denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

added IPsec bypass policy to receiving socket, allows incoming IKE traffic on host2host tunnels when using NAT

Browse Source
This commit is contained in:
Martin Willi
2006-07-14 08:08:55 +00:00
parent 325e497798
commit e3109c02ac
1 changed files with 29 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/charon/network/socket.c
+27 -24
View File
@@ -249,10 +249,14 @@ status_t sender(private_socket_t *this, packet_t *packet)
/** /**
* setup a send socket on a specified port * setup a send socket on a specified port
*/ */
static status_t setup_send_socket(private_socket_t *this, u_int16_t port, int *send_fd) { static status_t setup_send_socket(private_socket_t *this, u_int16_t port, int *send_fd)
{
int on = TRUE; int on = TRUE;
struct sockaddr_in addr; struct sockaddr_in addr;
int fd = socket(PF_INET, SOCK_DGRAM, IPPROTO_UDP); struct sadb_x_policy policy;
int fd;
fd = socket(PF_INET, SOCK_DGRAM, IPPROTO_UDP);
if (fd < 0) if (fd < 0)
{ {
this->logger->log(this->logger, ERROR, "could not open IPv4 send socket!"); this->logger->log(this->logger, ERROR, "could not open IPv4 send socket!");
@@ -266,33 +270,15 @@ static status_t setup_send_socket(private_socket_t *this, u_int16_t port, int *s
return FAILED; return FAILED;
} }
struct sadb_x_policy policy; /* bypass outgoung IKE traffic on send socket */
int level, opt;
policy.sadb_x_policy_len = sizeof(policy) / sizeof(u_int64_t); policy.sadb_x_policy_len = sizeof(policy) / sizeof(u_int64_t);
policy.sadb_x_policy_exttype = SADB_X_EXT_POLICY; policy.sadb_x_policy_exttype = SADB_X_EXT_POLICY;
policy.sadb_x_policy_type = IPSEC_POLICY_BYPASS; policy.sadb_x_policy_type = IPSEC_POLICY_BYPASS;
policy.sadb_x_policy_dir = IPSEC_DIR_INBOUND; policy.sadb_x_policy_dir = IPSEC_DIR_OUTBOUND;
policy.sadb_x_policy_reserved = 0; policy.sadb_x_policy_reserved = 0;
policy.sadb_x_policy_id = 0; policy.sadb_x_policy_id = 0;
/* TODO: use IPPROTO_IPV6/IPV6_IPSEC_POLICY for IPv6 sockets */
/* ipv6 if (setsockopt(fd, IPPROTO_IP, IP_IPSEC_POLICY, &policy, sizeof(policy)) < 0)
* level = IPPROTO_IPV6;
* opt = IPV6_IPSEC_POLICY;
*/
level = IPPROTO_IP;
opt = IP_IPSEC_POLICY;
if (setsockopt(fd, level, opt, &policy, sizeof(policy)) < 0)
{
this->logger->log(this->logger, ERROR, "unable to set IPSEC_POLICY on send socket!");
close(fd);
return FAILED;
}
policy.sadb_x_policy_dir = IPSEC_DIR_OUTBOUND;
if (setsockopt(fd, level, opt, &policy, sizeof(policy)) < 0)
{ {
this->logger->log(this->logger, ERROR, "unable to set IPSEC_POLICY on send socket!"); this->logger->log(this->logger, ERROR, "unable to set IPSEC_POLICY on send socket!");
close(fd); close(fd);
@@ -318,6 +304,8 @@ static status_t setup_send_socket(private_socket_t *this, u_int16_t port, int *s
*/ */
static status_t initialize(private_socket_t *this) static status_t initialize(private_socket_t *this)
{ {
struct sadb_x_policy policy;
/* This filter code filters out all non-IKEv2 traffic on /* This filter code filters out all non-IKEv2 traffic on
* a SOCK_RAW IP_PROTP_UDP socket. Handling of other * a SOCK_RAW IP_PROTP_UDP socket. Handling of other
* IKE versions is done in pluto. * IKE versions is done in pluto.
@@ -375,6 +363,21 @@ static status_t initialize(private_socket_t *this)
return FAILED; return FAILED;
} }
/* bypass incomining IKE traffic on this socket */
policy.sadb_x_policy_len = sizeof(policy) / sizeof(u_int64_t);
policy.sadb_x_policy_exttype = SADB_X_EXT_POLICY;
policy.sadb_x_policy_type = IPSEC_POLICY_BYPASS;
policy.sadb_x_policy_dir = IPSEC_DIR_INBOUND;
policy.sadb_x_policy_reserved = 0;
policy.sadb_x_policy_id = 0;
/* TODO: use IPPROTO_IPV6/IPV6_IPSEC_POLICY for IPv6 sockets */
if (setsockopt(this->raw_fd, IPPROTO_IP, IP_IPSEC_POLICY, &policy, sizeof(policy)) < 0)
{
this->logger->log(this->logger, ERROR, "unable to set IPSEC_POLICY on raw socket!");
close(this->raw_fd);
return FAILED;
}
/* setup the send sockets */ /* setup the send sockets */
if (this->setup_send_socket(this, this->port, &this->send_fd) != SUCCESS) if (this->setup_send_socket(this, this->port, &this->send_fd) != SUCCESS)
{ {