denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Added an option to specify the type of a policy to kernel_ipsec.add_policy.

Browse Source 
This will later allow us to support pluto's passthrough and drop
policies in charon.
This commit is contained in:
Tobias Brunner
2010-09-02 19:04:19 +02:00
parent 6a066ad19b
commit bd7a2f3bfc
7 changed files with 43 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/child_sa.c
+18 -18
View File
@@ -692,24 +692,24 @@ METHOD(child_sa_t, add_policies, status_t,
status |= hydra->kernel_interface->add_policy(
hydra->kernel_interface,
this->my_addr, this->other_addr, my_ts, other_ts,
POLICY_OUT, other_esp, other_ah, this->reqid,
this->mark_out, this->mode, this->ipcomp,
this->other_cpi, routed);
POLICY_OUT, POLICY_IPSEC, other_esp, other_ah,
this->reqid, this->mark_out, this->mode,
this->ipcomp, this->other_cpi, routed);
status |= hydra->kernel_interface->add_policy(
hydra->kernel_interface,
this->other_addr, this->my_addr, other_ts, my_ts,
POLICY_IN, my_esp, my_ah, this->reqid,
this->mark_in, this->mode, this->ipcomp,
this->my_cpi, routed);
POLICY_IN, POLICY_IPSEC, my_esp, my_ah,
this->reqid, this->mark_in, this->mode,
this->ipcomp, this->my_cpi, routed);
if (this->mode != MODE_TRANSPORT)
{
status |= hydra->kernel_interface->add_policy(
hydra->kernel_interface,
this->other_addr, this->my_addr, other_ts, my_ts,
POLICY_FWD, my_esp, my_ah, this->reqid,
this->mark_in, this->mode, this->ipcomp,
this->my_cpi, routed);
POLICY_FWD, POLICY_IPSEC, my_esp, my_ah,
this->reqid, this->mark_in, this->mode,
this->ipcomp, this->my_cpi, routed);
}
if (status != SUCCESS)
@@ -832,19 +832,19 @@ METHOD(child_sa_t, update, status_t,
/* reinstall updated policies */
hydra->kernel_interface->add_policy(hydra->kernel_interface,
me, other, my_ts, other_ts, POLICY_OUT,
other_esp, other_ah, this->reqid, this->mark_out,
this->mode, this->ipcomp, this->other_cpi, FALSE);
me, other, my_ts, other_ts, POLICY_OUT, POLICY_IPSEC,
other_esp, other_ah, this->reqid, this->mark_out,
this->mode, this->ipcomp, this->other_cpi, FALSE);
hydra->kernel_interface->add_policy(hydra->kernel_interface,
other, me, other_ts, my_ts, POLICY_IN,
my_esp, my_ah, this->reqid, this->mark_in,
this->mode, this->ipcomp, this->my_cpi, FALSE);
other, me, other_ts, my_ts, POLICY_IN, POLICY_IPSEC,
my_esp, my_ah, this->reqid, this->mark_in,
this->mode, this->ipcomp, this->my_cpi, FALSE);
if (this->mode != MODE_TRANSPORT)
{
hydra->kernel_interface->add_policy(hydra->kernel_interface,
other, me, other_ts, my_ts, POLICY_FWD,
my_esp, my_ah, this->reqid, this->mark_in,
this->mode, this->ipcomp, this->my_cpi, FALSE);
other, me, other_ts, my_ts, POLICY_FWD, POLICY_IPSEC,
my_esp, my_ah, this->reqid, this->mark_in,
this->mode, this->ipcomp, this->my_cpi, FALSE);
}
}
enumerator->destroy(enumerator);
src/libhydra/kernel/kernel_interface.c
+3 -2
View File
@@ -131,7 +131,7 @@ METHOD(kernel_interface_t, del_sa, status_t,
METHOD(kernel_interface_t, add_policy, status_t,
private_kernel_interface_t *this, host_t *src, host_t *dst,
traffic_selector_t *src_ts, traffic_selector_t *dst_ts,
policy_dir_t direction, u_int32_t spi, u_int32_t ah_spi,
policy_dir_t direction, policy_type_t type, u_int32_t spi, u_int32_t ah_spi,
u_int32_t reqid, mark_t mark, ipsec_mode_t mode, u_int16_t ipcomp,
u_int16_t cpi, bool routed)
{
@@ -140,7 +140,8 @@ METHOD(kernel_interface_t, add_policy, status_t,
return NOT_SUPPORTED;
}
return this->ipsec->add_policy(this->ipsec, src, dst, src_ts, dst_ts,
direction, spi, ah_spi, reqid, mark, mode, ipcomp, cpi, routed);
direction, type, spi, ah_spi, reqid, mark,
mode, ipcomp, cpi, routed);
}
METHOD(kernel_interface_t, query_policy, status_t,
src/libhydra/kernel/kernel_interface.h
+3 -2
View File
@@ -183,6 +183,7 @@ struct kernel_interface_t {
* @param src_ts traffic selector to match traffic source
* @param dst_ts traffic selector to match traffic dest
* @param direction direction of traffic, POLICY_(IN|OUT|FWD)
* @param type type of policy, POLICY_(IPSEC|PASS|DROP)
* @param spi SPI of optional ESP SA
* @param ah_spi SPI of optional AH SA
* @param reqid unique ID of an SA to use to enforce policy
@@ -197,8 +198,8 @@ struct kernel_interface_t {
host_t *src, host_t *dst,
traffic_selector_t *src_ts,
traffic_selector_t *dst_ts,
policy_dir_t direction, u_int32_t spi,
u_int32_t ah_spi, u_int32_t reqid,
policy_dir_t direction, policy_type_t type,
u_int32_t spi, u_int32_t ah_spi, u_int32_t reqid,
mark_t mark, ipsec_mode_t mode, u_int16_t ipcomp,
u_int16_t cpi, bool routed);
src/libhydra/kernel/kernel_ipsec.h
+16 -2
View File
@@ -26,6 +26,7 @@
typedef enum ipsec_mode_t ipsec_mode_t;
typedef enum policy_dir_t policy_dir_t;
typedef enum policy_type_t policy_type_t;
typedef enum ipcomp_transform_t ipcomp_transform_t;
typedef struct kernel_ipsec_t kernel_ipsec_t;
typedef struct lifetime_cfg_t lifetime_cfg_t;
@@ -71,6 +72,18 @@ enum policy_dir_t {
*/
extern enum_name_t *policy_dir_names;
/**
* Type of a policy.
*/
enum policy_type_t {
/** Normal IPsec policy */
POLICY_IPSEC = 1,
/** Passthrough policy (traffic is ignored by IPsec) */
POLICY_PASS,
/** Drop policy (traffic is discarded) */
POLICY_DROP,
};
/**
* IPComp transform IDs, as in RFC 4306
*/
@@ -258,6 +271,7 @@ struct kernel_ipsec_t {
* @param src_ts traffic selector to match traffic source
* @param dst_ts traffic selector to match traffic dest
* @param direction direction of traffic, POLICY_(IN|OUT|FWD)
* @param type type of policy, POLICY_(IPSEC|PASS|DROP)
* @param spi SPI of optional ESP SA
* @param ah_spi SPI of optional AH SA
* @param reqid unique ID of an SA to use to enforce policy
@@ -272,8 +286,8 @@ struct kernel_ipsec_t {
host_t *src, host_t *dst,
traffic_selector_t *src_ts,
traffic_selector_t *dst_ts,
policy_dir_t direction, u_int32_t spi,
u_int32_t ah_spi, u_int32_t reqid,
policy_dir_t direction, policy_type_t type,
u_int32_t spi, u_int32_t ah_spi, u_int32_t reqid,
mark_t mark, ipsec_mode_t mode,
u_int16_t ipcomp, u_int16_t cpi, bool routed);
src/libhydra/plugins/kernel_klips/kernel_klips_ipsec.c
+1 -1
View File
@@ -1969,7 +1969,7 @@ METHOD(kernel_ipsec_t, del_sa, status_t,
METHOD(kernel_ipsec_t, add_policy, status_t,
private_kernel_klips_ipsec_t *this, host_t *src, host_t *dst,
traffic_selector_t *src_ts, traffic_selector_t *dst_ts,
policy_dir_t direction, u_int32_t spi, u_int32_t ah_spi,
policy_dir_t direction, policy_type_t type, u_int32_t spi, u_int32_t ah_spi,
u_int32_t reqid, mark_t mark, ipsec_mode_t mode, u_int16_t ipcomp,
u_int16_t cpi, bool routed)
{
src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c
+1 -1
View File
@@ -1617,7 +1617,7 @@ METHOD(kernel_ipsec_t, update_sa, status_t,
METHOD(kernel_ipsec_t, add_policy, status_t,
private_kernel_netlink_ipsec_t *this, host_t *src, host_t *dst,
traffic_selector_t *src_ts, traffic_selector_t *dst_ts,
policy_dir_t direction, u_int32_t spi, u_int32_t ah_spi,
policy_dir_t direction, policy_type_t type, u_int32_t spi, u_int32_t ah_spi,
u_int32_t reqid, mark_t mark, ipsec_mode_t mode, u_int16_t ipcomp,
u_int16_t cpi, bool routed)
{
src/libhydra/plugins/kernel_pfkey/kernel_pfkey_ipsec.c
+1 -1
View File
@@ -1593,7 +1593,7 @@ METHOD(kernel_ipsec_t, del_sa, status_t,
METHOD(kernel_ipsec_t, add_policy, status_t,
private_kernel_pfkey_ipsec_t *this, host_t *src, host_t *dst,
traffic_selector_t *src_ts, traffic_selector_t *dst_ts,
policy_dir_t direction, u_int32_t spi, u_int32_t ah_spi,
policy_dir_t direction, policy_type_t type, u_int32_t spi, u_int32_t ah_spi,
u_int32_t reqid, mark_t mark, ipsec_mode_t mode, u_int16_t ipcomp,
u_int16_t cpi, bool routed)
{