denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

starter: Store mode of the IPsec SA/policy in a separate member.

Browse Source
This commit is contained in:
Tobias Brunner
2012-06-11 17:33:30 +02:00
parent f82365ad27
commit 6d065f14ae
4 changed files with 32 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/starter/confread.c
+16 -16
View File
@@ -83,8 +83,8 @@ static void default_values(starter_config_t *cfg)
cfg->conn_default.seen = SEEN_NONE; cfg->conn_default.seen = SEEN_NONE;
cfg->conn_default.startup = STARTUP_NO; cfg->conn_default.startup = STARTUP_NO;
cfg->conn_default.state = STATE_IGNORE; cfg->conn_default.state = STATE_IGNORE;
cfg->conn_default.policy = POLICY_ENCRYPT | POLICY_TUNNEL | POLICY_PUBKEY | cfg->conn_default.mode = MODE_TUNNEL;
POLICY_PFS | POLICY_MOBIKE; cfg->conn_default.policy = POLICY_PFS | POLICY_MOBIKE;
cfg->conn_default.ike = strdupnull(ike_defaults); cfg->conn_default.ike = strdupnull(ike_defaults);
cfg->conn_default.esp = strdupnull(esp_defaults); cfg->conn_default.esp = strdupnull(esp_defaults);
@@ -312,7 +312,8 @@ static void kw_end(starter_conn_t *conn, starter_end_t *end, kw_token_t token,
32 : 128; 32 : 128;
} }
} }
conn->policy |= POLICY_TUNNEL; conn->mode = MODE_TUNNEL;
conn->proxy_mode = FALSE;
break; break;
case KW_SENDCERT: case KW_SENDCERT:
if (end->sendcert == CERT_YES_SEND) if (end->sendcert == CERT_YES_SEND)
@@ -372,7 +373,8 @@ static void kw_end(starter_conn_t *conn, starter_end_t *end, kw_token_t token,
} }
end->sourceip = strdupnull(value); end->sourceip = strdupnull(value);
end->has_natip = TRUE; end->has_natip = TRUE;
conn->policy |= POLICY_TUNNEL; conn->mode = MODE_TUNNEL;
conn->proxy_mode = FALSE;
break; break;
} }
default: default:
@@ -529,32 +531,30 @@ static void load_conn(starter_conn_t *conn, kw_list_t *kw, starter_config_t *cfg
switch (token) switch (token)
{ {
case KW_TYPE: case KW_TYPE:
conn->policy &= ~(POLICY_TUNNEL | POLICY_SHUNT_MASK); conn->mode = MODE_TRANSPORT;
conn->proxy_mode = FALSE;
if (streq(kw->value, "tunnel")) if (streq(kw->value, "tunnel"))
{ {
conn->policy |= POLICY_TUNNEL; conn->mode = MODE_TUNNEL;
} }
else if (streq(kw->value, "beet")) else if (streq(kw->value, "beet"))
{ {
conn->policy |= POLICY_BEET; conn->mode = MODE_BEET;
} }
else if (streq(kw->value, "transport_proxy")) else if (streq(kw->value, "transport_proxy"))
{ {
conn->policy |= POLICY_PROXY; conn->mode = MODE_TRANSPORT;
conn->proxy_mode = TRUE;
} }
else if (streq(kw->value, "passthrough") || streq(kw->value, "pass")) else if (streq(kw->value, "passthrough") || streq(kw->value, "pass"))
{ {
conn->policy |= POLICY_SHUNT_PASS; conn->mode = MODE_PASS;
} }
else if (streq(kw->value, "drop")) else if (streq(kw->value, "drop") || streq(kw->value, "reject"))
{ {
conn->policy |= POLICY_SHUNT_DROP; conn->mode = MODE_DROP;
} }
else if (streq(kw->value, "reject")) else if (!streq(kw->value, "transport"))
{
conn->policy |= POLICY_SHUNT_REJECT;
}
else if (strcmp(kw->value, "transport") != 0)
{ {
DBG1(DBG_APP, "# bad policy value: %s=%s", kw->entry->name, DBG1(DBG_APP, "# bad policy value: %s=%s", kw->entry->name,
kw->value); kw->value);
src/starter/confread.h
+3
View File
@@ -18,6 +18,7 @@
#include <freeswan.h> #include <freeswan.h>
#include "../pluto/constants.h" #include "../pluto/constants.h"
#include <kernel/kernel_ipsec.h>
#include "ipsec-parser.h" #include "ipsec-parser.h"
@@ -116,6 +117,8 @@ struct starter_conn {
char *aaa_identity; char *aaa_identity;
char *xauth_identity; char *xauth_identity;
char *authby; char *authby;
ipsec_mode_t mode;
bool proxy_mode;
lset_t policy; lset_t policy;
time_t sa_ike_life_seconds; time_t sa_ike_life_seconds;
time_t sa_ipsec_life_seconds; time_t sa_ipsec_life_seconds;
src/starter/starterstroke.c
+3 -26
View File
@@ -1,4 +1,4 @@
/* Stroke for charon is the counterpart to whack from pluto /*
* Copyright (C) 2006 Martin Willi * Copyright (C) 2006 Martin Willi
* Hochschule fuer Technik Rapperswil * Hochschule fuer Technik Rapperswil
* *
@@ -204,31 +204,8 @@ int starter_stroke_add_conn(starter_config_t *cfg, starter_conn_t *conn)
msg.add_conn.aaa_identity = push_string(&msg, conn->aaa_identity); msg.add_conn.aaa_identity = push_string(&msg, conn->aaa_identity);
msg.add_conn.xauth_identity = push_string(&msg, conn->xauth_identity); msg.add_conn.xauth_identity = push_string(&msg, conn->xauth_identity);
if (conn->policy & POLICY_TUNNEL) msg.add_conn.mode = conn->mode;
{ msg.add_conn.proxy_mode = conn->proxy_mode;
msg.add_conn.mode = MODE_TUNNEL;
}
else if (conn->policy & POLICY_BEET)
{
msg.add_conn.mode = MODE_BEET;
}
else if (conn->policy & POLICY_PROXY)
{
msg.add_conn.mode = MODE_TRANSPORT;
msg.add_conn.proxy_mode = TRUE;
}
else if (conn->policy & POLICY_SHUNT_PASS)
{
msg.add_conn.mode = MODE_PASS;
}
else if (conn->policy & (POLICY_SHUNT_DROP | POLICY_SHUNT_REJECT))
{
msg.add_conn.mode = MODE_DROP;
}
else
{
msg.add_conn.mode = MODE_TRANSPORT;
}
if (!(conn->policy & POLICY_DONT_REKEY)) if (!(conn->policy & POLICY_DONT_REKEY))
{ {
src/starter/starterstroke.h
+10 -9
View File
@@ -1,5 +1,6 @@
/* Stroke for charon is the counterpart to whack from pluto /*
* Copyright (C) 2006 Martin Willi - Hochschule fuer Technik Rapperswil * Copyright (C) 2006 Martin Willi
* Hochschule fuer Technik Rapperswil
* *
* This program is free software; you can redistribute it and/or modify it * This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the * under the terms of the GNU General Public License as published by the
@@ -17,12 +18,12 @@
#include "confread.h" #include "confread.h"
extern int starter_stroke_add_conn(starter_config_t *cfg, starter_conn_t *conn); int starter_stroke_add_conn(starter_config_t *cfg, starter_conn_t *conn);
extern int starter_stroke_del_conn(starter_conn_t *conn); int starter_stroke_del_conn(starter_conn_t *conn);
extern int starter_stroke_route_conn(starter_conn_t *conn); int starter_stroke_route_conn(starter_conn_t *conn);
extern int starter_stroke_initiate_conn(starter_conn_t *conn); int starter_stroke_initiate_conn(starter_conn_t *conn);
extern int starter_stroke_add_ca(starter_ca_t *ca); int starter_stroke_add_ca(starter_ca_t *ca);
extern int starter_stroke_del_ca(starter_ca_t *ca); int starter_stroke_del_ca(starter_ca_t *ca);
extern int starter_stroke_configure(starter_config_t *cfg); int starter_stroke_configure(starter_config_t *cfg);
#endif /* _STARTER_STROKE_H_ */ #endif /* _STARTER_STROKE_H_ */