denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

using dpd actions to enforce connection state

Browse Source 
dpd actions a per child-, not peer ike-sa
This commit is contained in:
Martin Willi
2008-04-11 08:14:48 +00:00
parent 4a6474c2c3
commit 96926b006d
12 changed files with 264 additions and 239 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/charon/config/child_cfg.c
+25 -6
View File
@@ -28,6 +28,12 @@ ENUM(mode_names, MODE_TRANSPORT, MODE_BEET,
"BEET",
);
ENUM(action_names, ACTION_NONE, ACTION_RESTART,
"ACTION_NONE",
"ACTION_ROUTE",
"ACTION_RESTART",
);
typedef struct private_child_cfg_t private_child_cfg_t;
/**
@@ -80,6 +86,11 @@ struct private_child_cfg_t {
*/
mode_t mode;
/**
* action to take on DPD/passive close
*/
action_t action;
/**
* Time before an SA gets invalid
*/
@@ -338,13 +349,21 @@ static u_int32_t get_lifetime(private_child_cfg_t *this, bool rekey)
}
/**
* Implementation of child_cfg_t.get_name
* Implementation of child_cfg_t.get_mode
*/
static mode_t get_mode(private_child_cfg_t *this)
{
return this->mode;
}
/**
* Implementation of child_cfg_t.get_action
*/
static action_t get_action(private_child_cfg_t *this)
{
return this->action;
}
/**
* Implementation of child_cfg_t.get_dh_group.
*/
@@ -398,11 +417,11 @@ static void destroy(private_child_cfg_t *this)
*/
child_cfg_t *child_cfg_create(char *name, u_int32_t lifetime,
u_int32_t rekeytime, u_int32_t jitter,
char *updown, bool hostaccess, mode_t mode)
char *updown, bool hostaccess, mode_t mode,
action_t action)
{
private_child_cfg_t *this = malloc_thing(private_child_cfg_t);
/* public functions */
this->public.get_name = (char* (*) (child_cfg_t*))get_name;
this->public.add_traffic_selector = (void (*)(child_cfg_t*,bool,traffic_selector_t*))add_traffic_selector;
this->public.get_traffic_selectors = (linked_list_t*(*)(child_cfg_t*,bool,linked_list_t*,host_t*))get_traffic_selectors;
@@ -412,12 +431,12 @@ child_cfg_t *child_cfg_create(char *name, u_int32_t lifetime,
this->public.get_updown = (char* (*) (child_cfg_t*))get_updown;
this->public.get_hostaccess = (bool (*) (child_cfg_t*))get_hostaccess;
this->public.get_mode = (mode_t (*) (child_cfg_t *))get_mode;
this->public.get_action = (action_t (*) (child_cfg_t *))get_action;
this->public.get_lifetime = (u_int32_t (*) (child_cfg_t *,bool))get_lifetime;
this->public.get_dh_group = (diffie_hellman_group_t(*)(child_cfg_t*)) get_dh_group;
this->public.get_ref = (void (*) (child_cfg_t*))get_ref;
this->public.destroy = (void (*) (child_cfg_t*))destroy;
/* apply init values */
this->name = strdup(name);
this->lifetime = lifetime;
this->rekeytime = rekeytime;
@@ -425,8 +444,7 @@ child_cfg_t *child_cfg_create(char *name, u_int32_t lifetime,
this->updown = updown ? strdup(updown) : NULL;
this->hostaccess = hostaccess;
this->mode = mode;
/* initialize private members*/
this->action = action;
this->refcount = 1;
this->proposals = linked_list_create();
this->my_ts = linked_list_create();
@@ -434,3 +452,4 @@ child_cfg_t *child_cfg_create(char *name, u_int32_t lifetime,
return &this->public;
}
src/charon/config/child_cfg.h
+29 -2
View File
@@ -25,6 +25,7 @@
#define CHILD_CFG_H_
typedef enum mode_t mode_t;
typedef enum action_t action_t;
typedef struct child_cfg_t child_cfg_t;
#include <library.h>
@@ -50,6 +51,23 @@ enum mode_t {
*/
extern enum_name_t *mode_names;
/**
* Action to take when DPD detected/connection gets closed by peer.
*/
enum action_t {
/** No action */
ACTION_NONE,
/** Route config to reestablish on demand */
ACTION_ROUTE,
/** Restart config immediately */
ACTION_RESTART,
};
/**
* enum names for action_t.
*/
extern enum_name_t *action_names;
/**
* A child_cfg_t defines the config template for a CHILD_SA.
*
@@ -170,10 +188,17 @@ struct child_cfg_t {
* The mode is either tunnel, transport or BEET. The peer must agree
* on the method, fallback is tunnel mode.
*
* @return lifetime in seconds
* @return ipsec mode
*/
mode_t (*get_mode) (child_cfg_t *this);
/**
* Action to take on DPD/passive close
*
* @return DPD/passive close action
*/
action_t (*get_action) (child_cfg_t *this);
/**
* Get the DH group to use for CHILD_SA setup.
*
@@ -218,10 +243,12 @@ struct child_cfg_t {
* @param updown updown script to execute on up/down event
* @param hostaccess TRUE to allow access to the local host
* @param mode mode to propose for CHILD_SA, transport, tunnel or BEET
* @param action DPD/passive close action
* @return child_cfg_t object
*/
child_cfg_t *child_cfg_create(char *name, u_int32_t lifetime,
u_int32_t rekeytime, u_int32_t jitter,
char *updown, bool hostaccess, mode_t mode);
char *updown, bool hostaccess, mode_t mode,
action_t action);
#endif /* CHILD_CFG_H_ @} */
src/charon/config/peer_cfg.c
+9 -33
View File
@@ -31,13 +31,6 @@ ENUM(cert_policy_names, CERT_ALWAYS_SEND, CERT_NEVER_SEND,
"CERT_NEVER_SEND"
);
ENUM(dpd_action_names, DPD_NONE, DPD_RESTART,
"DPD_NONE",
"DPD_CLEAR",
"DPD_ROUTE",
"DPD_RESTART"
);
typedef struct private_peer_cfg_t private_peer_cfg_t;
/**
@@ -141,14 +134,9 @@ struct private_peer_cfg_t {
u_int32_t over_time;
/**
* What to do with an SA when other peer seams to be dead?
* DPD check intervall
*/
bool dpd_delay;
/**
* What to do with CHILDren when other peer seams to be dead?
*/
bool dpd_action;
u_int32_t dpd;
/**
* virtual IP to use locally
@@ -380,19 +368,11 @@ static bool use_mobike(private_peer_cfg_t *this)
}
/**
* Implements peer_cfg_t.get_dpd_delay
* Implements peer_cfg_t.get_dpd
*/
static u_int32_t get_dpd_delay(private_peer_cfg_t *this)
static u_int32_t get_dpd(private_peer_cfg_t *this)
{
return this->dpd_delay;
}
/**
* Implements peer_cfg_t.get_dpd_action
*/
static dpd_action_t get_dpd_action(private_peer_cfg_t *this)
{
return this->dpd_action;
return this->dpd;
}
/**
@@ -473,8 +453,7 @@ static bool equals(private_peer_cfg_t *this, private_peer_cfg_t *other)
this->reauth_time == other->reauth_time &&
this->jitter_time == other->jitter_time &&
this->over_time == other->over_time &&
this->dpd_delay == other->dpd_delay &&
this->dpd_action == other->dpd_action &&
this->dpd == other->dpd &&
(this->virtual_ip == other->virtual_ip ||
(this->virtual_ip && other->virtual_ip &&
this->virtual_ip->equals(this->virtual_ip, other->virtual_ip))) &&
@@ -531,8 +510,7 @@ peer_cfg_t *peer_cfg_create(char *name, u_int ike_version, ike_cfg_t *ike_cfg,
u_int32_t eap_vendor,
u_int32_t keyingtries, u_int32_t rekey_time,
u_int32_t reauth_time, u_int32_t jitter_time,
u_int32_t over_time, bool mobike,
u_int32_t dpd_delay, dpd_action_t dpd_action,
u_int32_t over_time, bool mobike, u_int32_t dpd,
host_t *virtual_ip, char *pool,
bool mediation, peer_cfg_t *mediated_by,
identification_t *peer_id)
@@ -557,8 +535,7 @@ peer_cfg_t *peer_cfg_create(char *name, u_int ike_version, ike_cfg_t *ike_cfg,
this->public.get_reauth_time = (u_int32_t(*)(peer_cfg_t*))get_reauth_time;
this->public.get_over_time = (u_int32_t(*)(peer_cfg_t*))get_over_time;
this->public.use_mobike = (bool (*) (peer_cfg_t *))use_mobike;
this->public.get_dpd_delay = (u_int32_t (*) (peer_cfg_t *))get_dpd_delay;
this->public.get_dpd_action = (dpd_action_t (*) (peer_cfg_t *))get_dpd_action;
this->public.get_dpd = (u_int32_t (*) (peer_cfg_t *))get_dpd;
this->public.get_virtual_ip = (host_t* (*) (peer_cfg_t *))get_virtual_ip;
this->public.get_pool = (char*(*)(peer_cfg_t*))get_pool;
this->public.get_auth = (auth_info_t*(*)(peer_cfg_t*))get_auth;
@@ -597,8 +574,7 @@ peer_cfg_t *peer_cfg_create(char *name, u_int ike_version, ike_cfg_t *ike_cfg,
this->jitter_time = jitter_time;
this->over_time = over_time;
this->use_mobike = mobike;
this->dpd_delay = dpd_delay;
this->dpd_action = dpd_action;
this->dpd = dpd;
this->virtual_ip = virtual_ip;
this->pool = pool ? strdup(pool) : NULL;
this->auth = auth_info_create();
src/charon/config/peer_cfg.h
+3 -34
View File
@@ -25,7 +25,6 @@
#ifndef PEER_CFG_H_
#define PEER_CFG_H_
typedef enum dpd_action_t dpd_action_t;
typedef enum cert_policy_t cert_policy_t;
typedef struct peer_cfg_t peer_cfg_t;
@@ -63,27 +62,6 @@ enum cert_policy_t {
*/
extern enum_name_t *cert_policy_names;
/**
* Actions to take when a peer does not respond (dead peer detected).
*
* These values are the same as in pluto/starter, so do not modify them!
*/
enum dpd_action_t {
/** DPD disabled */
DPD_NONE,
/** remove CHILD_SAs without replacement */
DPD_CLEAR,
/** route the CHILD_SAs to resetup when needed */
DPD_ROUTE,
/** restart CHILD_SAs in a new IKE_SA, immediately */
DPD_RESTART,
};
/**
* enum names for dpd_action_t.
*/
extern enum_name_t *dpd_action_names;
/**
* Configuration of a peer, specified by IDs.
*
@@ -259,14 +237,7 @@ struct peer_cfg_t {
*
* @return dpd_delay in seconds
*/
u_int32_t (*get_dpd_delay) (peer_cfg_t *this);
/**
* What should be done with a CHILD_SA, when other peer does not respond.
*
* @return dpd action
*/
dpd_action_t (*get_dpd_action) (peer_cfg_t *this);
u_int32_t (*get_dpd) (peer_cfg_t *this);
/**
* Get a virtual IP for the local peer.
@@ -371,8 +342,7 @@ struct peer_cfg_t {
* @param over_time maximum overtime before closing a rekeying/reauth SA
* @param reauth sould be done reauthentication instead of rekeying?
* @param mobike use MOBIKE (RFC4555) if peer supports it
* @param dpd_delay after how many seconds of inactivity to check DPD
* @param dpd_action what to do with CHILD_SAs when detected a dead peer
* @param dpd DPD check interval, 0 to disable
* @param virtual_ip virtual IP for local host, or NULL
* @param pool pool name to get configuration attributes from, or NULL
* @param mediation TRUE if this is a mediation connection
@@ -387,8 +357,7 @@ peer_cfg_t *peer_cfg_create(char *name, u_int ikev_version, ike_cfg_t *ike_cfg,
u_int32_t eap_vendor,
u_int32_t keyingtries, u_int32_t rekey_time,
u_int32_t reauth_time, u_int32_t jitter_time,
u_int32_t over_time, bool mobike,
u_int32_t dpd_delay, dpd_action_t dpd_action,
u_int32_t over_time, bool mobike, u_int32_t dpd,
host_t *virtual_ip, char *pool,
bool mediation, peer_cfg_t *mediated_by,
identification_t *peer_id);