denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

vici: Make combination of 'trap' and 'start' configurable

Browse Source
This commit is contained in:
Tobias Brunner
2022-04-14 18:42:01 +02:00
parent 7137fd96c2
commit c00c5e5a35
2 changed files with 17 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/vici/vici_config.c
+9
View File
@@ -1011,6 +1011,7 @@ CALLBACK(parse_action, bool,
{ "none", ACTION_NONE }, { "none", ACTION_NONE },
{ "clear", ACTION_NONE }, { "clear", ACTION_NONE },
}; };
char buf[BUF_LEN];
int d; int d;
if (parse_map(map, countof(map), &d, v)) if (parse_map(map, countof(map), &d, v))
@@ -1018,6 +1019,14 @@ CALLBACK(parse_action, bool,
*out = d; *out = d;
return TRUE; return TRUE;
} }
if (!vici_stringify(v, buf, sizeof(buf)))
{
return FALSE;
}
if (enum_flags_from_string(action_names, buf, out))
{
return TRUE;
}
return FALSE; return FALSE;
} }
src/swanctl/swanctl.opt
+8 -4
View File
@@ -885,7 +885,8 @@ connections.<conn>.children.<child>.dpd_action = clear
Action to perform for this CHILD_SA on DPD timeout. The default _clear_ Action to perform for this CHILD_SA on DPD timeout. The default _clear_
closes the CHILD_SA and does not take further action. _trap_ installs closes the CHILD_SA and does not take further action. _trap_ installs
a trap policy, which will catch matching traffic and tries to re-negotiate a trap policy, which will catch matching traffic and tries to re-negotiate
the tunnel on-demand. _restart_ immediately tries to re-negotiate the the tunnel on-demand (note that this is redundant if **start_action**
includes _trap_). _restart_ immediately tries to re-negotiate the
CHILD_SA under a fresh IKE_SA. CHILD_SA under a fresh IKE_SA.
connections.<conn>.children.<child>.ipcomp = no connections.<conn>.children.<child>.ipcomp = no
@@ -1075,19 +1076,22 @@ connections.<conn>.children.<child>.start_action = none
The value _trap_ installs a trap policy, which triggers the tunnel as soon The value _trap_ installs a trap policy, which triggers the tunnel as soon
as matching traffic has been detected. The value _start_ initiates as matching traffic has been detected. The value _start_ initiates
the connection actively. the connection actively. These two modes can be combined with _trap|start_,
to immediately initiate a connection for which trap policies have been
installed.
When unloading or replacing a CHILD_SA configuration having a When unloading or replacing a CHILD_SA configuration having a
**start_action** different from _none_, the inverse action is performed. **start_action** different from _none_, the inverse action is performed.
Configurations with _start_ get closed, while such with _trap_ get Configurations with _start_ get closed, while such with _trap_ get
uninstalled. uninstalled (both happens for connections with _trap|start_).
connections.<conn>.children.<child>.close_action = none connections.<conn>.children.<child>.close_action = none
Action to perform after a CHILD_SA gets closed (_none_, _trap_, _start_). Action to perform after a CHILD_SA gets closed (_none_, _trap_, _start_).
Action to perform after a CHILD_SA gets closed by the peer. The default of Action to perform after a CHILD_SA gets closed by the peer. The default of
_none_ does not take any action, _trap_ installs a trap policy for the _none_ does not take any action, _trap_ installs a trap policy for the
CHILD_SA. _start_ tries to re-create the CHILD_SA. CHILD_SA (note that this is redundant if **start_action** includes _trap_).
_start_ tries to immediately re-create the CHILD_SA.
**close_action** does not provide any guarantee that the CHILD_SA is kept **close_action** does not provide any guarantee that the CHILD_SA is kept
alive. It acts on explicit close messages only, but not on negotiation alive. It acts on explicit close messages only, but not on negotiation