denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

kernel-wfp: Install tunnel mode policies to appropriate sub-layers

Browse Source 
While it is unclear if this has any effect at all, we prefer specific sublayers
to install policies as suggested.
This commit is contained in:
Martin Willi
2014-06-04 16:32:11 +02:00
parent be32be01a8
commit 4a8ba369b6
2 changed files with 22 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/kernel_wfp/kernel_wfp_compat.h
+2
View File
@@ -127,6 +127,8 @@ const GUID FWPM_LAYER_OUTBOUND_TRANSPORT_V4;
const GUID FWPM_LAYER_OUTBOUND_TRANSPORT_V6; const GUID FWPM_LAYER_OUTBOUND_TRANSPORT_V6;
const GUID FWPM_LAYER_IPFORWARD_V4; const GUID FWPM_LAYER_IPFORWARD_V4;
const GUID FWPM_LAYER_IPFORWARD_V6; const GUID FWPM_LAYER_IPFORWARD_V6;
const GUID FWPM_SUBLAYER_IPSEC_TUNNEL;
const GUID FWPM_SUBLAYER_IPSEC_FORWARD_OUTBOUND_TUNNEL;
const GUID FWPM_CALLOUT_IPSEC_INBOUND_TRANSPORT_V4; const GUID FWPM_CALLOUT_IPSEC_INBOUND_TRANSPORT_V4;
const GUID FWPM_CALLOUT_IPSEC_INBOUND_TRANSPORT_V6; const GUID FWPM_CALLOUT_IPSEC_INBOUND_TRANSPORT_V6;
const GUID FWPM_CALLOUT_IPSEC_OUTBOUND_TRANSPORT_V4; const GUID FWPM_CALLOUT_IPSEC_OUTBOUND_TRANSPORT_V4;
src/libcharon/plugins/kernel_wfp/kernel_wfp_ipsec.c
+20 -6
View File
@@ -553,7 +553,7 @@ static void free_conditions(FWPM_FILTER_CONDITION0 *conds, int count)
* Find the callout GUID for given parameters * Find the callout GUID for given parameters
*/ */
static bool find_callout(bool tunnel, bool v6, bool inbound, bool forward, static bool find_callout(bool tunnel, bool v6, bool inbound, bool forward,
GUID *layer, GUID *callout) GUID *layer, GUID *sublayer, GUID *callout)
{ {
struct { struct {
bool tunnel; bool tunnel;
@@ -561,31 +561,40 @@ static bool find_callout(bool tunnel, bool v6, bool inbound, bool forward,
bool inbound; bool inbound;
bool forward; bool forward;
const GUID *layer; const GUID *layer;
const GUID *sublayer;
const GUID *callout; const GUID *callout;
} map[] = { } map[] = {
{ 0, 0, 0, 0, &FWPM_LAYER_OUTBOUND_TRANSPORT_V4, { 0, 0, 0, 0, &FWPM_LAYER_OUTBOUND_TRANSPORT_V4, NULL,
&FWPM_CALLOUT_IPSEC_OUTBOUND_TRANSPORT_V4 }, &FWPM_CALLOUT_IPSEC_OUTBOUND_TRANSPORT_V4 },
{ 0, 0, 1, 0, &FWPM_LAYER_INBOUND_TRANSPORT_V4, { 0, 0, 1, 0, &FWPM_LAYER_INBOUND_TRANSPORT_V4, NULL,
&FWPM_CALLOUT_IPSEC_INBOUND_TRANSPORT_V4 }, &FWPM_CALLOUT_IPSEC_INBOUND_TRANSPORT_V4 },
{ 0, 1, 0, 0, &FWPM_LAYER_OUTBOUND_TRANSPORT_V6, { 0, 1, 0, 0, &FWPM_LAYER_OUTBOUND_TRANSPORT_V6, NULL,
&FWPM_CALLOUT_IPSEC_OUTBOUND_TRANSPORT_V6 }, &FWPM_CALLOUT_IPSEC_OUTBOUND_TRANSPORT_V6 },
{ 0, 1, 1, 0, &FWPM_LAYER_INBOUND_TRANSPORT_V6, { 0, 1, 1, 0, &FWPM_LAYER_INBOUND_TRANSPORT_V6, NULL,
&FWPM_CALLOUT_IPSEC_INBOUND_TRANSPORT_V6 }, &FWPM_CALLOUT_IPSEC_INBOUND_TRANSPORT_V6 },
{ 1, 0, 0, 0, &FWPM_LAYER_OUTBOUND_TRANSPORT_V4, { 1, 0, 0, 0, &FWPM_LAYER_OUTBOUND_TRANSPORT_V4,
&FWPM_SUBLAYER_IPSEC_TUNNEL,
&FWPM_CALLOUT_IPSEC_OUTBOUND_TUNNEL_V4 }, &FWPM_CALLOUT_IPSEC_OUTBOUND_TUNNEL_V4 },
{ 1, 0, 0, 1, &FWPM_LAYER_IPFORWARD_V4, { 1, 0, 0, 1, &FWPM_LAYER_IPFORWARD_V4,
&FWPM_SUBLAYER_IPSEC_FORWARD_OUTBOUND_TUNNEL,
&FWPM_CALLOUT_IPSEC_FORWARD_OUTBOUND_TUNNEL_V4 }, &FWPM_CALLOUT_IPSEC_FORWARD_OUTBOUND_TUNNEL_V4 },
{ 1, 0, 1, 0, &FWPM_LAYER_INBOUND_TRANSPORT_V4, { 1, 0, 1, 0, &FWPM_LAYER_INBOUND_TRANSPORT_V4,
&FWPM_SUBLAYER_IPSEC_TUNNEL,
&FWPM_CALLOUT_IPSEC_INBOUND_TUNNEL_V4 }, &FWPM_CALLOUT_IPSEC_INBOUND_TUNNEL_V4 },
{ 1, 0, 1, 1, &FWPM_LAYER_IPFORWARD_V4, { 1, 0, 1, 1, &FWPM_LAYER_IPFORWARD_V4,
&FWPM_SUBLAYER_IPSEC_TUNNEL,
&FWPM_CALLOUT_IPSEC_FORWARD_INBOUND_TUNNEL_V4 }, &FWPM_CALLOUT_IPSEC_FORWARD_INBOUND_TUNNEL_V4 },
{ 1, 1, 0, 0, &FWPM_LAYER_OUTBOUND_TRANSPORT_V6, { 1, 1, 0, 0, &FWPM_LAYER_OUTBOUND_TRANSPORT_V6,
&FWPM_SUBLAYER_IPSEC_TUNNEL,
&FWPM_CALLOUT_IPSEC_OUTBOUND_TUNNEL_V6 }, &FWPM_CALLOUT_IPSEC_OUTBOUND_TUNNEL_V6 },
{ 1, 1, 0, 1, &FWPM_LAYER_IPFORWARD_V6, { 1, 1, 0, 1, &FWPM_LAYER_IPFORWARD_V6,
&FWPM_SUBLAYER_IPSEC_TUNNEL,
&FWPM_CALLOUT_IPSEC_FORWARD_OUTBOUND_TUNNEL_V6 }, &FWPM_CALLOUT_IPSEC_FORWARD_OUTBOUND_TUNNEL_V6 },
{ 1, 1, 1, 0, &FWPM_LAYER_INBOUND_TRANSPORT_V6, { 1, 1, 1, 0, &FWPM_LAYER_INBOUND_TRANSPORT_V6,
&FWPM_SUBLAYER_IPSEC_TUNNEL,
&FWPM_CALLOUT_IPSEC_INBOUND_TUNNEL_V6 }, &FWPM_CALLOUT_IPSEC_INBOUND_TUNNEL_V6 },
{ 1, 1, 1, 1, &FWPM_LAYER_IPFORWARD_V6, { 1, 1, 1, 1, &FWPM_LAYER_IPFORWARD_V6,
&FWPM_SUBLAYER_IPSEC_TUNNEL,
&FWPM_CALLOUT_IPSEC_FORWARD_INBOUND_TUNNEL_V6 }, &FWPM_CALLOUT_IPSEC_FORWARD_INBOUND_TUNNEL_V6 },
}; };
int i; int i;
@@ -599,6 +608,10 @@ static bool find_callout(bool tunnel, bool v6, bool inbound, bool forward,
{ {
*callout = *map[i].callout; *callout = *map[i].callout;
*layer = *map[i].layer; *layer = *map[i].layer;
if (map[i].sublayer)
{
*sublayer = *map[i].sublayer;
}
return TRUE; return TRUE;
} }
} }
@@ -635,7 +648,8 @@ static bool install_sp(private_kernel_wfp_ipsec_t *this, sp_entry_t *sp,
v6 = sp->src->get_type(sp->src) == TS_IPV6_ADDR_RANGE; v6 = sp->src->get_type(sp->src) == TS_IPV6_ADDR_RANGE;
if (!find_callout(context != NULL, v6, inbound, fwd, if (!find_callout(context != NULL, v6, inbound, fwd,
&filter.layerKey, &filter.action.calloutKey)) &filter.layerKey, &filter.subLayerKey,
&filter.action.calloutKey))
{ {
return FALSE; return FALSE;
} }