denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Refactored the lifetime_cfg_t struct to be simpler and more expressive. Initialization is now static.

Browse Source
This commit is contained in:
Tobias Brunner
2009-09-01 12:54:33 +02:00
parent abff49a7ff
commit e75f423753
12 changed files with 104 additions and 124 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/charon/plugins/kernel_klips/kernel_klips_ipsec.c
+4 -4
View File
@@ -1844,14 +1844,14 @@ static status_t add_sa(private_kernel_klips_ipsec_t *this,
/* Although KLIPS supports SADB_EXT_LIFETIME_SOFT/HARD, we handle the lifetime
* of SAs manually in the plugin. Refer to the comments in receive_events()
* for details. */
if (lifetime->rekey_time)
if (lifetime->time.rekey)
{
schedule_expire(this, protocol, spi, reqid, EXPIRE_TYPE_SOFT, lifetime->rekey_time);
schedule_expire(this, protocol, spi, reqid, EXPIRE_TYPE_SOFT, lifetime->time.rekey);
}
if (lifetime->life_time)
if (lifetime->time.life)
{
schedule_expire(this, protocol, spi, reqid, EXPIRE_TYPE_HARD, lifetime->life_time);
schedule_expire(this, protocol, spi, reqid, EXPIRE_TYPE_HARD, lifetime->time.life);
}
return SUCCESS;
src/charon/plugins/kernel_netlink/kernel_netlink_ipsec.c
+7 -7
View File
@@ -941,7 +941,7 @@ static status_t add_sa(private_kernel_netlink_ipsec_t *this,
* we are in the recursive call below */
if (ipcomp != IPCOMP_NONE && cpi != 0)
{
lifetime_cfg_t lft = { 0,0,0,0,0,0,0,0,0 };
lifetime_cfg_t lft = {{0,0,0},{0,0,0},{0,0,0}};
add_sa(this, src, dst, htonl(ntohs(cpi)), IPPROTO_COMP, reqid, &lft,
ENCR_UNDEFINED, chunk_empty, AUTH_UNDEFINED, chunk_empty,
mode, ipcomp, 0, FALSE, inbound);
@@ -971,13 +971,13 @@ static status_t add_sa(private_kernel_netlink_ipsec_t *this,
}
sa->replay_window = (protocol == IPPROTO_COMP) ? 0 : 32;
sa->reqid = reqid;
sa->lft.soft_byte_limit = XFRM_LIMIT(lifetime->rekey_bytes);
sa->lft.hard_byte_limit = XFRM_LIMIT(lifetime->life_bytes);
sa->lft.soft_packet_limit = XFRM_LIMIT(lifetime->rekey_packets);
sa->lft.hard_packet_limit = XFRM_LIMIT(lifetime->life_packets);
sa->lft.soft_byte_limit = XFRM_LIMIT(lifetime->bytes.rekey);
sa->lft.hard_byte_limit = XFRM_LIMIT(lifetime->bytes.life);
sa->lft.soft_packet_limit = XFRM_LIMIT(lifetime->packets.rekey);
sa->lft.hard_packet_limit = XFRM_LIMIT(lifetime->packets.life);
/* we use lifetimes since added, not since used */
sa->lft.soft_add_expires_seconds = lifetime->rekey_time;
sa->lft.hard_add_expires_seconds = lifetime->life_time;
sa->lft.soft_add_expires_seconds = lifetime->time.rekey;
sa->lft.hard_add_expires_seconds = lifetime->time.life;
sa->lft.soft_use_expires_seconds = 0;
sa->lft.hard_use_expires_seconds = 0;
src/charon/plugins/kernel_pfkey/kernel_pfkey_ipsec.c
+6 -6
View File
@@ -1287,18 +1287,18 @@ static status_t add_sa(private_kernel_pfkey_ipsec_t *this,
lft = (struct sadb_lifetime*)PFKEY_EXT_ADD_NEXT(msg);
lft->sadb_lifetime_exttype = SADB_EXT_LIFETIME_SOFT;
lft->sadb_lifetime_len = PFKEY_LEN(sizeof(struct sadb_lifetime));
lft->sadb_lifetime_allocations = lifetime->rekey_packets;
lft->sadb_lifetime_bytes = lifetime->rekey_bytes;
lft->sadb_lifetime_addtime = lifetime->rekey_time;
lft->sadb_lifetime_allocations = lifetime->packets.rekey;
lft->sadb_lifetime_bytes = lifetime->bytes.rekey;
lft->sadb_lifetime_addtime = lifetime->time.rekey;
lft->sadb_lifetime_usetime = 0; /* we only use addtime */
PFKEY_EXT_ADD(msg, lft);
lft = (struct sadb_lifetime*)PFKEY_EXT_ADD_NEXT(msg);
lft->sadb_lifetime_exttype = SADB_EXT_LIFETIME_HARD;
lft->sadb_lifetime_len = PFKEY_LEN(sizeof(struct sadb_lifetime));
lft->sadb_lifetime_allocations = lifetime->life_packets;
lft->sadb_lifetime_bytes = lifetime->life_bytes;
lft->sadb_lifetime_addtime = lifetime->life_time;
lft->sadb_lifetime_allocations = lifetime->packets.life;
lft->sadb_lifetime_bytes = lifetime->bytes.life;
lft->sadb_lifetime_addtime = lifetime->time.life;
lft->sadb_lifetime_usetime = 0; /* we only use addtime */
PFKEY_EXT_ADD(msg, lft);
src/charon/plugins/load_tester/load_tester_config.c
+8 -5
View File
@@ -178,10 +178,16 @@ static peer_cfg_t* generate_config(private_load_tester_config_t *this, uint num)
{
ike_cfg_t *ike_cfg;
child_cfg_t *child_cfg;
lifetime_cfg_t *lifetime;
peer_cfg_t *peer_cfg;
traffic_selector_t *ts;
proposal_t *proposal;
lifetime_cfg_t lifetime = {
.time = {
.life = this->child_rekey * 2,
.rekey = this->child_rekey,
.jitter = 0
}
};
ike_cfg = ike_cfg_create(FALSE, FALSE, "0.0.0.0", this->remote);
ike_cfg->add_proposal(ike_cfg, this->proposal->clone(this->proposal));
@@ -203,10 +209,7 @@ static peer_cfg_t* generate_config(private_load_tester_config_t *this, uint num)
generate_auth_cfg(this, this->initiator_auth, peer_cfg, FALSE, num);
}
lifetime = lifetime_cfg_create_time(this->child_rekey * 2,
this->child_rekey, 0);
child_cfg = child_cfg_create("load-test", lifetime, NULL, TRUE,
child_cfg = child_cfg_create("load-test", &lifetime, NULL, TRUE,
MODE_TUNNEL, ACTION_NONE, ACTION_NONE, FALSE);
proposal = proposal_create_from_string(PROTO_ESP, "aes128-sha1");
child_cfg->add_proposal(child_cfg, proposal);
src/charon/plugins/medcli/medcli_config.c
+17 -11
View File
@@ -99,8 +99,14 @@ static peer_cfg_t *get_peer_cfg_by_name(private_medcli_config_t *this, char *nam
ike_cfg_t *ike_cfg;
child_cfg_t *child_cfg;
chunk_t me, other;
lifetime_cfg_t *lifetime;
char *address, *local_net, *remote_net;
lifetime_cfg_t lifetime = {
.time = {
.life = this->rekey * 60 + this->rekey,
.rekey = this->rekey,
.jitter = this->rekey
}
};
/* query mediation server config:
* - build ike_cfg/peer_cfg for mediation connection on-the-fly
@@ -174,10 +180,7 @@ static peer_cfg_t *get_peer_cfg_by_name(private_medcli_config_t *this, char *nam
identification_create_from_encoding(ID_KEY_ID, other));
peer_cfg->add_auth_cfg(peer_cfg, auth, FALSE);
lifetime = lifetime_cfg_create_time(this->rekey * 60 + this->rekey,
this->rekey, this->rekey);
child_cfg = child_cfg_create(name, lifetime, NULL, TRUE,
child_cfg = child_cfg_create(name, &lifetime, NULL, TRUE,
MODE_TUNNEL, ACTION_NONE, ACTION_NONE, FALSE);
child_cfg->add_proposal(child_cfg, proposal_create_default(PROTO_ESP));
child_cfg->add_traffic_selector(child_cfg, TRUE, ts_from_string(local_net));
@@ -220,8 +223,14 @@ static bool peer_enumerator_enumerate(peer_enumerator_t *this, peer_cfg_t **cfg)
chunk_t me, other;
child_cfg_t *child_cfg;
auth_cfg_t *auth;
lifetime_cfg_t *lifetime;
lifetime_cfg_t lifetime = {
.time = {
.life = this->rekey * 60 + this->rekey,
.rekey = this->rekey
.jitter = this->rekey
}
};
DESTROY_IF(this->current);
if (!this->inner->enumerate(this->inner, &name, &me, &other,
&local_net, &remote_net))
@@ -249,10 +258,7 @@ static bool peer_enumerator_enumerate(peer_enumerator_t *this, peer_cfg_t **cfg)
identification_create_from_encoding(ID_KEY_ID, other));
this->current->add_auth_cfg(this->current, auth, FALSE);
lifetime = lifetime_cfg_create_time(this->rekey * 60 + this->rekey,
this->rekey, this->rekey);
child_cfg = child_cfg_create(name, lifetime, NULL, TRUE, MODE_TUNNEL,
child_cfg = child_cfg_create(name, &lifetime, NULL, TRUE, MODE_TUNNEL,
ACTION_NONE, ACTION_NONE, FALSE);
child_cfg->add_proposal(child_cfg, proposal_create_default(PROTO_ESP));
child_cfg->add_traffic_selector(child_cfg, TRUE, ts_from_string(local_net));
src/charon/plugins/nm/nm_service.c
+8 -5
View File
@@ -218,7 +218,6 @@ static gboolean connect_(NMVPNPlugin *plugin, NMConnection *connection,
ike_cfg_t *ike_cfg;
peer_cfg_t *peer_cfg;
child_cfg_t *child_cfg;
lifetime_cfg_t *lifetime;
traffic_selector_t *ts;
ike_sa_t *ike_sa;
auth_cfg_t *auth;
@@ -226,6 +225,13 @@ static gboolean connect_(NMVPNPlugin *plugin, NMConnection *connection,
certificate_t *cert = NULL;
x509_t *x509;
bool agent = FALSE;
lifetime_cfg_t lifetime = {
.time = {
.life = 10800 /* 3h */,
.rekey = 10200 /* 2h50min */,
.jitter = 300 /* 5min */
}
};
/**
* Read parameters
@@ -427,10 +433,7 @@ static gboolean connect_(NMVPNPlugin *plugin, NMConnection *connection,
auth->add(auth, AUTH_RULE_IDENTITY, gateway);
peer_cfg->add_auth_cfg(peer_cfg, auth, FALSE);
lifetime = lifetime_cfg_create_time(10800 /* 3h */, 10200 /* 2h50min */,
300 /* 5min */);
child_cfg = child_cfg_create(priv->name, lifetime,
child_cfg = child_cfg_create(priv->name, &lifetime,
NULL, TRUE, MODE_TUNNEL, /* updown, hostaccess */
ACTION_NONE, ACTION_NONE, ipcomp);
child_cfg->add_proposal(child_cfg, proposal_create_default(PROTO_ESP));
src/charon/plugins/sql/sql_config.c
+4 -3
View File
@@ -130,9 +130,10 @@ static child_cfg_t *build_child_cfg(private_sql_config_t *this, enumerator_t *e)
if (e->enumerate(e, &id, &name, &lifetime, &rekeytime, &jitter,
&updown, &hostaccess, &mode, &dpd, &close, &ipcomp))
{
lifetime_cfg_t *lft = lifetime_cfg_create_time(lifetime, rekeytime,
jitter);
child_cfg = child_cfg_create(name, lft, updown, hostaccess, mode,
lifetime_cfg_t lft = {
.time = { .life = lifetime, .rekey = rekeytime, .jitter = jitter }
};
child_cfg = child_cfg_create(name, &lft, updown, hostaccess, mode,
dpd, close, ipcomp);
/* TODO: read proposal from db */
child_cfg->add_proposal(child_cfg, proposal_create_default(PROTO_ESP));
src/charon/plugins/stroke/stroke_config.c
+18 -15
View File
@@ -752,8 +752,24 @@ static child_cfg_t *build_child_cfg(private_stroke_config_t *this,
stroke_msg_t *msg)
{
child_cfg_t *child_cfg;
lifetime_cfg_t *lifetime;
action_t dpd;
lifetime_cfg_t lifetime = {
.time = {
.life = msg->add_conn.rekey.ipsec_lifetime,
.rekey = msg->add_conn.rekey.ipsec_lifetime - msg->add_conn.rekey.margin,
.jitter = msg->add_conn.rekey.margin * msg->add_conn.rekey.fuzz / 100
},
.bytes = {
.life = msg->add_conn.rekey.life_bytes,
.rekey = msg->add_conn.rekey.life_bytes - msg->add_conn.rekey.margin_bytes,
.jitter = msg->add_conn.rekey.margin_bytes * msg->add_conn.rekey.fuzz / 100
},
.packets = {
.life = msg->add_conn.rekey.life_packets,
.rekey = msg->add_conn.rekey.life_packets - msg->add_conn.rekey.margin_packets,
.jitter = msg->add_conn.rekey.margin_packets * msg->add_conn.rekey.fuzz / 100
}
};
switch (msg->add_conn.dpd.action)
{ /* map startes magic values to our action type */
@@ -767,22 +783,9 @@ static child_cfg_t *build_child_cfg(private_stroke_config_t *this,
dpd = ACTION_NONE;
break;
}
lifetime = lifetime_cfg_create_time(
msg->add_conn.rekey.ipsec_lifetime,
msg->add_conn.rekey.ipsec_lifetime - msg->add_conn.rekey.margin,
msg->add_conn.rekey.margin * msg->add_conn.rekey.fuzz / 100);
LIFETIME_CFG_SET(lifetime, bytes,
msg->add_conn.rekey.life_bytes,
msg->add_conn.rekey.life_bytes - msg->add_conn.rekey.margin_bytes,
msg->add_conn.rekey.margin_bytes * msg->add_conn.rekey.fuzz / 100);
LIFETIME_CFG_SET(lifetime, packets,
msg->add_conn.rekey.life_packets,
msg->add_conn.rekey.life_packets - msg->add_conn.rekey.margin_packets,
msg->add_conn.rekey.margin_packets * msg->add_conn.rekey.fuzz / 100);
child_cfg = child_cfg_create(
msg->add_conn.name, lifetime,
msg->add_conn.name, &lifetime,
msg->add_conn.me.updown, msg->add_conn.me.hostaccess,
msg->add_conn.mode, dpd, dpd, msg->add_conn.ipcomp);
child_cfg->set_mipv6_options(child_cfg, msg->add_conn.proxy_mode,
src/charon/plugins/uci/uci_config.c
+9 -4
View File
@@ -142,9 +142,15 @@ static bool peer_enumerator_enumerate(peer_enumerator_t *this, peer_cfg_t **cfg)
char *local_id, *local_addr, *local_net;
char *remote_id, *remote_addr, *remote_net;
child_cfg_t *child_cfg;
lifetime_cfg_t *lifetime;
ike_cfg_t *ike_cfg;
auth_cfg_t *auth;
lifetime_cfg_t lifetime = {
.time = {
.life = create_rekey(esp_rekey) + 300,
.rekey = create_rekey(esp_rekey)
.jitter = 300
}
};
/* defaults */
name = "unnamed";
@@ -187,9 +193,8 @@ static bool peer_enumerator_enumerate(peer_enumerator_t *this, peer_cfg_t **cfg)
identification_create_from_string(remote_id));
}
this->peer_cfg->add_auth_cfg(this->peer_cfg, auth, FALSE);
lifetime = lifetime_cfg_create_time(create_rekey(esp_rekey) + 300,
create_rekey(esp_rekey), 300);
child_cfg = child_cfg_create(name, lifetime, NULL, TRUE, MODE_TUNNEL,
child_cfg = child_cfg_create(name, &lifetime, NULL, TRUE, MODE_TUNNEL,
ACTION_NONE, ACTION_NONE, FALSE);
child_cfg->add_proposal(child_cfg, create_proposal(esp_proposal, PROTO_ESP));
child_cfg->add_traffic_selector(child_cfg, TRUE, create_ts(local_net));