redirect-provider: Add interface to redirect clients during initial messages

This will allow e.g. plugins to decide whether a connecting client is
redirected to a different gateway using RFC 5685.

diff --git a/src/libcharon/Android.mk b/src/libcharon/Android.mk
index 844bbfd8e030fa9758aa92fe962d2ce3df58b702..ca9466692abf51644ac946033ac603f016fe27a2 100644 (file)
--- a/src/libcharon/Android.mk
+++ b/src/libcharon/Android.mk
@@ -84,6 +84,7 @@ sa/child_sa_manager.c sa/child_sa_manager.h \
 sa/task_manager.h sa/task_manager.c \
 sa/shunt_manager.c sa/shunt_manager.h \
 sa/trap_manager.c sa/trap_manager.h \
+sa/redirect_provider.h \
 sa/task.c sa/task.h
 
 libcharon_la_SOURCES += \

diff --git a/src/libcharon/Makefile.am b/src/libcharon/Makefile.am
index 4de8faab9232bf1e5802e456bb560ee4b38a2bbc..2edf92a7a7f8ed191d4471ac19b00f1ad034ac09 100644 (file)
--- a/src/libcharon/Makefile.am
+++ b/src/libcharon/Makefile.am
@@ -83,6 +83,7 @@ sa/child_sa_manager.c sa/child_sa_manager.h \
 sa/task_manager.h sa/task_manager.c \
 sa/shunt_manager.c sa/shunt_manager.h \
 sa/trap_manager.c sa/trap_manager.h \
+sa/redirect_provider.h \
 sa/task.c sa/task.h
 
 if USE_IKEV2

diff --git a/src/libcharon/sa/redirect_provider.h b/src/libcharon/sa/redirect_provider.h
new file mode 100644 (file)
index 0000000..ef2288f
--- /dev/null
+++ b/src/libcharon/sa/redirect_provider.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2015 Tobias Brunner
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+/**
+ * @defgroup redirect_provider redirect_provider
+ * @{ @ingroup sa
+ */
+
+#ifndef REDIRECT_PROVIDER_H_
+#define REDIRECT_PROVIDER_H_
+
+typedef struct redirect_provider_t redirect_provider_t;
+
+#include <library.h>
+#include <sa/ike_sa.h>
+
+/**
+ * Interface that allows implementations to decide whether a client is
+ * redirected during IKE_SA_INIT or IKE_AUTH using RFC 5685.
+ */
+struct redirect_provider_t {
+
+       /**
+        * Decide whether a client is redirect directly upon receipt of the
+        * IKE_SA_INIT message.
+        *
+        * @param ike_sa                IKE_SA for which this is called
+        * @param gateway[out]  new IKE gateway (IP or FQDN)
+        * @return                              TRUE if client should be redirected, FALSE otherwise
+        */
+       bool (*redirect_on_init)(redirect_provider_t *this, ike_sa_t *ike_sa,
+                                                        identification_t **gateway);
+
+       /**
+        * Decide whether a client is redirect after the IKE_AUTH has been
+        * handled.  This is called after the client is authenticated and when the
+        * server authenticates itself.
+        *
+        * @param ike_sa                IKE_SA for which this is called
+        * @param gateway[out]  new IKE gateway (IP or FQDN)
+        * @return                              TRUE if client should be redirected, FALSE otherwise
+        */
+       bool (*redirect_on_auth)(redirect_provider_t *this, ike_sa_t *ike_sa,
+                                                        identification_t **gateway);
+};
+
+#endif /** REDIRECT_PROVIDER_H_ @}*/