denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

reuse reqid when a ROUTED child_sa gets INSTALLED

Browse Source 
fixed a bug in retransmission code
added support for the "keyingtries" ipsec.conf parameter
added support for the "dpddelay" ipsec.conf parameter
done some work for "dpdaction" behavior
some other cleanups and fixes
This commit is contained in:
Martin Willi
2006-09-05 14:07:25 +00:00
parent da8ab11e91
commit a655f5c09c
35 changed files with 552 additions and 477 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/charon/sa/ike_sa.c
+46 -13
View File
@@ -51,8 +51,7 @@
#include <sa/transactions/dead_peer_detection.h>
#include <sa/transactions/rekey_ike_sa.h>
#include <queues/jobs/retransmit_request_job.h>
#include <queues/jobs/delete_established_ike_sa_job.h>
#include <queues/jobs/delete_half_open_ike_sa_job.h>
#include <queues/jobs/delete_ike_sa_job.h>
#include <queues/jobs/send_dpd_job.h>
#include <queues/jobs/send_keepalive_job.h>
#include <queues/jobs/rekey_ike_sa_job.h>
@@ -203,6 +202,16 @@ struct private_ike_sa_t {
u_int32_t delete;
} time;
/**
* interval to send DPD liveness check
*/
time_t dpd_delay;
/**
* number of retransmit sequences to go through before giving up (keyingtries)
*/
u_int32_t retrans_sequences;
/**
* List of queued transactions to process
*/
@@ -428,13 +437,19 @@ static status_t transmit_request(private_ike_sa_t *this)
u_int32_t transmitted;
u_int32_t timeout;
transaction_t *transaction = this->transaction_out;
u_int32_t message_id = transaction->get_message_id(transaction);
u_int32_t message_id;
this->logger->log(this->logger, CONTROL,
"transmitting request");
transmitted = transaction->requested(transaction);
timeout = charon->configuration->get_retransmit_timeout(charon->configuration,
transmitted);
transmitted,
this->retrans_sequences);
if (timeout == 0)
{
/* giving up. TODO: check for childrens with dpdaction=hold */
this->logger->log(this->logger, ERROR,
"giving up after %d retransmits, deleting IKE_SA",
transmitted - 1);
@@ -444,8 +459,11 @@ static status_t transmit_request(private_ike_sa_t *this)
status = transaction->get_request(transaction, &request);
if (status != SUCCESS)
{
this->logger->log(this->logger, ERROR,
"generating request failed");
return status;
}
message_id = transaction->get_message_id(transaction);
/* if we retransmit, the request is already generated */
if (transmitted == 0)
{
@@ -484,6 +502,8 @@ static status_t retransmit_request(private_ike_sa_t *this, u_int32_t message_id)
if (this->transaction_out == NULL ||
this->transaction_out->get_message_id(this->transaction_out) != message_id)
{
if (this->transaction_out)
printf("trans_out->mid = %d, mid = %d\n", this->transaction_out->get_message_id(this->transaction_out), message_id);
/* no retransmit necessary, transaction did already complete */
return SUCCESS;
}
@@ -668,8 +688,7 @@ static status_t process_response(private_ike_sa_t *this, message_t *response)
current = this->transaction_out;
/* check if message ID is that of our currently active transaction */
if (current == NULL ||
current->get_message_id(current) !=
response->get_message_id(response))
current->get_message_id(current) != response->get_message_id(response))
{
this->logger->log(this->logger, ERROR,
"received response with message ID %d not requested, ignored");
@@ -839,6 +858,8 @@ static status_t initiate(private_ike_sa_t *this,
DESTROY_IF(this->other_host);
this->other_host = connection->get_other_host(connection);
this->other_host = this->other_host->clone(this->other_host);
this->retrans_sequences = connection->get_retrans_seq(connection);
this->dpd_delay = connection->get_dpd_delay(connection);
this->message_id_out = 1;
ike_sa_init = ike_sa_init_create(&this->public);
@@ -958,6 +979,8 @@ static status_t acquire(private_ike_sa_t *this, u_int32_t reqid)
this->message_id_out = 1;
ike_sa_init = ike_sa_init_create(&this->public);
ike_sa_init->set_config(ike_sa_init, connection, policy);
/* reuse existing reqid */
ike_sa_init->set_reqid(ike_sa_init, reqid);
return queue_transaction(this, (transaction_t*)ike_sa_init, TRUE);
}
case IKE_CONNECTING:
@@ -971,6 +994,8 @@ static status_t acquire(private_ike_sa_t *this, u_int32_t reqid)
create_child = create_child_sa_create(&this->public);
create_child->set_policy(create_child, policy);
/* reuse existing reqid */
create_child->set_reqid(create_child, reqid);
return queue_transaction(this, (transaction_t*)create_child, FALSE);
}
default:
@@ -1090,6 +1115,8 @@ static status_t route(private_ike_sa_t *this, connection_t *connection, policy_t
this->other_host = this->other_host->clone(this->other_host);
}
set_name(this, connection->get_name(connection));
this->retrans_sequences = connection->get_retrans_seq(connection);
this->dpd_delay = connection->get_dpd_delay(connection);
break;
case IKE_ESTABLISHED:
case IKE_REKEYING:
@@ -1102,6 +1129,7 @@ static status_t route(private_ike_sa_t *this, connection_t *connection, policy_t
}
child_sa = child_sa_create(0, this->my_host, this->other_host, 0, 0, FALSE);
child_sa->set_name(child_sa, policy->get_name(policy));
my_ts = policy->get_my_traffic_selectors(policy, this->my_host);
other_ts = policy->get_other_traffic_selectors(policy, this->other_host);
status = child_sa->add_policies(child_sa, my_ts, other_ts);
@@ -1162,10 +1190,13 @@ static status_t unroute(private_ike_sa_t *this, policy_t *policy)
static status_t send_dpd(private_ike_sa_t *this)
{
send_dpd_job_t *job;
time_t diff, interval;
status_t status = SUCCESS;
time_t diff;
interval = charon->configuration->get_dpd_interval(charon->configuration);
if (this->dpd_delay == 0)
{
/* DPD disabled */
return SUCCESS;
}
if (this->transaction_out)
{
@@ -1179,20 +1210,20 @@ static status_t send_dpd(private_ike_sa_t *this)
last_in = get_time_inbound(this);
now = time(NULL);
diff = now - last_in;
if (diff >= interval)
if (diff >= this->dpd_delay)
{
/* to long ago, initiate dead peer detection */
dead_peer_detection_t *dpd;
this->logger->log(this->logger, CONTROL, "sending DPD request");
dpd = dead_peer_detection_create(&this->public);
status = queue_transaction(this, (transaction_t*)dpd, FALSE);
queue_transaction(this, (transaction_t*)dpd, FALSE);
diff = 0;
}
}
/* recheck in "interval" seconds */
job = send_dpd_job_create(this->ike_sa_id);
charon->event_queue->add_relative(charon->event_queue, (job_t*)job,
(interval - diff) * 1000);
(this->dpd_delay - diff) * 1000);
return SUCCESS;
}
@@ -1657,7 +1688,7 @@ static void set_lifetimes(private_ike_sa_t *this,
if (hard_lifetime)
{
this->time.delete = this->time.established + hard_lifetime;
job = (job_t*)delete_established_ike_sa_job_create(this->ike_sa_id);
job = (job_t*)delete_ike_sa_job_create(this->ike_sa_id, TRUE);
charon->event_queue->add_relative(charon->event_queue, job,
hard_lifetime * 1000);
}
@@ -1982,6 +2013,8 @@ ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id)
this->time.established = 0;
this->time.rekey = 0;
this->time.delete = 0;
this->dpd_delay = 0;
this->retrans_sequences = 0;
return &this->public;
}
src/charon/sa/ike_sa_manager.c
+19 -7
View File
@@ -375,11 +375,13 @@ static u_int64_t get_next_spi(private_ike_sa_manager_t *this)
}
/**
* Implementation of of ike_sa_manager.create_and_checkout.
* Implementation of of ike_sa_manager.checkout_by_id.
*/
static ike_sa_t* checkout_by_ids(private_ike_sa_manager_t *this,
identification_t *my_id,
identification_t *other_id)
static ike_sa_t* checkout_by_id(private_ike_sa_manager_t *this,
host_t *my_host,
host_t *other_host,
identification_t *my_id,
identification_t *other_id)
{
iterator_t *iterator;
ike_sa_t *ike_sa = NULL;
@@ -391,6 +393,7 @@ static ike_sa_t* checkout_by_ids(private_ike_sa_manager_t *this,
{
ike_sa_entry_t *entry;
identification_t *found_my_id, *found_other_id;
host_t *found_my_host, *found_other_host;
int wc;
iterator->current(iterator, (void**)&entry);
@@ -401,6 +404,8 @@ static ike_sa_t* checkout_by_ids(private_ike_sa_manager_t *this,
found_my_id = entry->ike_sa->get_my_id(entry->ike_sa);
found_other_id = entry->ike_sa->get_other_id(entry->ike_sa);
found_my_host = entry->ike_sa->get_my_host(entry->ike_sa);
found_other_host = entry->ike_sa->get_other_host(entry->ike_sa);
if (found_my_id->get_type(found_my_id) == ID_ANY &&
found_other_id->get_type(found_other_id) == ID_ANY)
@@ -409,12 +414,19 @@ static ike_sa_t* checkout_by_ids(private_ike_sa_manager_t *this,
continue;
}
if (found_my_id->matches(found_my_id, my_id, &wc) &&
/* compare ID and hosts. Supplied ID may contain wildcards, and IP
* may be %any. */
if ((found_my_host->is_anyaddr(found_my_host) ||
my_host->ip_equals(my_host, found_my_host)) &&
(found_other_host->is_anyaddr(found_other_host) ||
other_host->ip_equals(other_host, found_other_host)) &&
found_my_id->matches(found_my_id, my_id, &wc) &&
found_other_id->matches(found_other_id, other_id, &wc))
{
/* looks good, we take this one */
this->logger->log(this->logger, CONTROL|LEVEL1,
"found an existing IKE_SA for IDs %s - %s",
"found an existing IKE_SA for %s[%s]...%s[%s]",
my_host->get_string(my_host), other_host->get_string(other_host),
my_id->get_string(my_id), other_id->get_string(other_id));
entry->checked_out = TRUE;
ike_sa = entry->ike_sa;
@@ -931,7 +943,7 @@ ike_sa_manager_t *ike_sa_manager_create()
/* assign public functions */
this->public.destroy = (void(*)(ike_sa_manager_t*))destroy;
this->public.checkout_by_ids = (ike_sa_t*(*)(ike_sa_manager_t*,identification_t*,identification_t*))checkout_by_ids;
this->public.checkout_by_id = (ike_sa_t*(*)(ike_sa_manager_t*,host_t*,host_t*,identification_t*,identification_t*))checkout_by_id;
this->public.checkout = (ike_sa_t*(*)(ike_sa_manager_t*, ike_sa_id_t*))checkout;
this->public.checkout_by_child = (ike_sa_t*(*)(ike_sa_manager_t*,u_int32_t))checkout_by_child;
this->public.get_ike_sa_list = (linked_list_t*(*)(ike_sa_manager_t*))get_ike_sa_list;
src/charon/sa/ike_sa_manager.h
+10 -6
View File
@@ -69,18 +69,22 @@ struct ike_sa_manager_t {
ike_sa_t* (*checkout) (ike_sa_manager_t* this, ike_sa_id_t *sa_id);
/**
* @brief Checkout an IKE_SA by two identifications.
* @brief Checkout an existing IKE_SA by hosts and identifications.
*
* Allows the lookup of an IKE_SA by two user IDs. It returns the
* first found occurence, if there are multiple canddates. Supplied IDs
* may contain wildcards. If no IKE_SA is found, a new one is created.
* Allows the lookup of an IKE_SA by user IDs and hosts. It returns the
* first found occurence, if there are multiple candidates. Supplied IDs
* may contain wildcards, hosts may be %any.
* If no IKE_SA is found, a new one is created.
*
* @param this the manager object
* @param my_host address of our host
* @param other_id address of remote host
* @param my_id ID used by us
* @param other_id ID used by other
* @param other_id ID used by remote
* @return checked out/created IKE_SA
*/
ike_sa_t* (*checkout_by_ids) (ike_sa_manager_t* this,
ike_sa_t* (*checkout_by_id) (ike_sa_manager_t* this,
host_t *my_host, host_t* other_host,
identification_t *my_id,
identification_t *other_id);
src/charon/sa/transactions/create_child_sa.c
+20 -8
View File
@@ -69,6 +69,11 @@ struct private_create_child_sa_t {
*/
u_int32_t rekey_spi;
/**
* reqid to use for new CHILD_SA
*/
u_int32_t reqid;
/**
* policy definition used
*/
@@ -154,6 +159,14 @@ static void set_policy(private_create_child_sa_t *this, policy_t *policy)
this->policy = policy;
}
/**
* Implementation of create_child_sa_t.set_reqid.
*/
static void set_reqid(private_create_child_sa_t *this, u_int32_t reqid)
{
this->reqid = reqid;
}
/**
* Implementation of create_child_sa_t.rekeys_child.
*/
@@ -252,7 +265,6 @@ static status_t get_request(private_create_child_sa_t *this, message_t **result)
sa_payload_t *sa_payload;
linked_list_t *proposals;
bool use_natt;
u_int32_t reqid = 0;
/* get a policy, if we are rekeying */
if (this->rekeyed_sa)
@@ -270,20 +282,20 @@ static status_t get_request(private_create_child_sa_t *this, message_t **result)
my_ts, other_ts,
me, other);
reqid = this->rekeyed_sa->get_reqid(this->rekeyed_sa);
this->reqid = this->rekeyed_sa->get_reqid(this->rekeyed_sa);
if (this->policy == NULL)
{
this->logger->log(this->logger, ERROR,
"no policy found to rekey CHILD_SA with reqid %d",
reqid);
this->reqid);
return FAILED;
}
}
proposals = this->policy->get_proposals(this->policy);
use_natt = this->ike_sa->is_natt_enabled(this->ike_sa);
this->child_sa = child_sa_create(reqid, me, other,
this->child_sa = child_sa_create(this->reqid, me, other,
this->policy->get_soft_lifetime(this->policy),
this->policy->get_hard_lifetime(this->policy),
use_natt);
@@ -686,16 +698,14 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
}
else
{ /* create child sa */
u_int32_t reqid = 0;
if (this->rekeyed_sa)
{
reqid = this->rekeyed_sa->get_reqid(this->rekeyed_sa);
this->reqid = this->rekeyed_sa->get_reqid(this->rekeyed_sa);
}
soft_lifetime = this->policy->get_soft_lifetime(this->policy);
hard_lifetime = this->policy->get_hard_lifetime(this->policy);
use_natt = this->ike_sa->is_natt_enabled(this->ike_sa);
this->child_sa = child_sa_create(reqid, me, other,
this->child_sa = child_sa_create(this->reqid, me, other,
soft_lifetime, hard_lifetime,
use_natt);
this->child_sa->set_name(this->child_sa, this->policy->get_name(this->policy));
@@ -950,6 +960,7 @@ create_child_sa_t *create_child_sa_create(ike_sa_t *ike_sa)
/* public functions */
this->public.set_policy = (void(*)(create_child_sa_t*,policy_t*))set_policy;
this->public.set_reqid = (void(*)(create_child_sa_t*,u_int32_t))set_reqid;
this->public.rekeys_child = (void(*)(create_child_sa_t*,child_sa_t*))rekeys_child;
this->public.cancel = (void(*)(create_child_sa_t*))cancel;
@@ -959,6 +970,7 @@ create_child_sa_t *create_child_sa_create(ike_sa_t *ike_sa)
this->message = NULL;
this->requested = 0;
this->rekey_spi = 0;
this->reqid = 0;
this->nonce_i = CHUNK_INITIALIZER;
this->nonce_r = CHUNK_INITIALIZER;
this->nonce_s = CHUNK_INITIALIZER;
src/charon/sa/transactions/create_child_sa.h
+26 -15
View File
@@ -41,21 +41,21 @@ typedef struct create_child_sa_t create_child_sa_t;
* but includes an additional REKEY_SA notify and deletes the old
* one (in a separate transaction).
*
* ¦__________ _________¦
* ¦ Cyq \/ Czq ¦
* ¦__________/\_________¦
* detect ¦__________ _________¦ detect
* ¦ Czp \/ Czp ¦
* compare nonces, won ¦__________/\_________¦ compare nonces, lost
* ¦ ¦
* delete old ¦__________ ¦
* ¦ Dxq \__________¦
* ¦ __________¦
* ¦__________/ Dxp ¦
* ¦ __________¦ delete created
* ¦__________/ Dzq ¦
* ¦__________ ¦
* ¦ Dzp \__________¦
* __________ _________
* Cyq \/ Czq
* __________/\_________
* detect __________ _________ detect
* Czp \/ Czp
* compare nonces, won __________/\_________ compare nonces, lost
*
* delete old __________
* Dxq \__________
* __________
* __________/ Dxp
* __________ delete created
* __________/ Dzq
* __________
* Dzp \__________
*
*
* @b Constructors:
@@ -78,6 +78,17 @@ struct create_child_sa_t {
* @param policy policy for CHILD_SA
*/
void (*set_policy) (create_child_sa_t* this, policy_t *policy);
/**
* @brief Set the reqid used for CHILD_SA setup.
*
* If we acquire, we must use the same reqid as the
* installed policy.
*
* @param this calling object
* @param reqid reqid to use for the CHILD_SA
*/
void (*set_reqid) (create_child_sa_t* this, u_int32_t reqid);
/**
* @brief Set the CHILD_SA which gets rekeyed by the new one.
src/charon/sa/transactions/ike_auth.c
+17 -2
View File
@@ -124,6 +124,11 @@ struct private_ike_auth_t {
*/
bool build_child;
/**
* reqid to use for CHILD_SA setup
*/
u_int32_t reqid;
/**
* Assigned logger.
*/
@@ -156,6 +161,14 @@ static void set_config(private_ike_auth_t *this,
this->policy = policy;
}
/**
* Implementation of transaction_t.set_reqid.
*/
static void set_reqid(private_ike_auth_t *this, u_int32_t reqid)
{
this->reqid = reqid;
}
/**
* Implementation of transaction_t.set_nonces.
*/
@@ -303,7 +316,7 @@ static status_t get_request(private_ike_auth_t *this, message_t **result)
proposal_list = this->policy->get_proposals(this->policy);
soft_lifetime = this->policy->get_soft_lifetime(this->policy);
hard_lifetime = this->policy->get_hard_lifetime(this->policy);
this->child_sa = child_sa_create(0, me, other, soft_lifetime, hard_lifetime,
this->child_sa = child_sa_create(this->reqid, me, other, soft_lifetime, hard_lifetime,
this->ike_sa->is_natt_enabled(this->ike_sa));
this->child_sa->set_name(this->child_sa, this->policy->get_name(this->policy));
if (this->child_sa->alloc(this->child_sa, proposal_list) != SUCCESS)
@@ -768,7 +781,7 @@ static status_t get_response(private_ike_auth_t *this, message_t *request,
soft_lifetime = this->policy->get_soft_lifetime(this->policy);
hard_lifetime = this->policy->get_hard_lifetime(this->policy);
use_natt = this->ike_sa->is_natt_enabled(this->ike_sa);
this->child_sa = child_sa_create(0, me, other,
this->child_sa = child_sa_create(this->reqid, me, other,
soft_lifetime, hard_lifetime,
use_natt);
this->child_sa->set_name(this->child_sa, this->policy->get_name(this->policy));
@@ -1006,6 +1019,7 @@ ike_auth_t *ike_auth_create(ike_sa_t *ike_sa)
/* public functions */
this->public.set_config = (void(*)(ike_auth_t*,connection_t*,policy_t*))set_config;
this->public.set_reqid = (void(*)(ike_auth_t*,u_int32_t))set_reqid;
this->public.set_nonces = (void(*)(ike_auth_t*,chunk_t,chunk_t))set_nonces;
this->public.set_init_messages = (void(*)(ike_auth_t*,chunk_t,chunk_t))set_init_messages;
@@ -1023,6 +1037,7 @@ ike_auth_t *ike_auth_create(ike_sa_t *ike_sa)
this->tsi = NULL;
this->tsr = NULL;
this->build_child = TRUE;
this->reqid = 0;
this->logger = logger_manager->get_logger(logger_manager, IKE_SA);
return &this->public;
src/charon/sa/transactions/ike_auth.h
+12
View File
@@ -62,6 +62,18 @@ struct ike_auth_t {
*/
void (*set_config) (ike_auth_t* this,
connection_t *connection, policy_t *policy);
/**
* @brief Set the reqid used for CHILD_SA setup.
*
* The first two message exchanges may set up an associated
* CHILD_SA. If we acquire, we must use the same reqid as the
* installed policy.
*
* @param this calling object
* @param reqid reqid to use for the CHILD_SA
*/
void (*set_reqid) (ike_auth_t* this, u_int32_t reqid);
/**
* @brief Set the nonces used in the previous ike_sa_init transaction.
src/charon/sa/transactions/ike_sa_init.c
+20 -3
View File
@@ -33,8 +33,7 @@
#include <encoding/payloads/ke_payload.h>
#include <encoding/payloads/nonce_payload.h>
#include <sa/transactions/ike_auth.h>
#include <queues/jobs/delete_half_open_ike_sa_job.h>
#include <queues/jobs/delete_established_ike_sa_job.h>
#include <queues/jobs/delete_ike_sa_job.h>
#include <queues/jobs/rekey_ike_sa_job.h>
@@ -106,6 +105,11 @@ struct private_ike_sa_init_t {
*/
proposal_t *proposal;
/**
* Reqid to pass to IKE_AUTH, used for created CHILD_SA
*/
u_int32_t reqid;
/**
* Randomizer to generate nonces
*/
@@ -178,6 +182,14 @@ static void set_config(private_ike_sa_init_t *this,
this->policy = policy;
}
/**
* Implementation of ike_sa_init_t.set_reqid.
*/
static void set_reqid(private_ike_sa_init_t *this, u_int32_t reqid)
{
this->reqid = reqid;
}
/**
* Implementation of transaction_t.get_message_id.
*/
@@ -796,6 +808,7 @@ static status_t get_response(private_ike_sa_init_t *this,
/* create next transaction, for which we except a message */
ike_auth = ike_auth_create(this->ike_sa);
ike_auth->set_config(ike_auth, this->connection, this->policy);
ike_auth->set_reqid(ike_auth, this->reqid);
this->connection = NULL;
this->policy = NULL;
ike_auth->set_nonces(ike_auth,
@@ -809,7 +822,8 @@ static status_t get_response(private_ike_sa_init_t *this,
timeout = charon->configuration->get_half_open_ike_sa_timeout(charon->configuration);
if (timeout)
{
job_t *job = (job_t*)delete_half_open_ike_sa_job_create(this->ike_sa->get_id(this->ike_sa));
job_t *job = (job_t*)delete_ike_sa_job_create(
this->ike_sa->get_id(this->ike_sa), FALSE);
charon->event_queue->add_relative(charon->event_queue, job, timeout);
}
/* set new state */
@@ -1029,6 +1043,7 @@ static status_t conclude(private_ike_sa_init_t *this, message_t *response,
/* create next transaction, for which we except a message */
ike_auth = ike_auth_create(this->ike_sa);
ike_auth->set_config(ike_auth, this->connection, this->policy);
ike_auth->set_reqid(ike_auth, this->reqid);
this->connection = NULL;
this->policy = NULL;
ike_auth->set_nonces(ike_auth,
@@ -1074,6 +1089,7 @@ ike_sa_init_t *ike_sa_init_create(ike_sa_t *ike_sa)
/* public functions */
this->public.set_config = (void(*)(ike_sa_init_t*,connection_t*,policy_t*))set_config;
this->public.set_reqid = (void(*)(ike_sa_init_t*,u_int32_t))set_reqid;
this->public.use_dh_group = (bool(*)(ike_sa_init_t*,diffie_hellman_group_t))use_dh_group;
/* private data */
@@ -1087,6 +1103,7 @@ ike_sa_init_t *ike_sa_init_create(ike_sa_t *ike_sa)
this->connection = NULL;
this->policy = NULL;
this->proposal = NULL;
this->reqid = 0;
this->randomizer = randomizer_create();
this->nat_hasher = hasher_create(HASH_SHA1);
this->natd_src_hash = CHUNK_INITIALIZER;
src/charon/sa/transactions/ike_sa_init.h
+13
View File
@@ -58,6 +58,19 @@ struct ike_sa_init_t {
*/
void (*set_config) (ike_sa_init_t* this,
connection_t *connection, policy_t *policy);
/**
* @brief Set the reqid used for CHILD_SA setup.
*
* The first two message exchanges may set up an associated
* CHILD_SA. If we acquire, we must use the same reqid as the
* installed policy. This requid is passed to the ike_auth
* transaction which creates the CHILD_AS.
*
* @param this calling object
* @param reqid reqid to use for the CHILD_SA
*/
void (*set_reqid) (ike_sa_init_t* this, u_int32_t reqid);
/**
* @brief Set the Diffie Hellman group to use for initiating.