denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

DNS resolving of ike_cfg hosts dynamically on demand

Browse Source
This commit is contained in:
Martin Willi
2008-06-06 15:05:54 +00:00
parent 1e9c46f13d
commit 5a22a02156
14 changed files with 238 additions and 191 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/charon/sa/ike_sa.c
+26 -14
View File
@@ -410,18 +410,6 @@ static void set_peer_cfg(private_ike_sa_t *this, peer_cfg_t *peer_cfg)
this->ike_cfg = peer_cfg->get_ike_cfg(peer_cfg);
this->ike_cfg->get_ref(this->ike_cfg);
}
/* apply values, so we are ready to initate/acquire */
if (this->my_host->is_anyaddr(this->my_host))
{
host_t *me = this->ike_cfg->get_my_host(this->ike_cfg);
set_my_host(this, me->clone(me));
}
if (this->other_host->is_anyaddr(this->other_host))
{
host_t *other = this->ike_cfg->get_other_host(this->ike_cfg);
set_other_host(this, other->clone(other));
}
/* apply IDs if they are not already set */
if (this->my_id->contains_wildcards(this->my_id))
{
@@ -1041,6 +1029,28 @@ static status_t initiate_mediated(private_ike_sa_t *this, host_t *me, host_t *ot
}
#endif /* ME */
/**
* Resolve DNS host in configuration
*/
static void resolve_hosts(private_ike_sa_t *this)
{
host_t *host;
host = host_create_from_dns(this->ike_cfg->get_my_addr(this->ike_cfg), 0,
IKEV2_UDP_PORT);
if (host)
{
set_my_host(this, host);
}
host = host_create_from_dns(this->ike_cfg->get_other_addr(this->ike_cfg),
this->my_host->get_family(this->my_host),
IKEV2_UDP_PORT);
if (host)
{
set_other_host(this, host);
}
}
/**
* Initiates a CHILD_SA using the appropriate reqid
*/
@@ -1050,6 +1060,8 @@ static status_t initiate_with_reqid(private_ike_sa_t *this, child_cfg_t *child_c
if (this->state == IKE_CREATED)
{
resolve_hosts(this);
if (this->other_host->is_anyaddr(this->other_host)
#ifdef ME
&& !this->peer_cfg->get_mediated_by(this->peer_cfg)
@@ -2516,8 +2528,8 @@ ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id)
/* initialize private fields */
this->ike_sa_id = ike_sa_id->clone(ike_sa_id);
this->child_sas = linked_list_create();
this->my_host = host_create_any(AF_INET);
this->other_host = host_create_any(AF_INET);
this->my_host = host_create_from_string("0.0.0.0", IKEV2_UDP_PORT);
this->other_host = host_create_from_string("0.0.0.0", IKEV2_UDP_PORT);
this->my_id = identification_create_from_encoding(ID_ANY, chunk_empty);
this->other_id = identification_create_from_encoding(ID_ANY, chunk_empty);
this->extensions = 0;
src/charon/sa/ike_sa_manager.c
+52 -46
View File
@@ -497,64 +497,70 @@ static ike_sa_t* checkout_by_config(private_ike_sa_manager_t *this,
ike_cfg_t *ike_cfg;
ike_cfg = peer_cfg->get_ike_cfg(peer_cfg);
my_host = ike_cfg->get_my_host(ike_cfg);
other_host = ike_cfg->get_other_host(ike_cfg);
my_id = peer_cfg->get_my_id(peer_cfg);
other_id = peer_cfg->get_other_id(peer_cfg);
my_host = host_create_from_dns(ike_cfg->get_my_addr(ike_cfg), 0, 0);
other_host = host_create_from_dns(ike_cfg->get_other_addr(ike_cfg), 0, 0);
pthread_mutex_lock(&(this->mutex));
enumerator = this->ike_sa_list->create_enumerator(this->ike_sa_list);
while (enumerator->enumerate(enumerator, &entry))
if (my_host && other_host)
{
identification_t *found_my_id, *found_other_id;
host_t *found_my_host, *found_other_host;
if (!wait_for_entry(this, entry))
enumerator = this->ike_sa_list->create_enumerator(this->ike_sa_list);
while (enumerator->enumerate(enumerator, &entry))
{
continue;
}
identification_t *found_my_id, *found_other_id;
host_t *found_my_host, *found_other_host;
if (entry->ike_sa->get_state(entry->ike_sa) == IKE_DELETING)
{
/* skip IKE_SA which are not useable */
continue;
}
if (!wait_for_entry(this, entry))
{
continue;
}
found_my_id = entry->ike_sa->get_my_id(entry->ike_sa);
found_other_id = entry->ike_sa->get_other_id(entry->ike_sa);
found_my_host = entry->ike_sa->get_my_host(entry->ike_sa);
found_other_host = entry->ike_sa->get_other_host(entry->ike_sa);
if (entry->ike_sa->get_state(entry->ike_sa) == IKE_DELETING)
{
/* skip IKE_SA which are not useable */
continue;
}
if (found_my_id->get_type(found_my_id) == ID_ANY &&
found_other_id->get_type(found_other_id) == ID_ANY)
{
/* IKE_SA has no IDs yet, so we can't use it */
continue;
}
DBG2(DBG_MGR, "candidate IKE_SA for \n\t%H[%D]...%H[%D]\n\t%H[%D]...%H[%D]",
my_host, my_id, other_host, other_id,
found_my_host, found_my_id, found_other_host, found_other_id);
/* compare ID and hosts. Supplied ID may contain wildcards, and IP
* may be %any. */
if ((my_host->is_anyaddr(my_host) ||
my_host->ip_equals(my_host, found_my_host)) &&
(other_host->is_anyaddr(other_host) ||
other_host->ip_equals(other_host, found_other_host)) &&
found_my_id->matches(found_my_id, my_id) &&
found_other_id->matches(found_other_id, other_id) &&
streq(peer_cfg->get_name(peer_cfg),
entry->ike_sa->get_name(entry->ike_sa)))
{
/* looks good, we take this one */
DBG2(DBG_MGR, "found an existing IKE_SA for %H[%D]...%H[%D]",
my_host, my_id, other_host, other_id);
entry->checked_out = TRUE;
ike_sa = entry->ike_sa;
break;
found_my_id = entry->ike_sa->get_my_id(entry->ike_sa);
found_other_id = entry->ike_sa->get_other_id(entry->ike_sa);
found_my_host = entry->ike_sa->get_my_host(entry->ike_sa);
found_other_host = entry->ike_sa->get_other_host(entry->ike_sa);
if (found_my_id->get_type(found_my_id) == ID_ANY &&
found_other_id->get_type(found_other_id) == ID_ANY)
{
/* IKE_SA has no IDs yet, so we can't use it */
continue;
}
DBG2(DBG_MGR, "candidate IKE_SA for \n\t"
"%H[%D]...%H[%D]\n\t%H[%D]...%H[%D]",
my_host, my_id, other_host, other_id,
found_my_host, found_my_id, found_other_host, found_other_id);
/* compare ID and hosts. Supplied ID may contain wildcards, and IP
* may be %any. */
if ((my_host->is_anyaddr(my_host) ||
my_host->ip_equals(my_host, found_my_host)) &&
(other_host->is_anyaddr(other_host) ||
other_host->ip_equals(other_host, found_other_host)) &&
found_my_id->matches(found_my_id, my_id) &&
found_other_id->matches(found_other_id, other_id) &&
streq(peer_cfg->get_name(peer_cfg),
entry->ike_sa->get_name(entry->ike_sa)))
{
/* looks good, we take this one */
DBG2(DBG_MGR, "found an existing IKE_SA for %H[%D]...%H[%D]",
my_host, my_id, other_host, other_id);
entry->checked_out = TRUE;
ike_sa = entry->ike_sa;
break;
}
}
enumerator->destroy(enumerator);
}
enumerator->destroy(enumerator);
DESTROY_IF(my_host);
DESTROY_IF(other_host);
if (!ike_sa)
{
src/charon/sa/tasks/ike_init.c
+1 -1
View File
@@ -223,7 +223,7 @@ static status_t build_i(private_ike_init_t *this, message_t *message)
this->config = this->ike_sa->get_ike_cfg(this->ike_sa);
SIG(IKE_UP_START, "initiating IKE_SA '%s' to %H",
this->ike_sa->get_name(this->ike_sa),
this->config->get_other_host(this->config));
this->ike_sa->get_other_host(this->ike_sa));
this->ike_sa->set_state(this->ike_sa, IKE_CONNECTING);
if (this->retry++ >= MAX_RETRIES)