webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-21 00:12:58 +02:00
Code Issues Packages Projects Releases Wiki Activity

strongswan: Create configuration for better interoperability

Browse Source 
Also import some upstream fixes for connection stability.
This commit is contained in:
Michael Tremer
2015-02-11 15:15:47 +01:00
parent 0cf8de0502
commit dea158f2fc
4 changed files with 371 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
src/patches/strongswan-5.2.2-issue-816.patch Normal file
View File

@@ -0,0 +1,13 @@
diff --git a/src/libcharon/sa/ikev2/task_manager_v2.c b/src/libcharon/sa/ikev2/t
index e9a677a655e4..69118abe78df 100644
--- a/src/libcharon/sa/ikev2/task_manager_v2.c
+++ b/src/libcharon/sa/ikev2/task_manager_v2.c
@@ -1339,7 +1339,7 @@ METHOD(task_manager_t, process_message, status_t,
{
DBG1(DBG_IKE, "received message ID %d, expected %d. Ignored",
mid, this->responding.mid);
- if (msg->get_exchange_type(msg) == IKE_SA_INIT)
+ if (mid != 0 && msg->get_exchange_type(msg) == IKE_SA_INIT)
{ /* clean up IKE_SA state if IKE_SA_INIT has invalid msg ID */
return DESTROY_ME;
}

50
src/patches/strongswan-5.2.2-issue-819-cd2c30a.patch Normal file
View File

@@ -0,0 +1,50 @@
From cd2c30a56ec9bdab8b3923851509f27a4fd6f537 Mon Sep 17 00:00:00 2001
From: Tobias Brunner <tobias@strongswan.org>
Date: Tue, 10 Feb 2015 19:03:44 +0100
Subject: [PATCH] ikev1: Set protocol ID and SPIs in INITIAL-CONTACT
notification payloads
The payload we sent before is not compliant with RFC 2407 and thus some
peers might abort negotiation (e.g. with an INVALID-PROTOCOL-ID error).
#819
---
src/libcharon/sa/ikev1/tasks/main_mode.c | 15 +++++++++++++--
1 file changed, 13 insertions(+), 2 deletions(-)
diff --git a/src/libcharon/sa/ikev1/tasks/main_mode.c b/src/libcharon/sa/ikev1/tasks/main_mode.c
index 5065e70..3ea4a2a 100644
--- a/src/libcharon/sa/ikev1/tasks/main_mode.c
+++ b/src/libcharon/sa/ikev1/tasks/main_mode.c
@@ -213,6 +213,10 @@ static void add_initial_contact(private_main_mode_t *this, message_t *message,
{
identification_t *idr;
host_t *host;
+ notify_payload_t *notify;
+ ike_sa_id_t *ike_sa_id;
+ u_int64_t spi_i, spi_r;
+ chunk_t spi;
idr = this->ph1->get_id(this->ph1, this->peer_cfg, FALSE);
if (idr && !idr->contains_wildcards(idr))
@@ -224,8 +228,15 @@ static void add_initial_contact(private_main_mode_t *this, message_t *message,
if (!charon->ike_sa_manager->has_contact(charon->ike_sa_manager,
idi, idr, host->get_family(host)))
{
- message->add_notify(message, FALSE, INITIAL_CONTACT_IKEV1,
- chunk_empty);
+ notify = notify_payload_create_from_protocol_and_type(
+ PLV1_NOTIFY, PROTO_IKE, INITIAL_CONTACT_IKEV1);
+ ike_sa_id = this->ike_sa->get_id(this->ike_sa);
+ spi_i = ike_sa_id->get_initiator_spi(ike_sa_id);
+ spi_r = ike_sa_id->get_responder_spi(ike_sa_id);
+ spi = chunk_cata("cc", chunk_from_thing(spi_i),
+ chunk_from_thing(spi_r));
+ notify->set_spi_data(notify, spi);
+ message->add_payload(message, (payload_t*)notify);
}
}
}
--
1.7.9.5