denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fixed responder initiated CHILD_SA rekeying when using virtual IPs

Browse Source
This commit is contained in:
Martin Willi
2007-07-04 06:27:33 +00:00
parent eea626ed25
commit 419201c15d
1 changed files with 45 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/charon/sa/tasks/child_create.c
+45 -11
View File
@@ -493,6 +493,7 @@ static void process_payloads(private_child_create_t *this, message_t *message)
static status_t build_i(private_child_create_t *this, message_t *message) static status_t build_i(private_child_create_t *this, message_t *message)
{ {
host_t *me, *other, *vip; host_t *me, *other, *vip;
bool propose_all = FALSE;
peer_cfg_t *peer_cfg; peer_cfg_t *peer_cfg;
switch (message->get_exchange_type(message)) switch (message->get_exchange_type(message))
@@ -523,30 +524,51 @@ static status_t build_i(private_child_create_t *this, message_t *message)
SIG(CHILD_UP_START, "establishing CHILD_SA"); SIG(CHILD_UP_START, "establishing CHILD_SA");
me = this->ike_sa->get_my_host(this->ike_sa); /* reuse virtual IP if we already have one */
other = this->ike_sa->get_other_host(this->ike_sa); me = this->ike_sa->get_virtual_ip(this->ike_sa, TRUE);
peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa); if (me == NULL)
vip = peer_cfg->get_my_virtual_ip(peer_cfg); {
me = this->ike_sa->get_my_host(this->ike_sa);
}
other = this->ike_sa->get_virtual_ip(this->ike_sa, FALSE);
if (other == NULL)
{
other = this->ike_sa->get_other_host(this->ike_sa);
}
if (vip) /* check if we want a virtual IP, but don't have one */
if (!this->reqid)
{
peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
vip = peer_cfg->get_my_virtual_ip(peer_cfg);
if (vip)
{
propose_all = TRUE;
vip->destroy(vip);
}
}
if (propose_all)
{ /* propose a 0.0.0.0/0 subnet when we use virtual ip */ { /* propose a 0.0.0.0/0 subnet when we use virtual ip */
this->tsi = this->config->get_traffic_selectors(this->config, TRUE, this->tsi = this->config->get_traffic_selectors(this->config, TRUE,
NULL, NULL); NULL, NULL);
vip->destroy(vip);
} }
else else
{ /* but shorten a 0.0.0.0/0 subnet to the actual address if host2host */ { /* but shorten a 0.0.0.0/0 subnet for host2host/we already have a vip */
this->tsi = this->config->get_traffic_selectors(this->config, TRUE, this->tsi = this->config->get_traffic_selectors(this->config, TRUE,
NULL, me); NULL, me);
} }
this->tsr = this->config->get_traffic_selectors(this->config, FALSE, this->tsr = this->config->get_traffic_selectors(this->config, FALSE,
NULL, other); NULL, other);
this->proposals = this->config->get_proposals(this->config, this->proposals = this->config->get_proposals(this->config,
this->dh_group == MODP_NONE); this->dh_group == MODP_NONE);
this->mode = this->config->get_mode(this->config); this->mode = this->config->get_mode(this->config);
this->child_sa = child_sa_create( this->child_sa = child_sa_create(
me, other, this->ike_sa->get_my_id(this->ike_sa), this->ike_sa->get_my_host(this->ike_sa),
this->ike_sa->get_other_host(this->ike_sa),
this->ike_sa->get_my_id(this->ike_sa),
this->ike_sa->get_other_id(this->ike_sa), this->config, this->reqid, this->ike_sa->get_other_id(this->ike_sa), this->config, this->reqid,
this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY)); this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY));
@@ -608,9 +630,21 @@ static status_t process_r(private_child_create_t *this, message_t *message)
peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa); peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
if (peer_cfg) if (peer_cfg)
{ {
this->config = peer_cfg->select_child_cfg(peer_cfg, this->tsr, this->tsi, host_t *me, *other;
this->ike_sa->get_my_host(this->ike_sa),
this->ike_sa->get_other_host(this->ike_sa)); me = this->ike_sa->get_virtual_ip(this->ike_sa, TRUE);
if (me == NULL)
{
me = this->ike_sa->get_my_host(this->ike_sa);
}
other = this->ike_sa->get_virtual_ip(this->ike_sa, FALSE);
if (other == NULL)
{
other = this->ike_sa->get_other_host(this->ike_sa);
}
this->config = peer_cfg->select_child_cfg(peer_cfg, this->tsr,
this->tsi, me, other);
} }
return NEED_MORE; return NEED_MORE;
} }