purge auth_info when IKE_SA is established, releases cert memory

diff --git a/src/charon/credentials/auth_info.c b/src/charon/credentials/auth_info.c
index 42e1ea4c1d0f3ced427ca7e1e93b26c43b8faae0..62d5ea9b354c90e1b5ee117bcfc65bda8b56fc5c 100644 (file)
--- a/src/charon/credentials/auth_info.c
+++ b/src/charon/credentials/auth_info.c
@@ -560,9 +560,9 @@ static void destroy_item_value(item_t *item)
 }
 
 /**
- * Implementation of auth_info_t.destroy
+ * Implementation of auth_info_t.purge
  */
-static void destroy(private_auth_info_t *this)
+static void purge(private_auth_info_t *this)
 {
        item_t *item;
        
@@ -571,6 +571,14 @@ static void destroy(private_auth_info_t *this)
                destroy_item_value(item);
                free(item);
        }
+}
+
+/**
+ * Implementation of auth_info_t.destroy
+ */
+static void destroy(private_auth_info_t *this)
+{
+       purge(this);
        this->items->destroy(this->items);
        free(this);
 }
@@ -588,6 +596,7 @@ auth_info_t *auth_info_create()
        this->public.create_item_enumerator = (enumerator_t*(*)(auth_info_t*))create_item_enumerator;
        this->public.complies = (bool(*)(auth_info_t*, auth_info_t *))complies;
        this->public.merge = (void(*)(auth_info_t*, auth_info_t *other))merge;
+       this->public.purge = (void(*)(auth_info_t*))purge;
        this->public.equals = (bool(*)(auth_info_t*, auth_info_t *other))equals;
        this->public.destroy = (void(*)(auth_info_t*))destroy;
        

diff --git a/src/charon/credentials/auth_info.h b/src/charon/credentials/auth_info.h
index 52433433a44d83b112e7c9b70cfb761217fbb0b9..161698a655a2f275fdf29f32cbfb21153835eecb 100644 (file)
--- a/src/charon/credentials/auth_info.h
+++ b/src/charon/credentials/auth_info.h
@@ -171,6 +171,11 @@ struct auth_info_t {
         */
        void (*merge)(auth_info_t *this, auth_info_t *other);
        
+       /**
+        * Purge all items in auth_info.
+        */
+       void (*purge)(auth_info_t *this);
+       
        /**
         * Check two auth_infos for equality.
         *

diff --git a/src/charon/sa/ike_sa.c b/src/charon/sa/ike_sa.c
index fa04c04276440ba3139d4300247e77e3bb039dd7..a4e17fdd331f9fc45443b32977c7d6089107e17a 100644 (file)
--- a/src/charon/sa/ike_sa.c
+++ b/src/charon/sa/ike_sa.c
@@ -709,6 +709,12 @@ static void set_state(private_ike_sa_t *this, ike_sa_state_t state)
                        break;
        }
        charon->bus->ike_state_change(charon->bus, &this->public, state);
+       if (state == IKE_ESTABLISHED)
+       {       /* purge auth items after hook invocation, as they contain certs
+                * and other memory wasting elements */
+               this->my_auth->purge(this->my_auth);
+               this->other_auth->purge(this->other_auth);
+       }
        this->state = state;
 }