denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ike-sa: Add flags to force updating hosts/CHILD_SAs

Browse Source 
This allows more fine grained control over what's updated and does not
require multiple calls of the method. Plus we'll be able to use it in
the ike-mobike task.
This commit is contained in:
Tobias Brunner
2021-01-18 11:34:40 +01:00
parent 08a3ee0cce
commit 51c7cf9a04
7 changed files with 47 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/ikev2/task_manager_v2.c
+9 -7
View File
@@ -1649,8 +1649,10 @@ METHOD(task_manager_t, process_message, status_t,
return FAILED;
}
if (!this->ike_sa->supports_extension(this->ike_sa, EXT_MOBIKE))
{ /* with MOBIKE, we do no implicit updates */
this->ike_sa->update_hosts(this->ike_sa, me, other, mid == 1);
{ /* only do implicit updates without MOBIKE, and only force
* updates for IKE_AUTH (ports might change due to NAT-T) */
this->ike_sa->update_hosts(this->ike_sa, me, other,
mid == 1 ? UPDATE_HOSTS_FORCE_ADDRS : 0);
}
status = handle_fragment(this, &this->responding.defrag, msg);
if (status != SUCCESS)
@@ -1718,11 +1720,11 @@ METHOD(task_manager_t, process_message, status_t,
msg->get_exchange_type(msg) != IKE_SA_INIT)
{ /* only do updates based on verified messages (or initial ones) */
if (!this->ike_sa->supports_extension(this->ike_sa, EXT_MOBIKE))
{ /* with MOBIKE, we do no implicit updates. we force an
* update of the local address on IKE_SA_INIT, but never
* for the remote address */
this->ike_sa->update_hosts(this->ike_sa, me, NULL, mid == 0);
this->ike_sa->update_hosts(this->ike_sa, NULL, other, FALSE);
{ /* only do implicit updates without MOBIKE, we force an
* update of the local address on IKE_SA_INIT as we might
* not know it yet, but never for the remote address */
this->ike_sa->update_hosts(this->ike_sa, me, other,
mid == 0 ? UPDATE_HOSTS_FORCE_LOCAL : 0);
}
}
status = handle_fragment(this, &this->initiating.defrag, msg);