Removed references to protocol_id_t from kernel interface.
Instead we use the actual IP protocol identifier (the conversion now happens in child_sa_t and kernel_handler_t).
This commit is contained in:
Tobias Brunner
@@ -584,7 +584,7 @@ typedef struct sa_entry_t sa_entry_t;
|
||||
struct sa_entry_t {
|
||||
|
||||
/** protocol of this SA */
|
||||
protocol_id_t protocol;
|
||||
u_int8_t protocol;
|
||||
|
||||
/** reqid of this SA */
|
||||
u_int32_t reqid;
|
||||
@@ -608,7 +608,7 @@ struct sa_entry_t {
|
||||
/**
|
||||
* create an sa_entry_t object
|
||||
*/
|
||||
static sa_entry_t *create_sa_entry(protocol_id_t protocol, u_int32_t spi,
|
||||
static sa_entry_t *create_sa_entry(u_int8_t protocol, u_int32_t spi,
|
||||
u_int32_t reqid, host_t *src, host_t *dst,
|
||||
bool encap, bool inbound)
|
||||
{
|
||||
@@ -646,7 +646,7 @@ static inline bool sa_entry_match_encapbysrc(sa_entry_t *current, u_int32_t *spi
|
||||
/**
|
||||
* match an sa_entry_t by protocol, spi and dst address (as the kernel does it)
|
||||
*/
|
||||
static inline bool sa_entry_match_bydst(sa_entry_t *current, protocol_id_t *protocol,
|
||||
static inline bool sa_entry_match_bydst(sa_entry_t *current, u_int8_t *protocol,
|
||||
u_int32_t *spi, host_t *dst)
|
||||
{
|
||||
return current->protocol == *protocol && current->spi == *spi && dst->ip_equals(dst, current->dst);
|
||||
@@ -655,7 +655,7 @@ static inline bool sa_entry_match_bydst(sa_entry_t *current, protocol_id_t *prot
|
||||
/**
|
||||
* match an sa_entry_t by protocol, reqid and spi
|
||||
*/
|
||||
static inline bool sa_entry_match_byid(sa_entry_t *current, protocol_id_t *protocol,
|
||||
static inline bool sa_entry_match_byid(sa_entry_t *current, u_int8_t *protocol,
|
||||
u_int32_t *spi, u_int32_t *reqid)
|
||||
{
|
||||
return current->protocol == *protocol && current->spi == *spi && current->reqid == *reqid;
|
||||
@@ -713,15 +713,15 @@ struct pfkey_msg_t
|
||||
};
|
||||
|
||||
/**
|
||||
* convert a IKEv2 specific protocol identifier to the PF_KEY sa type
|
||||
* convert a protocol identifier to the PF_KEY sa type
|
||||
*/
|
||||
static u_int8_t proto_ike2satype(protocol_id_t proto)
|
||||
static u_int8_t proto2satype(u_int8_t proto)
|
||||
{
|
||||
switch (proto)
|
||||
{
|
||||
case PROTO_ESP:
|
||||
case IPPROTO_ESP:
|
||||
return SADB_SATYPE_ESP;
|
||||
case PROTO_AH:
|
||||
case IPPROTO_AH:
|
||||
return SADB_SATYPE_AH;
|
||||
case IPPROTO_COMP:
|
||||
return SADB_X_SATYPE_COMP;
|
||||
@@ -731,20 +731,20 @@ static u_int8_t proto_ike2satype(protocol_id_t proto)
|
||||
}
|
||||
|
||||
/**
|
||||
* convert a PF_KEY sa type to a IKEv2 specific protocol identifier
|
||||
* convert a PF_KEY sa type to a protocol identifier
|
||||
*/
|
||||
static protocol_id_t proto_satype2ike(u_int8_t proto)
|
||||
static u_int8_t satype2proto(u_int8_t satype)
|
||||
{
|
||||
switch (proto)
|
||||
switch (satype)
|
||||
{
|
||||
case SADB_SATYPE_ESP:
|
||||
return PROTO_ESP;
|
||||
return IPPROTO_ESP;
|
||||
case SADB_SATYPE_AH:
|
||||
return PROTO_AH;
|
||||
return IPPROTO_AH;
|
||||
case SADB_X_SATYPE_COMP:
|
||||
return IPPROTO_COMP;
|
||||
default:
|
||||
return proto;
|
||||
return satype;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1316,7 +1316,7 @@ static void process_mapping(private_kernel_klips_ipsec_t *this, struct sadb_msg*
|
||||
|
||||
spi = response.sa->sadb_sa_spi;
|
||||
|
||||
if (proto_satype2ike(msg->sadb_msg_satype) == PROTO_ESP)
|
||||
if (satype2proto(msg->sadb_msg_satype) == IPPROTO_ESP)
|
||||
{
|
||||
sa_entry_t *sa;
|
||||
sockaddr_t *addr = (sockaddr_t*)(response.src + 1);
|
||||
@@ -1448,7 +1448,7 @@ struct sa_expire_t {
|
||||
/** the SPI of the expiring SA */
|
||||
u_int32_t spi;
|
||||
/** the protocol of the expiring SA */
|
||||
protocol_id_t protocol;
|
||||
u_int8_t protocol;
|
||||
/** the reqid of the expiring SA*/
|
||||
u_int32_t reqid;
|
||||
/** what type of expire this is */
|
||||
@@ -1461,7 +1461,7 @@ struct sa_expire_t {
|
||||
static job_requeue_t sa_expires(sa_expire_t *expire)
|
||||
{
|
||||
private_kernel_klips_ipsec_t *this = expire->this;
|
||||
protocol_id_t protocol = expire->protocol;
|
||||
u_int8_t protocol = expire->protocol;
|
||||
u_int32_t spi = expire->spi, reqid = expire->reqid;
|
||||
bool hard = expire->type != EXPIRE_TYPE_SOFT;
|
||||
sa_entry_t *cached_sa;
|
||||
@@ -1500,7 +1500,7 @@ static job_requeue_t sa_expires(sa_expire_t *expire)
|
||||
* Schedule an expire job for an SA. Time is in seconds.
|
||||
*/
|
||||
static void schedule_expire(private_kernel_klips_ipsec_t *this,
|
||||
protocol_id_t protocol, u_int32_t spi,
|
||||
u_int8_t protocol, u_int32_t spi,
|
||||
u_int32_t reqid, expire_type_t type, u_int32_t time)
|
||||
{
|
||||
callback_job_t *job;
|
||||
@@ -1516,7 +1516,7 @@ static void schedule_expire(private_kernel_klips_ipsec_t *this,
|
||||
|
||||
METHOD(kernel_ipsec_t, get_spi, status_t,
|
||||
private_kernel_klips_ipsec_t *this, host_t *src, host_t *dst,
|
||||
protocol_id_t protocol, u_int32_t reqid, u_int32_t *spi)
|
||||
u_int8_t protocol, u_int32_t reqid, u_int32_t *spi)
|
||||
{
|
||||
/* we cannot use SADB_GETSPI because KLIPS does not allow us to set the
|
||||
* NAT-T type in an SADB_UPDATE which we would have to use to update the
|
||||
@@ -1611,7 +1611,7 @@ static status_t add_ipip_sa(private_kernel_klips_ipsec_t *this,
|
||||
*/
|
||||
static status_t group_ipip_sa(private_kernel_klips_ipsec_t *this,
|
||||
host_t *src, host_t *dst, u_int32_t spi,
|
||||
protocol_id_t protocol, u_int32_t reqid)
|
||||
u_int8_t protocol, u_int32_t reqid)
|
||||
{
|
||||
unsigned char request[PFKEY_BUFFER_SIZE];
|
||||
struct sadb_msg *msg, *out;
|
||||
@@ -1641,7 +1641,7 @@ static status_t group_ipip_sa(private_kernel_klips_ipsec_t *this,
|
||||
satype = (struct sadb_x_satype*)PFKEY_EXT_ADD_NEXT(msg);
|
||||
satype->sadb_x_satype_exttype = SADB_X_EXT_SATYPE2;
|
||||
satype->sadb_x_satype_len = PFKEY_LEN(sizeof(struct sadb_x_satype));
|
||||
satype->sadb_x_satype_satype = proto_ike2satype(protocol);
|
||||
satype->sadb_x_satype_satype = proto2satype(protocol);
|
||||
PFKEY_EXT_ADD(msg, satype);
|
||||
|
||||
sa = (struct sadb_sa*)PFKEY_EXT_ADD_NEXT(msg);
|
||||
@@ -1672,7 +1672,7 @@ static status_t group_ipip_sa(private_kernel_klips_ipsec_t *this,
|
||||
|
||||
METHOD(kernel_ipsec_t, add_sa, status_t,
|
||||
private_kernel_klips_ipsec_t *this, host_t *src, host_t *dst, u_int32_t spi,
|
||||
protocol_id_t protocol, u_int32_t reqid, mark_t mark,
|
||||
u_int8_t protocol, u_int32_t reqid, mark_t mark,
|
||||
lifetime_cfg_t *lifetime, u_int16_t enc_alg, chunk_t enc_key,
|
||||
u_int16_t int_alg, chunk_t int_key, ipsec_mode_t mode,
|
||||
u_int16_t ipcomp, u_int16_t cpi, bool encap, bool inbound,
|
||||
@@ -1713,7 +1713,7 @@ METHOD(kernel_ipsec_t, add_sa, status_t,
|
||||
msg = (struct sadb_msg*)request;
|
||||
msg->sadb_msg_version = PF_KEY_V2;
|
||||
msg->sadb_msg_type = SADB_ADD;
|
||||
msg->sadb_msg_satype = proto_ike2satype(protocol);
|
||||
msg->sadb_msg_satype = proto2satype(protocol);
|
||||
msg->sadb_msg_len = PFKEY_LEN(sizeof(struct sadb_msg));
|
||||
|
||||
sa = (struct sadb_sa*)PFKEY_EXT_ADD_NEXT(msg);
|
||||
@@ -1830,7 +1830,7 @@ METHOD(kernel_ipsec_t, add_sa, status_t,
|
||||
}
|
||||
|
||||
METHOD(kernel_ipsec_t, update_sa, status_t,
|
||||
private_kernel_klips_ipsec_t *this, u_int32_t spi, protocol_id_t protocol,
|
||||
private_kernel_klips_ipsec_t *this, u_int32_t spi, u_int8_t protocol,
|
||||
u_int16_t cpi, host_t *src, host_t *dst, host_t *new_src, host_t *new_dst,
|
||||
bool encap, bool new_encap, mark_t mark)
|
||||
{
|
||||
@@ -1867,7 +1867,7 @@ METHOD(kernel_ipsec_t, update_sa, status_t,
|
||||
msg = (struct sadb_msg*)request;
|
||||
msg->sadb_msg_version = PF_KEY_V2;
|
||||
msg->sadb_msg_type = SADB_UPDATE;
|
||||
msg->sadb_msg_satype = proto_ike2satype(protocol);
|
||||
msg->sadb_msg_satype = proto2satype(protocol);
|
||||
msg->sadb_msg_len = PFKEY_LEN(sizeof(struct sadb_msg));
|
||||
|
||||
sa = (struct sadb_sa*)PFKEY_EXT_ADD_NEXT(msg);
|
||||
@@ -1903,14 +1903,14 @@ METHOD(kernel_ipsec_t, update_sa, status_t,
|
||||
|
||||
METHOD(kernel_ipsec_t, query_sa, status_t,
|
||||
private_kernel_klips_ipsec_t *this, host_t *src, host_t *dst,
|
||||
u_int32_t spi, protocol_id_t protocol, mark_t mark, u_int64_t *bytes)
|
||||
u_int32_t spi, u_int8_t protocol, mark_t mark, u_int64_t *bytes)
|
||||
{
|
||||
return NOT_SUPPORTED; /* TODO */
|
||||
}
|
||||
|
||||
METHOD(kernel_ipsec_t, del_sa, status_t,
|
||||
private_kernel_klips_ipsec_t *this, host_t *src, host_t *dst,
|
||||
u_int32_t spi, protocol_id_t protocol, u_int16_t cpi, mark_t mark)
|
||||
u_int32_t spi, u_int8_t protocol, u_int16_t cpi, mark_t mark)
|
||||
{
|
||||
unsigned char request[PFKEY_BUFFER_SIZE];
|
||||
struct sadb_msg *msg, *out;
|
||||
@@ -1939,7 +1939,7 @@ METHOD(kernel_ipsec_t, del_sa, status_t,
|
||||
msg = (struct sadb_msg*)request;
|
||||
msg->sadb_msg_version = PF_KEY_V2;
|
||||
msg->sadb_msg_type = SADB_DELETE;
|
||||
msg->sadb_msg_satype = proto_ike2satype(protocol);
|
||||
msg->sadb_msg_satype = proto2satype(protocol);
|
||||
msg->sadb_msg_len = PFKEY_LEN(sizeof(struct sadb_msg));
|
||||
|
||||
sa = (struct sadb_sa*)PFKEY_EXT_ADD_NEXT(msg);
|
||||
@@ -1974,7 +1974,7 @@ METHOD(kernel_ipsec_t, del_sa, status_t,
|
||||
METHOD(kernel_ipsec_t, add_policy, status_t,
|
||||
private_kernel_klips_ipsec_t *this, host_t *src, host_t *dst,
|
||||
traffic_selector_t *src_ts, traffic_selector_t *dst_ts,
|
||||
policy_dir_t direction, u_int32_t spi, protocol_id_t protocol,
|
||||
policy_dir_t direction, u_int32_t spi, u_int8_t protocol,
|
||||
u_int32_t reqid, mark_t mark, ipsec_mode_t mode, u_int16_t ipcomp,
|
||||
u_int16_t cpi, bool routed)
|
||||
{
|
||||
@@ -1992,7 +1992,7 @@ METHOD(kernel_ipsec_t, add_policy, status_t,
|
||||
|
||||
/* tunnel mode policies direct the packets into the pseudo IPIP SA */
|
||||
satype = (mode == MODE_TUNNEL) ? SADB_X_SATYPE_IPIP :
|
||||
proto_ike2satype(protocol);
|
||||
proto2satype(protocol);
|
||||
|
||||
/* create a policy */
|
||||
policy = create_policy_entry(src_ts, dst_ts, direction);
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright (C) 2006-2009 Tobias Brunner
|
||||
* Copyright (C) 2006-2010 Tobias Brunner
|
||||
* Copyright (C) 2005-2009 Martin Willi
|
||||
* Copyright (C) 2008 Andreas Steffen
|
||||
* Copyright (C) 2006-2007 Fabian Hartmann, Noah Heusser
|
||||
@@ -348,38 +348,6 @@ struct private_kernel_netlink_ipsec_t {
|
||||
bool install_routes;
|
||||
};
|
||||
|
||||
/**
|
||||
* convert a IKEv2 specific protocol identifier to the kernel one
|
||||
*/
|
||||
static u_int8_t proto_ike2kernel(protocol_id_t proto)
|
||||
{
|
||||
switch (proto)
|
||||
{
|
||||
case PROTO_ESP:
|
||||
return IPPROTO_ESP;
|
||||
case PROTO_AH:
|
||||
return IPPROTO_AH;
|
||||
default:
|
||||
return proto;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* reverse of ike2kernel
|
||||
*/
|
||||
static protocol_id_t proto_kernel2ike(u_int8_t proto)
|
||||
{
|
||||
switch (proto)
|
||||
{
|
||||
case IPPROTO_ESP:
|
||||
return PROTO_ESP;
|
||||
case IPPROTO_AH:
|
||||
return PROTO_AH;
|
||||
default:
|
||||
return proto;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* convert the general ipsec mode to the one defined in xfrm.h
|
||||
*/
|
||||
@@ -595,18 +563,18 @@ static void process_acquire(private_kernel_netlink_ipsec_t *this, struct nlmsghd
|
||||
*/
|
||||
static void process_expire(private_kernel_netlink_ipsec_t *this, struct nlmsghdr *hdr)
|
||||
{
|
||||
protocol_id_t protocol;
|
||||
u_int8_t protocol;
|
||||
u_int32_t spi, reqid;
|
||||
struct xfrm_user_expire *expire;
|
||||
|
||||
expire = (struct xfrm_user_expire*)NLMSG_DATA(hdr);
|
||||
protocol = proto_kernel2ike(expire->state.id.proto);
|
||||
protocol = expire->state.id.proto;
|
||||
spi = expire->state.id.spi;
|
||||
reqid = expire->state.reqid;
|
||||
|
||||
DBG2(DBG_KNL, "received a XFRM_MSG_EXPIRE");
|
||||
|
||||
if (protocol != PROTO_ESP && protocol != PROTO_AH)
|
||||
if (protocol != IPPROTO_ESP && protocol != IPPROTO_AH)
|
||||
{
|
||||
DBG2(DBG_KNL, "ignoring XFRM_MSG_EXPIRE for SA with SPI %.8x and "
|
||||
"reqid {%u} which is not a CHILD_SA", ntohl(spi), reqid);
|
||||
@@ -659,18 +627,15 @@ static void process_migrate(private_kernel_netlink_ipsec_t *this, struct nlmsghd
|
||||
else if (rta->rta_type == XFRMA_MIGRATE)
|
||||
{
|
||||
struct xfrm_user_migrate *migrate;
|
||||
protocol_id_t proto;
|
||||
|
||||
migrate = (struct xfrm_user_migrate*)RTA_DATA(rta);
|
||||
old_src = xfrm2host(migrate->old_family, &migrate->old_saddr, 0);
|
||||
old_dst = xfrm2host(migrate->old_family, &migrate->old_daddr, 0);
|
||||
new_src = xfrm2host(migrate->new_family, &migrate->new_saddr, 0);
|
||||
new_dst = xfrm2host(migrate->new_family, &migrate->new_daddr, 0);
|
||||
proto = proto_kernel2ike(migrate->proto);
|
||||
reqid = migrate->reqid;
|
||||
DBG2(DBG_KNL, " migrate %N %H...%H to %H...%H, reqid {%u}",
|
||||
protocol_id_names, proto, old_src, old_dst,
|
||||
new_src, new_dst, reqid);
|
||||
DBG2(DBG_KNL, " migrate %H...%H to %H...%H, reqid {%u}",
|
||||
old_src, old_dst, new_src, new_dst, reqid);
|
||||
DESTROY_IF(old_src);
|
||||
DESTROY_IF(old_dst);
|
||||
DESTROY_IF(new_src);
|
||||
@@ -709,7 +674,7 @@ static void process_mapping(private_kernel_netlink_ipsec_t *this,
|
||||
|
||||
DBG2(DBG_KNL, "received a XFRM_MSG_MAPPING");
|
||||
|
||||
if (proto_kernel2ike(mapping->id.proto) == PROTO_ESP)
|
||||
if (mapping->id.proto == IPPROTO_ESP)
|
||||
{
|
||||
host = xfrm2host(mapping->id.family, &mapping->new_saddr,
|
||||
mapping->new_sport);
|
||||
@@ -858,11 +823,11 @@ static status_t get_spi_internal(private_kernel_netlink_ipsec_t *this,
|
||||
|
||||
METHOD(kernel_ipsec_t, get_spi, status_t,
|
||||
private_kernel_netlink_ipsec_t *this, host_t *src, host_t *dst,
|
||||
protocol_id_t protocol, u_int32_t reqid, u_int32_t *spi)
|
||||
u_int8_t protocol, u_int32_t reqid, u_int32_t *spi)
|
||||
{
|
||||
DBG2(DBG_KNL, "getting SPI for reqid {%u}", reqid);
|
||||
|
||||
if (get_spi_internal(this, src, dst, proto_ike2kernel(protocol),
|
||||
if (get_spi_internal(this, src, dst, protocol,
|
||||
0xc0000000, 0xcFFFFFFF, reqid, spi) != SUCCESS)
|
||||
{
|
||||
DBG1(DBG_KNL, "unable to get SPI for reqid {%u}", reqid);
|
||||
@@ -898,7 +863,7 @@ METHOD(kernel_ipsec_t, get_cpi, status_t,
|
||||
|
||||
METHOD(kernel_ipsec_t, add_sa, status_t,
|
||||
private_kernel_netlink_ipsec_t *this, host_t *src, host_t *dst,
|
||||
u_int32_t spi, protocol_id_t protocol, u_int32_t reqid, mark_t mark,
|
||||
u_int32_t spi, u_int8_t protocol, u_int32_t reqid, mark_t mark,
|
||||
lifetime_cfg_t *lifetime, u_int16_t enc_alg, chunk_t enc_key,
|
||||
u_int16_t int_alg, chunk_t int_key, ipsec_mode_t mode, u_int16_t ipcomp,
|
||||
u_int16_t cpi, bool encap, bool inbound,
|
||||
@@ -944,7 +909,7 @@ METHOD(kernel_ipsec_t, add_sa, status_t,
|
||||
host2xfrm(src, &sa->saddr);
|
||||
host2xfrm(dst, &sa->id.daddr);
|
||||
sa->id.spi = spi;
|
||||
sa->id.proto = proto_ike2kernel(protocol);
|
||||
sa->id.proto = protocol;
|
||||
sa->family = src->get_family(src);
|
||||
sa->mode = mode2kernel(mode);
|
||||
switch (mode)
|
||||
@@ -1206,7 +1171,7 @@ METHOD(kernel_ipsec_t, add_sa, status_t,
|
||||
* Get the replay state (i.e. sequence numbers) of an SA.
|
||||
*/
|
||||
static status_t get_replay_state(private_kernel_netlink_ipsec_t *this,
|
||||
u_int32_t spi, protocol_id_t protocol, host_t *dst,
|
||||
u_int32_t spi, u_int8_t protocol, host_t *dst,
|
||||
struct xfrm_replay_state *replay)
|
||||
{
|
||||
netlink_buf_t request;
|
||||
@@ -1230,7 +1195,7 @@ static status_t get_replay_state(private_kernel_netlink_ipsec_t *this,
|
||||
|
||||
host2xfrm(dst, &aevent_id->sa_id.daddr);
|
||||
aevent_id->sa_id.spi = spi;
|
||||
aevent_id->sa_id.proto = proto_ike2kernel(protocol);
|
||||
aevent_id->sa_id.proto = protocol;
|
||||
aevent_id->sa_id.family = dst->get_family(dst);
|
||||
|
||||
if (this->socket_xfrm->send(this->socket_xfrm, hdr, &out, &len) == SUCCESS)
|
||||
@@ -1292,7 +1257,7 @@ static status_t get_replay_state(private_kernel_netlink_ipsec_t *this,
|
||||
|
||||
METHOD(kernel_ipsec_t, query_sa, status_t,
|
||||
private_kernel_netlink_ipsec_t *this, host_t *src, host_t *dst,
|
||||
u_int32_t spi, protocol_id_t protocol, mark_t mark, u_int64_t *bytes)
|
||||
u_int32_t spi, u_int8_t protocol, mark_t mark, u_int64_t *bytes)
|
||||
{
|
||||
netlink_buf_t request;
|
||||
struct nlmsghdr *out = NULL, *hdr;
|
||||
@@ -1319,7 +1284,7 @@ METHOD(kernel_ipsec_t, query_sa, status_t,
|
||||
sa_id = (struct xfrm_usersa_id*)NLMSG_DATA(hdr);
|
||||
host2xfrm(dst, &sa_id->daddr);
|
||||
sa_id->spi = spi;
|
||||
sa_id->proto = proto_ike2kernel(protocol);
|
||||
sa_id->proto = protocol;
|
||||
sa_id->family = dst->get_family(dst);
|
||||
|
||||
if (mark.value)
|
||||
@@ -1395,7 +1360,7 @@ METHOD(kernel_ipsec_t, query_sa, status_t,
|
||||
|
||||
METHOD(kernel_ipsec_t, del_sa, status_t,
|
||||
private_kernel_netlink_ipsec_t *this, host_t *src, host_t *dst,
|
||||
u_int32_t spi, protocol_id_t protocol, u_int16_t cpi, mark_t mark)
|
||||
u_int32_t spi, u_int8_t protocol, u_int16_t cpi, mark_t mark)
|
||||
{
|
||||
netlink_buf_t request;
|
||||
struct nlmsghdr *hdr;
|
||||
@@ -1426,7 +1391,7 @@ METHOD(kernel_ipsec_t, del_sa, status_t,
|
||||
sa_id = (struct xfrm_usersa_id*)NLMSG_DATA(hdr);
|
||||
host2xfrm(dst, &sa_id->daddr);
|
||||
sa_id->spi = spi;
|
||||
sa_id->proto = proto_ike2kernel(protocol);
|
||||
sa_id->proto = protocol;
|
||||
sa_id->family = dst->get_family(dst);
|
||||
|
||||
if (mark.value)
|
||||
@@ -1473,7 +1438,7 @@ METHOD(kernel_ipsec_t, del_sa, status_t,
|
||||
}
|
||||
|
||||
METHOD(kernel_ipsec_t, update_sa, status_t,
|
||||
private_kernel_netlink_ipsec_t *this, u_int32_t spi, protocol_id_t protocol,
|
||||
private_kernel_netlink_ipsec_t *this, u_int32_t spi, u_int8_t protocol,
|
||||
u_int16_t cpi, host_t *src, host_t *dst, host_t *new_src, host_t *new_dst,
|
||||
bool old_encap, bool new_encap, mark_t mark)
|
||||
{
|
||||
@@ -1509,7 +1474,7 @@ METHOD(kernel_ipsec_t, update_sa, status_t,
|
||||
sa_id = (struct xfrm_usersa_id*)NLMSG_DATA(hdr);
|
||||
host2xfrm(dst, &sa_id->daddr);
|
||||
sa_id->spi = spi;
|
||||
sa_id->proto = proto_ike2kernel(protocol);
|
||||
sa_id->proto = protocol;
|
||||
sa_id->family = dst->get_family(dst);
|
||||
|
||||
if (this->socket_xfrm->send(this->socket_xfrm, hdr, &out, &len) == SUCCESS)
|
||||
@@ -1652,9 +1617,9 @@ METHOD(kernel_ipsec_t, update_sa, status_t,
|
||||
METHOD(kernel_ipsec_t, add_policy, status_t,
|
||||
private_kernel_netlink_ipsec_t *this, host_t *src, host_t *dst,
|
||||
traffic_selector_t *src_ts, traffic_selector_t *dst_ts,
|
||||
policy_dir_t direction, u_int32_t spi, protocol_id_t protocol,
|
||||
policy_dir_t direction, u_int32_t spi, u_int8_t protocol,
|
||||
u_int32_t reqid, mark_t mark, ipsec_mode_t mode, u_int16_t ipcomp,
|
||||
u_int16_t cpi, bool routed)
|
||||
u_int16_t cpi, bool routed)
|
||||
{
|
||||
policy_entry_t *current, *policy;
|
||||
bool found = FALSE;
|
||||
@@ -1784,7 +1749,7 @@ METHOD(kernel_ipsec_t, add_policy, status_t,
|
||||
}
|
||||
|
||||
tmpl->reqid = reqid;
|
||||
tmpl->id.proto = proto_ike2kernel(protocol);
|
||||
tmpl->id.proto = protocol;
|
||||
tmpl->aalgos = tmpl->ealgos = tmpl->calgos = ~0;
|
||||
tmpl->mode = mode2kernel(mode);
|
||||
tmpl->family = src->get_family(src);
|
||||
|
||||
@@ -394,15 +394,15 @@ ENUM(sadb_ext_type_names, SADB_EXT_RESERVED, SADB_EXT_MAX,
|
||||
);
|
||||
|
||||
/**
|
||||
* convert a IKEv2 specific protocol identifier to the PF_KEY sa type
|
||||
* convert a protocol identifier to the PF_KEY sa type
|
||||
*/
|
||||
static u_int8_t proto_ike2satype(protocol_id_t proto)
|
||||
static u_int8_t proto2satype(u_int8_t proto)
|
||||
{
|
||||
switch (proto)
|
||||
{
|
||||
case PROTO_ESP:
|
||||
case IPPROTO_ESP:
|
||||
return SADB_SATYPE_ESP;
|
||||
case PROTO_AH:
|
||||
case IPPROTO_AH:
|
||||
return SADB_SATYPE_AH;
|
||||
case IPPROTO_COMP:
|
||||
return SADB_X_SATYPE_IPCOMP;
|
||||
@@ -412,36 +412,20 @@ static u_int8_t proto_ike2satype(protocol_id_t proto)
|
||||
}
|
||||
|
||||
/**
|
||||
* convert a PF_KEY sa type to a IKEv2 specific protocol identifier
|
||||
* convert a PF_KEY sa type to a protocol identifier
|
||||
*/
|
||||
static protocol_id_t proto_satype2ike(u_int8_t proto)
|
||||
static u_int8_t satype2proto(u_int8_t satype)
|
||||
{
|
||||
switch (proto)
|
||||
switch (satype)
|
||||
{
|
||||
case SADB_SATYPE_ESP:
|
||||
return PROTO_ESP;
|
||||
return IPPROTO_ESP;
|
||||
case SADB_SATYPE_AH:
|
||||
return PROTO_AH;
|
||||
return IPPROTO_AH;
|
||||
case SADB_X_SATYPE_IPCOMP:
|
||||
return IPPROTO_COMP;
|
||||
default:
|
||||
return proto;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* convert a IKEv2 specific protocol identifier to the IP protocol identifier
|
||||
*/
|
||||
static u_int8_t proto_ike2ip(protocol_id_t proto)
|
||||
{
|
||||
switch (proto)
|
||||
{
|
||||
case PROTO_ESP:
|
||||
return IPPROTO_ESP;
|
||||
case PROTO_AH:
|
||||
return IPPROTO_AH;
|
||||
default:
|
||||
return proto;
|
||||
return satype;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -942,7 +926,7 @@ static void process_acquire(private_kernel_pfkey_ipsec_t *this, struct sadb_msg*
|
||||
static void process_expire(private_kernel_pfkey_ipsec_t *this, struct sadb_msg* msg)
|
||||
{
|
||||
pfkey_msg_t response;
|
||||
protocol_id_t protocol;
|
||||
u_int8_t protocol;
|
||||
u_int32_t spi, reqid;
|
||||
bool hard;
|
||||
|
||||
@@ -954,12 +938,12 @@ static void process_expire(private_kernel_pfkey_ipsec_t *this, struct sadb_msg*
|
||||
return;
|
||||
}
|
||||
|
||||
protocol = proto_satype2ike(msg->sadb_msg_satype);
|
||||
protocol = satype2proto(msg->sadb_msg_satype);
|
||||
spi = response.sa->sadb_sa_spi;
|
||||
reqid = response.x_sa2->sadb_x_sa2_reqid;
|
||||
hard = response.lft_hard != NULL;
|
||||
|
||||
if (protocol != PROTO_ESP && protocol != PROTO_AH)
|
||||
if (protocol != IPPROTO_ESP && protocol != IPPROTO_AH)
|
||||
{
|
||||
DBG2(DBG_KNL, "ignoring SADB_EXPIRE for SA with SPI %.8x and reqid {%u} "
|
||||
"which is not a CHILD_SA", ntohl(spi), reqid);
|
||||
@@ -1053,7 +1037,7 @@ static void process_mapping(private_kernel_pfkey_ipsec_t *this, struct sadb_msg*
|
||||
spi = response.sa->sadb_sa_spi;
|
||||
reqid = response.x_sa2->sadb_x_sa2_reqid;
|
||||
|
||||
if (proto_satype2ike(msg->sadb_msg_satype) == PROTO_ESP)
|
||||
if (satype2proto(msg->sadb_msg_satype) == IPPROTO_ESP)
|
||||
{
|
||||
sockaddr_t *sa = (sockaddr_t*)(response.dst + 1);
|
||||
switch (sa->sa_family)
|
||||
@@ -1155,7 +1139,7 @@ static job_requeue_t receive_events(private_kernel_pfkey_ipsec_t *this)
|
||||
|
||||
METHOD(kernel_ipsec_t, get_spi, status_t,
|
||||
private_kernel_pfkey_ipsec_t *this, host_t *src, host_t *dst,
|
||||
protocol_id_t protocol, u_int32_t reqid, u_int32_t *spi)
|
||||
u_int8_t protocol, u_int32_t reqid, u_int32_t *spi)
|
||||
{
|
||||
unsigned char request[PFKEY_BUFFER_SIZE];
|
||||
struct sadb_msg *msg, *out;
|
||||
@@ -1170,7 +1154,7 @@ METHOD(kernel_ipsec_t, get_spi, status_t,
|
||||
msg = (struct sadb_msg*)request;
|
||||
msg->sadb_msg_version = PF_KEY_V2;
|
||||
msg->sadb_msg_type = SADB_GETSPI;
|
||||
msg->sadb_msg_satype = proto_ike2satype(protocol);
|
||||
msg->sadb_msg_satype = proto2satype(protocol);
|
||||
msg->sadb_msg_len = PFKEY_LEN(sizeof(struct sadb_msg));
|
||||
|
||||
sa2 = (struct sadb_x_sa2*)PFKEY_EXT_ADD_NEXT(msg);
|
||||
@@ -1221,7 +1205,7 @@ METHOD(kernel_ipsec_t, get_cpi, status_t,
|
||||
|
||||
METHOD(kernel_ipsec_t, add_sa, status_t,
|
||||
private_kernel_pfkey_ipsec_t *this, host_t *src, host_t *dst, u_int32_t spi,
|
||||
protocol_id_t protocol, u_int32_t reqid, mark_t mark,
|
||||
u_int8_t protocol, u_int32_t reqid, mark_t mark,
|
||||
lifetime_cfg_t *lifetime, u_int16_t enc_alg, chunk_t enc_key,
|
||||
u_int16_t int_alg, chunk_t int_key, ipsec_mode_t mode,
|
||||
u_int16_t ipcomp, u_int16_t cpi, bool encap, bool inbound,
|
||||
@@ -1242,7 +1226,7 @@ METHOD(kernel_ipsec_t, add_sa, status_t,
|
||||
msg = (struct sadb_msg*)request;
|
||||
msg->sadb_msg_version = PF_KEY_V2;
|
||||
msg->sadb_msg_type = inbound ? SADB_UPDATE : SADB_ADD;
|
||||
msg->sadb_msg_satype = proto_ike2satype(protocol);
|
||||
msg->sadb_msg_satype = proto2satype(protocol);
|
||||
msg->sadb_msg_len = PFKEY_LEN(sizeof(struct sadb_msg));
|
||||
|
||||
#ifdef __APPLE__
|
||||
@@ -1367,7 +1351,7 @@ METHOD(kernel_ipsec_t, add_sa, status_t,
|
||||
}
|
||||
|
||||
METHOD(kernel_ipsec_t, update_sa, status_t,
|
||||
private_kernel_pfkey_ipsec_t *this, u_int32_t spi, protocol_id_t protocol,
|
||||
private_kernel_pfkey_ipsec_t *this, u_int32_t spi, u_int8_t protocol,
|
||||
u_int16_t cpi, host_t *src, host_t *dst, host_t *new_src, host_t *new_dst,
|
||||
bool encap, bool new_encap, mark_t mark)
|
||||
{
|
||||
@@ -1395,7 +1379,7 @@ METHOD(kernel_ipsec_t, update_sa, status_t,
|
||||
msg = (struct sadb_msg*)request;
|
||||
msg->sadb_msg_version = PF_KEY_V2;
|
||||
msg->sadb_msg_type = SADB_GET;
|
||||
msg->sadb_msg_satype = proto_ike2satype(protocol);
|
||||
msg->sadb_msg_satype = proto2satype(protocol);
|
||||
msg->sadb_msg_len = PFKEY_LEN(sizeof(struct sadb_msg));
|
||||
|
||||
sa = (struct sadb_sa*)PFKEY_EXT_ADD_NEXT(msg);
|
||||
@@ -1438,7 +1422,7 @@ METHOD(kernel_ipsec_t, update_sa, status_t,
|
||||
msg = (struct sadb_msg*)request;
|
||||
msg->sadb_msg_version = PF_KEY_V2;
|
||||
msg->sadb_msg_type = SADB_UPDATE;
|
||||
msg->sadb_msg_satype = proto_ike2satype(protocol);
|
||||
msg->sadb_msg_satype = proto2satype(protocol);
|
||||
msg->sadb_msg_len = PFKEY_LEN(sizeof(struct sadb_msg));
|
||||
|
||||
#ifdef __APPLE__
|
||||
@@ -1502,7 +1486,7 @@ METHOD(kernel_ipsec_t, update_sa, status_t,
|
||||
|
||||
METHOD(kernel_ipsec_t, query_sa, status_t,
|
||||
private_kernel_pfkey_ipsec_t *this, host_t *src, host_t *dst,
|
||||
u_int32_t spi, protocol_id_t protocol, mark_t mark, u_int64_t *bytes)
|
||||
u_int32_t spi, u_int8_t protocol, mark_t mark, u_int64_t *bytes)
|
||||
{
|
||||
unsigned char request[PFKEY_BUFFER_SIZE];
|
||||
struct sadb_msg *msg, *out;
|
||||
@@ -1517,7 +1501,7 @@ METHOD(kernel_ipsec_t, query_sa, status_t,
|
||||
msg = (struct sadb_msg*)request;
|
||||
msg->sadb_msg_version = PF_KEY_V2;
|
||||
msg->sadb_msg_type = SADB_GET;
|
||||
msg->sadb_msg_satype = proto_ike2satype(protocol);
|
||||
msg->sadb_msg_satype = proto2satype(protocol);
|
||||
msg->sadb_msg_len = PFKEY_LEN(sizeof(struct sadb_msg));
|
||||
|
||||
sa = (struct sadb_sa*)PFKEY_EXT_ADD_NEXT(msg);
|
||||
@@ -1558,7 +1542,7 @@ METHOD(kernel_ipsec_t, query_sa, status_t,
|
||||
|
||||
METHOD(kernel_ipsec_t, del_sa, status_t,
|
||||
private_kernel_pfkey_ipsec_t *this, host_t *src, host_t *dst,
|
||||
u_int32_t spi, protocol_id_t protocol, u_int16_t cpi, mark_t mark)
|
||||
u_int32_t spi, u_int8_t protocol, u_int16_t cpi, mark_t mark)
|
||||
{
|
||||
unsigned char request[PFKEY_BUFFER_SIZE];
|
||||
struct sadb_msg *msg, *out;
|
||||
@@ -1572,7 +1556,7 @@ METHOD(kernel_ipsec_t, del_sa, status_t,
|
||||
msg = (struct sadb_msg*)request;
|
||||
msg->sadb_msg_version = PF_KEY_V2;
|
||||
msg->sadb_msg_type = SADB_DELETE;
|
||||
msg->sadb_msg_satype = proto_ike2satype(protocol);
|
||||
msg->sadb_msg_satype = proto2satype(protocol);
|
||||
msg->sadb_msg_len = PFKEY_LEN(sizeof(struct sadb_msg));
|
||||
|
||||
sa = (struct sadb_sa*)PFKEY_EXT_ADD_NEXT(msg);
|
||||
@@ -1608,7 +1592,7 @@ METHOD(kernel_ipsec_t, del_sa, status_t,
|
||||
METHOD(kernel_ipsec_t, add_policy, status_t,
|
||||
private_kernel_pfkey_ipsec_t *this, host_t *src, host_t *dst,
|
||||
traffic_selector_t *src_ts, traffic_selector_t *dst_ts,
|
||||
policy_dir_t direction, u_int32_t spi, protocol_id_t protocol,
|
||||
policy_dir_t direction, u_int32_t spi, u_int8_t protocol,
|
||||
u_int32_t reqid, mark_t mark, ipsec_mode_t mode, u_int16_t ipcomp,
|
||||
u_int16_t cpi, bool routed)
|
||||
{
|
||||
@@ -1676,7 +1660,7 @@ METHOD(kernel_ipsec_t, add_policy, status_t,
|
||||
|
||||
/* one or more sadb_x_ipsecrequest extensions are added to the sadb_x_policy extension */
|
||||
req = (struct sadb_x_ipsecrequest*)(pol + 1);
|
||||
req->sadb_x_ipsecrequest_proto = proto_ike2ip(protocol);
|
||||
req->sadb_x_ipsecrequest_proto = protocol;
|
||||
/* !!! the length of this struct MUST be in octets instead of 64 bit words */
|
||||
req->sadb_x_ipsecrequest_len = sizeof(struct sadb_x_ipsecrequest);
|
||||
req->sadb_x_ipsecrequest_mode = mode2kernel(mode);
|
||||
|
||||
@@ -36,7 +36,7 @@ struct private_load_tester_ipsec_t {
|
||||
|
||||
METHOD(kernel_ipsec_t, get_spi, status_t,
|
||||
private_load_tester_ipsec_t *this, host_t *src, host_t *dst,
|
||||
protocol_id_t protocol, u_int32_t reqid, u_int32_t *spi)
|
||||
u_int8_t protocol, u_int32_t reqid, u_int32_t *spi)
|
||||
{
|
||||
*spi = ++this->spi;
|
||||
return SUCCESS;
|
||||
@@ -51,7 +51,7 @@ METHOD(kernel_ipsec_t, get_cpi, status_t,
|
||||
|
||||
METHOD(kernel_ipsec_t, add_sa, status_t,
|
||||
private_load_tester_ipsec_t *this, host_t *src, host_t *dst,
|
||||
u_int32_t spi, protocol_id_t protocol, u_int32_t reqid, mark_t mark,
|
||||
u_int32_t spi, u_int8_t protocol, u_int32_t reqid, mark_t mark,
|
||||
lifetime_cfg_t *lifetime, u_int16_t enc_alg, chunk_t enc_key,
|
||||
u_int16_t int_alg, chunk_t int_key, ipsec_mode_t mode, u_int16_t ipcomp,
|
||||
u_int16_t cpi, bool encap, bool inbound, traffic_selector_t *src_ts,
|
||||
@@ -61,7 +61,7 @@ METHOD(kernel_ipsec_t, add_sa, status_t,
|
||||
}
|
||||
|
||||
METHOD(kernel_ipsec_t, update_sa, status_t,
|
||||
private_load_tester_ipsec_t *this, u_int32_t spi, protocol_id_t protocol,
|
||||
private_load_tester_ipsec_t *this, u_int32_t spi, u_int8_t protocol,
|
||||
u_int16_t cpi, host_t *src, host_t *dst, host_t *new_src,
|
||||
host_t *new_dst, bool encap, bool new_encap, mark_t mark)
|
||||
{
|
||||
@@ -70,14 +70,14 @@ METHOD(kernel_ipsec_t, update_sa, status_t,
|
||||
|
||||
METHOD(kernel_ipsec_t, query_sa, status_t,
|
||||
private_load_tester_ipsec_t *this, host_t *src, host_t *dst,
|
||||
u_int32_t spi, protocol_id_t protocol, mark_t mark, u_int64_t *bytes)
|
||||
u_int32_t spi, u_int8_t protocol, mark_t mark, u_int64_t *bytes)
|
||||
{
|
||||
return NOT_SUPPORTED;
|
||||
}
|
||||
|
||||
METHOD(kernel_ipsec_t, del_sa, status_t,
|
||||
private_load_tester_ipsec_t *this, host_t *src, host_t *dst,
|
||||
u_int32_t spi, protocol_id_t protocol, u_int16_t cpi, mark_t mark)
|
||||
u_int32_t spi, u_int8_t protocol, u_int16_t cpi, mark_t mark)
|
||||
{
|
||||
return SUCCESS;
|
||||
}
|
||||
@@ -85,7 +85,7 @@ METHOD(kernel_ipsec_t, del_sa, status_t,
|
||||
METHOD(kernel_ipsec_t, add_policy, status_t,
|
||||
private_load_tester_ipsec_t *this, host_t *src, host_t *dst,
|
||||
traffic_selector_t *src_ts, traffic_selector_t *dst_ts,
|
||||
policy_dir_t direction, u_int32_t spi, protocol_id_t protocol,
|
||||
policy_dir_t direction, u_int32_t spi, u_int8_t protocol,
|
||||
u_int32_t reqid, mark_t mark, ipsec_mode_t mode, u_int16_t ipcomp,
|
||||
u_int16_t cpi, bool routed)
|
||||
{
|
||||
|
||||
Reference in New Issue
Block a user