denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

mem-pool: Pass the remote IKE address, to re-acquire() an address during reauth

Browse Source 
With make-before-break IKEv2 re-authentication, virtual IP addresses must be
assigned overlapping to the same peer. With the remote IKE address, the backend
can detect re-authentication attempts by comparing the remote host address and
port. This allows proper reassignment of the virtual IP if it is re-requested.

This change removes the mem-pool.reassign_online option, as it is obsolete now.
IPs get automatically reassigned if a peer re-requests the same address, and
additionally connects from the same address and port.
This commit is contained in:
Martin Willi
2015-02-20 13:34:57 +01:00
parent 3676023e54
commit 22e6a06b8c
7 changed files with 87 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files
conf/options/charon.opt
-4
View File
@@ -206,10 +206,6 @@ charon.make_before_break = no
gaps during reauthentication, but requires support for overlapping SAs by
the peer. strongSwan can handle such overlapping SAs since version 5.3.0.
charon.mem-pool.reassign_online = no
Reassign an online IP address lease from an in-memory address pool if a
client with the same identity requests it explicitly.
charon.multiple_authentication = yes
Enable multiple authentication exchanges (RFC 4739).