denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

merging kernel_klips plugin back into trunk

Browse Source
This commit is contained in:
Tobias Brunner
2008-11-11 09:22:00 +00:00
parent c117f24e61
commit ea625fabf9
30 changed files with 3774 additions and 262 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/charon/kernel/kernel_interface.c
+20 -19
View File
@@ -87,31 +87,32 @@ static status_t add_sa(private_kernel_interface_t *this, host_t *src, host_t *ds
u_int64_t expire_soft, u_int64_t expire_hard,
u_int16_t enc_alg, chunk_t enc_key,
u_int16_t int_alg, chunk_t int_key,
ipsec_mode_t mode, u_int16_t ipcomp, bool encap, bool update)
ipsec_mode_t mode, u_int16_t ipcomp, u_int16_t cpi, bool encap,
bool inbound)
{
return this->ipsec->add_sa(this->ipsec, src, dst, spi, protocol, reqid,
expire_soft, expire_hard, enc_alg, enc_key, int_alg, int_key,
mode, ipcomp, encap, update);
mode, ipcomp, cpi, encap, inbound);
}
/**
* Implementation of kernel_interface_t.update_sa
*/
static status_t update_sa(private_kernel_interface_t *this, u_int32_t spi,
protocol_id_t protocol, host_t *src, host_t *dst,
host_t *new_src, host_t *new_dst, bool encap)
protocol_id_t protocol, u_int16_t cpi, host_t *src, host_t *dst,
host_t *new_src, host_t *new_dst, bool encap, bool new_encap)
{
return this->ipsec->update_sa(this->ipsec, spi, protocol, src, dst, new_src,
new_dst, encap);
return this->ipsec->update_sa(this->ipsec, spi, protocol, cpi, src, dst,
new_src, new_dst, encap, new_encap);
}
/**
* Implementation of kernel_interface_t.del_sa
*/
static status_t del_sa(private_kernel_interface_t *this, host_t *dst, u_int32_t spi,
protocol_id_t protocol)
protocol_id_t protocol, u_int16_t cpi)
{
return this->ipsec->del_sa(this->ipsec, dst, spi, protocol);
return this->ipsec->del_sa(this->ipsec, dst, spi, protocol, cpi);
}
/**
@@ -119,12 +120,12 @@ static status_t del_sa(private_kernel_interface_t *this, host_t *dst, u_int32_t
*/
static status_t add_policy(private_kernel_interface_t *this, host_t *src, host_t *dst,
traffic_selector_t *src_ts, traffic_selector_t *dst_ts,
policy_dir_t direction, protocol_id_t protocol,
u_int32_t reqid, bool high_prio, ipsec_mode_t mode,
u_int16_t ipcomp)
policy_dir_t direction, u_int32_t spi, protocol_id_t protocol,
u_int32_t reqid, ipsec_mode_t mode, u_int16_t ipcomp, u_int16_t cpi,
bool routed)
{
return this->ipsec->add_policy(this->ipsec, src, dst, src_ts, dst_ts,
direction, protocol, reqid, high_prio, mode, ipcomp);
direction, spi, protocol, reqid, mode, ipcomp, cpi, routed);
}
/**
@@ -142,9 +143,9 @@ static status_t query_policy(private_kernel_interface_t *this,
*/
static status_t del_policy(private_kernel_interface_t *this,
traffic_selector_t *src_ts, traffic_selector_t *dst_ts,
policy_dir_t direction)
policy_dir_t direction, bool unrouted)
{
return this->ipsec->del_policy(this->ipsec, src_ts, dst_ts, direction);
return this->ipsec->del_policy(this->ipsec, src_ts, dst_ts, direction, unrouted);
}
/**
@@ -370,12 +371,12 @@ kernel_interface_t *kernel_interface_create()
this->public.get_spi = (status_t(*)(kernel_interface_t*,host_t*,host_t*,protocol_id_t,u_int32_t,u_int32_t*))get_spi;
this->public.get_cpi = (status_t(*)(kernel_interface_t*,host_t*,host_t*,u_int32_t,u_int16_t*))get_cpi;
this->public.add_sa = (status_t(*)(kernel_interface_t *,host_t*,host_t*,u_int32_t,protocol_id_t,u_int32_t,u_int64_t,u_int64_t,u_int16_t,chunk_t,u_int16_t,chunk_t,ipsec_mode_t,u_int16_t,bool,bool))add_sa;
this->public.update_sa = (status_t(*)(kernel_interface_t*,u_int32_t,protocol_id_t,host_t*,host_t*,host_t*,host_t*,bool))update_sa;
this->public.del_sa = (status_t(*)(kernel_interface_t*,host_t*,u_int32_t,protocol_id_t))del_sa;
this->public.add_policy = (status_t(*)(kernel_interface_t*,host_t*,host_t*,traffic_selector_t*,traffic_selector_t*,policy_dir_t,protocol_id_t,u_int32_t,bool,ipsec_mode_t,u_int16_t))add_policy;
this->public.add_sa = (status_t(*)(kernel_interface_t *,host_t*,host_t*,u_int32_t,protocol_id_t,u_int32_t,u_int64_t,u_int64_t,u_int16_t,chunk_t,u_int16_t,chunk_t,ipsec_mode_t,u_int16_t,u_int16_t,bool,bool))add_sa;
this->public.update_sa = (status_t(*)(kernel_interface_t*,u_int32_t,protocol_id_t,u_int16_t,host_t*,host_t*,host_t*,host_t*,bool,bool))update_sa;
this->public.del_sa = (status_t(*)(kernel_interface_t*,host_t*,u_int32_t,protocol_id_t,u_int16_t))del_sa;
this->public.add_policy = (status_t(*)(kernel_interface_t*,host_t*,host_t*,traffic_selector_t*,traffic_selector_t*,policy_dir_t,u_int32_t,protocol_id_t,u_int32_t,ipsec_mode_t,u_int16_t,u_int16_t,bool))add_policy;
this->public.query_policy = (status_t(*)(kernel_interface_t*,traffic_selector_t*,traffic_selector_t*,policy_dir_t,u_int32_t*))query_policy;
this->public.del_policy = (status_t(*)(kernel_interface_t*,traffic_selector_t*,traffic_selector_t*,policy_dir_t))del_policy;
this->public.del_policy = (status_t(*)(kernel_interface_t*,traffic_selector_t*,traffic_selector_t*,policy_dir_t,bool))del_policy;
this->public.get_source_addr = (host_t*(*)(kernel_interface_t*, host_t *dest, host_t *src))get_source_addr;
this->public.get_nexthop = (host_t*(*)(kernel_interface_t*, host_t *dest))get_nexthop;
src/charon/kernel/kernel_interface.h
+24 -17
View File
@@ -56,10 +56,6 @@ struct kernel_interface_t {
/**
* Get a SPI from the kernel.
*
* @warning get_spi() implicitly creates an SA with
* the allocated SPI, therefore the replace flag
* in add_sa() must be set when installing this SA.
*
* @param src source address of SA
* @param dst destination address of SA
* @param protocol protocol for SA (ESP/AH)
@@ -106,8 +102,9 @@ struct kernel_interface_t {
* @param int_key key to use for integrity protection
* @param mode mode of the SA (tunnel, transport)
* @param ipcomp IPComp transform to use
* @param cpi CPI for IPComp
* @param encap enable UDP encapsulation for NAT traversal
* @param replace Should an already installed SA be updated?
* @param inbound TRUE if this is an inbound SA
* @return SUCCESS if operation completed
*/
status_t (*add_sa) (kernel_interface_t *this,
@@ -116,8 +113,8 @@ struct kernel_interface_t {
u_int64_t expire_soft, u_int64_t expire_hard,
u_int16_t enc_alg, chunk_t enc_key,
u_int16_t int_alg, chunk_t int_key,
ipsec_mode_t mode, u_int16_t ipcomp, bool encap,
bool update);
ipsec_mode_t mode, u_int16_t ipcomp, u_int16_t cpi,
bool encap, bool inbound);
/**
* Update the hosts on an installed SA.
@@ -129,17 +126,21 @@ struct kernel_interface_t {
*
* @param spi SPI of the SA
* @param protocol protocol for this SA (ESP/AH)
* @param cpi CPI for IPComp, 0 if no IPComp is used
* @param src current source address
* @param dst current destination address
* @param new_src new source address
* @param new_dst new destination address
* @param encap use UDP encapsulation
* @return SUCCESS if operation completed
* @param encap current use of UDP encapsulation
* @param new_encap new use of UDP encapsulation
* @return SUCCESS if operation completed, NOT_SUPPORTED if
* the kernel interface can't update the SA
*/
status_t (*update_sa)(kernel_interface_t *this,
u_int32_t spi, protocol_id_t protocol,
u_int32_t spi, protocol_id_t protocol, u_int16_t cpi,
host_t *src, host_t *dst,
host_t *new_src, host_t *new_dst, bool encap);
host_t *new_src, host_t *new_dst,
bool encap, bool new_encap);
/**
* Delete a previously installed SA from the SAD.
@@ -147,10 +148,11 @@ struct kernel_interface_t {
* @param dst destination address for this SA
* @param spi SPI allocated by us or remote peer
* @param protocol protocol for this SA (ESP/AH)
* @param cpi CPI for IPComp or 0
* @return SUCCESS if operation completed
*/
status_t (*del_sa) (kernel_interface_t *this, host_t *dst, u_int32_t spi,
protocol_id_t protocol);
protocol_id_t protocol, u_int16_t cpi);
/**
* Add a policy to the SPD.
@@ -163,20 +165,23 @@ struct kernel_interface_t {
* @param src_ts traffic selector to match traffic source
* @param dst_ts traffic selector to match traffic dest
* @param direction direction of traffic, POLICY_IN, POLICY_OUT, POLICY_FWD
* @param spi SPI of SA
* @param protocol protocol to use to protect traffic (AH/ESP)
* @param reqid unique ID of an SA to use to enforce policy
* @param high_prio if TRUE, uses a higher priority than any with FALSE
* @param mode mode of SA (tunnel, transport)
* @param ipcomp the IPComp transform used
* @param cpi CPI for IPComp
* @param routed TRUE, if this policy is routed in the kernel
* @return SUCCESS if operation completed
*/
status_t (*add_policy) (kernel_interface_t *this,
host_t *src, host_t *dst,
traffic_selector_t *src_ts,
traffic_selector_t *dst_ts,
policy_dir_t direction, protocol_id_t protocol,
u_int32_t reqid, bool high_prio, ipsec_mode_t mode,
u_int16_t ipcomp);
policy_dir_t direction, u_int32_t spi,
protocol_id_t protocol, u_int32_t reqid,
ipsec_mode_t mode, u_int16_t ipcomp, u_int16_t cpi,
bool routed);
/**
* Query the use time of a policy.
@@ -206,12 +211,14 @@ struct kernel_interface_t {
* @param src_ts traffic selector to match traffic source
* @param dst_ts traffic selector to match traffic dest
* @param direction direction of traffic, POLICY_IN, POLICY_OUT, POLICY_FWD
* @param unrouted TRUE, if this policy is unrouted from the kernel
* @return SUCCESS if operation completed
*/
status_t (*del_policy) (kernel_interface_t *this,
traffic_selector_t *src_ts,
traffic_selector_t *dst_ts,
policy_dir_t direction);
policy_dir_t direction,
bool unrouted);
/**
* Get our outgoing source address for a destination.
src/charon/kernel/kernel_ipsec.h
+24 -17
View File
@@ -88,10 +88,6 @@ struct kernel_ipsec_t {
/**
* Get a SPI from the kernel.
*
* @warning get_spi() implicitly creates an SA with
* the allocated SPI, therefore the replace flag
* in add_sa() must be set when installing this SA.
*
* @param src source address of SA
* @param dst destination address of SA
* @param protocol protocol for SA (ESP/AH)
@@ -138,8 +134,9 @@ struct kernel_ipsec_t {
* @param int_key key to use for integrity protection
* @param mode mode of the SA (tunnel, transport)
* @param ipcomp IPComp transform to use
* @param cpi CPI for IPComp
* @param encap enable UDP encapsulation for NAT traversal
* @param replace Should an already installed SA be updated?
* @param inbound TRUE if this is an inbound SA
* @return SUCCESS if operation completed
*/
status_t (*add_sa) (kernel_ipsec_t *this,
@@ -148,8 +145,8 @@ struct kernel_ipsec_t {
u_int64_t expire_soft, u_int64_t expire_hard,
u_int16_t enc_alg, chunk_t enc_key,
u_int16_t int_alg, chunk_t int_key,
ipsec_mode_t mode, u_int16_t ipcomp, bool encap,
bool update);
ipsec_mode_t mode, u_int16_t ipcomp, u_int16_t cpi,
bool encap, bool inbound);
/**
* Update the hosts on an installed SA.
@@ -161,17 +158,21 @@ struct kernel_ipsec_t {
*
* @param spi SPI of the SA
* @param protocol protocol for this SA (ESP/AH)
* @param cpi CPI for IPComp, 0 if no IPComp is used
* @param src current source address
* @param dst current destination address
* @param new_src new source address
* @param new_dst new destination address
* @param encap use UDP encapsulation
* @return SUCCESS if operation completed
* @param encap current use of UDP encapsulation
* @param new_encap new use of UDP encapsulation
* @return SUCCESS if operation completed, NOT_SUPPORTED if
* the kernel interface can't update the SA
*/
status_t (*update_sa)(kernel_ipsec_t *this,
u_int32_t spi, protocol_id_t protocol,
u_int32_t spi, protocol_id_t protocol, u_int16_t cpi,
host_t *src, host_t *dst,
host_t *new_src, host_t *new_dst, bool encap);
host_t *new_src, host_t *new_dst,
bool encap, bool new_encap);
/**
* Delete a previusly installed SA from the SAD.
@@ -179,10 +180,11 @@ struct kernel_ipsec_t {
* @param dst destination address for this SA
* @param spi SPI allocated by us or remote peer
* @param protocol protocol for this SA (ESP/AH)
* @param cpi CPI for IPComp or 0
* @return SUCCESS if operation completed
*/
status_t (*del_sa) (kernel_ipsec_t *this, host_t *dst, u_int32_t spi,
protocol_id_t protocol);
protocol_id_t protocol, u_int16_t cpi);
/**
* Add a policy to the SPD.
@@ -195,20 +197,23 @@ struct kernel_ipsec_t {
* @param src_ts traffic selector to match traffic source
* @param dst_ts traffic selector to match traffic dest
* @param direction direction of traffic, POLICY_IN, POLICY_OUT, POLICY_FWD
* @param spi SPI of SA
* @param protocol protocol to use to protect traffic (AH/ESP)
* @param reqid unique ID of an SA to use to enforce policy
* @param high_prio if TRUE, uses a higher priority than any with FALSE
* @param mode mode of SA (tunnel, transport)
* @param ipcomp the IPComp transform used
* @param cpi CPI for IPComp
* @param routed TRUE, if this policy is routed in the kernel
* @return SUCCESS if operation completed
*/
status_t (*add_policy) (kernel_ipsec_t *this,
host_t *src, host_t *dst,
traffic_selector_t *src_ts,
traffic_selector_t *dst_ts,
policy_dir_t direction, protocol_id_t protocol,
u_int32_t reqid, bool high_prio, ipsec_mode_t mode,
u_int16_t ipcomp);
policy_dir_t direction, u_int32_t spi,
protocol_id_t protocol, u_int32_t reqid,
ipsec_mode_t mode, u_int16_t ipcomp, u_int16_t cpi,
bool routed);
/**
* Query the use time of a policy.
@@ -238,12 +243,14 @@ struct kernel_ipsec_t {
* @param src_ts traffic selector to match traffic source
* @param dst_ts traffic selector to match traffic dest
* @param direction direction of traffic, POLICY_IN, POLICY_OUT, POLICY_FWD
* @param unrouted TRUE, if this policy is unrouted from the kernel
* @return SUCCESS if operation completed
*/
status_t (*del_policy) (kernel_ipsec_t *this,
traffic_selector_t *src_ts,
traffic_selector_t *dst_ts,
policy_dir_t direction);
policy_dir_t direction,
bool unrouted);
/**
* Destroy the implementation.