denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add a responder narrow() hook to change TS in the kernel, but not on the wire

Browse Source
This commit is contained in:
Martin Willi
2012-09-11 16:14:39 +02:00
parent cf85ebbfec
commit f942588f95
3 changed files with 48 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/ikev2/tasks/child_create.c
+26 -1
View File
@@ -516,7 +516,32 @@ static status_t select_and_install(private_child_create_t *this,
return FAILED;
}
status = this->child_sa->add_policies(this->child_sa, my_ts, other_ts);
if (this->initiator)
{
status = this->child_sa->add_policies(this->child_sa, my_ts, other_ts);
}
else
{
/* use a copy of the traffic selectors, as the POST hook should not
* change payloads */
my_ts = this->tsr->clone_offset(this->tsr,
offsetof(traffic_selector_t, clone));
other_ts = this->tsi->clone_offset(this->tsi,
offsetof(traffic_selector_t, clone));
charon->bus->narrow(charon->bus, this->child_sa,
NARROW_RESPONDER_POST, my_ts, other_ts);
if (my_ts->get_count(my_ts) == 0 || other_ts->get_count(other_ts) == 0)
{
status = FAILED;
}
else
{
status = this->child_sa->add_policies(this->child_sa,
my_ts, other_ts);
}
my_ts->destroy_offset(my_ts, offsetof(traffic_selector_t, destroy));
other_ts->destroy_offset(other_ts, offsetof(traffic_selector_t, destroy));
}
if (status != SUCCESS)
{
DBG1(DBG_IKE, "unable to install IPsec policies (SPD) in kernel");