denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

pluto: Adapted kernel.c to changed kernel interface.

Browse Source
This commit is contained in:
Tobias Brunner
2010-09-02 19:04:22 +02:00
parent 71b6d2ff5e
commit 40bbff5dbf
1 changed files with 45 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/pluto/kernel.c
+45 -47
View File
@@ -159,19 +159,13 @@ static void set_text_said(char *text_said, const ip_address *dst,
bool no_klips = FALSE; /* don't actually use KLIPS */ bool no_klips = FALSE; /* don't actually use KLIPS */
/** /**
* Struct to store information about the SAs to install in the kernel * Default IPsec SA config (e.g. to install trap policies).
*/ */
struct kernel_proto_info { static ipsec_sa_cfg_t null_ipsec_sa = {
ipsec_mode_t mode;
u_int32_t esp_spi;
u_int32_t ah_spi;
u_int32_t reqid;
u_int16_t ipcomp;
u_int16_t cpi;
};
static const struct kernel_proto_info null_proto_info = {
.mode = MODE_TRANSPORT, .mode = MODE_TRANSPORT,
.esp = {
.use = TRUE,
},
}; };
/** /**
@@ -942,7 +936,7 @@ static bool raw_eroute(const ip_address *this_host,
unsigned int proto, unsigned int proto,
unsigned int satype, unsigned int satype,
unsigned int transport_proto, unsigned int transport_proto,
const struct kernel_proto_info *pi, ipsec_sa_cfg_t *sa,
time_t use_lifetime, time_t use_lifetime,
unsigned int op, unsigned int op,
const char *opname USED_BY_DEBUG) const char *opname USED_BY_DEBUG)
@@ -1016,9 +1010,8 @@ static bool raw_eroute(const ip_address *this_host,
{ {
/* FIXME: use_lifetime? */ /* FIXME: use_lifetime? */
ok = hydra->kernel_interface->add_policy(hydra->kernel_interface, ok = hydra->kernel_interface->add_policy(hydra->kernel_interface,
host_src, host_dst, ts_src, ts_dst, dir, type, host_src, host_dst, ts_src, ts_dst, dir, type, sa,
pi->esp_spi, pi->ah_spi, pi->reqid, mark_none, pi->mode, mark_none, routed) == SUCCESS;
pi->ipcomp, pi->cpi, routed) == SUCCESS;
} }
if (dir == POLICY_IN) if (dir == POLICY_IN)
@@ -1031,13 +1024,12 @@ static bool raw_eroute(const ip_address *this_host,
} }
if (!deleting && ok && if (!deleting && ok &&
(pi->mode == MODE_TUNNEL || satype == SADB_X_SATYPE_INT)) (sa->mode == MODE_TUNNEL || satype == SADB_X_SATYPE_INT))
{ {
/* FIXME: use_lifetime? */ /* FIXME: use_lifetime? */
ok = hydra->kernel_interface->add_policy(hydra->kernel_interface, ok = hydra->kernel_interface->add_policy(hydra->kernel_interface,
host_src, host_dst, ts_src, ts_dst, dir, type, host_src, host_dst, ts_src, ts_dst, dir, type, sa,
pi->esp_spi, pi->ah_spi, pi->reqid, mark_none, pi->mode, mark_none, routed) == SUCCESS;
pi->ipcomp, pi->cpi, routed) == SUCCESS;
} }
} }
@@ -1094,7 +1086,7 @@ bool replace_bare_shunt(const ip_address *src, const ip_address *dst,
{ {
if (raw_eroute(null_host, &this_broad_client, null_host, if (raw_eroute(null_host, &this_broad_client, null_host,
&that_broad_client, htonl(shunt_spi), SA_INT, &that_broad_client, htonl(shunt_spi), SA_INT,
SADB_X_SATYPE_INT, 0, &null_proto_info, SADB_X_SATYPE_INT, 0, &null_ipsec_sa,
SHUNT_PATIENCE, ERO_ADD, why)) SHUNT_PATIENCE, ERO_ADD, why))
{ {
struct bare_shunt *bs = malloc_thing(struct bare_shunt); struct bare_shunt *bs = malloc_thing(struct bare_shunt);
@@ -1119,7 +1111,7 @@ bool replace_bare_shunt(const ip_address *src, const ip_address *dst,
if (raw_eroute(null_host, &this_client, null_host, &that_client, if (raw_eroute(null_host, &this_client, null_host, &that_client,
htonl(shunt_spi), SA_INT, SADB_X_SATYPE_INT, transport_proto, htonl(shunt_spi), SA_INT, SADB_X_SATYPE_INT, transport_proto,
&null_proto_info, SHUNT_PATIENCE, ERO_DELETE, why)) &null_ipsec_sa, SHUNT_PATIENCE, ERO_DELETE, why))
{ {
struct bare_shunt **bs_pp = bare_shunt_ptr(&this_client, &that_client struct bare_shunt **bs_pp = bare_shunt_ptr(&this_client, &that_client
, transport_proto); , transport_proto);
@@ -1136,8 +1128,8 @@ bool replace_bare_shunt(const ip_address *src, const ip_address *dst,
static bool eroute_connection(struct spd_route *sr, ipsec_spi_t spi, static bool eroute_connection(struct spd_route *sr, ipsec_spi_t spi,
unsigned int proto, unsigned int satype, unsigned int proto, unsigned int satype,
const struct kernel_proto_info *proto_info, ipsec_sa_cfg_t *sa, unsigned int op,
unsigned int op, const char *opname) const char *opname)
{ {
const ip_address *peer = &sr->that.host_addr; const ip_address *peer = &sr->that.host_addr;
char buf2[256]; char buf2[256];
@@ -1151,7 +1143,7 @@ static bool eroute_connection(struct spd_route *sr, ipsec_spi_t spi,
} }
return raw_eroute(&sr->this.host_addr, &sr->this.client, peer, return raw_eroute(&sr->this.host_addr, &sr->this.client, peer,
&sr->that.client, spi, proto, satype, sr->this.protocol, &sr->that.client, spi, proto, satype, sr->this.protocol,
proto_info, 0, op, buf2); sa, 0, op, buf2);
} }
/* assign a bare hold to a connection */ /* assign a bare hold to a connection */
@@ -1195,10 +1187,10 @@ bool assign_hold(connection_t *c USED_BY_DEBUG, struct spd_route *sr,
{ {
if (erouted(ro) if (erouted(ro)
? !eroute_connection(sr, htonl(SPI_HOLD), SA_INT, SADB_X_SATYPE_INT, ? !eroute_connection(sr, htonl(SPI_HOLD), SA_INT, SADB_X_SATYPE_INT,
&null_proto_info, ERO_REPLACE, &null_ipsec_sa, ERO_REPLACE,
"replace %trap with broad %hold") "replace %trap with broad %hold")
: !eroute_connection(sr, htonl(SPI_HOLD), SA_INT, SADB_X_SATYPE_INT, : !eroute_connection(sr, htonl(SPI_HOLD), SA_INT, SADB_X_SATYPE_INT,
&null_proto_info, ERO_ADD, "add broad %hold")) &null_ipsec_sa, ERO_ADD, "add broad %hold"))
{ {
return FALSE; return FALSE;
} }
@@ -1218,7 +1210,7 @@ static bool sag_eroute(struct state *st, struct spd_route *sr,
{ {
u_int inner_proto, inner_satype; u_int inner_proto, inner_satype;
ipsec_spi_t inner_spi = 0; ipsec_spi_t inner_spi = 0;
struct kernel_proto_info proto_info = { ipsec_sa_cfg_t sa = {
.mode = MODE_TRANSPORT, .mode = MODE_TRANSPORT,
}; };
bool tunnel = FALSE; bool tunnel = FALSE;
@@ -1228,7 +1220,8 @@ static bool sag_eroute(struct state *st, struct spd_route *sr,
inner_spi = st->st_ah.attrs.spi; inner_spi = st->st_ah.attrs.spi;
inner_proto = SA_AH; inner_proto = SA_AH;
inner_satype = SADB_SATYPE_AH; inner_satype = SADB_SATYPE_AH;
proto_info.ah_spi = inner_spi; sa.ah.use = TRUE;
sa.ah.spi = inner_spi;
tunnel |= st->st_ah.attrs.encapsulation == ENCAPSULATION_MODE_TUNNEL; tunnel |= st->st_ah.attrs.encapsulation == ENCAPSULATION_MODE_TUNNEL;
} }
@@ -1237,7 +1230,8 @@ static bool sag_eroute(struct state *st, struct spd_route *sr,
inner_spi = st->st_esp.attrs.spi; inner_spi = st->st_esp.attrs.spi;
inner_proto = SA_ESP; inner_proto = SA_ESP;
inner_satype = SADB_SATYPE_ESP; inner_satype = SADB_SATYPE_ESP;
proto_info.esp_spi = inner_spi; sa.esp.use = TRUE;
sa.esp.spi = inner_spi;
tunnel |= st->st_esp.attrs.encapsulation == ENCAPSULATION_MODE_TUNNEL; tunnel |= st->st_esp.attrs.encapsulation == ENCAPSULATION_MODE_TUNNEL;
} }
@@ -1246,12 +1240,12 @@ static bool sag_eroute(struct state *st, struct spd_route *sr,
inner_spi = st->st_ipcomp.attrs.spi; inner_spi = st->st_ipcomp.attrs.spi;
inner_proto = SA_COMP; inner_proto = SA_COMP;
inner_satype = SADB_X_SATYPE_COMP; inner_satype = SADB_X_SATYPE_COMP;
proto_info.cpi = htons(ntohl(inner_spi)); sa.ipcomp.transform = st->st_ipcomp.attrs.transid;
proto_info.ipcomp = st->st_ipcomp.attrs.transid; sa.ipcomp.cpi = htons(ntohl(inner_spi));
tunnel |= st->st_ipcomp.attrs.encapsulation == ENCAPSULATION_MODE_TUNNEL; tunnel |= st->st_ipcomp.attrs.encapsulation == ENCAPSULATION_MODE_TUNNEL;
} }
if (!inner_spi) if (!sa.ah.use && !sa.esp.use && !sa.ipcomp.transform)
{ {
impossible(); /* no transform at all! */ impossible(); /* no transform at all! */
} }
@@ -1261,13 +1255,13 @@ static bool sag_eroute(struct state *st, struct spd_route *sr,
inner_spi = st->st_tunnel_out_spi; inner_spi = st->st_tunnel_out_spi;
inner_proto = SA_IPIP; inner_proto = SA_IPIP;
inner_satype = SADB_X_SATYPE_IPIP; inner_satype = SADB_X_SATYPE_IPIP;
proto_info.mode = MODE_TUNNEL; sa.mode = MODE_TUNNEL;
} }
proto_info.reqid = sr->reqid; sa.reqid = sr->reqid;
return eroute_connection(sr, inner_spi, inner_proto, inner_satype, return eroute_connection(sr, inner_spi, inner_proto, inner_satype,
&proto_info, op, opname); &sa, op, opname);
} }
/* compute a (host-order!) SPI to implement the policy in connection c */ /* compute a (host-order!) SPI to implement the policy in connection c */
@@ -1375,11 +1369,11 @@ static bool shunt_eroute(connection_t *c, struct spd_route *sr,
ok = raw_eroute(&c->spd.that.host_addr, &c->spd.that.client, ok = raw_eroute(&c->spd.that.host_addr, &c->spd.that.client,
&c->spd.this.host_addr, &c->spd.this.client, htonl(spi), &c->spd.this.host_addr, &c->spd.this.client, htonl(spi),
SA_INT, SADB_X_SATYPE_INT, 0, &null_proto_info, 0, SA_INT, SADB_X_SATYPE_INT, 0, &null_ipsec_sa, 0,
op | (SADB_X_SAFLAGS_INFLOW << ERO_FLAG_SHIFT), opname); op | (SADB_X_SAFLAGS_INFLOW << ERO_FLAG_SHIFT), opname);
return eroute_connection(sr, htonl(spi), SA_INT, SADB_X_SATYPE_INT, return eroute_connection(sr, htonl(spi), SA_INT, SADB_X_SATYPE_INT,
&null_proto_info, op, opname) && ok; &null_ipsec_sa, op, opname) && ok;
} }
static bool setup_half_ipsec_sa(struct state *st, bool inbound) static bool setup_half_ipsec_sa(struct state *st, bool inbound)
@@ -1388,7 +1382,7 @@ static bool setup_half_ipsec_sa(struct state *st, bool inbound)
connection_t *c = st->st_connection; connection_t *c = st->st_connection;
struct end *src, *dst; struct end *src, *dst;
ipsec_mode_t mode = MODE_TRANSPORT; ipsec_mode_t mode = MODE_TRANSPORT;
struct kernel_proto_info proto_info = { .mode = 0 }; ipsec_sa_cfg_t sa = { .mode = 0 };
lifetime_cfg_t lt_none = { .time = { .rekey = 0 } }; lifetime_cfg_t lt_none = { .time = { .rekey = 0 } };
mark_t mark_none = { 0, 0 }; mark_t mark_none = { 0, 0 };
bool ok = TRUE; bool ok = TRUE;
@@ -1415,8 +1409,8 @@ static bool setup_half_ipsec_sa(struct state *st, bool inbound)
mode = MODE_TUNNEL; mode = MODE_TUNNEL;
} }
proto_info.mode = mode; sa.mode = mode;
proto_info.reqid = c->spd.reqid; sa.reqid = c->spd.reqid;
memset(said, 0, sizeof(said)); memset(said, 0, sizeof(said));
@@ -1439,8 +1433,8 @@ static bool setup_half_ipsec_sa(struct state *st, bool inbound)
goto fail; goto fail;
} }
proto_info.cpi = htons(ntohl(ipcomp_spi)); sa.ipcomp.cpi = htons(ntohl(ipcomp_spi));
proto_info.ipcomp = st->st_ipcomp.attrs.transid; sa.ipcomp.transform = st->st_ipcomp.attrs.transid;
said_next->spi = ipcomp_spi; said_next->spi = ipcomp_spi;
said_next->proto = IPPROTO_COMP; said_next->proto = IPPROTO_COMP;
@@ -1548,7 +1542,9 @@ static bool setup_half_ipsec_sa(struct state *st, bool inbound)
auth_key.ptr = esp_dst_keymat + key_len; auth_key.ptr = esp_dst_keymat + key_len;
auth_key.len = ei->authkeylen; auth_key.len = ei->authkeylen;
proto_info.esp_spi = esp_spi; sa.esp.use = TRUE;
sa.esp.spi = esp_spi;
said_next->spi = esp_spi; said_next->spi = esp_spi;
said_next->proto = IPPROTO_ESP; said_next->proto = IPPROTO_ESP;
@@ -1579,7 +1575,9 @@ static bool setup_half_ipsec_sa(struct state *st, bool inbound)
auth_key.ptr = ah_dst_keymat; auth_key.ptr = ah_dst_keymat;
auth_key.len = st->st_ah.keymat_len; auth_key.len = st->st_ah.keymat_len;
proto_info.ah_spi = ah_spi; sa.ah.use = TRUE;
sa.ah.spi = ah_spi;
said_next->spi = ah_spi; said_next->spi = ah_spi;
said_next->proto = IPPROTO_AH; said_next->proto = IPPROTO_AH;
@@ -1599,7 +1597,7 @@ static bool setup_half_ipsec_sa(struct state *st, bool inbound)
{ {
(void) raw_eroute(&src->host_addr, &src->client, &dst->host_addr, (void) raw_eroute(&src->host_addr, &src->client, &dst->host_addr,
&dst->client, 256, SA_IPIP, SADB_SATYPE_UNSPEC, &dst->client, 256, SA_IPIP, SADB_SATYPE_UNSPEC,
c->spd.this.protocol, &proto_info, 0, ERO_ADD_INBOUND, c->spd.this.protocol, &sa, 0, ERO_ADD_INBOUND,
"add inbound"); "add inbound");
} }
@@ -1641,7 +1639,7 @@ static bool teardown_half_ipsec_sa(struct state *st, bool inbound)
(void) raw_eroute(&src->host_addr, &src->client, &dst->host_addr, (void) raw_eroute(&src->host_addr, &src->client, &dst->host_addr,
&dst->client, 256, IPSEC_PROTO_ANY, &dst->client, 256, IPSEC_PROTO_ANY,
SADB_SATYPE_UNSPEC, c->spd.this.protocol, SADB_SATYPE_UNSPEC, c->spd.this.protocol,
&null_proto_info, 0, ERO_DEL_INBOUND, &null_ipsec_sa, 0, ERO_DEL_INBOUND,
"delete inbound"); "delete inbound");
} }
} }
@@ -2130,7 +2128,7 @@ bool route_and_eroute(connection_t *c USED_BY_KLIPS,
&bs->his, &bs->his,
bs->said.spi, /* network order */ bs->said.spi, /* network order */
SA_INT, SADB_X_SATYPE_INT, 0, SA_INT, SADB_X_SATYPE_INT, 0,
&null_proto_info, SHUNT_PATIENCE, &null_ipsec_sa, SHUNT_PATIENCE,
ERO_REPLACE, "restore"); ERO_REPLACE, "restore");
} }
else if (ero != NULL) else if (ero != NULL)