denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

added mobike=yes|no connection option

Browse Source 
yes: include mobike support notifies as initiator
  no: only enable mobike as responder when initiator supports it
  default: yes
This commit is contained in:
Martin Willi
2007-08-29 12:11:25 +00:00
parent c5dfb88ab8
commit 9164e49ac0
13 changed files with 74 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/charon/config/peer_cfg.c
+17 -2
View File
@@ -129,6 +129,11 @@ struct private_peer_cfg_t {
*/
bool use_reauth;
/**
* enable support for MOBIKE
*/
bool use_mobike;
/**
* Time before an SA gets invalid
*/
@@ -330,10 +335,18 @@ static u_int32_t get_lifetime(private_peer_cfg_t *this, bool rekey)
/**
* Implementation of peer_cfg_t.use_reauth.
*/
static bool use_reauth(private_peer_cfg_t *this, bool rekey)
static bool use_reauth(private_peer_cfg_t *this)
{
return this->use_reauth;
}
/**
* Implementation of peer_cfg_t.use_mobike.
*/
static bool use_mobike(private_peer_cfg_t *this)
{
return this->use_mobike;
}
/**
* Implements peer_cfg_t.get_dpd_delay
@@ -421,7 +434,7 @@ peer_cfg_t *peer_cfg_create(char *name, u_int ike_version, ike_cfg_t *ike_cfg,
cert_policy_t cert_policy, auth_method_t auth_method,
eap_type_t eap_type, u_int32_t keyingtries,
u_int32_t lifetime, u_int32_t rekeytime,
u_int32_t jitter, bool reauth,
u_int32_t jitter, bool reauth, bool mobike,
u_int32_t dpd_delay, dpd_action_t dpd_action,
host_t *my_virtual_ip, host_t *other_virtual_ip)
{
@@ -444,6 +457,7 @@ peer_cfg_t *peer_cfg_create(char *name, u_int ike_version, ike_cfg_t *ike_cfg,
this->public.get_keyingtries = (u_int32_t (*) (peer_cfg_t *))get_keyingtries;
this->public.get_lifetime = (u_int32_t (*) (peer_cfg_t *, bool rekey))get_lifetime;
this->public.use_reauth = (bool (*) (peer_cfg_t *))use_reauth;
this->public.use_mobike = (bool (*) (peer_cfg_t *))use_mobike;
this->public.get_dpd_delay = (u_int32_t (*) (peer_cfg_t *))get_dpd_delay;
this->public.get_dpd_action = (dpd_action_t (*) (peer_cfg_t *))get_dpd_action;
this->public.get_my_virtual_ip = (host_t* (*) (peer_cfg_t *))get_my_virtual_ip;
@@ -469,6 +483,7 @@ peer_cfg_t *peer_cfg_create(char *name, u_int ike_version, ike_cfg_t *ike_cfg,
this->rekeytime = rekeytime;
this->jitter = jitter;
this->use_reauth = reauth;
this->use_mobike = mobike;
this->dpd_delay = dpd_delay;
this->dpd_action = dpd_action;
this->my_virtual_ip = my_virtual_ip;
src/charon/config/peer_cfg.h
+10 -1
View File
@@ -256,6 +256,14 @@ struct peer_cfg_t {
*/
bool (*use_reauth) (peer_cfg_t *this);
/**
* @brief Use MOBIKE (RFC4555) if peer supports it?
*
* @param this calling object
* @return TRUE to enable MOBIKE support
*/
bool (*use_mobike) (peer_cfg_t *this);
/**
* @brief Get the DPD check interval.
*
@@ -347,6 +355,7 @@ struct peer_cfg_t {
* @param rekeytime lifetime before rekeying an SA
* @param jitter range of random to substract from rekeytime
* @param use_reauth sould be done reauthentication instead of rekeying?
* @param use_mobike use MOBIKE (RFC4555) if peer supports it
* @param dpd_delay after how many seconds of inactivity to check DPD
* @param dpd_action what to do with CHILD_SAs when detected a dead peer
* @param my_virtual_ip virtual IP for local host, or NULL
@@ -361,7 +370,7 @@ peer_cfg_t *peer_cfg_create(char *name, u_int ikev_version, ike_cfg_t *ike_cfg,
cert_policy_t cert_policy, auth_method_t auth_method,
eap_type_t eap_type, u_int32_t keyingtries,
u_int32_t lifetime, u_int32_t rekeytime,
u_int32_t jitter, bool use_reauth,
u_int32_t jitter, bool use_reauth, bool use_mobike,
u_int32_t dpd_delay, dpd_action_t dpd_action,
host_t *my_virtual_ip, host_t *other_virtual_ip);
src/charon/control/interfaces/stroke_interface.c
+2 -2
View File
@@ -559,8 +559,8 @@ static void stroke_add_conn(stroke_msg_t *msg, FILE *out)
msg->add_conn.rekey.tries, msg->add_conn.rekey.ike_lifetime,
msg->add_conn.rekey.ike_lifetime - msg->add_conn.rekey.margin,
msg->add_conn.rekey.margin * msg->add_conn.rekey.fuzz / 100,
msg->add_conn.rekey.reauth, msg->add_conn.dpd.delay,
msg->add_conn.dpd.action,my_vip, other_vip);
msg->add_conn.rekey.reauth, msg->add_conn.mobike,
msg->add_conn.dpd.delay, msg->add_conn.dpd.action, my_vip, other_vip);
}
child_cfg = child_cfg_create(
src/charon/sa/ike_sa.c
+15 -6
View File
@@ -878,8 +878,11 @@ static status_t initiate(private_ike_sa_t *this, child_cfg_t *child_cfg)
this->task_manager->queue_task(this->task_manager, task);
task = (task_t*)ike_config_create(&this->public, TRUE);
this->task_manager->queue_task(this->task_manager, task);
task = (task_t*)ike_mobike_create(&this->public, TRUE);
this->task_manager->queue_task(this->task_manager, task);
if (this->peer_cfg->use_mobike(this->peer_cfg))
{
task = (task_t*)ike_mobike_create(&this->public, TRUE);
this->task_manager->queue_task(this->task_manager, task);
}
}
task = (task_t*)child_create_create(&this->public, child_cfg);
@@ -940,8 +943,11 @@ static status_t acquire(private_ike_sa_t *this, u_int32_t reqid)
this->task_manager->queue_task(this->task_manager, task);
task = (task_t*)ike_config_create(&this->public, TRUE);
this->task_manager->queue_task(this->task_manager, task);
task = (task_t*)ike_mobike_create(&this->public, TRUE);
this->task_manager->queue_task(this->task_manager, task);
if (this->peer_cfg->use_mobike(this->peer_cfg))
{
task = (task_t*)ike_mobike_create(&this->public, TRUE);
this->task_manager->queue_task(this->task_manager, task);
}
}
child_cfg = child_sa->get_config(child_sa);
@@ -1330,9 +1336,12 @@ static status_t retransmit(private_ike_sa_t *this, u_int32_t message_id)
{
task = (task_t*)child_create_create(&new->public, child_cfg);
new->task_manager->queue_task(new->task_manager, task);
}
if (this->peer_cfg->use_mobike(this->peer_cfg))
{
task = (task_t*)ike_mobike_create(&new->public, TRUE);
new->task_manager->queue_task(new->task_manager, task);
}
task = (task_t*)ike_mobike_create(&new->public, TRUE);
new->task_manager->queue_task(new->task_manager, task);
new->task_manager->initiate(new->task_manager);
}
charon->ike_sa_manager->checkin(charon->ike_sa_manager, &new->public);
src/charon/sa/tasks/ike_natd.c
+18 -11
View File
@@ -26,6 +26,7 @@
#include <string.h>
#include <daemon.h>
#include <config/peer_cfg.h>
#include <crypto/hashers/hasher.h>
#include <encoding/payloads/notify_payload.h>
@@ -218,18 +219,24 @@ static void process_payloads(private_ike_natd_t *this, message_t *message)
static status_t process_i(private_ike_natd_t *this, message_t *message)
{
process_payloads(this, message);
/* if peer supports NAT-T, we switch to port 4500 even
* if no NAT is detected. MOBIKE requires this. */
if (message->get_exchange_type(message) == IKE_SA_INIT &&
this->ike_sa->supports_extension(this->ike_sa, EXT_NATT))
{
host_t *me, *other;
me = this->ike_sa->get_my_host(this->ike_sa);
me->set_port(me, IKEV2_NATT_PORT);
other = this->ike_sa->get_other_host(this->ike_sa);
other->set_port(other, IKEV2_NATT_PORT);
if (message->get_exchange_type(message) == IKE_SA_INIT)
{
peer_cfg_t *peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
if (this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY) ||
/* if peer supports NAT-T, we switch to port 4500 even
* if no NAT is detected. MOBIKE requires this. */
(peer_cfg->use_mobike(peer_cfg) &&
this->ike_sa->supports_extension(this->ike_sa, EXT_NATT)))
{
host_t *me, *other;
me = this->ike_sa->get_my_host(this->ike_sa);
me->set_port(me, IKEV2_NATT_PORT);
other = this->ike_sa->get_other_host(this->ike_sa);
other->set_port(other, IKEV2_NATT_PORT);
}
}
return SUCCESS;