denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'trap-manager-uninstall'

Browse Source 
This changes how trap policies are deleted in order to avoid conflicts if a
trap policy with changed peer config is concurrently removed and reinstalled
under a different name (the reqid will be the same, so the wrong policy
could have been deleted by the old code).
This commit is contained in:
Tobias Brunner
2018-02-22 11:36:53 +01:00
parent c1c63a400e a541cf05c1
commit 6df2938fd2
13 changed files with 76 additions and 317 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/ha/ha_tunnel.c
+6 -7
View File
@@ -20,6 +20,8 @@
#include <utils/identification.h>
#include <processing/jobs/callback_job.h>
#define HA_CFG_NAME "ha"
typedef struct private_ha_tunnel_t private_ha_tunnel_t;
typedef struct ha_backend_t ha_backend_t;
typedef struct ha_creds_t ha_creds_t;
@@ -225,7 +227,7 @@ static void setup_tunnel(private_ha_tunnel_t *this,
remote, IKEV2_UDP_PORT, FRAGMENTATION_NO, 0);
ike_cfg->add_proposal(ike_cfg, proposal_create_default(PROTO_IKE));
ike_cfg->add_proposal(ike_cfg, proposal_create_default_aead(PROTO_IKE));
peer_cfg = peer_cfg_create("ha", ike_cfg, &peer);
peer_cfg = peer_cfg_create(HA_CFG_NAME, ike_cfg, &peer);
auth_cfg = auth_cfg_create();
auth_cfg->add(auth_cfg, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PSK);
@@ -239,7 +241,7 @@ static void setup_tunnel(private_ha_tunnel_t *this,
identification_create_from_string(remote));
peer_cfg->add_auth_cfg(peer_cfg, auth_cfg, FALSE);
child_cfg = child_cfg_create("ha", &child);
child_cfg = child_cfg_create(HA_CFG_NAME, &child);
ts = traffic_selector_create_dynamic(IPPROTO_UDP, HA_PORT, HA_PORT);
child_cfg->add_traffic_selector(child_cfg, TRUE, ts);
ts = traffic_selector_create_dynamic(IPPROTO_ICMP, 0, 65535);
@@ -260,7 +262,7 @@ static void setup_tunnel(private_ha_tunnel_t *this,
charon->backends->add_backend(charon->backends, &this->backend.public);
/* install an acquiring trap */
this->trap = charon->traps->install(charon->traps, peer_cfg, child_cfg, 0);
charon->traps->install(charon->traps, peer_cfg, child_cfg);
}
METHOD(ha_tunnel_t, destroy, void,
@@ -278,10 +280,7 @@ METHOD(ha_tunnel_t, destroy, void,
}
this->creds.local->destroy(this->creds.local);
this->creds.remote->destroy(this->creds.remote);
if (this->trap)
{
charon->traps->uninstall(charon->traps, this->trap);
}
charon->traps->uninstall(charon->traps, HA_CFG_NAME, HA_CFG_NAME);
free(this);
}
src/libcharon/plugins/stroke/stroke_control.c
+4 -80
View File
@@ -588,47 +588,6 @@ METHOD(stroke_control_t, purge_ike, void,
list->destroy(list);
}
/**
* Find an existing CHILD_SA/reqid
*/
static uint32_t find_reqid(child_cfg_t *child_cfg)
{
enumerator_t *enumerator, *children;
child_sa_t *child_sa;
ike_sa_t *ike_sa;
char *name;
uint32_t reqid;
reqid = charon->traps->find_reqid(charon->traps, child_cfg);
if (reqid)
{ /* already trapped */
return reqid;
}
name = child_cfg->get_name(child_cfg);
enumerator = charon->controller->create_ike_sa_enumerator(
charon->controller, TRUE);
while (enumerator->enumerate(enumerator, &ike_sa))
{
children = ike_sa->create_child_sa_enumerator(ike_sa);
while (children->enumerate(children, (void**)&child_sa))
{
if (streq(name, child_sa->get_name(child_sa)))
{
reqid = child_sa->get_reqid(child_sa);
break;
}
}
children->destroy(children);
if (reqid)
{
break;
}
}
enumerator->destroy(enumerator);
return reqid;
}
/**
* call charon to install a shunt or trap
*/
@@ -636,7 +595,6 @@ static void charon_route(peer_cfg_t *peer_cfg, child_cfg_t *child_cfg,
char *name, FILE *out)
{
ipsec_mode_t mode;
uint32_t reqid;
mode = child_cfg->get_mode(child_cfg);
if (mode == MODE_PASS || mode == MODE_DROP)
@@ -655,8 +613,7 @@ static void charon_route(peer_cfg_t *peer_cfg, child_cfg_t *child_cfg,
}
else
{
reqid = find_reqid(child_cfg);
if (charon->traps->install(charon->traps, peer_cfg, child_cfg, reqid))
if (charon->traps->install(charon->traps, peer_cfg, child_cfg))
{
fprintf(out, "'%s' routed\n", name);
}
@@ -730,46 +687,13 @@ METHOD(stroke_control_t, route, void,
METHOD(stroke_control_t, unroute, void,
private_stroke_control_t *this, stroke_msg_t *msg, FILE *out)
{
child_cfg_t *child_cfg;
child_sa_t *child_sa;
enumerator_t *enumerator;
char *ns, *found = NULL;
uint32_t id = 0;
enumerator = charon->shunts->create_enumerator(charon->shunts);
while (enumerator->enumerate(enumerator, &ns, &child_cfg))
if (charon->shunts->uninstall(charon->shunts, NULL, msg->unroute.name))
{
if (ns && streq(msg->unroute.name, child_cfg->get_name(child_cfg)))
{
found = strdup(ns);
break;
}
}
enumerator->destroy(enumerator);
if (found && charon->shunts->uninstall(charon->shunts, found,
msg->unroute.name))
{
free(found);
fprintf(out, "shunt policy '%s' uninstalled\n", msg->unroute.name);
return;
}
free(found);
enumerator = charon->traps->create_enumerator(charon->traps);
while (enumerator->enumerate(enumerator, NULL, &child_sa))
else if (charon->traps->uninstall(charon->traps, NULL, msg->unroute.name))
{
if (streq(msg->unroute.name, child_sa->get_name(child_sa)))
{
id = child_sa->get_reqid(child_sa);
break;
}
}
enumerator->destroy(enumerator);
if (id)
{
charon->traps->uninstall(charon->traps, id);
fprintf(out, "configuration '%s' unrouted\n", msg->unroute.name);
fprintf(out, "trap policy '%s' unrouted\n", msg->unroute.name);
}
else
{
src/libcharon/plugins/vici/vici_config.c
+2 -54
View File
@@ -1953,41 +1953,6 @@ CALLBACK(peer_sn, bool,
return FALSE;
}
/**
* Find reqid of an existing CHILD_SA
*/
static uint32_t find_reqid(child_cfg_t *cfg)
{
enumerator_t *enumerator, *children;
child_sa_t *child_sa;
ike_sa_t *ike_sa;
uint32_t reqid;
reqid = charon->traps->find_reqid(charon->traps, cfg);
if (reqid)
{ /* already trapped */
return reqid;
}
enumerator = charon->controller->create_ike_sa_enumerator(
charon->controller, TRUE);
while (!reqid && enumerator->enumerate(enumerator, &ike_sa))
{
children = ike_sa->create_child_sa_enumerator(ike_sa);
while (children->enumerate(children, &child_sa))
{
if (streq(cfg->get_name(cfg), child_sa->get_name(child_sa)))
{
reqid = child_sa->get_reqid(child_sa);
break;
}
}
children->destroy(children);
}
enumerator->destroy(enumerator);
return reqid;
}
/**
* Perform start actions associated with a child config
*/
@@ -2012,8 +1977,7 @@ static void run_start_action(private_vici_config_t *this, peer_cfg_t *peer_cfg,
peer_cfg->get_name(peer_cfg), child_cfg);
break;
default:
charon->traps->install(charon->traps, peer_cfg, child_cfg,
find_reqid(child_cfg));
charon->traps->install(charon->traps, peer_cfg, child_cfg);
break;
}
break;
@@ -2030,7 +1994,6 @@ static void clear_start_action(private_vici_config_t *this, char *peer_name,
{
enumerator_t *enumerator, *children;
child_sa_t *child_sa;
peer_cfg_t *peer_cfg;
ike_sa_t *ike_sa;
uint32_t id = 0, others;
array_t *ids = NULL, *ikeids = NULL;
@@ -2121,22 +2084,7 @@ static void clear_start_action(private_vici_config_t *this, char *peer_name,
charon->shunts->uninstall(charon->shunts, peer_name, name);
break;
default:
enumerator = charon->traps->create_enumerator(charon->traps);
while (enumerator->enumerate(enumerator, &peer_cfg,
&child_sa))
{
if (streq(peer_name, peer_cfg->get_name(peer_cfg)) &&
streq(name, child_sa->get_name(child_sa)))
{
id = child_sa->get_reqid(child_sa);
break;
}
}
enumerator->destroy(enumerator);
if (id)
{
charon->traps->uninstall(charon->traps, id);
}
charon->traps->uninstall(charon->traps, peer_name, name);
break;
}
break;
src/libcharon/plugins/vici/vici_control.c
+5 -86
View File
@@ -601,41 +601,6 @@ CALLBACK(redirect, vici_message_t*,
return builder->finalize(builder);
}
/**
* Find reqid of an existing CHILD_SA
*/
static uint32_t find_reqid(child_cfg_t *cfg)
{
enumerator_t *enumerator, *children;
child_sa_t *child_sa;
ike_sa_t *ike_sa;
uint32_t reqid;
reqid = charon->traps->find_reqid(charon->traps, cfg);
if (reqid)
{ /* already trapped */
return reqid;
}
enumerator = charon->controller->create_ike_sa_enumerator(
charon->controller, TRUE);
while (!reqid && enumerator->enumerate(enumerator, &ike_sa))
{
children = ike_sa->create_child_sa_enumerator(ike_sa);
while (children->enumerate(children, &child_sa))
{
if (streq(cfg->get_name(cfg), child_sa->get_name(child_sa)))
{
reqid = child_sa->get_reqid(child_sa);
break;
}
}
children->destroy(children);
}
enumerator->destroy(enumerator);
return reqid;
}
CALLBACK(install, vici_message_t*,
private_vici_control_t *this, char *name, u_int id, vici_message_t *request)
{
@@ -666,8 +631,7 @@ CALLBACK(install, vici_message_t*,
peer_cfg->get_name(peer_cfg), child_cfg);
break;
default:
ok = charon->traps->install(charon->traps, peer_cfg, child_cfg,
find_reqid(child_cfg));
ok = charon->traps->install(charon->traps, peer_cfg, child_cfg);
break;
}
peer_cfg->destroy(peer_cfg);
@@ -679,12 +643,7 @@ CALLBACK(install, vici_message_t*,
CALLBACK(uninstall, vici_message_t*,
private_vici_control_t *this, char *name, u_int id, vici_message_t *request)
{
peer_cfg_t *peer_cfg;
child_cfg_t *child_cfg;
child_sa_t *child_sa;
enumerator_t *enumerator;
uint32_t reqid = 0;
char *child, *ike, *ns;
char *child, *ike;
child = request->get_str(request, NULL, "child");
ike = request->get_str(request, NULL, "ike");
@@ -695,53 +654,13 @@ CALLBACK(uninstall, vici_message_t*,
DBG1(DBG_CFG, "vici uninstall '%s'", child);
if (!ike)
{
enumerator = charon->shunts->create_enumerator(charon->shunts);
while (enumerator->enumerate(enumerator, &ns, &child_cfg))
{
if (ns && streq(child, child_cfg->get_name(child_cfg)))
{
ike = strdup(ns);
break;
}
}
enumerator->destroy(enumerator);
if (ike)
{
if (charon->shunts->uninstall(charon->shunts, ike, child))
{
free(ike);
return send_reply(this, NULL);
}
free(ike);
return send_reply(this, "uninstalling policy '%s' failed", child);
}
}
else if (charon->shunts->uninstall(charon->shunts, ike, child))
if (charon->shunts->uninstall(charon->shunts, ike, child))
{
return send_reply(this, NULL);
}
enumerator = charon->traps->create_enumerator(charon->traps);
while (enumerator->enumerate(enumerator, &peer_cfg, &child_sa))
else if (charon->traps->uninstall(charon->traps, ike, child))
{
if ((!ike || streq(ike, peer_cfg->get_name(peer_cfg))) &&
streq(child, child_sa->get_name(child_sa)))
{
reqid = child_sa->get_reqid(child_sa);
break;
}
}
enumerator->destroy(enumerator);
if (reqid)
{
if (charon->traps->uninstall(charon->traps, reqid))
{
return send_reply(this, NULL);
}
return send_reply(this, "uninstalling policy '%s' failed", child);
return send_reply(this, NULL);
}
return send_reply(this, "policy '%s' not found", child);
}
src/libcharon/processing/jobs/start_action_job.c
+1 -1
View File
@@ -75,7 +75,7 @@ METHOD(job_t, execute, job_requeue_t,
else
{
charon->traps->install(charon->traps, peer_cfg,
child_cfg, 0);
child_cfg);
}
break;
case ACTION_NONE:
src/libcharon/sa/child_sa.c
+10 -16
View File
@@ -1754,7 +1754,7 @@ static host_t* get_proxy_addr(child_cfg_t *config, host_t *ike, bool local)
* Described in header.
*/
child_sa_t * child_sa_create(host_t *me, host_t* other,
child_cfg_t *config, uint32_t rekey, bool encap,
child_cfg_t *config, uint32_t reqid, bool encap,
u_int mark_in, u_int mark_out)
{
private_child_sa_t *this;
@@ -1865,21 +1865,15 @@ child_sa_t * child_sa_create(host_t *me, host_t* other,
if (!this->reqid)
{
/* reuse old reqid if we are rekeying an existing CHILD_SA. While the
* reqid cache would find the same reqid for our selectors, this does
* not work in a special case: If an SA is triggered by a trap policy,
* but the negotiated SA gets narrowed, we still must reuse the same
* reqid to successfully "trigger" the SA on the kernel level. Rekeying
* such an SA requires an explicit reqid, as the cache currently knows
* the original selectors only for that reqid. */
if (rekey)
{
this->reqid = rekey;
}
else
{
this->reqid = charon->traps->find_reqid(charon->traps, config);
}
/* reuse old reqid if we are rekeying an existing CHILD_SA and when
* initiating a trap policy. While the reqid cache would find the same
* reqid for our selectors, this does not work in a special case: If an
* SA is triggered by a trap policy, but the negotiated TS get
* narrowed, we still must reuse the same reqid to successfully
* replace the temporary SA on the kernel level. Rekeying such an SA
* requires an explicit reqid, as the cache currently knows the original
* selectors only for that reqid. */
this->reqid = reqid;
}
else
{
src/libcharon/sa/ike_sa.c
+1 -2
View File
@@ -2035,8 +2035,7 @@ METHOD(ike_sa_t, reestablish, status_t,
break;
case ACTION_ROUTE:
charon->traps->install(charon->traps, this->peer_cfg,
child_sa->get_config(child_sa),
child_sa->get_reqid(child_sa));
child_sa->get_config(child_sa));
break;
default:
break;
src/libcharon/sa/ikev1/tasks/quick_delete.c
+1 -1
View File
@@ -154,7 +154,7 @@ static bool delete_child(private_quick_delete_t *this, protocol_id_t protocol,
case ACTION_ROUTE:
charon->traps->install(charon->traps,
this->ike_sa->get_peer_cfg(this->ike_sa),
child_cfg, child_sa->get_reqid(child_sa));
child_cfg);
break;
default:
break;
src/libcharon/sa/ikev2/tasks/child_delete.c
+2 -2
View File
@@ -374,8 +374,8 @@ static status_t destroy_and_reestablish(private_child_delete_t *this)
break;
case ACTION_ROUTE:
charon->traps->install(charon->traps,
this->ike_sa->get_peer_cfg(this->ike_sa), child_cfg,
reqid);
this->ike_sa->get_peer_cfg(this->ike_sa),
child_cfg);
break;
default:
break;
src/libcharon/sa/shunt_manager.c
+10 -3
View File
@@ -1,5 +1,5 @@
/*
* Copyright (C) 2015-2016 Tobias Brunner
* Copyright (C) 2015-2017 Tobias Brunner
* Copyright (C) 2011-2016 Andreas Steffen
* HSR Hochschule fuer Technik Rapperswil
*
@@ -198,6 +198,13 @@ METHOD(shunt_manager_t, install, bool,
entry_t *entry;
bool found = FALSE, success;
if (!ns)
{
DBG1(DBG_CFG, "missing namespace for shunt policy '%s'",
cfg->get_name(cfg));
return FALSE;
}
/* check if not already installed */
this->lock->write_lock(this->lock);
if (this->installing == INSTALL_DISABLED)
@@ -224,7 +231,7 @@ METHOD(shunt_manager_t, install, bool,
return TRUE;
}
INIT(entry,
.ns = strdupnull(ns),
.ns = strdup(ns),
.cfg = cfg->get_ref(cfg),
);
this->shunts->insert_last(this->shunts, entry);
@@ -369,7 +376,7 @@ METHOD(shunt_manager_t, uninstall, bool,
enumerator = this->shunts->create_enumerator(this->shunts);
while (enumerator->enumerate(enumerator, &entry))
{
if (streq(ns, entry->ns) &&
if ((!ns || streq(ns, entry->ns)) &&
streq(name, entry->cfg->get_name(entry->cfg)))
{
this->shunts->remove_at(this->shunts, enumerator);
src/libcharon/sa/shunt_manager.h
+6 -4
View File
@@ -1,5 +1,5 @@
/*
* Copyright (C) 2015-2016 Tobias Brunner
* Copyright (C) 2015-2017 Tobias Brunner
* Copyright (C) 2011 Andreas Steffen
* HSR Hochschule fuer Technik Rapperswil
*
@@ -36,8 +36,7 @@ struct shunt_manager_t {
/**
* Install a policy as a shunt.
*
* @param ns optional namespace (e.g. name of a connection or
* plugin), cloned
* @param ns namespace (e.g. name of a connection or plugin), cloned
* @param child child configuration to install as a shunt
* @return TRUE if installed successfully
*/
@@ -46,7 +45,10 @@ struct shunt_manager_t {
/**
* Uninstall a shunt policy.
*
* @param ns namespace (same as given during installation)
* If no namespace is given the first matching child configuration is
* removed.
*
* @param ns namespace (same as given during installation) or NULL
* @param name name of child configuration to uninstall as a shunt
* @return TRUE if uninstalled successfully
*/
src/libcharon/sa/trap_manager.c
+18 -46
View File
@@ -1,7 +1,7 @@
/*
* Copyright (C) 2011-2015 Tobias Brunner
* Copyright (C) 2011-2017 Tobias Brunner
* Copyright (C) 2009 Martin Willi
* Hochschule fuer Technik Rapperswil
* HSR Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
@@ -183,9 +183,8 @@ static bool dynamic_remote_ts(child_cfg_t *child)
return found;
}
METHOD(trap_manager_t, install, uint32_t,
private_trap_manager_t *this, peer_cfg_t *peer, child_cfg_t *child,
uint32_t reqid)
METHOD(trap_manager_t, install, bool,
private_trap_manager_t *this, peer_cfg_t *peer, child_cfg_t *child)
{
entry_t *entry, *found = NULL;
ike_cfg_t *ike_cfg;
@@ -197,7 +196,7 @@ METHOD(trap_manager_t, install, uint32_t,
linked_list_t *proposals;
proposal_t *proposal;
protocol_id_t proto = PROTO_ESP;
bool wildcard = FALSE;
bool result = FALSE, wildcard = FALSE;
/* try to resolve addresses */
ike_cfg = peer->get_ike_cfg(peer);
@@ -213,7 +212,7 @@ METHOD(trap_manager_t, install, uint32_t,
{
other->destroy(other);
DBG1(DBG_CFG, "installing trap failed, remote address unknown");
return 0;
return FALSE;
}
else
{ /* depending on the traffic selectors we don't really need a remote
@@ -223,7 +222,7 @@ METHOD(trap_manager_t, install, uint32_t,
* which is probably not what users expect*/
DBG1(DBG_CFG, "installing trap failed, remote address unknown with "
"dynamic traffic selector");
return 0;
return FALSE;
}
me = ike_cfg->resolve_me(ike_cfg, other ? other->get_family(other)
: AF_UNSPEC);
@@ -250,12 +249,14 @@ METHOD(trap_manager_t, install, uint32_t,
this->lock->unlock(this->lock);
other->destroy(other);
me->destroy(me);
return 0;
return FALSE;
}
enumerator = this->traps->create_enumerator(this->traps);
while (enumerator->enumerate(enumerator, &entry))
{
if (streq(entry->name, child->get_name(child)))
if (streq(entry->name, child->get_name(child)) &&
streq(entry->peer_cfg->get_name(entry->peer_cfg),
peer->get_name(peer)))
{
found = entry;
if (entry->child_sa)
@@ -275,11 +276,10 @@ METHOD(trap_manager_t, install, uint32_t,
this->lock->unlock(this->lock);
other->destroy(other);
me->destroy(me);
return 0;
return FALSE;
}
/* config might have changed so update everything */
DBG1(DBG_CFG, "updating already routed CHILD_SA '%s'", found->name);
reqid = found->child_sa->get_reqid(found->child_sa);
}
INIT(entry,
@@ -293,7 +293,7 @@ METHOD(trap_manager_t, install, uint32_t,
this->lock->unlock(this->lock);
/* create and route CHILD_SA */
child_sa = child_sa_create(me, other, child, reqid, FALSE, 0, 0);
child_sa = child_sa_create(me, other, child, 0, FALSE, 0, 0);
list = linked_list_create_with_items(me, NULL);
my_ts = child->get_traffic_selectors(child, TRUE, NULL, list);
@@ -325,14 +325,13 @@ METHOD(trap_manager_t, install, uint32_t,
this->lock->unlock(this->lock);
entry->child_sa = child_sa;
destroy_entry(entry);
reqid = 0;
}
else
{
reqid = child_sa->get_reqid(child_sa);
this->lock->write_lock(this->lock);
entry->child_sa = child_sa;
this->lock->unlock(this->lock);
result = TRUE;
}
if (found)
{
@@ -343,11 +342,11 @@ METHOD(trap_manager_t, install, uint32_t,
this->installing--;
this->condvar->signal(this->condvar);
this->lock->unlock(this->lock);
return reqid;
return result;
}
METHOD(trap_manager_t, uninstall, bool,
private_trap_manager_t *this, uint32_t reqid)
private_trap_manager_t *this, char *peer, char *child)
{
enumerator_t *enumerator;
entry_t *entry, *found = NULL;
@@ -356,8 +355,8 @@ METHOD(trap_manager_t, uninstall, bool,
enumerator = this->traps->create_enumerator(this->traps);
while (enumerator->enumerate(enumerator, &entry))
{
if (entry->child_sa &&
entry->child_sa->get_reqid(entry->child_sa) == reqid)
if (streq(entry->name, child) &&
(!peer || streq(peer, entry->peer_cfg->get_name(entry->peer_cfg))))
{
this->traps->remove_at(this->traps, enumerator);
found = entry;
@@ -369,7 +368,6 @@ METHOD(trap_manager_t, uninstall, bool,
if (!found)
{
DBG1(DBG_CFG, "trap %d not found to uninstall", reqid);
return FALSE;
}
destroy_entry(found);
@@ -413,31 +411,6 @@ METHOD(trap_manager_t, create_enumerator, enumerator_t*,
(void*)this->lock->unlock);
}
METHOD(trap_manager_t, find_reqid, uint32_t,
private_trap_manager_t *this, child_cfg_t *child)
{
enumerator_t *enumerator;
entry_t *entry;
uint32_t reqid = 0;
this->lock->read_lock(this->lock);
enumerator = this->traps->create_enumerator(this->traps);
while (enumerator->enumerate(enumerator, &entry))
{
if (streq(entry->name, child->get_name(child)))
{
if (entry->child_sa)
{
reqid = entry->child_sa->get_reqid(entry->child_sa);
}
break;
}
}
enumerator->destroy(enumerator);
this->lock->unlock(this->lock);
return reqid;
}
METHOD(trap_manager_t, acquire, void,
private_trap_manager_t *this, uint32_t reqid,
traffic_selector_t *src, traffic_selector_t *dst)
@@ -693,7 +666,6 @@ trap_manager_t *trap_manager_create(void)
.install = _install,
.uninstall = _uninstall,
.create_enumerator = _create_enumerator,
.find_reqid = _find_reqid,
.acquire = _acquire,
.flush = _flush,
.destroy = _destroy,
src/libcharon/sa/trap_manager.h
+10 -15
View File
@@ -1,6 +1,7 @@
/*
* Copyright (C) 2013-2017 Tobias Brunner
* Copyright (C) 2009 Martin Willi
* Hochschule fuer Technik Rapperswil
* HSR Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
@@ -37,19 +38,21 @@ struct trap_manager_t {
*
* @param peer peer configuration to initiate on trap
* @param child child configuration to install as a trap
* @param reqid optional reqid to use
* @return reqid of installed CHILD_SA, 0 if failed
* @return TRUE if successfully installed
*/
uint32_t (*install)(trap_manager_t *this, peer_cfg_t *peer,
child_cfg_t *child, uint32_t reqid);
bool (*install)(trap_manager_t *this, peer_cfg_t *peer, child_cfg_t *child);
/**
* Uninstall a trap policy.
*
* @param id reqid of CHILD_SA to uninstall, returned by install()
* If no peer configuration name is given the first matching child
* configuration is uninstalled.
*
* @param peer peer configuration name or NULL
* @param child child configuration name
* @return TRUE if uninstalled successfully
*/
bool (*uninstall)(trap_manager_t *this, uint32_t reqid);
bool (*uninstall)(trap_manager_t *this, char *peer, char *child);
/**
* Create an enumerator over all installed traps.
@@ -58,14 +61,6 @@ struct trap_manager_t {
*/
enumerator_t* (*create_enumerator)(trap_manager_t *this);
/**
* Find the reqid of a child config installed as a trap.
*
* @param child CHILD_SA config to get the reqid for
* @return reqid of trap, 0 if not found
*/
uint32_t (*find_reqid)(trap_manager_t *this, child_cfg_t *child);
/**
* Acquire an SA triggered by an installed trap.
*