denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add an ikesa_limit option to limit number of IKE_SAs as responder

Browse Source
This commit is contained in:
Martin Willi
2012-11-16 10:27:36 +01:00
parent 5b89e3b061
commit 2354b10576
1 changed files with 39 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/ike_sa_manager.c
+25 -5
View File
@@ -397,6 +397,11 @@ struct private_ike_sa_manager_t {
* reuse existing IKE_SAs in checkout_by_config * reuse existing IKE_SAs in checkout_by_config
*/ */
bool reuse_ikesa; bool reuse_ikesa;
/**
* Configured IKE_SA limit, if any
*/
u_int ikesa_limit;
}; };
/** /**
@@ -1203,13 +1208,16 @@ METHOD(ike_sa_manager_t, checkout_by_message, ike_sa_t*,
{ {
case NOT_FOUND: case NOT_FOUND:
{ /* we've not seen this packet yet, create a new IKE_SA */ { /* we've not seen this packet yet, create a new IKE_SA */
if (!this->ikesa_limit ||
this->public.get_count(&this->public) < this->ikesa_limit)
{
id->set_responder_spi(id, our_spi); id->set_responder_spi(id, our_spi);
ike_sa = ike_sa_create(id, FALSE, ike_version); ike_sa = ike_sa_create(id, FALSE, ike_version);
if (ike_sa) if (ike_sa)
{ {
entry = entry_create(); entry = entry_create();
entry->ike_sa = ike_sa; entry->ike_sa = ike_sa;
entry->ike_sa_id = id->clone(id); entry->ike_sa_id = id;
segment = put_entry(this, entry); segment = put_entry(this, entry);
entry->checked_out = TRUE; entry->checked_out = TRUE;
@@ -1221,16 +1229,25 @@ METHOD(ike_sa_manager_t, checkout_by_message, ike_sa_t*,
DBG2(DBG_MGR, "created IKE_SA %s[%u]", DBG2(DBG_MGR, "created IKE_SA %s[%u]",
ike_sa->get_name(ike_sa), ike_sa->get_name(ike_sa),
ike_sa->get_unique_id(ike_sa)); ike_sa->get_unique_id(ike_sa));
charon->bus->set_sa(charon->bus, ike_sa);
return ike_sa;
} }
else else
{ {
DBG1(DBG_MGR, "creating IKE_SA failed, ignoring message");
}
}
else
{
DBG1(DBG_MGR, "ignoring %N, hitting IKE_SA limit (%u)",
exchange_type_names, message->get_exchange_type(message),
this->ikesa_limit);
}
remove_init_hash(this, hash); remove_init_hash(this, hash);
chunk_free(&hash); chunk_free(&hash);
DBG1(DBG_MGR, "ignoring message, no such IKE_SA");
}
id->destroy(id); id->destroy(id);
charon->bus->set_sa(charon->bus, ike_sa); return NULL;
return ike_sa;
} }
case FAILED: case FAILED:
{ /* we failed to allocate an SPI */ { /* we failed to allocate an SPI */
@@ -2049,6 +2066,9 @@ ike_sa_manager_t *ike_sa_manager_create()
return NULL; return NULL;
} }
this->ikesa_limit = lib->settings->get_int(lib->settings,
"%s.ikesa_limit", 0, charon->name);
this->table_size = get_nearest_powerof2(lib->settings->get_int( this->table_size = get_nearest_powerof2(lib->settings->get_int(
lib->settings, "%s.ikesa_table_size", lib->settings, "%s.ikesa_table_size",
DEFAULT_HASHTABLE_SIZE, charon->name)); DEFAULT_HASHTABLE_SIZE, charon->name));