denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ike-cfg: Pass arguments as struct

Browse Source
This commit is contained in:
Tobias Brunner
2019-04-25 14:31:33 +02:00
parent de77957eda
commit 9486a2e5b0
18 changed files with 253 additions and 153 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/ha/ha_tunnel.c
+9 -3
View File
@@ -190,6 +190,14 @@ static void setup_tunnel(private_ha_tunnel_t *this,
auth_cfg_t *auth_cfg;
child_cfg_t *child_cfg;
traffic_selector_t *ts;
ike_cfg_create_t ike = {
.version = IKEV2,
.local = local,
.local_port = charon->socket->get_port(charon->socket, FALSE),
.remote = remote,
.remote_port = IKEV2_UDP_PORT,
.no_certreq = TRUE,
};
peer_cfg_create_t peer = {
.cert_policy = CERT_NEVER_SEND,
.unique = UNIQUE_KEEP,
@@ -222,9 +230,7 @@ static void setup_tunnel(private_ha_tunnel_t *this,
lib->credmgr->add_set(lib->credmgr, &this->creds.public);
/* create config and backend */
ike_cfg = ike_cfg_create(IKEV2, FALSE, FALSE, local,
charon->socket->get_port(charon->socket, FALSE),
remote, IKEV2_UDP_PORT, FRAGMENTATION_NO, 0);
ike_cfg = ike_cfg_create(&ike);
ike_cfg->add_proposal(ike_cfg, proposal_create_default(PROTO_IKE));
ike_cfg->add_proposal(ike_cfg, proposal_create_default_aead(PROTO_IKE));
peer_cfg = peer_cfg_create(HA_CFG_NAME, ike_cfg, &peer);
src/libcharon/plugins/load_tester/load_tester_config.c
+12 -11
View File
@@ -686,8 +686,12 @@ static peer_cfg_t* generate_config(private_load_tester_config_t *this, uint num)
ike_cfg_t *ike_cfg;
child_cfg_t *child_cfg;
peer_cfg_t *peer_cfg;
char local[32], *remote;
char local[32];
host_t *addr;
ike_cfg_create_t ike = {
.version = this->version,
.remote_port = IKEV2_UDP_PORT,
};
peer_cfg_create_t peer = {
.cert_policy = CERT_SEND_IF_ASKED,
.unique = UNIQUE_NO,
@@ -726,28 +730,25 @@ static peer_cfg_t* generate_config(private_load_tester_config_t *this, uint num)
{
snprintf(local, sizeof(local), "%s", this->initiator);
}
remote = this->responder;
ike.remote = this->responder;
}
else
{
snprintf(local, sizeof(local), "%s", this->responder);
remote = this->initiator;
ike.remote = this->initiator;
}
ike.local = local;
if (this->port && num)
{
ike_cfg = ike_cfg_create(this->version, TRUE, FALSE,
local, this->port + num - 1,
remote, IKEV2_NATT_PORT,
FRAGMENTATION_NO, 0);
ike.local_port = this->port + num - 1;
ike.remote_port = IKEV2_NATT_PORT;
}
else
{
ike_cfg = ike_cfg_create(this->version, TRUE, FALSE, local,
charon->socket->get_port(charon->socket, FALSE),
remote, IKEV2_UDP_PORT,
FRAGMENTATION_NO, 0);
ike.local_port = charon->socket->get_port(charon->socket, FALSE);
}
ike_cfg = ike_cfg_create(&ike);
ike_cfg->add_proposal(ike_cfg, this->proposal->clone(this->proposal));
peer_cfg = peer_cfg_create("load-test", ike_cfg, &peer);
src/libcharon/plugins/medcli/medcli_config.c
+18 -9
View File
@@ -87,9 +87,15 @@ static peer_cfg_t *build_mediation_config(private_medcli_config_t *this,
auth_cfg_t *auth;
ike_cfg_t *ike_cfg;
peer_cfg_t *med_cfg;
ike_cfg_create_t ike = {
.version = IKEV2,
.local = "0.0.0.0",
.local_port = charon->socket->get_port(charon->socket, FALSE),
.remote_port = IKEV2_UDP_PORT,
.no_certreq = TRUE,
};
peer_cfg_create_t peer = *defaults;
chunk_t me, other;
char *address;
/* query mediation server config:
* - build ike_cfg/peer_cfg for mediation connection on-the-fly
@@ -98,14 +104,12 @@ static peer_cfg_t *build_mediation_config(private_medcli_config_t *this,
"SELECT Address, ClientConfig.KeyId, MediationServerConfig.KeyId "
"FROM MediationServerConfig JOIN ClientConfig",
DB_TEXT, DB_BLOB, DB_BLOB);
if (!e || !e->enumerate(e, &address, &me, &other))
if (!e || !e->enumerate(e, &ike.remote, &me, &other))
{
DESTROY_IF(e);
return NULL;
}
ike_cfg = ike_cfg_create(IKEV2, FALSE, FALSE, "0.0.0.0",
charon->socket->get_port(charon->socket, FALSE),
address, IKEV2_UDP_PORT, FRAGMENTATION_NO, 0);
ike_cfg = ike_cfg_create(&ike);
ike_cfg->add_proposal(ike_cfg, proposal_create_default(PROTO_IKE));
ike_cfg->add_proposal(ike_cfg, proposal_create_default_aead(PROTO_IKE));
@@ -397,6 +401,14 @@ METHOD(medcli_config_t, destroy, void,
medcli_config_t *medcli_config_create(database_t *db)
{
private_medcli_config_t *this;
ike_cfg_create_t ike = {
.version = IKEV2,
.local = "0.0.0.0",
.local_port = charon->socket->get_port(charon->socket, FALSE),
.remote = "0.0.0.0",
.remote_port = IKEV2_UDP_PORT,
.no_certreq = TRUE,
};
INIT(this,
.public = {
@@ -410,10 +422,7 @@ medcli_config_t *medcli_config_create(database_t *db)
.db = db,
.rekey = lib->settings->get_time(lib->settings, "medcli.rekey", 1200),
.dpd = lib->settings->get_time(lib->settings, "medcli.dpd", 300),
.ike = ike_cfg_create(IKEV2, FALSE, FALSE, "0.0.0.0",
charon->socket->get_port(charon->socket, FALSE),
"0.0.0.0", IKEV2_UDP_PORT,
FRAGMENTATION_NO, 0),
.ike = ike_cfg_create(&ike),
);
this->ike->add_proposal(this->ike, proposal_create_default(PROTO_IKE));
this->ike->add_proposal(this->ike, proposal_create_default_aead(PROTO_IKE));
src/libcharon/plugins/medsrv/medsrv_config.c
+9 -4
View File
@@ -130,6 +130,14 @@ METHOD(medsrv_config_t, destroy, void,
medsrv_config_t *medsrv_config_create(database_t *db)
{
private_medsrv_config_t *this;
ike_cfg_create_t ike = {
.version = IKEV2,
.local = "0.0.0.0",
.local_port = charon->socket->get_port(charon->socket, FALSE),
.remote = "0.0.0.0",
.remote_port = IKEV2_UDP_PORT,
.no_certreq = TRUE,
};
INIT(this,
.public = {
@@ -143,10 +151,7 @@ medsrv_config_t *medsrv_config_create(database_t *db)
.db = db,
.rekey = lib->settings->get_time(lib->settings, "medsrv.rekey", 1200),
.dpd = lib->settings->get_time(lib->settings, "medsrv.dpd", 300),
.ike = ike_cfg_create(IKEV2, FALSE, FALSE, "0.0.0.0",
charon->socket->get_port(charon->socket, FALSE),
"0.0.0.0", IKEV2_UDP_PORT,
FRAGMENTATION_NO, 0),
.ike = ike_cfg_create(&ike),
);
this->ike->add_proposal(this->ike, proposal_create_default(PROTO_IKE));
this->ike->add_proposal(this->ike, proposal_create_default_aead(PROTO_IKE));
src/libcharon/plugins/sql/sql_config.c
+11 -3
View File
@@ -272,10 +272,18 @@ static ike_cfg_t *build_ike_cfg(private_sql_config_t *this, enumerator_t *e,
while (e->enumerate(e, &id, &certreq, &force_encap, &local, &remote))
{
ike_cfg_t *ike_cfg;
ike_cfg_create_t ike = {
.version = IKEV2,
.local = local,
.local_port = charon->socket->get_port(charon->socket, FALSE),
.remote = remote,
.remote_port = IKEV2_UDP_PORT,
.no_certreq = !certreq,
.force_encap = force_encap,
.fragmentation = FRAGMENTATION_YES,
};
ike_cfg = ike_cfg_create(IKEV2, certreq, force_encap, local,
charon->socket->get_port(charon->socket, FALSE),
remote, IKEV2_UDP_PORT, FRAGMENTATION_NO, 0);
ike_cfg = ike_cfg_create(&ike);
add_ike_proposals(this, ike_cfg, id);
return ike_cfg;
}
src/libcharon/plugins/stroke/stroke_config.c
+19 -15
View File
@@ -260,36 +260,40 @@ static void swap_ends(stroke_msg_t *msg)
*/
static ike_cfg_t *build_ike_cfg(private_stroke_config_t *this, stroke_msg_t *msg)
{
ike_cfg_create_t ike;
ike_cfg_t *ike_cfg;
uint16_t ikeport;
char me[256], other[256];
swap_ends(msg);
ike = (ike_cfg_create_t){
.version = msg->add_conn.version,
.local = msg->add_conn.me.address,
.local_port = msg->add_conn.me.ikeport,
.remote = msg->add_conn.other.address,
.remote_port = msg->add_conn.other.ikeport,
.no_certreq = msg->add_conn.other.sendcert == CERT_NEVER_SEND,
.force_encap = msg->add_conn.force_encap,
.fragmentation = msg->add_conn.fragmentation,
.dscp = msg->add_conn.ikedscp,
};
if (msg->add_conn.me.allow_any)
{
snprintf(me, sizeof(me), "%s,0.0.0.0/0,::/0",
msg->add_conn.me.address);
ike.local = me;
}
if (msg->add_conn.other.allow_any)
{
snprintf(other, sizeof(other), "%s,0.0.0.0/0,::/0",
msg->add_conn.other.address);
ike.remote = other;
}
ikeport = msg->add_conn.me.ikeport;
ikeport = (ikeport == IKEV2_UDP_PORT) ?
charon->socket->get_port(charon->socket, FALSE) : ikeport;
ike_cfg = ike_cfg_create(msg->add_conn.version,
msg->add_conn.other.sendcert != CERT_NEVER_SEND,
msg->add_conn.force_encap,
msg->add_conn.me.allow_any ?
me : msg->add_conn.me.address,
ikeport,
msg->add_conn.other.allow_any ?
other : msg->add_conn.other.address,
msg->add_conn.other.ikeport,
msg->add_conn.fragmentation,
msg->add_conn.ikedscp);
if (ike.local_port == IKEV2_UDP_PORT)
{
ike.local_port = charon->socket->get_port(charon->socket, FALSE);
}
ike_cfg = ike_cfg_create(&ike);
if (!add_proposals(this, msg->add_conn.algorithms.ike, ike_cfg,
NULL, PROTO_IKE))
src/libcharon/plugins/uci/uci_config.c
+23 -17
View File
@@ -121,12 +121,19 @@ METHOD(enumerator_t, peer_enumerator_enumerate, bool,
peer_enumerator_t *this, va_list args)
{
char *name, *ike_proposal, *esp_proposal, *ike_rekey, *esp_rekey;
char *local_id, *local_addr, *local_net;
char *remote_id, *remote_addr, *remote_net;
char *local_id, *local_net, *remote_id, *remote_net;
peer_cfg_t **cfg;
child_cfg_t *child_cfg;
ike_cfg_t *ike_cfg;
auth_cfg_t *auth;
ike_cfg_create_t ike = {
.version = IKEV2,
.local = "0.0.0.0",
.local_port = charon->socket->get_port(charon->socket, FALSE),
.remote = "0.0.0.0",
.remote_port = IKEV2_UDP_PORT,
.no_certreq = TRUE,
};
peer_cfg_create_t peer = {
.cert_policy = CERT_SEND_IF_ASKED,
.unique = UNIQUE_NO,
@@ -152,8 +159,6 @@ METHOD(enumerator_t, peer_enumerator_enumerate, bool,
name = "unnamed";
local_id = NULL;
remote_id = NULL;
local_addr = "0.0.0.0";
remote_addr = "0.0.0.0";
local_net = NULL;
remote_net = NULL;
ike_proposal = NULL;
@@ -162,14 +167,12 @@ METHOD(enumerator_t, peer_enumerator_enumerate, bool,
esp_rekey = NULL;
if (this->inner->enumerate(this->inner, &name, &local_id, &remote_id,
&local_addr, &remote_addr, &local_net, &remote_net,
&ike.local, &ike.remote, &local_net, &remote_net,
&ike_proposal, &esp_proposal, &ike_rekey, &esp_rekey))
{
DESTROY_IF(this->peer_cfg);
ike_cfg = ike_cfg_create(IKEV2, FALSE, FALSE, local_addr,
charon->socket->get_port(charon->socket, FALSE),
remote_addr, IKEV2_UDP_PORT,
FRAGMENTATION_NO, 0);
ike_cfg = ike_cfg_create(&ike);
ike_cfg->add_proposal(ike_cfg, create_proposal(ike_proposal, PROTO_IKE));
peer.rekey_time = create_rekey(ike_rekey);
this->peer_cfg = peer_cfg_create(name, ike_cfg, &peer);
@@ -248,23 +251,26 @@ METHOD(enumerator_t, ike_enumerator_enumerate, bool,
ike_enumerator_t *this, va_list args)
{
ike_cfg_t **cfg;
char *local_addr, *remote_addr, *ike_proposal;
ike_cfg_create_t ike = {
.version = IKEV2,
.local = "0.0.0.0",
.local_port = charon->socket->get_port(charon->socket, FALSE),
.remote = "0.0.0.0",
.remote_port = IKEV2_UDP_PORT,
.no_certreq = TRUE,
};
char *ike_proposal;
VA_ARGS_VGET(args, cfg);
/* defaults */
local_addr = "0.0.0.0";
remote_addr = "0.0.0.0";
ike_proposal = NULL;
if (this->inner->enumerate(this->inner, NULL,
&local_addr, &remote_addr, &ike_proposal))
&ike.local, &ike.remote, &ike_proposal))
{
DESTROY_IF(this->ike_cfg);
this->ike_cfg = ike_cfg_create(IKEV2, FALSE, FALSE, local_addr,
charon->socket->get_port(charon->socket, FALSE),
remote_addr, IKEV2_UDP_PORT,
FRAGMENTATION_NO, 0);
this->ike_cfg = ike_cfg_create(&ike);
this->ike_cfg->add_proposal(this->ike_cfg,
create_proposal(ike_proposal, PROTO_IKE));
src/libcharon/plugins/vici/vici_config.c
+13 -4
View File
@@ -2382,6 +2382,7 @@ CALLBACK(config_sn, bool,
enumerator_t *enumerator;
peer_cfg_create_t cfg;
peer_cfg_t *peer_cfg;
ike_cfg_create_t ike;
ike_cfg_t *ike_cfg;
child_cfg_t *child_cfg;
auth_data_t *auth;
@@ -2509,10 +2510,18 @@ CALLBACK(config_sn, bool,
log_peer_data(&peer);
ike_cfg = ike_cfg_create(peer.version, peer.send_certreq, peer.encap,
peer.local_addrs, peer.local_port,
peer.remote_addrs, peer.remote_port,
peer.fragmentation, peer.dscp);
ike = (ike_cfg_create_t){
.version = peer.version,
.local = peer.local_addrs,
.local_port = peer.local_port,
.remote = peer.remote_addrs,
.remote_port = peer.remote_port,
.no_certreq = !peer.send_certreq,
.force_encap = peer.encap,
.fragmentation = peer.fragmentation,
.dscp = peer.dscp,
};
ike_cfg = ike_cfg_create(&ike);
cfg = (peer_cfg_create_t){
.cert_policy = peer.send_cert,