denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

child-sa: Replace reqid based marks by "unique" marks

Browse Source 
As we now use the same reqid for multiple CHILD_SAs with the same selectors,
having marks based on the reqid makes not that much sense anymore. Instead we
use unique marks that use a custom identifier. This identifier is reused during
rekeying, keeping the marks constant for any rule relying on it (for example
installed by updown).

This also simplifies handling of reqid allocation, as we do not have to query
the marks that is not yet assigned for an unknown reqid.
This commit is contained in:
Martin Willi
2015-02-20 13:34:49 +01:00
parent 4ec397b894
commit 85b238887d
13 changed files with 126 additions and 74 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/child_sa.c
+27 -4
View File
@@ -695,7 +695,7 @@ METHOD(child_sa_t, install, status_t,
if (!this->reqid_allocated)
{
status = hydra->kernel_interface->alloc_reqid(hydra->kernel_interface,
my_ts, other_ts, &this->mark_in, &this->mark_out,
my_ts, other_ts, this->mark_in, this->mark_out,
&this->reqid);
if (status != SUCCESS)
{
@@ -825,7 +825,7 @@ METHOD(child_sa_t, add_policies, status_t,
/* trap policy, get or confirm reqid */
status = hydra->kernel_interface->alloc_reqid(
hydra->kernel_interface, my_ts_list, other_ts_list,
&this->mark_in, &this->mark_out, &this->reqid);
this->mark_in, this->mark_out, &this->reqid);
if (status != SUCCESS)
{
return status;
@@ -1198,10 +1198,11 @@ static host_t* get_proxy_addr(child_cfg_t *config, host_t *ike, bool local)
* Described in header.
*/
child_sa_t * child_sa_create(host_t *me, host_t* other,
child_cfg_t *config, u_int32_t rekey, bool encap)
child_cfg_t *config, u_int32_t rekey, bool encap,
u_int mark_in, u_int mark_out)
{
private_child_sa_t *this;
static refcount_t unique_id = 0;
static refcount_t unique_id = 0, unique_mark = 0, mark;
INIT(this,
.public = {
@@ -1258,6 +1259,28 @@ child_sa_t * child_sa_create(host_t *me, host_t* other,
this->config = config;
config->get_ref(config);
if (mark_in)
{
this->mark_in.value = mark_in;
}
if (mark_out)
{
this->mark_out.value = mark_out;
}
if (this->mark_in.value == MARK_UNIQUE ||
this->mark_out.value == MARK_UNIQUE)
{
mark = ref_get(&unique_mark);
if (this->mark_in.value == MARK_UNIQUE)
{
this->mark_in.value = mark;
}
if (this->mark_out.value == MARK_UNIQUE)
{
this->mark_out.value = mark;
}
}
if (!this->reqid)
{
/* reuse old reqid if we are rekeying an existing CHILD_SA. While the