added support for transport mode and (experimental!) BEET mode

support for the type=transport/tunnel parameter in charon

src/charon/config/policies/policy.c

@@ -130,6 +130,11 @@ struct private_policy_t {
 	 * What to do with an SA when other peer seams to be dead?
 	 */
 	bool dpd_action;
+	
+	/**
+	 * Mode to propose for a initiated CHILD: tunnel/transport
+	 */
+	mode_t mode;
 };
 
 /**
@@ -378,7 +383,6 @@ static dpd_action_t get_dpd_action(private_policy_t *this)
 	return this->dpd_action;
 }
 
-
 /**
  * Implementation of policy_t.add_my_traffic_selector
  */
@@ -423,6 +427,14 @@ static u_int32_t get_hard_lifetime(private_policy_t *this)
 	return this->hard_lifetime;
 }
 
+/**
+ * Implementation of policy_t.get_mode.
+ */
+static mode_t get_mode(private_policy_t *this)
+{
+	return this->mode;
+}
+
 /**
  * Implements policy_t.get_ref.
  */
@@ -475,7 +487,7 @@ policy_t *policy_create(char *name, identification_t *my_id, identification_t *o
 						auth_method_t auth_method,
 						u_int32_t hard_lifetime, u_int32_t soft_lifetime, 
 						u_int32_t jitter, char *updown, bool hostaccess,
-						dpd_action_t dpd_action)
+						mode_t mode, dpd_action_t dpd_action)
 {
 	private_policy_t *this = malloc_thing(private_policy_t);
 
@@ -501,6 +513,7 @@ policy_t *policy_create(char *name, identification_t *my_id, identification_t *o
 	this->public.get_dpd_action = (dpd_action_t (*) (policy_t*))get_dpd_action;
 	this->public.get_soft_lifetime = (u_int32_t (*) (policy_t *))get_soft_lifetime;
 	this->public.get_hard_lifetime = (u_int32_t (*) (policy_t *))get_hard_lifetime;
+	this->public.get_mode = (mode_t (*) (policy_t *))get_mode;
 	this->public.get_ref = (void (*) (policy_t*))get_ref;
 	this->public.destroy = (void (*) (policy_t*))destroy;
 	
@@ -515,6 +528,7 @@ policy_t *policy_create(char *name, identification_t *my_id, identification_t *o
 	this->updown = (updown == NULL) ? NULL : strdup(updown);
 	this->hostaccess = hostaccess;
 	this->dpd_action = dpd_action;
+	this->mode = mode;
 	
 	/* initialize private members*/
 	this->refcount = 1;

src/charon/config/policies/policy.h

@@ -52,6 +52,22 @@ enum dpd_action_t {
 	DPD_RESTART,
 };
 
+/**
+ * @brief Mode of an IPsec SA.
+ *
+ * These are equal to those defined in XFRM, so don't change.
+ *
+ * @ingroup config
+ */
+enum mode_t {
+	/** transport mode, no inner address */
+	MODE_TRANSPORT = 0,
+	/** tunnel mode, inner and outer addresses */
+	MODE_TUNNEL = 1,
+	/** BEET mode, tunnel mode but fixed, bound inner addresses */
+	MODE_BEET = 4,
+};
+
 /**
  * enum names for dpd_action_t.
  */
@@ -290,6 +306,14 @@ struct policy_t {
 	 */
 	u_int32_t (*get_hard_lifetime) (policy_t *this);
 	
+	/**
+	 * @brief Get the mode to use for the CHILD_SA, tunnel, transport or BEET.
+	 * 
+	 * @param this			policy
+	 * @return				lifetime in seconds
+	 */
+	mode_t (*get_mode) (policy_t *this);
+	
 	/**
 	 * @brief Get a new reference.
 	 *
@@ -334,6 +358,7 @@ struct policy_t {
  * @param jitter			range of randomization time
  * @param updown			updown script to execute on up/down event
  * @param hostaccess		allow access to the host itself (used by the updown script)
+ * @param mode				mode to propose for CHILD_SA, transport, tunnel or BEET
  * @param dpd_action		what to to with a CHILD_SA when other peer does not respond
  * @return 					policy_t object
  * 
@@ -343,8 +368,7 @@ policy_t *policy_create(char *name,
 						identification_t *my_id, identification_t *other_id,
 						auth_method_t auth_method,
 						u_int32_t hard_lifetime, u_int32_t soft_lifetime,
-						u_int32_t jitter,
-						char *updown, bool hostaccess,
-						dpd_action_t dpd_action);
+						u_int32_t jitter, char *updown, bool hostaccess,
+						mode_t mode, dpd_action_t dpd_action);
 
 #endif /* POLICY_H_ */

src/charon/config/traffic_selector.c

@@ -447,15 +447,27 @@ static u_int8_t get_protocol(private_traffic_selector_t *this)
  */
 static bool is_host(private_traffic_selector_t *this, host_t *host)
 {
-	chunk_t addr;
-	int family = host->get_family(host);
-	
-	if ((family == AF_INET && this->type == TS_IPV4_ADDR_RANGE) ||
-		(family == AF_INET6 && this->type == TS_IPV6_ADDR_RANGE))
+	if (host)
 	{
-		addr = host->get_address(host);
-		if (memeq(addr.ptr, this->from, addr.len) &&
-			memeq(addr.ptr, this->to, addr.len))
+		chunk_t addr;
+		int family = host->get_family(host);
+		
+		if ((family == AF_INET && this->type == TS_IPV4_ADDR_RANGE) ||
+			(family == AF_INET6 && this->type == TS_IPV6_ADDR_RANGE))
+		{
+			addr = host->get_address(host);
+			if (memeq(addr.ptr, this->from, addr.len) &&
+				memeq(addr.ptr, this->to, addr.len))
+			{
+				return TRUE;
+			}
+		}
+	}
+	else
+	{
+		size_t length =  (this->type == TS_IPV4_ADDR_RANGE) ? 4 : 16;
+		
+		if (memeq(this->from, this->to, length))
 		{
 			return TRUE;
 		}

src/charon/config/traffic_selector.h

@@ -164,6 +164,8 @@ struct traffic_selector_t {
 	 * Traffic selector may describe the end of *-to-host tunnel. In this
 	 * case, the address range is a single address equal to the hosts
 	 * peer address.
+	 * If host is NULL, the traffic selector is checked if it is a single host,
+	 * but not a specific one.
 	 *
 	 * @param this		calling obect
 	 * @param host		host_t specifying the address range