denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Use XFRM instead of PF_KEY IKE bypass policies in netlink based kernel interface

Browse Source
This commit is contained in:
Martin Willi
2009-10-30 11:19:32 +01:00
parent f893bce3e7
commit 4a38687ae7
1 changed files with 12 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/charon/plugins/kernel_netlink/kernel_netlink_ipsec.c
+12 -23
View File
@@ -51,14 +51,14 @@
#endif #endif
/** from linux/in.h */ /** from linux/in.h */
#ifndef IP_IPSEC_POLICY #ifndef IP_XFRM_POLICY
#define IP_IPSEC_POLICY 16 #define IP_XFRM_POLICY 17
#endif #endif
/* missing on uclibc */ /* missing on uclibc */
#ifndef IPV6_IPSEC_POLICY #ifndef IPV6_XFRM_POLICY
#define IPV6_IPSEC_POLICY 34 #define IPV6_XFRM_POLICY 34
#endif /*IPV6_IPSEC_POLICY*/ #endif /*IPV6_XFRM_POLICY*/
/** default priority of installed policies */ /** default priority of installed policies */
#define PRIO_LOW 3000 #define PRIO_LOW 3000
@@ -1908,42 +1908,31 @@ static bool add_bypass_policies()
enumerator_t *sockets; enumerator_t *sockets;
bool status = TRUE; bool status = TRUE;
/* we open an AF_KEY socket to autoload the af_key module. Otherwise
* setsockopt(IPSEC_POLICY) won't work. */
fd = socket(AF_KEY, SOCK_RAW, PF_KEY_V2);
if (fd == 0)
{
DBG1(DBG_KNL, "could not open AF_KEY socket");
return FALSE;
}
close(fd);
sockets = charon->socket->create_enumerator(charon->socket); sockets = charon->socket->create_enumerator(charon->socket);
while (sockets->enumerate(sockets, &fd, &family, &port)) while (sockets->enumerate(sockets, &fd, &family, &port))
{ {
struct sadb_x_policy policy; struct xfrm_userpolicy_info policy;
u_int sol, ipsec_policy; u_int sol, ipsec_policy;
switch (family) switch (family)
{ {
case AF_INET: case AF_INET:
sol = SOL_IP; sol = SOL_IP;
ipsec_policy = IP_IPSEC_POLICY; ipsec_policy = IP_XFRM_POLICY;
break; break;
case AF_INET6: case AF_INET6:
sol = SOL_IPV6; sol = SOL_IPV6;
ipsec_policy = IPV6_IPSEC_POLICY; ipsec_policy = IPV6_XFRM_POLICY;
break; break;
default: default:
continue; continue;
} }
memset(&policy, 0, sizeof(policy)); memset(&policy, 0, sizeof(policy));
policy.sadb_x_policy_len = sizeof(policy) / sizeof(u_int64_t); policy.action = XFRM_POLICY_ALLOW;
policy.sadb_x_policy_exttype = SADB_X_EXT_POLICY; policy.sel.family = family;
policy.sadb_x_policy_type = IPSEC_POLICY_BYPASS;
policy.sadb_x_policy_dir = IPSEC_DIR_OUTBOUND; policy.dir = XFRM_POLICY_OUT;
if (setsockopt(fd, sol, ipsec_policy, &policy, sizeof(policy)) < 0) if (setsockopt(fd, sol, ipsec_policy, &policy, sizeof(policy)) < 0)
{ {
DBG1(DBG_KNL, "unable to set IPSEC_POLICY on socket: %s", DBG1(DBG_KNL, "unable to set IPSEC_POLICY on socket: %s",
@@ -1951,7 +1940,7 @@ static bool add_bypass_policies()
status = FALSE; status = FALSE;
break; break;
} }
policy.sadb_x_policy_dir = IPSEC_DIR_INBOUND; policy.dir = XFRM_POLICY_IN;
if (setsockopt(fd, sol, ipsec_policy, &policy, sizeof(policy)) < 0) if (setsockopt(fd, sol, ipsec_policy, &policy, sizeof(policy)) < 0)
{ {
DBG1(DBG_KNL, "unable to set IPSEC_POLICY on socket: %s", DBG1(DBG_KNL, "unable to set IPSEC_POLICY on socket: %s",