Merge branch 'multi-vip'
Brings support for multiple virtual IPs and multiple pools in left/rigthsourceip definitions. Also introduces the new left/rightdns options to configure requested DNS server address family and respond with multiple connection specific servers.
This commit is contained in:
Martin Willi
+1
-1
@@ -186,7 +186,7 @@ static const token_info_t token_info[] =
|
||||
{ ARG_STR, offsetof(starter_end_t, subnet), NULL },
|
||||
{ ARG_MISC, 0, NULL /* KW_PROTOPORT */ },
|
||||
{ ARG_STR, offsetof(starter_end_t, sourceip), NULL },
|
||||
{ ARG_MISC, 0, NULL /* KW_NATIP */ },
|
||||
{ ARG_STR, offsetof(starter_end_t, dns), NULL },
|
||||
{ ARG_ENUM, offsetof(starter_end_t, firewall), LST_bool },
|
||||
{ ARG_ENUM, offsetof(starter_end_t, hostaccess), LST_bool },
|
||||
{ ARG_ENUM, offsetof(starter_end_t, allow_any), LST_bool },
|
||||
|
||||
@@ -26,7 +26,6 @@ static bool starter_cmp_end(starter_end_t *c1, starter_end_t *c2)
|
||||
if ((c1 == NULL) || (c2 == NULL))
|
||||
return FALSE;
|
||||
|
||||
VARCMP(has_natip);
|
||||
VARCMP(modecfg);
|
||||
VARCMP(port);
|
||||
VARCMP(protocol);
|
||||
|
||||
@@ -231,64 +231,6 @@ static void kw_end(starter_conn_t *conn, starter_end_t *end, kw_token_t token,
|
||||
end->host = strdupnull(value);
|
||||
break;
|
||||
case KW_SOURCEIP:
|
||||
if (end->has_natip)
|
||||
{
|
||||
DBG1(DBG_APP, "# natip and sourceip cannot be defined at the same time");
|
||||
goto err;
|
||||
}
|
||||
if (value[0] == '%')
|
||||
{
|
||||
if (streq(value, "%modeconfig") || streq(value, "%modecfg") ||
|
||||
streq(value, "%config") || streq(value, "%cfg"))
|
||||
{
|
||||
/* request ip via config payload */
|
||||
free(end->sourceip);
|
||||
end->sourceip = NULL;
|
||||
end->sourceip_mask = 1;
|
||||
}
|
||||
else
|
||||
{ /* %poolname, strip %, serve ip requests */
|
||||
free(end->sourceip);
|
||||
end->sourceip = strdupnull(value+1);
|
||||
end->sourceip_mask = 0;
|
||||
}
|
||||
end->modecfg = TRUE;
|
||||
}
|
||||
else
|
||||
{
|
||||
host_t *host;
|
||||
char *sep;
|
||||
|
||||
sep = strchr(value, '/');
|
||||
if (sep)
|
||||
{ /* CIDR notation, address pool */
|
||||
*sep = '\0';
|
||||
host = host_create_from_string(value, 0);
|
||||
if (!host)
|
||||
{
|
||||
DBG1(DBG_APP, "# bad subnet: %s=%s", name, value);
|
||||
goto err;
|
||||
}
|
||||
host->destroy(host);
|
||||
free(end->sourceip);
|
||||
end->sourceip = strdupnull(value);
|
||||
end->sourceip_mask = atoi(sep + 1);
|
||||
/* restore the original text in case also= is used */
|
||||
*sep = '/';
|
||||
}
|
||||
else
|
||||
{ /* fixed srcip */
|
||||
host = host_create_from_string(value, 0);
|
||||
if (!host)
|
||||
{
|
||||
DBG1(DBG_APP, "# bad addr: %s=%s", name, value);
|
||||
goto err;
|
||||
}
|
||||
end->sourceip_mask = (host->get_family(host) == AF_INET) ?
|
||||
32 : 128;
|
||||
host->destroy(host);
|
||||
}
|
||||
}
|
||||
conn->mode = MODE_TUNNEL;
|
||||
conn->proxy_mode = FALSE;
|
||||
break;
|
||||
@@ -370,27 +312,6 @@ static void kw_end(starter_conn_t *conn, starter_end_t *end, kw_token_t token,
|
||||
}
|
||||
break;
|
||||
}
|
||||
case KW_NATIP:
|
||||
{
|
||||
host_t *host;
|
||||
if (end->sourceip)
|
||||
{
|
||||
DBG1(DBG_APP, "# natip and sourceip cannot be defined at the same time");
|
||||
goto err;
|
||||
}
|
||||
host = host_create_from_string(value, 0);
|
||||
if (!host)
|
||||
{
|
||||
DBG1(DBG_APP, "# bad addr: %s=%s", name, value);
|
||||
goto err;
|
||||
}
|
||||
host->destroy(host);
|
||||
end->sourceip = strdupnull(value);
|
||||
end->has_natip = TRUE;
|
||||
conn->mode = MODE_TUNNEL;
|
||||
conn->proxy_mode = FALSE;
|
||||
break;
|
||||
}
|
||||
default:
|
||||
break;
|
||||
}
|
||||
|
||||
@@ -102,7 +102,6 @@ struct starter_end {
|
||||
char *host;
|
||||
u_int ikeport;
|
||||
char *subnet;
|
||||
bool has_natip;
|
||||
bool modecfg;
|
||||
certpolicy_t sendcert;
|
||||
bool firewall;
|
||||
@@ -112,7 +111,7 @@ struct starter_end {
|
||||
u_int16_t port;
|
||||
u_int8_t protocol;
|
||||
char *sourceip;
|
||||
int sourceip_mask;
|
||||
char *dns;
|
||||
};
|
||||
|
||||
typedef struct also also_t;
|
||||
|
||||
@@ -97,7 +97,7 @@ typedef enum {
|
||||
KW_SUBNET,
|
||||
KW_PROTOPORT,
|
||||
KW_SOURCEIP,
|
||||
KW_NATIP,
|
||||
KW_DNS,
|
||||
KW_FIREWALL,
|
||||
KW_HOSTACCESS,
|
||||
KW_ALLOWANY,
|
||||
@@ -126,7 +126,7 @@ typedef enum {
|
||||
KW_LEFTSUBNET,
|
||||
KW_LEFTPROTOPORT,
|
||||
KW_LEFTSOURCEIP,
|
||||
KW_LEFTNATIP,
|
||||
KW_LEFTDNS,
|
||||
KW_LEFTFIREWALL,
|
||||
KW_LEFTHOSTACCESS,
|
||||
KW_LEFTALLOWANY,
|
||||
@@ -155,7 +155,7 @@ typedef enum {
|
||||
KW_RIGHTSUBNET,
|
||||
KW_RIGHTPROTOPORT,
|
||||
KW_RIGHTSOURCEIP,
|
||||
KW_RIGHTNATIP,
|
||||
KW_RIGHTDNS,
|
||||
KW_RIGHTFIREWALL,
|
||||
KW_RIGHTHOSTACCESS,
|
||||
KW_RIGHTALLOWANY,
|
||||
|
||||
@@ -85,7 +85,7 @@ leftsubnet, KW_LEFTSUBNET
|
||||
leftsubnetwithin, KW_LEFTSUBNET
|
||||
leftprotoport, KW_LEFTPROTOPORT
|
||||
leftsourceip, KW_LEFTSOURCEIP
|
||||
leftnatip, KW_LEFTNATIP
|
||||
leftdns, KW_LEFTDNS
|
||||
leftfirewall, KW_LEFTFIREWALL
|
||||
lefthostaccess, KW_LEFTHOSTACCESS
|
||||
leftallowany, KW_LEFTALLOWANY
|
||||
@@ -109,7 +109,7 @@ rightsubnet, KW_RIGHTSUBNET
|
||||
rightsubnetwithin, KW_RIGHTSUBNET
|
||||
rightprotoport, KW_RIGHTPROTOPORT
|
||||
rightsourceip, KW_RIGHTSOURCEIP
|
||||
rightnatip, KW_RIGHTNATIP
|
||||
rightdns, KW_RIGHTDNS
|
||||
rightfirewall, KW_RIGHTFIREWALL
|
||||
righthostaccess, KW_RIGHTHOSTACCESS
|
||||
rightallowany, KW_RIGHTALLOWANY
|
||||
|
||||
@@ -140,7 +140,7 @@ static void starter_stroke_add_end(stroke_msg_t *msg, stroke_end_t *msg_end, sta
|
||||
msg_end->ikeport = conn_end->ikeport;
|
||||
msg_end->subnets = push_string(msg, conn_end->subnet);
|
||||
msg_end->sourceip = push_string(msg, conn_end->sourceip);
|
||||
msg_end->sourceip_mask = conn_end->sourceip_mask;
|
||||
msg_end->dns = push_string(msg, conn_end->dns);
|
||||
msg_end->sendcert = conn_end->sendcert;
|
||||
msg_end->hostaccess = conn_end->hostaccess;
|
||||
msg_end->tohost = !conn_end->subnet;
|
||||
|
||||
Reference in New Issue
Block a user