denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Mark CHILD_SAs used for trap policies to uninstall them properly.

Browse Source 
If the installation failed the state is not CHILD_ROUTED which means the
wrong priority is used to uninstall the policies.  This is a problem for
kernel interfaces that keep track of installed policies as now the proper
policy is not found (if the priority is considered).
This commit is contained in:
Tobias Brunner
2012-06-04 18:04:48 +02:00
parent 93d9a02e9e
commit c8f7a114b6
1 changed files with 13 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/child_sa.c
+13 -6
View File
@@ -123,6 +123,11 @@ struct private_child_sa_t {
*/ */
child_sa_state_t state; child_sa_state_t state;
/**
* TRUE if this CHILD_SA is used to install trap policies
*/
bool trap;
/** /**
* Specifies if UDP encapsulation is enabled (NAT traversal) * Specifies if UDP encapsulation is enabled (NAT traversal)
*/ */
@@ -767,8 +772,11 @@ METHOD(child_sa_t, add_policies, status_t,
other_sa.ah.spi = this->other_spi; other_sa.ah.spi = this->other_spi;
} }
priority = this->state == CHILD_CREATED ? POLICY_PRIORITY_ROUTED /* if we're not in state CHILD_INSTALLING (i.e. if there is no SAD
: POLICY_PRIORITY_DEFAULT; * entry) we install a trap policy */
this->trap = this->state == CHILD_CREATED;
priority = this->trap ? POLICY_PRIORITY_ROUTED
: POLICY_PRIORITY_DEFAULT;
/* enumerate pairs of traffic selectors */ /* enumerate pairs of traffic selectors */
enumerator = create_policy_enumerator(this); enumerator = create_policy_enumerator(this);
@@ -797,8 +805,8 @@ METHOD(child_sa_t, add_policies, status_t,
enumerator->destroy(enumerator); enumerator->destroy(enumerator);
} }
if (status == SUCCESS && this->state == CHILD_CREATED) if (status == SUCCESS && this->trap)
{ /* switch to routed state if no SAD entry set up */ {
set_state(this, CHILD_ROUTED); set_state(this, CHILD_ROUTED);
} }
return status; return status;
@@ -970,8 +978,7 @@ METHOD(child_sa_t, destroy, void,
traffic_selector_t *my_ts, *other_ts; traffic_selector_t *my_ts, *other_ts;
policy_priority_t priority; policy_priority_t priority;
priority = this->state == CHILD_ROUTED ? POLICY_PRIORITY_ROUTED priority = this->trap ? POLICY_PRIORITY_ROUTED : POLICY_PRIORITY_DEFAULT;
: POLICY_PRIORITY_DEFAULT;
set_state(this, CHILD_DESTROYING); set_state(this, CHILD_DESTROYING);