From 95a0b6abc3945176e47a3ab35a79481b997cdc41 Mon Sep 17 00:00:00 2001
From: Nikos Mavrogiannopoulos <nmav@gnutls.org>
Date: Sat, 22 Feb 2014 12:51:34 +0100
Subject: [PATCH] Added the rekey-method config option.

---
 src/config.c        | 14 ++++++++++++++
 src/ocserv-args.def |  9 +++++++++
 src/vpn.h           |  8 +++++++-
 src/worker-vpn.c    | 13 +++++++------
 4 files changed, 37 insertions(+), 7 deletions(-)

diff --git a/src/config.c b/src/config.c
index ea9f2962..e7fca6ba 100644
--- a/src/config.c
+++ b/src/config.c
@@ -90,6 +90,7 @@ static struct cfg_options available_options[] = {
 	{ .name = "output-buffer", .type = OPTION_NUMERIC, .mandatory = 0 },
 	{ .name = "cookie-validity", .type = OPTION_NUMERIC, .mandatory = 1 },
 	{ .name = "rekey-time", .type = OPTION_NUMERIC, .mandatory = 0 },
+	{ .name = "rekey-method", .type = OPTION_STRING, .mandatory = 0 },
 	{ .name = "auth-timeout", .type = OPTION_NUMERIC, .mandatory = 0 },
 	{ .name = "idle-timeout", .type = OPTION_NUMERIC, .mandatory = 0 },
 	{ .name = "mobile-idle-timeout", .type = OPTION_NUMERIC, .mandatory = 0 },
@@ -251,6 +252,7 @@ unsigned j, mand;
 char** auth = NULL;
 unsigned auth_size = 0;
 unsigned prefix = 0;
+char *tmp;
 unsigned force_cert_auth;
 
 	pov = configFileLoad(file);
@@ -393,6 +395,18 @@ unsigned force_cert_auth;
 		config->rekey_time = 24*60*60;
 	}
 
+	tmp = NULL;
+	READ_STRING("rekey-method", tmp);
+	if (tmp == NULL || strcmp(tmp, "ssl") == 0)
+		config->rekey_method = REKEY_METHOD_SSL;
+	else if (strcmp(tmp, "new-tunnel") == 0)
+		config->rekey_method = REKEY_METHOD_NEW_TUNNEL;
+	else {
+		fprintf(stderr, "Unknown rekey method '%s'\n", tmp);
+		exit(1);
+	}
+	free(tmp); tmp = NULL;
+
 	READ_NUMERIC("auth-timeout", config->auth_timeout);
 	READ_NUMERIC("idle-timeout", config->idle_timeout);
 
diff --git a/src/ocserv-args.def b/src/ocserv-args.def
index 5bf2b079..a105eae8 100644
--- a/src/ocserv-args.def
+++ b/src/ocserv-args.def
@@ -206,6 +206,15 @@ cookie-validity = 86400
 # this amount of seconds is elapsed. Set to zero to disable.
 rekey-time = 172800
 
+# ReKey method
+# Valid options: ssl, new-tunnel
+#  ssl: Will perform an efficient rehandshake on the channel allowing
+#       a seamless connection during rekey.
+#  new-tunnel: Will instruct the client to discard and re-establish the channel.
+#       Use this option only if the connecting clients have issues with the ssl
+#       option.
+rekey-method = ssl
+
 # Script to call when a client connects and obtains an IP
 # Parameters are passed on the environment.
 # REASON, USERNAME, GROUPNAME, HOSTNAME (the hostname selected by client), 
diff --git a/src/vpn.h b/src/vpn.h
index afd1391c..36081671 100644
--- a/src/vpn.h
+++ b/src/vpn.h
@@ -59,6 +59,9 @@
 #define AC_PKT_COMPRESSED       8	/* Compressed data */
 #define AC_PKT_TERM_SERVER      9	/* Server kick */
 
+#define REKEY_METHOD_SSL 1
+#define REKEY_METHOD_NEW_TUNNEL 2
+
 extern int syslog_open;
 
 /* the first is generic, for the methods that require a username password */
@@ -199,7 +202,10 @@ struct cfg_st {
 
 	char* socket_file_prefix;
 	time_t cookie_validity;	/* in seconds */
+
 	time_t rekey_time;	/* in seconds */
+	unsigned rekey_method; /* REKEY_METHOD_ */
+
 	time_t min_reauth_time;	/* after a failed auth, how soon one can reauthenticate -> in seconds */
 	unsigned auth_timeout; /* timeout of HTTP auth */
 	unsigned idle_timeout; /* timeout when idle */
@@ -219,7 +225,7 @@ struct cfg_st {
 	                               * TCP sessions. */
 	unsigned rate_limit_ms; /* if non zero force a connection every rate_limit milliseconds */
 	unsigned ping_leases; /* non zero if we need to ping prior to leasing */
-	
+
 	size_t rx_per_sec;
 	size_t tx_per_sec;
 	unsigned net_priority;
diff --git a/src/worker-vpn.c b/src/worker-vpn.c
index 8ef31713..d621b71b 100644
--- a/src/worker-vpn.c
+++ b/src/worker-vpn.c
@@ -1286,7 +1286,8 @@ static int connect_handler(worker_st * ws)
 			       (unsigned)(ws->config->rekey_time));
 		SEND_ERR(ret);
 
-		ret = tls_puts(ws->session, "X-CSTP-Rekey-Method: ssl\r\n");
+		ret = tls_printf(ws->session, "X-CSTP-Rekey-Method: %s\r\n",
+			(ws->config->rekey_method == REKEY_METHOD_SSL)?"ssl":"new-tunnel");
 		SEND_ERR(ret);
 	} else {
 		ret = tls_puts(ws->session, "X-CSTP-Rekey-Method: none\r\n");
@@ -1378,11 +1379,11 @@ static int connect_handler(worker_st * ws)
 				       (unsigned)(ws->config->rekey_time+10));
 			SEND_ERR(ret);
 
-			ret = tls_puts(ws->session, "X-DTLS-Rekey-Method: ssl\r\n");
-			SEND_ERR(ret);
-		} else {
-			ret = tls_puts(ws->session, "X-DTLS-Rekey-Method: none\r\n");
-			SEND_ERR(ret);
+			/* This is our private extension */
+			if (ws->config->rekey_method == REKEY_METHOD_SSL) {
+				ret = tls_puts(ws->session, "X-DTLS-Rekey-Method: ssl\r\n");
+				SEND_ERR(ret);
+			}
 		}
 
 		ret =