denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Support multiple virtual IPs on peer_cfg and ike_sa classes

Browse Source
This commit is contained in:
Martin Willi
2012-08-30 16:43:42 +02:00
parent d8eec395b2
commit 101d26babe
34 changed files with 454 additions and 271 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/ha/ha_dispatcher.c
+10 -5
View File
@@ -344,10 +344,10 @@ static void process_ike_update(private_ha_dispatcher_t *this,
ike_sa->set_other_host(ike_sa, value.host->clone(value.host));
break;
case HA_LOCAL_VIP:
ike_sa->set_virtual_ip(ike_sa, TRUE, value.host);
ike_sa->add_virtual_ip(ike_sa, TRUE, value.host);
break;
case HA_REMOTE_VIP:
ike_sa->set_virtual_ip(ike_sa, FALSE, value.host);
ike_sa->add_virtual_ip(ike_sa, FALSE, value.host);
received_vip = TRUE;
break;
case HA_PEER_ADDR:
@@ -417,13 +417,18 @@ static void process_ike_update(private_ha_dispatcher_t *this,
char *pool;
peer_cfg = ike_sa->get_peer_cfg(ike_sa);
vip = ike_sa->get_virtual_ip(ike_sa, FALSE);
if (peer_cfg && vip)
if (peer_cfg)
{
pool = peer_cfg->get_pool(peer_cfg);
if (pool)
{
this->attr->reserve(this->attr, pool, vip);
enumerator = ike_sa->create_virtual_ip_enumerator(ike_sa,
FALSE);
while (enumerator->enumerate(enumerator, &vip))
{
this->attr->reserve(this->attr, pool, vip);
}
enumerator->destroy(enumerator);
}
}
}
src/libcharon/plugins/ha/ha_ike.c
+30 -22
View File
@@ -241,6 +241,34 @@ METHOD(listener_t, ike_state_change, bool,
return TRUE;
}
/**
* Send a virtual IP sync message for remote VIPs
*/
static void sync_vips(private_ha_ike_t *this, ike_sa_t *ike_sa)
{
ha_message_t *m = NULL;
enumerator_t *enumerator;
host_t *vip;
enumerator = ike_sa->create_virtual_ip_enumerator(ike_sa, FALSE);
while (enumerator->enumerate(enumerator, &vip))
{
if (!m)
{
m = ha_message_create(HA_IKE_UPDATE);
m->add_attribute(m, HA_IKE_ID, ike_sa->get_id(ike_sa));
}
m->add_attribute(m, HA_REMOTE_VIP, vip);
}
enumerator->destroy(enumerator);
if (m)
{
this->socket->push(this->socket, m);
this->cache->cache(this->cache, ike_sa, m);
}
}
METHOD(listener_t, message_hook, bool,
private_ha_ike_t *this, ike_sa_t *ike_sa, message_t *message,
bool incoming, bool plain)
@@ -276,18 +304,7 @@ METHOD(listener_t, message_hook, bool,
{ /* After IKE_SA has been established, sync peers virtual IP.
* We cannot sync it in the state_change hook, it is installed later.
* TODO: where to sync local VIP? */
ha_message_t *m;
host_t *vip;
vip = ike_sa->get_virtual_ip(ike_sa, FALSE);
if (vip)
{
m = ha_message_create(HA_IKE_UPDATE);
m->add_attribute(m, HA_IKE_ID, ike_sa->get_id(ike_sa));
m->add_attribute(m, HA_REMOTE_VIP, vip);
this->socket->push(this->socket, m);
this->cache->cache(this->cache, ike_sa, m);
}
sync_vips(this, ike_sa);
}
}
if (!plain && ike_sa->get_version(ike_sa) == IKEV1)
@@ -296,7 +313,6 @@ METHOD(listener_t, message_hook, bool,
keymat_v1_t *keymat;
u_int32_t mid;
chunk_t iv;
host_t *vip;
mid = message->get_message_id(message);
if (mid == 0)
@@ -313,15 +329,7 @@ METHOD(listener_t, message_hook, bool,
}
if (!incoming && message->get_exchange_type(message) == TRANSACTION)
{
vip = ike_sa->get_virtual_ip(ike_sa, FALSE);
if (vip)
{
m = ha_message_create(HA_IKE_UPDATE);
m->add_attribute(m, HA_IKE_ID, ike_sa->get_id(ike_sa));
m->add_attribute(m, HA_REMOTE_VIP, vip);
this->socket->push(this->socket, m);
this->cache->cache(this->cache, ike_sa, m);
}
sync_vips(this, ike_sa);
}
}
if (plain && ike_sa->get_version(ike_sa) == IKEV1 &&
src/libcharon/plugins/ha/ha_tunnel.c
+1 -1
View File
@@ -209,7 +209,7 @@ static void setup_tunnel(private_ha_tunnel_t *this,
ike_cfg->add_proposal(ike_cfg, proposal_create_default(PROTO_IKE));
peer_cfg = peer_cfg_create("ha", IKEV2, ike_cfg, CERT_NEVER_SEND,
UNIQUE_KEEP, 0, 86400, 0, 7200, 3600, FALSE, FALSE, 30,
0, NULL, NULL, FALSE, NULL, NULL);
0, NULL, FALSE, NULL, NULL);
auth_cfg = auth_cfg_create();
auth_cfg->add(auth_cfg, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PSK);