT_CFLAGS = @LIBGCRYPT_CFLAGS@
-LIBGCRYPT_CONFIG = @LIBGCRYPT_CONFIG@
-LIBGCRYPT_LIBS = @LIBGCRYPT_LIBS@
LIBOBJS = @LIBOBJS@
LIBS = @LIBS@
LIBTOOL = @LIBTOOL@
-LINUX_HEADERS = @LINUX_HEADERS@
LIPO = @LIPO@
LN_S = @LN_S@
LTLIBOBJS = @LTLIBOBJS@
MAKEINFO = @MAKEINFO@
MKDIR_P = @MKDIR_P@
+MYSQLCFLAG = @MYSQLCFLAG@
+MYSQLCONFIG = @MYSQLCONFIG@
+MYSQLLIB = @MYSQLLIB@
NM = @NM@
NMEDIT = @NMEDIT@
OBJDUMP = @OBJDUMP@
@@ -140,11 +162,14 @@ PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
PACKAGE_NAME = @PACKAGE_NAME@
PACKAGE_STRING = @PACKAGE_STRING@
PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_URL = @PACKAGE_URL@
PACKAGE_VERSION = @PACKAGE_VERSION@
PATH_SEPARATOR = @PATH_SEPARATOR@
PERL = @PERL@
PKG_CONFIG = @PKG_CONFIG@
+PTHREADLIB = @PTHREADLIB@
RANLIB = @RANLIB@
+RTLIB = @RTLIB@
RUBY = @RUBY@
RUBYINCLUDE = @RUBYINCLUDE@
SED = @SED@
@@ -173,9 +198,9 @@ build_cpu = @build_cpu@
build_os = @build_os@
build_vendor = @build_vendor@
builddir = @builddir@
-confdir = @confdir@
datadir = @datadir@
datarootdir = @datarootdir@
+default_pkcs11 = @default_pkcs11@
docdir = @docdir@
dvidir = @dvidir@
exec_prefix = @exec_prefix@
@@ -198,7 +223,7 @@ ipsecuser = @ipsecuser@
libdir = @libdir@
libexecdir = @libexecdir@
libstrongswan_plugins = @libstrongswan_plugins@
-linuxdir = @linuxdir@
+linux_headers = @linux_headers@
localedir = @localedir@
localstatedir = @localstatedir@
lt_ECHO = @lt_ECHO@
@@ -206,6 +231,7 @@ mandir = @mandir@
mkdir_p = @mkdir_p@
nm_CFLAGS = @nm_CFLAGS@
nm_LIBS = @nm_LIBS@
+nm_ca_dir = @nm_ca_dir@
oldincludedir = @oldincludedir@
pdfdir = @pdfdir@
piddir = @piddir@
@@ -214,10 +240,12 @@ pluto_plugins = @pluto_plugins@
prefix = @prefix@
program_transform_name = @program_transform_name@
psdir = @psdir@
+random_device = @random_device@
resolv_conf = @resolv_conf@
+routing_table = @routing_table@
+routing_table_prio = @routing_table_prio@
sbindir = @sbindir@
sharedstatedir = @sharedstatedir@
-simreader = @simreader@
srcdir = @srcdir@
strongswan_conf = @strongswan_conf@
sysconfdir = @sysconfdir@
@@ -225,6 +253,7 @@ target_alias = @target_alias@
top_build_prefix = @top_build_prefix@
top_builddir = @top_builddir@
top_srcdir = @top_srcdir@
+urandom_device = @urandom_device@
xml_CFLAGS = @xml_CFLAGS@
xml_LIBS = @xml_LIBS@
INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
@@ -252,9 +281,9 @@ $(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps)
exit 1;; \
esac; \
done; \
- echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/charon/plugins/load_tester/Makefile'; \
- cd $(top_srcdir) && \
- $(AUTOMAKE) --gnu src/charon/plugins/load_tester/Makefile
+ echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/charon/plugins/load_tester/Makefile'; \
+ $(am__cd) $(top_srcdir) && \
+ $(AUTOMAKE) --gnu src/charon/plugins/load_tester/Makefile
.PRECIOUS: Makefile
Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
@case '$?' in \
@@ -272,23 +301,28 @@ $(top_srcdir)/configure: $(am__configure_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
$(ACLOCAL_M4): $(am__aclocal_m4_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(am__aclocal_m4_deps):
install-pluginLTLIBRARIES: $(plugin_LTLIBRARIES)
@$(NORMAL_INSTALL)
test -z "$(plugindir)" || $(MKDIR_P) "$(DESTDIR)$(plugindir)"
- @list='$(plugin_LTLIBRARIES)'; for p in $$list; do \
+ @list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+ list2=; for p in $$list; do \
if test -f $$p; then \
- f=$(am__strip_dir) \
- echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(pluginLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) '$$p' '$(DESTDIR)$(plugindir)/$$f'"; \
- $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(pluginLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) "$$p" "$(DESTDIR)$(plugindir)/$$f"; \
+ list2="$$list2 $$p"; \
else :; fi; \
- done
+ done; \
+ test -z "$$list2" || { \
+ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(plugindir)'"; \
+ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(plugindir)"; \
+ }
uninstall-pluginLTLIBRARIES:
@$(NORMAL_UNINSTALL)
- @list='$(plugin_LTLIBRARIES)'; for p in $$list; do \
- p=$(am__strip_dir) \
- echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$p'"; \
- $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$p"; \
+ @list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+ for p in $$list; do \
+ $(am__strip_dir) \
+ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$f'"; \
+ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$f"; \
done
clean-pluginLTLIBRARIES:
@@ -317,21 +351,21 @@ distclean-compile:
.c.o:
@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(COMPILE) -c $<
.c.obj:
@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(COMPILE) -c `$(CYGPATH_W) '$<'`
.c.lo:
@am__fastdepCC_TRUE@ $(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(LTCOMPILE) -c -o $@ $<
@@ -354,7 +388,7 @@ tags: TAGS
TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
$(TAGS_FILES) $(LISP)
- tags=; \
+ set x; \
here=`pwd`; \
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
unique=`for i in $$list; do \
@@ -362,29 +396,34 @@ TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
- if test -z "$(ETAGS_ARGS)$$tags$$unique"; then :; else \
+ shift; \
+ if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
test -n "$$unique" || unique=$$empty_fix; \
- $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
- $$tags $$unique; \
+ if test $$# -gt 0; then \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ "$$@" $$unique; \
+ else \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ $$unique; \
+ fi; \
fi
ctags: CTAGS
CTAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
$(TAGS_FILES) $(LISP)
- tags=; \
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
unique=`for i in $$list; do \
if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
- test -z "$(CTAGS_ARGS)$$tags$$unique" \
+ test -z "$(CTAGS_ARGS)$$unique" \
|| $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
- $$tags $$unique
+ $$unique
GTAGS:
here=`$(am__cd) $(top_builddir) && pwd` \
- && cd $(top_srcdir) \
- && gtags -i $(GTAGS_ARGS) $$here
+ && $(am__cd) $(top_srcdir) \
+ && gtags -i $(GTAGS_ARGS) "$$here"
distclean-tags:
-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
@@ -405,13 +444,17 @@ distdir: $(DISTFILES)
if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
if test -d $$d/$$file; then \
dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
+ if test -d "$(distdir)/$$file"; then \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+ fi; \
if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
- cp -pR $(srcdir)/$$file $(distdir)$$dir || exit 1; \
+ cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
fi; \
- cp -pR $$d/$$file $(distdir)$$dir || exit 1; \
+ cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
else \
- test -f $(distdir)/$$file \
- || cp -p $$d/$$file $(distdir)/$$file \
+ test -f "$(distdir)/$$file" \
+ || cp -p $$d/$$file "$(distdir)/$$file" \
|| exit 1; \
fi; \
done
@@ -442,6 +485,7 @@ clean-generic:
distclean-generic:
-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+ -test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
maintainer-clean-generic:
@echo "This command is intended for maintainers to use"
@@ -463,6 +507,8 @@ dvi-am:
html: html-am
+html-am:
+
info: info-am
info-am:
@@ -471,18 +517,28 @@ install-data-am: install-pluginLTLIBRARIES
install-dvi: install-dvi-am
+install-dvi-am:
+
install-exec-am:
install-html: install-html-am
+install-html-am:
+
install-info: install-info-am
+install-info-am:
+
install-man:
install-pdf: install-pdf-am
+install-pdf-am:
+
install-ps: install-ps-am
+install-ps-am:
+
installcheck-am:
maintainer-clean: maintainer-clean-am
@@ -521,6 +577,7 @@ uninstall-am: uninstall-pluginLTLIBRARIES
mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \
tags uninstall uninstall-am uninstall-pluginLTLIBRARIES
+
# Tell versions [3.59,3.63) of GNU make to not export all variables.
# Otherwise a system limit (for SysV at least) may be exceeded.
.NOEXPORT:
diff --git a/src/charon/plugins/load_tester/load_tester_config.c b/src/charon/plugins/load_tester/load_tester_config.c
index 963f7cc01..82f408d45 100644
--- a/src/charon/plugins/load_tester/load_tester_config.c
+++ b/src/charon/plugins/load_tester/load_tester_config.c
@@ -28,52 +28,52 @@ struct private_load_tester_config_t {
* Public part
*/
load_tester_config_t public;
-
+
/**
* peer config
*/
peer_cfg_t *peer_cfg;
-
+
/**
* virtual IP, if any
*/
host_t *vip;
-
+
/**
* Remote address
*/
char *remote;
-
+
/**
* IP address pool
*/
char *pool;
-
+
/**
- * IKE proposal
- */
+ * IKE proposal
+ */
proposal_t *proposal;
-
+
/**
* Authentication method(s) to use/expect from initiator
*/
char *initiator_auth;
-
+
/**
* Authentication method(s) use/expected from responder
*/
char *responder_auth;
-
+
/**
* IKE_SA rekeying delay
*/
u_int ike_rekey;
-
+
/**
* CHILD_SA rekeying delay
*/
u_int child_rekey;
-
+
/**
* incremental numbering of generated configs
*/
@@ -93,13 +93,13 @@ static void generate_auth_cfg(private_load_tester_config_t *this, char *str,
eap_type_t type;
char buf[128];
int rnd = 0;
-
+
enumerator = enumerator_create_token(str, "|", " ");
while (enumerator->enumerate(enumerator, &str))
{
auth = auth_cfg_create();
rnd++;
-
+
if (streq(str, "psk"))
{ /* PSK authentication, use FQDNs */
class = AUTH_CLASS_PSK;
@@ -181,7 +181,14 @@ static peer_cfg_t* generate_config(private_load_tester_config_t *this, uint num)
peer_cfg_t *peer_cfg;
traffic_selector_t *ts;
proposal_t *proposal;
-
+ lifetime_cfg_t lifetime = {
+ .time = {
+ .life = this->child_rekey * 2,
+ .rekey = this->child_rekey,
+ .jitter = 0
+ }
+ };
+
ike_cfg = ike_cfg_create(FALSE, FALSE, "0.0.0.0", this->remote);
ike_cfg->add_proposal(ike_cfg, this->proposal->clone(this->proposal));
peer_cfg = peer_cfg_create("load-test", 2, ike_cfg,
@@ -201,9 +208,9 @@ static peer_cfg_t* generate_config(private_load_tester_config_t *this, uint num)
generate_auth_cfg(this, this->responder_auth, peer_cfg, TRUE, num);
generate_auth_cfg(this, this->initiator_auth, peer_cfg, FALSE, num);
}
- child_cfg = child_cfg_create("load-test", this->child_rekey * 2,
- this->child_rekey, 0, NULL, TRUE,
- MODE_TUNNEL, ACTION_NONE, ACTION_NONE, FALSE);
+
+ child_cfg = child_cfg_create("load-test", &lifetime, NULL, TRUE,
+ MODE_TUNNEL, ACTION_NONE, ACTION_NONE, FALSE, 0);
proposal = proposal_create_from_string(PROTO_ESP, "aes128-sha1");
child_cfg->add_proposal(child_cfg, proposal);
ts = traffic_selector_create_dynamic(0, 0, 65535);
@@ -218,7 +225,7 @@ static peer_cfg_t* generate_config(private_load_tester_config_t *this, uint num)
* Implementation of backend_t.create_peer_cfg_enumerator.
*/
static enumerator_t* create_peer_cfg_enumerator(private_load_tester_config_t *this,
- identification_t *me,
+ identification_t *me,
identification_t *other)
{
return enumerator_create_single(this->peer_cfg, NULL);
@@ -266,44 +273,44 @@ static void destroy(private_load_tester_config_t *this)
load_tester_config_t *load_tester_config_create()
{
private_load_tester_config_t *this = malloc_thing(private_load_tester_config_t);
-
+
this->public.backend.create_peer_cfg_enumerator = (enumerator_t*(*)(backend_t*, identification_t *me, identification_t *other))create_peer_cfg_enumerator;
this->public.backend.create_ike_cfg_enumerator = (enumerator_t*(*)(backend_t*, host_t *me, host_t *other))create_ike_cfg_enumerator;
this->public.backend.get_peer_cfg_by_name = (peer_cfg_t* (*)(backend_t*,char*))get_peer_cfg_by_name;
this->public.destroy = (void(*)(load_tester_config_t*))destroy;
-
+
this->vip = NULL;
if (lib->settings->get_bool(lib->settings,
- "charon.plugins.load_tester.request_virtual_ip", FALSE))
+ "charon.plugins.load-tester.request_virtual_ip", FALSE))
{
this->vip = host_create_from_string("0.0.0.0", 0);
}
this->pool = lib->settings->get_str(lib->settings,
- "charon.plugins.load_tester.pool", NULL);
- this->remote = lib->settings->get_str(lib->settings,
- "charon.plugins.load_tester.remote", "127.0.0.1");
-
+ "charon.plugins.load-tester.pool", NULL);
+ this->remote = lib->settings->get_str(lib->settings,
+ "charon.plugins.load-tester.remote", "127.0.0.1");
+
this->proposal = proposal_create_from_string(PROTO_IKE,
lib->settings->get_str(lib->settings,
- "charon.plugins.load_tester.proposal", "aes128-sha1-modp768"));
+ "charon.plugins.load-tester.proposal", "aes128-sha1-modp768"));
if (!this->proposal)
{ /* fallback */
this->proposal = proposal_create_from_string(PROTO_IKE,
"aes128-sha1-modp768");
}
this->ike_rekey = lib->settings->get_int(lib->settings,
- "charon.plugins.load_tester.ike_rekey", 0);
+ "charon.plugins.load-tester.ike_rekey", 0);
this->child_rekey = lib->settings->get_int(lib->settings,
- "charon.plugins.load_tester.child_rekey", 600);
-
+ "charon.plugins.load-tester.child_rekey", 600);
+
this->initiator_auth = lib->settings->get_str(lib->settings,
- "charon.plugins.load_tester.initiator_auth", "pubkey");
+ "charon.plugins.load-tester.initiator_auth", "pubkey");
this->responder_auth = lib->settings->get_str(lib->settings,
- "charon.plugins.load_tester.responder_auth", "pubkey");
-
+ "charon.plugins.load-tester.responder_auth", "pubkey");
+
this->num = 1;
this->peer_cfg = generate_config(this, 0);
-
+
return &this->public;
}
diff --git a/src/charon/plugins/load_tester/load_tester_config.h b/src/charon/plugins/load_tester/load_tester_config.h
index f09a3f832..c22387743 100644
--- a/src/charon/plugins/load_tester/load_tester_config.h
+++ b/src/charon/plugins/load_tester/load_tester_config.h
@@ -34,11 +34,11 @@ struct load_tester_config_t {
* Implements backend_t interface
*/
backend_t backend;
-
+
/**
* Destroy the backend.
*/
- void (*destroy)(load_tester_config_t *this);
+ void (*destroy)(load_tester_config_t *this);
};
/**
diff --git a/src/charon/plugins/load_tester/load_tester_creds.c b/src/charon/plugins/load_tester/load_tester_creds.c
index fdb5fa370..890703c1a 100644
--- a/src/charon/plugins/load_tester/load_tester_creds.c
+++ b/src/charon/plugins/load_tester/load_tester_creds.c
@@ -32,31 +32,26 @@ struct private_load_tester_creds_t {
* Public part
*/
load_tester_creds_t public;
-
+
/**
* Private key to create signatures
*/
private_key_t *private;
-
+
/**
* CA certificate, to issue/verify peer certificates
*/
certificate_t *ca;
-
+
/**
* serial number to issue certificates
*/
u_int32_t serial;
-
+
/**
* Preshared key
*/
shared_key_t *shared;
-
- /**
- * Identification for shared key
- */
- identification_t *id;
};
/**
@@ -195,10 +190,7 @@ static enumerator_t* create_private_enumerator(private_load_tester_creds_t *this
}
if (id)
{
- identification_t *keyid;
-
- keyid = this->private->get_id(this->private, id->get_type(id));
- if (!keyid || !keyid->equals(keyid, id))
+ if (!this->private->has_fingerprint(this->private, id->get_encoding(id)))
{
return NULL;
}
@@ -217,8 +209,7 @@ static enumerator_t* create_cert_enumerator(private_load_tester_creds_t *this,
public_key_t *peer_key, *ca_key;
u_int32_t serial;
time_t now;
- identification_t *keyid = NULL;
-
+
if (this->ca == NULL)
{
return NULL;
@@ -231,18 +222,24 @@ static enumerator_t* create_cert_enumerator(private_load_tester_creds_t *this,
{
return NULL;
}
+ if (!id)
+ {
+ return enumerator_create_single(this->ca, NULL);
+ }
ca_key = this->ca->get_public_key(this->ca);
- if (ca_key && id)
+ if (ca_key)
{
- keyid = ca_key->get_id(ca_key, id->get_type(id));
+ if (ca_key->has_fingerprint(ca_key, id->get_encoding(id)))
+ {
+ ca_key->destroy(ca_key);
+ return enumerator_create_single(this->ca, NULL);
+ }
+ ca_key->destroy(ca_key);
}
- if (!id || this->ca->has_subject(this->ca, id) ||
- (keyid && id->equals(id, keyid)))
- { /* ca certificate */
- DESTROY_IF(ca_key);
+ if (this->ca->has_subject(this->ca, id))
+ {
return enumerator_create_single(this->ca, NULL);
}
- DESTROY_IF(ca_key);
if (!trusted)
{
/* peer certificate, generate on demand */
@@ -270,22 +267,10 @@ static enumerator_t* create_cert_enumerator(private_load_tester_creds_t *this,
/**
* Implements credential_set_t.create_shared_enumerator
*/
-static enumerator_t* create_shared_enumerator(private_load_tester_creds_t *this,
+static enumerator_t* create_shared_enumerator(private_load_tester_creds_t *this,
shared_key_type_t type, identification_t *me,
identification_t *other)
{
- if (type != SHARED_ANY && type != SHARED_IKE)
- {
- return NULL;
- }
- if (me && !me->matches(me, this->id))
- {
- return NULL;
- }
- if (other && !other->matches(other, this->id))
- {
- return NULL;
- }
return enumerator_create_single(this->shared, NULL);
}
@@ -297,7 +282,6 @@ static void destroy(private_load_tester_creds_t *this)
DESTROY_IF(this->private);
DESTROY_IF(this->ca);
this->shared->destroy(this->shared);
- this->id->destroy(this->id);
free(this);
}
@@ -311,19 +295,18 @@ load_tester_creds_t *load_tester_creds_create()
this->public.credential_set.create_cdp_enumerator = (enumerator_t*(*) (credential_set_t *,certificate_type_t, identification_t *))return_null;
this->public.credential_set.cache_cert = (void (*)(credential_set_t *, certificate_t *))nop;
this->public.destroy = (void(*) (load_tester_creds_t*))destroy;
-
+
this->private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, KEY_RSA,
BUILD_BLOB_ASN1_DER, chunk_create(private, sizeof(private)),
BUILD_END);
-
+
this->ca = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
BUILD_BLOB_ASN1_DER, chunk_create(cert, sizeof(cert)),
BUILD_X509_FLAG, X509_CA,
BUILD_END);
-
- this->shared = shared_key_create(SHARED_IKE,
+
+ this->shared = shared_key_create(SHARED_IKE,
chunk_clone(chunk_create(psk, sizeof(psk))));
- this->id = identification_create_from_string("CN=*, OU=load-test, O=strongSwan");
this->serial = 0;
return &this->public;
}
diff --git a/src/charon/plugins/load_tester/load_tester_creds.h b/src/charon/plugins/load_tester/load_tester_creds.h
index 60cf67795..fb3541164 100644
--- a/src/charon/plugins/load_tester/load_tester_creds.h
+++ b/src/charon/plugins/load_tester/load_tester_creds.h
@@ -34,11 +34,11 @@ struct load_tester_creds_t {
* Implements credential set interface.
*/
credential_set_t credential_set;
-
+
/**
* Destroy the backend.
*/
- void (*destroy)(load_tester_creds_t *this);
+ void (*destroy)(load_tester_creds_t *this);
};
/**
diff --git a/src/charon/plugins/load_tester/load_tester_diffie_hellman.c b/src/charon/plugins/load_tester/load_tester_diffie_hellman.c
index 87d9ef42b..d5ec3599b 100644
--- a/src/charon/plugins/load_tester/load_tester_diffie_hellman.c
+++ b/src/charon/plugins/load_tester/load_tester_diffie_hellman.c
@@ -49,19 +49,19 @@ load_tester_diffie_hellman_t *load_tester_diffie_hellman_create(
diffie_hellman_group_t group)
{
load_tester_diffie_hellman_t *this;
-
+
if (group != MODP_NULL)
{
return NULL;
}
-
+
this = malloc_thing(load_tester_diffie_hellman_t);
-
+
this->dh.get_shared_secret = (status_t (*)(diffie_hellman_t *, chunk_t *))get_shared_secret;
this->dh.set_other_public_value = (void (*)(diffie_hellman_t *, chunk_t ))nop;
this->dh.get_my_public_value = (void (*)(diffie_hellman_t *, chunk_t *))get_my_public_value;
this->dh.get_dh_group = (diffie_hellman_group_t (*)(diffie_hellman_t *))get_dh_group;
this->dh.destroy = (void (*)(diffie_hellman_t *))free;
-
+
return this;
}
diff --git a/src/charon/plugins/load_tester/load_tester_diffie_hellman.h b/src/charon/plugins/load_tester/load_tester_diffie_hellman.h
index 045c4bb4a..672157fb8 100644
--- a/src/charon/plugins/load_tester/load_tester_diffie_hellman.h
+++ b/src/charon/plugins/load_tester/load_tester_diffie_hellman.h
@@ -29,7 +29,7 @@ typedef struct load_tester_diffie_hellman_t load_tester_diffie_hellman_t;
* A NULL Diffie Hellman implementation to avoid calculation overhead in tests.
*/
struct load_tester_diffie_hellman_t {
-
+
/**
* Implements diffie_hellman_t interface.
*/
@@ -38,11 +38,11 @@ struct load_tester_diffie_hellman_t {
/**
* Creates a new gmp_diffie_hellman_t object.
- *
+ *
* @param group Diffie Hellman group, supports MODP_NULL only
* @return gmp_diffie_hellman_t object
*/
load_tester_diffie_hellman_t *load_tester_diffie_hellman_create(
diffie_hellman_group_t group);
-#endif /** LOAD_TESTER_DIFFIE_HELLMAN_ @}*/
+#endif /** LOAD_TESTER_DIFFIE_HELLMAN_H_ @}*/
diff --git a/src/charon/plugins/load_tester/load_tester_ipsec.c b/src/charon/plugins/load_tester/load_tester_ipsec.c
index e463d2adc..1218443cc 100644
--- a/src/charon/plugins/load_tester/load_tester_ipsec.c
+++ b/src/charon/plugins/load_tester/load_tester_ipsec.c
@@ -27,7 +27,7 @@ struct private_load_tester_ipsec_t {
* Public interface.
*/
load_tester_ipsec_t public;
-
+
/**
* faked SPI counter
*/
@@ -37,8 +37,8 @@ struct private_load_tester_ipsec_t {
/**
* Implementation of kernel_interface_t.get_spi.
*/
-static status_t get_spi(private_load_tester_ipsec_t *this,
- host_t *src, host_t *dst,
+static status_t get_spi(private_load_tester_ipsec_t *this,
+ host_t *src, host_t *dst,
protocol_id_t protocol, u_int32_t reqid,
u_int32_t *spi)
{
@@ -49,8 +49,8 @@ static status_t get_spi(private_load_tester_ipsec_t *this,
/**
* Implementation of kernel_interface_t.get_cpi.
*/
-static status_t get_cpi(private_load_tester_ipsec_t *this,
- host_t *src, host_t *dst,
+static status_t get_cpi(private_load_tester_ipsec_t *this,
+ host_t *src, host_t *dst,
u_int32_t reqid, u_int16_t *cpi)
{
return FAILED;
@@ -62,11 +62,12 @@ static status_t get_cpi(private_load_tester_ipsec_t *this,
static status_t add_sa(private_load_tester_ipsec_t *this,
host_t *src, host_t *dst, u_int32_t spi,
protocol_id_t protocol, u_int32_t reqid,
- u_int64_t expire_soft, u_int64_t expire_hard,
+ lifetime_cfg_t *lifetime,
u_int16_t enc_alg, chunk_t enc_key,
u_int16_t int_alg, chunk_t int_key,
ipsec_mode_t mode, u_int16_t ipcomp, u_int16_t cpi,
- bool encap, bool inbound)
+ bool encap, bool inbound, traffic_selector_t *src_ts,
+ traffic_selector_t *dst_ts)
{
return SUCCESS;
}
@@ -122,11 +123,11 @@ static status_t add_policy(private_load_tester_ipsec_t *this,
* Implementation of kernel_interface_t.query_policy.
*/
static status_t query_policy(private_load_tester_ipsec_t *this,
- traffic_selector_t *src_ts,
+ traffic_selector_t *src_ts,
traffic_selector_t *dst_ts,
policy_dir_t direction, u_int32_t *use_time)
{
- *use_time = time(NULL);
+ *use_time = time_monotonic(NULL);
return SUCCESS;
}
@@ -134,7 +135,7 @@ static status_t query_policy(private_load_tester_ipsec_t *this,
* Implementation of kernel_interface_t.del_policy.
*/
static status_t del_policy(private_load_tester_ipsec_t *this,
- traffic_selector_t *src_ts,
+ traffic_selector_t *src_ts,
traffic_selector_t *dst_ts,
policy_dir_t direction, bool unrouted)
{
@@ -155,11 +156,11 @@ static void destroy(private_load_tester_ipsec_t *this)
load_tester_ipsec_t *load_tester_ipsec_create()
{
private_load_tester_ipsec_t *this = malloc_thing(private_load_tester_ipsec_t);
-
+
/* public functions */
this->public.interface.get_spi = (status_t(*)(kernel_ipsec_t*,host_t*,host_t*,protocol_id_t,u_int32_t,u_int32_t*))get_spi;
this->public.interface.get_cpi = (status_t(*)(kernel_ipsec_t*,host_t*,host_t*,u_int32_t,u_int16_t*))get_cpi;
- this->public.interface.add_sa = (status_t(*)(kernel_ipsec_t *,host_t*,host_t*,u_int32_t,protocol_id_t,u_int32_t,u_int64_t,u_int64_t,u_int16_t,chunk_t,u_int16_t,chunk_t,ipsec_mode_t,u_int16_t,u_int16_t,bool,bool))add_sa;
+ this->public.interface.add_sa = (status_t(*)(kernel_ipsec_t *,host_t*,host_t*,u_int32_t,protocol_id_t,u_int32_t,lifetime_cfg_t*,u_int16_t,chunk_t,u_int16_t,chunk_t,ipsec_mode_t,u_int16_t,u_int16_t,bool,bool,traffic_selector_t*,traffic_selector_t*))add_sa;
this->public.interface.update_sa = (status_t(*)(kernel_ipsec_t*,u_int32_t,protocol_id_t,u_int16_t,host_t*,host_t*,host_t*,host_t*,bool,bool))update_sa;
this->public.interface.query_sa = (status_t(*)(kernel_ipsec_t*,host_t*,host_t*,u_int32_t,protocol_id_t,u_int64_t*))query_sa;
this->public.interface.del_sa = (status_t(*)(kernel_ipsec_t*,host_t*,host_t*,u_int32_t,protocol_id_t,u_int16_t))del_sa;
@@ -167,9 +168,9 @@ load_tester_ipsec_t *load_tester_ipsec_create()
this->public.interface.query_policy = (status_t(*)(kernel_ipsec_t*,traffic_selector_t*,traffic_selector_t*,policy_dir_t,u_int32_t*))query_policy;
this->public.interface.del_policy = (status_t(*)(kernel_ipsec_t*,traffic_selector_t*,traffic_selector_t*,policy_dir_t,bool))del_policy;
this->public.interface.destroy = (void(*)(kernel_ipsec_t*)) destroy;
-
+
this->spi = 0;
-
+
return &this->public;
}
diff --git a/src/charon/plugins/load_tester/load_tester_listener.c b/src/charon/plugins/load_tester/load_tester_listener.c
index fe9a90aed..96b0cf1ec 100644
--- a/src/charon/plugins/load_tester/load_tester_listener.c
+++ b/src/charon/plugins/load_tester/load_tester_listener.c
@@ -30,7 +30,7 @@ struct private_load_tester_listener_t {
* Public part
*/
load_tester_listener_t public;
-
+
/**
* Delete IKE_SA after it has been established
*/
@@ -40,7 +40,7 @@ struct private_load_tester_listener_t {
* Number of established SAs
*/
u_int established;
-
+
/**
* Shutdown the daemon if we have established this SA count
*/
@@ -56,19 +56,19 @@ static bool ike_state_change(private_load_tester_listener_t *this,
if (state == IKE_ESTABLISHED)
{
ike_sa_id_t *id = ike_sa->get_id(ike_sa);
-
+
if (this->delete_after_established)
{
charon->processor->queue_job(charon->processor,
(job_t*)delete_ike_sa_job_create(id, TRUE));
}
-
+
if (id->is_initiator(id))
{
if (this->shutdown_on == ++this->established)
{
DBG1(DBG_CFG, "load-test complete, raising SIGTERM");
- pthread_kill(charon->main_thread_id, SIGTERM);
+ kill(0, SIGTERM);
}
}
}
@@ -86,17 +86,17 @@ static void destroy(private_load_tester_listener_t *this)
load_tester_listener_t *load_tester_listener_create(u_int shutdown_on)
{
private_load_tester_listener_t *this = malloc_thing(private_load_tester_listener_t);
-
+
memset(&this->public.listener, 0, sizeof(listener_t));
this->public.listener.ike_state_change = (void*)ike_state_change;
this->public.destroy = (void(*) (load_tester_listener_t*))destroy;
-
+
this->delete_after_established = lib->settings->get_bool(lib->settings,
- "charon.plugins.load_tester.delete_after_established", FALSE);
-
+ "charon.plugins.load-tester.delete_after_established", FALSE);
+
this->shutdown_on = shutdown_on;
this->established = 0;
-
+
return &this->public;
}
diff --git a/src/charon/plugins/load_tester/load_tester_listener.h b/src/charon/plugins/load_tester/load_tester_listener.h
index 6842b3532..b9599294c 100644
--- a/src/charon/plugins/load_tester/load_tester_listener.h
+++ b/src/charon/plugins/load_tester/load_tester_listener.h
@@ -34,11 +34,11 @@ struct load_tester_listener_t {
* Implements listener set interface.
*/
listener_t listener;
-
+
/**
* Destroy the backend.
*/
- void (*destroy)(load_tester_listener_t *this);
+ void (*destroy)(load_tester_listener_t *this);
};
/**
diff --git a/src/charon/plugins/load_tester/load_tester_plugin.c b/src/charon/plugins/load_tester/load_tester_plugin.c
index 93ed2e3c5..e25f97423 100644
--- a/src/charon/plugins/load_tester/load_tester_plugin.c
+++ b/src/charon/plugins/load_tester/load_tester_plugin.c
@@ -24,7 +24,8 @@
#include <daemon.h>
#include <processing/jobs/callback_job.h>
-#include <utils/mutex.h>
+#include <threading/condvar.h>
+#include <threading/mutex.h>
typedef struct private_load_tester_plugin_t private_load_tester_plugin_t;
@@ -37,47 +38,47 @@ struct private_load_tester_plugin_t {
* implements plugin interface
*/
load_tester_plugin_t public;
-
+
/**
* load_tester configuration backend
*/
load_tester_config_t *config;
-
+
/**
* load_tester credential set implementation
*/
load_tester_creds_t *creds;
-
+
/**
* event handler, listens on bus
*/
load_tester_listener_t *listener;
-
+
/**
* number of iterations per thread
*/
int iterations;
-
+
/**
* number desired initiator threads
*/
int initiators;
-
+
/**
* currenly running initiators
*/
int running;
-
+
/**
* delay between initiations, in ms
*/
int delay;
-
+
/**
* mutex to lock running field
*/
mutex_t *mutex;
-
+
/**
* condvar to wait for initiators
*/
@@ -90,7 +91,7 @@ struct private_load_tester_plugin_t {
static job_requeue_t do_load_test(private_load_tester_plugin_t *this)
{
int i, s = 0, ms = 0;
-
+
this->mutex->lock(this->mutex);
if (!this->running)
{
@@ -102,13 +103,13 @@ static job_requeue_t do_load_test(private_load_tester_plugin_t *this)
s = this->delay / 1000;
ms = this->delay % 1000;
}
-
+
for (i = 0; this->iterations == 0 || i < this->iterations; i++)
{
peer_cfg_t *peer_cfg;
child_cfg_t *child_cfg = NULL;
enumerator_t *enumerator;
-
+
peer_cfg = charon->backends->get_peer_cfg_by_name(charon->backends,
"load-test");
if (!peer_cfg)
@@ -122,7 +123,7 @@ static job_requeue_t do_load_test(private_load_tester_plugin_t *this)
break;
}
enumerator->destroy(enumerator);
-
+
charon->controller->initiate(charon->controller,
peer_cfg, child_cfg->get_ref(child_cfg),
NULL, NULL);
@@ -176,32 +177,32 @@ plugin_t *plugin_create()
{
private_load_tester_plugin_t *this;
u_int i, shutdown_on = 0;
-
+
if (!lib->settings->get_bool(lib->settings,
- "charon.plugins.load_tester.enable", FALSE))
+ "charon.plugins.load-tester.enable", FALSE))
{
DBG1(DBG_CFG, "disabling load-tester plugin, not configured");
return NULL;
}
-
+
this = malloc_thing(private_load_tester_plugin_t);
this->public.plugin.destroy = (void(*)(plugin_t*))destroy;
-
- lib->crypto->add_dh(lib->crypto, MODP_NULL,
+
+ lib->crypto->add_dh(lib->crypto, MODP_NULL,
(dh_constructor_t)load_tester_diffie_hellman_create);
-
+
this->delay = lib->settings->get_int(lib->settings,
- "charon.plugins.load_tester.delay", 0);
+ "charon.plugins.load-tester.delay", 0);
this->iterations = lib->settings->get_int(lib->settings,
- "charon.plugins.load_tester.iterations", 1);
+ "charon.plugins.load-tester.iterations", 1);
this->initiators = lib->settings->get_int(lib->settings,
- "charon.plugins.load_tester.initiators", 0);
+ "charon.plugins.load-tester.initiators", 0);
if (lib->settings->get_bool(lib->settings,
- "charon.plugins.load_tester.shutdown_when_complete", 0))
+ "charon.plugins.load-tester.shutdown_when_complete", 0))
{
shutdown_on = this->iterations * this->initiators;
}
-
+
this->mutex = mutex_create(MUTEX_TYPE_DEFAULT);
this->condvar = condvar_create(CONDVAR_TYPE_DEFAULT);
this->config = load_tester_config_create();
@@ -210,17 +211,17 @@ plugin_t *plugin_create()
charon->backends->add_backend(charon->backends, &this->config->backend);
charon->credentials->add_set(charon->credentials, &this->creds->credential_set);
charon->bus->add_listener(charon->bus, &this->listener->listener);
-
+
if (lib->settings->get_bool(lib->settings,
- "charon.plugins.load_tester.fake_kernel", FALSE))
+ "charon.plugins.load-tester.fake_kernel", FALSE))
{
- charon->kernel_interface->add_ipsec_interface(charon->kernel_interface,
+ charon->kernel_interface->add_ipsec_interface(charon->kernel_interface,
(kernel_ipsec_constructor_t)load_tester_ipsec_create);
}
this->running = 0;
for (i = 0; i < this->initiators; i++)
{
- charon->processor->queue_job(charon->processor,
+ charon->processor->queue_job(charon->processor,
(job_t*)callback_job_create((callback_job_cb_t)do_load_test,
this, NULL, NULL));
}
diff --git a/src/charon/plugins/load_tester/load_tester_plugin.h b/src/charon/plugins/load_tester/load_tester_plugin.h
index 87e8914e0..e33f06ac7 100644
--- a/src/charon/plugins/load_tester/load_tester_plugin.h
+++ b/src/charon/plugins/load_tester/load_tester_plugin.h
@@ -31,7 +31,7 @@ typedef struct load_tester_plugin_t load_tester_plugin_t;
/**
* Load tester plugin to inspect system core under high load.
*
- * This plugin
+ * This plugin
*/
struct load_tester_plugin_t {
diff --git a/src/charon/plugins/medcli/Makefile.in b/src/charon/plugins/medcli/Makefile.in
index 9a2b3f889..47eeecd5b 100644
--- a/src/charon/plugins/medcli/Makefile.in
+++ b/src/charon/plugins/medcli/Makefile.in
@@ -1,8 +1,9 @@
-# Makefile.in generated by automake 1.10.2 from Makefile.am.
+# Makefile.in generated by automake 1.11 from Makefile.am.
# @configure_input@
# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,
-# 2003, 2004, 2005, 2006, 2007, 2008 Free Software Foundation, Inc.
+# 2003, 2004, 2005, 2006, 2007, 2008, 2009 Free Software Foundation,
+# Inc.
# This Makefile.in is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.
@@ -16,8 +17,9 @@
VPATH = @srcdir@
pkgdatadir = $(datadir)/@PACKAGE@
-pkglibdir = $(libdir)/@PACKAGE@
pkgincludedir = $(includedir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkglibexecdir = $(libexecdir)/@PACKAGE@
am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
install_sh_DATA = $(install_sh) -c -m 644
install_sh_PROGRAM = $(install_sh) -c
@@ -35,19 +37,41 @@ host_triplet = @host@
subdir = src/charon/plugins/medcli
DIST_COMMON = $(srcdir)/Makefile.am $(srcdir)/Makefile.in
ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
-am__aclocal_m4_deps = $(top_srcdir)/configure.in
+am__aclocal_m4_deps = $(top_srcdir)/m4/config/libtool.m4 \
+ $(top_srcdir)/m4/config/ltoptions.m4 \
+ $(top_srcdir)/m4/config/ltsugar.m4 \
+ $(top_srcdir)/m4/config/ltversion.m4 \
+ $(top_srcdir)/m4/config/lt~obsolete.m4 \
+ $(top_srcdir)/m4/macros/with.m4 \
+ $(top_srcdir)/m4/macros/enable-disable.m4 \
+ $(top_srcdir)/configure.in
am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
$(ACLOCAL_M4)
mkinstalldirs = $(install_sh) -d
CONFIG_CLEAN_FILES =
+CONFIG_CLEAN_VPATH_FILES =
am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
am__vpath_adj = case $$p in \
$(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
*) f=$$p;; \
esac;
-am__strip_dir = `echo $$p | sed -e 's|^.*/||'`;
+am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
+am__install_max = 40
+am__nobase_strip_setup = \
+ srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
+am__nobase_strip = \
+ for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
+am__nobase_list = $(am__nobase_strip_setup); \
+ for p in $$list; do echo "$$p $$p"; done | \
+ sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
+ $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
+ if (++n[$$2] == $(am__install_max)) \
+ { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
+ END { for (dir in files) print dir, files[dir] }'
+am__base_list = \
+ sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
+ sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
am__installdirs = "$(DESTDIR)$(plugindir)"
-pluginLTLIBRARIES_INSTALL = $(INSTALL)
LTLIBRARIES = $(plugin_LTLIBRARIES)
libstrongswan_medcli_la_LIBADD =
am_libstrongswan_medcli_la_OBJECTS = medcli_plugin.lo medcli_creds.lo \
@@ -60,6 +84,7 @@ libstrongswan_medcli_la_LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) \
DEFAULT_INCLUDES = -I.@am__isrc@
depcomp = $(SHELL) $(top_srcdir)/depcomp
am__depfiles_maybe = depfiles
+am__mv = mv -f
COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
LTCOMPILE = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
@@ -107,25 +132,22 @@ INSTALL_DATA = @INSTALL_DATA@
INSTALL_PROGRAM = @INSTALL_PROGRAM@
INSTALL_SCRIPT = @INSTALL_SCRIPT@
INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
-IPSEC_ROUTING_TABLE = @IPSEC_ROUTING_TABLE@
-IPSEC_ROUTING_TABLE_PRIO = @IPSEC_ROUTING_TABLE_PRIO@
LD = @LD@
LDFLAGS = @LDFLAGS@
LEX = @LEX@
LEXLIB = @LEXLIB@
LEX_OUTPUT_ROOT = @LEX_OUTPUT_ROOT@
-LIBGCRYPT_CFLAGS = @LIBGCRYPT_CFLAGS@
-LIBGCRYPT_CONFIG = @LIBGCRYPT_CONFIG@
-LIBGCRYPT_LIBS = @LIBGCRYPT_LIBS@
LIBOBJS = @LIBOBJS@
LIBS = @LIBS@
LIBTOOL = @LIBTOOL@
-LINUX_HEADERS = @LINUX_HEADERS@
LIPO = @LIPO@
LN_S = @LN_S@
LTLIBOBJS = @LTLIBOBJS@
MAKEINFO = @MAKEINFO@
MKDIR_P = @MKDIR_P@
+MYSQLCFLAG = @MYSQLCFLAG@
+MYSQLCONFIG = @MYSQLCONFIG@
+MYSQLLIB = @MYSQLLIB@
NM = @NM@
NMEDIT = @NMEDIT@
OBJDUMP = @OBJDUMP@
@@ -137,11 +159,14 @@ PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
PACKAGE_NAME = @PACKAGE_NAME@
PACKAGE_STRING = @PACKAGE_STRING@
PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_URL = @PACKAGE_URL@
PACKAGE_VERSION = @PACKAGE_VERSION@
PATH_SEPARATOR = @PATH_SEPARATOR@
PERL = @PERL@
PKG_CONFIG = @PKG_CONFIG@
+PTHREADLIB = @PTHREADLIB@
RANLIB = @RANLIB@
+RTLIB = @RTLIB@
RUBY = @RUBY@
RUBYINCLUDE = @RUBYINCLUDE@
SED = @SED@
@@ -170,9 +195,9 @@ build_cpu = @build_cpu@
build_os = @build_os@
build_vendor = @build_vendor@
builddir = @builddir@
-confdir = @confdir@
datadir = @datadir@
datarootdir = @datarootdir@
+default_pkcs11 = @default_pkcs11@
docdir = @docdir@
dvidir = @dvidir@
exec_prefix = @exec_prefix@
@@ -195,7 +220,7 @@ ipsecuser = @ipsecuser@
libdir = @libdir@
libexecdir = @libexecdir@
libstrongswan_plugins = @libstrongswan_plugins@
-linuxdir = @linuxdir@
+linux_headers = @linux_headers@
localedir = @localedir@
localstatedir = @localstatedir@
lt_ECHO = @lt_ECHO@
@@ -203,6 +228,7 @@ mandir = @mandir@
mkdir_p = @mkdir_p@
nm_CFLAGS = @nm_CFLAGS@
nm_LIBS = @nm_LIBS@
+nm_ca_dir = @nm_ca_dir@
oldincludedir = @oldincludedir@
pdfdir = @pdfdir@
piddir = @piddir@
@@ -211,10 +237,12 @@ pluto_plugins = @pluto_plugins@
prefix = @prefix@
program_transform_name = @program_transform_name@
psdir = @psdir@
+random_device = @random_device@
resolv_conf = @resolv_conf@
+routing_table = @routing_table@
+routing_table_prio = @routing_table_prio@
sbindir = @sbindir@
sharedstatedir = @sharedstatedir@
-simreader = @simreader@
srcdir = @srcdir@
strongswan_conf = @strongswan_conf@
sysconfdir = @sysconfdir@
@@ -222,6 +250,7 @@ target_alias = @target_alias@
top_build_prefix = @top_build_prefix@
top_builddir = @top_builddir@
top_srcdir = @top_srcdir@
+urandom_device = @urandom_device@
xml_CFLAGS = @xml_CFLAGS@
xml_LIBS = @xml_LIBS@
INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
@@ -246,9 +275,9 @@ $(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps)
exit 1;; \
esac; \
done; \
- echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/charon/plugins/medcli/Makefile'; \
- cd $(top_srcdir) && \
- $(AUTOMAKE) --gnu src/charon/plugins/medcli/Makefile
+ echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/charon/plugins/medcli/Makefile'; \
+ $(am__cd) $(top_srcdir) && \
+ $(AUTOMAKE) --gnu src/charon/plugins/medcli/Makefile
.PRECIOUS: Makefile
Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
@case '$?' in \
@@ -266,23 +295,28 @@ $(top_srcdir)/configure: $(am__configure_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
$(ACLOCAL_M4): $(am__aclocal_m4_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(am__aclocal_m4_deps):
install-pluginLTLIBRARIES: $(plugin_LTLIBRARIES)
@$(NORMAL_INSTALL)
test -z "$(plugindir)" || $(MKDIR_P) "$(DESTDIR)$(plugindir)"
- @list='$(plugin_LTLIBRARIES)'; for p in $$list; do \
+ @list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+ list2=; for p in $$list; do \
if test -f $$p; then \
- f=$(am__strip_dir) \
- echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(pluginLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) '$$p' '$(DESTDIR)$(plugindir)/$$f'"; \
- $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(pluginLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) "$$p" "$(DESTDIR)$(plugindir)/$$f"; \
+ list2="$$list2 $$p"; \
else :; fi; \
- done
+ done; \
+ test -z "$$list2" || { \
+ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(plugindir)'"; \
+ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(plugindir)"; \
+ }
uninstall-pluginLTLIBRARIES:
@$(NORMAL_UNINSTALL)
- @list='$(plugin_LTLIBRARIES)'; for p in $$list; do \
- p=$(am__strip_dir) \
- echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$p'"; \
- $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$p"; \
+ @list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+ for p in $$list; do \
+ $(am__strip_dir) \
+ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$f'"; \
+ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$f"; \
done
clean-pluginLTLIBRARIES:
@@ -309,21 +343,21 @@ distclean-compile:
.c.o:
@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(COMPILE) -c $<
.c.obj:
@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(COMPILE) -c `$(CYGPATH_W) '$<'`
.c.lo:
@am__fastdepCC_TRUE@ $(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(LTCOMPILE) -c -o $@ $<
@@ -346,7 +380,7 @@ tags: TAGS
TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
$(TAGS_FILES) $(LISP)
- tags=; \
+ set x; \
here=`pwd`; \
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
unique=`for i in $$list; do \
@@ -354,29 +388,34 @@ TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
- if test -z "$(ETAGS_ARGS)$$tags$$unique"; then :; else \
+ shift; \
+ if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
test -n "$$unique" || unique=$$empty_fix; \
- $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
- $$tags $$unique; \
+ if test $$# -gt 0; then \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ "$$@" $$unique; \
+ else \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ $$unique; \
+ fi; \
fi
ctags: CTAGS
CTAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
$(TAGS_FILES) $(LISP)
- tags=; \
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
unique=`for i in $$list; do \
if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
- test -z "$(CTAGS_ARGS)$$tags$$unique" \
+ test -z "$(CTAGS_ARGS)$$unique" \
|| $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
- $$tags $$unique
+ $$unique
GTAGS:
here=`$(am__cd) $(top_builddir) && pwd` \
- && cd $(top_srcdir) \
- && gtags -i $(GTAGS_ARGS) $$here
+ && $(am__cd) $(top_srcdir) \
+ && gtags -i $(GTAGS_ARGS) "$$here"
distclean-tags:
-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
@@ -397,13 +436,17 @@ distdir: $(DISTFILES)
if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
if test -d $$d/$$file; then \
dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
+ if test -d "$(distdir)/$$file"; then \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+ fi; \
if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
- cp -pR $(srcdir)/$$file $(distdir)$$dir || exit 1; \
+ cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
fi; \
- cp -pR $$d/$$file $(distdir)$$dir || exit 1; \
+ cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
else \
- test -f $(distdir)/$$file \
- || cp -p $$d/$$file $(distdir)/$$file \
+ test -f "$(distdir)/$$file" \
+ || cp -p $$d/$$file "$(distdir)/$$file" \
|| exit 1; \
fi; \
done
@@ -434,6 +477,7 @@ clean-generic:
distclean-generic:
-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+ -test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
maintainer-clean-generic:
@echo "This command is intended for maintainers to use"
@@ -455,6 +499,8 @@ dvi-am:
html: html-am
+html-am:
+
info: info-am
info-am:
@@ -463,18 +509,28 @@ install-data-am: install-pluginLTLIBRARIES
install-dvi: install-dvi-am
+install-dvi-am:
+
install-exec-am:
install-html: install-html-am
+install-html-am:
+
install-info: install-info-am
+install-info-am:
+
install-man:
install-pdf: install-pdf-am
+install-pdf-am:
+
install-ps: install-ps-am
+install-ps-am:
+
installcheck-am:
maintainer-clean: maintainer-clean-am
@@ -513,6 +569,7 @@ uninstall-am: uninstall-pluginLTLIBRARIES
mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \
tags uninstall uninstall-am uninstall-pluginLTLIBRARIES
+
# Tell versions [3.59,3.63) of GNU make to not export all variables.
# Otherwise a system limit (for SysV at least) may be exceeded.
.NOEXPORT:
diff --git a/src/charon/plugins/medcli/medcli_config.c b/src/charon/plugins/medcli/medcli_config.c
index 3b3332549..2e49ebbf7 100644
--- a/src/charon/plugins/medcli/medcli_config.c
+++ b/src/charon/plugins/medcli/medcli_config.c
@@ -32,22 +32,22 @@ struct private_medcli_config_t {
* Public part
*/
medcli_config_t public;
-
+
/**
* database connection
*/
database_t *db;
-
+
/**
* rekey time
*/
int rekey;
-
+
/**
* dpd delay
*/
int dpd;
-
+
/**
* default ike config
*/
@@ -64,7 +64,7 @@ static traffic_selector_t *ts_from_string(char *str)
int netbits = 32;
host_t *net;
char *pos;
-
+
str = strdupa(str);
pos = strchr(str, '/');
if (pos)
@@ -100,9 +100,16 @@ static peer_cfg_t *get_peer_cfg_by_name(private_medcli_config_t *this, char *nam
child_cfg_t *child_cfg;
chunk_t me, other;
char *address, *local_net, *remote_net;
-
+ lifetime_cfg_t lifetime = {
+ .time = {
+ .life = this->rekey * 60 + this->rekey,
+ .rekey = this->rekey,
+ .jitter = this->rekey
+ }
+ };
+
/* query mediation server config:
- * - build ike_cfg/peer_cfg for mediation connection on-the-fly
+ * - build ike_cfg/peer_cfg for mediation connection on-the-fly
*/
e = this->db->query(this->db,
"SELECT Address, ClientConfig.KeyId, MediationServerConfig.KeyId "
@@ -117,14 +124,14 @@ static peer_cfg_t *get_peer_cfg_by_name(private_medcli_config_t *this, char *nam
ike_cfg->add_proposal(ike_cfg, proposal_create_default(PROTO_IKE));
med_cfg = peer_cfg_create(
"mediation", 2, ike_cfg,
- CERT_NEVER_SEND, UNIQUE_REPLACE,
+ CERT_NEVER_SEND, UNIQUE_REPLACE,
1, this->rekey*60, 0, /* keytries, rekey, reauth */
this->rekey*5, this->rekey*3, /* jitter, overtime */
TRUE, this->dpd, /* mobike, dpddelay */
NULL, NULL, /* vip, pool */
TRUE, NULL, NULL); /* mediation, med by, peer id */
e->destroy(e);
-
+
auth = auth_cfg_create();
auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PUBKEY);
auth->add(auth, AUTH_RULE_IDENTITY,
@@ -135,7 +142,7 @@ static peer_cfg_t *get_peer_cfg_by_name(private_medcli_config_t *this, char *nam
auth->add(auth, AUTH_RULE_IDENTITY,
identification_create_from_encoding(ID_KEY_ID, other));
med_cfg->add_auth_cfg(med_cfg, auth, FALSE);
-
+
/* query mediated config:
* - use any-any ike_cfg
* - build peer_cfg on-the-fly using med_cfg
@@ -154,14 +161,14 @@ static peer_cfg_t *get_peer_cfg_by_name(private_medcli_config_t *this, char *nam
}
peer_cfg = peer_cfg_create(
name, 2, this->ike->get_ref(this->ike),
- CERT_NEVER_SEND, UNIQUE_REPLACE,
+ CERT_NEVER_SEND, UNIQUE_REPLACE,
1, this->rekey*60, 0, /* keytries, rekey, reauth */
this->rekey*5, this->rekey*3, /* jitter, overtime */
TRUE, this->dpd, /* mobike, dpddelay */
NULL, NULL, /* vip, pool */
- FALSE, med_cfg, /* mediation, med by */
+ FALSE, med_cfg, /* mediation, med by */
identification_create_from_encoding(ID_KEY_ID, other));
-
+
auth = auth_cfg_create();
auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PUBKEY);
auth->add(auth, AUTH_RULE_IDENTITY,
@@ -172,10 +179,9 @@ static peer_cfg_t *get_peer_cfg_by_name(private_medcli_config_t *this, char *nam
auth->add(auth, AUTH_RULE_IDENTITY,
identification_create_from_encoding(ID_KEY_ID, other));
peer_cfg->add_auth_cfg(peer_cfg, auth, FALSE);
-
- child_cfg = child_cfg_create(name, this->rekey*60 + this->rekey,
- this->rekey*60, this->rekey, NULL, TRUE,
- MODE_TUNNEL, ACTION_NONE, ACTION_NONE, FALSE);
+
+ child_cfg = child_cfg_create(name, &lifetime, NULL, TRUE,
+ MODE_TUNNEL, ACTION_NONE, ACTION_NONE, FALSE, 0);
child_cfg->add_proposal(child_cfg, proposal_create_default(PROTO_ESP));
child_cfg->add_traffic_selector(child_cfg, TRUE, ts_from_string(local_net));
child_cfg->add_traffic_selector(child_cfg, FALSE, ts_from_string(remote_net));
@@ -217,7 +223,14 @@ static bool peer_enumerator_enumerate(peer_enumerator_t *this, peer_cfg_t **cfg)
chunk_t me, other;
child_cfg_t *child_cfg;
auth_cfg_t *auth;
-
+ lifetime_cfg_t lifetime = {
+ .time = {
+ .life = this->rekey * 60 + this->rekey,
+ .rekey = this->rekey,
+ .jitter = this->rekey
+ }
+ };
+
DESTROY_IF(this->current);
if (!this->inner->enumerate(this->inner, &name, &me, &other,
&local_net, &remote_net))
@@ -227,13 +240,13 @@ static bool peer_enumerator_enumerate(peer_enumerator_t *this, peer_cfg_t **cfg)
}
this->current = peer_cfg_create(
name, 2, this->ike->get_ref(this->ike),
- CERT_NEVER_SEND, UNIQUE_REPLACE,
+ CERT_NEVER_SEND, UNIQUE_REPLACE,
1, this->rekey*60, 0, /* keytries, rekey, reauth */
this->rekey*5, this->rekey*3, /* jitter, overtime */
TRUE, this->dpd, /* mobike, dpddelay */
NULL, NULL, /* vip, pool */
FALSE, NULL, NULL); /* mediation, med by, peer id */
-
+
auth = auth_cfg_create();
auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PUBKEY);
auth->add(auth, AUTH_RULE_IDENTITY,
@@ -244,11 +257,9 @@ static bool peer_enumerator_enumerate(peer_enumerator_t *this, peer_cfg_t **cfg)
auth->add(auth, AUTH_RULE_IDENTITY,
identification_create_from_encoding(ID_KEY_ID, other));
this->current->add_auth_cfg(this->current, auth, FALSE);
-
- child_cfg = child_cfg_create(
- name, this->rekey*60 + this->rekey,
- this->rekey*60, this->rekey, NULL, TRUE,
- MODE_TUNNEL, ACTION_NONE, ACTION_NONE, FALSE);
+
+ child_cfg = child_cfg_create(name, &lifetime, NULL, TRUE, MODE_TUNNEL,
+ ACTION_NONE, ACTION_NONE, FALSE, 0);
child_cfg->add_proposal(child_cfg, proposal_create_default(PROTO_ESP));
child_cfg->add_traffic_selector(child_cfg, TRUE, ts_from_string(local_net));
child_cfg->add_traffic_selector(child_cfg, FALSE, ts_from_string(remote_net));
@@ -275,7 +286,7 @@ static enumerator_t* create_peer_cfg_enumerator(private_medcli_config_t *this,
identification_t *other)
{
peer_enumerator_t *e = malloc_thing(peer_enumerator_t);
-
+
e->current = NULL;
e->ike = this->ike;
e->rekey = this->rekey;
@@ -289,12 +300,12 @@ static enumerator_t* create_peer_cfg_enumerator(private_medcli_config_t *this,
"Connection.LocalSubnet, Connection.RemoteSubnet "
"FROM ClientConfig JOIN Connection "
"WHERE Active AND "
- "(? OR ClientConfig.KeyId = ?) AND (? OR Connection.KeyId = ?)",
- DB_INT, me == NULL || me->get_type(me) == ID_ANY,
- DB_BLOB, me && me->get_type(me) == ID_KEY_ID ?
+ "(? OR ClientConfig.KeyId = ?) AND (? OR Connection.KeyId = ?)",
+ DB_INT, me == NULL || me->get_type(me) == ID_ANY,
+ DB_BLOB, me && me->get_type(me) == ID_KEY_ID ?
me->get_encoding(me) : chunk_empty,
- DB_INT, other == NULL || other->get_type(other) == ID_ANY,
- DB_BLOB, other && other->get_type(other) == ID_KEY_ID ?
+ DB_INT, other == NULL || other->get_type(other) == ID_ANY,
+ DB_BLOB, other && other->get_type(other) == ID_KEY_ID ?
other->get_encoding(other) : chunk_empty,
DB_TEXT, DB_BLOB, DB_BLOB, DB_TEXT, DB_TEXT);
if (!e->inner)
@@ -312,7 +323,7 @@ static job_requeue_t initiate_config(peer_cfg_t *peer_cfg)
{
enumerator_t *enumerator;
child_cfg_t *child_cfg = NULL;;
-
+
enumerator = peer_cfg->create_child_cfg_enumerator(peer_cfg);
enumerator->enumerate(enumerator, &child_cfg);
if (child_cfg)
@@ -337,7 +348,7 @@ static void schedule_autoinit(private_medcli_config_t *this)
{
enumerator_t *e;
char *name;
-
+
e = this->db->query(this->db, "SELECT Alias FROM Connection WHERE Active",
DB_TEXT);
if (e)
@@ -345,7 +356,7 @@ static void schedule_autoinit(private_medcli_config_t *this)
while (e->enumerate(e, &name))
{
peer_cfg_t *peer_cfg;
-
+
peer_cfg = get_peer_cfg_by_name(this, name);
if (peer_cfg)
{
@@ -380,15 +391,15 @@ medcli_config_t *medcli_config_create(database_t *db)
this->public.backend.create_ike_cfg_enumerator = (enumerator_t*(*)(backend_t*, host_t *me, host_t *other))create_ike_cfg_enumerator;
this->public.backend.get_peer_cfg_by_name = (peer_cfg_t* (*)(backend_t*,char*))get_peer_cfg_by_name;
this->public.destroy = (void(*)(medcli_config_t*))destroy;
-
+
this->db = db;
this->rekey = lib->settings->get_time(lib->settings, "medcli.rekey", 1200);
this->dpd = lib->settings->get_time(lib->settings, "medcli.dpd", 300);
this->ike = ike_cfg_create(FALSE, FALSE, "0.0.0.0", "0.0.0.0");
this->ike->add_proposal(this->ike, proposal_create_default(PROTO_IKE));
-
+
schedule_autoinit(this);
-
+
return &this->public;
}
diff --git a/src/charon/plugins/medcli/medcli_config.h b/src/charon/plugins/medcli/medcli_config.h
index a37280bd0..36c20adf7 100644
--- a/src/charon/plugins/medcli/medcli_config.h
+++ b/src/charon/plugins/medcli/medcli_config.h
@@ -35,11 +35,11 @@ struct medcli_config_t {
* Implements backend_t interface
*/
backend_t backend;
-
+
/**
* Destroy the backend.
*/
- void (*destroy)(medcli_config_t *this);
+ void (*destroy)(medcli_config_t *this);
};
/**
diff --git a/src/charon/plugins/medcli/medcli_creds.c b/src/charon/plugins/medcli/medcli_creds.c
index d3c66ae35..9729df3f5 100644
--- a/src/charon/plugins/medcli/medcli_creds.c
+++ b/src/charon/plugins/medcli/medcli_creds.c
@@ -30,7 +30,7 @@ struct private_medcli_creds_t {
* Public part
*/
medcli_creds_t public;
-
+
/**
* underlying database handle
*/
@@ -90,21 +90,21 @@ static enumerator_t* create_private_enumerator(private_medcli_creds_t *this,
key_type_t type, identification_t *id)
{
private_enumerator_t *e;
-
+
if ((type != KEY_RSA && type != KEY_ANY) ||
id == NULL || id->get_type(id) != ID_KEY_ID)
{
DBG1(DBG_CFG, "%N - %Y", key_type_names, type, id);
return NULL;
}
-
+
e = malloc_thing(private_enumerator_t);
e->current = NULL;
e->public.enumerate = (void*)private_enumerator_enumerate;
e->public.destroy = (void*)private_enumerator_destroy;
e->inner = this->db->query(this->db,
"SELECT PrivateKey FROM ClientConfig WHERE KeyId = ?",
- DB_BLOB, id->get_encoding(id),
+ DB_BLOB, id->get_encoding(id),
DB_BLOB);
if (!e->inner)
{
@@ -185,13 +185,13 @@ static enumerator_t* create_cert_enumerator(private_medcli_creds_t *this,
identification_t *id, bool trusted)
{
cert_enumerator_t *e;
-
+
if ((cert != CERT_TRUSTED_PUBKEY && cert != CERT_ANY) ||
id == NULL || id->get_type(id) != ID_KEY_ID)
{
return NULL;
}
-
+
e = malloc_thing(cert_enumerator_t);
e->current = NULL;
e->type = key;
@@ -218,7 +218,7 @@ static enumerator_t* create_cert_enumerator(private_medcli_creds_t *this,
*/
static void destroy(private_medcli_creds_t *this)
{
- free(this);
+ free(this);
}
/**
@@ -235,9 +235,9 @@ medcli_creds_t *medcli_creds_create(database_t *db)
this->public.set.cache_cert = (void*)nop;
this->public.destroy = (void (*)(medcli_creds_t*))destroy;
-
+
this->db = db;
-
+
return &this->public;
}
diff --git a/src/charon/plugins/medcli/medcli_creds.h b/src/charon/plugins/medcli/medcli_creds.h
index 97bf1c226..4b5402653 100644
--- a/src/charon/plugins/medcli/medcli_creds.h
+++ b/src/charon/plugins/medcli/medcli_creds.h
@@ -35,11 +35,11 @@ struct medcli_creds_t {
* Implements credential_set_t interface
*/
credential_set_t set;
-
+
/**
* Destroy the credentials databse.
*/
- void (*destroy)(medcli_creds_t *this);
+ void (*destroy)(medcli_creds_t *this);
};
/**
diff --git a/src/charon/plugins/medcli/medcli_listener.c b/src/charon/plugins/medcli/medcli_listener.c
index 4d058c0cd..142f02e6c 100644
--- a/src/charon/plugins/medcli/medcli_listener.c
+++ b/src/charon/plugins/medcli/medcli_listener.c
@@ -39,7 +39,7 @@ struct private_medcli_listener_t {
* Public part
*/
medcli_listener_t public;
-
+
/**
* underlying database handle
*/
@@ -117,17 +117,17 @@ static void destroy(private_medcli_listener_t *this)
medcli_listener_t *medcli_listener_create(database_t *db)
{
private_medcli_listener_t *this = malloc_thing(private_medcli_listener_t);
-
+
memset(&this->public.listener, 0, sizeof(listener_t));
-
+
this->public.listener.ike_state_change = (void*)ike_state_change;
this->public.listener.child_state_change = (void*)child_state_change;
this->public.destroy = (void (*)(medcli_listener_t*))destroy;
-
+
this->db = db;
db->execute(db, NULL, "UPDATE Connection SET Status = ?",
DB_UINT, STATE_DOWN);
-
+
return &this->public;
}
diff --git a/src/charon/plugins/medcli/medcli_listener.h b/src/charon/plugins/medcli/medcli_listener.h
index c6881f88a..4768beccd 100644
--- a/src/charon/plugins/medcli/medcli_listener.h
+++ b/src/charon/plugins/medcli/medcli_listener.h
@@ -35,11 +35,11 @@ struct medcli_listener_t {
* Implements bus_listener_t interface
*/
listener_t listener;
-
+
/**
* Destroy the credentials databse.
*/
- void (*destroy)(medcli_listener_t *this);
+ void (*destroy)(medcli_listener_t *this);
};
/**
diff --git a/src/charon/plugins/medcli/medcli_plugin.c b/src/charon/plugins/medcli/medcli_plugin.c
index 908b144f0..148eded61 100644
--- a/src/charon/plugins/medcli/medcli_plugin.c
+++ b/src/charon/plugins/medcli/medcli_plugin.c
@@ -32,22 +32,22 @@ struct private_medcli_plugin_t {
* implements plugin interface
*/
medcli_plugin_t public;
-
+
/**
* database connection instance
*/
database_t *db;
-
+
/**
* medcli credential set instance
*/
medcli_creds_t *creds;
-
+
/**
* medcli config database
*/
medcli_config_t *config;
-
+
/**
* Listener to update database connection state
*/
@@ -76,9 +76,9 @@ plugin_t *plugin_create()
{
char *uri;
private_medcli_plugin_t *this = malloc_thing(private_medcli_plugin_t);
-
+
this->public.plugin.destroy = (void(*)(plugin_t*))destroy;
-
+
uri = lib->settings->get_str(lib->settings,
"medcli.database", NULL);
if (!uri)
@@ -87,7 +87,7 @@ plugin_t *plugin_create()
free(this);
return NULL;
}
-
+
this->db = lib->db->create(lib->db, uri);
if (this->db == NULL)
{
@@ -95,15 +95,15 @@ plugin_t *plugin_create()
free(this);
return NULL;
}
-
+
this->creds = medcli_creds_create(this->db);
this->config = medcli_config_create(this->db);
this->listener = medcli_listener_create(this->db);
-
+
charon->credentials->add_set(charon->credentials, &this->creds->set);
charon->backends->add_backend(charon->backends, &this->config->backend);
charon->bus->add_listener(charon->bus, &this->listener->listener);
-
+
return &this->public.plugin;
}
diff --git a/src/charon/plugins/medsrv/Makefile.in b/src/charon/plugins/medsrv/Makefile.in
index ba599499b..c72887889 100644
--- a/src/charon/plugins/medsrv/Makefile.in
+++ b/src/charon/plugins/medsrv/Makefile.in
@@ -1,8 +1,9 @@
-# Makefile.in generated by automake 1.10.2 from Makefile.am.
+# Makefile.in generated by automake 1.11 from Makefile.am.
# @configure_input@
# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,
-# 2003, 2004, 2005, 2006, 2007, 2008 Free Software Foundation, Inc.
+# 2003, 2004, 2005, 2006, 2007, 2008, 2009 Free Software Foundation,
+# Inc.
# This Makefile.in is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.
@@ -16,8 +17,9 @@
VPATH = @srcdir@
pkgdatadir = $(datadir)/@PACKAGE@
-pkglibdir = $(libdir)/@PACKAGE@
pkgincludedir = $(includedir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkglibexecdir = $(libexecdir)/@PACKAGE@
am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
install_sh_DATA = $(install_sh) -c -m 644
install_sh_PROGRAM = $(install_sh) -c
@@ -35,19 +37,41 @@ host_triplet = @host@
subdir = src/charon/plugins/medsrv
DIST_COMMON = $(srcdir)/Makefile.am $(srcdir)/Makefile.in
ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
-am__aclocal_m4_deps = $(top_srcdir)/configure.in
+am__aclocal_m4_deps = $(top_srcdir)/m4/config/libtool.m4 \
+ $(top_srcdir)/m4/config/ltoptions.m4 \
+ $(top_srcdir)/m4/config/ltsugar.m4 \
+ $(top_srcdir)/m4/config/ltversion.m4 \
+ $(top_srcdir)/m4/config/lt~obsolete.m4 \
+ $(top_srcdir)/m4/macros/with.m4 \
+ $(top_srcdir)/m4/macros/enable-disable.m4 \
+ $(top_srcdir)/configure.in
am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
$(ACLOCAL_M4)
mkinstalldirs = $(install_sh) -d
CONFIG_CLEAN_FILES =
+CONFIG_CLEAN_VPATH_FILES =
am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
am__vpath_adj = case $$p in \
$(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
*) f=$$p;; \
esac;
-am__strip_dir = `echo $$p | sed -e 's|^.*/||'`;
+am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
+am__install_max = 40
+am__nobase_strip_setup = \
+ srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
+am__nobase_strip = \
+ for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
+am__nobase_list = $(am__nobase_strip_setup); \
+ for p in $$list; do echo "$$p $$p"; done | \
+ sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
+ $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
+ if (++n[$$2] == $(am__install_max)) \
+ { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
+ END { for (dir in files) print dir, files[dir] }'
+am__base_list = \
+ sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
+ sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
am__installdirs = "$(DESTDIR)$(plugindir)"
-pluginLTLIBRARIES_INSTALL = $(INSTALL)
LTLIBRARIES = $(plugin_LTLIBRARIES)
libstrongswan_medsrv_la_LIBADD =
am_libstrongswan_medsrv_la_OBJECTS = medsrv_plugin.lo medsrv_creds.lo \
@@ -60,6 +84,7 @@ libstrongswan_medsrv_la_LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) \
DEFAULT_INCLUDES = -I.@am__isrc@
depcomp = $(SHELL) $(top_srcdir)/depcomp
am__depfiles_maybe = depfiles
+am__mv = mv -f
COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
LTCOMPILE = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
@@ -107,25 +132,22 @@ INSTALL_DATA = @INSTALL_DATA@
INSTALL_PROGRAM = @INSTALL_PROGRAM@
INSTALL_SCRIPT = @INSTALL_SCRIPT@
INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
-IPSEC_ROUTING_TABLE = @IPSEC_ROUTING_TABLE@
-IPSEC_ROUTING_TABLE_PRIO = @IPSEC_ROUTING_TABLE_PRIO@
LD = @LD@
LDFLAGS = @LDFLAGS@
LEX = @LEX@
LEXLIB = @LEXLIB@
LEX_OUTPUT_ROOT = @LEX_OUTPUT_ROOT@
-LIBGCRYPT_CFLAGS = @LIBGCRYPT_CFLAGS@
-LIBGCRYPT_CONFIG = @LIBGCRYPT_CONFIG@
-LIBGCRYPT_LIBS = @LIBGCRYPT_LIBS@
LIBOBJS = @LIBOBJS@
LIBS = @LIBS@
LIBTOOL = @LIBTOOL@
-LINUX_HEADERS = @LINUX_HEADERS@
LIPO = @LIPO@
LN_S = @LN_S@
LTLIBOBJS = @LTLIBOBJS@
MAKEINFO = @MAKEINFO@
MKDIR_P = @MKDIR_P@
+MYSQLCFLAG = @MYSQLCFLAG@
+MYSQLCONFIG = @MYSQLCONFIG@
+MYSQLLIB = @MYSQLLIB@
NM = @NM@
NMEDIT = @NMEDIT@
OBJDUMP = @OBJDUMP@
@@ -137,11 +159,14 @@ PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
PACKAGE_NAME = @PACKAGE_NAME@
PACKAGE_STRING = @PACKAGE_STRING@
PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_URL = @PACKAGE_URL@
PACKAGE_VERSION = @PACKAGE_VERSION@
PATH_SEPARATOR = @PATH_SEPARATOR@
PERL = @PERL@
PKG_CONFIG = @PKG_CONFIG@
+PTHREADLIB = @PTHREADLIB@
RANLIB = @RANLIB@
+RTLIB = @RTLIB@
RUBY = @RUBY@
RUBYINCLUDE = @RUBYINCLUDE@
SED = @SED@
@@ -170,9 +195,9 @@ build_cpu = @build_cpu@
build_os = @build_os@
build_vendor = @build_vendor@
builddir = @builddir@
-confdir = @confdir@
datadir = @datadir@
datarootdir = @datarootdir@
+default_pkcs11 = @default_pkcs11@
docdir = @docdir@
dvidir = @dvidir@
exec_prefix = @exec_prefix@
@@ -195,7 +220,7 @@ ipsecuser = @ipsecuser@
libdir = @libdir@
libexecdir = @libexecdir@
libstrongswan_plugins = @libstrongswan_plugins@
-linuxdir = @linuxdir@
+linux_headers = @linux_headers@
localedir = @localedir@
localstatedir = @localstatedir@
lt_ECHO = @lt_ECHO@
@@ -203,6 +228,7 @@ mandir = @mandir@
mkdir_p = @mkdir_p@
nm_CFLAGS = @nm_CFLAGS@
nm_LIBS = @nm_LIBS@
+nm_ca_dir = @nm_ca_dir@
oldincludedir = @oldincludedir@
pdfdir = @pdfdir@
piddir = @piddir@
@@ -211,10 +237,12 @@ pluto_plugins = @pluto_plugins@
prefix = @prefix@
program_transform_name = @program_transform_name@
psdir = @psdir@
+random_device = @random_device@
resolv_conf = @resolv_conf@
+routing_table = @routing_table@
+routing_table_prio = @routing_table_prio@
sbindir = @sbindir@
sharedstatedir = @sharedstatedir@
-simreader = @simreader@
srcdir = @srcdir@
strongswan_conf = @strongswan_conf@
sysconfdir = @sysconfdir@
@@ -222,6 +250,7 @@ target_alias = @target_alias@
top_build_prefix = @top_build_prefix@
top_builddir = @top_builddir@
top_srcdir = @top_srcdir@
+urandom_device = @urandom_device@
xml_CFLAGS = @xml_CFLAGS@
xml_LIBS = @xml_LIBS@
INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
@@ -245,9 +274,9 @@ $(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps)
exit 1;; \
esac; \
done; \
- echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/charon/plugins/medsrv/Makefile'; \
- cd $(top_srcdir) && \
- $(AUTOMAKE) --gnu src/charon/plugins/medsrv/Makefile
+ echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/charon/plugins/medsrv/Makefile'; \
+ $(am__cd) $(top_srcdir) && \
+ $(AUTOMAKE) --gnu src/charon/plugins/medsrv/Makefile
.PRECIOUS: Makefile
Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
@case '$?' in \
@@ -265,23 +294,28 @@ $(top_srcdir)/configure: $(am__configure_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
$(ACLOCAL_M4): $(am__aclocal_m4_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(am__aclocal_m4_deps):
install-pluginLTLIBRARIES: $(plugin_LTLIBRARIES)
@$(NORMAL_INSTALL)
test -z "$(plugindir)" || $(MKDIR_P) "$(DESTDIR)$(plugindir)"
- @list='$(plugin_LTLIBRARIES)'; for p in $$list; do \
+ @list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+ list2=; for p in $$list; do \
if test -f $$p; then \
- f=$(am__strip_dir) \
- echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(pluginLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) '$$p' '$(DESTDIR)$(plugindir)/$$f'"; \
- $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(pluginLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) "$$p" "$(DESTDIR)$(plugindir)/$$f"; \
+ list2="$$list2 $$p"; \
else :; fi; \
- done
+ done; \
+ test -z "$$list2" || { \
+ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(plugindir)'"; \
+ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(plugindir)"; \
+ }
uninstall-pluginLTLIBRARIES:
@$(NORMAL_UNINSTALL)
- @list='$(plugin_LTLIBRARIES)'; for p in $$list; do \
- p=$(am__strip_dir) \
- echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$p'"; \
- $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$p"; \
+ @list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+ for p in $$list; do \
+ $(am__strip_dir) \
+ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$f'"; \
+ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$f"; \
done
clean-pluginLTLIBRARIES:
@@ -307,21 +341,21 @@ distclean-compile:
.c.o:
@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(COMPILE) -c $<
.c.obj:
@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(COMPILE) -c `$(CYGPATH_W) '$<'`
.c.lo:
@am__fastdepCC_TRUE@ $(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(LTCOMPILE) -c -o $@ $<
@@ -344,7 +378,7 @@ tags: TAGS
TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
$(TAGS_FILES) $(LISP)
- tags=; \
+ set x; \
here=`pwd`; \
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
unique=`for i in $$list; do \
@@ -352,29 +386,34 @@ TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
- if test -z "$(ETAGS_ARGS)$$tags$$unique"; then :; else \
+ shift; \
+ if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
test -n "$$unique" || unique=$$empty_fix; \
- $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
- $$tags $$unique; \
+ if test $$# -gt 0; then \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ "$$@" $$unique; \
+ else \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ $$unique; \
+ fi; \
fi
ctags: CTAGS
CTAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
$(TAGS_FILES) $(LISP)
- tags=; \
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
unique=`for i in $$list; do \
if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
- test -z "$(CTAGS_ARGS)$$tags$$unique" \
+ test -z "$(CTAGS_ARGS)$$unique" \
|| $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
- $$tags $$unique
+ $$unique
GTAGS:
here=`$(am__cd) $(top_builddir) && pwd` \
- && cd $(top_srcdir) \
- && gtags -i $(GTAGS_ARGS) $$here
+ && $(am__cd) $(top_srcdir) \
+ && gtags -i $(GTAGS_ARGS) "$$here"
distclean-tags:
-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
@@ -395,13 +434,17 @@ distdir: $(DISTFILES)
if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
if test -d $$d/$$file; then \
dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
+ if test -d "$(distdir)/$$file"; then \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+ fi; \
if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
- cp -pR $(srcdir)/$$file $(distdir)$$dir || exit 1; \
+ cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
fi; \
- cp -pR $$d/$$file $(distdir)$$dir || exit 1; \
+ cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
else \
- test -f $(distdir)/$$file \
- || cp -p $$d/$$file $(distdir)/$$file \
+ test -f "$(distdir)/$$file" \
+ || cp -p $$d/$$file "$(distdir)/$$file" \
|| exit 1; \
fi; \
done
@@ -432,6 +475,7 @@ clean-generic:
distclean-generic:
-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+ -test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
maintainer-clean-generic:
@echo "This command is intended for maintainers to use"
@@ -453,6 +497,8 @@ dvi-am:
html: html-am
+html-am:
+
info: info-am
info-am:
@@ -461,18 +507,28 @@ install-data-am: install-pluginLTLIBRARIES
install-dvi: install-dvi-am
+install-dvi-am:
+
install-exec-am:
install-html: install-html-am
+install-html-am:
+
install-info: install-info-am
+install-info-am:
+
install-man:
install-pdf: install-pdf-am
+install-pdf-am:
+
install-ps: install-ps-am
+install-ps-am:
+
installcheck-am:
maintainer-clean: maintainer-clean-am
@@ -511,6 +567,7 @@ uninstall-am: uninstall-pluginLTLIBRARIES
mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \
tags uninstall uninstall-am uninstall-pluginLTLIBRARIES
+
# Tell versions [3.59,3.63) of GNU make to not export all variables.
# Otherwise a system limit (for SysV at least) may be exceeded.
.NOEXPORT:
diff --git a/src/charon/plugins/medsrv/medsrv_config.c b/src/charon/plugins/medsrv/medsrv_config.c
index 1ab7f3864..3df720967 100644
--- a/src/charon/plugins/medsrv/medsrv_config.c
+++ b/src/charon/plugins/medsrv/medsrv_config.c
@@ -30,22 +30,22 @@ struct private_medsrv_config_t {
* Public part
*/
medsrv_config_t public;
-
+
/**
* database connection
*/
database_t *db;
-
+
/**
* rekey time
*/
int rekey;
-
+
/**
* dpd delay
*/
int dpd;
-
+
/**
* default ike config
*/
@@ -77,7 +77,7 @@ static enumerator_t* create_peer_cfg_enumerator(private_medsrv_config_t *this,
identification_t *other)
{
enumerator_t *e;
-
+
if (!me || !other || other->get_type(other) != ID_KEY_ID)
{
return NULL;
@@ -92,7 +92,7 @@ static enumerator_t* create_peer_cfg_enumerator(private_medsrv_config_t *this,
peer_cfg_t *peer_cfg;
auth_cfg_t *auth;
char *name;
-
+
if (e->enumerate(e, &name))
{
peer_cfg = peer_cfg_create(
@@ -104,7 +104,7 @@ static enumerator_t* create_peer_cfg_enumerator(private_medsrv_config_t *this,
NULL, NULL, /* vip, pool */
TRUE, NULL, NULL); /* mediation, med by, peer id */
e->destroy(e);
-
+
auth = auth_cfg_create();
auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PUBKEY);
auth->add(auth, AUTH_RULE_IDENTITY, me->clone(me));
@@ -113,7 +113,7 @@ static enumerator_t* create_peer_cfg_enumerator(private_medsrv_config_t *this,
auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PUBKEY);
auth->add(auth, AUTH_RULE_IDENTITY, other->clone(other));
peer_cfg->add_auth_cfg(peer_cfg, auth, FALSE);
-
+
return enumerator_create_single(peer_cfg, (void*)peer_cfg->destroy);
}
e->destroy(e);
@@ -141,13 +141,13 @@ medsrv_config_t *medsrv_config_create(database_t *db)
this->public.backend.create_ike_cfg_enumerator = (enumerator_t*(*)(backend_t*, host_t *me, host_t *other))create_ike_cfg_enumerator;
this->public.backend.get_peer_cfg_by_name = (peer_cfg_t* (*)(backend_t*,char*))get_peer_cfg_by_name;
this->public.destroy = (void(*)(medsrv_config_t*))destroy;
-
+
this->db = db;
this->rekey = lib->settings->get_time(lib->settings, "medsrv.rekey", 1200);
this->dpd = lib->settings->get_time(lib->settings, "medsrv.dpd", 300);
this->ike = ike_cfg_create(FALSE, FALSE, "0.0.0.0", "0.0.0.0");
this->ike->add_proposal(this->ike, proposal_create_default(PROTO_IKE));
-
+
return &this->public;
}
diff --git a/src/charon/plugins/medsrv/medsrv_config.h b/src/charon/plugins/medsrv/medsrv_config.h
index 2ed63bca7..fc8b0e972 100644
--- a/src/charon/plugins/medsrv/medsrv_config.h
+++ b/src/charon/plugins/medsrv/medsrv_config.h
@@ -35,11 +35,11 @@ struct medsrv_config_t {
* Implements backend_t interface
*/
backend_t backend;
-
+
/**
* Destroy the backend.
*/
- void (*destroy)(medsrv_config_t *this);
+ void (*destroy)(medsrv_config_t *this);
};
/**
diff --git a/src/charon/plugins/medsrv/medsrv_creds.c b/src/charon/plugins/medsrv/medsrv_creds.c
index 7dac37f1f..8d1643908 100644
--- a/src/charon/plugins/medsrv/medsrv_creds.c
+++ b/src/charon/plugins/medsrv/medsrv_creds.c
@@ -30,7 +30,7 @@ struct private_medsrv_creds_t {
* Public part
*/
medsrv_creds_t public;
-
+
/**
* underlying database handle
*/
@@ -109,13 +109,13 @@ static enumerator_t* create_cert_enumerator(private_medsrv_creds_t *this,
identification_t *id, bool trusted)
{
cert_enumerator_t *e;
-
+
if ((cert != CERT_TRUSTED_PUBKEY && cert != CERT_ANY) ||
id == NULL || id->get_type(id) != ID_KEY_ID)
{
return NULL;
}
-
+
e = malloc_thing(cert_enumerator_t);
e->current = NULL;
e->type = key;
@@ -138,7 +138,7 @@ static enumerator_t* create_cert_enumerator(private_medsrv_creds_t *this,
*/
static void destroy(private_medsrv_creds_t *this)
{
- free(this);
+ free(this);
}
/**
@@ -155,9 +155,9 @@ medsrv_creds_t *medsrv_creds_create(database_t *db)
this->public.set.cache_cert = (void*)nop;
this->public.destroy = (void (*)(medsrv_creds_t*))destroy;
-
+
this->db = db;
-
+
return &this->public;
}
diff --git a/src/charon/plugins/medsrv/medsrv_creds.h b/src/charon/plugins/medsrv/medsrv_creds.h
index da23220c2..d08adf3bf 100644
--- a/src/charon/plugins/medsrv/medsrv_creds.h
+++ b/src/charon/plugins/medsrv/medsrv_creds.h
@@ -35,11 +35,11 @@ struct medsrv_creds_t {
* Implements credential_set_t interface
*/
credential_set_t set;
-
+
/**
* Destroy the credentials databse.
*/
- void (*destroy)(medsrv_creds_t *this);
+ void (*destroy)(medsrv_creds_t *this);
};
/**
diff --git a/src/charon/plugins/medsrv/medsrv_plugin.c b/src/charon/plugins/medsrv/medsrv_plugin.c
index 4340d7991..7c533f10e 100644
--- a/src/charon/plugins/medsrv/medsrv_plugin.c
+++ b/src/charon/plugins/medsrv/medsrv_plugin.c
@@ -31,17 +31,17 @@ struct private_medsrv_plugin_t {
* implements plugin interface
*/
medsrv_plugin_t public;
-
+
/**
* database connection instance
*/
database_t *db;
-
+
/**
* medsrv credential set instance
*/
medsrv_creds_t *creds;
-
+
/**
* medsrv config database
*/
@@ -68,9 +68,9 @@ plugin_t *plugin_create()
{
char *uri;
private_medsrv_plugin_t *this = malloc_thing(private_medsrv_plugin_t);
-
+
this->public.plugin.destroy = (void(*)(plugin_t*))destroy;
-
+
uri = lib->settings->get_str(lib->settings,
"medsrv.database", NULL);
if (!uri)
@@ -79,7 +79,7 @@ plugin_t *plugin_create()
free(this);
return NULL;
}
-
+
this->db = lib->db->create(lib->db, uri);
if (this->db == NULL)
{
@@ -87,13 +87,13 @@ plugin_t *plugin_create()
free(this);
return NULL;
}
-
+
this->creds = medsrv_creds_create(this->db);
this->config = medsrv_config_create(this->db);
-
+
charon->credentials->add_set(charon->credentials, &this->creds->set);
charon->backends->add_backend(charon->backends, &this->config->backend);
-
+
return &this->public.plugin;
}
diff --git a/src/charon/plugins/nm/Makefile.am b/src/charon/plugins/nm/Makefile.am
index b74a4e46f..56eae6e00 100644
--- a/src/charon/plugins/nm/Makefile.am
+++ b/src/charon/plugins/nm/Makefile.am
@@ -1,7 +1,8 @@
INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon ${nm_CFLAGS}
-AM_CFLAGS = -rdynamic
+AM_CFLAGS = -rdynamic \
+ -DNM_CA_DIR=\"${nm_ca_dir}\"
plugin_LTLIBRARIES = libstrongswan-nm.la
libstrongswan_nm_la_SOURCES = \
diff --git a/src/charon/plugins/nm/Makefile.in b/src/charon/plugins/nm/Makefile.in
index c7c428c2a..90a50cfae 100644
--- a/src/charon/plugins/nm/Makefile.in
+++ b/src/charon/plugins/nm/Makefile.in
@@ -1,8 +1,9 @@
-# Makefile.in generated by automake 1.10.2 from Makefile.am.
+# Makefile.in generated by automake 1.11 from Makefile.am.
# @configure_input@
# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,
-# 2003, 2004, 2005, 2006, 2007, 2008 Free Software Foundation, Inc.
+# 2003, 2004, 2005, 2006, 2007, 2008, 2009 Free Software Foundation,
+# Inc.
# This Makefile.in is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.
@@ -16,8 +17,9 @@
VPATH = @srcdir@
pkgdatadir = $(datadir)/@PACKAGE@
-pkglibdir = $(libdir)/@PACKAGE@
pkgincludedir = $(includedir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkglibexecdir = $(libexecdir)/@PACKAGE@
am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
install_sh_DATA = $(install_sh) -c -m 644
install_sh_PROGRAM = $(install_sh) -c
@@ -35,19 +37,41 @@ host_triplet = @host@
subdir = src/charon/plugins/nm
DIST_COMMON = $(srcdir)/Makefile.am $(srcdir)/Makefile.in
ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
-am__aclocal_m4_deps = $(top_srcdir)/configure.in
+am__aclocal_m4_deps = $(top_srcdir)/m4/config/libtool.m4 \
+ $(top_srcdir)/m4/config/ltoptions.m4 \
+ $(top_srcdir)/m4/config/ltsugar.m4 \
+ $(top_srcdir)/m4/config/ltversion.m4 \
+ $(top_srcdir)/m4/config/lt~obsolete.m4 \
+ $(top_srcdir)/m4/macros/with.m4 \
+ $(top_srcdir)/m4/macros/enable-disable.m4 \
+ $(top_srcdir)/configure.in
am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
$(ACLOCAL_M4)
mkinstalldirs = $(install_sh) -d
CONFIG_CLEAN_FILES =
+CONFIG_CLEAN_VPATH_FILES =
am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
am__vpath_adj = case $$p in \
$(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
*) f=$$p;; \
esac;
-am__strip_dir = `echo $$p | sed -e 's|^.*/||'`;
+am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
+am__install_max = 40
+am__nobase_strip_setup = \
+ srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
+am__nobase_strip = \
+ for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
+am__nobase_list = $(am__nobase_strip_setup); \
+ for p in $$list; do echo "$$p $$p"; done | \
+ sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
+ $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
+ if (++n[$$2] == $(am__install_max)) \
+ { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
+ END { for (dir in files) print dir, files[dir] }'
+am__base_list = \
+ sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
+ sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
am__installdirs = "$(DESTDIR)$(plugindir)"
-pluginLTLIBRARIES_INSTALL = $(INSTALL)
LTLIBRARIES = $(plugin_LTLIBRARIES)
am__DEPENDENCIES_1 =
libstrongswan_nm_la_DEPENDENCIES = $(am__DEPENDENCIES_1)
@@ -60,6 +84,7 @@ libstrongswan_nm_la_LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) \
DEFAULT_INCLUDES = -I.@am__isrc@
depcomp = $(SHELL) $(top_srcdir)/depcomp
am__depfiles_maybe = depfiles
+am__mv = mv -f
COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
LTCOMPILE = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
@@ -107,25 +132,22 @@ INSTALL_DATA = @INSTALL_DATA@
INSTALL_PROGRAM = @INSTALL_PROGRAM@
INSTALL_SCRIPT = @INSTALL_SCRIPT@
INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
-IPSEC_ROUTING_TABLE = @IPSEC_ROUTING_TABLE@
-IPSEC_ROUTING_TABLE_PRIO = @IPSEC_ROUTING_TABLE_PRIO@
LD = @LD@
LDFLAGS = @LDFLAGS@
LEX = @LEX@
LEXLIB = @LEXLIB@
LEX_OUTPUT_ROOT = @LEX_OUTPUT_ROOT@
-LIBGCRYPT_CFLAGS = @LIBGCRYPT_CFLAGS@
-LIBGCRYPT_CONFIG = @LIBGCRYPT_CONFIG@
-LIBGCRYPT_LIBS = @LIBGCRYPT_LIBS@
LIBOBJS = @LIBOBJS@
LIBS = @LIBS@
LIBTOOL = @LIBTOOL@
-LINUX_HEADERS = @LINUX_HEADERS@
LIPO = @LIPO@
LN_S = @LN_S@
LTLIBOBJS = @LTLIBOBJS@
MAKEINFO = @MAKEINFO@
MKDIR_P = @MKDIR_P@
+MYSQLCFLAG = @MYSQLCFLAG@
+MYSQLCONFIG = @MYSQLCONFIG@
+MYSQLLIB = @MYSQLLIB@
NM = @NM@
NMEDIT = @NMEDIT@
OBJDUMP = @OBJDUMP@
@@ -137,11 +159,14 @@ PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
PACKAGE_NAME = @PACKAGE_NAME@
PACKAGE_STRING = @PACKAGE_STRING@
PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_URL = @PACKAGE_URL@
PACKAGE_VERSION = @PACKAGE_VERSION@
PATH_SEPARATOR = @PATH_SEPARATOR@
PERL = @PERL@
PKG_CONFIG = @PKG_CONFIG@
+PTHREADLIB = @PTHREADLIB@
RANLIB = @RANLIB@
+RTLIB = @RTLIB@
RUBY = @RUBY@
RUBYINCLUDE = @RUBYINCLUDE@
SED = @SED@
@@ -170,9 +195,9 @@ build_cpu = @build_cpu@
build_os = @build_os@
build_vendor = @build_vendor@
builddir = @builddir@
-confdir = @confdir@
datadir = @datadir@
datarootdir = @datarootdir@
+default_pkcs11 = @default_pkcs11@
docdir = @docdir@
dvidir = @dvidir@
exec_prefix = @exec_prefix@
@@ -195,7 +220,7 @@ ipsecuser = @ipsecuser@
libdir = @libdir@
libexecdir = @libexecdir@
libstrongswan_plugins = @libstrongswan_plugins@
-linuxdir = @linuxdir@
+linux_headers = @linux_headers@
localedir = @localedir@
localstatedir = @localstatedir@
lt_ECHO = @lt_ECHO@
@@ -203,6 +228,7 @@ mandir = @mandir@
mkdir_p = @mkdir_p@
nm_CFLAGS = @nm_CFLAGS@
nm_LIBS = @nm_LIBS@
+nm_ca_dir = @nm_ca_dir@
oldincludedir = @oldincludedir@
pdfdir = @pdfdir@
piddir = @piddir@
@@ -211,10 +237,12 @@ pluto_plugins = @pluto_plugins@
prefix = @prefix@
program_transform_name = @program_transform_name@
psdir = @psdir@
+random_device = @random_device@
resolv_conf = @resolv_conf@
+routing_table = @routing_table@
+routing_table_prio = @routing_table_prio@
sbindir = @sbindir@
sharedstatedir = @sharedstatedir@
-simreader = @simreader@
srcdir = @srcdir@
strongswan_conf = @strongswan_conf@
sysconfdir = @sysconfdir@
@@ -222,10 +250,13 @@ target_alias = @target_alias@
top_build_prefix = @top_build_prefix@
top_builddir = @top_builddir@
top_srcdir = @top_srcdir@
+urandom_device = @urandom_device@
xml_CFLAGS = @xml_CFLAGS@
xml_LIBS = @xml_LIBS@
INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon ${nm_CFLAGS}
-AM_CFLAGS = -rdynamic
+AM_CFLAGS = -rdynamic \
+ -DNM_CA_DIR=\"${nm_ca_dir}\"
+
plugin_LTLIBRARIES = libstrongswan-nm.la
libstrongswan_nm_la_SOURCES = \
nm_plugin.h nm_plugin.c \
@@ -248,9 +279,9 @@ $(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps)
exit 1;; \
esac; \
done; \
- echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/charon/plugins/nm/Makefile'; \
- cd $(top_srcdir) && \
- $(AUTOMAKE) --gnu src/charon/plugins/nm/Makefile
+ echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/charon/plugins/nm/Makefile'; \
+ $(am__cd) $(top_srcdir) && \
+ $(AUTOMAKE) --gnu src/charon/plugins/nm/Makefile
.PRECIOUS: Makefile
Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
@case '$?' in \
@@ -268,23 +299,28 @@ $(top_srcdir)/configure: $(am__configure_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
$(ACLOCAL_M4): $(am__aclocal_m4_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(am__aclocal_m4_deps):
install-pluginLTLIBRARIES: $(plugin_LTLIBRARIES)
@$(NORMAL_INSTALL)
test -z "$(plugindir)" || $(MKDIR_P) "$(DESTDIR)$(plugindir)"
- @list='$(plugin_LTLIBRARIES)'; for p in $$list; do \
+ @list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+ list2=; for p in $$list; do \
if test -f $$p; then \
- f=$(am__strip_dir) \
- echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(pluginLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) '$$p' '$(DESTDIR)$(plugindir)/$$f'"; \
- $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(pluginLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) "$$p" "$(DESTDIR)$(plugindir)/$$f"; \
+ list2="$$list2 $$p"; \
else :; fi; \
- done
+ done; \
+ test -z "$$list2" || { \
+ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(plugindir)'"; \
+ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(plugindir)"; \
+ }
uninstall-pluginLTLIBRARIES:
@$(NORMAL_UNINSTALL)
- @list='$(plugin_LTLIBRARIES)'; for p in $$list; do \
- p=$(am__strip_dir) \
- echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$p'"; \
- $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$p"; \
+ @list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+ for p in $$list; do \
+ $(am__strip_dir) \
+ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$f'"; \
+ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$f"; \
done
clean-pluginLTLIBRARIES:
@@ -311,21 +347,21 @@ distclean-compile:
.c.o:
@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(COMPILE) -c $<
.c.obj:
@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(COMPILE) -c `$(CYGPATH_W) '$<'`
.c.lo:
@am__fastdepCC_TRUE@ $(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(LTCOMPILE) -c -o $@ $<
@@ -348,7 +384,7 @@ tags: TAGS
TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
$(TAGS_FILES) $(LISP)
- tags=; \
+ set x; \
here=`pwd`; \
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
unique=`for i in $$list; do \
@@ -356,29 +392,34 @@ TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
- if test -z "$(ETAGS_ARGS)$$tags$$unique"; then :; else \
+ shift; \
+ if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
test -n "$$unique" || unique=$$empty_fix; \
- $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
- $$tags $$unique; \
+ if test $$# -gt 0; then \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ "$$@" $$unique; \
+ else \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ $$unique; \
+ fi; \
fi
ctags: CTAGS
CTAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
$(TAGS_FILES) $(LISP)
- tags=; \
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
unique=`for i in $$list; do \
if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
- test -z "$(CTAGS_ARGS)$$tags$$unique" \
+ test -z "$(CTAGS_ARGS)$$unique" \
|| $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
- $$tags $$unique
+ $$unique
GTAGS:
here=`$(am__cd) $(top_builddir) && pwd` \
- && cd $(top_srcdir) \
- && gtags -i $(GTAGS_ARGS) $$here
+ && $(am__cd) $(top_srcdir) \
+ && gtags -i $(GTAGS_ARGS) "$$here"
distclean-tags:
-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
@@ -399,13 +440,17 @@ distdir: $(DISTFILES)
if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
if test -d $$d/$$file; then \
dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
+ if test -d "$(distdir)/$$file"; then \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+ fi; \
if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
- cp -pR $(srcdir)/$$file $(distdir)$$dir || exit 1; \
+ cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
fi; \
- cp -pR $$d/$$file $(distdir)$$dir || exit 1; \
+ cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
else \
- test -f $(distdir)/$$file \
- || cp -p $$d/$$file $(distdir)/$$file \
+ test -f "$(distdir)/$$file" \
+ || cp -p $$d/$$file "$(distdir)/$$file" \
|| exit 1; \
fi; \
done
@@ -436,6 +481,7 @@ clean-generic:
distclean-generic:
-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+ -test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
maintainer-clean-generic:
@echo "This command is intended for maintainers to use"
@@ -457,6 +503,8 @@ dvi-am:
html: html-am
+html-am:
+
info: info-am
info-am:
@@ -465,18 +513,28 @@ install-data-am: install-pluginLTLIBRARIES
install-dvi: install-dvi-am
+install-dvi-am:
+
install-exec-am:
install-html: install-html-am
+install-html-am:
+
install-info: install-info-am
+install-info-am:
+
install-man:
install-pdf: install-pdf-am
+install-pdf-am:
+
install-ps: install-ps-am
+install-ps-am:
+
installcheck-am:
maintainer-clean: maintainer-clean-am
@@ -515,6 +573,7 @@ uninstall-am: uninstall-pluginLTLIBRARIES
mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \
tags uninstall uninstall-am uninstall-pluginLTLIBRARIES
+
# Tell versions [3.59,3.63) of GNU make to not export all variables.
# Otherwise a system limit (for SysV at least) may be exceeded.
.NOEXPORT:
diff --git a/src/charon/plugins/nm/nm_creds.c b/src/charon/plugins/nm/nm_creds.c
index 4ea2c36dd..193838e6b 100644
--- a/src/charon/plugins/nm/nm_creds.c
+++ b/src/charon/plugins/nm/nm_creds.c
@@ -15,8 +15,13 @@
#include "nm_creds.h"
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <unistd.h>
+
#include <daemon.h>
-#include <utils/mutex.h>
+#include <threading/rwlock.h>
+#include <credentials/certificates/x509.h>
typedef struct private_nm_creds_t private_nm_creds_t;
@@ -29,32 +34,32 @@ struct private_nm_creds_t {
* public functions
*/
nm_creds_t public;
-
+
/**
- * gateway certificate
+ * List of trusted certificates, certificate_t*
*/
- certificate_t *cert;
-
+ linked_list_t *certs;
+
/**
- * User name
- */
- identification_t *user;
-
+ * User name
+ */
+ identification_t *user;
+
/**
* User password
*/
char *pass;
-
+
/**
* users certificate
*/
certificate_t *usercert;
-
+
/**
* users private key
*/
private_key_t *key;
-
+
/**
* read/write lock
*/
@@ -68,13 +73,13 @@ static enumerator_t *create_usercert_enumerator(private_nm_creds_t *this,
certificate_type_t cert, key_type_t key)
{
public_key_t *public;
-
+
if (cert != CERT_ANY && cert != this->usercert->get_type(this->usercert))
{
return NULL;
}
if (key != KEY_ANY)
- {
+ {
public = this->usercert->get_public_key(this->usercert);
if (!public)
{
@@ -94,6 +99,80 @@ static enumerator_t *create_usercert_enumerator(private_nm_creds_t *this,
}
/**
+ * CA certificate enumerator data
+ */
+typedef struct {
+ /** ref to credential credential store */
+ private_nm_creds_t *this;
+ /** type of key we are looking for */
+ key_type_t key;
+ /** CA certificate ID */
+ identification_t *id;
+} cert_data_t;
+
+/**
+ * Destroy CA certificate enumerator data
+ */
+static void cert_data_destroy(cert_data_t *data)
+{
+ data->this->lock->unlock(data->this->lock);
+ free(data);
+}
+
+/**
+ * Filter function for certificates enumerator
+ */
+static bool cert_filter(cert_data_t *data, certificate_t **in,
+ certificate_t **out)
+{
+ certificate_t *cert = *in;
+ public_key_t *public;
+
+ public = cert->get_public_key(cert);
+ if (!public)
+ {
+ return FALSE;
+ }
+ if (data->key != KEY_ANY && public->get_type(public) != data->key)
+ {
+ public->destroy(public);
+ return FALSE;
+ }
+ if (data->id && data->id->get_type(data->id) == ID_KEY_ID &&
+ public->has_fingerprint(public, data->id->get_encoding(data->id)))
+ {
+ public->destroy(public);
+ *out = cert;
+ return TRUE;
+ }
+ public->destroy(public);
+ if (data->id && !cert->has_subject(cert, data->id))
+ {
+ return FALSE;
+ }
+ *out = cert;
+ return TRUE;
+}
+
+/**
+ * Create enumerator for trusted certificates
+ */
+static enumerator_t *create_trusted_cert_enumerator(private_nm_creds_t *this,
+ key_type_t key, identification_t *id)
+{
+ cert_data_t *data = malloc_thing(cert_data_t);
+
+ data->this = this;
+ data->id = id;
+ data->key = key;
+
+ this->lock->read_lock(this->lock);
+ return enumerator_create_filter(
+ this->certs->create_enumerator(this->certs),
+ (void*)cert_filter, data, (void*)cert_data_destroy);
+}
+
+/**
* Implements credential_set_t.create_cert_enumerator
*/
static enumerator_t* create_cert_enumerator(private_nm_creds_t *this,
@@ -105,38 +184,11 @@ static enumerator_t* create_cert_enumerator(private_nm_creds_t *this,
{
return create_usercert_enumerator(this, cert, key);
}
-
- if (!this->cert)
- {
- return NULL;
- }
- if (cert != CERT_ANY && cert != this->cert->get_type(this->cert))
+ if (cert == CERT_X509 || cert == CERT_ANY)
{
- return NULL;
+ return create_trusted_cert_enumerator(this, key, id);
}
- if (id && !this->cert->has_subject(this->cert, id))
- {
- return NULL;
- }
- if (key != KEY_ANY)
- {
- public_key_t *public;
-
- public = this->cert->get_public_key(this->cert);
- if (!public)
- {
- return NULL;
- }
- if (public->get_type(public) != key)
- {
- public->destroy(public);
- return NULL;
- }
- public->destroy(public);
- }
- this->lock->read_lock(this->lock);
- return enumerator_create_cleaner(enumerator_create_single(this->cert, NULL),
- (void*)this->lock->unlock, this->lock);
+ return NULL;
}
/**
@@ -155,10 +207,8 @@ static enumerator_t* create_private_enumerator(private_nm_creds_t *this,
}
if (id && id->get_type(id) != ID_ANY)
{
- identification_t *keyid;
-
- keyid = this->key->get_id(this->key, id->get_type(id));
- if (!keyid || !keyid->equals(keyid, id))
+ if (id->get_type(id) != ID_KEY_ID ||
+ !this->key->has_fingerprint(this->key, id->get_encoding(id)))
{
return NULL;
}
@@ -207,7 +257,7 @@ static void shared_destroy(shared_enumerator_t *this)
/**
* Implements credential_set_t.create_cert_enumerator
*/
-static enumerator_t* create_shared_enumerator(private_nm_creds_t *this,
+static enumerator_t* create_shared_enumerator(private_nm_creds_t *this,
shared_key_type_t type, identification_t *me,
identification_t *other)
{
@@ -225,7 +275,7 @@ static enumerator_t* create_shared_enumerator(private_nm_creds_t *this,
{
return NULL;
}
-
+
enumerator = malloc_thing(shared_enumerator_t);
enumerator->public.enumerate = (void*)shared_enumerate;
enumerator->public.destroy = (void*)shared_destroy;
@@ -239,17 +289,73 @@ static enumerator_t* create_shared_enumerator(private_nm_creds_t *this,
}
/**
- * Implementation of nm_creds_t.set_certificate
+ * Implementation of nm_creds_t.add_certificate
*/
-static void set_certificate(private_nm_creds_t *this, certificate_t *cert)
+static void add_certificate(private_nm_creds_t *this, certificate_t *cert)
{
this->lock->write_lock(this->lock);
- DESTROY_IF(this->cert);
- this->cert = cert;
+ this->certs->insert_last(this->certs, cert);
this->lock->unlock(this->lock);
}
/**
+ * Load a certificate file
+ */
+static void load_ca_file(private_nm_creds_t *this, char *file)
+{
+ certificate_t *cert;
+
+ /* We add the CA constraint, as many CAs miss it */
+ cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
+ BUILD_FROM_FILE, file, BUILD_END);
+ if (!cert)
+ {
+ DBG1(DBG_CFG, "loading CA certificate '%s' failed", file);
+ }
+ else
+ {
+ DBG2(DBG_CFG, "loaded CA certificate '%Y'", cert->get_subject(cert));
+ x509_t *x509 = (x509_t*)cert;
+ if (!(x509->get_flags(x509) & X509_SELF_SIGNED))
+ {
+ DBG1(DBG_CFG, "%Y is not self signed", cert->get_subject(cert));
+ }
+ this->certs->insert_last(this->certs, cert);
+ }
+}
+
+/**
+ * Implementation of nm_creds_t.load_ca_dir
+ */
+static void load_ca_dir(private_nm_creds_t *this, char *dir)
+{
+ enumerator_t *enumerator;
+ char *rel, *abs;
+ struct stat st;
+
+ enumerator = enumerator_create_directory(dir);
+ if (enumerator)
+ {
+ while (enumerator->enumerate(enumerator, &rel, &abs, &st))
+ {
+ /* skip '.', '..' and hidden files */
+ if (rel[0] != '.')
+ {
+ if (S_ISDIR(st.st_mode))
+ {
+ load_ca_dir(this, abs);
+ }
+ else if (S_ISREG(st.st_mode))
+ {
+ load_ca_file(this, abs);
+ }
+ }
+ }
+ enumerator->destroy(enumerator);
+ }
+}
+
+/**
* Implementation of nm_creds_t.set_password
*/
static void set_username_password(private_nm_creds_t *this, identification_t *id,
@@ -266,7 +372,7 @@ static void set_username_password(private_nm_creds_t *this, identification_t *id
/**
* Implementation of nm_creds_t.set_cert_and_key
*/
-static void set_cert_and_key(private_nm_creds_t *this, certificate_t *cert,
+static void set_cert_and_key(private_nm_creds_t *this, certificate_t *cert,
private_key_t *key)
{
this->lock->write_lock(this->lock);
@@ -275,14 +381,19 @@ static void set_cert_and_key(private_nm_creds_t *this, certificate_t *cert,
this->key = key;
this->usercert = cert;
this->lock->unlock(this->lock);
-}
+}
/**
* Implementation of nm_creds_t.clear
*/
static void clear(private_nm_creds_t *this)
{
- DESTROY_IF(this->cert);
+ certificate_t *cert;
+
+ while (this->certs->remove_last(this->certs, (void**)&cert) == SUCCESS)
+ {
+ cert->destroy(cert);
+ }
DESTROY_IF(this->user);
free(this->pass);
DESTROY_IF(this->usercert);
@@ -290,7 +401,6 @@ static void clear(private_nm_creds_t *this)
this->key = NULL;
this->usercert = NULL;
this->pass = NULL;
- this->cert = NULL;
this->user = NULL;
}
@@ -300,6 +410,7 @@ static void clear(private_nm_creds_t *this)
static void destroy(private_nm_creds_t *this)
{
clear(this);
+ this->certs->destroy(this->certs);
this->lock->destroy(this->lock);
free(this);
}
@@ -310,26 +421,27 @@ static void destroy(private_nm_creds_t *this)
nm_creds_t *nm_creds_create()
{
private_nm_creds_t *this = malloc_thing(private_nm_creds_t);
-
+
this->public.set.create_private_enumerator = (void*)create_private_enumerator;
this->public.set.create_cert_enumerator = (void*)create_cert_enumerator;
this->public.set.create_shared_enumerator = (void*)create_shared_enumerator;
this->public.set.create_cdp_enumerator = (void*)return_null;
this->public.set.cache_cert = (void*)nop;
- this->public.set_certificate = (void(*)(nm_creds_t*, certificate_t *cert))set_certificate;
+ this->public.add_certificate = (void(*)(nm_creds_t*, certificate_t *cert))add_certificate;
+ this->public.load_ca_dir = (void(*)(nm_creds_t*, char *dir))load_ca_dir;
this->public.set_username_password = (void(*)(nm_creds_t*, identification_t *id, char *password))set_username_password;
this->public.set_cert_and_key = (void(*)(nm_creds_t*, certificate_t *cert, private_key_t *key))set_cert_and_key;
this->public.clear = (void(*)(nm_creds_t*))clear;
this->public.destroy = (void(*)(nm_creds_t*))destroy;
-
+
this->lock = rwlock_create(RWLOCK_TYPE_DEFAULT);
-
- this->cert = NULL;
+
+ this->certs = linked_list_create();
this->user = NULL;
this->pass = NULL;
this->usercert = NULL;
this->key = NULL;
-
+
return &this->public;
}
diff --git a/src/charon/plugins/nm/nm_creds.h b/src/charon/plugins/nm/nm_creds.h
index 421442c81..b55cff31e 100644
--- a/src/charon/plugins/nm/nm_creds.h
+++ b/src/charon/plugins/nm/nm_creds.h
@@ -35,14 +35,21 @@ struct nm_creds_t {
* Implements credential_set_t
*/
credential_set_t set;
-
+
/**
- * Set the trusted gateway certificate to serve by this set.
+ * Add a trusted gateway certificate to serve by this set.
*
* @param cert certificate to serve
*/
- void (*set_certificate)(nm_creds_t *this, certificate_t *cert);
-
+ void (*add_certificate)(nm_creds_t *this, certificate_t *cert);
+
+ /**
+ * Load CA certificates recursively from a directory.
+ *
+ * @param dir directory to PEM encoded CA certificates
+ */
+ void (*load_ca_dir)(nm_creds_t *this, char *dir);
+
/**
* Set the username/password for authentication.
*
diff --git a/src/charon/plugins/nm/nm_handler.c b/src/charon/plugins/nm/nm_handler.c
index 026c47af2..eacb54dda 100644
--- a/src/charon/plugins/nm/nm_handler.c
+++ b/src/charon/plugins/nm/nm_handler.c
@@ -23,17 +23,17 @@ typedef struct private_nm_handler_t private_nm_handler_t;
* Private data of an nm_handler_t object.
*/
struct private_nm_handler_t {
-
+
/**
* Public nm_handler_t interface.
*/
nm_handler_t public;
-
+
/**
* list of received DNS server attributes, pointer to 4 byte data
*/
linked_list_t *dns;
-
+
/**
* list of received NBNS server attributes, pointer to 4 byte data
*/
@@ -43,11 +43,11 @@ struct private_nm_handler_t {
/**
* Implementation of attribute_handler_t.handle
*/
-static bool handle(private_nm_handler_t *this, ike_sa_t *ike_sa,
+static bool handle(private_nm_handler_t *this, identification_t *server,
configuration_attribute_type_t type, chunk_t data)
{
linked_list_t *list;
-
+
switch (type)
{
case INTERNAL_IP4_DNS:
@@ -68,6 +68,50 @@ static bool handle(private_nm_handler_t *this, ike_sa_t *ike_sa,
}
/**
+ * Implementation of create_attribute_enumerator().enumerate() for WINS
+ */
+static bool enumerate_nbns(enumerator_t *this,
+ configuration_attribute_type_t *type, chunk_t *data)
+{
+ *type = INTERNAL_IP4_NBNS;
+ *data = chunk_empty;
+ /* done */
+ this->enumerate = (void*)return_false;
+ return TRUE;
+}
+
+/**
+ * Implementation of create_attribute_enumerator().enumerate() for DNS
+ */
+static bool enumerate_dns(enumerator_t *this,
+ configuration_attribute_type_t *type, chunk_t *data)
+{
+ *type = INTERNAL_IP4_DNS;
+ *data = chunk_empty;
+ /* enumerate WINS server as next attribute ... */
+ this->enumerate = (void*)enumerate_nbns;
+ return TRUE;
+}
+
+/**
+ * Implementation of attribute_handler_t.create_attribute_enumerator
+ */
+static enumerator_t* create_attribute_enumerator(private_nm_handler_t *this,
+ identification_t *server, host_t *vip)
+{
+ if (vip && vip->get_family(vip) == AF_INET)
+ { /* no IPv6 attributes yet */
+ enumerator_t *enumerator = malloc_thing(enumerator_t);
+ /* enumerate DNS attribute first ... */
+ enumerator->enumerate = (void*)enumerate_dns;
+ enumerator->destroy = (void*)free;
+
+ return enumerator;
+ }
+ return enumerator_create_empty();
+}
+
+/**
* convert plain byte ptrs to handy chunk during enumeration
*/
static bool filter_chunks(void* null, char **in, chunk_t *out)
@@ -83,7 +127,7 @@ static enumerator_t* create_enumerator(private_nm_handler_t *this,
configuration_attribute_type_t type)
{
linked_list_t *list;
-
+
switch (type)
{
case INTERNAL_IP4_DNS:
@@ -105,7 +149,7 @@ static enumerator_t* create_enumerator(private_nm_handler_t *this,
static void reset(private_nm_handler_t *this)
{
void *data;
-
+
while (this->dns->remove_last(this->dns, (void**)&data) == SUCCESS)
{
free(data);
@@ -133,16 +177,17 @@ static void destroy(private_nm_handler_t *this)
nm_handler_t *nm_handler_create()
{
private_nm_handler_t *this = malloc_thing(private_nm_handler_t);
-
- this->public.handler.handle = (bool(*)(attribute_handler_t*, ike_sa_t*, configuration_attribute_type_t, chunk_t))handle;
- this->public.handler.release = (void(*)(attribute_handler_t*, ike_sa_t*, configuration_attribute_type_t, chunk_t))nop;
+
+ this->public.handler.handle = (bool(*)(attribute_handler_t*, identification_t*, configuration_attribute_type_t, chunk_t))handle;
+ this->public.handler.release = (void(*)(attribute_handler_t*, identification_t*, configuration_attribute_type_t, chunk_t))nop;
+ this->public.handler.create_attribute_enumerator = (enumerator_t*(*)(attribute_handler_t*, identification_t *server, host_t *vip))create_attribute_enumerator;
this->public.create_enumerator = (enumerator_t*(*)(nm_handler_t*, configuration_attribute_type_t type))create_enumerator;
this->public.reset = (void(*)(nm_handler_t*))reset;
this->public.destroy = (void(*)(nm_handler_t*))destroy;
-
+
this->dns = linked_list_create();
this->nbns = linked_list_create();
-
+
return &this->public;
}
diff --git a/src/charon/plugins/nm/nm_handler.h b/src/charon/plugins/nm/nm_handler.h
index d537bb8de..bb35ce767 100644
--- a/src/charon/plugins/nm/nm_handler.h
+++ b/src/charon/plugins/nm/nm_handler.h
@@ -21,7 +21,7 @@
#ifndef NM_HANDLER_H_
#define NM_HANDLER_H_
-#include <config/attributes/attribute_handler.h>
+#include <attributes/attribute_handler.h>
typedef struct nm_handler_t nm_handler_t;
@@ -29,12 +29,12 @@ typedef struct nm_handler_t nm_handler_t;
* Handles DNS/NBNS attributes to pass to NM.
*/
struct nm_handler_t {
-
+
/**
* Implements attribute handler interface
*/
attribute_handler_t handler;
-
+
/**
* Create an enumerator over received attributes of a given kind.
*
@@ -47,7 +47,7 @@ struct nm_handler_t {
* Reset state, flush all received attributes.
*/
void (*reset)(nm_handler_t *this);
-
+
/**
* Destroy a nm_handler_t.
*/
@@ -59,4 +59,4 @@ struct nm_handler_t {
*/
nm_handler_t *nm_handler_create();
-#endif /* NM_HANDLER_ @}*/
+#endif /** NM_HANDLER_H_ @}*/
diff --git a/src/charon/plugins/nm/nm_plugin.c b/src/charon/plugins/nm/nm_plugin.c
index 1fb46f814..daf2cc660 100644
--- a/src/charon/plugins/nm/nm_plugin.c
+++ b/src/charon/plugins/nm/nm_plugin.c
@@ -34,22 +34,22 @@ struct private_nm_plugin_t {
* implements plugin interface
*/
nm_plugin_t public;
-
+
/**
* NetworkManager service (VPNPlugin)
*/
NMStrongswanPlugin *plugin;
-
+
/**
* Glib main loop for a thread, handles DBUS calls
*/
GMainLoop *loop;
-
+
/**
* credential set registered at the daemon
*/
nm_creds_t *creds;
-
+
/**
* attribute handler regeisterd at the daemon
*/
@@ -84,8 +84,8 @@ static void destroy(private_nm_plugin_t *this)
g_object_unref(this->plugin);
}
charon->credentials->remove_set(charon->credentials, &this->creds->set);
+ lib->attributes->remove_handler(lib->attributes, &this->handler->handler);
this->creds->destroy(this->creds);
- charon->attributes->remove_handler(charon->attributes, &this->handler->handler);
this->handler->destroy(this->handler);
free(this);
}
@@ -96,20 +96,20 @@ static void destroy(private_nm_plugin_t *this)
plugin_t *plugin_create()
{
private_nm_plugin_t *this = malloc_thing(private_nm_plugin_t);
-
+
this->public.plugin.destroy = (void(*)(plugin_t*))destroy;
-
+
this->loop = NULL;
g_type_init ();
if (!g_thread_supported())
{
g_thread_init(NULL);
}
-
+
this->creds = nm_creds_create();
this->handler = nm_handler_create();
+ lib->attributes->add_handler(lib->attributes, &this->handler->handler);
charon->credentials->add_set(charon->credentials, &this->creds->set);
- charon->attributes->add_handler(charon->attributes, &this->handler->handler);
this->plugin = nm_strongswan_plugin_new(this->creds, this->handler);
if (!this->plugin)
{
@@ -117,13 +117,13 @@ plugin_t *plugin_create()
destroy(this);
return NULL;
}
-
+
/* bypass file permissions to read from users ssh-agent */
charon->keep_cap(charon, CAP_DAC_OVERRIDE);
-
- charon->processor->queue_job(charon->processor,
+
+ charon->processor->queue_job(charon->processor,
(job_t*)callback_job_create((callback_job_cb_t)run, this, NULL, NULL));
-
+
return &this->public.plugin;
}
diff --git a/src/charon/plugins/nm/nm_service.c b/src/charon/plugins/nm/nm_service.c
index 88a3cc95e..b05383c2b 100644
--- a/src/charon/plugins/nm/nm_service.c
+++ b/src/charon/plugins/nm/nm_service.c
@@ -18,7 +18,6 @@
#include "nm_service.h"
#include <daemon.h>
-#include <asn1/pem.h>
#include <utils/host.h>
#include <utils/identification.h>
#include <config/peer_cfg.h>
@@ -60,7 +59,7 @@ static GValue* handler_to_val(nm_handler_t *handler,
GArray *array;
enumerator_t *enumerator;
chunk_t chunk;
-
+
enumerator = handler->create_enumerator(handler, type);
array = g_array_new (FALSE, TRUE, sizeof (guint32));
while (enumerator->enumerate(enumerator, &chunk))
@@ -71,7 +70,7 @@ static GValue* handler_to_val(nm_handler_t *handler,
val = g_slice_new0 (GValue);
g_value_init (val, DBUS_TYPE_G_UINT_ARRAY);
g_value_set_boxed (val, array);
-
+
return val;
}
@@ -85,37 +84,37 @@ static void signal_ipv4_config(NMVPNPlugin *plugin,
GHashTable *config;
host_t *me, *other;
nm_handler_t *handler;
-
+
config = g_hash_table_new(g_str_hash, g_str_equal);
me = ike_sa->get_my_host(ike_sa);
other = ike_sa->get_other_host(ike_sa);
handler = NM_STRONGSWAN_PLUGIN_GET_PRIVATE(plugin)->handler;
-
+
/* NM requires a tundev, but netkey does not use one. Passing an invalid
* iface makes NM complain, but it accepts it without fiddling on eth0. */
val = g_slice_new0 (GValue);
g_value_init (val, G_TYPE_STRING);
g_value_set_string (val, "none");
g_hash_table_insert (config, NM_VPN_PLUGIN_IP4_CONFIG_TUNDEV, val);
-
+
val = g_slice_new0(GValue);
g_value_init(val, G_TYPE_UINT);
g_value_set_uint(val, *(u_int32_t*)me->get_address(me).ptr);
g_hash_table_insert(config, NM_VPN_PLUGIN_IP4_CONFIG_ADDRESS, val);
-
+
val = g_slice_new0(GValue);
g_value_init(val, G_TYPE_UINT);
g_value_set_uint(val, me->get_address(me).len * 8);
g_hash_table_insert(config, NM_VPN_PLUGIN_IP4_CONFIG_PREFIX, val);
-
+
val = handler_to_val(handler, INTERNAL_IP4_DNS);
g_hash_table_insert(config, NM_VPN_PLUGIN_IP4_CONFIG_DNS, val);
-
+
val = handler_to_val(handler, INTERNAL_IP4_NBNS);
g_hash_table_insert(config, NM_VPN_PLUGIN_IP4_CONFIG_NBNS, val);
-
+
handler->reset(handler);
-
+
nm_vpn_plugin_set_ip4_config(plugin, config);
}
@@ -125,11 +124,11 @@ static void signal_ipv4_config(NMVPNPlugin *plugin,
static void signal_failure(NMVPNPlugin *plugin, NMVPNPluginFailure failure)
{
nm_handler_t *handler = NM_STRONGSWAN_PLUGIN_GET_PRIVATE(plugin)->handler;
-
+
handler->reset(handler);
-
+
/* TODO: NM does not handle this failure!? */
- nm_vpn_plugin_failure(plugin, failure);
+ nm_vpn_plugin_failure(plugin, failure);
nm_vpn_plugin_set_state(plugin, NM_VPN_SERVICE_STATE_STOPPED);
}
@@ -140,7 +139,7 @@ static bool ike_state_change(listener_t *listener, ike_sa_t *ike_sa,
ike_sa_state_t state)
{
NMStrongswanPluginPrivate *private = (NMStrongswanPluginPrivate*)listener;
-
+
if (private->ike_sa == ike_sa && state == IKE_DESTROYING)
{
signal_failure(private->plugin, NM_VPN_PLUGIN_FAILURE_LOGIN_FAILED);
@@ -156,7 +155,7 @@ static bool child_state_change(listener_t *listener, ike_sa_t *ike_sa,
child_sa_t *child_sa, child_sa_state_t state)
{
NMStrongswanPluginPrivate *private = (NMStrongswanPluginPrivate*)listener;
-
+
if (private->ike_sa == ike_sa && state == CHILD_DESTROYING)
{
signal_failure(private->plugin, NM_VPN_PLUGIN_FAILURE_CONNECT_FAILED);
@@ -172,7 +171,7 @@ static bool child_updown(listener_t *listener, ike_sa_t *ike_sa,
child_sa_t *child_sa, bool up)
{
NMStrongswanPluginPrivate *private = (NMStrongswanPluginPrivate*)listener;
-
+
if (private->ike_sa == ike_sa)
{
if (up)
@@ -196,7 +195,7 @@ static bool child_updown(listener_t *listener, ike_sa_t *ike_sa,
static bool ike_rekey(listener_t *listener, ike_sa_t *old, ike_sa_t *new)
{
NMStrongswanPluginPrivate *private = (NMStrongswanPluginPrivate*)listener;
-
+
if (private->ike_sa == old)
{ /* follow a rekeyed IKE_SA */
private->ike_sa = new;
@@ -213,7 +212,7 @@ static gboolean connect_(NMVPNPlugin *plugin, NMConnection *connection,
NMStrongswanPluginPrivate *priv;
NMSettingConnection *conn;
NMSettingVPN *vpn;
- identification_t *user = NULL, *gateway;
+ identification_t *user = NULL, *gateway = NULL;
const char *address, *str;
bool virtual, encap, ipcomp;
ike_cfg_t *ike_cfg;
@@ -226,7 +225,14 @@ static gboolean connect_(NMVPNPlugin *plugin, NMConnection *connection,
certificate_t *cert = NULL;
x509_t *x509;
bool agent = FALSE;
-
+ lifetime_cfg_t lifetime = {
+ .time = {
+ .life = 10800 /* 3h */,
+ .rekey = 10200 /* 2h50min */,
+ .jitter = 300 /* 5min */
+ }
+ };
+
/**
* Read parameters
*/
@@ -248,7 +254,7 @@ static gboolean connect_(NMVPNPlugin *plugin, NMConnection *connection,
if (!address || !*address)
{
g_set_error(err, NM_VPN_PLUGIN_ERROR, NM_VPN_PLUGIN_ERROR_BAD_ARGUMENTS,
- "Gateway address missing.");
+ "Gateway address missing.");
return FALSE;
}
str = nm_setting_vpn_get_data_item(vpn, "virtual");
@@ -274,42 +280,50 @@ static gboolean connect_(NMVPNPlugin *plugin, NMConnection *connection,
auth_class = AUTH_CLASS_PUBKEY;
}
}
-
+
/**
* Register credentials
*/
priv->creds->clear(priv->creds);
-
+
/* gateway/CA cert */
str = nm_setting_vpn_get_data_item(vpn, "certificate");
if (str)
{
cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
BUILD_FROM_FILE, str, BUILD_END);
- priv->creds->set_certificate(priv->creds, cert);
+ if (!cert)
+ {
+ g_set_error(err, NM_VPN_PLUGIN_ERROR,
+ NM_VPN_PLUGIN_ERROR_BAD_ARGUMENTS,
+ "Loading gateway certificate failed.");
+ return FALSE;
+ }
+ priv->creds->add_certificate(priv->creds, cert);
+
+ x509 = (x509_t*)cert;
+ if (!(x509->get_flags(x509) & X509_CA))
+ { /* For a gateway certificate, we use the cert subject as identity. */
+ gateway = cert->get_subject(cert);
+ gateway = gateway->clone(gateway);
+ DBG1(DBG_CFG, "using gateway certificate, identity '%Y'", gateway);
+ }
}
- if (!cert)
+ else
{
- g_set_error(err, NM_VPN_PLUGIN_ERROR, NM_VPN_PLUGIN_ERROR_BAD_ARGUMENTS,
- "Loading gateway certificate failed.");
- return FALSE;
+ /* no certificate defined, fall back to system-wide CA certificates */
+ priv->creds->load_ca_dir(priv->creds, NM_CA_DIR);
}
- x509 = (x509_t*)cert;
- if (x509->get_flags(x509) & X509_CA)
- { /* If the user configured a CA certificate, we use the IP/DNS
+ if (!gateway)
+ {
+ /* If the user configured a CA certificate, we use the IP/DNS
* of the gateway as its identity. This identity will be used for
* certificate lookup and requires the configured IP/DNS to be
* included in the gateway certificate. */
gateway = identification_create_from_string((char*)address);
DBG1(DBG_CFG, "using CA certificate, gateway identity '%Y'", gateway);
}
- else
- { /* For a gateway certificate, we use the cert subject as identity. */
- gateway = cert->get_subject(cert);
- gateway = gateway->clone(gateway);
- DBG1(DBG_CFG, "using gateway certificate, identity '%Y'", gateway);
- }
-
+
if (auth_class == AUTH_CLASS_EAP)
{
/* username/password authentication ... */
@@ -321,7 +335,7 @@ static gboolean connect_(NMVPNPlugin *plugin, NMConnection *connection,
priv->creds->set_username_password(priv->creds, user, (char*)str);
}
}
-
+
if (auth_class == AUTH_CLASS_PUBKEY)
{
/* ... or certificate/private key authenitcation */
@@ -330,7 +344,7 @@ static gboolean connect_(NMVPNPlugin *plugin, NMConnection *connection,
{
public_key_t *public;
private_key_t *private = NULL;
-
+
cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
BUILD_FROM_FILE, str, BUILD_END);
if (!cert)
@@ -341,7 +355,7 @@ static gboolean connect_(NMVPNPlugin *plugin, NMConnection *connection,
gateway->destroy(gateway);
return FALSE;
}
- /* try agent */
+ /* try agent */
str = nm_setting_vpn_get_secret(vpn, "agent");
if (agent && str)
{
@@ -362,24 +376,20 @@ static gboolean connect_(NMVPNPlugin *plugin, NMConnection *connection,
"Connecting to SSH agent failed.");
}
}
- /* ... or key file */
+ /* ... or key file */
str = nm_setting_vpn_get_data_item(vpn, "userkey");
if (!agent && str)
{
- chunk_t secret, chunk;
- bool pgp = FALSE;
-
+ chunk_t secret;
+
secret.ptr = (char*)nm_setting_vpn_get_secret(vpn, "password");
if (secret.ptr)
{
secret.len = strlen(secret.ptr);
}
- if (pem_asn1_load_file((char*)str, &secret, &chunk, &pgp))
- {
- private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY,
- KEY_RSA, BUILD_BLOB_ASN1_DER, chunk, BUILD_END);
- free(chunk.ptr);
- }
+ private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY,
+ KEY_RSA, BUILD_FROM_FILE, str,
+ BUILD_PASSPHRASE, secret, BUILD_END);
if (!private)
{
g_set_error(err, NM_VPN_PLUGIN_ERROR,
@@ -401,7 +411,7 @@ static gboolean connect_(NMVPNPlugin *plugin, NMConnection *connection,
}
}
}
-
+
if (!user)
{
g_set_error(err, NM_VPN_PLUGIN_ERROR, NM_VPN_PLUGIN_ERROR_BAD_ARGUMENTS,
@@ -409,7 +419,7 @@ static gboolean connect_(NMVPNPlugin *plugin, NMConnection *connection,
gateway->destroy(gateway);
return FALSE;
}
-
+
/**
* Set up configurations
*/
@@ -430,12 +440,10 @@ static gboolean connect_(NMVPNPlugin *plugin, NMConnection *connection,
auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PUBKEY);
auth->add(auth, AUTH_RULE_IDENTITY, gateway);
peer_cfg->add_auth_cfg(peer_cfg, auth, FALSE);
-
- child_cfg = child_cfg_create(priv->name,
- 10800, 10200, /* lifetime 3h, rekey 2h50min */
- 300, /* jitter 5min */
+
+ child_cfg = child_cfg_create(priv->name, &lifetime,
NULL, TRUE, MODE_TUNNEL, /* updown, hostaccess */
- ACTION_NONE, ACTION_NONE, ipcomp);
+ ACTION_NONE, ACTION_NONE, ipcomp, 0);
child_cfg->add_proposal(child_cfg, proposal_create_default(PROTO_ESP));
ts = traffic_selector_create_dynamic(0, 0, 65535);
child_cfg->add_traffic_selector(child_cfg, TRUE, ts);
@@ -444,7 +452,7 @@ static gboolean connect_(NMVPNPlugin *plugin, NMConnection *connection,
"255.255.255.255", 65535);
child_cfg->add_traffic_selector(child_cfg, FALSE, ts);
peer_cfg->add_child_cfg(peer_cfg, child_cfg);
-
+
/**
* Prepare IKE_SA
*/
@@ -454,11 +462,8 @@ static gboolean connect_(NMVPNPlugin *plugin, NMConnection *connection,
{
ike_sa->set_peer_cfg(ike_sa, peer_cfg);
}
- else
- {
- peer_cfg->destroy(peer_cfg);
- }
-
+ peer_cfg->destroy(peer_cfg);
+
/**
* Register listener, enable initiate-failure-detection hooks
*/
@@ -466,7 +471,7 @@ static gboolean connect_(NMVPNPlugin *plugin, NMConnection *connection,
priv->listener.ike_state_change = ike_state_change;
priv->listener.child_state_change = child_state_change;
charon->bus->add_listener(charon->bus, &priv->listener);
-
+
/**
* Initiate
*/
@@ -474,9 +479,9 @@ static gboolean connect_(NMVPNPlugin *plugin, NMConnection *connection,
{
charon->bus->remove_listener(charon->bus, &priv->listener);
charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager, ike_sa);
-
+
g_set_error(err, NM_VPN_PLUGIN_ERROR, NM_VPN_PLUGIN_ERROR_LAUNCH_FAILED,
- "Initiating failed.");
+ "Initiating failed.");
return FALSE;
}
charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
@@ -484,16 +489,14 @@ static gboolean connect_(NMVPNPlugin *plugin, NMConnection *connection,
}
/**
- * NeedSecrets called from NM via DBUS
+ * NeedSecrets called from NM via DBUS
*/
static gboolean need_secrets(NMVPNPlugin *plugin, NMConnection *connection,
char **setting_name, GError **error)
{
NMSettingVPN *settings;
const char *method, *path;
- chunk_t secret = chunk_empty, key;
- bool pgp = FALSE;
-
+
settings = NM_SETTING_VPN(nm_connection_get_setting(connection,
NM_TYPE_SETTING_VPN));
method = nm_setting_vpn_get_data_item(settings, "method");
@@ -518,14 +521,21 @@ static gboolean need_secrets(NMVPNPlugin *plugin, NMConnection *connection,
path = nm_setting_vpn_get_data_item(settings, "userkey");
if (path)
{
+ private_key_t *key;
+ chunk_t secret;
+
secret.ptr = (char*)nm_setting_vpn_get_secret(settings, "password");
if (secret.ptr)
{
secret.len = strlen(secret.ptr);
}
- if (pem_asn1_load_file((char*)path, &secret, &key, &pgp))
+ /* try to load/decrypt the private key */
+ key = lib->creds->create(lib->creds, CRED_PRIVATE_KEY,
+ KEY_RSA, BUILD_FROM_FILE, path,
+ BUILD_PASSPHRASE, secret, BUILD_END);
+ if (key)
{
- free(key.ptr);
+ key->destroy(key);
return FALSE;
}
}
@@ -536,7 +546,7 @@ static gboolean need_secrets(NMVPNPlugin *plugin, NMConnection *connection,
}
/**
- * Disconnect called from NM via DBUS
+ * Disconnect called from NM via DBUS
*/
static gboolean disconnect(NMVPNPlugin *plugin, GError **err)
{
@@ -544,7 +554,7 @@ static gboolean disconnect(NMVPNPlugin *plugin, GError **err)
enumerator_t *enumerator;
ike_sa_t *ike_sa;
u_int id;
-
+
/* our ike_sa pointer might be invalid, lookup sa */
enumerator = charon->controller->create_ike_sa_enumerator(charon->controller);
while (enumerator->enumerate(enumerator, &ike_sa))
@@ -559,7 +569,7 @@ static gboolean disconnect(NMVPNPlugin *plugin, GError **err)
}
}
enumerator->destroy(enumerator);
-
+
g_set_error(err, NM_VPN_PLUGIN_ERROR, NM_VPN_PLUGIN_ERROR_GENERAL,
"Connection not found.");
return FALSE;
@@ -571,7 +581,7 @@ static gboolean disconnect(NMVPNPlugin *plugin, GError **err)
static void nm_strongswan_plugin_init(NMStrongswanPlugin *plugin)
{
NMStrongswanPluginPrivate *priv;
-
+
priv = NM_STRONGSWAN_PLUGIN_GET_PRIVATE(plugin);
priv->plugin = NM_VPN_PLUGIN(plugin);
memset(&priv->listener.log, 0, sizeof(listener_t));
@@ -586,7 +596,7 @@ static void nm_strongswan_plugin_class_init(
NMStrongswanPluginClass *strongswan_class)
{
NMVPNPluginClass *parent_class = NM_VPN_PLUGIN_CLASS(strongswan_class);
-
+
g_type_class_add_private(G_OBJECT_CLASS(strongswan_class),
sizeof(NMStrongswanPluginPrivate));
parent_class->connect = connect_;
@@ -607,7 +617,7 @@ NMStrongswanPlugin *nm_strongswan_plugin_new(nm_creds_t *creds,
if (plugin)
{
NMStrongswanPluginPrivate *priv;
-
+
priv = NM_STRONGSWAN_PLUGIN_GET_PRIVATE(plugin);
priv->creds = creds;
priv->handler = handler;
diff --git a/src/charon/plugins/resolv_conf/Makefile.am b/src/charon/plugins/resolv_conf/Makefile.am
deleted file mode 100644
index be7f862f2..000000000
--- a/src/charon/plugins/resolv_conf/Makefile.am
+++ /dev/null
@@ -1,13 +0,0 @@
-
-INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
-
-AM_CFLAGS = -rdynamic \
- -DRESOLV_CONF=\"${resolv_conf}\"
-
-plugin_LTLIBRARIES = libstrongswan-resolv-conf.la
-libstrongswan_resolv_conf_la_SOURCES = \
- resolv_conf_plugin.h resolv_conf_plugin.c \
- resolv_conf_handler.h resolv_conf_handler.c
-libstrongswan_resolv_conf_la_LDFLAGS = -module -avoid-version
-
-
diff --git a/src/charon/plugins/resolve/Makefile.am b/src/charon/plugins/resolve/Makefile.am
new file mode 100644
index 000000000..9d18b00b4
--- /dev/null
+++ b/src/charon/plugins/resolve/Makefile.am
@@ -0,0 +1,13 @@
+
+INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
+
+AM_CFLAGS = -rdynamic \
+ -DRESOLV_CONF=\"${resolv_conf}\"
+
+plugin_LTLIBRARIES = libstrongswan-resolve.la
+libstrongswan_resolve_la_SOURCES = \
+ resolve_plugin.h resolve_plugin.c \
+ resolve_handler.h resolve_handler.c
+libstrongswan_resolve_la_LDFLAGS = -module -avoid-version
+
+
diff --git a/src/charon/plugins/resolv_conf/Makefile.in b/src/charon/plugins/resolve/Makefile.in
index 19c20467a..478935752 100644
--- a/src/charon/plugins/resolv_conf/Makefile.in
+++ b/src/charon/plugins/resolve/Makefile.in
@@ -1,8 +1,9 @@
-# Makefile.in generated by automake 1.10.2 from Makefile.am.
+# Makefile.in generated by automake 1.11 from Makefile.am.
# @configure_input@
# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,
-# 2003, 2004, 2005, 2006, 2007, 2008 Free Software Foundation, Inc.
+# 2003, 2004, 2005, 2006, 2007, 2008, 2009 Free Software Foundation,
+# Inc.
# This Makefile.in is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.
@@ -16,8 +17,9 @@
VPATH = @srcdir@
pkgdatadir = $(datadir)/@PACKAGE@
-pkglibdir = $(libdir)/@PACKAGE@
pkgincludedir = $(includedir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkglibexecdir = $(libexecdir)/@PACKAGE@
am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
install_sh_DATA = $(install_sh) -c -m 644
install_sh_PROGRAM = $(install_sh) -c
@@ -32,35 +34,57 @@ PRE_UNINSTALL = :
POST_UNINSTALL = :
build_triplet = @build@
host_triplet = @host@
-subdir = src/charon/plugins/resolv_conf
+subdir = src/charon/plugins/resolve
DIST_COMMON = $(srcdir)/Makefile.am $(srcdir)/Makefile.in
ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
-am__aclocal_m4_deps = $(top_srcdir)/configure.in
+am__aclocal_m4_deps = $(top_srcdir)/m4/config/libtool.m4 \
+ $(top_srcdir)/m4/config/ltoptions.m4 \
+ $(top_srcdir)/m4/config/ltsugar.m4 \
+ $(top_srcdir)/m4/config/ltversion.m4 \
+ $(top_srcdir)/m4/config/lt~obsolete.m4 \
+ $(top_srcdir)/m4/macros/with.m4 \
+ $(top_srcdir)/m4/macros/enable-disable.m4 \
+ $(top_srcdir)/configure.in
am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
$(ACLOCAL_M4)
mkinstalldirs = $(install_sh) -d
CONFIG_CLEAN_FILES =
+CONFIG_CLEAN_VPATH_FILES =
am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
am__vpath_adj = case $$p in \
$(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
*) f=$$p;; \
esac;
-am__strip_dir = `echo $$p | sed -e 's|^.*/||'`;
+am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
+am__install_max = 40
+am__nobase_strip_setup = \
+ srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
+am__nobase_strip = \
+ for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
+am__nobase_list = $(am__nobase_strip_setup); \
+ for p in $$list; do echo "$$p $$p"; done | \
+ sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
+ $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
+ if (++n[$$2] == $(am__install_max)) \
+ { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
+ END { for (dir in files) print dir, files[dir] }'
+am__base_list = \
+ sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
+ sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
am__installdirs = "$(DESTDIR)$(plugindir)"
-pluginLTLIBRARIES_INSTALL = $(INSTALL)
LTLIBRARIES = $(plugin_LTLIBRARIES)
-libstrongswan_resolv_conf_la_LIBADD =
-am_libstrongswan_resolv_conf_la_OBJECTS = resolv_conf_plugin.lo \
- resolv_conf_handler.lo
-libstrongswan_resolv_conf_la_OBJECTS = \
- $(am_libstrongswan_resolv_conf_la_OBJECTS)
-libstrongswan_resolv_conf_la_LINK = $(LIBTOOL) --tag=CC \
- $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \
- $(AM_CFLAGS) $(CFLAGS) $(libstrongswan_resolv_conf_la_LDFLAGS) \
- $(LDFLAGS) -o $@
+libstrongswan_resolve_la_LIBADD =
+am_libstrongswan_resolve_la_OBJECTS = resolve_plugin.lo \
+ resolve_handler.lo
+libstrongswan_resolve_la_OBJECTS = \
+ $(am_libstrongswan_resolve_la_OBJECTS)
+libstrongswan_resolve_la_LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) \
+ $(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \
+ $(libstrongswan_resolve_la_LDFLAGS) $(LDFLAGS) -o $@
DEFAULT_INCLUDES = -I.@am__isrc@
depcomp = $(SHELL) $(top_srcdir)/depcomp
am__depfiles_maybe = depfiles
+am__mv = mv -f
COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
LTCOMPILE = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
@@ -70,8 +94,8 @@ CCLD = $(CC)
LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
--mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) $(AM_LDFLAGS) \
$(LDFLAGS) -o $@
-SOURCES = $(libstrongswan_resolv_conf_la_SOURCES)
-DIST_SOURCES = $(libstrongswan_resolv_conf_la_SOURCES)
+SOURCES = $(libstrongswan_resolve_la_SOURCES)
+DIST_SOURCES = $(libstrongswan_resolve_la_SOURCES)
ETAGS = etags
CTAGS = ctags
DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
@@ -108,25 +132,22 @@ INSTALL_DATA = @INSTALL_DATA@
INSTALL_PROGRAM = @INSTALL_PROGRAM@
INSTALL_SCRIPT = @INSTALL_SCRIPT@
INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
-IPSEC_ROUTING_TABLE = @IPSEC_ROUTING_TABLE@
-IPSEC_ROUTING_TABLE_PRIO = @IPSEC_ROUTING_TABLE_PRIO@
LD = @LD@
LDFLAGS = @LDFLAGS@
LEX = @LEX@
LEXLIB = @LEXLIB@
LEX_OUTPUT_ROOT = @LEX_OUTPUT_ROOT@
-LIBGCRYPT_CFLAGS = @LIBGCRYPT_CFLAGS@
-LIBGCRYPT_CONFIG = @LIBGCRYPT_CONFIG@
-LIBGCRYPT_LIBS = @LIBGCRYPT_LIBS@
LIBOBJS = @LIBOBJS@
LIBS = @LIBS@
LIBTOOL = @LIBTOOL@
-LINUX_HEADERS = @LINUX_HEADERS@
LIPO = @LIPO@
LN_S = @LN_S@
LTLIBOBJS = @LTLIBOBJS@
MAKEINFO = @MAKEINFO@
MKDIR_P = @MKDIR_P@
+MYSQLCFLAG = @MYSQLCFLAG@
+MYSQLCONFIG = @MYSQLCONFIG@
+MYSQLLIB = @MYSQLLIB@
NM = @NM@
NMEDIT = @NMEDIT@
OBJDUMP = @OBJDUMP@
@@ -138,11 +159,14 @@ PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
PACKAGE_NAME = @PACKAGE_NAME@
PACKAGE_STRING = @PACKAGE_STRING@
PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_URL = @PACKAGE_URL@
PACKAGE_VERSION = @PACKAGE_VERSION@
PATH_SEPARATOR = @PATH_SEPARATOR@
PERL = @PERL@
PKG_CONFIG = @PKG_CONFIG@
+PTHREADLIB = @PTHREADLIB@
RANLIB = @RANLIB@
+RTLIB = @RTLIB@
RUBY = @RUBY@
RUBYINCLUDE = @RUBYINCLUDE@
SED = @SED@
@@ -171,9 +195,9 @@ build_cpu = @build_cpu@
build_os = @build_os@
build_vendor = @build_vendor@
builddir = @builddir@
-confdir = @confdir@
datadir = @datadir@
datarootdir = @datarootdir@
+default_pkcs11 = @default_pkcs11@
docdir = @docdir@
dvidir = @dvidir@
exec_prefix = @exec_prefix@
@@ -196,7 +220,7 @@ ipsecuser = @ipsecuser@
libdir = @libdir@
libexecdir = @libexecdir@
libstrongswan_plugins = @libstrongswan_plugins@
-linuxdir = @linuxdir@
+linux_headers = @linux_headers@
localedir = @localedir@
localstatedir = @localstatedir@
lt_ECHO = @lt_ECHO@
@@ -204,6 +228,7 @@ mandir = @mandir@
mkdir_p = @mkdir_p@
nm_CFLAGS = @nm_CFLAGS@
nm_LIBS = @nm_LIBS@
+nm_ca_dir = @nm_ca_dir@
oldincludedir = @oldincludedir@
pdfdir = @pdfdir@
piddir = @piddir@
@@ -212,10 +237,12 @@ pluto_plugins = @pluto_plugins@
prefix = @prefix@
program_transform_name = @program_transform_name@
psdir = @psdir@
+random_device = @random_device@
resolv_conf = @resolv_conf@
+routing_table = @routing_table@
+routing_table_prio = @routing_table_prio@
sbindir = @sbindir@
sharedstatedir = @sharedstatedir@
-simreader = @simreader@
srcdir = @srcdir@
strongswan_conf = @strongswan_conf@
sysconfdir = @sysconfdir@
@@ -223,18 +250,19 @@ target_alias = @target_alias@
top_build_prefix = @top_build_prefix@
top_builddir = @top_builddir@
top_srcdir = @top_srcdir@
+urandom_device = @urandom_device@
xml_CFLAGS = @xml_CFLAGS@
xml_LIBS = @xml_LIBS@
INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
AM_CFLAGS = -rdynamic \
-DRESOLV_CONF=\"${resolv_conf}\"
-plugin_LTLIBRARIES = libstrongswan-resolv-conf.la
-libstrongswan_resolv_conf_la_SOURCES = \
- resolv_conf_plugin.h resolv_conf_plugin.c \
- resolv_conf_handler.h resolv_conf_handler.c
+plugin_LTLIBRARIES = libstrongswan-resolve.la
+libstrongswan_resolve_la_SOURCES = \
+ resolve_plugin.h resolve_plugin.c \
+ resolve_handler.h resolve_handler.c
-libstrongswan_resolv_conf_la_LDFLAGS = -module -avoid-version
+libstrongswan_resolve_la_LDFLAGS = -module -avoid-version
all: all-am
.SUFFIXES:
@@ -248,9 +276,9 @@ $(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps)
exit 1;; \
esac; \
done; \
- echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/charon/plugins/resolv_conf/Makefile'; \
- cd $(top_srcdir) && \
- $(AUTOMAKE) --gnu src/charon/plugins/resolv_conf/Makefile
+ echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/charon/plugins/resolve/Makefile'; \
+ $(am__cd) $(top_srcdir) && \
+ $(AUTOMAKE) --gnu src/charon/plugins/resolve/Makefile
.PRECIOUS: Makefile
Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
@case '$?' in \
@@ -268,23 +296,28 @@ $(top_srcdir)/configure: $(am__configure_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
$(ACLOCAL_M4): $(am__aclocal_m4_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(am__aclocal_m4_deps):
install-pluginLTLIBRARIES: $(plugin_LTLIBRARIES)
@$(NORMAL_INSTALL)
test -z "$(plugindir)" || $(MKDIR_P) "$(DESTDIR)$(plugindir)"
- @list='$(plugin_LTLIBRARIES)'; for p in $$list; do \
+ @list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+ list2=; for p in $$list; do \
if test -f $$p; then \
- f=$(am__strip_dir) \
- echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(pluginLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) '$$p' '$(DESTDIR)$(plugindir)/$$f'"; \
- $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(pluginLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) "$$p" "$(DESTDIR)$(plugindir)/$$f"; \
+ list2="$$list2 $$p"; \
else :; fi; \
- done
+ done; \
+ test -z "$$list2" || { \
+ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(plugindir)'"; \
+ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(plugindir)"; \
+ }
uninstall-pluginLTLIBRARIES:
@$(NORMAL_UNINSTALL)
- @list='$(plugin_LTLIBRARIES)'; for p in $$list; do \
- p=$(am__strip_dir) \
- echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$p'"; \
- $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$p"; \
+ @list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+ for p in $$list; do \
+ $(am__strip_dir) \
+ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$f'"; \
+ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$f"; \
done
clean-pluginLTLIBRARIES:
@@ -295,8 +328,8 @@ clean-pluginLTLIBRARIES:
echo "rm -f \"$${dir}/so_locations\""; \
rm -f "$${dir}/so_locations"; \
done
-libstrongswan-resolv-conf.la: $(libstrongswan_resolv_conf_la_OBJECTS) $(libstrongswan_resolv_conf_la_DEPENDENCIES)
- $(libstrongswan_resolv_conf_la_LINK) -rpath $(plugindir) $(libstrongswan_resolv_conf_la_OBJECTS) $(libstrongswan_resolv_conf_la_LIBADD) $(LIBS)
+libstrongswan-resolve.la: $(libstrongswan_resolve_la_OBJECTS) $(libstrongswan_resolve_la_DEPENDENCIES)
+ $(libstrongswan_resolve_la_LINK) -rpath $(plugindir) $(libstrongswan_resolve_la_OBJECTS) $(libstrongswan_resolve_la_LIBADD) $(LIBS)
mostlyclean-compile:
-rm -f *.$(OBJEXT)
@@ -304,26 +337,26 @@ mostlyclean-compile:
distclean-compile:
-rm -f *.tab.c
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/resolv_conf_handler.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/resolv_conf_plugin.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/resolve_handler.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/resolve_plugin.Plo@am__quote@
.c.o:
@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(COMPILE) -c $<
.c.obj:
@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(COMPILE) -c `$(CYGPATH_W) '$<'`
.c.lo:
@am__fastdepCC_TRUE@ $(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(LTCOMPILE) -c -o $@ $<
@@ -346,7 +379,7 @@ tags: TAGS
TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
$(TAGS_FILES) $(LISP)
- tags=; \
+ set x; \
here=`pwd`; \
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
unique=`for i in $$list; do \
@@ -354,29 +387,34 @@ TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
- if test -z "$(ETAGS_ARGS)$$tags$$unique"; then :; else \
+ shift; \
+ if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
test -n "$$unique" || unique=$$empty_fix; \
- $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
- $$tags $$unique; \
+ if test $$# -gt 0; then \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ "$$@" $$unique; \
+ else \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ $$unique; \
+ fi; \
fi
ctags: CTAGS
CTAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
$(TAGS_FILES) $(LISP)
- tags=; \
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
unique=`for i in $$list; do \
if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
- test -z "$(CTAGS_ARGS)$$tags$$unique" \
+ test -z "$(CTAGS_ARGS)$$unique" \
|| $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
- $$tags $$unique
+ $$unique
GTAGS:
here=`$(am__cd) $(top_builddir) && pwd` \
- && cd $(top_srcdir) \
- && gtags -i $(GTAGS_ARGS) $$here
+ && $(am__cd) $(top_srcdir) \
+ && gtags -i $(GTAGS_ARGS) "$$here"
distclean-tags:
-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
@@ -397,13 +435,17 @@ distdir: $(DISTFILES)
if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
if test -d $$d/$$file; then \
dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
+ if test -d "$(distdir)/$$file"; then \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+ fi; \
if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
- cp -pR $(srcdir)/$$file $(distdir)$$dir || exit 1; \
+ cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
fi; \
- cp -pR $$d/$$file $(distdir)$$dir || exit 1; \
+ cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
else \
- test -f $(distdir)/$$file \
- || cp -p $$d/$$file $(distdir)/$$file \
+ test -f "$(distdir)/$$file" \
+ || cp -p $$d/$$file "$(distdir)/$$file" \
|| exit 1; \
fi; \
done
@@ -434,6 +476,7 @@ clean-generic:
distclean-generic:
-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+ -test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
maintainer-clean-generic:
@echo "This command is intended for maintainers to use"
@@ -455,6 +498,8 @@ dvi-am:
html: html-am
+html-am:
+
info: info-am
info-am:
@@ -463,18 +508,28 @@ install-data-am: install-pluginLTLIBRARIES
install-dvi: install-dvi-am
+install-dvi-am:
+
install-exec-am:
install-html: install-html-am
+install-html-am:
+
install-info: install-info-am
+install-info-am:
+
install-man:
install-pdf: install-pdf-am
+install-pdf-am:
+
install-ps: install-ps-am
+install-ps-am:
+
installcheck-am:
maintainer-clean: maintainer-clean-am
@@ -513,6 +568,7 @@ uninstall-am: uninstall-pluginLTLIBRARIES
mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \
tags uninstall uninstall-am uninstall-pluginLTLIBRARIES
+
# Tell versions [3.59,3.63) of GNU make to not export all variables.
# Otherwise a system limit (for SysV at least) may be exceeded.
.NOEXPORT:
diff --git a/src/charon/plugins/resolv_conf/resolv_conf_handler.c b/src/charon/plugins/resolve/resolve_handler.c
index 749cfbc5b..714c751a6 100644
--- a/src/charon/plugins/resolv_conf/resolv_conf_handler.c
+++ b/src/charon/plugins/resolve/resolve_handler.c
@@ -13,30 +13,30 @@
* for more details.
*/
-#include "resolv_conf_handler.h"
+#include "resolve_handler.h"
#include <unistd.h>
#include <daemon.h>
-#include <utils/mutex.h>
+#include <threading/mutex.h>
-typedef struct private_resolv_conf_handler_t private_resolv_conf_handler_t;
+typedef struct private_resolve_handler_t private_resolve_handler_t;
/**
- * Private data of an resolv_conf_handler_t object.
+ * Private data of an resolve_handler_t object.
*/
-struct private_resolv_conf_handler_t {
-
+struct private_resolve_handler_t {
+
/**
- * Public resolv_conf_handler_t interface.
+ * Public resolve_handler_t interface.
*/
- resolv_conf_handler_t public;
-
+ resolve_handler_t public;
+
/**
* resolv.conf file to use
*/
char *file;
-
+
/**
* Mutex to access file exclusively
*/
@@ -46,43 +46,44 @@ struct private_resolv_conf_handler_t {
/**
* Implementation of attribute_handler_t.handle
*/
-static bool handle(private_resolv_conf_handler_t *this, ike_sa_t *ike_sa,
+static bool handle(private_resolve_handler_t *this, identification_t *server,
configuration_attribute_type_t type, chunk_t data)
{
FILE *in, *out;
char buf[1024];
host_t *addr;
- int family;
size_t len;
bool handled = FALSE;
-
+
switch (type)
{
case INTERNAL_IP4_DNS:
- family = AF_INET;
+ addr = host_create_from_chunk(AF_INET, data, 0);
break;
case INTERNAL_IP6_DNS:
- family = AF_INET6;
+ addr = host_create_from_chunk(AF_INET6, data, 0);
break;
default:
return FALSE;
}
-
+
+ if (!addr || addr->is_anyaddr(addr))
+ {
+ DESTROY_IF(addr);
+ return FALSE;
+ }
this->mutex->lock(this->mutex);
-
+
in = fopen(this->file, "r");
/* allows us to stream from in to out */
unlink(this->file);
out = fopen(this->file, "w");
if (out)
{
- addr = host_create_from_chunk(family, data, 0);
- fprintf(out, "nameserver %H # by strongSwan, from %Y\n",
- addr, ike_sa->get_other_id(ike_sa));
+ fprintf(out, "nameserver %H # by strongSwan, from %Y\n", addr, server);
DBG1(DBG_IKE, "installing DNS server %H to %s", addr, this->file);
- addr->destroy(addr);
handled = TRUE;
-
+
/* copy rest of the file */
if (in)
{
@@ -90,30 +91,34 @@ static bool handle(private_resolv_conf_handler_t *this, ike_sa_t *ike_sa,
{
ignore_result(fwrite(buf, 1, len, out));
}
- fclose(in);
}
fclose(out);
}
-
+ if (in)
+ {
+ fclose(in);
+ }
+ this->mutex->unlock(this->mutex);
+ addr->destroy(addr);
+
if (!handled)
{
DBG1(DBG_IKE, "adding DNS server failed", this->file);
}
- this->mutex->unlock(this->mutex);
return handled;
}
/**
* Implementation of attribute_handler_t.release
*/
-static void release(private_resolv_conf_handler_t *this, ike_sa_t *ike_sa,
+static void release(private_resolve_handler_t *this, identification_t *server,
configuration_attribute_type_t type, chunk_t data)
{
FILE *in, *out;
char line[1024], matcher[512], *pos;
host_t *addr;
int family;
-
+
switch (type)
{
case INTERNAL_IP4_DNS:
@@ -125,9 +130,9 @@ static void release(private_resolv_conf_handler_t *this, ike_sa_t *ike_sa,
default:
return;
}
-
+
this->mutex->lock(this->mutex);
-
+
in = fopen(this->file, "r");
if (in)
{
@@ -139,8 +144,8 @@ static void release(private_resolv_conf_handler_t *this, ike_sa_t *ike_sa,
addr = host_create_from_chunk(family, data, 0);
snprintf(matcher, sizeof(matcher),
"nameserver %H # by strongSwan, from %Y\n",
- addr, ike_sa->get_other_id(ike_sa));
-
+ addr, server);
+
/* copy all, but matching line */
while ((pos = fgets(line, sizeof(line), in)))
{
@@ -159,14 +164,67 @@ static void release(private_resolv_conf_handler_t *this, ike_sa_t *ike_sa,
}
fclose(in);
}
-
+
this->mutex->unlock(this->mutex);
}
/**
- * Implementation of resolv_conf_handler_t.destroy.
+ * Attribute enumerator implementation
+ */
+typedef struct {
+ /** implements enumerator_t interface */
+ enumerator_t public;
+ /** virtual IP we are requesting */
+ host_t *vip;
+} attribute_enumerator_t;
+
+/**
+ * Implementation of create_attribute_enumerator().enumerate()
+ */
+static bool attribute_enumerate(attribute_enumerator_t *this,
+ configuration_attribute_type_t *type, chunk_t *data)
+{
+ switch (this->vip->get_family(this->vip))
+ {
+ case AF_INET:
+ *type = INTERNAL_IP4_DNS;
+ break;
+ case AF_INET6:
+ *type = INTERNAL_IP6_DNS;
+ break;
+ default:
+ return FALSE;
+ }
+ *data = chunk_empty;
+ /* enumerate only once */
+ this->public.enumerate = (void*)return_false;
+ return TRUE;
+}
+
+/**
+ * Implementation of attribute_handler_t.create_attribute_enumerator
*/
-static void destroy(private_resolv_conf_handler_t *this)
+static enumerator_t* create_attribute_enumerator(private_resolve_handler_t *this,
+ identification_t *server, host_t *vip)
+{
+ if (vip)
+ {
+ attribute_enumerator_t *enumerator;
+
+ enumerator = malloc_thing(attribute_enumerator_t);
+ enumerator->public.enumerate = (void*)attribute_enumerate;
+ enumerator->public.destroy = (void*)free;
+ enumerator->vip = vip;
+
+ return &enumerator->public;
+ }
+ return enumerator_create_empty();
+}
+
+/**
+ * Implementation of resolve_handler_t.destroy.
+ */
+static void destroy(private_resolve_handler_t *this)
{
this->mutex->destroy(this->mutex);
free(this);
@@ -175,18 +233,19 @@ static void destroy(private_resolv_conf_handler_t *this)
/**
* See header
*/
-resolv_conf_handler_t *resolv_conf_handler_create()
+resolve_handler_t *resolve_handler_create()
{
- private_resolv_conf_handler_t *this = malloc_thing(private_resolv_conf_handler_t);
-
- this->public.handler.handle = (bool(*)(attribute_handler_t*, ike_sa_t*, configuration_attribute_type_t, chunk_t))handle;
- this->public.handler.release = (void(*)(attribute_handler_t*, ike_sa_t*, configuration_attribute_type_t, chunk_t))release;
- this->public.destroy = (void(*)(resolv_conf_handler_t*))destroy;
-
+ private_resolve_handler_t *this = malloc_thing(private_resolve_handler_t);
+
+ this->public.handler.handle = (bool(*)(attribute_handler_t*, identification_t*, configuration_attribute_type_t, chunk_t))handle;
+ this->public.handler.release = (void(*)(attribute_handler_t*, identification_t*, configuration_attribute_type_t, chunk_t))release;
+ this->public.handler.create_attribute_enumerator = (enumerator_t*(*)(attribute_handler_t*, identification_t *server, host_t *vip))create_attribute_enumerator;
+ this->public.destroy = (void(*)(resolve_handler_t*))destroy;
+
this->mutex = mutex_create(MUTEX_TYPE_DEFAULT);
this->file = lib->settings->get_str(lib->settings,
- "charon.plugins.resolv-conf.file", RESOLV_CONF);
-
+ "charon.plugins.resolve.file", RESOLV_CONF);
+
return &this->public;
}
diff --git a/src/charon/plugins/resolv_conf/resolv_conf_handler.h b/src/charon/plugins/resolve/resolve_handler.h
index 2635bb802..77bf9781c 100644
--- a/src/charon/plugins/resolv_conf/resolv_conf_handler.h
+++ b/src/charon/plugins/resolve/resolve_handler.h
@@ -14,36 +14,36 @@
*/
/**
- * @defgroup resolv_conf_handler resolv_conf_handler
- * @{ @ingroup resolv_conf
+ * @defgroup resolve_handler resolve_handler
+ * @{ @ingroup resolve
*/
-#ifndef RESOLV_CONF_HANDLER_H_
-#define RESOLV_CONF_HANDLER_H_
+#ifndef RESOLVE_HANDLER_H_
+#define RESOLVE_HANDLER_H_
-#include <config/attributes/attribute_handler.h>
+#include <attributes/attribute_handler.h>
-typedef struct resolv_conf_handler_t resolv_conf_handler_t;
+typedef struct resolve_handler_t resolve_handler_t;
/**
* Handle DNS configuration attributes by mangling a resolv.conf file.
*/
-struct resolv_conf_handler_t {
-
+struct resolve_handler_t {
+
/**
* Implements the attribute_handler_t interface
*/
attribute_handler_t handler;
-
+
/**
- * Destroy a resolv_conf_handler_t.
+ * Destroy a resolve_handler_t.
*/
- void (*destroy)(resolv_conf_handler_t *this);
+ void (*destroy)(resolve_handler_t *this);
};
/**
- * Create a resolv_conf_handler instance.
+ * Create a resolve_handler instance.
*/
-resolv_conf_handler_t *resolv_conf_handler_create();
+resolve_handler_t *resolve_handler_create();
-#endif /* RESOLV_CONF_HANDLER_ @}*/
+#endif /** RESOLVE_HANDLER_H_ @}*/
diff --git a/src/charon/plugins/resolv_conf/resolv_conf_plugin.c b/src/charon/plugins/resolve/resolve_plugin.c
index ff9d96eb3..c564981ef 100644
--- a/src/charon/plugins/resolv_conf/resolv_conf_plugin.c
+++ b/src/charon/plugins/resolve/resolve_plugin.c
@@ -13,36 +13,35 @@
* for more details.
*/
-#include "resolv_conf_plugin.h"
-#include "resolv_conf_handler.h"
+#include "resolve_plugin.h"
+#include "resolve_handler.h"
#include <daemon.h>
-typedef struct private_resolv_conf_plugin_t private_resolv_conf_plugin_t;
+typedef struct private_resolve_plugin_t private_resolve_plugin_t;
/**
- * private data of resolv_conf plugin
+ * private data of resolve plugin
*/
-struct private_resolv_conf_plugin_t {
+struct private_resolve_plugin_t {
/**
* implements plugin interface
*/
- resolv_conf_plugin_t public;
-
+ resolve_plugin_t public;
+
/**
* The registerd DNS attribute handler
*/
- resolv_conf_handler_t *handler;
+ resolve_handler_t *handler;
};
/**
* Implementation of plugin_t.destroy
*/
-static void destroy(private_resolv_conf_plugin_t *this)
+static void destroy(private_resolve_plugin_t *this)
{
- charon->attributes->remove_handler(charon->attributes,
- &this->handler->handler);
+ lib->attributes->remove_handler(lib->attributes, &this->handler->handler);
this->handler->destroy(this->handler);
free(this);
}
@@ -52,13 +51,12 @@ static void destroy(private_resolv_conf_plugin_t *this)
*/
plugin_t *plugin_create()
{
- private_resolv_conf_plugin_t *this = malloc_thing(private_resolv_conf_plugin_t);
-
+ private_resolve_plugin_t *this = malloc_thing(private_resolve_plugin_t);
+
this->public.plugin.destroy = (void(*)(plugin_t*))destroy;
-
- this->handler = resolv_conf_handler_create();
- charon->attributes->add_handler(charon->attributes, &this->handler->handler);
-
+ this->handler = resolve_handler_create();
+ lib->attributes->add_handler(lib->attributes, &this->handler->handler);
+
return &this->public.plugin;
}
diff --git a/src/charon/plugins/resolv_conf/resolv_conf_plugin.h b/src/charon/plugins/resolve/resolve_plugin.h
index f5943d9a3..d7e09f284 100644
--- a/src/charon/plugins/resolv_conf/resolv_conf_plugin.h
+++ b/src/charon/plugins/resolve/resolve_plugin.h
@@ -14,25 +14,25 @@
*/
/**
- * @defgroup resolv_conf resolv_conf
+ * @defgroup resolve resolve
* @ingroup cplugins
*
- * @defgroup resolv_conf_plugin resolv_conf_plugin
- * @{ @ingroup resolv_conf
+ * @defgroup resolve_plugin resolve_plugin
+ * @{ @ingroup resolve
*/
-#ifndef RESOLV_CONF_PLUGIN_H_
-#define RESOLV_CONF_PLUGIN_H_
+#ifndef RESOLVE_PLUGIN_H_
+#define RESOLVE_PLUGIN_H_
#include <plugins/plugin.h>
-typedef struct resolv_conf_plugin_t resolv_conf_plugin_t;
+typedef struct resolve_plugin_t resolve_plugin_t;
/**
* Plugin that writes received DNS servers in a resolv.conf file.
*/
-struct resolv_conf_plugin_t {
-
+struct resolve_plugin_t {
+
/**
* implements plugin interface
*/
@@ -40,8 +40,8 @@ struct resolv_conf_plugin_t {
};
/**
- * Create a resolv_conf_plugin instance.
+ * Create a resolve_plugin instance.
*/
plugin_t *plugin_create();
-#endif /** RESOLV_CONF_PLUGIN_H_ @}*/
+#endif /** RESOLVE_PLUGIN_H_ @}*/
diff --git a/src/charon/plugins/smp/Makefile.in b/src/charon/plugins/smp/Makefile.in
index d23d2d001..7512cd2f7 100644
--- a/src/charon/plugins/smp/Makefile.in
+++ b/src/charon/plugins/smp/Makefile.in
@@ -1,8 +1,9 @@
-# Makefile.in generated by automake 1.10.2 from Makefile.am.
+# Makefile.in generated by automake 1.11 from Makefile.am.
# @configure_input@
# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,
-# 2003, 2004, 2005, 2006, 2007, 2008 Free Software Foundation, Inc.
+# 2003, 2004, 2005, 2006, 2007, 2008, 2009 Free Software Foundation,
+# Inc.
# This Makefile.in is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.
@@ -16,8 +17,9 @@
VPATH = @srcdir@
pkgdatadir = $(datadir)/@PACKAGE@
-pkglibdir = $(libdir)/@PACKAGE@
pkgincludedir = $(includedir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkglibexecdir = $(libexecdir)/@PACKAGE@
am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
install_sh_DATA = $(install_sh) -c -m 644
install_sh_PROGRAM = $(install_sh) -c
@@ -35,19 +37,41 @@ host_triplet = @host@
subdir = src/charon/plugins/smp
DIST_COMMON = $(srcdir)/Makefile.am $(srcdir)/Makefile.in
ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
-am__aclocal_m4_deps = $(top_srcdir)/configure.in
+am__aclocal_m4_deps = $(top_srcdir)/m4/config/libtool.m4 \
+ $(top_srcdir)/m4/config/ltoptions.m4 \
+ $(top_srcdir)/m4/config/ltsugar.m4 \
+ $(top_srcdir)/m4/config/ltversion.m4 \
+ $(top_srcdir)/m4/config/lt~obsolete.m4 \
+ $(top_srcdir)/m4/macros/with.m4 \
+ $(top_srcdir)/m4/macros/enable-disable.m4 \
+ $(top_srcdir)/configure.in
am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
$(ACLOCAL_M4)
mkinstalldirs = $(install_sh) -d
CONFIG_CLEAN_FILES =
+CONFIG_CLEAN_VPATH_FILES =
am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
am__vpath_adj = case $$p in \
$(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
*) f=$$p;; \
esac;
-am__strip_dir = `echo $$p | sed -e 's|^.*/||'`;
+am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
+am__install_max = 40
+am__nobase_strip_setup = \
+ srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
+am__nobase_strip = \
+ for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
+am__nobase_list = $(am__nobase_strip_setup); \
+ for p in $$list; do echo "$$p $$p"; done | \
+ sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
+ $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
+ if (++n[$$2] == $(am__install_max)) \
+ { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
+ END { for (dir in files) print dir, files[dir] }'
+am__base_list = \
+ sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
+ sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
am__installdirs = "$(DESTDIR)$(plugindir)"
-pluginLTLIBRARIES_INSTALL = $(INSTALL)
LTLIBRARIES = $(plugin_LTLIBRARIES)
am__DEPENDENCIES_1 =
libstrongswan_smp_la_DEPENDENCIES = $(am__DEPENDENCIES_1)
@@ -59,6 +83,7 @@ libstrongswan_smp_la_LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) \
DEFAULT_INCLUDES = -I.@am__isrc@
depcomp = $(SHELL) $(top_srcdir)/depcomp
am__depfiles_maybe = depfiles
+am__mv = mv -f
COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
LTCOMPILE = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
@@ -106,25 +131,22 @@ INSTALL_DATA = @INSTALL_DATA@
INSTALL_PROGRAM = @INSTALL_PROGRAM@
INSTALL_SCRIPT = @INSTALL_SCRIPT@
INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
-IPSEC_ROUTING_TABLE = @IPSEC_ROUTING_TABLE@
-IPSEC_ROUTING_TABLE_PRIO = @IPSEC_ROUTING_TABLE_PRIO@
LD = @LD@
LDFLAGS = @LDFLAGS@
LEX = @LEX@
LEXLIB = @LEXLIB@
LEX_OUTPUT_ROOT = @LEX_OUTPUT_ROOT@
-LIBGCRYPT_CFLAGS = @LIBGCRYPT_CFLAGS@
-LIBGCRYPT_CONFIG = @LIBGCRYPT_CONFIG@
-LIBGCRYPT_LIBS = @LIBGCRYPT_LIBS@
LIBOBJS = @LIBOBJS@
LIBS = @LIBS@
LIBTOOL = @LIBTOOL@
-LINUX_HEADERS = @LINUX_HEADERS@
LIPO = @LIPO@
LN_S = @LN_S@
LTLIBOBJS = @LTLIBOBJS@
MAKEINFO = @MAKEINFO@
MKDIR_P = @MKDIR_P@
+MYSQLCFLAG = @MYSQLCFLAG@
+MYSQLCONFIG = @MYSQLCONFIG@
+MYSQLLIB = @MYSQLLIB@
NM = @NM@
NMEDIT = @NMEDIT@
OBJDUMP = @OBJDUMP@
@@ -136,11 +158,14 @@ PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
PACKAGE_NAME = @PACKAGE_NAME@
PACKAGE_STRING = @PACKAGE_STRING@
PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_URL = @PACKAGE_URL@
PACKAGE_VERSION = @PACKAGE_VERSION@
PATH_SEPARATOR = @PATH_SEPARATOR@
PERL = @PERL@
PKG_CONFIG = @PKG_CONFIG@
+PTHREADLIB = @PTHREADLIB@
RANLIB = @RANLIB@
+RTLIB = @RTLIB@
RUBY = @RUBY@
RUBYINCLUDE = @RUBYINCLUDE@
SED = @SED@
@@ -169,9 +194,9 @@ build_cpu = @build_cpu@
build_os = @build_os@
build_vendor = @build_vendor@
builddir = @builddir@
-confdir = @confdir@
datadir = @datadir@
datarootdir = @datarootdir@
+default_pkcs11 = @default_pkcs11@
docdir = @docdir@
dvidir = @dvidir@
exec_prefix = @exec_prefix@
@@ -194,7 +219,7 @@ ipsecuser = @ipsecuser@
libdir = @libdir@
libexecdir = @libexecdir@
libstrongswan_plugins = @libstrongswan_plugins@
-linuxdir = @linuxdir@
+linux_headers = @linux_headers@
localedir = @localedir@
localstatedir = @localstatedir@
lt_ECHO = @lt_ECHO@
@@ -202,6 +227,7 @@ mandir = @mandir@
mkdir_p = @mkdir_p@
nm_CFLAGS = @nm_CFLAGS@
nm_LIBS = @nm_LIBS@
+nm_ca_dir = @nm_ca_dir@
oldincludedir = @oldincludedir@
pdfdir = @pdfdir@
piddir = @piddir@
@@ -210,10 +236,12 @@ pluto_plugins = @pluto_plugins@
prefix = @prefix@
program_transform_name = @program_transform_name@
psdir = @psdir@
+random_device = @random_device@
resolv_conf = @resolv_conf@
+routing_table = @routing_table@
+routing_table_prio = @routing_table_prio@
sbindir = @sbindir@
sharedstatedir = @sharedstatedir@
-simreader = @simreader@
srcdir = @srcdir@
strongswan_conf = @strongswan_conf@
sysconfdir = @sysconfdir@
@@ -221,6 +249,7 @@ target_alias = @target_alias@
top_build_prefix = @top_build_prefix@
top_builddir = @top_builddir@
top_srcdir = @top_srcdir@
+urandom_device = @urandom_device@
xml_CFLAGS = @xml_CFLAGS@
xml_LIBS = @xml_LIBS@
INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon ${xml_CFLAGS}
@@ -242,9 +271,9 @@ $(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps)
exit 1;; \
esac; \
done; \
- echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/charon/plugins/smp/Makefile'; \
- cd $(top_srcdir) && \
- $(AUTOMAKE) --gnu src/charon/plugins/smp/Makefile
+ echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/charon/plugins/smp/Makefile'; \
+ $(am__cd) $(top_srcdir) && \
+ $(AUTOMAKE) --gnu src/charon/plugins/smp/Makefile
.PRECIOUS: Makefile
Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
@case '$?' in \
@@ -262,23 +291,28 @@ $(top_srcdir)/configure: $(am__configure_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
$(ACLOCAL_M4): $(am__aclocal_m4_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(am__aclocal_m4_deps):
install-pluginLTLIBRARIES: $(plugin_LTLIBRARIES)
@$(NORMAL_INSTALL)
test -z "$(plugindir)" || $(MKDIR_P) "$(DESTDIR)$(plugindir)"
- @list='$(plugin_LTLIBRARIES)'; for p in $$list; do \
+ @list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+ list2=; for p in $$list; do \
if test -f $$p; then \
- f=$(am__strip_dir) \
- echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(pluginLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) '$$p' '$(DESTDIR)$(plugindir)/$$f'"; \
- $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(pluginLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) "$$p" "$(DESTDIR)$(plugindir)/$$f"; \
+ list2="$$list2 $$p"; \
else :; fi; \
- done
+ done; \
+ test -z "$$list2" || { \
+ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(plugindir)'"; \
+ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(plugindir)"; \
+ }
uninstall-pluginLTLIBRARIES:
@$(NORMAL_UNINSTALL)
- @list='$(plugin_LTLIBRARIES)'; for p in $$list; do \
- p=$(am__strip_dir) \
- echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$p'"; \
- $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$p"; \
+ @list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+ for p in $$list; do \
+ $(am__strip_dir) \
+ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$f'"; \
+ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$f"; \
done
clean-pluginLTLIBRARIES:
@@ -302,21 +336,21 @@ distclean-compile:
.c.o:
@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(COMPILE) -c $<
.c.obj:
@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(COMPILE) -c `$(CYGPATH_W) '$<'`
.c.lo:
@am__fastdepCC_TRUE@ $(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(LTCOMPILE) -c -o $@ $<
@@ -339,7 +373,7 @@ tags: TAGS
TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
$(TAGS_FILES) $(LISP)
- tags=; \
+ set x; \
here=`pwd`; \
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
unique=`for i in $$list; do \
@@ -347,29 +381,34 @@ TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
- if test -z "$(ETAGS_ARGS)$$tags$$unique"; then :; else \
+ shift; \
+ if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
test -n "$$unique" || unique=$$empty_fix; \
- $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
- $$tags $$unique; \
+ if test $$# -gt 0; then \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ "$$@" $$unique; \
+ else \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ $$unique; \
+ fi; \
fi
ctags: CTAGS
CTAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
$(TAGS_FILES) $(LISP)
- tags=; \
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
unique=`for i in $$list; do \
if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
- test -z "$(CTAGS_ARGS)$$tags$$unique" \
+ test -z "$(CTAGS_ARGS)$$unique" \
|| $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
- $$tags $$unique
+ $$unique
GTAGS:
here=`$(am__cd) $(top_builddir) && pwd` \
- && cd $(top_srcdir) \
- && gtags -i $(GTAGS_ARGS) $$here
+ && $(am__cd) $(top_srcdir) \
+ && gtags -i $(GTAGS_ARGS) "$$here"
distclean-tags:
-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
@@ -390,13 +429,17 @@ distdir: $(DISTFILES)
if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
if test -d $$d/$$file; then \
dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
+ if test -d "$(distdir)/$$file"; then \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+ fi; \
if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
- cp -pR $(srcdir)/$$file $(distdir)$$dir || exit 1; \
+ cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
fi; \
- cp -pR $$d/$$file $(distdir)$$dir || exit 1; \
+ cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
else \
- test -f $(distdir)/$$file \
- || cp -p $$d/$$file $(distdir)/$$file \
+ test -f "$(distdir)/$$file" \
+ || cp -p $$d/$$file "$(distdir)/$$file" \
|| exit 1; \
fi; \
done
@@ -427,6 +470,7 @@ clean-generic:
distclean-generic:
-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+ -test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
maintainer-clean-generic:
@echo "This command is intended for maintainers to use"
@@ -448,6 +492,8 @@ dvi-am:
html: html-am
+html-am:
+
info: info-am
info-am:
@@ -456,18 +502,28 @@ install-data-am: install-pluginLTLIBRARIES
install-dvi: install-dvi-am
+install-dvi-am:
+
install-exec-am:
install-html: install-html-am
+install-html-am:
+
install-info: install-info-am
+install-info-am:
+
install-man:
install-pdf: install-pdf-am
+install-pdf-am:
+
install-ps: install-ps-am
+install-ps-am:
+
installcheck-am:
maintainer-clean: maintainer-clean-am
@@ -506,6 +562,7 @@ uninstall-am: uninstall-pluginLTLIBRARIES
mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \
tags uninstall uninstall-am uninstall-pluginLTLIBRARIES
+
# Tell versions [3.59,3.63) of GNU make to not export all variables.
# Otherwise a system limit (for SysV at least) may be exceeded.
.NOEXPORT:
diff --git a/src/charon/plugins/smp/smp.c b/src/charon/plugins/smp/smp.c
index 562add06d..21e682a0a 100644
--- a/src/charon/plugins/smp/smp.c
+++ b/src/charon/plugins/smp/smp.c
@@ -23,13 +23,13 @@
#include <sys/un.h>
#include <unistd.h>
#include <errno.h>
-#include <pthread.h>
#include <signal.h>
#include <libxml/xmlreader.h>
#include <libxml/xmlwriter.h>
#include <library.h>
#include <daemon.h>
+#include <threading/thread.h>
#include <processing/jobs/callback_job.h>
@@ -44,12 +44,12 @@ struct private_smp_t {
* Public part of smp_t object.
*/
smp_t public;
-
+
/**
* XML unix socket fd
*/
int socket;
-
+
/**
* job accepting stroke messages
*/
@@ -146,7 +146,7 @@ static void write_networks(xmlTextWriterPtr writer, char *element,
{
enumerator_t *enumerator;
traffic_selector_t *ts;
-
+
xmlTextWriterStartElement(writer, element);
enumerator = list->create_enumerator(list);
while (enumerator->enumerate(enumerator, (void**)&ts))
@@ -167,26 +167,26 @@ static void write_networks(xmlTextWriterPtr writer, char *element,
static void write_childend(xmlTextWriterPtr writer, child_sa_t *child, bool local)
{
linked_list_t *list;
-
- xmlTextWriterWriteFormatElement(writer, "spi", "%lx",
+
+ xmlTextWriterWriteFormatElement(writer, "spi", "%lx",
htonl(child->get_spi(child, local)));
list = child->get_traffic_selectors(child, local);
write_networks(writer, "networks", list);
}
/**
- * write a child_sa_t
+ * write a child_sa_t
*/
static void write_child(xmlTextWriterPtr writer, child_sa_t *child)
{
child_cfg_t *config;
-
+
config = child->get_config(child);
xmlTextWriterStartElement(writer, "childsa");
xmlTextWriterWriteFormatElement(writer, "reqid", "%d",
child->get_reqid(child));
- xmlTextWriterWriteFormatElement(writer, "childconfig", "%s",
+ xmlTextWriterWriteFormatElement(writer, "childconfig", "%s",
config->get_name(config));
xmlTextWriterStartElement(writer, "local");
write_childend(writer, child, TRUE);
@@ -207,7 +207,7 @@ static void request_query_ikesa(xmlTextReaderPtr reader, xmlTextWriterPtr writer
/* <ikesalist> */
xmlTextWriterStartElement(writer, "ikesalist");
-
+
enumerator = charon->controller->create_ike_sa_enumerator(charon->controller);
while (enumerator->enumerate(enumerator, &ike_sa))
{
@@ -215,18 +215,18 @@ static void request_query_ikesa(xmlTextReaderPtr reader, xmlTextWriterPtr writer
host_t *local, *remote;
iterator_t *children;
child_sa_t *child_sa;
-
+
id = ike_sa->get_id(ike_sa);
-
+
xmlTextWriterStartElement(writer, "ikesa");
xmlTextWriterWriteFormatElement(writer, "id", "%d",
ike_sa->get_unique_id(ike_sa));
- xmlTextWriterWriteFormatElement(writer, "status", "%N",
+ xmlTextWriterWriteFormatElement(writer, "status", "%N",
ike_sa_state_lower_names, ike_sa->get_state(ike_sa));
xmlTextWriterWriteElement(writer, "role",
id->is_initiator(id) ? "initiator" : "responder");
xmlTextWriterWriteElement(writer, "peerconfig", ike_sa->get_name(ike_sa));
-
+
/* <local> */
local = ike_sa->get_my_host(ike_sa);
xmlTextWriterStartElement(writer, "local");
@@ -243,7 +243,7 @@ static void request_query_ikesa(xmlTextReaderPtr reader, xmlTextWriterPtr writer
}
xmlTextWriterEndElement(writer);
/* </local> */
-
+
/* <remote> */
remote = ike_sa->get_other_host(ike_sa);
xmlTextWriterStartElement(writer, "remote");
@@ -259,8 +259,8 @@ static void request_query_ikesa(xmlTextReaderPtr reader, xmlTextWriterPtr writer
write_bool(writer, "nat", ike_sa->has_condition(ike_sa, COND_NAT_THERE));
}
xmlTextWriterEndElement(writer);
- /* </remote> */
-
+ /* </remote> */
+
/* <childsalist> */
xmlTextWriterStartElement(writer, "childsalist");
children = ike_sa->create_child_sa_iterator(ike_sa);
@@ -270,13 +270,13 @@ static void request_query_ikesa(xmlTextReaderPtr reader, xmlTextWriterPtr writer
}
children->destroy(children);
/* </childsalist> */
- xmlTextWriterEndElement(writer);
-
+ xmlTextWriterEndElement(writer);
+
/* </ikesa> */
xmlTextWriterEndElement(writer);
}
enumerator->destroy(enumerator);
-
+
/* </ikesalist> */
xmlTextWriterEndElement(writer);
}
@@ -291,7 +291,7 @@ static void request_query_config(xmlTextReaderPtr reader, xmlTextWriterPtr write
/* <configlist> */
xmlTextWriterStartElement(writer, "configlist");
-
+
enumerator = charon->backends->create_peer_cfg_enumerator(charon->backends,
NULL, NULL, NULL, NULL);
while (enumerator->enumerate(enumerator, &peer_cfg))
@@ -300,18 +300,18 @@ static void request_query_config(xmlTextReaderPtr reader, xmlTextWriterPtr write
child_cfg_t *child_cfg;
ike_cfg_t *ike_cfg;
linked_list_t *list;
-
+
if (peer_cfg->get_ike_version(peer_cfg) != 2)
{ /* only IKEv2 connections yet */
continue;
}
-
+
/* <peerconfig> */
xmlTextWriterStartElement(writer, "peerconfig");
xmlTextWriterWriteElement(writer, "name", peer_cfg->get_name(peer_cfg));
-
+
/* TODO: write auth_cfgs */
-
+
/* <ikeconfig> */
ike_cfg = peer_cfg->get_ike_cfg(peer_cfg);
xmlTextWriterStartElement(writer, "ikeconfig");
@@ -319,14 +319,14 @@ static void request_query_config(xmlTextReaderPtr reader, xmlTextWriterPtr write
xmlTextWriterWriteElement(writer, "remote", ike_cfg->get_other_addr(ike_cfg));
xmlTextWriterEndElement(writer);
/* </ikeconfig> */
-
+
/* <childconfiglist> */
xmlTextWriterStartElement(writer, "childconfiglist");
children = peer_cfg->create_child_cfg_enumerator(peer_cfg);
while (children->enumerate(children, &child_cfg))
{
/* <childconfig> */
- xmlTextWriterStartElement(writer, "childconfig");
+ xmlTextWriterStartElement(writer, "childconfig");
xmlTextWriterWriteElement(writer, "name",
child_cfg->get_name(child_cfg));
list = child_cfg->get_traffic_selectors(child_cfg, TRUE, NULL, NULL);
@@ -334,7 +334,7 @@ static void request_query_config(xmlTextReaderPtr reader, xmlTextWriterPtr write
list->destroy_offset(list, offsetof(traffic_selector_t, destroy));
list = child_cfg->get_traffic_selectors(child_cfg, FALSE, NULL, NULL);
write_networks(writer, "remote", list);
- list->destroy_offset(list, offsetof(traffic_selector_t, destroy));
+ list->destroy_offset(list, offsetof(traffic_selector_t, destroy));
xmlTextWriterEndElement(writer);
/* </childconfig> */
}
@@ -342,7 +342,7 @@ static void request_query_config(xmlTextReaderPtr reader, xmlTextWriterPtr write
/* </childconfiglist> */
xmlTextWriterEndElement(writer);
/* </peerconfig> */
- xmlTextWriterEndElement(writer);
+ xmlTextWriterEndElement(writer);
}
enumerator->destroy(enumerator);
/* </configlist> */
@@ -361,7 +361,7 @@ static bool xml_callback(xmlTextWriterPtr writer, debug_t group, level_t level,
xmlTextWriterStartElement(writer, "item");
xmlTextWriterWriteFormatAttribute(writer, "level", "%d", level);
xmlTextWriterWriteFormatAttribute(writer, "source", "%N", debug_names, group);
- xmlTextWriterWriteFormatAttribute(writer, "thread", "%u", pthread_self());
+ xmlTextWriterWriteFormatAttribute(writer, "thread", "%u", thread_current_id());
xmlTextWriterWriteVFormatString(writer, format, args);
xmlTextWriterEndElement(writer);
/* </item> */
@@ -381,7 +381,7 @@ static void request_control_terminate(xmlTextReaderPtr reader,
const char *str;
u_int32_t id;
status_t status;
-
+
str = xmlTextReaderConstValue(reader);
if (str == NULL)
{
@@ -393,7 +393,7 @@ static void request_control_terminate(xmlTextReaderPtr reader,
{
enumerator_t *enumerator;
ike_sa_t *ike_sa;
-
+
enumerator = charon->controller->create_ike_sa_enumerator(charon->controller);
while (enumerator->enumerate(enumerator, &ike_sa))
{
@@ -411,21 +411,21 @@ static void request_control_terminate(xmlTextReaderPtr reader,
DBG1(DBG_CFG, "error parsing XML id string");
return;
}
-
+
DBG1(DBG_CFG, "terminating %s_SA %d", ike ? "IKE" : "CHILD", id);
-
+
/* <log> */
xmlTextWriterStartElement(writer, "log");
if (ike)
{
status = charon->controller->terminate_ike(
- charon->controller, id,
+ charon->controller, id,
(controller_cb_t)xml_callback, writer);
}
else
{
status = charon->controller->terminate_child(
- charon->controller, id,
+ charon->controller, id,
(controller_cb_t)xml_callback, writer);
}
/* </log> */
@@ -448,7 +448,7 @@ static void request_control_initiate(xmlTextReaderPtr reader,
peer_cfg_t *peer;
child_cfg_t *child = NULL;
enumerator_t *enumerator;
-
+
str = xmlTextReaderConstValue(reader);
if (str == NULL)
{
@@ -456,7 +456,7 @@ static void request_control_initiate(xmlTextReaderPtr reader,
return;
}
DBG1(DBG_CFG, "initiating %s_SA %s", ike ? "IKE" : "CHILD", str);
-
+
/* <log> */
xmlTextWriterStartElement(writer, "log");
peer = charon->backends->get_peer_cfg_by_name(charon->backends, (char*)str);
@@ -508,8 +508,8 @@ static void request_query(xmlTextReaderPtr reader, xmlTextWriterPtr writer)
{
/* <query> */
xmlTextWriterStartElement(writer, "query");
- while (xmlTextReaderRead(reader))
- {
+ while (xmlTextReaderRead(reader))
+ {
if (xmlTextReaderNodeType(reader) == XML_READER_TYPE_ELEMENT)
{
if (streq(xmlTextReaderConstName(reader), "ikesalist"))
@@ -535,8 +535,8 @@ static void request_control(xmlTextReaderPtr reader, xmlTextWriterPtr writer)
{
/* <control> */
xmlTextWriterStartElement(writer, "control");
- while (xmlTextReaderRead(reader))
- {
+ while (xmlTextReaderRead(reader))
+ {
if (xmlTextReaderNodeType(reader) == XML_READER_TYPE_ELEMENT)
{
if (streq(xmlTextReaderConstName(reader), "ikesaterminate"))
@@ -571,7 +571,7 @@ static void request_control(xmlTextReaderPtr reader, xmlTextWriterPtr writer)
static void request(xmlTextReaderPtr reader, char *id, int fd)
{
xmlTextWriterPtr writer;
-
+
writer = xmlNewTextWriter(xmlOutputBufferCreateFd(fd, NULL));
if (writer == NULL)
{
@@ -622,17 +622,18 @@ static void closefdp(int *fd)
*/
static job_requeue_t process(int *fdp)
{
- int oldstate, fd = *fdp;
+ int fd = *fdp;
+ bool oldstate;
char buffer[4096];
size_t len;
xmlTextReaderPtr reader;
char *id = NULL, *type = NULL;
-
- pthread_cleanup_push((void*)closefdp, (void*)&fd);
- pthread_setcancelstate(PTHREAD_CANCEL_ENABLE, &oldstate);
+
+ thread_cleanup_push((thread_cleanup_t)closefdp, (void*)&fd);
+ oldstate = thread_cancelability(TRUE);
len = read(fd, buffer, sizeof(buffer));
- pthread_setcancelstate(oldstate, NULL);
- pthread_cleanup_pop(0);
+ thread_cancelability(oldstate);
+ thread_cleanup_pop(FALSE);
if (len <= 0)
{
close(fd);
@@ -640,17 +641,17 @@ static job_requeue_t process(int *fdp)
return JOB_REQUEUE_NONE;
}
DBG3(DBG_CFG, "got XML request: %b", buffer, len);
-
+
reader = xmlReaderForMemory(buffer, len, NULL, NULL, 0);
if (reader == NULL)
{
DBG1(DBG_CFG, "opening SMP XML reader failed");
return JOB_REQUEUE_FAIR;;
}
-
+
/* read message type and id */
- while (xmlTextReaderRead(reader))
- {
+ while (xmlTextReaderRead(reader))
+ {
if (xmlTextReaderNodeType(reader) == XML_READER_TYPE_ELEMENT &&
streq(xmlTextReaderConstName(reader), "message"))
{
@@ -658,20 +659,20 @@ static job_requeue_t process(int *fdp)
type = xmlTextReaderGetAttribute(reader, "type");
break;
}
- }
-
- /* process message */
- if (id && type)
+ }
+
+ /* process message */
+ if (id && type)
{
- if (streq(type, "request"))
- {
- request(reader, id, fd);
- }
- else
- {
- /* response(reader, id) */
- }
- }
+ if (streq(type, "request"))
+ {
+ request(reader, id, fd);
+ }
+ else
+ {
+ /* response(reader, id) */
+ }
+ }
xmlFreeTextReader(reader);
return JOB_REQUEUE_FAIR;;
}
@@ -682,26 +683,27 @@ static job_requeue_t process(int *fdp)
static job_requeue_t dispatch(private_smp_t *this)
{
struct sockaddr_un strokeaddr;
- int oldstate, fd, *fdp, strokeaddrlen = sizeof(strokeaddr);
+ int fd, *fdp, strokeaddrlen = sizeof(strokeaddr);
callback_job_t *job;
-
+ bool oldstate;
+
/* wait for connections, but allow thread to terminate */
- pthread_setcancelstate(PTHREAD_CANCEL_ENABLE, &oldstate);
+ oldstate = thread_cancelability(TRUE);
fd = accept(this->socket, (struct sockaddr *)&strokeaddr, &strokeaddrlen);
- pthread_setcancelstate(oldstate, NULL);
-
+ thread_cancelability(oldstate);
+
if (fd < 0)
{
DBG1(DBG_CFG, "accepting SMP XML socket failed: %s", strerror(errno));
sleep(1);
return JOB_REQUEUE_FAIR;;
}
-
+
fdp = malloc_thing(int);
*fdp = fd;
job = callback_job_create((callback_job_cb_t)process, fdp, free, this->job);
charon->processor->queue_job(charon->processor, (job_t*)job);
-
+
return JOB_REQUEUE_DIRECT;
}
@@ -725,7 +727,7 @@ plugin_t *plugin_create()
mode_t old;
this->public.plugin.destroy = (void (*)(plugin_t*))destroy;
-
+
/* set up unix socket */
this->socket = socket(AF_UNIX, SOCK_STREAM, 0);
if (this->socket == -1)
@@ -734,7 +736,7 @@ plugin_t *plugin_create()
free(this);
return NULL;
}
-
+
unlink(unix_addr.sun_path);
old = umask(~(S_IRWXU | S_IRWXG));
if (bind(this->socket, (struct sockaddr *)&unix_addr, sizeof(unix_addr)) < 0)
@@ -749,7 +751,7 @@ plugin_t *plugin_create()
{
DBG1(DBG_CFG, "changing XML socket permissions failed: %s", strerror(errno));
}
-
+
if (listen(this->socket, 5) < 0)
{
DBG1(DBG_CFG, "could not listen on XML socket: %s", strerror(errno));
@@ -760,7 +762,7 @@ plugin_t *plugin_create()
this->job = callback_job_create((callback_job_cb_t)dispatch, this, NULL, NULL);
charon->processor->queue_job(charon->processor, (job_t*)this->job);
-
+
return &this->public.plugin;
}
diff --git a/src/charon/plugins/sql/Makefile.am b/src/charon/plugins/sql/Makefile.am
index bf4963f29..60135bf08 100644
--- a/src/charon/plugins/sql/Makefile.am
+++ b/src/charon/plugins/sql/Makefile.am
@@ -2,16 +2,11 @@
INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
AM_CFLAGS = -rdynamic \
- -DSTRONGSWAN_CONF=\"${strongswan_conf}\" \
- -DIPSEC_PLUGINDIR=\"${plugindir}\" \
-DPLUGINS=\""${libstrongswan_plugins}\""
plugin_LTLIBRARIES = libstrongswan-sql.la
-libstrongswan_sql_la_SOURCES = sql_plugin.h sql_plugin.c \
- sql_config.h sql_config.c sql_cred.h sql_cred.c \
- sql_attribute.h sql_attribute.c sql_logger.h sql_logger.c
+libstrongswan_sql_la_SOURCES = \
+ sql_plugin.h sql_plugin.c sql_config.h sql_config.c \
+ sql_cred.h sql_cred.c sql_logger.h sql_logger.c
libstrongswan_sql_la_LDFLAGS = -module -avoid-version
-ipsec_PROGRAMS = pool
-pool_SOURCES = pool.c
-pool_LDADD = $(top_builddir)/src/libstrongswan/libstrongswan.la
diff --git a/src/charon/plugins/sql/Makefile.in b/src/charon/plugins/sql/Makefile.in
index f6fd8e4f7..ef9c33a1c 100644
--- a/src/charon/plugins/sql/Makefile.in
+++ b/src/charon/plugins/sql/Makefile.in
@@ -1,8 +1,9 @@
-# Makefile.in generated by automake 1.10.2 from Makefile.am.
+# Makefile.in generated by automake 1.11 from Makefile.am.
# @configure_input@
# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,
-# 2003, 2004, 2005, 2006, 2007, 2008 Free Software Foundation, Inc.
+# 2003, 2004, 2005, 2006, 2007, 2008, 2009 Free Software Foundation,
+# Inc.
# This Makefile.in is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.
@@ -14,11 +15,11 @@
@SET_MAKE@
-
VPATH = @srcdir@
pkgdatadir = $(datadir)/@PACKAGE@
-pkglibdir = $(libdir)/@PACKAGE@
pkgincludedir = $(includedir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkglibexecdir = $(libexecdir)/@PACKAGE@
am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
install_sh_DATA = $(install_sh) -c -m 644
install_sh_PROGRAM = $(install_sh) -c
@@ -33,40 +34,56 @@ PRE_UNINSTALL = :
POST_UNINSTALL = :
build_triplet = @build@
host_triplet = @host@
-ipsec_PROGRAMS = pool$(EXEEXT)
subdir = src/charon/plugins/sql
DIST_COMMON = $(srcdir)/Makefile.am $(srcdir)/Makefile.in
ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
-am__aclocal_m4_deps = $(top_srcdir)/configure.in
+am__aclocal_m4_deps = $(top_srcdir)/m4/config/libtool.m4 \
+ $(top_srcdir)/m4/config/ltoptions.m4 \
+ $(top_srcdir)/m4/config/ltsugar.m4 \
+ $(top_srcdir)/m4/config/ltversion.m4 \
+ $(top_srcdir)/m4/config/lt~obsolete.m4 \
+ $(top_srcdir)/m4/macros/with.m4 \
+ $(top_srcdir)/m4/macros/enable-disable.m4 \
+ $(top_srcdir)/configure.in
am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
$(ACLOCAL_M4)
mkinstalldirs = $(install_sh) -d
CONFIG_CLEAN_FILES =
+CONFIG_CLEAN_VPATH_FILES =
am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
am__vpath_adj = case $$p in \
$(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
*) f=$$p;; \
esac;
-am__strip_dir = `echo $$p | sed -e 's|^.*/||'`;
-am__installdirs = "$(DESTDIR)$(plugindir)" "$(DESTDIR)$(ipsecdir)"
-pluginLTLIBRARIES_INSTALL = $(INSTALL)
+am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
+am__install_max = 40
+am__nobase_strip_setup = \
+ srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
+am__nobase_strip = \
+ for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
+am__nobase_list = $(am__nobase_strip_setup); \
+ for p in $$list; do echo "$$p $$p"; done | \
+ sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
+ $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
+ if (++n[$$2] == $(am__install_max)) \
+ { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
+ END { for (dir in files) print dir, files[dir] }'
+am__base_list = \
+ sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
+ sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
+am__installdirs = "$(DESTDIR)$(plugindir)"
LTLIBRARIES = $(plugin_LTLIBRARIES)
libstrongswan_sql_la_LIBADD =
am_libstrongswan_sql_la_OBJECTS = sql_plugin.lo sql_config.lo \
- sql_cred.lo sql_attribute.lo sql_logger.lo
+ sql_cred.lo sql_logger.lo
libstrongswan_sql_la_OBJECTS = $(am_libstrongswan_sql_la_OBJECTS)
libstrongswan_sql_la_LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) \
$(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \
$(libstrongswan_sql_la_LDFLAGS) $(LDFLAGS) -o $@
-ipsecPROGRAMS_INSTALL = $(INSTALL_PROGRAM)
-PROGRAMS = $(ipsec_PROGRAMS)
-am_pool_OBJECTS = pool.$(OBJEXT)
-pool_OBJECTS = $(am_pool_OBJECTS)
-pool_DEPENDENCIES = \
- $(top_builddir)/src/libstrongswan/libstrongswan.la
DEFAULT_INCLUDES = -I.@am__isrc@
depcomp = $(SHELL) $(top_srcdir)/depcomp
am__depfiles_maybe = depfiles
+am__mv = mv -f
COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
LTCOMPILE = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
@@ -76,8 +93,8 @@ CCLD = $(CC)
LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
--mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) $(AM_LDFLAGS) \
$(LDFLAGS) -o $@
-SOURCES = $(libstrongswan_sql_la_SOURCES) $(pool_SOURCES)
-DIST_SOURCES = $(libstrongswan_sql_la_SOURCES) $(pool_SOURCES)
+SOURCES = $(libstrongswan_sql_la_SOURCES)
+DIST_SOURCES = $(libstrongswan_sql_la_SOURCES)
ETAGS = etags
CTAGS = ctags
DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
@@ -114,25 +131,22 @@ INSTALL_DATA = @INSTALL_DATA@
INSTALL_PROGRAM = @INSTALL_PROGRAM@
INSTALL_SCRIPT = @INSTALL_SCRIPT@
INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
-IPSEC_ROUTING_TABLE = @IPSEC_ROUTING_TABLE@
-IPSEC_ROUTING_TABLE_PRIO = @IPSEC_ROUTING_TABLE_PRIO@
LD = @LD@
LDFLAGS = @LDFLAGS@
LEX = @LEX@
LEXLIB = @LEXLIB@
LEX_OUTPUT_ROOT = @LEX_OUTPUT_ROOT@
-LIBGCRYPT_CFLAGS = @LIBGCRYPT_CFLAGS@
-LIBGCRYPT_CONFIG = @LIBGCRYPT_CONFIG@
-LIBGCRYPT_LIBS = @LIBGCRYPT_LIBS@
LIBOBJS = @LIBOBJS@
LIBS = @LIBS@
LIBTOOL = @LIBTOOL@
-LINUX_HEADERS = @LINUX_HEADERS@
LIPO = @LIPO@
LN_S = @LN_S@
LTLIBOBJS = @LTLIBOBJS@
MAKEINFO = @MAKEINFO@
MKDIR_P = @MKDIR_P@
+MYSQLCFLAG = @MYSQLCFLAG@
+MYSQLCONFIG = @MYSQLCONFIG@
+MYSQLLIB = @MYSQLLIB@
NM = @NM@
NMEDIT = @NMEDIT@
OBJDUMP = @OBJDUMP@
@@ -144,11 +158,14 @@ PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
PACKAGE_NAME = @PACKAGE_NAME@
PACKAGE_STRING = @PACKAGE_STRING@
PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_URL = @PACKAGE_URL@
PACKAGE_VERSION = @PACKAGE_VERSION@
PATH_SEPARATOR = @PATH_SEPARATOR@
PERL = @PERL@
PKG_CONFIG = @PKG_CONFIG@
+PTHREADLIB = @PTHREADLIB@
RANLIB = @RANLIB@
+RTLIB = @RTLIB@
RUBY = @RUBY@
RUBYINCLUDE = @RUBYINCLUDE@
SED = @SED@
@@ -177,9 +194,9 @@ build_cpu = @build_cpu@
build_os = @build_os@
build_vendor = @build_vendor@
builddir = @builddir@
-confdir = @confdir@
datadir = @datadir@
datarootdir = @datarootdir@
+default_pkcs11 = @default_pkcs11@
docdir = @docdir@
dvidir = @dvidir@
exec_prefix = @exec_prefix@
@@ -202,7 +219,7 @@ ipsecuser = @ipsecuser@
libdir = @libdir@
libexecdir = @libexecdir@
libstrongswan_plugins = @libstrongswan_plugins@
-linuxdir = @linuxdir@
+linux_headers = @linux_headers@
localedir = @localedir@
localstatedir = @localstatedir@
lt_ECHO = @lt_ECHO@
@@ -210,6 +227,7 @@ mandir = @mandir@
mkdir_p = @mkdir_p@
nm_CFLAGS = @nm_CFLAGS@
nm_LIBS = @nm_LIBS@
+nm_ca_dir = @nm_ca_dir@
oldincludedir = @oldincludedir@
pdfdir = @pdfdir@
piddir = @piddir@
@@ -218,10 +236,12 @@ pluto_plugins = @pluto_plugins@
prefix = @prefix@
program_transform_name = @program_transform_name@
psdir = @psdir@
+random_device = @random_device@
resolv_conf = @resolv_conf@
+routing_table = @routing_table@
+routing_table_prio = @routing_table_prio@
sbindir = @sbindir@
sharedstatedir = @sharedstatedir@
-simreader = @simreader@
srcdir = @srcdir@
strongswan_conf = @strongswan_conf@
sysconfdir = @sysconfdir@
@@ -229,22 +249,19 @@ target_alias = @target_alias@
top_build_prefix = @top_build_prefix@
top_builddir = @top_builddir@
top_srcdir = @top_srcdir@
+urandom_device = @urandom_device@
xml_CFLAGS = @xml_CFLAGS@
xml_LIBS = @xml_LIBS@
INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
AM_CFLAGS = -rdynamic \
- -DSTRONGSWAN_CONF=\"${strongswan_conf}\" \
- -DIPSEC_PLUGINDIR=\"${plugindir}\" \
-DPLUGINS=\""${libstrongswan_plugins}\""
plugin_LTLIBRARIES = libstrongswan-sql.la
-libstrongswan_sql_la_SOURCES = sql_plugin.h sql_plugin.c \
- sql_config.h sql_config.c sql_cred.h sql_cred.c \
- sql_attribute.h sql_attribute.c sql_logger.h sql_logger.c
+libstrongswan_sql_la_SOURCES = \
+ sql_plugin.h sql_plugin.c sql_config.h sql_config.c \
+ sql_cred.h sql_cred.c sql_logger.h sql_logger.c
libstrongswan_sql_la_LDFLAGS = -module -avoid-version
-pool_SOURCES = pool.c
-pool_LDADD = $(top_builddir)/src/libstrongswan/libstrongswan.la
all: all-am
.SUFFIXES:
@@ -258,9 +275,9 @@ $(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps)
exit 1;; \
esac; \
done; \
- echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/charon/plugins/sql/Makefile'; \
- cd $(top_srcdir) && \
- $(AUTOMAKE) --gnu src/charon/plugins/sql/Makefile
+ echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/charon/plugins/sql/Makefile'; \
+ $(am__cd) $(top_srcdir) && \
+ $(AUTOMAKE) --gnu src/charon/plugins/sql/Makefile
.PRECIOUS: Makefile
Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
@case '$?' in \
@@ -278,23 +295,28 @@ $(top_srcdir)/configure: $(am__configure_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
$(ACLOCAL_M4): $(am__aclocal_m4_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(am__aclocal_m4_deps):
install-pluginLTLIBRARIES: $(plugin_LTLIBRARIES)
@$(NORMAL_INSTALL)
test -z "$(plugindir)" || $(MKDIR_P) "$(DESTDIR)$(plugindir)"
- @list='$(plugin_LTLIBRARIES)'; for p in $$list; do \
+ @list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+ list2=; for p in $$list; do \
if test -f $$p; then \
- f=$(am__strip_dir) \
- echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(pluginLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) '$$p' '$(DESTDIR)$(plugindir)/$$f'"; \
- $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(pluginLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) "$$p" "$(DESTDIR)$(plugindir)/$$f"; \
+ list2="$$list2 $$p"; \
else :; fi; \
- done
+ done; \
+ test -z "$$list2" || { \
+ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(plugindir)'"; \
+ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(plugindir)"; \
+ }
uninstall-pluginLTLIBRARIES:
@$(NORMAL_UNINSTALL)
- @list='$(plugin_LTLIBRARIES)'; for p in $$list; do \
- p=$(am__strip_dir) \
- echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$p'"; \
- $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$p"; \
+ @list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+ for p in $$list; do \
+ $(am__strip_dir) \
+ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$f'"; \
+ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$f"; \
done
clean-pluginLTLIBRARIES:
@@ -307,37 +329,6 @@ clean-pluginLTLIBRARIES:
done
libstrongswan-sql.la: $(libstrongswan_sql_la_OBJECTS) $(libstrongswan_sql_la_DEPENDENCIES)
$(libstrongswan_sql_la_LINK) -rpath $(plugindir) $(libstrongswan_sql_la_OBJECTS) $(libstrongswan_sql_la_LIBADD) $(LIBS)
-install-ipsecPROGRAMS: $(ipsec_PROGRAMS)
- @$(NORMAL_INSTALL)
- test -z "$(ipsecdir)" || $(MKDIR_P) "$(DESTDIR)$(ipsecdir)"
- @list='$(ipsec_PROGRAMS)'; for p in $$list; do \
- p1=`echo $$p|sed 's/$(EXEEXT)$$//'`; \
- if test -f $$p \
- || test -f $$p1 \
- ; then \
- f=`echo "$$p1" | sed 's,^.*/,,;$(transform);s/$$/$(EXEEXT)/'`; \
- echo " $(INSTALL_PROGRAM_ENV) $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(ipsecPROGRAMS_INSTALL) '$$p' '$(DESTDIR)$(ipsecdir)/$$f'"; \
- $(INSTALL_PROGRAM_ENV) $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(ipsecPROGRAMS_INSTALL) "$$p" "$(DESTDIR)$(ipsecdir)/$$f" || exit 1; \
- else :; fi; \
- done
-
-uninstall-ipsecPROGRAMS:
- @$(NORMAL_UNINSTALL)
- @list='$(ipsec_PROGRAMS)'; for p in $$list; do \
- f=`echo "$$p" | sed 's,^.*/,,;s/$(EXEEXT)$$//;$(transform);s/$$/$(EXEEXT)/'`; \
- echo " rm -f '$(DESTDIR)$(ipsecdir)/$$f'"; \
- rm -f "$(DESTDIR)$(ipsecdir)/$$f"; \
- done
-
-clean-ipsecPROGRAMS:
- @list='$(ipsec_PROGRAMS)'; for p in $$list; do \
- f=`echo $$p|sed 's/$(EXEEXT)$$//'`; \
- echo " rm -f $$p $$f"; \
- rm -f $$p $$f ; \
- done
-pool$(EXEEXT): $(pool_OBJECTS) $(pool_DEPENDENCIES)
- @rm -f pool$(EXEEXT)
- $(LINK) $(pool_OBJECTS) $(pool_LDADD) $(LIBS)
mostlyclean-compile:
-rm -f *.$(OBJEXT)
@@ -345,8 +336,6 @@ mostlyclean-compile:
distclean-compile:
-rm -f *.tab.c
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/pool.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/sql_attribute.Plo@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/sql_config.Plo@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/sql_cred.Plo@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/sql_logger.Plo@am__quote@
@@ -354,21 +343,21 @@ distclean-compile:
.c.o:
@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(COMPILE) -c $<
.c.obj:
@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(COMPILE) -c `$(CYGPATH_W) '$<'`
.c.lo:
@am__fastdepCC_TRUE@ $(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(LTCOMPILE) -c -o $@ $<
@@ -391,7 +380,7 @@ tags: TAGS
TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
$(TAGS_FILES) $(LISP)
- tags=; \
+ set x; \
here=`pwd`; \
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
unique=`for i in $$list; do \
@@ -399,29 +388,34 @@ TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
- if test -z "$(ETAGS_ARGS)$$tags$$unique"; then :; else \
+ shift; \
+ if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
test -n "$$unique" || unique=$$empty_fix; \
- $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
- $$tags $$unique; \
+ if test $$# -gt 0; then \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ "$$@" $$unique; \
+ else \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ $$unique; \
+ fi; \
fi
ctags: CTAGS
CTAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
$(TAGS_FILES) $(LISP)
- tags=; \
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
unique=`for i in $$list; do \
if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
- test -z "$(CTAGS_ARGS)$$tags$$unique" \
+ test -z "$(CTAGS_ARGS)$$unique" \
|| $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
- $$tags $$unique
+ $$unique
GTAGS:
here=`$(am__cd) $(top_builddir) && pwd` \
- && cd $(top_srcdir) \
- && gtags -i $(GTAGS_ARGS) $$here
+ && $(am__cd) $(top_srcdir) \
+ && gtags -i $(GTAGS_ARGS) "$$here"
distclean-tags:
-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
@@ -442,21 +436,25 @@ distdir: $(DISTFILES)
if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
if test -d $$d/$$file; then \
dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
+ if test -d "$(distdir)/$$file"; then \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+ fi; \
if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
- cp -pR $(srcdir)/$$file $(distdir)$$dir || exit 1; \
+ cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
fi; \
- cp -pR $$d/$$file $(distdir)$$dir || exit 1; \
+ cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
else \
- test -f $(distdir)/$$file \
- || cp -p $$d/$$file $(distdir)/$$file \
+ test -f "$(distdir)/$$file" \
+ || cp -p $$d/$$file "$(distdir)/$$file" \
|| exit 1; \
fi; \
done
check-am: all-am
check: check-am
-all-am: Makefile $(LTLIBRARIES) $(PROGRAMS)
+all-am: Makefile $(LTLIBRARIES)
installdirs:
- for dir in "$(DESTDIR)$(plugindir)" "$(DESTDIR)$(ipsecdir)"; do \
+ for dir in "$(DESTDIR)$(plugindir)"; do \
test -z "$$dir" || $(MKDIR_P) "$$dir"; \
done
install: install-am
@@ -479,14 +477,15 @@ clean-generic:
distclean-generic:
-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+ -test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
maintainer-clean-generic:
@echo "This command is intended for maintainers to use"
@echo "it deletes files that may require special tools to rebuild."
clean: clean-am
-clean-am: clean-generic clean-ipsecPROGRAMS clean-libtool \
- clean-pluginLTLIBRARIES mostlyclean-am
+clean-am: clean-generic clean-libtool clean-pluginLTLIBRARIES \
+ mostlyclean-am
distclean: distclean-am
-rm -rf ./$(DEPDIR)
@@ -500,26 +499,38 @@ dvi-am:
html: html-am
+html-am:
+
info: info-am
info-am:
-install-data-am: install-ipsecPROGRAMS install-pluginLTLIBRARIES
+install-data-am: install-pluginLTLIBRARIES
install-dvi: install-dvi-am
+install-dvi-am:
+
install-exec-am:
install-html: install-html-am
+install-html-am:
+
install-info: install-info-am
+install-info-am:
+
install-man:
install-pdf: install-pdf-am
+install-pdf-am:
+
install-ps: install-ps-am
+install-ps-am:
+
installcheck-am:
maintainer-clean: maintainer-clean-am
@@ -540,25 +551,24 @@ ps: ps-am
ps-am:
-uninstall-am: uninstall-ipsecPROGRAMS uninstall-pluginLTLIBRARIES
+uninstall-am: uninstall-pluginLTLIBRARIES
.MAKE: install-am install-strip
.PHONY: CTAGS GTAGS all all-am check check-am clean clean-generic \
- clean-ipsecPROGRAMS clean-libtool clean-pluginLTLIBRARIES \
- ctags distclean distclean-compile distclean-generic \
- distclean-libtool distclean-tags distdir dvi dvi-am html \
- html-am info info-am install install-am install-data \
- install-data-am install-dvi install-dvi-am install-exec \
- install-exec-am install-html install-html-am install-info \
- install-info-am install-ipsecPROGRAMS install-man install-pdf \
- install-pdf-am install-pluginLTLIBRARIES install-ps \
- install-ps-am install-strip installcheck installcheck-am \
- installdirs maintainer-clean maintainer-clean-generic \
- mostlyclean mostlyclean-compile mostlyclean-generic \
- mostlyclean-libtool pdf pdf-am ps ps-am tags uninstall \
- uninstall-am uninstall-ipsecPROGRAMS \
- uninstall-pluginLTLIBRARIES
+ clean-libtool clean-pluginLTLIBRARIES ctags distclean \
+ distclean-compile distclean-generic distclean-libtool \
+ distclean-tags distdir dvi dvi-am html html-am info info-am \
+ install install-am install-data install-data-am install-dvi \
+ install-dvi-am install-exec install-exec-am install-html \
+ install-html-am install-info install-info-am install-man \
+ install-pdf install-pdf-am install-pluginLTLIBRARIES \
+ install-ps install-ps-am install-strip installcheck \
+ installcheck-am installdirs maintainer-clean \
+ maintainer-clean-generic mostlyclean mostlyclean-compile \
+ mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \
+ tags uninstall uninstall-am uninstall-pluginLTLIBRARIES
+
# Tell versions [3.59,3.63) of GNU make to not export all variables.
# Otherwise a system limit (for SysV at least) may be exceeded.
diff --git a/src/charon/plugins/sql/pool.c b/src/charon/plugins/sql/pool.c
deleted file mode 100644
index ebcc9adc7..000000000
--- a/src/charon/plugins/sql/pool.c
+++ /dev/null
@@ -1,797 +0,0 @@
-/*
- * Copyright (C) 2008 Martin Willi
- * Hochschule fuer Technik Rapperswil
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
- * for more details.
- */
-
-#define _GNU_SOURCE
-#include <getopt.h>
-#include <unistd.h>
-#include <stdio.h>
-#include <time.h>
-
-#include <debug.h>
-#include <library.h>
-#include <utils/host.h>
-#include <utils/identification.h>
-
-/**
- * global database handle
- */
-database_t *db;
-
-/**
- * --start/--end addresses of various subcommands
- */
-host_t *start = NULL, *end = NULL;
-
-/**
- * calculate the size of a pool using start and end address chunk
- */
-static u_int get_pool_size(chunk_t start, chunk_t end)
-{
- u_int *start_ptr, *end_ptr;
-
- if (start.len < sizeof(u_int) || end.len < sizeof(u_int))
- {
- return 0;
- }
- start_ptr = (u_int*)(start.ptr + start.len - sizeof(u_int));
- end_ptr = (u_int*)(end.ptr + end.len - sizeof(u_int));
- return ntohl(*end_ptr) - ntohl(*start_ptr) + 1;
-}
-
-/**
- * print usage info
- */
-static void usage(void)
-{
- printf("\
-Usage:\n\
- ipsec pool --status|--add|--del|--resize|--purge [options]\n\
- \n\
- ipsec pool --status\n\
- Show a list of installed pools with statistics.\n\
- \n\
- ipsec pool --add <name> --start <start> --end <end> [--timeout <timeout>]\n\
- Add a new pool to the database.\n\
- name: Name of the pool, as used in ipsec.conf rightsourceip=%%name\n\
- start: Start address of the pool\n\
- end: End address of the pool\n\
- timeout: Lease time in hours, 0 for static leases\n\
- \n\
- ipsec pool --del <name>\n\
- Delete a pool from the database.\n\
- name: Name of the pool to delete\n\
- \n\
- ipsec pool --resize <name> --end <end>\n\
- Grow or shrink an existing pool.\n\
- name: Name of the pool to resize\n\
- end: New end address for the pool\n\
- \n\
- ipsec pool --leases [--filter <filter>] [--utc]\n\
- Show lease information using filters:\n\
- filter: Filter string containing comma separated key=value filters,\n\
- e.g. id=alice@strongswan.org,addr=1.1.1.1\n\
- pool: name of the pool\n\
- id: assigned identity of the lease\n\
- addr: lease IP address\n\
- tstamp: UNIX timestamp when lease was valid, as integer\n\
- status: status of the lease: online|valid|expired\n\
- utc: Show times in UTC instead of local time\n\
- \n\
- ipsec pool --purge <name>\n\
- Delete lease history of a pool:\n\
- name: Name of the pool to purge\n\
- \n");
- exit(0);
-}
-
-/**
- * ipsec pool --status - show pool overview
- */
-static void status(void)
-{
- enumerator_t *pool, *lease;
- bool found = FALSE;
-
- pool = db->query(db, "SELECT id, name, start, end, timeout FROM pools",
- DB_INT, DB_TEXT, DB_BLOB, DB_BLOB, DB_UINT);
- if (pool)
- {
- char *name;
- chunk_t start_chunk, end_chunk;
- host_t *start, *end;
- u_int id, timeout, online = 0, used = 0, size = 0;
-
- while (pool->enumerate(pool, &id, &name,
- &start_chunk, &end_chunk, &timeout))
- {
- if (!found)
- {
- printf("%8s %15s %15s %8s %6s %11s %11s\n", "name", "start",
- "end", "timeout", "size", "online", "usage");
- found = TRUE;
- }
-
- start = host_create_from_chunk(AF_UNSPEC, start_chunk, 0);
- end = host_create_from_chunk(AF_UNSPEC, end_chunk, 0);
- size = get_pool_size(start_chunk, end_chunk);
- printf("%8s %15H %15H ", name, start, end);
- if (timeout)
- {
- printf("%7dh ", timeout/3600);
- }
- else
- {
- printf("%8s ", "static");
- }
- printf("%6d ", size);
- /* get number of online hosts */
- lease = db->query(db, "SELECT COUNT(*) FROM addresses "
- "WHERE pool = ? AND released = 0",
- DB_UINT, id, DB_INT);
- if (lease)
- {
- lease->enumerate(lease, &online);
- lease->destroy(lease);
- }
- printf("%5d (%2d%%) ", online, online*100/size);
- /* get number of online or valid lieases */
- lease = db->query(db, "SELECT COUNT(*) FROM addresses "
- "WHERE addresses.pool = ? "
- "AND ((? AND acquired != 0) "
- " OR released = 0 OR released > ?) ",
- DB_UINT, id, DB_UINT, !timeout,
- DB_UINT, time(NULL) - timeout, DB_UINT);
- if (lease)
- {
- lease->enumerate(lease, &used);
- lease->destroy(lease);
- }
- printf("%5d (%2d%%) ", used, used*100/size);
-
- printf("\n");
- DESTROY_IF(start);
- DESTROY_IF(end);
- }
- pool->destroy(pool);
- }
- if (!found)
- {
- printf("no pools found.\n");
- }
- exit(0);
-}
-
-/**
- * increment a chunk, as it would reprensent a network order integer
- */
-static void increment_chunk(chunk_t chunk)
-{
- int i;
-
- for (i = chunk.len - 1; i >= 0; i--)
- {
- if (++chunk.ptr[i] != 0)
- {
- return;
- }
- }
-}
-
-/**
- * ipsec pool --add - add a new pool
- */
-static void add(char *name, host_t *start, host_t *end, int timeout)
-{
- chunk_t start_addr, end_addr, cur_addr;
- u_int id, count;
-
- start_addr = start->get_address(start);
- end_addr = end->get_address(end);
- cur_addr = chunk_clonea(start_addr);
- count = get_pool_size(start_addr, end_addr);
-
- if (start_addr.len != end_addr.len ||
- memcmp(start_addr.ptr, end_addr.ptr, start_addr.len) > 0)
- {
- fprintf(stderr, "invalid start/end pair specified.\n");
- exit(-1);
- }
- if (db->execute(db, &id,
- "INSERT INTO pools (name, start, end, timeout) "
- "VALUES (?, ?, ?, ?)",
- DB_TEXT, name, DB_BLOB, start_addr,
- DB_BLOB, end_addr, DB_INT, timeout*3600) != 1)
- {
- fprintf(stderr, "creating pool failed.\n");
- exit(-1);
- }
- printf("allocating %d addresses... ", count);
- fflush(stdout);
- if (db->get_driver(db) == DB_SQLITE)
- { /* run population in a transaction for sqlite */
- db->execute(db, NULL, "BEGIN TRANSACTION");
- }
- while (TRUE)
- {
- db->execute(db, NULL,
- "INSERT INTO addresses (pool, address, identity, acquired, released) "
- "VALUES (?, ?, ?, ?, ?)",
- DB_UINT, id, DB_BLOB, cur_addr, DB_UINT, 0, DB_UINT, 0, DB_UINT, 1);
- if (chunk_equals(cur_addr, end_addr))
- {
- break;
- }
- increment_chunk(cur_addr);
- }
- if (db->get_driver(db) == DB_SQLITE)
- {
- db->execute(db, NULL, "END TRANSACTION");
- }
- printf("done.\n", count);
-
- exit(0);
-}
-
-/**
- * ipsec pool --del - delete a pool
- */
-static void del(char *name)
-{
- enumerator_t *query;
- u_int id;
- bool found = FALSE;
-
- query = db->query(db, "SELECT id FROM pools WHERE name = ?",
- DB_TEXT, name, DB_UINT);
- if (!query)
- {
- fprintf(stderr, "deleting pool failed.\n");
- exit(-1);
- }
- while (query->enumerate(query, &id))
- {
- found = TRUE;
- if (db->execute(db, NULL,
- "DELETE FROM leases WHERE address IN ("
- " SELECT id FROM addresses WHERE pool = ?)", DB_UINT, id) < 0 ||
- db->execute(db, NULL,
- "DELETE FROM addresses WHERE pool = ?", DB_UINT, id) < 0 ||
- db->execute(db, NULL,
- "DELETE FROM pools WHERE id = ?", DB_UINT, id) < 0)
- {
- fprintf(stderr, "deleting pool failed.\n");
- query->destroy(query);
- exit(-1);
- }
- }
- query->destroy(query);
- if (!found)
- {
- fprintf(stderr, "pool '%s' not found.\n", name);
- exit(-1);
- }
- exit(0);
-}
-
-/**
- * ipsec pool --resize - resize a pool
- */
-static void resize(char *name, host_t *end)
-{
- enumerator_t *query;
- chunk_t old_addr, new_addr, cur_addr;
- u_int id, count;
-
- new_addr = end->get_address(end);
-
- query = db->query(db, "SELECT id, end FROM pools WHERE name = ?",
- DB_TEXT, name, DB_UINT, DB_BLOB);
- if (!query || !query->enumerate(query, &id, &old_addr))
- {
- DESTROY_IF(query);
- fprintf(stderr, "resizing pool failed.\n");
- exit(-1);
- }
- if (old_addr.len != new_addr.len ||
- memcmp(new_addr.ptr, old_addr.ptr, old_addr.len) < 0)
- {
- fprintf(stderr, "shrinking of pools not supported.\n");
- query->destroy(query);
- exit(-1);
- }
- cur_addr = chunk_clonea(old_addr);
- count = get_pool_size(old_addr, new_addr) - 1;
- query->destroy(query);
-
- if (db->execute(db, NULL,
- "UPDATE pools SET end = ? WHERE name = ?",
- DB_BLOB, new_addr, DB_TEXT, name) <= 0)
- {
- fprintf(stderr, "pool '%s' not found.\n", name);
- exit(-1);
- }
-
- printf("allocating %d new addresses... ", count);
- fflush(stdout);
- if (db->get_driver(db) == DB_SQLITE)
- { /* run population in a transaction for sqlite */
- db->execute(db, NULL, "BEGIN TRANSACTION");
- }
- while (count-- > 0)
- {
- increment_chunk(cur_addr);
- db->execute(db, NULL,
- "INSERT INTO addresses (pool, address, identity, acquired, released) "
- "VALUES (?, ?, ?, ?, ?)",
- DB_UINT, id, DB_BLOB, cur_addr, DB_UINT, 0, DB_UINT, 0, DB_UINT, 1);
- }
- if (db->get_driver(db) == DB_SQLITE)
- {
- db->execute(db, NULL, "END TRANSACTION");
- }
- printf("done.\n", count);
-
- exit(0);
-}
-
-/**
- * create the lease query using the filter string
- */
-static enumerator_t *create_lease_query(char *filter)
-{
- enumerator_t *query;
- identification_t *id = NULL;
- host_t *addr = NULL;
- u_int tstamp = 0;
- bool online = FALSE, valid = FALSE, expired = FALSE;
- char *value, *pos, *pool = NULL;
- enum {
- FIL_POOL = 0,
- FIL_ID,
- FIL_ADDR,
- FIL_TSTAMP,
- FIL_STATE,
- };
- char *const token[] = {
- [FIL_POOL] = "pool",
- [FIL_ID] = "id",
- [FIL_ADDR] = "addr",
- [FIL_TSTAMP] = "tstamp",
- [FIL_STATE] = "status",
- NULL
- };
-
- /* if the filter string contains a distinguished name as a ID, we replace
- * ", " by "/ " in order to not confuse the getsubopt parser */
- pos = filter;
- while ((pos = strchr(pos, ',')))
- {
- if (pos[1] == ' ')
- {
- pos[0] = '/';
- }
- pos++;
- }
-
- while (filter && *filter != '\0')
- {
- switch (getsubopt(&filter, token, &value))
- {
- case FIL_POOL:
- if (value)
- {
- pool = value;
- }
- break;
- case FIL_ID:
- if (value)
- {
- id = identification_create_from_string(value);
- }
- break;
- case FIL_ADDR:
- if (value)
- {
- addr = host_create_from_string(value, 0);
- }
- if (!addr)
- {
- fprintf(stderr, "invalid 'addr' in filter string.\n");
- exit(-1);
- }
- break;
- case FIL_TSTAMP:
- if (value)
- {
- tstamp = atoi(value);
- }
- if (tstamp == 0)
- {
- online = TRUE;
- }
- break;
- case FIL_STATE:
- if (value)
- {
- if (streq(value, "online"))
- {
- online = TRUE;
- }
- else if (streq(value, "valid"))
- {
- valid = TRUE;
- }
- else if (streq(value, "expired"))
- {
- expired = TRUE;
- }
- else
- {
- fprintf(stderr, "invalid 'state' in filter string.\n");
- exit(-1);
- }
- }
- break;
- default:
- fprintf(stderr, "invalid filter string.\n");
- exit(-1);
- break;
- }
- }
- query = db->query(db,
- "SELECT name, addresses.address, identities.type, "
- "identities.data, leases.acquired, leases.released, timeout "
- "FROM leases JOIN addresses ON leases.address = addresses.id "
- "JOIN pools ON addresses.pool = pools.id "
- "JOIN identities ON leases.identity = identities.id "
- "WHERE (? OR name = ?) "
- "AND (? OR (identities.type = ? AND identities.data = ?)) "
- "AND (? OR addresses.address = ?) "
- "AND (? OR (? >= leases.acquired AND (? <= leases.released))) "
- "AND (? OR leases.released > ? - timeout) "
- "AND (? OR leases.released < ? - timeout) "
- "AND ? "
- "UNION "
- "SELECT name, address, identities.type, identities.data, "
- "acquired, released, timeout FROM addresses "
- "JOIN pools ON addresses.pool = pools.id "
- "JOIN identities ON addresses.identity = identities.id "
- "WHERE ? AND released = 0 "
- "AND (? OR name = ?) "
- "AND (? OR (identities.type = ? AND identities.data = ?)) "
- "AND (? OR address = ?)",
- DB_INT, pool == NULL, DB_TEXT, pool,
- DB_INT, id == NULL,
- DB_INT, id ? id->get_type(id) : 0,
- DB_BLOB, id ? id->get_encoding(id) : chunk_empty,
- DB_INT, addr == NULL,
- DB_BLOB, addr ? addr->get_address(addr) : chunk_empty,
- DB_INT, tstamp == 0, DB_UINT, tstamp, DB_UINT, tstamp,
- DB_INT, !valid, DB_INT, time(NULL),
- DB_INT, !expired, DB_INT, time(NULL),
- DB_INT, !online,
- /* union */
- DB_INT, !(valid || expired),
- DB_INT, pool == NULL, DB_TEXT, pool,
- DB_INT, id == NULL,
- DB_INT, id ? id->get_type(id) : 0,
- DB_BLOB, id ? id->get_encoding(id) : chunk_empty,
- DB_INT, addr == NULL,
- DB_BLOB, addr ? addr->get_address(addr) : chunk_empty,
- /* res */
- DB_TEXT, DB_BLOB, DB_INT, DB_BLOB, DB_UINT, DB_UINT, DB_UINT);
- /* id and addr leak but we can't destroy them until query is destroyed. */
- return query;
-}
-
-/**
- * ipsec pool --leases - show lease information of a pool
- */
-static void leases(char *filter, bool utc)
-{
- enumerator_t *query;
- chunk_t address_chunk, identity_chunk;
- int identity_type;
- char *name;
- u_int acquired, released, timeout;
- host_t *address;
- identification_t *identity;
- bool found = FALSE;
-
- query = create_lease_query(filter);
- if (!query)
- {
- fprintf(stderr, "querying leases failed.\n");
- exit(-1);
- }
- while (query->enumerate(query, &name, &address_chunk, &identity_type,
- &identity_chunk, &acquired, &released, &timeout))
- {
- if (!found)
- {
- int len = utc ? 25 : 21;
-
- found = TRUE;
- printf("%-8s %-15s %-7s %-*s %-*s %s\n",
- "name", "address", "status", len, "start", len, "end", "identity");
- }
- address = host_create_from_chunk(AF_UNSPEC, address_chunk, 0);
- identity = identification_create_from_encoding(identity_type, identity_chunk);
-
- printf("%-8s %-15H ", name, address);
- if (released == 0)
- {
- printf("%-7s ", "online");
- }
- else if (timeout == 0)
- {
- printf("%-7s ", "static");
- }
- else if (released >= time(NULL) - timeout)
- {
- printf("%-7s ", "valid");
- }
- else
- {
- printf("%-7s ", "expired");
- }
-
- printf(" %T ", &acquired, utc);
- if (released)
- {
- printf("%T ", &released, utc);
- }
- else
- {
- printf(" ");
- if (utc)
- {
- printf(" ");
- }
- }
- printf("%Y\n", identity);
- DESTROY_IF(address);
- identity->destroy(identity);
- }
- query->destroy(query);
- if (!found)
- {
- fprintf(stderr, "no matching leases found.\n");
- exit(-1);
- }
- exit(0);
-}
-
-/**
- * ipsec pool --purge - delete expired leases
- */
-static void purge(char *name)
-{
- int purged = 0;
-
- purged = db->execute(db, NULL,
- "DELETE FROM leases WHERE address IN ("
- " SELECT id FROM addresses WHERE pool IN ("
- " SELECT id FROM pools WHERE name = ?))",
- DB_TEXT, name);
- if (purged < 0)
- {
- fprintf(stderr, "purging pool '%s' failed.\n", name);
- exit(-1);
- }
- fprintf(stderr, "purged %d leases in pool '%s'.\n", purged, name);
- exit(0);
-}
-
-/**
- * atexit handler to close db on shutdown
- */
-static void cleanup(void)
-{
- db->destroy(db);
- DESTROY_IF(start);
- DESTROY_IF(end);
-}
-
-/**
- * Logging hook for library logs, using stderr output
- */
-static void dbg_stderr(int level, char *fmt, ...)
-{
- va_list args;
-
- if (level <= 1)
- {
- va_start(args, fmt);
- vfprintf(stderr, fmt, args);
- fprintf(stderr, "\n");
- va_end(args);
- }
-}
-
-int main(int argc, char *argv[])
-{
- char *uri, *name = "", *filter = "";
- int timeout = 0;
- bool utc = FALSE;
- enum {
- OP_USAGE,
- OP_STATUS,
- OP_ADD,
- OP_DEL,
- OP_RESIZE,
- OP_LEASES,
- OP_PURGE,
- } operation = OP_USAGE;
-
- dbg = dbg_stderr;
- atexit(library_deinit);
-
- /* initialize library */
- if (!library_init(STRONGSWAN_CONF))
- {
- exit(SS_RC_LIBSTRONGSWAN_INTEGRITY);
- }
- if (lib->integrity &&
- !lib->integrity->check_file(lib->integrity, "pool", argv[0]))
- {
- fprintf(stderr, "integrity check of pool failed\n");
- exit(SS_RC_DAEMON_INTEGRITY);
- }
- lib->plugins->load(lib->plugins, IPSEC_PLUGINDIR,
- lib->settings->get_str(lib->settings, "pool.load", PLUGINS));
-
- uri = lib->settings->get_str(lib->settings, "charon.plugins.sql.database", NULL);
- if (!uri)
- {
- fprintf(stderr, "database URI charon.plugins.sql.database not set.\n");
- exit(-1);
- }
- db = lib->db->create(lib->db, uri);
- if (!db)
- {
- fprintf(stderr, "opening database failed.\n");
- exit(-1);
- }
- atexit(cleanup);
-
- while (TRUE)
- {
- int c;
-
- struct option long_opts[] = {
- { "help", no_argument, NULL, 'h' },
-
- { "utc", no_argument, NULL, 'u' },
- { "status", no_argument, NULL, 'w' },
- { "add", required_argument, NULL, 'a' },
- { "del", required_argument, NULL, 'd' },
- { "resize", required_argument, NULL, 'r' },
- { "leases", no_argument, NULL, 'l' },
- { "purge", required_argument, NULL, 'p' },
-
- { "start", required_argument, NULL, 's' },
- { "end", required_argument, NULL, 'e' },
- { "timeout", required_argument, NULL, 't' },
- { "filter", required_argument, NULL, 'f' },
- { 0,0,0,0 }
- };
-
- c = getopt_long(argc, argv, "", long_opts, NULL);
- switch (c)
- {
- case EOF:
- break;
- case 'h':
- break;
- case 'w':
- operation = OP_STATUS;
- break;
- case 'u':
- utc = TRUE;
- continue;
- case 'a':
- operation = OP_ADD;
- name = optarg;
- continue;
- case 'd':
- operation = OP_DEL;
- name = optarg;
- continue;
- case 'r':
- operation = OP_RESIZE;
- name = optarg;
- continue;
- case 'l':
- operation = OP_LEASES;
- continue;
- case 'p':
- operation = OP_PURGE;
- name = optarg;
- continue;
- case 's':
- start = host_create_from_string(optarg, 0);
- if (start == NULL)
- {
- fprintf(stderr, "invalid start address: '%s'.\n", optarg);
- operation = OP_USAGE;
- break;
- }
- continue;
- case 'e':
- end = host_create_from_string(optarg, 0);
- if (end == NULL)
- {
- fprintf(stderr, "invalid end address: '%s'.\n", optarg);
- operation = OP_USAGE;
- break;
- }
- continue;
- case 't':
- timeout = atoi(optarg);
- if (timeout == 0 && strcmp(optarg, "0") != 0)
- {
- fprintf(stderr, "invalid timeout '%s'.\n", optarg);
- operation = OP_USAGE;
- break;
- }
- continue;
- case 'f':
- filter = optarg;
- continue;
- default:
- operation = OP_USAGE;
- break;
- }
- break;
- }
-
- switch (operation)
- {
- case OP_USAGE:
- usage();
- break;
- case OP_STATUS:
- status();
- break;
- case OP_ADD:
- if (start == NULL || end == NULL)
- {
- fprintf(stderr, "missing arguments.\n");
- usage();
- }
- add(name, start, end, timeout);
- break;
- case OP_DEL:
- del(name);
- break;
- case OP_RESIZE:
- if (end == NULL)
- {
- fprintf(stderr, "missing arguments.\n");
- usage();
- }
- resize(name, end);
- break;
- case OP_LEASES:
- leases(filter, utc);
- break;
- case OP_PURGE:
- purge(name);
- break;
- }
- exit(0);
-}
-
diff --git a/src/charon/plugins/sql/sql_attribute.c b/src/charon/plugins/sql/sql_attribute.c
deleted file mode 100644
index 77601e612..000000000
--- a/src/charon/plugins/sql/sql_attribute.c
+++ /dev/null
@@ -1,363 +0,0 @@
-/*
- * Copyright (C) 2008 Martin Willi
- * Hochschule fuer Technik Rapperswil
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
- * for more details.
- */
-
-#include "sql_attribute.h"
-
-#include <time.h>
-
-#include <daemon.h>
-
-typedef struct private_sql_attribute_t private_sql_attribute_t;
-
-/**
- * private data of sql_attribute
- */
-struct private_sql_attribute_t {
-
- /**
- * public functions
- */
- sql_attribute_t public;
-
- /**
- * database connection
- */
- database_t *db;
-
- /**
- * wheter to record lease history in lease table
- */
- bool history;
-};
-
-/**
- * lookup/insert an identity
- */
-static u_int get_identity(private_sql_attribute_t *this, identification_t *id)
-{
- enumerator_t *e;
- u_int row;
-
- /* look for peer identity in the identities table */
- e = this->db->query(this->db,
- "SELECT id FROM identities WHERE type = ? AND data = ?",
- DB_INT, id->get_type(id), DB_BLOB, id->get_encoding(id),
- DB_UINT);
-
- if (e && e->enumerate(e, &row))
- {
- e->destroy(e);
- return row;
- }
- DESTROY_IF(e);
- /* not found, insert new one */
- if (this->db->execute(this->db, &row,
- "INSERT INTO identities (type, data) VALUES (?, ?)",
- DB_INT, id->get_type(id), DB_BLOB, id->get_encoding(id)) == 1)
- {
- return row;
- }
- return 0;
-}
-
-/**
- * Lookup pool by name
- */
-static u_int get_pool(private_sql_attribute_t *this, char *name, u_int *timeout)
-{
- enumerator_t *e;
- u_int pool;
-
- e = this->db->query(this->db, "SELECT id, timeout FROM pools WHERE name = ?",
- DB_TEXT, name, DB_UINT, DB_UINT);
- if (e && e->enumerate(e, &pool, timeout))
- {
- e->destroy(e);
- return pool;
- }
- DESTROY_IF(e);
- return 0;
-}
-
-/**
- * Look up an existing lease
- */
-static host_t* check_lease(private_sql_attribute_t *this, char *name,
- u_int pool, u_int identity)
-{
- while (TRUE)
- {
- u_int id;
- chunk_t address;
- enumerator_t *e;
- time_t now = time(NULL);
-
- e = this->db->query(this->db,
- "SELECT id, address FROM addresses "
- "WHERE pool = ? AND identity = ? AND released != 0 LIMIT 1",
- DB_UINT, pool, DB_UINT, identity, DB_UINT, DB_BLOB);
- if (!e || !e->enumerate(e, &id, &address))
- {
- DESTROY_IF(e);
- break;
- }
- address = chunk_clonea(address);
- e->destroy(e);
-
- if (this->db->execute(this->db, NULL,
- "UPDATE addresses SET acquired = ?, released = 0 "
- "WHERE id = ? AND identity = ? AND released != 0",
- DB_UINT, now, DB_UINT, id, DB_UINT, identity) > 0)
- {
- host_t *host;
-
- host = host_create_from_chunk(AF_UNSPEC, address, 0);
- if (host)
- {
- DBG1(DBG_CFG, "acquired existing lease "
- "for address %H in pool '%s'", host, name);
- return host;
- }
- }
- }
- return NULL;
-}
-
-/**
- * We check for unallocated addresses or expired leases. First we select an
- * address as a candidate, but double check later on if it is still available
- * during the update operation. This allows us to work without locking.
- */
-static host_t* get_lease(private_sql_attribute_t *this, char *name,
- u_int pool, u_int timeout, u_int identity)
-{
- while (TRUE)
- {
- u_int id;
- chunk_t address;
- enumerator_t *e;
- time_t now = time(NULL);
- int hits;
-
- if (timeout)
- {
- /* check for an expired lease */
- e = this->db->query(this->db,
- "SELECT id, address FROM addresses "
- "WHERE pool = ? AND released != 0 AND released < ? LIMIT 1",
- DB_UINT, pool, DB_UINT, now - timeout, DB_UINT, DB_BLOB);
- }
- else
- {
- /* with static leases, check for an unallocated address */
- e = this->db->query(this->db,
- "SELECT id, address FROM addresses "
- "WHERE pool = ? AND identity = 0 LIMIT 1",
- DB_UINT, pool, DB_UINT, DB_BLOB);
-
- }
-
- if (!e || !e->enumerate(e, &id, &address))
- {
- DESTROY_IF(e);
- break;
- }
- address = chunk_clonea(address);
- e->destroy(e);
-
- if (timeout)
- {
- hits = this->db->execute(this->db, NULL,
- "UPDATE addresses SET "
- "acquired = ?, released = 0, identity = ? "
- "WHERE id = ? AND released != 0 AND released < ?",
- DB_UINT, now, DB_UINT, identity,
- DB_UINT, id, DB_UINT, now - timeout);
- }
- else
- {
- hits = this->db->execute(this->db, NULL,
- "UPDATE addresses SET "
- "acquired = ?, released = 0, identity = ? "
- "WHERE id = ? AND identity = 0",
- DB_UINT, now, DB_UINT, identity, DB_UINT, id);
- }
- if (hits > 0)
- {
- host_t *host;
-
- host = host_create_from_chunk(AF_UNSPEC, address, 0);
- if (host)
- {
- DBG1(DBG_CFG, "acquired new lease "
- "for address %H in pool '%s'", host, name);
- return host;
- }
- }
- }
- DBG1(DBG_CFG, "no available address found in pool '%s'", name);
- return NULL;
-}
-
-/**
- * Implementation of attribute_provider_t.acquire_address
- */
-static host_t* acquire_address(private_sql_attribute_t *this,
- char *names, identification_t *id,
- host_t *requested)
-{
- host_t *address = NULL;
- u_int identity, pool, timeout;
-
- identity = get_identity(this, id);
- if (identity)
- {
- /* check for a single pool first (no concatenation and enumeration) */
- if (strchr(names, ',') == NULL)
- {
- pool = get_pool(this, names, &timeout);
- if (pool)
- {
- /* check for an existing lease */
- address = check_lease(this, names, pool, identity);
- if (address == NULL)
- {
- /* get an unallocated address or expired lease */
- address = get_lease(this, names, pool, timeout, identity);
- }
- }
- }
- else
- {
- enumerator_t *enumerator;
- char *name;
-
- /* in a first step check for an existing lease over all pools */
- enumerator = enumerator_create_token(names, ",", " ");
- while (enumerator->enumerate(enumerator, &name))
- {
- pool = get_pool(this, name, &timeout);
- if (pool)
- {
- address = check_lease(this, name, pool, identity);
- if (address)
- {
- enumerator->destroy(enumerator);
- return address;
- }
- }
- }
- enumerator->destroy(enumerator);
-
- /* in a second step get an unallocated address or expired lease */
- enumerator = enumerator_create_token(names, ",", " ");
- while (enumerator->enumerate(enumerator, &name))
- {
- pool = get_pool(this, name, &timeout);
- if (pool)
- {
- address = get_lease(this, name, pool, timeout, identity);
- if (address)
- {
- break;
- }
- }
- }
- enumerator->destroy(enumerator);
- }
- }
- return address;
-}
-
-/**
- * Implementation of attribute_provider_t.release_address
- */
-static bool release_address(private_sql_attribute_t *this,
- char *name, host_t *address, identification_t *id)
-{
- enumerator_t *enumerator;
- bool found = FALSE;
- time_t now = time(NULL);
-
- enumerator = enumerator_create_token(name, ",", " ");
- while (enumerator->enumerate(enumerator, &name))
- {
- u_int pool, timeout;
-
- pool = get_pool(this, name, &timeout);
- if (pool)
- {
- if (this->history)
- {
- this->db->execute(this->db, NULL,
- "INSERT INTO leases (address, identity, acquired, released)"
- " SELECT id, identity, acquired, ? FROM addresses "
- " WHERE pool = ? AND address = ?",
- DB_UINT, now, DB_UINT, pool,
- DB_BLOB, address->get_address(address));
- }
- if (this->db->execute(this->db, NULL,
- "UPDATE addresses SET released = ? WHERE "
- "pool = ? AND address = ?", DB_UINT, time(NULL),
- DB_UINT, pool, DB_BLOB, address->get_address(address)) > 0)
- {
- found = TRUE;
- break;
- }
- }
- }
- enumerator->destroy(enumerator);
- return found;
-}
-
-/**
- * Implementation of sql_attribute_t.destroy
- */
-static void destroy(private_sql_attribute_t *this)
-{
- free(this);
-}
-
-/*
- * see header file
- */
-sql_attribute_t *sql_attribute_create(database_t *db)
-{
- private_sql_attribute_t *this = malloc_thing(private_sql_attribute_t);
- time_t now = time(NULL);
-
- this->public.provider.acquire_address = (host_t*(*)(attribute_provider_t *this, char*, identification_t *, host_t *))acquire_address;
- this->public.provider.release_address = (bool(*)(attribute_provider_t *this, char*,host_t *, identification_t*))release_address;
- this->public.provider.create_attribute_enumerator = (enumerator_t*(*)(attribute_provider_t*, identification_t *id))enumerator_create_empty;
- this->public.destroy = (void(*)(sql_attribute_t*))destroy;
-
- this->db = db;
- this->history = lib->settings->get_bool(lib->settings,
- "charon.plugins.sql.lease_history", TRUE);
-
- /* close any "online" leases in the case we crashed */
- if (this->history)
- {
- this->db->execute(this->db, NULL,
- "INSERT INTO leases (address, identity, acquired, released)"
- " SELECT id, identity, acquired, ? FROM addresses "
- " WHERE released = 0", DB_UINT, now);
- }
- this->db->execute(this->db, NULL,
- "UPDATE addresses SET released = ? WHERE released = 0",
- DB_UINT, now);
- return &this->public;
-}
-
diff --git a/src/charon/plugins/sql/sql_config.c b/src/charon/plugins/sql/sql_config.c
index e7dfe573b..afee0896c 100644
--- a/src/charon/plugins/sql/sql_config.c
+++ b/src/charon/plugins/sql/sql_config.c
@@ -30,7 +30,7 @@ struct private_sql_config_t {
* Public part
*/
sql_config_t public;
-
+
/**
* database connection
*/
@@ -58,7 +58,7 @@ static traffic_selector_t *build_traffic_selector(private_sql_config_t *this,
TS_LOCAL_DYNAMIC = 2,
TS_REMOTE_DYNAMIC = 3,
} kind;
-
+
while (e->enumerate(e, &kind, &type, &protocol,
&start_addr, &end_addr, &start_port, &end_port))
{
@@ -99,7 +99,7 @@ static void add_traffic_selectors(private_sql_config_t *this,
enumerator_t *e;
traffic_selector_t *ts;
bool local;
-
+
e = this->db->query(this->db,
"SELECT kind, type, protocol, "
"start_addr, end_addr, start_port, end_port "
@@ -126,12 +126,15 @@ static child_cfg_t *build_child_cfg(private_sql_config_t *this, enumerator_t *e)
int id, lifetime, rekeytime, jitter, hostaccess, mode, dpd, close, ipcomp;
char *name, *updown;
child_cfg_t *child_cfg;
-
- if (e->enumerate(e, &id, &name, &lifetime, &rekeytime, &jitter,
+
+ if (e->enumerate(e, &id, &name, &lifetime, &rekeytime, &jitter,
&updown, &hostaccess, &mode, &dpd, &close, &ipcomp))
{
- child_cfg = child_cfg_create(name, lifetime, rekeytime, jitter,
- updown, hostaccess, mode, dpd, close, ipcomp);
+ lifetime_cfg_t lft = {
+ .time = { .life = lifetime, .rekey = rekeytime, .jitter = jitter }
+ };
+ child_cfg = child_cfg_create(name, &lft, updown, hostaccess, mode,
+ dpd, close, ipcomp, 0);
/* TODO: read proposal from db */
child_cfg->add_proposal(child_cfg, proposal_create_default(PROTO_ESP));
add_traffic_selectors(this, child_cfg, id);
@@ -147,7 +150,7 @@ static void add_child_cfgs(private_sql_config_t *this, peer_cfg_t *peer, int id)
{
enumerator_t *e;
child_cfg_t *child_cfg;
-
+
e = this->db->query(this->db,
"SELECT id, name, lifetime, rekeytime, jitter, "
"updown, hostaccess, mode, dpd_action, close_action, ipcomp "
@@ -174,11 +177,11 @@ static ike_cfg_t *build_ike_cfg(private_sql_config_t *this, enumerator_t *e,
{
int certreq, force_encap;
char *local, *remote;
-
+
while (e->enumerate(e, &certreq, &force_encap, &local, &remote))
{
ike_cfg_t *ike_cfg;
-
+
ike_cfg = ike_cfg_create(certreq, force_encap, local, remote);
/* TODO: read proposal from db */
ike_cfg->add_proposal(ike_cfg, proposal_create_default(PROTO_IKE));
@@ -194,7 +197,7 @@ static ike_cfg_t* get_ike_cfg_by_id(private_sql_config_t *this, int id)
{
enumerator_t *e;
ike_cfg_t *ike_cfg = NULL;
-
+
e = this->db->query(this->db,
"SELECT certreq, force_encap, local, remote "
"FROM ike_configs WHERE id = ?",
@@ -215,7 +218,7 @@ static peer_cfg_t *get_peer_cfg_by_id(private_sql_config_t *this, int id)
{
enumerator_t *e;
peer_cfg_t *peer_cfg = NULL;
-
+
e = this->db->query(this->db,
"SELECT c.id, name, ike_cfg, l.type, l.data, r.type, r.data, "
"cert_policy, uniqueid, auth_method, eap_type, eap_vendor, "
@@ -229,8 +232,8 @@ static peer_cfg_t *get_peer_cfg_by_id(private_sql_config_t *this, int id)
"WHERE id = ?",
DB_INT, id,
DB_INT, DB_TEXT, DB_INT, DB_INT, DB_BLOB, DB_INT, DB_BLOB,
- DB_INT, DB_INT, DB_INT, DB_INT, DB_INT,
- DB_INT, DB_INT, DB_INT, DB_INT, DB_INT, DB_INT,
+ DB_INT, DB_INT, DB_INT, DB_INT, DB_INT,
+ DB_INT, DB_INT, DB_INT, DB_INT, DB_INT, DB_INT,
DB_INT, DB_TEXT, DB_TEXT,
DB_INT, DB_INT, DB_INT, DB_BLOB);
if (e)
@@ -253,11 +256,11 @@ static peer_cfg_t *build_peer_cfg(private_sql_config_t *this, enumerator_t *e,
mediation, mediated_by, p_type;
chunk_t l_data, r_data, p_data;
char *name, *virtual, *pool;
-
+
while (e->enumerate(e,
&id, &name, &ike_cfg, &l_type, &l_data, &r_type, &r_data,
&cert_policy, &uniqueid, &auth_method, &eap_type, &eap_vendor,
- &keyingtries, &rekeytime, &reauthtime, &jitter, &overtime, &mobike,
+ &keyingtries, &rekeytime, &reauthtime, &jitter, &overtime, &mobike,
&dpd_delay, &virtual, &pool,
&mediation, &mediated_by, &p_type, &p_data))
{
@@ -266,7 +269,7 @@ static peer_cfg_t *build_peer_cfg(private_sql_config_t *this, enumerator_t *e,
ike_cfg_t *ike;
host_t *vip = NULL;
auth_cfg_t *auth;
-
+
local_id = identification_create_from_encoding(l_type, l_data);
remote_id = identification_create_from_encoding(r_type, r_data);
if ((me && !me->matches(me, local_id)) ||
@@ -328,7 +331,7 @@ static peer_cfg_t *get_peer_cfg_by_name(private_sql_config_t *this, char *name)
{
enumerator_t *e;
peer_cfg_t *peer_cfg = NULL;
-
+
e = this->db->query(this->db,
"SELECT c.id, name, ike_cfg, l.type, l.data, r.type, r.data, "
"cert_policy, uniqueid, auth_method, eap_type, eap_vendor, "
@@ -401,14 +404,14 @@ static enumerator_t* create_ike_cfg_enumerator(private_sql_config_t *this,
host_t *me, host_t *other)
{
ike_enumerator_t *e = malloc_thing(ike_enumerator_t);
-
+
e->this = this;
e->me = me;
e->other = other;
e->current = NULL;
e->public.enumerate = (void*)ike_enumerator_enumerate;
e->public.destroy = (void*)ike_enumerator_destroy;
-
+
e->inner = this->db->query(this->db,
"SELECT certreq, force_encap, local, remote "
"FROM ike_configs",
@@ -470,7 +473,7 @@ static enumerator_t* create_peer_cfg_enumerator(private_sql_config_t *this,
identification_t *other)
{
peer_enumerator_t *e = malloc_thing(peer_enumerator_t);
-
+
e->this = this;
e->me = me;
e->other = other;
@@ -523,9 +526,9 @@ sql_config_t *sql_config_create(database_t *db)
this->public.backend.create_ike_cfg_enumerator = (enumerator_t*(*)(backend_t*, host_t *me, host_t *other))create_ike_cfg_enumerator;
this->public.backend.get_peer_cfg_by_name = (peer_cfg_t* (*)(backend_t*,char*))get_peer_cfg_by_name;
this->public.destroy = (void(*)(sql_config_t*))destroy;
-
+
this->db = db;
-
+
return &this->public;
}
diff --git a/src/charon/plugins/sql/sql_config.h b/src/charon/plugins/sql/sql_config.h
index abc6ef382..700d00a97 100644
--- a/src/charon/plugins/sql/sql_config.h
+++ b/src/charon/plugins/sql/sql_config.h
@@ -35,11 +35,11 @@ struct sql_config_t {
* Implements backend_t interface
*/
backend_t backend;
-
+
/**
* Destry the backend.
*/
- void (*destroy)(sql_config_t *this);
+ void (*destroy)(sql_config_t *this);
};
/**
diff --git a/src/charon/plugins/sql/sql_cred.c b/src/charon/plugins/sql/sql_cred.c
index f8b7a35c1..12f4ab045 100644
--- a/src/charon/plugins/sql/sql_cred.c
+++ b/src/charon/plugins/sql/sql_cred.c
@@ -30,7 +30,7 @@ struct private_sql_cred_t {
* Public part
*/
sql_cred_t public;
-
+
/**
* database connection
*/
@@ -92,7 +92,7 @@ static enumerator_t* create_private_enumerator(private_sql_cred_t *this,
identification_t *id)
{
private_enumerator_t *e;
-
+
e = malloc_thing(private_enumerator_t);
e->current = NULL;
e->public.enumerate = (void*)private_enumerator_enumerate;
@@ -178,7 +178,7 @@ static enumerator_t* create_cert_enumerator(private_sql_cred_t *this,
identification_t *id, bool trusted)
{
cert_enumerator_t *e;
-
+
e = malloc_thing(cert_enumerator_t);
e->current = NULL;
e->public.enumerate = (void*)cert_enumerator_enumerate;
@@ -275,11 +275,11 @@ static void shared_enumerator_destroy(shared_enumerator_t *this)
* Implementation of credential_set_t.create_shared_enumerator.
*/
static enumerator_t* create_shared_enumerator(private_sql_cred_t *this,
- shared_key_type_t type,
+ shared_key_type_t type,
identification_t *me, identification_t *other)
{
shared_enumerator_t *e;
-
+
e = malloc_thing(shared_enumerator_t);
e->me = me;
e->other = other;
@@ -306,12 +306,12 @@ static enumerator_t* create_shared_enumerator(private_sql_cred_t *this,
DB_INT, me->get_type(me), DB_BLOB, me->get_encoding(me),
DB_INT, other->get_type(other), DB_BLOB, other->get_encoding(other),
DB_INT, type == SHARED_ANY, DB_INT, type,
- DB_INT, DB_BLOB);
+ DB_INT, DB_BLOB);
}
else
{
identification_t *id = me ? me : other;
-
+
e->inner = this->db->query(this->db,
"SELECT s.type, s.data FROM shared_secrets AS s "
"JOIN shared_secret_identity AS si ON s.id = si.shared_secret "
@@ -350,16 +350,16 @@ static void destroy(private_sql_cred_t *this)
sql_cred_t *sql_cred_create(database_t *db)
{
private_sql_cred_t *this = malloc_thing(private_sql_cred_t);
-
+
this->public.set.create_private_enumerator = (void*)create_private_enumerator;
this->public.set.create_cert_enumerator = (void*)create_cert_enumerator;
this->public.set.create_shared_enumerator = (void*)create_shared_enumerator;
this->public.set.create_cdp_enumerator = (void*)return_null;
this->public.set.cache_cert = (void*)cache_cert;
this->public.destroy = (void(*)(sql_cred_t*))destroy;
-
+
this->db = db;
-
+
return &this->public;
}
diff --git a/src/charon/plugins/sql/sql_cred.h b/src/charon/plugins/sql/sql_cred.h
index 2a9a96df1..7f387398e 100644
--- a/src/charon/plugins/sql/sql_cred.h
+++ b/src/charon/plugins/sql/sql_cred.h
@@ -35,11 +35,11 @@ struct sql_cred_t {
* Implements credential_set_t interface
*/
credential_set_t set;
-
+
/**
* Destry the backend.
*/
- void (*destroy)(sql_cred_t *this);
+ void (*destroy)(sql_cred_t *this);
};
/**
diff --git a/src/charon/plugins/sql/sql_logger.c b/src/charon/plugins/sql/sql_logger.c
index 20d42662b..d350c4c3d 100644
--- a/src/charon/plugins/sql/sql_logger.c
+++ b/src/charon/plugins/sql/sql_logger.c
@@ -30,17 +30,17 @@ struct private_sql_logger_t {
* Public part
*/
sql_logger_t public;
-
+
/**
* database connection
*/
database_t *db;
-
+
/**
* logging level
*/
int level;
-
+
/**
* avoid recursive logging
*/
@@ -67,7 +67,7 @@ static bool log_(private_sql_logger_t *this, debug_t group, level_t level,
identification_t *local_id, *remote_id;
u_int64_t ispi, rspi;
ike_sa_id_t *id;
-
+
id = ike_sa->get_id(ike_sa);
ispi = id->get_initiator_spi(id);
rspi = id->get_responder_spi(id);
@@ -86,9 +86,9 @@ static bool log_(private_sql_logger_t *this, debug_t group, level_t level,
remote_id = ike_sa->get_other_id(ike_sa);
local_host = ike_sa->get_my_host(ike_sa);
remote_host = ike_sa->get_other_host(ike_sa);
-
+
vsnprintf(buffer, sizeof(buffer), format, args);
-
+
this->db->execute(this->db, NULL, "REPLACE INTO ike_sas ("
"local_spi, remote_spi, id, initiator, "
"local_id_type, local_id_data, "
@@ -129,17 +129,17 @@ static void destroy(private_sql_logger_t *this)
sql_logger_t *sql_logger_create(database_t *db)
{
private_sql_logger_t *this = malloc_thing(private_sql_logger_t);
-
+
memset(&this->public.listener, 0, sizeof(listener_t));
this->public.listener.log = (bool(*)(listener_t*,debug_t,level_t,int,ike_sa_t*,char*,va_list))log_;
this->public.destroy = (void(*)(sql_logger_t*))destroy;
-
+
this->db = db;
this->recursive = FALSE;
-
+
this->level = lib->settings->get_int(lib->settings,
"charon.plugins.sql.loglevel", -1);
-
+
return &this->public;
}
diff --git a/src/charon/plugins/sql/sql_logger.h b/src/charon/plugins/sql/sql_logger.h
index 3636c2293..a933705da 100644
--- a/src/charon/plugins/sql/sql_logger.h
+++ b/src/charon/plugins/sql/sql_logger.h
@@ -35,11 +35,11 @@ struct sql_logger_t {
* Implements bus_listener_t interface
*/
listener_t listener;
-
+
/**
* Destry the backend.
*/
- void (*destroy)(sql_logger_t *this);
+ void (*destroy)(sql_logger_t *this);
};
/**
diff --git a/src/charon/plugins/sql/sql_plugin.c b/src/charon/plugins/sql/sql_plugin.c
index e5a4afd1d..e2e410a8a 100644
--- a/src/charon/plugins/sql/sql_plugin.c
+++ b/src/charon/plugins/sql/sql_plugin.c
@@ -18,7 +18,6 @@
#include <daemon.h>
#include "sql_config.h"
#include "sql_cred.h"
-#include "sql_attribute.h"
#include "sql_logger.h"
typedef struct private_sql_plugin_t private_sql_plugin_t;
@@ -32,27 +31,22 @@ struct private_sql_plugin_t {
* implements plugin interface
*/
sql_plugin_t public;
-
+
/**
* database connection instance
*/
database_t *db;
-
+
/**
* configuration backend
*/
sql_config_t *config;
-
+
/**
* credential set
*/
sql_cred_t *cred;
-
- /**
- * CFG attributes
- */
- sql_attribute_t *attribute;
-
+
/**
* bus listener/logger
*/
@@ -66,11 +60,9 @@ static void destroy(private_sql_plugin_t *this)
{
charon->backends->remove_backend(charon->backends, &this->config->backend);
charon->credentials->remove_set(charon->credentials, &this->cred->set);
- charon->attributes->remove_provider(charon->attributes, &this->attribute->provider);
charon->bus->remove_listener(charon->bus, &this->logger->listener);
this->config->destroy(this->config);
this->cred->destroy(this->cred);
- this->attribute->destroy(this->attribute);
this->logger->destroy(this->logger);
this->db->destroy(this->db);
free(this);
@@ -83,18 +75,18 @@ plugin_t *plugin_create()
{
char *uri;
private_sql_plugin_t *this;
-
+
uri = lib->settings->get_str(lib->settings, "charon.plugins.sql.database", NULL);
if (!uri)
{
DBG1(DBG_CFG, "sql plugin: database URI not set");
return NULL;
}
-
+
this = malloc_thing(private_sql_plugin_t);
-
+
this->public.plugin.destroy = (void(*)(plugin_t*))destroy;
-
+
this->db = lib->db->create(lib->db, uri);
if (!this->db)
{
@@ -104,14 +96,12 @@ plugin_t *plugin_create()
}
this->config = sql_config_create(this->db);
this->cred = sql_cred_create(this->db);
- this->attribute = sql_attribute_create(this->db);
this->logger = sql_logger_create(this->db);
-
+
charon->backends->add_backend(charon->backends, &this->config->backend);
charon->credentials->add_set(charon->credentials, &this->cred->set);
- charon->attributes->add_provider(charon->attributes, &this->attribute->provider);
charon->bus->add_listener(charon->bus, &this->logger->listener);
-
+
return &this->public.plugin;
}
diff --git a/src/charon/plugins/stroke/Makefile.am b/src/charon/plugins/stroke/Makefile.am
index 79a63f2c2..94d311609 100644
--- a/src/charon/plugins/stroke/Makefile.am
+++ b/src/charon/plugins/stroke/Makefile.am
@@ -3,7 +3,7 @@ INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon -I$(top_
AM_CFLAGS = \
-rdynamic \
--DIPSEC_CONFDIR=\"${confdir}\" \
+-DIPSEC_CONFDIR=\"${sysconfdir}\" \
-DIPSEC_PIDDIR=\"${piddir}\"
plugin_LTLIBRARIES = libstrongswan-stroke.la
diff --git a/src/charon/plugins/stroke/Makefile.in b/src/charon/plugins/stroke/Makefile.in
index 19822ebc8..6e6b3b813 100644
--- a/src/charon/plugins/stroke/Makefile.in
+++ b/src/charon/plugins/stroke/Makefile.in
@@ -1,8 +1,9 @@
-# Makefile.in generated by automake 1.10.2 from Makefile.am.
+# Makefile.in generated by automake 1.11 from Makefile.am.
# @configure_input@
# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,
-# 2003, 2004, 2005, 2006, 2007, 2008 Free Software Foundation, Inc.
+# 2003, 2004, 2005, 2006, 2007, 2008, 2009 Free Software Foundation,
+# Inc.
# This Makefile.in is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.
@@ -16,8 +17,9 @@
VPATH = @srcdir@
pkgdatadir = $(datadir)/@PACKAGE@
-pkglibdir = $(libdir)/@PACKAGE@
pkgincludedir = $(includedir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkglibexecdir = $(libexecdir)/@PACKAGE@
am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
install_sh_DATA = $(install_sh) -c -m 644
install_sh_PROGRAM = $(install_sh) -c
@@ -35,19 +37,41 @@ host_triplet = @host@
subdir = src/charon/plugins/stroke
DIST_COMMON = $(srcdir)/Makefile.am $(srcdir)/Makefile.in
ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
-am__aclocal_m4_deps = $(top_srcdir)/configure.in
+am__aclocal_m4_deps = $(top_srcdir)/m4/config/libtool.m4 \
+ $(top_srcdir)/m4/config/ltoptions.m4 \
+ $(top_srcdir)/m4/config/ltsugar.m4 \
+ $(top_srcdir)/m4/config/ltversion.m4 \
+ $(top_srcdir)/m4/config/lt~obsolete.m4 \
+ $(top_srcdir)/m4/macros/with.m4 \
+ $(top_srcdir)/m4/macros/enable-disable.m4 \
+ $(top_srcdir)/configure.in
am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
$(ACLOCAL_M4)
mkinstalldirs = $(install_sh) -d
CONFIG_CLEAN_FILES =
+CONFIG_CLEAN_VPATH_FILES =
am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
am__vpath_adj = case $$p in \
$(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
*) f=$$p;; \
esac;
-am__strip_dir = `echo $$p | sed -e 's|^.*/||'`;
+am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
+am__install_max = 40
+am__nobase_strip_setup = \
+ srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
+am__nobase_strip = \
+ for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
+am__nobase_list = $(am__nobase_strip_setup); \
+ for p in $$list; do echo "$$p $$p"; done | \
+ sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
+ $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
+ if (++n[$$2] == $(am__install_max)) \
+ { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
+ END { for (dir in files) print dir, files[dir] }'
+am__base_list = \
+ sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
+ sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
am__installdirs = "$(DESTDIR)$(plugindir)"
-pluginLTLIBRARIES_INSTALL = $(INSTALL)
LTLIBRARIES = $(plugin_LTLIBRARIES)
libstrongswan_stroke_la_LIBADD =
am_libstrongswan_stroke_la_OBJECTS = stroke_plugin.lo stroke_socket.lo \
@@ -61,6 +85,7 @@ libstrongswan_stroke_la_LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) \
DEFAULT_INCLUDES = -I.@am__isrc@
depcomp = $(SHELL) $(top_srcdir)/depcomp
am__depfiles_maybe = depfiles
+am__mv = mv -f
COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
LTCOMPILE = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
@@ -108,25 +133,22 @@ INSTALL_DATA = @INSTALL_DATA@
INSTALL_PROGRAM = @INSTALL_PROGRAM@
INSTALL_SCRIPT = @INSTALL_SCRIPT@
INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
-IPSEC_ROUTING_TABLE = @IPSEC_ROUTING_TABLE@
-IPSEC_ROUTING_TABLE_PRIO = @IPSEC_ROUTING_TABLE_PRIO@
LD = @LD@
LDFLAGS = @LDFLAGS@
LEX = @LEX@
LEXLIB = @LEXLIB@
LEX_OUTPUT_ROOT = @LEX_OUTPUT_ROOT@
-LIBGCRYPT_CFLAGS = @LIBGCRYPT_CFLAGS@
-LIBGCRYPT_CONFIG = @LIBGCRYPT_CONFIG@
-LIBGCRYPT_LIBS = @LIBGCRYPT_LIBS@
LIBOBJS = @LIBOBJS@
LIBS = @LIBS@
LIBTOOL = @LIBTOOL@
-LINUX_HEADERS = @LINUX_HEADERS@
LIPO = @LIPO@
LN_S = @LN_S@
LTLIBOBJS = @LTLIBOBJS@
MAKEINFO = @MAKEINFO@
MKDIR_P = @MKDIR_P@
+MYSQLCFLAG = @MYSQLCFLAG@
+MYSQLCONFIG = @MYSQLCONFIG@
+MYSQLLIB = @MYSQLLIB@
NM = @NM@
NMEDIT = @NMEDIT@
OBJDUMP = @OBJDUMP@
@@ -138,11 +160,14 @@ PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
PACKAGE_NAME = @PACKAGE_NAME@
PACKAGE_STRING = @PACKAGE_STRING@
PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_URL = @PACKAGE_URL@
PACKAGE_VERSION = @PACKAGE_VERSION@
PATH_SEPARATOR = @PATH_SEPARATOR@
PERL = @PERL@
PKG_CONFIG = @PKG_CONFIG@
+PTHREADLIB = @PTHREADLIB@
RANLIB = @RANLIB@
+RTLIB = @RTLIB@
RUBY = @RUBY@
RUBYINCLUDE = @RUBYINCLUDE@
SED = @SED@
@@ -171,9 +196,9 @@ build_cpu = @build_cpu@
build_os = @build_os@
build_vendor = @build_vendor@
builddir = @builddir@
-confdir = @confdir@
datadir = @datadir@
datarootdir = @datarootdir@
+default_pkcs11 = @default_pkcs11@
docdir = @docdir@
dvidir = @dvidir@
exec_prefix = @exec_prefix@
@@ -196,7 +221,7 @@ ipsecuser = @ipsecuser@
libdir = @libdir@
libexecdir = @libexecdir@
libstrongswan_plugins = @libstrongswan_plugins@
-linuxdir = @linuxdir@
+linux_headers = @linux_headers@
localedir = @localedir@
localstatedir = @localstatedir@
lt_ECHO = @lt_ECHO@
@@ -204,6 +229,7 @@ mandir = @mandir@
mkdir_p = @mkdir_p@
nm_CFLAGS = @nm_CFLAGS@
nm_LIBS = @nm_LIBS@
+nm_ca_dir = @nm_ca_dir@
oldincludedir = @oldincludedir@
pdfdir = @pdfdir@
piddir = @piddir@
@@ -212,10 +238,12 @@ pluto_plugins = @pluto_plugins@
prefix = @prefix@
program_transform_name = @program_transform_name@
psdir = @psdir@
+random_device = @random_device@
resolv_conf = @resolv_conf@
+routing_table = @routing_table@
+routing_table_prio = @routing_table_prio@
sbindir = @sbindir@
sharedstatedir = @sharedstatedir@
-simreader = @simreader@
srcdir = @srcdir@
strongswan_conf = @strongswan_conf@
sysconfdir = @sysconfdir@
@@ -223,12 +251,13 @@ target_alias = @target_alias@
top_build_prefix = @top_build_prefix@
top_builddir = @top_builddir@
top_srcdir = @top_srcdir@
+urandom_device = @urandom_device@
xml_CFLAGS = @xml_CFLAGS@
xml_LIBS = @xml_LIBS@
INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon -I$(top_srcdir)/src/stroke
AM_CFLAGS = \
-rdynamic \
--DIPSEC_CONFDIR=\"${confdir}\" \
+-DIPSEC_CONFDIR=\"${sysconfdir}\" \
-DIPSEC_PIDDIR=\"${piddir}\"
plugin_LTLIBRARIES = libstrongswan-stroke.la
@@ -256,9 +285,9 @@ $(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps)
exit 1;; \
esac; \
done; \
- echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/charon/plugins/stroke/Makefile'; \
- cd $(top_srcdir) && \
- $(AUTOMAKE) --gnu src/charon/plugins/stroke/Makefile
+ echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/charon/plugins/stroke/Makefile'; \
+ $(am__cd) $(top_srcdir) && \
+ $(AUTOMAKE) --gnu src/charon/plugins/stroke/Makefile
.PRECIOUS: Makefile
Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
@case '$?' in \
@@ -276,23 +305,28 @@ $(top_srcdir)/configure: $(am__configure_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
$(ACLOCAL_M4): $(am__aclocal_m4_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(am__aclocal_m4_deps):
install-pluginLTLIBRARIES: $(plugin_LTLIBRARIES)
@$(NORMAL_INSTALL)
test -z "$(plugindir)" || $(MKDIR_P) "$(DESTDIR)$(plugindir)"
- @list='$(plugin_LTLIBRARIES)'; for p in $$list; do \
+ @list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+ list2=; for p in $$list; do \
if test -f $$p; then \
- f=$(am__strip_dir) \
- echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(pluginLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) '$$p' '$(DESTDIR)$(plugindir)/$$f'"; \
- $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(pluginLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) "$$p" "$(DESTDIR)$(plugindir)/$$f"; \
+ list2="$$list2 $$p"; \
else :; fi; \
- done
+ done; \
+ test -z "$$list2" || { \
+ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(plugindir)'"; \
+ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(plugindir)"; \
+ }
uninstall-pluginLTLIBRARIES:
@$(NORMAL_UNINSTALL)
- @list='$(plugin_LTLIBRARIES)'; for p in $$list; do \
- p=$(am__strip_dir) \
- echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$p'"; \
- $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$p"; \
+ @list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+ for p in $$list; do \
+ $(am__strip_dir) \
+ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$f'"; \
+ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$f"; \
done
clean-pluginLTLIBRARIES:
@@ -324,21 +358,21 @@ distclean-compile:
.c.o:
@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(COMPILE) -c $<
.c.obj:
@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(COMPILE) -c `$(CYGPATH_W) '$<'`
.c.lo:
@am__fastdepCC_TRUE@ $(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(LTCOMPILE) -c -o $@ $<
@@ -361,7 +395,7 @@ tags: TAGS
TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
$(TAGS_FILES) $(LISP)
- tags=; \
+ set x; \
here=`pwd`; \
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
unique=`for i in $$list; do \
@@ -369,29 +403,34 @@ TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
- if test -z "$(ETAGS_ARGS)$$tags$$unique"; then :; else \
+ shift; \
+ if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
test -n "$$unique" || unique=$$empty_fix; \
- $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
- $$tags $$unique; \
+ if test $$# -gt 0; then \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ "$$@" $$unique; \
+ else \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ $$unique; \
+ fi; \
fi
ctags: CTAGS
CTAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
$(TAGS_FILES) $(LISP)
- tags=; \
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
unique=`for i in $$list; do \
if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
- test -z "$(CTAGS_ARGS)$$tags$$unique" \
+ test -z "$(CTAGS_ARGS)$$unique" \
|| $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
- $$tags $$unique
+ $$unique
GTAGS:
here=`$(am__cd) $(top_builddir) && pwd` \
- && cd $(top_srcdir) \
- && gtags -i $(GTAGS_ARGS) $$here
+ && $(am__cd) $(top_srcdir) \
+ && gtags -i $(GTAGS_ARGS) "$$here"
distclean-tags:
-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
@@ -412,13 +451,17 @@ distdir: $(DISTFILES)
if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
if test -d $$d/$$file; then \
dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
+ if test -d "$(distdir)/$$file"; then \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+ fi; \
if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
- cp -pR $(srcdir)/$$file $(distdir)$$dir || exit 1; \
+ cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
fi; \
- cp -pR $$d/$$file $(distdir)$$dir || exit 1; \
+ cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
else \
- test -f $(distdir)/$$file \
- || cp -p $$d/$$file $(distdir)/$$file \
+ test -f "$(distdir)/$$file" \
+ || cp -p $$d/$$file "$(distdir)/$$file" \
|| exit 1; \
fi; \
done
@@ -449,6 +492,7 @@ clean-generic:
distclean-generic:
-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+ -test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
maintainer-clean-generic:
@echo "This command is intended for maintainers to use"
@@ -470,6 +514,8 @@ dvi-am:
html: html-am
+html-am:
+
info: info-am
info-am:
@@ -478,18 +524,28 @@ install-data-am: install-pluginLTLIBRARIES
install-dvi: install-dvi-am
+install-dvi-am:
+
install-exec-am:
install-html: install-html-am
+install-html-am:
+
install-info: install-info-am
+install-info-am:
+
install-man:
install-pdf: install-pdf-am
+install-pdf-am:
+
install-ps: install-ps-am
+install-ps-am:
+
installcheck-am:
maintainer-clean: maintainer-clean-am
@@ -528,6 +584,7 @@ uninstall-am: uninstall-pluginLTLIBRARIES
mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \
tags uninstall uninstall-am uninstall-pluginLTLIBRARIES
+
# Tell versions [3.59,3.63) of GNU make to not export all variables.
# Otherwise a system limit (for SysV at least) may be exceeded.
.NOEXPORT:
diff --git a/src/charon/plugins/stroke/stroke_attribute.c b/src/charon/plugins/stroke/stroke_attribute.c
index d3211fd67..7a5ce683e 100644
--- a/src/charon/plugins/stroke/stroke_attribute.c
+++ b/src/charon/plugins/stroke/stroke_attribute.c
@@ -18,7 +18,7 @@
#include <daemon.h>
#include <utils/linked_list.h>
#include <utils/hashtable.h>
-#include <utils/mutex.h>
+#include <threading/mutex.h>
#define POOL_LIMIT (sizeof(uintptr_t)*8)
@@ -33,12 +33,12 @@ struct private_stroke_attribute_t {
* public functions
*/
stroke_attribute_t public;
-
+
/**
* list of pools, contains pool_t
*/
linked_list_t *pools;
-
+
/**
* mutex to lock access to pools
*/
@@ -85,7 +85,7 @@ static void pool_destroy(pool_t *this)
{
enumerator_t *enumerator;
identification_t *id;
-
+
enumerator = this->ids->create_enumerator(this->ids);
while (enumerator->enumerate(enumerator, &id, NULL))
{
@@ -107,7 +107,7 @@ static pool_t *find_pool(private_stroke_attribute_t *this, char *name)
{
enumerator_t *enumerator;
pool_t *current, *found = NULL;
-
+
enumerator = this->pools->create_enumerator(this->pools);
while (enumerator->enumerate(enumerator, &current))
{
@@ -129,13 +129,13 @@ host_t* offset2host(pool_t *pool, int offset)
chunk_t addr;
host_t *host;
u_int32_t *pos;
-
+
offset--;
if (offset > pool->size)
{
return NULL;
}
-
+
addr = chunk_clone(pool->base->get_address(pool->base));
if (pool->base->get_family(pool->base) == AF_INET6)
{
@@ -158,7 +158,7 @@ int host2offset(pool_t *pool, host_t *addr)
{
chunk_t host, base;
u_int32_t hosti, basei;
-
+
if (addr->get_family(addr) != pool->base->get_family(pool->base))
{
return -1;
@@ -195,7 +195,7 @@ static host_t* acquire_address(private_stroke_attribute_t *this,
uintptr_t offset = 0;
enumerator_t *enumerator;
identification_t *old_id;
-
+
this->mutex->lock(this->mutex);
pool = find_pool(this, name);
while (pool)
@@ -206,7 +206,7 @@ static host_t* acquire_address(private_stroke_attribute_t *this,
this->mutex->unlock(this->mutex);
return requested->clone(requested);
}
-
+
if (!requested->is_anyaddr(requested) &&
requested->get_family(requested) !=
pool->base->get_family(pool->base))
@@ -214,7 +214,7 @@ static host_t* acquire_address(private_stroke_attribute_t *this,
DBG1(DBG_CFG, "IP pool address family mismatch");
break;
}
-
+
/* check for a valid offline lease, refresh */
offset = (uintptr_t)pool->offline->remove(pool->offline, id);
if (offset)
@@ -227,7 +227,7 @@ static host_t* acquire_address(private_stroke_attribute_t *this,
break;
}
}
-
+
/* check for a valid online lease, reassign */
offset = (uintptr_t)pool->online->get(pool->online, id);
if (offset && offset == host2offset(pool, requested))
@@ -235,7 +235,7 @@ static host_t* acquire_address(private_stroke_attribute_t *this,
DBG1(DBG_CFG, "reassigning online lease to '%Y'", id);
break;
}
-
+
if (pool->unused < pool->size)
{
/* assigning offset, starting by 1. Handling 0 in hashtable
@@ -270,7 +270,7 @@ static host_t* acquire_address(private_stroke_attribute_t *this,
}
}
enumerator->destroy(enumerator);
-
+
DBG1(DBG_CFG, "pool '%s' is full, unable to assign address", name);
break;
}
@@ -291,7 +291,7 @@ static bool release_address(private_stroke_attribute_t *this,
pool_t *pool;
bool found = FALSE;
uintptr_t offset;
-
+
this->mutex->lock(this->mutex);
pool = find_pool(this, name);
if (pool)
@@ -320,10 +320,10 @@ static bool release_address(private_stroke_attribute_t *this,
*/
static void add_pool(private_stroke_attribute_t *this, stroke_msg_t *msg)
{
- if (msg->add_conn.other.sourceip_size)
+ if (msg->add_conn.other.sourceip_mask)
{
pool_t *pool;
-
+
pool = malloc_thing(pool_t);
pool->base = NULL;
pool->size = 0;
@@ -335,17 +335,17 @@ static void add_pool(private_stroke_attribute_t *this, stroke_msg_t *msg)
(hashtable_equals_t)id_equals, 16);
pool->ids = hashtable_create((hashtable_hash_t)id_hash,
(hashtable_equals_t)id_equals, 16);
-
+
/* if %config, add an empty pool, otherwise */
if (msg->add_conn.other.sourceip)
{
u_int32_t bits;
int family;
-
- DBG1(DBG_CFG, "adding virtual IP address pool '%s': %s/%d",
- msg->add_conn.name, msg->add_conn.other.sourceip,
- msg->add_conn.other.sourceip_size);
-
+
+ DBG1(DBG_CFG, "adding virtual IP address pool '%s': %s/%d",
+ msg->add_conn.name, msg->add_conn.other.sourceip,
+ msg->add_conn.other.sourceip_mask);
+
pool->base = host_create_from_string(msg->add_conn.other.sourceip, 0);
if (!pool->base)
{
@@ -354,7 +354,7 @@ static void add_pool(private_stroke_attribute_t *this, stroke_msg_t *msg)
return;
}
family = pool->base->get_family(pool->base);
- bits = (family == AF_INET ? 32 : 128) - msg->add_conn.other.sourceip_size;
+ bits = (family == AF_INET ? 32 : 128) - msg->add_conn.other.sourceip_mask;
if (bits > POOL_LIMIT)
{
bits = POOL_LIMIT;
@@ -363,7 +363,7 @@ static void add_pool(private_stroke_attribute_t *this, stroke_msg_t *msg)
(family == AF_INET ? 32 : 128) - bits);
}
pool->size = 1 << (bits);
-
+
if (pool->size > 2)
{ /* do not use first and last addresses of a block */
pool->unused++;
@@ -383,7 +383,7 @@ static void del_pool(private_stroke_attribute_t *this, stroke_msg_t *msg)
{
enumerator_t *enumerator;
pool_t *pool;
-
+
this->mutex->lock(this->mutex);
enumerator = this->pools->create_enumerator(this->pools);
while (enumerator->enumerate(enumerator, &pool))
@@ -407,7 +407,7 @@ static bool pool_filter(void *mutex, pool_t **poolp, char **name,
void *d3, u_int *offline)
{
pool_t *pool = *poolp;
-
+
*name = pool->name;
*size = pool->size;
*online = pool->online->get_count(pool->online);
@@ -450,10 +450,10 @@ static bool lease_enumerate(lease_enumerator_t *this, identification_t **id_out,
{
identification_t *id;
uintptr_t offset;
-
+
DESTROY_IF(this->current);
this->current = NULL;
-
+
if (this->inner->enumerate(this->inner, &id, NULL))
{
offset = (uintptr_t)this->pool->online->get(this->pool->online, id);
@@ -494,7 +494,7 @@ static enumerator_t* create_lease_enumerator(private_stroke_attribute_t *this,
char *pool)
{
lease_enumerator_t *enumerator;
-
+
this->mutex->lock(this->mutex);
enumerator = malloc_thing(lease_enumerator_t);
enumerator->pool = find_pool(this, pool);
@@ -528,19 +528,19 @@ static void destroy(private_stroke_attribute_t *this)
stroke_attribute_t *stroke_attribute_create()
{
private_stroke_attribute_t *this = malloc_thing(private_stroke_attribute_t);
-
+
this->public.provider.acquire_address = (host_t*(*)(attribute_provider_t *this, char*, identification_t *,host_t *))acquire_address;
this->public.provider.release_address = (bool(*)(attribute_provider_t *this, char*,host_t *, identification_t*))release_address;
- this->public.provider.create_attribute_enumerator = (enumerator_t*(*)(attribute_provider_t*, identification_t *id))enumerator_create_empty;
+ this->public.provider.create_attribute_enumerator = (enumerator_t*(*)(attribute_provider_t*, identification_t *id, host_t *vip))enumerator_create_empty;
this->public.add_pool = (void(*)(stroke_attribute_t*, stroke_msg_t *msg))add_pool;
this->public.del_pool = (void(*)(stroke_attribute_t*, stroke_msg_t *msg))del_pool;
this->public.create_pool_enumerator = (enumerator_t*(*)(stroke_attribute_t*))create_pool_enumerator;
this->public.create_lease_enumerator = (enumerator_t*(*)(stroke_attribute_t*, char *pool))create_lease_enumerator;
this->public.destroy = (void(*)(stroke_attribute_t*))destroy;
-
+
this->pools = linked_list_create();
this->mutex = mutex_create(MUTEX_TYPE_RECURSIVE);
-
+
return &this->public;
}
diff --git a/src/charon/plugins/stroke/stroke_attribute.h b/src/charon/plugins/stroke/stroke_attribute.h
index fc273d1cb..cf6c950a6 100644
--- a/src/charon/plugins/stroke/stroke_attribute.h
+++ b/src/charon/plugins/stroke/stroke_attribute.h
@@ -22,7 +22,7 @@
#define STROKE_ATTRIBUTE_H_
#include <stroke_msg.h>
-#include <config/attributes/attribute_provider.h>
+#include <attributes/attribute_provider.h>
typedef struct stroke_attribute_t stroke_attribute_t;
@@ -30,12 +30,12 @@ typedef struct stroke_attribute_t stroke_attribute_t;
* Stroke IKEv2 cfg attribute provider
*/
struct stroke_attribute_t {
-
+
/**
* Implements attribute provider interface
*/
attribute_provider_t provider;
-
+
/**
* Add a virtual IP address.
*
@@ -43,24 +43,24 @@ struct stroke_attribute_t {
* @param end end of stroke message that contains virtual IP.
*/
void (*add_pool)(stroke_attribute_t *this, stroke_msg_t *msg);
-
+
/**
* Remove a virtual IP address.
*
* @param msg stroke message
*/
void (*del_pool)(stroke_attribute_t *this, stroke_msg_t *msg);
-
+
/**
* Create an enumerator over installed pools.
*
- * Enumerator enumerates over
+ * Enumerator enumerates over
* char *pool, u_int size, u_int offline, u_int online.
*
* @return enumerator
*/
enumerator_t* (*create_pool_enumerator)(stroke_attribute_t *this);
-
+
/**
* Create an enumerator over the leases of a pool.
*
diff --git a/src/charon/plugins/stroke/stroke_ca.c b/src/charon/plugins/stroke/stroke_ca.c
index c354d8cb8..49146f18b 100644
--- a/src/charon/plugins/stroke/stroke_ca.c
+++ b/src/charon/plugins/stroke/stroke_ca.c
@@ -17,7 +17,7 @@
#include "stroke_ca.h"
#include "stroke_cred.h"
-#include <utils/mutex.h>
+#include <threading/rwlock.h>
#include <utils/linked_list.h>
#include <crypto/hashers/hasher.h>
@@ -34,17 +34,17 @@ struct private_stroke_ca_t {
* public functions
*/
stroke_ca_t public;
-
+
/**
* read-write lock to lists
*/
rwlock_t *lock;
-
+
/**
* list of starters CA sections and its certificates (ca_section_t)
*/
linked_list_t *sections;
-
+
/**
* stroke credentials, stores our CA certificates
*/
@@ -62,27 +62,27 @@ struct ca_section_t {
* name of the CA section
*/
char *name;
-
+
/**
* reference to cert in trusted_credential_t
*/
certificate_t *cert;
-
+
/**
* CRL URIs
*/
linked_list_t *crl;
-
+
/**
* OCSP URIs
*/
linked_list_t *ocsp;
-
+
/**
* Hashes of certificates issued by this CA
*/
linked_list_t *hashes;
-
+
/**
* Base URI used for certificates from this CA
*/
@@ -90,12 +90,12 @@ struct ca_section_t {
};
/**
- * create a new CA section
+ * create a new CA section
*/
static ca_section_t *ca_section_create(char *name, certificate_t *cert)
{
ca_section_t *ca = malloc_thing(ca_section_t);
-
+
ca->name = strdup(name);
ca->crl = linked_list_create();
ca->ocsp = linked_list_create();
@@ -142,10 +142,9 @@ static void cdp_data_destroy(cdp_data_t *data)
static enumerator_t *create_inner_cdp(ca_section_t *section, cdp_data_t *data)
{
public_key_t *public;
- identification_t *keyid;
enumerator_t *enumerator = NULL;
linked_list_t *list;
-
+
if (data->type == CERT_X509_OCSP_RESPONSE)
{
list = section->ocsp;
@@ -164,10 +163,9 @@ static enumerator_t *create_inner_cdp(ca_section_t *section, cdp_data_t *data)
}
else
{
- keyid = public->get_id(public, data->id->get_type(data->id));
- if (keyid && keyid->matches(keyid, data->id))
+ if (public->has_fingerprint(public, data->id->get_encoding(data->id)))
{
- enumerator = list->create_enumerator(list);
+ enumerator = list->create_enumerator(list);
}
}
public->destroy(public);
@@ -182,25 +180,25 @@ static enumerator_t *create_inner_cdp_hashandurl(ca_section_t *section, cdp_data
{
enumerator_t *enumerator = NULL, *hash_enum;
identification_t *current;
-
+
if (!data->id || !section->certuribase)
{
return NULL;
}
-
+
hash_enum = section->hashes->create_enumerator(section->hashes);
while (hash_enum->enumerate(hash_enum, &current))
- {
+ {
if (current->matches(current, data->id))
{
char *url, *hash;
-
+
url = malloc(strlen(section->certuribase) + 40 + 1);
strcpy(url, section->certuribase);
hash = chunk_to_hex(current->get_encoding(current), NULL, FALSE).ptr;
strncat(url, hash, 40);
free(hash);
-
+
enumerator = enumerator_create_single(url, free);
break;
}
@@ -231,7 +229,7 @@ static enumerator_t *create_cdp_enumerator(private_stroke_ca_t *this,
data->this = this;
data->type = type;
data->id = id;
-
+
this->lock->read_lock(this->lock);
return enumerator_create_nested(this->sections->create_enumerator(this->sections),
(type == CERT_X509) ? (void*)create_inner_cdp_hashandurl : (void*)create_inner_cdp,
@@ -244,12 +242,12 @@ static void add(private_stroke_ca_t *this, stroke_msg_t *msg)
{
certificate_t *cert;
ca_section_t *ca;
-
+
if (msg->add_ca.cacert == NULL)
{
DBG1(DBG_CFG, "missing cacert parameter");
return;
- }
+ }
cert = this->cred->load_ca(this->cred, msg->add_ca.cacert);
if (cert)
{
@@ -288,7 +286,7 @@ static void del(private_stroke_ca_t *this, stroke_msg_t *msg)
{
enumerator_t *enumerator;
ca_section_t *ca = NULL;
-
+
this->lock->write_lock(this->lock);
enumerator = this->sections->create_enumerator(this->sections);
while (enumerator->enumerate(enumerator, &ca))
@@ -344,14 +342,14 @@ static void check_for_hash_and_url(private_stroke_ca_t *this, certificate_t* cer
{
ca_section_t *section;
enumerator_t *enumerator;
-
+
hasher_t *hasher = lib->crypto->create_hasher(lib->crypto, HASH_SHA1);
if (hasher == NULL)
{
DBG1(DBG_IKE, "unable to use hash-and-url: sha1 not supported");
return;
}
-
+
this->lock->write_lock(this->lock);
enumerator = this->sections->create_enumerator(this->sections);
while (enumerator->enumerate(enumerator, (void**)&section))
@@ -361,7 +359,7 @@ static void check_for_hash_and_url(private_stroke_ca_t *this, certificate_t* cer
chunk_t hash, encoded = cert->get_encoding(cert);
hasher->allocate_hash(hasher, encoded, &hash);
section->hashes->insert_last(section->hashes,
- identification_create_from_encoding(ID_CERT_DER_SHA1, hash));
+ identification_create_from_encoding(ID_KEY_ID, hash));
chunk_free(&hash);
chunk_free(&encoded);
break;
@@ -369,7 +367,7 @@ static void check_for_hash_and_url(private_stroke_ca_t *this, certificate_t* cer
}
enumerator->destroy(enumerator);
this->lock->unlock(this->lock);
-
+
hasher->destroy(hasher);
}
@@ -381,13 +379,14 @@ static void list(private_stroke_ca_t *this, stroke_msg_t *msg, FILE *out)
bool first = TRUE;
ca_section_t *section;
enumerator_t *enumerator;
-
+
this->lock->read_lock(this->lock);
enumerator = this->sections->create_enumerator(this->sections);
while (enumerator->enumerate(enumerator, (void**)&section))
{
certificate_t *cert = section->cert;
public_key_t *public = cert->get_public_key(cert);
+ chunk_t chunk;
if (first)
{
@@ -401,10 +400,14 @@ static void list(private_stroke_ca_t *this, stroke_msg_t *msg, FILE *out)
/* list authkey and keyid */
if (public)
{
- fprintf(out, " authkey: %Y\n",
- public->get_id(public, ID_PUBKEY_SHA1));
- fprintf(out, " keyid: %Y\n",
- public->get_id(public, ID_PUBKEY_INFO_SHA1));
+ if (public->get_fingerprint(public, KEY_ID_PUBKEY_SHA1, &chunk))
+ {
+ fprintf(out, " authkey: %#B\n", &chunk);
+ }
+ if (public->get_fingerprint(public, KEY_ID_PUBKEY_INFO_SHA1, &chunk))
+ {
+ fprintf(out, " keyid: %#B\n", &chunk);
+ }
public->destroy(public);
}
list_uris(section->crl, " crluris: ", out);
@@ -434,7 +437,7 @@ static void destroy(private_stroke_ca_t *this)
stroke_ca_t *stroke_ca_create(stroke_cred_t *cred)
{
private_stroke_ca_t *this = malloc_thing(private_stroke_ca_t);
-
+
this->public.set.create_private_enumerator = (void*)return_null;
this->public.set.create_cert_enumerator = (void*)return_null;
this->public.set.create_shared_enumerator = (void*)return_null;
@@ -445,11 +448,11 @@ stroke_ca_t *stroke_ca_create(stroke_cred_t *cred)
this->public.list = (void(*)(stroke_ca_t*, stroke_msg_t *msg, FILE *out))list;
this->public.check_for_hash_and_url = (void(*)(stroke_ca_t*, certificate_t*))check_for_hash_and_url;
this->public.destroy = (void(*)(stroke_ca_t*))destroy;
-
+
this->sections = linked_list_create();
this->lock = rwlock_create(RWLOCK_TYPE_DEFAULT);
this->cred = cred;
-
+
return &this->public;
}
diff --git a/src/charon/plugins/stroke/stroke_ca.h b/src/charon/plugins/stroke/stroke_ca.h
index c882d7b4e..21af912ea 100644
--- a/src/charon/plugins/stroke/stroke_ca.h
+++ b/src/charon/plugins/stroke/stroke_ca.h
@@ -37,39 +37,39 @@ struct stroke_ca_t {
* Implements credential_set_t
*/
credential_set_t set;
-
+
/**
* Add a CA to the set using a stroke_msg_t.
*
* @param msg stroke message containing CA info
*/
void (*add)(stroke_ca_t *this, stroke_msg_t *msg);
-
+
/**
* Remove a CA from the set using a stroke_msg_t.
*
* @param msg stroke message containing CA info
*/
void (*del)(stroke_ca_t *this, stroke_msg_t *msg);
-
+
/**
* List CA sections to stroke console.
*
* @param msg stroke message
*/
void (*list)(stroke_ca_t *this, stroke_msg_t *msg, FILE *out);
-
+
/**
* Check if a certificate can be made available through hash and URL.
- *
+ *
* @param cert peer certificate
*/
void (*check_for_hash_and_url)(stroke_ca_t *this, certificate_t* cert);
-
+
/**
- * Destroy a stroke_ca instance.
- */
- void (*destroy)(stroke_ca_t *this);
+ * Destroy a stroke_ca instance.
+ */
+ void (*destroy)(stroke_ca_t *this);
};
/**
diff --git a/src/charon/plugins/stroke/stroke_config.c b/src/charon/plugins/stroke/stroke_config.c
index 0b6a4ac31..0752f3c93 100644
--- a/src/charon/plugins/stroke/stroke_config.c
+++ b/src/charon/plugins/stroke/stroke_config.c
@@ -16,7 +16,7 @@
#include "stroke_config.h"
#include <daemon.h>
-#include <utils/mutex.h>
+#include <threading/mutex.h>
#include <utils/lexparser.h>
typedef struct private_stroke_config_t private_stroke_config_t;
@@ -30,22 +30,22 @@ struct private_stroke_config_t {
* public functions
*/
stroke_config_t public;
-
+
/**
* list of peer_cfg_t
*/
linked_list_t *list;
-
+
/**
* mutex to lock config list
*/
mutex_t *mutex;
-
+
/**
* ca sections
*/
stroke_ca_t *ca;
-
+
/**
* credentials
*/
@@ -93,7 +93,7 @@ static peer_cfg_t *get_peer_cfg_by_name(private_stroke_config_t *this, char *nam
enumerator_t *e1, *e2;
peer_cfg_t *current, *found = NULL;
child_cfg_t *child;
-
+
this->mutex->lock(this->mutex);
e1 = this->list->create_enumerator(this->list);
while (e1->enumerate(e1, &current))
@@ -139,7 +139,7 @@ static void add_proposals(private_stroke_config_t *this, char *string,
char *strict;
proposal_t *proposal;
protocol_id_t proto = PROTO_ESP;
-
+
if (ike_cfg)
{
proto = PROTO_IKE;
@@ -195,7 +195,7 @@ static ike_cfg_t *build_ike_cfg(private_stroke_config_t *this, stroke_msg_t *msg
ike_cfg_t *ike_cfg;
char *interface;
host_t *host;
-
+
host = host_create_from_dns(msg->add_conn.other.address, 0, 0);
if (host)
{
@@ -227,7 +227,7 @@ static ike_cfg_t *build_ike_cfg(private_stroke_config_t *this, stroke_msg_t *msg
{
free(interface);
}
-
+
}
}
}
@@ -236,7 +236,7 @@ static ike_cfg_t *build_ike_cfg(private_stroke_config_t *this, stroke_msg_t *msg
msg->add_conn.me.address,
msg->add_conn.other.address);
add_proposals(this, msg->add_conn.algorithms.ike, ike_cfg, NULL);
- return ike_cfg;
+ return ike_cfg;
}
/**
@@ -275,7 +275,7 @@ static auth_cfg_t *build_auth_cfg(private_stroke_config_t *this,
stroke_end_t *end, *other_end;
auth_cfg_t *cfg;
char eap_buf[32];
-
+
/* select strings */
if (local)
{
@@ -317,7 +317,7 @@ static auth_cfg_t *build_auth_cfg(private_stroke_config_t *this,
ca = other_end->ca2;
}
}
-
+
if (!auth)
{
if (primary)
@@ -366,9 +366,9 @@ static auth_cfg_t *build_auth_cfg(private_stroke_config_t *this,
return NULL;
}
}
-
+
cfg = auth_cfg_create();
-
+
/* add identity and peer certifcate */
identity = identification_create_from_string(id);
if (cert)
@@ -380,12 +380,12 @@ static auth_cfg_t *build_auth_cfg(private_stroke_config_t *this,
{
this->ca->check_for_hash_and_url(this->ca, certificate);
}
- cfg->add(cfg, AUTH_RULE_SUBJECT_CERT, certificate);
+ cfg->add(cfg, AUTH_RULE_SUBJECT_CERT, certificate);
if (identity->get_type(identity) == ID_ANY ||
!certificate->has_subject(certificate, identity))
{
- DBG1(DBG_CFG, " peerid %Y not confirmed by certificate, "
- "defaulting to subject DN: %Y", identity,
+ DBG1(DBG_CFG, " id '%Y' not confirmed by certificate, "
+ "defaulting to '%Y'", identity,
certificate->get_subject(certificate));
identity->destroy(identity);
identity = certificate->get_subject(certificate);
@@ -394,7 +394,7 @@ static auth_cfg_t *build_auth_cfg(private_stroke_config_t *this,
}
}
cfg->add(cfg, AUTH_RULE_IDENTITY, identity);
-
+
/* CA constraint */
if (ca)
{
@@ -412,13 +412,13 @@ static auth_cfg_t *build_auth_cfg(private_stroke_config_t *this,
"constraint", ca);
}
}
-
+
/* AC groups */
if (end->groups)
{
enumerator_t *enumerator;
char *group;
-
+
enumerator = enumerator_create_token(end->groups, ",", " ");
while (enumerator->enumerate(enumerator, &group))
{
@@ -428,7 +428,7 @@ static auth_cfg_t *build_auth_cfg(private_stroke_config_t *this,
}
enumerator->destroy(enumerator);
}
-
+
/* authentication metod (class, actually) */
if (streq(auth, "pubkey") ||
streq(auth, "rsasig") || streq(auth, "rsa") ||
@@ -446,9 +446,9 @@ static auth_cfg_t *build_auth_cfg(private_stroke_config_t *this,
enumerator_t *enumerator;
char *str;
int i = 0, type = 0, vendor;
-
+
cfg->add(cfg, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_EAP);
-
+
/* parse EAP string, format: eap[-type[-vendor]] */
enumerator = enumerator_create_token(auth, "-", " ");
while (enumerator->enumerate(enumerator, &str))
@@ -488,7 +488,7 @@ static auth_cfg_t *build_auth_cfg(private_stroke_config_t *this,
i++;
}
enumerator->destroy(enumerator);
-
+
if (msg->add_conn.eap_identity)
{
if (streq(msg->add_conn.eap_identity, "%identity"))
@@ -529,37 +529,36 @@ static peer_cfg_t *build_peer_cfg(private_stroke_config_t *this,
u_int32_t rekey = 0, reauth = 0, over, jitter;
peer_cfg_t *peer_cfg;
auth_cfg_t *auth_cfg;
-
+
#ifdef ME
if (msg->add_conn.ikeme.mediation && msg->add_conn.ikeme.mediated_by)
{
- DBG1(DBG_CFG, "a mediation connection cannot be a"
- " mediated connection at the same time, aborting");
+ DBG1(DBG_CFG, "a mediation connection cannot be a mediated connection "
+ "at the same time, aborting");
return NULL;
}
-
+
if (msg->add_conn.ikeme.mediation)
{
/* force unique connections for mediation connections */
msg->add_conn.unique = 1;
}
-
+
if (msg->add_conn.ikeme.mediated_by)
{
mediated_by = charon->backends->get_peer_cfg_by_name(charon->backends,
- msg->add_conn.ikeme.mediated_by);
+ msg->add_conn.ikeme.mediated_by);
if (!mediated_by)
{
DBG1(DBG_CFG, "mediation connection '%s' not found, aborting",
msg->add_conn.ikeme.mediated_by);
return NULL;
}
-
if (!mediated_by->is_mediation(mediated_by))
{
- DBG1(DBG_CFG, "connection '%s' as referred to by '%s' is"
- "no mediation connection, aborting",
- msg->add_conn.ikeme.mediated_by, msg->add_conn.name);
+ DBG1(DBG_CFG, "connection '%s' as referred to by '%s' is "
+ "no mediation connection, aborting",
+ msg->add_conn.ikeme.mediated_by, msg->add_conn.name);
mediated_by->destroy(mediated_by);
return NULL;
}
@@ -573,7 +572,7 @@ static peer_cfg_t *build_peer_cfg(private_stroke_config_t *this,
}
}
#endif /* ME */
-
+
jitter = msg->add_conn.rekey.margin * msg->add_conn.rekey.fuzz / 100;
over = msg->add_conn.rekey.margin;
if (msg->add_conn.rekey.reauth)
@@ -583,8 +582,8 @@ static peer_cfg_t *build_peer_cfg(private_stroke_config_t *this,
else
{
rekey = msg->add_conn.rekey.ike_lifetime - over;
- }
- if (msg->add_conn.me.sourceip_size)
+ }
+ if (msg->add_conn.me.sourceip_mask)
{
if (msg->add_conn.me.sourceip)
{
@@ -633,19 +632,19 @@ static peer_cfg_t *build_peer_cfg(private_stroke_config_t *this,
{ /* dpdaction=none disables DPD */
msg->add_conn.dpd.delay = 0;
}
-
+
/* other.sourceip is managed in stroke_attributes. If it is set, we define
* the pool name as the connection name, which the attribute provider
* uses to serve pool addresses. */
peer_cfg = peer_cfg_create(msg->add_conn.name,
msg->add_conn.ikev2 ? 2 : 1, ike_cfg,
- msg->add_conn.me.sendcert, unique,
+ msg->add_conn.me.sendcert, unique,
msg->add_conn.rekey.tries, rekey, reauth, jitter, over,
msg->add_conn.mobike, msg->add_conn.dpd.delay,
- vip, msg->add_conn.other.sourceip_size ?
+ vip, msg->add_conn.other.sourceip_mask ?
msg->add_conn.name : msg->add_conn.other.sourceip,
msg->add_conn.ikeme.mediation, mediated_by, peer_id);
-
+
/* build leftauth= */
auth_cfg = build_auth_cfg(this, msg, TRUE, TRUE);
if (auth_cfg)
@@ -685,7 +684,7 @@ static void add_ts(private_stroke_config_t *this,
stroke_end_t *end, child_cfg_t *child_cfg, bool local)
{
traffic_selector_t *ts;
-
+
if (end->tohost)
{
ts = traffic_selector_create_dynamic(end->protocol,
@@ -695,7 +694,7 @@ static void add_ts(private_stroke_config_t *this,
else
{
host_t *net;
-
+
if (!end->subnets)
{
net = host_create_from_string(end->address, IKEV2_UDP_PORT);
@@ -709,12 +708,12 @@ static void add_ts(private_stroke_config_t *this,
else
{
char *del, *start, *bits;
-
+
start = end->subnets;
do
{
int intbits = 0;
-
+
del = strchr(start, ',');
if (del)
{
@@ -726,7 +725,7 @@ static void add_ts(private_stroke_config_t *this,
*bits = '\0';
intbits = atoi(bits + 1);
}
-
+
net = host_create_from_string(start, IKEV2_UDP_PORT);
if (net)
{
@@ -753,7 +752,24 @@ static child_cfg_t *build_child_cfg(private_stroke_config_t *this,
{
child_cfg_t *child_cfg;
action_t dpd;
-
+ lifetime_cfg_t lifetime = {
+ .time = {
+ .life = msg->add_conn.rekey.ipsec_lifetime,
+ .rekey = msg->add_conn.rekey.ipsec_lifetime - msg->add_conn.rekey.margin,
+ .jitter = msg->add_conn.rekey.margin * msg->add_conn.rekey.fuzz / 100
+ },
+ .bytes = {
+ .life = msg->add_conn.rekey.life_bytes,
+ .rekey = msg->add_conn.rekey.life_bytes - msg->add_conn.rekey.margin_bytes,
+ .jitter = msg->add_conn.rekey.margin_bytes * msg->add_conn.rekey.fuzz / 100
+ },
+ .packets = {
+ .life = msg->add_conn.rekey.life_packets,
+ .rekey = msg->add_conn.rekey.life_packets - msg->add_conn.rekey.margin_packets,
+ .jitter = msg->add_conn.rekey.margin_packets * msg->add_conn.rekey.fuzz / 100
+ }
+ };
+
switch (msg->add_conn.dpd.action)
{ /* map startes magic values to our action type */
case 2: /* =hold */
@@ -766,19 +782,19 @@ static child_cfg_t *build_child_cfg(private_stroke_config_t *this,
dpd = ACTION_NONE;
break;
}
+
child_cfg = child_cfg_create(
- msg->add_conn.name, msg->add_conn.rekey.ipsec_lifetime,
- msg->add_conn.rekey.ipsec_lifetime - msg->add_conn.rekey.margin,
- msg->add_conn.rekey.margin * msg->add_conn.rekey.fuzz / 100,
+ msg->add_conn.name, &lifetime,
msg->add_conn.me.updown, msg->add_conn.me.hostaccess,
- msg->add_conn.mode, dpd, dpd, msg->add_conn.ipcomp);
+ msg->add_conn.mode, dpd, dpd, msg->add_conn.ipcomp,
+ msg->add_conn.inactivity);
child_cfg->set_mipv6_options(child_cfg, msg->add_conn.proxy_mode,
msg->add_conn.install_policy);
add_ts(this, &msg->add_conn.me, child_cfg, TRUE);
add_ts(this, &msg->add_conn.other, child_cfg, FALSE);
-
+
add_proposals(this, msg->add_conn.algorithms.esp, NULL, child_cfg);
-
+
return child_cfg;
}
@@ -804,7 +820,7 @@ static void add(private_stroke_config_t *this, stroke_msg_t *msg)
ike_cfg->destroy(ike_cfg);
return;
}
-
+
enumerator = create_peer_cfg_enumerator(this, NULL, NULL);
while (enumerator->enumerate(enumerator, &existing))
{
@@ -822,7 +838,7 @@ static void add(private_stroke_config_t *this, stroke_msg_t *msg)
}
}
enumerator->destroy(enumerator);
-
+
child_cfg = build_child_cfg(this, msg);
if (!child_cfg)
{
@@ -830,7 +846,7 @@ static void add(private_stroke_config_t *this, stroke_msg_t *msg)
return;
}
peer_cfg->add_child_cfg(peer_cfg, child_cfg);
-
+
if (use_existing)
{
peer_cfg->destroy(peer_cfg);
@@ -854,13 +870,13 @@ static void del(private_stroke_config_t *this, stroke_msg_t *msg)
peer_cfg_t *peer;
child_cfg_t *child;
bool deleted = FALSE;
-
+
this->mutex->lock(this->mutex);
enumerator = this->list->create_enumerator(this->list);
while (enumerator->enumerate(enumerator, (void**)&peer))
{
bool keep = FALSE;
-
+
/* remove any child with such a name */
children = peer->create_child_cfg_enumerator(peer);
while (children->enumerate(children, &child))
@@ -877,7 +893,7 @@ static void del(private_stroke_config_t *this, stroke_msg_t *msg)
}
}
children->destroy(children);
-
+
/* if peer config matches, or has no children anymore, remove it */
if (!keep || streq(peer->get_name(peer), msg->del_conn.name))
{
@@ -888,7 +904,7 @@ static void del(private_stroke_config_t *this, stroke_msg_t *msg)
}
enumerator->destroy(enumerator);
this->mutex->unlock(this->mutex);
-
+
if (deleted)
{
DBG1(DBG_CFG, "deleted connection '%s'", msg->del_conn.name);
@@ -915,19 +931,19 @@ static void destroy(private_stroke_config_t *this)
stroke_config_t *stroke_config_create(stroke_ca_t *ca, stroke_cred_t *cred)
{
private_stroke_config_t *this = malloc_thing(private_stroke_config_t);
-
+
this->public.backend.create_peer_cfg_enumerator = (enumerator_t*(*)(backend_t*, identification_t *me, identification_t *other))create_peer_cfg_enumerator;
this->public.backend.create_ike_cfg_enumerator = (enumerator_t*(*)(backend_t*, host_t *me, host_t *other))create_ike_cfg_enumerator;
this->public.backend.get_peer_cfg_by_name = (peer_cfg_t* (*)(backend_t*,char*))get_peer_cfg_by_name;
this->public.add = (void(*)(stroke_config_t*, stroke_msg_t *msg))add;
this->public.del = (void(*)(stroke_config_t*, stroke_msg_t *msg))del;
this->public.destroy = (void(*)(stroke_config_t*))destroy;
-
+
this->list = linked_list_create();
this->mutex = mutex_create(MUTEX_TYPE_RECURSIVE);
this->ca = ca;
this->cred = cred;
-
+
return &this->public;
}
diff --git a/src/charon/plugins/stroke/stroke_config.h b/src/charon/plugins/stroke/stroke_config.h
index 270795e4a..05e4665ca 100644
--- a/src/charon/plugins/stroke/stroke_config.h
+++ b/src/charon/plugins/stroke/stroke_config.h
@@ -37,25 +37,25 @@ struct stroke_config_t {
* Implements the backend_t interface
*/
backend_t backend;
-
+
/**
* Add a configuration to the backend.
*
* @param msg received stroke message containing config
*/
void (*add)(stroke_config_t *this, stroke_msg_t *msg);
-
+
/**
* Remove a configuration from the backend.
*
* @param msg received stroke message containing config name
*/
void (*del)(stroke_config_t *this, stroke_msg_t *msg);
-
+
/**
- * Destroy a stroke_config instance.
- */
- void (*destroy)(stroke_config_t *this);
+ * Destroy a stroke_config instance.
+ */
+ void (*destroy)(stroke_config_t *this);
};
/**
diff --git a/src/charon/plugins/stroke/stroke_control.c b/src/charon/plugins/stroke/stroke_control.c
index c572117a2..a03aef697 100644
--- a/src/charon/plugins/stroke/stroke_control.c
+++ b/src/charon/plugins/stroke/stroke_control.c
@@ -43,7 +43,7 @@ struct stroke_log_info_t {
* level to log up to
*/
level_t level;
-
+
/**
* where to write log
*/
@@ -75,7 +75,7 @@ static child_cfg_t* get_child_from_peer(peer_cfg_t *peer_cfg, char *name)
{
child_cfg_t *current, *found = NULL;
enumerator_t *enumerator;
-
+
enumerator = peer_cfg->create_child_cfg_enumerator(peer_cfg);
while (enumerator->enumerate(enumerator, &current))
{
@@ -98,7 +98,7 @@ static void initiate(private_stroke_control_t *this, stroke_msg_t *msg, FILE *ou
peer_cfg_t *peer_cfg;
child_cfg_t *child_cfg;
stroke_log_info_t info;
-
+
peer_cfg = charon->backends->get_peer_cfg_by_name(charon->backends,
msg->initiate.name);
if (peer_cfg == NULL)
@@ -113,7 +113,7 @@ static void initiate(private_stroke_control_t *this, stroke_msg_t *msg, FILE *ou
peer_cfg->destroy(peer_cfg);
return;
}
-
+
child_cfg = get_child_from_peer(peer_cfg, msg->initiate.name);
if (child_cfg == NULL)
{
@@ -121,7 +121,7 @@ static void initiate(private_stroke_control_t *this, stroke_msg_t *msg, FILE *ou
peer_cfg->destroy(peer_cfg);
return;
}
-
+
if (msg->output_verbosity < 0)
{
charon->controller->initiate(charon->controller, peer_cfg, child_cfg,
@@ -150,9 +150,9 @@ static void terminate(private_stroke_control_t *this, stroke_msg_t *msg, FILE *o
linked_list_t *ike_list, *child_list;
stroke_log_info_t info;
uintptr_t del;
-
+
string = msg->terminate.name;
-
+
len = strlen(string);
if (len < 1)
{
@@ -174,7 +174,7 @@ static void terminate(private_stroke_control_t *this, stroke_msg_t *msg, FILE *o
child = FALSE;
break;
}
-
+
if (name)
{
/* is a single name */
@@ -202,10 +202,10 @@ static void terminate(private_stroke_control_t *this, stroke_msg_t *msg, FILE *o
}
}
}
-
+
info.out = out;
info.level = msg->output_verbosity;
-
+
if (id)
{
if (child)
@@ -220,7 +220,7 @@ static void terminate(private_stroke_control_t *this, stroke_msg_t *msg, FILE *o
}
return;
}
-
+
ike_list = linked_list_create();
child_list = linked_list_create();
enumerator = charon->controller->create_ike_sa_enumerator(charon->controller);
@@ -228,7 +228,7 @@ static void terminate(private_stroke_control_t *this, stroke_msg_t *msg, FILE *o
{
child_sa_t *child_sa;
iterator_t *children;
-
+
if (child)
{
children = ike_sa->create_child_sa_iterator(ike_sa);
@@ -261,7 +261,7 @@ static void terminate(private_stroke_control_t *this, stroke_msg_t *msg, FILE *o
}
}
enumerator->destroy(enumerator);
-
+
enumerator = child_list->create_enumerator(child_list);
while (enumerator->enumerate(enumerator, &del))
{
@@ -269,7 +269,7 @@ static void terminate(private_stroke_control_t *this, stroke_msg_t *msg, FILE *o
(controller_cb_t)stroke_log, &info);
}
enumerator->destroy(enumerator);
-
+
enumerator = ike_list->create_enumerator(ike_list);
while (enumerator->enumerate(enumerator, &del))
{
@@ -277,7 +277,7 @@ static void terminate(private_stroke_control_t *this, stroke_msg_t *msg, FILE *o
(controller_cb_t)stroke_log, &info);
}
enumerator->destroy(enumerator);
-
+
if (child_list->get_count(child_list) == 0 &&
ike_list->get_count(ike_list) == 0)
{
@@ -298,7 +298,7 @@ static void terminate_srcip(private_stroke_control_t *this,
ike_sa_t *ike_sa;
host_t *start = NULL, *end = NULL, *vip;
chunk_t chunk_start, chunk_end = chunk_empty, chunk_vip;
-
+
if (msg->terminate_srcip.start)
{
start = host_create_from_string(msg->terminate_srcip.start, 0);
@@ -320,7 +320,7 @@ static void terminate_srcip(private_stroke_control_t *this,
}
chunk_end = end->get_address(end);
}
-
+
enumerator = charon->controller->create_ike_sa_enumerator(charon->controller);
while (enumerator->enumerate(enumerator, &ike_sa))
{
@@ -369,10 +369,10 @@ static void purge_ike(private_stroke_control_t *this, stroke_msg_t *msg, FILE *o
linked_list_t *list;
uintptr_t del;
stroke_log_info_t info;
-
+
info.out = out;
info.level = msg->output_verbosity;
-
+
list = linked_list_create();
enumerator = charon->controller->create_ike_sa_enumerator(charon->controller);
while (enumerator->enumerate(enumerator, &ike_sa))
@@ -386,7 +386,7 @@ static void purge_ike(private_stroke_control_t *this, stroke_msg_t *msg, FILE *o
iterator->destroy(iterator);
}
enumerator->destroy(enumerator);
-
+
enumerator = list->create_enumerator(list);
while (enumerator->enumerate(enumerator, &del))
{
@@ -404,7 +404,7 @@ static void route(private_stroke_control_t *this, stroke_msg_t *msg, FILE *out)
{
peer_cfg_t *peer_cfg;
child_cfg_t *child_cfg;
-
+
peer_cfg = charon->backends->get_peer_cfg_by_name(charon->backends,
msg->route.name);
if (peer_cfg == NULL)
@@ -417,7 +417,7 @@ static void route(private_stroke_control_t *this, stroke_msg_t *msg, FILE *out)
peer_cfg->destroy(peer_cfg);
return;
}
-
+
child_cfg = get_child_from_peer(peer_cfg, msg->route.name);
if (child_cfg == NULL)
{
@@ -425,7 +425,7 @@ static void route(private_stroke_control_t *this, stroke_msg_t *msg, FILE *out)
peer_cfg->destroy(peer_cfg);
return;
}
-
+
if (charon->traps->install(charon->traps, peer_cfg, child_cfg))
{
fprintf(out, "configuration '%s' routed\n", msg->route.name);
@@ -446,7 +446,7 @@ static void unroute(private_stroke_control_t *this, stroke_msg_t *msg, FILE *out
child_sa_t *child_sa;
enumerator_t *enumerator;
u_int32_t id;
-
+
enumerator = charon->traps->create_enumerator(charon->traps);
while (enumerator->enumerate(enumerator, NULL, &child_sa))
{
@@ -477,7 +477,7 @@ static void destroy(private_stroke_control_t *this)
stroke_control_t *stroke_control_create()
{
private_stroke_control_t *this = malloc_thing(private_stroke_control_t);
-
+
this->public.initiate = (void(*)(stroke_control_t*, stroke_msg_t *msg, FILE *out))initiate;
this->public.terminate = (void(*)(stroke_control_t*, stroke_msg_t *msg, FILE *out))terminate;
this->public.terminate_srcip = (void(*)(stroke_control_t*, stroke_msg_t *msg, FILE *out))terminate_srcip;
@@ -485,7 +485,7 @@ stroke_control_t *stroke_control_create()
this->public.route = (void(*)(stroke_control_t*, stroke_msg_t *msg, FILE *out))route;
this->public.unroute = (void(*)(stroke_control_t*, stroke_msg_t *msg, FILE *out))unroute;
this->public.destroy = (void(*)(stroke_control_t*))destroy;
-
+
return &this->public;
}
diff --git a/src/charon/plugins/stroke/stroke_control.h b/src/charon/plugins/stroke/stroke_control.h
index 5a61a90a4..9b49bdc31 100644
--- a/src/charon/plugins/stroke/stroke_control.h
+++ b/src/charon/plugins/stroke/stroke_control.h
@@ -38,42 +38,42 @@ struct stroke_control_t {
* @param msg stroke message
*/
void (*initiate)(stroke_control_t *this, stroke_msg_t *msg, FILE *out);
-
+
/**
* Terminate a connection.
*
* @param msg stroke message
*/
void (*terminate)(stroke_control_t *this, stroke_msg_t *msg, FILE *out);
-
+
/**
* Terminate a connection by peers virtual IP.
*
* @param msg stroke message
*/
void (*terminate_srcip)(stroke_control_t *this, stroke_msg_t *msg, FILE *out);
-
+
/**
* Delete IKE_SAs without a CHILD_SA.
*
* @param msg stroke message
*/
void (*purge_ike)(stroke_control_t *this, stroke_msg_t *msg, FILE *out);
-
+
/**
* Route a connection.
*
* @param msg stroke message
*/
void (*route)(stroke_control_t *this, stroke_msg_t *msg, FILE *out);
-
+
/**
* Unroute a connection.
*
* @param msg stroke message
*/
void (*unroute)(stroke_control_t *this, stroke_msg_t *msg, FILE *out);
-
+
/**
* Destroy a stroke_control instance.
*/
diff --git a/src/charon/plugins/stroke/stroke_cred.c b/src/charon/plugins/stroke/stroke_cred.c
index 31bcfe9f4..bc0b2f6fc 100644
--- a/src/charon/plugins/stroke/stroke_cred.c
+++ b/src/charon/plugins/stroke/stroke_cred.c
@@ -27,8 +27,7 @@
#include <credentials/certificates/ac.h>
#include <utils/linked_list.h>
#include <utils/lexparser.h>
-#include <utils/mutex.h>
-#include <asn1/pem.h>
+#include <threading/rwlock.h>
#include <daemon.h>
/* configuration directories and files */
@@ -56,7 +55,7 @@ struct private_stroke_cred_t {
* public functions
*/
stroke_cred_t public;
-
+
/**
* list of trusted peer/signer/CA certificates (certificate_t)
*/
@@ -71,12 +70,12 @@ struct private_stroke_cred_t {
* list of private keys (private_key_t)
*/
linked_list_t *private;
-
+
/**
* read-write lock to lists
*/
rwlock_t *lock;
-
+
/**
* cache CRLs to disk?
*/
@@ -89,6 +88,7 @@ struct private_stroke_cred_t {
typedef struct {
private_stroke_cred_t *this;
identification_t *id;
+ certificate_type_t type;
} id_data_t;
/**
@@ -106,25 +106,17 @@ static void id_data_destroy(id_data_t *data)
static bool private_filter(id_data_t *data,
private_key_t **in, private_key_t **out)
{
- identification_t *candidate;
- id_type_t type;
-
+ private_key_t *key;
+
+ key = *in;
if (data->id == NULL)
{
- *out = *in;
+ *out = key;
return TRUE;
}
- type = data->id->get_type(data->id);
- if (type == ID_KEY_ID)
- { /* handle ID_KEY_ID as a ID_PUBKEY_SHA1 */
- type = ID_PUBKEY_SHA1;
- }
- candidate = (*in)->get_id(*in, type);
- if (candidate &&
- chunk_equals(candidate->get_encoding(candidate),
- data->id->get_encoding(data->id)))
+ if (key->has_fingerprint(key, data->id->get_encoding(data->id)))
{
- *out = *in;
+ *out = key;
return TRUE;
}
return FALSE;
@@ -141,7 +133,7 @@ static enumerator_t* create_private_enumerator(private_stroke_cred_t *this,
data = malloc_thing(id_data_t);
data->this = this;
data->id = id;
-
+
this->lock->read_lock(this->lock);
return enumerator_create_filter(this->private->create_enumerator(this->private),
(void*)private_filter, data,
@@ -154,26 +146,22 @@ static enumerator_t* create_private_enumerator(private_stroke_cred_t *this,
static bool certs_filter(id_data_t *data, certificate_t **in, certificate_t **out)
{
public_key_t *public;
- identification_t *candidate;
certificate_t *cert = *in;
- certificate_type_t type = cert->get_type(cert);
- if (type == CERT_X509_CRL || type == CERT_X509_AC)
+ if (data->type != CERT_ANY && data->type != cert->get_type(cert))
{
return FALSE;
}
-
if (data->id == NULL || cert->has_subject(cert, data->id))
{
*out = *in;
return TRUE;
}
-
- public = (cert)->get_public_key(cert);
+
+ public = cert->get_public_key(cert);
if (public)
{
- candidate = public->get_id(public, data->id->get_type(data->id));
- if (candidate && data->id->equals(data->id, candidate))
+ if (public->has_fingerprint(public, data->id->get_encoding(data->id)))
{
public->destroy(public);
*out = *in;
@@ -185,46 +173,6 @@ static bool certs_filter(id_data_t *data, certificate_t **in, certificate_t **ou
}
/**
- * filter function for crl enumerator
- */
-static bool crl_filter(id_data_t *data, certificate_t **in, certificate_t **out)
-{
- certificate_t *cert = *in;
-
- if (cert->get_type(cert) != CERT_X509_CRL)
- {
- return FALSE;
- }
-
- if (data->id == NULL || cert->has_issuer(cert, data->id))
- {
- *out = *in;
- return TRUE;
- }
- return FALSE;
-}
-
-/**
- * filter function for attribute certificate enumerator
- */
-static bool ac_filter(id_data_t *data, certificate_t **in, certificate_t **out)
-{
- certificate_t *cert = *in;
-
- if (cert->get_type(cert) != CERT_X509_AC)
- {
- return FALSE;
- }
-
- if (data->id == NULL || cert->has_subject(cert, data->id))
- {
- *out = *in;
- return TRUE;
- }
- return FALSE;
-}
-
-/**
* Implements credential_set_t.create_cert_enumerator
*/
static enumerator_t* create_cert_enumerator(private_stroke_cred_t *this,
@@ -232,30 +180,16 @@ static enumerator_t* create_cert_enumerator(private_stroke_cred_t *this,
identification_t *id, bool trusted)
{
id_data_t *data;
-
- if (cert == CERT_X509_CRL || cert == CERT_X509_AC)
+
+ if (trusted && (cert == CERT_X509_CRL || cert == CERT_X509_AC))
{
- if (trusted)
- {
- return NULL;
- }
- data = malloc_thing(id_data_t);
- data->this = this;
- data->id = id;
-
- this->lock->read_lock(this->lock);
- return enumerator_create_filter(this->certs->create_enumerator(this->certs),
- (cert == CERT_X509_CRL)? (void*)crl_filter : (void*)ac_filter,
- data, (void*)id_data_destroy);
- }
- if (cert != CERT_X509 && cert != CERT_ANY)
- { /* we only have X509 certificates. TODO: ACs? */
return NULL;
}
data = malloc_thing(id_data_t);
data->this = this;
data->id = id;
-
+ data->type = cert;
+
this->lock->read_lock(this->lock);
return enumerator_create_filter(this->certs->create_enumerator(this->certs),
(void*)certs_filter, data,
@@ -286,7 +220,7 @@ static bool shared_filter(shared_data_t *data,
void **unused1, id_match_t *me,
void **unused2, id_match_t *other)
{
- id_match_t my_match, other_match;
+ id_match_t my_match = ID_MATCH_NONE, other_match = ID_MATCH_NONE;
stroke_shared_key_t *stroke = *in;
shared_key_t *shared = &stroke->shared;
@@ -294,10 +228,16 @@ static bool shared_filter(shared_data_t *data,
{
return FALSE;
}
-
- my_match = stroke->has_owner(stroke, data->me);
- other_match = stroke->has_owner(stroke, data->other);
- if (!my_match && !other_match)
+
+ if (data->me)
+ {
+ my_match = stroke->has_owner(stroke, data->me);
+ }
+ if (data->other)
+ {
+ other_match = stroke->has_owner(stroke, data->other);
+ }
+ if ((data->me || data->other) && (!my_match && !other_match))
{
return FALSE;
}
@@ -316,12 +256,12 @@ static bool shared_filter(shared_data_t *data,
/**
* Implements credential_set_t.create_shared_enumerator
*/
-static enumerator_t* create_shared_enumerator(private_stroke_cred_t *this,
+static enumerator_t* create_shared_enumerator(private_stroke_cred_t *this,
shared_key_type_t type, identification_t *me,
identification_t *other)
{
shared_data_t *data = malloc_thing(shared_data_t);
-
+
data->this = this;
data->me = me;
data->other = other;
@@ -339,7 +279,7 @@ static certificate_t* add_cert(private_stroke_cred_t *this, certificate_t *cert)
{
certificate_t *current;
enumerator_t *enumerator;
- bool new = TRUE;
+ bool new = TRUE;
this->lock->read_lock(this->lock);
enumerator = this->certs->create_enumerator(this->certs);
@@ -363,7 +303,7 @@ static certificate_t* add_cert(private_stroke_cred_t *this, certificate_t *cert)
this->lock->unlock(this->lock);
return cert;
}
-
+
/**
* Implementation of stroke_cred_t.load_ca.
*/
@@ -371,7 +311,7 @@ static certificate_t* load_ca(private_stroke_cred_t *this, char *filename)
{
certificate_t *cert;
char path[PATH_MAX];
-
+
if (*filename == '/')
{
snprintf(path, sizeof(path), "%s", filename);
@@ -380,7 +320,7 @@ static certificate_t* load_ca(private_stroke_cred_t *this, char *filename)
{
snprintf(path, sizeof(path), "%s/%s", CA_CERTIFICATE_DIR, filename);
}
-
+
cert = lib->creds->create(lib->creds,
CRED_CERTIFICATE, CERT_X509,
BUILD_FROM_FILE, path,
@@ -388,12 +328,12 @@ static certificate_t* load_ca(private_stroke_cred_t *this, char *filename)
if (cert)
{
x509_t *x509 = (x509_t*)cert;
-
+
if (!(x509->get_flags(x509) & X509_CA))
{
+ DBG1(DBG_CFG, " ca certificate \"%Y\" misses ca basic constraint, "
+ "discarded", cert->get_subject(cert));
cert->destroy(cert);
- DBG1(DBG_CFG, " ca certificate must have ca basic constraint set, "
- "discarded");
return NULL;
}
return (certificate_t*)add_cert(this, cert);
@@ -408,7 +348,7 @@ static bool add_crl(private_stroke_cred_t *this, crl_t* crl)
{
certificate_t *current, *cert = &crl->certificate;
enumerator_t *enumerator;
- bool new = TRUE, found = FALSE;
+ bool new = TRUE, found = FALSE;
this->lock->write_lock(this->lock);
enumerator = this->certs->create_enumerator(this->certs);
@@ -417,12 +357,11 @@ static bool add_crl(private_stroke_cred_t *this, crl_t* crl)
if (current->get_type(current) == CERT_X509_CRL)
{
crl_t *crl_c = (crl_t*)current;
- identification_t *authkey = crl->get_authKeyIdentifier(crl);
- identification_t *authkey_c = crl_c->get_authKeyIdentifier(crl_c);
+ chunk_t authkey = crl->get_authKeyIdentifier(crl);
+ chunk_t authkey_c = crl_c->get_authKeyIdentifier(crl_c);
/* if compare authorityKeyIdentifiers if available */
- if (authkey != NULL && authkey_c != NULL &&
- authkey->equals(authkey, authkey_c))
+ if (authkey.ptr && authkey_c.ptr && chunk_equals(authkey, authkey_c))
{
found = TRUE;
}
@@ -491,17 +430,19 @@ static certificate_t* load_peer(private_stroke_cred_t *this, char *filename)
{
snprintf(path, sizeof(path), "%s/%s", CERTIFICATE_DIR, filename);
}
-
+
cert = lib->creds->create(lib->creds,
- CRED_CERTIFICATE, CERT_X509,
+ CRED_CERTIFICATE, CERT_ANY,
BUILD_FROM_FILE, path,
- BUILD_X509_FLAG, 0,
BUILD_END);
if (cert)
{
cert = add_cert(this, cert);
+ DBG1(DBG_CFG, " loaded certificate \"%Y\" from '%s'",
+ cert->get_subject(cert), filename);
return cert->get_ref(cert);
}
+ DBG1(DBG_CFG, " loading certificate from '%s' failed", filename);
return NULL;
}
@@ -513,7 +454,7 @@ static void load_certdir(private_stroke_cred_t *this, char *path,
{
struct stat st;
char *file;
-
+
enumerator_t *enumerator = enumerator_create_directory(path);
if (!enumerator)
@@ -535,22 +476,33 @@ static void load_certdir(private_stroke_cred_t *this, char *path,
{
case CERT_X509:
if (flag & X509_CA)
- { /* for CA certificates, we strictly require CA
- * basicconstraints to be set */
+ { /* for CA certificates, we strictly require
+ * the CA basic constraint to be set */
cert = lib->creds->create(lib->creds,
CRED_CERTIFICATE, CERT_X509,
BUILD_FROM_FILE, file, BUILD_END);
if (cert)
{
x509_t *x509 = (x509_t*)cert;
-
+
if (!(x509->get_flags(x509) & X509_CA))
{
- DBG1(DBG_CFG, " ca certificate must have ca "
- "basic constraint set, discarded");
+ DBG1(DBG_CFG, " ca certificate \"%Y\" lacks "
+ "ca basic constraint, discarded",
+ cert->get_subject(cert));
cert->destroy(cert);
cert = NULL;
}
+ else
+ {
+ DBG1(DBG_CFG, " loaded ca certificate \"%Y\" from '%s'",
+ cert->get_subject(cert), file);
+ }
+ }
+ else
+ {
+ DBG1(DBG_CFG, " loading ca certificate from '%s' "
+ "failed", file);
}
}
else
@@ -559,6 +511,16 @@ static void load_certdir(private_stroke_cred_t *this, char *path,
CRED_CERTIFICATE, CERT_X509,
BUILD_FROM_FILE, file,
BUILD_X509_FLAG, flag, BUILD_END);
+ if (cert)
+ {
+ DBG1(DBG_CFG, " loaded certificate \"%Y\" from '%s'",
+ cert->get_subject(cert), file);
+ }
+ else
+ {
+ DBG1(DBG_CFG, " loading certificate from '%s' "
+ "failed", file);
+ }
}
if (cert)
{
@@ -573,6 +535,11 @@ static void load_certdir(private_stroke_cred_t *this, char *path,
if (cert)
{
add_crl(this, (crl_t*)cert);
+ DBG1(DBG_CFG, " loaded crl from '%s'", file);
+ }
+ else
+ {
+ DBG1(DBG_CFG, " loading crl from '%s' failed", file);
}
break;
case CERT_X509_AC:
@@ -583,10 +550,17 @@ static void load_certdir(private_stroke_cred_t *this, char *path,
if (cert)
{
add_ac(this, (ac_t*)cert);
+ DBG1(DBG_CFG, " loaded attribute certificate from '%s'",
+ file);
+ }
+ else
+ {
+ DBG1(DBG_CFG, " loading attribute certificate from '%s' "
+ "failed", file);
}
break;
default:
- break;
+ break;
}
}
enumerator->destroy(enumerator);
@@ -601,20 +575,18 @@ static void cache_cert(private_stroke_cred_t *this, certificate_t *cert)
{
/* CRLs get written to /etc/ipsec.d/crls/<authkeyId>.crl */
crl_t *crl = (crl_t*)cert;
-
+
cert->get_ref(cert);
if (add_crl(this, crl))
{
char buf[BUF_LEN];
chunk_t chunk, hex;
- identification_t *id;
-
- id = crl->get_authKeyIdentifier(crl);
- chunk = id->get_encoding(id);
+
+ chunk = crl->get_authKeyIdentifier(crl);
hex = chunk_to_hex(chunk, NULL, FALSE);
snprintf(buf, sizeof(buf), "%s/%s.crl", CRL_DIR, hex);
free(hex.ptr);
-
+
chunk = cert->get_encoding(cert);
chunk_write(chunk, buf, "crl", 022, TRUE);
free(chunk.ptr);
@@ -669,7 +641,7 @@ static err_t extract_secret(chunk_t *secret, chunk_t *line)
}
if (quotes)
- {
+ {
/* treat as an ASCII string */
*secret = chunk_clone(raw_secret);
return NULL;
@@ -693,9 +665,54 @@ static err_t extract_secret(chunk_t *secret, chunk_t *line)
}
/**
+ * Data to pass to passphrase_cb
+ */
+typedef struct {
+ /** socket we use for prompting */
+ FILE *prompt;
+ /** private key file */
+ char *file;
+ /** buffer for passphrase */
+ char buf[256];
+} passphrase_cb_data_t;
+
+/**
+ * Passphrase callback to read from whack fd
+ */
+chunk_t passphrase_cb(passphrase_cb_data_t *data, int try)
+{
+ chunk_t secret = chunk_empty;;
+
+ if (try > 5)
+ {
+ fprintf(data->prompt, "invalid passphrase, too many trials\n");
+ return chunk_empty;
+ }
+ if (try == 1)
+ {
+ fprintf(data->prompt, "Private key '%s' is encrypted\n", data->file);
+ }
+ else
+ {
+ fprintf(data->prompt, "invalid passphrase\n");
+ }
+ fprintf(data->prompt, "Passphrase:\n");
+ if (fgets(data->buf, sizeof(data->buf), data->prompt))
+ {
+ secret = chunk_create(data->buf, strlen(data->buf));
+ if (secret.len)
+ { /* trim appended \n */
+ secret.len--;
+ }
+ }
+ return secret;
+}
+
+/**
* reload ipsec.secrets
*/
-static void load_secrets(private_stroke_cred_t *this, char *file, int level)
+static void load_secrets(private_stroke_cred_t *this, char *file, int level,
+ FILE *prompt)
{
size_t bytes;
int line_nr = 0;
@@ -709,7 +726,7 @@ static void load_secrets(private_stroke_cred_t *this, char *file, int level)
fd = fopen(file, "r");
if (fd == NULL)
{
- DBG1(DBG_CFG, "opening secrets file '%s' failed");
+ DBG1(DBG_CFG, "opening secrets file '%s' failed", file);
return;
}
@@ -722,9 +739,10 @@ static void load_secrets(private_stroke_cred_t *this, char *file, int level)
fclose(fd);
src = chunk;
- this->lock->write_lock(this->lock);
if (level == 0)
{
+ this->lock->write_lock(this->lock);
+
/* flush secrets on non-recursive invocation */
while (this->shared->remove_last(this->shared,
(void**)&shared) == SUCCESS)
@@ -737,7 +755,7 @@ static void load_secrets(private_stroke_cred_t *this, char *file, int level)
private->destroy(private);
}
}
-
+
while (fetchline(&src, &line))
{
chunk_t ids, token;
@@ -755,7 +773,7 @@ static void load_secrets(private_stroke_cred_t *this, char *file, int level)
glob_t buf;
char **expanded, *dir, pattern[PATH_MAX];
u_char *pos;
-
+
if (level > MAX_SECRETS_RECURSION)
{
DBG1(DBG_CFG, "maximum level of %d includes reached, ignored",
@@ -782,7 +800,7 @@ static void load_secrets(private_stroke_cred_t *this, char *file, int level)
{ /* use directory of current file if relative */
dir = strdup(file);
dir = dirname(dir);
-
+
if (line.len + 1 + strlen(dir) + 1 > sizeof(pattern))
{
DBG1(DBG_CFG, "include pattern too long, ignored");
@@ -802,13 +820,13 @@ static void load_secrets(private_stroke_cred_t *this, char *file, int level)
{
for (expanded = buf.gl_pathv; *expanded != NULL; expanded++)
{
- load_secrets(this, *expanded, level + 1);
+ load_secrets(this, *expanded, level + 1, prompt);
}
}
globfree(&buf);
continue;
}
-
+
if (line.len > 2 && strneq(": ", line.ptr, 2))
{
/* no ids, skip the ':' */
@@ -837,9 +855,7 @@ static void load_secrets(private_stroke_cred_t *this, char *file, int level)
char path[PATH_MAX];
chunk_t filename;
chunk_t secret = chunk_empty;
- private_key_t *key;
- bool pgp = FALSE;
- chunk_t chunk = chunk_empty;
+ private_key_t *key = NULL;
key_type_t key_type = match("RSA", &token) ? KEY_RSA : KEY_ECDSA;
err_t ugh = extract_value(&filename, &line);
@@ -862,7 +878,7 @@ static void load_secrets(private_stroke_cred_t *this, char *file, int level)
else
{
/* relative path name */
- snprintf(path, sizeof(path), "%s/%.*s", PRIVATE_KEY_DIR,
+ snprintf(path, sizeof(path), "%s/%.*s", PRIVATE_KEY_DIR,
filename.len, filename.ptr);
}
@@ -876,18 +892,36 @@ static void load_secrets(private_stroke_cred_t *this, char *file, int level)
goto error;
}
}
-
- if (pem_asn1_load_file(path, &secret, &chunk, &pgp))
+ if (secret.len == 7 && strneq(secret.ptr, "%prompt", 7))
{
- key = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, key_type,
- BUILD_BLOB_ASN1_DER, chunk, BUILD_END);
- free(chunk.ptr);
- if (key)
+ if (prompt)
{
- DBG1(DBG_CFG, " loaded private key file '%s'", path);
- this->private->insert_last(this->private, key);
+ passphrase_cb_data_t data;
+
+ data.prompt = prompt;
+ data.file = path;
+ key = lib->creds->create(lib->creds, CRED_PRIVATE_KEY,
+ key_type, BUILD_FROM_FILE, path,
+ BUILD_PASSPHRASE_CALLBACK,
+ passphrase_cb, &data, BUILD_END);
}
}
+ else
+ {
+ key = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, key_type,
+ BUILD_FROM_FILE, path,
+ BUILD_PASSPHRASE, secret, BUILD_END);
+ }
+ if (key)
+ {
+ DBG1(DBG_CFG, " loaded %N private key from '%s'",
+ key_type_names, key->get_type(key), path);
+ this->private->insert_last(this->private, key);
+ }
+ else
+ {
+ DBG1(DBG_CFG, " loading private key from '%s' failed", path);
+ }
chunk_clear(&secret);
}
else if (match("PIN", &token))
@@ -896,9 +930,9 @@ static void load_secrets(private_stroke_cred_t *this, char *file, int level)
char smartcard[32], keyid[22], pin[32];
private_key_t *key;
u_int slot;
-
+
err_t ugh = extract_value(&sc, &line);
-
+
if (ugh != NULL)
{
DBG1(DBG_CFG, "line %d: %s", line_nr, ugh);
@@ -911,7 +945,7 @@ static void load_secrets(private_stroke_cred_t *this, char *file, int level)
}
snprintf(smartcard, sizeof(smartcard), "%.*s", sc.len, sc.ptr);
smartcard[sizeof(smartcard) - 1] = '\0';
-
+
/* parse slot and key id. only two formats are supported.
* first try %smartcard<slot>:<keyid> */
if (sscanf(smartcard, "%%smartcard%u:%s", &slot, keyid) == 2)
@@ -929,7 +963,7 @@ static void load_secrets(private_stroke_cred_t *this, char *file, int level)
" supported or invalid", line_nr);
goto error;
}
-
+
if (!eat_whitespace(&line))
{
DBG1(DBG_CFG, "line %d: expected PIN", line_nr);
@@ -943,12 +977,12 @@ static void load_secrets(private_stroke_cred_t *this, char *file, int level)
}
snprintf(pin, sizeof(pin), "%.*s", secret.len, secret.ptr);
pin[sizeof(pin) - 1] = '\0';
-
+
/* we assume an RSA key */
key = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, KEY_RSA,
BUILD_SMARTCARD_KEYID, smartcard,
BUILD_SMARTCARD_PIN, pin, BUILD_END);
-
+
if (key)
{
DBG1(DBG_CFG, " loaded private key from %.*s", sc.len, sc.ptr);
@@ -975,7 +1009,7 @@ static void load_secrets(private_stroke_cred_t *this, char *file, int level)
DBG1(DBG_CFG, " loaded %N secret for %s", shared_key_type_names, type,
ids.len > 0 ? (char*)ids.ptr : "%any");
DBG4(DBG_CFG, " secret: %#B", &secret);
-
+
this->shared->insert_last(this->shared, shared_key);
while (ids.len > 0)
{
@@ -992,7 +1026,7 @@ static void load_secrets(private_stroke_cred_t *this, char *file, int level)
{
continue;
}
-
+
/* NULL terminate the ID string */
*(id.ptr + id.len) = '\0';
peer_id = identification_create_from_string(id.ptr);
@@ -1001,7 +1035,7 @@ static void load_secrets(private_stroke_cred_t *this, char *file, int level)
peer_id->destroy(peer_id);
continue;
}
-
+
shared_key->add_owner(shared_key, peer_id);
any = FALSE;
}
@@ -1019,7 +1053,10 @@ static void load_secrets(private_stroke_cred_t *this, char *file, int level)
}
}
error:
- this->lock->unlock(this->lock);
+ if (level == 0)
+ {
+ this->lock->unlock(this->lock);
+ }
chunk_clear(&chunk);
}
@@ -1052,12 +1089,12 @@ static void load_certs(private_stroke_cred_t *this)
/**
* Implementation of stroke_cred_t.reread.
*/
-static void reread(private_stroke_cred_t *this, stroke_msg_t *msg)
+static void reread(private_stroke_cred_t *this, stroke_msg_t *msg, FILE *prompt)
{
if (msg->reread.flags & REREAD_SECRETS)
{
DBG1(DBG_CFG, "rereading secrets");
- load_secrets(this, SECRETS_FILE, 0);
+ load_secrets(this, SECRETS_FILE, 0, prompt);
}
if (msg->reread.flags & REREAD_CACERTS)
{
@@ -1110,28 +1147,28 @@ static void destroy(private_stroke_cred_t *this)
stroke_cred_t *stroke_cred_create()
{
private_stroke_cred_t *this = malloc_thing(private_stroke_cred_t);
-
+
this->public.set.create_private_enumerator = (void*)create_private_enumerator;
this->public.set.create_cert_enumerator = (void*)create_cert_enumerator;
this->public.set.create_shared_enumerator = (void*)create_shared_enumerator;
this->public.set.create_cdp_enumerator = (void*)return_null;
this->public.set.cache_cert = (void*)cache_cert;
- this->public.reread = (void(*)(stroke_cred_t*, stroke_msg_t *msg))reread;
+ this->public.reread = (void(*)(stroke_cred_t*, stroke_msg_t *msg, FILE*))reread;
this->public.load_ca = (certificate_t*(*)(stroke_cred_t*, char *filename))load_ca;
this->public.load_peer = (certificate_t*(*)(stroke_cred_t*, char *filename))load_peer;
this->public.cachecrl = (void(*)(stroke_cred_t*, bool enabled))cachecrl;
this->public.destroy = (void(*)(stroke_cred_t*))destroy;
-
+
this->certs = linked_list_create();
this->shared = linked_list_create();
this->private = linked_list_create();
this->lock = rwlock_create(RWLOCK_TYPE_DEFAULT);
load_certs(this);
- load_secrets(this, SECRETS_FILE, 0);
-
+ load_secrets(this, SECRETS_FILE, 0, NULL);
+
this->cachecrl = FALSE;
-
+
return &this->public;
}
diff --git a/src/charon/plugins/stroke/stroke_cred.h b/src/charon/plugins/stroke/stroke_cred.h
index 8bc042f13..ccee7d87c 100644
--- a/src/charon/plugins/stroke/stroke_cred.h
+++ b/src/charon/plugins/stroke/stroke_cred.h
@@ -21,6 +21,8 @@
#ifndef STROKE_CRED_H_
#define STROKE_CRED_H_
+#include <stdio.h>
+
#include <stroke_msg.h>
#include <credentials/credential_set.h>
#include <credentials/certificates/certificate.h>
@@ -36,14 +38,15 @@ struct stroke_cred_t {
* Implements credential_set_t
*/
credential_set_t set;
-
+
/**
* Reread secrets from config files.
*
* @param msg stroke message
+ * @param prompt I/O channel to prompt for private key passhprase
*/
- void (*reread)(stroke_cred_t *this, stroke_msg_t *msg);
-
+ void (*reread)(stroke_cred_t *this, stroke_msg_t *msg, FILE *prompt);
+
/**
* Load a CA certificate, and serve it through the credential_set.
*
@@ -51,7 +54,7 @@ struct stroke_cred_t {
* @return reference to loaded certificate, or NULL
*/
certificate_t* (*load_ca)(stroke_cred_t *this, char *filename);
-
+
/**
* Load a peer certificate and serve it rhrough the credential_set.
*
@@ -59,18 +62,18 @@ struct stroke_cred_t {
* @return reference to loaded certificate, or NULL
*/
certificate_t* (*load_peer)(stroke_cred_t *this, char *filename);
-
+
/**
* Enable/Disable CRL caching to disk.
*
* @param enabled TRUE to enable, FALSE to disable
*/
void (*cachecrl)(stroke_cred_t *this, bool enabled);
-
+
/**
- * Destroy a stroke_cred instance.
- */
- void (*destroy)(stroke_cred_t *this);
+ * Destroy a stroke_cred instance.
+ */
+ void (*destroy)(stroke_cred_t *this);
};
/**
diff --git a/src/charon/plugins/stroke/stroke_list.c b/src/charon/plugins/stroke/stroke_list.c
index 6f421bd30..c2a98da33 100644
--- a/src/charon/plugins/stroke/stroke_list.c
+++ b/src/charon/plugins/stroke/stroke_list.c
@@ -22,6 +22,8 @@
#include <credentials/certificates/x509.h>
#include <credentials/certificates/ac.h>
#include <credentials/certificates/crl.h>
+#include <credentials/certificates/pgp_certificate.h>
+#include <credentials/ietf_attributes/ietf_attributes.h>
#include <config/peer_cfg.h>
/* warning intervals for list functions */
@@ -40,12 +42,12 @@ struct private_stroke_list_t {
* public functions
*/
stroke_list_t public;
-
+
/**
* timestamp of daemon start
*/
time_t uptime;
-
+
/**
* strokes attribute provider
*/
@@ -58,45 +60,45 @@ struct private_stroke_list_t {
static void log_ike_sa(FILE *out, ike_sa_t *ike_sa, bool all)
{
ike_sa_id_t *id = ike_sa->get_id(ike_sa);
- time_t now = time(NULL);
-
+ time_t now = time_monotonic(NULL);
+
fprintf(out, "%12s[%d]: %N",
ike_sa->get_name(ike_sa), ike_sa->get_unique_id(ike_sa),
ike_sa_state_names, ike_sa->get_state(ike_sa));
-
+
if (ike_sa->get_state(ike_sa) == IKE_ESTABLISHED)
{
time_t established;
-
+
established = ike_sa->get_statistic(ike_sa, STAT_ESTABLISHED);
fprintf(out, " %V ago", &now, &established);
}
-
+
fprintf(out, ", %H[%Y]...%H[%Y]\n",
ike_sa->get_my_host(ike_sa), ike_sa->get_my_id(ike_sa),
ike_sa->get_other_host(ike_sa), ike_sa->get_other_id(ike_sa));
-
+
if (all)
{
proposal_t *ike_proposal;
-
+
ike_proposal = ike_sa->get_proposal(ike_sa);
-
+
fprintf(out, "%12s[%d]: IKE SPIs: %.16llx_i%s %.16llx_r%s",
ike_sa->get_name(ike_sa), ike_sa->get_unique_id(ike_sa),
id->get_initiator_spi(id), id->is_initiator(id) ? "*" : "",
id->get_responder_spi(id), id->is_initiator(id) ? "" : "*");
-
-
+
+
if (ike_sa->get_state(ike_sa) == IKE_ESTABLISHED)
{
time_t rekey, reauth;
peer_cfg_t *peer_cfg;
-
+
rekey = ike_sa->get_statistic(ike_sa, STAT_REKEY);
reauth = ike_sa->get_statistic(ike_sa, STAT_REAUTH);
peer_cfg = ike_sa->get_peer_cfg(ike_sa);
-
+
if (rekey)
{
fprintf(out, ", rekeying in %V", &rekey, &now);
@@ -106,7 +108,7 @@ static void log_ike_sa(FILE *out, ike_sa_t *ike_sa, bool all)
bool first = TRUE;
enumerator_t *enumerator;
auth_cfg_t *auth;
-
+
fprintf(out, ", ");
enumerator = peer_cfg->create_auth_cfg_enumerator(peer_cfg, TRUE);
while (enumerator->enumerate(enumerator, &auth))
@@ -128,11 +130,11 @@ static void log_ike_sa(FILE *out, ike_sa_t *ike_sa, bool all)
}
}
fprintf(out, "\n");
-
+
if (ike_proposal)
{
char buf[BUF_LEN];
-
+
snprintf(buf, BUF_LEN, "%P", ike_proposal);
fprintf(out, "%12s[%d]: IKE proposal: %s\n",
ike_sa->get_name(ike_sa), ike_sa->get_unique_id(ike_sa),
@@ -146,17 +148,18 @@ static void log_ike_sa(FILE *out, ike_sa_t *ike_sa, bool all)
*/
static void log_child_sa(FILE *out, child_sa_t *child_sa, bool all)
{
- time_t use_in, use_out, rekey, now = time(NULL);
+ time_t use_in, use_out, rekey, now;
u_int64_t bytes_in, bytes_out;
proposal_t *proposal;
child_cfg_t *config = child_sa->get_config(child_sa);
-
- fprintf(out, "%12s{%d}: %N, %N%s",
+
+
+ fprintf(out, "%12s{%d}: %N, %N%s",
child_sa->get_name(child_sa), child_sa->get_reqid(child_sa),
child_sa_state_names, child_sa->get_state(child_sa),
ipsec_mode_names, child_sa->get_mode(child_sa),
config->use_proxy_mode(config) ? "_PROXY" : "");
-
+
if (child_sa->get_state(child_sa) == CHILD_INSTALLED)
{
fprintf(out, ", %N%s SPIs: %.8x_i %.8x_o",
@@ -164,30 +167,30 @@ static void log_child_sa(FILE *out, child_sa_t *child_sa, bool all)
child_sa->has_encap(child_sa) ? " in UDP" : "",
ntohl(child_sa->get_spi(child_sa, TRUE)),
ntohl(child_sa->get_spi(child_sa, FALSE)));
-
+
if (child_sa->get_ipcomp(child_sa) != IPCOMP_NONE)
{
fprintf(out, ", IPCOMP CPIs: %.4x_i %.4x_o",
ntohs(child_sa->get_cpi(child_sa, TRUE)),
ntohs(child_sa->get_cpi(child_sa, FALSE)));
}
-
+
if (all)
{
- fprintf(out, "\n%12s{%d}: ", child_sa->get_name(child_sa),
+ fprintf(out, "\n%12s{%d}: ", child_sa->get_name(child_sa),
child_sa->get_reqid(child_sa));
-
+
proposal = child_sa->get_proposal(child_sa);
if (proposal)
{
u_int16_t encr_alg = ENCR_UNDEFINED, int_alg = AUTH_UNDEFINED;
u_int16_t encr_size = 0, int_size = 0;
-
+
proposal->get_algorithm(proposal, ENCRYPTION_ALGORITHM,
&encr_alg, &encr_size);
proposal->get_algorithm(proposal, INTEGRITY_ALGORITHM,
&int_alg, &int_size);
-
+
if (encr_alg != ENCR_UNDEFINED)
{
fprintf(out, "%N", encryption_algorithm_names, encr_alg);
@@ -206,6 +209,7 @@ static void log_child_sa(FILE *out, child_sa_t *child_sa, bool all)
}
}
+ now = time_monotonic(NULL);
child_sa->get_usestats(child_sa, TRUE, &use_in, &bytes_in);
fprintf(out, ", %llu bytes_i", bytes_in);
if (use_in)
@@ -220,7 +224,7 @@ static void log_child_sa(FILE *out, child_sa_t *child_sa, bool all)
fprintf(out, " (%ds ago)", now - use_out);
}
fprintf(out, ", rekeying ");
-
+
rekey = child_sa->get_lifetime(child_sa, FALSE);
if (rekey)
{
@@ -237,10 +241,10 @@ static void log_child_sa(FILE *out, child_sa_t *child_sa, bool all)
{
fprintf(out, "disabled");
}
-
+
}
}
-
+
fprintf(out, "\n%12s{%d}: %#R=== %#R\n",
child_sa->get_name(child_sa), child_sa->get_reqid(child_sa),
child_sa->get_traffic_selectors(child_sa, TRUE),
@@ -260,9 +264,9 @@ static void log_auth_cfgs(FILE *out, peer_cfg_t *peer_cfg, bool local)
certificate_t *cert;
cert_validation_t valid;
char *name;
-
+
name = peer_cfg->get_name(peer_cfg);
-
+
enumerator = peer_cfg->create_auth_cfg_enumerator(peer_cfg, local);
while (enumerator->enumerate(enumerator, &auth))
{
@@ -327,7 +331,7 @@ static void log_auth_cfgs(FILE *out, peer_cfg_t *peer_cfg, bool local)
fprintf(out, "%12s: ocsp: status must be GOOD%s\n", name,
(valid == VALIDATION_SKIPPED) ? " or SKIPPED" : "");
}
-
+
valid = (uintptr_t)auth->get(auth, AUTH_RULE_CRL_VALIDATION);
if (valid != VALIDATION_FAILED)
{
@@ -360,18 +364,21 @@ static void status(private_stroke_list_t *this, stroke_msg_t *msg, FILE *out, bo
ike_sa_t *ike_sa;
bool first, found = FALSE;
char *name = msg->status.name;
-
+
if (all)
{
peer_cfg_t *peer_cfg;
char *plugin, *pool;
host_t *host;
u_int32_t dpd;
- time_t now = time(NULL);
+ time_t since, now;
u_int size, online, offline;
-
+
+ now = time_monotonic(NULL);
+ since = time(NULL) - (now - this->uptime);
+
fprintf(out, "Status of IKEv2 charon daemon (strongSwan "VERSION"):\n");
- fprintf(out, " uptime: %V, since %T\n", &now, &this->uptime, &this->uptime, FALSE);
+ fprintf(out, " uptime: %V, since %T\n", &now, &this->uptime, &since, FALSE);
fprintf(out, " worker threads: %d idle of %d,",
charon->processor->get_idle_threads(charon->processor),
charon->processor->get_total_threads(charon->processor));
@@ -387,7 +394,7 @@ static void status(private_stroke_list_t *this, stroke_msg_t *msg, FILE *out, bo
}
enumerator->destroy(enumerator);
fprintf(out, "\n");
-
+
first = TRUE;
enumerator = this->attribute->create_pool_enumerator(this->attribute);
while (enumerator->enumerate(enumerator, &pool, &size, &online, &offline))
@@ -404,7 +411,7 @@ static void status(private_stroke_list_t *this, stroke_msg_t *msg, FILE *out, bo
fprintf(out, " %s: %u/%u/%u\n", pool, size, online, offline);
}
enumerator->destroy(enumerator);
-
+
enumerator = charon->kernel_interface->create_address_enumerator(
charon->kernel_interface, FALSE, FALSE);
fprintf(out, "Listening IP addresses:\n");
@@ -413,7 +420,7 @@ static void status(private_stroke_list_t *this, stroke_msg_t *msg, FILE *out, bo
fprintf(out, " %H\n", host);
}
enumerator->destroy(enumerator);
-
+
fprintf(out, "Connections:\n");
enumerator = charon->backends->create_peer_cfg_enumerator(
charon->backends, NULL, NULL, NULL, NULL);
@@ -424,33 +431,33 @@ static void status(private_stroke_list_t *this, stroke_msg_t *msg, FILE *out, bo
{
continue;
}
-
+
ike_cfg = peer_cfg->get_ike_cfg(peer_cfg);
fprintf(out, "%12s: %s...%s", peer_cfg->get_name(peer_cfg),
ike_cfg->get_my_addr(ike_cfg), ike_cfg->get_other_addr(ike_cfg));
-
+
dpd = peer_cfg->get_dpd(peer_cfg);
if (dpd)
{
fprintf(out, ", dpddelay=%us", dpd);
}
fprintf(out, "\n");
-
+
log_auth_cfgs(out, peer_cfg, TRUE);
log_auth_cfgs(out, peer_cfg, FALSE);
-
+
children = peer_cfg->create_child_cfg_enumerator(peer_cfg);
while (children->enumerate(children, &child_cfg))
{
linked_list_t *my_ts, *other_ts;
-
+
my_ts = child_cfg->get_traffic_selectors(child_cfg, TRUE, NULL, NULL);
other_ts = child_cfg->get_traffic_selectors(child_cfg, FALSE, NULL, NULL);
fprintf(out, "%12s: child: %#R=== %#R", child_cfg->get_name(child_cfg),
my_ts, other_ts);
my_ts->destroy_offset(my_ts, offsetof(traffic_selector_t, destroy));
other_ts->destroy_offset(other_ts, offsetof(traffic_selector_t, destroy));
-
+
if (dpd)
{
fprintf(out, ", dpdaction=%N", action_names,
@@ -463,7 +470,7 @@ static void status(private_stroke_list_t *this, stroke_msg_t *msg, FILE *out, bo
enumerator->destroy(enumerator);
}
- first = TRUE;
+ first = TRUE;
enumerator = charon->traps->create_enumerator(charon->traps);
while (enumerator->enumerate(enumerator, NULL, &child_sa))
{
@@ -475,14 +482,14 @@ static void status(private_stroke_list_t *this, stroke_msg_t *msg, FILE *out, bo
log_child_sa(out, child_sa, all);
}
enumerator->destroy(enumerator);
-
+
fprintf(out, "Security Associations:\n");
enumerator = charon->controller->create_ike_sa_enumerator(charon->controller);
while (enumerator->enumerate(enumerator, &ike_sa))
{
bool ike_printed = FALSE;
iterator_t *children = ike_sa->create_child_sa_iterator(ike_sa);
-
+
if (name == NULL || streq(name, ike_sa->get_name(ike_sa)))
{
log_ike_sa(out, ike_sa, all);
@@ -501,12 +508,12 @@ static void status(private_stroke_list_t *this, stroke_msg_t *msg, FILE *out, bo
ike_printed = TRUE;
}
log_child_sa(out, child_sa, all);
- }
+ }
}
children->destroy(children);
}
enumerator->destroy(enumerator);
-
+
if (!found)
{
if (name)
@@ -531,14 +538,14 @@ static linked_list_t* create_unique_cert_list(certificate_type_t type)
charon->credentials, type, KEY_ANY,
NULL, FALSE);
certificate_t *cert;
-
+
while (enumerator->enumerate(enumerator, (void**)&cert))
{
iterator_t *iterator = list->create_iterator(list, TRUE);
identification_t *issuer = cert->get_issuer(cert);
bool previous_same, same = FALSE, last = TRUE;
certificate_t *list_cert;
-
+
while (iterator->iterate(iterator, (void**)&list_cert))
{
/* exit if we have a duplicate? */
@@ -569,6 +576,41 @@ static linked_list_t* create_unique_cert_list(certificate_type_t type)
}
/**
+ * Print a single public key.
+ */
+static void list_public_key(public_key_t *public, FILE *out)
+{
+ private_key_t *private = NULL;
+ chunk_t keyid;
+ identification_t *id;
+ auth_cfg_t *auth;
+
+ if (public->get_fingerprint(public, KEY_ID_PUBKEY_SHA1, &keyid))
+ {
+ id = identification_create_from_encoding(ID_KEY_ID, keyid);
+ auth = auth_cfg_create();
+ private = charon->credentials->get_private(charon->credentials,
+ public->get_type(public), id, auth);
+ auth->destroy(auth);
+ id->destroy(id);
+ }
+
+ fprintf(out, " pubkey: %N %d bits%s\n",
+ key_type_names, public->get_type(public),
+ public->get_keysize(public) * 8,
+ private ? ", has private key" : "");
+ if (public->get_fingerprint(public, KEY_ID_PUBKEY_INFO_SHA1, &keyid))
+ {
+ fprintf(out, " keyid: %#B\n", &keyid);
+ }
+ if (public->get_fingerprint(public, KEY_ID_PUBKEY_SHA1, &keyid))
+ {
+ fprintf(out, " subjkey: %#B\n", &keyid);
+ }
+ DESTROY_IF(private);
+}
+
+/**
* list all raw public keys
*/
static void stroke_list_pubkeys(linked_list_t *list, bool utc, FILE *out)
@@ -584,9 +626,6 @@ static void stroke_list_pubkeys(linked_list_t *list, bool utc, FILE *out)
if (public)
{
- private_key_t *private = NULL;
- identification_t *id, *keyid;
-
if (first)
{
fprintf(out, "\n");
@@ -595,20 +634,52 @@ static void stroke_list_pubkeys(linked_list_t *list, bool utc, FILE *out)
}
fprintf(out, "\n");
- /* list public key information */
- id = public->get_id(public, ID_PUBKEY_SHA1);
- keyid = public->get_id(public, ID_PUBKEY_INFO_SHA1);
-
- private = charon->credentials->get_private(
- charon->credentials,
- public->get_type(public), keyid, NULL);
- fprintf(out, " pubkey: %N %d bits%s\n",
- key_type_names, public->get_type(public),
- public->get_keysize(public) * 8,
- private ? ", has private key" : "");
- fprintf(out, " keyid: %Y\n", keyid);
- fprintf(out, " subjkey: %Y\n", id);
- DESTROY_IF(private);
+ list_public_key(public, out);
+ public->destroy(public);
+ }
+ }
+ enumerator->destroy(enumerator);
+}
+
+/**
+ * list OpenPGP certificates
+ */
+static void stroke_list_pgp(linked_list_t *list,bool utc, FILE *out)
+{
+ bool first = TRUE;
+ time_t now = time(NULL);
+ enumerator_t *enumerator = list->create_enumerator(list);
+ certificate_t *cert;
+
+ while (enumerator->enumerate(enumerator, (void**)&cert))
+ {
+ time_t created, until;
+ public_key_t *public;
+ pgp_certificate_t *pgp_cert = (pgp_certificate_t*)cert;
+ chunk_t fingerprint = pgp_cert->get_fingerprint(pgp_cert);
+
+ if (first)
+ {
+
+ fprintf(out, "\n");
+ fprintf(out, "List of PGP End Entity Certificates:\n");
+ first = FALSE;
+ }
+ fprintf(out, "\n");
+ fprintf(out, " userid: '%Y'\n", cert->get_subject(cert));
+
+ fprintf(out, " digest: %#B\n", &fingerprint);
+
+ /* list validity */
+ cert->get_validity(cert, &now, &created, &until);
+ fprintf(out, " created: %T\n", &created, utc);
+ fprintf(out, " until: %T%s\n", &until, utc,
+ (until == TIME_32_BIT_SIGNED_MAX) ? " (expires never)":"");
+
+ public = cert->get_public_key(cert);
+ if (public)
+ {
+ list_public_key(public, out);
public->destroy(public);
}
}
@@ -618,29 +689,35 @@ static void stroke_list_pubkeys(linked_list_t *list, bool utc, FILE *out)
/**
* list all X.509 certificates matching the flags
*/
-static void stroke_list_certs(linked_list_t *list, char *label,
+static void stroke_list_certs(linked_list_t *list, char *label,
x509_flag_t flags, bool utc, FILE *out)
{
bool first = TRUE;
time_t now = time(NULL);
- enumerator_t *enumerator = list->create_enumerator(list);
+ enumerator_t *enumerator;
certificate_t *cert;
+ x509_flag_t flag_mask;
+
+ /* mask all auxiliary flags */
+ flag_mask = ~(X509_SERVER_AUTH | X509_CLIENT_AUTH |
+ X509_SELF_SIGNED | X509_IP_ADDR_BLOCKS );
+ enumerator = list->create_enumerator(list);
while (enumerator->enumerate(enumerator, (void**)&cert))
{
x509_t *x509 = (x509_t*)cert;
- x509_flag_t x509_flags = x509->get_flags(x509);
+ x509_flag_t x509_flags = x509->get_flags(x509) & flag_mask;
- /* list only if flag is set, or flags == 0 (ignoring self-signed) */
- if ((x509_flags & flags) || (flags == (x509_flags & ~X509_SELF_SIGNED)))
+ /* list only if flag is set or flag == 0 */
+ if ((x509_flags & flags) || (x509_flags == flags))
{
enumerator_t *enumerator;
identification_t *altName;
bool first_altName = TRUE;
- chunk_t serial = x509->get_serial(x509);
- identification_t *authkey = x509->get_authKeyIdentifier(x509);
+ int pathlen;
+ chunk_t serial, authkey;
time_t notBefore, notAfter;
- public_key_t *public = cert->get_public_key(cert);
+ public_key_t *public;
if (first)
{
@@ -673,6 +750,7 @@ static void stroke_list_certs(linked_list_t *list, char *label,
fprintf(out, " subject: \"%Y\"\n", cert->get_subject(cert));
fprintf(out, " issuer: \"%Y\"\n", cert->get_issuer(cert));
+ serial = x509->get_serial(x509);
fprintf(out, " serial: %#B\n", &serial);
/* list validity */
@@ -700,33 +778,50 @@ static void stroke_list_certs(linked_list_t *list, char *label,
}
fprintf(out, " \n");
}
-
- /* list public key information */
+
+ public = cert->get_public_key(cert);
if (public)
{
- private_key_t *private = NULL;
- identification_t *id, *keyid;
-
- id = public->get_id(public, ID_PUBKEY_SHA1);
- keyid = public->get_id(public, ID_PUBKEY_INFO_SHA1);
-
- private = charon->credentials->get_private(
- charon->credentials,
- public->get_type(public), keyid, NULL);
- fprintf(out, " pubkey: %N %d bits%s\n",
- key_type_names, public->get_type(public),
- public->get_keysize(public) * 8,
- private ? ", has private key" : "");
- fprintf(out, " keyid: %Y\n", keyid);
- fprintf(out, " subjkey: %Y\n", id);
- DESTROY_IF(private);
+ list_public_key(public, out);
public->destroy(public);
}
-
+
/* list optional authorityKeyIdentifier */
- if (authkey)
+ authkey = x509->get_authKeyIdentifier(x509);
+ if (authkey.ptr)
{
- fprintf(out, " authkey: %Y\n", authkey);
+ fprintf(out, " authkey: %#B\n", &authkey);
+ }
+
+ /* list optional pathLenConstraint */
+ pathlen = x509->get_pathLenConstraint(x509);
+ if (pathlen != X509_NO_PATH_LEN_CONSTRAINT)
+ {
+ fprintf(out, " pathlen: %d\n", pathlen);
+ }
+
+ /* list optional ipAddrBlocks */
+ if (x509->get_flags(x509) & X509_IP_ADDR_BLOCKS)
+ {
+ traffic_selector_t *ipAddrBlock;
+ bool first_ipAddrBlock = TRUE;
+
+ fprintf(out, " addresses: ");
+ enumerator = x509->create_ipAddrBlock_enumerator(x509);
+ while (enumerator->enumerate(enumerator, &ipAddrBlock))
+ {
+ if (first_ipAddrBlock)
+ {
+ first_ipAddrBlock = FALSE;
+ }
+ else
+ {
+ fprintf(out, ", ");
+ }
+ fprintf(out, "%R", ipAddrBlock);
+ }
+ enumerator->destroy(enumerator);
+ fprintf(out, "\n");
}
}
}
@@ -746,11 +841,9 @@ static void stroke_list_acerts(linked_list_t *list, bool utc, FILE *out)
while (enumerator->enumerate(enumerator, (void**)&cert))
{
ac_t *ac = (ac_t*)cert;
- chunk_t serial = ac->get_serial(ac);
- chunk_t holderSerial = ac->get_holderSerial(ac);
- identification_t *holderIssuer = ac->get_holderIssuer(ac);
- identification_t *authkey = ac->get_authKeyIdentifier(ac);
- identification_t *entityName = cert->get_subject(cert);
+ identification_t *id;
+ ietf_attributes_t *groups;
+ chunk_t chunk;
if (first)
{
@@ -760,20 +853,30 @@ static void stroke_list_acerts(linked_list_t *list, bool utc, FILE *out)
}
fprintf(out, "\n");
- if (entityName)
+ id = cert->get_subject(cert);
+ if (id)
{
- fprintf(out, " holder: \"%Y\"\n", entityName);
+ fprintf(out, " holder: \"%Y\"\n", id);
}
- if (holderIssuer)
+ id = ac->get_holderIssuer(ac);
+ if (id)
{
- fprintf(out, " hissuer: \"%Y\"\n", holderIssuer);
+ fprintf(out, " hissuer: \"%Y\"\n", id);
}
- if (holderSerial.ptr)
+ chunk = ac->get_holderSerial(ac);
+ if (chunk.ptr)
{
- fprintf(out, " hserial: %#B\n", &holderSerial);
+ fprintf(out, " hserial: %#B\n", &chunk);
+ }
+ groups = ac->get_groups(ac);
+ if (groups)
+ {
+ fprintf(out, " groups: %s\n", groups->get_string(groups));
+ groups->destroy(groups);
}
fprintf(out, " issuer: \"%Y\"\n", cert->get_issuer(cert));
- fprintf(out, " serial: %#B\n", &serial);
+ chunk = ac->get_serial(ac);
+ fprintf(out, " serial: %#B\n", &chunk);
/* list validity */
cert->get_validity(cert, &now, &thisUpdate, &nextUpdate);
@@ -794,9 +897,10 @@ static void stroke_list_acerts(linked_list_t *list, bool utc, FILE *out)
}
/* list optional authorityKeyIdentifier */
- if (authkey)
+ chunk = ac->get_authKeyIdentifier(ac);
+ if (chunk.ptr)
{
- fprintf(out, " authkey: %Y\n", authkey);
+ fprintf(out, " authkey: %#B\n", &chunk);
}
}
enumerator->destroy(enumerator);
@@ -811,12 +915,11 @@ static void stroke_list_crls(linked_list_t *list, bool utc, FILE *out)
time_t thisUpdate, nextUpdate, now = time(NULL);
enumerator_t *enumerator = list->create_enumerator(list);
certificate_t *cert;
-
+
while (enumerator->enumerate(enumerator, (void**)&cert))
{
crl_t *crl = (crl_t*)cert;
- chunk_t serial = crl->get_serial(crl);
- identification_t *authkey = crl->get_authKeyIdentifier(crl);
+ chunk_t chunk;
if (first)
{
@@ -829,9 +932,10 @@ static void stroke_list_crls(linked_list_t *list, bool utc, FILE *out)
fprintf(out, " issuer: \"%Y\"\n", cert->get_issuer(cert));
/* list optional crlNumber */
- if (serial.ptr)
+ chunk = crl->get_serial(crl);
+ if (chunk.ptr)
{
- fprintf(out, " serial: %#B\n", &serial);
+ fprintf(out, " serial: %#B\n", &chunk);
}
/* count the number of revoked certificates */
@@ -867,9 +971,10 @@ static void stroke_list_crls(linked_list_t *list, bool utc, FILE *out)
}
/* list optional authorityKeyIdentifier */
- if (authkey)
+ chunk = crl->get_authKeyIdentifier(crl);
+ if (chunk.ptr)
{
- fprintf(out, " authkey: %Y\n", authkey);
+ fprintf(out, " authkey: %#B\n", &chunk);
}
}
enumerator->destroy(enumerator);
@@ -883,7 +988,7 @@ static void stroke_list_ocsp(linked_list_t* list, bool utc, FILE *out)
bool first = TRUE;
enumerator_t *enumerator = list->create_enumerator(list);
certificate_t *cert;
-
+
while (enumerator->enumerate(enumerator, (void**)&cert))
{
if (first)
@@ -910,7 +1015,7 @@ static void list_algs(FILE *out)
hash_algorithm_t hash;
pseudo_random_function_t prf;
diffie_hellman_group_t group;
-
+
fprintf(out, "\n");
fprintf(out, "List of registered IKEv2 Algorithms:\n");
fprintf(out, "\n encryption: ");
@@ -963,7 +1068,14 @@ static void list(private_stroke_list_t *this, stroke_msg_t *msg, FILE *out)
linked_list_t *pubkey_list = create_unique_cert_list(CERT_TRUSTED_PUBKEY);
stroke_list_pubkeys(pubkey_list, msg->list.utc, out);
- pubkey_list->destroy_offset(pubkey_list, offsetof(certificate_t, destroy));
+ pubkey_list->destroy_offset(pubkey_list, offsetof(certificate_t, destroy));
+ }
+ if (msg->list.flags & LIST_CERTS)
+ {
+ linked_list_t *pgp_list = create_unique_cert_list(CERT_GPG);
+
+ stroke_list_pgp(pgp_list, msg->list.utc, out);
+ pgp_list->destroy_offset(pgp_list, offsetof(certificate_t, destroy));
}
if (msg->list.flags & (LIST_CERTS | LIST_CACERTS | LIST_OCSPCERTS | LIST_AACERTS))
{
@@ -972,7 +1084,7 @@ static void list(private_stroke_list_t *this, stroke_msg_t *msg, FILE *out)
if (msg->list.flags & LIST_CERTS)
{
stroke_list_certs(cert_list, "X.509 End Entity Certificates",
- 0, msg->list.utc, out);
+ X509_NONE, msg->list.utc, out);
}
if (msg->list.flags & LIST_CACERTS)
{
@@ -989,33 +1101,34 @@ static void list(private_stroke_list_t *this, stroke_msg_t *msg, FILE *out)
stroke_list_certs(cert_list, "X.509 AA Certificates",
X509_AA, msg->list.utc, out);
}
+ DESTROY_OFFSET_IF(cert_list, offsetof(certificate_t, destroy));
+
if (msg->list.flags & LIST_ACERTS)
{
linked_list_t *ac_list = create_unique_cert_list(CERT_X509_AC);
stroke_list_acerts(ac_list, msg->list.utc, out);
- ac_list->destroy_offset(ac_list, offsetof(certificate_t, destroy));
+ ac_list->destroy_offset(ac_list, offsetof(certificate_t, destroy));
}
if (msg->list.flags & LIST_CRLS)
{
linked_list_t *crl_list = create_unique_cert_list(CERT_X509_CRL);
stroke_list_crls(crl_list, msg->list.utc, out);
- crl_list->destroy_offset(crl_list, offsetof(certificate_t, destroy));
+ crl_list->destroy_offset(crl_list, offsetof(certificate_t, destroy));
}
if (msg->list.flags & LIST_OCSP)
{
linked_list_t *ocsp_list = create_unique_cert_list(CERT_X509_OCSP_RESPONSE);
stroke_list_ocsp(ocsp_list, msg->list.utc, out);
-
- ocsp_list->destroy_offset(ocsp_list, offsetof(certificate_t, destroy));
+
+ ocsp_list->destroy_offset(ocsp_list, offsetof(certificate_t, destroy));
}
if (msg->list.flags & LIST_ALGS)
{
list_algs(out);
}
- DESTROY_OFFSET_IF(cert_list, offsetof(certificate_t, destroy));
}
/**
@@ -1029,7 +1142,7 @@ static void pool_leases(private_stroke_list_t *this, FILE *out, char *pool,
host_t *lease;
bool on;
int found = 0;
-
+
fprintf(out, "Leases in pool '%s', usage: %lu/%lu, %lu online\n",
pool, online + offline, size, online);
enumerator = this->attribute->create_lease_enumerator(this->attribute, pool);
@@ -1059,12 +1172,12 @@ static void leases(private_stroke_list_t *this, stroke_msg_t *msg, FILE *out)
host_t *address = NULL;
char *pool;
int found = 0;
-
+
if (msg->leases.address)
{
address = host_create_from_string(msg->leases.address, 0);
}
-
+
enumerator = this->attribute->create_pool_enumerator(this->attribute);
while (enumerator->enumerate(enumerator, &pool, &size, &online, &offline))
{
@@ -1103,15 +1216,15 @@ static void destroy(private_stroke_list_t *this)
stroke_list_t *stroke_list_create(stroke_attribute_t *attribute)
{
private_stroke_list_t *this = malloc_thing(private_stroke_list_t);
-
+
this->public.list = (void(*)(stroke_list_t*, stroke_msg_t *msg, FILE *out))list;
this->public.status = (void(*)(stroke_list_t*, stroke_msg_t *msg, FILE *out,bool))status;
this->public.leases = (void(*)(stroke_list_t*, stroke_msg_t *msg, FILE *out))leases;
this->public.destroy = (void(*)(stroke_list_t*))destroy;
-
- this->uptime = time(NULL);
+
+ this->uptime = time_monotonic(NULL);
this->attribute = attribute;
-
+
return &this->public;
}
diff --git a/src/charon/plugins/stroke/stroke_list.h b/src/charon/plugins/stroke/stroke_list.h
index 2430abfbb..b5bedc6c2 100644
--- a/src/charon/plugins/stroke/stroke_list.h
+++ b/src/charon/plugins/stroke/stroke_list.h
@@ -40,7 +40,7 @@ struct stroke_list_t {
* @param out stroke console stream
*/
void (*list)(stroke_list_t *this, stroke_msg_t *msg, FILE *out);
-
+
/**
* Log status information to stroke console.
*
@@ -49,7 +49,7 @@ struct stroke_list_t {
* @param all TRUE for "statusall"
*/
void (*status)(stroke_list_t *this, stroke_msg_t *msg, FILE *out, bool all);
-
+
/**
* Log pool leases to stroke console.
*
@@ -57,7 +57,7 @@ struct stroke_list_t {
* @param out stroke console stream
*/
void (*leases)(stroke_list_t *this, stroke_msg_t *msg, FILE *out);
-
+
/**
* Destroy a stroke_list instance.
*/
diff --git a/src/charon/plugins/stroke/stroke_plugin.c b/src/charon/plugins/stroke/stroke_plugin.c
index 22c1125a1..61ae10953 100644
--- a/src/charon/plugins/stroke/stroke_plugin.c
+++ b/src/charon/plugins/stroke/stroke_plugin.c
@@ -29,7 +29,7 @@ struct private_stroke_plugin_t {
* public functions
*/
stroke_plugin_t public;
-
+
/**
* stroke socket, receives strokes
*/
@@ -51,9 +51,9 @@ static void destroy(private_stroke_plugin_t *this)
plugin_t *plugin_create()
{
private_stroke_plugin_t *this = malloc_thing(private_stroke_plugin_t);
-
+
this->public.plugin.destroy = (void(*)(plugin_t*))destroy;
-
+
this->socket = stroke_socket_create();
if (this->socket == NULL)
{
diff --git a/src/charon/plugins/stroke/stroke_plugin.h b/src/charon/plugins/stroke/stroke_plugin.h
index 6e9d556ad..3a1e81df6 100644
--- a/src/charon/plugins/stroke/stroke_plugin.h
+++ b/src/charon/plugins/stroke/stroke_plugin.h
@@ -20,7 +20,7 @@
* @defgroup stroke_plugin stroke_plugin
* @{ @ingroup stroke
*/
-
+
#ifndef STROKE_PLUGIN_H_
#define STROKE_PLUGIN_H_
diff --git a/src/charon/plugins/stroke/stroke_shared_key.c b/src/charon/plugins/stroke/stroke_shared_key.c
index 8f53f509d..4f716e83a 100644
--- a/src/charon/plugins/stroke/stroke_shared_key.c
+++ b/src/charon/plugins/stroke/stroke_shared_key.c
@@ -28,7 +28,7 @@ struct private_stroke_shared_key_t {
* implements shared_key_t
*/
stroke_shared_key_t public;
-
+
/**
* type of this key
*/
@@ -43,7 +43,7 @@ struct private_stroke_shared_key_t {
* list of key owners, as identification_t
*/
linked_list_t *owners;
-
+
/**
* reference counter
*/
@@ -73,8 +73,8 @@ static private_stroke_shared_key_t* get_ref(private_stroke_shared_key_t *this)
static chunk_t get_key(private_stroke_shared_key_t *this)
{
return this->key;
-}
-
+}
+
/**
* Implementation of stroke_shared_key_t.has_owner.
*/
@@ -83,7 +83,7 @@ static id_match_t has_owner(private_stroke_shared_key_t *this, identification_t
enumerator_t *enumerator;
id_match_t match, best = ID_MATCH_NONE;
identification_t *current;
-
+
enumerator = this->owners->create_enumerator(this->owners);
while (enumerator->enumerate(enumerator, &current))
{
@@ -135,6 +135,6 @@ stroke_shared_key_t *stroke_shared_key_create(shared_key_type_t type, chunk_t ke
this->type = type;
this->key = key;
this->ref = 1;
-
+
return &this->public;
}
diff --git a/src/charon/plugins/stroke/stroke_shared_key.h b/src/charon/plugins/stroke/stroke_shared_key.h
index 224062100..05ad55083 100644
--- a/src/charon/plugins/stroke/stroke_shared_key.h
+++ b/src/charon/plugins/stroke/stroke_shared_key.h
@@ -35,21 +35,21 @@ struct stroke_shared_key_t {
* Implements the shared_key_t interface.
*/
shared_key_t shared;
-
+
/**
* Add an owner to the key.
*
* @param owner owner to add
*/
void (*add_owner)(stroke_shared_key_t *this, identification_t *owner);
-
+
/**
* Check if a key has a specific owner.
*
* @param owner owner to check
* @return best match found
*/
- id_match_t (*has_owner)(stroke_shared_key_t *this, identification_t *owner);
+ id_match_t (*has_owner)(stroke_shared_key_t *this, identification_t *owner);
};
/**
diff --git a/src/charon/plugins/stroke/stroke_socket.c b/src/charon/plugins/stroke/stroke_socket.c
index 9b6a8a3a7..820e097f1 100644
--- a/src/charon/plugins/stroke/stroke_socket.c
+++ b/src/charon/plugins/stroke/stroke_socket.c
@@ -23,11 +23,10 @@
#include <sys/fcntl.h>
#include <unistd.h>
#include <errno.h>
-#include <pthread.h>
#include <processing/jobs/callback_job.h>
#include <daemon.h>
-#include <utils/mutex.h> /* for Mac OS X compatible accept */
+#include <threading/thread.h>
#include "stroke_config.h"
#include "stroke_control.h"
@@ -48,42 +47,42 @@ struct private_stroke_socket_t {
* public functions
*/
stroke_socket_t public;
-
+
/**
* Unix socket to listen for strokes
*/
int socket;
-
+
/**
* job accepting stroke messages
*/
callback_job_t *job;
-
+
/**
* configuration backend
*/
stroke_config_t *config;
-
+
/**
* attribute provider
*/
stroke_attribute_t *attribute;
-
+
/**
* controller to control daemon
*/
stroke_control_t *control;
-
+
/**
* credential set
*/
stroke_cred_t *cred;
-
+
/**
* CA sections
*/
stroke_ca_t *ca;
-
+
/**
* Status information logging
*/
@@ -99,7 +98,7 @@ struct stroke_job_context_t {
* file descriptor to read from
*/
int fd;
-
+
/**
* global stroke interface
*/
@@ -152,7 +151,7 @@ static void pop_end(stroke_msg_t *msg, const char* label, stroke_end_t *end)
pop_string(msg, &end->ca2);
pop_string(msg, &end->groups);
pop_string(msg, &end->updown);
-
+
DBG2(DBG_CFG, " %s=%s", label, end->address);
DBG2(DBG_CFG, " %ssubnet=%s", label, end->subnets);
DBG2(DBG_CFG, " %ssourceip=%s", label, end->sourceip);
@@ -202,7 +201,7 @@ static void stroke_del_conn(private_stroke_socket_t *this, stroke_msg_t *msg)
{
pop_string(msg, &msg->del_conn.name);
DBG1(DBG_CFG, "received stroke: delete connection '%s'", msg->del_conn.name);
-
+
this->config->del(this->config, msg);
this->attribute->del_pool(this->attribute, msg);
}
@@ -214,7 +213,7 @@ static void stroke_initiate(private_stroke_socket_t *this, stroke_msg_t *msg, FI
{
pop_string(msg, &msg->initiate.name);
DBG1(DBG_CFG, "received stroke: initiate '%s'", msg->initiate.name);
-
+
this->control->initiate(this->control, msg, out);
}
@@ -227,7 +226,7 @@ static void stroke_terminate(private_stroke_socket_t *this, stroke_msg_t *msg, F
DBG1(DBG_CFG, "received stroke: terminate '%s'", msg->terminate.name);
this->control->terminate(this->control, msg, out);
-}
+}
/**
* terminate a connection by peers virtual IP
@@ -250,7 +249,7 @@ static void stroke_route(private_stroke_socket_t *this, stroke_msg_t *msg, FILE
{
pop_string(msg, &msg->route.name);
DBG1(DBG_CFG, "received stroke: route '%s'", msg->route.name);
-
+
this->control->route(this->control, msg, out);
}
@@ -261,7 +260,7 @@ static void stroke_unroute(private_stroke_socket_t *this, stroke_msg_t *msg, FIL
{
pop_string(msg, &msg->terminate.name);
DBG1(DBG_CFG, "received stroke: unroute '%s'", msg->route.name);
-
+
this->control->unroute(this->control, msg, out);
}
@@ -287,7 +286,7 @@ static void stroke_add_ca(private_stroke_socket_t *this,
DBG2(DBG_CFG, " ocspuri=%s", msg->add_ca.ocspuri);
DBG2(DBG_CFG, " ocspuri2=%s", msg->add_ca.ocspuri2);
DBG2(DBG_CFG, " certuribase=%s", msg->add_ca.certuribase);
-
+
this->ca->add(this->ca, msg);
}
@@ -299,7 +298,7 @@ static void stroke_del_ca(private_stroke_socket_t *this,
{
pop_string(msg, &msg->del_ca.name);
DBG1(DBG_CFG, "received stroke: delete ca '%s'", msg->del_ca.name);
-
+
this->ca->del(this->ca, msg);
}
@@ -311,7 +310,7 @@ static void stroke_status(private_stroke_socket_t *this,
stroke_msg_t *msg, FILE *out, bool all)
{
pop_string(msg, &(msg->status.name));
-
+
this->list->status(this->list, msg, out, all);
}
@@ -333,7 +332,7 @@ static void stroke_list(private_stroke_socket_t *this, stroke_msg_t *msg, FILE *
static void stroke_reread(private_stroke_socket_t *this,
stroke_msg_t *msg, FILE *out)
{
- this->cred->reread(this->cred, msg);
+ this->cred->reread(this->cred, msg, out);
}
/**
@@ -361,7 +360,7 @@ static void stroke_leases(private_stroke_socket_t *this,
{
pop_string(msg, &msg->leases.pool);
pop_string(msg, &msg->leases.address);
-
+
this->list->leases(this->list, msg, out);
}
@@ -390,11 +389,11 @@ static void stroke_loglevel(private_stroke_socket_t *this,
sys_logger_t *sys_logger;
file_logger_t *file_logger;
debug_t group;
-
+
pop_string(msg, &(msg->loglevel.type));
DBG1(DBG_CFG, "received stroke: loglevel %d for %s",
msg->loglevel.level, msg->loglevel.type);
-
+
group = get_group_from_name(msg->loglevel.type);
if (group < 0)
{
@@ -448,7 +447,7 @@ static job_requeue_t process(stroke_job_context_t *ctx)
FILE *out;
private_stroke_socket_t *this = ctx->this;
int strokefd = ctx->fd;
-
+
/* peek the length */
bytes_read = recv(strokefd, &msg_length, sizeof(msg_length), MSG_PEEK);
if (bytes_read != sizeof(msg_length))
@@ -457,7 +456,7 @@ static job_requeue_t process(stroke_job_context_t *ctx)
strerror(errno));
return JOB_REQUEUE_NONE;
}
-
+
/* read message */
msg = alloca(msg_length);
bytes_read = recv(strokefd, msg, msg_length, 0);
@@ -466,16 +465,16 @@ static job_requeue_t process(stroke_job_context_t *ctx)
DBG1(DBG_CFG, "reading stroke message failed: %s", strerror(errno));
return JOB_REQUEUE_NONE;
}
-
- out = fdopen(strokefd, "w");
+
+ out = fdopen(strokefd, "w+");
if (out == NULL)
{
DBG1(DBG_CFG, "opening stroke output channel failed: %s", strerror(errno));
return JOB_REQUEUE_NONE;
}
-
+
DBG3(DBG_CFG, "stroke message %b", (void*)msg, msg_length);
-
+
switch (msg->type)
{
case STR_INITIATE:
@@ -547,27 +546,27 @@ static job_requeue_t receive(private_stroke_socket_t *this)
struct sockaddr_un strokeaddr;
int strokeaddrlen = sizeof(strokeaddr);
int strokefd;
- int oldstate;
+ bool oldstate;
callback_job_t *job;
stroke_job_context_t *ctx;
-
- pthread_setcancelstate(PTHREAD_CANCEL_ENABLE, &oldstate);
+
+ oldstate = thread_cancelability(TRUE);
strokefd = accept(this->socket, (struct sockaddr *)&strokeaddr, &strokeaddrlen);
- pthread_setcancelstate(oldstate, NULL);
-
+ thread_cancelability(oldstate);
+
if (strokefd < 0)
{
DBG1(DBG_CFG, "accepting stroke connection failed: %s", strerror(errno));
return JOB_REQUEUE_FAIR;
}
-
+
ctx = malloc_thing(stroke_job_context_t);
ctx->fd = strokefd;
ctx->this = this;
job = callback_job_create((callback_job_cb_t)process,
ctx, (void*)stroke_job_context_destroy, this->job);
charon->processor->queue_job(charon->processor, (job_t*)job);
-
+
return JOB_REQUEUE_FAIR;
}
@@ -582,7 +581,7 @@ static bool open_socket(private_stroke_socket_t *this)
socket_addr.sun_family = AF_UNIX;
strcpy(socket_addr.sun_path, STROKE_SOCKET);
-
+
/* set up unix socket */
this->socket = socket(AF_UNIX, SOCK_STREAM, 0);
if (this->socket == -1)
@@ -590,7 +589,7 @@ static bool open_socket(private_stroke_socket_t *this)
DBG1(DBG_CFG, "could not create stroke socket");
return FALSE;
}
-
+
unlink(socket_addr.sun_path);
old = umask(~(S_IRWXU | S_IRWXG));
if (bind(this->socket, (struct sockaddr *)&socket_addr, sizeof(socket_addr)) < 0)
@@ -605,7 +604,7 @@ static bool open_socket(private_stroke_socket_t *this)
DBG1(DBG_CFG, "changing stroke socket permissions failed: %s",
strerror(errno));
}
-
+
if (listen(this->socket, 10) < 0)
{
DBG1(DBG_CFG, "could not listen on stroke socket: %s", strerror(errno));
@@ -625,7 +624,7 @@ static void destroy(private_stroke_socket_t *this)
charon->credentials->remove_set(charon->credentials, &this->ca->set);
charon->credentials->remove_set(charon->credentials, &this->cred->set);
charon->backends->remove_backend(charon->backends, &this->config->backend);
- charon->attributes->remove_provider(charon->attributes, &this->attribute->provider);
+ lib->attributes->remove_provider(lib->attributes, &this->attribute->provider);
this->cred->destroy(this->cred);
this->ca->destroy(this->ca);
this->config->destroy(this->config);
@@ -641,31 +640,31 @@ static void destroy(private_stroke_socket_t *this)
stroke_socket_t *stroke_socket_create()
{
private_stroke_socket_t *this = malloc_thing(private_stroke_socket_t);
-
+
this->public.destroy = (void(*)(stroke_socket_t*))destroy;
-
+
if (!open_socket(this))
{
free(this);
return NULL;
}
-
+
this->cred = stroke_cred_create();
this->attribute = stroke_attribute_create();
this->ca = stroke_ca_create(this->cred);
this->config = stroke_config_create(this->ca, this->cred);
this->control = stroke_control_create();
this->list = stroke_list_create(this->attribute);
-
+
charon->credentials->add_set(charon->credentials, &this->ca->set);
charon->credentials->add_set(charon->credentials, &this->cred->set);
charon->backends->add_backend(charon->backends, &this->config->backend);
- charon->attributes->add_provider(charon->attributes, &this->attribute->provider);
-
+ lib->attributes->add_provider(lib->attributes, &this->attribute->provider);
+
this->job = callback_job_create((callback_job_cb_t)receive,
this, NULL, NULL);
charon->processor->queue_job(charon->processor, (job_t*)this->job);
-
+
return &this->public;
}
diff --git a/src/charon/plugins/stroke/stroke_socket.h b/src/charon/plugins/stroke/stroke_socket.h
index 6073f5133..2aac8be9b 100644
--- a/src/charon/plugins/stroke/stroke_socket.h
+++ b/src/charon/plugins/stroke/stroke_socket.h
@@ -27,11 +27,11 @@ typedef struct stroke_socket_t stroke_socket_t;
* Stroke socket, opens UNIX communication socket, reads and dispatches.
*/
struct stroke_socket_t {
-
+
/**
- * Destroy a stroke_socket instance.
- */
- void (*destroy)(stroke_socket_t *this);
+ * Destroy a stroke_socket instance.
+ */
+ void (*destroy)(stroke_socket_t *this);
};
/**
diff --git a/src/charon/plugins/uci/Makefile.in b/src/charon/plugins/uci/Makefile.in
index c4fb335d7..00436f509 100644
--- a/src/charon/plugins/uci/Makefile.in
+++ b/src/charon/plugins/uci/Makefile.in
@@ -1,8 +1,9 @@
-# Makefile.in generated by automake 1.10.2 from Makefile.am.
+# Makefile.in generated by automake 1.11 from Makefile.am.
# @configure_input@
# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,
-# 2003, 2004, 2005, 2006, 2007, 2008 Free Software Foundation, Inc.
+# 2003, 2004, 2005, 2006, 2007, 2008, 2009 Free Software Foundation,
+# Inc.
# This Makefile.in is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.
@@ -16,8 +17,9 @@
VPATH = @srcdir@
pkgdatadir = $(datadir)/@PACKAGE@
-pkglibdir = $(libdir)/@PACKAGE@
pkgincludedir = $(includedir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkglibexecdir = $(libexecdir)/@PACKAGE@
am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
install_sh_DATA = $(install_sh) -c -m 644
install_sh_PROGRAM = $(install_sh) -c
@@ -35,19 +37,41 @@ host_triplet = @host@
subdir = src/charon/plugins/uci
DIST_COMMON = $(srcdir)/Makefile.am $(srcdir)/Makefile.in
ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
-am__aclocal_m4_deps = $(top_srcdir)/configure.in
+am__aclocal_m4_deps = $(top_srcdir)/m4/config/libtool.m4 \
+ $(top_srcdir)/m4/config/ltoptions.m4 \
+ $(top_srcdir)/m4/config/ltsugar.m4 \
+ $(top_srcdir)/m4/config/ltversion.m4 \
+ $(top_srcdir)/m4/config/lt~obsolete.m4 \
+ $(top_srcdir)/m4/macros/with.m4 \
+ $(top_srcdir)/m4/macros/enable-disable.m4 \
+ $(top_srcdir)/configure.in
am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
$(ACLOCAL_M4)
mkinstalldirs = $(install_sh) -d
CONFIG_CLEAN_FILES =
+CONFIG_CLEAN_VPATH_FILES =
am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
am__vpath_adj = case $$p in \
$(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
*) f=$$p;; \
esac;
-am__strip_dir = `echo $$p | sed -e 's|^.*/||'`;
+am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
+am__install_max = 40
+am__nobase_strip_setup = \
+ srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
+am__nobase_strip = \
+ for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
+am__nobase_list = $(am__nobase_strip_setup); \
+ for p in $$list; do echo "$$p $$p"; done | \
+ sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
+ $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
+ if (++n[$$2] == $(am__install_max)) \
+ { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
+ END { for (dir in files) print dir, files[dir] }'
+am__base_list = \
+ sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
+ sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
am__installdirs = "$(DESTDIR)$(plugindir)"
-pluginLTLIBRARIES_INSTALL = $(INSTALL)
LTLIBRARIES = $(plugin_LTLIBRARIES)
libstrongswan_uci_la_DEPENDENCIES =
am_libstrongswan_uci_la_OBJECTS = uci_plugin.lo uci_parser.lo \
@@ -59,6 +83,7 @@ libstrongswan_uci_la_LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) \
DEFAULT_INCLUDES = -I.@am__isrc@
depcomp = $(SHELL) $(top_srcdir)/depcomp
am__depfiles_maybe = depfiles
+am__mv = mv -f
COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
LTCOMPILE = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
@@ -106,25 +131,22 @@ INSTALL_DATA = @INSTALL_DATA@
INSTALL_PROGRAM = @INSTALL_PROGRAM@
INSTALL_SCRIPT = @INSTALL_SCRIPT@
INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
-IPSEC_ROUTING_TABLE = @IPSEC_ROUTING_TABLE@
-IPSEC_ROUTING_TABLE_PRIO = @IPSEC_ROUTING_TABLE_PRIO@
LD = @LD@
LDFLAGS = @LDFLAGS@
LEX = @LEX@
LEXLIB = @LEXLIB@
LEX_OUTPUT_ROOT = @LEX_OUTPUT_ROOT@
-LIBGCRYPT_CFLAGS = @LIBGCRYPT_CFLAGS@
-LIBGCRYPT_CONFIG = @LIBGCRYPT_CONFIG@
-LIBGCRYPT_LIBS = @LIBGCRYPT_LIBS@
LIBOBJS = @LIBOBJS@
LIBS = @LIBS@
LIBTOOL = @LIBTOOL@
-LINUX_HEADERS = @LINUX_HEADERS@
LIPO = @LIPO@
LN_S = @LN_S@
LTLIBOBJS = @LTLIBOBJS@
MAKEINFO = @MAKEINFO@
MKDIR_P = @MKDIR_P@
+MYSQLCFLAG = @MYSQLCFLAG@
+MYSQLCONFIG = @MYSQLCONFIG@
+MYSQLLIB = @MYSQLLIB@
NM = @NM@
NMEDIT = @NMEDIT@
OBJDUMP = @OBJDUMP@
@@ -136,11 +158,14 @@ PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
PACKAGE_NAME = @PACKAGE_NAME@
PACKAGE_STRING = @PACKAGE_STRING@
PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_URL = @PACKAGE_URL@
PACKAGE_VERSION = @PACKAGE_VERSION@
PATH_SEPARATOR = @PATH_SEPARATOR@
PERL = @PERL@
PKG_CONFIG = @PKG_CONFIG@
+PTHREADLIB = @PTHREADLIB@
RANLIB = @RANLIB@
+RTLIB = @RTLIB@
RUBY = @RUBY@
RUBYINCLUDE = @RUBYINCLUDE@
SED = @SED@
@@ -169,9 +194,9 @@ build_cpu = @build_cpu@
build_os = @build_os@
build_vendor = @build_vendor@
builddir = @builddir@
-confdir = @confdir@
datadir = @datadir@
datarootdir = @datarootdir@
+default_pkcs11 = @default_pkcs11@
docdir = @docdir@
dvidir = @dvidir@
exec_prefix = @exec_prefix@
@@ -194,7 +219,7 @@ ipsecuser = @ipsecuser@
libdir = @libdir@
libexecdir = @libexecdir@
libstrongswan_plugins = @libstrongswan_plugins@
-linuxdir = @linuxdir@
+linux_headers = @linux_headers@
localedir = @localedir@
localstatedir = @localstatedir@
lt_ECHO = @lt_ECHO@
@@ -202,6 +227,7 @@ mandir = @mandir@
mkdir_p = @mkdir_p@
nm_CFLAGS = @nm_CFLAGS@
nm_LIBS = @nm_LIBS@
+nm_ca_dir = @nm_ca_dir@
oldincludedir = @oldincludedir@
pdfdir = @pdfdir@
piddir = @piddir@
@@ -210,10 +236,12 @@ pluto_plugins = @pluto_plugins@
prefix = @prefix@
program_transform_name = @program_transform_name@
psdir = @psdir@
+random_device = @random_device@
resolv_conf = @resolv_conf@
+routing_table = @routing_table@
+routing_table_prio = @routing_table_prio@
sbindir = @sbindir@
sharedstatedir = @sharedstatedir@
-simreader = @simreader@
srcdir = @srcdir@
strongswan_conf = @strongswan_conf@
sysconfdir = @sysconfdir@
@@ -221,6 +249,7 @@ target_alias = @target_alias@
top_build_prefix = @top_build_prefix@
top_builddir = @top_builddir@
top_srcdir = @top_srcdir@
+urandom_device = @urandom_device@
xml_CFLAGS = @xml_CFLAGS@
xml_LIBS = @xml_LIBS@
INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
@@ -246,9 +275,9 @@ $(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps)
exit 1;; \
esac; \
done; \
- echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/charon/plugins/uci/Makefile'; \
- cd $(top_srcdir) && \
- $(AUTOMAKE) --gnu src/charon/plugins/uci/Makefile
+ echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/charon/plugins/uci/Makefile'; \
+ $(am__cd) $(top_srcdir) && \
+ $(AUTOMAKE) --gnu src/charon/plugins/uci/Makefile
.PRECIOUS: Makefile
Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
@case '$?' in \
@@ -266,23 +295,28 @@ $(top_srcdir)/configure: $(am__configure_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
$(ACLOCAL_M4): $(am__aclocal_m4_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(am__aclocal_m4_deps):
install-pluginLTLIBRARIES: $(plugin_LTLIBRARIES)
@$(NORMAL_INSTALL)
test -z "$(plugindir)" || $(MKDIR_P) "$(DESTDIR)$(plugindir)"
- @list='$(plugin_LTLIBRARIES)'; for p in $$list; do \
+ @list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+ list2=; for p in $$list; do \
if test -f $$p; then \
- f=$(am__strip_dir) \
- echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(pluginLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) '$$p' '$(DESTDIR)$(plugindir)/$$f'"; \
- $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(pluginLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) "$$p" "$(DESTDIR)$(plugindir)/$$f"; \
+ list2="$$list2 $$p"; \
else :; fi; \
- done
+ done; \
+ test -z "$$list2" || { \
+ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(plugindir)'"; \
+ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(plugindir)"; \
+ }
uninstall-pluginLTLIBRARIES:
@$(NORMAL_UNINSTALL)
- @list='$(plugin_LTLIBRARIES)'; for p in $$list; do \
- p=$(am__strip_dir) \
- echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$p'"; \
- $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$p"; \
+ @list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+ for p in $$list; do \
+ $(am__strip_dir) \
+ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$f'"; \
+ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$f"; \
done
clean-pluginLTLIBRARIES:
@@ -310,21 +344,21 @@ distclean-compile:
.c.o:
@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(COMPILE) -c $<
.c.obj:
@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(COMPILE) -c `$(CYGPATH_W) '$<'`
.c.lo:
@am__fastdepCC_TRUE@ $(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(LTCOMPILE) -c -o $@ $<
@@ -347,7 +381,7 @@ tags: TAGS
TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
$(TAGS_FILES) $(LISP)
- tags=; \
+ set x; \
here=`pwd`; \
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
unique=`for i in $$list; do \
@@ -355,29 +389,34 @@ TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
- if test -z "$(ETAGS_ARGS)$$tags$$unique"; then :; else \
+ shift; \
+ if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
test -n "$$unique" || unique=$$empty_fix; \
- $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
- $$tags $$unique; \
+ if test $$# -gt 0; then \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ "$$@" $$unique; \
+ else \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ $$unique; \
+ fi; \
fi
ctags: CTAGS
CTAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
$(TAGS_FILES) $(LISP)
- tags=; \
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
unique=`for i in $$list; do \
if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
- test -z "$(CTAGS_ARGS)$$tags$$unique" \
+ test -z "$(CTAGS_ARGS)$$unique" \
|| $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
- $$tags $$unique
+ $$unique
GTAGS:
here=`$(am__cd) $(top_builddir) && pwd` \
- && cd $(top_srcdir) \
- && gtags -i $(GTAGS_ARGS) $$here
+ && $(am__cd) $(top_srcdir) \
+ && gtags -i $(GTAGS_ARGS) "$$here"
distclean-tags:
-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
@@ -398,13 +437,17 @@ distdir: $(DISTFILES)
if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
if test -d $$d/$$file; then \
dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
+ if test -d "$(distdir)/$$file"; then \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+ fi; \
if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
- cp -pR $(srcdir)/$$file $(distdir)$$dir || exit 1; \
+ cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
fi; \
- cp -pR $$d/$$file $(distdir)$$dir || exit 1; \
+ cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
else \
- test -f $(distdir)/$$file \
- || cp -p $$d/$$file $(distdir)/$$file \
+ test -f "$(distdir)/$$file" \
+ || cp -p $$d/$$file "$(distdir)/$$file" \
|| exit 1; \
fi; \
done
@@ -435,6 +478,7 @@ clean-generic:
distclean-generic:
-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+ -test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
maintainer-clean-generic:
@echo "This command is intended for maintainers to use"
@@ -456,6 +500,8 @@ dvi-am:
html: html-am
+html-am:
+
info: info-am
info-am:
@@ -464,18 +510,28 @@ install-data-am: install-pluginLTLIBRARIES
install-dvi: install-dvi-am
+install-dvi-am:
+
install-exec-am:
install-html: install-html-am
+install-html-am:
+
install-info: install-info-am
+install-info-am:
+
install-man:
install-pdf: install-pdf-am
+install-pdf-am:
+
install-ps: install-ps-am
+install-ps-am:
+
installcheck-am:
maintainer-clean: maintainer-clean-am
@@ -514,6 +570,7 @@ uninstall-am: uninstall-pluginLTLIBRARIES
mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \
tags uninstall uninstall-am uninstall-pluginLTLIBRARIES
+
# Tell versions [3.59,3.63) of GNU make to not export all variables.
# Otherwise a system limit (for SysV at least) may be exceeded.
.NOEXPORT:
diff --git a/src/charon/plugins/uci/uci_config.c b/src/charon/plugins/uci/uci_config.c
index e697e8be6..a6ee970ad 100644
--- a/src/charon/plugins/uci/uci_config.c
+++ b/src/charon/plugins/uci/uci_config.c
@@ -34,7 +34,7 @@ struct private_uci_config_t {
* Public part
*/
uci_config_t public;
-
+
/**
* UCI parser context
*/
@@ -59,7 +59,7 @@ typedef struct {
static proposal_t *create_proposal(char *string, protocol_id_t proto)
{
proposal_t *proposal = NULL;
-
+
if (string)
{
proposal = proposal_create_from_string(proto, string);
@@ -68,12 +68,12 @@ static proposal_t *create_proposal(char *string, protocol_id_t proto)
{ /* UCI default is aes/sha1 only */
if (proto == PROTO_IKE)
{
- proposal = proposal_create_from_string(proto,
+ proposal = proposal_create_from_string(proto,
"aes128-aes192-aes256-sha1-modp1536-modp2048");
}
else
{
- proposal = proposal_create_from_string(proto,
+ proposal = proposal_create_from_string(proto,
"aes128-aes192-aes256-sha1");
}
}
@@ -90,7 +90,7 @@ static traffic_selector_t *create_ts(char *string)
int netbits = 32;
host_t *net;
char *pos;
-
+
string = strdupa(string);
pos = strchr(string, '/');
if (pos)
@@ -120,7 +120,7 @@ static traffic_selector_t *create_ts(char *string)
static u_int create_rekey(char *string)
{
u_int rekey = 0;
-
+
if (string)
{
rekey = atoi(string);
@@ -144,7 +144,14 @@ static bool peer_enumerator_enumerate(peer_enumerator_t *this, peer_cfg_t **cfg)
child_cfg_t *child_cfg;
ike_cfg_t *ike_cfg;
auth_cfg_t *auth;
-
+ lifetime_cfg_t lifetime = {
+ .time = {
+ .life = create_rekey(esp_rekey) + 300,
+ .rekey = create_rekey(esp_rekey),
+ .jitter = 300
+ }
+ };
+
/* defaults */
name = "unnamed";
local_id = NULL;
@@ -157,7 +164,7 @@ static bool peer_enumerator_enumerate(peer_enumerator_t *this, peer_cfg_t **cfg)
esp_proposal = NULL;
ike_rekey = NULL;
esp_rekey = NULL;
-
+
if (this->inner->enumerate(this->inner, &name, &local_id, &remote_id,
&local_addr, &remote_addr, &local_net, &remote_net,
&ike_proposal, &esp_proposal, &ike_rekey, &esp_rekey))
@@ -177,7 +184,7 @@ static bool peer_enumerator_enumerate(peer_enumerator_t *this, peer_cfg_t **cfg)
auth->add(auth, AUTH_RULE_IDENTITY,
identification_create_from_string(local_id));
this->peer_cfg->add_auth_cfg(this->peer_cfg, auth, TRUE);
-
+
auth = auth_cfg_create();
auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PSK);
if (remote_id)
@@ -186,9 +193,9 @@ static bool peer_enumerator_enumerate(peer_enumerator_t *this, peer_cfg_t **cfg)
identification_create_from_string(remote_id));
}
this->peer_cfg->add_auth_cfg(this->peer_cfg, auth, FALSE);
- child_cfg = child_cfg_create(name,
- create_rekey(esp_rekey) + 300, create_rekey(ike_rekey), 300,
- NULL, TRUE, MODE_TUNNEL, ACTION_NONE, ACTION_NONE, FALSE);
+
+ child_cfg = child_cfg_create(name, &lifetime, NULL, TRUE, MODE_TUNNEL,
+ ACTION_NONE, ACTION_NONE, FALSE, 0);
child_cfg->add_proposal(child_cfg, create_proposal(esp_proposal, PROTO_ESP));
child_cfg->add_traffic_selector(child_cfg, TRUE, create_ts(local_net));
child_cfg->add_traffic_selector(child_cfg, FALSE, create_ts(remote_net));
@@ -213,15 +220,15 @@ static void peer_enumerator_destroy(peer_enumerator_t *this)
* Implementation of backend_t.create_peer_cfg_enumerator.
*/
static enumerator_t* create_peer_cfg_enumerator(private_uci_config_t *this,
- identification_t *me,
+ identification_t *me,
identification_t *other)
{
peer_enumerator_t *e = malloc_thing(peer_enumerator_t);
-
+
e->public.enumerate = (void*)peer_enumerator_enumerate;
e->public.destroy = (void*)peer_enumerator_destroy;
e->peer_cfg = NULL;
- e->inner = this->parser->create_section_enumerator(this->parser,
+ e->inner = this->parser->create_section_enumerator(this->parser,
"local_id", "remote_id", "local_addr", "remote_addr",
"local_net", "remote_net", "ike_proposal", "esp_proposal",
"ike_rekey", "esp_rekey", NULL);
@@ -251,12 +258,12 @@ typedef struct {
static bool ike_enumerator_enumerate(ike_enumerator_t *this, ike_cfg_t **cfg)
{
char *local_addr, *remote_addr, *ike_proposal;
-
+
/* defaults */
local_addr = "0.0.0.0";
remote_addr = "0.0.0.0";
ike_proposal = NULL;
-
+
if (this->inner->enumerate(this->inner, NULL,
&local_addr, &remote_addr, &ike_proposal))
{
@@ -288,11 +295,11 @@ static enumerator_t* create_ike_cfg_enumerator(private_uci_config_t *this,
host_t *me, host_t *other)
{
ike_enumerator_t *e = malloc_thing(ike_enumerator_t);
-
+
e->public.enumerate = (void*)ike_enumerator_enumerate;
e->public.destroy = (void*)ike_enumerator_destroy;
e->ike_cfg = NULL;
- e->inner = this->parser->create_section_enumerator(this->parser,
+ e->inner = this->parser->create_section_enumerator(this->parser,
"local_addr", "remote_addr", "ike_proposal", NULL);
if (!e->inner)
{
@@ -309,7 +316,7 @@ static peer_cfg_t *get_peer_cfg_by_name(private_uci_config_t *this, char *name)
{
enumerator_t *enumerator;
peer_cfg_t *current, *found = NULL;
-
+
enumerator = create_peer_cfg_enumerator(this, NULL, NULL);
if (enumerator)
{
diff --git a/src/charon/plugins/uci/uci_config.h b/src/charon/plugins/uci/uci_config.h
index eac05b1df..130f15d85 100644
--- a/src/charon/plugins/uci/uci_config.h
+++ b/src/charon/plugins/uci/uci_config.h
@@ -37,11 +37,11 @@ struct uci_config_t {
* Implements backend_t interface
*/
backend_t backend;
-
+
/**
* Destroy the backend.
*/
- void (*destroy)(uci_config_t *this);
+ void (*destroy)(uci_config_t *this);
};
/**
diff --git a/src/charon/plugins/uci/uci_control.c b/src/charon/plugins/uci/uci_control.c
index f74224fa7..3c4928be4 100644
--- a/src/charon/plugins/uci/uci_control.c
+++ b/src/charon/plugins/uci/uci_control.c
@@ -21,11 +21,11 @@
#include <sys/types.h>
#include <sys/stat.h>
#include <errno.h>
-#include <pthread.h>
#include "uci_control.h"
#include <daemon.h>
+#include <threading/thread.h>
#include <processing/jobs/callback_job.h>
#define FIFO_FILE "/var/run/charon.fifo"
@@ -37,14 +37,14 @@ typedef struct private_uci_control_t private_uci_control_t;
* private data of uci_control_t
*/
struct private_uci_control_t {
-
+
/**
* Public part
*/
uci_control_t public;
-
+
/**
- * Job
+ * Job
*/
callback_job_t *job;
};
@@ -56,7 +56,7 @@ static void write_fifo(private_uci_control_t *this, char *format, ...)
{
va_list args;
FILE *out;
-
+
out = fopen(FIFO_FILE, "w");
if (out)
{
@@ -83,7 +83,7 @@ static void status(private_uci_control_t *this, char *name)
peer_cfg_t *peer_cfg;
char buf[2048];
FILE *out = NULL;
-
+
configs = charon->backends->create_peer_cfg_enumerator(charon->backends,
NULL, NULL, NULL, NULL);
while (configs->enumerate(configs, &peer_cfg))
@@ -109,7 +109,7 @@ static void status(private_uci_control_t *this, char *name)
}
fprintf(out, "%-8s %-20D %-16H ", ike_sa->get_name(ike_sa),
ike_sa->get_other_id(ike_sa), ike_sa->get_other_host(ike_sa));
-
+
children = ike_sa->create_child_sa_iterator(ike_sa);
while (children->iterate(children, (void**)&child_sa))
{
@@ -141,7 +141,7 @@ static void initiate(private_uci_control_t *this, char *name)
peer_cfg_t *peer_cfg;
child_cfg_t *child_cfg;
enumerator_t *enumerator;
-
+
peer_cfg = charon->backends->get_peer_cfg_by_name(charon->backends, name);
if (peer_cfg)
{
@@ -173,7 +173,7 @@ static void terminate(private_uci_control_t *this, char *name)
enumerator_t *enumerator;
ike_sa_t *ike_sa;
u_int id;
-
+
enumerator = charon->controller->create_ike_sa_enumerator(charon->controller);
while (enumerator->enumerate(enumerator, &ike_sa))
{
@@ -197,7 +197,7 @@ static void terminate(private_uci_control_t *this, char *name)
static void process(private_uci_control_t *this, char *message)
{
enumerator_t* enumerator;
-
+
enumerator = enumerator_create_token(message, " \n", "");
if (enumerator->enumerate(enumerator, &message))
{
@@ -217,7 +217,7 @@ static void process(private_uci_control_t *this, char *message)
{
initiate(this, message);
}
- else if (streq(message, "down") &&
+ else if (streq(message, "down") &&
enumerator->enumerate(enumerator, &message))
{
terminate(this, message);
@@ -237,13 +237,14 @@ static void process(private_uci_control_t *this, char *message)
static job_requeue_t receive(private_uci_control_t *this)
{
char message[128];
- int oldstate, len;
+ int len;
+ bool oldstate;
FILE *in;
-
+
memset(message, 0, sizeof(message));
- pthread_setcancelstate(PTHREAD_CANCEL_ENABLE, &oldstate);
+ oldstate = thread_cancelability(TRUE);
in = fopen(FIFO_FILE, "r");
- pthread_setcancelstate(oldstate, NULL);
+ thread_cancelability(oldstate);
if (in)
{
len = fread(message, 1, sizeof(message) - 1, in);
@@ -280,9 +281,9 @@ static void destroy(private_uci_control_t *this)
uci_control_t *uci_control_create()
{
private_uci_control_t *this = malloc_thing(private_uci_control_t);
-
+
this->public.destroy = (void(*)(uci_control_t*))destroy;
-
+
unlink(FIFO_FILE);
if (mkfifo(FIFO_FILE, S_IRUSR|S_IWUSR) != 0)
{
diff --git a/src/charon/plugins/uci/uci_control.h b/src/charon/plugins/uci/uci_control.h
index 527ed82e7..794220aa1 100644
--- a/src/charon/plugins/uci/uci_control.h
+++ b/src/charon/plugins/uci/uci_control.h
@@ -27,7 +27,7 @@ typedef struct uci_control_t uci_control_t;
* UCI control interface, uses a simple FIFO file
*/
struct uci_control_t {
-
+
/**
* Destroy the controller
*/
diff --git a/src/charon/plugins/uci/uci_creds.c b/src/charon/plugins/uci/uci_creds.c
index 05bc6e109..4d664feb2 100644
--- a/src/charon/plugins/uci/uci_creds.c
+++ b/src/charon/plugins/uci/uci_creds.c
@@ -31,7 +31,7 @@ struct private_uci_creds_t {
* Public part
*/
uci_creds_t public;
-
+
/**
* UCI parser context
*/
@@ -66,7 +66,7 @@ static bool shared_enumerator_enumerate(shared_enumerator_t *this,
local_id = "%any";
remote_id = "%any";
psk = NULL;
-
+
if (!this->inner->enumerate(this->inner, NULL,
&local_id, &remote_id, &psk))
{
@@ -122,23 +122,23 @@ static void shared_enumerator_destroy(shared_enumerator_t *this)
*/
static enumerator_t* create_shared_enumerator(private_uci_creds_t *this,
shared_key_type_t type,
- identification_t *me,
+ identification_t *me,
identification_t *other)
{
shared_enumerator_t *e;
-
+
if (type != SHARED_IKE)
{
return NULL;
}
-
+
e = malloc_thing(shared_enumerator_t);
e->current = NULL;
e->public.enumerate = (void*)shared_enumerator_enumerate;
e->public.destroy = (void*)shared_enumerator_destroy;
e->me = me;
e->other = other;
- e->inner = this->parser->create_section_enumerator(this->parser,
+ e->inner = this->parser->create_section_enumerator(this->parser,
"local_id", "remote_id", "psk", NULL);
if (!e->inner)
{
@@ -166,7 +166,7 @@ uci_creds_t *uci_creds_create(uci_parser_t *parser)
this->public.credential_set.create_cdp_enumerator = (enumerator_t*(*) (credential_set_t *,certificate_type_t, identification_t *))return_null;
this->public.credential_set.cache_cert = (void (*)(credential_set_t *, certificate_t *))nop;
this->public.destroy = (void(*) (uci_creds_t*))destroy;
-
+
this->parser = parser;
return &this->public;
diff --git a/src/charon/plugins/uci/uci_creds.h b/src/charon/plugins/uci/uci_creds.h
index de50984a9..a283ed9f5 100644
--- a/src/charon/plugins/uci/uci_creds.h
+++ b/src/charon/plugins/uci/uci_creds.h
@@ -37,11 +37,11 @@ struct uci_creds_t {
* Implements credential set interface.
*/
credential_set_t credential_set;
-
+
/**
* Destroy the backend.
*/
- void (*destroy)(uci_creds_t *this);
+ void (*destroy)(uci_creds_t *this);
};
/**
diff --git a/src/charon/plugins/uci/uci_parser.c b/src/charon/plugins/uci/uci_parser.c
index f994e36f7..6de55d218 100644
--- a/src/charon/plugins/uci/uci_parser.c
+++ b/src/charon/plugins/uci/uci_parser.c
@@ -32,7 +32,7 @@ struct private_uci_parser_t {
* Public part
*/
uci_parser_t public;
-
+
/**
* UCI package name this parser reads
*/
@@ -66,12 +66,12 @@ static bool section_enumerator_enumerate(section_enumerator_t *this, ...)
char **value;
va_list args;
int i;
-
+
if (&this->current->list == this->list)
{
return FALSE;
}
-
+
va_start(args, this);
value = va_arg(args, char**);
@@ -87,19 +87,19 @@ static bool section_enumerator_enumerate(section_enumerator_t *this, ...)
*value = uci_to_section(this->current)->type;
}
}
-
+
/* followed by keyword parameters */
for (i = 0; this->keywords[i]; i++)
{
value = va_arg(args, char**);
if (value && uci_lookup(this->ctx, &element, this->package,
- this->current->name, this->keywords[i]) == UCI_OK)
+ this->current->name, this->keywords[i]) == UCI_OK)
{
*value = uci_to_option(element)->value;
}
}
va_end(args);
-
+
this->current = list_to_element(this->current->list.next);
return TRUE;
}
@@ -121,7 +121,7 @@ static enumerator_t* create_section_enumerator(private_uci_parser_t *this, ...)
section_enumerator_t *e;
va_list args;
int i;
-
+
/* allocate enumerator large enought to hold keyword pointers */
i = 1;
va_start(args, this);
@@ -133,16 +133,16 @@ static enumerator_t* create_section_enumerator(private_uci_parser_t *this, ...)
e = malloc(sizeof(section_enumerator_t) + sizeof(char*) * i);
i = 0;
va_start(args, this);
- do
+ do
{
e->keywords[i] = va_arg(args, char*);
}
while (e->keywords[i++]);
va_end(args);
-
+
e->public.enumerate = (void*)section_enumerator_enumerate;
e->public.destroy = (void*)section_enumerator_destroy;
-
+
/* load uci context */
e->ctx = uci_alloc_context();
if (uci_load(e->ctx, this->package, &e->package) != UCI_OK)
@@ -178,9 +178,9 @@ uci_parser_t *uci_parser_create(char *package)
this->public.create_section_enumerator = (enumerator_t*(*)(uci_parser_t*, ...))create_section_enumerator;
this->public.destroy = (void(*)(uci_parser_t*))destroy;
-
+
this->package = strdup(package);
-
+
return &this->public;
}
diff --git a/src/charon/plugins/uci/uci_parser.h b/src/charon/plugins/uci/uci_parser.h
index ef3d7b0f5..7217e507a 100644
--- a/src/charon/plugins/uci/uci_parser.h
+++ b/src/charon/plugins/uci/uci_parser.h
@@ -41,11 +41,11 @@ struct uci_parser_t {
* @return enumerator over sections
*/
enumerator_t* (*create_section_enumerator)(uci_parser_t *this, ...);
-
+
/**
* Destroy the parser.
*/
- void (*destroy)(uci_parser_t *this);
+ void (*destroy)(uci_parser_t *this);
};
/**
diff --git a/src/charon/plugins/uci/uci_plugin.c b/src/charon/plugins/uci/uci_plugin.c
index 3ab4c92f8..2a79b9109 100644
--- a/src/charon/plugins/uci/uci_plugin.c
+++ b/src/charon/plugins/uci/uci_plugin.c
@@ -36,17 +36,17 @@ struct private_uci_plugin_t {
* implements plugin interface
*/
uci_plugin_t public;
-
+
/**
* UCI configuration backend
*/
uci_config_t *config;
-
+
/**
* UCI credential set implementation
*/
uci_creds_t *creds;
-
+
/**
* UCI parser wrapper
*/
@@ -78,16 +78,16 @@ static void destroy(private_uci_plugin_t *this)
plugin_t *plugin_create()
{
private_uci_plugin_t *this = malloc_thing(private_uci_plugin_t);
-
+
this->public.plugin.destroy = (void(*)(plugin_t*))destroy;
-
+
this->parser = uci_parser_create(UCI_PACKAGE);
this->config = uci_config_create(this->parser);
this->creds = uci_creds_create(this->parser);
this->control = uci_control_create();
charon->backends->add_backend(charon->backends, &this->config->backend);
charon->credentials->add_set(charon->credentials, &this->creds->credential_set);
-
+
return &this->public.plugin;
}
diff --git a/src/charon/plugins/unit_tester/Makefile.in b/src/charon/plugins/unit_tester/Makefile.in
index 0bf0cf301..9926c43e8 100644
--- a/src/charon/plugins/unit_tester/Makefile.in
+++ b/src/charon/plugins/unit_tester/Makefile.in
@@ -1,8 +1,9 @@
-# Makefile.in generated by automake 1.10.2 from Makefile.am.
+# Makefile.in generated by automake 1.11 from Makefile.am.
# @configure_input@
# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,
-# 2003, 2004, 2005, 2006, 2007, 2008 Free Software Foundation, Inc.
+# 2003, 2004, 2005, 2006, 2007, 2008, 2009 Free Software Foundation,
+# Inc.
# This Makefile.in is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.
@@ -16,8 +17,9 @@
VPATH = @srcdir@
pkgdatadir = $(datadir)/@PACKAGE@
-pkglibdir = $(libdir)/@PACKAGE@
pkgincludedir = $(includedir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkglibexecdir = $(libexecdir)/@PACKAGE@
am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
install_sh_DATA = $(install_sh) -c -m 644
install_sh_PROGRAM = $(install_sh) -c
@@ -35,19 +37,41 @@ host_triplet = @host@
subdir = src/charon/plugins/unit_tester
DIST_COMMON = $(srcdir)/Makefile.am $(srcdir)/Makefile.in
ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
-am__aclocal_m4_deps = $(top_srcdir)/configure.in
+am__aclocal_m4_deps = $(top_srcdir)/m4/config/libtool.m4 \
+ $(top_srcdir)/m4/config/ltoptions.m4 \
+ $(top_srcdir)/m4/config/ltsugar.m4 \
+ $(top_srcdir)/m4/config/ltversion.m4 \
+ $(top_srcdir)/m4/config/lt~obsolete.m4 \
+ $(top_srcdir)/m4/macros/with.m4 \
+ $(top_srcdir)/m4/macros/enable-disable.m4 \
+ $(top_srcdir)/configure.in
am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
$(ACLOCAL_M4)
mkinstalldirs = $(install_sh) -d
CONFIG_CLEAN_FILES =
+CONFIG_CLEAN_VPATH_FILES =
am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
am__vpath_adj = case $$p in \
$(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
*) f=$$p;; \
esac;
-am__strip_dir = `echo $$p | sed -e 's|^.*/||'`;
+am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
+am__install_max = 40
+am__nobase_strip_setup = \
+ srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
+am__nobase_strip = \
+ for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
+am__nobase_list = $(am__nobase_strip_setup); \
+ for p in $$list; do echo "$$p $$p"; done | \
+ sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
+ $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
+ if (++n[$$2] == $(am__install_max)) \
+ { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
+ END { for (dir in files) print dir, files[dir] }'
+am__base_list = \
+ sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
+ sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
am__installdirs = "$(DESTDIR)$(plugindir)"
-pluginLTLIBRARIES_INSTALL = $(INSTALL)
LTLIBRARIES = $(plugin_LTLIBRARIES)
libstrongswan_unit_tester_la_LIBADD =
am_libstrongswan_unit_tester_la_OBJECTS = unit_tester.lo \
@@ -64,6 +88,7 @@ libstrongswan_unit_tester_la_LINK = $(LIBTOOL) --tag=CC \
DEFAULT_INCLUDES = -I.@am__isrc@
depcomp = $(SHELL) $(top_srcdir)/depcomp
am__depfiles_maybe = depfiles
+am__mv = mv -f
COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
LTCOMPILE = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
@@ -111,25 +136,22 @@ INSTALL_DATA = @INSTALL_DATA@
INSTALL_PROGRAM = @INSTALL_PROGRAM@
INSTALL_SCRIPT = @INSTALL_SCRIPT@
INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
-IPSEC_ROUTING_TABLE = @IPSEC_ROUTING_TABLE@
-IPSEC_ROUTING_TABLE_PRIO = @IPSEC_ROUTING_TABLE_PRIO@
LD = @LD@
LDFLAGS = @LDFLAGS@
LEX = @LEX@
LEXLIB = @LEXLIB@
LEX_OUTPUT_ROOT = @LEX_OUTPUT_ROOT@
-LIBGCRYPT_CFLAGS = @LIBGCRYPT_CFLAGS@
-LIBGCRYPT_CONFIG = @LIBGCRYPT_CONFIG@
-LIBGCRYPT_LIBS = @LIBGCRYPT_LIBS@
LIBOBJS = @LIBOBJS@
LIBS = @LIBS@
LIBTOOL = @LIBTOOL@
-LINUX_HEADERS = @LINUX_HEADERS@
LIPO = @LIPO@
LN_S = @LN_S@
LTLIBOBJS = @LTLIBOBJS@
MAKEINFO = @MAKEINFO@
MKDIR_P = @MKDIR_P@
+MYSQLCFLAG = @MYSQLCFLAG@
+MYSQLCONFIG = @MYSQLCONFIG@
+MYSQLLIB = @MYSQLLIB@
NM = @NM@
NMEDIT = @NMEDIT@
OBJDUMP = @OBJDUMP@
@@ -141,11 +163,14 @@ PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
PACKAGE_NAME = @PACKAGE_NAME@
PACKAGE_STRING = @PACKAGE_STRING@
PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_URL = @PACKAGE_URL@
PACKAGE_VERSION = @PACKAGE_VERSION@
PATH_SEPARATOR = @PATH_SEPARATOR@
PERL = @PERL@
PKG_CONFIG = @PKG_CONFIG@
+PTHREADLIB = @PTHREADLIB@
RANLIB = @RANLIB@
+RTLIB = @RTLIB@
RUBY = @RUBY@
RUBYINCLUDE = @RUBYINCLUDE@
SED = @SED@
@@ -174,9 +199,9 @@ build_cpu = @build_cpu@
build_os = @build_os@
build_vendor = @build_vendor@
builddir = @builddir@
-confdir = @confdir@
datadir = @datadir@
datarootdir = @datarootdir@
+default_pkcs11 = @default_pkcs11@
docdir = @docdir@
dvidir = @dvidir@
exec_prefix = @exec_prefix@
@@ -199,7 +224,7 @@ ipsecuser = @ipsecuser@
libdir = @libdir@
libexecdir = @libexecdir@
libstrongswan_plugins = @libstrongswan_plugins@
-linuxdir = @linuxdir@
+linux_headers = @linux_headers@
localedir = @localedir@
localstatedir = @localstatedir@
lt_ECHO = @lt_ECHO@
@@ -207,6 +232,7 @@ mandir = @mandir@
mkdir_p = @mkdir_p@
nm_CFLAGS = @nm_CFLAGS@
nm_LIBS = @nm_LIBS@
+nm_ca_dir = @nm_ca_dir@
oldincludedir = @oldincludedir@
pdfdir = @pdfdir@
piddir = @piddir@
@@ -215,10 +241,12 @@ pluto_plugins = @pluto_plugins@
prefix = @prefix@
program_transform_name = @program_transform_name@
psdir = @psdir@
+random_device = @random_device@
resolv_conf = @resolv_conf@
+routing_table = @routing_table@
+routing_table_prio = @routing_table_prio@
sbindir = @sbindir@
sharedstatedir = @sharedstatedir@
-simreader = @simreader@
srcdir = @srcdir@
strongswan_conf = @strongswan_conf@
sysconfdir = @sysconfdir@
@@ -226,6 +254,7 @@ target_alias = @target_alias@
top_build_prefix = @top_build_prefix@
top_builddir = @top_builddir@
top_srcdir = @top_srcdir@
+urandom_device = @urandom_device@
xml_CFLAGS = @xml_CFLAGS@
xml_LIBS = @xml_LIBS@
INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
@@ -260,9 +289,9 @@ $(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps)
exit 1;; \
esac; \
done; \
- echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/charon/plugins/unit_tester/Makefile'; \
- cd $(top_srcdir) && \
- $(AUTOMAKE) --gnu src/charon/plugins/unit_tester/Makefile
+ echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/charon/plugins/unit_tester/Makefile'; \
+ $(am__cd) $(top_srcdir) && \
+ $(AUTOMAKE) --gnu src/charon/plugins/unit_tester/Makefile
.PRECIOUS: Makefile
Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
@case '$?' in \
@@ -280,23 +309,28 @@ $(top_srcdir)/configure: $(am__configure_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
$(ACLOCAL_M4): $(am__aclocal_m4_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(am__aclocal_m4_deps):
install-pluginLTLIBRARIES: $(plugin_LTLIBRARIES)
@$(NORMAL_INSTALL)
test -z "$(plugindir)" || $(MKDIR_P) "$(DESTDIR)$(plugindir)"
- @list='$(plugin_LTLIBRARIES)'; for p in $$list; do \
+ @list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+ list2=; for p in $$list; do \
if test -f $$p; then \
- f=$(am__strip_dir) \
- echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(pluginLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) '$$p' '$(DESTDIR)$(plugindir)/$$f'"; \
- $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(pluginLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) "$$p" "$(DESTDIR)$(plugindir)/$$f"; \
+ list2="$$list2 $$p"; \
else :; fi; \
- done
+ done; \
+ test -z "$$list2" || { \
+ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(plugindir)'"; \
+ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(plugindir)"; \
+ }
uninstall-pluginLTLIBRARIES:
@$(NORMAL_UNINSTALL)
- @list='$(plugin_LTLIBRARIES)'; for p in $$list; do \
- p=$(am__strip_dir) \
- echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$p'"; \
- $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$p"; \
+ @list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+ for p in $$list; do \
+ $(am__strip_dir) \
+ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$f'"; \
+ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$f"; \
done
clean-pluginLTLIBRARIES:
@@ -333,115 +367,115 @@ distclean-compile:
.c.o:
@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(COMPILE) -c $<
.c.obj:
@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(COMPILE) -c `$(CYGPATH_W) '$<'`
.c.lo:
@am__fastdepCC_TRUE@ $(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(LTCOMPILE) -c -o $@ $<
test_enumerator.lo: tests/test_enumerator.c
-@am__fastdepCC_TRUE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT test_enumerator.lo -MD -MP -MF $(DEPDIR)/test_enumerator.Tpo -c -o test_enumerator.lo `test -f 'tests/test_enumerator.c' || echo '$(srcdir)/'`tests/test_enumerator.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/test_enumerator.Tpo $(DEPDIR)/test_enumerator.Plo
+@am__fastdepCC_TRUE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT test_enumerator.lo -MD -MP -MF $(DEPDIR)/test_enumerator.Tpo -c -o test_enumerator.lo `test -f 'tests/test_enumerator.c' || echo '$(srcdir)/'`tests/test_enumerator.c
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/test_enumerator.Tpo $(DEPDIR)/test_enumerator.Plo
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='tests/test_enumerator.c' object='test_enumerator.lo' libtool=yes @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o test_enumerator.lo `test -f 'tests/test_enumerator.c' || echo '$(srcdir)/'`tests/test_enumerator.c
+@am__fastdepCC_FALSE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o test_enumerator.lo `test -f 'tests/test_enumerator.c' || echo '$(srcdir)/'`tests/test_enumerator.c
test_auth_info.lo: tests/test_auth_info.c
-@am__fastdepCC_TRUE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT test_auth_info.lo -MD -MP -MF $(DEPDIR)/test_auth_info.Tpo -c -o test_auth_info.lo `test -f 'tests/test_auth_info.c' || echo '$(srcdir)/'`tests/test_auth_info.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/test_auth_info.Tpo $(DEPDIR)/test_auth_info.Plo
+@am__fastdepCC_TRUE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT test_auth_info.lo -MD -MP -MF $(DEPDIR)/test_auth_info.Tpo -c -o test_auth_info.lo `test -f 'tests/test_auth_info.c' || echo '$(srcdir)/'`tests/test_auth_info.c
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/test_auth_info.Tpo $(DEPDIR)/test_auth_info.Plo
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='tests/test_auth_info.c' object='test_auth_info.lo' libtool=yes @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o test_auth_info.lo `test -f 'tests/test_auth_info.c' || echo '$(srcdir)/'`tests/test_auth_info.c
+@am__fastdepCC_FALSE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o test_auth_info.lo `test -f 'tests/test_auth_info.c' || echo '$(srcdir)/'`tests/test_auth_info.c
test_curl.lo: tests/test_curl.c
-@am__fastdepCC_TRUE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT test_curl.lo -MD -MP -MF $(DEPDIR)/test_curl.Tpo -c -o test_curl.lo `test -f 'tests/test_curl.c' || echo '$(srcdir)/'`tests/test_curl.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/test_curl.Tpo $(DEPDIR)/test_curl.Plo
+@am__fastdepCC_TRUE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT test_curl.lo -MD -MP -MF $(DEPDIR)/test_curl.Tpo -c -o test_curl.lo `test -f 'tests/test_curl.c' || echo '$(srcdir)/'`tests/test_curl.c
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/test_curl.Tpo $(DEPDIR)/test_curl.Plo
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='tests/test_curl.c' object='test_curl.lo' libtool=yes @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o test_curl.lo `test -f 'tests/test_curl.c' || echo '$(srcdir)/'`tests/test_curl.c
+@am__fastdepCC_FALSE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o test_curl.lo `test -f 'tests/test_curl.c' || echo '$(srcdir)/'`tests/test_curl.c
test_mysql.lo: tests/test_mysql.c
-@am__fastdepCC_TRUE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT test_mysql.lo -MD -MP -MF $(DEPDIR)/test_mysql.Tpo -c -o test_mysql.lo `test -f 'tests/test_mysql.c' || echo '$(srcdir)/'`tests/test_mysql.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/test_mysql.Tpo $(DEPDIR)/test_mysql.Plo
+@am__fastdepCC_TRUE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT test_mysql.lo -MD -MP -MF $(DEPDIR)/test_mysql.Tpo -c -o test_mysql.lo `test -f 'tests/test_mysql.c' || echo '$(srcdir)/'`tests/test_mysql.c
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/test_mysql.Tpo $(DEPDIR)/test_mysql.Plo
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='tests/test_mysql.c' object='test_mysql.lo' libtool=yes @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o test_mysql.lo `test -f 'tests/test_mysql.c' || echo '$(srcdir)/'`tests/test_mysql.c
+@am__fastdepCC_FALSE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o test_mysql.lo `test -f 'tests/test_mysql.c' || echo '$(srcdir)/'`tests/test_mysql.c
test_sqlite.lo: tests/test_sqlite.c
-@am__fastdepCC_TRUE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT test_sqlite.lo -MD -MP -MF $(DEPDIR)/test_sqlite.Tpo -c -o test_sqlite.lo `test -f 'tests/test_sqlite.c' || echo '$(srcdir)/'`tests/test_sqlite.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/test_sqlite.Tpo $(DEPDIR)/test_sqlite.Plo
+@am__fastdepCC_TRUE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT test_sqlite.lo -MD -MP -MF $(DEPDIR)/test_sqlite.Tpo -c -o test_sqlite.lo `test -f 'tests/test_sqlite.c' || echo '$(srcdir)/'`tests/test_sqlite.c
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/test_sqlite.Tpo $(DEPDIR)/test_sqlite.Plo
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='tests/test_sqlite.c' object='test_sqlite.lo' libtool=yes @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o test_sqlite.lo `test -f 'tests/test_sqlite.c' || echo '$(srcdir)/'`tests/test_sqlite.c
+@am__fastdepCC_FALSE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o test_sqlite.lo `test -f 'tests/test_sqlite.c' || echo '$(srcdir)/'`tests/test_sqlite.c
test_mutex.lo: tests/test_mutex.c
-@am__fastdepCC_TRUE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT test_mutex.lo -MD -MP -MF $(DEPDIR)/test_mutex.Tpo -c -o test_mutex.lo `test -f 'tests/test_mutex.c' || echo '$(srcdir)/'`tests/test_mutex.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/test_mutex.Tpo $(DEPDIR)/test_mutex.Plo
+@am__fastdepCC_TRUE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT test_mutex.lo -MD -MP -MF $(DEPDIR)/test_mutex.Tpo -c -o test_mutex.lo `test -f 'tests/test_mutex.c' || echo '$(srcdir)/'`tests/test_mutex.c
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/test_mutex.Tpo $(DEPDIR)/test_mutex.Plo
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='tests/test_mutex.c' object='test_mutex.lo' libtool=yes @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o test_mutex.lo `test -f 'tests/test_mutex.c' || echo '$(srcdir)/'`tests/test_mutex.c
+@am__fastdepCC_FALSE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o test_mutex.lo `test -f 'tests/test_mutex.c' || echo '$(srcdir)/'`tests/test_mutex.c
test_rsa_gen.lo: tests/test_rsa_gen.c
-@am__fastdepCC_TRUE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT test_rsa_gen.lo -MD -MP -MF $(DEPDIR)/test_rsa_gen.Tpo -c -o test_rsa_gen.lo `test -f 'tests/test_rsa_gen.c' || echo '$(srcdir)/'`tests/test_rsa_gen.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/test_rsa_gen.Tpo $(DEPDIR)/test_rsa_gen.Plo
+@am__fastdepCC_TRUE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT test_rsa_gen.lo -MD -MP -MF $(DEPDIR)/test_rsa_gen.Tpo -c -o test_rsa_gen.lo `test -f 'tests/test_rsa_gen.c' || echo '$(srcdir)/'`tests/test_rsa_gen.c
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/test_rsa_gen.Tpo $(DEPDIR)/test_rsa_gen.Plo
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='tests/test_rsa_gen.c' object='test_rsa_gen.lo' libtool=yes @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o test_rsa_gen.lo `test -f 'tests/test_rsa_gen.c' || echo '$(srcdir)/'`tests/test_rsa_gen.c
+@am__fastdepCC_FALSE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o test_rsa_gen.lo `test -f 'tests/test_rsa_gen.c' || echo '$(srcdir)/'`tests/test_rsa_gen.c
test_cert.lo: tests/test_cert.c
-@am__fastdepCC_TRUE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT test_cert.lo -MD -MP -MF $(DEPDIR)/test_cert.Tpo -c -o test_cert.lo `test -f 'tests/test_cert.c' || echo '$(srcdir)/'`tests/test_cert.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/test_cert.Tpo $(DEPDIR)/test_cert.Plo
+@am__fastdepCC_TRUE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT test_cert.lo -MD -MP -MF $(DEPDIR)/test_cert.Tpo -c -o test_cert.lo `test -f 'tests/test_cert.c' || echo '$(srcdir)/'`tests/test_cert.c
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/test_cert.Tpo $(DEPDIR)/test_cert.Plo
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='tests/test_cert.c' object='test_cert.lo' libtool=yes @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o test_cert.lo `test -f 'tests/test_cert.c' || echo '$(srcdir)/'`tests/test_cert.c
+@am__fastdepCC_FALSE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o test_cert.lo `test -f 'tests/test_cert.c' || echo '$(srcdir)/'`tests/test_cert.c
test_med_db.lo: tests/test_med_db.c
-@am__fastdepCC_TRUE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT test_med_db.lo -MD -MP -MF $(DEPDIR)/test_med_db.Tpo -c -o test_med_db.lo `test -f 'tests/test_med_db.c' || echo '$(srcdir)/'`tests/test_med_db.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/test_med_db.Tpo $(DEPDIR)/test_med_db.Plo
+@am__fastdepCC_TRUE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT test_med_db.lo -MD -MP -MF $(DEPDIR)/test_med_db.Tpo -c -o test_med_db.lo `test -f 'tests/test_med_db.c' || echo '$(srcdir)/'`tests/test_med_db.c
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/test_med_db.Tpo $(DEPDIR)/test_med_db.Plo
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='tests/test_med_db.c' object='test_med_db.lo' libtool=yes @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o test_med_db.lo `test -f 'tests/test_med_db.c' || echo '$(srcdir)/'`tests/test_med_db.c
+@am__fastdepCC_FALSE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o test_med_db.lo `test -f 'tests/test_med_db.c' || echo '$(srcdir)/'`tests/test_med_db.c
test_chunk.lo: tests/test_chunk.c
-@am__fastdepCC_TRUE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT test_chunk.lo -MD -MP -MF $(DEPDIR)/test_chunk.Tpo -c -o test_chunk.lo `test -f 'tests/test_chunk.c' || echo '$(srcdir)/'`tests/test_chunk.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/test_chunk.Tpo $(DEPDIR)/test_chunk.Plo
+@am__fastdepCC_TRUE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT test_chunk.lo -MD -MP -MF $(DEPDIR)/test_chunk.Tpo -c -o test_chunk.lo `test -f 'tests/test_chunk.c' || echo '$(srcdir)/'`tests/test_chunk.c
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/test_chunk.Tpo $(DEPDIR)/test_chunk.Plo
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='tests/test_chunk.c' object='test_chunk.lo' libtool=yes @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o test_chunk.lo `test -f 'tests/test_chunk.c' || echo '$(srcdir)/'`tests/test_chunk.c
+@am__fastdepCC_FALSE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o test_chunk.lo `test -f 'tests/test_chunk.c' || echo '$(srcdir)/'`tests/test_chunk.c
test_pool.lo: tests/test_pool.c
-@am__fastdepCC_TRUE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT test_pool.lo -MD -MP -MF $(DEPDIR)/test_pool.Tpo -c -o test_pool.lo `test -f 'tests/test_pool.c' || echo '$(srcdir)/'`tests/test_pool.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/test_pool.Tpo $(DEPDIR)/test_pool.Plo
+@am__fastdepCC_TRUE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT test_pool.lo -MD -MP -MF $(DEPDIR)/test_pool.Tpo -c -o test_pool.lo `test -f 'tests/test_pool.c' || echo '$(srcdir)/'`tests/test_pool.c
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/test_pool.Tpo $(DEPDIR)/test_pool.Plo
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='tests/test_pool.c' object='test_pool.lo' libtool=yes @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o test_pool.lo `test -f 'tests/test_pool.c' || echo '$(srcdir)/'`tests/test_pool.c
+@am__fastdepCC_FALSE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o test_pool.lo `test -f 'tests/test_pool.c' || echo '$(srcdir)/'`tests/test_pool.c
test_agent.lo: tests/test_agent.c
-@am__fastdepCC_TRUE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT test_agent.lo -MD -MP -MF $(DEPDIR)/test_agent.Tpo -c -o test_agent.lo `test -f 'tests/test_agent.c' || echo '$(srcdir)/'`tests/test_agent.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/test_agent.Tpo $(DEPDIR)/test_agent.Plo
+@am__fastdepCC_TRUE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT test_agent.lo -MD -MP -MF $(DEPDIR)/test_agent.Tpo -c -o test_agent.lo `test -f 'tests/test_agent.c' || echo '$(srcdir)/'`tests/test_agent.c
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/test_agent.Tpo $(DEPDIR)/test_agent.Plo
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='tests/test_agent.c' object='test_agent.lo' libtool=yes @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o test_agent.lo `test -f 'tests/test_agent.c' || echo '$(srcdir)/'`tests/test_agent.c
+@am__fastdepCC_FALSE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o test_agent.lo `test -f 'tests/test_agent.c' || echo '$(srcdir)/'`tests/test_agent.c
test_id.lo: tests/test_id.c
-@am__fastdepCC_TRUE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT test_id.lo -MD -MP -MF $(DEPDIR)/test_id.Tpo -c -o test_id.lo `test -f 'tests/test_id.c' || echo '$(srcdir)/'`tests/test_id.c
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/test_id.Tpo $(DEPDIR)/test_id.Plo
+@am__fastdepCC_TRUE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT test_id.lo -MD -MP -MF $(DEPDIR)/test_id.Tpo -c -o test_id.lo `test -f 'tests/test_id.c' || echo '$(srcdir)/'`tests/test_id.c
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/test_id.Tpo $(DEPDIR)/test_id.Plo
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='tests/test_id.c' object='test_id.lo' libtool=yes @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o test_id.lo `test -f 'tests/test_id.c' || echo '$(srcdir)/'`tests/test_id.c
+@am__fastdepCC_FALSE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o test_id.lo `test -f 'tests/test_id.c' || echo '$(srcdir)/'`tests/test_id.c
mostlyclean-libtool:
-rm -f *.lo
@@ -461,7 +495,7 @@ tags: TAGS
TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
$(TAGS_FILES) $(LISP)
- tags=; \
+ set x; \
here=`pwd`; \
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
unique=`for i in $$list; do \
@@ -469,29 +503,34 @@ TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
- if test -z "$(ETAGS_ARGS)$$tags$$unique"; then :; else \
+ shift; \
+ if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
test -n "$$unique" || unique=$$empty_fix; \
- $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
- $$tags $$unique; \
+ if test $$# -gt 0; then \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ "$$@" $$unique; \
+ else \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ $$unique; \
+ fi; \
fi
ctags: CTAGS
CTAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
$(TAGS_FILES) $(LISP)
- tags=; \
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
unique=`for i in $$list; do \
if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
- test -z "$(CTAGS_ARGS)$$tags$$unique" \
+ test -z "$(CTAGS_ARGS)$$unique" \
|| $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
- $$tags $$unique
+ $$unique
GTAGS:
here=`$(am__cd) $(top_builddir) && pwd` \
- && cd $(top_srcdir) \
- && gtags -i $(GTAGS_ARGS) $$here
+ && $(am__cd) $(top_srcdir) \
+ && gtags -i $(GTAGS_ARGS) "$$here"
distclean-tags:
-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
@@ -512,13 +551,17 @@ distdir: $(DISTFILES)
if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
if test -d $$d/$$file; then \
dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
+ if test -d "$(distdir)/$$file"; then \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+ fi; \
if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
- cp -pR $(srcdir)/$$file $(distdir)$$dir || exit 1; \
+ cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
fi; \
- cp -pR $$d/$$file $(distdir)$$dir || exit 1; \
+ cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
else \
- test -f $(distdir)/$$file \
- || cp -p $$d/$$file $(distdir)/$$file \
+ test -f "$(distdir)/$$file" \
+ || cp -p $$d/$$file "$(distdir)/$$file" \
|| exit 1; \
fi; \
done
@@ -549,6 +592,7 @@ clean-generic:
distclean-generic:
-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+ -test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
maintainer-clean-generic:
@echo "This command is intended for maintainers to use"
@@ -570,6 +614,8 @@ dvi-am:
html: html-am
+html-am:
+
info: info-am
info-am:
@@ -578,18 +624,28 @@ install-data-am: install-pluginLTLIBRARIES
install-dvi: install-dvi-am
+install-dvi-am:
+
install-exec-am:
install-html: install-html-am
+install-html-am:
+
install-info: install-info-am
+install-info-am:
+
install-man:
install-pdf: install-pdf-am
+install-pdf-am:
+
install-ps: install-ps-am
+install-ps-am:
+
installcheck-am:
maintainer-clean: maintainer-clean-am
@@ -628,6 +684,7 @@ uninstall-am: uninstall-pluginLTLIBRARIES
mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \
tags uninstall uninstall-am uninstall-pluginLTLIBRARIES
+
# Tell versions [3.59,3.63) of GNU make to not export all variables.
# Otherwise a system limit (for SysV at least) may be exceeded.
.NOEXPORT:
diff --git a/src/charon/plugins/unit_tester/tests.h b/src/charon/plugins/unit_tester/tests.h
index b99940c1a..96313d390 100644
--- a/src/charon/plugins/unit_tester/tests.h
+++ b/src/charon/plugins/unit_tester/tests.h
@@ -14,7 +14,7 @@
*/
/**
- * @defgroup tests tests
+ * @defgroup tests tests
* @{ @ingroup unit_tester
*/
diff --git a/src/charon/plugins/unit_tester/tests/test_agent.c b/src/charon/plugins/unit_tester/tests/test_agent.c
index fd76b9cf5..baab629be 100644
--- a/src/charon/plugins/unit_tester/tests/test_agent.c
+++ b/src/charon/plugins/unit_tester/tests/test_agent.c
@@ -21,18 +21,18 @@
******************************************************************************/
bool test_agent()
{
- char *path, buf[] = {0x01,0x02,0x03,0x04,0x05,0x06,0x07,0x08};
- chunk_t sig, data = chunk_from_buf(buf);
+ char *path;
+ chunk_t sig, data = chunk_from_chars(0x01,0x02,0x03,0x04,0x05,0x06,0x07,0x08);
private_key_t *private;
public_key_t *public;
-
+
path = getenv("SSH_AUTH_SOCK");
if (!path)
{
DBG1(DBG_CFG, "ssh-agent not found.");
return FALSE;
}
-
+
private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, KEY_RSA,
BUILD_AGENT_SOCKET, path, BUILD_END);
if (!private)
@@ -53,15 +53,15 @@ bool test_agent()
return FALSE;
}
free(sig.ptr);
- buf[1] = 0x01; /* fake it */
+ data.ptr[1] = 0x01; /* fake it */
if (public->verify(public, SIGN_RSA_EMSA_PKCS1_SHA1, data, sig))
{
return FALSE;
}
-
+
private->destroy(private);
public->destroy(public);
-
+
return TRUE;
}
diff --git a/src/charon/plugins/unit_tester/tests/test_auth_info.c b/src/charon/plugins/unit_tester/tests/test_auth_info.c
index 37bdd1087..d6abe7a05 100644
--- a/src/charon/plugins/unit_tester/tests/test_auth_info.c
+++ b/src/charon/plugins/unit_tester/tests/test_auth_info.c
@@ -18,9 +18,7 @@
#include <config/auth_cfg.h>
-char buf[] = {0x01,0x02,0x03,0x04};
-chunk_t chunk = chunk_from_buf(buf);
-char certbuf[] = {
+static chunk_t certchunk = chunk_from_chars(
0x30,0x82,0x02,0xfa,0x30,0x82,0x01,0xe2,0xa0,0x03,0x02,0x01,0x02,0x02,0x10,0x5a,
0xf2,0x65,0xae,0x78,0xff,0x23,0xde,0xf7,0xa6,0xa3,0x94,0x8c,0x3f,0xa0,0xc1,0x30,
0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x05,0x00,0x30,0x39,
@@ -69,8 +67,7 @@ char certbuf[] = {
0xec,0xd2,0x31,0xc6,0x1e,0xb6,0xc0,0x57,0xd9,0xe1,0x14,0x06,0x9b,0xf8,0x51,0x69,
0x47,0xf0,0x9c,0xcd,0x69,0xef,0x8e,0x5f,0x62,0xda,0x10,0xf7,0x3c,0x6d,0x0f,0x33,
0xec,0x6f,0xfd,0x94,0x07,0x16,0x41,0x32,0x06,0xa4,0xe1,0x08,0x31,0x87,
-};
-chunk_t certchunk = chunk_from_buf(certbuf);
+);
/*******************************************************************************
* auth info test
@@ -83,7 +80,7 @@ bool test_auth_cfg()
int round = 0;
void *value;
auth_rule_t type;
-
+
c1 = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
BUILD_BLOB_ASN1_DER, certchunk,
BUILD_END);
@@ -91,7 +88,7 @@ bool test_auth_cfg()
{
return FALSE;
}
-
+
auth->add(auth, AUTH_RULE_SUBJECT_CERT, c1->get_ref(c1));
c2 = auth->get(auth, AUTH_RULE_SUBJECT_CERT);
if (!c2)
@@ -102,7 +99,7 @@ bool test_auth_cfg()
{
return FALSE;
}
-
+
enumerator = auth->create_enumerator(auth);
while (enumerator->enumerate(enumerator, &type, &value))
{
@@ -114,11 +111,11 @@ bool test_auth_cfg()
return FALSE;
}
enumerator->destroy(enumerator);
-
+
auth2 = auth_cfg_create();
auth2->add(auth2, AUTH_RULE_CA_CERT, c1->get_ref(c1));
auth2->merge(auth2, auth, FALSE);
-
+
round = 0;
enumerator = auth2->create_enumerator(auth2);
while (enumerator->enumerate(enumerator, &type, &value))
diff --git a/src/charon/plugins/unit_tester/tests/test_cert.c b/src/charon/plugins/unit_tester/tests/test_cert.c
index 95ab289df..3b00421f8 100644
--- a/src/charon/plugins/unit_tester/tests/test_cert.c
+++ b/src/charon/plugins/unit_tester/tests/test_cert.c
@@ -28,10 +28,10 @@ bool test_cert_x509()
identification_t *issuer, *subject;
u_int32_t serial = htonl(0);
chunk_t encoding;
-
+
issuer = identification_create_from_string("CN=CA, OU=Test, O=strongSwan");
subject = identification_create_from_string("CN=Peer, OU=Test, O=strongSwan");
-
+
ca_key = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, KEY_RSA,
BUILD_KEY_SIZE, 1024, BUILD_END);
peer_key = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, KEY_RSA,
@@ -50,7 +50,7 @@ bool test_cert_x509()
{
return FALSE;
}
-
+
encoding = ca_cert->get_encoding(ca_cert);
parsed = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
BUILD_BLOB_ASN1_DER, encoding,
@@ -65,7 +65,7 @@ bool test_cert_x509()
return FALSE;
}
parsed->destroy(parsed);
-
+
serial = htonl(ntohl(serial) + 1);
public = peer_key->get_public_key(peer_key);
peer_cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
@@ -80,7 +80,7 @@ bool test_cert_x509()
{
return FALSE;
}
-
+
encoding = peer_cert->get_encoding(peer_cert);
parsed = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
BUILD_BLOB_ASN1_DER, encoding,
@@ -95,7 +95,7 @@ bool test_cert_x509()
return FALSE;
}
parsed->destroy(parsed);
-
+
ca_cert->destroy(ca_cert);
ca_key->destroy(ca_key);
peer_cert->destroy(peer_cert);
diff --git a/src/charon/plugins/unit_tester/tests/test_chunk.c b/src/charon/plugins/unit_tester/tests/test_chunk.c
index 5356c1d96..2e0905b2c 100644
--- a/src/charon/plugins/unit_tester/tests/test_chunk.c
+++ b/src/charon/plugins/unit_tester/tests/test_chunk.c
@@ -31,12 +31,12 @@ bool test_chunk_base64()
* BASE64("fooba") = "Zm9vYmE="
* BASE64("foobar") = "Zm9vYmFy"
*/
-
+
typedef struct {
char *in;
char *out;
} testdata_t;
-
+
testdata_t test[] = {
{"", ""},
{"f", "Zg=="},
@@ -47,31 +47,31 @@ bool test_chunk_base64()
{"foobar", "Zm9vYmFy"},
};
int i;
-
+
for (i = 0; i < countof(test); i++)
{
chunk_t out;
-
+
out = chunk_to_base64(chunk_create(test[i].in, strlen(test[i].in)), NULL);
-
+
if (!streq(out.ptr, test[i].out))
{
- DBG1(DBG_CFG, "base64 conversion error - should %s, is %s",
+ DBG1(DBG_CFG, "base64 conversion error - should %s, is %s",
test[i].out, out.ptr);
return FALSE;
}
free(out.ptr);
}
-
+
for (i = 0; i < countof(test); i++)
{
chunk_t out;
-
+
out = chunk_from_base64(chunk_create(test[i].out, strlen(test[i].out)), NULL);
-
+
if (!strneq(out.ptr, test[i].in, out.len))
{
- DBG1(DBG_CFG, "base64 conversion error - should %s, is %#B",
+ DBG1(DBG_CFG, "base64 conversion error - should %s, is %#B",
test[i].in, &out);
return FALSE;
}
diff --git a/src/charon/plugins/unit_tester/tests/test_curl.c b/src/charon/plugins/unit_tester/tests/test_curl.c
index c011617a7..21656a94e 100644
--- a/src/charon/plugins/unit_tester/tests/test_curl.c
+++ b/src/charon/plugins/unit_tester/tests/test_curl.c
@@ -25,14 +25,14 @@
bool test_curl_get()
{
chunk_t chunk;
-
+
if (lib->fetcher->fetch(lib->fetcher, "http://www.strongswan.org",
&chunk, FETCH_END) != SUCCESS)
{
return FALSE;
}
free(chunk.ptr);
-
+
if (lib->fetcher->fetch(lib->fetcher, "http://www.google.com",
&chunk, FETCH_END) != SUCCESS)
{
diff --git a/src/charon/plugins/unit_tester/tests/test_enumerator.c b/src/charon/plugins/unit_tester/tests/test_enumerator.c
index 6898084fc..edbf0f5bb 100644
--- a/src/charon/plugins/unit_tester/tests/test_enumerator.c
+++ b/src/charon/plugins/unit_tester/tests/test_enumerator.c
@@ -23,7 +23,7 @@ bool test_list_remove()
{
void *a = (void*)1, *b = (void*)2;
linked_list_t *list;
-
+
list = linked_list_create();
list->insert_last(list, a);
if (list->remove(list, a, NULL) != 1)
@@ -67,15 +67,15 @@ bool test_enumerate()
void *a = (void*)4, *b = (void*)3, *c = (void*)2, *d = (void*)5, *e = (void*)1;
linked_list_t *list;
enumerator_t *enumerator;
-
+
list = linked_list_create();
-
+
list->insert_last(list, a);
list->insert_first(list, b);
list->insert_first(list, c);
list->insert_last(list, d);
list->insert_first(list, e);
-
+
round = 1;
enumerator = list->create_enumerator(list);
while (enumerator->enumerate(enumerator, &x))
@@ -87,7 +87,7 @@ bool test_enumerate()
round++;
}
enumerator->destroy(enumerator);
-
+
list->destroy(list);
return TRUE;
}
@@ -122,7 +122,7 @@ bool test_enumerate_nested()
void *a = (void*)1, *b = (void*)2, *c = (void*)3, *d = (void*)4, *e = (void*)5;
linked_list_t *list, *l1, *l2, *l3;
enumerator_t *enumerator;
-
+
bad_data = FALSE;
list = linked_list_create();
l1 = linked_list_create();
@@ -131,13 +131,13 @@ bool test_enumerate_nested()
list->insert_last(list, l1);
list->insert_last(list, l2);
list->insert_last(list, l3);
-
+
l1->insert_last(l1, a);
l1->insert_last(l1, b);
l3->insert_last(l3, c);
l3->insert_last(l3, d);
l3->insert_last(l3, e);
-
+
round = 1;
enumerator = enumerator_create_nested(list->create_enumerator(list),
(void*)create_inner, (void*)101, destroy_data);
@@ -150,7 +150,7 @@ bool test_enumerate_nested()
round++;
}
enumerator->destroy(enumerator);
-
+
list->destroy(list);
l1->destroy(l1);
l2->destroy(l2);
@@ -185,16 +185,16 @@ bool test_enumerate_filtered()
void *a = (void*)1, *b = (void*)2, *c = (void*)3, *d = (void*)4, *e = (void*)5;
linked_list_t *list;
enumerator_t *enumerator;
-
+
bad_data = FALSE;
list = linked_list_create();
-
+
list->insert_last(list, a);
list->insert_last(list, b);
list->insert_last(list, c);
list->insert_last(list, d);
list->insert_last(list, e);
-
+
round = 1;
enumerator = enumerator_create_filter(list->create_enumerator(list),
(void*)filter, (void*)101, destroy_data);
@@ -208,7 +208,7 @@ bool test_enumerate_filtered()
round++;
}
enumerator->destroy(enumerator);
-
+
list->destroy(list);
return !bad_data;
}
@@ -216,7 +216,7 @@ bool test_enumerate_filtered()
/*******************************************************************************
* token parser test
******************************************************************************/
-
+
bool test_enumerate_token()
{
enumerator_t *enumerator;
@@ -240,7 +240,7 @@ bool test_enumerate_token()
{"a.b,c", ",.", ""},
{" a b c ", " ", " "},
};
-
+
for (num = 0; num < countof(tests1); num++)
{
i = 0;
@@ -270,7 +270,7 @@ bool test_enumerate_token()
}
enumerator->destroy(enumerator);
}
-
+
for (num = 0; num < countof(tests2); num++)
{
i = 0;
@@ -300,7 +300,7 @@ bool test_enumerate_token()
}
enumerator->destroy(enumerator);
}
-
+
return TRUE;
}
diff --git a/src/charon/plugins/unit_tester/tests/test_id.c b/src/charon/plugins/unit_tester/tests/test_id.c
index a1ef76be8..868a2ca8b 100644
--- a/src/charon/plugins/unit_tester/tests/test_id.c
+++ b/src/charon/plugins/unit_tester/tests/test_id.c
@@ -25,9 +25,9 @@ bool test_id_parts()
id_part_t part;
chunk_t data;
int i = 0;
-
+
id = identification_create_from_string("C=CH, O=strongSwan, CN=tester");
-
+
enumerator = id->create_part_enumerator(id);
while (enumerator->enumerate(enumerator, &part, &data))
{
@@ -75,7 +75,7 @@ static bool test_id_wildcards_has(char *string)
{
identification_t *id;
bool contains;
-
+
id = identification_create_from_string(string);
contains = id->contains_wildcards(id);
id->destroy(id);
@@ -115,7 +115,7 @@ static bool test_id_equals_one(identification_t *a, char *b_str)
{
identification_t *b;
bool equals;
-
+
b = identification_create_from_string(b_str);
equals = a->equals(a, b);
b->destroy(b);
@@ -127,10 +127,10 @@ bool test_id_equals()
identification_t *a;
chunk_t encoding, fuzzed;
int i;
-
+
a = identification_create_from_string(
"C=CH, E=martin@strongswan.org, CN=martin");
-
+
if (!test_id_equals_one(a, "C=CH, E=martin@strongswan.org, CN=martin"))
{
return FALSE;
@@ -153,7 +153,7 @@ bool test_id_equals()
}
encoding = chunk_clone(a->get_encoding(a));
a->destroy(a);
-
+
/* simple fuzzing, increment each byte of encoding */
for (i = 0; i < encoding.len; i++)
{
@@ -171,7 +171,7 @@ bool test_id_equals()
a->destroy(a);
free(fuzzed.ptr);
}
-
+
/* and decrement each byte of encoding */
for (i = 0; i < encoding.len; i++)
{
@@ -201,7 +201,7 @@ static id_match_t test_id_matches_one(identification_t *a, char *b_str)
{
identification_t *b;
id_match_t match;
-
+
b = identification_create_from_string(b_str);
match = a->matches(a, b);
b->destroy(b);
@@ -211,10 +211,10 @@ static id_match_t test_id_matches_one(identification_t *a, char *b_str)
bool test_id_matches()
{
identification_t *a;
-
+
a = identification_create_from_string(
"C=CH, E=martin@strongswan.org, CN=martin");
-
+
if (test_id_matches_one(a, "C=CH, E=martin@strongswan.org, CN=martin")
!= ID_MATCH_PERFECT)
{
diff --git a/src/charon/plugins/unit_tester/tests/test_med_db.c b/src/charon/plugins/unit_tester/tests/test_med_db.c
index 7b4603bd7..7fd78b0bc 100644
--- a/src/charon/plugins/unit_tester/tests/test_med_db.c
+++ b/src/charon/plugins/unit_tester/tests/test_med_db.c
@@ -25,25 +25,27 @@
bool test_med_db()
{
- char keyid_buf[] = {
+ chunk_t found, keyid = chunk_from_chars(
0xed,0x90,0xe6,0x4f,0xec,0xa2,0x1f,0x4b,
0x68,0x97,0x99,0x24,0x22,0xe0,0xde,0x21,
0xb9,0xd6,0x26,0x29
- };
- chunk_t keyid = chunk_from_buf(keyid_buf);
- identification_t *id, *found;
+ );
+ identification_t *id;
enumerator_t *enumerator;
public_key_t *public;
auth_cfg_t *auth;
bool good = FALSE;
-
+
id = identification_create_from_encoding(ID_KEY_ID, keyid);
enumerator = charon->credentials->create_public_enumerator(
charon->credentials, KEY_ANY, id, NULL);
while (enumerator->enumerate(enumerator, &public, &auth))
{
- found = public->get_id(public, ID_PUBKEY_SHA1);
- good = chunk_equals(id->get_encoding(id), found->get_encoding(found));
+ good = public->get_fingerprint(public, KEY_ID_PUBKEY_SHA1, &found);
+ if (good)
+ {
+ good = chunk_equals(id->get_encoding(id), found);
+ }
}
enumerator->destroy(enumerator);
id->destroy(id);
diff --git a/src/charon/plugins/unit_tester/tests/test_mutex.c b/src/charon/plugins/unit_tester/tests/test_mutex.c
index cb315276b..77085cb2f 100644
--- a/src/charon/plugins/unit_tester/tests/test_mutex.c
+++ b/src/charon/plugins/unit_tester/tests/test_mutex.c
@@ -14,7 +14,7 @@
*/
#include <library.h>
-#include <utils/mutex.h>
+#include <threading/mutex.h>
#include <unistd.h>
#include <sched.h>
@@ -46,7 +46,7 @@ static void* run(void* null)
if (locked > 1)
{
failed = TRUE;
- }
+ }
locked--;
mutex->unlock(mutex);
mutex->unlock(mutex);
@@ -64,9 +64,9 @@ bool test_mutex()
{
int i;
pthread_t threads[THREADS];
-
+
mutex = mutex_create(MUTEX_TYPE_RECURSIVE);
-
+
for (i = 0; i < 10; i++)
{
mutex->lock(mutex);
@@ -80,9 +80,9 @@ bool test_mutex()
{
mutex->unlock(mutex);
}
-
+
pthread_barrier_init(&barrier, NULL, THREADS);
-
+
for (i = 0; i < THREADS; i++)
{
pthread_create(&threads[i], NULL, run, NULL);
@@ -92,9 +92,9 @@ bool test_mutex()
pthread_join(threads[i], NULL);
}
pthread_barrier_destroy(&barrier);
-
+
mutex->destroy(mutex);
-
+
return !failed;
}
diff --git a/src/charon/plugins/unit_tester/tests/test_mysql.c b/src/charon/plugins/unit_tester/tests/test_mysql.c
index ff3d38ad8..252441ef8 100644
--- a/src/charon/plugins/unit_tester/tests/test_mysql.c
+++ b/src/charon/plugins/unit_tester/tests/test_mysql.c
@@ -24,14 +24,13 @@ bool test_mysql()
{
database_t *db;
char *txt = "I'm a superduper test";
- char buf[] = {0x01,0x02,0x03,0x04,0x05,0x06,0x07,0x08};
- chunk_t data = chunk_from_buf(buf);
+ chunk_t data = chunk_from_chars(0x01,0x02,0x03,0x04,0x05,0x06,0x07,0x08);
int row;
chunk_t qdata;
char *qtxt;
bool good = FALSE;
enumerator_t *enumerator;
-
+
db = lib->db->create(lib->db, "mysql://testuser:testpass@localhost/test");
if (!db)
{
diff --git a/src/charon/plugins/unit_tester/tests/test_pool.c b/src/charon/plugins/unit_tester/tests/test_pool.c
index ba5330fd9..109c06fda 100644
--- a/src/charon/plugins/unit_tester/tests/test_pool.c
+++ b/src/charon/plugins/unit_tester/tests/test_pool.c
@@ -13,12 +13,10 @@
* for more details.
*/
-#include <sys/time.h>
#include <time.h>
#include <pthread.h>
#include <library.h>
-#include <daemon.h>
#define ALLOCS 1000
#define THREADS 20
@@ -28,33 +26,34 @@ static void* testing(void *thread)
int i;
host_t *addr[ALLOCS];
identification_t *id[ALLOCS];
-
+
/* prepare identities */
for (i = 0; i < ALLOCS; i++)
{
char buf[256];
-
+
snprintf(buf, sizeof(buf), "%d-%d@strongswan.org", (uintptr_t)thread, i);
id[i] = identification_create_from_string(buf);
}
-
+
/* allocate addresses */
for (i = 0; i < ALLOCS; i++)
{
- addr[i] = charon->attributes->acquire_address(charon->attributes,
- "test", id[i], NULL);
+ addr[i] = lib->attributes->acquire_address(lib->attributes,
+ "test", id[i], NULL);
if (!addr[i])
{
return (void*)FALSE;
}
}
-
+
/* release addresses */
for (i = 0; i < ALLOCS; i++)
{
- charon->attributes->release_address(charon->attributes, "test", addr[i], id[i]);
+ lib->attributes->release_address(lib->attributes,
+ "test", addr[i], id[i]);
}
-
+
/* cleanup */
for (i = 0; i < ALLOCS; i++)
{
@@ -73,7 +72,7 @@ bool test_pool()
uintptr_t i;
void *res;
pthread_t thread[THREADS];
-
+
for (i = 0; i < THREADS; i++)
{
if (pthread_create(&thread[i], NULL, (void*)testing, (void*)i) < 0)
diff --git a/src/charon/plugins/unit_tester/tests/test_rsa_gen.c b/src/charon/plugins/unit_tester/tests/test_rsa_gen.c
index 1b7af63ee..59da15644 100644
--- a/src/charon/plugins/unit_tester/tests/test_rsa_gen.c
+++ b/src/charon/plugins/unit_tester/tests/test_rsa_gen.c
@@ -21,12 +21,12 @@
******************************************************************************/
bool test_rsa_gen()
{
- char buf[] = {0x01,0x02,0x03,0x04,0x05,0x06,0x07,0x08};
- chunk_t data = chunk_from_buf(buf), sig, crypt, plain;
+ chunk_t data = chunk_from_chars(0x01,0x02,0x03,0x04,0x05,0x06,0x07,0x08);
+ chunk_t sig, crypt, plain;
private_key_t *private;
public_key_t *public;
u_int key_size;
-
+
for (key_size = 512; key_size <= 2048; key_size *= 2)
{
private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, KEY_RSA,
@@ -83,37 +83,30 @@ bool test_rsa_gen()
return TRUE;
}
-
-/*******************************************************************************
- * Load a subjectPubkeyInfo wrapped key (RSA in this case)
- ******************************************************************************/
-static char public_any[] = {
- 0x30,0x82,0x01,0x20,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,
- 0x01,0x05,0x00,0x03,0x82,0x01,0x0d,0x00,0x30,0x82,0x01,0x08,0x02,0x82,0x01,0x01,
- 0x00,0xc6,0x68,0x99,0x1d,0xc8,0x06,0xdb,0xcf,0x1c,0x66,0xbb,0x91,0xc3,0xd4,0x10,
- 0xb2,0x08,0xa9,0xc5,0x71,0x39,0x1c,0xbe,0x5b,0x1d,0xce,0xfd,0x1b,0xfa,0xec,0x04,
- 0x89,0x9f,0x79,0xc8,0x46,0x00,0xd2,0x71,0xfb,0x22,0x16,0x52,0x2f,0xda,0xbf,0x0f,
- 0xe7,0x16,0xb1,0xd7,0x6a,0xa5,0xa5,0xfc,0xee,0xff,0x84,0x4c,0x81,0x3f,0xab,0x84,
- 0x0e,0xed,0x4a,0x26,0x59,0xd0,0x9b,0xb5,0xe1,0xec,0x61,0xc4,0xd3,0x15,0x4c,0x29,
- 0x51,0xa0,0xde,0x33,0x07,0x58,0x6c,0x36,0x1b,0x18,0x61,0xd9,0x56,0x18,0x39,0x54,
- 0x8b,0xd2,0xea,0x4e,0x87,0x28,0x58,0xb9,0x88,0x3d,0x30,0xbc,0xfc,0x6d,0xad,0xab,
- 0x43,0x26,0x09,0x48,0x4e,0x6e,0x8a,0x8b,0x88,0xb3,0xf0,0x29,0x25,0x79,0xb6,0xb6,
- 0x71,0x3c,0x93,0x59,0xd2,0x36,0x94,0xd5,0xfc,0xf3,0x62,0x2b,0x69,0xa3,0x7a,0x47,
- 0x4e,0x53,0xa2,0x35,0x1b,0x26,0x89,0xaa,0x09,0xfd,0x56,0xd7,0x75,0x2a,0xd4,0x91,
- 0xc0,0xf2,0x78,0xd7,0x05,0xca,0x12,0x1d,0xd9,0xd4,0x81,0x23,0xb2,0x3c,0x38,0xd9,
- 0xb4,0xdc,0x21,0xe0,0xe5,0x2d,0xd4,0xbe,0x61,0x39,0x8a,0x46,0x90,0x46,0x73,0x31,
- 0xba,0x48,0xbb,0x51,0xbb,0x91,0xd5,0x62,0xad,0xd1,0x53,0x5b,0x85,0xc9,0x1d,0xa7,
- 0xf6,0xa0,0xe1,0x0e,0x6c,0x22,0x5d,0x29,0x9a,0xe7,0x0f,0xe8,0x0a,0x50,0xa7,0x19,
- 0x11,0xc2,0x8b,0xe0,0x8a,0xfd,0x2b,0x94,0x31,0x7a,0x78,0x9c,0x9b,0x75,0x63,0x49,
- 0xa9,0xe5,0x58,0xe6,0x3a,0x99,0xcb,0x2b,0xdd,0x0e,0xdc,0x7d,0x1b,0x98,0x80,0xc3,
- 0x9f,0x02,0x01,0x23,
-};
-
bool test_rsa_load_any()
{
- chunk_t chunk = chunk_from_buf(public_any);
+ chunk_t chunk = chunk_from_chars(
+ 0x30,0x82,0x01,0x20,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,
+ 0x01,0x05,0x00,0x03,0x82,0x01,0x0d,0x00,0x30,0x82,0x01,0x08,0x02,0x82,0x01,0x01,
+ 0x00,0xc6,0x68,0x99,0x1d,0xc8,0x06,0xdb,0xcf,0x1c,0x66,0xbb,0x91,0xc3,0xd4,0x10,
+ 0xb2,0x08,0xa9,0xc5,0x71,0x39,0x1c,0xbe,0x5b,0x1d,0xce,0xfd,0x1b,0xfa,0xec,0x04,
+ 0x89,0x9f,0x79,0xc8,0x46,0x00,0xd2,0x71,0xfb,0x22,0x16,0x52,0x2f,0xda,0xbf,0x0f,
+ 0xe7,0x16,0xb1,0xd7,0x6a,0xa5,0xa5,0xfc,0xee,0xff,0x84,0x4c,0x81,0x3f,0xab,0x84,
+ 0x0e,0xed,0x4a,0x26,0x59,0xd0,0x9b,0xb5,0xe1,0xec,0x61,0xc4,0xd3,0x15,0x4c,0x29,
+ 0x51,0xa0,0xde,0x33,0x07,0x58,0x6c,0x36,0x1b,0x18,0x61,0xd9,0x56,0x18,0x39,0x54,
+ 0x8b,0xd2,0xea,0x4e,0x87,0x28,0x58,0xb9,0x88,0x3d,0x30,0xbc,0xfc,0x6d,0xad,0xab,
+ 0x43,0x26,0x09,0x48,0x4e,0x6e,0x8a,0x8b,0x88,0xb3,0xf0,0x29,0x25,0x79,0xb6,0xb6,
+ 0x71,0x3c,0x93,0x59,0xd2,0x36,0x94,0xd5,0xfc,0xf3,0x62,0x2b,0x69,0xa3,0x7a,0x47,
+ 0x4e,0x53,0xa2,0x35,0x1b,0x26,0x89,0xaa,0x09,0xfd,0x56,0xd7,0x75,0x2a,0xd4,0x91,
+ 0xc0,0xf2,0x78,0xd7,0x05,0xca,0x12,0x1d,0xd9,0xd4,0x81,0x23,0xb2,0x3c,0x38,0xd9,
+ 0xb4,0xdc,0x21,0xe0,0xe5,0x2d,0xd4,0xbe,0x61,0x39,0x8a,0x46,0x90,0x46,0x73,0x31,
+ 0xba,0x48,0xbb,0x51,0xbb,0x91,0xd5,0x62,0xad,0xd1,0x53,0x5b,0x85,0xc9,0x1d,0xa7,
+ 0xf6,0xa0,0xe1,0x0e,0x6c,0x22,0x5d,0x29,0x9a,0xe7,0x0f,0xe8,0x0a,0x50,0xa7,0x19,
+ 0x11,0xc2,0x8b,0xe0,0x8a,0xfd,0x2b,0x94,0x31,0x7a,0x78,0x9c,0x9b,0x75,0x63,0x49,
+ 0xa9,0xe5,0x58,0xe6,0x3a,0x99,0xcb,0x2b,0xdd,0x0e,0xdc,0x7d,0x1b,0x98,0x80,0xc3,
+ 0x9f,0x02,0x01,0x23);
public_key_t *public;
-
+
public = lib->creds->create(lib->creds, CRED_PUBLIC_KEY, KEY_ANY,
BUILD_BLOB_ASN1_DER, chunk,
BUILD_END);
diff --git a/src/charon/plugins/unit_tester/tests/test_sqlite.c b/src/charon/plugins/unit_tester/tests/test_sqlite.c
index d152fc594..dd8d1955e 100644
--- a/src/charon/plugins/unit_tester/tests/test_sqlite.c
+++ b/src/charon/plugins/unit_tester/tests/test_sqlite.c
@@ -29,14 +29,13 @@ bool test_sqlite()
{
database_t *db;
char *txt = "I'm a superduper test";
- char buf[] = {0x01,0x02,0x03,0x04,0x05,0x06,0x07,0x08};
- chunk_t data = chunk_from_buf(buf);
+ chunk_t data = chunk_from_chars(0x01,0x02,0x03,0x04,0x05,0x06,0x07,0x08);
int row;
chunk_t qdata;
char *qtxt;
bool good = FALSE;
enumerator_t *enumerator;
-
+
db = lib->db->create(lib->db, "sqlite://" DBFILE);
if (!db)
{
diff --git a/src/charon/plugins/unit_tester/unit_tester.c b/src/charon/plugins/unit_tester/unit_tester.c
index c9651e601..3c39688c6 100644
--- a/src/charon/plugins/unit_tester/unit_tester.c
+++ b/src/charon/plugins/unit_tester/unit_tester.c
@@ -33,17 +33,17 @@ struct private_unit_tester_t {
};
struct unit_test_t {
-
+
/**
* name of the test
*/
char *name;
-
+
/**
* test function
*/
bool (*test)(void);
-
+
/**
* run the test?
*/
@@ -62,10 +62,10 @@ static unit_test_t tests[] = {
static void run_tests(private_unit_tester_t *this)
{
int i, run = 0, failed = 0, success = 0, skipped = 0;
-
+
DBG1(DBG_CFG, "running unit tests, %d tests registered",
sizeof(tests)/sizeof(unit_test_t));
-
+
for (i = 0; i < sizeof(tests)/sizeof(unit_test_t); i++)
{
if (tests[i].enabled)
@@ -106,11 +106,11 @@ static void destroy(private_unit_tester_t *this)
plugin_t *plugin_create()
{
private_unit_tester_t *this = malloc_thing(private_unit_tester_t);
-
+
this->public.plugin.destroy = (void(*)(plugin_t*))destroy;
-
+
run_tests(this);
-
+
return &this->public.plugin;
}
diff --git a/src/charon/plugins/unit_tester/unit_tester.h b/src/charon/plugins/unit_tester/unit_tester.h
index 33b13313d..79d5bc021 100644
--- a/src/charon/plugins/unit_tester/unit_tester.h
+++ b/src/charon/plugins/unit_tester/unit_tester.h
@@ -28,7 +28,7 @@ typedef struct unit_tester_t unit_tester_t;
/**
* Unit testing plugin.
*
- * The unit testing plugin runs tests on plugin initialization. Tests are
+ * The unit testing plugin runs tests on plugin initialization. Tests are
* defined in tests.h using the DEFINE_TEST macro. Implementation of the
* tests is done in the tests folder. Each test has uses a function which
* returns TRUE for success or FALSE for failure.
diff --git a/src/charon/plugins/updown/Makefile.am b/src/charon/plugins/updown/Makefile.am
index fe6e0bb52..6cad02a96 100644
--- a/src/charon/plugins/updown/Makefile.am
+++ b/src/charon/plugins/updown/Makefile.am
@@ -6,7 +6,7 @@ AM_CFLAGS = -rdynamic
plugin_LTLIBRARIES = libstrongswan-updown.la
libstrongswan_updown_la_SOURCES = \
updown_plugin.h updown_plugin.c \
- updown_listener.h updown_listener.c
+ updown_listener.h updown_listener.c
libstrongswan_updown_la_LDFLAGS = -module -avoid-version
diff --git a/src/charon/plugins/updown/Makefile.in b/src/charon/plugins/updown/Makefile.in
index b1b6fb497..78ba19d65 100644
--- a/src/charon/plugins/updown/Makefile.in
+++ b/src/charon/plugins/updown/Makefile.in
@@ -1,8 +1,9 @@
-# Makefile.in generated by automake 1.10.2 from Makefile.am.
+# Makefile.in generated by automake 1.11 from Makefile.am.
# @configure_input@
# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,
-# 2003, 2004, 2005, 2006, 2007, 2008 Free Software Foundation, Inc.
+# 2003, 2004, 2005, 2006, 2007, 2008, 2009 Free Software Foundation,
+# Inc.
# This Makefile.in is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.
@@ -16,8 +17,9 @@
VPATH = @srcdir@
pkgdatadir = $(datadir)/@PACKAGE@
-pkglibdir = $(libdir)/@PACKAGE@
pkgincludedir = $(includedir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkglibexecdir = $(libexecdir)/@PACKAGE@
am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
install_sh_DATA = $(install_sh) -c -m 644
install_sh_PROGRAM = $(install_sh) -c
@@ -35,19 +37,41 @@ host_triplet = @host@
subdir = src/charon/plugins/updown
DIST_COMMON = $(srcdir)/Makefile.am $(srcdir)/Makefile.in
ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
-am__aclocal_m4_deps = $(top_srcdir)/configure.in
+am__aclocal_m4_deps = $(top_srcdir)/m4/config/libtool.m4 \
+ $(top_srcdir)/m4/config/ltoptions.m4 \
+ $(top_srcdir)/m4/config/ltsugar.m4 \
+ $(top_srcdir)/m4/config/ltversion.m4 \
+ $(top_srcdir)/m4/config/lt~obsolete.m4 \
+ $(top_srcdir)/m4/macros/with.m4 \
+ $(top_srcdir)/m4/macros/enable-disable.m4 \
+ $(top_srcdir)/configure.in
am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
$(ACLOCAL_M4)
mkinstalldirs = $(install_sh) -d
CONFIG_CLEAN_FILES =
+CONFIG_CLEAN_VPATH_FILES =
am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
am__vpath_adj = case $$p in \
$(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
*) f=$$p;; \
esac;
-am__strip_dir = `echo $$p | sed -e 's|^.*/||'`;
+am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
+am__install_max = 40
+am__nobase_strip_setup = \
+ srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
+am__nobase_strip = \
+ for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
+am__nobase_list = $(am__nobase_strip_setup); \
+ for p in $$list; do echo "$$p $$p"; done | \
+ sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
+ $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
+ if (++n[$$2] == $(am__install_max)) \
+ { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
+ END { for (dir in files) print dir, files[dir] }'
+am__base_list = \
+ sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
+ sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
am__installdirs = "$(DESTDIR)$(plugindir)"
-pluginLTLIBRARIES_INSTALL = $(INSTALL)
LTLIBRARIES = $(plugin_LTLIBRARIES)
libstrongswan_updown_la_LIBADD =
am_libstrongswan_updown_la_OBJECTS = updown_plugin.lo \
@@ -60,6 +84,7 @@ libstrongswan_updown_la_LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) \
DEFAULT_INCLUDES = -I.@am__isrc@
depcomp = $(SHELL) $(top_srcdir)/depcomp
am__depfiles_maybe = depfiles
+am__mv = mv -f
COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
LTCOMPILE = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
@@ -107,25 +132,22 @@ INSTALL_DATA = @INSTALL_DATA@
INSTALL_PROGRAM = @INSTALL_PROGRAM@
INSTALL_SCRIPT = @INSTALL_SCRIPT@
INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
-IPSEC_ROUTING_TABLE = @IPSEC_ROUTING_TABLE@
-IPSEC_ROUTING_TABLE_PRIO = @IPSEC_ROUTING_TABLE_PRIO@
LD = @LD@
LDFLAGS = @LDFLAGS@
LEX = @LEX@
LEXLIB = @LEXLIB@
LEX_OUTPUT_ROOT = @LEX_OUTPUT_ROOT@
-LIBGCRYPT_CFLAGS = @LIBGCRYPT_CFLAGS@
-LIBGCRYPT_CONFIG = @LIBGCRYPT_CONFIG@
-LIBGCRYPT_LIBS = @LIBGCRYPT_LIBS@
LIBOBJS = @LIBOBJS@
LIBS = @LIBS@
LIBTOOL = @LIBTOOL@
-LINUX_HEADERS = @LINUX_HEADERS@
LIPO = @LIPO@
LN_S = @LN_S@
LTLIBOBJS = @LTLIBOBJS@
MAKEINFO = @MAKEINFO@
MKDIR_P = @MKDIR_P@
+MYSQLCFLAG = @MYSQLCFLAG@
+MYSQLCONFIG = @MYSQLCONFIG@
+MYSQLLIB = @MYSQLLIB@
NM = @NM@
NMEDIT = @NMEDIT@
OBJDUMP = @OBJDUMP@
@@ -137,11 +159,14 @@ PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
PACKAGE_NAME = @PACKAGE_NAME@
PACKAGE_STRING = @PACKAGE_STRING@
PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_URL = @PACKAGE_URL@
PACKAGE_VERSION = @PACKAGE_VERSION@
PATH_SEPARATOR = @PATH_SEPARATOR@
PERL = @PERL@
PKG_CONFIG = @PKG_CONFIG@
+PTHREADLIB = @PTHREADLIB@
RANLIB = @RANLIB@
+RTLIB = @RTLIB@
RUBY = @RUBY@
RUBYINCLUDE = @RUBYINCLUDE@
SED = @SED@
@@ -170,9 +195,9 @@ build_cpu = @build_cpu@
build_os = @build_os@
build_vendor = @build_vendor@
builddir = @builddir@
-confdir = @confdir@
datadir = @datadir@
datarootdir = @datarootdir@
+default_pkcs11 = @default_pkcs11@
docdir = @docdir@
dvidir = @dvidir@
exec_prefix = @exec_prefix@
@@ -195,7 +220,7 @@ ipsecuser = @ipsecuser@
libdir = @libdir@
libexecdir = @libexecdir@
libstrongswan_plugins = @libstrongswan_plugins@
-linuxdir = @linuxdir@
+linux_headers = @linux_headers@
localedir = @localedir@
localstatedir = @localstatedir@
lt_ECHO = @lt_ECHO@
@@ -203,6 +228,7 @@ mandir = @mandir@
mkdir_p = @mkdir_p@
nm_CFLAGS = @nm_CFLAGS@
nm_LIBS = @nm_LIBS@
+nm_ca_dir = @nm_ca_dir@
oldincludedir = @oldincludedir@
pdfdir = @pdfdir@
piddir = @piddir@
@@ -211,10 +237,12 @@ pluto_plugins = @pluto_plugins@
prefix = @prefix@
program_transform_name = @program_transform_name@
psdir = @psdir@
+random_device = @random_device@
resolv_conf = @resolv_conf@
+routing_table = @routing_table@
+routing_table_prio = @routing_table_prio@
sbindir = @sbindir@
sharedstatedir = @sharedstatedir@
-simreader = @simreader@
srcdir = @srcdir@
strongswan_conf = @strongswan_conf@
sysconfdir = @sysconfdir@
@@ -222,6 +250,7 @@ target_alias = @target_alias@
top_build_prefix = @top_build_prefix@
top_builddir = @top_builddir@
top_srcdir = @top_srcdir@
+urandom_device = @urandom_device@
xml_CFLAGS = @xml_CFLAGS@
xml_LIBS = @xml_LIBS@
INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
@@ -229,7 +258,7 @@ AM_CFLAGS = -rdynamic
plugin_LTLIBRARIES = libstrongswan-updown.la
libstrongswan_updown_la_SOURCES = \
updown_plugin.h updown_plugin.c \
- updown_listener.h updown_listener.c
+ updown_listener.h updown_listener.c
libstrongswan_updown_la_LDFLAGS = -module -avoid-version
all: all-am
@@ -245,9 +274,9 @@ $(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps)
exit 1;; \
esac; \
done; \
- echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/charon/plugins/updown/Makefile'; \
- cd $(top_srcdir) && \
- $(AUTOMAKE) --gnu src/charon/plugins/updown/Makefile
+ echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/charon/plugins/updown/Makefile'; \
+ $(am__cd) $(top_srcdir) && \
+ $(AUTOMAKE) --gnu src/charon/plugins/updown/Makefile
.PRECIOUS: Makefile
Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
@case '$?' in \
@@ -265,23 +294,28 @@ $(top_srcdir)/configure: $(am__configure_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
$(ACLOCAL_M4): $(am__aclocal_m4_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(am__aclocal_m4_deps):
install-pluginLTLIBRARIES: $(plugin_LTLIBRARIES)
@$(NORMAL_INSTALL)
test -z "$(plugindir)" || $(MKDIR_P) "$(DESTDIR)$(plugindir)"
- @list='$(plugin_LTLIBRARIES)'; for p in $$list; do \
+ @list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+ list2=; for p in $$list; do \
if test -f $$p; then \
- f=$(am__strip_dir) \
- echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(pluginLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) '$$p' '$(DESTDIR)$(plugindir)/$$f'"; \
- $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(pluginLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) "$$p" "$(DESTDIR)$(plugindir)/$$f"; \
+ list2="$$list2 $$p"; \
else :; fi; \
- done
+ done; \
+ test -z "$$list2" || { \
+ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(plugindir)'"; \
+ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(plugindir)"; \
+ }
uninstall-pluginLTLIBRARIES:
@$(NORMAL_UNINSTALL)
- @list='$(plugin_LTLIBRARIES)'; for p in $$list; do \
- p=$(am__strip_dir) \
- echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$p'"; \
- $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$p"; \
+ @list='$(plugin_LTLIBRARIES)'; test -n "$(plugindir)" || list=; \
+ for p in $$list; do \
+ $(am__strip_dir) \
+ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(plugindir)/$$f'"; \
+ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(plugindir)/$$f"; \
done
clean-pluginLTLIBRARIES:
@@ -306,21 +340,21 @@ distclean-compile:
.c.o:
@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(COMPILE) -c $<
.c.obj:
@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(COMPILE) -c `$(CYGPATH_W) '$<'`
.c.lo:
@am__fastdepCC_TRUE@ $(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@ mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
+@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@ $(LTCOMPILE) -c -o $@ $<
@@ -343,7 +377,7 @@ tags: TAGS
TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
$(TAGS_FILES) $(LISP)
- tags=; \
+ set x; \
here=`pwd`; \
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
unique=`for i in $$list; do \
@@ -351,29 +385,34 @@ TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
- if test -z "$(ETAGS_ARGS)$$tags$$unique"; then :; else \
+ shift; \
+ if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
test -n "$$unique" || unique=$$empty_fix; \
- $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
- $$tags $$unique; \
+ if test $$# -gt 0; then \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ "$$@" $$unique; \
+ else \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ $$unique; \
+ fi; \
fi
ctags: CTAGS
CTAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
$(TAGS_FILES) $(LISP)
- tags=; \
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
unique=`for i in $$list; do \
if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
- test -z "$(CTAGS_ARGS)$$tags$$unique" \
+ test -z "$(CTAGS_ARGS)$$unique" \
|| $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
- $$tags $$unique
+ $$unique
GTAGS:
here=`$(am__cd) $(top_builddir) && pwd` \
- && cd $(top_srcdir) \
- && gtags -i $(GTAGS_ARGS) $$here
+ && $(am__cd) $(top_srcdir) \
+ && gtags -i $(GTAGS_ARGS) "$$here"
distclean-tags:
-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
@@ -394,13 +433,17 @@ distdir: $(DISTFILES)
if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
if test -d $$d/$$file; then \
dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
+ if test -d "$(distdir)/$$file"; then \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+ fi; \
if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
- cp -pR $(srcdir)/$$file $(distdir)$$dir || exit 1; \
+ cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
+ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
fi; \
- cp -pR $$d/$$file $(distdir)$$dir || exit 1; \
+ cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
else \
- test -f $(distdir)/$$file \
- || cp -p $$d/$$file $(distdir)/$$file \
+ test -f "$(distdir)/$$file" \
+ || cp -p $$d/$$file "$(distdir)/$$file" \
|| exit 1; \
fi; \
done
@@ -431,6 +474,7 @@ clean-generic:
distclean-generic:
-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+ -test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
maintainer-clean-generic:
@echo "This command is intended for maintainers to use"
@@ -452,6 +496,8 @@ dvi-am:
html: html-am
+html-am:
+
info: info-am
info-am:
@@ -460,18 +506,28 @@ install-data-am: install-pluginLTLIBRARIES
install-dvi: install-dvi-am
+install-dvi-am:
+
install-exec-am:
install-html: install-html-am
+install-html-am:
+
install-info: install-info-am
+install-info-am:
+
install-man:
install-pdf: install-pdf-am
+install-pdf-am:
+
install-ps: install-ps-am
+install-ps-am:
+
installcheck-am:
maintainer-clean: maintainer-clean-am
@@ -510,6 +566,7 @@ uninstall-am: uninstall-pluginLTLIBRARIES
mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \
tags uninstall uninstall-am uninstall-pluginLTLIBRARIES
+
# Tell versions [3.59,3.63) of GNU make to not export all variables.
# Otherwise a system limit (for SysV at least) may be exceeded.
.NOEXPORT:
diff --git a/src/charon/plugins/updown/updown_listener.c b/src/charon/plugins/updown/updown_listener.c
index a6be35690..5a6746f92 100644
--- a/src/charon/plugins/updown/updown_listener.c
+++ b/src/charon/plugins/updown/updown_listener.c
@@ -27,12 +27,12 @@ typedef struct private_updown_listener_t private_updown_listener_t;
* Private data of an updown_listener_t object.
*/
struct private_updown_listener_t {
-
+
/**
* Public updown_listener_t interface.
*/
updown_listener_t public;
-
+
/**
* List of cached interface names
*/
@@ -58,10 +58,10 @@ static void cache_iface(private_updown_listener_t *this, u_int32_t reqid,
char *iface)
{
cache_entry_t *entry = malloc_thing(cache_entry_t);
-
+
entry->reqid = reqid;
entry->iface = strdup(iface);
-
+
this->iface_cache->insert_first(this->iface_cache, entry);
}
@@ -73,7 +73,7 @@ static char* uncache_iface(private_updown_listener_t *this, u_int32_t reqid)
enumerator_t *enumerator;
cache_entry_t *entry;
char *iface = NULL;
-
+
enumerator = this->iface_cache->create_enumerator(this->iface_cache);
while (enumerator->enumerate(enumerator, &entry))
{
@@ -89,35 +89,34 @@ static char* uncache_iface(private_updown_listener_t *this, u_int32_t reqid)
return iface;
}
-/**
- * Run the up/down script
- */
-static void updown(private_updown_listener_t *this, ike_sa_t *ike_sa,
- child_sa_t *child_sa, bool up)
+METHOD(listener_t, child_updown, bool,
+ private_updown_listener_t *this, ike_sa_t *ike_sa, child_sa_t *child_sa,
+ bool up)
{
traffic_selector_t *my_ts, *other_ts;
enumerator_t *enumerator;
child_cfg_t *config;
host_t *vip, *me, *other;
char *script;
-
+
config = child_sa->get_config(child_sa);
vip = ike_sa->get_virtual_ip(ike_sa, TRUE);
script = config->get_updown(config);
me = ike_sa->get_my_host(ike_sa);
other = ike_sa->get_other_host(ike_sa);
-
+
if (script == NULL)
{
- return;
+ return TRUE;
}
-
+
enumerator = child_sa->create_policy_enumerator(child_sa);
while (enumerator->enumerate(enumerator, &my_ts, &other_ts))
{
char command[1024];
char *my_client, *other_client, *my_client_mask, *other_client_mask;
char *pos, *virtual_ip, *iface;
+ bool is_host, is_ipv6;
FILE *shell;
/* get subnet/bits from string */
@@ -160,7 +159,7 @@ static void updown(private_updown_listener_t *this, ike_sa_t *ike_sa,
virtual_ip = NULL;
}
}
-
+
if (up)
{
iface = charon->kernel_interface->get_interface(
@@ -174,7 +173,12 @@ static void updown(private_updown_listener_t *this, ike_sa_t *ike_sa,
{
iface = uncache_iface(this, child_sa->get_reqid(child_sa));
}
-
+
+ /* determine IPv4/IPv6 and client/host situation */
+ is_host = my_ts->is_host(my_ts, me);
+ is_ipv6 = is_host ? (me->get_family(me) == AF_INET6) :
+ (my_ts->get_type(my_ts) == TS_IPV6_ADDR_RANGE);
+
/* build the command with all env variables.
* TODO: PLUTO_PEER_CA and PLUTO_NEXT_HOP are currently missing
*/
@@ -203,8 +207,8 @@ static void updown(private_updown_listener_t *this, ike_sa_t *ike_sa,
"%s"
"%s",
up ? "up" : "down",
- my_ts->is_host(my_ts, me) ? "-host" : "-client",
- me->get_family(me) == AF_INET ? "" : "-v6",
+ is_host ? "-host" : "-client",
+ is_ipv6 ? "-v6" : "",
config->get_name(config),
iface ? iface : "unknown",
child_sa->get_reqid(child_sa),
@@ -225,31 +229,27 @@ static void updown(private_updown_listener_t *this, ike_sa_t *ike_sa,
free(other_client);
free(virtual_ip);
free(iface);
-
+
DBG3(DBG_CHD, "running updown script: %s", command);
shell = popen(command, "r");
if (shell == NULL)
{
DBG1(DBG_CHD, "could not execute updown script '%s'", script);
- return;
+ return TRUE;
}
-
+
while (TRUE)
{
char resp[128];
-
+
if (fgets(resp, sizeof(resp), shell) == NULL)
{
if (ferror(shell))
{
DBG1(DBG_CHD, "error reading output from updown script");
- return;
- }
- else
- {
- break;
}
+ break;
}
else
{
@@ -264,37 +264,11 @@ static void updown(private_updown_listener_t *this, ike_sa_t *ike_sa,
pclose(shell);
}
enumerator->destroy(enumerator);
-}
-
-/**
- * Listener implementation
- */
-static bool child_state_change(private_updown_listener_t *this, ike_sa_t *ike_sa,
- child_sa_t *child_sa, child_sa_state_t state)
-{
- child_sa_state_t old;
-
- if (ike_sa)
- {
- old = child_sa->get_state(child_sa);
-
- if ((old == CHILD_INSTALLED && state != CHILD_REKEYING ) ||
- (old == CHILD_DELETING && state == CHILD_DESTROYING))
- {
- updown(this, ike_sa, child_sa, FALSE);
- }
- else if (state == CHILD_INSTALLED)
- {
- updown(this, ike_sa, child_sa, TRUE);
- }
- }
return TRUE;
}
-/**
- * Implementation of updown_listener_t.destroy.
- */
-static void destroy(private_updown_listener_t *this)
+METHOD(updown_listener_t, destroy, void,
+ private_updown_listener_t *this)
{
this->iface_cache->destroy(this->iface_cache);
free(this);
@@ -305,14 +279,16 @@ static void destroy(private_updown_listener_t *this)
*/
updown_listener_t *updown_listener_create()
{
- private_updown_listener_t *this = malloc_thing(private_updown_listener_t);
-
- memset(&this->public.listener, 0, sizeof(listener_t));
- this->public.listener.child_state_change = (void*)child_state_change;
- this->public.destroy = (void(*)(updown_listener_t*))destroy;
-
- this->iface_cache = linked_list_create();
-
+ private_updown_listener_t *this;
+
+ INIT(this,
+ .public = {
+ .listener.child_updown = _child_updown,
+ .destroy = _destroy,
+ },
+ .iface_cache = linked_list_create(),
+ );
+
return &this->public;
}
diff --git a/src/charon/plugins/updown/updown_listener.h b/src/charon/plugins/updown/updown_listener.h
index cc59f61c6..5b866c4e5 100644
--- a/src/charon/plugins/updown/updown_listener.h
+++ b/src/charon/plugins/updown/updown_listener.h
@@ -29,12 +29,12 @@ typedef struct updown_listener_t updown_listener_t;
* Listener which invokes the scripts on CHILD_SA up/down.
*/
struct updown_listener_t {
-
+
/**
* Implements listener_t.
*/
listener_t listener;
-
+
/**
* Destroy a updown_listener_t.
*/
@@ -46,4 +46,4 @@ struct updown_listener_t {
*/
updown_listener_t *updown_listener_create();
-#endif /** UPDOWN_LISTENER_ @}*/
+#endif /** UPDOWN_LISTENER_H_ @}*/
diff --git a/src/charon/plugins/updown/updown_plugin.c b/src/charon/plugins/updown/updown_plugin.c
index 4f0483fac..6cb0efdcd 100644
--- a/src/charon/plugins/updown/updown_plugin.c
+++ b/src/charon/plugins/updown/updown_plugin.c
@@ -29,7 +29,7 @@ struct private_updown_plugin_t {
* implements plugin interface
*/
updown_plugin_t public;
-
+
/**
* Listener interface, listens to CHILD_SA state changes
*/
@@ -52,12 +52,12 @@ static void destroy(private_updown_plugin_t *this)
plugin_t *plugin_create()
{
private_updown_plugin_t *this = malloc_thing(private_updown_plugin_t);
-
+
this->public.plugin.destroy = (void(*)(plugin_t*))destroy;
-
+
this->listener = updown_listener_create();
charon->bus->add_listener(charon->bus, &this->listener->listener);
-
+
return &this->public.plugin;
}
diff --git a/src/charon/processing/jobs/acquire_job.c b/src/charon/processing/jobs/acquire_job.c
index 90b221b84..45ace9312 100644
--- a/src/charon/processing/jobs/acquire_job.c
+++ b/src/charon/processing/jobs/acquire_job.c
@@ -28,17 +28,17 @@ struct private_acquire_job_t {
* Public acquire_job_t interface.
*/
acquire_job_t public;
-
+
/**
* reqid of the child to rekey
*/
u_int32_t reqid;
-
+
/**
* acquired source traffic selector
*/
traffic_selector_t *src_ts;
-
+
/**
* acquired destination traffic selector
*/
@@ -73,14 +73,14 @@ acquire_job_t *acquire_job_create(u_int32_t reqid,
traffic_selector_t *dst_ts)
{
private_acquire_job_t *this = malloc_thing(private_acquire_job_t);
-
+
this->public.job_interface.execute = (void (*) (job_t *)) execute;
this->public.job_interface.destroy = (void (*)(job_t*)) destroy;
-
+
this->reqid = reqid;
this->src_ts = src_ts;
this->dst_ts = dst_ts;
-
+
return &this->public;
}
diff --git a/src/charon/processing/jobs/acquire_job.h b/src/charon/processing/jobs/acquire_job.h
index a78e5274d..eff79a9b0 100644
--- a/src/charon/processing/jobs/acquire_job.h
+++ b/src/charon/processing/jobs/acquire_job.h
@@ -24,12 +24,12 @@
typedef struct acquire_job_t acquire_job_t;
#include <library.h>
-#include <config/traffic_selector.h>
+#include <selectors/traffic_selector.h>
#include <processing/jobs/job.h>
/**
* Class representing an ACQUIRE Job.
- *
+ *
* This job initiates a CHILD SA on kernel request.
*/
struct acquire_job_t {
diff --git a/src/charon/processing/jobs/callback_job.c b/src/charon/processing/jobs/callback_job.c
index f4beb5abd..7e35dcdcb 100644
--- a/src/charon/processing/jobs/callback_job.c
+++ b/src/charon/processing/jobs/callback_job.c
@@ -1,4 +1,5 @@
/*
+ * Copyright (C) 2009 Tobias Brunner
* Copyright (C) 2007 Martin Willi
* Hochschule fuer Technik Rapperswil
*
@@ -12,13 +13,15 @@
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
-
+
#include "callback_job.h"
-#include <pthread.h>
+#include <semaphore.h>
#include <daemon.h>
-#include <utils/mutex.h>
+#include <threading/thread.h>
+#include <threading/condvar.h>
+#include <threading/mutex.h>
typedef struct private_callback_job_t private_callback_job_t;
@@ -30,7 +33,7 @@ struct private_callback_job_t {
* Public callback_job_t interface.
*/
callback_job_t public;
-
+
/**
* Callback to call on execution
*/
@@ -40,70 +43,94 @@ struct private_callback_job_t {
* parameter to supply to callback
*/
void *data;
-
+
/**
* cleanup function for data
*/
callback_job_cleanup_t cleanup;
-
+
/**
- * thread ID of the job, if running
+ * thread of the job, if running
*/
- pthread_t thread;
-
+ thread_t *thread;
+
/**
* mutex to access jobs interna
*/
mutex_t *mutex;
-
+
/**
* list of asociated child jobs
*/
linked_list_t *children;
-
+
/**
* parent of this job, or NULL
*/
private_callback_job_t *parent;
-};
-/**
- * Implements job_t.destroy.
- */
-static void destroy(private_callback_job_t *this)
-{
- if (this->cleanup)
- {
- this->cleanup(this->data);
- }
- this->children->destroy(this->children);
- this->mutex->destroy(this->mutex);
- free(this);
-}
+ /**
+ * TRUE if the job got cancelled
+ */
+ bool cancelled;
+
+ /**
+ * condvar to synchronize the cancellation/destruction of the job
+ */
+ condvar_t *destroyable;
+
+ /**
+ * semaphore to synchronize the termination of the assigned thread.
+ *
+ * separately allocated during cancellation, so that we can wait on it
+ * without risking that it gets freed too early during destruction.
+ */
+ sem_t *terminated;
+};
/**
* unregister a child from its parent, if any.
+ * note: this->mutex has to be locked
*/
static void unregister(private_callback_job_t *this)
{
if (this->parent)
{
- iterator_t *iterator;
- private_callback_job_t *child;
-
this->parent->mutex->lock(this->parent->mutex);
- iterator = this->parent->children->create_iterator(this->parent->children, TRUE);
- while (iterator->iterate(iterator, (void**)&child))
+ if (this->parent->cancelled && !this->cancelled)
{
- if (child == this)
- {
- iterator->remove(iterator);
- break;
- }
+ /* if the parent has been cancelled but we have not yet, we do not
+ * unregister until we got cancelled by the parent. */
+ this->parent->mutex->unlock(this->parent->mutex);
+ this->destroyable->wait(this->destroyable, this->mutex);
+ this->parent->mutex->lock(this->parent->mutex);
}
- iterator->destroy(iterator);
+ this->parent->children->remove(this->parent->children, this, NULL);
this->parent->mutex->unlock(this->parent->mutex);
+ this->parent = NULL;
+ }
+}
+
+/**
+ * Implements job_t.destroy.
+ */
+static void destroy(private_callback_job_t *this)
+{
+ this->mutex->lock(this->mutex);
+ unregister(this);
+ if (this->cleanup)
+ {
+ this->cleanup(this->data);
}
+ if (this->terminated)
+ {
+ sem_post(this->terminated);
+ }
+ this->children->destroy(this->children);
+ this->destroyable->destroy(this->destroyable);
+ this->mutex->unlock(this->mutex);
+ this->mutex->destroy(this->mutex);
+ free(this);
}
/**
@@ -111,20 +138,42 @@ static void unregister(private_callback_job_t *this)
*/
static void cancel(private_callback_job_t *this)
{
- pthread_t thread;
-
+ callback_job_t *child;
+ sem_t *terminated = NULL;
+
this->mutex->lock(this->mutex);
- thread = this->thread;
-
- /* terminate its children */
- this->children->invoke_offset(this->children, offsetof(callback_job_t, cancel));
+ this->cancelled = TRUE;
+ /* terminate children */
+ while (this->children->get_first(this->children, (void**)&child) == SUCCESS)
+ {
+ this->mutex->unlock(this->mutex);
+ child->cancel(child);
+ this->mutex->lock(this->mutex);
+ }
+ if (this->thread)
+ {
+ /* terminate the thread, if there is currently one executing the job.
+ * we wait for its termination using a semaphore */
+ this->thread->cancel(this->thread);
+ terminated = this->terminated = malloc_thing(sem_t);
+ sem_init(terminated, 0, 0);
+ }
+ else
+ {
+ /* if the job is currently queued, it gets terminated later.
+ * we can't wait, because it might not get executed at all.
+ * we also unregister the queued job manually from its parent (the
+ * others get unregistered during destruction) */
+ unregister(this);
+ }
+ this->destroyable->signal(this->destroyable);
this->mutex->unlock(this->mutex);
-
- /* terminate thread */
- if (thread)
+
+ if (terminated)
{
- pthread_cancel(thread);
- pthread_join(thread, NULL);
+ sem_wait(terminated);
+ sem_destroy(terminated);
+ free(terminated);
}
}
@@ -135,20 +184,28 @@ static void execute(private_callback_job_t *this)
{
bool cleanup = FALSE;
+ thread_cleanup_push((thread_cleanup_t)destroy, this);
+
this->mutex->lock(this->mutex);
- this->thread = pthread_self();
+ this->thread = thread_current();
this->mutex->unlock(this->mutex);
-
- pthread_cleanup_push((void*)destroy, this);
+
while (TRUE)
{
+ this->mutex->lock(this->mutex);
+ if (this->cancelled)
+ {
+ this->mutex->unlock(this->mutex);
+ cleanup = TRUE;
+ break;
+ }
+ this->mutex->unlock(this->mutex);
switch (this->callback(this->data))
{
case JOB_REQUEUE_DIRECT:
continue;
case JOB_REQUEUE_FAIR:
{
- this->thread = 0;
charon->processor->queue_job(charon->processor,
&this->public.job_interface);
break;
@@ -156,15 +213,19 @@ static void execute(private_callback_job_t *this)
case JOB_REQUEUE_NONE:
default:
{
- this->thread = 0;
cleanup = TRUE;
break;
}
}
break;
}
- unregister(this);
- pthread_cleanup_pop(cleanup);
+ this->mutex->lock(this->mutex);
+ this->thread = NULL;
+ this->mutex->unlock(this->mutex);
+ /* manually create a cancellation point to avoid that a cancelled thread
+ * goes back into the thread pool */
+ thread_cancellation_point();
+ thread_cleanup_pop(cleanup);
}
/*
@@ -175,7 +236,7 @@ callback_job_t *callback_job_create(callback_job_cb_t cb, void *data,
callback_job_t *parent)
{
private_callback_job_t *this = malloc_thing(private_callback_job_t);
-
+
/* interface functions */
this->public.job_interface.execute = (void (*) (job_t *)) execute;
this->public.job_interface.destroy = (void (*) (job_t *)) destroy;
@@ -189,7 +250,10 @@ callback_job_t *callback_job_create(callback_job_cb_t cb, void *data,
this->thread = 0;
this->children = linked_list_create();
this->parent = (private_callback_job_t*)parent;
-
+ this->cancelled = FALSE;
+ this->destroyable = condvar_create(CONDVAR_TYPE_DEFAULT);
+ this->terminated = NULL;
+
/* register us at parent */
if (parent)
{
@@ -197,7 +261,7 @@ callback_job_t *callback_job_create(callback_job_cb_t cb, void *data,
this->parent->children->insert_last(this->parent->children, this);
this->parent->mutex->unlock(this->parent->mutex);
}
-
+
return &this->public;
}
diff --git a/src/charon/processing/jobs/callback_job.h b/src/charon/processing/jobs/callback_job.h
index 2bb209cb7..62da1edd1 100644
--- a/src/charon/processing/jobs/callback_job.h
+++ b/src/charon/processing/jobs/callback_job.h
@@ -41,12 +41,12 @@ enum job_requeue_t {
* Do not requeue job, destroy it
*/
JOB_REQUEUE_NONE,
-
+
/**
* Reque the job fairly, meaning it has to requeue as any other job
*/
JOB_REQUEUE_FAIR,
-
+
/**
* Reexecute the job directly, without the need of requeueing it
*/
@@ -88,10 +88,11 @@ struct callback_job_t {
* The job_t interface.
*/
job_t job_interface;
-
+
/**
- * Cancel the jobs thread and wait for its termination.
- */
+ * Cancel the job's thread and wait for its termination. This only works
+ * reliably for jobs that always use JOB_REQUEUE_FAIR or JOB_REQUEUE_DIRECT,
+ * otherwise the job may already be destroyed when cancel is called. */
void (*cancel)(callback_job_t *this);
};
@@ -103,7 +104,7 @@ struct callback_job_t {
* If parent is not NULL, the specified job gets an association. Whenever
* the parent gets cancelled (or runs out), all of its children are cancelled,
* too.
- *
+ *
* @param cb callback to call from the processor
* @param data user data to supply to callback
* @param cleanup destructor for data on destruction, or NULL
diff --git a/src/charon/processing/jobs/delete_child_sa_job.c b/src/charon/processing/jobs/delete_child_sa_job.c
index 206f07617..ca55721f2 100644
--- a/src/charon/processing/jobs/delete_child_sa_job.c
+++ b/src/charon/processing/jobs/delete_child_sa_job.c
@@ -29,17 +29,17 @@ struct private_delete_child_sa_job_t {
* Public delete_child_sa_job_t interface.
*/
delete_child_sa_job_t public;
-
+
/**
* reqid of the CHILD_SA
*/
u_int32_t reqid;
-
+
/**
* protocol of the CHILD_SA (ESP/AH)
*/
protocol_id_t protocol;
-
+
/**
* inbound SPI of the CHILD_SA
*/
@@ -60,7 +60,7 @@ static void destroy(private_delete_child_sa_job_t *this)
static void execute(private_delete_child_sa_job_t *this)
{
ike_sa_t *ike_sa;
-
+
ike_sa = charon->ike_sa_manager->checkout_by_id(charon->ike_sa_manager,
this->reqid, TRUE);
if (ike_sa == NULL)
@@ -71,7 +71,7 @@ static void execute(private_delete_child_sa_job_t *this)
else
{
ike_sa->delete_child_sa(ike_sa, this->protocol, this->spi);
-
+
charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
}
destroy(this);
@@ -80,21 +80,21 @@ static void execute(private_delete_child_sa_job_t *this)
/*
* Described in header
*/
-delete_child_sa_job_t *delete_child_sa_job_create(u_int32_t reqid,
- protocol_id_t protocol,
+delete_child_sa_job_t *delete_child_sa_job_create(u_int32_t reqid,
+ protocol_id_t protocol,
u_int32_t spi)
{
private_delete_child_sa_job_t *this = malloc_thing(private_delete_child_sa_job_t);
-
+
/* interface functions */
this->public.job_interface.execute = (void (*) (job_t *)) execute;
this->public.job_interface.destroy = (void (*)(job_t*)) destroy;
-
+
/* private variables */
this->reqid = reqid;
this->protocol = protocol;
this->spi = spi;
-
+
return &this->public;
}
diff --git a/src/charon/processing/jobs/delete_child_sa_job.h b/src/charon/processing/jobs/delete_child_sa_job.h
index 9bf6ee423..662a7b7c7 100644
--- a/src/charon/processing/jobs/delete_child_sa_job.h
+++ b/src/charon/processing/jobs/delete_child_sa_job.h
@@ -31,7 +31,7 @@ typedef struct delete_child_sa_job_t delete_child_sa_job_t;
/**
* Class representing an DELETE_CHILD_SA Job.
- *
+ *
* This job initiates the delete of a CHILD SA.
*/
struct delete_child_sa_job_t {
@@ -52,8 +52,8 @@ struct delete_child_sa_job_t {
* @param spi security parameter index of the CHILD_SA
* @return delete_child_sa_job_t object
*/
-delete_child_sa_job_t *delete_child_sa_job_create(u_int32_t reqid,
- protocol_id_t protocol,
+delete_child_sa_job_t *delete_child_sa_job_create(u_int32_t reqid,
+ protocol_id_t protocol,
u_int32_t spi);
#endif /** DELETE_CHILD_SA_JOB_H_ @}*/
diff --git a/src/charon/processing/jobs/delete_ike_sa_job.c b/src/charon/processing/jobs/delete_ike_sa_job.c
index 6d4639fad..dffd08ba3 100644
--- a/src/charon/processing/jobs/delete_ike_sa_job.c
+++ b/src/charon/processing/jobs/delete_ike_sa_job.c
@@ -28,12 +28,12 @@ struct private_delete_ike_sa_job_t {
* public delete_ike_sa_job_t interface
*/
delete_ike_sa_job_t public;
-
+
/**
* ID of the ike_sa to delete
*/
ike_sa_id_t *ike_sa_id;
-
+
/**
* Should the IKE_SA be deleted if it is in ESTABLISHED state?
*/
@@ -56,7 +56,7 @@ static void destroy(private_delete_ike_sa_job_t *this)
static void execute(private_delete_ike_sa_job_t *this)
{
ike_sa_t *ike_sa;
-
+
ike_sa = charon->ike_sa_manager->checkout(charon->ike_sa_manager,
this->ike_sa_id);
if (ike_sa)
@@ -99,18 +99,18 @@ static void execute(private_delete_ike_sa_job_t *this)
/*
* Described in header
*/
-delete_ike_sa_job_t *delete_ike_sa_job_create(ike_sa_id_t *ike_sa_id,
+delete_ike_sa_job_t *delete_ike_sa_job_create(ike_sa_id_t *ike_sa_id,
bool delete_if_established)
{
private_delete_ike_sa_job_t *this = malloc_thing(private_delete_ike_sa_job_t);
-
+
/* interface functions */
this->public.job_interface.execute = (void (*) (job_t *)) execute;
this->public.job_interface.destroy = (void (*)(job_t *)) destroy;;
-
+
/* private variables */
this->ike_sa_id = ike_sa_id->clone(ike_sa_id);
this->delete_if_established = delete_if_established;
-
+
return &(this->public);
}
diff --git a/src/charon/processing/jobs/delete_ike_sa_job.h b/src/charon/processing/jobs/delete_ike_sa_job.h
index 8209977f9..f641deea3 100644
--- a/src/charon/processing/jobs/delete_ike_sa_job.h
+++ b/src/charon/processing/jobs/delete_ike_sa_job.h
@@ -18,7 +18,7 @@
* @defgroup delete_child_sa_job delete_child_sa_job
* @{ @ingroup jobs
*/
-
+
#ifndef DELETE_IKE_SA_JOB_H_
#define DELETE_IKE_SA_JOB_H_
@@ -32,12 +32,12 @@ typedef struct delete_ike_sa_job_t delete_ike_sa_job_t;
/**
* Class representing an DELETE_IKE_SA Job.
*
- * This job is responsible for deleting established or half open IKE_SAs.
+ * This job is responsible for deleting established or half open IKE_SAs.
* A half open IKE_SA is every IKE_SA which hasn't reache the SA_ESTABLISHED
* state.
*/
struct delete_ike_sa_job_t {
-
+
/**
* The job_t interface.
*/
@@ -46,7 +46,7 @@ struct delete_ike_sa_job_t {
/**
* Creates a job of type DELETE_IKE_SA.
- *
+ *
* @param ike_sa_id id of the IKE_SA to delete
* @param delete_if_established should the IKE_SA be deleted if it is established?
* @return created delete_ike_sa_job_t object
diff --git a/src/charon/processing/jobs/inactivity_job.c b/src/charon/processing/jobs/inactivity_job.c
new file mode 100644
index 000000000..13fc5e3d0
--- /dev/null
+++ b/src/charon/processing/jobs/inactivity_job.c
@@ -0,0 +1,150 @@
+/*
+ * Copyright (C) 2010 Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+
+#include "inactivity_job.h"
+
+#include <daemon.h>
+
+typedef struct private_inactivity_job_t private_inactivity_job_t;
+
+/**
+ * Private data of an inactivity_job_t object.
+ */
+struct private_inactivity_job_t {
+
+ /**
+ * Public inactivity_job_t interface.
+ */
+ inactivity_job_t public;
+
+ /**
+ * Reqid of CHILD_SA to check
+ */
+ u_int32_t reqid;
+
+ /**
+ * Inactivity timeout
+ */
+ u_int32_t timeout;
+
+ /**
+ * Close IKE_SA if last remaining CHILD inactive?
+ */
+ bool close_ike;
+};
+
+METHOD(job_t, destroy, void,
+ private_inactivity_job_t *this)
+{
+ free(this);
+}
+
+METHOD(job_t, execute, void,
+ private_inactivity_job_t *this)
+{
+ ike_sa_t *ike_sa;
+ bool rescheduled = FALSE;
+
+ ike_sa = charon->ike_sa_manager->checkout_by_id(charon->ike_sa_manager,
+ this->reqid, TRUE);
+ if (ike_sa)
+ {
+ iterator_t *iterator;
+ child_sa_t *child_sa;
+ u_int32_t delete = 0;
+ protocol_id_t proto = 0;
+ int children = 0;
+ status_t status = SUCCESS;
+
+ iterator = ike_sa->create_child_sa_iterator(ike_sa);
+ while (iterator->iterate(iterator, (void**)&child_sa))
+ {
+ if (child_sa->get_reqid(child_sa) == this->reqid)
+ {
+ time_t in, out, diff;
+
+ child_sa->get_usestats(child_sa, TRUE, &in, NULL);
+ child_sa->get_usestats(child_sa, FALSE, &out, NULL);
+
+ diff = time_monotonic(NULL) - max(in, out);
+
+ if (diff >= this->timeout)
+ {
+ delete = child_sa->get_spi(child_sa, TRUE);
+ proto = child_sa->get_protocol(child_sa);
+ }
+ else
+ {
+ charon->scheduler->schedule_job(charon->scheduler,
+ &this->public.job_interface, this->timeout - diff);
+ rescheduled = TRUE;
+ }
+ }
+ children++;
+ }
+ iterator->destroy(iterator);
+
+ if (delete)
+ {
+ if (children == 1 && this->close_ike)
+ {
+ DBG1(DBG_JOB, "deleting IKE_SA after %d seconds "
+ "of CHILD_SA inactivity", this->timeout);
+ status = ike_sa->delete(ike_sa);
+ }
+ else
+ {
+ DBG1(DBG_JOB, "deleting CHILD_SA after %d seconds "
+ "of inactivity", this->timeout);
+ status = ike_sa->delete_child_sa(ike_sa, proto, delete);
+ }
+ }
+ if (status == DESTROY_ME)
+ {
+ charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager,
+ ike_sa);
+ }
+ else
+ {
+ charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
+ }
+ }
+ if (!rescheduled)
+ {
+ destroy(this);
+ }
+}
+
+/**
+ * See header
+ */
+inactivity_job_t *inactivity_job_create(u_int32_t reqid, u_int32_t timeout,
+ bool close_ike)
+{
+ private_inactivity_job_t *this;
+
+ INIT(this,
+ .public.job_interface = {
+ .execute = _execute,
+ .destroy = _destroy,
+ },
+ .reqid = reqid,
+ .timeout = timeout,
+ .close_ike = close_ike,
+ );
+
+ return &this->public;
+}
+
diff --git a/src/charon/processing/jobs/inactivity_job.h b/src/charon/processing/jobs/inactivity_job.h
new file mode 100644
index 000000000..9c9daced8
--- /dev/null
+++ b/src/charon/processing/jobs/inactivity_job.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2010 Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+
+/**
+ * @defgroup inactivity_job inactivity_job
+ * @{ @ingroup jobs
+ */
+
+#ifndef INACTIVITY_JOB_H_
+#define INACTIVITY_JOB_H_
+
+#include <library.h>
+#include <processing/jobs/job.h>
+
+typedef struct inactivity_job_t inactivity_job_t;
+
+/**
+ * Job checking for inactivity of CHILD_SA to close them.
+ *
+ * The inactivity job reschedules itself to check CHILD_SAs prediodically.
+ */
+struct inactivity_job_t {
+
+ /**
+ * Implements job_t.
+ */
+ job_t job_interface;
+};
+
+/**
+ * Create a inactivity_job instance.
+ *
+ * @param reqid reqid of CHILD_SA to check for inactivity
+ * @param timeout inactivity timeout in s
+ * @param close_ike close IKE_SA if the last remaining CHILD_SA is inactive?
+ * @return inactivity checking job
+ */
+inactivity_job_t *inactivity_job_create(u_int32_t reqid, u_int32_t timeout,
+ bool close_ike);
+
+#endif /** INACTIVITY_JOB_H_ @}*/
diff --git a/src/charon/processing/jobs/initiate_mediation_job.c b/src/charon/processing/jobs/initiate_mediation_job.c
index 157d84341..ffe8755e2 100644
--- a/src/charon/processing/jobs/initiate_mediation_job.c
+++ b/src/charon/processing/jobs/initiate_mediation_job.c
@@ -29,12 +29,12 @@ struct private_initiate_mediation_job_t {
* public initiate_mediation_job_t interface
*/
initiate_mediation_job_t public;
-
+
/**
* ID of the IKE_SA of the mediated connection.
*/
ike_sa_id_t *mediated_sa_id;
-
+
/**
* ID of the IKE_SA of the mediation connection.
*/
@@ -68,26 +68,27 @@ static bool initiate_callback(private_initiate_mediation_job_t *this,
/**
* Implementation of job_t.execute.
- */
+ */
static void initiate(private_initiate_mediation_job_t *this)
{
ike_sa_t *mediated_sa, *mediation_sa;
peer_cfg_t *mediated_cfg, *mediation_cfg;
enumerator_t *enumerator;
auth_cfg_t *auth_cfg;
-
+
mediated_sa = charon->ike_sa_manager->checkout(charon->ike_sa_manager,
this->mediated_sa_id);
if (mediated_sa)
{
+ DBG1(DBG_IKE, "initiating mediation connection");
mediated_cfg = mediated_sa->get_peer_cfg(mediated_sa);
- mediated_cfg->get_ref(mediated_cfg);
-
+ mediated_cfg->get_ref(mediated_cfg);
+
charon->ike_sa_manager->checkin(charon->ike_sa_manager, mediated_sa);
-
+
mediation_cfg = mediated_cfg->get_mediated_by(mediated_cfg);
mediation_cfg->get_ref(mediation_cfg);
-
+
enumerator = mediation_cfg->create_auth_cfg_enumerator(mediation_cfg,
TRUE);
if (!enumerator->enumerate(enumerator, &auth_cfg) ||
@@ -99,7 +100,8 @@ static void initiate(private_initiate_mediation_job_t *this)
destroy(this);
return;
}
-
+ enumerator->destroy(enumerator);
+
if (charon->connect_manager->check_and_register(charon->connect_manager,
auth_cfg->get(auth_cfg, AUTH_RULE_IDENTITY),
mediated_cfg->get_peer_id(mediated_cfg),
@@ -107,7 +109,7 @@ static void initiate(private_initiate_mediation_job_t *this)
{
mediated_cfg->destroy(mediated_cfg);
mediation_cfg->destroy(mediation_cfg);
-
+
mediated_sa = charon->ike_sa_manager->checkout(
charon->ike_sa_manager, this->mediated_sa_id);
if (mediated_sa)
@@ -121,7 +123,7 @@ static void initiate(private_initiate_mediation_job_t *this)
return;
}
/* we need an additional reference because initiate consumes one */
- mediation_cfg->get_ref(mediation_cfg);
+ mediation_cfg->get_ref(mediation_cfg);
if (charon->controller->initiate(charon->controller, mediation_cfg,
NULL, (controller_cb_t)initiate_callback, this) != SUCCESS)
@@ -142,8 +144,7 @@ static void initiate(private_initiate_mediation_job_t *this)
mediation_cfg->destroy(mediation_cfg);
mediation_sa = charon->ike_sa_manager->checkout(charon->ike_sa_manager,
- this->mediation_sa_id);
-
+ this->mediation_sa_id);
if (mediation_sa)
{
if (mediation_sa->initiate_mediation(mediation_sa,
@@ -163,10 +164,9 @@ static void initiate(private_initiate_mediation_job_t *this)
destroy(this);
return;
}
-
- charon->ike_sa_manager->checkin(charon->ike_sa_manager, mediation_sa);
+ charon->ike_sa_manager->checkin(charon->ike_sa_manager,
+ mediation_sa);
}
-
mediated_cfg->destroy(mediated_cfg);
}
destroy(this);
@@ -174,44 +174,50 @@ static void initiate(private_initiate_mediation_job_t *this)
/**
* Implementation of job_t.execute.
- */
+ */
static void reinitiate(private_initiate_mediation_job_t *this)
{
ike_sa_t *mediated_sa, *mediation_sa;
peer_cfg_t *mediated_cfg;
-
+
mediated_sa = charon->ike_sa_manager->checkout(charon->ike_sa_manager,
- this->mediated_sa_id);
+ this->mediated_sa_id);
if (mediated_sa)
{
mediated_cfg = mediated_sa->get_peer_cfg(mediated_sa);
mediated_cfg->get_ref(mediated_cfg);
charon->ike_sa_manager->checkin(charon->ike_sa_manager, mediated_sa);
-
+
mediation_sa = charon->ike_sa_manager->checkout(charon->ike_sa_manager,
- this->mediation_sa_id);
+ this->mediation_sa_id);
if (mediation_sa)
{
- if (mediation_sa->initiate_mediation(mediation_sa, mediated_cfg) != SUCCESS)
+ if (mediation_sa->initiate_mediation(mediation_sa,
+ mediated_cfg) != SUCCESS)
{
DBG1(DBG_JOB, "initiating mediated connection '%s' failed",
- mediated_cfg->get_name(mediated_cfg));
+ mediated_cfg->get_name(mediated_cfg));
mediated_cfg->destroy(mediated_cfg);
- charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager, mediation_sa);
+ charon->ike_sa_manager->checkin_and_destroy(
+ charon->ike_sa_manager,
+ mediation_sa);
mediated_sa = charon->ike_sa_manager->checkout(
- charon->ike_sa_manager, this->mediated_sa_id);
+ charon->ike_sa_manager,
+ this->mediated_sa_id);
if (mediated_sa)
{
DBG1(DBG_IKE, "establishing mediation connection failed");
charon->ike_sa_manager->checkin_and_destroy(
- charon->ike_sa_manager, mediated_sa);
+ charon->ike_sa_manager,
+ mediated_sa);
}
destroy(this);
return;
}
- charon->ike_sa_manager->checkin(charon->ike_sa_manager, mediation_sa);
+ charon->ike_sa_manager->checkin(charon->ike_sa_manager,
+ mediation_sa);
}
-
+
mediated_cfg->destroy(mediated_cfg);
}
destroy(this);
@@ -223,10 +229,10 @@ static void reinitiate(private_initiate_mediation_job_t *this)
static private_initiate_mediation_job_t *initiate_mediation_job_create_empty()
{
private_initiate_mediation_job_t *this = malloc_thing(private_initiate_mediation_job_t);
-
+
/* interface functions */
this->public.job_interface.destroy = (void (*) (job_t *)) destroy;
-
+
/* private variables */
this->mediation_sa_id = NULL;
this->mediated_sa_id = NULL;
@@ -240,9 +246,9 @@ static private_initiate_mediation_job_t *initiate_mediation_job_create_empty()
initiate_mediation_job_t *initiate_mediation_job_create(ike_sa_id_t *ike_sa_id)
{
private_initiate_mediation_job_t *this = initiate_mediation_job_create_empty();
-
+
this->public.job_interface.execute = (void (*) (job_t *)) initiate;
-
+
this->mediated_sa_id = ike_sa_id->clone(ike_sa_id);
return &this->public;
@@ -255,11 +261,11 @@ initiate_mediation_job_t *reinitiate_mediation_job_create(ike_sa_id_t *mediation
ike_sa_id_t *mediated_sa_id)
{
private_initiate_mediation_job_t *this = initiate_mediation_job_create_empty();
-
+
this->public.job_interface.execute = (void (*) (job_t *)) reinitiate;
-
+
this->mediation_sa_id = mediation_sa_id->clone(mediation_sa_id);
this->mediated_sa_id = mediated_sa_id->clone(mediated_sa_id);
-
- return &this->public;
+
+ return &this->public;
}
diff --git a/src/charon/processing/jobs/initiate_mediation_job.h b/src/charon/processing/jobs/initiate_mediation_job.h
index 084e1b9fd..fddb1dd7b 100644
--- a/src/charon/processing/jobs/initiate_mediation_job.h
+++ b/src/charon/processing/jobs/initiate_mediation_job.h
@@ -28,7 +28,7 @@ typedef struct initiate_mediation_job_t initiate_mediation_job_t;
/**
* Class representing a INITIATE_MEDIATION Job.
- *
+ *
* This job will initiate a mediation on behalf of a mediated connection.
* If required the mediation connection is established.
*/
@@ -41,7 +41,7 @@ struct initiate_mediation_job_t {
/**
* Creates a job of type INITIATE_MEDIATION.
- *
+ *
* @param ike_sa_id identification of the ike_sa as ike_sa_id_t object (gets cloned)
* @return job object
*/
@@ -50,12 +50,13 @@ initiate_mediation_job_t *initiate_mediation_job_create(ike_sa_id_t *ike_sa_id);
/**
* Creates a special job of type INITIATE_MEDIATION that reinitiates a
* specific connection.
- *
+ *
* @param mediation_sa_id identification of the mediation sa (gets cloned)
* @param mediated_sa_id identification of the mediated sa (gets cloned)
* @return job object
*/
-initiate_mediation_job_t *reinitiate_mediation_job_create(ike_sa_id_t *mediation_sa_id,
- ike_sa_id_t *mediated_sa_id);
+initiate_mediation_job_t *reinitiate_mediation_job_create(
+ ike_sa_id_t *mediation_sa_id,
+ ike_sa_id_t *mediated_sa_id);
#endif /** INITIATE_MEDIATION_JOB_H_ @}*/
diff --git a/src/charon/processing/jobs/job.h b/src/charon/processing/jobs/job.h
index acc88b124..0f1c16ebe 100644
--- a/src/charon/processing/jobs/job.h
+++ b/src/charon/processing/jobs/job.h
@@ -33,7 +33,7 @@ struct job_t {
/**
* Execute a job.
- *
+ *
* The processing facility executes a job using this method. Jobs are
* one-shot, they destroy themself after execution, so don't use a job
* once it has been executed.
diff --git a/src/charon/processing/jobs/mediation_job.c b/src/charon/processing/jobs/mediation_job.c
index cf522faff..b5b8af3b3 100644
--- a/src/charon/processing/jobs/mediation_job.c
+++ b/src/charon/processing/jobs/mediation_job.c
@@ -29,37 +29,37 @@ struct private_mediation_job_t {
* public mediation_job_t interface
*/
mediation_job_t public;
-
+
/**
* ID of target peer.
*/
identification_t *target;
-
+
/**
* ID of the source peer.
*/
identification_t *source;
-
+
/**
* ME_CONNECTID
*/
chunk_t connect_id;
-
+
/**
* ME_CONNECTKEY
*/
chunk_t connect_key;
-
+
/**
* Submitted endpoints
*/
linked_list_t *endpoints;
-
+
/**
* Is this a callback job?
*/
bool callback;
-
+
/**
* Is this a response?
*/
@@ -81,13 +81,13 @@ static void destroy(private_mediation_job_t *this)
/**
* Implementation of job_t.execute.
- */
+ */
static void execute(private_mediation_job_t *this)
{
ike_sa_id_t *target_sa_id;
-
+
target_sa_id = charon->mediation_manager->check(charon->mediation_manager, this->target);
-
+
if (target_sa_id)
{
ike_sa_t *target_sa = charon->ike_sa_manager->checkout(charon->ike_sa_manager,
@@ -120,7 +120,7 @@ static void execute(private_mediation_job_t *this)
return;
}
}
-
+
charon->ike_sa_manager->checkin(charon->ike_sa_manager, target_sa);
}
else
@@ -143,11 +143,11 @@ static void execute(private_mediation_job_t *this)
static private_mediation_job_t *mediation_job_create_empty()
{
private_mediation_job_t *this = malloc_thing(private_mediation_job_t);
-
+
/* interface functions */
this->public.job_interface.execute = (void (*) (job_t *)) execute;
this->public.job_interface.destroy = (void (*) (job_t *)) destroy;
-
+
/* private variables */
this->target = NULL;
this->source = NULL;
@@ -156,7 +156,7 @@ static private_mediation_job_t *mediation_job_create_empty()
this->connect_key = chunk_empty;
this->endpoints = NULL;
this->response = FALSE;
-
+
return this;
}
@@ -175,7 +175,7 @@ mediation_job_t *mediation_job_create(identification_t *peer_id,
this->connect_key = chunk_clone(connect_key);
this->endpoints = endpoints->clone_offset(endpoints, offsetof(endpoint_notify_t, clone));
this->response = response;
-
+
return &this->public;
}
@@ -186,10 +186,10 @@ mediation_job_t *mediation_callback_job_create(identification_t *requester,
identification_t *peer_id)
{
private_mediation_job_t *this = mediation_job_create_empty();
-
+
this->target = requester->clone(requester);
this->source = peer_id->clone(peer_id);
this->callback = TRUE;
-
+
return &this->public;
}
diff --git a/src/charon/processing/jobs/mediation_job.h b/src/charon/processing/jobs/mediation_job.h
index 583ea8230..0574c65eb 100644
--- a/src/charon/processing/jobs/mediation_job.h
+++ b/src/charon/processing/jobs/mediation_job.h
@@ -30,7 +30,7 @@ typedef struct mediation_job_t mediation_job_t;
/**
* Class representing a MEDIATION Job.
- *
+ *
* This job handles the mediation on the mediation server.
*/
struct mediation_job_t {
@@ -42,9 +42,9 @@ struct mediation_job_t {
/**
* Creates a job of type MEDIATION.
- *
+ *
* Parameters get cloned.
- *
+ *
* @param peer_id ID of the requested peer
* @param requester ID of the requesting peer
* @param connect_id content of ME_CONNECTID (could be NULL)
@@ -61,9 +61,9 @@ mediation_job_t *mediation_job_create(identification_t *peer_id,
/**
* Creates a special job of type MEDIATION that is used to send a callback
* notification to a peer.
- *
+ *
* Parameters get cloned.
- *
+ *
* @param requester ID of the waiting peer
* @param peer_id ID of the requested peer
* @return job object
diff --git a/src/charon/processing/jobs/migrate_job.c b/src/charon/processing/jobs/migrate_job.c
index a57d0478b..05f47340c 100644
--- a/src/charon/processing/jobs/migrate_job.c
+++ b/src/charon/processing/jobs/migrate_job.c
@@ -30,7 +30,7 @@ struct private_migrate_job_t {
* Public migrate_job_t interface.
*/
migrate_job_t public;
-
+
/**
* reqid of the CHILD_SA if it already exists
*/
@@ -75,7 +75,7 @@ static void destroy(private_migrate_job_t *this)
static void execute(private_migrate_job_t *this)
{
ike_sa_t *ike_sa = NULL;
-
+
if (this->reqid)
{
ike_sa = charon->ike_sa_manager->checkout_by_id(charon->ike_sa_manager,
@@ -110,7 +110,7 @@ static void execute(private_migrate_job_t *this)
if (child_sa->update(child_sa, this->local, this->remote,
ike_sa->get_virtual_ip(ike_sa, TRUE),
- ike_sa->has_condition(ike_sa, COND_NAT_ANY)) == NOT_SUPPORTED)
+ ike_sa->has_condition(ike_sa, COND_NAT_ANY)) == NOT_SUPPORTED)
{
ike_sa->rekey_child_sa(ike_sa, child_sa->get_protocol(child_sa),
child_sa->get_spi(child_sa, TRUE));
@@ -134,17 +134,17 @@ migrate_job_t *migrate_job_create(u_int32_t reqid,
host_t *local, host_t *remote)
{
private_migrate_job_t *this = malloc_thing(private_migrate_job_t);
-
+
/* interface functions */
this->public.job_interface.execute = (void (*) (job_t *)) execute;
this->public.job_interface.destroy = (void (*)(job_t*)) destroy;
-
+
/* private variables */
this->reqid = reqid;
this->src_ts = (dir == POLICY_OUT) ? src_ts : dst_ts;
this->dst_ts = (dir == POLICY_OUT) ? dst_ts : src_ts;
this->local = local;
this->remote = remote;
-
+
return &this->public;
}
diff --git a/src/charon/processing/jobs/migrate_job.h b/src/charon/processing/jobs/migrate_job.h
index 672a09b0a..de313d517 100644
--- a/src/charon/processing/jobs/migrate_job.h
+++ b/src/charon/processing/jobs/migrate_job.h
@@ -25,14 +25,14 @@ typedef struct migrate_job_t migrate_job_t;
#include <library.h>
#include <utils/host.h>
-#include <config/traffic_selector.h>
+#include <selectors/traffic_selector.h>
#include <kernel/kernel_ipsec.h>
#include <processing/jobs/job.h>
/**
* Class representing a MIGRATE Job.
- *
- * This job sets a routed CHILD_SA for an existing IPsec policy.
+ *
+ * This job sets a routed CHILD_SA for an existing IPsec policy.
*/
struct migrate_job_t {
/**
@@ -49,15 +49,13 @@ struct migrate_job_t {
* @param reqid reqid of the CHILD_SA to acquire
* @param src_ts source traffic selector to be used in the policy
* @param dst_ts destination traffic selector to be used in the policy
- * @param dir direction of the policy (in|out)
- * @param local local host address to be used in the IKE_SA
- * @param remote remote host address to be used in the IKE_SA
+ * @param dir direction of the policy (in|out)
+ * @param local local host address to be used in the IKE_SA
+ * @param remote remote host address to be used in the IKE_SA
* @return migrate_job_t object
*/
migrate_job_t *migrate_job_create(u_int32_t reqid,
- traffic_selector_t *src_ts,
- traffic_selector_t *dst_ts,
- policy_dir_t dir,
- host_t *local, host_t *remote);
+ traffic_selector_t *src_ts, traffic_selector_t *dst_ts,
+ policy_dir_t dir, host_t *local, host_t *remote);
#endif /** MIGRATE_JOB_H_ @}*/
diff --git a/src/charon/processing/jobs/process_message_job.c b/src/charon/processing/jobs/process_message_job.c
index 1f0b3e287..a47d48e38 100644
--- a/src/charon/processing/jobs/process_message_job.c
+++ b/src/charon/processing/jobs/process_message_job.c
@@ -28,7 +28,7 @@ struct private_process_message_job_t {
* public process_message_job_t interface
*/
process_message_job_t public;
-
+
/**
* Message associated with this job
*/
@@ -50,9 +50,9 @@ static void destroy(private_process_message_job_t *this)
static void execute(private_process_message_job_t *this)
{
ike_sa_t *ike_sa;
-
+
#ifdef ME
- /* if this is an unencrypted INFORMATIONAL exchange it is likely a
+ /* if this is an unencrypted INFORMATIONAL exchange it is likely a
* connectivity check. */
if (this->message->get_exchange_type(this->message) == INFORMATIONAL &&
this->message->get_first_payload_type(this->message) != ENCRYPTED)
@@ -67,7 +67,7 @@ static void execute(private_process_message_job_t *this)
return;
}
#endif /* ME */
-
+
ike_sa = charon->ike_sa_manager->checkout_by_message(charon->ike_sa_manager,
this->message);
if (ike_sa)
@@ -98,9 +98,9 @@ process_message_job_t *process_message_job_create(message_t *message)
/* interface functions */
this->public.job_interface.execute = (void (*) (job_t *)) execute;
this->public.job_interface.destroy = (void(*)(job_t*))destroy;
-
+
/* private variables */
this->message = message;
-
+
return &(this->public);
}
diff --git a/src/charon/processing/jobs/process_message_job.h b/src/charon/processing/jobs/process_message_job.h
index b01d388f9..5e3f44d1f 100644
--- a/src/charon/processing/jobs/process_message_job.h
+++ b/src/charon/processing/jobs/process_message_job.h
@@ -40,7 +40,7 @@ struct process_message_job_t {
/**
* Creates a job of type PROCESS_MESSAGE.
- *
+ *
* @param message message to process
* @return created process_message_job_t object
*/
diff --git a/src/charon/processing/jobs/rekey_child_sa_job.c b/src/charon/processing/jobs/rekey_child_sa_job.c
index 17fcf641b..b797d181e 100644
--- a/src/charon/processing/jobs/rekey_child_sa_job.c
+++ b/src/charon/processing/jobs/rekey_child_sa_job.c
@@ -28,17 +28,17 @@ struct private_rekey_child_sa_job_t {
* Public rekey_child_sa_job_t interface.
*/
rekey_child_sa_job_t public;
-
+
/**
* reqid of the child to rekey
*/
u_int32_t reqid;
-
+
/**
* protocol of the CHILD_SA (ESP/AH)
*/
protocol_id_t protocol;
-
+
/**
* inbound SPI of the CHILD_SA
*/
@@ -59,7 +59,7 @@ static void destroy(private_rekey_child_sa_job_t *this)
static void execute(private_rekey_child_sa_job_t *this)
{
ike_sa_t *ike_sa;
-
+
ike_sa = charon->ike_sa_manager->checkout_by_id(charon->ike_sa_manager,
this->reqid, TRUE);
if (ike_sa == NULL)
@@ -69,7 +69,7 @@ static void execute(private_rekey_child_sa_job_t *this)
}
else
{
- ike_sa->rekey_child_sa(ike_sa, this->protocol, this->spi);
+ ike_sa->rekey_child_sa(ike_sa, this->protocol, this->spi);
charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
}
destroy(this);
@@ -78,20 +78,20 @@ static void execute(private_rekey_child_sa_job_t *this)
/*
* Described in header
*/
-rekey_child_sa_job_t *rekey_child_sa_job_create(u_int32_t reqid,
- protocol_id_t protocol,
+rekey_child_sa_job_t *rekey_child_sa_job_create(u_int32_t reqid,
+ protocol_id_t protocol,
u_int32_t spi)
{
private_rekey_child_sa_job_t *this = malloc_thing(private_rekey_child_sa_job_t);
-
+
/* interface functions */
this->public.job_interface.execute = (void (*) (job_t *)) execute;
this->public.job_interface.destroy = (void (*)(job_t*)) destroy;
-
+
/* private variables */
this->reqid = reqid;
this->protocol = protocol;
this->spi = spi;
-
+
return &this->public;
}
diff --git a/src/charon/processing/jobs/rekey_child_sa_job.h b/src/charon/processing/jobs/rekey_child_sa_job.h
index 2e2eef361..62887d6b9 100644
--- a/src/charon/processing/jobs/rekey_child_sa_job.h
+++ b/src/charon/processing/jobs/rekey_child_sa_job.h
@@ -51,7 +51,7 @@ struct rekey_child_sa_job_t {
* @param spi security parameter index of the CHILD_SA
* @return rekey_child_sa_job_t object
*/
-rekey_child_sa_job_t *rekey_child_sa_job_create(u_int32_t reqid,
+rekey_child_sa_job_t *rekey_child_sa_job_create(u_int32_t reqid,
protocol_id_t protocol,
u_int32_t spi);
#endif /** REKEY_CHILD_SA_JOB_H_ @}*/
diff --git a/src/charon/processing/jobs/rekey_ike_sa_job.c b/src/charon/processing/jobs/rekey_ike_sa_job.c
index 1ceb1e144..5ec0b1b88 100644
--- a/src/charon/processing/jobs/rekey_ike_sa_job.c
+++ b/src/charon/processing/jobs/rekey_ike_sa_job.c
@@ -12,7 +12,7 @@
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
-
+
#include "rekey_ike_sa_job.h"
#include <daemon.h>
@@ -27,12 +27,12 @@ struct private_rekey_ike_sa_job_t {
* Public rekey_ike_sa_job_t interface.
*/
rekey_ike_sa_job_t public;
-
+
/**
* ID of the IKE_SA to rekey
*/
ike_sa_id_t *ike_sa_id;
-
+
/**
* force reauthentication of the peer (full IKE_SA setup)
*/
@@ -55,7 +55,7 @@ static void execute(private_rekey_ike_sa_job_t *this)
{
ike_sa_t *ike_sa;
status_t status = SUCCESS;
-
+
ike_sa = charon->ike_sa_manager->checkout(charon->ike_sa_manager,
this->ike_sa_id);
if (ike_sa == NULL)
@@ -72,7 +72,7 @@ static void execute(private_rekey_ike_sa_job_t *this)
{
status = ike_sa->rekey(ike_sa);
}
-
+
if (status == DESTROY_ME)
{
charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager, ike_sa);
@@ -91,14 +91,14 @@ static void execute(private_rekey_ike_sa_job_t *this)
rekey_ike_sa_job_t *rekey_ike_sa_job_create(ike_sa_id_t *ike_sa_id, bool reauth)
{
private_rekey_ike_sa_job_t *this = malloc_thing(private_rekey_ike_sa_job_t);
-
+
/* interface functions */
this->public.job_interface.execute = (void (*) (job_t *)) execute;
this->public.job_interface.destroy = (void (*)(job_t*)) destroy;
-
+
/* private variables */
this->ike_sa_id = ike_sa_id->clone(ike_sa_id);
this->reauth = reauth;
-
+
return &(this->public);
}
diff --git a/src/charon/processing/jobs/rekey_ike_sa_job.h b/src/charon/processing/jobs/rekey_ike_sa_job.h
index 0d830e134..a5c1028aa 100644
--- a/src/charon/processing/jobs/rekey_ike_sa_job.h
+++ b/src/charon/processing/jobs/rekey_ike_sa_job.h
@@ -29,7 +29,7 @@ typedef struct rekey_ike_sa_job_t rekey_ike_sa_job_t;
/**
* Class representing an REKEY_IKE_SA Job.
- *
+ *
* This job initiates the rekeying of an IKE_SA.
*/
struct rekey_ike_sa_job_t {
diff --git a/src/charon/processing/jobs/retransmit_job.c b/src/charon/processing/jobs/retransmit_job.c
index 122cad853..fc787f208 100644
--- a/src/charon/processing/jobs/retransmit_job.c
+++ b/src/charon/processing/jobs/retransmit_job.c
@@ -13,7 +13,7 @@
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
-
+
#include "retransmit_job.h"
#include <daemon.h>
@@ -28,7 +28,7 @@ struct private_retransmit_job_t {
* Public retransmit_job_t interface.
*/
retransmit_job_t public;
-
+
/**
* Message ID of the request to resend.
*/
@@ -55,7 +55,7 @@ static void destroy(private_retransmit_job_t *this)
static void execute(private_retransmit_job_t *this)
{
ike_sa_t *ike_sa;
-
+
ike_sa = charon->ike_sa_manager->checkout(charon->ike_sa_manager,
this->ike_sa_id);
if (ike_sa)
@@ -80,7 +80,7 @@ static void execute(private_retransmit_job_t *this)
retransmit_job_t *retransmit_job_create(u_int32_t message_id,ike_sa_id_t *ike_sa_id)
{
private_retransmit_job_t *this = malloc_thing(private_retransmit_job_t);
-
+
/* interface functions */
this->public.job_interface.execute = (void (*) (job_t *)) execute;
this->public.job_interface.destroy = (void (*) (job_t *)) destroy;
@@ -88,6 +88,6 @@ retransmit_job_t *retransmit_job_create(u_int32_t message_id,ike_sa_id_t *ike_sa
/* private variables */
this->message_id = message_id;
this->ike_sa_id = ike_sa_id->clone(ike_sa_id);
-
+
return &this->public;
}
diff --git a/src/charon/processing/jobs/retransmit_job.h b/src/charon/processing/jobs/retransmit_job.h
index 4c9bea1c8..c8c13479b 100644
--- a/src/charon/processing/jobs/retransmit_job.h
+++ b/src/charon/processing/jobs/retransmit_job.h
@@ -44,7 +44,7 @@ struct retransmit_job_t {
/**
* Creates a job of type retransmit.
- *
+ *
* @param message_id message_id of the request to resend
* @param ike_sa_id identification of the ike_sa as ike_sa_id_t
* @return retransmit_job_t object
diff --git a/src/charon/processing/jobs/roam_job.c b/src/charon/processing/jobs/roam_job.c
index c01f83248..adc884a8a 100644
--- a/src/charon/processing/jobs/roam_job.c
+++ b/src/charon/processing/jobs/roam_job.c
@@ -31,7 +31,7 @@ struct private_roam_job_t {
* public roam_job_t interface
*/
roam_job_t public;
-
+
/**
* has the address list changed, or the routing only?
*/
@@ -47,16 +47,16 @@ static void destroy(private_roam_job_t *this)
}
/**
- * Implementation of job_t.execute.
- */
+ * Implementation of job_t.execute.
+ */
static void execute(private_roam_job_t *this)
{
ike_sa_t *ike_sa;
linked_list_t *list;
ike_sa_id_t *id;
enumerator_t *enumerator;
-
- /* enumerator over all IKE_SAs gives us no way to checkin_and_destroy
+
+ /* enumerator over all IKE_SAs gives us no way to checkin_and_destroy
* after a DESTROY_ME, so we check out each available IKE_SA by hand. */
list = linked_list_create();
enumerator = charon->ike_sa_manager->create_enumerator(charon->ike_sa_manager);
@@ -66,7 +66,7 @@ static void execute(private_roam_job_t *this)
list->insert_last(list, id->clone(id));
}
enumerator->destroy(enumerator);
-
+
while (list->remove_last(list, (void**)&id) == SUCCESS)
{
ike_sa = charon->ike_sa_manager->checkout(charon->ike_sa_manager, id);
@@ -95,10 +95,10 @@ static void execute(private_roam_job_t *this)
roam_job_t *roam_job_create(bool address)
{
private_roam_job_t *this = malloc_thing(private_roam_job_t);
-
+
this->public.job_interface.execute = (void (*) (job_t *)) execute;
this->public.job_interface.destroy = (void (*) (job_t *)) destroy;
-
+
this->address = address;
return &this->public;
diff --git a/src/charon/processing/jobs/roam_job.h b/src/charon/processing/jobs/roam_job.h
index 7bb1227f5..55bdf2b28 100644
--- a/src/charon/processing/jobs/roam_job.h
+++ b/src/charon/processing/jobs/roam_job.h
@@ -29,7 +29,7 @@ typedef struct roam_job_t roam_job_t;
/**
* A job to inform IKE_SAs about changed local address setup.
- *
+ *
* If a local address appears or disappears, the kernel fires this job to
* update all IKE_SAs.
*/
@@ -43,7 +43,7 @@ struct roam_job_t {
/**
* Creates a job to inform IKE_SAs about an updated address list.
- *
+ *
* @param address TRUE if address list changed, FALSE if routing changed
* @return initiate_ike_sa_job_t object
*/
diff --git a/src/charon/processing/jobs/send_dpd_job.c b/src/charon/processing/jobs/send_dpd_job.c
index c6e81a56f..1c2da52b8 100644
--- a/src/charon/processing/jobs/send_dpd_job.c
+++ b/src/charon/processing/jobs/send_dpd_job.c
@@ -31,7 +31,7 @@ struct private_send_dpd_job_t {
* public send_dpd_job_t interface
*/
send_dpd_job_t public;
-
+
/**
* ID of the IKE_SA which the message belongs to.
*/
@@ -48,12 +48,12 @@ static void destroy(private_send_dpd_job_t *this)
}
/**
- * Implementation of job_t.execute.
- */
+ * Implementation of job_t.execute.
+ */
static void execute(private_send_dpd_job_t *this)
{
ike_sa_t *ike_sa;
-
+
ike_sa = charon->ike_sa_manager->checkout(charon->ike_sa_manager,
this->ike_sa_id);
if (ike_sa)
@@ -76,11 +76,11 @@ static void execute(private_send_dpd_job_t *this)
send_dpd_job_t *send_dpd_job_create(ike_sa_id_t *ike_sa_id)
{
private_send_dpd_job_t *this = malloc_thing(private_send_dpd_job_t);
-
+
/* interface functions */
this->public.job_interface.execute = (void (*) (job_t *)) execute;
this->public.job_interface.destroy = (void (*) (job_t *)) destroy;
-
+
/* private variables */
this->ike_sa_id = ike_sa_id->clone(ike_sa_id);
diff --git a/src/charon/processing/jobs/send_dpd_job.h b/src/charon/processing/jobs/send_dpd_job.h
index 91556a9d1..8078a38bc 100644
--- a/src/charon/processing/jobs/send_dpd_job.h
+++ b/src/charon/processing/jobs/send_dpd_job.h
@@ -29,7 +29,7 @@ typedef struct send_dpd_job_t send_dpd_job_t;
/**
* Class representing a SEND_DPD Job.
- *
+ *
* Job to periodically send a Dead Peer Detection (DPD) request,
* ie. an IKE request with no payloads other than the encrypted payload
* required by the syntax.
@@ -43,7 +43,7 @@ struct send_dpd_job_t {
/**
* Creates a job of type SEND_DPD.
- *
+ *
* @param ike_sa_id identification of the ike_sa as ike_sa_id_t object (gets cloned)
* @return initiate_ike_sa_job_t object
*/
diff --git a/src/charon/processing/jobs/send_keepalive_job.c b/src/charon/processing/jobs/send_keepalive_job.c
index 5d3cfb530..3d02cea2e 100644
--- a/src/charon/processing/jobs/send_keepalive_job.c
+++ b/src/charon/processing/jobs/send_keepalive_job.c
@@ -31,7 +31,7 @@ struct private_send_keepalive_job_t {
* public send_keepalive_job_t interface
*/
send_keepalive_job_t public;
-
+
/**
* ID of the IKE_SA which the message belongs to.
*/
@@ -49,11 +49,11 @@ static void destroy(private_send_keepalive_job_t *this)
/**
* Implementation of job_t.execute.
- */
+ */
static void execute(private_send_keepalive_job_t *this)
{
ike_sa_t *ike_sa;
-
+
ike_sa = charon->ike_sa_manager->checkout(charon->ike_sa_manager,
this->ike_sa_id);
if (ike_sa)
@@ -70,11 +70,11 @@ static void execute(private_send_keepalive_job_t *this)
send_keepalive_job_t *send_keepalive_job_create(ike_sa_id_t *ike_sa_id)
{
private_send_keepalive_job_t *this = malloc_thing(private_send_keepalive_job_t);
-
+
/* interface functions */
this->public.job_interface.execute = (void (*) (job_t *)) execute;
this->public.job_interface.destroy = (void (*) (job_t *)) destroy;
-
+
/* private variables */
this->ike_sa_id = ike_sa_id->clone(ike_sa_id);
diff --git a/src/charon/processing/jobs/send_keepalive_job.h b/src/charon/processing/jobs/send_keepalive_job.h
index f92e6217a..cda83cd7e 100644
--- a/src/charon/processing/jobs/send_keepalive_job.h
+++ b/src/charon/processing/jobs/send_keepalive_job.h
@@ -29,7 +29,7 @@ typedef struct send_keepalive_job_t send_keepalive_job_t;
/**
* Class representing a SEND_KEEPALIVE Job.
- *
+ *
* This job will send a NAT keepalive packet if the IKE SA is still alive,
* and reinsert itself into the event queue.
*/
@@ -42,7 +42,7 @@ struct send_keepalive_job_t {
/**
* Creates a job of type SEND_KEEPALIVE.
- *
+ *
* @param ike_sa_id identification of the ike_sa as ike_sa_id_t object (gets cloned)
* @return initiate_ike_sa_job_t object
*/
diff --git a/src/charon/processing/jobs/update_sa_job.c b/src/charon/processing/jobs/update_sa_job.c
index 5e6c83942..17dce2548 100644
--- a/src/charon/processing/jobs/update_sa_job.c
+++ b/src/charon/processing/jobs/update_sa_job.c
@@ -31,12 +31,12 @@ struct private_update_sa_job_t {
* public update_sa_job_t interface
*/
update_sa_job_t public;
-
+
/**
* reqid of the CHILD_SA
*/
u_int32_t reqid;
-
+
/**
* New SA address and port
*/
@@ -53,12 +53,12 @@ static void destroy(private_update_sa_job_t *this)
}
/**
- * Implementation of job_t.execute.
- */
+ * Implementation of job_t.execute.
+ */
static void execute(private_update_sa_job_t *this)
{
ike_sa_t *ike_sa;
-
+
ike_sa = charon->ike_sa_manager->checkout_by_id(charon->ike_sa_manager,
this->reqid, TRUE);
if (ike_sa == NULL)
@@ -84,10 +84,10 @@ static void execute(private_update_sa_job_t *this)
update_sa_job_t *update_sa_job_create(u_int32_t reqid, host_t *new)
{
private_update_sa_job_t *this = malloc_thing(private_update_sa_job_t);
-
+
this->public.job_interface.execute = (void (*) (job_t *)) execute;
this->public.job_interface.destroy = (void (*) (job_t *)) destroy;
-
+
this->reqid = reqid;
this->new = new;
diff --git a/src/charon/processing/jobs/update_sa_job.h b/src/charon/processing/jobs/update_sa_job.h
index 93262d46f..11d1ac9b6 100644
--- a/src/charon/processing/jobs/update_sa_job.h
+++ b/src/charon/processing/jobs/update_sa_job.h
@@ -40,7 +40,7 @@ struct update_sa_job_t {
/**
* Creates a job to update IKE and CHILD_SA addresses.
- *
+ *
* @param reqid reqid of the CHILD_SA
* @param new new address and port
* @return update_sa_job_t object
diff --git a/src/charon/processing/processor.c b/src/charon/processing/processor.c
index 4a3943323..d5774af26 100644
--- a/src/charon/processing/processor.c
+++ b/src/charon/processing/processor.c
@@ -13,16 +13,17 @@
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
-
+
#include <stdlib.h>
-#include <pthread.h>
#include <string.h>
#include <errno.h>
#include "processor.h"
#include <daemon.h>
-#include <utils/mutex.h>
+#include <threading/thread.h>
+#include <threading/condvar.h>
+#include <threading/mutex.h>
#include <utils/linked_list.h>
@@ -41,22 +42,28 @@ struct private_processor_t {
* Number of running threads
*/
u_int total_threads;
-
+
/**
* Desired number of threads
*/
u_int desired_threads;
-
+
/**
* Number of threads waiting for work
*/
u_int idle_threads;
/**
+ * All threads managed in the pool (including threads that have been
+ * cancelled, this allows to join them during destruction)
+ */
+ linked_list_t *threads;
+
+ /**
* The jobs are stored in a linked list
*/
linked_list_t *list;
-
+
/**
* access to linked_list is locked through this mutex
*/
@@ -66,7 +73,7 @@ struct private_processor_t {
* Condvar to wait for new jobs
*/
condvar_t *job_added;
-
+
/**
* Condvar to wait for terminated threads
*/
@@ -80,17 +87,23 @@ static void process_jobs(private_processor_t *this);
*/
static void restart(private_processor_t *this)
{
- pthread_t thread;
-
+ thread_t *thread;
+
+ DBG2(DBG_JOB, "terminated worker thread, ID: %u", thread_current_id());
+
/* respawn thread if required */
- if (this->desired_threads == 0 ||
- pthread_create(&thread, NULL, (void*)process_jobs, this) != 0)
+ this->mutex->lock(this->mutex);
+ if (this->desired_threads < this->total_threads ||
+ (thread = thread_create((thread_main_t)process_jobs, this)) == NULL)
{
- this->mutex->lock(this->mutex);
this->total_threads--;
- this->thread_terminated->broadcast(this->thread_terminated);
- this->mutex->unlock(this->mutex);
+ this->thread_terminated->signal(this->thread_terminated);
}
+ else
+ {
+ this->threads->insert_last(this->threads, thread);
+ }
+ this->mutex->unlock(this->mutex);
}
/**
@@ -98,17 +111,16 @@ static void restart(private_processor_t *this)
*/
static void process_jobs(private_processor_t *this)
{
- int oldstate;
-
- pthread_setcancelstate(PTHREAD_CANCEL_DISABLE, &oldstate);
-
- DBG2(DBG_JOB, "started worker thread, thread_ID: %06u", (int)pthread_self());
-
+ /* worker threads are not cancellable by default */
+ thread_cancelability(FALSE);
+
+ DBG2(DBG_JOB, "started worker thread, ID: %u", thread_current_id());
+
this->mutex->lock(this->mutex);
while (this->desired_threads >= this->total_threads)
{
job_t *job;
-
+
if (this->list->get_count(this->list) == 0)
{
this->idle_threads++;
@@ -119,14 +131,13 @@ static void process_jobs(private_processor_t *this)
this->list->remove_first(this->list, (void**)&job);
this->mutex->unlock(this->mutex);
/* terminated threads are restarted, so we have a constant pool */
- pthread_cleanup_push((void*)restart, this);
+ thread_cleanup_push((thread_cleanup_t)restart, this);
job->execute(job);
- pthread_cleanup_pop(0);
+ thread_cleanup_pop(FALSE);
this->mutex->lock(this->mutex);
}
- this->total_threads--;
- this->thread_terminated->signal(this->thread_terminated);
this->mutex->unlock(this->mutex);
+ restart(this);
}
/**
@@ -136,7 +147,7 @@ static u_int get_total_threads(private_processor_t *this)
{
u_int count;
this->mutex->lock(this->mutex);
- count = this->total_threads;
+ count = this->total_threads;
this->mutex->unlock(this->mutex);
return count;
}
@@ -175,7 +186,7 @@ static void queue_job(private_processor_t *this, job_t *job)
this->job_added->signal(this->job_added);
this->mutex->unlock(this->mutex);
}
-
+
/**
* Implementation of processor_t.set_threads.
*/
@@ -185,14 +196,16 @@ static void set_threads(private_processor_t *this, u_int count)
if (count > this->total_threads)
{ /* increase thread count */
int i;
- pthread_t current;
-
+ thread_t *current;
+
this->desired_threads = count;
DBG1(DBG_JOB, "spawning %d worker threads", count - this->total_threads);
for (i = this->total_threads; i < count; i++)
{
- if (pthread_create(&current, NULL, (void*)process_jobs, this) == 0)
+ current = thread_create((thread_main_t)process_jobs, this);
+ if (current)
{
+ this->threads->insert_last(this->threads, current);
this->total_threads++;
}
}
@@ -210,6 +223,7 @@ static void set_threads(private_processor_t *this, u_int count)
*/
static void destroy(private_processor_t *this)
{
+ thread_t *current;
set_threads(this, 0);
this->mutex->lock(this->mutex);
while (this->total_threads > 0)
@@ -217,11 +231,17 @@ static void destroy(private_processor_t *this)
this->job_added->broadcast(this->job_added);
this->thread_terminated->wait(this->thread_terminated, this->mutex);
}
+ while (this->threads->remove_first(this->threads,
+ (void**)&current) == SUCCESS)
+ {
+ current->join(current);
+ }
this->mutex->unlock(this->mutex);
this->thread_terminated->destroy(this->thread_terminated);
this->job_added->destroy(this->job_added);
this->mutex->destroy(this->mutex);
this->list->destroy_offset(this->list, offsetof(job_t, destroy));
+ this->threads->destroy(this->threads);
free(this);
}
@@ -231,22 +251,23 @@ static void destroy(private_processor_t *this)
processor_t *processor_create(size_t pool_size)
{
private_processor_t *this = malloc_thing(private_processor_t);
-
+
this->public.get_total_threads = (u_int(*)(processor_t*))get_total_threads;
this->public.get_idle_threads = (u_int(*)(processor_t*))get_idle_threads;
this->public.get_job_load = (u_int(*)(processor_t*))get_job_load;
this->public.queue_job = (void(*)(processor_t*, job_t*))queue_job;
this->public.set_threads = (void(*)(processor_t*, u_int))set_threads;
this->public.destroy = (void(*)(processor_t*))destroy;
-
+
this->list = linked_list_create();
+ this->threads = linked_list_create();
this->mutex = mutex_create(MUTEX_TYPE_DEFAULT);
this->job_added = condvar_create(CONDVAR_TYPE_DEFAULT);
this->thread_terminated = condvar_create(CONDVAR_TYPE_DEFAULT);
this->total_threads = 0;
this->desired_threads = 0;
this->idle_threads = 0;
-
+
return &this->public;
}
diff --git a/src/charon/processing/processor.h b/src/charon/processing/processor.h
index e56e69382..5bf8cf573 100644
--- a/src/charon/processing/processor.h
+++ b/src/charon/processing/processor.h
@@ -33,21 +33,21 @@ typedef struct processor_t processor_t;
* The processor uses threads to process queued jobs.
*/
struct processor_t {
-
+
/**
* Get the total number of threads used by the processor.
- *
+ *
* @return size of thread pool
*/
u_int (*get_total_threads) (processor_t *this);
-
+
/**
* Get the number of threads currently waiting.
- *
+ *
* @return number of idle threads
*/
u_int (*get_idle_threads) (processor_t *this);
-
+
/**
* Get the number of queued jobs.
*
@@ -60,10 +60,10 @@ struct processor_t {
*
* This function is non blocking and adds a job_t to the queue.
*
- * @param job job to add to the queue
+ * @param job job to add to the queue
*/
void (*queue_job) (processor_t *this, job_t *job);
-
+
/**
* Set the number of threads to use in the processor.
*
@@ -75,7 +75,7 @@ struct processor_t {
* @param count number of threads to allocate
*/
void (*set_threads)(processor_t *this, u_int count);
-
+
/**
* Destroy a processor object.
*/
diff --git a/src/charon/processing/scheduler.c b/src/charon/processing/scheduler.c
index 1f59205af..345af502a 100644
--- a/src/charon/processing/scheduler.c
+++ b/src/charon/processing/scheduler.c
@@ -16,14 +16,15 @@
*/
#include <stdlib.h>
-#include <pthread.h>
#include "scheduler.h"
#include <daemon.h>
#include <processing/processor.h>
#include <processing/jobs/callback_job.h>
-#include <utils/mutex.h>
+#include <threading/thread.h>
+#include <threading/condvar.h>
+#include <threading/mutex.h>
/* the initial size of the heap */
#define HEAP_SIZE_DEFAULT 64
@@ -38,7 +39,7 @@ struct event_t {
* Time to fire the event.
*/
timeval_t time;
-
+
/**
* Every event has its assigned job.
*/
@@ -60,37 +61,37 @@ typedef struct private_scheduler_t private_scheduler_t;
* Private data of a scheduler_t object.
*/
struct private_scheduler_t {
-
+
/**
* Public part of a scheduler_t object.
*/
scheduler_t public;
-
+
/**
* Job which queues scheduled jobs to the processor.
*/
callback_job_t *job;
-
+
/**
* The heap in which the events are stored.
*/
event_t **heap;
-
+
/**
* The size of the heap.
*/
u_int heap_size;
-
+
/**
* The number of scheduled events.
*/
u_int event_count;
-
+
/**
* Exclusive access to list
*/
mutex_t *mutex;
-
+
/**
* Condvar to wait for next job.
*/
@@ -140,12 +141,12 @@ static event_t *remove_event(private_scheduler_t *this)
{
return NULL;
}
-
+
/* store the value to return */
event = this->heap[1];
/* move the bottom event to the top */
top = this->heap[1] = this->heap[this->event_count];
-
+
if (--this->event_count > 1)
{
/* seep down the top event */
@@ -153,7 +154,7 @@ static event_t *remove_event(private_scheduler_t *this)
while ((position << 1) <= this->event_count)
{
u_int child = position << 1;
-
+
if ((child + 1) <= this->event_count &&
timeval_cmp(&this->heap[child + 1]->time,
&this->heap[child]->time) < 0)
@@ -161,14 +162,14 @@ static event_t *remove_event(private_scheduler_t *this)
/* the "right" child is smaller */
child++;
}
-
+
if (timeval_cmp(&top->time, &this->heap[child]->time) <= 0)
{
/* the top event fires before the smaller of the two children,
* stop */
break;
}
-
+
/* swap with the smaller child */
this->heap[position] = this->heap[child];
position = child;
@@ -185,13 +186,12 @@ static job_requeue_t schedule(private_scheduler_t * this)
{
timeval_t now;
event_t *event;
- int oldstate;
- bool timed = FALSE;
-
+ bool timed = FALSE, oldstate;
+
this->mutex->lock(this->mutex);
-
- gettimeofday(&now, NULL);
-
+
+ time_monotonic(&now);
+
if ((event = peek_event(this)) != NULL)
{
if (timeval_cmp(&now, &event->time) >= 0)
@@ -215,9 +215,9 @@ static job_requeue_t schedule(private_scheduler_t * this)
}
timed = TRUE;
}
- pthread_cleanup_push((void*)this->mutex->unlock, this->mutex);
- pthread_setcancelstate(PTHREAD_CANCEL_ENABLE, &oldstate);
-
+ thread_cleanup_push((thread_cleanup_t)this->mutex->unlock, this->mutex);
+ oldstate = thread_cancelability(TRUE);
+
if (timed)
{
this->condvar->timed_wait_abs(this->condvar, this->mutex, event->time);
@@ -227,8 +227,8 @@ static job_requeue_t schedule(private_scheduler_t * this)
DBG2(DBG_JOB, "no events, waiting");
this->condvar->wait(this->condvar, this->mutex);
}
- pthread_setcancelstate(oldstate, NULL);
- pthread_cleanup_pop(TRUE);
+ thread_cancelability(oldstate);
+ thread_cleanup_pop(TRUE);
return JOB_REQUEUE_DIRECT;
}
@@ -251,13 +251,13 @@ static void schedule_job_tv(private_scheduler_t *this, job_t *job, timeval_t tv)
{
event_t *event;
u_int position;
-
+
event = malloc_thing(event_t);
event->job = job;
event->time = tv;
-
+
this->mutex->lock(this->mutex);
-
+
this->event_count++;
if (this->event_count > this->heap_size)
{
@@ -268,7 +268,7 @@ static void schedule_job_tv(private_scheduler_t *this, job_t *job, timeval_t tv)
}
/* "put" the event to the bottom */
position = this->event_count;
-
+
/* then bubble it up */
while (position > 1 && timeval_cmp(&this->heap[position >> 1]->time,
&event->time) > 0)
@@ -278,7 +278,7 @@ static void schedule_job_tv(private_scheduler_t *this, job_t *job, timeval_t tv)
position >>= 1;
}
this->heap[position] = event;
-
+
this->condvar->signal(this->condvar);
this->mutex->unlock(this->mutex);
}
@@ -289,10 +289,10 @@ static void schedule_job_tv(private_scheduler_t *this, job_t *job, timeval_t tv)
static void schedule_job(private_scheduler_t *this, job_t *job, u_int32_t s)
{
timeval_t tv;
-
- gettimeofday(&tv, NULL);
+
+ time_monotonic(&tv);
tv.tv_sec += s;
-
+
schedule_job_tv(this, job, tv);
}
@@ -302,13 +302,13 @@ static void schedule_job(private_scheduler_t *this, job_t *job, u_int32_t s)
static void schedule_job_ms(private_scheduler_t *this, job_t *job, u_int32_t ms)
{
timeval_t tv, add;
-
- gettimeofday(&tv, NULL);
+
+ time_monotonic(&tv);
add.tv_sec = ms / 1000;
add.tv_usec = (ms % 1000) * 1000;
-
+
timeradd(&tv, &add, &tv);
-
+
schedule_job_tv(this, job, tv);
}
@@ -335,24 +335,24 @@ static void destroy(private_scheduler_t *this)
scheduler_t * scheduler_create()
{
private_scheduler_t *this = malloc_thing(private_scheduler_t);
-
+
this->public.get_job_load = (u_int (*) (scheduler_t *this)) get_job_load;
this->public.schedule_job = (void (*) (scheduler_t *this, job_t *job, u_int32_t s)) schedule_job;
this->public.schedule_job_ms = (void (*) (scheduler_t *this, job_t *job, u_int32_t ms)) schedule_job_ms;
this->public.schedule_job_tv = (void (*) (scheduler_t *this, job_t *job, timeval_t tv)) schedule_job_tv;
this->public.destroy = (void(*)(scheduler_t*)) destroy;
-
+
/* Note: the root of the heap is at index 1 */
this->event_count = 0;
this->heap_size = HEAP_SIZE_DEFAULT;
this->heap = (event_t**)calloc(this->heap_size + 1, sizeof(event_t*));
-
+
this->mutex = mutex_create(MUTEX_TYPE_DEFAULT);
this->condvar = condvar_create(CONDVAR_TYPE_DEFAULT);
-
+
this->job = callback_job_create((callback_job_cb_t)schedule, this, NULL, NULL);
charon->processor->queue_job(charon->processor, (job_t*)this->job);
-
+
return &this->public;
}
diff --git a/src/charon/processing/scheduler.h b/src/charon/processing/scheduler.h
index 502f70b33..5f5d2a563 100644
--- a/src/charon/processing/scheduler.h
+++ b/src/charon/processing/scheduler.h
@@ -25,8 +25,6 @@
typedef struct scheduler_t scheduler_t;
-#include <sys/time.h>
-
#include <library.h>
#include <processing/jobs/job.h>
@@ -81,7 +79,7 @@ typedef struct scheduler_t scheduler_t;
* children has a smaller key or it is again a leaf node.
*/
struct scheduler_t {
-
+
/**
* Adds a event to the queue, using a relative time offset in s.
*
@@ -89,7 +87,7 @@ struct scheduler_t {
* @param time relative time to schedule job, in s
*/
void (*schedule_job) (scheduler_t *this, job_t *job, u_int32_t s);
-
+
/**
* Adds a event to the queue, using a relative time offset in ms.
*
@@ -97,22 +95,25 @@ struct scheduler_t {
* @param time relative time to schedule job, in ms
*/
void (*schedule_job_ms) (scheduler_t *this, job_t *job, u_int32_t ms);
-
+
/**
* Adds a event to the queue, using an absolut time.
*
+ * The passed timeval should be calculated based on the time_monotonic()
+ * function.
+ *
* @param job job to schedule
* @param time absolut time to schedule job
*/
void (*schedule_job_tv) (scheduler_t *this, job_t *job, timeval_t tv);
-
+
/**
* Returns number of jobs scheduled.
*
* @return number of scheduled jobs
*/
u_int (*get_job_load) (scheduler_t *this);
-
+
/**
* Destroys a scheduler object.
*/
diff --git a/src/charon/sa/authenticators/authenticator.c b/src/charon/sa/authenticators/authenticator.c
index ea8a16279..13586a23e 100644
--- a/src/charon/sa/authenticators/authenticator.c
+++ b/src/charon/sa/authenticators/authenticator.c
@@ -75,7 +75,7 @@ authenticator_t *authenticator_create_verifier(
chunk_t received_init, chunk_t sent_init)
{
auth_payload_t *auth_payload;
-
+
auth_payload = (auth_payload_t*)message->get_payload(message, AUTHENTICATION);
if (auth_payload == NULL)
{
diff --git a/src/charon/sa/authenticators/authenticator.h b/src/charon/sa/authenticators/authenticator.h
index c60881629..fff91ed34 100644
--- a/src/charon/sa/authenticators/authenticator.h
+++ b/src/charon/sa/authenticators/authenticator.h
@@ -36,34 +36,34 @@ typedef struct authenticator_t authenticator_t;
*/
enum auth_method_t {
/**
- * Computed as specified in section 2.15 of RFC using
+ * Computed as specified in section 2.15 of RFC using
* an RSA private key over a PKCS#1 padded hash.
*/
AUTH_RSA = 1,
-
+
/**
- * Computed as specified in section 2.15 of RFC using the
- * shared key associated with the identity in the ID payload
+ * Computed as specified in section 2.15 of RFC using the
+ * shared key associated with the identity in the ID payload
* and the negotiated prf function
*/
AUTH_PSK = 2,
-
+
/**
- * Computed as specified in section 2.15 of RFC using a
+ * Computed as specified in section 2.15 of RFC using a
* DSS private key over a SHA-1 hash.
*/
AUTH_DSS = 3,
-
+
/**
* ECDSA with SHA-256 on the P-256 curve as specified in RFC 4754
*/
AUTH_ECDSA_256 = 9,
-
+
/**
* ECDSA with SHA-384 on the P-384 curve as specified in RFC 4754
*/
AUTH_ECDSA_384 = 10,
-
+
/**
* ECDSA with SHA-512 on the P-521 curve as specified in RFC 4754
*/
@@ -115,7 +115,7 @@ struct authenticator_t {
* - NEED_MORE if another exchange required
*/
status_t (*process)(authenticator_t *this, message_t *message);
-
+
/**
* Attach authentication data to an outgoing message.
*
@@ -126,7 +126,17 @@ struct authenticator_t {
* - NEED_MORE if another exchange required
*/
status_t (*build)(authenticator_t *this, message_t *message);
-
+
+ /**
+ * Check if the authenticator is capable of mutual authentication.
+ *
+ * Some authenticator authenticate both peers, e.g. EAP. To support
+ * mutual authentication with only a single authenticator (EAP-only
+ * authentication), it must be mutual. This method is invoked in ike_auth
+ * to check if the given authenticator is capable of doing so.
+ */
+ bool (*is_mutual)(authenticator_t *this);
+
/**
* Destroy authenticator instance.
*/
@@ -151,7 +161,7 @@ authenticator_t *authenticator_create_builder(
/**
* Create an authenticator to verify signatures.
- *
+ *
* @param ike_sa associated ike_sa
* @param message message containing authentication data
* @param received_nonce nonce received in IKE_SA_INIT
diff --git a/src/charon/sa/authenticators/eap/eap_manager.c b/src/charon/sa/authenticators/eap/eap_manager.c
index 24a4fd6ed..f795183f0 100644
--- a/src/charon/sa/authenticators/eap/eap_manager.c
+++ b/src/charon/sa/authenticators/eap/eap_manager.c
@@ -16,7 +16,7 @@
#include "eap_manager.h"
#include <utils/linked_list.h>
-#include <utils/mutex.h>
+#include <threading/rwlock.h>
typedef struct private_eap_manager_t private_eap_manager_t;
typedef struct eap_entry_t eap_entry_t;
@@ -25,22 +25,22 @@ typedef struct eap_entry_t eap_entry_t;
* EAP constructor entry
*/
struct eap_entry_t {
-
+
/**
* EAP method type, vendor specific if vendor is set
*/
eap_type_t type;
-
+
/**
* vendor ID, 0 for default EAP methods
*/
u_int32_t vendor;
-
+
/**
* Role of the method returned by the constructor, EAP_SERVER or EAP_PEER
*/
eap_role_t role;
-
+
/**
* constructor function to create instance
*/
@@ -56,12 +56,12 @@ struct private_eap_manager_t {
* public functions
*/
eap_manager_t public;
-
+
/**
* list of eap_entry_t's
*/
linked_list_t *methods;
-
+
/**
* rwlock to lock methods
*/
@@ -76,7 +76,7 @@ static void add_method(private_eap_manager_t *this, eap_type_t type,
eap_constructor_t constructor)
{
eap_entry_t *entry = malloc_thing(eap_entry_t);
-
+
entry->type = type;
entry->vendor = vendor;
entry->role = role;
@@ -94,7 +94,7 @@ static void remove_method(private_eap_manager_t *this, eap_constructor_t constru
{
enumerator_t *enumerator;
eap_entry_t *entry;
-
+
this->lock->write_lock(this->lock);
enumerator = this->methods->create_enumerator(this->methods);
while (enumerator->enumerate(enumerator, &entry))
@@ -120,7 +120,7 @@ static eap_method_t* create_instance(private_eap_manager_t *this,
enumerator_t *enumerator;
eap_entry_t *entry;
eap_method_t *method = NULL;
-
+
this->lock->read_lock(this->lock);
enumerator = this->methods->create_enumerator(this->methods);
while (enumerator->enumerate(enumerator, &entry))
@@ -156,15 +156,15 @@ static void destroy(private_eap_manager_t *this)
eap_manager_t *eap_manager_create()
{
private_eap_manager_t *this = malloc_thing(private_eap_manager_t);
-
+
this->public.add_method = (void(*)(eap_manager_t*, eap_type_t type, u_int32_t vendor, eap_role_t role, eap_constructor_t constructor))add_method;
this->public.remove_method = (void(*)(eap_manager_t*, eap_constructor_t constructor))remove_method;
this->public.create_instance = (eap_method_t*(*)(eap_manager_t*, eap_type_t type, u_int32_t vendor, eap_role_t role, identification_t*,identification_t*))create_instance;
this->public.destroy = (void(*)(eap_manager_t*))destroy;
-
+
this->methods = linked_list_create();
this->lock = rwlock_create(RWLOCK_TYPE_DEFAULT);
-
+
return &this->public;
}
diff --git a/src/charon/sa/authenticators/eap/eap_manager.h b/src/charon/sa/authenticators/eap/eap_manager.h
index 667c54a8e..0333fb6da 100644
--- a/src/charon/sa/authenticators/eap/eap_manager.h
+++ b/src/charon/sa/authenticators/eap/eap_manager.h
@@ -45,14 +45,14 @@ struct eap_manager_t {
*/
void (*add_method)(eap_manager_t *this, eap_type_t type, u_int32_t vendor,
eap_role_t role, eap_constructor_t constructor);
-
+
/**
* Unregister a EAP method implementation using it's constructor.
*
* @param constructor constructor function to remove, as added in add_method
*/
void (*remove_method)(eap_manager_t *this, eap_constructor_t constructor);
-
+
/**
* Create a new EAP method instance.
*
@@ -67,11 +67,11 @@ struct eap_manager_t {
u_int32_t vendor, eap_role_t role,
identification_t *server,
identification_t *peer);
-
+
/**
- * Destroy a eap_manager instance.
- */
- void (*destroy)(eap_manager_t *this);
+ * Destroy a eap_manager instance.
+ */
+ void (*destroy)(eap_manager_t *this);
};
/**
diff --git a/src/charon/sa/authenticators/eap/eap_method.c b/src/charon/sa/authenticators/eap/eap_method.c
index 1d1900301..91fa5305f 100644
--- a/src/charon/sa/authenticators/eap/eap_method.c
+++ b/src/charon/sa/authenticators/eap/eap_method.c
@@ -34,6 +34,25 @@ ENUM_NEXT(eap_type_names, EAP_RADIUS, EAP_EXPERIMENTAL, EAP_MSCHAPV2,
"EAP_EXPERIMENTAL");
ENUM_END(eap_type_names, EAP_EXPERIMENTAL);
+ENUM_BEGIN(eap_type_short_names, EAP_IDENTITY, EAP_GTC,
+ "ID",
+ "NTF",
+ "NAK",
+ "MD5",
+ "OTP",
+ "GTC");
+ENUM_NEXT(eap_type_short_names, EAP_SIM, EAP_SIM, EAP_GTC,
+ "SIM");
+ENUM_NEXT(eap_type_short_names, EAP_AKA, EAP_AKA, EAP_SIM,
+ "AKA");
+ENUM_NEXT(eap_type_short_names, EAP_MSCHAPV2, EAP_MSCHAPV2, EAP_AKA,
+ "MSCHAPV2");
+ENUM_NEXT(eap_type_short_names, EAP_RADIUS, EAP_EXPERIMENTAL, EAP_MSCHAPV2,
+ "RAD",
+ "EXP",
+ "XP");
+ENUM_END(eap_type_short_names, EAP_EXPERIMENTAL);
+
/*
* See header
*/
@@ -53,7 +72,7 @@ eap_type_t eap_type_from_string(char *name)
{"mschapv2", EAP_MSCHAPV2},
{"radius", EAP_RADIUS},
};
-
+
for (i = 0; i < countof(types); i++)
{
if (strcaseeq(name, types[i].name))
@@ -71,6 +90,13 @@ ENUM(eap_code_names, EAP_REQUEST, EAP_FAILURE,
"EAP_FAILURE",
);
+ENUM(eap_code_short_names, EAP_REQUEST, EAP_FAILURE,
+ "REQ",
+ "RES",
+ "SUCC",
+ "FAIL",
+);
+
ENUM(eap_role_names, EAP_SERVER, EAP_PEER,
"EAP_SERVER",
"EAP_PEER",
diff --git a/src/charon/sa/authenticators/eap/eap_method.h b/src/charon/sa/authenticators/eap/eap_method.h
index 578b89e96..4cab84535 100644
--- a/src/charon/sa/authenticators/eap/eap_method.h
+++ b/src/charon/sa/authenticators/eap/eap_method.h
@@ -67,6 +67,11 @@ enum eap_type_t {
extern enum_name_t *eap_type_names;
/**
+ * short string enum names for eap_type_t.
+ */
+extern enum_name_t *eap_type_short_names;
+
+/**
* Lookup the EAP method type from a string.
*
* @param name EAP method name (such as "md5", "aka")
@@ -90,6 +95,11 @@ enum eap_code_t {
extern enum_name_t *eap_code_names;
/**
+ * short string enum names for eap_code_t.
+ */
+extern enum_name_t *eap_code_short_names;
+
+/**
* Interface of an EAP method for server and client side.
*
* An EAP method initiates an EAP exchange and processes requests and
@@ -107,7 +117,7 @@ extern enum_name_t *eap_code_names;
* EAP-Identity exchange always uses identifier 0.
*/
struct eap_method_t {
-
+
/**
* Initiate the EAP exchange.
*
@@ -121,7 +131,7 @@ struct eap_method_t {
* - FAILED, if unable to create eap request payload
*/
status_t (*initiate) (eap_method_t *this, eap_payload_t **out);
-
+
/**
* Process a received EAP message.
*
@@ -136,7 +146,7 @@ struct eap_method_t {
*/
status_t (*process) (eap_method_t *this, eap_payload_t *in,
eap_payload_t **out);
-
+
/**
* Get the EAP type implemented in this method.
*
@@ -144,17 +154,17 @@ struct eap_method_t {
* @return type of the EAP method
*/
eap_type_t (*get_type) (eap_method_t *this, u_int32_t *vendor);
-
+
/**
* Check if this EAP method authenticates the server.
*
- * Some EAP methods provide mutual authentication and
+ * Some EAP methods provide mutual authentication and
* allow authentication using only EAP, if the peer supports it.
*
* @return TRUE if methods provides mutual authentication
*/
bool (*is_mutual) (eap_method_t *this);
-
+
/**
* Get the MSK established by this EAP method.
*
@@ -167,7 +177,7 @@ struct eap_method_t {
* - FAILED, if MSK not established (yet)
*/
status_t (*get_msk) (eap_method_t *this, chunk_t *msk);
-
+
/**
* Destroys a eap_method_t object.
*/
diff --git a/src/charon/sa/authenticators/eap/sim_manager.c b/src/charon/sa/authenticators/eap/sim_manager.c
index 51cd4fb3f..5060a3147 100644
--- a/src/charon/sa/authenticators/eap/sim_manager.c
+++ b/src/charon/sa/authenticators/eap/sim_manager.c
@@ -15,6 +15,7 @@
#include "sim_manager.h"
+#include <daemon.h>
#include <utils/linked_list.h>
typedef struct private_sim_manager_t private_sim_manager_t;
@@ -23,21 +24,26 @@ typedef struct private_sim_manager_t private_sim_manager_t;
* Private data of an sim_manager_t object.
*/
struct private_sim_manager_t {
-
+
/**
* Public sim_manager_t interface.
*/
sim_manager_t public;
-
+
/**
* list of added cards
*/
linked_list_t *cards;
-
+
/**
* list of added provider
*/
- linked_list_t *provider;
+ linked_list_t *providers;
+
+ /**
+ * list of added hooks
+ */
+ linked_list_t *hooks;
};
/**
@@ -57,37 +63,431 @@ static void remove_card(private_sim_manager_t *this, sim_card_t *card)
}
/**
- * Implementation of sim_manager_t.create_card_enumerator
+ * Implementation of sim_manager_t.card_get_triplet
+ */
+static bool card_get_triplet(private_sim_manager_t *this, identification_t *id,
+ char rand[SIM_RAND_LEN], char sres[SIM_SRES_LEN],
+ char kc[SIM_KC_LEN])
+{
+ enumerator_t *enumerator;
+ sim_card_t *card;
+ int tried = 0;
+
+ enumerator = this->cards->create_enumerator(this->cards);
+ while (enumerator->enumerate(enumerator, &card))
+ {
+ if (card->get_triplet(card, id, rand, sres, kc))
+ {
+ enumerator->destroy(enumerator);
+ return TRUE;
+ }
+ tried++;
+ }
+ enumerator->destroy(enumerator);
+ DBG1(DBG_IKE, "tried %d SIM cards, but none has triplets for '%Y'",
+ tried, id);
+ return FALSE;
+}
+
+/**
+ * Implementation of sim_manager_t.card_get_quintuplet
+ */
+static status_t card_get_quintuplet(private_sim_manager_t *this,
+ identification_t *id, char rand[AKA_RAND_LEN],
+ char autn[AKA_AUTN_LEN], char ck[AKA_CK_LEN],
+ char ik[AKA_IK_LEN], char res[AKA_RES_MAX],
+ int *res_len)
+{
+ enumerator_t *enumerator;
+ sim_card_t *card;
+ status_t status = NOT_FOUND;
+ int tried = 0;
+
+ enumerator = this->cards->create_enumerator(this->cards);
+ while (enumerator->enumerate(enumerator, &card))
+ {
+ status = card->get_quintuplet(card, id, rand, autn, ck, ik, res, res_len);
+ switch (status)
+ { /* try next on error, but not on INVALID_STATE */
+ case SUCCESS:
+ case INVALID_STATE:
+ enumerator->destroy(enumerator);
+ return status;
+ case NOT_SUPPORTED:
+ case FAILED:
+ default:
+ tried++;
+ continue;
+ }
+ }
+ enumerator->destroy(enumerator);
+ DBG1(DBG_IKE, "tried %d SIM cards, but none has quintuplets for '%Y'",
+ tried, id);
+ return status;
+}
+
+/**
+ * Implementation of sim_manager_t.card_resync
+ */
+static bool card_resync(private_sim_manager_t *this, identification_t *id,
+ char rand[AKA_RAND_LEN], char auts[AKA_AUTS_LEN])
+{
+ enumerator_t *enumerator;
+ sim_card_t *card;
+
+ enumerator = this->cards->create_enumerator(this->cards);
+ while (enumerator->enumerate(enumerator, &card))
+ {
+ if (card->resync(card, id, rand, auts))
+ {
+ enumerator->destroy(enumerator);
+ return TRUE;
+ }
+ }
+ enumerator->destroy(enumerator);
+ return FALSE;
+}
+
+/**
+ * Implementation of sim_manager_t.card_set_pseudonym
+ */
+static void card_set_pseudonym(private_sim_manager_t *this,
+ identification_t *id, identification_t *pseudonym)
+{
+ enumerator_t *enumerator;
+ sim_card_t *card;
+
+ DBG1(DBG_IKE, "storing pseudonym '%Y' for '%Y'", pseudonym, id);
+
+ enumerator = this->cards->create_enumerator(this->cards);
+ while (enumerator->enumerate(enumerator, &card))
+ {
+ card->set_pseudonym(card, id, pseudonym);
+ }
+ enumerator->destroy(enumerator);
+}
+
+/**
+ * Implementation of sim_manager_t.card_get_pseudonym
+ */
+static identification_t* card_get_pseudonym(private_sim_manager_t *this,
+ identification_t *id)
+{
+ enumerator_t *enumerator;
+ sim_card_t *card;
+ identification_t *pseudonym = NULL;
+
+ enumerator = this->cards->create_enumerator(this->cards);
+ while (enumerator->enumerate(enumerator, &card))
+ {
+ pseudonym = card->get_pseudonym(card, id);
+ if (pseudonym)
+ {
+ DBG1(DBG_IKE, "using stored pseudonym identity '%Y' "
+ "instead of '%Y'", pseudonym, id);
+ break;
+ }
+ }
+ enumerator->destroy(enumerator);
+ return pseudonym;
+}
+
+/**
+ * Implementation of sim_manager_t.card_set_reauth
*/
-static enumerator_t* create_card_enumerator(private_sim_manager_t *this)
+static void card_set_reauth(private_sim_manager_t *this, identification_t *id,
+ identification_t *next, char mk[HASH_SIZE_SHA1],
+ u_int16_t counter)
{
- return this->cards->create_enumerator(this->cards);
+ enumerator_t *enumerator;
+ sim_card_t *card;
+
+ DBG1(DBG_IKE, "storing next reauthentication identity '%Y' for '%Y'",
+ next, id);
+
+ enumerator = this->cards->create_enumerator(this->cards);
+ while (enumerator->enumerate(enumerator, &card))
+ {
+ card->set_reauth(card, id, next, mk, counter);
+ }
+ enumerator->destroy(enumerator);
+}
+
+/**
+ * Implementation of sim_manager_t.card_get_reauth
+ */
+static identification_t* card_get_reauth(private_sim_manager_t *this,
+ identification_t *id, char mk[HASH_SIZE_SHA1],
+ u_int16_t *counter)
+{
+ enumerator_t *enumerator;
+ sim_card_t *card;
+ identification_t *reauth = NULL;
+
+ enumerator = this->cards->create_enumerator(this->cards);
+ while (enumerator->enumerate(enumerator, &card))
+ {
+ reauth = card->get_reauth(card, id, mk, counter);
+ if (reauth)
+ {
+ DBG1(DBG_IKE, "using stored reauthentication identity '%Y' "
+ "instead of '%Y'", reauth, id);
+ break;
+ }
+ }
+ enumerator->destroy(enumerator);
+ return reauth;
}
/**
* Implementation of sim_manager_t.add_provider
*/
-static void add_provider(private_sim_manager_t *this,
- sim_provider_t *provider)
+static void add_provider(private_sim_manager_t *this, sim_provider_t *provider)
{
- this->provider->insert_last(this->provider, provider);
+ this->providers->insert_last(this->providers, provider);
}
/**
* Implementation of sim_manager_t.remove_provider
*/
static void remove_provider(private_sim_manager_t *this,
- sim_provider_t *provider)
+ sim_provider_t *provider)
{
- this->provider->remove(this->provider, provider, NULL);
+ this->providers->remove(this->providers, provider, NULL);
}
/**
- * Implementation of sim_manager_t.create_provider_enumerator
+ * Implementation of sim_manager_t.provider_get_triplet
*/
-static enumerator_t* create_provider_enumerator(private_sim_manager_t *this)
+static bool provider_get_triplet(private_sim_manager_t *this,
+ identification_t *id, char rand[SIM_RAND_LEN],
+ char sres[SIM_SRES_LEN], char kc[SIM_KC_LEN])
{
- return this->provider->create_enumerator(this->provider);
+ enumerator_t *enumerator;
+ sim_provider_t *provider;
+ int tried = 0;
+
+ enumerator = this->providers->create_enumerator(this->providers);
+ while (enumerator->enumerate(enumerator, &provider))
+ {
+ if (provider->get_triplet(provider, id, rand, sres, kc))
+ {
+ enumerator->destroy(enumerator);
+ return TRUE;
+ }
+ tried++;
+ }
+ enumerator->destroy(enumerator);
+ DBG1(DBG_IKE, "tried %d SIM providers, but none had a triplet for '%Y'",
+ tried, id);
+ return FALSE;
+}
+
+/**
+ * Implementation of sim_manager_t.provider_get_quintuplet
+ */
+static bool provider_get_quintuplet(private_sim_manager_t *this,
+ identification_t *id, char rand[AKA_RAND_LEN],
+ char xres[AKA_RES_MAX], int *xres_len,
+ char ck[AKA_CK_LEN], char ik[AKA_IK_LEN],
+ char autn[AKA_AUTN_LEN])
+{
+ enumerator_t *enumerator;
+ sim_provider_t *provider;
+ int tried = 0;
+
+ enumerator = this->providers->create_enumerator(this->providers);
+ while (enumerator->enumerate(enumerator, &provider))
+ {
+ if (provider->get_quintuplet(provider, id, rand, xres, xres_len,
+ ck, ik, autn))
+ {
+ enumerator->destroy(enumerator);
+ return TRUE;
+ }
+ }
+ enumerator->destroy(enumerator);
+ DBG1(DBG_IKE, "tried %d SIM providers, but none had a quintuplet for '%Y'",
+ tried, id);
+ return FALSE;
+}
+
+/**
+ * Implementation of sim_manager_t.provider_resync
+ */
+static bool provider_resync(private_sim_manager_t *this, identification_t *id,
+ char rand[AKA_RAND_LEN], char auts[AKA_AUTS_LEN])
+{
+ enumerator_t *enumerator;
+ sim_provider_t *provider;
+
+ enumerator = this->providers->create_enumerator(this->providers);
+ while (enumerator->enumerate(enumerator, &provider))
+ {
+ if (provider->resync(provider, id, rand, auts))
+ {
+ enumerator->destroy(enumerator);
+ return TRUE;
+ }
+ }
+ enumerator->destroy(enumerator);
+ return FALSE;
+}
+
+/**
+ * Implementation of sim_manager_t.provider_is_pseudonym
+ */
+static identification_t* provider_is_pseudonym(private_sim_manager_t *this,
+ identification_t *id)
+{
+ enumerator_t *enumerator;
+ sim_provider_t *provider;
+ identification_t *permanent = NULL;
+
+ enumerator = this->providers->create_enumerator(this->providers);
+ while (enumerator->enumerate(enumerator, &provider))
+ {
+ permanent = provider->is_pseudonym(provider, id);
+ if (permanent)
+ {
+ DBG1(DBG_IKE, "received pseudonym identity '%Y' "
+ "mapping to '%Y'", id, permanent);
+ break;
+ }
+ }
+ enumerator->destroy(enumerator);
+ return permanent;
+}
+
+/**
+ * Implementation of sim_manager_t.provider_gen_pseudonym
+ */
+static identification_t* provider_gen_pseudonym(private_sim_manager_t *this,
+ identification_t *id)
+{
+ enumerator_t *enumerator;
+ sim_provider_t *provider;
+ identification_t *pseudonym = NULL;
+
+ enumerator = this->providers->create_enumerator(this->providers);
+ while (enumerator->enumerate(enumerator, &provider))
+ {
+ pseudonym = provider->gen_pseudonym(provider, id);
+ if (pseudonym)
+ {
+ DBG1(DBG_IKE, "proposing new pseudonym '%Y'", pseudonym);
+ break;
+ }
+ }
+ enumerator->destroy(enumerator);
+ return pseudonym;
+}
+
+/**
+ * Implementation of sim_manager_t.provider_is_reauth
+ */
+static identification_t* provider_is_reauth(private_sim_manager_t *this,
+ identification_t *id, char mk[HASH_SIZE_SHA1],
+ u_int16_t *counter)
+{
+ enumerator_t *enumerator;
+ sim_provider_t *provider;
+ identification_t *permanent = NULL;
+
+ enumerator = this->providers->create_enumerator(this->providers);
+ while (enumerator->enumerate(enumerator, &provider))
+ {
+ permanent = provider->is_reauth(provider, id, mk, counter);
+ if (permanent)
+ {
+ DBG1(DBG_IKE, "received reauthentication identity '%Y' "
+ "mapping to '%Y'", id, permanent);
+ break;
+ }
+ }
+ enumerator->destroy(enumerator);
+ return permanent;
+}
+
+/**
+ * Implementation of sim_manager_t.provider_gen_reauth
+ */
+static identification_t* provider_gen_reauth(private_sim_manager_t *this,
+ identification_t *id, char mk[HASH_SIZE_SHA1])
+{
+ enumerator_t *enumerator;
+ sim_provider_t *provider;
+ identification_t *reauth = NULL;
+
+ enumerator = this->providers->create_enumerator(this->providers);
+ while (enumerator->enumerate(enumerator, &provider))
+ {
+ reauth = provider->gen_reauth(provider, id, mk);
+ if (reauth)
+ {
+ DBG1(DBG_IKE, "proposing new reauthentication identity '%Y'", reauth);
+ break;
+ }
+ }
+ enumerator->destroy(enumerator);
+ return reauth;
+}
+
+/**
+ * Implementation of sim_manager_t.add_hooks
+ */
+static void add_hooks(private_sim_manager_t *this, sim_hooks_t *hooks)
+{
+ this->hooks->insert_last(this->hooks, hooks);
+}
+
+/**
+ * Implementation of sim_manager_t.remove_hooks
+ */
+static void remove_hooks(private_sim_manager_t *this, sim_hooks_t *hooks)
+{
+ this->hooks->remove(this->hooks, hooks, NULL);
+}
+
+/**
+ * Implementation of sim_manager_t.attribute_hook
+ */
+static bool attribute_hook(private_sim_manager_t *this, eap_code_t code,
+ eap_type_t type, u_int8_t subtype,
+ u_int8_t attribute, chunk_t data)
+{
+ enumerator_t *enumerator;
+ sim_hooks_t *hooks;
+ bool filter = FALSE;
+
+ enumerator = this->hooks->create_enumerator(this->hooks);
+ while (enumerator->enumerate(enumerator, &hooks))
+ {
+ if (hooks->attribute(hooks, code, type, subtype, attribute, data))
+ {
+ filter = TRUE;
+ break;
+ }
+ }
+ enumerator->destroy(enumerator);
+ return filter;
+}
+
+/**
+ * Implementation of sim_manager_t.key_hook
+ */
+static void key_hook(private_sim_manager_t *this,
+ chunk_t k_encr, chunk_t k_auth)
+{
+ enumerator_t *enumerator;
+ sim_hooks_t *hooks;
+
+ enumerator = this->hooks->create_enumerator(this->hooks);
+ while (enumerator->enumerate(enumerator, &hooks))
+ {
+ hooks->keys(hooks, k_encr, k_auth);
+ }
+ enumerator->destroy(enumerator);
}
/**
@@ -96,7 +496,8 @@ static enumerator_t* create_provider_enumerator(private_sim_manager_t *this)
static void destroy(private_sim_manager_t *this)
{
this->cards->destroy(this->cards);
- this->provider->destroy(this->provider);
+ this->providers->destroy(this->providers);
+ this->hooks->destroy(this->hooks);
free(this);
}
@@ -106,18 +507,35 @@ static void destroy(private_sim_manager_t *this)
sim_manager_t *sim_manager_create()
{
private_sim_manager_t *this = malloc_thing(private_sim_manager_t);
-
+
this->public.add_card = (void(*)(sim_manager_t*, sim_card_t *card))add_card;
this->public.remove_card = (void(*)(sim_manager_t*, sim_card_t *card))remove_card;
- this->public.create_card_enumerator = (enumerator_t*(*)(sim_manager_t*))create_card_enumerator;
+ this->public.card_get_triplet = (bool(*)(sim_manager_t*, identification_t *id, char rand[SIM_RAND_LEN], char sres[SIM_SRES_LEN], char kc[SIM_KC_LEN]))card_get_triplet;
+ this->public.card_get_quintuplet = (status_t(*)(sim_manager_t*, identification_t *id, char rand[AKA_RAND_LEN], char autn[AKA_AUTN_LEN], char ck[AKA_CK_LEN], char ik[AKA_IK_LEN], char res[AKA_RES_MAX], int *res_len))card_get_quintuplet;
+ this->public.card_resync = (bool(*)(sim_manager_t*, identification_t *id, char rand[AKA_RAND_LEN], char auts[AKA_AUTS_LEN]))card_resync;
+ this->public.card_set_pseudonym = (void(*)(sim_manager_t*, identification_t *id, identification_t *pseudonym))card_set_pseudonym;
+ this->public.card_get_pseudonym = (identification_t*(*)(sim_manager_t*, identification_t *id))card_get_pseudonym;
+ this->public.card_set_reauth = (void(*)(sim_manager_t*, identification_t *id, identification_t *next, char mk[HASH_SIZE_SHA1], u_int16_t counter))card_set_reauth;
+ this->public.card_get_reauth = (identification_t*(*)(sim_manager_t*, identification_t *id, char mk[HASH_SIZE_SHA1], u_int16_t *counter))card_get_reauth;
this->public.add_provider = (void(*)(sim_manager_t*, sim_provider_t *provider))add_provider;
this->public.remove_provider = (void(*)(sim_manager_t*, sim_provider_t *provider))remove_provider;
- this->public.create_provider_enumerator = (enumerator_t*(*)(sim_manager_t*))create_provider_enumerator;
+ this->public.provider_get_triplet = (bool(*)(sim_manager_t*, identification_t *id, char rand[SIM_RAND_LEN], char sres[SIM_SRES_LEN], char kc[SIM_KC_LEN]))provider_get_triplet;
+ this->public.provider_get_quintuplet = (bool(*)(sim_manager_t*, identification_t *id, char rand[AKA_RAND_LEN], char xres[AKA_RES_MAX], int *xres_len, char ck[AKA_CK_LEN], char ik[AKA_IK_LEN], char autn[AKA_AUTN_LEN]))provider_get_quintuplet;
+ this->public.provider_resync = (bool(*)(sim_manager_t*, identification_t *id, char rand[AKA_RAND_LEN], char auts[AKA_AUTS_LEN]))provider_resync;
+ this->public.provider_is_pseudonym = (identification_t*(*)(sim_manager_t*, identification_t *id))provider_is_pseudonym;
+ this->public.provider_gen_pseudonym = (identification_t*(*)(sim_manager_t*, identification_t *id))provider_gen_pseudonym;
+ this->public.provider_is_reauth = (identification_t*(*)(sim_manager_t*, identification_t *id, char mk[HASH_SIZE_SHA1], u_int16_t *counter))provider_is_reauth;
+ this->public.provider_gen_reauth = (identification_t*(*)(sim_manager_t*, identification_t *id, char mk[HASH_SIZE_SHA1]))provider_gen_reauth;
+ this->public.add_hooks = (void(*)(sim_manager_t*, sim_hooks_t *hooks))add_hooks;
+ this->public.remove_hooks = (void(*)(sim_manager_t*, sim_hooks_t *hooks))remove_hooks;
+ this->public.attribute_hook = (bool(*)(sim_manager_t*, eap_code_t code, eap_type_t type, u_int8_t subtype, u_int8_t attribute, chunk_t data))attribute_hook;
+ this->public.key_hook = (void(*)(sim_manager_t*, chunk_t k_encr, chunk_t k_auth))key_hook;
this->public.destroy = (void(*)(sim_manager_t*))destroy;
-
+
this->cards = linked_list_create();
- this->provider = linked_list_create();
-
+ this->providers = linked_list_create();
+ this->hooks = linked_list_create();
+
return &this->public;
}
diff --git a/src/charon/sa/authenticators/eap/sim_manager.h b/src/charon/sa/authenticators/eap/sim_manager.h
index 3c6d66dfe..49d27cbaa 100644
--- a/src/charon/sa/authenticators/eap/sim_manager.h
+++ b/src/charon/sa/authenticators/eap/sim_manager.h
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2008 Martin Willi
+ * Copyright (C) 2008-2009 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
@@ -21,105 +21,484 @@
#ifndef SIM_MANAGER_H_
#define SIM_MANAGER_H_
+#include <crypto/hashers/hasher.h>
#include <utils/identification.h>
#include <utils/enumerator.h>
+#include <sa/authenticators/eap/eap_method.h>
typedef struct sim_manager_t sim_manager_t;
typedef struct sim_card_t sim_card_t;
typedef struct sim_provider_t sim_provider_t;
+typedef struct sim_hooks_t sim_hooks_t;
+
+#define SIM_RAND_LEN 16
+#define SIM_SRES_LEN 4
+#define SIM_KC_LEN 8
+
+#define AKA_RAND_LEN 16
+#define AKA_RES_MAX 16
+#define AKA_CK_LEN 16
+#define AKA_IK_LEN 16
+#define AKA_AUTN_LEN 16
+#define AKA_AUTS_LEN 14
/**
- * Interface for a SIM card (used as EAP client).
+ * Interface for a (U)SIM card (used as EAP client).
+ *
+ * The SIM card completes triplets/quintuplets requested in a challenge
+ * received from the server.
+ * An implementation supporting only one of SIM/AKA authentication may
+ * implement the other methods with return_false()/return NOT_SUPPORTED/NULL.
*/
struct sim_card_t {
/**
- * Get the identity of a SIM card.
+ * Calculate SRES/KC from a RAND for SIM authentication.
+ *
+ * @param id permanent identity to get a triplet for
+ * @param rand RAND input buffer, fixed size 16 bytes
+ * @param sres SRES output buffer, fixed size 4 byte
+ * @param kc KC output buffer, fixed size 8 bytes
+ * @return TRUE if SRES/KC calculated, FALSE on error/wrong identity
+ */
+ bool (*get_triplet)(sim_card_t *this, identification_t *id,
+ char rand[SIM_RAND_LEN], char sres[SIM_SRES_LEN],
+ char kc[SIM_KC_LEN]);
+
+ /**
+ * Calculate CK/IK/RES from RAND/AUTN for AKA authentication.
+ *
+ * If the received sequence number (in autn) is out of sync, INVALID_STATE
+ * is returned.
+ * The RES value is the only one with variable length. Pass a buffer
+ * of at least AKA_RES_MAX, the actual number of bytes is written to the
+ * res_len value. While the standard would allow any bit length between
+ * 32 and 128 bits, we support only full bytes for now.
+ *
+ * @param id permanent identity to request quintuplet for
+ * @param rand random value rand
+ * @param autn authentication token autn
+ * @param ck buffer receiving encryption key ck
+ * @param ik buffer receiving integrity key ik
+ * @param res buffer receiving authentication result res
+ * @param res_len nubmer of bytes written to res buffer
+ * @return SUCCESS, FAILED, or INVALID_STATE if out of sync
+ */
+ status_t (*get_quintuplet)(sim_card_t *this, identification_t *id,
+ char rand[AKA_RAND_LEN], char autn[AKA_AUTN_LEN],
+ char ck[AKA_CK_LEN], char ik[AKA_IK_LEN],
+ char res[AKA_RES_MAX], int *res_len);
+
+ /**
+ * Calculate AUTS from RAND for AKA resynchronization.
+ *
+ * @param id permanent identity to request quintuplet for
+ * @param rand random value rand
+ * @param auts resynchronization parameter auts
+ * @return TRUE if parameter generated successfully
+ */
+ bool (*resync)(sim_card_t *this, identification_t *id,
+ char rand[AKA_RAND_LEN], char auts[AKA_AUTS_LEN]);
+
+ /**
+ * Set the pseudonym to use for next authentication.
+ *
+ * @param id permanent identity of the peer
+ * @param pseudonym pseudonym identity received from the server
+ */
+ void (*set_pseudonym)(sim_card_t *this, identification_t *id,
+ identification_t *pseudonym);
+
+ /**
+ * Get the pseudonym previously stored via set_pseudonym().
*
- * The returned identity owned by the sim_card and not destroyed outside.
- * The SIM card may return ID_ANY if it does not support/use an IMSI.
+ * @param id permanent identity of the peer
+ * @return associated pseudonym identity, NULL if none stored
+ */
+ identification_t* (*get_pseudonym)(sim_card_t *this, identification_t *id);
+
+ /**
+ * Store parameters to use for the next fast reauthentication.
*
- * @return identity
+ * @param id permanent identity of the peer
+ * @param next next fast reauthentication identity to use
+ * @param mk master key MK to store for reauthentication
+ * @param counter counter value to store, host order
*/
- identification_t* (*get_imsi)(sim_card_t *this);
-
+ void (*set_reauth)(sim_card_t *this, identification_t *id,
+ identification_t *next, char mk[HASH_SIZE_SHA1],
+ u_int16_t counter);
+
/**
- * Calculate SRES/KC from a RAND.
+ * Retrieve parameters for fast reauthentication stored via set_reauth().
*
- * @param rand RAND input buffer, fixed size 16 bytes
- * @param sres SRES output buffer, fixed size 4 byte
- * @param kc KC output buffer, fixed size 8 bytes
- * @return TRUE if SRES/KC calculated, FALSE on error
+ * @param id permanent identity of the peer
+ * @param mk buffer receiving master key MK
+ * @param counter pointer receiving counter value, in host order
+ * @return fast reauthentication identity, NULL if not found
*/
- bool (*get_triplet)(sim_card_t *this,
- char rand[16], char sres[4], char kc[8]);
+ identification_t* (*get_reauth)(sim_card_t *this, identification_t *id,
+ char mk[HASH_SIZE_SHA1], u_int16_t *counter);
};
/**
- * Interface for a triplet provider (used as EAP server).
+ * Interface for a triplet/quintuplet provider (used as EAP server).
+ *
+ * A SIM provider hands out triplets for SIM authentication and quintuplets
+ * for AKA authentication. Multiple SIM provider instances can serve as
+ * authentication backend to authenticate clients using SIM/AKA.
+ * An implementation supporting only one of SIM/AKA authentication may
+ * implement the other methods with return_false().
*/
struct sim_provider_t {
-
+
/**
- * Get a single triplet to authenticate a EAP client.
+ * Create a challenge for SIM authentication.
*
- * @param imsi client identity
- * @param rand RAND output buffer, fixed size 16 bytes
- * @param sres SRES output buffer, fixed size 4 byte
- * @param kc KC output buffer, fixed size 8 bytes
- * @return TRUE if triplet received, FALSE otherwise
+ * @param id permanent identity of peer to gen triplet for
+ * @param rand RAND output buffer, fixed size 16 bytes
+ * @param sres SRES output buffer, fixed size 4 byte
+ * @param kc KC output buffer, fixed size 8 bytes
+ * @return TRUE if triplet received, FALSE otherwise
*/
- bool (*get_triplet)(sim_provider_t *this, identification_t *imsi,
- char rand[16], char sres[4], char kc[8]);
+ bool (*get_triplet)(sim_provider_t *this, identification_t *id,
+ char rand[SIM_RAND_LEN], char sres[SIM_SRES_LEN],
+ char kc[SIM_KC_LEN]);
+
+ /**
+ * Create a challenge for AKA authentication.
+ *
+ * The XRES value is the only one with variable length. Pass a buffer
+ * of at least AKA_RES_MAX, the actual number of bytes is written to the
+ * xres_len value. While the standard would allow any bit length between
+ * 32 and 128 bits, we support only full bytes for now.
+ *
+ * @param id permanent identity of peer to create challenge for
+ * @param rand buffer receiving random value rand
+ * @param xres buffer receiving expected authentication result xres
+ * @param xres_len nubmer of bytes written to xres buffer
+ * @param ck buffer receiving encryption key ck
+ * @param ik buffer receiving integrity key ik
+ * @param autn authentication token autn
+ * @return TRUE if quintuplet generated successfully
+ */
+ bool (*get_quintuplet)(sim_provider_t *this, identification_t *id,
+ char rand[AKA_RAND_LEN],
+ char xres[AKA_RES_MAX], int *xres_len,
+ char ck[AKA_CK_LEN], char ik[AKA_IK_LEN],
+ char autn[AKA_AUTN_LEN]);
+
+ /**
+ * Process AKA resynchroniusation request of a peer.
+ *
+ * @param id permanent identity of peer requesting resynchronisation
+ * @param rand random value rand
+ * @param auts synchronization parameter auts
+ * @return TRUE if resynchronized successfully
+ */
+ bool (*resync)(sim_provider_t *this, identification_t *id,
+ char rand[AKA_RAND_LEN], char auts[AKA_AUTS_LEN]);
+
+ /**
+ * Check if peer uses a pseudonym, get permanent identity.
+ *
+ * @param id pseudonym identity candidate
+ * @return permanent identity, NULL if id not a pseudonym
+ */
+ identification_t* (*is_pseudonym)(sim_provider_t *this,
+ identification_t *id);
+
+ /**
+ * Generate a pseudonym identitiy for a given peer identity.
+ *
+ * @param id permanent identity to generate a pseudonym for
+ * @return generated pseudonym, NULL to not use a pseudonym identity
+ */
+ identification_t* (*gen_pseudonym)(sim_provider_t *this,
+ identification_t *id);
+
+ /**
+ * Check if peer uses reauthentication, retrieve reauth parameters.
+ *
+ * @param id reauthentication identity (candidate)
+ * @param mk buffer receiving master key MK
+ * @param counter pointer receiving current counter value, host order
+ * @return permanent identity, NULL if id not a reauth identity
+ */
+ identification_t* (*is_reauth)(sim_provider_t *this, identification_t *id,
+ char mk[HASH_SIZE_SHA1], u_int16_t *counter);
+
+ /**
+ * Generate a fast reauthentication identity, associated to a master key.
+ *
+ * @param id permanent peer identity
+ * @param mk master key to store along with generated identity
+ * @return fast reauthentication identity, NULL to not use reauth
+ */
+ identification_t* (*gen_reauth)(sim_provider_t *this, identification_t *id,
+ char mk[HASH_SIZE_SHA1]);
};
/**
- * The EAP-SIM manager handles multiple SIM cards and providers.
+ * Additional hooks invoked during EAP-SIM/AKA message processing.
+ */
+struct sim_hooks_t {
+
+ /**
+ * SIM/AKA attribute parsing hook.
+ *
+ * @param code code of EAP message the attribute was parsed from
+ * @param type EAP method, SIM or AKA
+ * @param subtye method specific subtype
+ * @param attribute parsed SIM/AKA attribute type
+ * @param data attribute data
+ * @return TRUE to filter out attribute from further processing
+ */
+ bool (*attribute)(sim_hooks_t *this, eap_code_t code, eap_type_t type,
+ u_int8_t subtype, u_int8_t attribute, chunk_t data);
+
+ /**
+ * SIM/AKA encryption/authentication key hooks.
+ *
+ * @param k_encr derived SIM/AKA encryption key k_encr
+ * @param k_auth derived SIM/AKA authentication key k_auth
+ */
+ void (*keys)(sim_hooks_t *this, chunk_t k_encr, chunk_t k_auth);
+};
+
+/**
+ * The SIM manager handles multiple (U)SIM cards/providers and hooks.
*/
struct sim_manager_t {
-
+
/**
* Register a SIM card (client) at the manager.
*
* @param card sim card to register
*/
void (*add_card)(sim_manager_t *this, sim_card_t *card);
-
+
/**
* Unregister a previously registered card from the manager.
*
* @param card sim card to unregister
*/
void (*remove_card)(sim_manager_t *this, sim_card_t *card);
-
+
+ /**
+ * Calculate SIM triplets on one of the registered SIM cards.
+ *
+ * @param id permanent identity to get a triplet for
+ * @param rand RAND input buffer, fixed size 16 bytes
+ * @param sres SRES output buffer, fixed size 4 byte
+ * @param kc KC output buffer, fixed size 8 bytes
+ * @return TRUE if calculated, FALSE if no matching card found
+ */
+ bool (*card_get_triplet)(sim_manager_t *this, identification_t *id,
+ char rand[SIM_RAND_LEN], char sres[SIM_SRES_LEN],
+ char kc[SIM_KC_LEN]);
+
+ /**
+ * Calculate AKA quitpulets on one of the registered SIM cards.
+ *
+ * @param id permanent identity to request quintuplet for
+ * @param rand random value rand
+ * @param autn authentication token autn
+ * @param ck buffer receiving encryption key ck
+ * @param ik buffer receiving integrity key ik
+ * @param res buffer receiving authentication result res
+ * @param res_len nubmer of bytes written to res buffer
+ * @return SUCCESS, FAILED, or INVALID_STATE if out of sync
+ */
+ status_t (*card_get_quintuplet)(sim_manager_t *this, identification_t *id,
+ char rand[AKA_RAND_LEN], char autn[AKA_AUTN_LEN],
+ char ck[AKA_CK_LEN], char ik[AKA_IK_LEN],
+ char res[AKA_RES_MAX], int *res_len);
+
+ /**
+ * Calculate resynchronization data on one of the registered SIM cards.
+ *
+ * @param id permanent identity to request quintuplet for
+ * @param rand random value rand
+ * @param auts resynchronization parameter auts
+ * @return TRUE if calculated, FALSE if no matcing card found
+ */
+ bool (*card_resync)(sim_manager_t *this, identification_t *id,
+ char rand[AKA_RAND_LEN], char auts[AKA_AUTS_LEN]);
+
+ /**
+ * Store a received pseudonym on one of the registered SIM cards.
+ *
+ * @param id permanent identity of the peer
+ * @param pseudonym pseudonym identity received from the server
+ */
+ void (*card_set_pseudonym)(sim_manager_t *this, identification_t *id,
+ identification_t *pseudonym);
+
+ /**
+ * Get a stored pseudonym from one of the registerd SIM cards.
+ *
+ * @param id permanent identity of the peer
+ * @return associated pseudonym identity, NULL if none found
+ */
+ identification_t* (*card_get_pseudonym)(sim_manager_t *this,
+ identification_t *id);
+
/**
- * Create an enumerator over all registered cards.
+ * Store fast reauthentication parameters on one of the registered cards.
*
- * @return enumerator over sim_card_t's
+ * @param id permanent identity of the peer
+ * @param next next fast reauthentication identity to use
+ * @param mk master key MK to store for reauthentication
+ * @param counter counter value to store, host order
*/
- enumerator_t* (*create_card_enumerator)(sim_manager_t *this);
-
+ void (*card_set_reauth)(sim_manager_t *this, identification_t *id,
+ identification_t *next, char mk[HASH_SIZE_SHA1],
+ u_int16_t counter);
+
+ /**
+ * Retrieve fast reauthentication parameters from one of the registerd cards.
+ *
+ * @param id permanent identity of the peer
+ * @param mk buffer receiving master key MK
+ * @param counter pointer receiving counter value, in host order
+ * @return fast reauthentication identity, NULL if none found
+ */
+ identification_t* (*card_get_reauth)(sim_manager_t *this,
+ identification_t *id, char mk[HASH_SIZE_SHA1],
+ u_int16_t *counter);
+
/**
* Register a triplet provider (server) at the manager.
*
* @param card sim card to register
*/
void (*add_provider)(sim_manager_t *this, sim_provider_t *provider);
-
+
/**
* Unregister a previously registered provider from the manager.
*
* @param card sim card to unregister
*/
void (*remove_provider)(sim_manager_t *this, sim_provider_t *provider);
-
+
+ /**
+ * Get a SIM triplet from one of the registered providers.
+ *
+ * @param id permanent identity of peer to gen triplet for
+ * @param rand RAND output buffer, fixed size 16 bytes
+ * @param sres SRES output buffer, fixed size 4 byte
+ * @param kc KC output buffer, fixed size 8 bytes
+ * @return TRUE if triplet received, FALSE if no match found
+ */
+ bool (*provider_get_triplet)(sim_manager_t *this, identification_t *id,
+ char rand[SIM_RAND_LEN], char sres[SIM_SRES_LEN],
+ char kc[SIM_KC_LEN]);
+
+ /**
+ * Get a AKA quintuplet from one of the registered providers.
+ *
+ * @param id permanent identity of peer to create challenge for
+ * @param rand buffer receiving random value rand
+ * @param xres buffer receiving expected authentication result xres
+ * @param ck buffer receiving encryption key ck
+ * @param ik buffer receiving integrity key ik
+ * @param autn authentication token autn
+ * @return TRUE if quintuplet received, FALSE if no match found
+ */
+ bool (*provider_get_quintuplet)(sim_manager_t *this, identification_t *id,
+ char rand[AKA_RAND_LEN],
+ char xres[AKA_RES_MAX], int *xres_len,
+ char ck[AKA_CK_LEN], char ik[AKA_IK_LEN],
+ char autn[AKA_AUTN_LEN]);
+
/**
- * Create an enumerator over all registered provider.
+ * Pass AKA resynchronization data to one of the registered providers.
*
- * @return enumerator over sim_provider_t's
+ * @param id permanent identity of peer requesting resynchronisation
+ * @param rand random value rand
+ * @param auts synchronization parameter auts
+ * @return TRUE if resynchronized, FALSE if not handled
*/
- enumerator_t* (*create_provider_enumerator)(sim_manager_t *this);
-
+ bool (*provider_resync)(sim_manager_t *this, identification_t *id,
+ char rand[AKA_RAND_LEN], char auts[AKA_AUTS_LEN]);
+
+ /**
+ * Check if a peer uses a pseudonym using one of the registered providers.
+ *
+ * @param id pseudonym identity candidate
+ * @return permanent identity, NULL if id not a pseudonym
+ */
+ identification_t* (*provider_is_pseudonym)(sim_manager_t *this,
+ identification_t *id);
+
+ /**
+ * Generate a new pseudonym using one of the registered providers.
+ *
+ * @param id permanent identity to generate a pseudonym for
+ * @return generated pseudonym, NULL to not use a pseudonym identity
+ */
+ identification_t* (*provider_gen_pseudonym)(sim_manager_t *this,
+ identification_t *id);
+
+ /**
+ * Check if a peer uses a reauth id using one of the registered providers.
+ *
+ * @param id reauthentication identity (candidate)
+ * @param mk buffer receiving master key MK
+ * @param counter pointer receiving current counter value, host order
+ * @return permanent identity, NULL if not a known reauth identity
+ */
+ identification_t* (*provider_is_reauth)(sim_manager_t *this,
+ identification_t *id, char mk[HASH_SIZE_SHA1],
+ u_int16_t *counter);
+
+ /**
+ * Generate a fast reauth id using one of the registered providers.
+ *
+ * @param id permanent peer identity
+ * @param mk master key to store along with generated identity
+ * @return fast reauthentication identity, NULL to not use reauth
+ */
+ identification_t* (*provider_gen_reauth)(sim_manager_t *this,
+ identification_t *id, char mk[HASH_SIZE_SHA1]);
+
+ /**
+ * Register a set of hooks to the manager.
+ *
+ * @param hooks hook interface implementation to register
+ */
+ void (*add_hooks)(sim_manager_t *this, sim_hooks_t *hooks);
+
+ /**
+ * Unregister a set of hooks from the manager.
+ *
+ * @param hooks hook interface implementation to unregister
+ */
+ void (*remove_hooks)(sim_manager_t *this, sim_hooks_t *hooks);
+
+ /**
+ * Invoke SIM/AKA attribute hook.
+ *
+ * @param code EAP message code (Request/response/success/failed)
+ * @param type EAP method type, EAP-SIM or AKA
+ * @param subtype method specific message subtype
+ * @param attribute SIM/AKA attribute type
+ * @param data attribute data
+ * @return TRUE to filter out attribute from further processing
+ */
+ bool (*attribute_hook)(sim_manager_t *this, eap_code_t code,
+ eap_type_t type, u_int8_t subtype,
+ u_int8_t attribute, chunk_t data);
+
+ /**
+ * Invoke SIM/AKA key hook.
+ *
+ * @param k_encr SIM/AKA encryption key k_encr
+ * @param k_auth SIM/AKA authentication key k_auth
+ */
+ void (*key_hook)(sim_manager_t *this, chunk_t k_encr, chunk_t k_auth);
+
/**
* Destroy a manager instance.
*/
@@ -127,7 +506,7 @@ struct sim_manager_t {
};
/**
- * Create an SIM manager to handle multiple SIM cards/providers.
+ * Create an SIM manager to handle multiple (U)SIM cards/providers.
*
* @return sim_t object
*/
diff --git a/src/charon/sa/authenticators/eap_authenticator.c b/src/charon/sa/authenticators/eap_authenticator.c
index 2abdf7a02..16911050a 100644
--- a/src/charon/sa/authenticators/eap_authenticator.c
+++ b/src/charon/sa/authenticators/eap_authenticator.c
@@ -26,62 +26,67 @@ typedef struct private_eap_authenticator_t private_eap_authenticator_t;
* Private data of an eap_authenticator_t object.
*/
struct private_eap_authenticator_t {
-
+
/**
* Public authenticator_t interface.
*/
eap_authenticator_t public;
-
+
/**
* Assigned IKE_SA
*/
ike_sa_t *ike_sa;
-
+
/**
* others nonce to include in AUTH calculation
*/
chunk_t received_nonce;
-
+
/**
* our nonce to include in AUTH calculation
*/
chunk_t sent_nonce;
-
+
/**
* others IKE_SA_INIT message data to include in AUTH calculation
*/
chunk_t received_init;
-
+
/**
* our IKE_SA_INIT message data to include in AUTH calculation
*/
chunk_t sent_init;
-
+
/**
* Current EAP method processing
*/
eap_method_t *method;
-
+
/**
* MSK used to build and verify auth payload
*/
chunk_t msk;
-
+
/**
* EAP authentication method completed successfully
*/
bool eap_complete;
-
+
+ /**
+ * Set if we require mutual EAP due EAP-only authentication
+ */
+ bool require_mutual;
+
/**
* authentication payload verified successfully
*/
bool auth_complete;
-
+
/**
* generated EAP payload
*/
eap_payload_t *eap_payload;
-
+
/**
* EAP identity of peer
*/
@@ -95,7 +100,7 @@ static eap_method_t *load_method(private_eap_authenticator_t *this,
eap_type_t type, u_int32_t vendor, eap_role_t role)
{
identification_t *server, *peer;
-
+
if (role == EAP_SERVER)
{
server = this->ike_sa->get_my_id(this->ike_sa);
@@ -125,9 +130,10 @@ static eap_payload_t* server_initiate_eap(private_eap_authenticator_t *this,
identification_t *id;
u_int32_t vendor;
eap_payload_t *out;
-
+ char *action;
+
auth = this->ike_sa->get_auth_cfg(this->ike_sa, FALSE);
-
+
/* initiate EAP-Identity exchange if required */
if (!this->eap_identity && do_identity)
{
@@ -150,33 +156,62 @@ static eap_payload_t* server_initiate_eap(private_eap_authenticator_t *this,
/* invoke real EAP method */
type = (uintptr_t)auth->get(auth, AUTH_RULE_EAP_TYPE);
vendor = (uintptr_t)auth->get(auth, AUTH_RULE_EAP_VENDOR);
+ action = "loading";
this->method = load_method(this, type, vendor, EAP_SERVER);
- if (this->method &&
- this->method->initiate(this->method, &out) == NEED_MORE)
+ if (this->method)
{
- if (vendor)
+ action = "initiating";
+ if (this->method->initiate(this->method, &out) == NEED_MORE)
{
- DBG1(DBG_IKE, "initiating EAP vendor type %d-%d", type, vendor);
-
- }
- else
- {
- DBG1(DBG_IKE, "initiating %N", eap_type_names, type);
+ if (vendor)
+ {
+ DBG1(DBG_IKE, "initiating EAP vendor type %d-%d method",
+ type, vendor);
+ }
+ else
+ {
+ DBG1(DBG_IKE, "initiating %N method", eap_type_names, type);
+ }
+ return out;
}
- return out;
}
if (vendor)
{
- DBG1(DBG_IKE, "initiating EAP vendor type %d-%d failed", type, vendor);
+ DBG1(DBG_IKE, "%s EAP vendor type %d-%d method failed",
+ action, type, vendor);
}
else
{
- DBG1(DBG_IKE, "initiating %N failed", eap_type_names, type);
+ DBG1(DBG_IKE, "%s %N method failed", action, eap_type_names, type);
}
return eap_payload_create_code(EAP_FAILURE, 0);
}
/**
+ * Replace the existing EAP-Identity in other auth config
+ */
+static void replace_eap_identity(private_eap_authenticator_t *this)
+{
+ enumerator_t *enumerator;
+ auth_rule_t rule;
+ auth_cfg_t *cfg;
+ void *ptr;
+
+ cfg = this->ike_sa->get_auth_cfg(this->ike_sa, FALSE);
+ enumerator = cfg->create_enumerator(cfg);
+ while (enumerator->enumerate(enumerator, &rule, &ptr))
+ {
+ if (rule == AUTH_RULE_EAP_IDENTITY)
+ {
+ cfg->replace(cfg, enumerator, AUTH_RULE_EAP_IDENTITY,
+ this->eap_identity->clone(this->eap_identity));
+ break;
+ }
+ }
+ enumerator->destroy(enumerator);
+}
+
+/**
* Handle EAP exchange as server
*/
static eap_payload_t* server_process_eap(private_eap_authenticator_t *this,
@@ -186,14 +221,14 @@ static eap_payload_t* server_process_eap(private_eap_authenticator_t *this,
u_int32_t vendor, received_vendor;
eap_payload_t *out;
auth_cfg_t *cfg;
-
+
if (in->get_code(in) != EAP_RESPONSE)
{
DBG1(DBG_IKE, "received %N, sending %N",
eap_code_names, in->get_code(in), eap_code_names, EAP_FAILURE);
return eap_payload_create_code(EAP_FAILURE, in->get_identifier(in));
}
-
+
type = this->method->get_type(this->method, &vendor);
received_type = in->get_type(in, &received_vendor);
if (type != received_type || vendor != received_vendor)
@@ -210,7 +245,7 @@ static eap_payload_t* server_process_eap(private_eap_authenticator_t *this,
}
return eap_payload_create_code(EAP_FAILURE, in->get_identifier(in));
}
-
+
switch (this->method->process(this->method, in, &out))
{
case NEED_MORE:
@@ -219,14 +254,13 @@ static eap_payload_t* server_process_eap(private_eap_authenticator_t *this,
if (type == EAP_IDENTITY)
{
chunk_t data;
- char buf[256];
-
+
if (this->method->get_msk(this->method, &data) == SUCCESS)
{
- snprintf(buf, sizeof(buf), "%.*s", data.len, data.ptr);
- this->eap_identity = identification_create_from_string(buf);
+ this->eap_identity = identification_create_from_data(data);
DBG1(DBG_IKE, "received EAP identity '%Y'",
this->eap_identity);
+ replace_eap_identity(this);
}
/* restart EAP exchange, but with real method */
this->method->destroy(this->method);
@@ -262,7 +296,7 @@ static eap_payload_t* server_process_eap(private_eap_authenticator_t *this,
if (vendor)
{
DBG1(DBG_IKE, "EAP vendor specific method %d-%d failed for "
- "peer %Y", type, vendor,
+ "peer %Y", type, vendor,
this->ike_sa->get_other_id(this->ike_sa));
}
else
@@ -286,9 +320,9 @@ static eap_payload_t* client_process_eap(private_eap_authenticator_t *this,
auth_cfg_t *auth;
eap_payload_t *out;
identification_t *id;
-
+
type = in->get_type(in, &vendor);
-
+
if (!vendor && type == EAP_IDENTITY)
{
DESTROY_IF(this->eap_identity);
@@ -301,7 +335,7 @@ static eap_payload_t* client_process_eap(private_eap_authenticator_t *this,
DBG1(DBG_IKE, "server requested %N, sending '%Y'",
eap_type_names, type, id);
this->eap_identity = id->clone(id);
-
+
this->method = load_method(this, type, vendor, EAP_PEER);
if (this->method)
{
@@ -337,14 +371,14 @@ static eap_payload_t* client_process_eap(private_eap_authenticator_t *this,
return eap_payload_create_nak(in->get_identifier(in));
}
}
-
+
type = this->method->get_type(this->method, &vendor);
-
+
if (this->method->process(this->method, in, &out) == NEED_MORE)
{ /* client methods should never return SUCCESS */
return out;
}
-
+
if (vendor)
{
DBG1(DBG_IKE, "vendor specific EAP method %d-%d failed", type, vendor);
@@ -367,7 +401,7 @@ static bool verify_auth(private_eap_authenticator_t *this, message_t *message,
identification_t *other_id;
auth_cfg_t *auth;
keymat_t *keymat;
-
+
auth_payload = (auth_payload_t*)message->get_payload(message,
AUTHENTICATION);
if (!auth_payload)
@@ -388,7 +422,7 @@ static bool verify_auth(private_eap_authenticator_t *this, message_t *message,
return FALSE;
}
chunk_free(&auth_data);
-
+
DBG1(DBG_IKE, "authentication of '%Y' with %N successful",
other_id, auth_class_names, AUTH_CLASS_EAP);
this->auth_complete = TRUE;
@@ -407,13 +441,13 @@ static void build_auth(private_eap_authenticator_t *this, message_t *message,
identification_t *my_id;
chunk_t auth_data;
keymat_t *keymat;
-
+
my_id = this->ike_sa->get_my_id(this->ike_sa);
keymat = this->ike_sa->get_keymat(this->ike_sa);
-
+
DBG1(DBG_IKE, "authentication of '%Y' (myself) with %N",
my_id, auth_class_names, AUTH_CLASS_EAP);
-
+
auth_data = keymat->get_psk_sig(keymat, FALSE, init, nonce, this->msk, my_id);
auth_payload = auth_payload_create();
auth_payload->set_auth_method(auth_payload, AUTH_PSK);
@@ -429,7 +463,7 @@ static status_t process_server(private_eap_authenticator_t *this,
message_t *message)
{
eap_payload_t *eap_payload;
-
+
if (this->eap_complete)
{
if (!verify_auth(this, message, this->sent_nonce, this->received_init))
@@ -438,7 +472,7 @@ static status_t process_server(private_eap_authenticator_t *this,
}
return NEED_MORE;
}
-
+
if (!this->method)
{
this->eap_payload = server_initiate_eap(this, TRUE);
@@ -465,7 +499,7 @@ static status_t build_server(private_eap_authenticator_t *this,
if (this->eap_payload)
{
eap_code_t code;
-
+
code = this->eap_payload->get_code(this->eap_payload);
message->add_payload(message, (payload_t*)this->eap_payload);
this->eap_payload = NULL;
@@ -490,16 +524,25 @@ static status_t process_client(private_eap_authenticator_t *this,
message_t *message)
{
eap_payload_t *eap_payload;
-
+
if (this->eap_complete)
{
if (!verify_auth(this, message, this->sent_nonce, this->received_init))
{
return FAILED;
}
+ if (this->require_mutual && !this->method->is_mutual(this->method))
+ { /* we require mutual authentication due to EAP-only */
+ u_int32_t vendor;
+
+ DBG1(DBG_IKE, "EAP-only authentication requires a mutual and "
+ "MSK deriving EAP method, but %N is not",
+ eap_type_names, this->method->get_type(this->method, &vendor));
+ return FAILED;
+ }
return SUCCESS;
}
-
+
eap_payload = (eap_payload_t*)message->get_payload(message,
EXTENSIBLE_AUTHENTICATION);
if (eap_payload)
@@ -520,7 +563,7 @@ static status_t process_client(private_eap_authenticator_t *this,
eap_type_t type;
u_int32_t vendor;
auth_cfg_t *cfg;
-
+
if (this->method->get_msk(this->method, &this->msk) == SUCCESS)
{
this->msk = chunk_clone(this->msk);
@@ -561,7 +604,7 @@ static status_t process_client(private_eap_authenticator_t *this,
/**
* Implementation of authenticator_t.build for a client
*/
-static status_t build_client(private_eap_authenticator_t *this,
+static status_t build_client(private_eap_authenticator_t *this,
message_t *message)
{
if (this->eap_payload)
@@ -579,6 +622,16 @@ static status_t build_client(private_eap_authenticator_t *this,
}
/**
+ * Implementation of authenticator_t.is_mutual.
+ */
+static bool is_mutual(private_eap_authenticator_t *this)
+{
+ /* we don't know yet, but insist on it after EAP is complete */
+ this->require_mutual = TRUE;
+ return TRUE;
+}
+
+/**
* Implementation of authenticator_t.destroy.
*/
static void destroy(private_eap_authenticator_t *this)
@@ -598,11 +651,12 @@ eap_authenticator_t *eap_authenticator_create_builder(ike_sa_t *ike_sa,
chunk_t received_init, chunk_t sent_init)
{
private_eap_authenticator_t *this = malloc_thing(private_eap_authenticator_t);
-
+
this->public.authenticator.build = (status_t(*)(authenticator_t*, message_t *message))build_client;
this->public.authenticator.process = (status_t(*)(authenticator_t*, message_t *message))process_client;
+ this->public.authenticator.is_mutual = (bool(*)(authenticator_t*))is_mutual;
this->public.authenticator.destroy = (void(*)(authenticator_t*))destroy;
-
+
this->ike_sa = ike_sa;
this->received_init = received_init;
this->received_nonce = received_nonce;
@@ -614,7 +668,8 @@ eap_authenticator_t *eap_authenticator_create_builder(ike_sa_t *ike_sa,
this->eap_complete = FALSE;
this->auth_complete = FALSE;
this->eap_identity = NULL;
-
+ this->require_mutual = FALSE;
+
return &this->public;
}
@@ -626,11 +681,12 @@ eap_authenticator_t *eap_authenticator_create_verifier(ike_sa_t *ike_sa,
chunk_t received_init, chunk_t sent_init)
{
private_eap_authenticator_t *this = malloc_thing(private_eap_authenticator_t);
-
+
this->public.authenticator.build = (status_t(*)(authenticator_t*, message_t *messageh))build_server;
this->public.authenticator.process = (status_t(*)(authenticator_t*, message_t *message))process_server;
+ this->public.authenticator.is_mutual = (bool(*)(authenticator_t*))is_mutual;
this->public.authenticator.destroy = (void(*)(authenticator_t*))destroy;
-
+
this->ike_sa = ike_sa;
this->received_init = received_init;
this->received_nonce = received_nonce;
@@ -642,7 +698,8 @@ eap_authenticator_t *eap_authenticator_create_verifier(ike_sa_t *ike_sa,
this->eap_complete = FALSE;
this->auth_complete = FALSE;
this->eap_identity = NULL;
-
+ this->require_mutual = FALSE;
+
return &this->public;
}
diff --git a/src/charon/sa/authenticators/eap_authenticator.h b/src/charon/sa/authenticators/eap_authenticator.h
index b90a6f4df..41eb6a8c9 100644
--- a/src/charon/sa/authenticators/eap_authenticator.h
+++ b/src/charon/sa/authenticators/eap_authenticator.h
@@ -83,7 +83,7 @@ eap_authenticator_t *eap_authenticator_create_builder(ike_sa_t *ike_sa,
/**
* Create an authenticator to authenticate EAP clients.
- *
+ *
* @param ike_sa associated ike_sa
* @param received_nonce nonce received in IKE_SA_INIT
* @param sent_nonce nonce sent in IKE_SA_INIT
diff --git a/src/charon/sa/authenticators/psk_authenticator.c b/src/charon/sa/authenticators/psk_authenticator.c
index 742b67789..67197d690 100644
--- a/src/charon/sa/authenticators/psk_authenticator.c
+++ b/src/charon/sa/authenticators/psk_authenticator.c
@@ -35,12 +35,12 @@ struct private_psk_authenticator_t {
* Assigned IKE_SA
*/
ike_sa_t *ike_sa;
-
+
/**
* nonce to include in AUTH calculation
*/
chunk_t nonce;
-
+
/**
* IKE_SA_INIT message data to include in AUTH calculation
*/
@@ -57,7 +57,7 @@ static status_t build(private_psk_authenticator_t *this, message_t *message)
shared_key_t *key;
chunk_t auth_data;
keymat_t *keymat;
-
+
keymat = this->ike_sa->get_keymat(this->ike_sa);
my_id = this->ike_sa->get_my_id(this->ike_sa);
other_id = this->ike_sa->get_other_id(this->ike_sa);
@@ -79,7 +79,7 @@ static status_t build(private_psk_authenticator_t *this, message_t *message)
auth_payload->set_data(auth_payload, auth_data);
chunk_free(&auth_data);
message->add_payload(message, (payload_t*)auth_payload);
-
+
return SUCCESS;
}
@@ -97,7 +97,7 @@ static status_t process(private_psk_authenticator_t *this, message_t *message)
bool authenticated = FALSE;
int keys_found = 0;
keymat_t *keymat;
-
+
auth_payload = (auth_payload_t*)message->get_payload(message, AUTHENTICATION);
if (!auth_payload)
{
@@ -112,7 +112,7 @@ static status_t process(private_psk_authenticator_t *this, message_t *message)
while (!authenticated && enumerator->enumerate(enumerator, &key, NULL, NULL))
{
keys_found++;
-
+
auth_data = keymat->get_psk_sig(keymat, TRUE, this->ike_sa_init,
this->nonce, key->get_key(key), other_id);
if (auth_data.len && chunk_equals(auth_data, recv_auth_data))
@@ -124,7 +124,7 @@ static status_t process(private_psk_authenticator_t *this, message_t *message)
chunk_free(&auth_data);
}
enumerator->destroy(enumerator);
-
+
if (!authenticated)
{
if (keys_found == 0)
@@ -136,7 +136,7 @@ static status_t process(private_psk_authenticator_t *this, message_t *message)
keys_found, keys_found == 1 ? "" : "s", my_id, other_id);
return FAILED;
}
-
+
auth = this->ike_sa->get_auth_cfg(this->ike_sa, FALSE);
auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PSK);
return SUCCESS;
@@ -166,15 +166,16 @@ psk_authenticator_t *psk_authenticator_create_builder(ike_sa_t *ike_sa,
chunk_t received_nonce, chunk_t sent_init)
{
private_psk_authenticator_t *this = malloc_thing(private_psk_authenticator_t);
-
+
this->public.authenticator.build = (status_t(*)(authenticator_t*, message_t *message))build;
this->public.authenticator.process = (status_t(*)(authenticator_t*, message_t *message))return_failed;
+ this->public.authenticator.is_mutual = (bool(*)(authenticator_t*))return_false;
this->public.authenticator.destroy = (void(*)(authenticator_t*))destroy;
-
+
this->ike_sa = ike_sa;
this->ike_sa_init = sent_init;
this->nonce = received_nonce;
-
+
return &this->public;
}
@@ -185,15 +186,16 @@ psk_authenticator_t *psk_authenticator_create_verifier(ike_sa_t *ike_sa,
chunk_t sent_nonce, chunk_t received_init)
{
private_psk_authenticator_t *this = malloc_thing(private_psk_authenticator_t);
-
+
this->public.authenticator.build = (status_t(*)(authenticator_t*, message_t *messageh))return_failed;
this->public.authenticator.process = (status_t(*)(authenticator_t*, message_t *message))process;
+ this->public.authenticator.is_mutual = (bool(*)(authenticator_t*))return_false;
this->public.authenticator.destroy = (void(*)(authenticator_t*))destroy;
-
+
this->ike_sa = ike_sa;
this->ike_sa_init = received_init;
this->nonce = sent_nonce;
-
+
return &this->public;
}
diff --git a/src/charon/sa/authenticators/psk_authenticator.h b/src/charon/sa/authenticators/psk_authenticator.h
index 5bb743d93..0fab11095 100644
--- a/src/charon/sa/authenticators/psk_authenticator.h
+++ b/src/charon/sa/authenticators/psk_authenticator.h
@@ -49,7 +49,7 @@ psk_authenticator_t *psk_authenticator_create_builder(ike_sa_t *ike_sa,
/**
* Create an authenticator to verify PSK signatures.
- *
+ *
* @param ike_sa associated ike_sa
* @param sent_nonce nonce sent in IKE_SA_INIT
* @param received_init received IKE_SA_INIT message data
diff --git a/src/charon/sa/authenticators/pubkey_authenticator.c b/src/charon/sa/authenticators/pubkey_authenticator.c
index 44cabfb94..f1dca2702 100644
--- a/src/charon/sa/authenticators/pubkey_authenticator.c
+++ b/src/charon/sa/authenticators/pubkey_authenticator.c
@@ -26,22 +26,22 @@ typedef struct private_pubkey_authenticator_t private_pubkey_authenticator_t;
* Private data of an pubkey_authenticator_t object.
*/
struct private_pubkey_authenticator_t {
-
+
/**
* Public authenticator_t interface.
*/
pubkey_authenticator_t public;
-
+
/**
* Assigned IKE_SA
*/
ike_sa_t *ike_sa;
-
+
/**
* nonce to include in AUTH calculation
*/
chunk_t nonce;
-
+
/**
* IKE_SA_INIT message data to include in AUTH calculation
*/
@@ -72,11 +72,11 @@ static status_t build(private_pubkey_authenticator_t *this, message_t *message)
DBG1(DBG_IKE, "no private key found for '%Y'", id);
return NOT_FOUND;
}
-
+
switch (private->get_type(private))
{
case KEY_RSA:
- /* we currently use always SHA1 for signatures,
+ /* we currently use always SHA1 for signatures,
* TODO: support other hashes depending on configuration/auth */
scheme = SIGN_RSA_EMSA_PKCS1_SHA1;
auth_method = AUTH_RSA;
@@ -86,7 +86,7 @@ static status_t build(private_pubkey_authenticator_t *this, message_t *message)
switch (private->get_keysize(private))
{
case 32:
- scheme = SIGN_ECDSA_256;
+ scheme = SIGN_ECDSA_256;
auth_method = AUTH_ECDSA_256;
break;
case 48:
@@ -121,11 +121,11 @@ static status_t build(private_pubkey_authenticator_t *this, message_t *message)
status = SUCCESS;
}
DBG1(DBG_IKE, "authentication of '%Y' (myself) with %N %s", id,
- auth_method_names, auth_method,
+ auth_method_names, auth_method,
(status == SUCCESS)? "successful":"failed");
chunk_free(&octets);
private->destroy(private);
-
+
return status;
}
@@ -145,7 +145,7 @@ static status_t process(private_pubkey_authenticator_t *this, message_t *message
signature_scheme_t scheme;
status_t status = NOT_FOUND;
keymat_t *keymat;
-
+
auth_payload = (auth_payload_t*)message->get_payload(message, AUTHENTICATION);
if (!auth_payload)
{
@@ -231,15 +231,16 @@ pubkey_authenticator_t *pubkey_authenticator_create_builder(ike_sa_t *ike_sa,
chunk_t received_nonce, chunk_t sent_init)
{
private_pubkey_authenticator_t *this = malloc_thing(private_pubkey_authenticator_t);
-
+
this->public.authenticator.build = (status_t(*)(authenticator_t*, message_t *message))build;
this->public.authenticator.process = (status_t(*)(authenticator_t*, message_t *message))return_failed;
+ this->public.authenticator.is_mutual = (bool(*)(authenticator_t*))return_false;
this->public.authenticator.destroy = (void(*)(authenticator_t*))destroy;
-
+
this->ike_sa = ike_sa;
this->ike_sa_init = sent_init;
this->nonce = received_nonce;
-
+
return &this->public;
}
@@ -250,14 +251,15 @@ pubkey_authenticator_t *pubkey_authenticator_create_verifier(ike_sa_t *ike_sa,
chunk_t sent_nonce, chunk_t received_init)
{
private_pubkey_authenticator_t *this = malloc_thing(private_pubkey_authenticator_t);
-
+
this->public.authenticator.build = (status_t(*)(authenticator_t*, message_t *message))return_failed;
this->public.authenticator.process = (status_t(*)(authenticator_t*, message_t *message))process;
+ this->public.authenticator.is_mutual = (bool(*)(authenticator_t*))return_false;
this->public.authenticator.destroy = (void(*)(authenticator_t*))destroy;
-
+
this->ike_sa = ike_sa;
this->ike_sa_init = received_init;
this->nonce = sent_nonce;
-
+
return &this->public;
}
diff --git a/src/charon/sa/authenticators/pubkey_authenticator.h b/src/charon/sa/authenticators/pubkey_authenticator.h
index e67f020ff..be369cb89 100644
--- a/src/charon/sa/authenticators/pubkey_authenticator.h
+++ b/src/charon/sa/authenticators/pubkey_authenticator.h
@@ -50,7 +50,7 @@ pubkey_authenticator_t *pubkey_authenticator_create_builder(ike_sa_t *ike_sa,
/**
* Create an authenticator to verify public key signatures.
- *
+ *
* @param ike_sa associated ike_sa
* @param sent_nonce nonce sent in IKE_SA_INIT
* @param received_init received IKE_SA_INIT message data
diff --git a/src/charon/sa/child_sa.c b/src/charon/sa/child_sa.c
index 14d174ab5..3fdfb51ad 100644
--- a/src/charon/sa/child_sa.c
+++ b/src/charon/sa/child_sa.c
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2006-2008 Tobias Brunner
+ * Copyright (C) 2006-2009 Tobias Brunner
* Copyright (C) 2005-2008 Martin Willi
* Copyright (C) 2006 Daniel Roethlisberger
* Copyright (C) 2005 Jan Hutter
@@ -46,67 +46,67 @@ struct private_child_sa_t {
* Public interface of child_sa_t.
*/
child_sa_t public;
-
+
/**
* address of us
*/
host_t *my_addr;
-
+
/**
* address of remote
*/
host_t *other_addr;
-
+
/**
* our actually used SPI, 0 if unused
*/
u_int32_t my_spi;
-
+
/**
* others used SPI, 0 if unused
*/
u_int32_t other_spi;
-
+
/**
* our Compression Parameter Index (CPI) used, 0 if unused
*/
u_int16_t my_cpi;
-
+
/**
* others Compression Parameter Index (CPI) used, 0 if unused
*/
u_int16_t other_cpi;
-
+
/**
* List for local traffic selectors
*/
linked_list_t *my_ts;
-
+
/**
* List for remote traffic selectors
*/
linked_list_t *other_ts;
-
+
/**
* Protocol used to protect this SA, ESP|AH
*/
protocol_id_t protocol;
-
+
/**
* reqid used for this child_sa
*/
u_int32_t reqid;
-
+
/**
* absolute time when rekeying is scheduled
*/
time_t rekey_time;
-
+
/**
* absolute time when the SA expires
*/
time_t expire_time;
-
+
/**
* state of the CHILD_SA
*/
@@ -116,22 +116,22 @@ struct private_child_sa_t {
* Specifies if UDP encapsulation is enabled (NAT traversal)
*/
bool encap;
-
+
/**
* Specifies the IPComp transform used (IPCOMP_NONE if disabled)
*/
ipcomp_transform_t ipcomp;
-
+
/**
* mode this SA uses, tunnel/transport
*/
ipsec_mode_t mode;
-
+
/**
- * selected proposal
- */
- proposal_t *proposal;
-
+ * selected proposal
+ */
+ proposal_t *proposal;
+
/**
* config used to create this child
*/
@@ -320,7 +320,7 @@ static bool policy_enumerate(policy_enumerator_t *this,
traffic_selector_t **my_out, traffic_selector_t **other_out)
{
traffic_selector_t *other_ts;
-
+
while (this->ts || this->mine->enumerate(this->mine, &this->ts))
{
if (!this->other->enumerate(this->other, &other_ts))
@@ -363,14 +363,14 @@ static void policy_destroy(policy_enumerator_t *this)
static enumerator_t* create_policy_enumerator(private_child_sa_t *this)
{
policy_enumerator_t *e = malloc_thing(policy_enumerator_t);
-
+
e->public.enumerate = (void*)policy_enumerate;
e->public.destroy = (void*)policy_destroy;
e->mine = this->my_ts->create_enumerator(this->my_ts);
e->other = this->other_ts->create_enumerator(this->other_ts);
e->list = this->other_ts;
e->ts = NULL;
-
+
return &e->public;
}
@@ -384,7 +384,7 @@ static status_t update_usebytes(private_child_sa_t *this, bool inbound)
{
status_t status = FAILED;
u_int64_t bytes;
-
+
if (inbound)
{
if (this->my_spi)
@@ -434,12 +434,12 @@ static void update_usetime(private_child_sa_t *this, bool inbound)
enumerator_t *enumerator;
traffic_selector_t *my_ts, *other_ts;
u_int32_t last_use = 0;
-
+
enumerator = create_policy_enumerator(this);
while (enumerator->enumerate(enumerator, &my_ts, &other_ts))
{
u_int32_t in, out, fwd;
-
+
if (inbound)
{
if (charon->kernel_interface->query_policy(charon->kernel_interface,
@@ -507,7 +507,7 @@ static void get_usestats(private_child_sa_t *this, bool inbound,
/**
* Implementation of child_sa_t.get_lifetime
*/
-static u_int32_t get_lifetime(private_child_sa_t *this, bool hard)
+static time_t get_lifetime(private_child_sa_t *this, bool hard)
{
return hard ? this->expire_time : this->rekey_time;
}
@@ -544,14 +544,17 @@ static u_int16_t alloc_cpi(private_child_sa_t *this)
* Implementation of child_sa_t.install
*/
static status_t install(private_child_sa_t *this, chunk_t encr, chunk_t integ,
- u_int32_t spi, u_int16_t cpi, bool inbound)
+ u_int32_t spi, u_int16_t cpi, bool inbound,
+ linked_list_t *my_ts, linked_list_t *other_ts)
{
u_int16_t enc_alg = ENCR_UNDEFINED, int_alg = AUTH_UNDEFINED, size;
- u_int32_t soft, hard, now;
+ traffic_selector_t *src_ts = NULL, *dst_ts = NULL;
+ time_t now;
+ lifetime_cfg_t *lifetime;
host_t *src, *dst;
status_t status;
bool update = FALSE;
-
+
/* now we have to decide which spi to use. Use self allocated, if "in",
* or the one in the proposal, if not "in" (others). Additionally,
* source and dest host switch depending on the role */
@@ -573,35 +576,59 @@ static status_t install(private_child_sa_t *this, chunk_t encr, chunk_t integ,
this->other_spi = spi;
this->other_cpi = cpi;
}
-
+
DBG2(DBG_CHD, "adding %s %N SA", inbound ? "inbound" : "outbound",
protocol_id_names, this->protocol);
-
+
/* send SA down to the kernel */
DBG2(DBG_CHD, " SPI 0x%.8x, src %H dst %H", ntohl(spi), src, dst);
-
+
this->proposal->get_algorithm(this->proposal, ENCRYPTION_ALGORITHM,
&enc_alg, &size);
this->proposal->get_algorithm(this->proposal, INTEGRITY_ALGORITHM,
&int_alg, &size);
-
- soft = this->config->get_lifetime(this->config, TRUE);
- hard = this->config->get_lifetime(this->config, FALSE);
-
- status = charon->kernel_interface->add_sa(charon->kernel_interface,
- src, dst, spi, this->protocol, this->reqid,
- inbound ? soft : 0, hard, enc_alg, encr, int_alg, integ,
- this->mode, this->ipcomp, cpi, this->encap, update);
-
- now = time(NULL);
- if (soft)
+
+ lifetime = this->config->get_lifetime(this->config);
+
+ now = time_monotonic(NULL);
+ if (lifetime->time.rekey)
{
- this->rekey_time = now + soft;
+ this->rekey_time = now + lifetime->time.rekey;
}
- if (hard)
+ if (lifetime->time.life)
+ {
+ this->expire_time = now + lifetime->time.life;
+ }
+
+ if (!lifetime->time.jitter && !inbound)
+ { /* avoid triggering multiple rekey events */
+ lifetime->time.rekey = 0;
+ }
+
+ if (this->mode == MODE_BEET)
{
- this->expire_time = now + hard;
+ /* BEET requires the bound address from the traffic selectors.
+ * TODO: We add just the first traffic selector for now, as the
+ * kernel accepts a single TS per SA only */
+ if (inbound)
+ {
+ my_ts->get_first(my_ts, (void**)&dst_ts);
+ other_ts->get_first(other_ts, (void**)&src_ts);
+ }
+ else
+ {
+ my_ts->get_first(my_ts, (void**)&src_ts);
+ other_ts->get_first(other_ts, (void**)&dst_ts);
+ }
}
+
+ status = charon->kernel_interface->add_sa(charon->kernel_interface,
+ src, dst, spi, this->protocol, this->reqid, lifetime,
+ enc_alg, encr, int_alg, integ, this->mode, this->ipcomp, cpi,
+ this->encap, update, src_ts, dst_ts);
+
+ free(lifetime);
+
return status;
}
@@ -615,7 +642,7 @@ static status_t add_policies(private_child_sa_t *this,
traffic_selector_t *my_ts, *other_ts;
status_t status = SUCCESS;
bool routed = (this->state == CHILD_CREATED);
-
+
/* apply traffic selectors */
enumerator = my_ts_list->create_enumerator(my_ts_list);
while (enumerator->enumerate(enumerator, &my_ts))
@@ -629,7 +656,7 @@ static status_t add_policies(private_child_sa_t *this,
this->other_ts->insert_last(this->other_ts, other_ts->clone(other_ts));
}
enumerator->destroy(enumerator);
-
+
if (this->config->install_policy(this->config))
{
/* enumerate pairs of traffic selectors */
@@ -641,7 +668,7 @@ static status_t add_policies(private_child_sa_t *this,
this->my_addr, this->other_addr, my_ts, other_ts, POLICY_OUT,
this->other_spi, this->protocol, this->reqid, this->mode,
this->ipcomp, this->other_cpi, routed);
-
+
status |= charon->kernel_interface->add_policy(charon->kernel_interface,
this->other_addr, this->my_addr, other_ts, my_ts, POLICY_IN,
this->my_spi, this->protocol, this->reqid, this->mode,
@@ -653,7 +680,7 @@ static status_t add_policies(private_child_sa_t *this,
this->my_spi, this->protocol, this->reqid, this->mode,
this->ipcomp, this->my_cpi, routed);
}
-
+
if (status != SUCCESS)
{
break;
@@ -661,7 +688,7 @@ static status_t add_policies(private_child_sa_t *this,
}
enumerator->destroy(enumerator);
}
-
+
if (status == SUCCESS && this->state == CHILD_CREATED)
{ /* switch to routed state if no SAD entry set up */
set_state(this, CHILD_ROUTED);
@@ -677,19 +704,19 @@ static status_t update(private_child_sa_t *this, host_t *me, host_t *other,
{
child_sa_state_t old;
bool transport_proxy_mode;
-
+
/* anything changed at all? */
if (me->equals(me, this->my_addr) &&
other->equals(other, this->other_addr) && this->encap == encap)
{
return SUCCESS;
}
-
+
old = this->state;
set_state(this, CHILD_UPDATING);
transport_proxy_mode = this->config->use_proxy_mode(this->config) &&
this->mode == MODE_TRANSPORT;
-
+
if (!transport_proxy_mode)
{
/* update our (initator) SA */
@@ -704,13 +731,13 @@ static status_t update(private_child_sa_t *this, host_t *me, host_t *other,
return NOT_SUPPORTED;
}
}
-
+
/* update his (responder) SA */
if (this->other_spi)
{
if (charon->kernel_interface->update_sa(charon->kernel_interface,
this->other_spi, this->protocol,
- this->ipcomp != IPCOMP_NONE ? this->other_cpi : 0,
+ this->ipcomp != IPCOMP_NONE ? this->other_cpi : 0,
this->my_addr, this->other_addr, me, other,
this->encap, encap) == NOT_SUPPORTED)
{
@@ -718,7 +745,7 @@ static status_t update(private_child_sa_t *this, host_t *me, host_t *other,
}
}
}
-
+
if (this->config->install_policy(this->config))
{
/* update policies */
@@ -727,7 +754,7 @@ static status_t update(private_child_sa_t *this, host_t *me, host_t *other,
{
enumerator_t *enumerator;
traffic_selector_t *my_ts, *other_ts;
-
+
/* always use high priorities, as hosts getting updated are INSTALLED */
enumerator = create_policy_enumerator(this);
while (enumerator->enumerate(enumerator, &my_ts, &other_ts))
@@ -742,7 +769,7 @@ static status_t update(private_child_sa_t *this, host_t *me, host_t *other,
charon->kernel_interface->del_policy(charon->kernel_interface,
other_ts, my_ts, POLICY_FWD, FALSE);
}
-
+
/* check whether we have to update a "dynamic" traffic selector */
if (!me->ip_equals(me, this->my_addr) &&
my_ts->is_host(my_ts, this->my_addr))
@@ -754,7 +781,7 @@ static status_t update(private_child_sa_t *this, host_t *me, host_t *other,
{
other_ts->set_address(other_ts, other);
}
-
+
/* we reinstall the virtual IP to handle interface roaming
* correctly */
if (vip)
@@ -762,7 +789,7 @@ static status_t update(private_child_sa_t *this, host_t *me, host_t *other,
charon->kernel_interface->del_ip(charon->kernel_interface, vip);
charon->kernel_interface->add_ip(charon->kernel_interface, vip, me);
}
-
+
/* reinstall updated policies */
charon->kernel_interface->add_policy(charon->kernel_interface,
me, other, my_ts, other_ts, POLICY_OUT, this->other_spi,
@@ -813,12 +840,18 @@ static void destroy(private_child_sa_t *this)
enumerator_t *enumerator;
traffic_selector_t *my_ts, *other_ts;
bool unrouted = (this->state == CHILD_ROUTED);
-
+
set_state(this, CHILD_DESTROYING);
-
+
/* delete SAs in the kernel, if they are set up */
if (this->my_spi)
{
+ /* if CHILD was not established, use PROTO_ESP used during alloc_spi().
+ * TODO: For AH support, we have to store protocol specific SPI.s */
+ if (this->protocol == PROTO_NONE)
+ {
+ this->protocol = PROTO_ESP;
+ }
charon->kernel_interface->del_sa(charon->kernel_interface,
this->other_addr, this->my_addr, this->my_spi,
this->protocol, this->my_cpi);
@@ -829,7 +862,7 @@ static void destroy(private_child_sa_t *this)
this->my_addr, this->other_addr, this->other_spi,
this->protocol, this->other_cpi);
}
-
+
if (this->config->install_policy(this->config))
{
/* delete all policies in the kernel */
@@ -848,7 +881,7 @@ static void destroy(private_child_sa_t *this)
}
enumerator->destroy(enumerator);
}
-
+
this->my_ts->destroy_offset(this->my_ts, offsetof(traffic_selector_t, destroy));
this->other_ts->destroy_offset(this->other_ts, offsetof(traffic_selector_t, destroy));
this->my_addr->destroy(this->my_addr);
@@ -881,20 +914,20 @@ child_sa_t * child_sa_create(host_t *me, host_t* other,
this->public.set_mode = (void(*)(child_sa_t*, ipsec_mode_t mode))set_mode;
this->public.get_proposal = (proposal_t*(*)(child_sa_t*))get_proposal;
this->public.set_proposal = (void(*)(child_sa_t*, proposal_t *proposal))set_proposal;
- this->public.get_lifetime = (u_int32_t(*)(child_sa_t*, bool))get_lifetime;
+ this->public.get_lifetime = (time_t(*)(child_sa_t*, bool))get_lifetime;
this->public.get_usestats = (void(*)(child_sa_t*,bool,time_t*,u_int64_t*))get_usestats;
this->public.has_encap = (bool(*)(child_sa_t*))has_encap;
this->public.get_ipcomp = (ipcomp_transform_t(*)(child_sa_t*))get_ipcomp;
this->public.set_ipcomp = (void(*)(child_sa_t*,ipcomp_transform_t))set_ipcomp;
this->public.alloc_spi = (u_int32_t(*)(child_sa_t*, protocol_id_t protocol))alloc_spi;
this->public.alloc_cpi = (u_int16_t(*)(child_sa_t*))alloc_cpi;
- this->public.install = (status_t(*)(child_sa_t*, chunk_t encr, chunk_t integ, u_int32_t spi, u_int16_t cpi, bool inbound))install;
+ this->public.install = (status_t(*)(child_sa_t*, chunk_t encr, chunk_t integ, u_int32_t spi, u_int16_t cpi, bool inbound, linked_list_t *my_ts_list, linked_list_t *other_ts_list))install;
this->public.update = (status_t (*)(child_sa_t*,host_t*,host_t*,host_t*,bool))update;
this->public.add_policies = (status_t (*)(child_sa_t*, linked_list_t*,linked_list_t*))add_policies;
this->public.get_traffic_selectors = (linked_list_t*(*)(child_sa_t*,bool))get_traffic_selectors;
this->public.create_policy_enumerator = (enumerator_t*(*)(child_sa_t*))create_policy_enumerator;
this->public.destroy = (void(*)(child_sa_t*))destroy;
-
+
/* private data */
this->my_addr = me->clone(me);
this->other_addr = other->clone(other);
@@ -920,10 +953,10 @@ child_sa_t * child_sa_create(host_t *me, host_t* other,
this->expire_time = 0;
this->config = config;
config->get_ref(config);
-
+
/* MIPv6 proxy transport mode sets SA endpoints to TS hosts */
if (config->get_mode(config) == MODE_TRANSPORT &&
- config->use_proxy_mode(config))
+ config->use_proxy_mode(config))
{
ts_type_t type;
int family;
@@ -932,9 +965,9 @@ child_sa_t * child_sa_create(host_t *me, host_t* other,
enumerator_t *enumerator;
linked_list_t *my_ts_list, *other_ts_list;
traffic_selector_t *my_ts, *other_ts;
-
+
this->mode = MODE_TRANSPORT;
-
+
my_ts_list = config->get_traffic_selectors(config, TRUE, NULL, me);
enumerator = my_ts_list->create_enumerator(my_ts_list);
if (enumerator->enumerate(enumerator, &my_ts))
@@ -955,7 +988,7 @@ child_sa_t * child_sa_create(host_t *me, host_t* other,
}
enumerator->destroy(enumerator);
my_ts_list->destroy_offset(my_ts_list, offsetof(traffic_selector_t, destroy));
-
+
other_ts_list = config->get_traffic_selectors(config, FALSE, NULL, other);
enumerator = other_ts_list->create_enumerator(other_ts_list);
if (enumerator->enumerate(enumerator, &other_ts))
@@ -977,6 +1010,6 @@ child_sa_t * child_sa_create(host_t *me, host_t* other,
enumerator->destroy(enumerator);
other_ts_list->destroy_offset(other_ts_list, offsetof(traffic_selector_t, destroy));
}
-
+
return &this->public;
}
diff --git a/src/charon/sa/child_sa.h b/src/charon/sa/child_sa.h
index 698da8bc7..d70bed664 100644
--- a/src/charon/sa/child_sa.h
+++ b/src/charon/sa/child_sa.h
@@ -36,42 +36,42 @@ typedef struct child_sa_t child_sa_t;
* States of a CHILD_SA
*/
enum child_sa_state_t {
-
+
/**
* Just created, uninstalled CHILD_SA
*/
CHILD_CREATED,
-
+
/**
* Installed SPD, but no SAD entries
*/
CHILD_ROUTED,
-
+
/**
* Installing an in-use CHILD_SA
*/
CHILD_INSTALLING,
-
+
/**
* Installed an in-use CHILD_SA
*/
CHILD_INSTALLED,
-
+
/**
* While updating hosts, in update_hosts()
*/
CHILD_UPDATING,
-
+
/**
* CHILD_SA which is rekeying
*/
CHILD_REKEYING,
-
+
/**
* CHILD_SA in progress of delete
*/
CHILD_DELETING,
-
+
/**
* CHILD_SA object gets destroyed
*/
@@ -102,14 +102,14 @@ extern enum_name_t *child_sa_state_names;
* Once SAs are set up, policies can be added using add_policies.
*/
struct child_sa_t {
-
+
/**
* Get the name of the config this CHILD_SA uses.
*
* @return name
*/
char* (*get_name) (child_sa_t *this);
-
+
/**
* Get the reqid of the CHILD SA.
*
@@ -119,28 +119,28 @@ struct child_sa_t {
* @return reqid of the CHILD SA
*/
u_int32_t (*get_reqid)(child_sa_t *this);
-
+
/**
* Get the config used to set up this child sa.
*
* @return child_cfg
*/
child_cfg_t* (*get_config) (child_sa_t *this);
-
+
/**
* Get the state of the CHILD_SA.
*
* @return CHILD_SA state
*/
child_sa_state_t (*get_state) (child_sa_t *this);
-
+
/**
* Set the state of the CHILD_SA.
*
* @param state state to set on CHILD_SA
*/
void (*set_state) (child_sa_t *this, child_sa_state_t state);
-
+
/**
* Get the SPI of this CHILD_SA.
*
@@ -152,7 +152,7 @@ struct child_sa_t {
* @return SPI of the CHILD SA
*/
u_int32_t (*get_spi) (child_sa_t *this, bool inbound);
-
+
/**
* Get the CPI of this CHILD_SA.
*
@@ -171,71 +171,71 @@ struct child_sa_t {
* @return AH | ESP
*/
protocol_id_t (*get_protocol) (child_sa_t *this);
-
+
/**
* Set the negotiated protocol to use for this CHILD_SA.
*
* @param protocol AH | ESP
*/
void (*set_protocol)(child_sa_t *this, protocol_id_t protocol);
-
+
/**
* Get the IPsec mode of this CHILD_SA.
*
* @return TUNNEL | TRANSPORT | BEET
*/
ipsec_mode_t (*get_mode)(child_sa_t *this);
-
+
/**
* Set the negotiated IPsec mode to use.
*
* @param mode TUNNEL | TRANPORT | BEET
*/
void (*set_mode)(child_sa_t *this, ipsec_mode_t mode);
-
+
/**
* Get the used IPComp algorithm.
*
* @return IPComp compression algorithm.
*/
ipcomp_transform_t (*get_ipcomp)(child_sa_t *this);
-
+
/**
* Set the IPComp algorithm to use.
*
* @param ipcomp the IPComp transform to use
*/
void (*set_ipcomp)(child_sa_t *this, ipcomp_transform_t ipcomp);
-
+
/**
* Get the selected proposal.
*
* @return selected proposal
*/
proposal_t* (*get_proposal)(child_sa_t *this);
-
+
/**
* Set the negotiated proposal.
*
* @param proposal selected proposal
*/
void (*set_proposal)(child_sa_t *this, proposal_t *proposal);
-
+
/**
* Check if this CHILD_SA uses UDP encapsulation.
*
* @return TRUE if SA encapsulates ESP packets
*/
bool (*has_encap)(child_sa_t *this);
-
+
/**
- * Get the lifetime of the CHILD_SA.
+ * Get the absolute time when the CHILD_SA expires or gets rekeyed.
*
* @param hard TRUE for hard lifetime, FALSE for soft (rekey) lifetime
- * @return lifetime in seconds
+ * @return absolute time
*/
- u_int32_t (*get_lifetime)(child_sa_t *this, bool hard);
-
+ time_t (*get_lifetime)(child_sa_t *this, bool hard);
+
/**
* Get last use time and the number of bytes processed.
*
@@ -245,7 +245,7 @@ struct child_sa_t {
*/
void (*get_usestats)(child_sa_t *this, bool inbound, time_t *time,
u_int64_t *bytes);
-
+
/**
* Get the traffic selectors list added for one side.
*
@@ -253,14 +253,14 @@ struct child_sa_t {
* @return list of traffic selectors
*/
linked_list_t* (*get_traffic_selectors) (child_sa_t *this, bool local);
-
+
/**
* Create an enumerator over installed policies.
*
* @return enumerator over pairs of traffic selectors.
*/
enumerator_t* (*create_policy_enumerator)(child_sa_t *this);
-
+
/**
* Allocate an SPI to include in a proposal.
*
@@ -269,14 +269,14 @@ struct child_sa_t {
* @return SPI, 0 on failure
*/
u_int32_t (*alloc_spi)(child_sa_t *this, protocol_id_t protocol);
-
+
/**
* Allocate a CPI to use for IPComp.
*
* @return CPI, 0 on failure
*/
u_int16_t (*alloc_cpi)(child_sa_t *this);
-
+
/**
* Install an IPsec SA for one direction.
*
@@ -285,10 +285,13 @@ struct child_sa_t {
* @param spi SPI to use, allocated for inbound
* @param cpi CPI to use, allocated for outbound
* @param inbound TRUE to install an inbound SA, FALSE for outbound
+ * @param my_ts negotiated local traffic selector list
+ * @param other_ts negotiated remote traffic selector list
* @return SUCCESS or FAILED
*/
status_t (*install)(child_sa_t *this, chunk_t encr, chunk_t integ,
- u_int32_t spi, u_int16_t cpi, bool inbound);
+ u_int32_t spi, u_int16_t cpi, bool inbound,
+ linked_list_t *my_ts, linked_list_t *other_ts);
/**
* Install the policies using some traffic selectors.
*
diff --git a/src/charon/sa/connect_manager.c b/src/charon/sa/connect_manager.c
index f26cf9405..b78ba070d 100644
--- a/src/charon/sa/connect_manager.c
+++ b/src/charon/sa/connect_manager.c
@@ -18,7 +18,7 @@
#include <math.h>
#include <daemon.h>
-#include <utils/mutex.h>
+#include <threading/mutex.h>
#include <utils/linked_list.h>
#include <crypto/hashers/hasher.h>
@@ -42,7 +42,6 @@
* the first check has succeeded */
#define ME_WAIT_TO_FINISH 1000 /* ms */
-
typedef struct private_connect_manager_t private_connect_manager_t;
/**
@@ -53,24 +52,25 @@ struct private_connect_manager_t {
* Public interface of connect_manager_t.
*/
connect_manager_t public;
-
+
/**
* Lock for exclusivly accessing the manager.
*/
mutex_t *mutex;
-
+
/**
* Hasher to generate signatures
*/
hasher_t *hasher;
-
+
/**
* Linked list with initiated mediated connections
*/
linked_list_t *initiated;
-
+
/**
- * Linked list with checklists (hash table with connect ID as key would be better).
+ * Linked list with checklists (hash table with connect ID as key would
+ * be better).
*/
linked_list_t *checklists;
};
@@ -93,24 +93,24 @@ typedef struct endpoint_pair_t endpoint_pair_t;
struct endpoint_pair_t {
/** pair id */
u_int32_t id;
-
+
/** priority */
u_int64_t priority;
-
+
/** local endpoint */
- host_t *local;
-
- /** remote endpoint */
- host_t *remote;
-
- /** state */
- check_state_t state;
-
- /** number of retransmissions */
- u_int32_t retransmitted;
-
- /** the generated packet */
- packet_t *packet;
+ host_t *local;
+
+ /** remote endpoint */
+ host_t *remote;
+
+ /** state */
+ check_state_t state;
+
+ /** number of retransmissions */
+ u_int32_t retransmitted;
+
+ /** the generated packet */
+ packet_t *packet;
};
/**
@@ -119,8 +119,8 @@ struct endpoint_pair_t {
static void endpoint_pair_destroy(endpoint_pair_t *this)
{
DESTROY_IF(this->local);
- DESTROY_IF(this->remote);
- DESTROY_IF(this->packet);
+ DESTROY_IF(this->remote);
+ DESTROY_IF(this->packet);
free(this);
}
@@ -131,22 +131,24 @@ static endpoint_pair_t *endpoint_pair_create(endpoint_notify_t *initiator,
endpoint_notify_t *responder, bool initiator_is_local)
{
endpoint_pair_t *this = malloc_thing(endpoint_pair_t);
-
+
this->id = 0;
-
+
u_int32_t pi = initiator->get_priority(initiator);
u_int32_t pr = responder->get_priority(responder);
this->priority = pow(2, 32) * min(pi, pr) + 2 * max(pi, pr) + (pi > pr ? 1 : 0);
-
- this->local = initiator_is_local ? initiator->get_base(initiator) : responder->get_base(responder);
+
+ this->local = initiator_is_local ? initiator->get_base(initiator)
+ : responder->get_base(responder);
this->local = this->local->clone(this->local);
- this->remote = initiator_is_local ? responder->get_host(responder) : initiator->get_host(initiator);
+ this->remote = initiator_is_local ? responder->get_host(responder)
+ : initiator->get_host(initiator);
this->remote = this->remote->clone(this->remote);
-
+
this->state = CHECK_WAITING;
this->retransmitted = 0;
this->packet = NULL;
-
+
return this;
}
@@ -157,50 +159,50 @@ typedef struct check_list_t check_list_t;
* An entry in the linked list.
*/
struct check_list_t {
-
+
struct {
/** initiator's id */
identification_t *id;
-
+
/** initiator's key */
chunk_t key;
-
+
/** initiator's endpoints */
linked_list_t *endpoints;
} initiator;
-
+
struct {
/** responder's id */
identification_t *id;
-
+
/** responder's key */
chunk_t key;
-
+
/** responder's endpoints */
linked_list_t *endpoints;
} responder;
-
+
/** connect id */
chunk_t connect_id;
-
- /** list of endpoint pairs */
- linked_list_t *pairs;
-
- /** pairs queued for triggered checks */
- linked_list_t *triggered;
-
- /** state */
- check_state_t state;
-
- /** TRUE if this is the initiator */
+
+ /** list of endpoint pairs */
+ linked_list_t *pairs;
+
+ /** pairs queued for triggered checks */
+ linked_list_t *triggered;
+
+ /** state */
+ check_state_t state;
+
+ /** TRUE if this is the initiator */
bool is_initiator;
-
+
/** TRUE if the initiator is finishing the checks */
bool is_finishing;
-
+
/** the current sender job */
job_t *sender;
-
+
};
/**
@@ -210,46 +212,51 @@ static void check_list_destroy(check_list_t *this)
{
DESTROY_IF(this->initiator.id);
DESTROY_IF(this->responder.id);
-
+
chunk_free(&this->connect_id);
chunk_free(&this->initiator.key);
chunk_free(&this->responder.key);
-
- DESTROY_OFFSET_IF(this->initiator.endpoints, offsetof(endpoint_notify_t, destroy));
- DESTROY_OFFSET_IF(this->responder.endpoints, offsetof(endpoint_notify_t, destroy));
-
+
+ DESTROY_OFFSET_IF(this->initiator.endpoints,
+ offsetof(endpoint_notify_t, destroy));
+ DESTROY_OFFSET_IF(this->responder.endpoints,
+ offsetof(endpoint_notify_t, destroy));
+
DESTROY_FUNCTION_IF(this->pairs, (void*)endpoint_pair_destroy);
- /* this list contains some of the same elements as contained in this->pairs */
- DESTROY_IF(this->triggered);
-
+ /* this list contains some of the elements contained in this->pairs */
+ DESTROY_IF(this->triggered);
+
free(this);
}
/**
* Creates a new checklist
*/
-static check_list_t *check_list_create(identification_t *initiator, identification_t *responder,
- chunk_t connect_id, chunk_t initiator_key, linked_list_t *initiator_endpoints,
- bool is_initiator)
+static check_list_t *check_list_create(identification_t *initiator,
+ identification_t *responder,
+ chunk_t connect_id,
+ chunk_t initiator_key,
+ linked_list_t *initiator_endpoints,
+ bool is_initiator)
{
check_list_t *this = malloc_thing(check_list_t);
-
+
this->connect_id = chunk_clone(connect_id);
-
+
this->initiator.id = initiator->clone(initiator);
this->initiator.key = chunk_clone(initiator_key);
this->initiator.endpoints = initiator_endpoints->clone_offset(initiator_endpoints, offsetof(endpoint_notify_t, clone));
-
+
this->responder.id = responder->clone(responder);
this->responder.key = chunk_empty;
- this->responder.endpoints = NULL;
-
- this->pairs = linked_list_create();
- this->triggered = linked_list_create();
- this->state = CHECK_NONE;
- this->is_initiator = is_initiator;
- this->is_finishing = FALSE;
-
+ this->responder.endpoints = NULL;
+
+ this->pairs = linked_list_create();
+ this->triggered = linked_list_create();
+ this->state = CHECK_NONE;
+ this->is_initiator = is_initiator;
+ this->is_finishing = FALSE;
+
return this;
}
@@ -261,10 +268,10 @@ typedef struct initiated_t initiated_t;
struct initiated_t {
/** my id */
identification_t *id;
-
+
/** peer id */
identification_t *peer_id;
-
+
/** list of mediated sas */
linked_list_t *mediated;
};
@@ -276,21 +283,23 @@ static void initiated_destroy(initiated_t *this)
{
DESTROY_IF(this->id);
DESTROY_IF(this->peer_id);
- this->mediated->destroy_offset(this->mediated, offsetof(ike_sa_id_t, destroy));
+ this->mediated->destroy_offset(this->mediated,
+ offsetof(ike_sa_id_t, destroy));
free(this);
}
/**
* Creates a queued initiation
*/
-static initiated_t *initiated_create(identification_t *id, identification_t *peer_id)
+static initiated_t *initiated_create(identification_t *id,
+ identification_t *peer_id)
{
initiated_t *this = malloc_thing(initiated_t);
-
+
this->id = id->clone(id);
this->peer_id = peer_id->clone(peer_id);
this->mediated = linked_list_create();
-
+
return this;
}
@@ -303,24 +312,24 @@ typedef struct check_t check_t;
struct check_t {
/** message id */
u_int32_t mid;
-
+
/** source of the connectivity check */
host_t *src;
-
+
/** destination of the connectivity check */
host_t *dst;
-
+
/** connect id */
chunk_t connect_id;
-
+
/** endpoint */
endpoint_notify_t *endpoint;
-
+
/** raw endpoint payload (to verify the signature) */
chunk_t endpoint_raw;
-
- /** connect auth */
- chunk_t auth;
+
+ /** connect auth */
+ chunk_t auth;
};
/**
@@ -343,16 +352,16 @@ static void check_destroy(check_t *this)
static check_t *check_create()
{
check_t *this = malloc_thing(check_t);
-
+
this->connect_id = chunk_empty;
this->auth = chunk_empty;
this->endpoint_raw = chunk_empty;
this->src = NULL;
this->dst = NULL;
this->endpoint = NULL;
-
+
this->mid = 0;
-
+
return this;
}
@@ -364,10 +373,10 @@ typedef struct callback_data_t callback_data_t;
struct callback_data_t {
/** connect manager */
private_connect_manager_t *connect_manager;
-
+
/** connect id */
chunk_t connect_id;
-
+
/** message (pair) id */
u_int32_t mid;
};
@@ -385,9 +394,9 @@ static void callback_data_destroy(callback_data_t *this)
* Creates a new callback data object
*/
static callback_data_t *callback_data_create(private_connect_manager_t *connect_manager,
- chunk_t connect_id)
+ chunk_t connect_id)
{
- callback_data_t *this = malloc_thing(callback_data_t);
+ callback_data_t *this = malloc_thing(callback_data_t);
this->connect_manager = connect_manager;
this->connect_id = chunk_clone(connect_id);
this->mid = 0;
@@ -398,7 +407,7 @@ static callback_data_t *callback_data_create(private_connect_manager_t *connect_
* Creates a new retransmission data object
*/
static callback_data_t *retransmit_data_create(private_connect_manager_t *connect_manager,
- chunk_t connect_id, u_int32_t mid)
+ chunk_t connect_id, u_int32_t mid)
{
callback_data_t *this = callback_data_create(connect_manager, connect_id);
this->mid = mid;
@@ -413,7 +422,7 @@ typedef struct initiate_data_t initiate_data_t;
struct initiate_data_t {
/** checklist */
check_list_t *checklist;
-
+
/** waiting mediated connections */
initiated_t *initiated;
};
@@ -431,10 +440,11 @@ static void initiate_data_destroy(initiate_data_t *this)
/**
* Creates a new initiate data object
*/
-static initiate_data_t *initiate_data_create(check_list_t *checklist, initiated_t *initiated)
+static initiate_data_t *initiate_data_create(check_list_t *checklist,
+ initiated_t *initiated)
{
initiate_data_t *this = malloc_thing(initiate_data_t);
-
+
this->checklist = checklist;
this->initiated = initiated;
@@ -445,27 +455,30 @@ static initiate_data_t *initiate_data_create(check_list_t *checklist, initiated_
* Find an initiated connection by the peers' ids
*/
static bool match_initiated_by_ids(initiated_t *current, identification_t *id,
- identification_t *peer_id)
+ identification_t *peer_id)
{
return id->equals(id, current->id) && peer_id->equals(peer_id, current->peer_id);
}
static status_t get_initiated_by_ids(private_connect_manager_t *this,
- identification_t *id, identification_t *peer_id, initiated_t **initiated)
+ identification_t *id,
+ identification_t *peer_id,
+ initiated_t **initiated)
{
return this->initiated->find_first(this->initiated,
- (linked_list_match_t)match_initiated_by_ids,
- (void**)initiated, id, peer_id);
+ (linked_list_match_t)match_initiated_by_ids,
+ (void**)initiated, id, peer_id);
}
/**
* Removes data about initiated connections
*/
-static void remove_initiated(private_connect_manager_t *this, initiated_t *initiated)
+static void remove_initiated(private_connect_manager_t *this,
+ initiated_t *initiated)
{
iterator_t *iterator;
initiated_t *current;
-
+
iterator = this->initiated->create_iterator(this->initiated, TRUE);
while (iterator->iterate(iterator, (void**)&current))
{
@@ -487,21 +500,23 @@ static bool match_checklist_by_id(check_list_t *current, chunk_t *connect_id)
}
static status_t get_checklist_by_id(private_connect_manager_t *this,
- chunk_t connect_id, check_list_t **check_list)
+ chunk_t connect_id,
+ check_list_t **check_list)
{
return this->checklists->find_first(this->checklists,
- (linked_list_match_t)match_checklist_by_id,
- (void**)check_list, &connect_id);
+ (linked_list_match_t)match_checklist_by_id,
+ (void**)check_list, &connect_id);
}
/**
* Removes a checklist
*/
-static void remove_checklist(private_connect_manager_t *this, check_list_t *checklist)
+static void remove_checklist(private_connect_manager_t *this,
+ check_list_t *checklist)
{
iterator_t *iterator;
check_list_t *current;
-
+
iterator = this->checklists->create_iterator(this->checklists, TRUE);
while (iterator->iterate(iterator, (void**)&current))
{
@@ -522,22 +537,23 @@ static bool match_endpoint_by_host(endpoint_notify_t *current, host_t *host)
return host->equals(host, current->get_host(current));
}
-static status_t endpoints_contain(linked_list_t *endpoints, host_t *host, endpoint_notify_t **endpoint)
+static status_t endpoints_contain(linked_list_t *endpoints, host_t *host,
+ endpoint_notify_t **endpoint)
{
return endpoints->find_first(endpoints,
- (linked_list_match_t)match_endpoint_by_host,
- (void**)endpoint, host);
+ (linked_list_match_t)match_endpoint_by_host,
+ (void**)endpoint, host);
}
/**
- * Inserts an endpoint pair into the list of pairs ordered by priority (high to low)
+ * Inserts an endpoint pair into a list of pairs ordered by priority (high to low)
*/
static void insert_pair_by_priority(linked_list_t *pairs, endpoint_pair_t *pair)
{
iterator_t *iterator;
endpoint_pair_t *current;
bool inserted = FALSE;
-
+
iterator = pairs->create_iterator(pairs, TRUE);
while (iterator->iterate(iterator, (void**)&current))
{
@@ -549,7 +565,7 @@ static void insert_pair_by_priority(linked_list_t *pairs, endpoint_pair_t *pair)
}
}
iterator->destroy(iterator);
-
+
if (!inserted)
{
pairs->insert_last(pairs, pair);
@@ -559,16 +575,17 @@ static void insert_pair_by_priority(linked_list_t *pairs, endpoint_pair_t *pair)
/**
* Searches a list of endpoint_pair_t for a pair with specific host_ts
*/
-static bool match_pair_by_hosts(endpoint_pair_t *current, host_t *local, host_t *remote)
+static bool match_pair_by_hosts(endpoint_pair_t *current, host_t *local,
+ host_t *remote)
{
return local->equals(local, current->local) && remote->equals(remote, current->remote);
}
-static status_t get_pair_by_hosts(linked_list_t *pairs, host_t *local, host_t *remote, endpoint_pair_t **pair)
+static status_t get_pair_by_hosts(linked_list_t *pairs, host_t *local,
+ host_t *remote, endpoint_pair_t **pair)
{
- return pairs->find_first(pairs,
- (linked_list_match_t)match_pair_by_hosts,
- (void**)pair, local, remote);
+ return pairs->find_first(pairs, (linked_list_match_t)match_pair_by_hosts,
+ (void**)pair, local, remote);
}
static bool match_pair_by_id(endpoint_pair_t *current, u_int32_t *id)
@@ -579,11 +596,12 @@ static bool match_pair_by_id(endpoint_pair_t *current, u_int32_t *id)
/**
* Searches for a pair with a specific id
*/
-static status_t get_pair_by_id(check_list_t *checklist, u_int32_t id, endpoint_pair_t **pair)
+static status_t get_pair_by_id(check_list_t *checklist, u_int32_t id,
+ endpoint_pair_t **pair)
{
return checklist->pairs->find_first(checklist->pairs,
- (linked_list_match_t)match_pair_by_id,
- (void**)pair, &id);
+ (linked_list_match_t)match_pair_by_id,
+ (void**)pair, &id);
}
static bool match_succeeded_pair(endpoint_pair_t *current)
@@ -592,13 +610,14 @@ static bool match_succeeded_pair(endpoint_pair_t *current)
}
/**
- * Returns the best pair of state CHECK_SUCCEEDED from a checklist.
+ * Returns the best pair of state CHECK_SUCCEEDED from a checklist.
*/
-static status_t get_best_valid_pair(check_list_t *checklist, endpoint_pair_t **pair)
+static status_t get_best_valid_pair(check_list_t *checklist,
+ endpoint_pair_t **pair)
{
return checklist->pairs->find_first(checklist->pairs,
- (linked_list_match_t)match_succeeded_pair,
- (void**)pair);
+ (linked_list_match_t)match_succeeded_pair,
+ (void**)pair);
}
static bool match_waiting_pair(endpoint_pair_t *current)
@@ -607,19 +626,20 @@ static bool match_waiting_pair(endpoint_pair_t *current)
}
/**
- * Returns and *removes* the first triggered pair in state CHECK_WAITING.
+ * Returns and *removes* the first triggered pair in state CHECK_WAITING.
*/
-static status_t get_triggered_pair(check_list_t *checklist, endpoint_pair_t **pair)
+static status_t get_triggered_pair(check_list_t *checklist,
+ endpoint_pair_t **pair)
{
iterator_t *iterator;
endpoint_pair_t *current;
status_t status = NOT_FOUND;
-
+
iterator = checklist->triggered->create_iterator(checklist->triggered, TRUE);
while (iterator->iterate(iterator, (void**)&current))
{
iterator->remove(iterator);
-
+
if (current->state == CHECK_WAITING)
{
if (pair)
@@ -631,7 +651,7 @@ static status_t get_triggered_pair(check_list_t *checklist, endpoint_pair_t **pa
}
}
iterator->destroy(iterator);
-
+
return status;
}
@@ -642,13 +662,13 @@ static void print_checklist(check_list_t *checklist)
{
iterator_t *iterator;
endpoint_pair_t *current;
-
+
DBG1(DBG_IKE, "pairs on checklist %#B:", &checklist->connect_id);
iterator = checklist->pairs->create_iterator(checklist->pairs, TRUE);
while (iterator->iterate(iterator, (void**)&current))
{
DBG1(DBG_IKE, " * %#H - %#H (%d)", current->local, current->remote,
- current->priority);
+ current->priority);
}
iterator->destroy(iterator);
}
@@ -662,29 +682,29 @@ static void prune_pairs(linked_list_t *pairs)
iterator_t *iterator, *search;
endpoint_pair_t *current, *other;
u_int32_t id = 0;
-
+
iterator = pairs->create_iterator(pairs, TRUE);
search = pairs->create_iterator(pairs, TRUE);
while (iterator->iterate(iterator, (void**)&current))
{
current->id = ++id;
-
+
while (search->iterate(search, (void**)&other))
{
if (current == other)
{
continue;
}
-
+
if (current->local->equals(current->local, other->local) &&
- current->remote->equals(current->remote, other->remote))
+ current->remote->equals(current->remote, other->remote))
{
/* since the list of pairs is sorted by priority in descending
* order, and we iterate the list from the beginning, we are
* sure that the priority of 'other' is lower than that of
* 'current', remove it */
DBG1(DBG_IKE, "pruning endpoint pair %#H - %#H with priority %d",
- other->local, other->remote, other->priority);
+ other->local, other->remote, other->priority);
search->remove(search);
endpoint_pair_destroy(other);
}
@@ -703,25 +723,27 @@ static void build_pairs(check_list_t *checklist)
/* FIXME: limit endpoints and pairs */
iterator_t *iterator_i, *iterator_r;
endpoint_notify_t *initiator, *responder;
-
- iterator_i = checklist->initiator.endpoints->create_iterator(checklist->initiator.endpoints, TRUE);
+
+ iterator_i = checklist->initiator.endpoints->create_iterator(
+ checklist->initiator.endpoints, TRUE);
while (iterator_i->iterate(iterator_i, (void**)&initiator))
{
- iterator_r = checklist->responder.endpoints->create_iterator(checklist->responder.endpoints, TRUE);
+ iterator_r = checklist->responder.endpoints->create_iterator(
+ checklist->responder.endpoints, TRUE);
while (iterator_r->iterate(iterator_r, (void**)&responder))
{
if (initiator->get_family(initiator) != responder->get_family(responder))
{
continue;
}
-
- insert_pair_by_priority(checklist->pairs,
- endpoint_pair_create(initiator, responder, checklist->is_initiator));
+
+ insert_pair_by_priority(checklist->pairs, endpoint_pair_create(
+ initiator, responder, checklist->is_initiator));
}
iterator_r->destroy(iterator_r);
}
iterator_i->destroy(iterator_i);
-
+
print_checklist(checklist);
prune_pairs(checklist->pairs);
@@ -741,22 +763,24 @@ static status_t process_payloads(message_t *message, check_t *check)
if (payload->get_type(payload) != NOTIFY)
{
DBG1(DBG_IKE, "ignoring payload of type '%N' while processing "
- "connectivity check", payload_type_names, payload->get_type(payload));
+ "connectivity check", payload_type_names,
+ payload->get_type(payload));
continue;
}
-
+
notify_payload_t *notify = (notify_payload_t*)payload;
-
+
switch (notify->get_notify_type(notify))
{
case ME_ENDPOINT:
{
if (check->endpoint)
{
- DBG1(DBG_IKE, "connectivity check contains multiple ME_ENDPOINT notifies");
+ DBG1(DBG_IKE, "connectivity check contains multiple "
+ "ME_ENDPOINT notifies");
break;
}
-
+
endpoint_notify_t *endpoint = endpoint_notify_create_from_payload(notify);
if (!endpoint)
{
@@ -772,7 +796,8 @@ static status_t process_payloads(message_t *message, check_t *check)
{
if (check->connect_id.ptr)
{
- DBG1(DBG_IKE, "connectivity check contains multiple ME_CONNECTID notifies");
+ DBG1(DBG_IKE, "connectivity check contains multiple "
+ "ME_CONNECTID notifies");
break;
}
check->connect_id = chunk_clone(notify->get_notification_data(notify));
@@ -783,7 +808,8 @@ static status_t process_payloads(message_t *message, check_t *check)
{
if (check->auth.ptr)
{
- DBG1(DBG_IKE, "connectivity check contains multiple ME_CONNECTAUTH notifies");
+ DBG1(DBG_IKE, "connectivity check contains multiple "
+ "ME_CONNECTAUTH notifies");
break;
}
check->auth = chunk_clone(notify->get_notification_data(notify));
@@ -795,38 +821,40 @@ static status_t process_payloads(message_t *message, check_t *check)
}
}
enumerator->destroy(enumerator);
-
+
if (!check->connect_id.ptr || !check->endpoint || !check->auth.ptr)
{
- DBG1(DBG_IKE, "at least one payload was missing from the connectivity check");
+ DBG1(DBG_IKE, "at least one required payload was missing from the "
+ "connectivity check");
return FAILED;
}
-
+
return SUCCESS;
}
/**
* Builds the signature for a connectivity check
*/
-static chunk_t build_signature(private_connect_manager_t *this,
+static chunk_t build_signature(private_connect_manager_t *this,
check_list_t *checklist, check_t *check, bool outbound)
{
u_int32_t mid;
chunk_t mid_chunk, key_chunk, sig_chunk;
chunk_t sig_hash;
-
+
mid = htonl(check->mid);
mid_chunk = chunk_from_thing(mid);
-
+
key_chunk = (checklist->is_initiator && outbound) || (!checklist->is_initiator && !outbound)
? checklist->initiator.key : checklist->responder.key;
-
+
/* signature = SHA1( MID | ME_CONNECTID | ME_ENDPOINT | ME_CONNECTKEY ) */
- sig_chunk = chunk_cat("cccc", mid_chunk, check->connect_id, check->endpoint_raw, key_chunk);
+ sig_chunk = chunk_cat("cccc", mid_chunk, check->connect_id,
+ check->endpoint_raw, key_chunk);
this->hasher->allocate_hash(this->hasher, sig_chunk, &sig_hash);
DBG3(DBG_IKE, "sig_chunk %#B", &sig_chunk);
DBG3(DBG_IKE, "sig_hash %#B", &sig_hash);
-
+
chunk_free(&sig_chunk);
return sig_hash;
}
@@ -837,7 +865,7 @@ static void finish_checks(private_connect_manager_t *this, check_list_t *checkli
/**
* After one of the initiator's pairs has succeeded we finish the checks without
- * waiting for all the timeouts
+ * waiting for all the timeouts
*/
static job_requeue_t initiator_finish(callback_data_t *data)
{
@@ -848,23 +876,24 @@ static job_requeue_t initiator_finish(callback_data_t *data)
check_list_t *checklist;
if (get_checklist_by_id(this, data->connect_id, &checklist) != SUCCESS)
{
- DBG1(DBG_IKE, "checklist with id '%#B' not found, can't finish connectivity checks",
- &data->connect_id);
+ DBG1(DBG_IKE, "checklist with id '%#B' not found, can't finish "
+ "connectivity checks", &data->connect_id);
this->mutex->unlock(this->mutex);
return JOB_REQUEUE_NONE;
}
-
+
finish_checks(this, checklist);
-
+
this->mutex->unlock(this->mutex);
-
+
return JOB_REQUEUE_NONE;
}
/**
* Updates the state of the whole checklist
*/
-static void update_checklist_state(private_connect_manager_t *this, check_list_t *checklist)
+static void update_checklist_state(private_connect_manager_t *this,
+ check_list_t *checklist)
{
iterator_t *iterator;
endpoint_pair_t *current;
@@ -891,21 +920,22 @@ static void update_checklist_state(private_connect_manager_t *this, check_list_t
}
}
iterator->destroy(iterator);
-
+
if (checklist->is_initiator && succeeded && !checklist->is_finishing)
{
/* instead of waiting until all checks have finished (i.e. all
* retransmissions have failed) the initiator finishes the checks
* right after the first check has succeeded. to allow a probably
* better pair to succeed, we still wait a certain time */
- DBG2(DBG_IKE, "fast finishing checks for checklist '%#B'", &checklist->connect_id);
-
+ DBG2(DBG_IKE, "fast finishing checks for checklist '%#B'",
+ &checklist->connect_id);
+
callback_data_t *data = callback_data_create(this, checklist->connect_id);
job_t *job = (job_t*)callback_job_create((callback_job_cb_t)initiator_finish, data, (callback_job_cleanup_t)callback_data_destroy, NULL);
charon->scheduler->schedule_job_ms(charon->scheduler, job, ME_WAIT_TO_FINISH);
checklist->is_finishing = TRUE;
}
-
+
if (in_progress)
{
checklist->state = CHECK_IN_PROGRESS;
@@ -926,48 +956,48 @@ static void update_checklist_state(private_connect_manager_t *this, check_list_t
static job_requeue_t retransmit(callback_data_t *data)
{
private_connect_manager_t *this = data->connect_manager;
-
+
this->mutex->lock(this->mutex);
check_list_t *checklist;
if (get_checklist_by_id(this, data->connect_id, &checklist) != SUCCESS)
{
- DBG1(DBG_IKE, "checklist with id '%#B' not found, can't retransmit connectivity check",
- &data->connect_id);
+ DBG1(DBG_IKE, "checklist with id '%#B' not found, can't retransmit "
+ "connectivity check", &data->connect_id);
this->mutex->unlock(this->mutex);
return JOB_REQUEUE_NONE;
}
-
+
endpoint_pair_t *pair;
if (get_pair_by_id(checklist, data->mid, &pair) != SUCCESS)
{
- DBG1(DBG_IKE, "pair with id '%d' not found, can't retransmit connectivity check",
- data->mid);
+ DBG1(DBG_IKE, "pair with id '%d' not found, can't retransmit "
+ "connectivity check", data->mid);
goto retransmit_end;
}
-
+
if (pair->state != CHECK_IN_PROGRESS)
{
- DBG2(DBG_IKE, "pair with id '%d' is in wrong state [%d], don't retransmit the connectivity check",
- data->mid, pair->state);
+ DBG2(DBG_IKE, "pair with id '%d' is in wrong state [%d], don't "
+ "retransmit the connectivity check", data->mid, pair->state);
goto retransmit_end;
}
-
+
if (++pair->retransmitted > ME_MAX_RETRANS)
{
DBG2(DBG_IKE, "pair with id '%d' failed after %d retransmissions",
- data->mid, ME_MAX_RETRANS);
+ data->mid, ME_MAX_RETRANS);
pair->state = CHECK_FAILED;
goto retransmit_end;
}
-
+
charon->sender->send(charon->sender, pair->packet->clone(pair->packet));
-
+
queue_retransmission(this, checklist, pair);
retransmit_end:
update_checklist_state(this, checklist);
-
+
switch(checklist->state)
{
case CHECK_SUCCEEDED:
@@ -977,9 +1007,9 @@ retransmit_end:
default:
break;
}
-
+
this->mutex->unlock(this->mutex);
-
+
/* we reschedule it manually */
return JOB_REQUEUE_NONE;
}
@@ -991,15 +1021,16 @@ static void queue_retransmission(private_connect_manager_t *this, check_list_t *
{
callback_data_t *data = retransmit_data_create(this, checklist->connect_id, pair->id);
job_t *job = (job_t*)callback_job_create((callback_job_cb_t)retransmit, data, (callback_job_cleanup_t)callback_data_destroy, NULL);
-
+
u_int32_t retransmission = pair->retransmitted + 1;
u_int32_t rto = ME_INTERVAL;
if (retransmission > ME_BOOST)
{
rto = (u_int32_t)(ME_INTERVAL * pow(ME_RETRANS_BASE, retransmission - ME_BOOST));
}
- DBG2(DBG_IKE, "scheduling retransmission %d of pair '%d' in %dms", retransmission, pair->id, rto);
-
+ DBG2(DBG_IKE, "scheduling retransmission %d of pair '%d' in %dms",
+ retransmission, pair->id, rto);
+
charon->scheduler->schedule_job_ms(charon->scheduler, (job_t*)job, rto);
}
@@ -1015,28 +1046,28 @@ static void send_check(private_connect_manager_t *this, check_list_t *checklist,
message->set_request(message, request);
message->set_destination(message, check->dst->clone(check->dst));
message->set_source(message, check->src->clone(check->src));
-
+
ike_sa_id_t *ike_sa_id = ike_sa_id_create(0, 0, request);
message->set_ike_sa_id(message, ike_sa_id);
ike_sa_id->destroy(ike_sa_id);
message->add_notify(message, FALSE, ME_CONNECTID, check->connect_id);
DBG2(DBG_IKE, "send ME_CONNECTID %#B", &check->connect_id);
-
+
notify_payload_t *endpoint = check->endpoint->build_notify(check->endpoint);
check->endpoint_raw = chunk_clone(endpoint->get_notification_data(endpoint));
message->add_payload(message, (payload_t*)endpoint);
DBG2(DBG_IKE, "send ME_ENDPOINT notify");
-
+
check->auth = build_signature(this, checklist, check, TRUE);
message->add_notify(message, FALSE, ME_CONNECTAUTH, check->auth);
DBG2(DBG_IKE, "send ME_CONNECTAUTH %#B", &check->auth);
-
+
packet_t *packet;
if (message->generate(message, NULL, NULL, &packet) == SUCCESS)
{
charon->sender->send(charon->sender, packet->clone(packet));
-
+
if (request)
{
DESTROY_IF(pair->packet);
@@ -1055,18 +1086,18 @@ static void send_check(private_connect_manager_t *this, check_list_t *checklist,
/**
* Queues a triggered check
*/
-static void queue_triggered_check(private_connect_manager_t *this,
+static void queue_triggered_check(private_connect_manager_t *this,
check_list_t *checklist, endpoint_pair_t *pair)
{
DBG2(DBG_IKE, "queueing triggered check for pair '%d'", pair->id);
- pair->state = CHECK_WAITING;
- checklist->triggered->insert_last(checklist->triggered, pair);
-
- if (!checklist->sender)
- {
- /* if the sender is not running we restart it */
- schedule_checks(this, checklist, ME_INTERVAL);
- }
+ pair->state = CHECK_WAITING;
+ checklist->triggered->insert_last(checklist->triggered, pair);
+
+ if (!checklist->sender)
+ {
+ /* if the sender is not running we restart it */
+ schedule_checks(this, checklist, ME_INTERVAL);
+ }
}
/**
@@ -1077,26 +1108,27 @@ static job_requeue_t sender(callback_data_t *data)
private_connect_manager_t *this = data->connect_manager;
this->mutex->lock(this->mutex);
-
+
check_list_t *checklist;
if (get_checklist_by_id(this, data->connect_id, &checklist) != SUCCESS)
{
- DBG1(DBG_IKE, "checklist with id '%#B' not found, can't send connectivity check",
- &data->connect_id);
+ DBG1(DBG_IKE, "checklist with id '%#B' not found, can't send "
+ "connectivity check", &data->connect_id);
this->mutex->unlock(this->mutex);
return JOB_REQUEUE_NONE;
}
-
+
/* reset the sender */
checklist->sender = NULL;
-
+
endpoint_pair_t *pair;
if (get_triggered_pair(checklist, &pair) != SUCCESS)
{
DBG1(DBG_IKE, "no triggered check queued, sending an ordinary check");
-
+
if (checklist->pairs->find_first(checklist->pairs,
- (linked_list_match_t)match_waiting_pair, (void**)&pair) != SUCCESS)
+ (linked_list_match_t)match_waiting_pair,
+ (void**)&pair) != SUCCESS)
{
this->mutex->unlock(this->mutex);
DBG1(DBG_IKE, "no pairs in waiting state, aborting");
@@ -1113,19 +1145,20 @@ static job_requeue_t sender(callback_data_t *data)
check->src = pair->local->clone(pair->local);
check->dst = pair->remote->clone(pair->remote);
check->connect_id = chunk_clone(checklist->connect_id);
- check->endpoint = endpoint_notify_create();
-
+ check->endpoint = endpoint_notify_create_from_host(PEER_REFLEXIVE, NULL,
+ NULL);
+
pair->state = CHECK_IN_PROGRESS;
-
+
send_check(this, checklist, check, pair, TRUE);
-
+
check_destroy(check);
-
+
/* schedule this job again */
schedule_checks(this, checklist, ME_INTERVAL);
-
+
this->mutex->unlock(this->mutex);
-
+
/* we reschedule it manually */
return JOB_REQUEUE_NONE;
}
@@ -1147,7 +1180,7 @@ static job_requeue_t initiate_mediated(initiate_data_t *data)
{
check_list_t *checklist = data->checklist;
initiated_t *initiated = data->initiated;
-
+
endpoint_pair_t *pair;
if (get_best_valid_pair(checklist, &pair) == SUCCESS)
{
@@ -1169,7 +1202,7 @@ static job_requeue_t initiate_mediated(initiate_data_t *data)
{
/* this should (can?) not happen */
}
-
+
return JOB_REQUEUE_NONE;
}
@@ -1186,7 +1219,7 @@ static void finish_checks(private_connect_manager_t *this, check_list_t *checkli
{
remove_checklist(this, checklist);
remove_initiated(this, initiated);
-
+
initiate_data_t *data = initiate_data_create(checklist, initiated);
job_t *job = (job_t*)callback_job_create((callback_job_cb_t)initiate_mediated, data, (callback_job_cleanup_t)initiate_data_destroy, NULL);
charon->processor->queue_job(charon->processor, job);
@@ -1194,8 +1227,8 @@ static void finish_checks(private_connect_manager_t *this, check_list_t *checkli
}
else
{
- DBG1(DBG_IKE, "there is no mediated connection waiting between '%Y' "
- "and '%Y'", checklist->initiator.id, checklist->responder.id);
+ DBG1(DBG_IKE, "there is no mediated connection waiting between '%Y'"
+ " and '%Y'", checklist->initiator.id, checklist->responder.id);
}
}
}
@@ -1210,28 +1243,30 @@ static void process_response(private_connect_manager_t *this, check_t *check,
if (get_pair_by_id(checklist, check->mid, &pair) == SUCCESS)
{
if (pair->local->equals(pair->local, check->dst) &&
- pair->remote->equals(pair->remote, check->src))
+ pair->remote->equals(pair->remote, check->src))
{
- DBG1(DBG_IKE, "endpoint pair '%d' is valid: '%#H' - '%#H'", pair->id,
- pair->local, pair->remote);
+ DBG1(DBG_IKE, "endpoint pair '%d' is valid: '%#H' - '%#H'",
+ pair->id, pair->local, pair->remote);
pair->state = CHECK_SUCCEEDED;
}
-
+
linked_list_t *local_endpoints = checklist->is_initiator ?
checklist->initiator.endpoints : checklist->responder.endpoints;
-
+
endpoint_notify_t *local_endpoint;
if (endpoints_contain(local_endpoints,
- check->endpoint->get_host(check->endpoint), &local_endpoint) != SUCCESS)
+ check->endpoint->get_host(check->endpoint),
+ &local_endpoint) != SUCCESS)
{
local_endpoint = endpoint_notify_create_from_host(PEER_REFLEXIVE,
check->endpoint->get_host(check->endpoint), pair->local);
- local_endpoint->set_priority(local_endpoint, check->endpoint->get_priority(check->endpoint));
+ local_endpoint->set_priority(local_endpoint,
+ check->endpoint->get_priority(check->endpoint));
local_endpoints->insert_last(local_endpoints, local_endpoint);
}
-
+
update_checklist_state(this, checklist);
-
+
switch(checklist->state)
{
case CHECK_SUCCEEDED:
@@ -1249,31 +1284,35 @@ static void process_response(private_connect_manager_t *this, check_t *check,
}
static void process_request(private_connect_manager_t *this, check_t *check,
- check_list_t *checklist)
+ check_list_t *checklist)
{
linked_list_t *remote_endpoints = checklist->is_initiator ?
checklist->responder.endpoints : checklist->initiator.endpoints;
-
+
endpoint_notify_t *peer_reflexive, *remote_endpoint;
- peer_reflexive = endpoint_notify_create_from_host(PEER_REFLEXIVE, check->src, NULL);
- peer_reflexive->set_priority(peer_reflexive, check->endpoint->get_priority(check->endpoint));
-
+ peer_reflexive = endpoint_notify_create_from_host(PEER_REFLEXIVE,
+ check->src, NULL);
+ peer_reflexive->set_priority(peer_reflexive,
+ check->endpoint->get_priority(check->endpoint));
+
if (endpoints_contain(remote_endpoints, check->src, &remote_endpoint) != SUCCESS)
{
remote_endpoint = peer_reflexive->clone(peer_reflexive);
remote_endpoints->insert_last(remote_endpoints, remote_endpoint);
}
-
+
endpoint_pair_t *pair;
- if (get_pair_by_hosts(checklist->pairs, check->dst, check->src, &pair) == SUCCESS)
+ if (get_pair_by_hosts(checklist->pairs, check->dst, check->src,
+ &pair) == SUCCESS)
{
switch(pair->state)
{
case CHECK_IN_PROGRESS:
/* prevent retransmissions */
pair->retransmitted = ME_MAX_RETRANS;
- /* FIXME: we should wait to the next rto to send the triggered check
- * fall-through */
+ /* FIXME: we should wait to the next rto to send the triggered
+ * check */
+ /* fall-through */
case CHECK_WAITING:
case CHECK_FAILED:
queue_triggered_check(this, checklist, pair);
@@ -1286,31 +1325,30 @@ static void process_request(private_connect_manager_t *this, check_t *check,
else
{
endpoint_notify_t *local_endpoint = endpoint_notify_create_from_host(HOST, check->dst, NULL);
-
+
endpoint_notify_t *initiator = checklist->is_initiator ? local_endpoint : remote_endpoint;
endpoint_notify_t *responder = checklist->is_initiator ? remote_endpoint : local_endpoint;
-
+
pair = endpoint_pair_create(initiator, responder, checklist->is_initiator);
pair->id = checklist->pairs->get_count(checklist->pairs) + 1;
-
+
insert_pair_by_priority(checklist->pairs, pair);
-
+
queue_triggered_check(this, checklist, pair);
-
+
local_endpoint->destroy(local_endpoint);
}
-
-
+
check_t *response = check_create();
-
+
response->mid = check->mid;
response->src = check->dst->clone(check->dst);
response->dst = check->src->clone(check->src);
response->connect_id = chunk_clone(check->connect_id);
response->endpoint = peer_reflexive;
-
+
send_check(this, checklist, response, pair, FALSE);
-
+
check_destroy(response);
}
@@ -1327,35 +1365,35 @@ static void process_check(private_connect_manager_t *this, message_t *message)
message->get_message_id(message));
return;
}
-
+
check_t *check = check_create();
check->mid = message->get_message_id(message);
check->src = message->get_source(message);
check->src = check->src->clone(check->src);
check->dst = message->get_destination(message);
check->dst = check->dst->clone(check->dst);
-
+
if (process_payloads(message, check) != SUCCESS)
{
DBG1(DBG_IKE, "invalid connectivity check %s received",
- message->get_request(message) ? "request" : "response");
+ message->get_request(message) ? "request" : "response");
check_destroy(check);
return;
}
-
+
this->mutex->lock(this->mutex);
-
+
check_list_t *checklist;
if (get_checklist_by_id(this, check->connect_id, &checklist) != SUCCESS)
{
DBG1(DBG_IKE, "checklist with id '%#B' not found",
- &check->connect_id);
+ &check->connect_id);
check_destroy(check);
this->mutex->unlock(this->mutex);
return;
}
-
- chunk_t sig = build_signature(this, checklist, check, FALSE);
+
+ chunk_t sig = build_signature(this, checklist, check, FALSE);
if (!chunk_equals(sig, check->auth))
{
DBG1(DBG_IKE, "connectivity check verification failed");
@@ -1365,7 +1403,7 @@ static void process_check(private_connect_manager_t *this, message_t *message)
return;
}
chunk_free(&sig);
-
+
if (message->get_request(message))
{
process_request(this, check, checklist);
@@ -1374,9 +1412,9 @@ static void process_check(private_connect_manager_t *this, message_t *message)
{
process_response(this, check, checklist);
}
-
+
this->mutex->unlock(this->mutex);
-
+
check_destroy(check);
}
@@ -1394,16 +1432,19 @@ static bool check_and_register(private_connect_manager_t *this,
if (get_initiated_by_ids(this, id, peer_id, &initiated) != SUCCESS)
{
- DBG2(DBG_IKE, "registered waiting mediated connection with '%Y'", peer_id);
+ DBG2(DBG_IKE, "registered waiting mediated connection with '%Y'",
+ peer_id);
initiated = initiated_create(id, peer_id);
this->initiated->insert_last(this->initiated, initiated);
already_there = FALSE;
}
-
- if (initiated->mediated->find_first(initiated->mediated,
- (linked_list_match_t)mediated_sa->equals, NULL, mediated_sa) != SUCCESS)
+
+ if (initiated->mediated->find_first(initiated->mediated,
+ (linked_list_match_t)mediated_sa->equals,
+ NULL, mediated_sa) != SUCCESS)
{
- initiated->mediated->insert_last(initiated->mediated, mediated_sa->clone(mediated_sa));
+ initiated->mediated->insert_last(initiated->mediated,
+ mediated_sa->clone(mediated_sa));
}
this->mutex->unlock(this->mutex);
@@ -1414,8 +1455,9 @@ static bool check_and_register(private_connect_manager_t *this,
/**
* Implementation of connect_manager_t.check_and_initiate.
*/
-static void check_and_initiate(private_connect_manager_t *this, ike_sa_id_t *mediation_sa,
- identification_t *id, identification_t *peer_id)
+static void check_and_initiate(private_connect_manager_t *this,
+ ike_sa_id_t *mediation_sa, identification_t *id,
+ identification_t *peer_id)
{
initiated_t *initiated;
@@ -1427,12 +1469,14 @@ static void check_and_initiate(private_connect_manager_t *this, ike_sa_id_t *med
this->mutex->unlock(this->mutex);
return;
}
-
+
ike_sa_id_t *waiting_sa;
- iterator_t *iterator = initiated->mediated->create_iterator(initiated->mediated, TRUE);
+ iterator_t *iterator = initiated->mediated->create_iterator(
+ initiated->mediated, TRUE);
while (iterator->iterate(iterator, (void**)&waiting_sa))
{
- job_t *job = (job_t*)reinitiate_mediation_job_create(mediation_sa, waiting_sa);
+ job_t *job = (job_t*)reinitiate_mediation_job_create(mediation_sa,
+ waiting_sa);
charon->processor->queue_job(charon->processor, job);
}
iterator->destroy(iterator);
@@ -1444,26 +1488,29 @@ static void check_and_initiate(private_connect_manager_t *this, ike_sa_id_t *med
* Implementation of connect_manager_t.set_initiator_data.
*/
static status_t set_initiator_data(private_connect_manager_t *this,
- identification_t *initiator, identification_t *responder,
- chunk_t connect_id, chunk_t key, linked_list_t *endpoints, bool is_initiator)
+ identification_t *initiator,
+ identification_t *responder,
+ chunk_t connect_id, chunk_t key,
+ linked_list_t *endpoints, bool is_initiator)
{
check_list_t *checklist;
-
- this->mutex->lock(this->mutex);
-
+
+ this->mutex->lock(this->mutex);
+
if (get_checklist_by_id(this, connect_id, NULL) == SUCCESS)
{
DBG1(DBG_IKE, "checklist with id '%#B' already exists, aborting",
- &connect_id);
+ &connect_id);
this->mutex->unlock(this->mutex);
return FAILED;
}
-
- checklist = check_list_create(initiator, responder, connect_id, key, endpoints, is_initiator);
+
+ checklist = check_list_create(initiator, responder, connect_id, key,
+ endpoints, is_initiator);
this->checklists->insert_last(this->checklists, checklist);
-
+
this->mutex->unlock(this->mutex);
-
+
return SUCCESS;
}
@@ -1471,31 +1518,33 @@ static status_t set_initiator_data(private_connect_manager_t *this,
* Implementation of connect_manager_t.set_responder_data.
*/
static status_t set_responder_data(private_connect_manager_t *this,
- chunk_t connect_id, chunk_t key, linked_list_t *endpoints)
+ chunk_t connect_id, chunk_t key,
+ linked_list_t *endpoints)
{
check_list_t *checklist;
this->mutex->lock(this->mutex);
-
+
if (get_checklist_by_id(this, connect_id, &checklist) != SUCCESS)
{
DBG1(DBG_IKE, "checklist with id '%#B' not found",
- &connect_id);
+ &connect_id);
this->mutex->unlock(this->mutex);
return NOT_FOUND;
}
-
+
checklist->responder.key = chunk_clone(key);
- checklist->responder.endpoints = endpoints->clone_offset(endpoints, offsetof(endpoint_notify_t, clone));
+ checklist->responder.endpoints = endpoints->clone_offset(endpoints,
+ offsetof(endpoint_notify_t, clone));
checklist->state = CHECK_WAITING;
-
+
build_pairs(checklist);
-
+
/* send the first check immediately */
schedule_checks(this, checklist, 0);
-
+
this->mutex->unlock(this->mutex);
-
+
return SUCCESS;
}
@@ -1507,22 +1556,22 @@ static status_t stop_checks(private_connect_manager_t *this, chunk_t connect_id)
check_list_t *checklist;
this->mutex->lock(this->mutex);
-
+
if (get_checklist_by_id(this, connect_id, &checklist) != SUCCESS)
{
DBG1(DBG_IKE, "checklist with id '%#B' not found",
- &connect_id);
+ &connect_id);
this->mutex->unlock(this->mutex);
return NOT_FOUND;
}
-
+
DBG1(DBG_IKE, "removing checklist with id '%#B'", &connect_id);
-
+
remove_checklist(this, checklist);
check_list_destroy(checklist);
-
+
this->mutex->unlock(this->mutex);
-
+
return SUCCESS;
}
@@ -1532,12 +1581,12 @@ static status_t stop_checks(private_connect_manager_t *this, chunk_t connect_id)
static void destroy(private_connect_manager_t *this)
{
this->mutex->lock(this->mutex);
-
+
this->hasher->destroy(this->hasher);
this->checklists->destroy_function(this->checklists, (void*)check_list_destroy);
this->initiated->destroy_function(this->initiated, (void*)initiated_destroy);
-
- this->mutex->unlock(this->mutex);
+
+ this->mutex->unlock(this->mutex);
this->mutex->destroy(this->mutex);
free(this);
}
@@ -1556,7 +1605,7 @@ connect_manager_t *connect_manager_create()
this->public.set_responder_data = (status_t(*)(connect_manager_t*,chunk_t,chunk_t,linked_list_t*))set_responder_data;
this->public.process_check = (void(*)(connect_manager_t*,message_t*))process_check;
this->public.stop_checks = (status_t(*)(connect_manager_t*,chunk_t))stop_checks;
-
+
this->hasher = lib->crypto->create_hasher(lib->crypto, HASH_SHA1);
if (this->hasher == NULL)
{
@@ -1564,11 +1613,11 @@ connect_manager_t *connect_manager_create()
free(this);
return NULL;
}
-
+
this->checklists = linked_list_create();
this->initiated = linked_list_create();
-
+
this->mutex = mutex_create(MUTEX_TYPE_DEFAULT);
-
+
return (connect_manager_t*)this;
}
diff --git a/src/charon/sa/connect_manager.h b/src/charon/sa/connect_manager.h
index b5abc853c..8fa8ff697 100644
--- a/src/charon/sa/connect_manager.h
+++ b/src/charon/sa/connect_manager.h
@@ -32,79 +32,84 @@ typedef struct connect_manager_t connect_manager_t;
* connection with another peer.
*/
struct connect_manager_t {
-
+
/**
* Checks if a there is already a mediated connection registered
* between two peers.
- *
- * @param id my id
- * @param peer_id the other peer's id
- * @param mediated_sa the IKE_SA ID of the mediated connection
- * @returns
- * - TRUE, if there was already a mediated connection registered
- * - FALSE, otherwise
+ *
+ * @param id my id
+ * @param peer_id the other peer's id
+ * @param mediated_sa the IKE_SA ID of the mediated connection
+ * @returns
+ * - TRUE, if a mediated connection is registered
+ * - FALSE, otherwise
*/
- bool (*check_and_register) (connect_manager_t *this,
- identification_t *id, identification_t *peer_id, ike_sa_id_t *mediated_sa);
-
+ bool (*check_and_register) (connect_manager_t *this, identification_t *id,
+ identification_t *peer_id,
+ ike_sa_id_t *mediated_sa);
+
/**
* Checks if there are waiting connections with a specific peer.
* If so, reinitiate them.
- *
- * @param id my id
- * @param peer_id the other peer's id
+ *
+ * @param id my id
+ * @param peer_id the other peer's id
*/
- void (*check_and_initiate) (connect_manager_t *this, ike_sa_id_t *mediation_sa,
- identification_t *id, identification_t *peer_id);
-
+ void (*check_and_initiate) (connect_manager_t *this,
+ ike_sa_id_t *mediation_sa, identification_t *id,
+ identification_t *peer_id);
+
/**
* Creates a checklist and sets the initiator's data.
- *
- * @param initiator ID of the initiator
- * @param responder ID of the responder
- * @param connect_id the connect ID provided by the initiator
- * @param key the initiator's key
- * @param endpoints the initiator's endpoints
- * @param is_initiator TRUE, if the caller of this method is the initiator
- * FALSE, otherwise
- * @returns SUCCESS
+ *
+ * @param initiator ID of the initiator
+ * @param responder ID of the responder
+ * @param connect_id the connect ID provided by the initiator
+ * @param key the initiator's key
+ * @param endpoints the initiator's endpoints
+ * @param is_initiator TRUE, if the caller of this method is the initiator
+ * @returns SUCCESS
*/
status_t (*set_initiator_data) (connect_manager_t *this,
- identification_t *initiator, identification_t *responder,
- chunk_t connect_id, chunk_t key, linked_list_t *endpoints, bool is_initiator);
-
+ identification_t *initiator,
+ identification_t *responder,
+ chunk_t connect_id, chunk_t key,
+ linked_list_t *endpoints,
+ bool is_initiator);
+
/**
* Updates a checklist and sets the responder's data. The checklist's
* state is advanced to WAITING which means that checks will be sent.
- *
- * @param connect_id the connect ID
- * @param chunk_t the responder's key
- * @param endpoints the responder's endpoints
- * @returns
- * - NOT_FOUND, if the checklist has not been found
- * - SUCCESS, otherwise
+ *
+ * @param connect_id the connect ID
+ * @param chunk_t the responder's key
+ * @param endpoints the responder's endpoints
+ * @returns
+ * - NOT_FOUND, if the checklist has not been found
+ * - SUCCESS, otherwise
*/
status_t (*set_responder_data) (connect_manager_t *this,
- chunk_t connect_id, chunk_t key, linked_list_t *endpoints);
-
+ chunk_t connect_id, chunk_t key,
+ linked_list_t *endpoints);
+
/**
- * Stops checks for a checklist. Used after the responder received an IKE_SA_INIT
- * request which contains a ME_CONNECTID payload.
- *
- * @param connect_id the connect ID
+ * Stops checks for a checklist. Called after the responder received an
+ * IKE_SA_INIT request which contains a ME_CONNECTID payload.
+ *
+ * @param connect_id the connect ID
* @returns
- * - NOT_FOUND, if the checklist has not been found
- * - SUCCESS, otherwise
+ * - NOT_FOUND, if the checklist has not been found
+ * - SUCCESS, otherwise
*/
status_t (*stop_checks) (connect_manager_t *this, chunk_t connect_id);
-
+
/**
* Processes a connectivity check
- *
- * @param message the received message
+ *
+ * @param message the received message
*/
void (*process_check) (connect_manager_t *this, message_t *message);
-
+
/**
* Destroys the manager with all data.
*/
@@ -113,8 +118,8 @@ struct connect_manager_t {
/**
* Create a manager.
- *
- * @returns connect_manager_t object
+ *
+ * @returns connect_manager_t object
*/
connect_manager_t *connect_manager_create(void);
diff --git a/src/charon/sa/ike_sa.c b/src/charon/sa/ike_sa.c
index be973a2ce..975a0904a 100644
--- a/src/charon/sa/ike_sa.c
+++ b/src/charon/sa/ike_sa.c
@@ -16,7 +16,6 @@
* for more details.
*/
-#include <sys/time.h>
#include <string.h>
#include <sys/stat.h>
#include <errno.h>
@@ -41,6 +40,7 @@
#include <sa/tasks/ike_reauth.h>
#include <sa/tasks/ike_delete.h>
#include <sa/tasks/ike_dpd.h>
+#include <sa/tasks/ike_vendor.h>
#include <sa/tasks/child_create.h>
#include <sa/tasks/child_delete.h>
#include <sa/tasks/child_rekey.h>
@@ -72,169 +72,174 @@ typedef struct attribute_entry_t attribute_entry_t;
* Private data of an ike_sa_t object.
*/
struct private_ike_sa_t {
-
+
/**
* Public members
*/
ike_sa_t public;
-
+
/**
* Identifier for the current IKE_SA.
*/
ike_sa_id_t *ike_sa_id;
-
+
/**
* unique numerical ID for this IKE_SA.
*/
u_int32_t unique_id;
-
+
/**
* Current state of the IKE_SA
*/
ike_sa_state_t state;
-
+
/**
* IKE configuration used to set up this IKE_SA
*/
ike_cfg_t *ike_cfg;
-
+
/**
* Peer and authentication information to establish IKE_SA.
*/
peer_cfg_t *peer_cfg;
-
+
/**
* currently used authentication ruleset, local (as auth_cfg_t)
*/
auth_cfg_t *my_auth;
-
+
+ /**
+ * list of completed local authentication rounds
+ */
+ linked_list_t *my_auths;
+
+ /**
+ * list of completed remote authentication rounds
+ */
+ linked_list_t *other_auths;
+
/**
* currently used authentication constraints, remote (as auth_cfg_t)
*/
auth_cfg_t *other_auth;
-
+
/**
* Selected IKE proposal
*/
proposal_t *proposal;
-
+
/**
* Juggles tasks to process messages
*/
task_manager_t *task_manager;
-
+
/**
* Address of local host
*/
host_t *my_host;
-
+
/**
* Address of remote host
*/
host_t *other_host;
-
+
#ifdef ME
/**
* Are we mediation server
*/
bool is_mediation_server;
-
+
/**
* Server reflexive host
*/
host_t *server_reflexive_host;
-
+
/**
* Connect ID
*/
chunk_t connect_id;
#endif /* ME */
-
+
/**
* Identification used for us
*/
identification_t *my_id;
-
+
/**
* Identification used for other
*/
identification_t *other_id;
-
- /**
- * EAP Identity exchange in EAP-Identity method
- */
- identification_t *eap_identity;;
-
+
/**
* set of extensions the peer supports
*/
ike_extension_t extensions;
-
+
/**
* set of condition flags currently enabled for this IKE_SA
*/
ike_condition_t conditions;
-
+
/**
* Linked List containing the child sa's of the current IKE_SA.
*/
linked_list_t *child_sas;
-
+
/**
* keymat of this IKE_SA
*/
keymat_t *keymat;
-
+
/**
* Virtual IP on local host, if any
*/
host_t *my_virtual_ip;
-
+
/**
* Virtual IP on remote host, if any
*/
host_t *other_virtual_ip;
-
+
/**
* List of configuration attributes (attribute_entry_t)
*/
linked_list_t *attributes;
-
+
/**
* list of peers additional addresses, transmitted via MOBIKE
*/
linked_list_t *additional_addresses;
-
+
/**
* previously value of received DESTINATION_IP hash
*/
chunk_t nat_detection_dest;
-
+
/**
* number pending UPDATE_SA_ADDRESS (MOBIKE)
*/
u_int32_t pending_updates;
-
+
/**
* NAT keep alive interval
*/
u_int32_t keepalive_interval;
-
+
/**
* Timestamps for this IKE_SA
*/
u_int32_t stats[STAT_MAX];
-
+
/**
* how many times we have retried so far (keyingtries)
*/
u_int32_t keyingtry;
-
+
/**
* local host address to be used for IKE, set via MIGRATE kernel message
*/
host_t *local_host;
-
+
/**
* remote host address to be used for IKE, set via MIGRATE kernel message
*/
@@ -261,7 +266,7 @@ static time_t get_use_time(private_ike_sa_t* this, bool inbound)
enumerator_t *enumerator;
child_sa_t *child_sa;
time_t use_time, current;
-
+
if (inbound)
{
use_time = this->stats[STAT_INBOUND];
@@ -277,7 +282,7 @@ static time_t get_use_time(private_ike_sa_t* this, bool inbound)
use_time = max(use_time, current);
}
enumerator->destroy(enumerator);
-
+
return use_time;
}
@@ -363,7 +368,7 @@ static void set_peer_cfg(private_ike_sa_t *this, peer_cfg_t *peer_cfg)
DESTROY_IF(this->peer_cfg);
peer_cfg->get_ref(peer_cfg);
this->peer_cfg = peer_cfg;
-
+
if (this->ike_cfg == NULL)
{
this->ike_cfg = peer_cfg->get_ike_cfg(peer_cfg);
@@ -384,6 +389,56 @@ static auth_cfg_t* get_auth_cfg(private_ike_sa_t *this, bool local)
}
/**
+ * Implementation of ike_sa_t.add_auth_cfg
+ */
+static void add_auth_cfg(private_ike_sa_t *this, bool local, auth_cfg_t *cfg)
+{
+ if (local)
+ {
+ this->my_auths->insert_last(this->my_auths, cfg);
+ }
+ else
+ {
+ this->other_auths->insert_last(this->other_auths, cfg);
+ }
+}
+
+/**
+ * Implementation of ike_sa_t.create_auth_cfg_enumerator
+ */
+static enumerator_t* create_auth_cfg_enumerator(private_ike_sa_t *this,
+ bool local)
+{
+ if (local)
+ {
+ return this->my_auths->create_enumerator(this->my_auths);
+ }
+ return this->other_auths->create_enumerator(this->other_auths);
+}
+
+/**
+ * Flush the stored authentication round information
+ */
+static void flush_auth_cfgs(private_ike_sa_t *this)
+{
+ auth_cfg_t *cfg;
+
+ if (lib->settings->get_bool(lib->settings, "charon.flush_auth_cfg", TRUE))
+ {
+ while (this->my_auths->remove_last(this->my_auths,
+ (void**)&cfg) == SUCCESS)
+ {
+ cfg->destroy(cfg);
+ }
+ while (this->other_auths->remove_last(this->other_auths,
+ (void**)&cfg) == SUCCESS)
+ {
+ cfg->destroy(cfg);
+ }
+ }
+}
+
+/**
* Implementation of ike_sa_t.get_proposal
*/
static proposal_t* get_proposal(private_ike_sa_t *this)
@@ -422,22 +477,22 @@ static void send_keepalive(private_ike_sa_t *this)
{
send_keepalive_job_t *job;
time_t last_out, now, diff;
-
+
if (!(this->conditions & COND_NAT_HERE) || this->keepalive_interval == 0)
{ /* disable keep alives if we are not NATed anymore */
return;
}
-
+
last_out = get_use_time(this, FALSE);
- now = time(NULL);
-
+ now = time_monotonic(NULL);
+
diff = now - last_out;
-
+
if (diff >= this->keepalive_interval)
{
packet_t *packet;
chunk_t data;
-
+
packet = packet_create();
packet->set_source(packet, this->my_host->clone(this->my_host));
packet->set_destination(packet, this->other_host->clone(this->other_host));
@@ -552,15 +607,15 @@ static status_t send_dpd(private_ike_sa_t *this)
{
job_t *job;
time_t diff, delay;
-
+
delay = this->peer_cfg->get_dpd(this->peer_cfg);
-
+
if (delay == 0)
{
/* DPD disabled */
return SUCCESS;
}
-
+
if (this->task_manager->busy(this->task_manager))
{
/* an exchange is in the air, no need to start a DPD check */
@@ -571,14 +626,14 @@ static status_t send_dpd(private_ike_sa_t *this)
/* check if there was any inbound traffic */
time_t last_in, now;
last_in = get_use_time(this, TRUE);
- now = time(NULL);
+ now = time_monotonic(NULL);
diff = now - last_in;
if (diff >= delay)
{
/* to long ago, initiate dead peer detection */
task_t *task;
ike_mobike_t *mobike;
-
+
if (supports_extension(this, EXT_MOBIKE) &&
has_condition(this, COND_NAT_HERE))
{
@@ -593,7 +648,7 @@ static status_t send_dpd(private_ike_sa_t *this)
}
diff = 0;
DBG1(DBG_IKE, "sending DPD request");
-
+
this->task_manager->queue_task(this->task_manager, task);
this->task_manager->initiate(this->task_manager);
}
@@ -621,7 +676,7 @@ static void set_state(private_ike_sa_t *this, ike_sa_state_t state)
get_name(this), this->unique_id,
ike_sa_state_names, this->state,
ike_sa_state_names, state);
-
+
switch (state)
{
case IKE_ESTABLISHED:
@@ -631,14 +686,14 @@ static void set_state(private_ike_sa_t *this, ike_sa_state_t state)
{
job_t *job;
u_int32_t t;
-
+
/* calculate rekey, reauth and lifetime */
- this->stats[STAT_ESTABLISHED] = time(NULL);
-
+ this->stats[STAT_ESTABLISHED] = time_monotonic(NULL);
+
/* schedule rekeying if we have a time which is smaller than
* an already scheduled rekeying */
t = this->peer_cfg->get_rekey_time(this->peer_cfg);
- if (t && (this->stats[STAT_REKEY] == 0 ||
+ if (t && (this->stats[STAT_REKEY] == 0 ||
(this->stats[STAT_REKEY] > t + this->stats[STAT_ESTABLISHED])))
{
this->stats[STAT_REKEY] = t + this->stats[STAT_ESTABLISHED];
@@ -647,7 +702,7 @@ static void set_state(private_ike_sa_t *this, ike_sa_state_t state)
DBG1(DBG_IKE, "scheduling rekeying in %ds", t);
}
t = this->peer_cfg->get_reauth_time(this->peer_cfg);
- if (t && (this->stats[STAT_REAUTH] == 0 ||
+ if (t && (this->stats[STAT_REAUTH] == 0 ||
(this->stats[STAT_REAUTH] > t + this->stats[STAT_ESTABLISHED])))
{
this->stats[STAT_REAUTH] = t + this->stats[STAT_ESTABLISHED];
@@ -677,7 +732,7 @@ static void set_state(private_ike_sa_t *this, ike_sa_state_t state)
charon->scheduler->schedule_job(charon->scheduler, job, t);
DBG1(DBG_IKE, "maximum IKE_SA lifetime %ds", t);
}
-
+
/* start DPD checks */
send_dpd(this);
}
@@ -687,7 +742,7 @@ static void set_state(private_ike_sa_t *this, ike_sa_state_t state)
{
/* delete may fail if a packet gets lost, so set a timeout */
job_t *job = (job_t*)delete_ike_sa_job_create(this->ike_sa_id, TRUE);
- charon->scheduler->schedule_job(charon->scheduler, job,
+ charon->scheduler->schedule_job(charon->scheduler, job,
HALF_OPEN_IKE_SA_TIMEOUT);
break;
}
@@ -708,9 +763,9 @@ static void reset(private_ike_sa_t *this)
{
this->ike_sa_id->set_responder_spi(this->ike_sa_id, 0);
}
-
+
set_state(this, IKE_CREATED);
-
+
this->task_manager->reset(this->task_manager, 0, 0);
}
@@ -777,7 +832,7 @@ static void add_additional_address(private_ike_sa_t *this, host_t *host)
{
this->additional_addresses->insert_last(this->additional_addresses, host);
}
-
+
/**
* Implementation of ike_sa_t.create_additional_address_iterator.
*/
@@ -828,7 +883,7 @@ static u_int32_t get_pending_updates(private_ike_sa_t *this)
static void update_hosts(private_ike_sa_t *this, host_t *me, host_t *other)
{
bool update = FALSE;
-
+
if (me == NULL)
{
me = this->my_host;
@@ -837,7 +892,7 @@ static void update_hosts(private_ike_sa_t *this, host_t *me, host_t *other)
{
other = this->other_host;
}
-
+
/* apply hosts on first received message */
if (this->my_host->is_anyaddr(this->my_host) ||
this->other_host->is_anyaddr(this->other_host))
@@ -854,7 +909,7 @@ static void update_hosts(private_ike_sa_t *this, host_t *me, host_t *other)
set_my_host(this, me->clone(me));
update = TRUE;
}
-
+
if (!other->equals(other, this->other_host))
{
/* update others adress if we are NOT NATed,
@@ -867,13 +922,13 @@ static void update_hosts(private_ike_sa_t *this, host_t *me, host_t *other)
}
}
}
-
+
/* update all associated CHILD_SAs, if required */
if (update)
{
iterator_t *iterator;
child_sa_t *child_sa;
-
+
iterator = this->child_sas->create_iterator(this->child_sas, TRUE);
while (iterator->iterate(iterator, (void**)&child_sa))
{
@@ -896,7 +951,7 @@ static void update_hosts(private_ike_sa_t *this, host_t *me, host_t *other)
static status_t generate_message(private_ike_sa_t *this, message_t *message,
packet_t **packet)
{
- this->stats[STAT_OUTBOUND] = time(NULL);
+ this->stats[STAT_OUTBOUND] = time_monotonic(NULL);
message->set_ike_sa_id(message, this->ike_sa_id);
return message->generate(message,
this->keymat->get_crypter(this->keymat, FALSE),
@@ -911,7 +966,7 @@ static void send_notify_response(private_ike_sa_t *this, message_t *request,
{
message_t *response;
packet_t *packet;
-
+
response = message_create();
response->set_exchange_type(response, request->get_exchange_type(request));
response->set_request(response, FALSE);
@@ -989,7 +1044,7 @@ static chunk_t get_connect_id(private_ike_sa_t *this)
* Implementation of ike_sa_t.respond
*/
static status_t respond(private_ike_sa_t *this, identification_t *peer_id,
- chunk_t connect_id)
+ chunk_t connect_id)
{
ike_me_t *task = ike_me_create(&this->public, TRUE);
task->respond(task, peer_id, connect_id);
@@ -1012,7 +1067,8 @@ static status_t callback(private_ike_sa_t *this, identification_t *peer_id)
* Implementation of ike_sa_t.relay
*/
static status_t relay(private_ike_sa_t *this, identification_t *requester,
- chunk_t connect_id, chunk_t connect_key, linked_list_t *endpoints, bool response)
+ chunk_t connect_id, chunk_t connect_key,
+ linked_list_t *endpoints, bool response)
{
ike_me_t *task = ike_me_create(&this->public, TRUE);
task->relay(task, requester, connect_id, connect_key, endpoints, response);
@@ -1023,7 +1079,8 @@ static status_t relay(private_ike_sa_t *this, identification_t *requester,
/**
* Implementation of ike_sa_t.initiate_mediation
*/
-static status_t initiate_mediation(private_ike_sa_t *this, peer_cfg_t *mediated_cfg)
+static status_t initiate_mediation(private_ike_sa_t *this,
+ peer_cfg_t *mediated_cfg)
{
ike_me_t *task = ike_me_create(&this->public, TRUE);
task->connect(task, mediated_cfg->get_peer_id(mediated_cfg));
@@ -1034,14 +1091,13 @@ static status_t initiate_mediation(private_ike_sa_t *this, peer_cfg_t *mediated_
/**
* Implementation of ike_sa_t.initiate_mediated
*/
-static status_t initiate_mediated(private_ike_sa_t *this, host_t *me, host_t *other,
- chunk_t connect_id)
+static status_t initiate_mediated(private_ike_sa_t *this, host_t *me,
+ host_t *other, chunk_t connect_id)
{
set_my_host(this, me->clone(me));
set_other_host(this, other->clone(other));
chunk_free(&this->connect_id);
this->connect_id = chunk_clone(connect_id);
-
return this->task_manager->initiate(this->task_manager);
}
#endif /* ME */
@@ -1052,7 +1108,7 @@ static status_t initiate_mediated(private_ike_sa_t *this, host_t *me, host_t *ot
static void resolve_hosts(private_ike_sa_t *this)
{
host_t *host;
-
+
if (this->remote_host)
{
host = this->remote_host->clone(this->remote_host);
@@ -1067,7 +1123,7 @@ static void resolve_hosts(private_ike_sa_t *this)
{
set_other_host(this, host);
}
-
+
if (this->local_host)
{
host = this->local_host->clone(this->local_host);
@@ -1075,10 +1131,16 @@ static void resolve_hosts(private_ike_sa_t *this)
}
else
{
+ int family = 0;
+
+ /* use same address family as for other */
+ if (!this->other_host->is_anyaddr(this->other_host))
+ {
+ family = this->other_host->get_family(this->other_host);
+ }
host = host_create_from_dns(this->ike_cfg->get_my_addr(this->ike_cfg),
- this->my_host->get_family(this->my_host),
- IKEV2_UDP_PORT);
-
+ family, IKEV2_UDP_PORT);
+
if (host && host->is_anyaddr(host) &&
!this->other_host->is_anyaddr(this->other_host))
{
@@ -1111,11 +1173,11 @@ static status_t initiate(private_ike_sa_t *this,
traffic_selector_t *tsi, traffic_selector_t *tsr)
{
task_t *task;
-
+
if (this->state == IKE_CREATED)
{
resolve_hosts(this);
-
+
if (this->other_host->is_anyaddr(this->other_host)
#ifdef ME
&& !this->peer_cfg->get_mediated_by(this->peer_cfg)
@@ -1126,11 +1188,13 @@ static status_t initiate(private_ike_sa_t *this,
DBG1(DBG_IKE, "unable to initiate to %%any");
return DESTROY_ME;
}
-
+
set_condition(this, COND_ORIGINAL_INITIATOR, TRUE);
-
+
task = (task_t*)ike_init_create(&this->public, TRUE, NULL);
this->task_manager->queue_task(this->task_manager, task);
+ task = (task_t*)ike_vendor_create(&this->public, TRUE);
+ this->task_manager->queue_task(this->task_manager, task);
task = (task_t*)ike_natd_create(&this->public, TRUE);
this->task_manager->queue_task(this->task_manager, task);
task = (task_t*)ike_cert_pre_create(&this->public, TRUE);
@@ -1159,8 +1223,8 @@ static status_t initiate(private_ike_sa_t *this,
{
if (this->state == IKE_ESTABLISHED)
{
- /* mediation connection is already established, retrigger state change
- * to notify bus listeners */
+ /* mediation connection is already established, retrigger state
+ * change to notify bus listeners */
DBG1(DBG_IKE, "mediation connection is already up");
set_state(this, IKE_ESTABLISHED);
}
@@ -1190,7 +1254,7 @@ static status_t initiate(private_ike_sa_t *this,
}
#endif /* ME */
}
-
+
return this->task_manager->initiate(this->task_manager);
}
@@ -1201,20 +1265,20 @@ static status_t process_message(private_ike_sa_t *this, message_t *message)
{
status_t status;
bool is_request;
-
+
if (this->state == IKE_PASSIVE)
{ /* do not handle messages in passive state */
return FAILED;
}
-
+
is_request = message->get_request(message);
-
+
status = message->parse_body(message,
this->keymat->get_crypter(this->keymat, TRUE),
this->keymat->get_signer(this->keymat, TRUE));
if (status != SUCCESS)
{
-
+
if (is_request)
{
switch (status)
@@ -1258,20 +1322,19 @@ static status_t process_message(private_ike_sa_t *this, message_t *message)
exchange_type_names, message->get_exchange_type(message),
message->get_request(message) ? "request" : "response",
message->get_message_id(message));
-
+
if (this->state == IKE_CREATED)
{ /* invalid initiation attempt, close SA */
return DESTROY_ME;
}
- return status;
}
else
{
host_t *me, *other;
-
+
me = message->get_destination(message);
other = message->get_source(message);
-
+
/* if this IKE_SA is virgin, we check for a config */
if (this->ike_cfg == NULL)
{
@@ -1291,7 +1354,7 @@ static status_t process_message(private_ike_sa_t *this, message_t *message)
charon->scheduler->schedule_job(charon->scheduler, job,
HALF_OPEN_IKE_SA_TIMEOUT);
}
- this->stats[STAT_INBOUND] = time(NULL);
+ this->stats[STAT_INBOUND] = time_monotonic(NULL);
/* check if message is trustworthy, and update host information */
if (this->state == IKE_CREATED || this->state == IKE_CONNECTING ||
message->get_exchange_type(message) != IKE_SA_INIT)
@@ -1301,8 +1364,14 @@ static status_t process_message(private_ike_sa_t *this, message_t *message)
update_hosts(this, me, other);
}
}
- return this->task_manager->process_message(this->task_manager, message);
+ status = this->task_manager->process_message(this->task_manager, message);
+ if (message->get_exchange_type(message) == IKE_AUTH &&
+ this->state == IKE_ESTABLISHED)
+ { /* authentication completed */
+ flush_auth_cfgs(this);
+ }
}
+ return status;
}
/**
@@ -1348,23 +1417,6 @@ static void set_other_id(private_ike_sa_t *this, identification_t *other)
}
/**
- * Implementation of ike_sa_t.get_eap_identity.
- */
-static identification_t* get_eap_identity(private_ike_sa_t *this)
-{
- return this->eap_identity;
-}
-
-/**
- * Implementation of ike_sa_t.set_eap_identity.
- */
-static void set_eap_identity(private_ike_sa_t *this, identification_t *id)
-{
- DESTROY_IF(this->eap_identity);
- this->eap_identity = id;
-}
-
-/**
* Implementation of ike_sa_t.add_child_sa.
*/
static void add_child_sa(private_ike_sa_t *this, child_sa_t *child_sa)
@@ -1380,7 +1432,7 @@ static child_sa_t* get_child_sa(private_ike_sa_t *this, protocol_id_t protocol,
{
iterator_t *iterator;
child_sa_t *current, *found = NULL;
-
+
iterator = this->child_sas->create_iterator(this->child_sas, TRUE);
while (iterator->iterate(iterator, (void**)&current))
{
@@ -1409,7 +1461,7 @@ static status_t rekey_child_sa(private_ike_sa_t *this, protocol_id_t protocol,
u_int32_t spi)
{
child_rekey_t *child_rekey;
-
+
child_rekey = child_rekey_create(&this->public, protocol, spi);
this->task_manager->queue_task(this->task_manager, &child_rekey->task);
return this->task_manager->initiate(this->task_manager);
@@ -1422,7 +1474,7 @@ static status_t delete_child_sa(private_ike_sa_t *this, protocol_id_t protocol,
u_int32_t spi)
{
child_delete_t *child_delete;
-
+
child_delete = child_delete_create(&this->public, protocol, spi);
this->task_manager->queue_task(this->task_manager, &child_delete->task);
return this->task_manager->initiate(this->task_manager);
@@ -1437,7 +1489,7 @@ static status_t destroy_child_sa(private_ike_sa_t *this, protocol_id_t protocol,
iterator_t *iterator;
child_sa_t *child_sa;
status_t status = NOT_FOUND;
-
+
iterator = this->child_sas->create_iterator(this->child_sas, TRUE);
while (iterator->iterate(iterator, (void**)&child_sa))
{
@@ -1487,9 +1539,9 @@ static status_t delete_(private_ike_sa_t *this)
static status_t rekey(private_ike_sa_t *this)
{
ike_rekey_t *ike_rekey;
-
+
ike_rekey = ike_rekey_create(&this->public, TRUE);
-
+
this->task_manager->queue_task(this->task_manager, &ike_rekey->task);
return this->task_manager->initiate(this->task_manager);
}
@@ -1510,13 +1562,13 @@ static status_t reauth(private_ike_sa_t *this)
if (this->other_virtual_ip != NULL ||
has_condition(this, COND_EAP_AUTHENTICATED)
#ifdef ME
- /* if we are mediation server we too cannot reauth the IKE_SA */
+ /* as mediation server we too cannot reauth the IKE_SA */
|| this->is_mediation_server
#endif /* ME */
)
{
- time_t now = time(NULL);
-
+ time_t now = time_monotonic(NULL);
+
DBG1(DBG_IKE, "IKE_SA will timeout in %V",
&now, &this->stats[STAT_DELETE]);
return FAILED;
@@ -1543,10 +1595,10 @@ static status_t reestablish(private_ike_sa_t *this)
iterator_t *iterator;
child_sa_t *child_sa;
child_cfg_t *child_cfg;
- bool required = FALSE;
+ bool restart = FALSE;
status_t status = FAILED;
-
- /* check if we have children to keep up at all*/
+
+ /* check if we have children to keep up at all */
iterator = create_child_sa_iterator(this);
while (iterator->iterate(iterator, (void**)&child_sa))
{
@@ -1562,25 +1614,28 @@ static status_t reestablish(private_ike_sa_t *this)
switch (action)
{
case ACTION_RESTART:
+ restart = TRUE;
+ break;
case ACTION_ROUTE:
- required = TRUE;
+ charon->traps->install(charon->traps, this->peer_cfg, child_cfg);
+ break;
default:
break;
}
}
iterator->destroy(iterator);
#ifdef ME
- /* we initiate the new IKE_SA of the mediation connection without CHILD_SA */
+ /* mediation connections have no children, keep them up anyway */
if (this->peer_cfg->is_mediation(this->peer_cfg))
{
- required = TRUE;
+ restart = TRUE;
}
#endif /* ME */
- if (!required)
+ if (!restart)
{
return FAILED;
}
-
+
/* check if we are able to reestablish this IKE_SA */
if (!has_condition(this, COND_ORIGINAL_INITIATOR) &&
(this->other_virtual_ip != NULL ||
@@ -1593,7 +1648,7 @@ static status_t reestablish(private_ike_sa_t *this)
DBG1(DBG_IKE, "unable to reestablish IKE_SA due asymetric setup");
return FAILED;
}
-
+
new = charon->ike_sa_manager->checkout_new(charon->ike_sa_manager, TRUE);
new->set_peer_cfg(new, this->peer_cfg);
host = this->other_host;
@@ -1606,7 +1661,7 @@ static status_t reestablish(private_ike_sa_t *this)
{
new->set_virtual_ip(new, TRUE, host);
}
-
+
#ifdef ME
if (this->peer_cfg->is_mediation(this->peer_cfg))
{
@@ -1635,10 +1690,6 @@ static status_t reestablish(private_ike_sa_t *this)
child_cfg->get_ref(child_cfg);
status = new->initiate(new, child_cfg, 0, NULL, NULL);
break;
- case ACTION_ROUTE:
- charon->traps->install(charon->traps,
- this->peer_cfg, child_cfg);
- break;
default:
continue;
}
@@ -1649,7 +1700,7 @@ static status_t reestablish(private_ike_sa_t *this)
}
iterator->destroy(iterator);
}
-
+
if (status == DESTROY_ME)
{
charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager, new);
@@ -1669,7 +1720,7 @@ static status_t reestablish(private_ike_sa_t *this)
*/
static status_t retransmit(private_ike_sa_t *this, u_int32_t message_id)
{
- this->stats[STAT_OUTBOUND] = time(NULL);
+ this->stats[STAT_OUTBOUND] = time_monotonic(NULL);
if (this->task_manager->retransmit(this->task_manager, message_id) != SUCCESS)
{
/* send a proper signal to brief interested bus listeners */
@@ -1711,17 +1762,17 @@ static status_t retransmit(private_ike_sa_t *this, u_int32_t message_id)
static void set_auth_lifetime(private_ike_sa_t *this, u_int32_t lifetime)
{
u_int32_t reduction = this->peer_cfg->get_over_time(this->peer_cfg);
- u_int32_t reauth_time = time(NULL) + lifetime - reduction;
+ u_int32_t reauth_time = time_monotonic(NULL) + lifetime - reduction;
if (lifetime < reduction)
{
DBG1(DBG_IKE, "received AUTH_LIFETIME of %ds, starting reauthentication",
lifetime);
charon->processor->queue_job(charon->processor,
- (job_t*)rekey_ike_sa_job_create(this->ike_sa_id, TRUE));
+ (job_t*)rekey_ike_sa_job_create(this->ike_sa_id, TRUE));
}
else if (this->stats[STAT_REAUTH] == 0 ||
- this->stats[STAT_REAUTH] > reauth_time)
+ this->stats[STAT_REAUTH] > reauth_time)
{
this->stats[STAT_REAUTH] = reauth_time;
DBG1(DBG_IKE, "received AUTH_LIFETIME of %ds, scheduling reauthentication"
@@ -1732,8 +1783,9 @@ static void set_auth_lifetime(private_ike_sa_t *this, u_int32_t lifetime)
}
else
{
- DBG1(DBG_IKE, "received AUTH_LIFETIME of %ds, reauthentication already "
- "scheduled in %ds", lifetime, this->stats[STAT_REAUTH] - time(NULL));
+ DBG1(DBG_IKE, "received AUTH_LIFETIME of %ds, "
+ "reauthentication already scheduled in %ds", lifetime,
+ this->stats[STAT_REAUTH] - time_monotonic(NULL));
}
}
@@ -1744,7 +1796,7 @@ static status_t roam(private_ike_sa_t *this, bool address)
{
host_t *src;
ike_mobike_t *mobike;
-
+
switch (this->state)
{
case IKE_CREATED:
@@ -1767,7 +1819,7 @@ static status_t roam(private_ike_sa_t *this, bool address)
}
return SUCCESS;
}
-
+
/* keep existing path if possible */
src = charon->kernel_interface->get_source_addr(charon->kernel_interface,
this->other_host, this->my_host);
@@ -1782,14 +1834,14 @@ static status_t roam(private_ike_sa_t *this, bool address)
return SUCCESS;
}
src->destroy(src);
-
+
}
else
{
/* check if we find a route at all */
enumerator_t *enumerator;
host_t *addr;
-
+
src = charon->kernel_interface->get_source_addr(charon->kernel_interface,
this->other_host, NULL);
if (!src)
@@ -1818,7 +1870,7 @@ static status_t roam(private_ike_sa_t *this, bool address)
src->destroy(src);
}
set_condition(this, COND_STALE, FALSE);
-
+
/* update addresses with mobike, if supported ... */
if (supports_extension(this, EXT_MOBIKE))
{
@@ -1837,22 +1889,16 @@ static status_t roam(private_ike_sa_t *this, bool address)
* Implementation of ike_sa_t.add_configuration_attribute
*/
static void add_configuration_attribute(private_ike_sa_t *this,
+ attribute_handler_t *handler,
configuration_attribute_type_t type, chunk_t data)
{
- attribute_entry_t *entry;
- attribute_handler_t *handler;
-
- handler = charon->attributes->handle(charon->attributes,
- &this->public, type, data);
- if (handler)
- {
- entry = malloc_thing(attribute_entry_t);
- entry->handler = handler;
- entry->type = type;
- entry->data = chunk_clone(data);
-
- this->attributes->insert_last(this->attributes, entry);
- }
+ attribute_entry_t *entry = malloc_thing(attribute_entry_t);
+
+ entry->handler = handler;
+ entry->type = type;
+ entry->data = chunk_clone(data);
+
+ this->attributes->insert_last(this->attributes, entry);
}
/**
@@ -1862,7 +1908,7 @@ static status_t inherit(private_ike_sa_t *this, private_ike_sa_t *other)
{
child_sa_t *child_sa;
attribute_entry_t *entry;
-
+
/* apply hosts and ids */
this->my_host->destroy(this->my_host);
this->other_host->destroy(this->other_host);
@@ -1872,7 +1918,7 @@ static status_t inherit(private_ike_sa_t *this, private_ike_sa_t *other)
this->other_host = other->other_host->clone(other->other_host);
this->my_id = other->my_id->clone(other->my_id);
this->other_id = other->other_id->clone(other->other_id);
-
+
/* apply virtual assigned IPs... */
if (other->my_virtual_ip)
{
@@ -1884,9 +1930,9 @@ static status_t inherit(private_ike_sa_t *this, private_ike_sa_t *other)
this->other_virtual_ip = other->other_virtual_ip;
other->other_virtual_ip = NULL;
}
-
+
/* ... and configuration attributes */
- while (other->attributes->remove_last(other->attributes,
+ while (other->attributes->remove_last(other->attributes,
(void**)&entry) == SUCCESS)
{
this->attributes->insert_first(this->attributes, entry);
@@ -1898,7 +1944,7 @@ static status_t inherit(private_ike_sa_t *this, private_ike_sa_t *other)
{
send_keepalive(this);
}
-
+
#ifdef ME
if (other->is_mediation_server)
{
@@ -1913,28 +1959,28 @@ static status_t inherit(private_ike_sa_t *this, private_ike_sa_t *other)
/* adopt all children */
while (other->child_sas->remove_last(other->child_sas,
- (void**)&child_sa) == SUCCESS)
+ (void**)&child_sa) == SUCCESS)
{
this->child_sas->insert_first(this->child_sas, (void*)child_sa);
}
-
+
/* move pending tasks to the new IKE_SA */
this->task_manager->adopt_tasks(this->task_manager, other->task_manager);
-
+
/* reauthentication timeout survives a rekeying */
if (other->stats[STAT_REAUTH])
{
- time_t reauth, delete, now = time(NULL);
-
+ time_t reauth, delete, now = time_monotonic(NULL);
+
this->stats[STAT_REAUTH] = other->stats[STAT_REAUTH];
reauth = this->stats[STAT_REAUTH] - now;
delete = reauth + this->peer_cfg->get_over_time(this->peer_cfg);
this->stats[STAT_DELETE] = this->stats[STAT_REAUTH] + delete;
DBG1(DBG_IKE, "rescheduling reauthentication in %ds after rekeying, "
"lifetime reduced to %ds", reauth, delete);
- charon->scheduler->schedule_job(charon->scheduler,
+ charon->scheduler->schedule_job(charon->scheduler,
(job_t*)rekey_ike_sa_job_create(this->ike_sa_id, TRUE), reauth);
- charon->scheduler->schedule_job(charon->scheduler,
+ charon->scheduler->schedule_job(charon->scheduler,
(job_t*)delete_ike_sa_job_create(this->ike_sa_id, TRUE), delete);
}
/* we have to initate here, there may be new tasks to handle */
@@ -1947,30 +1993,30 @@ static status_t inherit(private_ike_sa_t *this, private_ike_sa_t *other)
static void destroy(private_ike_sa_t *this)
{
attribute_entry_t *entry;
-
+
charon->bus->set_sa(charon->bus, &this->public);
-
+
set_state(this, IKE_DESTROYING);
-
+
/* remove attributes first, as we pass the IKE_SA to the handler */
- while (this->attributes->remove_last(this->attributes,
+ while (this->attributes->remove_last(this->attributes,
(void**)&entry) == SUCCESS)
{
- charon->attributes->release(charon->attributes, entry->handler,
- &this->public, entry->type, entry->data);
+ lib->attributes->release(lib->attributes, entry->handler,
+ this->other_id, entry->type, entry->data);
free(entry->data.ptr);
free(entry);
}
this->attributes->destroy(this->attributes);
-
+
this->child_sas->destroy_offset(this->child_sas, offsetof(child_sa_t, destroy));
-
+
/* unset SA after here to avoid usage by the listeners */
charon->bus->set_sa(charon->bus, NULL);
-
+
this->task_manager->destroy(this->task_manager);
this->keymat->destroy(this->keymat);
-
+
if (this->my_virtual_ip)
{
charon->kernel_interface->del_ip(charon->kernel_interface,
@@ -1981,7 +2027,7 @@ static void destroy(private_ike_sa_t *this)
{
if (this->peer_cfg && this->peer_cfg->get_pool(this->peer_cfg))
{
- charon->attributes->release_address(charon->attributes,
+ lib->attributes->release_address(lib->attributes,
this->peer_cfg->get_pool(this->peer_cfg),
this->other_virtual_ip, this->other_id);
}
@@ -1992,27 +2038,31 @@ static void destroy(private_ike_sa_t *this)
#ifdef ME
if (this->is_mediation_server)
{
- charon->mediation_manager->remove(charon->mediation_manager, this->ike_sa_id);
+ charon->mediation_manager->remove(charon->mediation_manager,
+ this->ike_sa_id);
}
DESTROY_IF(this->server_reflexive_host);
chunk_free(&this->connect_id);
#endif /* ME */
free(this->nat_detection_dest.ptr);
-
+
DESTROY_IF(this->my_host);
DESTROY_IF(this->other_host);
DESTROY_IF(this->my_id);
DESTROY_IF(this->other_id);
DESTROY_IF(this->local_host);
DESTROY_IF(this->remote_host);
- DESTROY_IF(this->eap_identity);
-
+
DESTROY_IF(this->ike_cfg);
DESTROY_IF(this->peer_cfg);
DESTROY_IF(this->proposal);
this->my_auth->destroy(this->my_auth);
this->other_auth->destroy(this->other_auth);
-
+ this->my_auths->destroy_offset(this->my_auths,
+ offsetof(auth_cfg_t, destroy));
+ this->other_auths->destroy_offset(this->other_auths,
+ offsetof(auth_cfg_t, destroy));
+
this->ike_sa_id->destroy(this->ike_sa_id);
free(this);
}
@@ -2024,7 +2074,7 @@ ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id)
{
private_ike_sa_t *this = malloc_thing(private_ike_sa_t);
static u_int32_t unique_id = 0;
-
+
/* Public functions */
this->public.get_state = (ike_sa_state_t (*)(ike_sa_t*)) get_state;
this->public.set_state = (void (*)(ike_sa_t*,ike_sa_state_t)) set_state;
@@ -2037,6 +2087,8 @@ ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id)
this->public.get_peer_cfg = (peer_cfg_t* (*)(ike_sa_t*))get_peer_cfg;
this->public.set_peer_cfg = (void (*)(ike_sa_t*,peer_cfg_t*))set_peer_cfg;
this->public.get_auth_cfg = (auth_cfg_t*(*)(ike_sa_t*, bool local))get_auth_cfg;
+ this->public.create_auth_cfg_enumerator = (enumerator_t*(*)(ike_sa_t*, bool local))create_auth_cfg_enumerator;
+ this->public.add_auth_cfg = (void(*)(ike_sa_t*, bool local, auth_cfg_t *cfg))add_auth_cfg;
this->public.get_proposal = (proposal_t*(*)(ike_sa_t*))get_proposal;
this->public.set_proposal = (void(*)(ike_sa_t*, proposal_t *proposal))set_proposal;
this->public.get_id = (ike_sa_id_t* (*)(ike_sa_t*)) get_id;
@@ -2050,8 +2102,6 @@ ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id)
this->public.set_my_id = (void (*)(ike_sa_t*,identification_t*)) set_my_id;
this->public.get_other_id = (identification_t* (*)(ike_sa_t*)) get_other_id;
this->public.set_other_id = (void (*)(ike_sa_t*,identification_t*)) set_other_id;
- this->public.get_eap_identity = (identification_t* (*)(ike_sa_t*)) get_eap_identity;
- this->public.set_eap_identity = (void (*)(ike_sa_t*,identification_t*)) set_eap_identity;
this->public.enable_extension = (void(*)(ike_sa_t*, ike_extension_t extension))enable_extension;
this->public.supports_extension = (bool(*)(ike_sa_t*, ike_extension_t extension))supports_extension;
this->public.set_condition = (void (*)(ike_sa_t*, ike_condition_t,bool)) set_condition;
@@ -2084,7 +2134,7 @@ ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id)
this->public.get_unique_id = (u_int32_t (*)(ike_sa_t*))get_unique_id;
this->public.set_virtual_ip = (void (*)(ike_sa_t*,bool,host_t*))set_virtual_ip;
this->public.get_virtual_ip = (host_t* (*)(ike_sa_t*,bool))get_virtual_ip;
- this->public.add_configuration_attribute = (void(*)(ike_sa_t*, configuration_attribute_type_t type, chunk_t data))add_configuration_attribute;
+ this->public.add_configuration_attribute = (void(*)(ike_sa_t*, attribute_handler_t *handler,configuration_attribute_type_t type, chunk_t data))add_configuration_attribute;
this->public.set_kmaddress = (void (*)(ike_sa_t*,host_t*,host_t*))set_kmaddress;
#ifdef ME
this->public.act_as_mediation_server = (void (*)(ike_sa_t*)) act_as_mediation_server;
@@ -2097,7 +2147,7 @@ ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id)
this->public.callback = (status_t (*)(ike_sa_t*,identification_t*)) callback;
this->public.respond = (status_t (*)(ike_sa_t*,identification_t*,chunk_t)) respond;
#endif /* ME */
-
+
/* initialize private fields */
this->ike_sa_id = ike_sa_id->clone(ike_sa_id);
this->child_sas = linked_list_create();
@@ -2106,7 +2156,6 @@ ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id)
this->other_host = host_create_any(AF_INET);
this->my_id = identification_create_from_encoding(ID_ANY, chunk_empty);
this->other_id = identification_create_from_encoding(ID_ANY, chunk_empty);
- this->eap_identity = NULL;
this->extensions = 0;
this->conditions = 0;
this->keymat = keymat_create(ike_sa_id->is_initiator(ike_sa_id));
@@ -2114,11 +2163,13 @@ ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id)
this->keepalive_interval = lib->settings->get_time(lib->settings,
"charon.keep_alive", KEEPALIVE_INTERVAL);
memset(this->stats, 0, sizeof(this->stats));
- this->stats[STAT_INBOUND] = this->stats[STAT_OUTBOUND] = time(NULL);
+ this->stats[STAT_INBOUND] = this->stats[STAT_OUTBOUND] = time_monotonic(NULL);
this->ike_cfg = NULL;
this->peer_cfg = NULL;
this->my_auth = auth_cfg_create();
this->other_auth = auth_cfg_create();
+ this->my_auths = linked_list_create();
+ this->other_auths = linked_list_create();
this->proposal = NULL;
this->task_manager = task_manager_create(&this->public);
this->unique_id = ++unique_id;
@@ -2136,6 +2187,6 @@ ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id)
this->server_reflexive_host = NULL;
this->connect_id = chunk_empty;
#endif /* ME */
-
+
return &this->public;
}
diff --git a/src/charon/sa/ike_sa.h b/src/charon/sa/ike_sa.h
index 41d7a7976..4dce1937c 100644
--- a/src/charon/sa/ike_sa.h
+++ b/src/charon/sa/ike_sa.h
@@ -66,7 +66,7 @@ typedef struct ike_sa_t ike_sa_t;
* Extensions (or optional features) the peer supports
*/
enum ike_extension_t {
-
+
/**
* peer supports NAT traversal as specified in RFC4306
*/
@@ -76,58 +76,68 @@ enum ike_extension_t {
* peer supports MOBIKE (RFC4555)
*/
EXT_MOBIKE = (1<<1),
-
+
/**
* peer supports HTTP cert lookups as specified in RFC4306
*/
EXT_HASH_AND_URL = (1<<2),
-
+
/**
* peer supports multiple authentication exchanges, RFC4739
*/
EXT_MULTIPLE_AUTH = (1<<3),
+
+ /**
+ * peer uses strongSwan, accept private use extensions
+ */
+ EXT_STRONGSWAN = (1<<4),
+
+ /**
+ * peer supports EAP-only authentication, draft-eronen-ipsec-ikev2-eap-auth
+ */
+ EXT_EAP_ONLY_AUTHENTICATION = (1<<5),
};
/**
* Conditions of an IKE_SA, change during its lifetime
*/
enum ike_condition_t {
-
+
/**
* Connection is natted (or faked) somewhere
*/
COND_NAT_ANY = (1<<0),
-
+
/**
* we are behind NAT
*/
COND_NAT_HERE = (1<<1),
-
+
/**
* other is behind NAT
*/
COND_NAT_THERE = (1<<2),
-
+
/**
* Faking NAT to enforce UDP encapsulation
*/
COND_NAT_FAKE = (1<<3),
-
+
/**
* peer has been authenticated using EAP at least once
*/
COND_EAP_AUTHENTICATED = (1<<4),
-
+
/**
* received a certificate request from the peer
*/
COND_CERTREQ_SEEN = (1<<5),
-
+
/**
* Local peer is the "original" IKE initiator. Unaffected from rekeying.
*/
COND_ORIGINAL_INITIATOR = (1<<6),
-
+
/**
* IKE_SA is stale, the peer is currently unreachable (MOBIKE)
*/
@@ -150,7 +160,7 @@ enum statistic_t {
STAT_INBOUND,
/** Timestamp of last outbound IKE packet */
STAT_OUTBOUND,
-
+
STAT_MAX
};
@@ -164,7 +174,7 @@ enum statistic_t {
¦ SA_CREATED ¦
+----------------+
¦
- on initiate()---> ¦ <----- on IKE_SA_INIT received
+ on initiate()---> ¦ <----- on IKE_SA_INIT received
V
+----------------+
¦ SA_CONNECTING ¦
@@ -192,37 +202,37 @@ enum statistic_t {
@endverbatim
*/
enum ike_sa_state_t {
-
+
/**
* IKE_SA just got created, but is not initiating nor responding yet.
*/
IKE_CREATED,
-
+
/**
* IKE_SA gets initiated actively or passively
*/
IKE_CONNECTING,
-
+
/**
* IKE_SA is fully established
*/
IKE_ESTABLISHED,
-
+
/**
* IKE_SA is managed externally and does not process messages
*/
IKE_PASSIVE,
-
+
/**
* IKE_SA rekeying in progress
*/
IKE_REKEYING,
-
+
/**
* IKE_SA is in progress of deletion
*/
IKE_DELETING,
-
+
/**
* IKE_SA object gets destroyed
*/
@@ -246,41 +256,41 @@ struct ike_sa_t {
/**
* Get the id of the SA.
- *
+ *
* Returned ike_sa_id_t object is not getting cloned!
*
* @return ike_sa's ike_sa_id_t
*/
ike_sa_id_t* (*get_id) (ike_sa_t *this);
-
+
/**
* Get the numerical ID uniquely defining this IKE_SA.
*
* @return unique ID
*/
u_int32_t (*get_unique_id) (ike_sa_t *this);
-
+
/**
* Get the state of the IKE_SA.
*
* @return state of the IKE_SA
*/
ike_sa_state_t (*get_state) (ike_sa_t *this);
-
+
/**
* Set the state of the IKE_SA.
*
* @param state state to set for the IKE_SA
*/
void (*set_state) (ike_sa_t *this, ike_sa_state_t ike_sa);
-
+
/**
* Get the name of the connection this IKE_SA uses.
*
* @return name
*/
char* (*get_name) (ike_sa_t *this);
-
+
/**
* Get statistic values from the IKE_SA.
*
@@ -288,35 +298,35 @@ struct ike_sa_t {
* @return value as integer
*/
u_int32_t (*get_statistic)(ike_sa_t *this, statistic_t kind);
-
+
/**
* Get the own host address.
- *
+ *
* @return host address
*/
host_t* (*get_my_host) (ike_sa_t *this);
-
+
/**
* Set the own host address.
- *
+ *
* @param me host address
*/
void (*set_my_host) (ike_sa_t *this, host_t *me);
-
+
/**
* Get the other peers host address.
- *
+ *
* @return host address
*/
host_t* (*get_other_host) (ike_sa_t *this);
-
+
/**
* Set the others host address.
- *
+ *
* @param other host address
*/
void (*set_other_host) (ike_sa_t *this, host_t *other);
-
+
/**
* Update the IKE_SAs host.
*
@@ -326,79 +336,63 @@ struct ike_sa_t {
* @param other new remote host address, or NULL
*/
void (*update_hosts)(ike_sa_t *this, host_t *me, host_t *other);
-
+
/**
* Get the own identification.
- *
+ *
* @return identification
*/
identification_t* (*get_my_id) (ike_sa_t *this);
-
+
/**
* Set the own identification.
- *
+ *
* @param me identification
*/
void (*set_my_id) (ike_sa_t *this, identification_t *me);
-
+
/**
* Get the other peer's identification.
- *
+ *
* @return identification
*/
identification_t* (*get_other_id) (ike_sa_t *this);
-
+
/**
* Set the other peer's identification.
- *
+ *
* @param other identification
*/
void (*set_other_id) (ike_sa_t *this, identification_t *other);
-
- /**
- * Get the peers EAP identity.
- *
- * The EAP identity is exchanged in a EAP-Identity exchange.
- *
- * @return identification, NULL if none set
- */
- identification_t* (*get_eap_identity) (ike_sa_t *this);
-
- /**
- * Set the peer's EAP identity.
- *
- * @param id identification
- */
- void (*set_eap_identity) (ike_sa_t *this, identification_t *id);
-
+
/**
* Get the config used to setup this IKE_SA.
- *
+ *
* @return ike_config
*/
ike_cfg_t* (*get_ike_cfg) (ike_sa_t *this);
-
+
/**
* Set the config to setup this IKE_SA.
- *
+ *
* @param config ike_config to use
*/
void (*set_ike_cfg) (ike_sa_t *this, ike_cfg_t* config);
/**
* Get the peer config used by this IKE_SA.
- *
+ *
* @return peer_config
*/
peer_cfg_t* (*get_peer_cfg) (ike_sa_t *this);
-
+
/**
* Set the peer config to use with this IKE_SA.
- *
+ *
* @param config peer_config to use
*/
void (*set_peer_cfg) (ike_sa_t *this, peer_cfg_t *config);
-
+
/**
* Get the authentication config with rules of the current auth round.
*
@@ -406,21 +400,37 @@ struct ike_sa_t {
* @return current cfg
*/
auth_cfg_t* (*get_auth_cfg)(ike_sa_t *this, bool local);
-
+
+ /**
+ * Insert a completed authentication round.
+ *
+ * @param local TRUE for own rules, FALSE for others constraints
+ * @param cfg auth config to append
+ */
+ void (*add_auth_cfg)(ike_sa_t *this, bool local, auth_cfg_t *cfg);
+
+ /**
+ * Create an enumerator over added authentication rounds.
+ *
+ * @param local TRUE for own rules, FALSE for others constraints
+ * @return enumerator over auth_cfg_t
+ */
+ enumerator_t* (*create_auth_cfg_enumerator)(ike_sa_t *this, bool local);
+
/**
* Get the selected proposal of this IKE_SA.
*
* @return selected proposal
*/
proposal_t* (*get_proposal)(ike_sa_t *this);
-
+
/**
* Set the proposal selected for this IKE_SA.
*
* @param selected proposal
*/
void (*set_proposal)(ike_sa_t *this, proposal_t *proposal);
-
+
/**
* Set the message id of the IKE_SA.
*
@@ -431,7 +441,7 @@ struct ike_sa_t {
* @param mid message id to set
*/
void (*set_message_id)(ike_sa_t *this, bool initiate, u_int32_t mid);
-
+
/**
* Add an additional address for the peer.
*
@@ -443,14 +453,14 @@ struct ike_sa_t {
* @param host host to add to list
*/
void (*add_additional_address)(ike_sa_t *this, host_t *host);
-
+
/**
* Create an iterator over all additional addresses of the peer.
*
* @return iterator over addresses
*/
iterator_t* (*create_additional_address_iterator)(ike_sa_t *this);
-
+
/**
* Check if mappings have changed on a NAT for our source address.
*
@@ -458,7 +468,7 @@ struct ike_sa_t {
* @return TRUE if mappings have changed
*/
bool (*has_mapping_changed)(ike_sa_t *this, chunk_t hash);
-
+
/**
* Enable an extension the peer supports.
*
@@ -468,7 +478,7 @@ struct ike_sa_t {
* @param extension extension to enable
*/
void (*enable_extension)(ike_sa_t *this, ike_extension_t extension);
-
+
/**
* Check if the peer supports an extension.
*
@@ -476,7 +486,7 @@ struct ike_sa_t {
* @return TRUE if peer supports it, FALSE otherwise
*/
bool (*supports_extension)(ike_sa_t *this, ike_extension_t extension);
-
+
/**
* Enable/disable a condition flag for this IKE_SA.
*
@@ -492,150 +502,152 @@ struct ike_sa_t {
* @return TRUE if condition flag set, FALSE otherwise
*/
bool (*has_condition) (ike_sa_t *this, ike_condition_t condition);
-
+
/**
* Get the number of queued MOBIKE address updates.
*
* @return number of pending updates
*/
u_int32_t (*get_pending_updates)(ike_sa_t *this);
-
+
/**
* Set the number of queued MOBIKE address updates.
*
* @param updates number of pending updates
*/
void (*set_pending_updates)(ike_sa_t *this, u_int32_t updates);
-
+
#ifdef ME
/**
* Activate mediation server functionality for this IKE_SA.
*/
void (*act_as_mediation_server) (ike_sa_t *this);
-
+
/**
* Get the server reflexive host.
- *
+ *
* @return server reflexive host
*/
host_t* (*get_server_reflexive_host) (ike_sa_t *this);
-
+
/**
* Set the server reflexive host.
- *
+ *
* @param host server reflexive host
*/
void (*set_server_reflexive_host) (ike_sa_t *this, host_t *host);
-
+
/**
* Get the connect ID.
- *
+ *
* @return connect ID
*/
chunk_t (*get_connect_id) (ike_sa_t *this);
-
+
/**
* Initiate the mediation of a mediated connection (i.e. initiate a
- * ME_CONNECT exchange).
- *
- * @param mediated_cfg peer_cfg of the mediated connection
- * @return
- * - SUCCESS if initialization started
- * - DESTROY_ME if initialization failed
+ * ME_CONNECT exchange to a mediation server).
+ *
+ * @param mediated_cfg peer_cfg of the mediated connection
+ * @return
+ * - SUCCESS if initialization started
+ * - DESTROY_ME if initialization failed
*/
status_t (*initiate_mediation) (ike_sa_t *this, peer_cfg_t *mediated_cfg);
-
+
/**
* Initiate the mediated connection
- *
- * @param me local endpoint (gets cloned)
- * @param other remote endpoint (gets cloned)
- * @param connect_id connect ID (gets cloned)
- * @return
- * - SUCCESS if initialization started
- * - DESTROY_ME if initialization failed
+ *
+ * @param me local endpoint (gets cloned)
+ * @param other remote endpoint (gets cloned)
+ * @param connect_id connect ID (gets cloned)
+ * @return
+ * - SUCCESS if initialization started
+ * - DESTROY_ME if initialization failed
*/
status_t (*initiate_mediated) (ike_sa_t *this, host_t *me, host_t *other,
- chunk_t connect_id);
-
+ chunk_t connect_id);
+
/**
- * Relay data from one peer to another (i.e. initiate a
- * ME_CONNECT exchange).
+ * Relay data from one peer to another (i.e. initiate a ME_CONNECT exchange
+ * to a peer).
*
* Data is cloned.
- *
- * @param requester ID of the requesting peer
- * @param connect_id data of the ME_CONNECTID payload
- * @param connect_key data of the ME_CONNECTKEY payload
- * @param endpoints endpoints
- * @param response TRUE if this is a response
- * @return
- * - SUCCESS if relay started
- * - DESTROY_ME if relay failed
- */
- status_t (*relay) (ike_sa_t *this, identification_t *requester, chunk_t connect_id,
- chunk_t connect_key, linked_list_t *endpoints, bool response);
-
+ *
+ * @param requester ID of the requesting peer
+ * @param connect_id data of the ME_CONNECTID payload
+ * @param connect_key data of the ME_CONNECTKEY payload
+ * @param endpoints endpoints
+ * @param response TRUE if this is a response
+ * @return
+ * - SUCCESS if relay started
+ * - DESTROY_ME if relay failed
+ */
+ status_t (*relay) (ike_sa_t *this, identification_t *requester,
+ chunk_t connect_id, chunk_t connect_key,
+ linked_list_t *endpoints, bool response);
+
/**
* Send a callback to a peer.
- *
+ *
* Data is cloned.
- *
- * @param peer_id ID of the other peer
+ *
+ * @param peer_id ID of the other peer
* @return
- * - SUCCESS if response started
- * - DESTROY_ME if response failed
+ * - SUCCESS if response started
+ * - DESTROY_ME if response failed
*/
status_t (*callback) (ike_sa_t *this, identification_t *peer_id);
-
+
/**
* Respond to a ME_CONNECT request.
- *
+ *
* Data is cloned.
- *
- * @param peer_id ID of the other peer
- * @param connect_id the connect ID supplied by the initiator
+ *
+ * @param peer_id ID of the other peer
+ * @param connect_id the connect ID supplied by the initiator
* @return
- * - SUCCESS if response started
- * - DESTROY_ME if response failed
+ * - SUCCESS if response started
+ * - DESTROY_ME if response failed
*/
- status_t (*respond) (ike_sa_t *this, identification_t *peer_id, chunk_t connect_id);
+ status_t (*respond) (ike_sa_t *this, identification_t *peer_id,
+ chunk_t connect_id);
#endif /* ME */
-
+
/**
* Initiate a new connection.
*
* The configs are owned by the IKE_SA after the call. If the initiate
* is triggered by a packet, traffic selectors of the packet can be added
* to the CHILD_SA.
- *
+ *
* @param child_cfg child config to create CHILD from
* @param reqid reqid to use for CHILD_SA, 0 assigne uniquely
* @param tsi source of triggering packet
* @param tsr destination of triggering packet.
- * @return
+ * @return
* - SUCCESS if initialization started
* - DESTROY_ME if initialization failed
*/
status_t (*initiate) (ike_sa_t *this, child_cfg_t *child_cfg,
u_int32_t reqid, traffic_selector_t *tsi,
traffic_selector_t *tsr);
-
+
/**
* Initiates the deletion of an IKE_SA.
- *
+ *
* Sends a delete message to the remote peer and waits for
* its response. If the response comes in, or a timeout occurs,
* the IKE SA gets deleted.
- *
+ *
* @return
* - SUCCESS if deletion is initialized
- * - DESTROY_ME, if the IKE_SA is not in
+ * - DESTROY_ME, if the IKE_SA is not in
* an established state and can not be
* deleted (but destroyed).
*/
status_t (*delete) (ike_sa_t *this);
-
+
/**
* Update IKE_SAs after network interfaces have changed.
*
@@ -649,61 +661,61 @@ struct ike_sa_t {
* @return SUCCESS, FAILED, DESTROY_ME
*/
status_t (*roam)(ike_sa_t *this, bool address);
-
+
/**
* Processes a incoming IKEv2-Message.
*
- * Message processing may fail. If a critical failure occurs,
- * process_message() return DESTROY_ME. Then the caller must
+ * Message processing may fail. If a critical failure occurs,
+ * process_message() return DESTROY_ME. Then the caller must
* destroy the IKE_SA immediatly, as it is unusable.
- *
+ *
* @param message message to process
- * @return
+ * @return
* - SUCCESS
* - FAILED
* - DESTROY_ME if this IKE_SA MUST be deleted
*/
status_t (*process_message) (ike_sa_t *this, message_t *message);
-
+
/**
* Generate a IKE message to send it to the peer.
- *
+ *
* This method generates all payloads in the message and encrypts/signs
* the packet.
- *
+ *
* @param message message to generate
* @param packet generated output packet
- * @return
+ * @return
* - SUCCESS
* - FAILED
* - DESTROY_ME if this IKE_SA MUST be deleted
*/
status_t (*generate_message) (ike_sa_t *this, message_t *message,
packet_t **packet);
-
+
/**
* Retransmits a request.
- *
+ *
* @param message_id ID of the request to retransmit
* @return
* - SUCCESS
* - NOT_FOUND if request doesn't have to be retransmited
*/
status_t (*retransmit) (ike_sa_t *this, u_int32_t message_id);
-
+
/**
* Sends a DPD request to the peer.
*
* To check if a peer is still alive, periodic
* empty INFORMATIONAL messages are sent if no
* other traffic was received.
- *
+ *
* @return
* - SUCCESS
* - DESTROY_ME, if peer did not respond
*/
status_t (*send_dpd) (ike_sa_t *this);
-
+
/**
* Sends a keep alive packet.
*
@@ -713,39 +725,39 @@ struct ike_sa_t {
* was sent.
*/
void (*send_keepalive) (ike_sa_t *this);
-
+
/**
* Get the keying material of this IKE_SA.
*
* @return per IKE_SA keymat instance
*/
keymat_t* (*get_keymat)(ike_sa_t *this);
-
+
/**
* Associates a child SA to this IKE SA
- *
+ *
* @param child_sa child_sa to add
*/
void (*add_child_sa) (ike_sa_t *this, child_sa_t *child_sa);
-
+
/**
* Get a CHILD_SA identified by protocol and SPI.
- *
+ *
* @param protocol protocol of the SA
* @param spi SPI of the CHILD_SA
* @param inbound TRUE if SPI is inbound, FALSE if outbound
* @return child_sa, or NULL if none found
*/
- child_sa_t* (*get_child_sa) (ike_sa_t *this, protocol_id_t protocol,
+ child_sa_t* (*get_child_sa) (ike_sa_t *this, protocol_id_t protocol,
u_int32_t spi, bool inbound);
-
+
/**
* Create an iterator over all CHILD_SAs.
- *
+ *
* @return iterator
*/
iterator_t* (*create_child_sa_iterator) (ike_sa_t *this);
-
+
/**
* Rekey the CHILD SA with the specified reqid.
*
@@ -814,14 +826,14 @@ struct ike_sa_t {
* @return DESTROY_ME to destroy the IKE_SA
*/
status_t (*reestablish) (ike_sa_t *this);
-
+
/**
* Set the lifetime limit received from a AUTH_LIFETIME notify.
*
* @param lifetime lifetime in seconds
*/
void (*set_auth_lifetime)(ike_sa_t *this, u_int32_t lifetime);
-
+
/**
* Set the virtual IP to use for this IKE_SA and its children.
*
@@ -832,7 +844,7 @@ struct ike_sa_t {
* @param ip IP to set as virtual IP
*/
void (*set_virtual_ip) (ike_sa_t *this, bool local, host_t *ip);
-
+
/**
* Get the virtual IP configured.
*
@@ -840,7 +852,7 @@ struct ike_sa_t {
* @return host_t *virtual IP
*/
host_t* (*get_virtual_ip) (ike_sa_t *this, bool local);
-
+
/**
* Register a configuration attribute to the IKE_SA.
*
@@ -853,8 +865,9 @@ struct ike_sa_t {
* @param data associated attribute data
*/
void (*add_configuration_attribute)(ike_sa_t *this,
+ attribute_handler_t *handler,
configuration_attribute_type_t type, chunk_t data);
-
+
/**
* Set local and remote host addresses to be used for IKE.
*
@@ -865,7 +878,7 @@ struct ike_sa_t {
* @param remote remote kmaddress
*/
void (*set_kmaddress) (ike_sa_t *this, host_t *local, host_t *remote);
-
+
/**
* Inherit all attributes of other to this after rekeying.
*
@@ -877,12 +890,12 @@ struct ike_sa_t {
* @return DESTROY_ME if initiation of inherited task failed
*/
status_t (*inherit) (ike_sa_t *this, ike_sa_t *other);
-
+
/**
* Reset the IKE_SA, useable when initiating fails
*/
void (*reset) (ike_sa_t *this);
-
+
/**
* Destroys a ike_sa_t object.
*/
diff --git a/src/charon/sa/ike_sa_id.h b/src/charon/sa/ike_sa_id.h
index 377e64e8a..a833aa9d6 100644
--- a/src/charon/sa/ike_sa_id.h
+++ b/src/charon/sa/ike_sa_id.h
@@ -67,21 +67,21 @@ struct ike_sa_id_t {
/**
* Check if two ike_sa_id_t objects are equal.
- *
+ *
* Two ike_sa_id_t objects are equal if both SPI values and the role matches.
*
- * @param other ike_sa_id_t object to check if equal
- * @return TRUE if given ike_sa_id_t are equal, FALSE otherwise
+ * @param other ike_sa_id_t object to check if equal
+ * @return TRUE if given ike_sa_id_t are equal, FALSE otherwise
*/
bool (*equals) (ike_sa_id_t *this, ike_sa_id_t *other);
/**
* Replace all values of a given ike_sa_id_t object with values.
* from another ike_sa_id_t object.
- *
+ *
* After calling this function, both objects are equal.
*
- * @param other ike_sa_id_t object from which values will be taken
+ * @param other ike_sa_id_t object from which values will be taken
*/
void (*replace_values) (ike_sa_id_t *this, ike_sa_id_t *other);
@@ -94,7 +94,7 @@ struct ike_sa_id_t {
/**
* Switche the original initiator flag.
- *
+ *
* @return TRUE if we are the original initator after switch, FALSE otherwise
*/
bool (*switch_initiator) (ike_sa_id_t *this);
diff --git a/src/charon/sa/ike_sa_manager.c b/src/charon/sa/ike_sa_manager.c
index ec1a7f741..3ef0f3bb0 100644
--- a/src/charon/sa/ike_sa_manager.c
+++ b/src/charon/sa/ike_sa_manager.c
@@ -22,7 +22,9 @@
#include <daemon.h>
#include <sa/ike_sa_id.h>
#include <bus/bus.h>
-#include <utils/mutex.h>
+#include <threading/condvar.h>
+#include <threading/mutex.h>
+#include <threading/rwlock.h>
#include <utils/linked_list.h>
#include <crypto/hashers/hasher.h>
@@ -41,67 +43,67 @@ typedef struct entry_t entry_t;
* An entry in the linked list, contains IKE_SA, locking and lookup data.
*/
struct entry_t {
-
+
/**
* Number of threads waiting for this ike_sa_t object.
*/
int waiting_threads;
-
+
/**
* Condvar where threads can wait until ike_sa_t object is free for use again.
*/
condvar_t *condvar;
-
+
/**
* Is this ike_sa currently checked out?
*/
bool checked_out;
-
+
/**
* Does this SA drives out new threads?
*/
bool driveout_new_threads;
-
+
/**
* Does this SA drives out waiting threads?
*/
bool driveout_waiting_threads;
-
+
/**
* Identification of an IKE_SA (SPIs).
*/
ike_sa_id_t *ike_sa_id;
-
+
/**
* The contained ike_sa_t object.
*/
ike_sa_t *ike_sa;
-
+
/**
* hash of the IKE_SA_INIT message, used to detect retransmissions
*/
chunk_t init_hash;
-
+
/**
* remote host address, required for DoS detection
*/
host_t *other;
-
+
/**
* As responder: Is this SA half-open?
*/
bool half_open;
-
+
/**
* own identity, required for duplicate checking
*/
identification_t *my_id;
-
+
/**
* remote identity, required for duplicate checking
*/
identification_t *other_id;
-
+
/**
* message ID currently processing, if any
*/
@@ -131,10 +133,10 @@ static status_t entry_destroy(entry_t *this)
static entry_t *entry_create()
{
entry_t *this = malloc_thing(entry_t);
-
+
this->waiting_threads = 0;
this->condvar = condvar_create(CONDVAR_TYPE_DEFAULT);
-
+
/* we set checkout flag when we really give it out */
this->checked_out = FALSE;
this->driveout_new_threads = FALSE;
@@ -147,7 +149,7 @@ static entry_t *entry_create()
this->other_id = NULL;
this->ike_sa_id = NULL;
this->ike_sa = NULL;
-
+
return this;
}
@@ -171,7 +173,7 @@ static bool entry_match_by_id(entry_t *entry, ike_sa_id_t *id)
if (id->equals(id, entry->ike_sa_id))
{
return TRUE;
- }
+ }
if ((id->get_responder_spi(id) == 0 ||
entry->ike_sa_id->get_responder_spi(entry->ike_sa_id) == 0) &&
id->is_initiator(id) == entry->ike_sa_id->is_initiator(entry->ike_sa_id) &&
@@ -208,7 +210,7 @@ typedef struct half_open_t half_open_t;
struct half_open_t {
/** chunk of remote host address */
chunk_t other;
-
+
/** the number of half-open IKE_SAs with that host */
u_int count;
};
@@ -235,10 +237,10 @@ typedef struct connected_peers_t connected_peers_t;
struct connected_peers_t {
/** own identity */
identification_t *my_id;
-
+
/** remote identity */
identification_t *other_id;
-
+
/** list of ike_sa_id_t objects of IKE_SAs between the two identities */
linked_list_t *sas;
};
@@ -269,7 +271,7 @@ typedef struct segment_t segment_t;
struct segment_t {
/** mutex to access a segment exclusively */
mutex_t *mutex;
-
+
/** the number of entries in this segment */
u_int count;
};
@@ -282,7 +284,7 @@ typedef struct shareable_segment_t shareable_segment_t;
struct shareable_segment_t {
/** rwlock to access a segment non-/exclusively */
rwlock_t *lock;
-
+
/** the number of entries in this segment - in case of the "half-open table"
* it's the sum of all half_open_t.count in a segment. */
u_int count;
@@ -298,67 +300,67 @@ struct private_ike_sa_manager_t {
* Public interface of ike_sa_manager_t.
*/
ike_sa_manager_t public;
-
+
/**
* Hash table with entries for the ike_sa_t objects.
*/
linked_list_t **ike_sa_table;
-
+
/**
* The size of the hash table.
*/
u_int table_size;
-
+
/**
* Mask to map the hashes to table rows.
*/
u_int table_mask;
-
+
/**
* Segments of the hash table.
*/
segment_t *segments;
-
+
/**
* The number of segments.
*/
u_int segment_count;
-
+
/**
* Mask to map a table row to a segment.
*/
u_int segment_mask;
-
+
/**
* Hash table with half_open_t objects.
*/
linked_list_t **half_open_table;
-
+
/**
* Segments of the "half-open" hash table.
*/
shareable_segment_t *half_open_segments;
-
+
/**
* Hash table with connected_peers_t objects.
*/
linked_list_t **connected_peers_table;
-
+
/**
* Segments of the "connected peers" hash table.
*/
shareable_segment_t *connected_peers_segments;
-
+
/**
* RNG to get random SPIs for our side
*/
rng_t *rng;
-
+
/**
* SHA1 hasher for IKE_SA_INIT retransmit detection
*/
hasher_t *hasher;
-
+
/**
* reuse existing IKE_SAs in checkout_by_config
*/
@@ -372,7 +374,7 @@ struct private_ike_sa_manager_t {
static void lock_single_segment(private_ike_sa_manager_t *this, u_int index)
{
mutex_t *lock = this->segments[index & this->segment_mask].mutex;
-
+
lock->lock(lock);
}
@@ -383,7 +385,7 @@ static void lock_single_segment(private_ike_sa_manager_t *this, u_int index)
static void unlock_single_segment(private_ike_sa_manager_t *this, u_int index)
{
mutex_t *lock = this->segments[index & this->segment_mask].mutex;
-
+
lock->unlock(lock);
}
@@ -393,7 +395,7 @@ static void unlock_single_segment(private_ike_sa_manager_t *this, u_int index)
static void lock_all_segments(private_ike_sa_manager_t *this)
{
u_int i;
-
+
for (i = 0; i < this->segment_count; ++i)
{
this->segments[i].mutex->lock(this->segments[i].mutex);
@@ -406,7 +408,7 @@ static void lock_all_segments(private_ike_sa_manager_t *this)
static void unlock_all_segments(private_ike_sa_manager_t *this)
{
u_int i;
-
+
for (i = 0; i < this->segment_count; ++i)
{
this->segments[i].mutex->unlock(this->segments[i].mutex);
@@ -424,27 +426,27 @@ struct private_enumerator_t {
* implements enumerator interface
*/
enumerator_t enumerator;
-
+
/**
* associated ike_sa_manager_t
*/
private_ike_sa_manager_t *manager;
-
+
/**
* current segment index
*/
u_int segment;
-
+
/**
* currently enumerating entry
*/
entry_t *entry;
-
+
/**
* current table row index
*/
u_int row;
-
+
/**
* enumerator for the current table row
*/
@@ -468,7 +470,7 @@ static bool enumerate(private_enumerator_t *this, entry_t **entry, u_int *segmen
if (this->current)
{
entry_t *item;
-
+
if (this->current->enumerate(this->current, &item))
{
*entry = this->entry = item;
@@ -482,7 +484,7 @@ static bool enumerate(private_enumerator_t *this, entry_t **entry, u_int *segmen
else
{
linked_list_t *list;
-
+
lock_single_segment(this->manager, this->segment);
if ((list = this->manager->ike_sa_table[this->row]) != NULL &&
list->get_count(list))
@@ -523,7 +525,7 @@ static void enumerator_destroy(private_enumerator_t *this)
static enumerator_t* create_table_enumerator(private_ike_sa_manager_t *this)
{
private_enumerator_t *enumerator = malloc_thing(private_enumerator_t);
-
+
enumerator->enumerator.enumerate = (void*)enumerate;
enumerator->enumerator.destroy = (void*)enumerator_destroy;
enumerator->manager = this;
@@ -531,7 +533,7 @@ static enumerator_t* create_table_enumerator(private_ike_sa_manager_t *this)
enumerator->entry = NULL;
enumerator->row = 0;
enumerator->current = NULL;
-
+
return &enumerator->enumerator;
}
@@ -544,7 +546,7 @@ static u_int put_entry(private_ike_sa_manager_t *this, entry_t *entry)
linked_list_t *list;
u_int row = ike_sa_id_hash(entry->ike_sa_id) & this->table_mask;
u_int segment = row & this->segment_mask;
-
+
lock_single_segment(this, segment);
if ((list = this->ike_sa_table[row]) == NULL)
{
@@ -564,7 +566,7 @@ static void remove_entry(private_ike_sa_manager_t *this, entry_t *entry)
linked_list_t *list;
u_int row = ike_sa_id_hash(entry->ike_sa_id) & this->table_mask;
u_int segment = row & this->segment_mask;
-
+
if ((list = this->ike_sa_table[row]) != NULL)
{
entry_t *current;
@@ -609,7 +611,7 @@ static status_t get_entry_by_match_function(private_ike_sa_manager_t *this,
linked_list_t *list;
u_int row = ike_sa_id_hash(ike_sa_id) & this->table_mask;
u_int seg = row & this->segment_mask;
-
+
lock_single_segment(this, seg);
if ((list = this->ike_sa_table[row]) != NULL)
{
@@ -632,7 +634,7 @@ static status_t get_entry_by_match_function(private_ike_sa_manager_t *this,
static status_t get_entry_by_id(private_ike_sa_manager_t *this,
ike_sa_id_t *ike_sa_id, entry_t **entry, u_int *segment)
{
- return get_entry_by_match_function(this, ike_sa_id, entry, segment,
+ return get_entry_by_match_function(this, ike_sa_id, entry, segment,
(linked_list_match_t)entry_match_by_id, ike_sa_id, NULL);
}
@@ -670,7 +672,7 @@ static bool wait_for_entry(private_ike_sa_manager_t *this, entry_t *entry,
/* we are not allowed to get this */
return FALSE;
}
- while (entry->checked_out && !entry->driveout_waiting_threads)
+ while (entry->checked_out && !entry->driveout_waiting_threads)
{
/* so wait until we can get it for us.
* we register us as waiting. */
@@ -698,7 +700,7 @@ static void put_half_open(private_ike_sa_manager_t *this, entry_t *entry)
chunk_t addr = entry->other->get_address(entry->other);
u_int row = chunk_hash(addr) & this->table_mask;
u_int segment = row & this->segment_mask;
-
+
rwlock_t *lock = this->half_open_segments[segment].lock;
lock->write_lock(lock);
if ((list = this->half_open_table[row]) == NULL)
@@ -716,7 +718,7 @@ static void put_half_open(private_ike_sa_manager_t *this, entry_t *entry)
this->half_open_segments[segment].count++;
}
}
-
+
if (!half_open)
{
half_open = malloc_thing(half_open_t);
@@ -737,7 +739,7 @@ static void remove_half_open(private_ike_sa_manager_t *this, entry_t *entry)
chunk_t addr = entry->other->get_address(entry->other);
u_int row = chunk_hash(addr) & this->table_mask;
u_int segment = row & this->segment_mask;
-
+
rwlock_t *lock = this->half_open_segments[segment].lock;
lock->write_lock(lock);
if ((list = this->half_open_table[row]) != NULL)
@@ -773,7 +775,7 @@ static void put_connected_peers(private_ike_sa_manager_t *this, entry_t *entry)
other_id = entry->other_id->get_encoding(entry->other_id);
u_int row = chunk_hash_inc(other_id, chunk_hash(my_id)) & this->table_mask;
u_int segment = row & this->segment_mask;
-
+
rwlock_t *lock = this->connected_peers_segments[segment].lock;
lock->write_lock(lock);
if ((list = this->connected_peers_table[row]) == NULL)
@@ -796,7 +798,7 @@ static void put_connected_peers(private_ike_sa_manager_t *this, entry_t *entry)
}
}
}
-
+
if (!connected_peers)
{
connected_peers = malloc_thing(connected_peers_t);
@@ -821,7 +823,7 @@ static void remove_connected_peers(private_ike_sa_manager_t *this, entry_t *entr
other_id = entry->other_id->get_encoding(entry->other_id);
u_int row = chunk_hash_inc(other_id, chunk_hash(my_id)) & this->table_mask;
u_int segment = row & this->segment_mask;
-
+
rwlock_t *lock = this->connected_peers_segments[segment].lock;
lock->write_lock(lock);
if ((list = this->connected_peers_table[row]) != NULL)
@@ -864,7 +866,7 @@ static void remove_connected_peers(private_ike_sa_manager_t *this, entry_t *entr
static u_int64_t get_next_spi(private_ike_sa_manager_t *this)
{
u_int64_t spi;
-
+
this->rng->get_bytes(this->rng, sizeof(spi), (u_int8_t*)&spi);
return spi;
}
@@ -877,9 +879,9 @@ static ike_sa_t* checkout(private_ike_sa_manager_t *this, ike_sa_id_t *ike_sa_id
ike_sa_t *ike_sa = NULL;
entry_t *entry;
u_int segment;
-
+
DBG2(DBG_MGR, "checkout IKE_SA");
-
+
if (get_entry_by_id(this, ike_sa_id, &entry, &segment) == SUCCESS)
{
if (wait_for_entry(this, entry, segment))
@@ -903,7 +905,7 @@ static ike_sa_t *checkout_new(private_ike_sa_manager_t* this, bool initiator)
ike_sa_t *ike_sa;
entry_t *entry;
u_int segment;
-
+
if (initiator)
{
ike_sa_id = ike_sa_id_create(get_next_spi(this), 0, TRUE);
@@ -913,15 +915,15 @@ static ike_sa_t *checkout_new(private_ike_sa_manager_t* this, bool initiator)
ike_sa_id = ike_sa_id_create(0, get_next_spi(this), FALSE);
}
ike_sa = ike_sa_create(ike_sa_id);
-
+
DBG2(DBG_MGR, "created IKE_SA");
-
+
if (!initiator)
{
ike_sa_id->destroy(ike_sa_id);
return ike_sa;
}
-
+
entry = entry_create();
entry->ike_sa_id = ike_sa_id;
entry->ike_sa = ike_sa;
@@ -944,19 +946,19 @@ static ike_sa_t* checkout_by_message(private_ike_sa_manager_t* this,
id = id->clone(id);
id->switch_initiator(id);
-
+
DBG2(DBG_MGR, "checkout IKE_SA by message");
-
+
if (message->get_request(message) &&
message->get_exchange_type(message) == IKE_SA_INIT)
{
/* IKE_SA_INIT request. Check for an IKE_SA with such a message hash. */
chunk_t data, hash;
-
+
data = message->get_packet_data(message);
this->hasher->allocate_hash(this->hasher, data, &hash);
chunk_free(&data);
-
+
if (get_entry_by_hash(this, id, hash, &entry, &segment) == SUCCESS)
{
if (entry->message_id == 0)
@@ -976,7 +978,7 @@ static ike_sa_t* checkout_by_message(private_ike_sa_manager_t* this,
}
unlock_single_segment(this, segment);
}
-
+
if (ike_sa == NULL)
{
if (id->get_responder_spi(id) == 0 &&
@@ -987,15 +989,15 @@ static ike_sa_t* checkout_by_message(private_ike_sa_manager_t* this,
entry = entry_create();
entry->ike_sa = ike_sa_create(id);
entry->ike_sa_id = id->clone(id);
-
+
segment = put_entry(this, entry);
entry->checked_out = TRUE;
unlock_single_segment(this, segment);
-
- entry->message_id = message->get_message_id(message);
+
+ entry->message_id = message->get_message_id(message);
entry->init_hash = hash;
ike_sa = entry->ike_sa;
-
+
DBG2(DBG_MGR, "created IKE_SA");
}
else
@@ -1012,7 +1014,7 @@ static ike_sa_t* checkout_by_message(private_ike_sa_manager_t* this,
charon->bus->set_sa(charon->bus, ike_sa);
return ike_sa;
}
-
+
if (get_entry_by_id(this, id, &entry, &segment) == SUCCESS)
{
/* only check out if we are not processing this request */
@@ -1053,14 +1055,14 @@ static ike_sa_t* checkout_by_config(private_ike_sa_manager_t *this,
peer_cfg_t *current_peer;
ike_cfg_t *current_ike;
u_int segment;
-
+
if (!this->reuse_ikesa)
{ /* IKE_SA reuse disable by config */
- ike_sa = checkout_new(this, TRUE);
+ ike_sa = checkout_new(this, TRUE);
charon->bus->set_sa(charon->bus, ike_sa);
return ike_sa;
}
-
+
enumerator = create_table_enumerator(this);
while (enumerator->enumerate(enumerator, &entry, &segment))
{
@@ -1072,7 +1074,7 @@ static ike_sa_t* checkout_by_config(private_ike_sa_manager_t *this,
{ /* skip IKE_SAs which are not usable */
continue;
}
-
+
current_peer = entry->ike_sa->get_peer_cfg(entry->ike_sa);
if (current_peer && current_peer->equals(current_peer, peer_cfg))
{
@@ -1088,10 +1090,10 @@ static ike_sa_t* checkout_by_config(private_ike_sa_manager_t *this,
}
}
enumerator->destroy(enumerator);
-
+
if (!ike_sa)
{ /* no IKE_SA using such a config, hand out a new */
- ike_sa = checkout_new(this, TRUE);
+ ike_sa = checkout_new(this, TRUE);
}
charon->bus->set_sa(charon->bus, ike_sa);
return ike_sa;
@@ -1109,7 +1111,7 @@ static ike_sa_t* checkout_by_id(private_ike_sa_manager_t *this, u_int32_t id,
ike_sa_t *ike_sa = NULL;
child_sa_t *child_sa;
u_int segment;
-
+
enumerator = create_table_enumerator(this);
while (enumerator->enumerate(enumerator, &entry, &segment))
{
@@ -1125,7 +1127,7 @@ static ike_sa_t* checkout_by_id(private_ike_sa_manager_t *this, u_int32_t id,
{
ike_sa = entry->ike_sa;
break;
- }
+ }
}
children->destroy(children);
}
@@ -1145,7 +1147,7 @@ static ike_sa_t* checkout_by_id(private_ike_sa_manager_t *this, u_int32_t id,
}
}
enumerator->destroy(enumerator);
-
+
charon->bus->set_sa(charon->bus, ike_sa);
return ike_sa;
}
@@ -1162,7 +1164,7 @@ static ike_sa_t* checkout_by_name(private_ike_sa_manager_t *this, char *name,
ike_sa_t *ike_sa = NULL;
child_sa_t *child_sa;
u_int segment;
-
+
enumerator = create_table_enumerator(this);
while (enumerator->enumerate(enumerator, &entry, &segment))
{
@@ -1178,7 +1180,7 @@ static ike_sa_t* checkout_by_name(private_ike_sa_manager_t *this, char *name,
{
ike_sa = entry->ike_sa;
break;
- }
+ }
}
children->destroy(children);
}
@@ -1198,13 +1200,13 @@ static ike_sa_t* checkout_by_name(private_ike_sa_manager_t *this, char *name,
}
}
enumerator->destroy(enumerator);
-
+
charon->bus->set_sa(charon->bus, ike_sa);
return ike_sa;
}
/**
- * enumerator filter function
+ * enumerator filter function
*/
static bool enumerator_filter(private_ike_sa_manager_t *this,
entry_t **in, ike_sa_t **out, u_int *segment)
@@ -1243,14 +1245,14 @@ static void checkin(private_ike_sa_manager_t *this, ike_sa_t *ike_sa)
host_t *other;
identification_t *my_id, *other_id;
u_int segment;
-
+
ike_sa_id = ike_sa->get_id(ike_sa);
my_id = ike_sa->get_my_id(ike_sa);
other_id = ike_sa->get_other_id(ike_sa);
other = ike_sa->get_other_host(ike_sa);
-
+
DBG2(DBG_MGR, "checkin IKE_SA");
-
+
/* look for the entry */
if (get_entry_by_sa(this, ike_sa_id, ike_sa, &entry, &segment) == SUCCESS)
{
@@ -1293,7 +1295,7 @@ static void checkin(private_ike_sa_manager_t *this, ike_sa_t *ike_sa)
entry->ike_sa = ike_sa;
segment = put_entry(this, entry);
}
-
+
/* apply identities for duplicate test (only as responder) */
if (!entry->ike_sa_id->is_initiator(entry->ike_sa_id) &&
ike_sa->get_state(ike_sa) == IKE_ESTABLISHED &&
@@ -1303,9 +1305,9 @@ static void checkin(private_ike_sa_manager_t *this, ike_sa_t *ike_sa)
entry->other_id = other_id->clone(other_id);
put_connected_peers(this, entry);
}
-
+
unlock_single_segment(this, segment);
-
+
charon->bus->set_sa(charon->bus, NULL);
}
@@ -1322,11 +1324,11 @@ static void checkin_and_destroy(private_ike_sa_manager_t *this, ike_sa_t *ike_sa
entry_t *entry;
ike_sa_id_t *ike_sa_id;
u_int segment;
-
+
ike_sa_id = ike_sa->get_id(ike_sa);
-
+
DBG2(DBG_MGR, "checkin and destroy IKE_SA");
-
+
if (get_entry_by_sa(this, ike_sa_id, ike_sa, &entry, &segment) == SUCCESS)
{
/* drive out waiting threads, as we are in hurry */
@@ -1343,7 +1345,7 @@ static void checkin_and_destroy(private_ike_sa_manager_t *this, ike_sa_t *ike_sa
}
remove_entry(this, entry);
unlock_single_segment(this, segment);
-
+
if (entry->half_open)
{
remove_half_open(this, entry);
@@ -1353,9 +1355,9 @@ static void checkin_and_destroy(private_ike_sa_manager_t *this, ike_sa_t *ike_sa
{
remove_connected_peers(this, entry);
}
-
+
entry_destroy(entry);
-
+
DBG2(DBG_MGR, "check-in and destroy of IKE_SA successful");
}
else
@@ -1366,7 +1368,7 @@ static void checkin_and_destroy(private_ike_sa_manager_t *this, ike_sa_t *ike_sa
charon->bus->set_sa(charon->bus, NULL);
}
-
+
/**
* Implementation of ike_sa_manager_t.check_uniqueness.
*/
@@ -1381,27 +1383,27 @@ static bool check_uniqueness(private_ike_sa_manager_t *this, ike_sa_t *ike_sa)
identification_t *me, *other;
u_int row, segment;
rwlock_t *lock;
-
+
peer_cfg = ike_sa->get_peer_cfg(ike_sa);
policy = peer_cfg->get_unique_policy(peer_cfg);
if (policy == UNIQUE_NO)
{
return FALSE;
}
-
+
me = ike_sa->get_my_id(ike_sa);
other = ike_sa->get_other_id(ike_sa);
-
+
row = chunk_hash_inc(other->get_encoding(other),
chunk_hash(me->get_encoding(me))) & this->table_mask;
segment = row & this->segment_mask;
-
+
lock = this->connected_peers_segments[segment & this->segment_mask].lock;
lock->read_lock(lock);
if ((list = this->connected_peers_table[row]) != NULL)
{
connected_peers_t *current;
-
+
if (list->find_first(list, (linked_list_match_t)connected_peers_match,
(void**)&current, me, other) == SUCCESS)
{
@@ -1411,18 +1413,18 @@ static bool check_uniqueness(private_ike_sa_manager_t *this, ike_sa_t *ike_sa)
}
}
lock->unlock(lock);
-
+
if (!duplicate_ids)
{
return FALSE;
}
-
+
enumerator = duplicate_ids->create_enumerator(duplicate_ids);
while (enumerator->enumerate(enumerator, &duplicate_id))
{
status_t status = SUCCESS;
ike_sa_t *duplicate;
-
+
duplicate = checkout(this, duplicate_id);
if (!duplicate)
{
@@ -1485,13 +1487,13 @@ static int get_half_open_count(private_ike_sa_manager_t *this, host_t *ip)
chunk_t addr = ip->get_address(ip);
u_int row = chunk_hash(addr) & this->table_mask;
u_int segment = row & this->segment_mask;
-
+
rwlock_t *lock = this->half_open_segments[segment & this->segment_mask].lock;
lock->read_lock(lock);
if ((list = this->half_open_table[row]) != NULL)
{
half_open_t *current;
-
+
if (list->find_first(list, (linked_list_match_t)half_open_match,
(void**)&current, &addr) == SUCCESS)
{
@@ -1503,7 +1505,7 @@ static int get_half_open_count(private_ike_sa_manager_t *this, host_t *ip)
else
{
u_int segment;
-
+
for (segment = 0; segment < this->segment_count; ++segment)
{
rwlock_t *lock;
@@ -1513,7 +1515,7 @@ static int get_half_open_count(private_ike_sa_manager_t *this, host_t *ip)
lock->unlock(lock);
}
}
-
+
return count;
}
@@ -1526,7 +1528,7 @@ static void flush(private_ike_sa_manager_t *this)
enumerator_t *enumerator;
entry_t *entry;
u_int segment;
-
+
lock_all_segments(this);
DBG2(DBG_MGR, "going to destroy IKE_SA manager and all managed IKE_SA's");
/* Step 1: drive out all waiting threads */
@@ -1536,7 +1538,7 @@ static void flush(private_ike_sa_manager_t *this)
{
/* do not accept new threads, drive out waiting threads */
entry->driveout_new_threads = TRUE;
- entry->driveout_waiting_threads = TRUE;
+ entry->driveout_waiting_threads = TRUE;
}
enumerator->destroy(enumerator);
DBG2(DBG_MGR, "wait for all threads to leave IKE_SA's");
@@ -1573,7 +1575,7 @@ static void flush(private_ike_sa_manager_t *this)
entry->ike_sa->delete(entry->ike_sa);
}
enumerator->destroy(enumerator);
-
+
DBG2(DBG_MGR, "destroy all entries");
/* Step 4: destroy all entries */
enumerator = create_table_enumerator(this);
@@ -1633,7 +1635,7 @@ static void destroy(private_ike_sa_manager_t *this)
free(this->segments);
free(this->half_open_segments);
free(this->connected_peers_segments);
-
+
this->rng->destroy(this->rng);
this->hasher->destroy(this->hasher);
free(this);
@@ -1648,7 +1650,7 @@ static void destroy(private_ike_sa_manager_t *this)
static u_int get_nearest_powerof2(u_int n)
{
u_int i;
-
+
--n;
for (i = 1; i < sizeof(u_int) * 8; i <<= 1)
{
@@ -1679,7 +1681,7 @@ ike_sa_manager_t *ike_sa_manager_create()
this->public.checkin = (void(*)(ike_sa_manager_t*,ike_sa_t*))checkin;
this->public.checkin_and_destroy = (void(*)(ike_sa_manager_t*,ike_sa_t*))checkin_and_destroy;
this->public.get_half_open_count = (int(*)(ike_sa_manager_t*,host_t*))get_half_open_count;
-
+
/* initialize private variables */
this->hasher = lib->crypto->create_hasher(lib->crypto, HASH_PREFERRED);
if (this->hasher == NULL)
@@ -1700,21 +1702,21 @@ ike_sa_manager_t *ike_sa_manager_create()
"charon.ikesa_table_size", DEFAULT_HASHTABLE_SIZE));
this->table_size = max(1, min(this->table_size, MAX_HASHTABLE_SIZE));
this->table_mask = this->table_size - 1;
-
+
this->segment_count = get_nearest_powerof2(lib->settings->get_int(lib->settings,
"charon.ikesa_table_segments", DEFAULT_SEGMENT_COUNT));
this->segment_count = max(1, min(this->segment_count, this->table_size));
this->segment_mask = this->segment_count - 1;
-
+
this->ike_sa_table = calloc(this->table_size, sizeof(linked_list_t*));
-
+
this->segments = (segment_t*)calloc(this->segment_count, sizeof(segment_t));
for (i = 0; i < this->segment_count; ++i)
{
this->segments[i].mutex = mutex_create(MUTEX_TYPE_RECURSIVE);
this->segments[i].count = 0;
}
-
+
/* we use the same table parameters for the table to track half-open SAs */
this->half_open_table = calloc(this->table_size, sizeof(linked_list_t*));
this->half_open_segments = calloc(this->segment_count, sizeof(shareable_segment_t));
@@ -1723,7 +1725,7 @@ ike_sa_manager_t *ike_sa_manager_create()
this->half_open_segments[i].lock = rwlock_create(RWLOCK_TYPE_DEFAULT);
this->half_open_segments[i].count = 0;
}
-
+
/* also for the hash table used for duplicate tests */
this->connected_peers_table = calloc(this->table_size, sizeof(linked_list_t*));
this->connected_peers_segments = calloc(this->segment_count, sizeof(shareable_segment_t));
@@ -1732,7 +1734,7 @@ ike_sa_manager_t *ike_sa_manager_create()
this->connected_peers_segments[i].lock = rwlock_create(RWLOCK_TYPE_DEFAULT);
this->connected_peers_segments[i].count = 0;
}
-
+
this->reuse_ikesa = lib->settings->get_bool(lib->settings,
"charon.reuse_ikesa", TRUE);
return &this->public;
diff --git a/src/charon/sa/ike_sa_manager.h b/src/charon/sa/ike_sa_manager.h
index 6da768080..38f5454e1 100644
--- a/src/charon/sa/ike_sa_manager.h
+++ b/src/charon/sa/ike_sa_manager.h
@@ -38,20 +38,20 @@ typedef struct ike_sa_manager_t ike_sa_manager_t;
* by the owning thread.
*/
struct ike_sa_manager_t {
-
+
/**
* Checkout an existing IKE_SA.
- *
+ *
* @param ike_sa_id the SA identifier, will be updated
- * @returns
+ * @returns
* - checked out IKE_SA if found
* - NULL, if specified IKE_SA is not found.
*/
ike_sa_t* (*checkout) (ike_sa_manager_t* this, ike_sa_id_t *sa_id);
-
+
/**
* Create and check out a new IKE_SA.
- *
+ *
* @note If initiator equals FALSE, the returned IKE_SA is not registered
* in the manager.
*
@@ -59,30 +59,30 @@ struct ike_sa_manager_t {
* @returns created and checked out IKE_SA
*/
ike_sa_t* (*checkout_new) (ike_sa_manager_t* this, bool initiator);
-
+
/**
* Checkout an IKE_SA by a message.
- *
+ *
* In some situations, it is necessary that the manager knows the
* message to use for the checkout. This has the following reasons:
- *
+ *
* 1. If the targeted IKE_SA is already processing a message, we do not
* check it out if the message ID is the same.
- * 2. If it is an IKE_SA_INIT request, we have to check if it is a
+ * 2. If it is an IKE_SA_INIT request, we have to check if it is a
* retransmission. If so, we have to drop the message, we would
* create another unneeded IKE_SA for each retransmitted packet.
*
* A call to checkout_by_message() returns a (maybe new created) IKE_SA.
* If processing the message does not make sense (for the reasons above),
* NULL is returned.
- *
+ *
* @param ike_sa_id the SA identifier, will be updated
- * @returns
+ * @returns
* - checked out/created IKE_SA
* - NULL to not process message further
*/
ike_sa_t* (*checkout_by_message) (ike_sa_manager_t* this, message_t *message);
-
+
/**
* Checkout an IKE_SA for initiation by a peer_config.
*
@@ -97,27 +97,27 @@ struct ike_sa_manager_t {
* @return checked out/created IKE_SA
*/
ike_sa_t* (*checkout_by_config) (ike_sa_manager_t* this,
- peer_cfg_t *peer_cfg);
-
+ peer_cfg_t *peer_cfg);
+
/**
* Check for duplicates of the given IKE_SA.
- *
+ *
* Measures are taken according to the uniqueness policy of the IKE_SA.
* The return value indicates whether duplicates have been found and if
* further measures should be taken (e.g. cancelling an IKE_AUTH exchange).
* check_uniqueness() must be called before the IKE_SA is complete,
* deadlocks occur otherwise.
- *
+ *
* @param ike_sa ike_sa to check
* @return TRUE, if the given IKE_SA has duplicates and
* should be deleted
*/
bool (*check_uniqueness)(ike_sa_manager_t *this, ike_sa_t *ike_sa);
-
+
/**
* Check out an IKE_SA a unique ID.
*
- * Every IKE_SA and every CHILD_SA is uniquely identified by an ID.
+ * Every IKE_SA and every CHILD_SA is uniquely identified by an ID.
* These checkout function uses, depending
* on the child parameter, the unique ID of the IKE_SA or the reqid
* of one of a IKE_SAs CHILD_SA.
@@ -130,7 +130,7 @@ struct ike_sa_manager_t {
*/
ike_sa_t* (*checkout_by_id) (ike_sa_manager_t* this, u_int32_t id,
bool child);
-
+
/**
* Check out an IKE_SA by the policy/connection name.
*
@@ -145,7 +145,7 @@ struct ike_sa_manager_t {
*/
ike_sa_t* (*checkout_by_name) (ike_sa_manager_t* this, char *name,
bool child);
-
+
/**
* Create an enumerator over all stored IKE_SAs.
*
@@ -155,7 +155,7 @@ struct ike_sa_manager_t {
* @return enumerator over all IKE_SAs.
*/
enumerator_t *(*create_enumerator) (ike_sa_manager_t* this);
-
+
/**
* Checkin the SA after usage.
*
@@ -165,7 +165,7 @@ struct ike_sa_manager_t {
* @param ike_sa checked out SA
*/
void (*checkin) (ike_sa_manager_t* this, ike_sa_t *ike_sa);
-
+
/**
* Destroy a checked out SA.
*
@@ -179,7 +179,7 @@ struct ike_sa_manager_t {
* @param ike_sa SA to delete
*/
void (*checkin_and_destroy) (ike_sa_manager_t* this, ike_sa_t *ike_sa);
-
+
/**
* Get the number of IKE_SAs which are in the connecting state.
*
@@ -189,19 +189,19 @@ struct ike_sa_manager_t {
* If a host is supplied, only the number of half open IKE_SAs initiated
* from this IP are counted.
* Only SAs for which we are the responder are counted.
- *
+ *
* @param ip NULL for all, IP for half open IKE_SAs with IP
* @return number of half open IKE_SAs
*/
int (*get_half_open_count) (ike_sa_manager_t *this, host_t *ip);
-
+
/**
* Delete all existing IKE_SAs and destroy them immediately.
- *
+ *
* Threads will be driven out, so all SAs can be deleted cleanly.
*/
void (*flush)(ike_sa_manager_t *this);
-
+
/**
* Destroys the manager with all associated SAs.
*
@@ -212,7 +212,7 @@ struct ike_sa_manager_t {
/**
* Create the IKE_SA manager.
- *
+ *
* @returns ike_sa_manager_t object, NULL if initialization fails
*/
ike_sa_manager_t *ike_sa_manager_create(void);
diff --git a/src/charon/sa/keymat.c b/src/charon/sa/keymat.c
index 46fb79587..e49626354 100644
--- a/src/charon/sa/keymat.c
+++ b/src/charon/sa/keymat.c
@@ -24,52 +24,52 @@ typedef struct private_keymat_t private_keymat_t;
* Private data of an keymat_t object.
*/
struct private_keymat_t {
-
+
/**
* Public keymat_t interface.
*/
keymat_t public;
-
+
/**
- * IKE_SA Role, initiator or responder
- */
- bool initiator;
-
+ * IKE_SA Role, initiator or responder
+ */
+ bool initiator;
+
/**
* inbound signer (verify)
*/
signer_t *signer_in;
-
+
/**
* outbound signer (sign)
*/
signer_t *signer_out;
-
+
/**
* inbound crypter (decrypt)
*/
crypter_t *crypter_in;
-
+
/**
* outbound crypter (encrypt)
*/
crypter_t *crypter_out;
-
+
/**
* General purpose PRF
*/
prf_t *prf;
-
+
/**
* Negotiated PRF algorithm
*/
pseudo_random_function_t prf_alg;
-
+
/**
* Key to derive key material from for CHILD_SAs, rekeying
*/
chunk_t skd;
-
+
/**
* Key to build outging authentication data (SKp)
*/
@@ -110,6 +110,7 @@ keylen_entry_t keylen_enc[] = {
keylen_entry_t keylen_int[] = {
{AUTH_HMAC_MD5_96, 128},
{AUTH_HMAC_SHA1_96, 160},
+ {AUTH_HMAC_SHA2_256_96, 256},
{AUTH_HMAC_SHA2_256_128, 256},
{AUTH_HMAC_SHA2_384_192, 384},
{AUTH_HMAC_SHA2_512_256, 512},
@@ -158,15 +159,15 @@ static bool derive_ike_keys(private_keymat_t *this, proposal_t *proposal,
prf_plus_t *prf_plus;
u_int16_t alg, key_size;
prf_t *rekey_prf = NULL;
-
+
spi_i = chunk_alloca(sizeof(u_int64_t));
spi_r = chunk_alloca(sizeof(u_int64_t));
-
+
if (dh->get_shared_secret(dh, &secret) != SUCCESS)
{
return FALSE;
}
-
+
/* Create SAs general purpose PRF first, we may use it here */
if (!proposal->get_algorithm(proposal, PSEUDO_RANDOM_FUNCTION, &alg, NULL))
{
@@ -206,8 +207,8 @@ static bool derive_ike_keys(private_keymat_t *this, proposal_t *proposal,
*((u_int64_t*)spi_i.ptr) = id->get_initiator_spi(id);
*((u_int64_t*)spi_r.ptr) = id->get_responder_spi(id);
prf_plus_seed = chunk_cat("ccc", full_nonce, spi_i, spi_r);
-
- /* KEYMAT = prf+ (SKEYSEED, Ni | Nr | SPIi | SPIr)
+
+ /* KEYMAT = prf+ (SKEYSEED, Ni | Nr | SPIi | SPIr)
*
* if we are rekeying, SKEYSEED is built on another way
*/
@@ -221,7 +222,7 @@ static bool derive_ike_keys(private_keymat_t *this, proposal_t *proposal,
}
else
{
- /* SKEYSEED = prf(SK_d (old), [g^ir (new)] | Ni | Nr)
+ /* SKEYSEED = prf(SK_d (old), [g^ir (new)] | Ni | Nr)
* use OLD SAs PRF functions for both prf_plus and prf */
rekey_prf = lib->crypto->create_prf(lib->crypto, rekey_function);
if (!rekey_prf)
@@ -240,20 +241,20 @@ static bool derive_ike_keys(private_keymat_t *this, proposal_t *proposal,
prf_plus = prf_plus_create(rekey_prf, prf_plus_seed);
}
DBG4(DBG_IKE, "SKEYSEED %B", &skeyseed);
-
+
chunk_clear(&skeyseed);
chunk_clear(&secret);
chunk_free(&full_nonce);
chunk_free(&fixed_nonce);
chunk_clear(&prf_plus_seed);
-
+
/* KEYMAT = SK_d | SK_ai | SK_ar | SK_ei | SK_er | SK_pi | SK_pr */
-
+
/* SK_d is used for generating CHILD_SA key mat => store for later use */
key_size = this->prf->get_key_size(this->prf);
prf_plus->allocate_bytes(prf_plus, key_size, &this->skd);
DBG4(DBG_IKE, "Sk_d secret %B", &this->skd);
-
+
/* SK_ai/SK_ar used for integrity protection => signer_in/signer_out */
if (!proposal->get_algorithm(proposal, INTEGRITY_ALGORITHM, &alg, NULL))
{
@@ -275,17 +276,17 @@ static bool derive_ike_keys(private_keymat_t *this, proposal_t *proposal,
return FALSE;
}
key_size = signer_i->get_key_size(signer_i);
-
+
prf_plus->allocate_bytes(prf_plus, key_size, &key);
DBG4(DBG_IKE, "Sk_ai secret %B", &key);
signer_i->set_key(signer_i, key);
chunk_clear(&key);
-
+
prf_plus->allocate_bytes(prf_plus, key_size, &key);
DBG4(DBG_IKE, "Sk_ar secret %B", &key);
signer_r->set_key(signer_r, key);
chunk_clear(&key);
-
+
if (this->initiator)
{
this->signer_in = signer_r;
@@ -296,7 +297,7 @@ static bool derive_ike_keys(private_keymat_t *this, proposal_t *proposal,
this->signer_in = signer_i;
this->signer_out = signer_r;
}
-
+
/* SK_ei/SK_er used for encryption => crypter_in/crypter_out */
if (!proposal->get_algorithm(proposal, ENCRYPTION_ALGORITHM, &alg, &key_size))
{
@@ -318,17 +319,17 @@ static bool derive_ike_keys(private_keymat_t *this, proposal_t *proposal,
return FALSE;
}
key_size = crypter_i->get_key_size(crypter_i);
-
+
prf_plus->allocate_bytes(prf_plus, key_size, &key);
DBG4(DBG_IKE, "Sk_ei secret %B", &key);
crypter_i->set_key(crypter_i, key);
chunk_clear(&key);
-
+
prf_plus->allocate_bytes(prf_plus, key_size, &key);
DBG4(DBG_IKE, "Sk_er secret %B", &key);
crypter_r->set_key(crypter_r, key);
chunk_clear(&key);
-
+
if (this->initiator)
{
this->crypter_in = crypter_r;
@@ -339,8 +340,8 @@ static bool derive_ike_keys(private_keymat_t *this, proposal_t *proposal,
this->crypter_in = crypter_i;
this->crypter_out = crypter_r;
}
-
- /* SK_pi/SK_pr used for authentication => stored for later */
+
+ /* SK_pi/SK_pr used for authentication => stored for later */
key_size = this->prf->get_key_size(this->prf);
prf_plus->allocate_bytes(prf_plus, key_size, &key);
DBG4(DBG_IKE, "Sk_pi secret %B", &key);
@@ -362,11 +363,11 @@ static bool derive_ike_keys(private_keymat_t *this, proposal_t *proposal,
{
this->skp_build = key;
}
-
+
/* all done, prf_plus not needed anymore */
prf_plus->destroy(prf_plus);
DESTROY_IF(rekey_prf);
-
+
return TRUE;
}
@@ -382,7 +383,7 @@ static bool derive_child_keys(private_keymat_t *this,
u_int16_t enc_alg, int_alg, enc_size = 0, int_size = 0;
chunk_t seed, secret = chunk_empty;
prf_plus_t *prf_plus;
-
+
if (dh)
{
if (dh->get_shared_secret(dh, &secret) != SUCCESS)
@@ -393,13 +394,13 @@ static bool derive_child_keys(private_keymat_t *this,
}
seed = chunk_cata("mcc", secret, nonce_i, nonce_r);
DBG4(DBG_CHD, "seed %B", &seed);
-
+
if (proposal->get_algorithm(proposal, ENCRYPTION_ALGORITHM,
&enc_alg, &enc_size))
{
- DBG2(DBG_CHD, " using %N for encryption",
+ DBG2(DBG_CHD, " using %N for encryption",
encryption_algorithm_names, enc_alg);
-
+
if (!enc_size)
{
enc_size = lookup_keylen(keylen_enc, enc_alg);
@@ -412,7 +413,7 @@ static bool derive_child_keys(private_keymat_t *this,
}
/* to bytes */
enc_size /= 8;
-
+
/* CCM/GCM/CTR needs additional bytes */
switch (enc_alg)
{
@@ -434,13 +435,13 @@ static bool derive_child_keys(private_keymat_t *this,
break;
}
}
-
+
if (proposal->get_algorithm(proposal, INTEGRITY_ALGORITHM,
&int_alg, &int_size))
{
DBG2(DBG_CHD, " using %N for integrity",
integrity_algorithm_names, int_alg);
-
+
if (!int_size)
{
int_size = lookup_keylen(keylen_int, int_alg);
@@ -454,17 +455,17 @@ static bool derive_child_keys(private_keymat_t *this,
/* to bytes */
int_size /= 8;
}
-
+
this->prf->set_key(this->prf, this->skd);
prf_plus = prf_plus_create(this->prf, seed);
-
+
prf_plus->allocate_bytes(prf_plus, enc_size, encr_i);
prf_plus->allocate_bytes(prf_plus, int_size, integ_i);
prf_plus->allocate_bytes(prf_plus, enc_size, encr_r);
prf_plus->allocate_bytes(prf_plus, int_size, integ_r);
-
+
prf_plus->destroy(prf_plus);
-
+
if (enc_size)
{
DBG4(DBG_CHD, "encryption initiator key %B", encr_i);
@@ -512,19 +513,19 @@ static chunk_t get_auth_octets(private_keymat_t *this, bool verify,
{
chunk_t chunk, idx, octets;
chunk_t skp;
-
+
skp = verify ? this->skp_verify : this->skp_build;
-
+
chunk = chunk_alloca(4);
memset(chunk.ptr, 0, chunk.len);
chunk.ptr[0] = id->get_type(id);
idx = chunk_cata("cc", chunk, id->get_encoding(id));
-
+
DBG3(DBG_IKE, "IDx' %B", &idx);
DBG3(DBG_IKE, "SK_p %B", &skp);
this->prf->set_key(this->prf, skp);
this->prf->allocate_bytes(this->prf, idx, &chunk);
-
+
octets = chunk_cat("ccm", ike_sa_init, nonce, chunk);
DBG3(DBG_IKE, "octets = message + nonce + prf(Sk_px, IDx') %B", &octets);
return octets;
@@ -539,12 +540,12 @@ static chunk_t get_auth_octets(private_keymat_t *this, bool verify,
/**
* Implementation of keymat_t.get_psk_sig
*/
-static chunk_t get_psk_sig(private_keymat_t *this, bool verify,
+static chunk_t get_psk_sig(private_keymat_t *this, bool verify,
chunk_t ike_sa_init, chunk_t nonce, chunk_t secret,
identification_t *id)
{
chunk_t key_pad, key, sig, octets;
-
+
if (!secret.len)
{ /* EAP uses SK_p if no MSK has been established */
secret = verify ? this->skp_verify : this->skp_build;
@@ -561,7 +562,7 @@ static chunk_t get_psk_sig(private_keymat_t *this, bool verify,
DBG3(DBG_IKE, "AUTH = prf(prf(secret, keypad), octets) %B", &sig);
chunk_free(&octets);
chunk_free(&key);
-
+
return sig;
}
@@ -587,7 +588,7 @@ static void destroy(private_keymat_t *this)
keymat_t *keymat_create(bool initiator)
{
private_keymat_t *this = malloc_thing(private_keymat_t);
-
+
this->public.create_dh = (diffie_hellman_t*(*)(keymat_t*, diffie_hellman_group_t group))create_dh;
this->public.derive_ike_keys = (bool(*)(keymat_t*, proposal_t *proposal, diffie_hellman_t *dh, chunk_t nonce_i, chunk_t nonce_r, ike_sa_id_t *id, pseudo_random_function_t,chunk_t))derive_ike_keys;
this->public.derive_child_keys = (bool(*)(keymat_t*, proposal_t *proposal, diffie_hellman_t *dh, chunk_t nonce_i, chunk_t nonce_r, chunk_t *encr_i, chunk_t *integ_i, chunk_t *encr_r, chunk_t *integ_r))derive_child_keys;
@@ -597,9 +598,9 @@ keymat_t *keymat_create(bool initiator)
this->public.get_auth_octets = (chunk_t(*)(keymat_t *, bool verify, chunk_t ike_sa_init, chunk_t nonce, identification_t *id))get_auth_octets;
this->public.get_psk_sig = (chunk_t(*)(keymat_t*, bool verify, chunk_t ike_sa_init, chunk_t nonce, chunk_t secret, identification_t *id))get_psk_sig;
this->public.destroy = (void(*)(keymat_t*))destroy;
-
+
this->initiator = initiator;
-
+
this->signer_in = NULL;
this->signer_out = NULL;
this->crypter_in = NULL;
@@ -609,7 +610,7 @@ keymat_t *keymat_create(bool initiator)
this->skd = chunk_empty;
this->skp_verify = chunk_empty;
this->skp_build = chunk_empty;
-
+
return &this->public;
}
diff --git a/src/charon/sa/keymat.h b/src/charon/sa/keymat.h
index 43b9dd113..e51709e8d 100644
--- a/src/charon/sa/keymat.h
+++ b/src/charon/sa/keymat.h
@@ -35,7 +35,7 @@ typedef struct keymat_t keymat_t;
* Derivation an management of sensitive keying material.
*/
struct keymat_t {
-
+
/**
* Create a diffie hellman object for key agreement.
*
@@ -47,7 +47,7 @@ struct keymat_t {
* @return DH object, NULL if group not supported
*/
diffie_hellman_t* (*create_dh)(keymat_t *this, diffie_hellman_group_t group);
-
+
/**
* Derive keys for the IKE_SA.
*
@@ -86,7 +86,7 @@ struct keymat_t {
* @param integ_r chunk to write responders integrity key to
* @return TRUE on success
*/
- bool (*derive_child_keys)(keymat_t *this,
+ bool (*derive_child_keys)(keymat_t *this,
proposal_t *proposal, diffie_hellman_t *dh,
chunk_t nonce_i, chunk_t nonce_r,
chunk_t *encr_i, chunk_t *integ_i,
@@ -98,7 +98,7 @@ struct keymat_t {
* @return PRF function to derive keymat
*/
pseudo_random_function_t (*get_skd)(keymat_t *this, chunk_t *skd);
-
+
/**
* Get a signer to sign/verify IKE messages.
*
@@ -106,7 +106,7 @@ struct keymat_t {
* @return signer
*/
signer_t* (*get_signer)(keymat_t *this, bool in);
-
+
/*
* Get a crypter to en-/decrypt IKE messages.
*
@@ -114,7 +114,7 @@ struct keymat_t {
* @return crypter
*/
crypter_t* (*get_crypter)(keymat_t *this, bool in);
-
+
/**
* Generate octets to use for authentication procedure (RFC4306 2.15).
*
@@ -160,4 +160,4 @@ struct keymat_t {
*/
keymat_t *keymat_create(bool initiator);
-#endif /** KEYMAT_ @}*/
+#endif /** KEYMAT_H_ @}*/
diff --git a/src/charon/sa/mediation_manager.c b/src/charon/sa/mediation_manager.c
index a69c00173..035f49053 100644
--- a/src/charon/sa/mediation_manager.c
+++ b/src/charon/sa/mediation_manager.c
@@ -16,11 +16,10 @@
#include "mediation_manager.h"
#include <daemon.h>
-#include <utils/mutex.h>
+#include <threading/mutex.h>
#include <utils/linked_list.h>
#include <processing/jobs/mediation_job.h>
-
typedef struct peer_t peer_t;
/**
@@ -28,13 +27,13 @@ typedef struct peer_t peer_t;
*/
struct peer_t {
/** id of the peer */
- identification_t *id;
+ identification_t *id;
/** sa id of the peer, NULL if offline */
- ike_sa_id_t *ike_sa_id;
-
- /** list of peer ids that reuested this peer */
- linked_list_t *requested_by;
+ ike_sa_id_t *ike_sa_id;
+
+ /** list of peer ids that reuested this peer */
+ linked_list_t *requested_by;
};
/**
@@ -43,8 +42,9 @@ struct peer_t {
static void peer_destroy(peer_t *this)
{
DESTROY_IF(this->id);
- DESTROY_IF(this->ike_sa_id);
- this->requested_by->destroy_offset(this->requested_by, offsetof(identification_t, destroy));
+ DESTROY_IF(this->ike_sa_id);
+ this->requested_by->destroy_offset(this->requested_by,
+ offsetof(identification_t, destroy));
free(this);
}
@@ -54,16 +54,15 @@ static void peer_destroy(peer_t *this)
static peer_t *peer_create(identification_t *id, ike_sa_id_t* ike_sa_id)
{
peer_t *this = malloc_thing(peer_t);
-
+
/* clone everything */
this->id = id->clone(id);
- this->ike_sa_id = ike_sa_id ? ike_sa_id->clone(ike_sa_id) : NULL;
- this->requested_by = linked_list_create();
-
+ this->ike_sa_id = ike_sa_id ? ike_sa_id->clone(ike_sa_id) : NULL;
+ this->requested_by = linked_list_create();
+
return this;
}
-
typedef struct private_mediation_manager_t private_mediation_manager_t;
/**
@@ -74,7 +73,7 @@ struct private_mediation_manager_t {
* Public interface of mediation_manager_t.
*/
mediation_manager_t public;
-
+
/**
* Lock for exclusivly accessing the manager.
*/
@@ -93,7 +92,7 @@ static void register_peer(peer_t *peer, identification_t *peer_id)
{
iterator_t *iterator;
identification_t *current;
-
+
iterator = peer->requested_by->create_iterator(peer->requested_by, TRUE);
while (iterator->iterate(iterator, (void**)&current))
{
@@ -104,20 +103,21 @@ static void register_peer(peer_t *peer, identification_t *peer_id)
}
}
iterator->destroy(iterator);
-
- peer->requested_by->insert_last(peer->requested_by, peer_id->clone(peer_id));
+
+ peer->requested_by->insert_last(peer->requested_by,
+ peer_id->clone(peer_id));
}
/**
* Get a peer_t object by a peer's id
*/
static status_t get_peer_by_id(private_mediation_manager_t *this,
- identification_t *id, peer_t **peer)
+ identification_t *id, peer_t **peer)
{
iterator_t *iterator;
peer_t *current;
status_t status = NOT_FOUND;
-
+
iterator = this->peers->create_iterator(this->peers, TRUE);
while (iterator->iterate(iterator, (void**)&current))
{
@@ -141,7 +141,8 @@ static status_t get_peer_by_id(private_mediation_manager_t *this,
* and then remove peers completely that are not online and have no registered
* peers.
*/
-static void unregister_peer(private_mediation_manager_t *this, identification_t *peer_id)
+static void unregister_peer(private_mediation_manager_t *this,
+ identification_t *peer_id)
{
iterator_t *iterator, *iterator_r;
peer_t *peer;
@@ -150,7 +151,8 @@ static void unregister_peer(private_mediation_manager_t *this, identification_t
iterator = this->peers->create_iterator(this->peers, TRUE);
while (iterator->iterate(iterator, (void**)&peer))
{
- iterator_r = peer->requested_by->create_iterator(peer->requested_by, TRUE);
+ iterator_r = peer->requested_by->create_iterator(peer->requested_by,
+ TRUE);
while (iterator_r->iterate(iterator_r, (void**)&registered))
{
if (peer_id->equals(peer_id, registered))
@@ -161,7 +163,7 @@ static void unregister_peer(private_mediation_manager_t *this, identification_t
}
}
iterator_r->destroy(iterator_r);
-
+
if (!peer->ike_sa_id && !peer->requested_by->get_count(peer->requested_by))
{
iterator->remove(iterator);
@@ -181,16 +183,16 @@ static void remove_sa(private_mediation_manager_t *this, ike_sa_id_t *ike_sa_id)
peer_t *peer;
this->mutex->lock(this->mutex);
-
+
iterator = this->peers->create_iterator(this->peers, TRUE);
while (iterator->iterate(iterator, (void**)&peer))
{
if (ike_sa_id->equals(ike_sa_id, peer->ike_sa_id))
{
iterator->remove(iterator);
-
+
unregister_peer(this, peer->id);
-
+
peer_destroy(peer);
break;
}
@@ -222,7 +224,7 @@ static void update_sa_id(private_mediation_manager_t *this, identification_t *pe
}
}
iterator->destroy(iterator);
-
+
if (!found)
{
DBG2(DBG_IKE, "adding peer '%Y'", peer_id);
@@ -230,18 +232,19 @@ static void update_sa_id(private_mediation_manager_t *this, identification_t *pe
this->peers->insert_last(this->peers, peer);
}
- DBG2(DBG_IKE, "changing registered IKE_SA ID of peer '%Y'", peer_id);
+ DBG2(DBG_IKE, "changing registered IKE_SA ID of peer '%Y'", peer_id);
peer->ike_sa_id = ike_sa_id ? ike_sa_id->clone(ike_sa_id) : NULL;
-
+
/* send callbacks to registered peers */
identification_t *requester;
- while(peer->requested_by->remove_last(peer->requested_by, (void**)&requester) == SUCCESS)
+ while(peer->requested_by->remove_last(peer->requested_by,
+ (void**)&requester) == SUCCESS)
{
job_t *job = (job_t*)mediation_callback_job_create(requester, peer_id);
charon->processor->queue_job(charon->processor, job);
requester->destroy(requester);
}
-
+
this->mutex->unlock(this->mutex);
}
@@ -286,11 +289,12 @@ static ike_sa_id_t *check_and_register(private_mediation_manager_t *this,
peer = peer_create(peer_id, NULL);
this->peers->insert_last(this->peers, peer);
}
-
+
if (!peer->ike_sa_id)
{
/* the peer is not online */
- DBG2(DBG_IKE, "requested peer '%Y' is offline, registering peer '%Y'", peer_id, requester);
+ DBG2(DBG_IKE, "requested peer '%Y' is offline, registering peer '%Y'",
+ peer_id, requester);
register_peer(peer, requester);
this->mutex->unlock(this->mutex);
return NULL;
@@ -309,9 +313,9 @@ static ike_sa_id_t *check_and_register(private_mediation_manager_t *this,
static void destroy(private_mediation_manager_t *this)
{
this->mutex->lock(this->mutex);
-
+
this->peers->destroy_function(this->peers, (void*)peer_destroy);
-
+
this->mutex->unlock(this->mutex);
this->mutex->destroy(this->mutex);
free(this);
@@ -329,9 +333,9 @@ mediation_manager_t *mediation_manager_create()
this->public.update_sa_id = (void(*)(mediation_manager_t*,identification_t*,ike_sa_id_t*))update_sa_id;
this->public.check = (ike_sa_id_t*(*)(mediation_manager_t*,identification_t*))check;
this->public.check_and_register = (ike_sa_id_t*(*)(mediation_manager_t*,identification_t*,identification_t*))check_and_register;
-
+
this->peers = linked_list_create();
this->mutex = mutex_create(MUTEX_TYPE_DEFAULT);
-
+
return (mediation_manager_t*)this;
}
diff --git a/src/charon/sa/mediation_manager.h b/src/charon/sa/mediation_manager.h
index 29e16d84f..31a16f69c 100644
--- a/src/charon/sa/mediation_manager.h
+++ b/src/charon/sa/mediation_manager.h
@@ -31,48 +31,49 @@ typedef struct mediation_manager_t mediation_manager_t;
* peers and registered requests for offline peers on the mediation server.
*/
struct mediation_manager_t {
-
+
/**
* Remove the IKE_SA of a peer.
- *
+ *
* @param ike_sa_id the IKE_SA ID of the peer's SA
*/
void (*remove) (mediation_manager_t* this, ike_sa_id_t *ike_sa_id);
-
+
/**
* Update the ike_sa_id that is assigned to a peer's ID. If the peer
- * is new, it gets a new record assigned.
- *
+ * is new, it gets a new record assigned.
+ *
* @param peer_id the peer's ID
* @param ike_sa_id the IKE_SA ID of the peer's SA
*/
void (*update_sa_id) (mediation_manager_t* this, identification_t *peer_id,
- ike_sa_id_t *ike_sa_id);
-
+ ike_sa_id_t *ike_sa_id);
+
/**
* Checks if a specific peer is online.
- *
+ *
* @param peer_id the peer's ID
- * @returns
- * - IKE_SA ID of the peer's SA.
- * - NULL, if the peer is not online.
+ * @returns
+ * - IKE_SA ID of the peer's SA.
+ * - NULL, if the peer is not online.
*/
ike_sa_id_t* (*check) (mediation_manager_t* this,
- identification_t *peer_id);
-
+ identification_t *peer_id);
+
/**
* Checks if a specific peer is online and registers the requesting
* peer if it is not.
- *
+ *
* @param peer_id the peer's ID
* @param requester the requesters ID
- * @returns
- * - IKE_SA ID of the peer's SA.
- * - NULL, if the peer is not online.
+ * @returns
+ * - IKE_SA ID of the peer's SA.
+ * - NULL, if the peer is not online.
*/
ike_sa_id_t* (*check_and_register) (mediation_manager_t* this,
- identification_t *peer_id, identification_t *requester);
-
+ identification_t *peer_id,
+ identification_t *requester);
+
/**
* Destroys the manager with all data.
*/
@@ -81,8 +82,8 @@ struct mediation_manager_t {
/**
* Create a manager.
- *
- * @returns mediation_manager_t object
+ *
+ * @returns mediation_manager_t object
*/
mediation_manager_t *mediation_manager_create(void);
diff --git a/src/charon/sa/task_manager.c b/src/charon/sa/task_manager.c
index f33fcd6d4..1de0c06f0 100644
--- a/src/charon/sa/task_manager.c
+++ b/src/charon/sa/task_manager.c
@@ -30,6 +30,7 @@
#include <sa/tasks/ike_delete.h>
#include <sa/tasks/ike_config.h>
#include <sa/tasks/ike_dpd.h>
+#include <sa/tasks/ike_vendor.h>
#include <sa/tasks/child_create.h>
#include <sa/tasks/child_rekey.h>
#include <sa/tasks/child_delete.h>
@@ -46,12 +47,12 @@ typedef struct exchange_t exchange_t;
* An exchange in the air, used do detect and handle retransmission
*/
struct exchange_t {
-
+
/**
* Message ID used for this transaction
*/
u_int32_t mid;
-
+
/**
* generated packet for retransmission
*/
@@ -64,17 +65,17 @@ typedef struct private_task_manager_t private_task_manager_t;
* private data of the task manager
*/
struct private_task_manager_t {
-
+
/**
* public functions
*/
task_manager_t public;
-
+
/**
* associated IKE_SA we are serving
*/
ike_sa_t *ike_sa;
-
+
/**
* Exchange we are currently handling as responder
*/
@@ -83,14 +84,14 @@ struct private_task_manager_t {
* Message ID of the exchange
*/
u_int32_t mid;
-
+
/**
* packet for retransmission
*/
packet_t *packet;
-
+
} responding;
-
+
/**
* Exchange we are currently handling as initiator
*/
@@ -99,7 +100,7 @@ struct private_task_manager_t {
* Message ID of the exchange
*/
u_int32_t mid;
-
+
/**
* how many times we have retransmitted so far
*/
@@ -109,33 +110,48 @@ struct private_task_manager_t {
* packet for retransmission
*/
packet_t *packet;
-
+
/**
* type of the initated exchange
*/
exchange_type_t type;
-
+
} initiating;
-
+
/**
* List of queued tasks not yet in action
*/
linked_list_t *queued_tasks;
-
+
/**
* List of active tasks, initiated by ourselve
*/
linked_list_t *active_tasks;
-
+
/**
* List of tasks initiated by peer
*/
linked_list_t *passive_tasks;
-
+
/**
- * the task manager has been reset
+ * the task manager has been reset
*/
bool reset;
+
+ /**
+ * Number of times we retransmit messages before giving up
+ */
+ u_int retransmit_tries;
+
+ /**
+ * Retransmission timeout
+ */
+ double retransmit_timeout;
+
+ /**
+ * Base to calculate retransmission timeout
+ */
+ double retransmit_base;
};
/**
@@ -143,7 +159,7 @@ struct private_task_manager_t {
*/
static void flush(private_task_manager_t *this)
{
- this->queued_tasks->destroy_offset(this->queued_tasks,
+ this->queued_tasks->destroy_offset(this->queued_tasks,
offsetof(task_t, destroy));
this->passive_tasks->destroy_offset(this->passive_tasks,
offsetof(task_t, destroy));
@@ -162,7 +178,7 @@ static bool activate_task(private_task_manager_t *this, task_type_t type)
iterator_t *iterator;
task_t *task;
bool found = FALSE;
-
+
iterator = this->queued_tasks->create_iterator(this->queued_tasks, TRUE);
while (iterator->iterate(iterator, (void**)&task))
{
@@ -192,7 +208,7 @@ static status_t retransmit(private_task_manager_t *this, u_int32_t message_id)
packet_t *packet;
task_t *task;
ike_mobike_t *mobike = NULL;
-
+
/* check if we are retransmitting a MOBIKE routability check */
iterator = this->active_tasks->create_iterator(this->active_tasks, TRUE);
while (iterator->iterate(iterator, (void*)&task))
@@ -211,10 +227,10 @@ static status_t retransmit(private_task_manager_t *this, u_int32_t message_id)
if (mobike == NULL)
{
- if (this->initiating.retransmitted <= RETRANSMIT_TRIES)
+ if (this->initiating.retransmitted <= this->retransmit_tries)
{
- timeout = (u_int32_t)(RETRANSMIT_TIMEOUT *
- pow(RETRANSMIT_BASE, this->initiating.retransmitted));
+ timeout = (u_int32_t)(this->retransmit_timeout * 1000.0 *
+ pow(this->retransmit_base, this->initiating.retransmitted));
}
else
{
@@ -226,13 +242,14 @@ static status_t retransmit(private_task_manager_t *this, u_int32_t message_id)
}
return DESTROY_ME;
}
-
+
if (this->initiating.retransmitted)
{
DBG1(DBG_IKE, "retransmit %d of request with message ID %d",
this->initiating.retransmitted, message_id);
}
packet = this->initiating.packet->clone(this->initiating.packet);
+ charon->sender->send(charon->sender, packet);
}
else
{ /* for routeability checks, we use a more aggressive behavior */
@@ -247,18 +264,15 @@ static status_t retransmit(private_task_manager_t *this, u_int32_t message_id)
charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
return DESTROY_ME;
}
-
+
if (this->initiating.retransmitted)
{
DBG1(DBG_IKE, "path probing attempt %d",
this->initiating.retransmitted);
}
- packet = this->initiating.packet->clone(this->initiating.packet);
- mobike->transmit(mobike, packet);
+ mobike->transmit(mobike, this->initiating.packet);
}
-
- charon->sender->send(charon->sender, packet);
-
+
this->initiating.retransmitted++;
job = (job_t*)retransmit_job_create(this->initiating.mid,
this->ike_sa->get_id(this->ike_sa));
@@ -279,14 +293,14 @@ static status_t build_request(private_task_manager_t *this)
host_t *me, *other;
status_t status;
exchange_type_t exchange = 0;
-
+
if (this->initiating.type != EXCHANGE_TYPE_UNDEFINED)
{
DBG2(DBG_IKE, "delaying task initiation, exchange in progress");
/* do not initiate if we already have a message in the air */
return SUCCESS;
}
-
+
if (this->active_tasks->get_count(this->active_tasks) == 0)
{
DBG2(DBG_IKE, "activating new tasks");
@@ -297,6 +311,7 @@ static status_t build_request(private_task_manager_t *this)
{
this->initiating.mid = 0;
exchange = IKE_SA_INIT;
+ activate_task(this, IKE_VENDOR);
activate_task(this, IKE_NATD);
activate_task(this, IKE_CERT_PRE);
#ifdef ME
@@ -402,17 +417,17 @@ static status_t build_request(private_task_manager_t *this)
}
iterator->destroy(iterator);
}
-
+
if (exchange == 0)
{
DBG2(DBG_IKE, "nothing to initiate");
/* nothing to do yet... */
return SUCCESS;
}
-
+
me = this->ike_sa->get_my_host(this->ike_sa);
other = this->ike_sa->get_other_host(this->ike_sa);
-
+
message = message_create();
message->set_message_id(message, this->initiating.mid);
message->set_source(message, me->clone(me));
@@ -420,7 +435,7 @@ static status_t build_request(private_task_manager_t *this)
message->set_exchange_type(message, exchange);
this->initiating.type = exchange;
this->initiating.retransmitted = 0;
-
+
iterator = this->active_tasks->create_iterator(this->active_tasks, TRUE);
while (iterator->iterate(iterator, (void*)&task))
{
@@ -450,10 +465,11 @@ static status_t build_request(private_task_manager_t *this)
}
}
iterator->destroy(iterator);
-
+
/* update exchange type if a task changed it */
this->initiating.type = message->get_exchange_type(message);
-
+
+ charon->bus->message(charon->bus, message, FALSE);
status = this->ike_sa->generate_message(this->ike_sa, message,
&this->initiating.packet);
if (status != SUCCESS)
@@ -465,10 +481,8 @@ static status_t build_request(private_task_manager_t *this)
charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
return DESTROY_ME;
}
-
- charon->bus->message(charon->bus, message, FALSE);
message->destroy(message);
-
+
return retransmit(this, this->initiating.mid);
}
@@ -480,7 +494,7 @@ static status_t process_response(private_task_manager_t *this,
{
iterator_t *iterator;
task_t *task;
-
+
if (message->get_exchange_type(message) != this->initiating.type)
{
DBG1(DBG_IKE, "received %N response, but expected %N",
@@ -489,7 +503,7 @@ static status_t process_response(private_task_manager_t *this,
charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
return DESTROY_ME;
}
-
+
/* catch if we get resetted while processing */
this->reset = FALSE;
iterator = this->active_tasks->create_iterator(this->active_tasks, TRUE);
@@ -521,15 +535,15 @@ static status_t process_response(private_task_manager_t *this,
this->reset = FALSE;
iterator->destroy(iterator);
return build_request(this);
- }
+ }
}
iterator->destroy(iterator);
-
+
this->initiating.mid++;
this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
this->initiating.packet->destroy(this->initiating.packet);
this->initiating.packet = NULL;
-
+
return build_request(this);
}
@@ -541,9 +555,9 @@ static void handle_collisions(private_task_manager_t *this, task_t *task)
iterator_t *iterator;
task_t *active;
task_type_t type;
-
+
type = task->get_type(task);
-
+
/* do we have to check */
if (type == IKE_REKEY || type == CHILD_REKEY ||
type == CHILD_DELETE || type == IKE_DELETE || type == IKE_REAUTH)
@@ -594,10 +608,10 @@ static status_t build_response(private_task_manager_t *this, message_t *request)
host_t *me, *other;
bool delete = FALSE;
status_t status;
-
+
me = request->get_destination(request);
other = request->get_source(request);
-
+
message = message_create();
message->set_exchange_type(message, request->get_exchange_type(request));
/* send response along the path the request came in */
@@ -605,7 +619,7 @@ static status_t build_response(private_task_manager_t *this, message_t *request)
message->set_destination(message, other->clone(other));
message->set_message_id(message, this->responding.mid);
message->set_request(message, FALSE);
-
+
iterator = this->passive_tasks->create_iterator(this->passive_tasks, TRUE);
while (iterator->iterate(iterator, (void*)&task))
{
@@ -633,27 +647,27 @@ static status_t build_response(private_task_manager_t *this, message_t *request)
}
}
iterator->destroy(iterator);
-
+
/* remove resonder SPI if IKE_SA_INIT failed */
if (delete && request->get_exchange_type(request) == IKE_SA_INIT)
{
ike_sa_id_t *id = this->ike_sa->get_id(this->ike_sa);
id->set_responder_spi(id, 0);
}
-
+
/* message complete, send it */
DESTROY_IF(this->responding.packet);
this->responding.packet = NULL;
+ charon->bus->message(charon->bus, message, FALSE);
status = this->ike_sa->generate_message(this->ike_sa, message,
&this->responding.packet);
- charon->bus->message(charon->bus, message, FALSE);
message->destroy(message);
if (status != SUCCESS)
{
charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
return DESTROY_ME;
}
-
+
charon->sender->send(charon->sender,
this->responding.packet->clone(this->responding.packet));
if (delete)
@@ -675,7 +689,7 @@ static status_t process_request(private_task_manager_t *this,
payload_t *payload;
notify_payload_t *notify;
delete_payload_t *delete;
-
+
if (this->passive_tasks->get_count(this->passive_tasks) == 0)
{ /* create tasks depending on request type, if not already some queued */
switch (message->get_exchange_type(message))
@@ -684,11 +698,13 @@ static status_t process_request(private_task_manager_t *this,
{
task = (task_t*)ike_init_create(this->ike_sa, FALSE, NULL);
this->passive_tasks->insert_last(this->passive_tasks, task);
+ task = (task_t*)ike_vendor_create(this->ike_sa, FALSE);
+ this->passive_tasks->insert_last(this->passive_tasks, task);
task = (task_t*)ike_natd_create(this->ike_sa, FALSE);
this->passive_tasks->insert_last(this->passive_tasks, task);
task = (task_t*)ike_cert_pre_create(this->ike_sa, FALSE);
this->passive_tasks->insert_last(this->passive_tasks, task);
-#ifdef ME
+#ifdef ME
task = (task_t*)ike_me_create(this->ike_sa, FALSE);
this->passive_tasks->insert_last(this->passive_tasks, task);
#endif /* ME */
@@ -737,7 +753,7 @@ static status_t process_request(private_task_manager_t *this,
}
}
enumerator->destroy(enumerator);
-
+
if (ts_found)
{
if (notify_found)
@@ -816,7 +832,7 @@ static status_t process_request(private_task_manager_t *this,
}
}
enumerator->destroy(enumerator);
-
+
if (task == NULL)
{
task = (task_t*)ike_dpd_create(FALSE);
@@ -835,7 +851,7 @@ static status_t process_request(private_task_manager_t *this,
break;
}
}
-
+
/* let the tasks process the message */
iterator = this->passive_tasks->create_iterator(this->passive_tasks, TRUE);
while (iterator->iterate(iterator, (void*)&task))
@@ -863,7 +879,7 @@ static status_t process_request(private_task_manager_t *this,
}
}
iterator->destroy(iterator);
-
+
return build_response(this, message);
}
@@ -873,7 +889,7 @@ static status_t process_request(private_task_manager_t *this,
static status_t process_message(private_task_manager_t *this, message_t *msg)
{
u_int32_t mid = msg->get_message_id(msg);
-
+
if (msg->get_request(msg))
{
if (mid == this->responding.mid)
@@ -890,9 +906,9 @@ static status_t process_message(private_task_manager_t *this, message_t *msg)
{
packet_t *clone;
host_t *me, *other;
-
+
DBG1(DBG_IKE, "received retransmit of request with ID %d, "
- "retransmitting response", mid);
+ "retransmitting response", mid);
clone = this->responding.packet->clone(this->responding.packet);
me = msg->get_destination(msg);
other = msg->get_source(msg);
@@ -935,7 +951,7 @@ static void queue_task(private_task_manager_t *this, task_t *task)
{ /* there is no need to queue more than one mobike task */
iterator_t *iterator;
task_t *current;
-
+
iterator = this->queued_tasks->create_iterator(this->queued_tasks, TRUE);
while (iterator->iterate(iterator, (void**)&current))
{
@@ -958,7 +974,7 @@ static void queue_task(private_task_manager_t *this, task_t *task)
static void adopt_tasks(private_task_manager_t *this, private_task_manager_t *other)
{
task_t *task;
-
+
/* move queued tasks from other to this */
while (other->queued_tasks->remove_last(other->queued_tasks,
(void**)&task) == SUCCESS)
@@ -984,7 +1000,7 @@ static void reset(private_task_manager_t *this,
u_int32_t initiate, u_int32_t respond)
{
task_t *task;
-
+
/* reset message counters and retransmit packets */
DESTROY_IF(this->responding.packet);
DESTROY_IF(this->initiating.packet);
@@ -999,7 +1015,7 @@ static void reset(private_task_manager_t *this,
this->responding.mid = respond;
}
this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
-
+
/* reset active tasks */
while (this->active_tasks->remove_last(this->active_tasks,
(void**)&task) == SUCCESS)
@@ -1007,7 +1023,7 @@ static void reset(private_task_manager_t *this,
task->migrate(task, this->ike_sa);
this->queued_tasks->insert_first(this->queued_tasks, task);
}
-
+
this->reset = TRUE;
}
@@ -1017,11 +1033,11 @@ static void reset(private_task_manager_t *this,
static void destroy(private_task_manager_t *this)
{
flush(this);
-
+
this->active_tasks->destroy(this->active_tasks);
this->queued_tasks->destroy(this->queued_tasks);
this->passive_tasks->destroy(this->passive_tasks);
-
+
DESTROY_IF(this->responding.packet);
DESTROY_IF(this->initiating.packet);
free(this);
@@ -1033,7 +1049,7 @@ static void destroy(private_task_manager_t *this)
task_manager_t *task_manager_create(ike_sa_t *ike_sa)
{
private_task_manager_t *this = malloc_thing(private_task_manager_t);
-
+
this->public.process_message = (status_t(*)(task_manager_t*,message_t*))process_message;
this->public.queue_task = (void(*)(task_manager_t*,task_t*))queue_task;
this->public.initiate = (status_t(*)(task_manager_t*))build_request;
@@ -1042,7 +1058,7 @@ task_manager_t *task_manager_create(ike_sa_t *ike_sa)
this->public.adopt_tasks = (void(*)(task_manager_t*,task_manager_t*))adopt_tasks;
this->public.busy = (bool(*)(task_manager_t*))busy;
this->public.destroy = (void(*)(task_manager_t*))destroy;
-
+
this->ike_sa = ike_sa;
this->responding.packet = NULL;
this->initiating.packet = NULL;
@@ -1053,6 +1069,14 @@ task_manager_t *task_manager_create(ike_sa_t *ike_sa)
this->active_tasks = linked_list_create();
this->passive_tasks = linked_list_create();
this->reset = FALSE;
-
+
+ this->retransmit_tries = lib->settings->get_int(lib->settings,
+ "charon.retransmit_tries", RETRANSMIT_TRIES);
+ this->retransmit_timeout = lib->settings->get_double(lib->settings,
+ "charon.retransmit_timeout", RETRANSMIT_TIMEOUT);
+ this->retransmit_base = lib->settings->get_double(lib->settings,
+ "charon.retransmit_base", RETRANSMIT_BASE);
+
return &this->public;
}
+
diff --git a/src/charon/sa/task_manager.h b/src/charon/sa/task_manager.h
index 9c3b2cc87..731ed4898 100644
--- a/src/charon/sa/task_manager.h
+++ b/src/charon/sa/task_manager.h
@@ -31,9 +31,9 @@ typedef struct task_manager_t task_manager_t;
#include <sa/tasks/task.h>
/**
- * First retransmit timeout in milliseconds.
+ * First retransmit timeout in seconds.
*/
-#define RETRANSMIT_TIMEOUT 4000
+#define RETRANSMIT_TIMEOUT 4.0
/**
* Base which is raised to the power of the retransmission try.
@@ -69,7 +69,7 @@ typedef struct task_manager_t task_manager_t;
* For the initial IKE_SA setup, several tasks are queued: One for the
* unauthenticated IKE_SA setup, one for authentication, one for CHILD_SA setup
* and maybe one for virtual IP assignement.
- * The task manager is also responsible for retransmission. It uses a backoff
+ * The task manager is also responsible for retransmission. It uses a backoff
* algorithm. The timeout is calculated using
* RETRANSMIT_TIMEOUT * (RETRANSMIT_BASE ** try).
* When try reaches RETRANSMIT_TRIES, retransmission is given up.
@@ -84,7 +84,7 @@ typedef struct task_manager_t task_manager_t;
4s * (1.8 ** 3) = 23s 47s
4s * (1.8 ** 4) = 42s 89s
4s * (1.8 ** 5) = 76s 165s
-
+
@endverbatim
* The peer is considered dead after 2min 45s when no reply comes in.
*/
@@ -92,10 +92,10 @@ struct task_manager_t {
/**
* Process an incoming message.
- *
+ *
* @param message message to add payloads to
* @return
- * - DESTROY_ME if IKE_SA must be closed
+ * - DESTROY_ME if IKE_SA must be closed
* - SUCCESS otherwise
*/
status_t (*process_message) (task_manager_t *this, message_t *message);
@@ -118,24 +118,24 @@ struct task_manager_t {
* A return value of INVALID_STATE means that the message was already
* acknowledged and has not to be retransmitted. A return value of SUCCESS
* means retransmission was required and the message has been resent.
- *
+ *
* @param message_id ID of the message to retransmit
* @return
- * - INVALID_STATE if retransmission not required
+ * - INVALID_STATE if retransmission not required
* - SUCCESS if retransmission sent
*/
status_t (*retransmit) (task_manager_t *this, u_int32_t message_id);
-
+
/**
* Migrate all tasks from other to this.
*
* To rekey or reestablish an IKE_SA completely, all queued or active
* tasks should get migrated to the new IKE_SA.
- *
+ *
* @param other manager which gives away its tasks
*/
void (*adopt_tasks) (task_manager_t *this, task_manager_t *other);
-
+
/**
* Reset message ID counters of the task manager.
*
@@ -149,14 +149,14 @@ struct task_manager_t {
* @param respond message ID to respond to exchanges (expect)
*/
void (*reset) (task_manager_t *this, u_int32_t initiate, u_int32_t respond);
-
+
/**
* Check if we are currently waiting for a reply.
*
* @return TRUE if we are waiting, FALSE otherwise
*/
bool (*busy) (task_manager_t *this);
-
+
/**
* Destroy the task_manager_t.
*/
diff --git a/src/charon/sa/tasks/child_create.c b/src/charon/sa/tasks/child_create.c
index 558938f2e..3f002f263 100644
--- a/src/charon/sa/tasks/child_create.c
+++ b/src/charon/sa/tasks/child_create.c
@@ -19,12 +19,14 @@
#include <daemon.h>
#include <crypto/diffie_hellman.h>
+#include <credentials/certificates/x509.h>
#include <encoding/payloads/sa_payload.h>
#include <encoding/payloads/ke_payload.h>
#include <encoding/payloads/ts_payload.h>
#include <encoding/payloads/nonce_payload.h>
#include <encoding/payloads/notify_payload.h>
#include <processing/jobs/delete_ike_sa_job.h>
+#include <processing/jobs/inactivity_job.h>
typedef struct private_child_create_t private_child_create_t;
@@ -33,132 +35,132 @@ typedef struct private_child_create_t private_child_create_t;
* Private members of a child_create_t task.
*/
struct private_child_create_t {
-
+
/**
* Public methods and task_t interface.
*/
child_create_t public;
-
+
/**
* Assigned IKE_SA.
*/
ike_sa_t *ike_sa;
-
+
/**
* Are we the initiator?
*/
bool initiator;
-
+
/**
* nonce chosen by us
*/
chunk_t my_nonce;
-
+
/**
* nonce chosen by peer
*/
chunk_t other_nonce;
-
+
/**
* config to create the CHILD_SA from
*/
child_cfg_t *config;
-
+
/**
* list of proposal candidates
*/
linked_list_t *proposals;
-
+
/**
* selected proposal to use for CHILD_SA
*/
proposal_t *proposal;
-
+
/**
* traffic selectors for initiators side
*/
linked_list_t *tsi;
-
+
/**
* traffic selectors for responders side
*/
linked_list_t *tsr;
-
+
/**
* source of triggering packet
*/
traffic_selector_t *packet_tsi;
-
+
/**
* destination of triggering packet
*/
traffic_selector_t *packet_tsr;
-
+
/**
* optional diffie hellman exchange
*/
diffie_hellman_t *dh;
-
+
/**
* group used for DH exchange
*/
diffie_hellman_group_t dh_group;
-
+
/**
* IKE_SAs keymat
*/
keymat_t *keymat;
-
+
/**
* mode the new CHILD_SA uses (transport/tunnel/beet)
*/
ipsec_mode_t mode;
-
+
/**
* IPComp transform to use
*/
ipcomp_transform_t ipcomp;
-
+
/**
* IPComp transform proposed or accepted by the other peer
*/
ipcomp_transform_t ipcomp_received;
-
+
/**
* Own allocated SPI
*/
u_int32_t my_spi;
-
+
/**
* SPI received in proposal
*/
u_int32_t other_spi;
-
+
/**
* Own allocated Compression Parameter Index (CPI)
*/
u_int16_t my_cpi;
-
+
/**
* Other Compression Parameter Index (CPI), received via IPCOMP_SUPPORTED
*/
u_int16_t other_cpi;
-
+
/**
* reqid to use if we are rekeying
*/
u_int32_t reqid;
-
+
/**
* CHILD_SA which gets established
*/
child_sa_t *child_sa;
-
+
/**
* successfully established the CHILD?
*/
bool established;
-
+
/**
* whether the CHILD_SA rekeys an existing one
*/
@@ -171,7 +173,7 @@ struct private_child_create_t {
static status_t get_nonce(message_t *message, chunk_t *nonce)
{
nonce_payload_t *payload;
-
+
payload = (nonce_payload_t*)message->get_payload(message, NONCE);
if (payload == NULL)
{
@@ -187,7 +189,7 @@ static status_t get_nonce(message_t *message, chunk_t *nonce)
static status_t generate_nonce(chunk_t *nonce)
{
rng_t *rng;
-
+
rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
if (!rng)
{
@@ -207,7 +209,7 @@ static bool ts_list_is_host(linked_list_t *list, host_t *host)
traffic_selector_t *ts;
bool is_host = TRUE;
iterator_t *iterator = list->create_iterator(list, TRUE);
-
+
while (is_host && iterator->iterate(iterator, (void**)&ts))
{
is_host = is_host && ts->is_host(ts, host);
@@ -223,8 +225,8 @@ static bool allocate_spi(private_child_create_t *this)
{
enumerator_t *enumerator;
proposal_t *proposal;
-
- /* TODO: allocate additional SPI for AH if we have such proposals */
+
+ /* TODO: allocate additional SPI for AH if we have such proposals */
this->my_spi = this->child_sa->alloc_spi(this->child_sa, PROTO_ESP);
if (this->my_spi)
{
@@ -247,6 +249,25 @@ static bool allocate_spi(private_child_create_t *this)
}
/**
+ * Schedule inactivity timeout for CHILD_SA with reqid, if enabled
+ */
+static void schedule_inactivity_timeout(private_child_create_t *this)
+{
+ u_int32_t timeout;
+ bool close_ike;
+
+ timeout = this->config->get_inactivity(this->config);
+ if (timeout)
+ {
+ close_ike = lib->settings->get_bool(lib->settings,
+ "charon.inactivity_close_ike", FALSE);
+ charon->scheduler->schedule_job(charon->scheduler, (job_t*)
+ inactivity_job_create(this->child_sa->get_reqid(this->child_sa),
+ timeout, close_ike), timeout);
+ }
+}
+
+/**
* Install a CHILD_SA for usage, return value:
* - FAILED: no acceptable proposal
* - INVALID_ARG: diffie hellman group inacceptable
@@ -260,7 +281,8 @@ static status_t select_and_install(private_child_create_t *this, bool no_dh)
chunk_t integ_i = chunk_empty, integ_r = chunk_empty;
linked_list_t *my_ts, *other_ts;
host_t *me, *other, *other_vip, *my_vip;
-
+ bool private;
+
if (this->proposals == NULL)
{
DBG1(DBG_IKE, "SA payload missing in message");
@@ -271,32 +293,33 @@ static status_t select_and_install(private_child_create_t *this, bool no_dh)
DBG1(DBG_IKE, "TS payloads missing in message");
return NOT_FOUND;
}
-
+
me = this->ike_sa->get_my_host(this->ike_sa);
other = this->ike_sa->get_other_host(this->ike_sa);
my_vip = this->ike_sa->get_virtual_ip(this->ike_sa, TRUE);
other_vip = this->ike_sa->get_virtual_ip(this->ike_sa, FALSE);
-
- this->proposal = this->config->select_proposal(this->config, this->proposals,
- no_dh);
+
+ private = this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN);
+ this->proposal = this->config->select_proposal(this->config,
+ this->proposals, no_dh, private);
if (this->proposal == NULL)
{
DBG1(DBG_IKE, "no acceptable proposal found");
return FAILED;
}
this->other_spi = this->proposal->get_spi(this->proposal);
-
+
if (!this->initiator && !allocate_spi(this))
{ /* responder has no SPI allocated yet */
DBG1(DBG_IKE, "allocating SPI failed");
return FAILED;
}
this->child_sa->set_proposal(this->child_sa, this->proposal);
-
+
if (!this->proposal->has_dh_group(this->proposal, this->dh_group))
{
u_int16_t group;
-
+
if (this->proposal->get_algorithm(this->proposal, DIFFIE_HELLMAN_GROUP,
&group, NULL))
{
@@ -312,7 +335,7 @@ static status_t select_and_install(private_child_create_t *this, bool no_dh)
return FAILED;
}
}
-
+
if (my_vip == NULL)
{
my_vip = me;
@@ -321,7 +344,7 @@ static status_t select_and_install(private_child_create_t *this, bool no_dh)
{
other_vip = other;
}
-
+
if (this->initiator)
{
nonce_i = this->my_nonce;
@@ -338,9 +361,9 @@ static status_t select_and_install(private_child_create_t *this, bool no_dh)
}
my_ts = this->config->get_traffic_selectors(this->config, TRUE, my_ts,
my_vip);
- other_ts = this->config->get_traffic_selectors(this->config, FALSE, other_ts,
+ other_ts = this->config->get_traffic_selectors(this->config, FALSE, other_ts,
other_vip);
-
+
if (my_ts->get_count(my_ts) == 0 || other_ts->get_count(other_ts) == 0)
{
my_ts->destroy_offset(my_ts, offsetof(traffic_selector_t, destroy));
@@ -348,7 +371,7 @@ static status_t select_and_install(private_child_create_t *this, bool no_dh)
DBG1(DBG_IKE, "no acceptable traffic selectors found");
return NOT_FOUND;
}
-
+
this->tsr->destroy_offset(this->tsr, offsetof(traffic_selector_t, destroy));
this->tsi->destroy_offset(this->tsi, offsetof(traffic_selector_t, destroy));
if (this->initiator)
@@ -361,7 +384,7 @@ static status_t select_and_install(private_child_create_t *this, bool no_dh)
this->tsr = my_ts;
this->tsi = other_ts;
}
-
+
if (!this->initiator)
{
/* check if requested mode is acceptable, downgrade if required */
@@ -394,13 +417,73 @@ static status_t select_and_install(private_child_create_t *this, bool no_dh)
break;
}
}
-
+
+ /* check for any certificate-based IP address block constraints */
+ if (this->mode == MODE_BEET || this->mode == MODE_TUNNEL)
+ {
+ auth_cfg_t *auth;
+ enumerator_t *auth_enum;
+ certificate_t *cert = NULL;
+
+ auth_enum = this->ike_sa->create_auth_cfg_enumerator(this->ike_sa, FALSE);
+ while (auth_enum->enumerate(auth_enum, &auth))
+ {
+ cert = auth->get(auth, AUTH_HELPER_SUBJECT_CERT);
+ if (cert)
+ {
+ break;
+ }
+ }
+ auth_enum->destroy(auth_enum);
+
+ if (cert && cert->get_type(cert) == CERT_X509)
+ {
+ x509_t *x509 = (x509_t*)cert;
+
+ if (x509->get_flags(x509) & X509_IP_ADDR_BLOCKS)
+ {
+ enumerator_t *enumerator, *block_enum;
+ traffic_selector_t *ts, *block_ts;
+
+ DBG1(DBG_IKE, "checking certificate-based traffic selector "
+ "constraints [RFC 3779]");
+ enumerator = other_ts->create_enumerator(other_ts);
+ while (enumerator->enumerate(enumerator, &ts))
+ {
+ bool contained = FALSE;
+
+ block_enum = x509->create_ipAddrBlock_enumerator(x509);
+ while (block_enum->enumerate(block_enum, &block_ts))
+ {
+ if (ts->is_contained_in(ts, block_ts))
+ {
+ DBG1(DBG_IKE, " TS %R is contained in address block"
+ " constraint %R", ts, block_ts);
+ contained = TRUE;
+ break;
+ }
+ }
+ block_enum->destroy(block_enum);
+
+ if (!contained)
+ {
+ DBG1(DBG_IKE, " TS %R is not contained in any"
+ " address block constraint", ts);
+ enumerator->destroy(enumerator);
+ return FAILED;
+ }
+ }
+ enumerator->destroy(enumerator);
+ }
+ }
+ }
+
this->child_sa->set_state(this->child_sa, CHILD_INSTALLING);
this->child_sa->set_ipcomp(this->child_sa, this->ipcomp);
this->child_sa->set_mode(this->child_sa, this->mode);
this->child_sa->set_protocol(this->child_sa,
this->proposal->get_protocol(this->proposal));
-
+
if (this->my_cpi == 0 || this->other_cpi == 0 || this->ipcomp == IPCOMP_NONE)
{
this->my_cpi = this->other_cpi = 0;
@@ -408,28 +491,28 @@ static status_t select_and_install(private_child_create_t *this, bool no_dh)
}
status_i = status_o = FAILED;
if (this->keymat->derive_child_keys(this->keymat, this->proposal,
- this->dh, nonce_i, nonce_r, &encr_i, &integ_i, &encr_r, &integ_r))
+ this->dh, nonce_i, nonce_r, &encr_i, &integ_i, &encr_r, &integ_r))
{
if (this->initiator)
{
status_i = this->child_sa->install(this->child_sa, encr_r, integ_r,
- this->my_spi, this->my_cpi, TRUE);
+ this->my_spi, this->my_cpi, TRUE, my_ts, other_ts);
status_o = this->child_sa->install(this->child_sa, encr_i, integ_i,
- this->other_spi, this->other_cpi, FALSE);
+ this->other_spi, this->other_cpi, FALSE, my_ts, other_ts);
}
else
{
status_i = this->child_sa->install(this->child_sa, encr_i, integ_i,
- this->my_spi, this->my_cpi, TRUE);
+ this->my_spi, this->my_cpi, TRUE, my_ts, other_ts);
status_o = this->child_sa->install(this->child_sa, encr_r, integ_r,
- this->other_spi, this->other_cpi, FALSE);
+ this->other_spi, this->other_cpi, FALSE, my_ts, other_ts);
}
}
chunk_clear(&integ_i);
chunk_clear(&integ_r);
chunk_clear(&encr_i);
chunk_clear(&encr_r);
-
+
if (status_i != SUCCESS || status_o != SUCCESS)
{
DBG1(DBG_IKE, "unable to install %s%s%sIPsec SA (SAD) in kernel",
@@ -438,21 +521,26 @@ static status_t select_and_install(private_child_create_t *this, bool no_dh)
(status_o != SUCCESS) ? "outbound " : "");
return FAILED;
}
-
+
status = this->child_sa->add_policies(this->child_sa, my_ts, other_ts);
if (status != SUCCESS)
- {
+ {
DBG1(DBG_IKE, "unable to install IPsec policies (SPD) in kernel");
return NOT_FOUND;
}
-
+
charon->bus->child_keys(charon->bus, this->child_sa, this->dh,
nonce_i, nonce_r);
-
+
/* add to IKE_SA, and remove from task */
this->child_sa->set_state(this->child_sa, CHILD_INSTALLED);
this->ike_sa->add_child_sa(this->ike_sa, this->child_sa);
this->established = TRUE;
+
+ if (!this->rekey)
+ { /* a rekeyed SA uses the same reqid, no need for a new job */
+ schedule_inactivity_timeout(this);
+ }
return SUCCESS;
}
@@ -476,7 +564,7 @@ static void build_payloads(private_child_create_t *this, message_t *message)
sa_payload = sa_payload_create_from_proposal(this->proposal);
}
message->add_payload(message, (payload_t*)sa_payload);
-
+
/* add nonce payload if not in IKE_AUTH */
if (message->get_exchange_type(message) == CREATE_CHILD_SA)
{
@@ -484,14 +572,14 @@ static void build_payloads(private_child_create_t *this, message_t *message)
nonce_payload->set_nonce(nonce_payload, this->my_nonce);
message->add_payload(message, (payload_t*)nonce_payload);
}
-
+
/* diffie hellman exchange, if PFS enabled */
if (this->dh)
{
ke_payload = ke_payload_create_from_diffie_hellman(this->dh);
message->add_payload(message, (payload_t*)ke_payload);
}
-
+
/* add TSi/TSr payloads */
ts_payload = ts_payload_create_from_traffic_selectors(TRUE, this->tsi);
message->add_payload(message, (payload_t*)ts_payload);
@@ -524,12 +612,12 @@ static void add_ipcomp_notify(private_child_create_t *this,
"IPComp disabled");
return;
}
-
+
this->my_cpi = this->child_sa->alloc_cpi(this->child_sa);
if (this->my_cpi)
{
this->ipcomp = ipcomp;
- message->add_notify(message, FALSE, IPCOMP_SUPPORTED,
+ message->add_notify(message, FALSE, IPCOMP_SUPPORTED,
chunk_cata("cc", chunk_from_thing(this->my_cpi),
chunk_from_thing(ipcomp)));
}
@@ -550,14 +638,22 @@ static void handle_notify(private_child_create_t *this, notify_payload_t *notify
this->mode = MODE_TRANSPORT;
break;
case USE_BEET_MODE:
- this->mode = MODE_BEET;
+ if (this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN))
+ { /* handle private use notify only if we know its meaning */
+ this->mode = MODE_BEET;
+ }
+ else
+ {
+ DBG1(DBG_IKE, "received a notify strongSwan uses for BEET "
+ "mode, but peer implementation unknown, skipped");
+ }
break;
case IPCOMP_SUPPORTED:
{
ipcomp_transform_t ipcomp;
u_int16_t cpi;
chunk_t data;
-
+
data = notify->get_notification_data(notify);
cpi = *(u_int16_t*)data.ptr;
ipcomp = (ipcomp_transform_t)(*(data.ptr + 2));
@@ -591,7 +687,7 @@ static void process_payloads(private_child_create_t *this, message_t *message)
sa_payload_t *sa_payload;
ke_payload_t *ke_payload;
ts_payload_t *ts_payload;
-
+
/* defaults to TUNNEL mode */
this->mode = MODE_TUNNEL;
@@ -620,7 +716,7 @@ static void process_payloads(private_child_create_t *this, message_t *message)
case TRAFFIC_SELECTOR_INITIATOR:
ts_payload = (ts_payload_t*)payload;
this->tsi = ts_payload->get_traffic_selectors(ts_payload);
- break;
+ break;
case TRAFFIC_SELECTOR_RESPONDER:
ts_payload = (ts_payload_t*)payload;
this->tsr = ts_payload->get_traffic_selectors(ts_payload);
@@ -642,7 +738,7 @@ static status_t build_i(private_child_create_t *this, message_t *message)
{
host_t *me, *other, *vip;
peer_cfg_t *peer_cfg;
-
+
switch (message->get_exchange_type(message))
{
case IKE_SA_INIT:
@@ -668,7 +764,7 @@ static status_t build_i(private_child_create_t *this, message_t *message)
default:
break;
}
-
+
if (this->reqid)
{
DBG0(DBG_IKE, "establishing CHILD_SA %s{%d}",
@@ -679,7 +775,7 @@ static status_t build_i(private_child_create_t *this, message_t *message)
DBG0(DBG_IKE, "establishing CHILD_SA %s",
this->config->get_name(this->config));
}
-
+
/* reuse virtual IP if we already have one */
me = this->ike_sa->get_virtual_ip(this->ike_sa, TRUE);
if (me == NULL)
@@ -691,7 +787,7 @@ static status_t build_i(private_child_create_t *this, message_t *message)
{
other = this->ike_sa->get_other_host(this->ike_sa);
}
-
+
/* check if we want a virtual IP, but don't have one */
peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
vip = peer_cfg->get_virtual_ip(peer_cfg);
@@ -708,9 +804,9 @@ static status_t build_i(private_child_create_t *this, message_t *message)
this->tsi = this->config->get_traffic_selectors(this->config, TRUE,
NULL, me);
}
- this->tsr = this->config->get_traffic_selectors(this->config, FALSE,
+ this->tsr = this->config->get_traffic_selectors(this->config, FALSE,
NULL, other);
-
+
if (this->packet_tsi)
{
this->tsi->insert_first(this->tsi,
@@ -724,37 +820,43 @@ static status_t build_i(private_child_create_t *this, message_t *message)
this->proposals = this->config->get_proposals(this->config,
this->dh_group == MODP_NONE);
this->mode = this->config->get_mode(this->config);
-
+ if (this->mode == MODE_TRANSPORT &&
+ this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY))
+ {
+ this->mode = MODE_TUNNEL;
+ DBG1(DBG_IKE, "not using transport mode, connection NATed");
+ }
+
this->child_sa = child_sa_create(this->ike_sa->get_my_host(this->ike_sa),
this->ike_sa->get_other_host(this->ike_sa), this->config, this->reqid,
this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY));
-
+
if (!allocate_spi(this))
{
DBG1(DBG_IKE, "unable to allocate SPIs from kernel");
return FAILED;
}
-
+
if (this->dh_group != MODP_NONE)
{
this->dh = this->keymat->create_dh(this->keymat, this->dh_group);
}
-
+
if (this->config->use_ipcomp(this->config))
{
/* IPCOMP_DEFLATE is the only transform we support at the moment */
add_ipcomp_notify(this, message, IPCOMP_DEFLATE);
}
-
+
build_payloads(this, message);
-
+
this->tsi->destroy_offset(this->tsi, offsetof(traffic_selector_t, destroy));
this->tsr->destroy_offset(this->tsr, offsetof(traffic_selector_t, destroy));
this->proposals->destroy_offset(this->proposals, offsetof(proposal_t, destroy));
this->tsi = NULL;
this->tsr = NULL;
this->proposals = NULL;
-
+
return NEED_MORE;
}
@@ -779,9 +881,9 @@ static status_t process_r(private_child_create_t *this, message_t *message)
default:
break;
}
-
+
process_payloads(this, message);
-
+
return NEED_MORE;
}
@@ -813,7 +915,7 @@ static status_t build_r(private_child_create_t *this, message_t *message)
payload_t *payload;
enumerator_t *enumerator;
bool no_dh = TRUE;
-
+
switch (message->get_exchange_type(message))
{
case IKE_SA_INIT:
@@ -835,19 +937,19 @@ static status_t build_r(private_child_create_t *this, message_t *message)
default:
break;
}
-
+
if (this->ike_sa->get_state(this->ike_sa) == IKE_REKEYING)
{
DBG1(DBG_IKE, "unable to create CHILD_SA while rekeying IKE_SA");
message->add_notify(message, TRUE, NO_ADDITIONAL_SAS, chunk_empty);
return SUCCESS;
}
-
+
peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
if (peer_cfg && this->tsi && this->tsr)
{
host_t *me, *other;
-
+
me = this->ike_sa->get_virtual_ip(this->ike_sa, TRUE);
if (me == NULL)
{
@@ -861,7 +963,7 @@ static status_t build_r(private_child_create_t *this, message_t *message)
this->config = peer_cfg->select_child_cfg(peer_cfg, this->tsr,
this->tsi, me, other);
}
-
+
if (this->config == NULL)
{
DBG1(DBG_IKE, "traffic selectors %#R=== %#R inacceptable",
@@ -870,7 +972,7 @@ static status_t build_r(private_child_create_t *this, message_t *message)
handle_child_sa_failure(this, message);
return SUCCESS;
}
-
+
/* check if ike_config_t included non-critical error notifies */
enumerator = message->create_payload_enumerator(message);
while (enumerator->enumerate(enumerator, &payload))
@@ -878,7 +980,7 @@ static status_t build_r(private_child_create_t *this, message_t *message)
if (payload->get_type(payload) == NOTIFY)
{
notify_payload_t *notify = (notify_payload_t*)payload;
-
+
switch (notify->get_notify_type(notify))
{
case INTERNAL_ADDRESS_FAILURE:
@@ -896,11 +998,11 @@ static status_t build_r(private_child_create_t *this, message_t *message)
}
}
enumerator->destroy(enumerator);
-
+
this->child_sa = child_sa_create(this->ike_sa->get_my_host(this->ike_sa),
this->ike_sa->get_other_host(this->ike_sa), this->config, this->reqid,
this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY));
-
+
if (this->ipcomp_received != IPCOMP_NONE)
{
if (this->config->use_ipcomp(this->config))
@@ -913,7 +1015,7 @@ static status_t build_r(private_child_create_t *this, message_t *message)
notify_type_names, IPCOMP_SUPPORTED);
}
}
-
+
switch (select_and_install(this, no_dh))
{
case SUCCESS:
@@ -936,9 +1038,9 @@ static status_t build_r(private_child_create_t *this, message_t *message)
handle_child_sa_failure(this, message);
return SUCCESS;
}
-
+
build_payloads(this, message);
-
+
DBG0(DBG_IKE, "CHILD_SA %s{%d} established "
"with SPIs %.8x_i %.8x_o and TS %#R=== %#R",
this->child_sa->get_name(this->child_sa),
@@ -947,7 +1049,7 @@ static status_t build_r(private_child_create_t *this, message_t *message)
ntohl(this->child_sa->get_spi(this->child_sa, FALSE)),
this->child_sa->get_traffic_selectors(this->child_sa, TRUE),
this->child_sa->get_traffic_selectors(this->child_sa, FALSE));
-
+
if (!this->rekey)
{ /* invoke the child_up() hook if we are not rekeying */
charon->bus->child_updown(charon->bus, this->child_sa, TRUE);
@@ -989,7 +1091,7 @@ static status_t process_i(private_child_create_t *this, message_t *message)
{
notify_payload_t *notify = (notify_payload_t*)payload;
notify_type_t type = notify->get_notify_type(notify);
-
+
switch (type)
{
/* handle notify errors related to CHILD_SA only */
@@ -1011,15 +1113,18 @@ static status_t process_i(private_child_create_t *this, message_t *message)
case INVALID_KE_PAYLOAD:
{
chunk_t data;
- diffie_hellman_group_t bad_group;
-
- bad_group = this->dh_group;
+ u_int16_t group = MODP_NONE;
+
data = notify->get_notification_data(notify);
- this->dh_group = ntohs(*((u_int16_t*)data.ptr));
+ if (data.len == sizeof(group))
+ {
+ memcpy(&group, data.ptr, data.len);
+ group = ntohs(group);
+ }
DBG1(DBG_IKE, "peer didn't accept DH group %N, "
"it requested %N", diffie_hellman_group_names,
- bad_group, diffie_hellman_group_names, this->dh_group);
-
+ this->dh_group, diffie_hellman_group_names, group);
+ this->dh_group = group;
this->public.task.migrate(&this->public.task, this->ike_sa);
enumerator->destroy(enumerator);
return NEED_MORE;
@@ -1030,9 +1135,9 @@ static status_t process_i(private_child_create_t *this, message_t *message)
}
}
enumerator->destroy(enumerator);
-
+
process_payloads(this, message);
-
+
if (this->ipcomp == IPCOMP_NONE && this->ipcomp_received != IPCOMP_NONE)
{
DBG1(DBG_IKE, "received an IPCOMP_SUPPORTED notify without requesting"
@@ -1053,7 +1158,7 @@ static status_t process_i(private_child_create_t *this, message_t *message)
handle_child_sa_failure(this, message);
return SUCCESS;
}
-
+
if (select_and_install(this, no_dh) == SUCCESS)
{
DBG0(DBG_IKE, "CHILD_SA %s{%d} established "
@@ -1064,7 +1169,7 @@ static status_t process_i(private_child_create_t *this, message_t *message)
ntohl(this->child_sa->get_spi(this->child_sa, FALSE)),
this->child_sa->get_traffic_selectors(this->child_sa, TRUE),
this->child_sa->get_traffic_selectors(this->child_sa, FALSE));
-
+
if (!this->rekey)
{ /* invoke the child_up() hook if we are not rekeying */
charon->bus->child_updown(charon->bus, this->child_sa, TRUE);
@@ -1105,7 +1210,7 @@ static child_sa_t* get_child(private_child_create_t *this)
* Implementation of child_create_t.get_lower_nonce
*/
static chunk_t get_lower_nonce(private_child_create_t *this)
-{
+{
if (memcmp(this->my_nonce.ptr, this->other_nonce.ptr,
min(this->my_nonce.len, this->other_nonce.len)) < 0)
{
@@ -1139,7 +1244,7 @@ static void migrate(private_child_create_t *this, ike_sa_t *ike_sa)
{
this->proposals->destroy_offset(this->proposals, offsetof(proposal_t, destroy));
}
-
+
this->ike_sa = ike_sa;
this->keymat = ike_sa->get_keymat(ike_sa);
this->proposal = NULL;
@@ -1183,7 +1288,7 @@ static void destroy(private_child_create_t *this)
{
this->proposals->destroy_offset(this->proposals, offsetof(proposal_t, destroy));
}
-
+
DESTROY_IF(this->config);
free(this);
}
@@ -1216,7 +1321,7 @@ child_create_t *child_create_create(ike_sa_t *ike_sa,
this->public.task.process = (status_t(*)(task_t*,message_t*))process_r;
this->initiator = FALSE;
}
-
+
this->ike_sa = ike_sa;
this->config = config;
this->my_nonce = chunk_empty;
@@ -1241,6 +1346,6 @@ child_create_t *child_create_create(ike_sa_t *ike_sa,
this->reqid = 0;
this->established = FALSE;
this->rekey = rekey;
-
+
return &this->public;
}
diff --git a/src/charon/sa/tasks/child_create.h b/src/charon/sa/tasks/child_create.h
index 41f4fe2c8..5dedeb8b1 100644
--- a/src/charon/sa/tasks/child_create.h
+++ b/src/charon/sa/tasks/child_create.h
@@ -31,7 +31,7 @@ typedef struct child_create_t child_create_t;
/**
* Task of type CHILD_CREATE, established a new CHILD_SA.
*
- * This task may be included in the IKE_AUTH message or in a separate
+ * This task may be included in the IKE_AUTH message or in a separate
* CREATE_CHILD_SA exchange.
*/
struct child_create_t {
@@ -40,24 +40,24 @@ struct child_create_t {
* Implements the task_t interface
*/
task_t task;
-
+
/**
* Use a specific reqid for the CHILD_SA.
*
* When this task is used for rekeying, the same reqid is used
- * for the new CHILD_SA.
+ * for the new CHILD_SA.
*
* @param reqid reqid to use
*/
void (*use_reqid) (child_create_t *this, u_int32_t reqid);
-
+
/**
* Get the lower of the two nonces, used for rekey collisions.
*
* @return lower nonce
*/
chunk_t (*get_lower_nonce) (child_create_t *this);
-
+
/**
* Get the CHILD_SA established/establishing by this task.
*
diff --git a/src/charon/sa/tasks/child_delete.c b/src/charon/sa/tasks/child_delete.c
index 7abb07a84..d7c6b0541 100644
--- a/src/charon/sa/tasks/child_delete.c
+++ b/src/charon/sa/tasks/child_delete.c
@@ -25,42 +25,42 @@ typedef struct private_child_delete_t private_child_delete_t;
* Private members of a child_delete_t task.
*/
struct private_child_delete_t {
-
+
/**
* Public methods and task_t interface.
*/
child_delete_t public;
-
+
/**
* Assigned IKE_SA.
*/
ike_sa_t *ike_sa;
-
+
/**
* Are we the initiator?
*/
bool initiator;
-
+
/**
* Protocol of CHILD_SA to delete
*/
protocol_id_t protocol;
-
+
/**
* Inbound SPI of CHILD_SA to delete
*/
u_int32_t spi;
-
+
/**
* whether to enforce delete action policy
*/
bool check_delete_action;
-
+
/**
* is this delete exchange following a rekey?
*/
bool rekeyed;
-
+
/**
* CHILD_SAs which get deleted
*/
@@ -75,10 +75,10 @@ static void build_payloads(private_child_delete_t *this, message_t *message)
delete_payload_t *ah = NULL, *esp = NULL;
iterator_t *iterator;
child_sa_t *child_sa;
-
+
iterator = this->child_sas->create_iterator(this->child_sas, TRUE);
while (iterator->iterate(iterator, (void**)&child_sa))
- {
+ {
protocol_id_t protocol = child_sa->get_protocol(child_sa);
u_int32_t spi = child_sa->get_spi(child_sa, TRUE);
@@ -91,7 +91,7 @@ static void build_payloads(private_child_delete_t *this, message_t *message)
message->add_payload(message, (payload_t*)esp);
}
esp->add_spi(esp, spi);
- DBG1(DBG_IKE, "sending DELETE for %N CHILD_SA with SPI %.8x",
+ DBG1(DBG_IKE, "sending DELETE for %N CHILD_SA with SPI %.8x",
protocol_id_names, protocol, ntohl(spi));
break;
case PROTO_AH:
@@ -101,7 +101,7 @@ static void build_payloads(private_child_delete_t *this, message_t *message)
message->add_payload(message, (payload_t*)ah);
}
ah->add_spi(ah, spi);
- DBG1(DBG_IKE, "sending DELETE for %N CHILD_SA with SPI %.8x",
+ DBG1(DBG_IKE, "sending DELETE for %N CHILD_SA with SPI %.8x",
protocol_id_names, protocol, ntohl(spi));
break;
default:
@@ -124,7 +124,7 @@ static void process_payloads(private_child_delete_t *this, message_t *message)
u_int32_t *spi;
protocol_id_t protocol;
child_sa_t *child_sa;
-
+
payloads = message->create_payload_enumerator(message);
while (payloads->enumerate(payloads, &payload))
{
@@ -147,9 +147,9 @@ static void process_payloads(private_child_delete_t *this, message_t *message)
"but no such SA", protocol_id_names, protocol, ntohl(*spi));
continue;
}
- DBG1(DBG_IKE, "received DELETE for %N CHILD_SA with SPI %.8x",
+ DBG1(DBG_IKE, "received DELETE for %N CHILD_SA with SPI %.8x",
protocol_id_names, protocol, ntohl(*spi));
-
+
switch (child_sa->get_state(child_sa))
{
case CHILD_REKEYING:
@@ -172,7 +172,7 @@ static void process_payloads(private_child_delete_t *this, message_t *message)
default:
break;
}
-
+
this->child_sas->insert_last(this->child_sas, child_sa);
}
spis->destroy(spis);
@@ -192,7 +192,7 @@ static status_t destroy_and_reestablish(private_child_delete_t *this)
protocol_id_t protocol;
u_int32_t spi;
status_t status = SUCCESS;
-
+
iterator = this->child_sas->create_iterator(this->child_sas, TRUE);
while (iterator->iterate(iterator, (void**)&child_sa))
{
@@ -215,7 +215,7 @@ static status_t destroy_and_reestablish(private_child_delete_t *this)
status = this->ike_sa->initiate(this->ike_sa, child_cfg, 0,
NULL, NULL);
break;
- case ACTION_ROUTE:
+ case ACTION_ROUTE:
charon->traps->install(charon->traps,
this->ike_sa->get_peer_cfg(this->ike_sa), child_cfg);
break;
@@ -241,13 +241,13 @@ static void log_children(private_child_delete_t *this)
iterator_t *iterator;
child_sa_t *child_sa;
u_int64_t bytes_in, bytes_out;
-
+
iterator = this->child_sas->create_iterator(this->child_sas, TRUE);
while (iterator->iterate(iterator, (void**)&child_sa))
{
child_sa->get_usestats(child_sa, TRUE, NULL, &bytes_in);
child_sa->get_usestats(child_sa, FALSE, NULL, &bytes_out);
-
+
DBG0(DBG_IKE, "closing CHILD_SA %s{%d} "
"with SPIs %.8x_i (%llu bytes) %.8x_o (%llu bytes) and TS %#R=== %#R",
child_sa->get_name(child_sa), child_sa->get_reqid(child_sa),
@@ -265,12 +265,19 @@ static void log_children(private_child_delete_t *this)
static status_t build_i(private_child_delete_t *this, message_t *message)
{
child_sa_t *child_sa;
-
+
child_sa = this->ike_sa->get_child_sa(this->ike_sa, this->protocol,
this->spi, TRUE);
if (!child_sa)
- { /* child does not exist anymore */
- return SUCCESS;
+ { /* check if it is an outbound sa */
+ child_sa = this->ike_sa->get_child_sa(this->ike_sa, this->protocol,
+ this->spi, FALSE);
+ if (!child_sa)
+ { /* child does not exist anymore */
+ return SUCCESS;
+ }
+ /* we work only with the inbound SPI */
+ this->spi = child_sa->get_spi(child_sa, TRUE);
}
this->child_sas->insert_last(this->child_sas, child_sa);
if (child_sa->get_state(child_sa) == CHILD_REKEYING)
@@ -290,7 +297,7 @@ static status_t process_i(private_child_delete_t *this, message_t *message)
/* flush the list before adding new SAs */
this->child_sas->destroy(this->child_sas);
this->child_sas = linked_list_create();
-
+
process_payloads(this, message);
DBG1(DBG_IKE, "CHILD_SA closed");
return destroy_and_reestablish(this);
@@ -314,7 +321,7 @@ static status_t build_r(private_child_delete_t *this, message_t *message)
/* if we are rekeying, we send an empty informational */
if (this->ike_sa->get_state(this->ike_sa) != IKE_REKEYING)
{
- build_payloads(this, message);
+ build_payloads(this, message);
}
DBG1(DBG_IKE, "CHILD_SA closed");
return destroy_and_reestablish(this);
@@ -345,7 +352,7 @@ static void migrate(private_child_delete_t *this, ike_sa_t *ike_sa)
{
this->check_delete_action = FALSE;
this->ike_sa = ike_sa;
-
+
this->child_sas->destroy(this->child_sas);
this->child_sas = linked_list_create();
}
@@ -371,14 +378,14 @@ child_delete_t *child_delete_create(ike_sa_t *ike_sa, protocol_id_t protocol,
this->public.task.get_type = (task_type_t(*)(task_t*))get_type;
this->public.task.migrate = (void(*)(task_t*,ike_sa_t*))migrate;
this->public.task.destroy = (void(*)(task_t*))destroy;
-
+
this->ike_sa = ike_sa;
this->check_delete_action = FALSE;
this->child_sas = linked_list_create();
this->protocol = protocol;
this->spi = spi;
this->rekeyed = FALSE;
-
+
if (protocol != PROTO_NONE)
{
this->public.task.build = (status_t(*)(task_t*,message_t*))build_i;
diff --git a/src/charon/sa/tasks/child_delete.h b/src/charon/sa/tasks/child_delete.h
index 27d847035..365807c68 100644
--- a/src/charon/sa/tasks/child_delete.h
+++ b/src/charon/sa/tasks/child_delete.h
@@ -37,7 +37,7 @@ struct child_delete_t {
* Implements the task_t interface
*/
task_t task;
-
+
/**
* Get the CHILD_SA to delete by this task.
*
diff --git a/src/charon/sa/tasks/child_rekey.c b/src/charon/sa/tasks/child_rekey.c
index 601e054ea..b5e4e84b4 100644
--- a/src/charon/sa/tasks/child_rekey.c
+++ b/src/charon/sa/tasks/child_rekey.c
@@ -30,47 +30,47 @@ typedef struct private_child_rekey_t private_child_rekey_t;
* Private members of a child_rekey_t task.
*/
struct private_child_rekey_t {
-
+
/**
* Public methods and task_t interface.
*/
child_rekey_t public;
-
+
/**
* Assigned IKE_SA.
*/
ike_sa_t *ike_sa;
-
+
/**
* Are we the initiator?
*/
bool initiator;
-
+
/**
* Protocol of CHILD_SA to rekey
*/
protocol_id_t protocol;
-
+
/**
* Inbound SPI of CHILD_SA to rekey
*/
u_int32_t spi;
-
+
/**
* the CHILD_CREATE task which is reused to simplify rekeying
*/
child_create_t *child_create;
-
+
/**
* the CHILD_DELETE task to delete rekeyed CHILD_SA
*/
child_delete_t *child_delete;
-
+
/**
* CHILD_SA which gets rekeyed
*/
child_sa_t *child_sa;
-
+
/**
* colliding task, may be delete or rekey
*/
@@ -84,7 +84,7 @@ static status_t build_i_delete(private_child_rekey_t *this, message_t *message)
{
/* update exchange type to INFORMATIONAL for the delete */
message->set_exchange_type(message, INFORMATIONAL);
-
+
return this->child_delete->task.build(&this->child_delete->task, message);
}
@@ -101,35 +101,22 @@ static status_t process_i_delete(private_child_rekey_t *this, message_t *message
*/
static void find_child(private_child_rekey_t *this, message_t *message)
{
- enumerator_t *enumerator;
- payload_t *payload;
-
- enumerator = message->create_payload_enumerator(message);
- while (enumerator->enumerate(enumerator, &payload))
+ notify_payload_t *notify;
+ protocol_id_t protocol;
+ u_int32_t spi;
+
+ notify = message->get_notify(message, REKEY_SA);
+ if (notify)
{
- notify_payload_t *notify;
- u_int32_t spi;
- protocol_id_t protocol;
-
- if (payload->get_type(payload) != NOTIFY)
- {
- continue;
- }
-
- notify = (notify_payload_t*)payload;
protocol = notify->get_protocol_id(notify);
spi = notify->get_spi(notify);
-
- if (protocol != PROTO_ESP && protocol != PROTO_AH)
+
+ if (protocol == PROTO_ESP || protocol == PROTO_AH)
{
- continue;
+ this->child_sa = this->ike_sa->get_child_sa(this->ike_sa, protocol,
+ spi, FALSE);
}
- this->child_sa = this->ike_sa->get_child_sa(this->ike_sa, protocol,
- spi, FALSE);
- break;
-
}
- enumerator->destroy(enumerator);
}
/**
@@ -140,30 +127,42 @@ static status_t build_i(private_child_rekey_t *this, message_t *message)
notify_payload_t *notify;
u_int32_t reqid;
child_cfg_t *config;
-
+
this->child_sa = this->ike_sa->get_child_sa(this->ike_sa, this->protocol,
this->spi, TRUE);
if (!this->child_sa)
- { /* CHILD_SA is gone, unable to rekey */
- return SUCCESS;
+ { /* check if it is an outbound CHILD_SA */
+ this->child_sa = this->ike_sa->get_child_sa(this->ike_sa, this->protocol,
+ this->spi, FALSE);
+ if (!this->child_sa)
+ { /* CHILD_SA is gone, unable to rekey. As an empty CREATE_CHILD_SA
+ * exchange is invalid, we fall back to an INFORMATIONAL exchange.*/
+ message->set_exchange_type(message, INFORMATIONAL);
+ return SUCCESS;
+ }
+ /* we work only with the inbound SPI */
+ this->spi = this->child_sa->get_spi(this->child_sa, TRUE);
}
config = this->child_sa->get_config(this->child_sa);
-
+
/* we just need the rekey notify ... */
notify = notify_payload_create_from_protocol_and_type(this->protocol,
REKEY_SA);
notify->set_spi(notify, this->spi);
message->add_payload(message, (payload_t*)notify);
-
+
/* ... our CHILD_CREATE task does the hard work for us. */
+ if (!this->child_create)
+ {
+ this->child_create = child_create_create(this->ike_sa, config, TRUE,
+ NULL, NULL);
+ }
reqid = this->child_sa->get_reqid(this->child_sa);
- this->child_create = child_create_create(this->ike_sa, config, TRUE,
- NULL, NULL);
this->child_create->use_reqid(this->child_create, reqid);
this->child_create->task.build(&this->child_create->task, message);
-
+
this->child_sa->set_state(this->child_sa, CHILD_REKEYING);
-
+
return NEED_MORE;
}
@@ -174,9 +173,9 @@ static status_t process_r(private_child_rekey_t *this, message_t *message)
{
/* let the CHILD_CREATE task process the message */
this->child_create->task.process(&this->child_create->task, message);
-
+
find_child(this, message);
-
+
return NEED_MORE;
}
@@ -194,21 +193,21 @@ static status_t build_r(private_child_rekey_t *this, message_t *message)
message->add_notify(message, TRUE, NO_PROPOSAL_CHOSEN, chunk_empty);
return SUCCESS;
}
-
+
/* let the CHILD_CREATE task build the response */
reqid = this->child_sa->get_reqid(this->child_sa);
this->child_create->use_reqid(this->child_create, reqid);
this->child_create->task.build(&this->child_create->task, message);
-
+
if (message->get_payload(message, SECURITY_ASSOCIATION) == NULL)
{
/* rekeying failed, reuse old child */
this->child_sa->set_state(this->child_sa, CHILD_INSTALLED);
return SUCCESS;
}
-
+
this->child_sa->set_state(this->child_sa, CHILD_REKEYING);
-
+
/* invoke rekey hook */
charon->bus->child_rekey(charon->bus, this->child_sa,
this->child_create->get_child(this->child_create));
@@ -223,33 +222,20 @@ static status_t process_i(private_child_rekey_t *this, message_t *message)
protocol_id_t protocol;
u_int32_t spi;
child_sa_t *to_delete;
- enumerator_t *enumerator;
- payload_t *payload;
-
- /* handle NO_ADDITIONAL_SAS notify */
- enumerator = message->create_payload_enumerator(message);
- while (enumerator->enumerate(enumerator, &payload))
+
+ if (message->get_notify(message, NO_ADDITIONAL_SAS))
{
- if (payload->get_type(payload) == NOTIFY)
- {
- notify_payload_t *notify = (notify_payload_t*)payload;
-
- if (notify->get_notify_type(notify) == NO_ADDITIONAL_SAS)
- {
- DBG1(DBG_IKE, "peer seems to not support CHILD_SA rekeying, "
- "starting reauthentication");
- this->child_sa->set_state(this->child_sa, CHILD_INSTALLED);
- charon->processor->queue_job(charon->processor,
- (job_t*)rekey_ike_sa_job_create(
- this->ike_sa->get_id(this->ike_sa), TRUE));
- enumerator->destroy(enumerator);
- return SUCCESS;
- }
- }
+ DBG1(DBG_IKE, "peer seems to not support CHILD_SA rekeying, "
+ "starting reauthentication");
+ this->child_sa->set_state(this->child_sa, CHILD_INSTALLED);
+ charon->processor->queue_job(charon->processor,
+ (job_t*)rekey_ike_sa_job_create(
+ this->ike_sa->get_id(this->ike_sa), TRUE));
+ return SUCCESS;
}
- enumerator->destroy(enumerator);
-
- if (this->child_create->task.process(&this->child_create->task, message) == NEED_MORE)
+
+ if (this->child_create->task.process(&this->child_create->task,
+ message) == NEED_MORE)
{
/* bad DH group while rekeying, try again */
this->child_create->task.migrate(&this->child_create->task, this->ike_sa);
@@ -259,39 +245,39 @@ static status_t process_i(private_child_rekey_t *this, message_t *message)
{
/* establishing new child failed, reuse old. but not when we
* recieved a delete in the meantime */
- if (!(this->collision &&
+ if (!(this->collision &&
this->collision->get_type(this->collision) == CHILD_DELETE))
{
job_t *job;
u_int32_t retry = RETRY_INTERVAL - (random() % RETRY_JITTER);
-
+
job = (job_t*)rekey_child_sa_job_create(
this->child_sa->get_reqid(this->child_sa),
this->child_sa->get_protocol(this->child_sa),
this->child_sa->get_spi(this->child_sa, TRUE));
DBG1(DBG_IKE, "CHILD_SA rekeying failed, "
- "trying again in %d seconds", retry);
+ "trying again in %d seconds", retry);
this->child_sa->set_state(this->child_sa, CHILD_INSTALLED);
charon->scheduler->schedule_job(charon->scheduler, job, retry);
}
return SUCCESS;
}
-
+
to_delete = this->child_sa;
-
+
/* check for rekey collisions */
if (this->collision &&
this->collision->get_type(this->collision) == CHILD_REKEY)
{
chunk_t this_nonce, other_nonce;
private_child_rekey_t *other = (private_child_rekey_t*)this->collision;
-
+
this_nonce = this->child_create->get_lower_nonce(this->child_create);
other_nonce = other->child_create->get_lower_nonce(other->child_create);
-
+
/* if we have the lower nonce, delete rekeyed SA. If not, delete
* the redundant. */
- if (memcmp(this_nonce.ptr, other_nonce.ptr,
+ if (memcmp(this_nonce.ptr, other_nonce.ptr,
min(this_nonce.len, other_nonce.len)) < 0)
{
DBG1(DBG_IKE, "CHILD_SA rekey collision won, deleting rekeyed child");
@@ -307,21 +293,21 @@ static status_t process_i(private_child_rekey_t *this, message_t *message)
}
}
}
-
+
if (to_delete != this->child_create->get_child(this->child_create))
{ /* invoke rekey hook if rekeying successful */
charon->bus->child_rekey(charon->bus, this->child_sa,
this->child_create->get_child(this->child_create));
}
-
+
spi = to_delete->get_spi(to_delete, TRUE);
protocol = to_delete->get_protocol(to_delete);
-
+
/* rekeying done, delete the obsolete CHILD_SA using a subtask */
this->child_delete = child_delete_create(this->ike_sa, protocol, spi);
this->public.task.build = (status_t(*)(task_t*,message_t*))build_i_delete;
this->public.task.process = (status_t(*)(task_t*,message_t*))process_i_delete;
-
+
return NEED_MORE;
}
@@ -338,7 +324,7 @@ static task_type_t get_type(private_child_rekey_t *this)
*/
static void collide(private_child_rekey_t *this, task_t *other)
{
- /* the task manager only detects exchange collision, but not if
+ /* the task manager only detects exchange collision, but not if
* the collision is for the same child. we check it here. */
if (other->get_type(other) == CHILD_REKEY)
{
@@ -346,6 +332,7 @@ static void collide(private_child_rekey_t *this, task_t *other)
if (rekey == NULL || rekey->child_sa != this->child_sa)
{
/* not the same child => no collision */
+ other->destroy(other);
return;
}
}
@@ -354,13 +341,15 @@ static void collide(private_child_rekey_t *this, task_t *other)
child_delete_t *del = (child_delete_t*)other;
if (del == NULL || del->get_child(del) != this->child_sa)
{
- /* not the same child => no collision */
+ /* not the same child => no collision */
+ other->destroy(other);
return;
}
}
else
{
/* any other task is not critical for collisisions, ignore */
+ other->destroy(other);
return;
}
DESTROY_IF(this->collision);
@@ -371,7 +360,7 @@ static void collide(private_child_rekey_t *this, task_t *other)
* Implementation of task_t.migrate
*/
static void migrate(private_child_rekey_t *this, ike_sa_t *ike_sa)
-{
+{
if (this->child_create)
{
this->child_create->task.migrate(&this->child_create->task, ike_sa);
@@ -381,7 +370,7 @@ static void migrate(private_child_rekey_t *this, ike_sa_t *ike_sa)
this->child_delete->task.migrate(&this->child_delete->task, ike_sa);
}
DESTROY_IF(this->collision);
-
+
this->ike_sa = ike_sa;
this->collision = NULL;
}
@@ -410,7 +399,7 @@ child_rekey_t *child_rekey_create(ike_sa_t *ike_sa, protocol_id_t protocol,
u_int32_t spi)
{
private_child_rekey_t *this = malloc_thing(private_child_rekey_t);
-
+
this->public.collide = (void (*)(child_rekey_t*,task_t*))collide;
this->public.task.get_type = (task_type_t(*)(task_t*))get_type;
this->public.task.migrate = (void(*)(task_t*,ike_sa_t*))migrate;
@@ -429,13 +418,13 @@ child_rekey_t *child_rekey_create(ike_sa_t *ike_sa, protocol_id_t protocol,
this->initiator = FALSE;
this->child_create = child_create_create(ike_sa, NULL, TRUE, NULL, NULL);
}
-
+
this->ike_sa = ike_sa;
this->child_sa = NULL;
this->protocol = protocol;
this->spi = spi;
this->collision = NULL;
this->child_delete = NULL;
-
+
return &this->public;
}
diff --git a/src/charon/sa/tasks/child_rekey.h b/src/charon/sa/tasks/child_rekey.h
index 5aae2fb39..9b1aea5fa 100644
--- a/src/charon/sa/tasks/child_rekey.h
+++ b/src/charon/sa/tasks/child_rekey.h
@@ -37,7 +37,7 @@ struct child_rekey_t {
* Implements the task_t interface
*/
task_t task;
-
+
/**
* Register a rekeying task which collides with this one
*
@@ -56,7 +56,7 @@ struct child_rekey_t {
* @param ike_sa IKE_SA this task works for
* @param protocol protocol of CHILD_SA to rekey, PROTO_NONE as responder
* @param spi inbound SPI of CHILD_SA to rekey
- * @return child_rekey task to handle by the task_manager
+ * @return child_rekey task to handle by the task_manager
*/
child_rekey_t *child_rekey_create(ike_sa_t *ike_sa, protocol_id_t protocol,
u_int32_t spi);
diff --git a/src/charon/sa/tasks/ike_auth.c b/src/charon/sa/tasks/ike_auth.c
index d0b2a7e91..a07f96767 100644
--- a/src/charon/sa/tasks/ike_auth.c
+++ b/src/charon/sa/tasks/ike_auth.c
@@ -31,82 +31,72 @@ typedef struct private_ike_auth_t private_ike_auth_t;
* Private members of a ike_auth_t task.
*/
struct private_ike_auth_t {
-
+
/**
* Public methods and task_t interface.
*/
ike_auth_t public;
-
+
/**
* Assigned IKE_SA.
*/
ike_sa_t *ike_sa;
-
+
/**
* Are we the initiator?
*/
bool initiator;
-
+
/**
* Nonce chosen by us in ike_init
*/
chunk_t my_nonce;
-
+
/**
* Nonce chosen by peer in ike_init
*/
chunk_t other_nonce;
-
+
/**
* IKE_SA_INIT message sent by us
*/
packet_t *my_packet;
-
+
/**
* IKE_SA_INIT message sent by peer
*/
packet_t *other_packet;
-
- /**
- * completed authentication configs initiated by us (auth_cfg_t)
- */
- linked_list_t *my_cfgs;
-
- /**
- * completed authentication configs initiated by other (auth_cfg_t)
- */
- linked_list_t *other_cfgs;;
-
+
/**
* currently active authenticator, to authenticate us
*/
authenticator_t *my_auth;
-
+
/**
* currently active authenticator, to authenticate peer
*/
authenticator_t *other_auth;
-
+
/**
* peer_cfg candidates, ordered by priority
*/
linked_list_t *candidates;
-
+
/**
* selected peer config (might change when using multiple authentications)
*/
peer_cfg_t *peer_cfg;
-
+
/**
* have we planned an(other) authentication exchange?
*/
bool do_another_auth;
-
+
/**
* has the peer announced another authentication exchange?
*/
bool expect_another_auth;
-
+
/**
* should we send a AUTHENTICATION_FAILED notify?
*/
@@ -129,7 +119,7 @@ static status_t collect_my_init_data(private_ike_auth_t *this,
message_t *message)
{
nonce_payload_t *nonce;
-
+
/* get the nonce that was generated in ike_init */
nonce = (nonce_payload_t*)message->get_payload(message, NONCE);
if (nonce == NULL)
@@ -137,14 +127,14 @@ static status_t collect_my_init_data(private_ike_auth_t *this,
return FAILED;
}
this->my_nonce = nonce->get_nonce(nonce);
-
+
/* pre-generate the message, keep a copy */
if (this->ike_sa->generate_message(this->ike_sa, message,
&this->my_packet) != SUCCESS)
{
return FAILED;
}
- return NEED_MORE;
+ return NEED_MORE;
}
/**
@@ -155,7 +145,7 @@ static status_t collect_other_init_data(private_ike_auth_t *this,
{
/* we collect the needed information in the IKE_SA_INIT exchange */
nonce_payload_t *nonce;
-
+
/* get the nonce that was generated in ike_init */
nonce = (nonce_payload_t*)message->get_payload(message, NONCE);
if (nonce == NULL)
@@ -163,10 +153,10 @@ static status_t collect_other_init_data(private_ike_auth_t *this,
return FAILED;
}
this->other_nonce = nonce->get_nonce(nonce);
-
+
/* keep a copy of the received packet */
this->other_packet = message->get_packet(message);
- return NEED_MORE;
+ return NEED_MORE;
}
/**
@@ -176,21 +166,14 @@ static auth_cfg_t *get_auth_cfg(private_ike_auth_t *this, bool local)
{
enumerator_t *e1, *e2;
auth_cfg_t *c1, *c2, *next = NULL;
-
+
/* find an available config not already done */
e1 = this->peer_cfg->create_auth_cfg_enumerator(this->peer_cfg, local);
while (e1->enumerate(e1, &c1))
{
bool found = FALSE;
-
- if (local)
- {
- e2 = this->my_cfgs->create_enumerator(this->my_cfgs);
- }
- else
- {
- e2 = this->other_cfgs->create_enumerator(this->other_cfgs);
- }
+
+ e2 = this->ike_sa->create_auth_cfg_enumerator(this->ike_sa, local);
while (e2->enumerate(e2, &c2))
{
if (c2->complies(c2, c1, FALSE))
@@ -218,13 +201,13 @@ static bool do_another_auth(private_ike_auth_t *this)
bool do_another = FALSE;
enumerator_t *done, *todo;
auth_cfg_t *done_cfg, *todo_cfg;
-
+
if (!this->ike_sa->supports_extension(this->ike_sa, EXT_MULTIPLE_AUTH))
{
return FALSE;
}
-
- done = this->my_cfgs->create_enumerator(this->my_cfgs);
+
+ done = this->ike_sa->create_auth_cfg_enumerator(this->ike_sa, TRUE);
todo = this->peer_cfg->create_auth_cfg_enumerator(this->peer_cfg, TRUE);
while (todo->enumerate(todo, &todo_cfg))
{
@@ -252,12 +235,12 @@ static bool load_cfg_candidates(private_ike_auth_t *this)
peer_cfg_t *peer_cfg;
host_t *me, *other;
identification_t *my_id, *other_id;
-
+
me = this->ike_sa->get_my_host(this->ike_sa);
other = this->ike_sa->get_other_host(this->ike_sa);
my_id = this->ike_sa->get_my_id(this->ike_sa);
other_id = this->ike_sa->get_other_id(this->ike_sa);
-
+
enumerator = charon->backends->create_peer_cfg_enumerator(charon->backends,
me, other, my_id, other_id);
while (enumerator->enumerate(enumerator, &peer_cfg))
@@ -296,10 +279,10 @@ static bool update_cfg_candidates(private_ike_auth_t *this, bool strict)
bool complies = TRUE;
enumerator_t *e1, *e2, *tmp;
auth_cfg_t *c1, *c2;
-
- e1 = this->other_cfgs->create_enumerator(this->other_cfgs);
+
+ e1 = this->ike_sa->create_auth_cfg_enumerator(this->ike_sa, FALSE);
e2 = this->peer_cfg->create_auth_cfg_enumerator(this->peer_cfg, FALSE);
-
+
if (strict)
{ /* swap lists in strict mode: all configured rounds must be
* fulfilled. If !strict, we check only the rounds done so far. */
@@ -342,7 +325,7 @@ static bool update_cfg_candidates(private_ike_auth_t *this, bool strict)
}
}
while (this->peer_cfg);
-
+
return this->peer_cfg != NULL;
}
@@ -352,39 +335,45 @@ static bool update_cfg_candidates(private_ike_auth_t *this, bool strict)
static status_t build_i(private_ike_auth_t *this, message_t *message)
{
auth_cfg_t *cfg;
-
+
if (message->get_exchange_type(message) == IKE_SA_INIT)
{
return collect_my_init_data(this, message);
}
-
+
if (this->peer_cfg == NULL)
{
this->peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
this->peer_cfg->get_ref(this->peer_cfg);
}
-
- if (message->get_message_id(message) == 1 &&
- this->ike_sa->supports_extension(this->ike_sa, EXT_MULTIPLE_AUTH))
- { /* in the first IKE_AUTH, indicate support for multiple authentication */
- message->add_notify(message, FALSE, MULTIPLE_AUTH_SUPPORTED, chunk_empty);
+
+ if (message->get_message_id(message) == 1)
+ { /* in the first IKE_AUTH ... */
+ if (this->ike_sa->supports_extension(this->ike_sa, EXT_MULTIPLE_AUTH))
+ { /* indicate support for multiple authentication */
+ message->add_notify(message, FALSE, MULTIPLE_AUTH_SUPPORTED,
+ chunk_empty);
+ }
+ /* indicate support for EAP-only authentication */
+ message->add_notify(message, FALSE, EAP_ONLY_AUTHENTICATION,
+ chunk_empty);
}
-
+
if (!this->do_another_auth && !this->my_auth)
{ /* we have done our rounds */
return NEED_MORE;
}
-
+
/* check if an authenticator is in progress */
if (this->my_auth == NULL)
{
identification_t *id;
id_payload_t *id_payload;
-
+
/* clean up authentication config from a previous round */
cfg = this->ike_sa->get_auth_cfg(this->ike_sa, TRUE);
cfg->purge(cfg, TRUE);
-
+
/* add (optional) IDr */
cfg = get_auth_cfg(this, FALSE);
if (cfg)
@@ -410,7 +399,7 @@ static status_t build_i(private_ike_auth_t *this, message_t *message)
this->ike_sa->set_my_id(this->ike_sa, id->clone(id));
id_payload = id_payload_create_from_identification(ID_INITIATOR, id);
message->add_payload(message, (payload_t*)id_payload);
-
+
/* build authentication data */
this->my_auth = authenticator_create_builder(this->ike_sa, cfg,
this->other_nonce, this->my_nonce,
@@ -427,7 +416,7 @@ static status_t build_i(private_ike_auth_t *this, message_t *message)
/* authentication step complete, reset authenticator */
cfg = auth_cfg_create();
cfg->merge(cfg, this->ike_sa->get_auth_cfg(this->ike_sa, TRUE), TRUE);
- this->my_cfgs->insert_last(this->my_cfgs, cfg);
+ this->ike_sa->add_auth_cfg(this->ike_sa, TRUE, cfg);
this->my_auth->destroy(this->my_auth);
this->my_auth = NULL;
break;
@@ -436,7 +425,7 @@ static status_t build_i(private_ike_auth_t *this, message_t *message)
default:
return FAILED;
}
-
+
/* check for additional authentication rounds */
if (do_another_auth(this))
{
@@ -460,12 +449,12 @@ static status_t process_r(private_ike_auth_t *this, message_t *message)
auth_cfg_t *cfg, *cand;
id_payload_t *id_payload;
identification_t *id;
-
+
if (message->get_exchange_type(message) == IKE_SA_INIT)
{
return collect_other_init_data(this, message);
}
-
+
if (this->my_auth == NULL && this->do_another_auth)
{
/* handle (optional) IDr payload, apply proposed identity */
@@ -480,16 +469,26 @@ static status_t process_r(private_ike_auth_t *this, message_t *message)
}
this->ike_sa->set_my_id(this->ike_sa, id);
}
-
+
if (!this->expect_another_auth)
{
return NEED_MORE;
}
- if (message->get_notify(message, MULTIPLE_AUTH_SUPPORTED))
- {
- this->ike_sa->enable_extension(this->ike_sa, EXT_MULTIPLE_AUTH);
+
+ if (message->get_message_id(message) == 1)
+ { /* check for extensions in the first IKE_AUTH */
+ if (message->get_notify(message, MULTIPLE_AUTH_SUPPORTED))
+ {
+ this->ike_sa->enable_extension(this->ike_sa, EXT_MULTIPLE_AUTH);
+ }
+ if (this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN) &&
+ message->get_notify(message, EAP_ONLY_AUTHENTICATION))
+ { /* EAP-only has no official notify, accept only from strongSwan */
+ this->ike_sa->enable_extension(this->ike_sa,
+ EXT_EAP_ONLY_AUTHENTICATION);
+ }
}
-
+
if (this->other_auth == NULL)
{
/* handle IDi payload */
@@ -503,7 +502,7 @@ static status_t process_r(private_ike_auth_t *this, message_t *message)
this->ike_sa->set_other_id(this->ike_sa, id);
cfg = this->ike_sa->get_auth_cfg(this->ike_sa, FALSE);
cfg->add(cfg, AUTH_RULE_IDENTITY, id->clone(id));
-
+
if (this->peer_cfg == NULL)
{
if (!load_cfg_candidates(this))
@@ -530,7 +529,7 @@ static status_t process_r(private_ike_auth_t *this, message_t *message)
}
cfg->merge(cfg, cand, TRUE);
}
-
+
/* verify authentication data */
this->other_auth = authenticator_create_verifier(this->ike_sa,
message, this->other_nonce, this->my_nonce,
@@ -558,27 +557,26 @@ static status_t process_r(private_ike_auth_t *this, message_t *message)
this->authentication_failed = TRUE;
return NEED_MORE;
}
-
+
/* store authentication information */
cfg = auth_cfg_create();
cfg->merge(cfg, this->ike_sa->get_auth_cfg(this->ike_sa, FALSE), FALSE);
- this->other_cfgs->insert_last(this->other_cfgs, cfg);
-
+ this->ike_sa->add_auth_cfg(this->ike_sa, FALSE, cfg);
+
/* another auth round done, invoke authorize hook */
- if (!charon->bus->authorize(charon->bus, this->other_cfgs, FALSE))
+ if (!charon->bus->authorize(charon->bus, FALSE))
{
- DBG1(DBG_IKE, "round %d authorization hook forbids IKE_SA, cancelling",
- this->other_cfgs->get_count(this->other_cfgs));
+ DBG1(DBG_IKE, "authorization hook forbids IKE_SA, cancelling");
this->authentication_failed = TRUE;
return NEED_MORE;
}
-
+
if (!update_cfg_candidates(this, FALSE))
{
this->authentication_failed = TRUE;
return NEED_MORE;
}
-
+
if (message->get_notify(message, ANOTHER_AUTH_FOLLOWS) == NULL)
{
this->expect_another_auth = FALSE;
@@ -597,7 +595,7 @@ static status_t process_r(private_ike_auth_t *this, message_t *message)
static status_t build_r(private_ike_auth_t *this, message_t *message)
{
auth_cfg_t *cfg;
-
+
if (message->get_exchange_type(message) == IKE_SA_INIT)
{
if (multiple_auth_enabled())
@@ -607,23 +605,23 @@ static status_t build_r(private_ike_auth_t *this, message_t *message)
}
return collect_my_init_data(this, message);
}
-
+
if (this->authentication_failed || this->peer_cfg == NULL)
{
message->add_notify(message, TRUE, AUTHENTICATION_FAILED, chunk_empty);
return FAILED;
}
-
+
if (this->my_auth == NULL && this->do_another_auth)
{
identification_t *id, *id_cfg;
id_payload_t *id_payload;
-
+
/* add IDr */
cfg = this->ike_sa->get_auth_cfg(this->ike_sa, TRUE);
cfg->purge(cfg, TRUE);
cfg->merge(cfg, get_auth_cfg(this, TRUE), TRUE);
-
+
id_cfg = cfg->get(cfg, AUTH_RULE_IDENTITY);
id = this->ike_sa->get_my_id(this->ike_sa);
if (id->get_type(id) == ID_ANY)
@@ -648,22 +646,38 @@ static status_t build_r(private_ike_auth_t *this, message_t *message)
return FAILED;
}
}
-
+
id_payload = id_payload_create_from_identification(ID_RESPONDER, id);
message->add_payload(message, (payload_t*)id_payload);
-
- /* build authentication data */
- this->my_auth = authenticator_create_builder(this->ike_sa, cfg,
- this->other_nonce, this->my_nonce,
- this->other_packet->get_data(this->other_packet),
- this->my_packet->get_data(this->my_packet));
- if (!this->my_auth)
+
+ if ((uintptr_t)cfg->get(cfg, AUTH_RULE_AUTH_CLASS) == AUTH_CLASS_EAP)
+ { /* EAP-only authentication */
+ if (!this->ike_sa->supports_extension(this->ike_sa,
+ EXT_EAP_ONLY_AUTHENTICATION))
+ {
+ DBG1(DBG_IKE, "configured EAP-only authentication, but peer "
+ "does not support it");
+ message->add_notify(message, TRUE, AUTHENTICATION_FAILED,
+ chunk_empty);
+ return FAILED;
+ }
+ }
+ else
{
- message->add_notify(message, TRUE, AUTHENTICATION_FAILED, chunk_empty);
- return FAILED;
+ /* build authentication data */
+ this->my_auth = authenticator_create_builder(this->ike_sa, cfg,
+ this->other_nonce, this->my_nonce,
+ this->other_packet->get_data(this->other_packet),
+ this->my_packet->get_data(this->my_packet));
+ if (!this->my_auth)
+ {
+ message->add_notify(message, TRUE, AUTHENTICATION_FAILED,
+ chunk_empty);
+ return FAILED;
+ }
}
}
-
+
if (this->other_auth)
{
switch (this->other_auth->build(this->other_auth, message))
@@ -691,7 +705,7 @@ static status_t build_r(private_ike_auth_t *this, message_t *message)
cfg = auth_cfg_create();
cfg->merge(cfg, this->ike_sa->get_auth_cfg(this->ike_sa, TRUE),
TRUE);
- this->my_cfgs->insert_last(this->my_cfgs, cfg);
+ this->ike_sa->add_auth_cfg(this->ike_sa, TRUE, cfg);
this->my_auth->destroy(this->my_auth);
this->my_auth = NULL;
break;
@@ -703,7 +717,7 @@ static status_t build_r(private_ike_auth_t *this, message_t *message)
return FAILED;
}
}
-
+
/* check for additional authentication rounds */
if (do_another_auth(this))
{
@@ -723,21 +737,21 @@ static status_t build_r(private_ike_auth_t *this, message_t *message)
chunk_empty);
return FAILED;
}
- if (!charon->bus->authorize(charon->bus, this->other_cfgs, TRUE))
+ if (!charon->bus->authorize(charon->bus, TRUE))
{
DBG1(DBG_IKE, "final authorization hook forbids IKE_SA, cancelling");
message->add_notify(message, TRUE, AUTHENTICATION_FAILED,
chunk_empty);
return FAILED;
}
- this->ike_sa->set_state(this->ike_sa, IKE_ESTABLISHED);
DBG0(DBG_IKE, "IKE_SA %s[%d] established between %H[%Y]...%H[%Y]",
this->ike_sa->get_name(this->ike_sa),
this->ike_sa->get_unique_id(this->ike_sa),
this->ike_sa->get_my_host(this->ike_sa),
- this->ike_sa->get_my_id(this->ike_sa),
+ this->ike_sa->get_my_id(this->ike_sa),
this->ike_sa->get_other_host(this->ike_sa),
this->ike_sa->get_other_id(this->ike_sa));
+ this->ike_sa->set_state(this->ike_sa, IKE_ESTABLISHED);
charon->bus->ike_updown(charon->bus, this->ike_sa, TRUE);
return SUCCESS;
}
@@ -752,7 +766,8 @@ static status_t process_i(private_ike_auth_t *this, message_t *message)
enumerator_t *enumerator;
payload_t *payload;
auth_cfg_t *cfg;
-
+ bool mutual_eap = FALSE;
+
if (message->get_exchange_type(message) == IKE_SA_INIT)
{
if (message->get_notify(message, MULTIPLE_AUTH_SUPPORTED) &&
@@ -762,7 +777,7 @@ static status_t process_i(private_ike_auth_t *this, message_t *message)
}
return collect_other_init_data(this, message);
}
-
+
enumerator = message->create_payload_enumerator(message);
while (enumerator->enumerate(enumerator, &payload))
{
@@ -770,7 +785,7 @@ static status_t process_i(private_ike_auth_t *this, message_t *message)
{
notify_payload_t *notify = (notify_payload_t*)payload;
notify_type_t type = notify->get_notify_type(notify);
-
+
switch (type)
{
case NO_PROPOSAL_CHOSEN:
@@ -801,7 +816,7 @@ static status_t process_i(private_ike_auth_t *this, message_t *message)
DBG1(DBG_IKE, "received %N notify error",
notify_type_names, type);
enumerator->destroy(enumerator);
- return FAILED;
+ return FAILED;
}
DBG2(DBG_IKE, "received %N notify",
notify_type_names, type);
@@ -811,41 +826,14 @@ static status_t process_i(private_ike_auth_t *this, message_t *message)
}
}
enumerator->destroy(enumerator);
-
- if (this->my_auth)
- {
- switch (this->my_auth->process(this->my_auth, message))
- {
- case SUCCESS:
- cfg = auth_cfg_create();
- cfg->merge(cfg, this->ike_sa->get_auth_cfg(this->ike_sa, TRUE),
- TRUE);
- this->my_cfgs->insert_last(this->my_cfgs, cfg);
- this->my_auth->destroy(this->my_auth);
- this->my_auth = NULL;
- this->do_another_auth = do_another_auth(this);
- break;
- case NEED_MORE:
- break;
- default:
- return FAILED;
- }
- }
-
+
if (this->expect_another_auth)
{
if (this->other_auth == NULL)
{
id_payload_t *id_payload;
identification_t *id;
-
- /* responder is not allowed to do EAP */
- if (!message->get_payload(message, AUTHENTICATION))
- {
- DBG1(DBG_IKE, "AUTH payload missing");
- return FAILED;
- }
-
+
/* handle IDr payload */
id_payload = (id_payload_t*)message->get_payload(message,
ID_RESPONDER);
@@ -858,42 +846,81 @@ static status_t process_i(private_ike_auth_t *this, message_t *message)
this->ike_sa->set_other_id(this->ike_sa, id);
cfg = this->ike_sa->get_auth_cfg(this->ike_sa, FALSE);
cfg->add(cfg, AUTH_RULE_IDENTITY, id->clone(id));
-
- /* verify authentication data */
- this->other_auth = authenticator_create_verifier(this->ike_sa,
- message, this->other_nonce, this->my_nonce,
- this->other_packet->get_data(this->other_packet),
- this->my_packet->get_data(this->my_packet));
- if (!this->other_auth)
+
+ if (message->get_payload(message, AUTHENTICATION))
{
- return FAILED;
+ /* verify authentication data */
+ this->other_auth = authenticator_create_verifier(this->ike_sa,
+ message, this->other_nonce, this->my_nonce,
+ this->other_packet->get_data(this->other_packet),
+ this->my_packet->get_data(this->my_packet));
+ if (!this->other_auth)
+ {
+ return FAILED;
+ }
+ }
+ else
+ {
+ /* responder omitted AUTH payload, indicating EAP-only */
+ mutual_eap = TRUE;
}
}
- switch (this->other_auth->process(this->other_auth, message))
+ if (this->other_auth)
+ {
+ switch (this->other_auth->process(this->other_auth, message))
+ {
+ case SUCCESS:
+ break;
+ case NEED_MORE:
+ return NEED_MORE;
+ default:
+ return FAILED;
+ }
+ this->other_auth->destroy(this->other_auth);
+ this->other_auth = NULL;
+ }
+ /* store authentication information, reset authenticator */
+ cfg = auth_cfg_create();
+ cfg->merge(cfg, this->ike_sa->get_auth_cfg(this->ike_sa, FALSE), FALSE);
+ this->ike_sa->add_auth_cfg(this->ike_sa, FALSE, cfg);
+
+ /* another auth round done, invoke authorize hook */
+ if (!charon->bus->authorize(charon->bus, FALSE))
+ {
+ DBG1(DBG_IKE, "authorization forbids IKE_SA, cancelling");
+ return FAILED;
+ }
+ }
+
+ if (this->my_auth)
+ {
+ switch (this->my_auth->process(this->my_auth, message))
{
case SUCCESS:
+ cfg = auth_cfg_create();
+ cfg->merge(cfg, this->ike_sa->get_auth_cfg(this->ike_sa, TRUE),
+ TRUE);
+ this->ike_sa->add_auth_cfg(this->ike_sa, TRUE, cfg);
+ this->my_auth->destroy(this->my_auth);
+ this->my_auth = NULL;
+ this->do_another_auth = do_another_auth(this);
break;
case NEED_MORE:
- return NEED_MORE;
+ break;
default:
return FAILED;
}
- /* store authentication information, reset authenticator */
- cfg = auth_cfg_create();
- cfg->merge(cfg, this->ike_sa->get_auth_cfg(this->ike_sa, FALSE), FALSE);
- this->other_cfgs->insert_last(this->other_cfgs, cfg);
- this->other_auth->destroy(this->other_auth);
- this->other_auth = NULL;
-
- /* another auth round done, invoke authorize hook */
- if (!charon->bus->authorize(charon->bus, this->other_cfgs, FALSE))
+ }
+ if (mutual_eap)
+ {
+ if (!this->my_auth || !this->my_auth->is_mutual(this->my_auth))
{
- DBG1(DBG_IKE, "round %d authorization forbids IKE_SA, cancelling",
- this->other_cfgs->get_count(this->other_cfgs));
+ DBG1(DBG_IKE, "do not allow non-mutual EAP-only authentication");
return FAILED;
}
+ DBG1(DBG_IKE, "allow mutual EAP-only authentication");
}
-
+
if (message->get_notify(message, ANOTHER_AUTH_FOLLOWS) == NULL)
{
this->expect_another_auth = FALSE;
@@ -904,19 +931,19 @@ static status_t process_i(private_ike_auth_t *this, message_t *message)
{
return FAILED;
}
- if (!charon->bus->authorize(charon->bus, this->other_cfgs, TRUE))
+ if (!charon->bus->authorize(charon->bus, TRUE))
{
DBG1(DBG_IKE, "final authorization hook forbids IKE_SA, cancelling");
return FAILED;
}
- this->ike_sa->set_state(this->ike_sa, IKE_ESTABLISHED);
DBG0(DBG_IKE, "IKE_SA %s[%d] established between %H[%Y]...%H[%Y]",
this->ike_sa->get_name(this->ike_sa),
this->ike_sa->get_unique_id(this->ike_sa),
this->ike_sa->get_my_host(this->ike_sa),
- this->ike_sa->get_my_id(this->ike_sa),
+ this->ike_sa->get_my_id(this->ike_sa),
this->ike_sa->get_other_host(this->ike_sa),
this->ike_sa->get_other_id(this->ike_sa));
+ this->ike_sa->set_state(this->ike_sa, IKE_ESTABLISHED);
charon->bus->ike_updown(charon->bus, this->ike_sa, TRUE);
return SUCCESS;
}
@@ -943,10 +970,8 @@ static void migrate(private_ike_auth_t *this, ike_sa_t *ike_sa)
DESTROY_IF(this->peer_cfg);
DESTROY_IF(this->my_auth);
DESTROY_IF(this->other_auth);
- this->my_cfgs->destroy_offset(this->my_cfgs, offsetof(auth_cfg_t, destroy));
- this->other_cfgs->destroy_offset(this->other_cfgs, offsetof(auth_cfg_t, destroy));
this->candidates->destroy_offset(this->candidates, offsetof(peer_cfg_t, destroy));
-
+
this->my_packet = NULL;
this->other_packet = NULL;
this->ike_sa = ike_sa;
@@ -956,8 +981,6 @@ static void migrate(private_ike_auth_t *this, ike_sa_t *ike_sa)
this->do_another_auth = TRUE;
this->expect_another_auth = TRUE;
this->authentication_failed = FALSE;
- this->my_cfgs = linked_list_create();
- this->other_cfgs = linked_list_create();
this->candidates = linked_list_create();
}
@@ -973,8 +996,6 @@ static void destroy(private_ike_auth_t *this)
DESTROY_IF(this->my_auth);
DESTROY_IF(this->other_auth);
DESTROY_IF(this->peer_cfg);
- this->my_cfgs->destroy_offset(this->my_cfgs, offsetof(auth_cfg_t, destroy));
- this->other_cfgs->destroy_offset(this->other_cfgs, offsetof(auth_cfg_t, destroy));
this->candidates->destroy_offset(this->candidates, offsetof(peer_cfg_t, destroy));
free(this);
}
@@ -985,11 +1006,11 @@ static void destroy(private_ike_auth_t *this)
ike_auth_t *ike_auth_create(ike_sa_t *ike_sa, bool initiator)
{
private_ike_auth_t *this = malloc_thing(private_ike_auth_t);
-
+
this->public.task.get_type = (task_type_t(*)(task_t*))get_type;
this->public.task.migrate = (void(*)(task_t*,ike_sa_t*))migrate;
this->public.task.destroy = (void(*)(task_t*))destroy;
-
+
if (initiator)
{
this->public.task.build = (status_t(*)(task_t*,message_t*))build_i;
@@ -1000,7 +1021,7 @@ ike_auth_t *ike_auth_create(ike_sa_t *ike_sa, bool initiator)
this->public.task.build = (status_t(*)(task_t*,message_t*))build_r;
this->public.task.process = (status_t(*)(task_t*,message_t*))process_r;
}
-
+
this->ike_sa = ike_sa;
this->initiator = initiator;
this->my_nonce = chunk_empty;
@@ -1008,15 +1029,13 @@ ike_auth_t *ike_auth_create(ike_sa_t *ike_sa, bool initiator)
this->my_packet = NULL;
this->other_packet = NULL;
this->peer_cfg = NULL;
- this->my_cfgs = linked_list_create();
- this->other_cfgs = linked_list_create();
this->candidates = linked_list_create();
this->my_auth = NULL;
this->other_auth = NULL;
this->do_another_auth = TRUE;
this->expect_another_auth = TRUE;
this->authentication_failed = FALSE;
-
+
return &this->public;
}
diff --git a/src/charon/sa/tasks/ike_auth_lifetime.c b/src/charon/sa/tasks/ike_auth_lifetime.c
index a047e6b81..75ff35168 100644
--- a/src/charon/sa/tasks/ike_auth_lifetime.c
+++ b/src/charon/sa/tasks/ike_auth_lifetime.c
@@ -27,12 +27,12 @@ typedef struct private_ike_auth_lifetime_t private_ike_auth_lifetime_t;
* Private members of a ike_auth_lifetime_t task.
*/
struct private_ike_auth_lifetime_t {
-
+
/**
* Public methods and task_t interface.
*/
ike_auth_lifetime_t public;
-
+
/**
* Assigned IKE_SA.
*/
@@ -46,11 +46,11 @@ static void add_auth_lifetime(private_ike_auth_lifetime_t *this, message_t *mess
{
chunk_t chunk;
u_int32_t lifetime;
-
+
lifetime = this->ike_sa->get_statistic(this->ike_sa, STAT_REAUTH);
if (lifetime)
{
- lifetime -= time(NULL);
+ lifetime -= time_monotonic(NULL);
chunk = chunk_from_thing(lifetime);
*(u_int32_t*)chunk.ptr = htonl(lifetime);
message->add_notify(message, FALSE, AUTH_LIFETIME, chunk);
@@ -62,31 +62,17 @@ static void add_auth_lifetime(private_ike_auth_lifetime_t *this, message_t *mess
*/
static void process_payloads(private_ike_auth_lifetime_t *this, message_t *message)
{
- enumerator_t *enumerator;
- payload_t *payload;
notify_payload_t *notify;
-
- enumerator = message->create_payload_enumerator(message);
- while (enumerator->enumerate(enumerator, &payload))
+ chunk_t data;
+ u_int32_t lifetime;
+
+ notify = message->get_notify(message, AUTH_LIFETIME);
+ if (notify)
{
- if (payload->get_type(payload) == NOTIFY)
- {
- notify = (notify_payload_t*)payload;
- switch (notify->get_notify_type(notify))
- {
- case AUTH_LIFETIME:
- {
- chunk_t data = notify->get_notification_data(notify);
- u_int32_t lifetime = ntohl(*(u_int32_t*)data.ptr);
- this->ike_sa->set_auth_lifetime(this->ike_sa, lifetime);
- break;
- }
- default:
- break;
- }
- }
+ data = notify->get_notification_data(notify);
+ lifetime = ntohl(*(u_int32_t*)data.ptr);
+ this->ike_sa->set_auth_lifetime(this->ike_sa, lifetime);
}
- enumerator->destroy(enumerator);
}
/**
@@ -177,7 +163,7 @@ ike_auth_lifetime_t *ike_auth_lifetime_create(ike_sa_t *ike_sa, bool initiator)
this->public.task.get_type = (task_type_t(*)(task_t*))get_type;
this->public.task.migrate = (void(*)(task_t*,ike_sa_t*))migrate;
this->public.task.destroy = (void(*)(task_t*))destroy;
-
+
if (initiator)
{
this->public.task.build = (status_t(*)(task_t*,message_t*))build_i;
@@ -188,9 +174,9 @@ ike_auth_lifetime_t *ike_auth_lifetime_create(ike_sa_t *ike_sa, bool initiator)
this->public.task.build = (status_t(*)(task_t*,message_t*))build_r;
this->public.task.process = (status_t(*)(task_t*,message_t*))process_r;
}
-
+
this->ike_sa = ike_sa;
-
+
return &this->public;
}
diff --git a/src/charon/sa/tasks/ike_auth_lifetime.h b/src/charon/sa/tasks/ike_auth_lifetime.h
index 812caaf43..3b129b9e3 100644
--- a/src/charon/sa/tasks/ike_auth_lifetime.h
+++ b/src/charon/sa/tasks/ike_auth_lifetime.h
@@ -30,7 +30,7 @@ typedef struct ike_auth_lifetime_t ike_auth_lifetime_t;
/**
* Task of type IKE_AUTH_LIFETIME, implements RFC4478.
*
- * This task exchanges lifetimes for IKE_AUTH to force a client to
+ * This task exchanges lifetimes for IKE_AUTH to force a client to
* reauthenticate before the responders lifetime reaches the limit.
*/
struct ike_auth_lifetime_t {
@@ -46,7 +46,7 @@ struct ike_auth_lifetime_t {
*
* @param ike_sa IKE_SA this task works for
* @param initiator TRUE if taks is initiated by us
- * @return ike_auth_lifetime task to handle by the task_manager
+ * @return ike_auth_lifetime task to handle by the task_manager
*/
ike_auth_lifetime_t *ike_auth_lifetime_create(ike_sa_t *ike_sa, bool initiator);
diff --git a/src/charon/sa/tasks/ike_cert_post.c b/src/charon/sa/tasks/ike_cert_post.c
index 70e87c2e7..c831df975 100644
--- a/src/charon/sa/tasks/ike_cert_post.c
+++ b/src/charon/sa/tasks/ike_cert_post.c
@@ -30,17 +30,17 @@ typedef struct private_ike_cert_post_t private_ike_cert_post_t;
* Private members of a ike_cert_post_t task.
*/
struct private_ike_cert_post_t {
-
+
/**
* Public methods and task_t interface.
*/
ike_cert_post_t public;
-
+
/**
* Assigned IKE_SA.
*/
ike_sa_t *ike_sa;
-
+
/**
* Are we the initiator?
*/
@@ -50,49 +50,47 @@ struct private_ike_cert_post_t {
/**
* Generates the cert payload, if possible with "Hash and URL"
*/
-static cert_payload_t *build_cert_payload(private_ike_cert_post_t *this, certificate_t *cert)
+static cert_payload_t *build_cert_payload(private_ike_cert_post_t *this,
+ certificate_t *cert)
{
+ hasher_t *hasher;
+ identification_t *id;
+ chunk_t hash, encoded ;
+ enumerator_t *enumerator;
+ char *url;
cert_payload_t *payload = NULL;
-
- if (this->ike_sa->supports_extension(this->ike_sa, EXT_HASH_AND_URL))
+
+ if (!this->ike_sa->supports_extension(this->ike_sa, EXT_HASH_AND_URL))
{
- /* ok, our peer sent us a HTTP_CERT_LOOKUP_SUPPORTED Notify */
- hasher_t *hasher = lib->crypto->create_hasher(lib->crypto, HASH_SHA1);
- if (hasher != NULL)
- {
- chunk_t hash, encoded = cert->get_encoding(cert);
- enumerator_t *enumerator;
- char *url;
-
- hasher->allocate_hash(hasher, encoded, &hash);
- identification_t *id = identification_create_from_encoding(ID_CERT_DER_SHA1, hash);
-
- enumerator = charon->credentials->create_cdp_enumerator(charon->credentials, CERT_X509, id);
- if (enumerator->enumerate(enumerator, &url))
- {
- /* if we have an URL available we send that to our peer */
- payload = cert_payload_create_from_hash_and_url(hash, url);
- }
- enumerator->destroy(enumerator);
-
- id->destroy(id);
- chunk_free(&hash);
- chunk_free(&encoded);
- hasher->destroy(hasher);
- }
- else
- {
- DBG1(DBG_IKE, "unable to use hash-and-url: sha1 not supported");
- }
+ return cert_payload_create_from_cert(cert);
+ }
+
+ hasher = lib->crypto->create_hasher(lib->crypto, HASH_SHA1);
+ if (!hasher)
+ {
+ DBG1(DBG_IKE, "unable to use hash-and-url: sha1 not supported");
+ return cert_payload_create_from_cert(cert);
}
-
- if (!payload)
+
+ encoded = cert->get_encoding(cert);
+ hasher->allocate_hash(hasher, encoded, &hash);
+ chunk_free(&encoded);
+ hasher->destroy(hasher);
+ id = identification_create_from_encoding(ID_KEY_ID, hash);
+
+ enumerator = charon->credentials->create_cdp_enumerator(charon->credentials,
+ CERT_X509, id);
+ if (enumerator->enumerate(enumerator, &url))
+ {
+ payload = cert_payload_create_from_hash_and_url(hash, url);
+ }
+ else
{
- /* our peer does not support "Hash and URL" or we do not have an URL
- * to send to our peer, just create a normal cert payload */
payload = cert_payload_create_from_cert(cert);
}
-
+ enumerator->destroy(enumerator);
+ chunk_free(&hash);
+ id->destroy(id);
return payload;
}
@@ -103,14 +101,14 @@ static void build_certs(private_ike_cert_post_t *this, message_t *message)
{
peer_cfg_t *peer_cfg;
auth_payload_t *payload;
-
+
payload = (auth_payload_t*)message->get_payload(message, AUTHENTICATION);
peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
if (!peer_cfg || !payload || payload->get_auth_method(payload) == AUTH_PSK)
{ /* no CERT payload for EAP/PSK */
return;
}
-
+
switch (peer_cfg->get_cert_policy(peer_cfg))
{
case CERT_NEVER_SEND:
@@ -128,9 +126,9 @@ static void build_certs(private_ike_cert_post_t *this, message_t *message)
certificate_t *cert;
auth_rule_t type;
auth_cfg_t *auth;
-
+
auth = this->ike_sa->get_auth_cfg(this->ike_sa, TRUE);
-
+
/* get subject cert first, then issuing certificates */
cert = auth->get(auth, AUTH_RULE_SUBJECT_CERT);
if (!cert)
@@ -145,7 +143,7 @@ static void build_certs(private_ike_cert_post_t *this, message_t *message)
DBG1(DBG_IKE, "sending end entity cert \"%Y\"",
cert->get_subject(cert));
message->add_payload(message, (payload_t*)payload);
-
+
enumerator = auth->create_enumerator(auth);
while (enumerator->enumerate(enumerator, &type, &cert))
{
@@ -161,7 +159,7 @@ static void build_certs(private_ike_cert_post_t *this, message_t *message)
}
}
enumerator->destroy(enumerator);
- }
+ }
}
}
@@ -171,7 +169,7 @@ static void build_certs(private_ike_cert_post_t *this, message_t *message)
static status_t build_i(private_ike_cert_post_t *this, message_t *message)
{
build_certs(this, message);
-
+
return NEED_MORE;
}
@@ -179,7 +177,7 @@ static status_t build_i(private_ike_cert_post_t *this, message_t *message)
* Implementation of task_t.process for responder
*/
static status_t process_r(private_ike_cert_post_t *this, message_t *message)
-{
+{
return NEED_MORE;
}
@@ -189,7 +187,7 @@ static status_t process_r(private_ike_cert_post_t *this, message_t *message)
static status_t build_r(private_ike_cert_post_t *this, message_t *message)
{
build_certs(this, message);
-
+
if (this->ike_sa->get_state(this->ike_sa) != IKE_ESTABLISHED)
{ /* stay alive, we might have additional rounds with certs */
return NEED_MORE;
@@ -243,7 +241,7 @@ ike_cert_post_t *ike_cert_post_create(ike_sa_t *ike_sa, bool initiator)
this->public.task.get_type = (task_type_t(*)(task_t*))get_type;
this->public.task.migrate = (void(*)(task_t*,ike_sa_t*))migrate;
this->public.task.destroy = (void(*)(task_t*))destroy;
-
+
if (initiator)
{
this->public.task.build = (status_t(*)(task_t*,message_t*))build_i;
@@ -254,10 +252,10 @@ ike_cert_post_t *ike_cert_post_create(ike_sa_t *ike_sa, bool initiator)
this->public.task.build = (status_t(*)(task_t*,message_t*))build_r;
this->public.task.process = (status_t(*)(task_t*,message_t*))process_r;
}
-
+
this->ike_sa = ike_sa;
this->initiator = initiator;
-
+
return &this->public;
}
diff --git a/src/charon/sa/tasks/ike_cert_post.h b/src/charon/sa/tasks/ike_cert_post.h
index fa555eac7..a21f45927 100644
--- a/src/charon/sa/tasks/ike_cert_post.h
+++ b/src/charon/sa/tasks/ike_cert_post.h
@@ -46,7 +46,7 @@ struct ike_cert_post_t {
*
* @param ike_sa IKE_SA this task works for
* @param initiator TRUE if thask is the original initator
- * @return ike_cert_post task to handle by the task_manager
+ * @return ike_cert_post task to handle by the task_manager
*/
ike_cert_post_t *ike_cert_post_create(ike_sa_t *ike_sa, bool initiator);
diff --git a/src/charon/sa/tasks/ike_cert_pre.c b/src/charon/sa/tasks/ike_cert_pre.c
index 1c72f289f..0805d0290 100644
--- a/src/charon/sa/tasks/ike_cert_pre.c
+++ b/src/charon/sa/tasks/ike_cert_pre.c
@@ -29,27 +29,27 @@ typedef struct private_ike_cert_pre_t private_ike_cert_pre_t;
* Private members of a ike_cert_pre_t task.
*/
struct private_ike_cert_pre_t {
-
+
/**
* Public methods and task_t interface.
*/
ike_cert_pre_t public;
-
+
/**
* Assigned IKE_SA.
*/
ike_sa_t *ike_sa;
-
+
/**
* Are we the initiator?
*/
bool initiator;
-
+
/**
* Do we accept HTTP certificate lookup requests
*/
bool do_http_lookup;
-
+
/**
* wheter this is the final authentication round
*/
@@ -57,29 +57,29 @@ struct private_ike_cert_pre_t {
};
/**
- * read certificate requests
+ * read certificate requests
*/
static void process_certreqs(private_ike_cert_pre_t *this, message_t *message)
{
enumerator_t *enumerator;
payload_t *payload;
auth_cfg_t *auth;
-
+
auth = this->ike_sa->get_auth_cfg(this->ike_sa, TRUE);
-
+
enumerator = message->create_payload_enumerator(message);
while (enumerator->enumerate(enumerator, &payload))
{
- switch(payload->get_type(payload))
+ switch (payload->get_type(payload))
{
case CERTIFICATE_REQUEST:
{
certreq_payload_t *certreq = (certreq_payload_t*)payload;
enumerator_t *enumerator;
chunk_t keyid;
-
+
this->ike_sa->set_condition(this->ike_sa, COND_CERTREQ_SEEN, TRUE);
-
+
if (certreq->get_cert_type(certreq) != CERT_X509)
{
DBG1(DBG_IKE, "cert payload %N not supported - ignored",
@@ -91,10 +91,9 @@ static void process_certreqs(private_ike_cert_pre_t *this, message_t *message)
{
identification_t *id;
certificate_t *cert;
-
- id = identification_create_from_encoding(
- ID_PUBKEY_INFO_SHA1, keyid);
- cert = charon->credentials->get_cert(charon->credentials,
+
+ id = identification_create_from_encoding(ID_KEY_ID, keyid);
+ cert = charon->credentials->get_cert(charon->credentials,
CERT_X509, KEY_ANY, id, TRUE);
if (cert)
{
@@ -115,7 +114,7 @@ static void process_certreqs(private_ike_cert_pre_t *this, message_t *message)
case NOTIFY:
{
notify_payload_t *notify = (notify_payload_t*)payload;
-
+
/* we only handle one type of notify here */
if (notify->get_notify_type(notify) == HTTP_CERT_LOOKUP_SUPPORTED)
{
@@ -135,11 +134,11 @@ static void process_certreqs(private_ike_cert_pre_t *this, message_t *message)
* tries to extract a certificate from the cert payload or the credential
* manager (based on the hash of a "Hash and URL" encoded cert).
* Note: the returned certificate (if any) has to be destroyed
- */
+ */
static certificate_t *try_get_cert(cert_payload_t *cert_payload)
{
certificate_t *cert = NULL;
-
+
switch (cert_payload->get_cert_encoding(cert_payload))
{
case ENC_X509_SIGNATURE:
@@ -156,8 +155,8 @@ static certificate_t *try_get_cert(cert_payload_t *cert_payload)
/* invalid "Hash and URL" data (logged elsewhere) */
break;
}
- id = identification_create_from_encoding(ID_CERT_DER_SHA1, hash);
- cert = charon->credentials->get_cert(charon->credentials,
+ id = identification_create_from_encoding(ID_KEY_ID, hash);
+ cert = charon->credentials->get_cert(charon->credentials,
CERT_X509, KEY_ANY, id, FALSE);
id->destroy(id);
break;
@@ -179,9 +178,9 @@ static void process_certs(private_ike_cert_pre_t *this, message_t *message)
payload_t *payload;
auth_cfg_t *auth;
bool first = TRUE;
-
+
auth = this->ike_sa->get_auth_cfg(this->ike_sa, FALSE);
-
+
enumerator = message->create_payload_enumerator(message);
while (enumerator->enumerate(enumerator, &payload))
{
@@ -191,10 +190,10 @@ static void process_certs(private_ike_cert_pre_t *this, message_t *message)
cert_encoding_t encoding;
certificate_t *cert;
char *url;
-
+
cert_payload = (cert_payload_t*)payload;
encoding = cert_payload->get_cert_encoding(cert_payload);
-
+
switch (encoding)
{
case ENC_X509_HASH_AND_URL:
@@ -284,9 +283,9 @@ static void add_certreq(certreq_payload_t **req, certificate_t *cert)
case CERT_X509:
{
public_key_t *public;
- identification_t *keyid;
+ chunk_t keyid;
x509_t *x509 = (x509_t*)cert;
-
+
if (!(x509->get_flags(x509) & X509_CA))
{ /* no CA cert, skip */
break;
@@ -300,11 +299,13 @@ static void add_certreq(certreq_payload_t **req, certificate_t *cert)
{
*req = certreq_payload_create_type(CERT_X509);
}
- keyid = public->get_id(public, ID_PUBKEY_INFO_SHA1);
- (*req)->add_keyid(*req, keyid->get_encoding(keyid));
+ if (public->get_fingerprint(public, KEY_ID_PUBKEY_INFO_SHA1, &keyid))
+ {
+ (*req)->add_keyid(*req, keyid);
+ DBG1(DBG_IKE, "sending cert request for \"%Y\"",
+ cert->get_subject(cert));
+ }
public->destroy(public);
- DBG1(DBG_IKE, "sending cert request for \"%Y\"",
- cert->get_subject(cert));
break;
}
default:
@@ -320,7 +321,7 @@ static void add_certreqs(certreq_payload_t **req, auth_cfg_t *auth)
enumerator_t *enumerator;
auth_rule_t type;
void *value;
-
+
enumerator = auth->create_enumerator(auth);
while (enumerator->enumerate(enumerator, &type, &value))
{
@@ -347,13 +348,13 @@ static void build_certreqs(private_ike_cert_pre_t *this, message_t *message)
certificate_t *cert;
auth_cfg_t *auth;
certreq_payload_t *req = NULL;
-
+
ike_cfg = this->ike_sa->get_ike_cfg(this->ike_sa);
if (!ike_cfg->send_certreq(ike_cfg))
{
return;
}
-
+
/* check if we require a specific CA for that peer */
peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
if (peer_cfg)
@@ -365,7 +366,7 @@ static void build_certreqs(private_ike_cert_pre_t *this, message_t *message)
}
enumerator->destroy(enumerator);
}
-
+
if (!req)
{
/* otherwise add all trusted CA certificates */
@@ -377,11 +378,11 @@ static void build_certreqs(private_ike_cert_pre_t *this, message_t *message)
}
enumerator->destroy(enumerator);
}
-
+
if (req)
{
message->add_payload(message, (payload_t*)req);
-
+
if (lib->settings->get_bool(lib->settings, "charon.hash_and_url", FALSE))
{
message->add_notify(message, FALSE, HTTP_CERT_LOOKUP_SUPPORTED,
@@ -396,29 +397,15 @@ static void build_certreqs(private_ike_cert_pre_t *this, message_t *message)
*/
static bool final_auth(message_t *message)
{
- enumerator_t *enumerator;
- payload_t *payload;
- notify_payload_t *notify;
-
/* we check for an AUTH payload without a ANOTHER_AUTH_FOLLOWS notify */
if (message->get_payload(message, AUTHENTICATION) == NULL)
{
return FALSE;
}
- enumerator = message->create_payload_enumerator(message);
- while (enumerator->enumerate(enumerator, &payload))
+ if (message->get_notify(message, ANOTHER_AUTH_FOLLOWS))
{
- if (payload->get_type(payload) == NOTIFY)
- {
- notify = (notify_payload_t*)payload;
- if (notify->get_notify_type(notify) == ANOTHER_AUTH_FOLLOWS)
- {
- enumerator->destroy(enumerator);
- return FALSE;
- }
- }
+ return FALSE;
}
- enumerator->destroy(enumerator);
return TRUE;
}
@@ -426,7 +413,7 @@ static bool final_auth(message_t *message)
* Implementation of task_t.process for initiator
*/
static status_t build_i(private_ike_cert_pre_t *this, message_t *message)
-{
+{
if (message->get_message_id(message) == 1)
{ /* initiator sends CERTREQs in first IKE_AUTH */
build_certreqs(this, message);
@@ -474,7 +461,7 @@ static status_t process_i(private_ike_cert_pre_t *this, message_t *message)
process_certreqs(this, message);
}
process_certs(this, message);
-
+
if (final_auth(message))
{
return SUCCESS;
@@ -516,7 +503,7 @@ ike_cert_pre_t *ike_cert_pre_create(ike_sa_t *ike_sa, bool initiator)
this->public.task.get_type = (task_type_t(*)(task_t*))get_type;
this->public.task.migrate = (void(*)(task_t*,ike_sa_t*))migrate;
this->public.task.destroy = (void(*)(task_t*))destroy;
-
+
if (initiator)
{
this->public.task.build = (status_t(*)(task_t*,message_t*))build_i;
@@ -527,11 +514,11 @@ ike_cert_pre_t *ike_cert_pre_create(ike_sa_t *ike_sa, bool initiator)
this->public.task.build = (status_t(*)(task_t*,message_t*))build_r;
this->public.task.process = (status_t(*)(task_t*,message_t*))process_r;
}
-
+
this->ike_sa = ike_sa;
this->initiator = initiator;
this->do_http_lookup = FALSE;
this->final = FALSE;
-
+
return &this->public;
}
diff --git a/src/charon/sa/tasks/ike_cert_pre.h b/src/charon/sa/tasks/ike_cert_pre.h
index d49005e68..1541b80e5 100644
--- a/src/charon/sa/tasks/ike_cert_pre.h
+++ b/src/charon/sa/tasks/ike_cert_pre.h
@@ -46,7 +46,7 @@ struct ike_cert_pre_t {
*
* @param ike_sa IKE_SA this task works for
* @param initiator TRUE if thask is the original initator
- * @return ike_cert_pre task to handle by the task_manager
+ * @return ike_cert_pre task to handle by the task_manager
*/
ike_cert_pre_t *ike_cert_pre_create(ike_sa_t *ike_sa, bool initiator);
diff --git a/src/charon/sa/tasks/ike_config.c b/src/charon/sa/tasks/ike_config.c
index 1f75521b6..f010439fe 100644
--- a/src/charon/sa/tasks/ike_config.c
+++ b/src/charon/sa/tasks/ike_config.c
@@ -19,50 +19,60 @@
#include <daemon.h>
#include <encoding/payloads/cp_payload.h>
-#define DNS_SERVER_MAX 2
-#define NBNS_SERVER_MAX 2
-
typedef struct private_ike_config_t private_ike_config_t;
/**
* Private members of a ike_config_t task.
*/
struct private_ike_config_t {
-
+
/**
* Public methods and task_t interface.
*/
ike_config_t public;
-
+
/**
* Assigned IKE_SA.
*/
ike_sa_t *ike_sa;
-
+
/**
* Are we the initiator?
*/
bool initiator;
-
+
/**
* virtual ip
*/
host_t *virtual_ip;
+
+ /**
+ * list of attributes requested and its handler, entry_t
+ */
+ linked_list_t *requested;
};
/**
- * build INTERNAL_IPV4/6_ADDRESS from virtual ip
+ * Entry for a requested attribute and the requesting handler
+ */
+typedef struct {
+ /** attribute requested */
+ configuration_attribute_type_t type;
+ /** handler requesting this attribute */
+ attribute_handler_t *handler;
+} entry_t;
+
+/**
+ * build INTERNAL_IPV4/6_ADDRESS attribute from virtual ip
*/
-static void build_vip(private_ike_config_t *this, host_t *vip, cp_payload_t *cp)
+static configuration_attribute_t *build_vip(host_t *vip)
{
- configuration_attribute_t *ca;
+ configuration_attribute_type_t type;
chunk_t chunk, prefix;
-
- ca = configuration_attribute_create();
-
+
if (vip->get_family(vip) == AF_INET)
{
- ca->set_type(ca, INTERNAL_IP4_ADDRESS);
+ type = INTERNAL_IP4_ADDRESS;
if (vip->is_anyaddr(vip))
{
chunk = chunk_empty;
@@ -74,7 +84,7 @@ static void build_vip(private_ike_config_t *this, host_t *vip, cp_payload_t *cp)
}
else
{
- ca->set_type(ca, INTERNAL_IP6_ADDRESS);
+ type = INTERNAL_IP6_ADDRESS;
if (vip->is_anyaddr(vip))
{
chunk = chunk_empty;
@@ -87,8 +97,42 @@ static void build_vip(private_ike_config_t *this, host_t *vip, cp_payload_t *cp)
chunk = chunk_cata("cc", chunk, prefix);
}
}
- ca->set_value(ca, chunk);
- cp->add_configuration_attribute(cp, ca);
+ return configuration_attribute_create_value(type, chunk);
+}
+
+/**
+ * Handle a received attribute as initiator
+ */
+static void handle_attribute(private_ike_config_t *this,
+ configuration_attribute_t *ca)
+{
+ attribute_handler_t *handler = NULL;
+ enumerator_t *enumerator;
+ entry_t *entry;
+
+ /* find the handler which requested this attribute */
+ enumerator = this->requested->create_enumerator(this->requested);
+ while (enumerator->enumerate(enumerator, &entry))
+ {
+ if (entry->type == ca->get_type(ca))
+ {
+ handler = entry->handler;
+ this->requested->remove_at(this->requested, enumerator);
+ free(entry);
+ break;
+ }
+ }
+ enumerator->destroy(enumerator);
+
+ /* and pass it to the handle function */
+ handler = lib->attributes->handle(lib->attributes,
+ this->ike_sa->get_other_id(this->ike_sa), handler,
+ ca->get_type(ca), ca->get_value(ca));
+ if (handler)
+ {
+ this->ike_sa->add_configuration_attribute(this->ike_sa,
+ handler, ca->get_type(ca), ca->get_value(ca));
+ }
}
/**
@@ -100,7 +144,7 @@ static void process_attribute(private_ike_config_t *this,
host_t *ip;
chunk_t addr;
int family = AF_INET6;
-
+
switch (ca->get_type(ca))
{
case INTERNAL_IP4_ADDRESS:
@@ -118,7 +162,7 @@ static void process_attribute(private_ike_config_t *this,
/* skip prefix byte in IPv6 payload*/
if (family == AF_INET6)
{
- addr.len--;
+ addr.len--;
}
ip = host_create_from_chunk(family, addr, 0);
}
@@ -130,15 +174,12 @@ static void process_attribute(private_ike_config_t *this,
break;
}
default:
+ {
if (this->initiator)
{
- this->ike_sa->add_configuration_attribute(this->ike_sa,
- ca->get_type(ca), ca->get_value(ca));
- }
- else
- {
- /* we do not handle attribute requests other than for VIPs */
+ handle_attribute(this, ca);
}
+ }
}
}
@@ -147,10 +188,9 @@ static void process_attribute(private_ike_config_t *this,
*/
static void process_payloads(private_ike_config_t *this, message_t *message)
{
- enumerator_t *enumerator;
- iterator_t *attributes;
+ enumerator_t *enumerator, *attributes;
payload_t *payload;
-
+
enumerator = message->create_payload_enumerator(message);
while (enumerator->enumerate(enumerator, &payload))
{
@@ -158,22 +198,25 @@ static void process_payloads(private_ike_config_t *this, message_t *message)
{
cp_payload_t *cp = (cp_payload_t*)payload;
configuration_attribute_t *ca;
- switch (cp->get_config_type(cp))
+
+ switch (cp->get_type(cp))
{
case CFG_REQUEST:
case CFG_REPLY:
{
- attributes = cp->create_attribute_iterator(cp);
- while (attributes->iterate(attributes, (void**)&ca))
+ attributes = cp->create_attribute_enumerator(cp);
+ while (attributes->enumerate(attributes, &ca))
{
+ DBG2(DBG_IKE, "processing %N attribute",
+ configuration_attribute_type_names, ca->get_type(ca));
process_attribute(this, ca);
}
attributes->destroy(attributes);
break;
}
default:
- DBG1(DBG_IKE, "ignoring %N config payload",
- config_type_names, cp->get_config_type(cp));
+ DBG1(DBG_IKE, "ignoring %N config payload",
+ config_type_names, cp->get_type(cp));
break;
}
}
@@ -188,9 +231,14 @@ static status_t build_i(private_ike_config_t *this, message_t *message)
{
if (message->get_message_id(message) == 1)
{ /* in first IKE_AUTH only */
+ cp_payload_t *cp = NULL;
+ enumerator_t *enumerator;
+ attribute_handler_t *handler;
peer_cfg_t *config;
+ configuration_attribute_type_t type;
+ chunk_t data;
host_t *vip;
-
+
/* reuse virtual IP if we already have one */
vip = this->ike_sa->get_virtual_ip(this->ike_sa, TRUE);
if (!vip)
@@ -200,25 +248,38 @@ static status_t build_i(private_ike_config_t *this, message_t *message)
}
if (vip)
{
+ cp = cp_payload_create_type(CFG_REQUEST);
+ cp->add_attribute(cp, build_vip(vip));
+ }
+
+ enumerator = lib->attributes->create_initiator_enumerator(lib->attributes,
+ this->ike_sa->get_other_id(this->ike_sa), vip);
+ while (enumerator->enumerate(enumerator, &handler, &type, &data))
+ {
configuration_attribute_t *ca;
- cp_payload_t *cp;
-
- cp = cp_payload_create();
- cp->set_config_type(cp, CFG_REQUEST);
-
- build_vip(this, vip, cp);
-
- /* we currently always add a DNS request if we request an IP */
- ca = configuration_attribute_create();
- if (vip->get_family(vip) == AF_INET)
- {
- ca->set_type(ca, INTERNAL_IP4_DNS);
- }
- else
+ entry_t *entry;
+
+ /* create configuration attribute */
+ DBG2(DBG_IKE, "building %N attribute",
+ configuration_attribute_type_names, type);
+ ca = configuration_attribute_create_value(type, data);
+ if (!cp)
{
- ca->set_type(ca, INTERNAL_IP6_DNS);
+ cp = cp_payload_create_type(CFG_REQUEST);
}
- cp->add_configuration_attribute(cp, ca);
+ cp->add_attribute(cp, ca);
+
+ /* save handler along with requested type */
+ entry = malloc_thing(entry_t);
+ entry->type = type;
+ entry->handler = handler;
+
+ this->requested->insert_last(this->requested, entry);
+ }
+ enumerator->destroy(enumerator);
+
+ if (cp)
+ {
message->add_payload(message, (payload_t*)cp);
}
}
@@ -238,30 +299,62 @@ static status_t process_r(private_ike_config_t *this, message_t *message)
}
/**
+ * Find a peer (EAP) identity to query provider for attributes
+ */
+static identification_t *get_peer_identity(private_ike_config_t *this)
+{
+ identification_t *id = NULL, *current;
+ enumerator_t *enumerator;
+ auth_cfg_t *cfg;
+
+ enumerator = this->ike_sa->create_auth_cfg_enumerator(this->ike_sa, FALSE);
+ while (enumerator->enumerate(enumerator, &cfg))
+ {
+ /* prefer EAP-Identity of last round */
+ current = cfg->get(cfg, AUTH_RULE_EAP_IDENTITY);
+ if (!current || current->get_type(current) == ID_ANY)
+ {
+ current = cfg->get(cfg, AUTH_RULE_IDENTITY);
+ }
+ if (current && current->get_type(current) != ID_ANY)
+ {
+ id = current;
+ continue;
+ }
+ }
+ enumerator->destroy(enumerator);
+ if (!id)
+ { /* fallback, should not happen */
+ id = this->ike_sa->get_other_id(this->ike_sa);
+ }
+ return id;
+}
+
+/**
* Implementation of task_t.build for responder
*/
static status_t build_r(private_ike_config_t *this, message_t *message)
{
if (this->ike_sa->get_state(this->ike_sa) == IKE_ESTABLISHED)
{ /* in last IKE_AUTH exchange */
- peer_cfg_t *config = this->ike_sa->get_peer_cfg(this->ike_sa);
-
+ enumerator_t *enumerator;
+ configuration_attribute_type_t type;
+ chunk_t value;
+ host_t *vip = NULL;
+ cp_payload_t *cp = NULL;
+ peer_cfg_t *config;
+ identification_t *id;
+
+ id = get_peer_identity(this);
+
+ config = this->ike_sa->get_peer_cfg(this->ike_sa);
if (config && this->virtual_ip)
{
- enumerator_t *enumerator;
- configuration_attribute_type_t type;
- configuration_attribute_t *ca;
- chunk_t value;
- cp_payload_t *cp;
- host_t *vip = NULL;
-
DBG1(DBG_IKE, "peer requested virtual IP %H", this->virtual_ip);
if (config->get_pool(config))
{
- vip = charon->attributes->acquire_address(charon->attributes,
- config->get_pool(config),
- this->ike_sa->get_other_id(this->ike_sa),
- this->virtual_ip);
+ vip = lib->attributes->acquire_address(lib->attributes,
+ config->get_pool(config), id, this->virtual_ip);
}
if (vip == NULL)
{
@@ -273,27 +366,32 @@ static status_t build_r(private_ike_config_t *this, message_t *message)
}
DBG1(DBG_IKE, "assigning virtual IP %H to peer", vip);
this->ike_sa->set_virtual_ip(this->ike_sa, FALSE, vip);
-
- cp = cp_payload_create();
- cp->set_config_type(cp, CFG_REPLY);
-
- build_vip(this, vip, cp);
- vip->destroy(vip);
-
- /* if we add an IP, we also look for other attributes */
- enumerator = charon->attributes->create_attribute_enumerator(
- charon->attributes, this->ike_sa->get_other_id(this->ike_sa));
- while (enumerator->enumerate(enumerator, &type, &value))
+
+ cp = cp_payload_create_type(CFG_REPLY);
+ cp->add_attribute(cp, build_vip(vip));
+ }
+
+ /* query registered providers for additional attributes to include */
+ enumerator = lib->attributes->create_responder_enumerator(
+ lib->attributes, id, vip);
+ while (enumerator->enumerate(enumerator, &type, &value))
+ {
+ if (!cp)
{
- ca = configuration_attribute_create();
- ca->set_type(ca, type);
- ca->set_value(ca, value);
- cp->add_configuration_attribute(cp, ca);
+ cp = cp_payload_create_type(CFG_REPLY);
}
- enumerator->destroy(enumerator);
-
+ DBG2(DBG_IKE, "building %N attribute",
+ configuration_attribute_type_names, type);
+ cp->add_attribute(cp,
+ configuration_attribute_create_value(type, value));
+ }
+ enumerator->destroy(enumerator);
+
+ if (cp)
+ {
message->add_payload(message, (payload_t*)cp);
}
+ DESTROY_IF(vip);
return SUCCESS;
}
return NEED_MORE;
@@ -306,9 +404,9 @@ static status_t process_i(private_ike_config_t *this, message_t *message)
{
if (this->ike_sa->get_state(this->ike_sa) == IKE_ESTABLISHED)
{ /* in last IKE_AUTH exchange */
-
+
process_payloads(this, message);
-
+
if (this->virtual_ip)
{
this->ike_sa->set_virtual_ip(this->ike_sa, TRUE, this->virtual_ip);
@@ -332,9 +430,11 @@ static task_type_t get_type(private_ike_config_t *this)
static void migrate(private_ike_config_t *this, ike_sa_t *ike_sa)
{
DESTROY_IF(this->virtual_ip);
-
+
this->ike_sa = ike_sa;
this->virtual_ip = NULL;
+ this->requested->destroy_function(this->requested, free);
+ this->requested = linked_list_create();
}
/**
@@ -343,6 +443,7 @@ static void migrate(private_ike_config_t *this, ike_sa_t *ike_sa)
static void destroy(private_ike_config_t *this)
{
DESTROY_IF(this->virtual_ip);
+ this->requested->destroy_function(this->requested, free);
free(this);
}
@@ -352,15 +453,16 @@ static void destroy(private_ike_config_t *this)
ike_config_t *ike_config_create(ike_sa_t *ike_sa, bool initiator)
{
private_ike_config_t *this = malloc_thing(private_ike_config_t);
-
+
this->public.task.get_type = (task_type_t(*)(task_t*))get_type;
this->public.task.migrate = (void(*)(task_t*,ike_sa_t*))migrate;
this->public.task.destroy = (void(*)(task_t*))destroy;
-
+
this->initiator = initiator;
this->ike_sa = ike_sa;
this->virtual_ip = NULL;
-
+ this->requested = linked_list_create();
+
if (initiator)
{
this->public.task.build = (status_t(*)(task_t*,message_t*))build_i;
@@ -371,7 +473,7 @@ ike_config_t *ike_config_create(ike_sa_t *ike_sa, bool initiator)
this->public.task.build = (status_t(*)(task_t*,message_t*))build_r;
this->public.task.process = (status_t(*)(task_t*,message_t*))process_r;
}
-
+
return &this->public;
}
diff --git a/src/charon/sa/tasks/ike_config.h b/src/charon/sa/tasks/ike_config.h
index 32635e85e..8cef08697 100644
--- a/src/charon/sa/tasks/ike_config.h
+++ b/src/charon/sa/tasks/ike_config.h
@@ -44,7 +44,7 @@ struct ike_config_t {
*
* @param ike_sa IKE_SA this task works for
* @param initiator TRUE for initiator
- * @return ike_config task to handle by the task_manager
+ * @return ike_config task to handle by the task_manager
*/
ike_config_t *ike_config_create(ike_sa_t *ike_sa, bool initiator);
diff --git a/src/charon/sa/tasks/ike_delete.c b/src/charon/sa/tasks/ike_delete.c
index cde117934..130948836 100644
--- a/src/charon/sa/tasks/ike_delete.c
+++ b/src/charon/sa/tasks/ike_delete.c
@@ -25,27 +25,27 @@ typedef struct private_ike_delete_t private_ike_delete_t;
* Private members of a ike_delete_t task.
*/
struct private_ike_delete_t {
-
+
/**
* Public methods and task_t interface.
*/
ike_delete_t public;
-
+
/**
* Assigned IKE_SA.
*/
ike_sa_t *ike_sa;
-
+
/**
* Are we the initiator?
*/
bool initiator;
-
+
/**
* are we deleting a rekeyed SA?
*/
bool rekeyed;
-
+
/**
* are we responding to a delete, but have initated our own?
*/
@@ -69,7 +69,7 @@ static status_t build_i(private_ike_delete_t *this, message_t *message)
delete_payload = delete_payload_create(PROTO_IKE);
message->add_payload(message, (payload_t*)delete_payload);
-
+
if (this->ike_sa->get_state(this->ike_sa) == IKE_REKEYING)
{
this->rekeyed = TRUE;
@@ -189,7 +189,7 @@ ike_delete_t *ike_delete_create(ike_sa_t *ike_sa, bool initiator)
this->public.task.get_type = (task_type_t(*)(task_t*))get_type;
this->public.task.migrate = (void(*)(task_t*,ike_sa_t*))migrate;
this->public.task.destroy = (void(*)(task_t*))destroy;
-
+
if (initiator)
{
this->public.task.build = (status_t(*)(task_t*,message_t*))build_i;
@@ -200,11 +200,11 @@ ike_delete_t *ike_delete_create(ike_sa_t *ike_sa, bool initiator)
this->public.task.build = (status_t(*)(task_t*,message_t*))build_r;
this->public.task.process = (status_t(*)(task_t*,message_t*))process_r;
}
-
+
this->ike_sa = ike_sa;
this->initiator = initiator;
this->rekeyed = FALSE;
this->simultaneous = FALSE;
-
+
return &this->public;
}
diff --git a/src/charon/sa/tasks/ike_dpd.c b/src/charon/sa/tasks/ike_dpd.c
index 3aa714049..4c6ba7662 100644
--- a/src/charon/sa/tasks/ike_dpd.c
+++ b/src/charon/sa/tasks/ike_dpd.c
@@ -24,7 +24,7 @@ typedef struct private_ike_dpd_t private_ike_dpd_t;
* Private members of a ike_dpd_t task.
*/
struct private_ike_dpd_t {
-
+
/**
* Public methods and task_t interface.
*/
@@ -83,7 +83,7 @@ ike_dpd_t *ike_dpd_create(bool initiator)
this->public.task.get_type = (task_type_t(*)(task_t*))get_type;
this->public.task.migrate = (void(*)(task_t*,ike_sa_t*))migrate;
this->public.task.destroy = (void(*)(task_t*))destroy;
-
+
if (initiator)
{
this->public.task.build = (status_t(*)(task_t*,message_t*))return_need_more;
@@ -94,6 +94,6 @@ ike_dpd_t *ike_dpd_create(bool initiator)
this->public.task.build = (status_t(*)(task_t*,message_t*))return_success;
this->public.task.process = (status_t(*)(task_t*,message_t*))return_need_more;
}
-
+
return &this->public;
}
diff --git a/src/charon/sa/tasks/ike_init.c b/src/charon/sa/tasks/ike_init.c
index 2705f5886..5eb33b540 100644
--- a/src/charon/sa/tasks/ike_init.c
+++ b/src/charon/sa/tasks/ike_init.c
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2008 Tobias Brunner
+ * Copyright (C) 2008-2009 Tobias Brunner
* Copyright (C) 2005-2008 Martin Willi
* Copyright (C) 2005 Jan Hutter
* Hochschule fuer Technik Rapperswil
@@ -24,7 +24,6 @@
#include <encoding/payloads/sa_payload.h>
#include <encoding/payloads/ke_payload.h>
#include <encoding/payloads/nonce_payload.h>
-#include <encoding/payloads/vendor_id_payload.h>
/** maximum retries to do with cookies/other dh groups */
#define MAX_RETRIES 5
@@ -35,67 +34,67 @@ typedef struct private_ike_init_t private_ike_init_t;
* Private members of a ike_init_t task.
*/
struct private_ike_init_t {
-
+
/**
* Public methods and task_t interface.
*/
ike_init_t public;
-
+
/**
* Assigned IKE_SA.
*/
ike_sa_t *ike_sa;
-
+
/**
* Are we the initiator?
*/
bool initiator;
-
+
/**
* IKE config to establish
*/
ike_cfg_t *config;
-
+
/**
* diffie hellman group to use
*/
diffie_hellman_group_t dh_group;
-
+
/**
* diffie hellman key exchange
*/
diffie_hellman_t *dh;
-
+
/**
* Keymat derivation (from IKE_SA)
*/
keymat_t *keymat;
-
+
/**
* nonce chosen by us
*/
chunk_t my_nonce;
-
+
/**
* nonce chosen by peer
*/
chunk_t other_nonce;
-
+
/**
* Negotiated proposal used for IKE_SA
*/
proposal_t *proposal;
-
+
/**
* Old IKE_SA which gets rekeyed
*/
ike_sa_t *old_sa;
-
+
/**
* cookie received from responder
*/
chunk_t cookie;
-
+
/**
* retries done so far after failure (cookie or bad dh group)
*/
@@ -114,16 +113,16 @@ static void build_payloads(private_ike_init_t *this, message_t *message)
ike_sa_id_t *id;
proposal_t *proposal;
iterator_t *iterator;
-
+
id = this->ike_sa->get_id(this->ike_sa);
-
+
this->config = this->ike_sa->get_ike_cfg(this->ike_sa);
if (this->initiator)
{
proposal_list = this->config->get_proposals(this->config);
if (this->old_sa)
- {
+ {
/* include SPI of new IKE_SA when we are rekeying */
iterator = proposal_list->create_iterator(proposal_list, TRUE);
while (iterator->iterate(iterator, (void**)&proposal))
@@ -132,7 +131,7 @@ static void build_payloads(private_ike_init_t *this, message_t *message)
}
iterator->destroy(iterator);
}
-
+
sa_payload = sa_payload_create_from_proposal_list(proposal_list);
proposal_list->destroy_offset(proposal_list, offsetof(proposal_t, destroy));
}
@@ -146,11 +145,11 @@ static void build_payloads(private_ike_init_t *this, message_t *message)
sa_payload = sa_payload_create_from_proposal(this->proposal);
}
message->add_payload(message, (payload_t*)sa_payload);
-
+
nonce_payload = nonce_payload_create();
nonce_payload->set_nonce(nonce_payload, this->my_nonce);
ke_payload = ke_payload_create_from_diffie_hellman(this->dh);
-
+
if (this->old_sa)
{ /* payload order differs if we are rekeying */
message->add_payload(message, (payload_t*)nonce_payload);
@@ -170,7 +169,7 @@ static void process_payloads(private_ike_init_t *this, message_t *message)
{
enumerator_t *enumerator;
payload_t *payload;
-
+
enumerator = message->create_payload_enumerator(message);
while (enumerator->enumerate(enumerator, &payload))
{
@@ -180,18 +179,21 @@ static void process_payloads(private_ike_init_t *this, message_t *message)
{
sa_payload_t *sa_payload = (sa_payload_t*)payload;
linked_list_t *proposal_list;
-
+ bool private;
+
proposal_list = sa_payload->get_proposals(sa_payload);
+ private = this->ike_sa->supports_extension(this->ike_sa,
+ EXT_STRONGSWAN);
this->proposal = this->config->select_proposal(this->config,
- proposal_list);
- proposal_list->destroy_offset(proposal_list,
+ proposal_list, private);
+ proposal_list->destroy_offset(proposal_list,
offsetof(proposal_t, destroy));
break;
}
case KEY_EXCHANGE:
{
ke_payload_t *ke_payload = (ke_payload_t*)payload;
-
+
this->dh_group = ke_payload->get_dh_group_number(ke_payload);
if (!this->initiator)
{
@@ -212,13 +214,6 @@ static void process_payloads(private_ike_init_t *this, message_t *message)
this->other_nonce = nonce_payload->get_nonce(nonce_payload);
break;
}
- case VENDOR_ID:
- {
- vendor_id_payload_t *vendor_id = (vendor_id_payload_t*)payload;
- chunk_t vid = vendor_id->get_data(vendor_id);
-
- DBG1(DBG_ENC, "received vendor id: %#B", &vid);
- }
default:
break;
}
@@ -232,20 +227,20 @@ static void process_payloads(private_ike_init_t *this, message_t *message)
static status_t build_i(private_ike_init_t *this, message_t *message)
{
rng_t *rng;
-
+
this->config = this->ike_sa->get_ike_cfg(this->ike_sa);
DBG0(DBG_IKE, "initiating IKE_SA %s[%d] to %H",
this->ike_sa->get_name(this->ike_sa),
this->ike_sa->get_unique_id(this->ike_sa),
this->ike_sa->get_other_host(this->ike_sa));
this->ike_sa->set_state(this->ike_sa, IKE_CONNECTING);
-
- if (this->retry++ >= MAX_RETRIES)
+
+ if (this->retry >= MAX_RETRIES)
{
DBG1(DBG_IKE, "giving up after %d retries", MAX_RETRIES);
return FAILED;
}
-
+
/* if the DH group is set via use_dh_group(), we already have a DH object */
if (!this->dh)
{
@@ -258,7 +253,7 @@ static status_t build_i(private_ike_init_t *this, message_t *message)
return FAILED;
}
}
-
+
/* generate nonce only when we are trying the first time */
if (this->my_nonce.ptr == NULL)
{
@@ -271,12 +266,12 @@ static status_t build_i(private_ike_init_t *this, message_t *message)
rng->allocate_bytes(rng, NONCE_SIZE, &this->my_nonce);
rng->destroy(rng);
}
-
+
if (this->cookie.ptr)
{
message->add_notify(message, FALSE, COOKIE, this->cookie);
}
-
+
build_payloads(this, message);
#ifdef ME
@@ -288,7 +283,7 @@ static status_t build_i(private_ike_init_t *this, message_t *message)
}
}
#endif /* ME */
-
+
return NEED_MORE;
}
@@ -296,9 +291,9 @@ static status_t build_i(private_ike_init_t *this, message_t *message)
* Implementation of task_t.process for responder
*/
static status_t process_r(private_ike_init_t *this, message_t *message)
-{
+{
rng_t *rng;
-
+
this->config = this->ike_sa->get_ike_cfg(this->ike_sa);
DBG0(DBG_IKE, "%H is initiating an IKE_SA", message->get_source(message));
this->ike_sa->set_state(this->ike_sa, IKE_CONNECTING);
@@ -311,59 +306,22 @@ static status_t process_r(private_ike_init_t *this, message_t *message)
}
rng->allocate_bytes(rng, NONCE_SIZE, &this->my_nonce);
rng->destroy(rng);
-
+
#ifdef ME
{
- chunk_t connect_id = chunk_empty;
- enumerator_t *enumerator;
- payload_t *payload;
-
- /* check for a ME_CONNECTID notify */
- enumerator = message->create_payload_enumerator(message);
- while (enumerator->enumerate(enumerator, &payload))
- {
- if (payload->get_type(payload) == NOTIFY)
- {
- notify_payload_t *notify = (notify_payload_t*)payload;
- notify_type_t type = notify->get_notify_type(notify);
-
- switch (type)
- {
- case ME_CONNECTID:
- {
- chunk_free(&connect_id);
- connect_id = chunk_clone(notify->get_notification_data(notify));
- DBG2(DBG_IKE, "received ME_CONNECTID %#B", &connect_id);
- break;
- }
- default:
- {
- if (type < 16383)
- {
- DBG1(DBG_IKE, "received %N notify error",
- notify_type_names, type);
- break;
- }
- DBG2(DBG_IKE, "received %N notify",
- notify_type_names, type);
- break;
- }
- }
- }
- }
- enumerator->destroy(enumerator);
-
- if (connect_id.ptr)
+ notify_payload_t *notify = message->get_notify(message, ME_CONNECTID);
+ if (notify)
{
+ chunk_t connect_id = notify->get_notification_data(notify);
+ DBG2(DBG_IKE, "received ME_CONNECTID %#B", &connect_id);
charon->connect_manager->stop_checks(charon->connect_manager,
- connect_id);
- chunk_free(&connect_id);
+ connect_id);
}
}
#endif /* ME */
-
+
process_payloads(this, message);
-
+
return NEED_MORE;
}
@@ -377,7 +335,7 @@ static bool derive_keys(private_ike_init_t *this,
pseudo_random_function_t prf_alg = PRF_UNDEFINED;
chunk_t skd = chunk_empty;
ike_sa_id_t *id;
-
+
id = this->ike_sa->get_id(this->ike_sa);
if (this->old_sa)
{
@@ -417,12 +375,12 @@ static status_t build_r(private_ike_init_t *this, message_t *message)
return FAILED;
}
this->ike_sa->set_proposal(this->ike_sa, this->proposal);
-
+
if (this->dh == NULL ||
!this->proposal->has_dh_group(this->proposal, this->dh_group))
{
u_int16_t group;
-
+
if (this->proposal->get_algorithm(this->proposal, DIFFIE_HELLMAN_GROUP,
&group, NULL))
{
@@ -440,7 +398,7 @@ static status_t build_r(private_ike_init_t *this, message_t *message)
}
return FAILED;
}
-
+
if (!derive_keys(this, this->other_nonce, this->my_nonce))
{
DBG1(DBG_IKE, "key derivation failed");
@@ -458,7 +416,7 @@ static status_t process_i(private_ike_init_t *this, message_t *message)
{
enumerator_t *enumerator;
payload_t *payload;
-
+
/* check for erronous notifies */
enumerator = message->create_payload_enumerator(message);
while (enumerator->enumerate(enumerator, &payload))
@@ -467,27 +425,28 @@ static status_t process_i(private_ike_init_t *this, message_t *message)
{
notify_payload_t *notify = (notify_payload_t*)payload;
notify_type_t type = notify->get_notify_type(notify);
-
+
switch (type)
{
case INVALID_KE_PAYLOAD:
{
chunk_t data;
diffie_hellman_group_t bad_group;
-
+
bad_group = this->dh_group;
data = notify->get_notification_data(notify);
this->dh_group = ntohs(*((u_int16_t*)data.ptr));
DBG1(DBG_IKE, "peer didn't accept DH group %N, "
"it requested %N", diffie_hellman_group_names,
bad_group, diffie_hellman_group_names, this->dh_group);
-
+
if (this->old_sa == NULL)
{ /* reset the IKE_SA if we are not rekeying */
this->ike_sa->reset(this->ike_sa);
}
-
+
enumerator->destroy(enumerator);
+ this->retry++;
return NEED_MORE;
}
case NAT_DETECTION_SOURCE_IP:
@@ -504,6 +463,7 @@ static status_t process_i(private_ike_init_t *this, message_t *message)
this->ike_sa->reset(this->ike_sa);
enumerator->destroy(enumerator);
DBG2(DBG_IKE, "received %N notify", notify_type_names, type);
+ this->retry++;
return NEED_MORE;
}
default:
@@ -513,7 +473,7 @@ static status_t process_i(private_ike_init_t *this, message_t *message)
DBG1(DBG_IKE, "received %N notify error",
notify_type_names, type);
enumerator->destroy(enumerator);
- return FAILED;
+ return FAILED;
}
DBG2(DBG_IKE, "received %N notify",
notify_type_names, type);
@@ -523,7 +483,7 @@ static status_t process_i(private_ike_init_t *this, message_t *message)
}
}
enumerator->destroy(enumerator);
-
+
process_payloads(this, message);
/* check if we have everything */
@@ -534,14 +494,14 @@ static status_t process_i(private_ike_init_t *this, message_t *message)
return FAILED;
}
this->ike_sa->set_proposal(this->ike_sa, this->proposal);
-
+
if (this->dh == NULL ||
!this->proposal->has_dh_group(this->proposal, this->dh_group))
{
DBG1(DBG_IKE, "peer DH group selection invalid");
return FAILED;
}
-
+
if (!derive_keys(this, this->my_nonce, this->other_nonce))
{
DBG1(DBG_IKE, "key derivation failed");
@@ -581,7 +541,7 @@ static void migrate(private_ike_init_t *this, ike_sa_t *ike_sa)
{
DESTROY_IF(this->proposal);
chunk_free(&this->other_nonce);
-
+
this->ike_sa = ike_sa;
this->proposal = NULL;
DESTROY_IF(this->dh);
@@ -622,7 +582,7 @@ ike_init_t *ike_init_create(ike_sa_t *ike_sa, bool initiator, ike_sa_t *old_sa)
this->public.task.build = (status_t(*)(task_t*,message_t*))build_r;
this->public.task.process = (status_t(*)(task_t*,message_t*))process_r;
}
-
+
this->ike_sa = ike_sa;
this->initiator = initiator;
this->dh_group = MODP_NONE;
@@ -635,6 +595,6 @@ ike_init_t *ike_init_create(ike_sa_t *ike_sa, bool initiator, ike_sa_t *old_sa)
this->config = NULL;
this->old_sa = old_sa;
this->retry = 0;
-
+
return &this->public;
}
diff --git a/src/charon/sa/tasks/ike_init.h b/src/charon/sa/tasks/ike_init.h
index 8d3810ef2..7bd784cff 100644
--- a/src/charon/sa/tasks/ike_init.h
+++ b/src/charon/sa/tasks/ike_init.h
@@ -38,7 +38,7 @@ struct ike_init_t {
* Implements the task_t interface
*/
task_t task;
-
+
/**
* Get the lower of the two nonces, used for rekey collisions.
*
diff --git a/src/charon/sa/tasks/ike_me.c b/src/charon/sa/tasks/ike_me.c
index d359aa339..2d2847ae0 100644
--- a/src/charon/sa/tasks/ike_me.c
+++ b/src/charon/sa/tasks/ike_me.c
@@ -12,7 +12,7 @@
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
-
+
#include "ike_me.h"
#include <string.h>
@@ -33,71 +33,71 @@ typedef struct private_ike_me_t private_ike_me_t;
* Private members of a ike_me_t task.
*/
struct private_ike_me_t {
-
+
/**
* Public methods and task_t interface.
*/
ike_me_t public;
-
+
/**
* Assigned IKE_SA.
*/
ike_sa_t *ike_sa;
-
+
/**
* Are we the initiator?
*/
bool initiator;
-
+
/**
* Is this a mediation connection?
*/
bool mediation;
-
+
/**
* Is this the response from another peer?
*/
bool response;
-
+
/**
* Gathered endpoints
*/
linked_list_t *local_endpoints;
-
+
/**
* Parsed endpoints
*/
linked_list_t *remote_endpoints;
-
+
/**
* Did the peer request a callback?
*/
bool callback;
-
+
/**
* Did the connect fail?
*/
bool failed;
-
+
/**
* Was there anything wrong with the payloads?
*/
bool invalid_syntax;
-
+
/**
* The requested peer
*/
- identification_t *peer_id;
+ identification_t *peer_id;
/**
* Received ID used for connectivity checks
*/
chunk_t connect_id;
-
+
/**
* Received key used for connectivity checks
*/
chunk_t connect_key;
-
+
/**
* Peer config of the mediated connection
*/
@@ -112,7 +112,7 @@ static void add_endpoints_to_message(message_t *message, linked_list_t *endpoint
{
iterator_t *iterator;
endpoint_notify_t *endpoint;
-
+
iterator = endpoints->create_iterator(endpoints, TRUE);
while (iterator->iterate(iterator, (void**)&endpoint))
{
@@ -129,25 +129,25 @@ static void gather_and_add_endpoints(private_ike_me_t *this, message_t *message)
enumerator_t *enumerator;
host_t *addr, *host;
u_int16_t port;
-
+
/* get the port that is used to communicate with the ms */
host = this->ike_sa->get_my_host(this->ike_sa);
port = host->get_port(host);
-
+
enumerator = charon->kernel_interface->create_address_enumerator(
charon->kernel_interface, FALSE, FALSE);
while (enumerator->enumerate(enumerator, (void**)&addr))
{
host = addr->clone(addr);
host->set_port(host, port);
-
+
this->local_endpoints->insert_last(this->local_endpoints,
endpoint_notify_create_from_host(HOST, host, NULL));
-
+
host->destroy(host);
}
enumerator->destroy(enumerator);
-
+
host = this->ike_sa->get_server_reflexive_host(this->ike_sa);
if (host)
{
@@ -155,7 +155,7 @@ static void gather_and_add_endpoints(private_ike_me_t *this, message_t *message)
endpoint_notify_create_from_host(SERVER_REFLEXIVE, host,
this->ike_sa->get_my_host(this->ike_sa)));
}
-
+
add_endpoints_to_message(message, this->local_endpoints);
}
@@ -166,7 +166,7 @@ static void process_payloads(private_ike_me_t *this, message_t *message)
{
enumerator_t *enumerator;
payload_t *payload;
-
+
enumerator = message->create_payload_enumerator(message);
while (enumerator->enumerate(enumerator, &payload))
{
@@ -174,9 +174,9 @@ static void process_payloads(private_ike_me_t *this, message_t *message)
{
continue;
}
-
+
notify_payload_t *notify = (notify_payload_t*)payload;
-
+
switch (notify->get_notify_type(notify))
{
case ME_CONNECT_FAILED:
@@ -193,16 +193,19 @@ static void process_payloads(private_ike_me_t *this, message_t *message)
}
case ME_ENDPOINT:
{
- endpoint_notify_t *endpoint = endpoint_notify_create_from_payload(notify);
+ endpoint_notify_t *endpoint;
+ endpoint = endpoint_notify_create_from_payload(notify);
if (!endpoint)
{
DBG1(DBG_IKE, "received invalid ME_ENDPOINT notify");
break;
}
- DBG1(DBG_IKE, "received %N ME_ENDPOINT %#H", me_endpoint_type_names,
- endpoint->get_type(endpoint), endpoint->get_host(endpoint));
-
- this->remote_endpoints->insert_last(this->remote_endpoints, endpoint);
+ DBG1(DBG_IKE, "received %N ME_ENDPOINT %#H",
+ me_endpoint_type_names, endpoint->get_type(endpoint),
+ endpoint->get_host(endpoint));
+
+ this->remote_endpoints->insert_last(this->remote_endpoints,
+ endpoint);
break;
}
case ME_CALLBACK:
@@ -263,7 +266,9 @@ static status_t build_i(private_ike_me_t *this, message_t *message)
{
if (this->ike_sa->has_condition(this->ike_sa, COND_NAT_HERE))
{
- endpoint_notify_t *endpoint = endpoint_notify_create_from_host(SERVER_REFLEXIVE, NULL, NULL);
+ endpoint_notify_t *endpoint;
+ endpoint = endpoint_notify_create_from_host(SERVER_REFLEXIVE,
+ NULL, NULL);
message->add_payload(message, (payload_t*)endpoint->build_notify(endpoint));
endpoint->destroy(endpoint);
}
@@ -271,42 +276,42 @@ static status_t build_i(private_ike_me_t *this, message_t *message)
}
case ME_CONNECT:
{
- id_payload_t *id_payload;
rng_t *rng;
-
- id_payload = id_payload_create_from_identification(ID_PEER, this->peer_id);
+ id_payload_t *id_payload;
+ id_payload = id_payload_create_from_identification(ID_PEER,
+ this->peer_id);
message->add_payload(message, (payload_t*)id_payload);
-
+
rng = lib->crypto->create_rng(lib->crypto, RNG_STRONG);
if (!rng)
{
- DBG1(DBG_IKE, "unable to generate connect ID for ME_CONNECT");
+ DBG1(DBG_IKE, "unable to generate connect ID for ME_CONNECT");
return FAILED;
}
if (!this->response)
{
- /* only the initiator creates a connect ID. the responder returns
- * the connect ID that it received from the initiator */
+ /* only the initiator creates a connect ID. the responder
+ * returns the connect ID that it received from the initiator */
rng->allocate_bytes(rng, ME_CONNECTID_LEN, &this->connect_id);
}
rng->allocate_bytes(rng, ME_CONNECTKEY_LEN, &this->connect_key);
rng->destroy(rng);
-
+
message->add_notify(message, FALSE, ME_CONNECTID, this->connect_id);
message->add_notify(message, FALSE, ME_CONNECTKEY, this->connect_key);
-
+
if (this->response)
{
message->add_notify(message, FALSE, ME_RESPONSE, chunk_empty);
}
else
{
- /* FIXME: should we make that configurable? */
+ /* FIXME: should we make this configurable? */
message->add_notify(message, FALSE, ME_CALLBACK, chunk_empty);
}
-
+
gather_and_add_endpoints(this, message);
-
+
break;
}
default:
@@ -328,40 +333,44 @@ static status_t process_r(private_ike_me_t *this, message_t *message)
id_payload = (id_payload_t*)message->get_payload(message, ID_PEER);
if (!id_payload)
{
- DBG1(DBG_IKE, "received ME_CONNECT without ID_PEER payload, aborting");
+ DBG1(DBG_IKE, "received ME_CONNECT without ID_PEER payload"
+ ", aborting");
break;
}
this->peer_id = id_payload->get_identification(id_payload);
-
+
process_payloads(this, message);
-
+
if (this->callback)
{
DBG1(DBG_IKE, "received ME_CALLBACK for '%Y'", this->peer_id);
break;
- }
-
+ }
+
if (!this->connect_id.ptr)
{
- DBG1(DBG_IKE, "received ME_CONNECT without ME_CONNECTID notify, aborting");
+ DBG1(DBG_IKE, "received ME_CONNECT without ME_CONNECTID notify"
+ ", aborting");
this->invalid_syntax = TRUE;
break;
}
-
+
if (!this->connect_key.ptr)
{
- DBG1(DBG_IKE, "received ME_CONNECT without ME_CONNECTKEY notify, aborting");
+ DBG1(DBG_IKE, "received ME_CONNECT without ME_CONNECTKEY "
+ "notify, aborting");
this->invalid_syntax = TRUE;
break;
}
-
+
if (!this->remote_endpoints->get_count(this->remote_endpoints))
{
- DBG1(DBG_IKE, "received ME_CONNECT without any ME_ENDPOINT payloads, aborting");
+ DBG1(DBG_IKE, "received ME_CONNECT without any ME_ENDPOINT "
+ "payloads, aborting");
this->invalid_syntax = TRUE;
break;
}
-
+
DBG1(DBG_IKE, "received ME_CONNECT");
break;
}
@@ -385,33 +394,39 @@ static status_t build_r(private_ike_me_t *this, message_t *message)
message->add_notify(message, TRUE, INVALID_SYNTAX, chunk_empty);
break;
}
-
+
if (this->callback)
{
- charon->connect_manager->check_and_initiate(charon->connect_manager,
+ /* we got a callback from the mediation server, initiate the
+ * queued mediated connecction */
+ charon->connect_manager->check_and_initiate(
+ charon->connect_manager,
this->ike_sa->get_id(this->ike_sa),
this->ike_sa->get_my_id(this->ike_sa), this->peer_id);
return SUCCESS;
}
-
+
if (this->response)
{
/* FIXME: handle result of set_responder_data
* as initiator, upon receiving a response from another peer,
* update the checklist and start sending checks */
- charon->connect_manager->set_responder_data(charon->connect_manager,
- this->connect_id, this->connect_key, this->remote_endpoints);
+ charon->connect_manager->set_responder_data(
+ charon->connect_manager,
+ this->connect_id, this->connect_key,
+ this->remote_endpoints);
}
else
{
/* FIXME: handle result of set_initiator_data
* as responder, create a checklist with the initiator's data */
- charon->connect_manager->set_initiator_data(charon->connect_manager,
+ charon->connect_manager->set_initiator_data(
+ charon->connect_manager,
this->peer_id, this->ike_sa->get_my_id(this->ike_sa),
- this->connect_id, this->connect_key, this->remote_endpoints,
- FALSE);
+ this->connect_id, this->connect_key,
+ this->remote_endpoints, FALSE);
if (this->ike_sa->respond(this->ike_sa, this->peer_id,
- this->connect_id) != SUCCESS)
+ this->connect_id) != SUCCESS)
{
return FAILED;
}
@@ -434,13 +449,11 @@ static status_t process_i(private_ike_me_t *this, message_t *message)
case IKE_SA_INIT:
{
process_payloads(this, message);
-
if (!this->mediation)
{
DBG1(DBG_IKE, "server did not return a ME_MEDIATION, aborting");
return FAILED;
}
-
return NEED_MORE;
}
case IKE_AUTH:
@@ -449,24 +462,21 @@ static status_t process_i(private_ike_me_t *this, message_t *message)
/* FIXME: we should update the server reflexive endpoint somehow,
* if mobike notices a change */
endpoint_notify_t *reflexive;
- if (this->remote_endpoints->get_first(this->remote_endpoints,
+ if (this->remote_endpoints->get_first(this->remote_endpoints,
(void**)&reflexive) == SUCCESS &&
reflexive->get_type(reflexive) == SERVER_REFLEXIVE)
- { /* FIXME: should we accept this endpoint even if we did not send
+ { /* FIXME: should we accept this endpoint even if we did not send
* a request? */
host_t *endpoint = reflexive->get_host(reflexive);
-
- this->ike_sa->set_server_reflexive_host(this->ike_sa, endpoint->clone(endpoint));
+ endpoint = endpoint->clone(endpoint);
+ this->ike_sa->set_server_reflexive_host(this->ike_sa, endpoint);
}
- /* FIXME: what if it failed? e.g. AUTH failure */
- DBG1(DBG_IKE, "established mediation connection successfully");
-
break;
}
case ME_CONNECT:
{
process_payloads(this, message);
-
+
if (this->failed)
{
DBG1(DBG_IKE, "peer '%Y' is not online", this->peer_id);
@@ -476,21 +486,25 @@ static status_t process_i(private_ike_me_t *this, message_t *message)
{
if (this->response)
{
- /* FIXME: handle result of set_responder_data.
- * as responder, we update the checklist and start sending checks */
- charon->connect_manager->set_responder_data(charon->connect_manager,
- this->connect_id, this->connect_key, this->local_endpoints);
+ /* FIXME: handle result of set_responder_data. */
+ /* as responder, we update the checklist and start sending
+ * checks */
+ charon->connect_manager->set_responder_data(
+ charon->connect_manager, this->connect_id,
+ this->connect_key, this->local_endpoints);
}
else
{
- /* FIXME: handle result of set_initiator_data
- * as initiator, we create a checklist and set the initiator's data */
- charon->connect_manager->set_initiator_data(charon->connect_manager,
- this->ike_sa->get_my_id(this->ike_sa), this->peer_id,
- this->connect_id, this->connect_key, this->local_endpoints,
- TRUE);
- /* FIXME: also start a timer for the whole transaction (maybe
- * within the connect_manager?) */
+ /* FIXME: handle result of set_initiator_data */
+ /* as initiator, we create a checklist and set the
+ * initiator's data */
+ charon->connect_manager->set_initiator_data(
+ charon->connect_manager,
+ this->ike_sa->get_my_id(this->ike_sa),
+ this->peer_id, this->connect_id, this->connect_key,
+ this->local_endpoints, TRUE);
+ /* FIXME: also start a timer for the whole transaction
+ * (maybe within the connect_manager?) */
}
}
break;
@@ -510,9 +524,11 @@ static status_t build_i_ms(private_ike_me_t *this, message_t *message)
{
case ME_CONNECT:
{
- id_payload_t *id_payload = id_payload_create_from_identification(ID_PEER, this->peer_id);
+ id_payload_t *id_payload;
+ id_payload = id_payload_create_from_identification(ID_PEER,
+ this->peer_id);
message->add_payload(message, (payload_t*)id_payload);
-
+
if (this->callback)
{
message->add_notify(message, FALSE, ME_CALLBACK, chunk_empty);
@@ -521,11 +537,13 @@ static status_t build_i_ms(private_ike_me_t *this, message_t *message)
{
if (this->response)
{
- message->add_notify(message, FALSE, ME_RESPONSE, chunk_empty);
- }
- message->add_notify(message, FALSE, ME_CONNECTID, this->connect_id);
- message->add_notify(message, FALSE, ME_CONNECTKEY, this->connect_key);
-
+ message->add_notify(message, FALSE, ME_RESPONSE,
+ chunk_empty);
+ }
+ message->add_notify(message, FALSE, ME_CONNECTID,
+ this->connect_id);
+ message->add_notify(message, FALSE, ME_CONNECTKEY,
+ this->connect_key);
add_endpoints_to_message(message, this->remote_endpoints);
}
break;
@@ -533,7 +551,6 @@ static status_t build_i_ms(private_ike_me_t *this, message_t *message)
default:
break;
}
-
return NEED_MORE;
}
@@ -546,15 +563,15 @@ static status_t process_r_ms(private_ike_me_t *this, message_t *message)
{
case IKE_SA_INIT:
{
- /* FIXME: we should check for SA* and TS* payloads
- * if any are there send NO_ADDITIONAL_SAS back and delete this SA */
+ /* FIXME: we should check for SA* and TS* payloads. if there are
+ * any, send NO_ADDITIONAL_SAS back and delete this SA */
process_payloads(this, message);
return this->mediation ? NEED_MORE : SUCCESS;
}
case IKE_AUTH:
{
- /* FIXME: we should check whether the current peer_config is configured
- * as mediation connection */
+ /* FIXME: we should check whether the current peer_config is
+ * configured as mediation connection */
process_payloads(this, message);
break;
}
@@ -570,32 +587,35 @@ static status_t process_r_ms(private_ike_me_t *this, message_t *message)
id_payload = (id_payload_t*)message->get_payload(message, ID_PEER);
if (!id_payload)
{
- DBG1(DBG_IKE, "received ME_CONNECT without ID_PEER payload, aborting");
+ DBG1(DBG_IKE, "received ME_CONNECT without ID_PEER payload"
+ ", aborting");
this->invalid_syntax = TRUE;
break;
}
-
this->peer_id = id_payload->get_identification(id_payload);
-
+
process_payloads(this, message);
-
+
if (!this->connect_id.ptr)
{
- DBG1(DBG_IKE, "received ME_CONNECT without ME_CONNECTID notify, aborting");
+ DBG1(DBG_IKE, "received ME_CONNECT without ME_CONNECTID notify"
+ ", aborting");
this->invalid_syntax = TRUE;
break;
}
-
+
if (!this->connect_key.ptr)
{
- DBG1(DBG_IKE, "received ME_CONNECT without ME_CONNECTKEY notify, aborting");
+ DBG1(DBG_IKE, "received ME_CONNECT without ME_CONNECTKEY notify"
+ ", aborting");
this->invalid_syntax = TRUE;
break;
}
-
+
if (!this->remote_endpoints->get_count(this->remote_endpoints))
{
- DBG1(DBG_IKE, "received ME_CONNECT without any ME_ENDPOINT payloads, aborting");
+ DBG1(DBG_IKE, "received ME_CONNECT without any ME_ENDPOINT "
+ "payloads, aborting");
this->invalid_syntax = TRUE;
break;
}
@@ -604,7 +624,6 @@ static status_t process_r_ms(private_ike_me_t *this, message_t *message)
default:
break;
}
-
return NEED_MORE;
}
@@ -623,58 +642,54 @@ static status_t build_r_ms(private_ike_me_t *this, message_t *message)
case IKE_AUTH:
{
endpoint_notify_t *endpoint;
- if (this->remote_endpoints->get_first(this->remote_endpoints, (void**)&endpoint) == SUCCESS &&
- endpoint->get_type(endpoint) == SERVER_REFLEXIVE)
+ if (this->remote_endpoints->get_first(this->remote_endpoints,
+ (void**)&endpoint) == SUCCESS &&
+ endpoint->get_type(endpoint) == SERVER_REFLEXIVE)
{
host_t *host = this->ike_sa->get_other_host(this->ike_sa);
-
- DBG2(DBG_IKE, "received request for a server reflexive endpoint "
- "sending: %#H", host);
-
- endpoint = endpoint_notify_create_from_host(SERVER_REFLEXIVE, host, NULL);
+ DBG2(DBG_IKE, "received request for a server reflexive "
+ "endpoint sending: %#H", host);
+ endpoint = endpoint_notify_create_from_host(SERVER_REFLEXIVE,
+ host, NULL);
message->add_payload(message, (payload_t*)endpoint->build_notify(endpoint));
endpoint->destroy(endpoint);
}
-
- /* FIXME: we actually must delete any existing IKE_SAs with the same remote id */
this->ike_sa->act_as_mediation_server(this->ike_sa);
-
- DBG1(DBG_IKE, "established mediation connection successfully");
-
break;
}
case ME_CONNECT:
- {
+ {
if (this->invalid_syntax)
{
message->add_notify(message, TRUE, INVALID_SYNTAX, chunk_empty);
break;
}
-
+
ike_sa_id_t *peer_sa;
if (this->callback)
{
- peer_sa = charon->mediation_manager->check_and_register(charon->mediation_manager,
- this->peer_id, this->ike_sa->get_other_id(this->ike_sa));
+ peer_sa = charon->mediation_manager->check_and_register(
+ charon->mediation_manager, this->peer_id,
+ this->ike_sa->get_other_id(this->ike_sa));
}
else
{
- peer_sa = charon->mediation_manager->check(charon->mediation_manager,
- this->peer_id);
+ peer_sa = charon->mediation_manager->check(
+ charon->mediation_manager, this->peer_id);
}
-
+
if (!peer_sa)
{
/* the peer is not online */
- message->add_notify(message, TRUE, ME_CONNECT_FAILED, chunk_empty);
+ message->add_notify(message, TRUE, ME_CONNECT_FAILED,
+ chunk_empty);
break;
}
-
+
job_t *job = (job_t*)mediation_job_create(this->peer_id,
this->ike_sa->get_other_id(this->ike_sa), this->connect_id,
this->connect_key, this->remote_endpoints, this->response);
charon->processor->queue_job(charon->processor, job);
-
break;
}
default:
@@ -706,8 +721,8 @@ static void me_connect(private_ike_me_t *this, identification_t *peer_id)
/**
* Implementation of ike_me.respond
*/
-static void me_respond(private_ike_me_t *this, identification_t *peer_id,
- chunk_t connect_id)
+static void me_respond(private_ike_me_t *this, identification_t *peer_id,
+ chunk_t connect_id)
{
this->peer_id = peer_id->clone(peer_id);
this->connect_id = chunk_clone(connect_id);
@@ -726,16 +741,19 @@ static void me_callback(private_ike_me_t *this, identification_t *peer_id)
/**
* Implementation of ike_me.relay
*/
-static void relay(private_ike_me_t *this, identification_t *requester, chunk_t connect_id,
- chunk_t connect_key, linked_list_t *endpoints, bool response)
+static void relay(private_ike_me_t *this, identification_t *requester,
+ chunk_t connect_id, chunk_t connect_key,
+ linked_list_t *endpoints, bool response)
{
this->peer_id = requester->clone(requester);
this->connect_id = chunk_clone(connect_id);
this->connect_key = chunk_clone(connect_key);
-
- this->remote_endpoints->destroy_offset(this->remote_endpoints, offsetof(endpoint_notify_t, destroy));
- this->remote_endpoints = endpoints->clone_offset(endpoints, offsetof(endpoint_notify_t, clone));
-
+
+ this->remote_endpoints->destroy_offset(this->remote_endpoints,
+ offsetof(endpoint_notify_t, destroy));
+ this->remote_endpoints = endpoints->clone_offset(endpoints,
+ offsetof(endpoint_notify_t, clone));
+
this->response = response;
}
@@ -761,13 +779,15 @@ static void migrate(private_ike_me_t *this, ike_sa_t *ike_sa)
static void destroy(private_ike_me_t *this)
{
DESTROY_IF(this->peer_id);
-
+
chunk_free(&this->connect_id);
chunk_free(&this->connect_key);
-
- this->local_endpoints->destroy_offset(this->local_endpoints, offsetof(endpoint_notify_t, destroy));
- this->remote_endpoints->destroy_offset(this->remote_endpoints, offsetof(endpoint_notify_t, destroy));
-
+
+ this->local_endpoints->destroy_offset(this->local_endpoints,
+ offsetof(endpoint_notify_t, destroy));
+ this->remote_endpoints->destroy_offset(this->remote_endpoints,
+ offsetof(endpoint_notify_t, destroy));
+
DESTROY_IF(this->mediated_cfg);
free(this);
}
@@ -782,7 +802,7 @@ ike_me_t *ike_me_create(ike_sa_t *ike_sa, bool initiator)
this->public.task.get_type = (task_type_t(*)(task_t*))get_type;
this->public.task.migrate = (void(*)(task_t*,ike_sa_t*))migrate;
this->public.task.destroy = (void(*)(task_t*))destroy;
-
+
if (ike_sa->has_condition(ike_sa, COND_ORIGINAL_INITIATOR))
{
if (initiator)
@@ -810,15 +830,15 @@ ike_me_t *ike_me_create(ike_sa_t *ike_sa, bool initiator)
this->public.task.process = (status_t(*)(task_t*,message_t*))process_r_ms;
}
}
-
+
this->public.connect = (void(*)(ike_me_t*,identification_t*))me_connect;
this->public.respond = (void(*)(ike_me_t*,identification_t*,chunk_t))me_respond;
this->public.callback = (void(*)(ike_me_t*,identification_t*))me_callback;
this->public.relay = (void(*)(ike_me_t*,identification_t*,chunk_t,chunk_t,linked_list_t*,bool))relay;
-
+
this->ike_sa = ike_sa;
this->initiator = initiator;
-
+
this->peer_id = NULL;
this->connect_id = chunk_empty;
this->connect_key = chunk_empty;
@@ -829,8 +849,8 @@ ike_me_t *ike_me_create(ike_sa_t *ike_sa, bool initiator)
this->callback = FALSE;
this->failed = FALSE;
this->invalid_syntax = FALSE;
-
+
this->mediated_cfg = NULL;
-
+
return &this->public;
}
diff --git a/src/charon/sa/tasks/ike_me.h b/src/charon/sa/tasks/ike_me.h
index 4b35c313c..31285a426 100644
--- a/src/charon/sa/tasks/ike_me.h
+++ b/src/charon/sa/tasks/ike_me.h
@@ -34,18 +34,17 @@ typedef struct ike_me_t ike_me_t;
* connection, allows to initiate mediated connections using ME_CONNECT
* exchanges and to request reflexive addresses from the mediation server using
* ME_ENDPOINT notifies.
- *
+ *
* @note This task has to be activated before the IKE_AUTH task, because that
* task generates the IKE_SA_INIT message so that no more payloads can be added
* to it afterwards.
*/
struct ike_me_t {
-
/**
* Implements the task_t interface
*/
task_t task;
-
+
/**
* Initiates a connection with another peer (i.e. sends a ME_CONNECT
* to the mediation server)
@@ -53,45 +52,48 @@ struct ike_me_t {
* @param peer_id ID of the other peer (gets cloned)
*/
void (*connect)(ike_me_t *this, identification_t *peer_id);
-
+
/**
* Responds to a ME_CONNECT from another peer (i.e. sends a ME_CONNECT
* to the mediation server)
- *
- * @param peer_id ID of the other peer (gets cloned)
- * @param connect_id the connect ID as provided by the initiator (gets cloned)
+ *
+ * Data gets cloned.
+ *
+ * @param peer_id ID of the other peer
+ * @param connect_id the connect ID as provided by the initiator
*/
- void (*respond)(ike_me_t *this, identification_t *peer_id, chunk_t connect_id);
-
+ void (*respond)(ike_me_t *this, identification_t *peer_id,
+ chunk_t connect_id);
+
/**
- * Sends a ME_CALLBACK to a peer that previously requested another peer.
- *
+ * Sends a ME_CALLBACK to a peer that previously requested some other peer.
+ *
* @param peer_id ID of the other peer (gets cloned)
*/
void (*callback)(ike_me_t *this, identification_t *peer_id);
-
+
/**
* Relays data to another peer (i.e. sends a ME_CONNECT to the peer)
- *
+ *
* Data gets cloned.
- *
+ *
* @param requester ID of the requesting peer
* @param connect_id content of the ME_CONNECTID notify
* @param connect_key content of the ME_CONNECTKEY notify
* @param endpoints endpoints
* @param response TRUE if this is a response
*/
- void (*relay)(ike_me_t *this, identification_t *requester, chunk_t connect_id,
- chunk_t connect_key, linked_list_t *endpoints, bool response);
-
+ void (*relay)(ike_me_t *this, identification_t *requester,
+ chunk_t connect_id, chunk_t connect_key,
+ linked_list_t *endpoints, bool response);
};
/**
* Create a new ike_me task.
*
* @param ike_sa IKE_SA this task works for
- * @param initiator TRUE if taks is initiated by us
- * @return ike_me task to handle by the task_manager
+ * @param initiator TRUE if task is initiated by us
+ * @return ike_me task to be handled by the task_manager
*/
ike_me_t *ike_me_create(ike_sa_t *ike_sa, bool initiator);
diff --git a/src/charon/sa/tasks/ike_mobike.c b/src/charon/sa/tasks/ike_mobike.c
index 9a1afe744..d76ba8d2b 100644
--- a/src/charon/sa/tasks/ike_mobike.c
+++ b/src/charon/sa/tasks/ike_mobike.c
@@ -30,42 +30,42 @@ typedef struct private_ike_mobike_t private_ike_mobike_t;
* Private members of a ike_mobike_t task.
*/
struct private_ike_mobike_t {
-
+
/**
* Public methods and task_t interface.
*/
ike_mobike_t public;
-
+
/**
* Assigned IKE_SA.
*/
ike_sa_t *ike_sa;
-
+
/**
* Are we the initiator?
*/
bool initiator;
-
+
/**
* cookie2 value to verify new addresses
*/
chunk_t cookie2;
-
+
/**
* NAT discovery reusing the IKE_NATD task
*/
ike_natd_t *natd;
-
+
/**
* use task to update addresses
*/
bool update;
-
+
/**
* do routability check
*/
bool check;
-
+
/**
* include address list update
*/
@@ -79,7 +79,7 @@ static void flush_additional_addresses(private_ike_mobike_t *this)
{
iterator_t *iterator;
host_t *host;
-
+
iterator = this->ike_sa->create_additional_address_iterator(this->ike_sa);
while (iterator->iterate(iterator, (void**)&host))
{
@@ -98,7 +98,7 @@ static void process_payloads(private_ike_mobike_t *this, message_t *message)
enumerator_t *enumerator;
payload_t *payload;
bool first = TRUE;
-
+
enumerator = message->create_payload_enumerator(message);
while (enumerator->enumerate(enumerator, &payload))
{
@@ -106,7 +106,7 @@ static void process_payloads(private_ike_mobike_t *this, message_t *message)
notify_payload_t *notify;
chunk_t data;
host_t *host;
-
+
if (payload->get_type(payload) != NOTIFY)
{
continue;
@@ -117,9 +117,9 @@ static void process_payloads(private_ike_mobike_t *this, message_t *message)
case MOBIKE_SUPPORTED:
{
peer_cfg_t *peer_cfg;
-
+
peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
- if (!this->initiator &&
+ if (!this->initiator &&
peer_cfg && !peer_cfg->use_mobike(peer_cfg))
{
DBG1(DBG_IKE, "peer supports MOBIKE, but disabled in config");
@@ -191,7 +191,7 @@ static void build_address_list(private_ike_mobike_t *this, message_t *message)
host_t *host, *me;
notify_type_t type;
int added = 0;
-
+
me = this->ike_sa->get_my_host(this->ike_sa);
enumerator = charon->kernel_interface->create_address_enumerator(
charon->kernel_interface, FALSE, FALSE);
@@ -227,7 +227,7 @@ static void build_address_list(private_ike_mobike_t *this, message_t *message)
}
/**
- * build a cookie and add it to the message
+ * build a cookie and add it to the message
*/
static void build_cookie(private_ike_mobike_t *this, message_t *message)
{
@@ -250,12 +250,12 @@ static void update_children(private_ike_mobike_t *this)
{
iterator_t *iterator;
child_sa_t *child_sa;
-
+
iterator = this->ike_sa->create_child_sa_iterator(this->ike_sa);
while (iterator->iterate(iterator, (void**)&child_sa))
{
if (child_sa->update(child_sa,
- this->ike_sa->get_my_host(this->ike_sa),
+ this->ike_sa->get_my_host(this->ike_sa),
this->ike_sa->get_other_host(this->ike_sa),
this->ike_sa->get_virtual_ip(this->ike_sa, TRUE),
this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY)) == NOT_SUPPORTED)
@@ -276,7 +276,7 @@ static void transmit(private_ike_mobike_t *this, packet_t *packet)
host_t *me, *other, *me_old, *other_old;
iterator_t *iterator;
packet_t *copy;
-
+
if (!this->check)
{
return;
@@ -284,16 +284,19 @@ static void transmit(private_ike_mobike_t *this, packet_t *packet)
me_old = this->ike_sa->get_my_host(this->ike_sa);
other_old = this->ike_sa->get_other_host(this->ike_sa);
-
+
me = charon->kernel_interface->get_source_addr(
charon->kernel_interface, other_old, NULL);
if (me)
{
me->set_port(me, me->ip_equals(me, me_old) ?
me_old->get_port(me_old) : IKEV2_NATT_PORT);
- packet->set_source(packet, me);
+ DBG1(DBG_IKE, "checking original path %#H - %#H", me, other_old);
+ copy = packet->clone(packet);
+ copy->set_source(copy, me);
+ charon->sender->send(charon->sender, copy);
}
-
+
iterator = this->ike_sa->create_additional_address_iterator(this->ike_sa);
while (iterator->iterate(iterator, (void**)&other))
{
@@ -320,9 +323,6 @@ static void transmit(private_ike_mobike_t *this, packet_t *packet)
}
}
iterator->destroy(iterator);
- me = packet->get_source(packet);
- other = packet->get_destination(packet);
- DBG1(DBG_IKE, "checking path %#H - %#H", me, other);
}
/**
@@ -338,8 +338,8 @@ static status_t build_i(private_ike_mobike_t *this, message_t *message)
else if (message->get_exchange_type(message) == INFORMATIONAL)
{
host_t *old, *new;
-
- /* we check if the existing address is still valid */
+
+ /* we check if the existing address is still valid */
old = message->get_source(message);
new = charon->kernel_interface->get_source_addr(charon->kernel_interface,
message->get_destination(message), old);
@@ -388,13 +388,13 @@ static status_t process_r(private_ike_mobike_t *this, message_t *message)
if (this->update)
{
host_t *me, *other;
-
+
me = message->get_destination(message);
other = message->get_source(message);
this->ike_sa->set_my_host(this->ike_sa, me->clone(me));
this->ike_sa->set_other_host(this->ike_sa, other->clone(other));
}
-
+
if (this->natd)
{
this->natd->task.process(&this->natd->task, message);
@@ -461,7 +461,7 @@ static status_t process_i(private_ike_mobike_t *this, message_t *message)
if (this->cookie2.ptr)
{ /* check cookie if we included one */
chunk_t cookie2;
-
+
cookie2 = this->cookie2;
this->cookie2 = chunk_empty;
process_payloads(this, message);
@@ -496,17 +496,17 @@ static status_t process_i(private_ike_mobike_t *this, message_t *message)
if (this->check)
{
host_t *me_new, *me_old, *other_new, *other_old;
-
+
me_new = message->get_destination(message);
other_new = message->get_source(message);
me_old = this->ike_sa->get_my_host(this->ike_sa);
other_old = this->ike_sa->get_other_host(this->ike_sa);
-
+
if (!me_new->equals(me_new, me_old))
{
this->update = TRUE;
this->ike_sa->set_my_host(this->ike_sa, me_new->clone(me_new));
- }
+ }
if (!other_new->equals(other_new, other_old))
{
this->update = TRUE;
@@ -538,7 +538,7 @@ static void roam(private_ike_mobike_t *this, bool address)
{
this->check = TRUE;
this->address = address;
- this->ike_sa->set_pending_updates(this->ike_sa,
+ this->ike_sa->set_pending_updates(this->ike_sa,
this->ike_sa->get_pending_updates(this->ike_sa) + 1);
}
@@ -552,7 +552,7 @@ static void dpd(private_ike_mobike_t *this)
this->natd = ike_natd_create(this->ike_sa, this->initiator);
}
this->address = FALSE;
- this->ike_sa->set_pending_updates(this->ike_sa,
+ this->ike_sa->set_pending_updates(this->ike_sa,
this->ike_sa->get_pending_updates(this->ike_sa) + 1);
}
@@ -612,7 +612,7 @@ ike_mobike_t *ike_mobike_create(ike_sa_t *ike_sa, bool initiator)
this->public.task.get_type = (task_type_t(*)(task_t*))get_type;
this->public.task.migrate = (void(*)(task_t*,ike_sa_t*))migrate;
this->public.task.destroy = (void(*)(task_t*))destroy;
-
+
if (initiator)
{
this->public.task.build = (status_t(*)(task_t*,message_t*))build_i;
@@ -623,7 +623,7 @@ ike_mobike_t *ike_mobike_create(ike_sa_t *ike_sa, bool initiator)
this->public.task.build = (status_t(*)(task_t*,message_t*))build_r;
this->public.task.process = (status_t(*)(task_t*,message_t*))process_r;
}
-
+
this->ike_sa = ike_sa;
this->initiator = initiator;
this->update = FALSE;
@@ -631,7 +631,7 @@ ike_mobike_t *ike_mobike_create(ike_sa_t *ike_sa, bool initiator)
this->address = TRUE;
this->cookie2 = chunk_empty;
this->natd = NULL;
-
+
return &this->public;
}
diff --git a/src/charon/sa/tasks/ike_mobike.h b/src/charon/sa/tasks/ike_mobike.h
index 919b5ddd3..05b2224d1 100644
--- a/src/charon/sa/tasks/ike_mobike.h
+++ b/src/charon/sa/tasks/ike_mobike.h
@@ -35,7 +35,7 @@ typedef struct ike_mobike_t ike_mobike_t;
* and IPsec tunnel addresses.
* This tasks handles the MOBIKE_SUPPORTED notify exchange to detect MOBIKE
* support, allows the exchange of ADDITIONAL_*_ADDRESS to exchange additional
- * endpoints and handles the UPDATE_SA_ADDRESS notify to finally update
+ * endpoints and handles the UPDATE_SA_ADDRESS notify to finally update
* endpoints.
*/
struct ike_mobike_t {
@@ -44,36 +44,36 @@ struct ike_mobike_t {
* Implements the task_t interface
*/
task_t task;
-
+
/**
* Use the task to roam to other addresses.
*
* @param address TRUE to include address list update
*/
void (*roam)(ike_mobike_t *this, bool address);
-
+
/**
* Use the task for a DPD check which detects changes in NAT mappings.
*/
void (*dpd)(ike_mobike_t *this);
-
+
/**
* Transmision hook, called by task manager.
*
- * The task manager calls this hook whenever it transmits a packet. It
+ * The task manager calls this hook whenever it transmits a packet. It
* allows the mobike task to send the packet on multiple paths to do path
* probing.
*
* @param packet the packet to transmit
*/
void (*transmit)(ike_mobike_t *this, packet_t *packet);
-
+
/**
* Check if this task is probing for routability.
*
* @return TRUE if task is probing
*/
- bool (*is_probing)(ike_mobike_t *this);
+ bool (*is_probing)(ike_mobike_t *this);
};
/**
@@ -81,7 +81,7 @@ struct ike_mobike_t {
*
* @param ike_sa IKE_SA this task works for
* @param initiator TRUE if taks is initiated by us
- * @return ike_mobike task to handle by the task_manager
+ * @return ike_mobike task to handle by the task_manager
*/
ike_mobike_t *ike_mobike_create(ike_sa_t *ike_sa, bool initiator);
diff --git a/src/charon/sa/tasks/ike_natd.c b/src/charon/sa/tasks/ike_natd.c
index bb18e7bda..9121fe2ea 100644
--- a/src/charon/sa/tasks/ike_natd.c
+++ b/src/charon/sa/tasks/ike_natd.c
@@ -30,47 +30,47 @@ typedef struct private_ike_natd_t private_ike_natd_t;
* Private members of a ike_natd_t task.
*/
struct private_ike_natd_t {
-
+
/**
* Public methods and task_t interface.
*/
ike_natd_t public;
-
+
/**
* Assigned IKE_SA.
*/
ike_sa_t *ike_sa;
-
+
/**
* Are we the initiator?
*/
bool initiator;
-
+
/**
* Hasher used to build NAT detection hashes
*/
hasher_t *hasher;
-
+
/**
* Did we process any NAT detection notifys for a source address?
*/
bool src_seen;
-
+
/**
* Did we process any NAT detection notifys for a destination address?
*/
bool dst_seen;
-
+
/**
* Have we found a matching source address NAT hash?
*/
bool src_matched;
-
+
/**
* Have we found a matching destination address NAT hash?
*/
bool dst_matched;
-
+
/**
* whether NAT mappings for our NATed address has changed
*/
@@ -88,7 +88,7 @@ static chunk_t generate_natd_hash(private_ike_natd_t *this,
chunk_t natd_hash;
u_int64_t spi_i, spi_r;
u_int16_t port;
-
+
/* prepare all required chunks */
spi_i = ike_sa_id->get_initiator_spi(ike_sa_id);
spi_r = ike_sa_id->get_responder_spi(ike_sa_id);
@@ -100,13 +100,13 @@ static chunk_t generate_natd_hash(private_ike_natd_t *this,
port_chunk.ptr = (void*)&port;
port_chunk.len = sizeof(port);
addr_chunk = host->get_address(host);
-
+
/* natd_hash = SHA1( spi_i | spi_r | address | port ) */
natd_chunk = chunk_cat("cccc", spi_i_chunk, spi_r_chunk, addr_chunk, port_chunk);
this->hasher->allocate_hash(this->hasher, natd_chunk, &natd_hash);
DBG3(DBG_IKE, "natd_chunk %B", &natd_chunk);
DBG3(DBG_IKE, "natd_hash %B", &natd_hash);
-
+
chunk_free(&natd_chunk);
return natd_hash;
}
@@ -118,7 +118,7 @@ static chunk_t generate_natd_hash_faked(private_ike_natd_t *this)
{
rng_t *rng;
chunk_t chunk;
-
+
rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
if (!rng)
{
@@ -137,10 +137,10 @@ static notify_payload_t *build_natd_payload(private_ike_natd_t *this,
notify_type_t type, host_t *host)
{
chunk_t hash;
- notify_payload_t *notify;
+ notify_payload_t *notify;
ike_sa_id_t *ike_sa_id;
ike_cfg_t *config;
-
+
ike_sa_id = this->ike_sa->get_id(this->ike_sa);
config = this->ike_sa->get_ike_cfg(this->ike_sa);
if (config->force_encap(config) && type == NAT_DETECTION_SOURCE_IP)
@@ -155,7 +155,7 @@ static notify_payload_t *build_natd_payload(private_ike_natd_t *this,
notify->set_notify_type(notify, type);
notify->set_notification_data(notify, hash);
chunk_free(&hash);
-
+
return notify;
}
@@ -171,17 +171,17 @@ static void process_payloads(private_ike_natd_t *this, message_t *message)
ike_sa_id_t *ike_sa_id;
host_t *me, *other;
ike_cfg_t *config;
-
+
/* Precompute NAT-D hashes for incoming NAT notify comparison */
ike_sa_id = message->get_ike_sa_id(message);
me = message->get_destination(message);
other = message->get_source(message);
dst_hash = generate_natd_hash(this, ike_sa_id, me);
src_hash = generate_natd_hash(this, ike_sa_id, other);
-
+
DBG3(DBG_IKE, "precalculated src_hash %B", &src_hash);
DBG3(DBG_IKE, "precalculated dst_hash %B", &dst_hash);
-
+
enumerator = message->create_payload_enumerator(message);
while (enumerator->enumerate(enumerator, &payload))
{
@@ -234,10 +234,10 @@ static void process_payloads(private_ike_natd_t *this, message_t *message)
}
}
enumerator->destroy(enumerator);
-
+
chunk_free(&src_hash);
chunk_free(&dst_hash);
-
+
if (this->src_seen && this->dst_seen)
{
this->ike_sa->enable_extension(this->ike_sa, EXT_NATT);
@@ -245,12 +245,12 @@ static void process_payloads(private_ike_natd_t *this, message_t *message)
this->ike_sa->set_condition(this->ike_sa, COND_NAT_HERE,
!this->dst_matched);
this->ike_sa->set_condition(this->ike_sa, COND_NAT_THERE,
- !this->src_matched);
+ !this->src_matched);
config = this->ike_sa->get_ike_cfg(this->ike_sa);
if (this->dst_matched && this->src_matched &&
config->force_encap(config))
{
- this->ike_sa->set_condition(this->ike_sa, COND_NAT_FAKE, TRUE);
+ this->ike_sa->set_condition(this->ike_sa, COND_NAT_FAKE, TRUE);
}
}
}
@@ -261,7 +261,7 @@ static void process_payloads(private_ike_natd_t *this, message_t *message)
static status_t process_i(private_ike_natd_t *this, message_t *message)
{
process_payloads(this, message);
-
+
if (message->get_exchange_type(message) == IKE_SA_INIT)
{
peer_cfg_t *peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
@@ -275,10 +275,10 @@ static status_t process_i(private_ike_natd_t *this, message_t *message)
return SUCCESS;
}
#endif /* ME */
-
+
if (this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY) ||
#ifdef ME
- /* if we are on a mediation connection we swith to port 4500 even
+ /* if we are on a mediation connection we switch to port 4500 even
* if no NAT is detected. */
peer_cfg->is_mediation(peer_cfg) ||
#endif /* ME */
@@ -288,7 +288,7 @@ static status_t process_i(private_ike_natd_t *this, message_t *message)
this->ike_sa->supports_extension(this->ike_sa, EXT_NATT)))
{
host_t *me, *other;
-
+
/* do not switch if we have a custom port from mobike/NAT */
me = this->ike_sa->get_my_host(this->ike_sa);
if (me->get_port(me) == IKEV2_UDP_PORT)
@@ -302,7 +302,7 @@ static status_t process_i(private_ike_natd_t *this, message_t *message)
}
}
}
-
+
return SUCCESS;
}
@@ -314,18 +314,18 @@ static status_t build_i(private_ike_natd_t *this, message_t *message)
notify_payload_t *notify;
enumerator_t *enumerator;
host_t *host;
-
+
if (this->hasher == NULL)
{
DBG1(DBG_IKE, "unable to build NATD payloads, SHA1 not supported");
return NEED_MORE;
}
-
+
/* destination is always set */
host = message->get_destination(message);
notify = build_natd_payload(this, NAT_DETECTION_DESTINATION_IP, host);
message->add_payload(message, (payload_t*)notify);
-
+
/* source may be any, we have 3 possibilities to get our source address:
* 1. It is defined in the config => use the one of the IKE_SA
* 2. We do a routing lookup in the kernel interface
@@ -374,7 +374,7 @@ static status_t build_r(private_ike_natd_t *this, message_t *message)
{
notify_payload_t *notify;
host_t *me, *other;
-
+
/* only add notifies on successfull responses. */
if (message->get_exchange_type(message) == IKE_SA_INIT &&
message->get_payload(message, SECURITY_ASSOCIATION) == NULL)
@@ -389,12 +389,12 @@ static status_t build_r(private_ike_natd_t *this, message_t *message)
DBG1(DBG_IKE, "unable to build NATD payloads, SHA1 not supported");
return SUCCESS;
}
-
+
/* initiator seems to support NAT detection, add response */
me = message->get_source(message);
notify = build_natd_payload(this, NAT_DETECTION_SOURCE_IP, me);
message->add_payload(message, (payload_t*)notify);
-
+
other = message->get_destination(message);
notify = build_natd_payload(this, NAT_DETECTION_DESTINATION_IP, other);
message->add_payload(message, (payload_t*)notify);
@@ -406,9 +406,9 @@ static status_t build_r(private_ike_natd_t *this, message_t *message)
* Implementation of task_t.process for responder
*/
static status_t process_r(private_ike_natd_t *this, message_t *message)
-{
+{
process_payloads(this, message);
-
+
return NEED_MORE;
}
@@ -460,7 +460,7 @@ ike_natd_t *ike_natd_create(ike_sa_t *ike_sa, bool initiator)
this->public.task.get_type = (task_type_t(*)(task_t*))get_type;
this->public.task.migrate = (void(*)(task_t*,ike_sa_t*))migrate;
this->public.task.destroy = (void(*)(task_t*))destroy;
-
+
if (initiator)
{
this->public.task.build = (status_t(*)(task_t*,message_t*))build_i;
@@ -471,9 +471,9 @@ ike_natd_t *ike_natd_create(ike_sa_t *ike_sa, bool initiator)
this->public.task.build = (status_t(*)(task_t*,message_t*))build_r;
this->public.task.process = (status_t(*)(task_t*,message_t*))process_r;
}
-
+
this->public.has_mapping_changed = (bool(*)(ike_natd_t*))has_mapping_changed;
-
+
this->ike_sa = ike_sa;
this->initiator = initiator;
this->hasher = lib->crypto->create_hasher(lib->crypto, HASH_SHA1);
@@ -482,6 +482,6 @@ ike_natd_t *ike_natd_create(ike_sa_t *ike_sa, bool initiator)
this->src_matched = FALSE;
this->dst_matched = FALSE;
this->mapping_changed = FALSE;
-
+
return &this->public;
}
diff --git a/src/charon/sa/tasks/ike_natd.h b/src/charon/sa/tasks/ike_natd.h
index 698394842..97b652ead 100644
--- a/src/charon/sa/tasks/ike_natd.h
+++ b/src/charon/sa/tasks/ike_natd.h
@@ -36,7 +36,7 @@ struct ike_natd_t {
* Implements the task_t interface
*/
task_t task;
-
+
/**
* Check if the NAT mapping has changed for our address.
*
diff --git a/src/charon/sa/tasks/ike_reauth.c b/src/charon/sa/tasks/ike_reauth.c
index 80f1b7b8c..ac89c358b 100644
--- a/src/charon/sa/tasks/ike_reauth.c
+++ b/src/charon/sa/tasks/ike_reauth.c
@@ -25,17 +25,17 @@ typedef struct private_ike_reauth_t private_ike_reauth_t;
* Private members of a ike_reauth_t task.
*/
struct private_ike_reauth_t {
-
+
/**
* Public methods and task_t interface.
*/
ike_reauth_t public;
-
+
/**
* Assigned IKE_SA.
*/
ike_sa_t *ike_sa;
-
+
/**
* reused ike_delete task
*/
@@ -60,17 +60,17 @@ static status_t process_i(private_ike_reauth_t *this, message_t *message)
iterator_t *iterator;
child_sa_t *child_sa;
peer_cfg_t *peer_cfg;
-
+
/* process delete response first */
this->ike_delete->task.process(&this->ike_delete->task, message);
peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
-
+
/* reauthenticate only if we have children */
iterator = this->ike_sa->create_child_sa_iterator(this->ike_sa);
if (iterator->get_count(iterator) == 0
#ifdef ME
- /* we allow a peer to reauth a mediation connection (without CHILD_SA) */
+ /* we allow peers to reauth mediation connections (without children) */
&& !peer_cfg->is_mediation(peer_cfg)
#endif /* ME */
)
@@ -79,9 +79,9 @@ static status_t process_i(private_ike_reauth_t *this, message_t *message)
iterator->destroy(iterator);
return FAILED;
}
-
+
new = charon->ike_sa_manager->checkout_new(charon->ike_sa_manager, TRUE);
-
+
new->set_peer_cfg(new, peer_cfg);
host = this->ike_sa->get_other_host(this->ike_sa);
new->set_other_host(new, host->clone(host));
@@ -93,7 +93,7 @@ static status_t process_i(private_ike_reauth_t *this, message_t *message)
{
new->set_virtual_ip(new, TRUE, host);
}
-
+
#ifdef ME
/* we initiate the new IKE_SA of the mediation connection without CHILD_SA */
if (peer_cfg->is_mediation(peer_cfg))
@@ -109,7 +109,7 @@ static status_t process_i(private_ike_reauth_t *this, message_t *message)
}
}
#endif /* ME */
-
+
while (iterator->iterate(iterator, (void**)&child_sa))
{
switch (child_sa->get_state(child_sa))
@@ -144,7 +144,7 @@ static status_t process_i(private_ike_reauth_t *this, message_t *message)
charon->ike_sa_manager->checkin(charon->ike_sa_manager, new);
/* set threads active IKE_SA after checkin */
charon->bus->set_sa(charon->bus, this->ike_sa);
-
+
/* we always return failed to delete the obsolete IKE_SA */
return FAILED;
}
@@ -187,10 +187,10 @@ ike_reauth_t *ike_reauth_create(ike_sa_t *ike_sa)
this->public.task.destroy = (void(*)(task_t*))destroy;
this->public.task.build = (status_t(*)(task_t*,message_t*))build_i;
this->public.task.process = (status_t(*)(task_t*,message_t*))process_i;
-
+
this->ike_sa = ike_sa;
this->ike_delete = ike_delete_create(ike_sa, TRUE);
-
+
return &this->public;
}
diff --git a/src/charon/sa/tasks/ike_rekey.c b/src/charon/sa/tasks/ike_rekey.c
index 3a049b566..a2275e796 100644
--- a/src/charon/sa/tasks/ike_rekey.c
+++ b/src/charon/sa/tasks/ike_rekey.c
@@ -30,37 +30,37 @@ typedef struct private_ike_rekey_t private_ike_rekey_t;
* Private members of a ike_rekey_t task.
*/
struct private_ike_rekey_t {
-
+
/**
* Public methods and task_t interface.
*/
ike_rekey_t public;
-
+
/**
* Assigned IKE_SA.
*/
ike_sa_t *ike_sa;
-
+
/**
* New IKE_SA which replaces the current one
*/
ike_sa_t *new_sa;
-
+
/**
* Are we the initiator?
*/
bool initiator;
-
+
/**
* the IKE_INIT task which is reused to simplify rekeying
*/
ike_init_t *ike_init;
-
+
/**
* IKE_DELETE task to delete the old IKE_SA after rekeying was successful
*/
ike_delete_t *ike_delete;
-
+
/**
* colliding task detected by the task manager
*/
@@ -74,7 +74,7 @@ static status_t build_i_delete(private_ike_rekey_t *this, message_t *message)
{
/* update exchange type to INFORMATIONAL for the delete */
message->set_exchange_type(message, INFORMATIONAL);
-
+
return this->ike_delete->task.build(&this->ike_delete->task, message);
}
@@ -93,13 +93,13 @@ static status_t build_i(private_ike_rekey_t *this, message_t *message)
{
peer_cfg_t *peer_cfg;
host_t *other_host;
-
+
/* create new SA only on first try */
if (this->new_sa == NULL)
{
this->new_sa = charon->ike_sa_manager->checkout_new(charon->ike_sa_manager,
TRUE);
-
+
peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
other_host = this->ike_sa->get_other_host(this->ike_sa);
this->new_sa->set_peer_cfg(this->new_sa, peer_cfg);
@@ -120,7 +120,7 @@ static status_t process_r(private_ike_rekey_t *this, message_t *message)
peer_cfg_t *peer_cfg;
iterator_t *iterator;
child_sa_t *child_sa;
-
+
if (this->ike_sa->get_state(this->ike_sa) == IKE_DELETING)
{
DBG1(DBG_IKE, "peer initiated rekeying, but we are deleting");
@@ -144,15 +144,15 @@ static status_t process_r(private_ike_rekey_t *this, message_t *message)
}
}
iterator->destroy(iterator);
-
+
this->new_sa = charon->ike_sa_manager->checkout_new(charon->ike_sa_manager,
FALSE);
-
+
peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
this->new_sa->set_peer_cfg(this->new_sa, peer_cfg);
this->ike_init = ike_init_create(this->new_sa, FALSE, this->ike_sa);
this->ike_init->task.process(&this->ike_init->task, message);
-
+
return NEED_MORE;
}
@@ -167,12 +167,12 @@ static status_t build_r(private_ike_rekey_t *this, message_t *message)
message->add_notify(message, TRUE, NO_PROPOSAL_CHOSEN, chunk_empty);
return SUCCESS;
}
-
+
if (this->ike_init->task.build(&this->ike_init->task, message) == FAILED)
{
return SUCCESS;
}
-
+
this->ike_sa->set_state(this->ike_sa, IKE_REKEYING);
this->new_sa->set_state(this->new_sa, IKE_ESTABLISHED);
DBG0(DBG_IKE, "IKE_SA %s[%d] established between %H[%Y]...%H[%Y]",
@@ -182,7 +182,7 @@ static status_t build_r(private_ike_rekey_t *this, message_t *message)
this->ike_sa->get_my_id(this->ike_sa),
this->ike_sa->get_other_host(this->ike_sa),
this->ike_sa->get_other_id(this->ike_sa));
-
+
return SUCCESS;
}
@@ -191,32 +191,17 @@ static status_t build_r(private_ike_rekey_t *this, message_t *message)
*/
static status_t process_i(private_ike_rekey_t *this, message_t *message)
{
- enumerator_t *enumerator;
- payload_t *payload;
-
- /* handle NO_ADDITIONAL_SAS notify */
- enumerator = message->create_payload_enumerator(message);
- while (enumerator->enumerate(enumerator, &payload))
+ if (message->get_notify(message, NO_ADDITIONAL_SAS))
{
- if (payload->get_type(payload) == NOTIFY)
- {
- notify_payload_t *notify = (notify_payload_t*)payload;
-
- if (notify->get_notify_type(notify) == NO_ADDITIONAL_SAS)
- {
- DBG1(DBG_IKE, "peer seems to not support IKE rekeying, "
- "starting reauthentication");
- this->ike_sa->set_state(this->ike_sa, IKE_ESTABLISHED);
- charon->processor->queue_job(charon->processor,
- (job_t*)rekey_ike_sa_job_create(
- this->ike_sa->get_id(this->ike_sa), TRUE));
- enumerator->destroy(enumerator);
- return SUCCESS;
- }
- }
+ DBG1(DBG_IKE, "peer seems to not support IKE rekeying, "
+ "starting reauthentication");
+ this->ike_sa->set_state(this->ike_sa, IKE_ESTABLISHED);
+ charon->processor->queue_job(charon->processor,
+ (job_t*)rekey_ike_sa_job_create(
+ this->ike_sa->get_id(this->ike_sa), TRUE));
+ return SUCCESS;
}
- enumerator->destroy(enumerator);
-
+
switch (this->ike_init->task.process(&this->ike_init->task, message))
{
case FAILED:
@@ -230,7 +215,7 @@ static status_t process_i(private_ike_rekey_t *this, message_t *message)
job = (job_t*)rekey_ike_sa_job_create(
this->ike_sa->get_id(this->ike_sa), FALSE);
DBG1(DBG_IKE, "IKE_SA rekeying failed, "
- "trying again in %d seconds", retry);
+ "trying again in %d seconds", retry);
this->ike_sa->set_state(this->ike_sa, IKE_ESTABLISHED);
charon->scheduler->schedule_job(charon->scheduler, job, retry);
}
@@ -242,7 +227,7 @@ static status_t process_i(private_ike_rekey_t *this, message_t *message)
default:
break;
}
-
+
this->new_sa->set_state(this->new_sa, IKE_ESTABLISHED);
DBG0(DBG_IKE, "IKE_SA %s[%d] established between %H[%Y]...%H[%Y]",
this->new_sa->get_name(this->new_sa),
@@ -251,7 +236,7 @@ static status_t process_i(private_ike_rekey_t *this, message_t *message)
this->ike_sa->get_my_id(this->ike_sa),
this->ike_sa->get_other_host(this->ike_sa),
this->ike_sa->get_other_id(this->ike_sa));
-
+
/* check for collisions */
if (this->collision &&
this->collision->get_type(this->collision) == IKE_REKEY)
@@ -259,13 +244,13 @@ static status_t process_i(private_ike_rekey_t *this, message_t *message)
chunk_t this_nonce, other_nonce;
host_t *host;
private_ike_rekey_t *other = (private_ike_rekey_t*)this->collision;
-
+
this_nonce = this->ike_init->get_lower_nonce(this->ike_init);
other_nonce = other->ike_init->get_lower_nonce(other->ike_init);
-
+
/* if we have the lower nonce, delete rekeyed SA. If not, delete
* the redundant. */
- if (memcmp(this_nonce.ptr, other_nonce.ptr,
+ if (memcmp(this_nonce.ptr, other_nonce.ptr,
min(this_nonce.len, other_nonce.len)) < 0)
{
/* peer should delete this SA. Add a timeout just in case. */
@@ -305,12 +290,12 @@ static status_t process_i(private_ike_rekey_t *this, message_t *message)
/* set threads active IKE_SA after checkin */
charon->bus->set_sa(charon->bus, this->ike_sa);
}
-
+
/* rekeying successful, delete the IKE_SA using a subtask */
this->ike_delete = ike_delete_create(this->ike_sa, TRUE);
this->public.task.build = (status_t(*)(task_t*,message_t*))build_i_delete;
this->public.task.process = (status_t(*)(task_t*,message_t*))process_i_delete;
-
+
return NEED_MORE;
}
@@ -349,7 +334,7 @@ static void migrate(private_ike_rekey_t *this, ike_sa_t *ike_sa)
charon->bus->set_sa(charon->bus, this->ike_sa);
}
DESTROY_IF(this->collision);
-
+
this->collision = NULL;
this->ike_sa = ike_sa;
this->new_sa = NULL;
@@ -412,13 +397,13 @@ ike_rekey_t *ike_rekey_create(ike_sa_t *ike_sa, bool initiator)
this->public.task.build = (status_t(*)(task_t*,message_t*))build_r;
this->public.task.process = (status_t(*)(task_t*,message_t*))process_r;
}
-
+
this->ike_sa = ike_sa;
this->new_sa = NULL;
this->ike_init = NULL;
this->ike_delete = NULL;
this->initiator = initiator;
this->collision = NULL;
-
+
return &this->public;
}
diff --git a/src/charon/sa/tasks/ike_rekey.h b/src/charon/sa/tasks/ike_rekey.h
index 6748279ab..1c9550768 100644
--- a/src/charon/sa/tasks/ike_rekey.h
+++ b/src/charon/sa/tasks/ike_rekey.h
@@ -36,7 +36,7 @@ struct ike_rekey_t {
* Implements the task_t interface
*/
task_t task;
-
+
/**
* Register a rekeying task which collides with this one.
*
@@ -54,7 +54,7 @@ struct ike_rekey_t {
*
* @param ike_sa IKE_SA this task works for
* @param initiator TRUE for initiator, FALSE for responder
- * @return IKE_REKEY task to handle by the task_manager
+ * @return IKE_REKEY task to handle by the task_manager
*/
ike_rekey_t *ike_rekey_create(ike_sa_t *ike_sa, bool initiator);
diff --git a/src/charon/sa/tasks/ike_vendor.c b/src/charon/sa/tasks/ike_vendor.c
new file mode 100644
index 000000000..7c435b6d1
--- /dev/null
+++ b/src/charon/sa/tasks/ike_vendor.c
@@ -0,0 +1,139 @@
+/*
+ * Copyright (C) 2009 Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+
+#include "ike_vendor.h"
+
+#include <daemon.h>
+#include <encoding/payloads/vendor_id_payload.h>
+
+typedef struct private_ike_vendor_t private_ike_vendor_t;
+
+/**
+ * Private data of an ike_vendor_t object.
+ */
+struct private_ike_vendor_t {
+
+ /**
+ * Public ike_vendor_t interface.
+ */
+ ike_vendor_t public;
+
+ /**
+ * Associated IKE_SA
+ */
+ ike_sa_t *ike_sa;
+
+ /**
+ * Are we the inititator of this task
+ */
+ bool initiator;
+};
+
+/**
+ * strongSwan specific vendor ID without version, MD5("strongSwan")
+ */
+static chunk_t strongswan_vid = chunk_from_chars(
+ 0x88,0x2f,0xe5,0x6d,0x6f,0xd2,0x0d,0xbc,
+ 0x22,0x51,0x61,0x3b,0x2e,0xbe,0x5b,0xeb
+);
+
+METHOD(task_t, build, status_t,
+ private_ike_vendor_t *this, message_t *message)
+{
+ if (lib->settings->get_bool(lib->settings,
+ "charon.send_vendor_id", FALSE))
+ {
+ vendor_id_payload_t *vid;
+
+ vid = vendor_id_payload_create_data(chunk_clone(strongswan_vid));
+ message->add_payload(message, &vid->payload_interface);
+ }
+
+ return this->initiator ? NEED_MORE : SUCCESS;
+}
+
+METHOD(task_t, process, status_t,
+ private_ike_vendor_t *this, message_t *message)
+{
+ enumerator_t *enumerator;
+ payload_t *payload;
+
+ enumerator = message->create_payload_enumerator(message);
+ while (enumerator->enumerate(enumerator, &payload))
+ {
+ if (payload->get_type(payload) == VENDOR_ID)
+ {
+ vendor_id_payload_t *vid;
+ chunk_t data;
+
+ vid = (vendor_id_payload_t*)payload;
+ data = vid->get_data(vid);
+
+ if (chunk_equals(data, strongswan_vid))
+ {
+ DBG1(DBG_IKE, "received strongSwan vendor id");
+ this->ike_sa->enable_extension(this->ike_sa, EXT_STRONGSWAN);
+ }
+ else
+ {
+ DBG1(DBG_ENC, "received unknown vendor id: %#B", &data);
+ }
+ }
+ }
+ enumerator->destroy(enumerator);
+
+ return this->initiator ? SUCCESS : NEED_MORE;
+}
+
+METHOD(task_t, migrate, void,
+ private_ike_vendor_t *this, ike_sa_t *ike_sa)
+{
+ this->ike_sa = ike_sa;
+}
+
+METHOD(task_t, get_type, task_type_t,
+ private_ike_vendor_t *this)
+{
+ return IKE_VENDOR;
+}
+
+METHOD(task_t, destroy, void,
+ private_ike_vendor_t *this)
+{
+ free(this);
+}
+
+/**
+ * See header
+ */
+ike_vendor_t *ike_vendor_create(ike_sa_t *ike_sa, bool initiator)
+{
+ private_ike_vendor_t *this;
+
+ INIT(this,
+ .public.task = {
+ .build = _build,
+ .process = _process,
+ .migrate = _migrate,
+ .get_type = _get_type,
+ .destroy = _destroy,
+ },
+ .initiator = initiator,
+ .ike_sa = ike_sa,
+ );
+
+ return &this->public;
+}
+
diff --git a/src/charon/plugins/sql/sql_attribute.h b/src/charon/sa/tasks/ike_vendor.h
index 23700dea9..dcdd37424 100644
--- a/src/charon/plugins/sql/sql_attribute.h
+++ b/src/charon/sa/tasks/ike_vendor.h
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2008 Martin Willi
+ * Copyright (C) 2009 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
@@ -14,36 +14,36 @@
*/
/**
- * @defgroup sql_attribute sql_attribute
- * @{ @ingroup sql
+ * @defgroup ike_vendor ike_vendor
+ * @{ @ingroup tasks
*/
-#ifndef SQL_ATTRIBUTE_H_
-#define SQL_ATTRIBUTE_H_
+#ifndef IKE_VENDOR_H_
+#define IKE_VENDOR_H_
-#include <config/attributes/attribute_provider.h>
+typedef struct ike_vendor_t ike_vendor_t;
-typedef struct sql_attribute_t sql_attribute_t;
+#include <library.h>
+#include <sa/ike_sa.h>
+#include <sa/tasks/task.h>
/**
- * SQL database based IKEv2 cfg attribute provider.
+ * Vendor ID processing task.
*/
-struct sql_attribute_t {
+struct ike_vendor_t {
/**
- * Implements attribute provider interface
+ * Implements task interface.
*/
- attribute_provider_t provider;
-
- /**
- * Destroy a sql_attribute instance.
- */
- void (*destroy)(sql_attribute_t *this);
+ task_t task;
};
/**
- * Create a sql_attribute instance.
+ * Create a ike_vendor instance.
+ *
+ * @param ike_sa IKE_SA this task works for
+ * @param initiator TRUE if thask is the original initator
*/
-sql_attribute_t *sql_attribute_create(database_t *db);
+ike_vendor_t *ike_vendor_create(ike_sa_t *ike_sa, bool initiator);
-#endif /** SQL_ATTRIBUTE_H_ @}*/
+#endif /** IKE_VENDOR_H_ @}*/
diff --git a/src/charon/sa/tasks/task.c b/src/charon/sa/tasks/task.c
index 9e35b62a5..0d7383141 100644
--- a/src/charon/sa/tasks/task.c
+++ b/src/charon/sa/tasks/task.c
@@ -30,6 +30,7 @@ ENUM(task_type_names, IKE_INIT, CHILD_REKEY,
"IKE_REAUTH",
"IKE_DELETE",
"IKE_DPD",
+ "IKE_VENDOR",
"IKE_ME",
"CHILD_CREATE",
"CHILD_DELETE",
@@ -49,6 +50,7 @@ ENUM(task_type_names, IKE_INIT, CHILD_REKEY,
"IKE_REAUTH",
"IKE_DELETE",
"IKE_DPD",
+ "IKE_VENDOR",
"CHILD_CREATE",
"CHILD_DELETE",
"CHILD_REKEY",
diff --git a/src/charon/sa/tasks/task.h b/src/charon/sa/tasks/task.h
index 3d2014599..4468f2ebe 100644
--- a/src/charon/sa/tasks/task.h
+++ b/src/charon/sa/tasks/task.h
@@ -57,6 +57,8 @@ enum task_type_t {
IKE_DELETE,
/** liveness check */
IKE_DPD,
+ /** Vendor ID processing */
+ IKE_VENDOR,
#ifdef ME
/** handle ME stuff */
IKE_ME,
@@ -79,7 +81,7 @@ extern enum_name_t *task_type_names;
*
* A task is an elemantary operation. It may be handled by a single or by
* multiple exchanges. An exchange may even complete multiple tasks.
- * A task has a build() and an process() operation. The build() operation
+ * A task has a build() and an process() operation. The build() operation
* creates payloads and adds it to the message. The process() operation
* inspects a message and handles its payloads. An initiator of an exchange
* first calls build() to build the request, and processes the response message
@@ -97,7 +99,7 @@ struct task_t {
/**
* Build a request or response message for this task.
- *
+ *
* @param message message to add payloads to
* @return
* - FAILED if a critical error occured
@@ -109,7 +111,7 @@ struct task_t {
/**
* Process a request or response message for this task.
- *
+ *
* @param message message to read payloads from
* @return
* - FAILED if a critical error occured
@@ -123,7 +125,7 @@ struct task_t {
* Get the type of the task implementation.
*/
task_type_t (*get_type) (task_t *this);
-
+
/**
* Migrate a task to a new IKE_SA.
*
@@ -138,7 +140,7 @@ struct task_t {
* @param ike_sa new IKE_SA this task works for
*/
void (*migrate) (task_t *this, ike_sa_t *ike_sa);
-
+
/**
* Destroys a task_t object.
*/
diff --git a/src/charon/sa/trap_manager.c b/src/charon/sa/trap_manager.c
index 570335eb4..ed758995a 100644
--- a/src/charon/sa/trap_manager.c
+++ b/src/charon/sa/trap_manager.c
@@ -16,7 +16,7 @@
#include "trap_manager.h"
#include <daemon.h>
-#include <utils/mutex.h>
+#include <threading/rwlock.h>
#include <utils/linked_list.h>
@@ -27,12 +27,12 @@ typedef struct trap_listener_t trap_listener_t;
* listener to track acquires
*/
struct trap_listener_t {
-
+
/**
* Implements listener interface
*/
listener_t listener;
-
+
/**
* points to trap_manager
*/
@@ -43,22 +43,22 @@ struct trap_listener_t {
* Private data of an trap_manager_t object.
*/
struct private_trap_manager_t {
-
+
/**
* Public trap_manager_t interface.
*/
trap_manager_t public;
-
+
/**
* Installed traps, as entry_t
*/
linked_list_t *traps;
-
+
/**
* read write lock for traps list
*/
rwlock_t *lock;
-
+
/**
* listener to track acquiring IKE_SAs
*/
@@ -102,7 +102,7 @@ static u_int32_t install(private_trap_manager_t *this, peer_cfg_t *peer,
bool found = FALSE;
status_t status;
u_int32_t reqid;
-
+
/* check if not already done */
this->lock->read_lock(this->lock);
enumerator = this->traps->create_enumerator(this->traps);
@@ -123,10 +123,10 @@ static u_int32_t install(private_trap_manager_t *this, peer_cfg_t *peer,
child->get_name(child));
return 0;
}
-
+
/* try to resolve addresses */
ike_cfg = peer->get_ike_cfg(peer);
- other = host_create_from_dns(ike_cfg->get_other_addr(ike_cfg),
+ other = host_create_from_dns(ike_cfg->get_other_addr(ike_cfg),
0, IKEV2_UDP_PORT);
if (!other)
{
@@ -148,14 +148,14 @@ static u_int32_t install(private_trap_manager_t *this, peer_cfg_t *peer,
}
me->set_port(me, IKEV2_UDP_PORT);
}
-
+
/* create and route CHILD_SA */
child_sa = child_sa_create(me, other, child, 0, FALSE);
my_ts = child->get_traffic_selectors(child, TRUE, NULL, me);
other_ts = child->get_traffic_selectors(child, FALSE, NULL, other);
me->destroy(me);
other->destroy(other);
-
+
/* while we don't know the finally negotiated protocol (ESP|AH), we
* could iterate all proposals for a best guest (TODO). But as we
* support ESP only for now, we set here. */
@@ -170,17 +170,17 @@ static u_int32_t install(private_trap_manager_t *this, peer_cfg_t *peer,
DBG1(DBG_CFG, "installing trap failed");
return 0;
}
-
+
reqid = child_sa->get_reqid(child_sa);
entry = malloc_thing(entry_t);
entry->child_sa = child_sa;
entry->peer_cfg = peer->get_ref(peer);
entry->pending = NULL;
-
+
this->lock->write_lock(this->lock);
this->traps->insert_last(this->traps, entry);
this->lock->unlock(this->lock);
-
+
return reqid;
}
@@ -191,7 +191,7 @@ static bool uninstall(private_trap_manager_t *this, u_int32_t reqid)
{
enumerator_t *enumerator;
entry_t *entry, *found = NULL;
-
+
this->lock->write_lock(this->lock);
enumerator = this->traps->create_enumerator(this->traps);
while (enumerator->enumerate(enumerator, &entry))
@@ -205,13 +205,13 @@ static bool uninstall(private_trap_manager_t *this, u_int32_t reqid)
}
enumerator->destroy(enumerator);
this->lock->unlock(this->lock);
-
+
if (!found)
{
DBG1(DBG_CFG, "trap %d not found to uninstall", reqid);
return FALSE;
}
-
+
destroy_entry(found);
return TRUE;
}
@@ -255,7 +255,7 @@ static void acquire(private_trap_manager_t *this, u_int32_t reqid,
peer_cfg_t *peer;
child_cfg_t *child;
ike_sa_t *ike_sa;
-
+
this->lock->read_lock(this->lock);
enumerator = this->traps->create_enumerator(this->traps);
while (enumerator->enumerate(enumerator, &entry))
@@ -267,7 +267,7 @@ static void acquire(private_trap_manager_t *this, u_int32_t reqid,
}
}
enumerator->destroy(enumerator);
-
+
if (!found)
{
DBG1(DBG_CFG, "trap not found, unable to acquire reqid %d",reqid);
@@ -303,37 +303,64 @@ static void acquire(private_trap_manager_t *this, u_int32_t reqid,
}
/**
- * Implementation of listener_t.ike_state_change
+ * Complete the acquire, if successful or failed
*/
-static bool ike_state_change(trap_listener_t *listener, ike_sa_t *ike_sa,
- ike_sa_state_t state)
+static void complete(private_trap_manager_t *this, ike_sa_t *ike_sa,
+ child_sa_t *child_sa)
{
- private_trap_manager_t *this;
enumerator_t *enumerator;
entry_t *entry;
-
- switch (state)
- {
- case IKE_ESTABLISHED:
- case IKE_DESTROYING:
- break;
- default:
- return TRUE;
- }
-
- this = listener->traps;
+
this->lock->read_lock(this->lock);
enumerator = this->traps->create_enumerator(this->traps);
while (enumerator->enumerate(enumerator, &entry))
{
- if (entry->pending == ike_sa)
+ if (entry->pending != ike_sa)
+ {
+ continue;
+ }
+ if (child_sa && child_sa->get_reqid(child_sa) !=
+ entry->child_sa->get_reqid(entry->child_sa))
{
- entry->pending = NULL;
+ continue;
}
+ entry->pending = NULL;
}
enumerator->destroy(enumerator);
this->lock->unlock(this->lock);
- return TRUE;
+}
+
+/**
+ * Implementation of listener_t.ike_state_change
+ */
+static bool ike_state_change(trap_listener_t *listener, ike_sa_t *ike_sa,
+ ike_sa_state_t state)
+{
+ switch (state)
+ {
+ case IKE_DESTROYING:
+ complete(listener->traps, ike_sa, NULL);
+ return TRUE;
+ default:
+ return TRUE;
+ }
+}
+
+/**
+ * Implementation of listener_t.child_state_change
+ */
+static bool child_state_change(trap_listener_t *listener, ike_sa_t *ike_sa,
+ child_sa_t *child_sa, child_sa_state_t state)
+{
+ switch (state)
+ {
+ case CHILD_INSTALLED:
+ case CHILD_DESTROYING:
+ complete(listener->traps, ike_sa, child_sa);
+ return TRUE;
+ default:
+ return TRUE;
+ }
}
/**
@@ -354,22 +381,23 @@ static void destroy(private_trap_manager_t *this)
trap_manager_t *trap_manager_create()
{
private_trap_manager_t *this = malloc_thing(private_trap_manager_t);
-
+
this->public.install = (u_int(*)(trap_manager_t*, peer_cfg_t *peer, child_cfg_t *child))install;
this->public.uninstall = (bool(*)(trap_manager_t*, u_int32_t id))uninstall;
this->public.create_enumerator = (enumerator_t*(*)(trap_manager_t*))create_enumerator;
this->public.acquire = (void(*)(trap_manager_t*, u_int32_t reqid, traffic_selector_t *src, traffic_selector_t *dst))acquire;
this->public.destroy = (void(*)(trap_manager_t*))destroy;
-
+
this->traps = linked_list_create();
this->lock = rwlock_create(RWLOCK_TYPE_DEFAULT);
-
+
/* register listener for IKE state changes */
this->listener.traps = this;
memset(&this->listener.listener, 0, sizeof(listener_t));
this->listener.listener.ike_state_change = (void*)ike_state_change;
+ this->listener.listener.child_state_change = (void*)child_state_change;
charon->bus->add_listener(charon->bus, &this->listener.listener);
-
+
return &this->public;
}
diff --git a/src/charon/sa/trap_manager.h b/src/charon/sa/trap_manager.h
index cb6907cdc..37b42e2b0 100644
--- a/src/charon/sa/trap_manager.h
+++ b/src/charon/sa/trap_manager.h
@@ -31,7 +31,7 @@ typedef struct trap_manager_t trap_manager_t;
* Manage policies to create SAs from traffic.
*/
struct trap_manager_t {
-
+
/**
* Install a policy as a trap.
*
@@ -41,7 +41,7 @@ struct trap_manager_t {
*/
u_int32_t (*install)(trap_manager_t *this, peer_cfg_t *peer,
child_cfg_t *child);
-
+
/**
* Uninstall a trap policy.
*
@@ -49,14 +49,14 @@ struct trap_manager_t {
* @return TRUE if uninstalled successfully
*/
bool (*uninstall)(trap_manager_t *this, u_int32_t reqid);
-
+
/**
* Create an enumerator over all installed traps.
*
* @return enumerator over (peer_cfg_t, child_sa_t)
*/
enumerator_t* (*create_enumerator)(trap_manager_t *this);
-
+
/**
* Acquire an SA triggered by an installed trap.
*
@@ -66,7 +66,7 @@ struct trap_manager_t {
*/
void (*acquire)(trap_manager_t *this, u_int32_t reqid,
traffic_selector_t *src, traffic_selector_t *dst);
-
+
/**
* Destroy a trap_manager_t.
*/
@@ -78,4 +78,4 @@ struct trap_manager_t {
*/
trap_manager_t *trap_manager_create();
-#endif /* TRAP_MANAGER_ @}*/
+#endif /** TRAP_MANAGER_H_ @}*/