denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

pluto: Migrated get_ipsec_spi to libhydra's kernel interface.

Browse Source
This commit is contained in:
Tobias Brunner
2010-09-02 19:04:19 +02:00
parent 55be07a15f
commit 89f0cca111
1 changed files with 20 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/pluto/kernel.c
+18 -44
View File
@@ -1,7 +1,11 @@
/* routines that interface with the kernel's IPsec mechanism /* routines that interface with the kernel's IPsec mechanism
* Copyright (C) 1997 Angelos D. Keromytis. *
* Copyright (C) 1998-2002 D. Hugh Redelmeier. * Copyright (C) 2010 Tobias Brunner
* Copyright (C) 2009 Andreas Steffen - Hochschule fuer Technik Rapperswil * Copyright (C) 2009 Andreas Steffen
* Hochschule fuer Technik Rapperswil
*
* Copyright (C) 1998-2002 D. Hugh Redelmeier
* Copyright (C) 1997 Angelos D. Keromytis
* *
* This program is free software; you can redistribute it and/or modify it * This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the * under the terms of the GNU General Public License as published by the
@@ -32,6 +36,7 @@
#include <freeswan.h> #include <freeswan.h>
#include <library.h> #include <library.h>
#include <hydra.h>
#include <crypto/rngs/rng.h> #include <crypto/rngs/rng.h>
#ifdef KLIPS #ifdef KLIPS
@@ -256,58 +261,27 @@ static unsigned get_proto_reqid(unsigned base, int proto)
/* Generate Unique SPI numbers. /* Generate Unique SPI numbers.
* *
* The specs say that the number must not be less than IPSEC_DOI_SPI_MIN.
* Pluto generates numbers not less than IPSEC_DOI_SPI_OUR_MIN,
* reserving numbers in between for manual keying (but we cannot so
* restrict numbers generated by our peer).
* XXX This should be replaced by a call to the kernel when
* XXX we get an API.
* The returned SPI is in network byte order. * The returned SPI is in network byte order.
* We use a random number as the initial SPI so that there is
* a good chance that different Pluto instances will choose
* different SPIs. This is good for two reasons.
* - the keying material for the initiator and responder only
* differs if the SPIs differ.
* - if Pluto is restarted, it would otherwise recycle the SPI
* numbers and confuse everything. When the kernel generates
* SPIs, this will no longer matter.
* We then allocate numbers sequentially. Thus we don't have to
* check if the number was previously used (assuming that no
* SPI lives longer than 4G of its successors).
*/ */
ipsec_spi_t get_ipsec_spi(ipsec_spi_t avoid, int proto, struct spd_route *sr, ipsec_spi_t get_ipsec_spi(ipsec_spi_t avoid, int proto, struct spd_route *sr,
bool tunnel) bool tunnel)
{ {
static ipsec_spi_t spi = 0; /* host order, so not returned directly! */ host_t *host_src, *host_dst;
char text_said[SATOT_BUF]; u_int32_t spi;
rng_t *rng;
set_text_said(text_said, &sr->this.host_addr, 0, proto); host_src = host_create_from_sockaddr((sockaddr_t*)&sr->that.host_addr);
host_dst = host_create_from_sockaddr((sockaddr_t*)&sr->this.host_addr);
if (kernel_ops->get_spi) if (hydra->kernel_interface->get_spi(hydra->kernel_interface, host_src,
host_dst, proto, sr->reqid, &spi) != SUCCESS)
{ {
return kernel_ops->get_spi(&sr->that.host_addr spi = 0;
, &sr->this.host_addr, proto, tunnel
, get_proto_reqid(sr->reqid, proto)
, IPSEC_DOI_SPI_OUR_MIN, 0xffffffff
, text_said);
} }
spi++; host_src->destroy(host_src);
rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK); host_dst->destroy(host_dst);
while (spi < IPSEC_DOI_SPI_OUR_MIN || spi == ntohl(avoid))
{
rng->get_bytes(rng, sizeof(spi), (u_char *)&spi);
}
rng->destroy(rng);
DBG(DBG_CONTROL,
{
ipsec_spi_t spi_net = htonl(spi);
DBG_dump("generate SPI:", (u_char *)&spi_net, sizeof(spi_net)); return spi;
});
return htonl(spi);
} }
/* Generate Unique CPI numbers. /* Generate Unique CPI numbers.