denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

- implemented jobs DELETE_HALF_OPEN_IKE_SA and DELETE_ESTABLISHED_IKE_SA

Browse Source
This commit is contained in:
Jan Hutter
2005-12-06 12:27:09 +00:00
parent d381f36608
commit e314700cb5
25 changed files with 504 additions and 119 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Source/charon/config/configuration_manager.c
+23 -5
View File
@@ -207,6 +207,11 @@ struct private_configuration_manager_t {
* First retransmit timeout in ms.
*/
u_int32_t first_retransmit_timeout;
/**
* Timeout in ms after that time a IKE_SA gets deleted.
*/
u_int32_t half_open_ike_sa_timeout;
/**
* Adds a new IKE_SA configuration.
@@ -308,21 +313,24 @@ static void load_default_config (private_configuration_manager_t *this)
sa_config1 = sa_config_create(ID_IPV4_ADDR, "152.96.193.130",
ID_IPV4_ADDR, "152.96.193.131",
SHARED_KEY_MESSAGE_INTEGRITY_CODE);
SHARED_KEY_MESSAGE_INTEGRITY_CODE,
30000);
sa_config1->add_traffic_selector_initiator(sa_config1,ts);
sa_config1->add_traffic_selector_responder(sa_config1,ts);
sa_config2 = sa_config_create(ID_IPV4_ADDR, "152.96.193.131",
ID_IPV4_ADDR, "152.96.193.130",
SHARED_KEY_MESSAGE_INTEGRITY_CODE);
SHARED_KEY_MESSAGE_INTEGRITY_CODE,
30000);
sa_config2->add_traffic_selector_initiator(sa_config2,ts);
sa_config2->add_traffic_selector_responder(sa_config2,ts);
sa_config3 = sa_config_create(ID_IPV4_ADDR, "127.0.0.1",
ID_IPV4_ADDR, "127.0.0.1",
RSA_DIGITAL_SIGNATURE);
RSA_DIGITAL_SIGNATURE,
30000);
sa_config3->add_traffic_selector_initiator(sa_config3,ts);
sa_config3->add_traffic_selector_responder(sa_config3,ts);
@@ -715,7 +723,7 @@ static status_t get_rsa_private_key(private_configuration_manager_t *this, ident
}
/**
* Implementation of configuration_manager_t.destroy.
* Implementation of configuration_manager_t.get_retransmit_timeout.
*/
static status_t get_retransmit_timeout (private_configuration_manager_t *this, u_int32_t retransmit_count, u_int32_t *timeout)
{
@@ -732,6 +740,14 @@ static status_t get_retransmit_timeout (private_configuration_manager_t *this, u
return SUCCESS;
}
/**
* Implementation of configuration_manager_t.get_half_open_ike_sa_timeout.
*/
static u_int32_t get_half_open_ike_sa_timeout (private_configuration_manager_t *this)
{
return this->half_open_ike_sa_timeout;
}
/**
* Implementation of configuration_manager_t.destroy.
*/
@@ -807,7 +823,7 @@ static void destroy(private_configuration_manager_t *this)
/*
* Described in header-file
*/
configuration_manager_t *configuration_manager_create(u_int32_t first_retransmit_timeout,u_int32_t max_retransmit_count)
configuration_manager_t *configuration_manager_create(u_int32_t first_retransmit_timeout,u_int32_t max_retransmit_count, u_int32_t half_open_ike_sa_timeout)
{
private_configuration_manager_t *this = allocator_alloc_thing(private_configuration_manager_t);
@@ -818,6 +834,7 @@ configuration_manager_t *configuration_manager_create(u_int32_t first_retransmit
this->public.get_sa_config_for_name =(status_t (*) (configuration_manager_t *, char *, sa_config_t **)) get_sa_config_for_name;
this->public.get_sa_config_for_init_config_and_id =(status_t (*) (configuration_manager_t *, init_config_t *, identification_t *, identification_t *,sa_config_t **)) get_sa_config_for_init_config_and_id;
this->public.get_retransmit_timeout = (status_t (*) (configuration_manager_t *, u_int32_t retransmit_count, u_int32_t *timeout))get_retransmit_timeout;
this->public.get_half_open_ike_sa_timeout = (u_int32_t (*) (configuration_manager_t *)) get_half_open_ike_sa_timeout;
this->public.get_shared_secret = (status_t (*) (configuration_manager_t *, identification_t *, chunk_t *))get_shared_secret;
this->public.get_rsa_private_key = (status_t (*) (configuration_manager_t *, identification_t *, rsa_private_key_t**))get_rsa_private_key;
this->public.get_rsa_public_key = (status_t (*) (configuration_manager_t *, identification_t *, rsa_public_key_t**))get_rsa_public_key;
@@ -839,6 +856,7 @@ configuration_manager_t *configuration_manager_create(u_int32_t first_retransmit
this->rsa_public_keys = linked_list_create();
this->max_retransmit_count = max_retransmit_count;
this->first_retransmit_timeout = first_retransmit_timeout;
this->half_open_ike_sa_timeout = half_open_ike_sa_timeout;
this->load_default_config(this);
Source/charon/config/configuration_manager.h
+17 -1
View File
@@ -129,6 +129,21 @@ struct configuration_manager_t {
*/
status_t (*get_retransmit_timeout) (configuration_manager_t *this, u_int32_t retransmit_count, u_int32_t *timeout);
/**
* @brief Returns the timeout for an half open IKE_SA in ms.
*
* Half open means that the IKE_SA is still in one of the following states:
* - INITIATOR_INIT
* - RESPONDER_INIT
* - IKE_SA_INIT_REQUESTED
* - IKE_SA_INIT_RESPONDED
* - IKE_AUTH_REQUESTED
*
* @param this calling object
* @return timeout in milliseconds (ms)
*/
u_int32_t (*get_half_open_ike_sa_timeout) (configuration_manager_t *this);
/**
* @brief Returns the preshared secret of a specific ID.
*
@@ -192,10 +207,11 @@ struct configuration_manager_t {
*
* @param first_retransmit_timeout first retransmit timeout in milliseconds
* @param max_retransmit_count max number of tries to retransmitted a requests (0 for infinite)
* @param half_open_ike_sa_timeout timeout after that a half open IKE_SA gets deleted
* @return
* - pointer to created configuration_manager_t object
* @ingroup config
*/
configuration_manager_t *configuration_manager_create(u_int32_t first_retransmit_timeout,u_int32_t max_retransmit_count);
configuration_manager_t *configuration_manager_create(u_int32_t first_retransmit_timeout,u_int32_t max_retransmit_count, u_int32_t half_open_ike_sa_timeout);
#endif /*CONFIGURATION_MANAGER_H_*/
Source/charon/config/sa_config.c
+30 -16
View File
@@ -53,6 +53,11 @@ struct private_sa_config_t {
*/
auth_method_t auth_method;
/**
* Lifetime of IKE_SA in milliseconds.
*/
u_int32_t ike_sa_lifetime;
/**
* list for all proposals
*/
@@ -85,7 +90,7 @@ struct private_sa_config_t {
};
/**
* implements sa_config_t.get_my_id
* Implementation of sa_config_t.get_my_id
*/
static identification_t *get_my_id(private_sa_config_t *this)
{
@@ -93,7 +98,7 @@ static identification_t *get_my_id(private_sa_config_t *this)
}
/**
* implements sa_config_t.get_other_id
* Implementation of sa_config_t.get_other_id
*/
static identification_t *get_other_id(private_sa_config_t *this)
{
@@ -101,16 +106,23 @@ static identification_t *get_other_id(private_sa_config_t *this)
}
/**
* implements sa_config_t.get_auth_method
* Implementation of sa_config_t.get_auth_method.
*/
static auth_method_t get_auth_method(private_sa_config_t *this)
{
return this->auth_method;
}
/**
* Implementation of sa_config_t.get_ike_sa_lifetime.
*/
static u_int32_t get_ike_sa_lifetime (private_sa_config_t *this)
{
return this->ike_sa_lifetime;
}
/**
* implements sa_config_t.get_traffic_selectors_initiator
* Implementation of sa_config_t.get_traffic_selectors_initiator
*/
static size_t get_traffic_selectors_initiator(private_sa_config_t *this, traffic_selector_t **traffic_selectors[])
{
@@ -118,7 +130,7 @@ static size_t get_traffic_selectors_initiator(private_sa_config_t *this, traffic
}
/**
* implements sa_config_t.get_traffic_selectors_responder
* Implementation of sa_config_t.get_traffic_selectors_responder
*/
static size_t get_traffic_selectors_responder(private_sa_config_t *this, traffic_selector_t **traffic_selectors[])
{
@@ -126,7 +138,7 @@ static size_t get_traffic_selectors_responder(private_sa_config_t *this, traffic
}
/**
* implements private_sa_config_t.get_traffic_selectors
* Implementation of private_sa_config_t.get_traffic_selectors
*/
static size_t get_traffic_selectors(private_sa_config_t *this, linked_list_t *ts_list, traffic_selector_t **traffic_selectors[])
{
@@ -148,7 +160,7 @@ static size_t get_traffic_selectors(private_sa_config_t *this, linked_list_t *ts
}
/**
* implements private_sa_config_t.select_traffic_selectors_initiator
* Implementation of private_sa_config_t.select_traffic_selectors_initiator
*/
static size_t select_traffic_selectors_initiator(private_sa_config_t *this,traffic_selector_t *supplied[], size_t count, traffic_selector_t **selected[])
{
@@ -156,14 +168,14 @@ static size_t select_traffic_selectors_initiator(private_sa_config_t *this,traff
}
/**
* implements private_sa_config_t.select_traffic_selectors_responder
* Implementation of private_sa_config_t.select_traffic_selectors_responder
*/
static size_t select_traffic_selectors_responder(private_sa_config_t *this,traffic_selector_t *supplied[], size_t count, traffic_selector_t **selected[])
{
return this->select_traffic_selectors(this, this->ts_responder, supplied, count, selected);
}
/**
* implements private_sa_config_t.select_traffic_selectors
* Implementation of private_sa_config_t.select_traffic_selectors
*/
static size_t select_traffic_selectors(private_sa_config_t *this, linked_list_t *ts_list, traffic_selector_t *supplied[], size_t count, traffic_selector_t **selected[])
{
@@ -198,7 +210,7 @@ static size_t select_traffic_selectors(private_sa_config_t *this, linked_list_t
}
/**
* implements sa_config_t.get_proposals
* Implementation of sa_config_t.get_proposals
*/
static size_t get_proposals(private_sa_config_t *this, u_int8_t ah_spi[4], u_int8_t esp_spi[4], child_proposal_t **proposals)
{
@@ -223,7 +235,7 @@ static size_t get_proposals(private_sa_config_t *this, u_int8_t ah_spi[4], u_int
}
/**
* implements sa_config_t.select_proposal
* Implementation of sa_config_t.select_proposal
*/
static child_proposal_t *select_proposal(private_sa_config_t *this, u_int8_t ah_spi[4], u_int8_t esp_spi[4], child_proposal_t *supplied, size_t count)
{
@@ -256,7 +268,7 @@ static child_proposal_t *select_proposal(private_sa_config_t *this, u_int8_t ah_
/**
* implements private_sa_config_t.proposal_equals
* Implementation of private_sa_config_t.proposal_equals
*/
static bool proposal_equals(private_sa_config_t *this, child_proposal_t *first, child_proposal_t *second)
{
@@ -333,7 +345,7 @@ static bool proposal_equals(private_sa_config_t *this, child_proposal_t *first,
}
/**
* implements sa_config_t.add_traffic_selector_initiator
* Implementation of sa_config_t.add_traffic_selector_initiator
*/
static void add_traffic_selector_initiator(private_sa_config_t *this, traffic_selector_t *traffic_selector)
{
@@ -342,7 +354,7 @@ static void add_traffic_selector_initiator(private_sa_config_t *this, traffic_se
}
/**
* implements sa_config_t.add_traffic_selector_responder
* Implementation of sa_config_t.add_traffic_selector_responder
*/
static void add_traffic_selector_responder(private_sa_config_t *this, traffic_selector_t *traffic_selector)
{
@@ -351,7 +363,7 @@ static void add_traffic_selector_responder(private_sa_config_t *this, traffic_se
}
/**
* implements sa_config_t.add_proposal
* Implementation of sa_config_t.add_proposal
*/
static void add_proposal(private_sa_config_t *this, child_proposal_t *proposal)
{
@@ -405,7 +417,7 @@ static status_t destroy(private_sa_config_t *this)
/*
* Described in header-file
*/
sa_config_t *sa_config_create(id_type_t my_id_type, char *my_id, id_type_t other_id_type, char *other_id, auth_method_t auth_method)
sa_config_t *sa_config_create(id_type_t my_id_type, char *my_id, id_type_t other_id_type, char *other_id, auth_method_t auth_method, u_int32_t ike_sa_lifetime)
{
private_sa_config_t *this = allocator_alloc_thing(private_sa_config_t);
@@ -413,6 +425,7 @@ sa_config_t *sa_config_create(id_type_t my_id_type, char *my_id, id_type_t other
this->public.get_my_id = (identification_t*(*)(sa_config_t*))get_my_id;
this->public.get_other_id = (identification_t*(*)(sa_config_t*))get_other_id;
this->public.get_auth_method = (auth_method_t(*)(sa_config_t*))get_auth_method;
this->public.get_ike_sa_lifetime = (u_int32_t(*)(sa_config_t*))get_ike_sa_lifetime;
this->public.get_traffic_selectors_initiator = (size_t(*)(sa_config_t*,traffic_selector_t**[]))get_traffic_selectors_initiator;
this->public.select_traffic_selectors_initiator = (size_t(*)(sa_config_t*,traffic_selector_t*[],size_t,traffic_selector_t**[]))select_traffic_selectors_initiator;
this->public.get_traffic_selectors_responder = (size_t(*)(sa_config_t*,traffic_selector_t**[]))get_traffic_selectors_responder;
@@ -448,6 +461,7 @@ sa_config_t *sa_config_create(id_type_t my_id_type, char *my_id, id_type_t other
this->ts_initiator = linked_list_create();
this->ts_responder = linked_list_create();
this->auth_method = auth_method;
this->ike_sa_lifetime = ike_sa_lifetime;
return (&this->public);
}
Source/charon/config/sa_config.h
+16 -2
View File
@@ -119,6 +119,13 @@ struct sa_config_t {
*/
auth_method_t (*get_auth_method) (sa_config_t *this);
/**
* @brief Get lifetime of IKE_SA in milliseconds.
*
* @return IKE_SA lifetime in milliseconds.
*/
u_int32_t (*get_ike_sa_lifetime) (sa_config_t *this);
/**
* @brief Get configured traffic selectors for initiator site.
*
@@ -256,10 +263,17 @@ struct sa_config_t {
/**
* @brief Create a configuration object for IKE_AUTH and later.
*
* @return created sa_config_t
* @param my_id_type type of my identification
* @param my_id my identification as string
* @param other_id_type type of other identification
* @param other_id other identification as string
* @param auth_method Method of authentication
* @param ike_sa_lifetime lifetime of this IKE_SA in milliseconds. IKE_SA will be deleted
* after this lifetime!
* @return created sa_config_t
*
* @ingroup config
*/
sa_config_t *sa_config_create();
sa_config_t *sa_config_create(id_type_t my_id_type, char *my_id, id_type_t other_id_type, char *other_id, auth_method_t auth_method, u_int32_t ike_sa_lifetime);
#endif //_SA_CONFIG_H_