denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

cache keys for in and outbound ESP SAs

Browse Source 
removed redundant storing of traffic selectors in CHILD_SA (sa_policy_t)
creating TS pairs dynamically using create_policy_enumerator()
This commit is contained in:
Martin Willi
2008-10-15 12:24:44 +00:00
parent 35379b2130
commit 1df106bf39
4 changed files with 241 additions and 202 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/charon/plugins/smp/smp.c
+2 -8
View File
@@ -181,19 +181,13 @@ static void write_childend(xmlTextWriterPtr writer, child_sa_t *child, bool loca
*/ */
static void write_child(xmlTextWriterPtr writer, child_sa_t *child) static void write_child(xmlTextWriterPtr writer, child_sa_t *child)
{ {
ipsec_mode_t mode;
encryption_algorithm_t encr;
integrity_algorithm_t int_algo;
chunk_t encr_key, int_key;
u_int32_t rekey, use_in, use_out, use_fwd;
child_cfg_t *config; child_cfg_t *config;
config = child->get_config(child); config = child->get_config(child);
child->get_stats(child, &mode, &encr, &encr_key, &int_algo, &int_key,
&rekey, &use_in, &use_out, &use_fwd);
xmlTextWriterStartElement(writer, "childsa"); xmlTextWriterStartElement(writer, "childsa");
xmlTextWriterWriteFormatElement(writer, "reqid", "%d", child->get_reqid(child)); xmlTextWriterWriteFormatElement(writer, "reqid", "%d",
child->get_reqid(child));
xmlTextWriterWriteFormatElement(writer, "childconfig", "%s", xmlTextWriterWriteFormatElement(writer, "childconfig", "%s",
config->get_name(config)); config->get_name(config));
xmlTextWriterStartElement(writer, "local"); xmlTextWriterStartElement(writer, "local");
src/charon/plugins/stroke/stroke_list.c
+3 -3
View File
@@ -129,9 +129,9 @@ static void log_child_sa(FILE *out, child_sa_t *child_sa, bool all)
chunk_t encr_key, int_key; chunk_t encr_key, int_key;
ipsec_mode_t mode; ipsec_mode_t mode;
child_sa->get_stats(child_sa, &mode, &encr_alg, &encr_key, child_sa->get_stats(child_sa, &mode,
&int_alg, &int_key, &rekey, &use_in, &use_out, &encr_alg, &encr_key, NULL, &int_alg, &int_key, NULL,
&use_fwd); &rekey, &use_in, &use_out, &use_fwd);
fprintf(out, "%12s{%d}: %N, %N", fprintf(out, "%12s{%d}: %N, %N",
child_sa->get_name(child_sa), child_sa->get_reqid(child_sa), child_sa->get_name(child_sa), child_sa->get_reqid(child_sa),
src/charon/sa/child_sa.c
+225 -189
View File
@@ -35,25 +35,6 @@ ENUM(child_sa_state_names, CHILD_CREATED, CHILD_DESTROYING,
"DESTROYING", "DESTROYING",
); );
typedef struct sa_policy_t sa_policy_t;
/**
* Struct used to store information for a policy. This
* is needed since we must provide all this information
* for deleting a policy...
*/
struct sa_policy_t {
/**
* Traffic selector for us
*/
traffic_selector_t *my_ts;
/**
* Traffic selector for other
*/
traffic_selector_t *other_ts;
};
typedef struct private_child_sa_t private_child_sa_t; typedef struct private_child_sa_t private_child_sa_t;
/** /**
@@ -91,11 +72,6 @@ struct private_child_sa_t {
*/ */
protocol_id_t protocol; protocol_id_t protocol;
/**
* List containing sa_policy_t objects
*/
linked_list_t *policies;
/** /**
* Separate list for local traffic selectors * Separate list for local traffic selectors
*/ */
@@ -117,9 +93,9 @@ struct private_child_sa_t {
u_int16_t enc_alg; u_int16_t enc_alg;
/** /**
* Encryption key data * Encryption key data, inbound and outbound
*/ */
chunk_t enc_key; chunk_t enc_key[2];
/** /**
* integrity protection algorithm used for this SA * integrity protection algorithm used for this SA
@@ -127,9 +103,9 @@ struct private_child_sa_t {
u_int16_t int_alg; u_int16_t int_alg;
/** /**
* integrity key data * integrity key data, inbound and outbound
*/ */
chunk_t int_key; chunk_t int_key[2];
/** /**
* time, on which SA was installed * time, on which SA was installed
@@ -298,50 +274,133 @@ static child_cfg_t* get_config(private_child_sa_t *this)
return this->config; return this->config;
} }
typedef struct policy_enumerator_t policy_enumerator_t;
/**
* Private policy enumerator
*/
struct policy_enumerator_t {
/** implements enumerator_t */
enumerator_t public;
/** enumerator over own TS */
enumerator_t *mine;
/** enumerator over others TS */
enumerator_t *other;
/** list of others TS, to recreate enumerator */
linked_list_t *list;
};
/**
* enumerator function of create_policy_enumerator()
*/
static bool policy_enumerate(policy_enumerator_t *this,
traffic_selector_t **my_out, traffic_selector_t **other_out)
{
traffic_selector_t *my_ts, *other_ts;
while (this->mine->enumerate(this->mine, &my_ts))
{
while (TRUE)
{
if (!this->other->enumerate(this->other, &other_ts))
{ /* end of others list, restart with new of mine */
this->other->destroy(this->other);
this->other = this->list->create_enumerator(this->list);
break;
}
if (my_ts->get_type(my_ts) != other_ts->get_type(other_ts))
{ /* family mismatch */
continue;
}
if (my_ts->get_protocol(my_ts) &&
other_ts->get_protocol(other_ts) &&
my_ts->get_protocol(my_ts) != other_ts->get_protocol(other_ts))
{ /* protocol mismatch */
continue;
}
*my_out = my_ts;
*other_out = other_ts;
return TRUE;
}
}
return FALSE;
}
/**
* destroy function of create_policy_enumerator()
*/
static void policy_destroy(policy_enumerator_t *this)
{
this->mine->destroy(this->mine);
this->other->destroy(this->other);
free(this);
}
/**
* Implementation of child_sa_t.create_policy_enumerator
*/
static enumerator_t* create_policy_enumerator(private_child_sa_t *this)
{
policy_enumerator_t *e = malloc_thing(policy_enumerator_t);
e->public.enumerate = (void*)policy_enumerate;
e->public.destroy = (void*)policy_destroy;
e->mine = this->my_ts->create_enumerator(this->my_ts);
e->other = this->other_ts->create_enumerator(this->other_ts);
e->list = this->other_ts;
return &e->public;
}
/** /**
* Implementation of child_sa_t.get_stats. * Implementation of child_sa_t.get_stats.
*/ */
static void get_stats(private_child_sa_t *this, ipsec_mode_t *mode, static void get_stats(private_child_sa_t *this, ipsec_mode_t *mode,
encryption_algorithm_t *encr_algo, chunk_t *encr_key, encryption_algorithm_t *encr_algo,
integrity_algorithm_t *int_algo, chunk_t *int_key, chunk_t *encr_key_in, chunk_t *encr_key_out,
integrity_algorithm_t *int_algo,
chunk_t *int_key_in, chunk_t *int_key_out,
u_int32_t *rekey, u_int32_t *use_in, u_int32_t *use_out, u_int32_t *rekey, u_int32_t *use_in, u_int32_t *use_out,
u_int32_t *use_fwd) u_int32_t *use_fwd)
{ {
sa_policy_t *policy; traffic_selector_t *my_ts, *other_ts;
iterator_t *iterator; enumerator_t *enumerator;
u_int32_t in = 0, out = 0, fwd = 0, time; u_int32_t in = 0, out = 0, fwd = 0, time;
iterator = this->policies->create_iterator(this->policies, TRUE); enumerator = create_policy_enumerator(this);
while (iterator->iterate(iterator, (void**)&policy)) while (enumerator->enumerate(enumerator, &my_ts, &other_ts))
{ {
if (charon->kernel_interface->query_policy(charon->kernel_interface, if (charon->kernel_interface->query_policy(charon->kernel_interface,
policy->other_ts, policy->my_ts, POLICY_IN, &time) == SUCCESS) other_ts, my_ts, POLICY_IN, &time) == SUCCESS)
{ {
in = max(in, time); in = max(in, time);
} }
if (charon->kernel_interface->query_policy(charon->kernel_interface, if (charon->kernel_interface->query_policy(charon->kernel_interface,
policy->my_ts, policy->other_ts, POLICY_OUT, &time) == SUCCESS) my_ts, other_ts, POLICY_OUT, &time) == SUCCESS)
{ {
out = max(out, time); out = max(out, time);
} }
if (charon->kernel_interface->query_policy(charon->kernel_interface, if (charon->kernel_interface->query_policy(charon->kernel_interface,
policy->other_ts, policy->my_ts, POLICY_FWD, &time) == SUCCESS) other_ts, my_ts, POLICY_FWD, &time) == SUCCESS)
{ {
fwd = max(fwd, time); fwd = max(fwd, time);
} }
} }
iterator->destroy(iterator); enumerator->destroy(enumerator);
*mode = this->mode; #define SET_PTR_IF(x, y) if (x) { *x = y; }
*encr_algo = this->enc_alg; SET_PTR_IF(mode, this->mode);
*encr_key = this->enc_key; SET_PTR_IF(encr_algo, this->enc_alg);
*int_algo = this->int_alg; SET_PTR_IF(encr_key_in, this->enc_key[0]);
*int_key = this->int_key; SET_PTR_IF(encr_key_out, this->enc_key[1]);
*rekey = this->rekey_time; SET_PTR_IF(int_algo, this->int_alg);
*use_in = in; SET_PTR_IF(int_key_in, this->int_key[0]);
*use_out = out; SET_PTR_IF(int_key_out, this->int_key[1]);
*use_fwd = fwd; SET_PTR_IF(rekey, this->rekey_time);
SET_PTR_IF(use_in, in);
SET_PTR_IF(use_out, out);
SET_PTR_IF(use_fwd, fwd);
} }
/** /**
@@ -349,8 +408,8 @@ static void get_stats(private_child_sa_t *this, ipsec_mode_t *mode,
*/ */
static void updown(private_child_sa_t *this, bool up) static void updown(private_child_sa_t *this, bool up)
{ {
sa_policy_t *policy; traffic_selector_t *my_ts, *other_ts;
iterator_t *iterator; enumerator_t *enumerator;
char *script; char *script;
script = this->config->get_updown(this->config); script = this->config->get_updown(this->config);
@@ -360,8 +419,8 @@ static void updown(private_child_sa_t *this, bool up)
return; return;
} }
iterator = this->policies->create_iterator(this->policies, TRUE); enumerator = create_policy_enumerator(this);
while (iterator->iterate(iterator, (void**)&policy)) while (enumerator->enumerate(enumerator, &my_ts, &other_ts))
{ {
char command[1024]; char command[1024];
char *my_client, *other_client, *my_client_mask, *other_client_mask; char *my_client, *other_client, *my_client_mask, *other_client_mask;
@@ -369,7 +428,7 @@ static void updown(private_child_sa_t *this, bool up)
FILE *shell; FILE *shell;
/* get subnet/bits from string */ /* get subnet/bits from string */
asprintf(&my_client, "%R", policy->my_ts); asprintf(&my_client, "%R", my_ts);
pos = strchr(my_client, '/'); pos = strchr(my_client, '/');
*pos = '\0'; *pos = '\0';
my_client_mask = pos + 1; my_client_mask = pos + 1;
@@ -378,7 +437,7 @@ static void updown(private_child_sa_t *this, bool up)
{ {
*pos = '\0'; *pos = '\0';
} }
asprintf(&other_client, "%R", policy->other_ts); asprintf(&other_client, "%R", other_ts);
pos = strchr(other_client, '/'); pos = strchr(other_client, '/');
*pos = '\0'; *pos = '\0';
other_client_mask = pos + 1; other_client_mask = pos + 1;
@@ -435,8 +494,7 @@ static void updown(private_child_sa_t *this, bool up)
"%s" "%s"
"%s", "%s",
up ? "up" : "down", up ? "up" : "down",
policy->my_ts->is_host(policy->my_ts, my_ts->is_host(my_ts, this->me.addr) ? "-host" : "-client",
this->me.addr) ? "-host" : "-client",
this->me.addr->get_family(this->me.addr) == AF_INET ? "" : "-v6", this->me.addr->get_family(this->me.addr) == AF_INET ? "" : "-v6",
this->config->get_name(this->config), this->config->get_name(this->config),
this->iface ? this->iface : "unknown", this->iface ? this->iface : "unknown",
@@ -445,14 +503,14 @@ static void updown(private_child_sa_t *this, bool up)
this->me.id, this->me.id,
my_client, my_client_mask, my_client, my_client_mask,
my_client, my_client_mask, my_client, my_client_mask,
policy->my_ts->get_from_port(policy->my_ts), my_ts->get_from_port(my_ts),
policy->my_ts->get_protocol(policy->my_ts), my_ts->get_protocol(my_ts),
this->other.addr, this->other.addr,
this->other.id, this->other.id,
other_client, other_client_mask, other_client, other_client_mask,
other_client, other_client_mask, other_client, other_client_mask,
policy->other_ts->get_from_port(policy->other_ts), other_ts->get_from_port(other_ts),
policy->other_ts->get_protocol(policy->other_ts), other_ts->get_protocol(other_ts),
virtual_ip, virtual_ip,
this->config->get_hostaccess(this->config) ? this->config->get_hostaccess(this->config) ?
"PLUTO_HOST_ACCESS='1' " : "", "PLUTO_HOST_ACCESS='1' " : "",
@@ -498,7 +556,7 @@ static void updown(private_child_sa_t *this, bool up)
} }
pclose(shell); pclose(shell);
} }
iterator->destroy(iterator); enumerator->destroy(enumerator);
} }
/** /**
@@ -666,7 +724,7 @@ static status_t install(private_child_sa_t *this, proposal_t *proposal,
add_keymat = 0; add_keymat = 0;
break; break;
} }
prf_plus->allocate_bytes(prf_plus, enc_size / 8, &this->enc_key); prf_plus->allocate_bytes(prf_plus, enc_size / 8, &this->enc_key[!!mine]);
} }
/* select integrity algo, derive key */ /* select integrity algo, derive key */
@@ -688,7 +746,7 @@ static status_t install(private_child_sa_t *this, proposal_t *proposal,
integrity_algorithm_names, this->int_alg); integrity_algorithm_names, this->int_alg);
return FAILED; return FAILED;
} }
prf_plus->allocate_bytes(prf_plus, int_size / 8, &this->int_key); prf_plus->allocate_bytes(prf_plus, int_size / 8, &this->int_key[!!mine]);
} }
/* send SA down to the kernel */ /* send SA down to the kernel */
@@ -706,9 +764,10 @@ static status_t install(private_child_sa_t *this, proposal_t *proposal,
soft = this->config->get_lifetime(this->config, TRUE); soft = this->config->get_lifetime(this->config, TRUE);
hard = this->config->get_lifetime(this->config, FALSE); hard = this->config->get_lifetime(this->config, FALSE);
status = charon->kernel_interface->add_sa(charon->kernel_interface, status = charon->kernel_interface->add_sa(charon->kernel_interface, src, dst,
src, dst, spi, this->protocol, this->reqid, mine ? soft : 0, hard, spi, this->protocol, this->reqid, mine ? soft : 0, hard,
this->enc_alg, this->enc_key, this->int_alg, this->int_key, this->enc_alg, this->enc_key[!!mine],
this->int_alg, this->int_key[!!mine],
mode, IPCOMP_NONE, this->encap, mine); mode, IPCOMP_NONE, this->encap, mine);
this->install_time = time(NULL); this->install_time = time(NULL);
@@ -777,85 +836,69 @@ static status_t add_policies(private_child_sa_t *this,
linked_list_t *my_ts_list, linked_list_t *other_ts_list, linked_list_t *my_ts_list, linked_list_t *other_ts_list,
ipsec_mode_t mode, protocol_id_t proto) ipsec_mode_t mode, protocol_id_t proto)
{ {
iterator_t *my_iter, *other_iter; enumerator_t *enumerator;
traffic_selector_t *my_ts, *other_ts; traffic_selector_t *my_ts, *other_ts;
/* use low prio for ROUTED policies */ status_t status = SUCCESS;
bool high_prio = (this->state != CHILD_CREATED); bool high_prio = TRUE;
if (this->state == CHILD_CREATED)
{ /* use low prio for ROUTED policies */
high_prio = FALSE;
}
if (this->protocol == PROTO_NONE) if (this->protocol == PROTO_NONE)
{ /* update if not set yet */ { /* update if not set yet */
this->protocol = proto; this->protocol = proto;
} }
/* iterate over both lists */ /* apply traffic selectors */
my_iter = my_ts_list->create_iterator(my_ts_list, TRUE); enumerator = my_ts_list->create_enumerator(my_ts_list);
other_iter = other_ts_list->create_iterator(other_ts_list, TRUE); while (enumerator->enumerate(enumerator, &my_ts))
while (my_iter->iterate(my_iter, (void**)&my_ts))
{ {
other_iter->reset(other_iter); this->my_ts->insert_last(this->my_ts, my_ts->clone(my_ts));
while (other_iter->iterate(other_iter, (void**)&other_ts)) }
enumerator->destroy(enumerator);
enumerator = other_ts_list->create_enumerator(other_ts_list);
while (enumerator->enumerate(enumerator, &other_ts))
{
this->other_ts->insert_last(this->other_ts, other_ts->clone(other_ts));
}
enumerator->destroy(enumerator);
/* enumerate pairs of traffic selectors */
enumerator = create_policy_enumerator(this);
while (enumerator->enumerate(enumerator, &my_ts, &other_ts))
{
/* install 3 policies: out, in and forward */
status |= charon->kernel_interface->add_policy(charon->kernel_interface,
this->me.addr, this->other.addr, my_ts, other_ts, POLICY_OUT,
this->protocol, this->reqid, high_prio, mode, this->ipcomp);
status |= charon->kernel_interface->add_policy(charon->kernel_interface,
this->other.addr, this->me.addr, other_ts, my_ts, POLICY_IN,
this->protocol, this->reqid, high_prio, mode, this->ipcomp);
status |= charon->kernel_interface->add_policy(charon->kernel_interface,
this->other.addr, this->me.addr, other_ts, my_ts, POLICY_FWD,
this->protocol, this->reqid, high_prio, mode, this->ipcomp);
if (status != SUCCESS)
{ {
/* set up policies for every entry in my_ts_list to every entry in other_ts_list */ break;
status_t status;
sa_policy_t *policy;
if (my_ts->get_type(my_ts) != other_ts->get_type(other_ts))
{
DBG2(DBG_CHD,
"CHILD_SA policy uses two different IP families - ignored");
continue;
}
/* only set up policies if protocol matches, or if one is zero (any) */
if (my_ts->get_protocol(my_ts) != other_ts->get_protocol(other_ts) &&
my_ts->get_protocol(my_ts) && other_ts->get_protocol(other_ts))
{
DBG2(DBG_CHD,
"CHILD_SA policy uses two different protocols - ignored");
continue;
}
/* install 3 policies: out, in and forward */
status = charon->kernel_interface->add_policy(charon->kernel_interface,
this->me.addr, this->other.addr, my_ts, other_ts, POLICY_OUT,
this->protocol, this->reqid, high_prio, mode, this->ipcomp);
status |= charon->kernel_interface->add_policy(charon->kernel_interface,
this->other.addr, this->me.addr, other_ts, my_ts, POLICY_IN,
this->protocol, this->reqid, high_prio, mode, this->ipcomp);
status |= charon->kernel_interface->add_policy(charon->kernel_interface,
this->other.addr, this->me.addr, other_ts, my_ts, POLICY_FWD,
this->protocol, this->reqid, high_prio, mode, this->ipcomp);
if (status != SUCCESS)
{
my_iter->destroy(my_iter);
other_iter->destroy(other_iter);
return status;
}
/* store policy to delete/update them later */
policy = malloc_thing(sa_policy_t);
policy->my_ts = my_ts->clone(my_ts);
policy->other_ts = other_ts->clone(other_ts);
this->policies->insert_last(this->policies, policy);
/* add to separate list to query them via get_*_traffic_selectors() */
this->my_ts->insert_last(this->my_ts, policy->my_ts);
this->other_ts->insert_last(this->other_ts, policy->other_ts);
} }
} }
my_iter->destroy(my_iter); enumerator->destroy(enumerator);
other_iter->destroy(other_iter);
/* switch to routed state if no SAD entry set up */ if (status == SUCCESS)
if (this->state == CHILD_CREATED)
{ {
set_state(this, CHILD_ROUTED); /* switch to routed state if no SAD entry set up */
if (this->state == CHILD_CREATED)
{
set_state(this, CHILD_ROUTED);
}
/* needed to update hosts */
this->mode = mode;
} }
/* needed to update hosts */ return status;
this->mode = mode;
return SUCCESS;
} }
/** /**
@@ -873,40 +916,38 @@ static linked_list_t *get_traffic_selectors(private_child_sa_t *this, bool local
/** /**
* Implementation of child_sa_t.get_use_time * Implementation of child_sa_t.get_use_time
*/ */
static status_t get_use_time(private_child_sa_t *this, bool inbound, time_t *use_time) static status_t get_use_time(private_child_sa_t *this,
bool inbound, time_t *use_time)
{ {
iterator_t *iterator; enumerator_t *enumerator;
sa_policy_t *policy; traffic_selector_t *my_ts, *other_ts;
status_t status = FAILED; status_t status = FAILED;
*use_time = UNDEFINED_TIME; *use_time = UNDEFINED_TIME;
iterator = this->policies->create_iterator(this->policies, TRUE); enumerator = create_policy_enumerator(this);
while (iterator->iterate(iterator, (void**)&policy)) while (enumerator->enumerate(enumerator, &my_ts, &other_ts))
{ {
if (inbound) if (inbound)
{ {
time_t in = UNDEFINED_TIME, fwd = UNDEFINED_TIME; time_t in = UNDEFINED_TIME, fwd = UNDEFINED_TIME;
status = charon->kernel_interface->query_policy( status = charon->kernel_interface->query_policy(
charon->kernel_interface, charon->kernel_interface, other_ts, my_ts,
policy->other_ts, policy->my_ts,
POLICY_IN, (u_int32_t*)&in); POLICY_IN, (u_int32_t*)&in);
status |= charon->kernel_interface->query_policy( status |= charon->kernel_interface->query_policy(
charon->kernel_interface, charon->kernel_interface, other_ts, my_ts,
policy->other_ts, policy->my_ts,
POLICY_FWD, (u_int32_t*)&fwd); POLICY_FWD, (u_int32_t*)&fwd);
*use_time = max(in, fwd); *use_time = max(in, fwd);
} }
else else
{ {
status = charon->kernel_interface->query_policy( status = charon->kernel_interface->query_policy(
charon->kernel_interface, charon->kernel_interface, my_ts, other_ts,
policy->my_ts, policy->other_ts,
POLICY_OUT, (u_int32_t*)use_time); POLICY_OUT, (u_int32_t*)use_time);
} }
} }
iterator->destroy(iterator); enumerator->destroy(enumerator);
return status; return status;
} }
@@ -948,31 +989,31 @@ static status_t update_hosts(private_child_sa_t *this,
if (!me->ip_equals(me, this->me.addr) || if (!me->ip_equals(me, this->me.addr) ||
!other->ip_equals(other, this->other.addr)) !other->ip_equals(other, this->other.addr))
{ {
iterator_t *iterator; enumerator_t *enumerator;
sa_policy_t *policy; traffic_selector_t *my_ts, *other_ts;
/* always use high priorities, as hosts getting updated are INSTALLED */ /* always use high priorities, as hosts getting updated are INSTALLED */
iterator = this->policies->create_iterator(this->policies, TRUE); enumerator = create_policy_enumerator(this);
while (iterator->iterate(iterator, (void**)&policy)) while (enumerator->enumerate(enumerator, &my_ts, &other_ts))
{ {
/* remove old policies first */ /* remove old policies first */
charon->kernel_interface->del_policy(charon->kernel_interface, charon->kernel_interface->del_policy(charon->kernel_interface,
policy->my_ts, policy->other_ts, POLICY_OUT); my_ts, other_ts, POLICY_OUT);
charon->kernel_interface->del_policy(charon->kernel_interface, charon->kernel_interface->del_policy(charon->kernel_interface,
policy->other_ts, policy->my_ts, POLICY_IN); other_ts, my_ts, POLICY_IN);
charon->kernel_interface->del_policy(charon->kernel_interface, charon->kernel_interface->del_policy(charon->kernel_interface,
policy->other_ts, policy->my_ts, POLICY_FWD); other_ts, my_ts, POLICY_FWD);
/* check whether we have to update a "dynamic" traffic selector */ /* check whether we have to update a "dynamic" traffic selector */
if (!me->ip_equals(me, this->me.addr) && if (!me->ip_equals(me, this->me.addr) &&
policy->my_ts->is_host(policy->my_ts, this->me.addr)) my_ts->is_host(my_ts, this->me.addr))
{ {
policy->my_ts->set_address(policy->my_ts, me); my_ts->set_address(my_ts, me);
} }
if (!other->ip_equals(other, this->other.addr) && if (!other->ip_equals(other, this->other.addr) &&
policy->other_ts->is_host(policy->other_ts, this->other.addr)) other_ts->is_host(other_ts, this->other.addr))
{ {
policy->other_ts->set_address(policy->other_ts, other); other_ts->set_address(other_ts, other);
} }
/* we reinstall the virtual IP to handle interface roaming /* we reinstall the virtual IP to handle interface roaming
@@ -987,16 +1028,16 @@ static status_t update_hosts(private_child_sa_t *this,
/* reinstall updated policies */ /* reinstall updated policies */
charon->kernel_interface->add_policy(charon->kernel_interface, charon->kernel_interface->add_policy(charon->kernel_interface,
me, other, policy->my_ts, policy->other_ts, POLICY_OUT, me, other, my_ts, other_ts, POLICY_OUT, this->protocol,
this->protocol, this->reqid, TRUE, this->mode, this->ipcomp); this->reqid, TRUE, this->mode, this->ipcomp);
charon->kernel_interface->add_policy(charon->kernel_interface, charon->kernel_interface->add_policy(charon->kernel_interface,
other, me, policy->other_ts, policy->my_ts, POLICY_IN, other, me, other_ts, my_ts, POLICY_IN, this->protocol,
this->protocol, this->reqid, TRUE, this->mode, this->ipcomp); this->reqid, TRUE, this->mode, this->ipcomp);
charon->kernel_interface->add_policy(charon->kernel_interface, charon->kernel_interface->add_policy(charon->kernel_interface,
other, me, policy->other_ts, policy->my_ts, POLICY_FWD, other, me, other_ts, my_ts, POLICY_FWD, this->protocol,
this->protocol, this->reqid, TRUE, this->mode, this->ipcomp); this->reqid, TRUE, this->mode, this->ipcomp);
} }
iterator->destroy(iterator); enumerator->destroy(enumerator);
} }
/* apply hosts */ /* apply hosts */
@@ -1054,7 +1095,8 @@ static u_int16_t allocate_cpi(private_child_sa_t *this)
*/ */
static void destroy(private_child_sa_t *this) static void destroy(private_child_sa_t *this)
{ {
sa_policy_t *policy; enumerator_t *enumerator;
traffic_selector_t *my_ts, *other_ts;
if (this->state == CHILD_DELETING || this->state == CHILD_INSTALLED) if (this->state == CHILD_DELETING || this->state == CHILD_INSTALLED)
{ {
@@ -1067,59 +1109,53 @@ static void destroy(private_child_sa_t *this)
if (this->me.spi) if (this->me.spi)
{ {
charon->kernel_interface->del_sa(charon->kernel_interface, charon->kernel_interface->del_sa(charon->kernel_interface,
this->me.addr, this->me.spi, this->protocol); this->me.addr, this->me.spi, this->protocol);
} }
if (this->alloc_esp_spi && this->alloc_esp_spi != this->me.spi) if (this->alloc_esp_spi && this->alloc_esp_spi != this->me.spi)
{ {
charon->kernel_interface->del_sa(charon->kernel_interface, charon->kernel_interface->del_sa(charon->kernel_interface,
this->me.addr, this->alloc_esp_spi, PROTO_ESP); this->me.addr, this->alloc_esp_spi, PROTO_ESP);
} }
if (this->alloc_ah_spi && this->alloc_ah_spi != this->me.spi) if (this->alloc_ah_spi && this->alloc_ah_spi != this->me.spi)
{ {
charon->kernel_interface->del_sa(charon->kernel_interface, charon->kernel_interface->del_sa(charon->kernel_interface,
this->me.addr, this->alloc_ah_spi, PROTO_AH); this->me.addr, this->alloc_ah_spi, PROTO_AH);
} }
if (this->other.spi) if (this->other.spi)
{ {
charon->kernel_interface->del_sa(charon->kernel_interface, charon->kernel_interface->del_sa(charon->kernel_interface,
this->other.addr, this->other.spi, this->protocol); this->other.addr, this->other.spi, this->protocol);
} }
if (this->me.cpi) if (this->me.cpi)
{ {
charon->kernel_interface->del_sa(charon->kernel_interface, charon->kernel_interface->del_sa(charon->kernel_interface,
this->me.addr, htonl(ntohs(this->me.cpi)), IPPROTO_COMP); this->me.addr, htonl(ntohs(this->me.cpi)), IPPROTO_COMP);
} }
if (this->other.cpi) if (this->other.cpi)
{ {
charon->kernel_interface->del_sa(charon->kernel_interface, charon->kernel_interface->del_sa(charon->kernel_interface,
this->other.addr, htonl(ntohs(this->other.cpi)), IPPROTO_COMP); this->other.addr, htonl(ntohs(this->other.cpi)), IPPROTO_COMP);
} }
/* delete all policies in the kernel */ /* delete all policies in the kernel */
while (this->policies->remove_last(this->policies, (void**)&policy) == SUCCESS) enumerator = create_policy_enumerator(this);
while (enumerator->enumerate(enumerator, &my_ts, &other_ts))
{ {
/* let rekeyed policies, as they are used by another child_sa */
charon->kernel_interface->del_policy(charon->kernel_interface, charon->kernel_interface->del_policy(charon->kernel_interface,
policy->my_ts, policy->other_ts, my_ts, other_ts, POLICY_OUT);
POLICY_OUT);
charon->kernel_interface->del_policy(charon->kernel_interface, charon->kernel_interface->del_policy(charon->kernel_interface,
policy->other_ts, policy->my_ts, other_ts, my_ts, POLICY_IN);
POLICY_IN);
charon->kernel_interface->del_policy(charon->kernel_interface, charon->kernel_interface->del_policy(charon->kernel_interface,
policy->other_ts, policy->my_ts, other_ts, my_ts, POLICY_FWD);
POLICY_FWD);
policy->my_ts->destroy(policy->my_ts);
policy->other_ts->destroy(policy->other_ts);
free(policy);
} }
this->policies->destroy(this->policies); enumerator->destroy(enumerator);
chunk_clear(&this->enc_key); chunk_clear(&this->enc_key[0]);
chunk_clear(&this->int_key); chunk_clear(&this->enc_key[1]);
this->my_ts->destroy(this->my_ts); chunk_clear(&this->int_key[0]);
this->other_ts->destroy(this->other_ts); chunk_clear(&this->int_key[1]);
this->my_ts->destroy_offset(this->my_ts, offsetof(traffic_selector_t, destroy));
this->other_ts->destroy_offset(this->other_ts, offsetof(traffic_selector_t, destroy));
this->me.addr->destroy(this->me.addr); this->me.addr->destroy(this->me.addr);
this->other.addr->destroy(this->other.addr); this->other.addr->destroy(this->other.addr);
this->me.id->destroy(this->me.id); this->me.id->destroy(this->me.id);
@@ -1146,13 +1182,14 @@ child_sa_t * child_sa_create(host_t *me, host_t* other,
this->public.get_spi = (u_int32_t(*)(child_sa_t*, bool))get_spi; this->public.get_spi = (u_int32_t(*)(child_sa_t*, bool))get_spi;
this->public.get_cpi = (u_int16_t(*)(child_sa_t*, bool))get_cpi; this->public.get_cpi = (u_int16_t(*)(child_sa_t*, bool))get_cpi;
this->public.get_protocol = (protocol_id_t(*)(child_sa_t*))get_protocol; this->public.get_protocol = (protocol_id_t(*)(child_sa_t*))get_protocol;
this->public.get_stats = (void(*)(child_sa_t*, ipsec_mode_t*,encryption_algorithm_t*,chunk_t*,integrity_algorithm_t*,chunk_t*,u_int32_t*,u_int32_t*,u_int32_t*,u_int32_t*))get_stats; this->public.get_stats = (void(*)(child_sa_t*, ipsec_mode_t*,encryption_algorithm_t*,chunk_t*,chunk_t*,integrity_algorithm_t*,chunk_t*,chunk_t*,u_int32_t*,u_int32_t*,u_int32_t*,u_int32_t*))get_stats;
this->public.alloc = (status_t(*)(child_sa_t*,linked_list_t*))alloc; this->public.alloc = (status_t(*)(child_sa_t*,linked_list_t*))alloc;
this->public.add = (status_t(*)(child_sa_t*,proposal_t*,ipsec_mode_t,prf_plus_t*))add; this->public.add = (status_t(*)(child_sa_t*,proposal_t*,ipsec_mode_t,prf_plus_t*))add;
this->public.update = (status_t(*)(child_sa_t*,proposal_t*,ipsec_mode_t,prf_plus_t*))update; this->public.update = (status_t(*)(child_sa_t*,proposal_t*,ipsec_mode_t,prf_plus_t*))update;
this->public.update_hosts = (status_t (*)(child_sa_t*,host_t*,host_t*,bool))update_hosts; this->public.update_hosts = (status_t (*)(child_sa_t*,host_t*,host_t*,bool))update_hosts;
this->public.add_policies = (status_t (*)(child_sa_t*, linked_list_t*,linked_list_t*,ipsec_mode_t,protocol_id_t))add_policies; this->public.add_policies = (status_t (*)(child_sa_t*, linked_list_t*,linked_list_t*,ipsec_mode_t,protocol_id_t))add_policies;
this->public.get_traffic_selectors = (linked_list_t*(*)(child_sa_t*,bool))get_traffic_selectors; this->public.get_traffic_selectors = (linked_list_t*(*)(child_sa_t*,bool))get_traffic_selectors;
this->public.create_policy_enumerator = (enumerator_t*(*)(child_sa_t*))create_policy_enumerator;
this->public.get_use_time = (status_t (*)(child_sa_t*,bool,time_t*))get_use_time; this->public.get_use_time = (status_t (*)(child_sa_t*,bool,time_t*))get_use_time;
this->public.set_state = (void(*)(child_sa_t*,child_sa_state_t))set_state; this->public.set_state = (void(*)(child_sa_t*,child_sa_state_t))set_state;
this->public.get_state = (child_sa_state_t(*)(child_sa_t*))get_state; this->public.get_state = (child_sa_state_t(*)(child_sa_t*))get_state;
@@ -1180,10 +1217,9 @@ child_sa_t * child_sa_create(host_t *me, host_t* other,
/* reuse old reqid if we are rekeying an existing CHILD_SA */ /* reuse old reqid if we are rekeying an existing CHILD_SA */
this->reqid = rekey ? rekey : ++reqid; this->reqid = rekey ? rekey : ++reqid;
this->enc_alg = ENCR_UNDEFINED; this->enc_alg = ENCR_UNDEFINED;
this->enc_key = chunk_empty; this->enc_key[0] = this->enc_key[1] = chunk_empty;
this->int_alg = AUTH_UNDEFINED; this->int_alg = AUTH_UNDEFINED;
this->int_key = chunk_empty; this->int_key[0] = this->int_key[1] = chunk_empty;
this->policies = linked_list_create();
this->my_ts = linked_list_create(); this->my_ts = linked_list_create();
this->other_ts = linked_list_create(); this->other_ts = linked_list_create();
this->protocol = PROTO_NONE; this->protocol = PROTO_NONE;
src/charon/sa/child_sa.h
+11 -2
View File
@@ -156,8 +156,10 @@ struct child_sa_t {
* @param use_fwd time when last traffic was getting forwarded * @param use_fwd time when last traffic was getting forwarded
*/ */
void (*get_stats)(child_sa_t *this, ipsec_mode_t *mode, void (*get_stats)(child_sa_t *this, ipsec_mode_t *mode,
encryption_algorithm_t *encr, chunk_t *encr_key, encryption_algorithm_t *encr,
integrity_algorithm_t *int_algo, chunk_t *int_key, chunk_t *encr_key_in, chunk_t *encr_key_out,
integrity_algorithm_t *int_algo,
chunk_t *int_key_in, chunk_t *int_key_out,
u_int32_t *rekey, u_int32_t *use_in, u_int32_t *use_out, u_int32_t *rekey, u_int32_t *use_in, u_int32_t *use_out,
u_int32_t *use_fwd); u_int32_t *use_fwd);
@@ -235,6 +237,13 @@ struct child_sa_t {
*/ */
linked_list_t* (*get_traffic_selectors) (child_sa_t *this, bool local); linked_list_t* (*get_traffic_selectors) (child_sa_t *this, bool local);
/**
* Create an enumerator over installed policies.
*
* @return enumerator over pairs of traffic selectors.
*/
enumerator_t* (*create_policy_enumerator)(child_sa_t *this);
/** /**
* Get the time of this child_sa_t's last use (i.e. last use of any of its policies) * Get the time of this child_sa_t's last use (i.e. last use of any of its policies)
* *