kernel: Use structs to pass information to the kernel-ipsec interface
This commit is contained in:
Tobias Brunner
committed by
Andreas Steffen
Andreas Steffen
parent
ea3a4d3f72
commit
89da06ace9
@@ -81,13 +81,8 @@ METHOD(kernel_ipsec_t, get_cpi, status_t,
|
||||
}
|
||||
|
||||
METHOD(kernel_ipsec_t, add_sa, status_t,
|
||||
private_tkm_kernel_ipsec_t *this, host_t *src, host_t *dst,
|
||||
uint32_t spi, uint8_t protocol, uint32_t reqid, mark_t mark,
|
||||
uint32_t tfc, lifetime_cfg_t *lifetime, uint16_t enc_alg, chunk_t enc_key,
|
||||
uint16_t int_alg, chunk_t int_key, ipsec_mode_t mode,
|
||||
uint16_t ipcomp, uint16_t cpi, uint32_t replay_window,
|
||||
bool initiator, bool encap, bool esn, bool inbound, bool update,
|
||||
linked_list_t* src_ts, linked_list_t* dst_ts)
|
||||
private_tkm_kernel_ipsec_t *this, kernel_ipsec_sa_id_t *id,
|
||||
kernel_ipsec_add_sa_t *data)
|
||||
{
|
||||
esa_info_t esa;
|
||||
esp_spi_type spi_loc, spi_rem;
|
||||
@@ -97,43 +92,43 @@ METHOD(kernel_ipsec_t, add_sa, status_t,
|
||||
esa_id_type esa_id;
|
||||
nonce_type nc_rem;
|
||||
|
||||
if (enc_key.ptr == NULL)
|
||||
if (data->enc_key.ptr == NULL)
|
||||
{
|
||||
DBG1(DBG_KNL, "Unable to get ESA information");
|
||||
return FAILED;
|
||||
}
|
||||
esa = *(esa_info_t *)(enc_key.ptr);
|
||||
esa = *(esa_info_t *)(data->enc_key.ptr);
|
||||
|
||||
/* only handle the case where we have both distinct ESP spi's available */
|
||||
if (esa.spi_r == spi)
|
||||
if (esa.spi_r == id->spi)
|
||||
{
|
||||
chunk_free(&esa.nonce_i);
|
||||
chunk_free(&esa.nonce_r);
|
||||
return SUCCESS;
|
||||
}
|
||||
|
||||
if (initiator)
|
||||
if (data->initiator)
|
||||
{
|
||||
spi_loc = spi;
|
||||
spi_loc = id->spi;
|
||||
spi_rem = esa.spi_r;
|
||||
local = dst;
|
||||
peer = src;
|
||||
local = id->dst;
|
||||
peer = id->src;
|
||||
nonce_loc = &esa.nonce_i;
|
||||
nonce_rem = &esa.nonce_r;
|
||||
}
|
||||
else
|
||||
{
|
||||
spi_loc = esa.spi_r;
|
||||
spi_rem = spi;
|
||||
local = src;
|
||||
peer = dst;
|
||||
spi_rem = id->spi;
|
||||
local = id->src;
|
||||
peer = id->dst;
|
||||
nonce_loc = &esa.nonce_r;
|
||||
nonce_rem = &esa.nonce_i;
|
||||
}
|
||||
|
||||
esa_id = tkm->idmgr->acquire_id(tkm->idmgr, TKM_CTX_ESA);
|
||||
if (!tkm->sad->insert(tkm->sad, esa_id, reqid, local, peer, spi_loc, spi_rem,
|
||||
protocol))
|
||||
if (!tkm->sad->insert(tkm->sad, esa_id, data->reqid, local, peer,
|
||||
spi_loc, spi_rem, id->proto))
|
||||
{
|
||||
DBG1(DBG_KNL, "unable to add entry (%llu) to SAD", esa_id);
|
||||
goto sad_failure;
|
||||
@@ -146,8 +141,8 @@ METHOD(kernel_ipsec_t, add_sa, status_t,
|
||||
nonce_loc_id = tkm->chunk_map->get_id(tkm->chunk_map, nonce_loc);
|
||||
if (nonce_loc_id == 0 && esa.dh_id == 0)
|
||||
{
|
||||
if (ike_esa_create_first(esa_id, esa.isa_id, reqid, 1, spi_loc, spi_rem)
|
||||
!= TKM_OK)
|
||||
if (ike_esa_create_first(esa_id, esa.isa_id, data->reqid, 1, spi_loc,
|
||||
spi_rem) != TKM_OK)
|
||||
{
|
||||
DBG1(DBG_KNL, "child SA (%llu, first) creation failed", esa_id);
|
||||
goto failure;
|
||||
@@ -157,9 +152,9 @@ METHOD(kernel_ipsec_t, add_sa, status_t,
|
||||
else if (nonce_loc_id != 0 && esa.dh_id == 0)
|
||||
{
|
||||
chunk_to_sequence(nonce_rem, &nc_rem, sizeof(nonce_type));
|
||||
if (ike_esa_create_no_pfs(esa_id, esa.isa_id, reqid, 1, nonce_loc_id,
|
||||
nc_rem, initiator, spi_loc, spi_rem)
|
||||
!= TKM_OK)
|
||||
if (ike_esa_create_no_pfs(esa_id, esa.isa_id, data->reqid, 1,
|
||||
nonce_loc_id, nc_rem, data->initiator,
|
||||
spi_loc, spi_rem) != TKM_OK)
|
||||
{
|
||||
DBG1(DBG_KNL, "child SA (%llu, no PFS) creation failed", esa_id);
|
||||
goto failure;
|
||||
@@ -171,8 +166,9 @@ METHOD(kernel_ipsec_t, add_sa, status_t,
|
||||
else
|
||||
{
|
||||
chunk_to_sequence(nonce_rem, &nc_rem, sizeof(nonce_type));
|
||||
if (ike_esa_create(esa_id, esa.isa_id, reqid, 1, esa.dh_id, nonce_loc_id,
|
||||
nc_rem, initiator, spi_loc, spi_rem) != TKM_OK)
|
||||
if (ike_esa_create(esa_id, esa.isa_id, data->reqid, 1, esa.dh_id,
|
||||
nonce_loc_id, nc_rem, data->initiator, spi_loc,
|
||||
spi_rem) != TKM_OK)
|
||||
{
|
||||
DBG1(DBG_KNL, "child SA (%llu) creation failed", esa_id);
|
||||
goto failure;
|
||||
@@ -192,7 +188,7 @@ METHOD(kernel_ipsec_t, add_sa, status_t,
|
||||
|
||||
DBG1(DBG_KNL, "added child SA (esa: %llu, isa: %llu, esp_spi_loc: %x, "
|
||||
"esp_spi_rem: %x, role: %s)", esa_id, esa.isa_id, ntohl(spi_loc),
|
||||
ntohl(spi_rem), initiator ? "initiator" : "responder");
|
||||
ntohl(spi_rem), data->initiator ? "initiator" : "responder");
|
||||
chunk_free(&esa.nonce_i);
|
||||
chunk_free(&esa.nonce_r);
|
||||
|
||||
@@ -208,20 +204,21 @@ sad_failure:
|
||||
}
|
||||
|
||||
METHOD(kernel_ipsec_t, query_sa, status_t,
|
||||
private_tkm_kernel_ipsec_t *this, host_t *src, host_t *dst,
|
||||
uint32_t spi, uint8_t protocol, mark_t mark, uint64_t *bytes,
|
||||
uint64_t *packets, time_t *time)
|
||||
private_tkm_kernel_ipsec_t *this, kernel_ipsec_sa_id_t *id,
|
||||
kernel_ipsec_query_sa_t *data, uint64_t *bytes, uint64_t *packets,
|
||||
time_t *time)
|
||||
{
|
||||
return NOT_SUPPORTED;
|
||||
}
|
||||
|
||||
METHOD(kernel_ipsec_t, del_sa, status_t,
|
||||
private_tkm_kernel_ipsec_t *this, host_t *src, host_t *dst,
|
||||
uint32_t spi, uint8_t protocol, uint16_t cpi, mark_t mark)
|
||||
private_tkm_kernel_ipsec_t *this, kernel_ipsec_sa_id_t *id,
|
||||
kernel_ipsec_del_sa_t *data)
|
||||
{
|
||||
esa_id_type esa_id, other_esa_id;
|
||||
|
||||
esa_id = tkm->sad->get_esa_id(tkm->sad, src, dst, spi, protocol);
|
||||
esa_id = tkm->sad->get_esa_id(tkm->sad, id->src, id->dst,
|
||||
id->spi, id->proto);
|
||||
if (esa_id)
|
||||
{
|
||||
other_esa_id = tkm->sad->get_other_esa_id(tkm->sad, esa_id);
|
||||
@@ -236,7 +233,7 @@ METHOD(kernel_ipsec_t, del_sa, status_t,
|
||||
}
|
||||
|
||||
DBG1(DBG_KNL, "deleting child SA (esa: %llu, spi: %x)", esa_id,
|
||||
ntohl(spi));
|
||||
ntohl(id->spi));
|
||||
if (ike_esa_reset(esa_id) != TKM_OK)
|
||||
{
|
||||
DBG1(DBG_KNL, "child SA (%llu) deletion failed", esa_id);
|
||||
@@ -249,9 +246,8 @@ METHOD(kernel_ipsec_t, del_sa, status_t,
|
||||
}
|
||||
|
||||
METHOD(kernel_ipsec_t, update_sa, status_t,
|
||||
private_tkm_kernel_ipsec_t *this, uint32_t spi, uint8_t protocol,
|
||||
uint16_t cpi, host_t *src, host_t *dst, host_t *new_src, host_t *new_dst,
|
||||
bool old_encap, bool new_encap, mark_t mark)
|
||||
private_tkm_kernel_ipsec_t *this, kernel_ipsec_sa_id_t *id,
|
||||
kernel_ipsec_update_sa_t *data)
|
||||
{
|
||||
return NOT_SUPPORTED;
|
||||
}
|
||||
@@ -264,27 +260,22 @@ METHOD(kernel_ipsec_t, flush_sas, status_t,
|
||||
}
|
||||
|
||||
METHOD(kernel_ipsec_t, add_policy, status_t,
|
||||
private_tkm_kernel_ipsec_t *this, host_t *src, host_t *dst,
|
||||
traffic_selector_t *src_ts, traffic_selector_t *dst_ts,
|
||||
policy_dir_t direction, policy_type_t type, ipsec_sa_cfg_t *sa,
|
||||
mark_t mark, policy_priority_t priority)
|
||||
private_tkm_kernel_ipsec_t *this, kernel_ipsec_policy_id_t *id,
|
||||
kernel_ipsec_manage_policy_t *data)
|
||||
{
|
||||
return SUCCESS;
|
||||
}
|
||||
|
||||
METHOD(kernel_ipsec_t, query_policy, status_t,
|
||||
private_tkm_kernel_ipsec_t *this, traffic_selector_t *src_ts,
|
||||
traffic_selector_t *dst_ts, policy_dir_t direction, mark_t mark,
|
||||
time_t *use_time)
|
||||
private_tkm_kernel_ipsec_t *this, kernel_ipsec_policy_id_t *id,
|
||||
kernel_ipsec_query_policy_t *data, time_t *use_time)
|
||||
{
|
||||
return NOT_SUPPORTED;
|
||||
}
|
||||
|
||||
METHOD(kernel_ipsec_t, del_policy, status_t,
|
||||
private_tkm_kernel_ipsec_t *this, host_t *src, host_t *dst,
|
||||
traffic_selector_t *src_ts, traffic_selector_t *dst_ts,
|
||||
policy_dir_t direction, policy_type_t type, ipsec_sa_cfg_t *sa,
|
||||
mark_t mark, policy_priority_t priority)
|
||||
private_tkm_kernel_ipsec_t *this, kernel_ipsec_policy_id_t *id,
|
||||
kernel_ipsec_manage_policy_t *data)
|
||||
{
|
||||
return SUCCESS;
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user