denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

vici: Make installation of outbound FWD policies configurable

Browse Source
This commit is contained in:
Tobias Brunner
2016-09-28 17:56:43 +02:00
parent c98e48cf0e
commit 50721a61d8
2 changed files with 36 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/vici/vici_config.c
+29 -25
View File
@@ -437,6 +437,7 @@ typedef struct {
linked_list_t *remote_ts; linked_list_t *remote_ts;
uint32_t replay_window; uint32_t replay_window;
bool policies; bool policies;
bool policies_fwd_out;
child_cfg_create_t cfg; child_cfg_create_t cfg;
} child_data_t; } child_data_t;
@@ -462,6 +463,7 @@ static void log_child_data(child_data_t *data, char *name)
DBG2(DBG_CFG, " ipcomp = %u", cfg->ipcomp); DBG2(DBG_CFG, " ipcomp = %u", cfg->ipcomp);
DBG2(DBG_CFG, " mode = %N", ipsec_mode_names, cfg->mode); DBG2(DBG_CFG, " mode = %N", ipsec_mode_names, cfg->mode);
DBG2(DBG_CFG, " policies = %u", data->policies); DBG2(DBG_CFG, " policies = %u", data->policies);
DBG2(DBG_CFG, " policies_fwd_out = %u", data->policies_fwd_out);
if (data->replay_window != REPLAY_UNDEFINED) if (data->replay_window != REPLAY_UNDEFINED)
{ {
DBG2(DBG_CFG, " replay_window = %u", data->replay_window); DBG2(DBG_CFG, " replay_window = %u", data->replay_window);
@@ -1330,31 +1332,32 @@ CALLBACK(child_kv, bool,
child_data_t *child, vici_message_t *message, char *name, chunk_t value) child_data_t *child, vici_message_t *message, char *name, chunk_t value)
{ {
parse_rule_t rules[] = { parse_rule_t rules[] = {
{ "updown", parse_string, &child->cfg.updown }, { "updown", parse_string, &child->cfg.updown },
{ "hostaccess", parse_bool, &child->cfg.hostaccess }, { "hostaccess", parse_bool, &child->cfg.hostaccess },
{ "mode", parse_mode, &child->cfg.mode }, { "mode", parse_mode, &child->cfg.mode },
{ "policies", parse_bool, &child->policies }, { "policies", parse_bool, &child->policies },
{ "replay_window", parse_uint32, &child->replay_window }, { "policies_fwd_out", parse_bool, &child->policies_fwd_out },
{ "rekey_time", parse_time, &child->cfg.lifetime.time.rekey }, { "replay_window", parse_uint32, &child->replay_window },
{ "life_time", parse_time, &child->cfg.lifetime.time.life }, { "rekey_time", parse_time, &child->cfg.lifetime.time.rekey },
{ "rand_time", parse_time, &child->cfg.lifetime.time.jitter }, { "life_time", parse_time, &child->cfg.lifetime.time.life },
{ "rekey_bytes", parse_bytes, &child->cfg.lifetime.bytes.rekey }, { "rand_time", parse_time, &child->cfg.lifetime.time.jitter },
{ "life_bytes", parse_bytes, &child->cfg.lifetime.bytes.life }, { "rekey_bytes", parse_bytes, &child->cfg.lifetime.bytes.rekey },
{ "rand_bytes", parse_bytes, &child->cfg.lifetime.bytes.jitter }, { "life_bytes", parse_bytes, &child->cfg.lifetime.bytes.life },
{ "rekey_packets", parse_uint64, &child->cfg.lifetime.packets.rekey }, { "rand_bytes", parse_bytes, &child->cfg.lifetime.bytes.jitter },
{ "life_packets", parse_uint64, &child->cfg.lifetime.packets.life }, { "rekey_packets", parse_uint64, &child->cfg.lifetime.packets.rekey },
{ "rand_packets", parse_uint64, &child->cfg.lifetime.packets.jitter }, { "life_packets", parse_uint64, &child->cfg.lifetime.packets.life },
{ "dpd_action", parse_action, &child->cfg.dpd_action }, { "rand_packets", parse_uint64, &child->cfg.lifetime.packets.jitter },
{ "start_action", parse_action, &child->cfg.start_action }, { "dpd_action", parse_action, &child->cfg.dpd_action },
{ "close_action", parse_action, &child->cfg.close_action }, { "start_action", parse_action, &child->cfg.start_action },
{ "ipcomp", parse_bool, &child->cfg.ipcomp }, { "close_action", parse_action, &child->cfg.close_action },
{ "inactivity", parse_time, &child->cfg.inactivity }, { "ipcomp", parse_bool, &child->cfg.ipcomp },
{ "reqid", parse_uint32, &child->cfg.reqid }, { "inactivity", parse_time, &child->cfg.inactivity },
{ "mark_in", parse_mark, &child->cfg.mark_in }, { "reqid", parse_uint32, &child->cfg.reqid },
{ "mark_out", parse_mark, &child->cfg.mark_out }, { "mark_in", parse_mark, &child->cfg.mark_in },
{ "tfc_padding", parse_tfc, &child->cfg.tfc }, { "mark_out", parse_mark, &child->cfg.mark_out },
{ "priority", parse_uint32, &child->cfg.priority }, { "tfc_padding", parse_tfc, &child->cfg.tfc },
{ "interface", parse_string, &child->cfg.interface }, { "priority", parse_uint32, &child->cfg.priority },
{ "interface", parse_string, &child->cfg.interface },
}; };
return parse_rules(rules, countof(rules), name, value, return parse_rules(rules, countof(rules), name, value,
@@ -1537,6 +1540,7 @@ CALLBACK(children_sn, bool,
} }
} }
child.cfg.suppress_policies = !child.policies; child.cfg.suppress_policies = !child.policies;
child.cfg.fwd_out_policies = child.policies_fwd_out;
check_lifetimes(&child.cfg.lifetime); check_lifetimes(&child.cfg.lifetime);
src/swanctl/swanctl.opt
+7
View File
@@ -659,6 +659,13 @@ connections.<conn>.children.<child>.policies = yes
Whether to install IPsec policies or not. Disabling this can be useful in Whether to install IPsec policies or not. Disabling this can be useful in
some scenarios e.g. MIPv6, where policies are not managed by the IKE daemon. some scenarios e.g. MIPv6, where policies are not managed by the IKE daemon.
connections.<conn>.children.<child>.policies_fwd_out = no
Whether to install outbound FWD IPsec policies or not.
Whether to install outbound FWD IPsec policies or not. Enabling this is
required in case there is a drop policy that would match and block forwarded
traffic for this CHILD_SA.
connections.<conn>.children.<child>.dpd_action = clear connections.<conn>.children.<child>.dpd_action = clear
Action to perform on DPD timeout (_clear_, _trap_ or _restart_). Action to perform on DPD timeout (_clear_, _trap_ or _restart_).