denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

mem-pool: Pass the remote IKE address, to re-acquire() an address during reauth

Browse Source 
With make-before-break IKEv2 re-authentication, virtual IP addresses must be
assigned overlapping to the same peer. With the remote IKE address, the backend
can detect re-authentication attempts by comparing the remote host address and
port. This allows proper reassignment of the virtual IP if it is re-requested.

This change removes the mem-pool.reassign_online option, as it is obsolete now.
IPs get automatically reassigned if a peer re-requests the same address, and
additionally connects from the same address and port.
This commit is contained in:
Martin Willi
2015-02-20 13:34:57 +01:00
parent 3676023e54
commit 22e6a06b8c
7 changed files with 87 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/load_tester/load_tester_config.c
+1 -1
View File
@@ -618,7 +618,7 @@ static host_t *allocate_addr(private_load_tester_config_t *this, uint num)
enumerator = this->pools->create_enumerator(this->pools);
while (enumerator->enumerate(enumerator, &pool))
{
found = pool->acquire_address(pool, id, requested, MEM_POOL_NEW);
found = pool->acquire_address(pool, id, requested, MEM_POOL_NEW, NULL);
if (found)
{
iface = (char*)pool->get_name(pool);
src/libcharon/plugins/stroke/stroke_attribute.c
+7 -6
View File
@@ -94,7 +94,7 @@ static mem_pool_t *find_pool(private_stroke_attribute_t *this, char *name)
*/
static host_t *find_addr(private_stroke_attribute_t *this, linked_list_t *pools,
identification_t *id, host_t *requested,
mem_pool_op_t operation)
mem_pool_op_t operation, host_t *peer)
{
host_t *addr = NULL;
enumerator_t *enumerator;
@@ -107,7 +107,7 @@ static host_t *find_addr(private_stroke_attribute_t *this, linked_list_t *pools,
pool = find_pool(this, name);
if (pool)
{
addr = pool->acquire_address(pool, id, requested, operation);
addr = pool->acquire_address(pool, id, requested, operation, peer);
if (addr)
{
break;
@@ -124,19 +124,20 @@ METHOD(attribute_provider_t, acquire_address, host_t*,
host_t *requested)
{
identification_t *id;
host_t *addr;
host_t *addr, *peer;
id = ike_sa->get_other_eap_id(ike_sa);
peer = ike_sa->get_other_host(ike_sa);
this->lock->read_lock(this->lock);
addr = find_addr(this, pools, id, requested, MEM_POOL_EXISTING);
addr = find_addr(this, pools, id, requested, MEM_POOL_EXISTING, peer);
if (!addr)
{
addr = find_addr(this, pools, id, requested, MEM_POOL_NEW);
addr = find_addr(this, pools, id, requested, MEM_POOL_NEW, peer);
if (!addr)
{
addr = find_addr(this, pools, id, requested, MEM_POOL_REASSIGN);
addr = find_addr(this, pools, id, requested, MEM_POOL_REASSIGN, peer);
}
}
src/libcharon/plugins/vici/vici_attribute.c
+9 -6
View File
@@ -96,7 +96,8 @@ static void pool_destroy(pool_t *pool)
* Find an existing or not yet existing lease
*/
static host_t *find_addr(private_vici_attribute_t *this, linked_list_t *pools,
identification_t *id, host_t *requested, mem_pool_op_t op)
identification_t *id, host_t *requested,
mem_pool_op_t op, host_t *peer)
{
enumerator_t *enumerator;
host_t *addr = NULL;
@@ -109,7 +110,8 @@ static host_t *find_addr(private_vici_attribute_t *this, linked_list_t *pools,
pool = this->pools->get(this->pools, name);
if (pool)
{
addr = pool->vips->acquire_address(pool->vips, id, requested, op);
addr = pool->vips->acquire_address(pool->vips, id, requested,
op, peer);
if (addr)
{
break;
@@ -126,19 +128,20 @@ METHOD(attribute_provider_t, acquire_address, host_t*,
host_t *requested)
{
identification_t *id;
host_t *addr;
host_t *addr, *peer;
id = ike_sa->get_other_eap_id(ike_sa);
peer = ike_sa->get_other_host(ike_sa);
this->lock->read_lock(this->lock);
addr = find_addr(this, pools, id, requested, MEM_POOL_EXISTING);
addr = find_addr(this, pools, id, requested, MEM_POOL_EXISTING, peer);
if (!addr)
{
addr = find_addr(this, pools, id, requested, MEM_POOL_NEW);
addr = find_addr(this, pools, id, requested, MEM_POOL_NEW, peer);
if (!addr)
{
addr = find_addr(this, pools, id, requested, MEM_POOL_REASSIGN);
addr = find_addr(this, pools, id, requested, MEM_POOL_REASSIGN, peer);
}
}