denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

child-sa: Support dynamically updating trap policies

Browse Source
This commit is contained in:
Tobias Brunner
2022-04-14 18:42:01 +02:00
parent f9b895b49f
commit 9619b1e757
1 changed files with 7 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/child_sa.c
+7 -4
View File
@@ -1636,13 +1636,16 @@ METHOD(child_sa_t, update, status_t,
ipsec_sa_cfg_t my_sa, other_sa; ipsec_sa_cfg_t my_sa, other_sa;
enumerator_t *enumerator; enumerator_t *enumerator;
traffic_selector_t *my_ts, *other_ts; traffic_selector_t *my_ts, *other_ts;
policy_priority_t priority;
uint32_t manual_prio; uint32_t manual_prio;
status_t state; status_t state;
bool outbound; bool outbound;
prepare_sa_cfg(this, &my_sa, &other_sa); prepare_sa_cfg(this, &my_sa, &other_sa);
manual_prio = this->config->get_manual_prio(this->config); manual_prio = this->config->get_manual_prio(this->config);
outbound = (this->outbound_state & CHILD_OUTBOUND_POLICIES); priority = this->trap ? POLICY_PRIORITY_ROUTED
: POLICY_PRIORITY_DEFAULT;
outbound = (this->outbound_state & CHILD_OUTBOUND_POLICIES) || this->trap;
enumerator = create_policy_enumerator(this); enumerator = create_policy_enumerator(this);
while (enumerator->enumerate(enumerator, &my_ts, &other_ts)) while (enumerator->enumerate(enumerator, &my_ts, &other_ts))
@@ -1657,7 +1660,7 @@ METHOD(child_sa_t, update, status_t,
/* remove old policies */ /* remove old policies */
del_policies_internal(this, this->my_addr, this->other_addr, del_policies_internal(this, this->my_addr, this->other_addr,
my_ts, other_ts, &my_sa, &other_sa, POLICY_IPSEC, my_ts, other_ts, &my_sa, &other_sa, POLICY_IPSEC,
POLICY_PRIORITY_DEFAULT, manual_prio, outbound); priority, manual_prio, outbound);
} }
enumerator->destroy(enumerator); enumerator->destroy(enumerator);
@@ -1674,7 +1677,7 @@ METHOD(child_sa_t, update, status_t,
{ {
install_policies_internal(this, this->my_addr, this->other_addr, install_policies_internal(this, this->my_addr, this->other_addr,
my_ts, other_ts, &my_sa, &other_sa, POLICY_IPSEC, my_ts, other_ts, &my_sa, &other_sa, POLICY_IPSEC,
POLICY_PRIORITY_DEFAULT, manual_prio, outbound); priority, manual_prio, outbound);
} }
else else
{ {
@@ -1702,7 +1705,7 @@ METHOD(child_sa_t, update, status_t,
/* reinstall updated policies */ /* reinstall updated policies */
install_policies_internal(this, me, other, my_ts, other_ts, install_policies_internal(this, me, other, my_ts, other_ts,
&my_sa, &other_sa, POLICY_IPSEC, &my_sa, &other_sa, POLICY_IPSEC,
POLICY_PRIORITY_DEFAULT, manual_prio, outbound); priority, manual_prio, outbound);
} }
/* remove the drop policy */ /* remove the drop policy */
if (outbound) if (outbound)