denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

shunt-manager: Install passthrough policies with highest priority

Browse Source 
This avoids conflicts with regular IPsec policies.

Similarly, use the lowest priority for drop policies.
This commit is contained in:
Tobias Brunner
2014-06-19 14:20:33 +02:00
parent 5b883719a1
commit 981466251f
1 changed files with 34 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/shunt_manager.c
+34 -9
View File
@@ -49,11 +49,24 @@ static bool install_shunt_policy(child_cfg_t *child)
traffic_selector_t *my_ts, *other_ts; traffic_selector_t *my_ts, *other_ts;
host_t *host_any; host_t *host_any;
policy_type_t policy_type; policy_type_t policy_type;
policy_priority_t policy_prio;
status_t status = SUCCESS; status_t status = SUCCESS;
ipsec_sa_cfg_t sa = { .mode = MODE_TRANSPORT }; ipsec_sa_cfg_t sa = { .mode = MODE_TRANSPORT };
policy_type = (child->get_mode(child) == MODE_PASS) ? switch (child->get_mode(child))
POLICY_PASS : POLICY_DROP; {
case MODE_PASS:
policy_type = POLICY_PASS;
policy_prio = POLICY_PRIORITY_PASS;
break;
case MODE_DROP:
policy_type = POLICY_DROP;
policy_prio = POLICY_PRIORITY_FALLBACK;
break;
default:
return FALSE;
}
my_ts_list = child->get_traffic_selectors(child, TRUE, NULL, NULL); my_ts_list = child->get_traffic_selectors(child, TRUE, NULL, NULL);
other_ts_list = child->get_traffic_selectors(child, FALSE, NULL, NULL); other_ts_list = child->get_traffic_selectors(child, FALSE, NULL, NULL);
host_any = host_create_any(AF_INET); host_any = host_create_any(AF_INET);
@@ -70,21 +83,21 @@ static bool install_shunt_policy(child_cfg_t *child)
hydra->kernel_interface, host_any, host_any, hydra->kernel_interface, host_any, host_any,
my_ts, other_ts, POLICY_OUT, policy_type, my_ts, other_ts, POLICY_OUT, policy_type,
&sa, child->get_mark(child, FALSE), &sa, child->get_mark(child, FALSE),
POLICY_PRIORITY_DEFAULT); policy_prio);
/* install in policy */ /* install in policy */
status |= hydra->kernel_interface->add_policy( status |= hydra->kernel_interface->add_policy(
hydra->kernel_interface, host_any, host_any, hydra->kernel_interface, host_any, host_any,
other_ts, my_ts, POLICY_IN, policy_type, other_ts, my_ts, POLICY_IN, policy_type,
&sa, child->get_mark(child, TRUE), &sa, child->get_mark(child, TRUE),
POLICY_PRIORITY_DEFAULT); policy_prio);
/* install forward policy */ /* install forward policy */
status |= hydra->kernel_interface->add_policy( status |= hydra->kernel_interface->add_policy(
hydra->kernel_interface, host_any, host_any, hydra->kernel_interface, host_any, host_any,
other_ts, my_ts, POLICY_FWD, policy_type, other_ts, my_ts, POLICY_FWD, policy_type,
&sa, child->get_mark(child, TRUE), &sa, child->get_mark(child, TRUE),
POLICY_PRIORITY_DEFAULT); policy_prio);
} }
e_other_ts->destroy(e_other_ts); e_other_ts->destroy(e_other_ts);
} }
@@ -137,8 +150,21 @@ static void uninstall_shunt_policy(child_cfg_t *child)
enumerator_t *e_my_ts, *e_other_ts; enumerator_t *e_my_ts, *e_other_ts;
linked_list_t *my_ts_list, *other_ts_list; linked_list_t *my_ts_list, *other_ts_list;
traffic_selector_t *my_ts, *other_ts; traffic_selector_t *my_ts, *other_ts;
policy_priority_t policy_prio;
status_t status = SUCCESS; status_t status = SUCCESS;
switch (child->get_mode(child))
{
case MODE_PASS:
policy_prio = POLICY_PRIORITY_PASS;
break;
case MODE_DROP:
policy_prio = POLICY_PRIORITY_FALLBACK;
break;
default:
return;
}
my_ts_list = child->get_traffic_selectors(child, TRUE, NULL, NULL); my_ts_list = child->get_traffic_selectors(child, TRUE, NULL, NULL);
other_ts_list = child->get_traffic_selectors(child, FALSE, NULL, NULL); other_ts_list = child->get_traffic_selectors(child, FALSE, NULL, NULL);
@@ -153,19 +179,19 @@ static void uninstall_shunt_policy(child_cfg_t *child)
status |= hydra->kernel_interface->del_policy( status |= hydra->kernel_interface->del_policy(
hydra->kernel_interface, my_ts, other_ts, hydra->kernel_interface, my_ts, other_ts,
POLICY_OUT, 0, child->get_mark(child, FALSE), POLICY_OUT, 0, child->get_mark(child, FALSE),
POLICY_PRIORITY_DEFAULT); policy_prio);
/* uninstall in policy */ /* uninstall in policy */
status |= hydra->kernel_interface->del_policy( status |= hydra->kernel_interface->del_policy(
hydra->kernel_interface, other_ts, my_ts, hydra->kernel_interface, other_ts, my_ts,
POLICY_IN, 0, child->get_mark(child, TRUE), POLICY_IN, 0, child->get_mark(child, TRUE),
POLICY_PRIORITY_DEFAULT); policy_prio);
/* uninstall forward policy */ /* uninstall forward policy */
status |= hydra->kernel_interface->del_policy( status |= hydra->kernel_interface->del_policy(
hydra->kernel_interface, other_ts, my_ts, hydra->kernel_interface, other_ts, my_ts,
POLICY_FWD, 0, child->get_mark(child, TRUE), POLICY_FWD, 0, child->get_mark(child, TRUE),
POLICY_PRIORITY_DEFAULT); policy_prio);
} }
e_other_ts->destroy(e_other_ts); e_other_ts->destroy(e_other_ts);
} }
@@ -249,4 +275,3 @@ shunt_manager_t *shunt_manager_create()
return &this->public; return &this->public;
} }