denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ike: Only consider number of half-open SAs as responder when deciding whether COOKIEs are sent

Browse Source
This commit is contained in:
Tobias Brunner
2015-08-27 11:18:51 +02:00
parent 5de8703ee0
commit 735f929ca7
6 changed files with 45 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/ike_sa_manager.h
+5 -4
View File
@@ -216,14 +216,15 @@ struct ike_sa_manager_t {
* To prevent the server from resource exhaustion, cookies and other
* mechanisms are used. The number of half open IKE_SAs is a good
* indicator to see if a peer is flooding the server.
* If a host is supplied, only the number of half open IKE_SAs initiated
* from this IP are counted.
* Only SAs for which we are the responder are counted.
* If a host is supplied, only the number of half open IKE_SAs with this IP
* are counted.
*
* @param ip NULL for all, IP for half open IKE_SAs with IP
* @param responder_only TRUE to return only the number of responding SAs
* @return number of half open IKE_SAs
*/
u_int (*get_half_open_count) (ike_sa_manager_t *this, host_t *ip);
u_int (*get_half_open_count)(ike_sa_manager_t *this, host_t *ip,
bool responder_only);
/**
* Delete all existing IKE_SAs and destroy them immediately.