denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

implement proper handling of most simultaneous IKE_SA rekeying cases

Browse Source
This commit is contained in:
Martin Willi
2006-08-23 07:30:43 +00:00
parent c3f97102f1
commit 3183006de2
8 changed files with 288 additions and 57 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/charon/sa/ike_sa.h
+56 -22
View File
@@ -51,30 +51,32 @@ typedef enum ike_sa_state_t ike_sa_state_t;
* SA is in the state CREATED.
* @verbatim
+----------------+
¦ SA_CREATED ¦
¦ SA_CREATED ¦
+----------------+
¦
on initiate()---> ¦ <----- on IKE_SA_INIT received
¦
¦
on initiate()---> ¦ <----- on IKE_SA_INIT received
V
+----------------+
¦ SA_CONNECTING ¦
¦ SA_CONNECTING ¦
+----------------+
¦
¦ <----- on IKE_AUTH successfully completed
¦
¦
¦ <----- on IKE_AUTH successfully completed
V
+----------------+
¦ SA_ESTABLISHED ¦
¦ SA_ESTABLISHED ¦-------------------------+ <-- on rekeying
+----------------+ ¦
¦ V
on delete()---> ¦ <----- on IKE_SA +-------------+
¦ delete request ¦ SA_REKEYING ¦
¦ received +-------------+
V ¦
+----------------+ ¦
¦ SA_DELETING ¦<------------------------+ <-- after rekeying
+----------------+
¦
on delete()---> ¦ <----- on IKE_SA delete request received
¦
+----------------+
¦ SA_DELETING ¦
+----------------+
¦
¦ <----- after delete() acknowledged
¦
\¦/
¦
¦ <----- after delete() acknowledged
¦
\V/
X
/ \
@endverbatim
@@ -98,6 +100,11 @@ enum ike_sa_state_t {
*/
IKE_ESTABLISHED,
/**
* IKE_SA rekeying in progress
*/
IKE_REKEYING,
/**
* IKE_SA is in progress of deletion
*/
@@ -279,7 +286,7 @@ struct ike_sa_t {
* @brief Acquire connection setup for a policy.
*
* If an installed policy raises an acquire, the kernel calls
* this function to establsh the CHILD_SA (and maybe the IKE_SA).
* this function to establish the CHILD_SA (and maybe the IKE_SA).
*
* @param this calling object
* @param reqid reqid of the CHILD_SA the policy belongs to.
@@ -418,12 +425,13 @@ struct ike_sa_t {
* @param nonce_i initiators nonce
* @param nonce_r responders nonce
* @param initiator TRUE if initiator, FALSE otherwise
* @param rekey_prf PRF with SK_d key when rekeying, NULL otherwise
* @param child_prf PRF with SK_d key when rekeying, NULL otherwise
* @param old_prf general purpose PRF of old SA when rekeying
*/
status_t (*derive_keys)(ike_sa_t *this, proposal_t* proposal,
diffie_hellman_t *dh,
chunk_t nonce_i, chunk_t nonce_r,
bool initiator, prf_t *rekey_prf);
bool initiator, prf_t *child_prf, prf_t *old_prf);
/**
* @brief Get the multi purpose prf.
@@ -486,6 +494,14 @@ struct ike_sa_t {
child_sa_t* (*get_child_sa) (ike_sa_t *this, protocol_id_t protocol,
u_int32_t spi, bool inbound);
/**
* @brief Create an iterator over all CHILD_SAs.
*
* @param this calling object
* @return iterator
*/
iterator_t* (*create_child_sa_iterator) (ike_sa_t *this);
/**
* @brief Rekey the CHILD SA with the specified reqid.
*
@@ -555,6 +571,24 @@ struct ike_sa_t {
*/
status_t (*rekey) (ike_sa_t *this);
/**
* @brief Get the transaction which rekeys this IKE_SA.
*
* @todo Fix include for rekey_ike_sa.h
*
* @param this calling object
* @return rekey_ike_sa_t transaction or NULL
*/
void* (*get_rekeying_transaction) (ike_sa_t *this);
/**
* @brief Set the transaction which rekeys this IKE_SA.
*
* @param this calling object
* @param rekey rekey_ike_sa_t transaction or NULL
*/
void (*set_rekeying_transaction) (ike_sa_t *this, void *rekey);
/**
* @brief Move all children from other IKE_SA to this IKE_SA.
*