denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

child-cfg: Use flags for boolean options

Browse Source 
Makes it potentially easier to add new flags.
This commit is contained in:
Tobias Brunner
2017-05-23 16:51:15 +02:00
parent d42948fc05
commit 749ac175fa
12 changed files with 129 additions and 153 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/config/child_cfg.c
+18 -73
View File
@@ -1,6 +1,6 @@
/*
* Copyright (C) 2008-2017 Tobias Brunner
* Copyright (C) 2016 Andreas Steffen
* Copyright (C) 2008-2016 Tobias Brunner
* Copyright (C) 2005-2007 Martin Willi
* Copyright (C) 2005 Jan Hutter
* HSR Hochschule fuer Technik Rapperswil
@@ -53,6 +53,11 @@ struct private_child_cfg_t {
*/
char *name;
/**
* Options
*/
child_cfg_option_t options;
/**
* list for all proposals
*/
@@ -73,11 +78,6 @@ struct private_child_cfg_t {
*/
char *updown;
/**
* allow host access
*/
bool hostaccess;
/**
* Mode to propose for a initiated CHILD: tunnel/transport
*/
@@ -103,11 +103,6 @@ struct private_child_cfg_t {
*/
lifetime_cfg_t lifetime;
/**
* enable IPComp
*/
bool use_ipcomp;
/**
* Inactivity timeout
*/
@@ -143,21 +138,6 @@ struct private_child_cfg_t {
*/
char *interface;
/**
* set up IPsec transport SA in MIPv6 proxy mode
*/
bool proxy_mode;
/**
* enable installation and removal of kernel IPsec policies
*/
bool install_policy;
/**
* Install outbound FWD policies
*/
bool fwd_out_policy;
/**
* anti-replay window size
*/
@@ -170,6 +150,12 @@ METHOD(child_cfg_t, get_name, char*,
return this->name;
}
METHOD(child_cfg_t, has_option, bool,
private_child_cfg_t *this, child_cfg_option_t option)
{
return this->options & option;
}
METHOD(child_cfg_t, add_proposal, void,
private_child_cfg_t *this, proposal_t *proposal)
{
@@ -311,8 +297,9 @@ METHOD(child_cfg_t, get_traffic_selectors, linked_list_t*,
{
if (hosts && hosts->get_count(hosts))
{ /* set hosts if TS is dynamic or as initiator in transport mode */
bool dynamic = ts1->is_dynamic(ts1);
if (dynamic || (this->mode == MODE_TRANSPORT && !this->proxy_mode &&
bool dynamic = ts1->is_dynamic(ts1),
proxy_mode = has_option(this, OPT_PROXY_MODE);
if (dynamic || (this->mode == MODE_TRANSPORT && !proxy_mode &&
!supplied))
{
e2 = hosts->create_enumerator(hosts);
@@ -428,12 +415,6 @@ METHOD(child_cfg_t, get_updown, char*,
return this->updown;
}
METHOD(child_cfg_t, get_hostaccess, bool,
private_child_cfg_t *this)
{
return this->hostaccess;
}
/**
* Applies jitter to the rekey value. Returns the new rekey value.
* Note: The distribution of random values is not perfect, but it
@@ -508,12 +489,6 @@ METHOD(child_cfg_t, get_dh_group, diffie_hellman_group_t,
return dh_group;
}
METHOD(child_cfg_t, use_ipcomp, bool,
private_child_cfg_t *this)
{
return this->use_ipcomp;
}
METHOD(child_cfg_t, get_inactivity, uint32_t,
private_child_cfg_t *this)
{
@@ -562,24 +537,6 @@ METHOD(child_cfg_t, set_replay_window, void,
this->replay_window = replay_window;
}
METHOD(child_cfg_t, use_proxy_mode, bool,
private_child_cfg_t *this)
{
return this->proxy_mode;
}
METHOD(child_cfg_t, install_policy, bool,
private_child_cfg_t *this)
{
return this->install_policy;
}
METHOD(child_cfg_t, install_fwd_out_policy, bool,
private_child_cfg_t *this)
{
return this->fwd_out_policy;
}
#define LT_PART_EQUALS(a, b) ({ a.life == b.life && a.rekey == b.rekey && a.jitter == b.jitter; })
#define LIFETIME_EQUALS(a, b) ({ LT_PART_EQUALS(a.time, b.time) && LT_PART_EQUALS(a.bytes, b.bytes) && LT_PART_EQUALS(a.packets, b.packets); })
@@ -611,13 +568,12 @@ METHOD(child_cfg_t, equals, bool,
{
return FALSE;
}
return this->hostaccess == other->hostaccess &&
return this->options == other->options &&
this->mode == other->mode &&
this->start_action == other->start_action &&
this->dpd_action == other->dpd_action &&
this->close_action == other->close_action &&
LIFETIME_EQUALS(this->lifetime, other->lifetime) &&
this->use_ipcomp == other->use_ipcomp &&
this->inactivity == other->inactivity &&
this->reqid == other->reqid &&
this->mark_in.value == other->mark_in.value &&
@@ -627,9 +583,6 @@ METHOD(child_cfg_t, equals, bool,
this->tfc == other->tfc &&
this->manual_prio == other->manual_prio &&
this->replay_window == other->replay_window &&
this->proxy_mode == other->proxy_mode &&
this->install_policy == other->install_policy &&
this->fwd_out_policy == other->fwd_out_policy &&
streq(this->updown, other->updown) &&
streq(this->interface, other->interface);
}
@@ -672,14 +625,12 @@ child_cfg_t *child_cfg_create(char *name, child_cfg_create_t *data)
.get_proposals = _get_proposals,
.select_proposal = _select_proposal,
.get_updown = _get_updown,
.get_hostaccess = _get_hostaccess,
.get_mode = _get_mode,
.get_start_action = _get_start_action,
.get_dpd_action = _get_dpd_action,
.get_close_action = _get_close_action,
.get_lifetime = _get_lifetime,
.get_dh_group = _get_dh_group,
.use_ipcomp = _use_ipcomp,
.get_inactivity = _get_inactivity,
.get_reqid = _get_reqid,
.get_mark = _get_mark,
@@ -688,19 +639,16 @@ child_cfg_t *child_cfg_create(char *name, child_cfg_create_t *data)
.get_interface = _get_interface,
.get_replay_window = _get_replay_window,
.set_replay_window = _set_replay_window,
.use_proxy_mode = _use_proxy_mode,
.install_policy = _install_policy,
.install_fwd_out_policy = _install_fwd_out_policy,
.has_option = _has_option,
.equals = _equals,
.get_ref = _get_ref,
.destroy = _destroy,
},
.name = strdup(name),
.options = data->options,
.updown = strdupnull(data->updown),
.hostaccess = data->hostaccess,
.reqid = data->reqid,
.mode = data->mode,
.proxy_mode = data->proxy_mode,
.start_action = data->start_action,
.dpd_action = data->dpd_action,
.close_action = data->close_action,
@@ -708,12 +656,9 @@ child_cfg_t *child_cfg_create(char *name, child_cfg_create_t *data)
.mark_out = data->mark_out,
.lifetime = data->lifetime,
.inactivity = data->inactivity,
.use_ipcomp = data->ipcomp,
.tfc = data->tfc,
.manual_prio = data->priority,
.interface = strdupnull(data->interface),
.install_policy = !data->suppress_policies,
.fwd_out_policy = data->fwd_out_policies,
.refcount = 1,
.proposals = linked_list_create(),
.my_ts = linked_list_create(),
src/libcharon/config/child_cfg.h
+29 -47
View File
@@ -1,6 +1,6 @@
/*
* Copyright (C) 2008-2017 Tobias Brunner
* Copyright (C) 2016 Andreas Steffen
* Copyright (C) 2008-2016 Tobias Brunner
* Copyright (C) 2005-2007 Martin Willi
* Copyright (C) 2005 Jan Hutter
* HSR Hochschule fuer Technik Rapperswil
@@ -25,6 +25,7 @@
#define CHILD_CFG_H_
typedef enum action_t action_t;
typedef enum child_cfg_option_t child_cfg_option_t;
typedef struct child_cfg_t child_cfg_t;
typedef struct child_cfg_create_t child_cfg_create_t;
@@ -146,13 +147,6 @@ struct child_cfg_t {
*/
char* (*get_updown)(child_cfg_t *this);
/**
* Should we allow access to the local host (gateway)?
*
* @return value of hostaccess flag
*/
bool (*get_hostaccess) (child_cfg_t *this);
/**
* Get the lifetime configuration of a CHILD_SA.
*
@@ -202,14 +196,6 @@ struct child_cfg_t {
*/
diffie_hellman_group_t (*get_dh_group)(child_cfg_t *this);
/**
* Check whether IPComp should be used, if the other peer supports it.
*
* @return TRUE, if IPComp should be used
* FALSE, otherwise
*/
bool (*use_ipcomp)(child_cfg_t *this);
/**
* Get the inactivity timeout value.
*
@@ -263,33 +249,17 @@ struct child_cfg_t {
/**
* Set anti-replay window size
*
* @param window anti-replay window size
* @param window anti-replay window size
*/
void (*set_replay_window)(child_cfg_t *this, uint32_t window);
/**
* Check whether IPsec transport SA should be set up in proxy mode.
* Check if an option flag is set.
*
* @return TRUE, if proxy mode should be used
* FALSE, otherwise
* @param option option flag to check
* @return TRUE if option flag set, FALSE otherwise
*/
bool (*use_proxy_mode)(child_cfg_t *this);
/**
* Check whether IPsec policies should be installed in the kernel.
*
* @return TRUE, if IPsec kernel policies should be installed
* FALSE, otherwise
*/
bool (*install_policy)(child_cfg_t *this);
/**
* Check whether outbound FWD IPsec policies should be installed.
*
* @return TRUE, if outbound FWD policies should be installed
* FALSE, otherwise
*/
bool (*install_fwd_out_policy)(child_cfg_t *this);
bool (*has_option)(child_cfg_t *this, child_cfg_option_t option);
/**
* Check if two child_cfg objects are equal.
@@ -315,11 +285,33 @@ struct child_cfg_t {
void (*destroy) (child_cfg_t *this);
};
/**
* Option flags that may be set on a child_cfg_t object
*/
enum child_cfg_option_t {
/** Use IPsec transport proxy mode */
OPT_PROXY_MODE = (1<<0),
/** Use IPComp, if peer supports it */
OPT_IPCOMP = (1<<1),
/** Allow access to the local host */
OPT_HOSTACCESS = (1<<2),
/** Don't install any IPsec policies */
OPT_NO_POLICIES = (1<<3),
/** Install outbound FWD IPsec policies to bypass drop policies */
OPT_FWD_OUT_POLICIES = (1<<4),
};
/**
* Data passed to the constructor of a child_cfg_t object.
*/
struct child_cfg_create_t {
/** Options set for CHILD_SA */
child_cfg_option_t options;
/** Specific reqid to use for CHILD_SA, 0 for auto assignment */
uint32_t reqid;
/** Optional inbound mark */
@@ -328,10 +320,6 @@ struct child_cfg_create_t {
mark_t mark_out;
/** Mode to propose for CHILD_SA */
ipsec_mode_t mode;
/** Use IPsec transport proxy mode */
bool proxy_mode;
/** Use IPComp, if peer supports it */
bool ipcomp;
/** TFC padding size, 0 to disable, -1 to pad to PMTU */
uint32_t tfc;
/** Optional manually-set IPsec policy priority */
@@ -350,12 +338,6 @@ struct child_cfg_create_t {
action_t close_action;
/** updown script to execute on up/down event (cloned) */
char *updown;
/** TRUE to allow access to the local host */
bool hostaccess;
/** Don't install IPsec policies */
bool suppress_policies;
/** Install outbound FWD IPsec policies to bypass drop policies */
bool fwd_out_policies;
};
/**