projects/aports·blob master · refs

149 lines · 4.9 KiB

1https://github.com/strongswan/strongswan/pull/502
2
3From 59e1a0469bbd50704f777835c0fcd7013f7841c7 Mon Sep 17 00:00:00 2001
4From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <[email protected]>
5Date: Mon, 21 Sep 2015 13:42:05 +0300
6Subject: [PATCH] vici: send certificates for ike-sa events
7MIME-Version: 1.0
8Content-Type: text/plain; charset=UTF-8
9Content-Transfer-Encoding: 8bit
10
11Signed-off-by: Timo Teräs <[email protected]>
12---
13 src/libcharon/plugins/vici/vici_query.c | 50 +++++++++++++++++++++----
14 1 file changed, 42 insertions(+), 8 deletions(-)
15
16diff --git a/src/libcharon/plugins/vici/vici_query.c b/src/libcharon/plugins/vici/vici_query.c
17index 43e3f441377..5e49cb8a0b1 100644
18--- a/src/libcharon/plugins/vici/vici_query.c
19+++ b/src/libcharon/plugins/vici/vici_query.c
20@@ -469,7 +469,7 @@ static void list_vips(private_vici_query_t *this, vici_builder_t *b,
21 * List details of an IKE_SA
22 */
23 static void list_ike(private_vici_query_t *this, vici_builder_t *b,
24- ike_sa_t *ike_sa, time_t now)
25+ ike_sa_t *ike_sa, time_t now, bool add_certs)
26 {
27 time_t t;
28 ike_sa_id_t *id;
29@@ -478,6 +478,8 @@ static void list_ike(private_vici_query_t *this, vici_builder_t *b,
30 uint32_t if_id;
31 uint16_t alg, ks;
32 host_t *host;
33+ auth_cfg_t *auth_cfg;
34+ enumerator_t *enumerator;
35
36 b->add_kv(b, "uniqueid", "%u", ike_sa->get_unique_id(ike_sa));
37 b->add_kv(b, "version", "%u", ike_sa->get_version(ike_sa));
38@@ -487,12 +489,44 @@ static void list_ike(private_vici_query_t *this, vici_builder_t *b,
39 b->add_kv(b, "local-host", "%H", host);
40 b->add_kv(b, "local-port", "%d", host->get_port(host));
41 b->add_kv(b, "local-id", "%Y", ike_sa->get_my_id(ike_sa));
42+ if (add_certs)
43+ {
44+ enumerator = ike_sa->create_auth_cfg_enumerator(ike_sa, TRUE);
45+ if (enumerator->enumerate(enumerator, &auth_cfg))
46+ {
47+ certificate_t *cert = auth_cfg->get(auth_cfg, AUTH_RULE_SUBJECT_CERT);
48+ chunk_t encoding;
49
50+ if (cert && cert->get_encoding(cert, CERT_ASN1_DER, &encoding))
51+ {
52+ b->add(b, VICI_KEY_VALUE, "local-cert-data", encoding);
53+ free(encoding.ptr);
54+ }
55+ }
56+ enumerator->destroy(enumerator);
57+ }
58+
59 host = ike_sa->get_other_host(ike_sa);
60 b->add_kv(b, "remote-host", "%H", host);
61 b->add_kv(b, "remote-port", "%d", host->get_port(host));
62 b->add_kv(b, "remote-id", "%Y", ike_sa->get_other_id(ike_sa));
63+ if (add_certs)
64+ {
65+ enumerator = ike_sa->create_auth_cfg_enumerator(ike_sa, FALSE);
66+ if (enumerator->enumerate(enumerator, &auth_cfg))
67+ {
68+ certificate_t *cert = auth_cfg->get(auth_cfg, AUTH_RULE_SUBJECT_CERT);
69+ chunk_t encoding;
70
71+ if (cert && cert->get_encoding(cert, CERT_ASN1_DER, &encoding))
72+ {
73+ b->add(b, VICI_KEY_VALUE, "remote-cert-data", encoding);
74+ free(encoding.ptr);
75+ }
76+ }
77+ enumerator->destroy(enumerator);
78+ }
79+
80 eap = ike_sa->get_other_eap_id(ike_sa);
81
82 if (!eap->equals(eap, ike_sa->get_other_id(ike_sa)))
83@@ -624,7 +658,7 @@ CALLBACK(list_sas, vici_message_t*,
84 b = vici_builder_create();
85 b->begin_section(b, ike_sa->get_name(ike_sa));
86
87- list_ike(this, b, ike_sa, now);
88+ list_ike(this, b, ike_sa, now, TRUE);
89
90 b->begin_section(b, "child-sas");
91 csas = ike_sa->create_child_sa_enumerator(ike_sa);
92@@ -1847,7 +1881,7 @@ METHOD(listener_t, ike_updown, bool,
93 }
94
95 b->begin_section(b, ike_sa->get_name(ike_sa));
96- list_ike(this, b, ike_sa, now);
97+ list_ike(this, b, ike_sa, now, up);
98 b->end_section(b);
99
100 this->dispatcher->raise_event(this->dispatcher,
101@@ -1872,10 +1906,10 @@ METHOD(listener_t, ike_rekey, bool,
102 b = vici_builder_create();
103 b->begin_section(b, old->get_name(old));
104 b->begin_section(b, "old");
105- list_ike(this, b, old, now);
106+ list_ike(this, b, old, now, TRUE);
107 b->end_section(b);
108 b->begin_section(b, "new");
109- list_ike(this, b, new, now);
110+ list_ike(this, b, new, now, TRUE);
111 b->end_section(b);
112 b->end_section(b);
113
114@@ -1906,7 +1940,7 @@ METHOD(listener_t, ike_update, bool,
115 b->add_kv(b, "remote-port", "%d", remote->get_port(remote));
116
117 b->begin_section(b, ike_sa->get_name(ike_sa));
118- list_ike(this, b, ike_sa, now);
119+ list_ike(this, b, ike_sa, now, TRUE);
120 b->end_section(b);
121
122 this->dispatcher->raise_event(this->dispatcher,
123@@ -1936,7 +1970,7 @@ METHOD(listener_t, child_updown, bool,
124 }
125
126 b->begin_section(b, ike_sa->get_name(ike_sa));
127- list_ike(this, b, ike_sa, now);
128+ list_ike(this, b, ike_sa, now, up);
129 b->begin_section(b, "child-sas");
130
131 snprintf(buf, sizeof(buf), "%s-%u", child_sa->get_name(child_sa),
132@@ -1971,7 +2005,7 @@ METHOD(listener_t, child_rekey, bool,
133 b = vici_builder_create();
134
135 b->begin_section(b, ike_sa->get_name(ike_sa));
136- list_ike(this, b, ike_sa, now);
137+ list_ike(this, b, ike_sa, now, TRUE);
138 b->begin_section(b, "child-sas");
139
140 b->begin_section(b, old->get_name(old));
141@@ -2010,7 +2044,7 @@ METHOD(listener_t, alert, bool,
142 {
143 b->begin_section(b, "ike-sa");
144 b->begin_section(b, ike_sa->get_name(ike_sa));
145- list_ike(this, b, ike_sa, time_monotonic(NULL));
146+ list_ike(this, b, ike_sa, time_monotonic(NULL), FALSE);
147 b->end_section(b);
148 b->end_section(b);
149 }