@@ -945,6 +945,10 @@ int ipsec_reconfig()

 		return 0;

 	}

+	if(clean_spi_list() != 0) {

+		return 1;

+	}

+

 	return ipsec_cleanall();

 }

@@ -82,7 +82,7 @@ modparam("ims_ipsec_pcscf", "ipsec_listen_addr6", "")

     <section>

       <title><varname>ipsec_client_port</varname> (int)</title>

-      <para>Start port number which will be bound for incoming (server) IPSec traffic.</para>

+      <para>Port number which will be bound for incoming (server) IPSec traffic.</para>

       <para><emphasis>Default value is 5062.</emphasis></para>

@@ -100,7 +100,7 @@ modparam("ims_ipsec_pcscf", "ipsec_client_port", 5062)

     <section>

       <title><varname>ipsec_server_port</varname> (int)</title>

-      <para>Start port number which will be bound for incoming (server) IPSec traffic.</para>

+      <para>Port number which will be bound for incoming (server) IPSec traffic.</para>

       <para><emphasis>Default value is 5063.</emphasis></para>

@@ -118,9 +118,7 @@ modparam("ims_ipsec_pcscf", "ipsec_server_port", 5063)

     <section>

       <title><varname>ipsec_max_connections</varname> (int)</title>

-      <para>Maximum IPSec connections for the process. E.g. if ipsec_client_port=5100, ipsec_server_port=6100 and

-      ipsec_max_connections=10, all client ports between 5100 and 5109 and all server ports between 6100 and 6109

-      will be used for maximum to 10 IPSec connections.</para>

+      <para>Maximum simultanious IPSec connections</para>

       <para><emphasis>Default value is 2.</emphasis></para>

@@ -138,11 +136,9 @@ modparam("ims_ipsec_pcscf", "ipsec_max_connections", 10)

     <section>

       <title><varname>ipsec_reuse_server_port</varname> (int)</title>

-      <para>Reuse (1) or not (0) the P-CSCF Server port for Re-registration for one UA.

-      When set to 0 - During Re-registration P-CSCF will distribute new P-CSCF client and

-      P-CSCF server ports.

-      When set to 1 - During Re-registration P-CSCF will reuse the old P-CSCF server port and

-      will distribute a new P-CSCF client port.</para>

+      <para>Reuse (1) or not (0) the P-CSCF IPSec information for Re-registration for one UA.

+      When set to 0 - During Re-registration P-CSCF will create new IPSec tunnels.

+      When set to 1 - During Re-registration P-CSCF will reuse the old IPSec tunnels.</para>

       <para><emphasis>Default value is 1.</emphasis></para>

@@ -192,6 +188,40 @@ modparam("ims_ipsec_pcscf", "ipsec_spi_id_start", 100)

         <programlisting format="linespecific">

 ...

 modparam("ims_ipsec_pcscf", "ipsec_spi_id_range", 1000)

+...

+        </programlisting>

+      </example>

+    </section>

+

+    <section>

+      <title><varname>ipsec_preferred_alg</varname> (string)</title>

+

+      <para>A name of an authentication algorithm which the Proxy-CSCF will <emphasis>prefer</emphasis> when creating IPSec tunnels.</para>

+      <para><emphasis>Default value is empty string (null) - the last algorithm in the Sec-Agree header will be used.</emphasis></para>

+

+      <example>

+        <title><varname>ipsec_preferred_alg</varname> parameter usage</title>

+

+        <programlisting format="linespecific">

+...

+modparam("ims_ipsec_pcscf", "ipsec_preferred_alg", "hmac-sha-1-96")

+...

+        </programlisting>

+      </example>

+    </section>

+

+    <section>

+      <title><varname>ipsec_preferred_ealg</varname> (string)</title>

+

+      <para>A name of an encrytion algorithm which the Proxy-CSCF will <emphasis>prefer</emphasis> when creating IPSec tunnels.</para>

+      <para><emphasis>Default value is empty string (null) - the last algorithm in the Sec-Agree header will be used. Note that the possibility of it being the "null" algorithm is not insignificant.</emphasis></para>

+

+      <example>

+        <title><varname>ipsec_preferred_ealg</varname> parameter usage</title>

+

+        <programlisting format="linespecific">

+...

+modparam("ims_ipsec_pcscf", "ipsec_preferred_ealg", "aes-cbc")

 ...

         </programlisting>

       </example>

@@ -43,6 +43,8 @@ int ipsec_reuse_server_port = 1;

 int ipsec_max_connections = 2;

 int spi_id_start = 100;

 int spi_id_range = 1000;

+str ipsec_preferred_alg= STR_NULL;

+str ipsec_preferred_ealg= STR_NULL;

 int xfrm_user_selector = 143956232;

 ip_addr_t ipsec_listen_ip_addr;

@@ -90,6 +92,8 @@ static param_export_t params[] = {

 	{"ipsec_max_connections",	INT_PARAM, &ipsec_max_connections	},

 	{"ipsec_spi_id_start",		INT_PARAM, &spi_id_start			},

 	{"ipsec_spi_id_range",		INT_PARAM, &spi_id_range			},

+	{"ipsec_preferred_alg",		PARAM_STR, &ipsec_preferred_alg		},

+	{"ipsec_preferred_ealg",	PARAM_STR, &ipsec_preferred_ealg	},

 	{0, 0, 0}

 };

@@ -25,6 +25,9 @@

 #include "../../core/parser/msg_parser.h"

 #include "../../core/mem/mem.h"

+extern str ipsec_preferred_alg;

+extern str ipsec_preferred_ealg;

+

 static uint32_t parse_digits(str value)

 {

     uint32_t ret = 0;

@@ -76,7 +79,7 @@ static int process_sec_agree_param(str name, str value, ipsec_t *ret, char *alg_

     if(strncasecmp(name.s, "alg", name.len) == 0) {

         SEC_COPY_STR_PARAM(ret->r_alg, value);

-        if(strncasecmp(value.s, "hmac-sha-1-96", value.len) == 0) {

+        if(ipsec_preferred_alg.len && STR_EQ(value, ipsec_preferred_alg)) {

             *alg_found = 1;

         }

     }

@@ -89,7 +92,7 @@ static int process_sec_agree_param(str name, str value, ipsec_t *ret, char *alg_

     else if(strncasecmp(name.s, "ealg", name.len) == 0) {

         SEC_COPY_STR_PARAM(ret->r_ealg, value);

-        if(strncasecmp(value.s, "aes-cbc", value.len) == 0) {

+        if(ipsec_preferred_ealg.len && STR_EQ(value, ipsec_preferred_ealg)) {

             *ealg_found = 1;

         }

     }

@@ -35,12 +35,51 @@ typedef struct spi_generator{

 	uint32_t		spi_val;

 	uint32_t		min_spi;

 	uint32_t		max_spi;

+	uint32_t		sport_start_val;

+	uint32_t		cport_start_val;

+	uint32_t		port_range;

 } spi_generator_t;

 spi_generator_t* spi_data = NULL;

+static int init_free_spi()

+{

+	uint32_t sport_start_val, cport_start_val, port_range, sport, cport, j;

+

+	if(!spi_data) {

+		return 1;

+	}

+

+	sport_start_val = spi_data->sport_start_val;

+	cport_start_val = spi_data->cport_start_val;

+	port_range = spi_data->port_range;

+	//save the initial value for the highly unlikely case where there are no free SPIs

+	sport = sport_start_val;

+	cport = cport_start_val;

+

+	spi_data->free_spi = create_list();

+	for(j = spi_data->min_spi; j < spi_data->max_spi; j+=2)

+	{

+		spi_add(&spi_data->free_spi, j, j+1, cport, sport);

+		cport++;

+		sport++;

+

+		if(cport >= cport_start_val + port_range) {

+			cport = cport_start_val;

+		}

+

+		if(sport >= sport_start_val + port_range) {

+			sport = sport_start_val;

+		}

+	}

+

+	return 0;

+}

+

 int init_spi_gen(uint32_t spi_start_val, uint32_t spi_range, uint32_t sport_start_val, uint32_t cport_start_val, uint32_t port_range)

 {

+    uint32_t j;

+

     if(spi_start_val < 1) {

         return 1;

     }

@@ -49,11 +88,6 @@ int init_spi_gen(uint32_t spi_start_val, uint32_t spi_range, uint32_t sport_star

         return 2;

     }

-    //save the initial value for the highly unlikely case where there are no free SPIs

-    uint32_t sport = sport_start_val;

-    uint32_t cport = cport_start_val;

-    uint32_t j = 0;

-

     if(spi_data){

         return 3;

     }

@@ -76,27 +110,15 @@ int init_spi_gen(uint32_t spi_start_val, uint32_t spi_range, uint32_t sport_star

         spi_data->used_spis[j] = create_list();

     }

-    spi_data->free_spi = create_list();

     spi_data->spi_val  = spi_data->min_spi = spi_start_val;

     spi_data->max_spi  = spi_start_val + spi_range;

+    spi_data->sport_start_val = sport_start_val;

+    spi_data->cport_start_val = cport_start_val;

+    spi_data->port_range = port_range;

-    LM_ERR("spi_data:%p init free spi for IPSEC tunnel min_spi:%u max_api:%u\n", spi_data, spi_data->min_spi, spi_data->max_spi);

-

-    for(j = spi_data->min_spi; j < spi_data->max_spi; j+=2)

-    {

-        spi_add(&spi_data->free_spi, j, j+1, cport, sport);

-        LM_ERR("spi_data:%p add element to spi free list head:%p\n", spi_data, spi_data->free_spi.head);

-        cport++;

-        sport++;

-

-        if(cport >= cport_start_val + port_range) {

-            cport = cport_start_val;

-        }

-

-        if(sport >= sport_start_val + port_range) {

-            sport = sport_start_val;

-        }

-    }

+	if(init_free_spi() != 0) {

+		return 7;

+	}

 	pthread_mutex_unlock(&spi_data->spis_mut);

@@ -159,6 +181,8 @@ int release_spi(uint32_t spi_cid, uint32_t spi_sid, uint16_t cport, uint16_t spo

 int clean_spi_list()

 {

+	uint32_t j;

+

 	if(!spi_data){

 		return 1;

 	}

@@ -167,11 +191,13 @@ int clean_spi_list()

 		return 1;

 	}

-  uint32_t j = 0;

 	for(j = 0; j < MAX_HASH_SPI; j++) {

 		destroy_list(&spi_data->used_spis[j]);

 	}

-  destroy_list(&spi_data->free_spi);

+

+	destroy_list(&spi_data->free_spi);

+	init_free_spi();

+

 	spi_data->spi_val = spi_data->min_spi;

 	pthread_mutex_unlock(&spi_data->spis_mut);

@@ -181,7 +207,6 @@ int clean_spi_list()

 int destroy_spi_gen()

 {

-	LM_ERR("destroy spi list \n" );

 	if(!spi_data){

 		return 1;

 	}