denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add an ikesa_limit option to limit number of IKE_SAs as responder

Browse Source
This commit is contained in:
Martin Willi
2012-11-16 10:27:36 +01:00
parent 5b89e3b061
commit 2354b10576
1 changed files with 39 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/ike_sa_manager.c
+39 -19
View File
@@ -397,6 +397,11 @@ struct private_ike_sa_manager_t {
* reuse existing IKE_SAs in checkout_by_config * reuse existing IKE_SAs in checkout_by_config
*/ */
bool reuse_ikesa; bool reuse_ikesa;
/**
* Configured IKE_SA limit, if any
*/
u_int ikesa_limit;
}; };
/** /**
@@ -1203,34 +1208,46 @@ METHOD(ike_sa_manager_t, checkout_by_message, ike_sa_t*,
{ {
case NOT_FOUND: case NOT_FOUND:
{ /* we've not seen this packet yet, create a new IKE_SA */ { /* we've not seen this packet yet, create a new IKE_SA */
id->set_responder_spi(id, our_spi); if (!this->ikesa_limit ||
ike_sa = ike_sa_create(id, FALSE, ike_version); this->public.get_count(&this->public) < this->ikesa_limit)
if (ike_sa)
{ {
entry = entry_create(); id->set_responder_spi(id, our_spi);
entry->ike_sa = ike_sa; ike_sa = ike_sa_create(id, FALSE, ike_version);
entry->ike_sa_id = id->clone(id); if (ike_sa)
{
entry = entry_create();
entry->ike_sa = ike_sa;
entry->ike_sa_id = id;
segment = put_entry(this, entry); segment = put_entry(this, entry);
entry->checked_out = TRUE; entry->checked_out = TRUE;
unlock_single_segment(this, segment); unlock_single_segment(this, segment);
entry->message_id = message->get_message_id(message); entry->message_id = message->get_message_id(message);
entry->init_hash = hash; entry->init_hash = hash;
DBG2(DBG_MGR, "created IKE_SA %s[%u]", DBG2(DBG_MGR, "created IKE_SA %s[%u]",
ike_sa->get_name(ike_sa), ike_sa->get_name(ike_sa),
ike_sa->get_unique_id(ike_sa)); ike_sa->get_unique_id(ike_sa));
charon->bus->set_sa(charon->bus, ike_sa);
return ike_sa;
}
else
{
DBG1(DBG_MGR, "creating IKE_SA failed, ignoring message");
}
} }
else else
{ {
remove_init_hash(this, hash); DBG1(DBG_MGR, "ignoring %N, hitting IKE_SA limit (%u)",
chunk_free(&hash); exchange_type_names, message->get_exchange_type(message),
DBG1(DBG_MGR, "ignoring message, no such IKE_SA"); this->ikesa_limit);
} }
remove_init_hash(this, hash);
chunk_free(&hash);
id->destroy(id); id->destroy(id);
charon->bus->set_sa(charon->bus, ike_sa); return NULL;
return ike_sa;
} }
case FAILED: case FAILED:
{ /* we failed to allocate an SPI */ { /* we failed to allocate an SPI */
@@ -2049,6 +2066,9 @@ ike_sa_manager_t *ike_sa_manager_create()
return NULL; return NULL;
} }
this->ikesa_limit = lib->settings->get_int(lib->settings,
"%s.ikesa_limit", 0, charon->name);
this->table_size = get_nearest_powerof2(lib->settings->get_int( this->table_size = get_nearest_powerof2(lib->settings->get_int(
lib->settings, "%s.ikesa_table_size", lib->settings, "%s.ikesa_table_size",
DEFAULT_HASHTABLE_SIZE, charon->name)); DEFAULT_HASHTABLE_SIZE, charon->name));