denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

kernel: Make range of SPIs for IPsec SAs configurable

Browse Source
This commit is contained in:
Tobias Brunner
2017-03-02 08:52:56 +01:00
parent 4b5cbb3db1
commit 6d86d0f516
5 changed files with 46 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/kernel/kernel_interface.h
+6
View File
@@ -56,6 +56,12 @@ typedef enum kernel_feature_t kernel_feature_t;
#include <kernel/kernel_ipsec.h>
#include <kernel/kernel_net.h>
/**
* Default range for SPIs requested from kernels
*/
#define KERNEL_SPI_MIN 0xc0000000
#define KERNEL_SPI_MAX 0xcfffffff
/**
* Bitfield of optional features a kernel backend supports.
*
src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c
+10 -3
View File
@@ -1,5 +1,5 @@
/*
* Copyright (C) 2006-2016 Tobias Brunner
* Copyright (C) 2006-2017 Tobias Brunner
* Copyright (C) 2005-2009 Martin Willi
* Copyright (C) 2008-2016 Andreas Steffen
* Copyright (C) 2006-2007 Fabian Hartmann, Noah Heusser
@@ -1211,8 +1211,15 @@ METHOD(kernel_ipsec_t, get_spi, status_t,
private_kernel_netlink_ipsec_t *this, host_t *src, host_t *dst,
uint8_t protocol, uint32_t *spi)
{
if (get_spi_internal(this, src, dst, protocol,
0xc0000000, 0xcFFFFFFF, spi) != SUCCESS)
uint32_t spi_min, spi_max;
spi_min = lib->settings->get_int(lib->settings, "%s.spi_min",
KERNEL_SPI_MIN, lib->ns);
spi_max = lib->settings->get_int(lib->settings, "%s.spi_max",
KERNEL_SPI_MAX, lib->ns);
if (get_spi_internal(this, src, dst, protocol, min(spi_min, spi_max),
max(spi_min, spi_max), spi) != SUCCESS)
{
DBG1(DBG_KNL, "unable to get SPI");
return FAILED;
src/libcharon/plugins/kernel_pfkey/kernel_pfkey_ipsec.c
+10 -3
View File
@@ -1,5 +1,5 @@
/*
* Copyright (C) 2008-2016 Tobias Brunner
* Copyright (C) 2008-2017 Tobias Brunner
* Copyright (C) 2008 Andreas Steffen
* HSR Hochschule fuer Technik Rapperswil
*
@@ -1586,8 +1586,15 @@ METHOD(kernel_ipsec_t, get_spi, status_t,
private_kernel_pfkey_ipsec_t *this, host_t *src, host_t *dst,
uint8_t protocol, uint32_t *spi)
{
if (get_spi_internal(this, src, dst, protocol,
0xc0000000, 0xcFFFFFFF, spi) != SUCCESS)
uint32_t spi_min, spi_max;
spi_min = lib->settings->get_int(lib->settings, "%s.spi_min",
KERNEL_SPI_MIN, lib->ns);
spi_max = lib->settings->get_int(lib->settings, "%s.spi_max",
KERNEL_SPI_MAX, lib->ns);
if (get_spi_internal(this, src, dst, protocol, min(spi_min, spi_max),
max(spi_min, spi_max), spi) != SUCCESS)
{
DBG1(DBG_KNL, "unable to get SPI");
return FAILED;