denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

split connections with different virtual IPs in different peer_cfgs

Browse Source 
respect different peer_cfg's when initiating a CHILD_SA within an existing IKE_SA
This commit is contained in:
Martin Willi
2008-02-05 12:39:30 +00:00
parent cdd33ec665
commit 5bbac9ffff
4 changed files with 49 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/charon/sa/ike_sa_manager.c
+16 -7
View File
@@ -483,16 +483,23 @@ static ike_sa_t* checkout_by_message(private_ike_sa_manager_t* this,
}
/**
* Implementation of of ike_sa_manager.checkout_by_peer.
* Implementation of of ike_sa_manager.checkout_by_config.
*/
static ike_sa_t* checkout_by_peer(private_ike_sa_manager_t *this,
host_t *my_host, host_t *other_host,
identification_t *my_id,
identification_t *other_id)
static ike_sa_t* checkout_by_config(private_ike_sa_manager_t *this,
peer_cfg_t *peer_cfg)
{
iterator_t *iterator;
entry_t *entry;
ike_sa_t *ike_sa = NULL;
identification_t *my_id, *other_id;
host_t *my_host, *other_host;
ike_cfg_t *ike_cfg;
ike_cfg = peer_cfg->get_ike_cfg(peer_cfg);
my_host = ike_cfg->get_my_host(ike_cfg);
other_host = ike_cfg->get_other_host(ike_cfg);
my_id = peer_cfg->get_my_id(peer_cfg);
other_id = peer_cfg->get_other_id(peer_cfg);
pthread_mutex_lock(&(this->mutex));
@@ -535,7 +542,9 @@ static ike_sa_t* checkout_by_peer(private_ike_sa_manager_t *this,
(other_host->is_anyaddr(other_host) ||
other_host->ip_equals(other_host, found_other_host)) &&
found_my_id->matches(found_my_id, my_id, &wc) &&
found_other_id->matches(found_other_id, other_id, &wc))
found_other_id->matches(found_other_id, other_id, &wc) &&
streq(peer_cfg->get_name(peer_cfg),
entry->ike_sa->get_name(entry->ike_sa)))
{
/* looks good, we take this one */
DBG2(DBG_MGR, "found an existing IKE_SA for %H[%D]...%H[%D]",
@@ -902,7 +911,7 @@ ike_sa_manager_t *ike_sa_manager_create()
this->public.checkout = (ike_sa_t*(*)(ike_sa_manager_t*, ike_sa_id_t*))checkout;
this->public.checkout_new = (ike_sa_t*(*)(ike_sa_manager_t*,bool))checkout_new;
this->public.checkout_by_message = (ike_sa_t*(*)(ike_sa_manager_t*,message_t*))checkout_by_message;
this->public.checkout_by_peer = (ike_sa_t*(*)(ike_sa_manager_t*,host_t*,host_t*,identification_t*,identification_t*))checkout_by_peer;
this->public.checkout_by_config = (ike_sa_t*(*)(ike_sa_manager_t*,peer_cfg_t*))checkout_by_config;
this->public.checkout_by_id = (ike_sa_t*(*)(ike_sa_manager_t*,u_int32_t,bool))checkout_by_id;
this->public.checkout_by_name = (ike_sa_t*(*)(ike_sa_manager_t*,char*,bool))checkout_by_name;
this->public.create_iterator = (iterator_t*(*)(ike_sa_manager_t*))create_iterator;
src/charon/sa/ike_sa_manager.h
+9 -12
View File
@@ -29,6 +29,7 @@ typedef struct ike_sa_manager_t ike_sa_manager_t;
#include <library.h>
#include <sa/ike_sa.h>
#include <encoding/message.h>
#include <config/peer_cfg.h>
/**
* @brief The IKE_SA-Manager is responsible for managing all initiated and responded IKE_SA's.
@@ -94,25 +95,21 @@ struct ike_sa_manager_t {
ike_sa_t* (*checkout_by_message) (ike_sa_manager_t* this, message_t *message);
/**
* @brief Checkout an existing IKE_SA by hosts and identifications.
* @brief Checkout an IKE_SA for initiation by a peer_config.
*
* Allows the lookup of an IKE_SA by user IDs and hosts. It returns the
* first found occurence, if there are multiple candidates. Supplied IDs
* may contain wildcards, hosts may be %any.
* To initiate, a CHILD_SA may be established within an existing IKE_SA.
* This call checks for an existing IKE_SA by comparing the configuration.
* If the CHILD_SA can be created in an existing IKE_SA, the matching SA
* is returned.
* If no IKE_SA is found, a new one is created. This is also the case when
* the found IKE_SA is in the DELETING state.
*
* @param this the manager object
* @param my_host address of our host
* @param other_id address of remote host
* @param my_id ID used by us
* @param other_id ID used by remote
* @param peer_cfg configuration used to find an existing IKE_SA
* @return checked out/created IKE_SA
*/
ike_sa_t* (*checkout_by_peer) (ike_sa_manager_t* this,
host_t *my_host, host_t* other_host,
identification_t *my_id,
identification_t *other_id);
ike_sa_t* (*checkout_by_config) (ike_sa_manager_t* this,
peer_cfg_t *peer_cfg);
/**
* @brief Check out an IKE_SA a unique ID.