denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Added an option to configure the maximum size of a fragment

Browse Source
This commit is contained in:
Tobias Brunner
2013-01-12 11:54:58 +01:00
parent 7ae245f685
commit ee6902ef7f
2 changed files with 14 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
man/strongswan.conf.5.in
+4
View File
@@ -164,6 +164,10 @@ are released to free memory once an IKE_SA is established.
Enabling this might conflict with plugins that later need access to e.g. the Enabling this might conflict with plugins that later need access to e.g. the
used certificates. used certificates.
.TP .TP
.BR charon.fragment_size " [512]"
Maximum size (in bytes) of a sent fragment when using the proprietary IKEv1
fragmentation extension.
.TP
.BR charon.half_open_timeout " [30]" .BR charon.half_open_timeout " [30]"
Timeout in seconds for connecting IKE_SAs (also see IKE_SA_INIT DROPPING). Timeout in seconds for connecting IKE_SAs (also see IKE_SA_INIT DROPPING).
.TP .TP
src/libcharon/sa/ikev1/task_manager_v1.c
+10 -3
View File
@@ -1,5 +1,5 @@
/* /*
* Copyright (C) 2007-2012 Tobias Brunner * Copyright (C) 2007-2013 Tobias Brunner
* Copyright (C) 2007-2011 Martin Willi * Copyright (C) 2007-2011 Martin Willi
* Hochschule fuer Technik Rapperswil * Hochschule fuer Technik Rapperswil
* *
@@ -216,6 +216,11 @@ struct private_task_manager_t {
*/ */
size_t max_packet; size_t max_packet;
/**
* Maximum length of a single fragment (when sending)
*/
size_t size;
/** /**
* The exchange type we use for fragments. Always the initial type even * The exchange type we use for fragments. Always the initial type even
* for fragmented quick mode or transaction messages (i.e. either * for fragmented quick mode or transaction messages (i.e. either
@@ -414,7 +419,7 @@ static bool send_packet(private_task_manager_t *this, bool request,
ike_cfg = this->ike_sa->get_ike_cfg(this->ike_sa); ike_cfg = this->ike_sa->get_ike_cfg(this->ike_sa);
fragmentation = ike_cfg->fragmentation(ike_cfg); fragmentation = ike_cfg->fragmentation(ike_cfg);
data = packet->get_data(packet); data = packet->get_data(packet);
if (data.len > MAX_FRAGMENT_SIZE && (fragmentation == FRAGMENTATION_FORCE || if (data.len > this->frag.size && (fragmentation == FRAGMENTATION_FORCE ||
(this->ike_sa->supports_extension(this->ike_sa, EXT_IKE_FRAGMENTATION) && (this->ike_sa->supports_extension(this->ike_sa, EXT_IKE_FRAGMENTATION) &&
fragmentation == FRAGMENTATION_YES))) fragmentation == FRAGMENTATION_YES)))
{ {
@@ -425,7 +430,7 @@ static bool send_packet(private_task_manager_t *this, bool request,
/* reduce size due to non-ESP marker */ /* reduce size due to non-ESP marker */
nat = this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY); nat = this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY);
frag_size = MAX_FRAGMENT_SIZE - (nat ? 4 : 0); frag_size = this->frag.size - (nat ? 4 : 0);
src = packet->get_source(packet); src = packet->get_source(packet);
dst = packet->get_destination(packet); dst = packet->get_destination(packet);
@@ -1989,6 +1994,8 @@ task_manager_v1_t *task_manager_v1_create(ike_sa_t *ike_sa)
.exchange = ID_PROT, .exchange = ID_PROT,
.max_packet = lib->settings->get_int(lib->settings, .max_packet = lib->settings->get_int(lib->settings,
"%s.max_packet", MAX_PACKET, charon->name), "%s.max_packet", MAX_PACKET, charon->name),
.size = lib->settings->get_int(lib->settings,
"%s.fragment_size", MAX_FRAGMENT_SIZE, charon->name),
}, },
.ike_sa = ike_sa, .ike_sa = ike_sa,
.rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK), .rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK),