denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

kernel-wfp: Install routes for trap policies

Browse Source
This commit is contained in:
Martin Willi
2014-06-04 16:32:11 +02:00
parent e36d1d4124
commit 78bde29a7c
1 changed files with 21 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/kernel_wfp/kernel_wfp_ipsec.c
+21 -3
View File
@@ -1440,6 +1440,12 @@ typedef struct {
u_int32_t reqid; u_int32_t reqid;
/** is this a forward policy trap for tunnel mode? */ /** is this a forward policy trap for tunnel mode? */
bool fwd; bool fwd;
/** do we have installed a route for this trap policy? */
bool route;
/** local address of associated route */
host_t *local;
/** remote address of associated route */
host_t *remote;
/** src traffic selector */ /** src traffic selector */
traffic_selector_t *src; traffic_selector_t *src;
/** dst traffic selector */ /** dst traffic selector */
@@ -1453,6 +1459,8 @@ typedef struct {
*/ */
static void destroy_trap(trap_t *this) static void destroy_trap(trap_t *this)
{ {
this->local->destroy(this->local);
this->remote->destroy(this->remote);
this->src->destroy(this->src); this->src->destroy(this->src);
this->dst->destroy(this->dst); this->dst->destroy(this->dst);
free(this); free(this);
@@ -1699,7 +1707,7 @@ static bool uninstall_trap(private_kernel_wfp_ipsec_t *this, trap_t *trap)
* Create and install a new trap entry * Create and install a new trap entry
*/ */
static bool add_trap(private_kernel_wfp_ipsec_t *this, static bool add_trap(private_kernel_wfp_ipsec_t *this,
u_int32_t reqid, bool fwd, u_int32_t reqid, bool fwd, host_t *local, host_t *remote,
traffic_selector_t *src, traffic_selector_t *dst) traffic_selector_t *src, traffic_selector_t *dst)
{ {
trap_t *trap; trap_t *trap;
@@ -1709,6 +1717,8 @@ static bool add_trap(private_kernel_wfp_ipsec_t *this,
.fwd = fwd, .fwd = fwd,
.src = src->clone(src), .src = src->clone(src),
.dst = dst->clone(dst), .dst = dst->clone(dst),
.local = local->clone(local),
.remote = remote->clone(remote),
); );
if (!install_trap(this, trap)) if (!install_trap(this, trap))
@@ -1716,6 +1726,9 @@ static bool add_trap(private_kernel_wfp_ipsec_t *this,
destroy_trap(trap); destroy_trap(trap);
return FALSE; return FALSE;
} }
trap->route = manage_route(this, local, remote, src, dst, TRUE);
this->mutex->lock(this->mutex); this->mutex->lock(this->mutex);
this->traps->put(this->traps, trap, trap); this->traps->put(this->traps, trap, trap);
this->mutex->unlock(this->mutex); this->mutex->unlock(this->mutex);
@@ -1751,6 +1764,11 @@ static bool remove_trap(private_kernel_wfp_ipsec_t *this,
if (found) if (found)
{ {
if (trap->route)
{
trap->route = !manage_route(this, trap->local, trap->remote,
src, dst, FALSE);
}
uninstall_trap(this, found); uninstall_trap(this, found);
destroy_trap(found); destroy_trap(found);
return TRUE; return TRUE;
@@ -2215,13 +2233,13 @@ METHOD(kernel_ipsec_t, add_policy, status_t,
case POLICY_PRIORITY_DEFAULT: case POLICY_PRIORITY_DEFAULT:
break; break;
case POLICY_PRIORITY_ROUTED: case POLICY_PRIORITY_ROUTED:
if (!add_trap(this, sa->reqid, FALSE, src_ts, dst_ts)) if (!add_trap(this, sa->reqid, FALSE, src, dst, src_ts, dst_ts))
{ {
return FAILED; return FAILED;
} }
if (sa->mode == MODE_TUNNEL) if (sa->mode == MODE_TUNNEL)
{ {
if (!add_trap(this, sa->reqid, TRUE, src_ts, dst_ts)) if (!add_trap(this, sa->reqid, TRUE, src, dst, src_ts, dst_ts))
{ {
return FAILED; return FAILED;
} }