denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Include the destination net in the policy priority calculation.

Browse Source 
The resulting priorities are as follows:

    IPv6               IPv4
    routed   normal    routed   normal
max 4096(+3) 2048(+3)  4096(+3) 2048(+3)
min 3072     1024      3840     1792

Where min is for a policy between two single hosts and max is
for /0 on both ends (lower priorities are preferred by the kernel).
(+3) applies for cases where no protocol and no ports are defined.
This commit is contained in:
Tobias Brunner
2010-12-07 12:14:50 +01:00
parent 4332cd7f95
commit e6f42b0721
2 changed files with 20 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c
+11 -6
View File
@@ -58,8 +58,8 @@
#endif /*IPV6_XFRM_POLICY*/ #endif /*IPV6_XFRM_POLICY*/
/** default priority of installed policies */ /** default priority of installed policies */
#define PRIO_LOW 3000 #define PRIO_LOW 1024
#define PRIO_HIGH 2000 #define PRIO_HIGH 512
/** /**
* map the limit for bytes and packets to XFRM_INF per default * map the limit for bytes and packets to XFRM_INF per default
@@ -1687,11 +1687,16 @@ METHOD(kernel_ipsec_t, add_policy, status_t,
policy_info = (struct xfrm_userpolicy_info*)NLMSG_DATA(hdr); policy_info = (struct xfrm_userpolicy_info*)NLMSG_DATA(hdr);
policy_info->sel = policy->sel; policy_info->sel = policy->sel;
policy_info->dir = policy->direction; policy_info->dir = policy->direction;
/* calculate priority based on source selector size, small size = high prio */
/* calculate priority based on selector size, small size = high prio */
policy_info->priority = routed ? PRIO_LOW : PRIO_HIGH; policy_info->priority = routed ? PRIO_LOW : PRIO_HIGH;
policy_info->priority -= policy->sel.prefixlen_s * 10; policy_info->priority -= policy->sel.prefixlen_s;
policy_info->priority -= policy->sel.proto ? 2 : 0; policy_info->priority -= policy->sel.prefixlen_d;
policy_info->priority -= policy->sel.sport_mask ? 1 : 0; policy_info->priority <<= 2; /* make some room for the two flags */
policy_info->priority += policy->sel.sport_mask ||
policy->sel.dport_mask ? 0 : 2;
policy_info->priority += policy->sel.proto ? 0 : 1;
policy_info->action = type != POLICY_DROP ? XFRM_POLICY_ALLOW policy_info->action = type != POLICY_DROP ? XFRM_POLICY_ALLOW
: XFRM_POLICY_BLOCK; : XFRM_POLICY_BLOCK;
policy_info->share = XFRM_SHARE_ANY; policy_info->share = XFRM_SHARE_ANY;
src/libhydra/plugins/kernel_pfkey/kernel_pfkey_ipsec.c
+9 -6
View File
@@ -99,8 +99,8 @@
#endif #endif
/** default priority of installed policies */ /** default priority of installed policies */
#define PRIO_LOW 3000 #define PRIO_LOW 1024
#define PRIO_HIGH 2000 #define PRIO_HIGH 512
#ifdef __APPLE__ #ifdef __APPLE__
/** from xnu/bsd/net/pfkeyv2.h */ /** from xnu/bsd/net/pfkeyv2.h */
@@ -1651,11 +1651,14 @@ METHOD(kernel_ipsec_t, add_policy, status_t,
pol->sadb_x_policy_dir = dir2kernel(direction); pol->sadb_x_policy_dir = dir2kernel(direction);
pol->sadb_x_policy_type = IPSEC_POLICY_IPSEC; pol->sadb_x_policy_type = IPSEC_POLICY_IPSEC;
#ifdef HAVE_STRUCT_SADB_X_POLICY_SADB_X_POLICY_PRIORITY #ifdef HAVE_STRUCT_SADB_X_POLICY_SADB_X_POLICY_PRIORITY
/* calculate priority based on source selector size, small size = high prio */ /* calculate priority based on selector size, small size = high prio */
pol->sadb_x_policy_priority = routed ? PRIO_LOW : PRIO_HIGH; pol->sadb_x_policy_priority = routed ? PRIO_LOW : PRIO_HIGH;
pol->sadb_x_policy_priority -= policy->src.mask * 10; pol->sadb_x_policy_priority -= policy->src.mask;
pol->sadb_x_policy_priority -= policy->src.proto != IPSEC_PROTO_ANY ? 2 : 0; pol->sadb_x_policy_priority -= policy->dst.mask;
pol->sadb_x_policy_priority -= policy->src.net->get_port(policy->src.net) ? 1 : 0; pol->sadb_x_policy_priority <<= 2; /* make some room for the flags */
pol->sadb_x_policy_priority += policy->src.net->get_port(policy->src.net) ||
policy->dst.net->get_port(policy->dst.net) ? 0 : 2;
pol->sadb_x_policy_priority += policy->src.proto != IPSEC_PROTO_ANY ? 0 : 1;
#endif #endif
/* one or more sadb_x_ipsecrequest extensions are added to the sadb_x_policy extension */ /* one or more sadb_x_ipsecrequest extensions are added to the sadb_x_policy extension */