ike: support multiple addresses, ranges and subnets in IKE address config

Replace the allowany semantic by a more powerful subnet and IP range matching.
Multiple addresses, DNS names, subnets and ranges can be specified in a comma
separated list. Initiators ignore the ranges/subnets, responders match
configurations against all addresses, ranges and subnets.
This commit is contained in:
Martin Willi
2013-09-04 10:38:37 +02:00
parent beffdc6ab8
commit 3070697f9f
16 changed files with 311 additions and 115 deletions
+2 -4
View File
@@ -258,11 +258,9 @@ static ike_cfg_t *build_ike_cfg(private_sql_config_t *this, enumerator_t *e,
{
ike_cfg_t *ike_cfg;
ike_cfg = ike_cfg_create(IKEV2, certreq, force_encap,
local, FALSE,
ike_cfg = ike_cfg_create(IKEV2, certreq, force_encap, local,
charon->socket->get_port(charon->socket, FALSE),
remote, FALSE, IKEV2_UDP_PORT,
FRAGMENTATION_NO, 0);
remote, IKEV2_UDP_PORT, FRAGMENTATION_NO, 0);
add_ike_proposals(this, ike_cfg, id);
return ike_cfg;
}