denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add an option to en-/disable IKE fragmentation

Browse Source 
Fragments are always accepted but will not be sent if disabled.  The
vendor ID is only sent if the option is enabled.
This commit is contained in:
Tobias Brunner
2012-12-24 12:29:31 +01:00
parent 5cafefcd5d
commit 2f62bb1549
3 changed files with 25 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/ikev1/task_manager_v1.c
+8 -1
View File
@@ -225,6 +225,11 @@ struct private_task_manager_t {
} frag;
/**
* TRUE if fragmentation (as sender) is enabled in config
*/
bool fragmentation;
/**
* List of queued tasks not yet in action
*/
@@ -411,7 +416,7 @@ static bool send_packet(private_task_manager_t *this, bool request,
data = packet->get_data(packet);
if (this->ike_sa->supports_extension(this->ike_sa, EXT_IKE_FRAGMENTATION) &&
data.len > MAX_FRAGMENT_SIZE)
this->fragmentation && data.len > MAX_FRAGMENT_SIZE)
{
fragment_payload_t *fragment;
u_int8_t num, count;
@@ -1996,6 +2001,8 @@ task_manager_v1_t *task_manager_v1_create(ike_sa_t *ike_sa)
"%s.retransmit_timeout", RETRANSMIT_TIMEOUT, charon->name),
.retransmit_base = lib->settings->get_double(lib->settings,
"%s.retransmit_base", RETRANSMIT_BASE, charon->name),
.fragmentation = lib->settings->get_bool(lib->settings,
"%s.ike_fragmentation", FALSE, charon->name),
);
if (!this->rng)
src/libcharon/sa/ikev1/tasks/isakmp_vendor.c
+12 -4
View File
@@ -155,18 +155,26 @@ METHOD(task_t, build, status_t,
private_isakmp_vendor_t *this, message_t *message)
{
vendor_id_payload_t *vid_payload;
bool strongswan, cisco_unity;
bool strongswan, cisco_unity, fragmentation;
int i;
strongswan = lib->settings->get_bool(lib->settings,
"%s.send_vendor_id", FALSE, charon->name);
"%s.send_vendor_id", FALSE, charon->name);
cisco_unity = lib->settings->get_bool(lib->settings,
"%s.cisco_unity", FALSE, charon->name);
"%s.cisco_unity", FALSE, charon->name);
fragmentation = lib->settings->get_bool(lib->settings,
"%s.ike_fragmentation", FALSE, charon->name);
if (!this->initiator && fragmentation)
{
fragmentation = this->ike_sa->supports_extension(this->ike_sa,
EXT_IKE_FRAGMENTATION);
}
for (i = 0; i < countof(vendor_ids); i++)
{
if (vendor_ids[i].send ||
(vendor_ids[i].extension == EXT_STRONGSWAN && strongswan) ||
(vendor_ids[i].extension == EXT_CISCO_UNITY && cisco_unity))
(vendor_ids[i].extension == EXT_CISCO_UNITY && cisco_unity) ||
(vendor_ids[i].extension == EXT_IKE_FRAGMENTATION && fragmentation))
{
DBG2(DBG_IKE, "sending %s vendor ID", vendor_ids[i].desc);
vid_payload = vendor_id_payload_create_data(VENDOR_ID_V1,