denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Port floating patch partially reversed.

Browse Source 
If MOBIKE is enabled, we do have to switch to port 4500 with the
IKE_AUTH request, that is, before we know whether the other peer
actually supports MOBIKE or not.
This commit is contained in:
Tobias Brunner
2010-08-30 14:54:31 +02:00
parent 277f02ce9e
commit 2402dee177
2 changed files with 8 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/tasks/ike_mobike.c
-11
View File
@@ -468,18 +468,7 @@ static status_t process_i(private_ike_mobike_t *this, message_t *message)
if (message->get_exchange_type(message) == IKE_AUTH && if (message->get_exchange_type(message) == IKE_AUTH &&
this->ike_sa->get_state(this->ike_sa) == IKE_ESTABLISHED) this->ike_sa->get_state(this->ike_sa) == IKE_ESTABLISHED)
{ {
peer_cfg_t *peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
process_payloads(this, message); process_payloads(this, message);
/* if peer supports NAT-T and MOBIKE, we switch to port 4500 even
* if no NAT is detected. MOBIKE requires this. */
if (peer_cfg->use_mobike(peer_cfg) &&
this->ike_sa->supports_extension(this->ike_sa, EXT_NATT) &&
this->ike_sa->supports_extension(this->ike_sa, EXT_MOBIKE))
{
this->ike_sa->float_ports(this->ike_sa);
}
return SUCCESS; return SUCCESS;
} }
else if (message->get_exchange_type(message) == INFORMATIONAL) else if (message->get_exchange_type(message) == INFORMATIONAL)
src/libcharon/sa/tasks/ike_natd.c
+8 -1
View File
@@ -264,7 +264,14 @@ static status_t process_i(private_ike_natd_t *this, message_t *message)
if (message->get_exchange_type(message) == IKE_SA_INIT) if (message->get_exchange_type(message) == IKE_SA_INIT)
{ {
if (this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY)) peer_cfg_t *peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
if (this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY) ||
/* if peer supports NAT-T, we switch to port 4500 even
* if no NAT is detected. can't be done later (when we would know
* whether the peer supports MOBIKE) because there would be no
* exchange to actually do the switch (other than a forced DPD). */
(peer_cfg->use_mobike(peer_cfg) &&
this->ike_sa->supports_extension(this->ike_sa, EXT_NATT)))
{ {
this->ike_sa->float_ports(this->ike_sa); this->ike_sa->float_ports(this->ike_sa);
} }