denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

kernel-pfkey: Only flush SAs of types we actually manage

Browse Source
This commit is contained in:
Tobias Brunner
2015-08-21 18:27:05 +02:00
parent 82b5d1c018
commit 603e3b489b
1 changed files with 26 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libhydra/plugins/kernel_pfkey/kernel_pfkey_ipsec.c
+26 -13
View File
@@ -2086,31 +2086,44 @@ METHOD(kernel_ipsec_t, flush_sas, status_t,
{ {
unsigned char request[PFKEY_BUFFER_SIZE]; unsigned char request[PFKEY_BUFFER_SIZE];
struct sadb_msg *msg, *out; struct sadb_msg *msg, *out;
struct {
u_int8_t proto;
char *name;
} protos[] = {
{ SADB_SATYPE_AH, "AH" },
{ SADB_SATYPE_ESP, "ESP" },
{ SADB_X_SATYPE_IPCOMP, "IPComp" },
};
size_t len; size_t len;
int i;
memset(&request, 0, sizeof(request)); memset(&request, 0, sizeof(request));
DBG2(DBG_KNL, "flushing all SAD entries");
msg = (struct sadb_msg*)request; msg = (struct sadb_msg*)request;
msg->sadb_msg_version = PF_KEY_V2; msg->sadb_msg_version = PF_KEY_V2;
msg->sadb_msg_type = SADB_FLUSH; msg->sadb_msg_type = SADB_FLUSH;
msg->sadb_msg_satype = SADB_SATYPE_UNSPEC;
msg->sadb_msg_len = PFKEY_LEN(sizeof(struct sadb_msg)); msg->sadb_msg_len = PFKEY_LEN(sizeof(struct sadb_msg));
if (pfkey_send(this, msg, &out, &len) != SUCCESS) for (i = 0; i < countof(protos); i++)
{ {
DBG1(DBG_KNL, "unable to flush SAD entries"); DBG2(DBG_KNL, "flushing all %s SAD entries", protos[i].name);
return FAILED;
} msg->sadb_msg_satype = protos[i].proto;
else if (out->sadb_msg_errno) if (pfkey_send(this, msg, &out, &len) != SUCCESS)
{ {
DBG1(DBG_KNL, "unable to flush SAD entries: %s (%d)", DBG1(DBG_KNL, "unable to flush %s SAD entries", protos[i].name);
strerror(out->sadb_msg_errno), out->sadb_msg_errno); return FAILED;
}
else if (out->sadb_msg_errno)
{
DBG1(DBG_KNL, "unable to flush %s SAD entries: %s (%d)",
protos[i].name, strerror(out->sadb_msg_errno),
out->sadb_msg_errno);
free(out);
return FAILED;
}
free(out); free(out);
return FAILED;
} }
free(out);
return SUCCESS; return SUCCESS;
} }