denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

cleanups in kernel interface code

Browse Source 
added proper traffic selector to string conversion
some cleanups here & there
This commit is contained in:
Martin Willi
2006-07-18 12:53:54 +00:00
parent 623d3dcf78
commit 92ee45a0ee
23 changed files with 730 additions and 586 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/charon/threads/kernel_interface.c
+218 -64
View File
@@ -29,6 +29,7 @@
#include <sys/socket.h>
#include <linux/netlink.h>
#include <linux/rtnetlink.h>
#include <linux/xfrm.h>
#include <linux/udp.h>
#include <pthread.h>
#include <unistd.h>
@@ -389,8 +390,8 @@ static void receive_messages(private_kernel_interface_t *this)
* list these responses for the sender
*/
else if (hdr->nlmsg_type == NLMSG_ERROR ||
hdr->nlmsg_type == XFRM_MSG_NEWSA ||
hdr->nlmsg_type == XFRM_MSG_NEWPOLICY)
hdr->nlmsg_type == XFRM_MSG_NEWSA ||
hdr->nlmsg_type == XFRM_MSG_NEWPOLICY)
{
/* add response to queue */
listed_response = malloc(hdr->nlmsg_len);
@@ -408,11 +409,20 @@ static void receive_messages(private_kernel_interface_t *this)
}
}
/**
* convert a host_t to a struct xfrm_address
*/
static void host2xfrm(host_t *host, xfrm_address_t *xfrm)
{
chunk_t chunk = host->get_address(host);
memcpy(xfrm, chunk.ptr, max(chunk.len, sizeof(xfrm_address_t)));
}
/**
* Implementation of kernel_interface_t.get_spi.
*/
static status_t get_spi(private_kernel_interface_t *this,
host_t *src, host_t *dest,
host_t *src, host_t *dst,
protocol_id_t protocol, u_int32_t reqid,
u_int32_t *spi)
{
@@ -432,8 +442,8 @@ static status_t get_spi(private_kernel_interface_t *this,
hdr->nlmsg_len = NLMSG_LENGTH(sizeof(struct xfrm_userspi_info));
userspi = (struct xfrm_userspi_info*)NLMSG_DATA(hdr);
userspi->info.saddr = src->get_xfrm_addr(src);
userspi->info.id.daddr = dest->get_xfrm_addr(dest);
host2xfrm(src, &userspi->info.saddr);
host2xfrm(dst, &userspi->info.id.daddr);
userspi->info.id.proto = (protocol == PROTO_ESP) ? KERNEL_ESP : KERNEL_AH;
userspi->info.mode = TRUE; /* tunnel mode */
userspi->info.reqid = reqid;
@@ -476,9 +486,8 @@ static status_t get_spi(private_kernel_interface_t *this,
* Implementation of kernel_interface_t.add_sa.
*/
static status_t add_sa(private_kernel_interface_t *this,
host_t *me, host_t *other,
u_int32_t spi, protocol_id_t protocol,
u_int32_t reqid,
host_t *src, host_t *dst, u_int32_t spi,
protocol_id_t protocol, u_int32_t reqid,
u_int64_t expire_soft, u_int64_t expire_hard,
algorithm_t *enc_alg, algorithm_t *int_alg,
prf_plus_t *prf_plus, natt_conf_t *natt,
@@ -502,12 +511,11 @@ static status_t add_sa(private_kernel_interface_t *this,
hdr->nlmsg_len = NLMSG_LENGTH(sizeof(struct xfrm_usersa_info));
sa = (struct xfrm_usersa_info*)NLMSG_DATA(hdr);
sa->saddr = me->get_xfrm_addr(me);
sa->id.daddr = other->get_xfrm_addr(other);
host2xfrm(src, &sa->saddr);
host2xfrm(dst, &sa->id.daddr);
sa->id.spi = spi;
sa->id.proto = (protocol == PROTO_ESP) ? KERNEL_ESP : KERNEL_AH;
sa->family = me->get_family(me);
sa->family = src->get_family(src);
sa->mode = TRUE; /* tunnel mode */
sa->replay_window = 32;
sa->reqid = reqid;
@@ -595,8 +603,8 @@ static status_t add_sa(private_kernel_interface_t *this,
struct xfrm_encap_tmpl* encap = (struct xfrm_encap_tmpl*)RTA_DATA(rthdr);
encap->encap_type = UDP_ENCAP_ESPINUDP;
encap->encap_sport = ntohs(natt->sport);
encap->encap_dport = ntohs(natt->dport);
encap->encap_sport = htons(natt->sport);
encap->encap_dport = htons(natt->dport);
memset(&encap->encap_oa, 0, sizeof (xfrm_address_t));
/* encap_oa could probably be derived from the
* traffic selectors [rfc4306, p39]. In the netlink kernel implementation
@@ -633,13 +641,13 @@ static status_t add_sa(private_kernel_interface_t *this,
}
/**
* Implementation of kernel_interface_t.update_sa_hosts.
* Implementation of kernel_interface_t.update_sa.
*/
static status_t update_sa_hosts(
static status_t update_sa(
private_kernel_interface_t *this,
host_t *src, host_t *dst,
host_t *new_src, host_t *new_dst,
int src_changes, int dst_changes,
host_diff_t src_changes, host_diff_t dst_changes,
u_int32_t spi, protocol_id_t protocol)
{
unsigned char request[BUFFER_SIZE];
@@ -658,11 +666,11 @@ static status_t update_sa_hosts(
hdr->nlmsg_len = NLMSG_LENGTH(sizeof(struct xfrm_usersa_id));
sa_id = (struct xfrm_usersa_id*)NLMSG_DATA(hdr);
sa_id->daddr = dst->get_xfrm_addr(dst);
host2xfrm(dst, &sa_id->daddr);
sa_id->spi = spi;
sa_id->proto = (protocol == PROTO_ESP) ? KERNEL_ESP : KERNEL_AH;
sa_id->family = dst->get_family(dst);
POS;
if (send_message(this, hdr, &update) != SUCCESS)
{
this->logger->log(this->logger, ERROR, "netlink communication failed");
@@ -687,6 +695,7 @@ static status_t update_sa_hosts(
free(update);
return FAILED;
}
POS;
this->logger->log(this->logger, CONTROL|LEVEL2, "updating SA");
update->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK;
@@ -695,7 +704,7 @@ static status_t update_sa_hosts(
struct xfrm_usersa_info *sa = (struct xfrm_usersa_info*)NLMSG_DATA(update);
if (src_changes & HOST_DIFF_ADDR)
{
sa->saddr = new_src->get_xfrm_addr(new_src);
host2xfrm(new_src, &sa->saddr);
}
if (dst_changes & HOST_DIFF_ADDR)
@@ -703,7 +712,7 @@ static status_t update_sa_hosts(
this->logger->log(this->logger, CONTROL|LEVEL2, "destination address changed! replacing SA");
update->nlmsg_type = XFRM_MSG_NEWSA;
sa->id.daddr = new_dst->get_xfrm_addr(new_dst);
host2xfrm(new_dst, &sa->id.daddr);
}
if (src_changes & HOST_DIFF_PORT || dst_changes & HOST_DIFF_PORT)
@@ -722,7 +731,7 @@ static status_t update_sa_hosts(
rthdr = RTA_NEXT(rthdr, rtsize);
}
}
POS;
if (send_message(this, update, &response) != SUCCESS)
{
this->logger->log(this->logger, ERROR, "netlink communication failed");
@@ -745,6 +754,7 @@ static status_t update_sa_hosts(
this->logger->log(this->logger, CONTROL|LEVEL2, "deleting old SA");
status = this->public.del_sa(&this->public, dst, spi, protocol);
}
POS;
free(update);
free(response);
@@ -755,7 +765,7 @@ static status_t update_sa_hosts(
* Implementation of kernel_interface_t.query_sa.
*/
static status_t query_sa(private_kernel_interface_t *this, host_t *dst,
u_int32_t spi, protocol_id_t protocol, time_t *use_time)
u_int32_t spi, protocol_id_t protocol, u_int32_t *use_time)
{
unsigned char request[BUFFER_SIZE];
struct nlmsghdr *response;
@@ -772,7 +782,7 @@ static status_t query_sa(private_kernel_interface_t *this, host_t *dst,
hdr->nlmsg_len = NLMSG_LENGTH(sizeof(struct xfrm_usersa_info));
sa_id = (struct xfrm_usersa_id*)NLMSG_DATA(hdr);
sa_id->daddr = dst->get_xfrm_addr(dst);
host2xfrm(dst, &sa_id->daddr);
sa_id->spi = spi;
sa_id->proto = (protocol == PROTO_ESP) ? KERNEL_ESP : KERNEL_AH;
sa_id->family = dst->get_family(dst);
@@ -796,7 +806,7 @@ static status_t query_sa(private_kernel_interface_t *this, host_t *dst,
}
sa_info = (struct xfrm_usersa_info*)NLMSG_DATA(response);
*use_time = (time_t)sa_info->curlft.use_time;
*use_time = sa_info->curlft.use_time;
free(response);
return SUCCESS;
@@ -824,7 +834,7 @@ static status_t del_sa(private_kernel_interface_t *this, host_t *dst,
hdr->nlmsg_len = NLMSG_LENGTH(sizeof(struct xfrm_usersa_id));
sa_id = (struct xfrm_usersa_id*)NLMSG_DATA(hdr);
sa_id->daddr = dst->get_xfrm_addr(dst);
host2xfrm(dst, &sa_id->daddr);
sa_id->spi = spi;
sa_id->proto = (protocol == PROTO_ESP) ? KERNEL_ESP : KERNEL_AH;
sa_id->family = dst->get_family(dst);
@@ -850,16 +860,111 @@ static status_t del_sa(private_kernel_interface_t *this, host_t *dst,
return status;
}
/**
* convert a traffic selector address range to subnet and its mask.
*/
static void ts2subnet(traffic_selector_t* ts,
xfrm_address_t *net, u_int8_t *mask)
{
/* there is no way to do this cleanly, as the address range may
* be anything else but a subnet. We use from_addr as subnet
* and try to calculate a usable subnet mask.
*/
chunk_t chunk;
chunk = ts->get_from_address(ts);
memcpy(net, chunk.ptr, chunk.len);
switch (ts->get_type(ts))
{
case TS_IPV4_ADDR_RANGE:
{
u_int32_t from, to, bit;
from = *(u_int32_t*)chunk.ptr;
chunk_free(&chunk);
chunk = ts->get_to_address(ts);
to = *(u_int32_t*)chunk.ptr;
chunk_free(&chunk);
for (bit = 0; bit < 32; bit++)
{
if ((1<<bit & from) != (1<<bit & to))
{
*mask = bit;
return;
}
}
*mask = 32;
return;
}
case TS_IPV6_ADDR_RANGE:
default:
{
/* TODO: IPV6 support */
*mask = 0;
return;
}
}
}
/**
* convert a traffic selector port range to port/portmask
*/
static void ts2ports(traffic_selector_t* ts,
u_int16_t *port, u_int16_t *mask)
{
/* linux does not seem to accept complex portmasks. Only
* any or a specific port is allowed. We set to any, if we have
* a port range, or to a specific, if we have one port only.
*/
u_int16_t from, to;
from = ts->get_from_port(ts);
to = ts->get_to_port(ts);
if (from == to)
{
*port = htons(from);
*mask = ~0;
}
else
{
*port = 0;
*mask = 0;
}
}
/**
* convert a pair of traffic_selectors to a xfrm_selector
*/
static struct xfrm_selector ts2selector(traffic_selector_t *src,
traffic_selector_t *dst)
{
struct xfrm_selector sel;
memset(&sel, 0, sizeof(sel));
sel.family = src->get_type(src) == TS_IPV4_ADDR_RANGE ? AF_INET : AF_INET6;
/* src or dest proto may be "any" (0), use more restrictive one */
sel.proto = max(src->get_protocol(src), dst->get_protocol(dst));
ts2subnet(dst, &sel.daddr, &sel.prefixlen_d);
ts2subnet(src, &sel.saddr, &sel.prefixlen_s);
ts2ports(dst, &sel.dport, &sel.dport_mask);
ts2ports(src, &sel.sport, &sel.sport_mask);
sel.ifindex = 0;
sel.user = 0;
return sel;
}
/**
* Implementation of kernel_interface_t.add_policy.
*/
static status_t add_policy(private_kernel_interface_t *this,
host_t *me, host_t *other,
host_t *src, host_t *dst,
u_int8_t src_hostbits, u_int8_t dst_hostbits,
u_int8_t direction, u_int8_t upper_proto,
protocol_id_t protocol,
u_int32_t reqid, bool update)
host_t *src, host_t *dst,
traffic_selector_t *src_ts,
traffic_selector_t *dst_ts,
policy_dir_t direction, protocol_id_t protocol,
u_int32_t reqid, bool update)
{
iterator_t *iterator;
kernel_policy_t *current, *policy;
@@ -873,16 +978,7 @@ static status_t add_policy(private_kernel_interface_t *this,
/* create a policy */
policy = malloc_thing(kernel_policy_t);
memset(policy, 0, sizeof(kernel_policy_t));
policy->sel.saddr = src->get_xfrm_addr(src);
policy->sel.prefixlen_s = src_hostbits;
policy->sel.sport = htons(src->get_port(src));
policy->sel.sport_mask = (policy->sel.sport) ? ~0 : 0;
policy->sel.daddr = dst->get_xfrm_addr(dst);
policy->sel.prefixlen_d = dst_hostbits;
policy->sel.dport = htons(dst->get_port(dst));
policy->sel.dport_mask = (policy->sel.dport) ? ~0 : 0;
policy->sel.proto = upper_proto;
policy->sel.family = src->get_family(src);
policy->sel = ts2selector(src_ts, dst_ts);
policy->direction = direction;
/* find the policy, which matches EXACTLY */
@@ -893,12 +989,17 @@ static status_t add_policy(private_kernel_interface_t *this,
if (memcmp(current, policy, sizeof(struct xfrm_selector)) == 0 &&
policy->direction == current->direction)
{
free(policy);
/* use existing policy */
if (!update)
{
current->refcount++;
iterator->destroy(iterator);
pthread_mutex_unlock(&this->pol_mutex);
this->logger->log(this->logger, CONTROL|LEVEL1,
"policy already exists, increasing refcount");
return SUCCESS;
}
free(policy);
policy = current;
found = TRUE;
break;
@@ -921,7 +1022,7 @@ static status_t add_policy(private_kernel_interface_t *this,
policy_info = (struct xfrm_userpolicy_info*)NLMSG_DATA(hdr);
policy_info->sel = policy->sel;
policy_info->dir = direction;
policy_info->dir = policy->direction;
policy_info->priority = SPD_PRIORITY;
policy_info->action = XFRM_POLICY_ALLOW;
policy_info->share = XFRM_SHARE_ANY;
@@ -955,8 +1056,8 @@ static status_t add_policy(private_kernel_interface_t *this,
tmpl->aalgos = tmpl->ealgos = tmpl->calgos = ~0;
tmpl->mode = TRUE;
tmpl->saddr = me->get_xfrm_addr(me);
tmpl->id.daddr = other->get_xfrm_addr(other);
host2xfrm(src, &tmpl->saddr);
host2xfrm(dst, &tmpl->id.daddr);
if (send_message(this, hdr, &response) != SUCCESS)
{
@@ -981,13 +1082,74 @@ static status_t add_policy(private_kernel_interface_t *this,
return status;
}
/**
* Implementation of kernel_interface_t.query_policy.
*/
static status_t query_policy(private_kernel_interface_t *this,
traffic_selector_t *src_ts,
traffic_selector_t *dst_ts,
policy_dir_t direction, u_int32_t *use_time)
{
unsigned char request[BUFFER_SIZE];
struct nlmsghdr *response;
struct nlmsghdr *hdr;
struct xfrm_userpolicy_id *policy_id;
struct xfrm_userpolicy_info *policy;
memset(&request, 0, sizeof(request));
status_t status = SUCCESS;
this->logger->log(this->logger, CONTROL|LEVEL2, "querying policy");
hdr = (struct nlmsghdr*)request;
hdr->nlmsg_flags = NLM_F_REQUEST;
hdr->nlmsg_type = XFRM_MSG_GETPOLICY;
hdr->nlmsg_len = NLMSG_LENGTH(sizeof(struct xfrm_userpolicy_id));
policy_id = (struct xfrm_userpolicy_id*)NLMSG_DATA(hdr);
policy_id->sel = ts2selector(src_ts, dst_ts);
policy_id->dir = direction;
if (send_message(this, hdr, &response) != SUCCESS)
{
this->logger->log(this->logger, ERROR, "netlink communication failed");
return FAILED;
}
else if (response->nlmsg_type == NLMSG_ERROR)
{
this->logger->log(this->logger, ERROR, "netlink request XFRM_MSG_GETPOLICY got an error: %s",
strerror(-((struct nlmsgerr*)NLMSG_DATA(response))->error));
free(response);
return FAILED;
}
else if (response->nlmsg_type != XFRM_MSG_NEWPOLICY)
{
this->logger->log(this->logger, ERROR, "netlink request XFRM_MSG_GETPOLICY got an unknown reply");
free(response);
return FAILED;
}
else if (response->nlmsg_len < NLMSG_LENGTH(sizeof(struct xfrm_userpolicy_info)))
{
this->logger->log(this->logger, ERROR, "netlink request XFRM_MSG_GETPOLICY got an invalid reply");
free(response);
return FAILED;
}
policy = (struct xfrm_userpolicy_info*)NLMSG_DATA(response);
*use_time = (time_t)policy->curlft.use_time;
free(response);
return status;
}
/**
* Implementation of kernel_interface_t.del_policy.
*/
static status_t del_policy(private_kernel_interface_t *this,
host_t *src, host_t *dst,
u_int8_t src_hostbits, u_int8_t dst_hostbits,
u_int8_t direction, u_int8_t upper_proto)
traffic_selector_t *src_ts,
traffic_selector_t *dst_ts,
policy_dir_t direction)
{
kernel_policy_t *current, policy, *to_delete = NULL;
unsigned char request[BUFFER_SIZE];
@@ -1001,16 +1163,7 @@ static status_t del_policy(private_kernel_interface_t *this,
/* create a policy */
memset(&policy, 0, sizeof(kernel_policy_t));
policy.sel.saddr = src->get_xfrm_addr(src);
policy.sel.prefixlen_s = src_hostbits;
policy.sel.sport = htons(src->get_port(src));
policy.sel.sport_mask = (policy.sel.sport) ? ~0 : 0;
policy.sel.daddr = dst->get_xfrm_addr(dst);
policy.sel.prefixlen_d = dst_hostbits;
policy.sel.dport = htons(dst->get_port(dst));
policy.sel.dport_mask = (policy.sel.dport) ? ~0 : 0;
policy.sel.proto = upper_proto;
policy.sel.family = src->get_family(src);
policy.sel = ts2selector(src_ts, dst_ts);
policy.direction = direction;
/* find the policy */
@@ -1025,7 +1178,7 @@ static status_t del_policy(private_kernel_interface_t *this,
if (--to_delete->refcount > 0)
{
/* is used by more SAs, keep in kernel */
this->logger->log(this->logger, CONTROL|LEVEL2,
this->logger->log(this->logger, CONTROL|LEVEL1,
"is used by other SAs, not removed");
iterator->destroy(iterator);
pthread_mutex_unlock(&this->pol_mutex);
@@ -1103,11 +1256,12 @@ kernel_interface_t *kernel_interface_create()
/* public functions */
this->public.get_spi = (status_t(*)(kernel_interface_t*,host_t*,host_t*,protocol_id_t,u_int32_t,u_int32_t*))get_spi;
this->public.add_sa = (status_t(*)(kernel_interface_t *,host_t*,host_t*,u_int32_t,protocol_id_t,u_int32_t,u_int64_t,u_int64_t,algorithm_t*,algorithm_t*,prf_plus_t*,natt_conf_t*,bool))add_sa;
this->public.update_sa_hosts = (status_t(*)(kernel_interface_t*,host_t*,host_t*,host_t*,host_t*,int,int,u_int32_t,protocol_id_t))update_sa_hosts;
this->public.query_sa = (status_t(*)(kernel_interface_t*,host_t*,u_int32_t,protocol_id_t,time_t*))query_sa;
this->public.update_sa = (status_t(*)(kernel_interface_t*,host_t*,u_int32_t,protocol_id_t,host_t*,host_t*,host_diff_t,host_diff_t))update_sa;
this->public.query_sa = (status_t(*)(kernel_interface_t*,host_t*,u_int32_t,protocol_id_t,u_int32_t*))query_sa;
this->public.del_sa = (status_t(*)(kernel_interface_t*,host_t*,u_int32_t,protocol_id_t))del_sa;
this->public.add_policy = (status_t(*)(kernel_interface_t*,host_t*,host_t*,host_t*,host_t*,u_int8_t,u_int8_t,u_int8_t,u_int8_t,protocol_id_t,u_int32_t,bool))add_policy;
this->public.del_policy = (status_t(*)(kernel_interface_t*,host_t*,host_t*,u_int8_t,u_int8_t,u_int8_t,u_int8_t))del_policy;
this->public.add_policy = (status_t(*)(kernel_interface_t*,host_t*,host_t*,traffic_selector_t*,traffic_selector_t*,policy_dir_t,protocol_id_t,u_int32_t,bool))add_policy;
this->public.query_policy = (status_t(*)(kernel_interface_t*,traffic_selector_t*,traffic_selector_t*,policy_dir_t,u_int32_t*))query_policy;
this->public.del_policy = (status_t(*)(kernel_interface_t*,traffic_selector_t*,traffic_selector_t*,policy_dir_t))del_policy;
this->public.destroy = (void(*)(kernel_interface_t*)) destroy;
/* private members */
src/charon/threads/kernel_interface.h
+88 -48
View File
@@ -25,8 +25,6 @@
#ifndef KERNEL_INTERFACE_H_
#define KERNEL_INTERFACE_H_
#include <linux/xfrm.h>
#include <utils/host.h>
#include <crypto/prf_plus.h>
#include <encoding/payloads/proposal_substructure.h>
@@ -34,10 +32,29 @@
typedef struct natt_conf_t natt_conf_t;
/**
* @brief Configuration for NAT-T
* Configuration for NAT-T
*/
struct natt_conf_t {
u_int16_t sport, dport;
/** source port to use for UDP-encapsulated packets */
u_int16_t sport;
/** dest port to use for UDP-encapsulated packets */
u_int16_t dport;
};
typedef enum policy_dir_t policy_dir_t;
/**
* Direction of a policy. These are equal to those
* defined in xfrm.h, but we want to stay implementation
* neutral here.
*/
enum policy_dir_t {
/** Policy for inbound traffic */
POLICY_IN = 0,
/** Policy for outbound traffic */
POLICY_OUT = 1,
/** Policy for forwarded traffic */
POLICY_FWD = 2,
};
typedef struct kernel_interface_t kernel_interface_t;
@@ -52,10 +69,10 @@ typedef struct kernel_interface_t kernel_interface_t;
* reference counting. The Linux kernel does not allow the same policy
* installed twice, but we need this as CHILD_SA exist multiple times
* when rekeying. Thats why we do reference counting of policies.
*
*
* @b Constructors:
* - kernel_interface_create()
*
*
* @ingroup threads
*/
struct kernel_interface_t {
@@ -101,8 +118,8 @@ struct kernel_interface_t {
* @param expire_hard lieftime in seconds before delete
* @param enc_alg Algorithm to use for encryption (ESP only)
* @param int_alg Algorithm to use for integrity protection
* @param prf_plus PRF to derive keys
* @param natt NAT-T Configuration
* @param prf_plus PRF to derive keys from
* @param natt NAT-T Configuration, or NULL of no NAT-T used
* @param replace Should an already installed SA be updated?
* @return
* - SUCCESS
@@ -113,35 +130,38 @@ struct kernel_interface_t {
protocol_id_t protocol, u_int32_t reqid,
u_int64_t expire_soft, u_int64_t expire_hard,
algorithm_t *enc_alg, algorithm_t *int_alg,
prf_plus_t *prf_plus, natt_conf_t *natt, bool replace);
prf_plus_t *prf_plus, natt_conf_t *natt, bool update);
/**
* @brief Update the hosts on an installed SA. Encapsulation ports are also updated.
* @brief Update the hosts on an installed SA.
*
* @note We cannot directly update the destination address as the kernel requires the spi,
* the protocol AND the destination address (and family) to identify SAs. Therefore if the
* destination address changed we create a new SA and delete the old one.
* We cannot directly update the destination address as the kernel
* requires the spi, the protocol AND the destination address (and family)
* to identify SAs. Therefore if the destination address changed we
* create a new SA and delete the old one.
*
* @param this calling object
* @param src source address for this SA
* @param dst destination address for this SA
* @param spi SPI of the SA
* @param protocol protocol for this SA (ESP/AH)
* @param new_src new source address for this SA
* @param new_dst new destination address for this SA
* @param src_changes changes in src
* @param dst_changes changes in dst
* @param spi SPI allocated by us or remote peer
* @param protocol protocol for this SA (ESP/AH)
* @return
* - SUCCESS
* - FAILED if kernel comm failed
*/
status_t (*update_sa_hosts)(kernel_interface_t *this,
host_t *src, host_t *dst,
host_t *new_src, host_t *new_dst,
int src_changes, int dst_changes,
u_int32_t spi, protocol_id_t protocol);
status_t (*update_sa)(kernel_interface_t *this, host_t *dst, u_int32_t spi,
protocol_id_t protocol,
host_t *new_src, host_t *new_dst,
host_diff_t src_changes, host_diff_t dst_changes);
/**
* @brief Query the use time of an SA.
*
* The use time of an SA is not the time of the last usage, but
* the time of the first usage of the SA.
*
* @param this calling object
* @param dst destination address for this SA
@@ -153,7 +173,7 @@ struct kernel_interface_t {
* - FAILED if kernel comm failed
*/
status_t (*query_sa) (kernel_interface_t *this, host_t *dst, u_int32_t spi,
protocol_id_t protocol, time_t *use_time);
protocol_id_t protocol, u_int32_t *use_time);
/**
* @brief Delete a previusly installed SA from the SAD.
@@ -172,20 +192,19 @@ struct kernel_interface_t {
/**
* @brief Add a policy to the SPD.
*
* A policy is always associated to an SA, so
* traffic applied to a policy. Traffic which
* matches a policy is handled by the SA with the same
* reqid.
* A policy is always associated to an SA. Traffic which matches a
* policy is handled by the SA with the same reqid.
* If the update flag is set, the policy is updated with the new
* src/dst addresses.
* If the update flag is not set, but a such policy is already in the
* kernel, the reference count to this policy is increased.
*
* @param this calling object
* @param me address of local peer
* @param other address of remote peer
* @param src src address of traffic this policy applies
* @param dst dest address of traffic this policy applies
* @param src_hostbits subnetmask to use for src address
* @param dst_hostbits subnetmask to use for dst address
* @param direction direction of traffic, XFRM_POLICY_OUT, XFRM_POLICY_IN, XFRM_POLICY_FWD
* @param upper_proto upper layer protocol of traffic for this policy (TCP, UDP, ICMP, ...)
* @param src source address of SA
* @param dst dest address of SA
* @param src_ts traffic selector to match traffic source
* @param dst_ts traffic selector to match traffic dest
* @param direction direction of traffic, POLICY_IN, POLICY_OUT, POLICY_FWD
* @param protocol protocol to use to protect traffic (AH/ESP)
* @param reqid uniqe ID of an SA to use to enforce policy
* @param update update an existing policy, if TRUE
@@ -193,32 +212,53 @@ struct kernel_interface_t {
* - SUCCESS
* - FAILED if kernel comm failed
*/
status_t (*add_policy) (kernel_interface_t *this,
host_t *me, host_t *other,
status_t (*add_policy) (kernel_interface_t *this,
host_t *src, host_t *dst,
u_int8_t src_hostbits, u_int8_t dst_hostbits,
u_int8_t direction, u_int8_t upper_proto,
protocol_id_t protocol,
traffic_selector_t *src_ts,
traffic_selector_t *dst_ts,
policy_dir_t direction, protocol_id_t protocol,
u_int32_t reqid, bool update);
/**
* @brief Query the use time of a policy.
*
* The use time of a policy is the time the policy was used
* for the last time.
*
* @param this calling object
* @param src_ts traffic selector to match traffic source
* @param dst_ts traffic selector to match traffic dest
* @param direction direction of traffic, POLICY_IN, POLICY_OUT, POLICY_FWD
* @param[out] use_time the time of this SA's last use
* @return
* - SUCCESS
* - FAILED if kernel comm failed
*/
status_t (*query_policy) (kernel_interface_t *this,
traffic_selector_t *src_ts,
traffic_selector_t *dst_ts,
policy_dir_t direction, u_int32_t *use_time);
/**
* @brief Remove a policy from the SPD.
*
* The kernel interface implements reference counting for policies.
* If the same policy is installed multiple times (in the case of rekeying),
* the reference counter is increased. del_policy() decreases the ref counter
* and removes the policy only when no more references are available.
*
* @param this calling object
* @param src src address of traffic this policy applies
* @param dst dest address of traffic this policy applies
* @param src_hostbits subnetmask to use for src address
* @param dst_hostbits subnetmask to use for dst address
* @param direction direction of traffic, XFRM_POLICY_OUT, XFRM_POLICY_IN, XFRM_POLICY_FWD
* @param upper_proto upper layer protocol of traffic for this policy (TCP, UDP, ICMP, ...)
* @param src_ts traffic selector to match traffic source
* @param dst_ts traffic selector to match traffic dest
* @param direction direction of traffic, POLICY_IN, POLICY_OUT, POLICY_FWD
* @return
* - SUCCESS
* - FAILED if kernel comm failed
*/
status_t (*del_policy) (kernel_interface_t *this,
host_t *src, host_t *dst,
u_int8_t src_hostbits, u_int8_t dst_hostbits,
u_int8_t direction, u_int8_t upper_proto);
traffic_selector_t *src_ts,
traffic_selector_t *dst_ts,
policy_dir_t direction);
/**
* @brief Destroys a kernel_interface object.
src/charon/threads/stroke_interface.c
+2 -2
View File
@@ -428,9 +428,9 @@ static void stroke_add_conn(private_stroke_t *this, stroke_msg_t *msg)
charon->connections->add_connection(charon->connections, connection);
this->logger->log(this->logger, CONTROL, "added connection \"%s\": %s[%s]...%s[%s]",
msg->add_conn.name,
my_host->get_address(my_host),
my_host->get_string(my_host),
my_id->get_string(my_id),
other_host->get_address(other_host),
other_host->get_string(other_host),
other_id->get_string(other_id));
/* add to global policy list */
charon->policies->add_policy(charon->policies, policy);