denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

merging kernel_pfkey plugin back from kernel-interface branch

Browse Source
This commit is contained in:
Tobias Brunner
2008-10-14 08:46:31 +00:00
parent 9257c3a287
commit 1adaa02bb2
23 changed files with 2186 additions and 274 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/charon/plugins/kernel_netlink/kernel_netlink_ipsec.c
+10 -173
View File
@@ -96,12 +96,6 @@ struct kernel_algorithm_t {
u_int key_size;
};
ENUM(policy_dir_names, POLICY_IN, POLICY_FWD,
"in",
"out",
"fwd"
);
#define END_OF_LIST -1
/**
@@ -221,9 +215,6 @@ struct policy_entry_t {
/** direction of this policy: in, out, forward */
u_int8_t direction;
/** reqid of the policy */
u_int32_t reqid;
/** parameters of installed policy */
struct xfrm_selector sel;
@@ -344,41 +335,13 @@ static host_t* xfrm2host(int family, xfrm_address_t *xfrm, u_int16_t port)
static void ts2subnet(traffic_selector_t* ts,
xfrm_address_t *net, u_int8_t *mask)
{
/* there is no way to do this cleanly, as the address range may
* be anything else but a subnet. We use from_addr as subnet
* and try to calculate a usable subnet mask.
*/
int byte, bit;
bool found = FALSE;
chunk_t from, to;
size_t size = (ts->get_type(ts) == TS_IPV4_ADDR_RANGE) ? 4 : 16;
host_t *net_host;
chunk_t net_chunk;
from = ts->get_from_address(ts);
to = ts->get_to_address(ts);
*mask = (size * 8);
/* go trough all bits of the addresses, beginning in the front.
* as long as they are equal, the subnet gets larger
*/
for (byte = 0; byte < size; byte++)
{
for (bit = 7; bit >= 0; bit--)
{
if ((1<<bit & from.ptr[byte]) != (1<<bit & to.ptr[byte]))
{
*mask = ((7 - bit) + (byte * 8));
found = TRUE;
break;
}
}
if (found)
{
break;
}
}
memcpy(net, from.ptr, from.len);
chunk_free(&from);
chunk_free(&to);
ts->to_subnet(ts, &net_host, mask);
net_chunk = net_host->get_address(net_host);
memcpy(net, net_chunk.ptr, net_chunk.len);
net_host->destroy(net_host);
}
/**
@@ -534,7 +497,7 @@ static void process_mapping(private_kernel_netlink_ipsec_t *this,
if (host)
{
DBG1(DBG_KNL, "NAT mappings of ESP CHILD_SA with SPI %.8x and "
"reqid {%d} changed, queueing update job", ntohl(spi), reqid);
"reqid {%d} changed, queuing update job", ntohl(spi), reqid);
job = (job_t*)update_sa_job_create(reqid, host);
charon->processor->queue_job(charon->processor, job);
}
@@ -600,64 +563,6 @@ static job_requeue_t receive_events(private_kernel_netlink_ipsec_t *this)
return JOB_REQUEUE_DIRECT;
}
/**
* Tries to find an ip address of a local interface that is included in the
* supplied traffic selector.
*/
static status_t get_address_by_ts(private_kernel_netlink_ipsec_t *this,
traffic_selector_t *ts, host_t **ip)
{
enumerator_t *addrs;
host_t *host;
int family;
bool found = FALSE;
DBG2(DBG_KNL, "getting a local address in traffic selector %R", ts);
/* if we have a family which includes localhost, we do not
* search for an IP, we use the default */
family = ts->get_type(ts) == TS_IPV4_ADDR_RANGE ? AF_INET : AF_INET6;
if (family == AF_INET)
{
host = host_create_from_string("127.0.0.1", 0);
}
else
{
host = host_create_from_string("::1", 0);
}
if (ts->includes(ts, host))
{
*ip = host_create_any(family);
host->destroy(host);
DBG2(DBG_KNL, "using host %H", *ip);
return SUCCESS;
}
host->destroy(host);
addrs = charon->kernel_interface->create_address_enumerator(
charon->kernel_interface, TRUE, TRUE);
while (addrs->enumerate(addrs, (void**)&host))
{
if (ts->includes(ts, host))
{
found = TRUE;
*ip = host->clone(host);
break;
}
}
addrs->destroy(addrs);
if (!found)
{
DBG1(DBG_KNL, "no local address found in traffic selector %R", ts);
return FAILED;
}
DBG2(DBG_KNL, "using host %H", *ip);
return SUCCESS;
}
/**
* Get an SPI for a specific protocol from the kernel.
*/
@@ -1256,74 +1161,6 @@ static status_t update_sa(private_kernel_netlink_ipsec_t *this,
return SUCCESS;
}
/**
* Implementation of kernel_interface_t.query_sa.
*/
static status_t query_sa(private_kernel_netlink_ipsec_t *this, host_t *dst,
u_int32_t spi, protocol_id_t protocol,
u_int32_t *use_time)
{
unsigned char request[NETLINK_BUFFER_SIZE];
struct nlmsghdr *out = NULL, *hdr;
struct xfrm_usersa_id *sa_id;
struct xfrm_usersa_info *sa = NULL;
size_t len;
DBG2(DBG_KNL, "querying SAD entry with SPI %.8x", ntohl(spi));
memset(&request, 0, sizeof(request));
hdr = (struct nlmsghdr*)request;
hdr->nlmsg_flags = NLM_F_REQUEST;
hdr->nlmsg_type = XFRM_MSG_GETSA;
hdr->nlmsg_len = NLMSG_LENGTH(sizeof(struct xfrm_usersa_info));
sa_id = (struct xfrm_usersa_id*)NLMSG_DATA(hdr);
host2xfrm(dst, &sa_id->daddr);
sa_id->spi = spi;
sa_id->proto = proto_ike2kernel(protocol);
sa_id->family = dst->get_family(dst);
if (this->socket_xfrm->send(this->socket_xfrm, hdr, &out, &len) == SUCCESS)
{
hdr = out;
while (NLMSG_OK(hdr, len))
{
switch (hdr->nlmsg_type)
{
case XFRM_MSG_NEWSA:
{
sa = NLMSG_DATA(hdr);
break;
}
case NLMSG_ERROR:
{
struct nlmsgerr *err = NLMSG_DATA(hdr);
DBG1(DBG_KNL, "querying SAD entry failed: %s (%d)",
strerror(-err->error), -err->error);
break;
}
default:
hdr = NLMSG_NEXT(hdr, len);
continue;
case NLMSG_DONE:
break;
}
break;
}
}
if (sa == NULL)
{
DBG1(DBG_KNL, "unable to query SAD entry with SPI %.8x", ntohl(spi));
free(out);
return FAILED;
}
*use_time = sa->curlft.use_time;
free (out);
return SUCCESS;
}
/**
* Implementation of kernel_interface_t.del_sa.
*/
@@ -1503,7 +1340,8 @@ static status_t add_policy(private_kernel_netlink_ipsec_t *this,
{
route_entry_t *route = malloc_thing(route_entry_t);
if (get_address_by_ts(this, dst_ts, &route->src_ip) == SUCCESS)
if (charon->kernel_interface->get_address_by_ts(charon->kernel_interface,
dst_ts, &route->src_ip) == SUCCESS)
{
/* get the nexthop to src (src as we are in POLICY_FWD).*/
route->gateway = charon->kernel_interface->get_nexthop(
@@ -1638,7 +1476,7 @@ static status_t del_policy(private_kernel_netlink_ipsec_t *this,
iterator = this->policies->create_iterator_locked(this->policies, &this->mutex);
while (iterator->iterate(iterator, (void**)&current))
{
if (memcmp(&current->sel, &policy.sel, sizeof(struct xfrm_selector)) == 0 &&
if (memeq(&current->sel, &policy.sel, sizeof(struct xfrm_selector)) &&
policy.direction == current->direction)
{
to_delete = current;
@@ -1723,7 +1561,6 @@ kernel_netlink_ipsec_t *kernel_netlink_ipsec_create()
this->public.interface.get_cpi = (status_t(*)(kernel_ipsec_t*,host_t*,host_t*,u_int32_t,u_int16_t*))get_cpi;
this->public.interface.add_sa = (status_t(*)(kernel_ipsec_t *,host_t*,host_t*,u_int32_t,protocol_id_t,u_int32_t,u_int64_t,u_int64_t,u_int16_t,u_int16_t,u_int16_t,u_int16_t,prf_plus_t*,ipsec_mode_t,u_int16_t,bool,bool))add_sa;
this->public.interface.update_sa = (status_t(*)(kernel_ipsec_t*,u_int32_t,protocol_id_t,host_t*,host_t*,host_t*,host_t*,bool))update_sa;
this->public.interface.query_sa = (status_t(*)(kernel_ipsec_t*,host_t*,u_int32_t,protocol_id_t,u_int32_t*))query_sa;
this->public.interface.del_sa = (status_t(*)(kernel_ipsec_t*,host_t*,u_int32_t,protocol_id_t))del_sa;
this->public.interface.add_policy = (status_t(*)(kernel_ipsec_t*,host_t*,host_t*,traffic_selector_t*,traffic_selector_t*,policy_dir_t,protocol_id_t,u_int32_t,bool,ipsec_mode_t,u_int16_t))add_policy;
this->public.interface.query_policy = (status_t(*)(kernel_ipsec_t*,traffic_selector_t*,traffic_selector_t*,policy_dir_t,u_int32_t*))query_policy;
src/charon/plugins/kernel_pfkey/Makefile.am
+10
View File
@@ -0,0 +1,10 @@
INCLUDES = -I${linuxdir} -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
AM_CFLAGS = -rdynamic
plugin_LTLIBRARIES = libstrongswan-kernel-pfkey.la
libstrongswan_kernel_pfkey_la_SOURCES = kernel_pfkey_plugin.h kernel_pfkey_plugin.c \
kernel_pfkey_ipsec.h kernel_pfkey_ipsec.c
libstrongswan_kernel_pfkey_la_LDFLAGS = -module
src/charon/plugins/kernel_pfkey/kernel_pfkey_ipsec.c
+1810
View File
File diff suppressed because it is too large Load Diff
src/charon/plugins/kernel_pfkey/kernel_pfkey_ipsec.h
+48
View File
@@ -0,0 +1,48 @@
/*
* Copyright (C) 2008 Tobias Brunner
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
/**
* @defgroup kernel_pfkey_ipsec_i kernel_pfkey_ipsec
* @{ @ingroup kernel_pfkey
*/
#ifndef KERNEL_PFKEY_IPSEC_H_
#define KERNEL_PFKEY_IPSEC_H_
#include <kernel/kernel_ipsec.h>
typedef struct kernel_pfkey_ipsec_t kernel_pfkey_ipsec_t;
/**
* Implementation of the kernel ipsec interface using PF_KEY.
*/
struct kernel_pfkey_ipsec_t {
/**
* Implements kernel_ipsec_t interface
*/
kernel_ipsec_t interface;
};
/**
* Create a PF_KEY kernel ipsec interface instance.
*
* @return kernel_pfkey_ipsec_t instance
*/
kernel_pfkey_ipsec_t *kernel_pfkey_ipsec_create();
#endif /* KERNEL_PFKEY_IPSEC_H_ @} */
src/charon/plugins/kernel_pfkey/kernel_pfkey_plugin.c
+58
View File
@@ -0,0 +1,58 @@
/*
* Copyright (C) 2008 Tobias Brunner
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
#include "kernel_pfkey_plugin.h"
#include "kernel_pfkey_ipsec.h"
#include <daemon.h>
typedef struct private_kernel_pfkey_plugin_t private_kernel_pfkey_plugin_t;
/**
* private data of kernel PF_KEY plugin
*/
struct private_kernel_pfkey_plugin_t {
/**
* implements plugin interface
*/
kernel_pfkey_plugin_t public;
};
/**
* Implementation of plugin_t.destroy
*/
static void destroy(private_kernel_pfkey_plugin_t *this)
{
charon->kernel_interface->remove_ipsec_interface(charon->kernel_interface, (kernel_ipsec_constructor_t)kernel_pfkey_ipsec_create);
free(this);
}
/*
* see header file
*/
plugin_t *plugin_create()
{
private_kernel_pfkey_plugin_t *this = malloc_thing(private_kernel_pfkey_plugin_t);
this->public.plugin.destroy = (void(*)(plugin_t*))destroy;
charon->kernel_interface->add_ipsec_interface(charon->kernel_interface, (kernel_ipsec_constructor_t)kernel_pfkey_ipsec_create);
return &this->public.plugin;
}
src/charon/plugins/kernel_pfkey/kernel_pfkey_plugin.h
+49
View File
@@ -0,0 +1,49 @@
/*
* Copyright (C) 2008 Tobias Brunner
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
/**
* @defgroup kernel_pfkey kernel_pfkey
* @ingroup cplugins
*
* @defgroup kernel_pfkey_plugin kernel_pfkey_plugin
* @{ @ingroup kernel_pfkey
*/
#ifndef KERNEL_PFKEY_PLUGIN_H_
#define KERNEL_PFKEY_PLUGIN_H_
#include <plugins/plugin.h>
typedef struct kernel_pfkey_plugin_t kernel_pfkey_plugin_t;
/**
* PF_KEY kernel interface plugin
*/
struct kernel_pfkey_plugin_t {
/**
* implements plugin interface
*/
plugin_t plugin;
};
/**
* Create a kernel_pfkey_plugin instance.
*/
plugin_t *plugin_create();
#endif /* KERNEL_PFKEY_PLUGIN_H_ @} */
src/charon/plugins/nm/nm_service.c
+7 -34
View File
@@ -49,41 +49,14 @@ typedef struct {
*/
static u_int ts2subnet(traffic_selector_t* ts, u_int8_t *mask)
{
/* there is no way to do this cleanly, as the address range may
* be anything else but a subnet. We use from_addr as subnet
* and try to calculate a usable subnet mask.
*/
int byte, bit, net;
bool found = FALSE;
chunk_t from, to;
size_t size = (ts->get_type(ts) == TS_IPV4_ADDR_RANGE) ? 4 : 16;
u_int net;
host_t *net_host;
chunk_t net_chunk;
from = ts->get_from_address(ts);
to = ts->get_to_address(ts);
*mask = (size * 8);
/* go trough all bits of the addresses, beginning in the front.
* as long as they are equal, the subnet gets larger
*/
for (byte = 0; byte < size; byte++)
{
for (bit = 7; bit >= 0; bit--)
{
if ((1<<bit & from.ptr[byte]) != (1<<bit & to.ptr[byte]))
{
*mask = ((7 - bit) + (byte * 8));
found = TRUE;
break;
}
}
if (found)
{
break;
}
}
net = *(u_int32_t*)from.ptr;
chunk_free(&from);
chunk_free(&to);
ts->to_subnet(ts, &net_host, mask);
net_chunk = net_host->get_address(net_host);
net = *(u_int32_t*)net_chunk.ptr;
net_host->destroy(net_host);
return net;
}