mem-pool: Pass the remote IKE address, to re-acquire() an address during reauth
With make-before-break IKEv2 re-authentication, virtual IP addresses must be assigned overlapping to the same peer. With the remote IKE address, the backend can detect re-authentication attempts by comparing the remote host address and port. This allows proper reassignment of the virtual IP if it is re-requested. This change removes the mem-pool.reassign_online option, as it is obsolete now. IPs get automatically reassigned if a peer re-requests the same address, and additionally connects from the same address and port.
This commit is contained in:
@@ -87,13 +87,21 @@ struct mem_pool_t {
|
||||
* acquire a new lease (MEM_POOL_NEW), and if the pool is full once again
|
||||
* to assign an existing offline lease (MEM_POOL_REASSIGN).
|
||||
*
|
||||
* If the same identity requests a virtual IP that is already assigned to
|
||||
* it, the peer address and port is used to check if it is the same client
|
||||
* instance that is connecting. If this is true, the request is considered
|
||||
* a request for a reauthentication attempt, and the same virtual IP gets
|
||||
* assigned to the peer.
|
||||
*
|
||||
* @param id the id to acquire an address for
|
||||
* @param requested acquire this address, if possible
|
||||
* @param operation acquire operation to perform, see above
|
||||
* @param peer optional remote IKE address and port
|
||||
* @return the acquired address
|
||||
*/
|
||||
host_t* (*acquire_address)(mem_pool_t *this, identification_t *id,
|
||||
host_t *requested, mem_pool_op_t operation);
|
||||
host_t *requested, mem_pool_op_t operation,
|
||||
host_t *peer);
|
||||
|
||||
/**
|
||||
* Release a previously acquired address.
|
||||
|
||||
Reference in New Issue
Block a user