denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

implemented the right|leftallowany feature

Browse Source
This commit is contained in:
Andreas Steffen
2012-06-08 21:24:41 +02:00
parent e5f0f9ff96
commit 1d315bddd3
19 changed files with 137 additions and 77 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/config/backend_manager.c
+20 -11
View File
@@ -78,12 +78,14 @@ static enumerator_t *ike_enum_create(backend_t *backend, ike_data_t *data)
static ike_cfg_match_t get_ike_match(ike_cfg_t *cand, host_t *me, host_t *other)
{
host_t *me_cand, *other_cand;
char *my_addr, *other_addr;
bool my_allow_any, other_allow_any;
ike_cfg_match_t match = MATCH_NONE;
if (me)
{
me_cand = host_create_from_dns(cand->get_my_addr(cand),
me->get_family(me), 0);
my_addr = cand->get_my_addr(cand, &my_allow_any);
me_cand = host_create_from_dns(my_addr, me->get_family(me), 0);
if (!me_cand)
{
return MATCH_NONE;
@@ -92,7 +94,7 @@ static ike_cfg_match_t get_ike_match(ike_cfg_t *cand, host_t *me, host_t *other)
{
match += MATCH_ME;
}
else if (me_cand->is_anyaddr(me_cand))
else if (my_allow_any || me_cand->is_anyaddr(me_cand))
{
match += MATCH_ANY;
}
@@ -110,8 +112,8 @@ static ike_cfg_match_t get_ike_match(ike_cfg_t *cand, host_t *me, host_t *other)
if (other)
{
other_cand = host_create_from_dns(cand->get_other_addr(cand),
other->get_family(other), 0);
other_addr = cand->get_other_addr(cand, &other_allow_any);
other_cand = host_create_from_dns(other_addr, other->get_family(other), 0);
if (!other_cand)
{
return MATCH_NONE;
@@ -120,7 +122,7 @@ static ike_cfg_match_t get_ike_match(ike_cfg_t *cand, host_t *me, host_t *other)
{
match += MATCH_OTHER;
}
else if (other_cand->is_anyaddr(other_cand))
else if (other_allow_any || other_cand->is_anyaddr(other_cand))
{
match += MATCH_ANY;
}
@@ -142,6 +144,8 @@ METHOD(backend_manager_t, get_ike_cfg, ike_cfg_t*,
private_backend_manager_t *this, host_t *me, host_t *other)
{
ike_cfg_t *current, *found = NULL;
char *my_addr, *other_addr;
bool my_allow_any, other_allow_any;
enumerator_t *enumerator;
ike_cfg_match_t match, best = MATCH_ANY;
ike_data_t *data;
@@ -164,9 +168,11 @@ METHOD(backend_manager_t, get_ike_cfg, ike_cfg_t*,
DBG3(DBG_CFG, "ike config match: %d (%H %H)", match, me, other);
if (match)
{
DBG2(DBG_CFG, " candidate: %s...%s, prio %d",
current->get_my_addr(current),
current->get_other_addr(current), match);
my_addr = current->get_my_addr(current, &my_allow_any);
other_addr = current->get_other_addr(current, &other_allow_any);
DBG2(DBG_CFG, " candidate: %s%s...%s%s, prio %d",
my_allow_any ? "%":"", my_addr,
other_allow_any ? "%":"", other_addr, match);
if (match > best)
{
DESTROY_IF(found);
@@ -180,8 +186,11 @@ METHOD(backend_manager_t, get_ike_cfg, ike_cfg_t*,
this->lock->unlock(this->lock);
if (found)
{
DBG2(DBG_CFG, "found matching ike config: %s...%s with prio %d",
found->get_my_addr(found), found->get_other_addr(found), best);
my_addr = found->get_my_addr(found, &my_allow_any);
other_addr = found->get_other_addr(found, &other_allow_any);
DBG2(DBG_CFG, "found matching ike config: %s%s...%s%s with prio %d",
my_allow_any ? "%":"", my_addr,
other_allow_any ? "%":"", other_addr, best);
}
return found;
}
src/libcharon/config/ike_cfg.c
+24 -3
View File
@@ -48,6 +48,16 @@ struct private_ike_cfg_t {
*/
char *other;
/**
* Allow override of local address
*/
bool my_allow_any;
/**
* Allow override of remote address
*/
bool other_allow_any;
/**
* our source port
*/
@@ -87,14 +97,22 @@ METHOD(ike_cfg_t, force_encap_, bool,
}
METHOD(ike_cfg_t, get_my_addr, char*,
private_ike_cfg_t *this)
private_ike_cfg_t *this, bool *allow_any)
{
if (allow_any)
{
*allow_any = this->my_allow_any;
}
return this->me;
}
METHOD(ike_cfg_t, get_other_addr, char*,
private_ike_cfg_t *this)
private_ike_cfg_t *this, bool *allow_any)
{
if (allow_any)
{
*allow_any = this->other_allow_any;
}
return this->other;
}
@@ -260,7 +278,8 @@ METHOD(ike_cfg_t, destroy, void,
* Described in header.
*/
ike_cfg_t *ike_cfg_create(bool certreq, bool force_encap,
char *me, u_int16_t my_port, char *other, u_int16_t other_port)
char *me, bool my_allow_any, u_int16_t my_port,
char *other, bool other_allow_any, u_int16_t other_port)
{
private_ike_cfg_t *this;
@@ -285,6 +304,8 @@ ike_cfg_t *ike_cfg_create(bool certreq, bool force_encap,
.force_encap = force_encap,
.me = strdup(me),
.other = strdup(other),
.my_allow_any = my_allow_any,
.other_allow_any = other_allow_any,
.my_port = my_port,
.other_port = other_port,
.proposals = linked_list_create(),
src/libcharon/config/ike_cfg.h
+31 -26
View File
@@ -41,28 +41,30 @@ struct ike_cfg_t {
/**
* Get own address.
*
* @return string of address/DNS name
* @param allow_any allow any address to match
* @return string of address/DNS name
*/
char* (*get_my_addr) (ike_cfg_t *this);
char* (*get_my_addr) (ike_cfg_t *this, bool *allow_any);
/**
* Get peers address.
* Get peer's address.
*
* @return string of address/DNS name
* @param allow_any allow any address to match
* @return string of address/DNS name
*/
char* (*get_other_addr) (ike_cfg_t *this);
char* (*get_other_addr) (ike_cfg_t *this, bool *allow_any);
/**
* Get the port to use as our source port.
*
* @return source address port, host order
* @return source address port, host order
*/
u_int16_t (*get_my_port)(ike_cfg_t *this);
/**
* Get the port to use as destination port.
*
* @return destination address, host order
* @return destination address, host order
*/
u_int16_t (*get_other_port)(ike_cfg_t *this);
@@ -72,7 +74,7 @@ struct ike_cfg_t {
* The first added proposal has the highest priority, the last
* added the lowest.
*
* @param proposal proposal to add
* @param proposal proposal to add
*/
void (*add_proposal) (ike_cfg_t *this, proposal_t *proposal);
@@ -81,7 +83,7 @@ struct ike_cfg_t {
*
* Returned list and its proposals must be destroyed after use.
*
* @return list containing all the proposals
* @return list containing all the proposals
*/
linked_list_t* (*get_proposals) (ike_cfg_t *this);
@@ -90,9 +92,9 @@ struct ike_cfg_t {
*
* Returned proposal must be destroyed after use.
*
* @param proposals list of proposals to select from
* @param private accept algorithms from a private range
* @return selected proposal, or NULL if none matches.
* @param proposals list of proposals to select from
* @param private accept algorithms from a private range
* @return selected proposal, or NULL if none matches.
*/
proposal_t *(*select_proposal) (ike_cfg_t *this, linked_list_t *proposals,
bool private);
@@ -100,36 +102,36 @@ struct ike_cfg_t {
/**
* Should we send a certificate request in IKE_SA_INIT?
*
* @return certificate request sending policy
* @return certificate request sending policy
*/
bool (*send_certreq) (ike_cfg_t *this);
/**
* Enforce UDP encapsulation by faking NATD notifies?
*
* @return TRUE to enfoce UDP encapsulation
* @return TRUE to enfoce UDP encapsulation
*/
bool (*force_encap) (ike_cfg_t *this);
/**
* Get the DH group to use for IKE_SA setup.
*
* @return dh group to use for initialization
* @return dh group to use for initialization
*/
diffie_hellman_group_t (*get_dh_group)(ike_cfg_t *this);
/**
* Check if two IKE configs are equal.
*
* @param other other to check for equality
* @return TRUE if other equal to this
* @param other other to check for equality
* @return TRUE if other equal to this
*/
bool (*equals)(ike_cfg_t *this, ike_cfg_t *other);
/**
* Increase reference count.
*
* @return reference to this
* @return reference to this
*/
ike_cfg_t* (*get_ref) (ike_cfg_t *this);
@@ -147,15 +149,18 @@ struct ike_cfg_t {
*
* Supplied hosts become owned by ike_cfg, the name gets cloned.
*
* @param certreq TRUE to send a certificate request
* @param force_encap enforce UDP encapsulation by faking NATD notify
* @param me address/DNS name of local peer
* @param my_port IKE port to use as source, 500 uses IKEv2 port floating
* @param other address/DNS name of remote peer
* @param other_port IKE port to use as dest, 500 uses IKEv2 port floating
* @return ike_cfg_t object.
* @param certreq TRUE to send a certificate request
* @param force_encap enforce UDP encapsulation by faking NATD notify
* @param me address/DNS name of local peer
* @param my_allow_any allow override of local address by any address
* @param my_port IKE port to use as source, 500 uses IKEv2 port floating
* @param other address/DNS name of remote peer
* @param other_allow_any allow override of remote address by any address
* @param other_port IKE port to use as dest, 500 uses IKEv2 port floating
* @return ike_cfg_t object.
*/
ike_cfg_t *ike_cfg_create(bool certreq, bool force_encap,
char *me, u_int16_t my_port, char *other, u_int16_t other_port);
char *me, bool my_allow_any, u_int16_t my_port,
char *other, bool other_allow_any, u_int16_t other_port);
#endif /** IKE_CFG_H_ @}*/