denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

reuse reqid when a ROUTED child_sa gets INSTALLED

Browse Source 
fixed a bug in retransmission code
added support for the "keyingtries" ipsec.conf parameter
added support for the "dpddelay" ipsec.conf parameter
done some work for "dpdaction" behavior
some other cleanups and fixes
This commit is contained in:
Martin Willi
2006-09-05 14:07:25 +00:00
parent da8ab11e91
commit a655f5c09c
35 changed files with 552 additions and 477 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/charon/sa/transactions/create_child_sa.c
+20 -8
View File
@@ -69,6 +69,11 @@ struct private_create_child_sa_t {
*/
u_int32_t rekey_spi;
/**
* reqid to use for new CHILD_SA
*/
u_int32_t reqid;
/**
* policy definition used
*/
@@ -154,6 +159,14 @@ static void set_policy(private_create_child_sa_t *this, policy_t *policy)
this->policy = policy;
}
/**
* Implementation of create_child_sa_t.set_reqid.
*/
static void set_reqid(private_create_child_sa_t *this, u_int32_t reqid)
{
this->reqid = reqid;
}
/**
* Implementation of create_child_sa_t.rekeys_child.
*/
@@ -252,7 +265,6 @@ static status_t get_request(private_create_child_sa_t *this, message_t **result)
sa_payload_t *sa_payload;
linked_list_t *proposals;
bool use_natt;
u_int32_t reqid = 0;
/* get a policy, if we are rekeying */
if (this->rekeyed_sa)
@@ -270,20 +282,20 @@ static status_t get_request(private_create_child_sa_t *this, message_t **result)
my_ts, other_ts,
me, other);
reqid = this->rekeyed_sa->get_reqid(this->rekeyed_sa);
this->reqid = this->rekeyed_sa->get_reqid(this->rekeyed_sa);
if (this->policy == NULL)
{
this->logger->log(this->logger, ERROR,
"no policy found to rekey CHILD_SA with reqid %d",
reqid);
this->reqid);
return FAILED;
}
}
proposals = this->policy->get_proposals(this->policy);
use_natt = this->ike_sa->is_natt_enabled(this->ike_sa);
this->child_sa = child_sa_create(reqid, me, other,
this->child_sa = child_sa_create(this->reqid, me, other,
this->policy->get_soft_lifetime(this->policy),
this->policy->get_hard_lifetime(this->policy),
use_natt);
@@ -686,16 +698,14 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
}
else
{ /* create child sa */
u_int32_t reqid = 0;
if (this->rekeyed_sa)
{
reqid = this->rekeyed_sa->get_reqid(this->rekeyed_sa);
this->reqid = this->rekeyed_sa->get_reqid(this->rekeyed_sa);
}
soft_lifetime = this->policy->get_soft_lifetime(this->policy);
hard_lifetime = this->policy->get_hard_lifetime(this->policy);
use_natt = this->ike_sa->is_natt_enabled(this->ike_sa);
this->child_sa = child_sa_create(reqid, me, other,
this->child_sa = child_sa_create(this->reqid, me, other,
soft_lifetime, hard_lifetime,
use_natt);
this->child_sa->set_name(this->child_sa, this->policy->get_name(this->policy));
@@ -950,6 +960,7 @@ create_child_sa_t *create_child_sa_create(ike_sa_t *ike_sa)
/* public functions */
this->public.set_policy = (void(*)(create_child_sa_t*,policy_t*))set_policy;
this->public.set_reqid = (void(*)(create_child_sa_t*,u_int32_t))set_reqid;
this->public.rekeys_child = (void(*)(create_child_sa_t*,child_sa_t*))rekeys_child;
this->public.cancel = (void(*)(create_child_sa_t*))cancel;
@@ -959,6 +970,7 @@ create_child_sa_t *create_child_sa_create(ike_sa_t *ike_sa)
this->message = NULL;
this->requested = 0;
this->rekey_spi = 0;
this->reqid = 0;
this->nonce_i = CHUNK_INITIALIZER;
this->nonce_r = CHUNK_INITIALIZER;
this->nonce_s = CHUNK_INITIALIZER;
src/charon/sa/transactions/create_child_sa.h
+26 -15
View File
@@ -41,21 +41,21 @@ typedef struct create_child_sa_t create_child_sa_t;
* but includes an additional REKEY_SA notify and deletes the old
* one (in a separate transaction).
*
* ¦__________ _________¦
* ¦ Cyq \/ Czq ¦
* ¦__________/\_________¦
* detect ¦__________ _________¦ detect
* ¦ Czp \/ Czp ¦
* compare nonces, won ¦__________/\_________¦ compare nonces, lost
* ¦ ¦
* delete old ¦__________ ¦
* ¦ Dxq \__________¦
* ¦ __________¦
* ¦__________/ Dxp ¦
* ¦ __________¦ delete created
* ¦__________/ Dzq ¦
* ¦__________ ¦
* ¦ Dzp \__________¦
* __________ _________
* Cyq \/ Czq
* __________/\_________
* detect __________ _________ detect
* Czp \/ Czp
* compare nonces, won __________/\_________ compare nonces, lost
*
* delete old __________
* Dxq \__________
* __________
* __________/ Dxp
* __________ delete created
* __________/ Dzq
* __________
* Dzp \__________
*
*
* @b Constructors:
@@ -78,6 +78,17 @@ struct create_child_sa_t {
* @param policy policy for CHILD_SA
*/
void (*set_policy) (create_child_sa_t* this, policy_t *policy);
/**
* @brief Set the reqid used for CHILD_SA setup.
*
* If we acquire, we must use the same reqid as the
* installed policy.
*
* @param this calling object
* @param reqid reqid to use for the CHILD_SA
*/
void (*set_reqid) (create_child_sa_t* this, u_int32_t reqid);
/**
* @brief Set the CHILD_SA which gets rekeyed by the new one.
src/charon/sa/transactions/ike_auth.c
+17 -2
View File
@@ -124,6 +124,11 @@ struct private_ike_auth_t {
*/
bool build_child;
/**
* reqid to use for CHILD_SA setup
*/
u_int32_t reqid;
/**
* Assigned logger.
*/
@@ -156,6 +161,14 @@ static void set_config(private_ike_auth_t *this,
this->policy = policy;
}
/**
* Implementation of transaction_t.set_reqid.
*/
static void set_reqid(private_ike_auth_t *this, u_int32_t reqid)
{
this->reqid = reqid;
}
/**
* Implementation of transaction_t.set_nonces.
*/
@@ -303,7 +316,7 @@ static status_t get_request(private_ike_auth_t *this, message_t **result)
proposal_list = this->policy->get_proposals(this->policy);
soft_lifetime = this->policy->get_soft_lifetime(this->policy);
hard_lifetime = this->policy->get_hard_lifetime(this->policy);
this->child_sa = child_sa_create(0, me, other, soft_lifetime, hard_lifetime,
this->child_sa = child_sa_create(this->reqid, me, other, soft_lifetime, hard_lifetime,
this->ike_sa->is_natt_enabled(this->ike_sa));
this->child_sa->set_name(this->child_sa, this->policy->get_name(this->policy));
if (this->child_sa->alloc(this->child_sa, proposal_list) != SUCCESS)
@@ -768,7 +781,7 @@ static status_t get_response(private_ike_auth_t *this, message_t *request,
soft_lifetime = this->policy->get_soft_lifetime(this->policy);
hard_lifetime = this->policy->get_hard_lifetime(this->policy);
use_natt = this->ike_sa->is_natt_enabled(this->ike_sa);
this->child_sa = child_sa_create(0, me, other,
this->child_sa = child_sa_create(this->reqid, me, other,
soft_lifetime, hard_lifetime,
use_natt);
this->child_sa->set_name(this->child_sa, this->policy->get_name(this->policy));
@@ -1006,6 +1019,7 @@ ike_auth_t *ike_auth_create(ike_sa_t *ike_sa)
/* public functions */
this->public.set_config = (void(*)(ike_auth_t*,connection_t*,policy_t*))set_config;
this->public.set_reqid = (void(*)(ike_auth_t*,u_int32_t))set_reqid;
this->public.set_nonces = (void(*)(ike_auth_t*,chunk_t,chunk_t))set_nonces;
this->public.set_init_messages = (void(*)(ike_auth_t*,chunk_t,chunk_t))set_init_messages;
@@ -1023,6 +1037,7 @@ ike_auth_t *ike_auth_create(ike_sa_t *ike_sa)
this->tsi = NULL;
this->tsr = NULL;
this->build_child = TRUE;
this->reqid = 0;
this->logger = logger_manager->get_logger(logger_manager, IKE_SA);
return &this->public;
src/charon/sa/transactions/ike_auth.h
+12
View File
@@ -62,6 +62,18 @@ struct ike_auth_t {
*/
void (*set_config) (ike_auth_t* this,
connection_t *connection, policy_t *policy);
/**
* @brief Set the reqid used for CHILD_SA setup.
*
* The first two message exchanges may set up an associated
* CHILD_SA. If we acquire, we must use the same reqid as the
* installed policy.
*
* @param this calling object
* @param reqid reqid to use for the CHILD_SA
*/
void (*set_reqid) (ike_auth_t* this, u_int32_t reqid);
/**
* @brief Set the nonces used in the previous ike_sa_init transaction.
src/charon/sa/transactions/ike_sa_init.c
+20 -3
View File
@@ -33,8 +33,7 @@
#include <encoding/payloads/ke_payload.h>
#include <encoding/payloads/nonce_payload.h>
#include <sa/transactions/ike_auth.h>
#include <queues/jobs/delete_half_open_ike_sa_job.h>
#include <queues/jobs/delete_established_ike_sa_job.h>
#include <queues/jobs/delete_ike_sa_job.h>
#include <queues/jobs/rekey_ike_sa_job.h>
@@ -106,6 +105,11 @@ struct private_ike_sa_init_t {
*/
proposal_t *proposal;
/**
* Reqid to pass to IKE_AUTH, used for created CHILD_SA
*/
u_int32_t reqid;
/**
* Randomizer to generate nonces
*/
@@ -178,6 +182,14 @@ static void set_config(private_ike_sa_init_t *this,
this->policy = policy;
}
/**
* Implementation of ike_sa_init_t.set_reqid.
*/
static void set_reqid(private_ike_sa_init_t *this, u_int32_t reqid)
{
this->reqid = reqid;
}
/**
* Implementation of transaction_t.get_message_id.
*/
@@ -796,6 +808,7 @@ static status_t get_response(private_ike_sa_init_t *this,
/* create next transaction, for which we except a message */
ike_auth = ike_auth_create(this->ike_sa);
ike_auth->set_config(ike_auth, this->connection, this->policy);
ike_auth->set_reqid(ike_auth, this->reqid);
this->connection = NULL;
this->policy = NULL;
ike_auth->set_nonces(ike_auth,
@@ -809,7 +822,8 @@ static status_t get_response(private_ike_sa_init_t *this,
timeout = charon->configuration->get_half_open_ike_sa_timeout(charon->configuration);
if (timeout)
{
job_t *job = (job_t*)delete_half_open_ike_sa_job_create(this->ike_sa->get_id(this->ike_sa));
job_t *job = (job_t*)delete_ike_sa_job_create(
this->ike_sa->get_id(this->ike_sa), FALSE);
charon->event_queue->add_relative(charon->event_queue, job, timeout);
}
/* set new state */
@@ -1029,6 +1043,7 @@ static status_t conclude(private_ike_sa_init_t *this, message_t *response,
/* create next transaction, for which we except a message */
ike_auth = ike_auth_create(this->ike_sa);
ike_auth->set_config(ike_auth, this->connection, this->policy);
ike_auth->set_reqid(ike_auth, this->reqid);
this->connection = NULL;
this->policy = NULL;
ike_auth->set_nonces(ike_auth,
@@ -1074,6 +1089,7 @@ ike_sa_init_t *ike_sa_init_create(ike_sa_t *ike_sa)
/* public functions */
this->public.set_config = (void(*)(ike_sa_init_t*,connection_t*,policy_t*))set_config;
this->public.set_reqid = (void(*)(ike_sa_init_t*,u_int32_t))set_reqid;
this->public.use_dh_group = (bool(*)(ike_sa_init_t*,diffie_hellman_group_t))use_dh_group;
/* private data */
@@ -1087,6 +1103,7 @@ ike_sa_init_t *ike_sa_init_create(ike_sa_t *ike_sa)
this->connection = NULL;
this->policy = NULL;
this->proposal = NULL;
this->reqid = 0;
this->randomizer = randomizer_create();
this->nat_hasher = hasher_create(HASH_SHA1);
this->natd_src_hash = CHUNK_INITIALIZER;
src/charon/sa/transactions/ike_sa_init.h
+13
View File
@@ -58,6 +58,19 @@ struct ike_sa_init_t {
*/
void (*set_config) (ike_sa_init_t* this,
connection_t *connection, policy_t *policy);
/**
* @brief Set the reqid used for CHILD_SA setup.
*
* The first two message exchanges may set up an associated
* CHILD_SA. If we acquire, we must use the same reqid as the
* installed policy. This requid is passed to the ike_auth
* transaction which creates the CHILD_AS.
*
* @param this calling object
* @param reqid reqid to use for the CHILD_SA
*/
void (*set_reqid) (ike_sa_init_t* this, u_int32_t reqid);
/**
* @brief Set the Diffie Hellman group to use for initiating.