denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

kernel-interface: Add feature to indicate if query_sa() returns last use time

Browse Source 
Currently supported by libipsec and PF_KEY on macOS (FreeBSD, like Linux,
reports the time the SA was first used in sadb_lifetime_usetime - it also
triggers rekeyings based on that, which Linux doesn't, it also triggers
them if an SA is never used).
This commit is contained in:
Tobias Brunner
2023-02-22 13:20:10 +01:00
parent 1efdb0f791
commit b9131c34d3
5 changed files with 40 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/kernel_libipsec/kernel_libipsec_ipsec.c
+2 -1
View File
@@ -231,7 +231,8 @@ static void expire(uint8_t protocol, uint32_t spi, host_t *dst, bool hard)
METHOD(kernel_ipsec_t, get_features, kernel_feature_t,
private_kernel_libipsec_ipsec_t *this)
{
return KERNEL_REQUIRE_UDP_ENCAPSULATION | KERNEL_ESP_V3_TFC;
return KERNEL_REQUIRE_UDP_ENCAPSULATION | KERNEL_ESP_V3_TFC |
KERNEL_SA_USE_TIME;
}
METHOD(kernel_ipsec_t, get_spi, status_t,
src/libcharon/plugins/kernel_pfkey/kernel_pfkey_ipsec.c
+14 -3
View File
@@ -1659,6 +1659,16 @@ static status_t get_spi_internal(private_kernel_pfkey_ipsec_t *this,
return SUCCESS;
}
METHOD(kernel_ipsec_t, get_features, kernel_feature_t,
private_kernel_pfkey_ipsec_t *this)
{
#ifdef __APPLE__
return KERNEL_SA_USE_TIME;
#else
return 0;
#endif
}
METHOD(kernel_ipsec_t, get_spi, status_t,
private_kernel_pfkey_ipsec_t *this, host_t *src, host_t *dst,
uint8_t protocol, uint32_t *spi)
@@ -2198,9 +2208,9 @@ METHOD(kernel_ipsec_t, query_sa, status_t,
/* OS X uses the "last" time of use in usetime */
*time = response.lft_current->sadb_lifetime_usetime;
#else /* !__APPLE__ */
/* on Linux, sadb_lifetime_usetime is set to the "first" time of use,
* which is actually correct according to PF_KEY. We have to query
* policies for the last usetime. */
/* on Linux and FreeBSD, sadb_lifetime_usetime is set to the "first"
* time of use, which is actually correct according to PF_KEY. We have
* to query policies for the last usetime. */
*time = 0;
#endif /* !__APPLE__ */
}
@@ -3308,6 +3318,7 @@ kernel_pfkey_ipsec_t *kernel_pfkey_ipsec_create()
INIT(this,
.public = {
.interface = {
.get_features = _get_features,
.get_spi = _get_spi,
.get_cpi = _get_cpi,
.add_sa = _add_sa,