denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ikev1: Adopt virtual IPs on new IKE_SA during re-authentication

Browse Source 
Some clients like iOS/Mac OS X don't do a mode config exchange on the
new SA during re-authentication.  If we don't adopt the previous virtual
IP Quick Mode rekeying will later fail.

If a client does do Mode Config we directly reassign the VIPs we migrated
from the old SA, without querying the attributes framework.

Fixes #807, #810.
This commit is contained in:
Tobias Brunner
2015-03-19 10:32:06 +01:00
parent 5c6a62ceb6
commit 31be582399
3 changed files with 156 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/ike_sa_manager.c
+28 -3
View File
@@ -1728,20 +1728,45 @@ METHOD(ike_sa_manager_t, create_id_enumerator, enumerator_t*,
}
/**
* Move all CHILD_SAs from old to new
* Move all CHILD_SAs and virtual IPs from old to new
*/
static void adopt_children(ike_sa_t *old, ike_sa_t *new)
static void adopt_children_and_vips(ike_sa_t *old, ike_sa_t *new)
{
enumerator_t *enumerator;
child_sa_t *child_sa;
host_t *vip;
int chcount = 0, vipcount = 0;
enumerator = old->create_child_sa_enumerator(old);
while (enumerator->enumerate(enumerator, &child_sa))
{
old->remove_child_sa(old, enumerator);
new->add_child_sa(new, child_sa);
chcount++;
}
enumerator->destroy(enumerator);
enumerator = old->create_virtual_ip_enumerator(old, FALSE);
while (enumerator->enumerate(enumerator, &vip))
{
new->add_virtual_ip(new, FALSE, vip);
vipcount++;
}
enumerator->destroy(enumerator);
/* this does not release the addresses, which is good, but it does trigger
* an assign_vips(FALSE) event... */
old->clear_virtual_ips(old, FALSE);
/* ...trigger the analogous event on the new SA */
charon->bus->set_sa(charon->bus, new);
charon->bus->assign_vips(charon->bus, new, TRUE);
charon->bus->set_sa(charon->bus, old);
if (chcount || vipcount)
{
DBG1(DBG_IKE, "detected reauth of existing IKE_SA, adopting %d "
"children and %d virtual IPs", chcount, vipcount);
}
}
/**
@@ -1761,7 +1786,7 @@ static status_t enforce_replace(private_ike_sa_manager_t *this,
{
/* IKEv1 implicitly takes over children, IKEv2 recreates them
* explicitly. */
adopt_children(duplicate, new);
adopt_children_and_vips(duplicate, new);
}
/* For IKEv1 we have to delay the delete for the old IKE_SA. Some
* peers need to complete the new SA first, otherwise the quick modes