denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Slightly refactored port floating.

Browse Source 
In case of MOBIKE, only float to port 4500 if the other peer actually supports MOBIKE.
This commit is contained in:
Tobias Brunner
2010-08-30 13:42:58 +02:00
parent be63a48c36
commit 277f02ce9e
5 changed files with 39 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/tasks/ike_me.c
+3
View File
@@ -454,6 +454,9 @@ static status_t process_i(private_ike_me_t *this, message_t *message)
DBG1(DBG_IKE, "server did not return a ME_MEDIATION, aborting");
return FAILED;
}
/* if we are on a mediation connection we switch to port 4500 even
* if no NAT is detected. */
this->ike_sa->float_ports(this->ike_sa);
return NEED_MORE;
}
case IKE_AUTH:
src/libcharon/sa/tasks/ike_mobike.c
+11
View File
@@ -468,7 +468,18 @@ static status_t process_i(private_ike_mobike_t *this, message_t *message)
if (message->get_exchange_type(message) == IKE_AUTH &&
this->ike_sa->get_state(this->ike_sa) == IKE_ESTABLISHED)
{
peer_cfg_t *peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
process_payloads(this, message);
/* if peer supports NAT-T and MOBIKE, we switch to port 4500 even
* if no NAT is detected. MOBIKE requires this. */
if (peer_cfg->use_mobike(peer_cfg) &&
this->ike_sa->supports_extension(this->ike_sa, EXT_NATT) &&
this->ike_sa->supports_extension(this->ike_sa, EXT_MOBIKE))
{
this->ike_sa->float_ports(this->ike_sa);
}
return SUCCESS;
}
else if (message->get_exchange_type(message) == INFORMATIONAL)
src/libcharon/sa/tasks/ike_natd.c
+2 -35
View File
@@ -264,42 +264,9 @@ static status_t process_i(private_ike_natd_t *this, message_t *message)
if (message->get_exchange_type(message) == IKE_SA_INIT)
{
peer_cfg_t *peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
#ifdef ME
/* if we are on a mediated connection we have already switched to
* port 4500 and the correct destination port is already configured,
* therefore we must not switch again */
if (peer_cfg->get_mediated_by(peer_cfg))
if (this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY))
{
return SUCCESS;
}
#endif /* ME */
if (this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY) ||
#ifdef ME
/* if we are on a mediation connection we switch to port 4500 even
* if no NAT is detected. */
peer_cfg->is_mediation(peer_cfg) ||
#endif /* ME */
/* if peer supports NAT-T, we switch to port 4500 even
* if no NAT is detected. MOBIKE requires this. */
(peer_cfg->use_mobike(peer_cfg) &&
this->ike_sa->supports_extension(this->ike_sa, EXT_NATT)))
{
host_t *me, *other;
/* do not switch if we have a custom port from mobike/NAT */
me = this->ike_sa->get_my_host(this->ike_sa);
if (me->get_port(me) == IKEV2_UDP_PORT)
{
me->set_port(me, IKEV2_NATT_PORT);
}
other = this->ike_sa->get_other_host(this->ike_sa);
if (other->get_port(other) == IKEV2_UDP_PORT)
{
other->set_port(other, IKEV2_NATT_PORT);
}
this->ike_sa->float_ports(this->ike_sa);
}
}