]> git.ipfire.org Git - thirdparty/strongswan.git/commitdiff
ike-sa: Use a struct to pass optional arguments when initiating CHILD_SAs
authorTobias Brunner <tobias@strongswan.org>
Wed, 19 May 2021 12:16:20 +0000 (14:16 +0200)
committerTobias Brunner <tobias@strongswan.org>
Thu, 14 Apr 2022 16:42:01 +0000 (18:42 +0200)
18 files changed:
src/charon-nm/nm/nm_service.c
src/frontends/android/app/src/main/jni/libandroidbridge/backend/android_service.c
src/libcharon/control/controller.c
src/libcharon/processing/jobs/adopt_children_job.c
src/libcharon/processing/jobs/initiate_tasks_job.c
src/libcharon/sa/ike_sa.c
src/libcharon/sa/ike_sa.h
src/libcharon/sa/ikev1/task_manager_v1.c
src/libcharon/sa/ikev1/tasks/quick_delete.c
src/libcharon/sa/ikev2/task_manager_v2.c
src/libcharon/sa/ikev2/tasks/child_delete.c
src/libcharon/sa/ikev2/tasks/child_rekey.c
src/libcharon/sa/task_manager.h
src/libcharon/sa/trap_manager.c
src/libcharon/tests/suites/test_child_create.c
src/libcharon/tests/suites/test_childless.c
src/libcharon/tests/suites/test_ike_mid_sync.c
src/libcharon/tests/utils/exchange_test_helper.c

index 2d93b2fae47ed684ffbcf36bd43eac20ee0a5cfb..6fae7bf9a375d40531f08a6e57a062ca96bc9bd0 100644 (file)
@@ -903,7 +903,7 @@ static gboolean connect_(NMVpnServicePlugin *plugin, NMConnection *connection,
         * Initiate
         */
        child_cfg->get_ref(child_cfg);
-       if (ike_sa->initiate(ike_sa, child_cfg, 0, NULL, NULL) != SUCCESS)
+       if (ike_sa->initiate(ike_sa, child_cfg, NULL) != SUCCESS)
        {
                charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager, ike_sa);
 
index 3e686ac839abdcf467fb0a16fc302f27b6869a85..a99d039f8e2365451ac30311304999a633f4337a 100644 (file)
@@ -924,7 +924,7 @@ static job_requeue_t initiate(private_android_service_t *this)
 
        /* get an additional reference because initiate consumes one */
        child_cfg->get_ref(child_cfg);
-       if (ike_sa->initiate(ike_sa, child_cfg, 0, NULL, NULL) != SUCCESS)
+       if (ike_sa->initiate(ike_sa, child_cfg, NULL) != SUCCESS)
        {
                DBG1(DBG_CFG, "failed to initiate tunnel");
                charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager,
index 46b065e3fd064ae3a11a57471de0043a0d6a4858..cd25b28fefa6bfcf5c0864374bad321f4eacc520 100644 (file)
@@ -473,7 +473,7 @@ METHOD(job_t, initiate_execute, job_requeue_t,
                }
        }
 
-       if (ike_sa->initiate(ike_sa, listener->child_cfg, 0, NULL, NULL) == SUCCESS)
+       if (ike_sa->initiate(ike_sa, listener->child_cfg, NULL) == SUCCESS)
        {
                if (!listener->logger.callback)
                {
index e2a7f6b202979dc1cea5494804e4a98ef288679c..f969419fd20827d6db2c5eae769a17f7f42272b5 100644 (file)
@@ -253,7 +253,7 @@ METHOD(job_t, execute, job_requeue_t,
                                        task->migrate(task, ike_sa);
                                        ike_sa->queue_task(ike_sa, task);
                                }
-                               if (ike_sa->initiate(ike_sa, NULL, 0, NULL, NULL) == DESTROY_ME)
+                               if (ike_sa->initiate(ike_sa, NULL, NULL) == DESTROY_ME)
                                {
                                        charon->ike_sa_manager->checkin_and_destroy(
                                                                                        charon->ike_sa_manager, ike_sa);
index 001e71fd1f6edf65ed03448fb90094823385de65..442cd31635d3701d53e94b0791296bde84725b0d 100644 (file)
@@ -55,7 +55,7 @@ METHOD(job_t, execute, job_requeue_t,
                                                                                          this->ike_sa_id);
        if (ike_sa)
        {
-               if (ike_sa->initiate(ike_sa, NULL, 0, NULL, NULL) == DESTROY_ME)
+               if (ike_sa->initiate(ike_sa, NULL, NULL) == DESTROY_ME)
                {
                        charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager,
                                                                                                                ike_sa);
index a891aff4970a0a62a8058b44745f726c92f68411..3ef5e020b1d8c6eda53cdff25b4e6746b8ed13a4 100644 (file)
@@ -1531,8 +1531,7 @@ static void resolve_hosts(private_ike_sa_t *this)
 }
 
 METHOD(ike_sa_t, initiate, status_t,
-       private_ike_sa_t *this, child_cfg_t *child_cfg, uint32_t reqid,
-       traffic_selector_t *tsi, traffic_selector_t *tsr)
+       private_ike_sa_t *this, child_cfg_t *child_cfg, child_init_args_t *args)
 {
        bool defer_initiate = FALSE;
 
@@ -1587,8 +1586,7 @@ METHOD(ike_sa_t, initiate, status_t,
        if (child_cfg)
        {
                /* normal IKE_SA with CHILD_SA */
-               this->task_manager->queue_child(this->task_manager, child_cfg, reqid,
-                                                                               tsi, tsr);
+               this->task_manager->queue_child(this->task_manager, child_cfg, args);
 #ifdef ME
                if (this->peer_cfg->get_mediated_by(this->peer_cfg))
                {
@@ -1621,7 +1619,7 @@ METHOD(ike_sa_t, retry_initiate, status_t,
        if (this->retry_initiate_queued)
        {
                this->retry_initiate_queued = FALSE;
-               return initiate(this, NULL, 0, NULL, NULL);
+               return initiate(this, NULL, NULL);
        }
        return SUCCESS;
 }
@@ -2077,13 +2075,15 @@ static status_t reestablish_children(private_ike_sa_t *this, ike_sa_t *new,
                }
                if (action == ACTION_RESTART)
                {
+                       child_init_args_t args = {
+                               .reqid = child_sa->get_reqid(child_sa),
+                       };
                        child_cfg = child_sa->get_config(child_sa);
                        DBG1(DBG_IKE, "restarting CHILD_SA %s",
                                 child_cfg->get_name(child_cfg));
                        other->task_manager->queue_child(other->task_manager,
                                                                                         child_cfg->get_ref(child_cfg),
-                                                                                        child_sa->get_reqid(child_sa),
-                                                                                        NULL, NULL);
+                                                                                        &args);
                }
        }
        enumerator->destroy(enumerator);
@@ -2091,7 +2091,7 @@ static status_t reestablish_children(private_ike_sa_t *this, ike_sa_t *new,
        /* adopt any active or queued CHILD-creating tasks */
        new->adopt_child_tasks(new, &this->public);
 
-       return new->initiate(new, NULL, 0, NULL, NULL);
+       return new->initiate(new, NULL, NULL);
 }
 
 METHOD(ike_sa_t, reestablish, status_t,
@@ -2224,7 +2224,7 @@ METHOD(ike_sa_t, reestablish, status_t,
 #ifdef ME
        if (this->peer_cfg->is_mediation(this->peer_cfg))
        {
-               status = new->initiate(new, NULL, 0, NULL, NULL);
+               status = new->initiate(new, NULL, NULL);
        }
        else
 #endif /* ME */
index ada8e89b60073ce2187bafee9b17d93943475425..37aac2d3891f2a0091d74be372183287d8dbcf08 100644 (file)
@@ -29,6 +29,7 @@ typedef enum ike_condition_t ike_condition_t;
 typedef enum ike_sa_state_t ike_sa_state_t;
 typedef enum statistic_t statistic_t;
 typedef enum update_hosts_flag_t update_hosts_flag_t;
+typedef struct child_init_args_t child_init_args_t;
 typedef struct ike_sa_t ike_sa_t;
 
 #include <library.h>
@@ -369,6 +370,18 @@ enum ike_sa_state_t {
  */
 extern enum_name_t *ike_sa_state_names;
 
+/**
+ * Optional arguments passed when initiating a CHILD_SA.
+ */
+struct child_init_args_t {
+       /** Reqid to use for CHILD_SA, 0 to assign automatically */
+       uint32_t reqid;
+       /** Optional source of triggering packet */
+       traffic_selector_t *src;
+       /** Optional destination of triggering packet */
+       traffic_selector_t *dst;
+};
+
 /**
  * Class ike_sa_t representing an IKE_SA.
  *
@@ -787,16 +800,13 @@ struct ike_sa_t {
         * to the CHILD_SA.
         *
         * @param child_cfg             child config to create CHILD from
-        * @param reqid                 reqid to use for CHILD_SA, 0 assign uniquely
-        * @param tsi                   source of triggering packet
-        * @param tsr                   destination of triggering packet.
+        * @param args                  optional arguments for the CHILD initiation
         * @return
         *                                              - SUCCESS if initialization started
         *                                              - DESTROY_ME if initialization failed
         */
        status_t (*initiate) (ike_sa_t *this, child_cfg_t *child_cfg,
-                                                 uint32_t reqid, traffic_selector_t *tsi,
-                                                 traffic_selector_t *tsr);
+                                                 child_init_args_t *args);
 
        /**
         * Retry initiation of this IKE_SA after it got deferred previously.
index 8df2862dd9fc64de3a326184595a45918525ba4d..cafeabb841e7f48b3ea04448c72504733e782901 100644 (file)
@@ -1685,7 +1685,7 @@ METHOD(task_manager_t, queue_ike_reauth, void,
                enumerator->destroy(enumerator);
        }
 
-       if (new->initiate(new, NULL, 0, NULL, NULL) != DESTROY_ME)
+       if (new->initiate(new, NULL, NULL) != DESTROY_ME)
        {
                charon->ike_sa_manager->checkin(charon->ike_sa_manager, new);
                this->ike_sa->set_state(this->ike_sa, IKE_REKEYING);
@@ -1732,14 +1732,19 @@ METHOD(task_manager_t, queue_mobike, void,
 }
 
 METHOD(task_manager_t, queue_child, void,
-       private_task_manager_t *this, child_cfg_t *cfg, uint32_t reqid,
-       traffic_selector_t *tsi, traffic_selector_t *tsr)
+       private_task_manager_t *this, child_cfg_t *cfg, child_init_args_t *args)
 {
        quick_mode_t *task;
 
-       task = quick_mode_create(this->ike_sa, cfg, tsi, tsr);
-       task->use_reqid(task, reqid);
-
+       if (args)
+       {
+               task = quick_mode_create(this->ike_sa, cfg, args->src, args->dst);
+               task->use_reqid(task, args->reqid);
+       }
+       else
+       {
+               task = quick_mode_create(this->ike_sa, cfg, NULL, NULL);
+       }
        queue_task(this, &task->task);
 }
 
index 7dff247fbe8847ffa0ea432982538210dd3656be..ecfc8dda33bf70172aa8239e1e655d67ee0829d9 100644 (file)
@@ -149,6 +149,9 @@ static status_t delete_child(private_quick_delete_t *this,
 
                if (remote_close)
                {
+                       child_init_args_t args = {
+                               .reqid = child_sa->get_reqid(child_sa),
+                       };
                        child_cfg = child_sa->get_config(child_sa);
                        child_cfg->get_ref(child_cfg);
 
@@ -157,7 +160,7 @@ static status_t delete_child(private_quick_delete_t *this,
                                case ACTION_RESTART:
                                        child_cfg->get_ref(child_cfg);
                                        status = this->ike_sa->initiate(this->ike_sa, child_cfg,
-                                                                       child_sa->get_reqid(child_sa), NULL, NULL);
+                                                                                                       &args);
                                        break;
                                case ACTION_ROUTE:
                                        charon->traps->install(charon->traps,
index f45d074e12cc36382aadda05ad65a1577c7db689..b359c67bb2ca3004fbf1f48f9004be18672460fc 100644 (file)
@@ -1983,7 +1983,7 @@ static void trigger_mbb_reauth(private_task_manager_t *this)
        /* suspend online revocation checking until the SA is established */
        new->set_condition(new, COND_ONLINE_VALIDATION_SUSPENDED, TRUE);
 
-       if (new->initiate(new, NULL, 0, NULL, NULL) != DESTROY_ME)
+       if (new->initiate(new, NULL, NULL) != DESTROY_ME)
        {
                new->queue_task(new, (task_t*)ike_verify_peer_cert_create(new));
                new->queue_task(new, (task_t*)ike_reauth_complete_create(new,
@@ -2102,15 +2102,18 @@ METHOD(task_manager_t, queue_dpd, void,
 }
 
 METHOD(task_manager_t, queue_child, void,
-       private_task_manager_t *this, child_cfg_t *cfg, uint32_t reqid,
-       traffic_selector_t *tsi, traffic_selector_t *tsr)
+       private_task_manager_t *this, child_cfg_t *cfg, child_init_args_t *args)
 {
        child_create_t *task;
 
-       task = child_create_create(this->ike_sa, cfg, FALSE, tsi, tsr);
-       if (reqid)
+       if (args)
        {
-               task->use_reqid(task, reqid);
+               task = child_create_create(this->ike_sa, cfg, FALSE, args->src, args->dst);
+               task->use_reqid(task, args->reqid);
+       }
+       else
+       {
+               task = child_create_create(this->ike_sa, cfg, FALSE, NULL, NULL);
        }
        queue_task(this, &task->task);
 }
index f3881ceaa2bc5e825208d927d65a3771a1880ba4..5ce251b5ff51f9a22bd0bb33ff795a1f80a11ad1 100644 (file)
@@ -312,12 +312,13 @@ static void process_payloads(private_child_delete_t *this, message_t *message)
  */
 static status_t destroy_and_reestablish(private_child_delete_t *this)
 {
+       child_init_args_t args = {};
        enumerator_t *enumerator;
        entry_t *entry;
        child_sa_t *child_sa;
        child_cfg_t *child_cfg;
        protocol_id_t protocol;
-       uint32_t spi, reqid;
+       uint32_t spi;
        action_t action;
        status_t status = SUCCESS;
        time_t now, expire;
@@ -362,9 +363,9 @@ static status_t destroy_and_reestablish(private_child_delete_t *this)
                        /* no delay and no lifetime, destroy it immediately */
                }
                spi = child_sa->get_spi(child_sa, TRUE);
-               reqid = child_sa->get_reqid(child_sa);
                child_cfg = child_sa->get_config(child_sa);
                child_cfg->get_ref(child_cfg);
+               args.reqid = child_sa->get_reqid(child_sa);
                action = child_sa->get_close_action(child_sa);
 
                this->ike_sa->destroy_child_sa(this->ike_sa, protocol, spi);
@@ -376,7 +377,7 @@ static status_t destroy_and_reestablish(private_child_delete_t *this)
                                case ACTION_RESTART:
                                        child_cfg->get_ref(child_cfg);
                                        status = this->ike_sa->initiate(this->ike_sa, child_cfg,
-                                                                                                       reqid, NULL, NULL);
+                                                                                                       &args);
                                        break;
                                case ACTION_ROUTE:
                                        charon->traps->install(charon->traps,
index 37f7ea9bdb0540fc52b5852be9ede76fe59b02bd..cf103e19410b383bfea50850e9867a341eafa598 100644 (file)
@@ -391,7 +391,7 @@ METHOD(task_t, process_i, status_t,
        if (message->get_notify(message, CHILD_SA_NOT_FOUND))
        {
                child_cfg_t *child_cfg;
-               uint32_t reqid;
+               child_init_args_t args = {};
 
                if (this->collision &&
                        this->collision->get_type(this->collision) == TASK_CHILD_DELETE)
@@ -406,15 +406,14 @@ METHOD(task_t, process_i, status_t,
                 * that (we could go by name, but that might be tricky e.g. due to
                 * narrowing) */
                spi = this->child_sa->get_spi(this->child_sa, TRUE);
-               reqid = this->child_sa->get_reqid(this->child_sa);
                protocol = this->child_sa->get_protocol(this->child_sa);
                child_cfg = this->child_sa->get_config(this->child_sa);
                child_cfg->get_ref(child_cfg);
+               args.reqid = this->child_sa->get_reqid(this->child_sa);
                charon->bus->child_updown(charon->bus, this->child_sa, FALSE);
                this->ike_sa->destroy_child_sa(this->ike_sa, protocol, spi);
                return this->ike_sa->initiate(this->ike_sa,
-                                                                         child_cfg->get_ref(child_cfg), reqid,
-                                                                         NULL, NULL);
+                                                                         child_cfg->get_ref(child_cfg), &args);
        }
 
        if (this->child_create->task.process(&this->child_create->task,
index f9225c56ad4c93d75e8c548e27795da908f3b65c..8c6496adfcf58a6dc1af208cf3a22f48f4d57042 100644 (file)
@@ -172,12 +172,10 @@ struct task_manager_t {
         * Queue CHILD_SA establishing tasks.
         *
         * @param cfg                   CHILD_SA config to establish
-        * @param reqid                 reqid to use for CHILD_SA
-        * @param tsi                   initiator traffic selector, if packet-triggered
-        * @param tsr                   responder traffic selector, if packet-triggered
+        * @param args                  optional arguments for the initiation
         */
-       void (*queue_child)(task_manager_t *this, child_cfg_t *cfg, uint32_t reqid,
-                                               traffic_selector_t *tsi, traffic_selector_t *tsr);
+       void (*queue_child)(task_manager_t *this, child_cfg_t *cfg,
+                                               child_init_args_t *args);
 
        /**
         * Queue CHILD_SA rekeying tasks.
index f9f78acabaee2a75481f651a3eeac89fb17ec808..fc78eb441dc0d16b409cc1bf037c7a84d9f2b9f3 100644 (file)
@@ -542,17 +542,23 @@ METHOD(trap_manager_t, acquire, void,
 
        if (ike_sa)
        {
+               child_init_args_t args = {
+                       .reqid = reqid,
+                       .src = src,
+                       .dst = dst,
+               };
+
                if (this->ignore_acquire_ts || ike_sa->get_version(ike_sa) == IKEV1)
                {       /* in IKEv1, don't prepend the acquiring packet TS, as we only
                         * have a single TS that we can establish in a Quick Mode. */
-                       src = dst = NULL;
+                       args.src = args.dst = NULL;
                }
 
                this->mutex->lock(this->mutex);
                acquire->ike_sa = ike_sa;
                this->mutex->unlock(this->mutex);
 
-               if (ike_sa->initiate(ike_sa, child, reqid, src, dst) != DESTROY_ME)
+               if (ike_sa->initiate(ike_sa, child, &args) != DESTROY_ME)
                {
                        charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
                }
index 20a47f6bffece60a542054290fc5d69ef4134529..4f6733a92083789c3164f7115a07b7ad62a1c13d 100644 (file)
@@ -44,7 +44,7 @@ START_TEST(test_collision_ike_rekey)
                                                                traffic_selector_create_dynamic(0, 0, 65535));
        child_cfg->add_traffic_selector(child_cfg, FALSE,
                                                                traffic_selector_create_dynamic(0, 0, 65535));
-       call_ikesa(a, initiate, child_cfg, 0, NULL, NULL);
+       call_ikesa(a, initiate, child_cfg, NULL);
        assert_child_sa_count(a, 1);
        assert_hook();
 
@@ -81,7 +81,7 @@ START_TEST(test_collision_ike_rekey)
        ck_assert(!exchange_test_helper->sender->dequeue(exchange_test_helper->sender));
        assert_num_tasks(a, 0, TASK_QUEUE_ACTIVE);
        assert_num_tasks(a, 1, TASK_QUEUE_QUEUED);
-       call_ikesa(a, initiate, NULL, 0, NULL, NULL);
+       call_ikesa(a, initiate, NULL, NULL);
        assert_num_tasks(a, 0, TASK_QUEUE_ACTIVE);
 
        assert_sa_idle(b);
index 6ac02aad8144a69044c4e9996851282fbef1cb93..931abbb5ec23aad3131fa47aa7ed509ae9263ad9 100644 (file)
@@ -44,7 +44,7 @@ START_TEST(test_regular)
        id_a = a->get_id(a);
        id_b = b->get_id(b);
 
-       call_ikesa(a, initiate, child_cfg, 0, NULL, NULL);
+       call_ikesa(a, initiate, child_cfg, NULL);
 
        /* IKE_SA_INIT --> */
        id_b->set_initiator_spi(id_b, id_a->get_initiator_spi(id_a));
@@ -115,7 +115,7 @@ START_TEST(test_regular_manual)
        id_a = a->get_id(a);
        id_b = b->get_id(b);
 
-       call_ikesa(a, initiate, NULL, 0, NULL, NULL);
+       call_ikesa(a, initiate, NULL, NULL);
 
        /* IKE_SA_INIT --> */
        id_b->set_initiator_spi(id_b, id_a->get_initiator_spi(id_a));
@@ -144,7 +144,7 @@ START_TEST(test_regular_manual)
        assert_sa_idle(a);
        assert_sa_idle(b);
 
-       call_ikesa(a, initiate, child_cfg, 0, NULL, NULL);
+       call_ikesa(a, initiate, child_cfg, NULL);
 
        /* CREATE_CHILD_SA { SA, Ni, KEi, TSi, TSr } --> */
        assert_hook_called(child_updown);
@@ -192,7 +192,7 @@ START_TEST(test_failure_init)
        id_a = a->get_id(a);
        id_b = b->get_id(b);
 
-       call_ikesa(a, initiate, child_cfg, 0, NULL, NULL);
+       call_ikesa(a, initiate, child_cfg, NULL);
 
        /* IKE_SA_INIT --> */
        id_b->set_initiator_spi(id_b, id_a->get_initiator_spi(id_a));
@@ -233,7 +233,7 @@ START_TEST(test_failure_resp)
        id_a = a->get_id(a);
        id_b = b->get_id(b);
 
-       call_ikesa(a, initiate, child_cfg, 0, NULL, NULL);
+       call_ikesa(a, initiate, child_cfg, NULL);
 
        /* IKE_SA_INIT --> */
        id_b->set_initiator_spi(id_b, id_a->get_initiator_spi(id_a));
index 3776f39e9dbb10e8b34bed2556e28f870fa6e8db..cfebf4b5a8e1a3e3dd9ef6142f6fed842d58015a 100644 (file)
@@ -493,7 +493,7 @@ START_TEST(test_active)
        charon->bus->remove_listener(charon->bus, &mid.listener);
 
        /* the active task was queued again */
-       call_ikesa(a, initiate, NULL, 0, NULL, NULL);
+       call_ikesa(a, initiate, NULL, NULL);
        exchange_test_helper->process_message(exchange_test_helper, b, NULL);
        exchange_test_helper->process_message(exchange_test_helper, a, NULL);
        send_dpd(b, a);
index be55a1387fcba4c03b22d4464fcf10c86dfcf505..1448504abe34af9203eadadfb1d99db2bce61ec0 100644 (file)
@@ -273,7 +273,7 @@ METHOD(exchange_test_helper_t, establish_sa, void,
        id_i = sa_i->get_id(sa_i);
        id_r = sa_r->get_id(sa_r);
 
-       call_ikesa(sa_i, initiate, child_i, 0, NULL, NULL);
+       call_ikesa(sa_i, initiate, child_i, NULL);
 
        /* IKE_SA_INIT --> */
        id_r->set_initiator_spi(id_r, id_i->get_initiator_spi(id_i));