denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Remove policies in kernel interfaces based on their priority.

Browse Source 
This allows to unroute a connection while the same connection is
currently established.  In this case both CHILD_SAs share the same
reqid but the installed policies have different priorities.
This commit is contained in:
Tobias Brunner
2011-07-27 13:41:35 +02:00
parent a2e377fcfd
commit fbedc6a45b
10 changed files with 140 additions and 80 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/load_tester/load_tester_ipsec.c
+2 -2
View File
@@ -86,7 +86,7 @@ METHOD(kernel_ipsec_t, add_policy, status_t,
private_load_tester_ipsec_t *this, host_t *src, host_t *dst,
traffic_selector_t *src_ts, traffic_selector_t *dst_ts,
policy_dir_t direction, policy_type_t type, ipsec_sa_cfg_t *sa,
mark_t mark, bool routed)
mark_t mark, policy_priority_t priority)
{
return SUCCESS;
}
@@ -103,7 +103,7 @@ METHOD(kernel_ipsec_t, query_policy, status_t,
METHOD(kernel_ipsec_t, del_policy, status_t,
private_load_tester_ipsec_t *this, traffic_selector_t *src_ts,
traffic_selector_t *dst_ts, policy_dir_t direction, u_int32_t reqid,
mark_t mark, bool unrouted)
mark_t mark, policy_priority_t priority)
{
return SUCCESS;
}
src/libcharon/sa/child_sa.c
+21 -15
View File
@@ -1,5 +1,5 @@
/*
* Copyright (C) 2006-2010 Tobias Brunner
* Copyright (C) 2006-2011 Tobias Brunner
* Copyright (C) 2005-2008 Martin Willi
* Copyright (C) 2006 Daniel Roethlisberger
* Copyright (C) 2005 Jan Hutter
@@ -664,7 +664,6 @@ METHOD(child_sa_t, add_policies, status_t,
enumerator_t *enumerator;
traffic_selector_t *my_ts, *other_ts;
status_t status = SUCCESS;
bool routed = (this->state == CHILD_CREATED);
/* apply traffic selectors */
enumerator = my_ts_list->create_enumerator(my_ts_list);
@@ -682,6 +681,7 @@ METHOD(child_sa_t, add_policies, status_t,
if (this->config->install_policy(this->config))
{
policy_priority_t priority;
ipsec_sa_cfg_t my_sa = {
.mode = this->mode,
.reqid = this->reqid,
@@ -708,6 +708,9 @@ METHOD(child_sa_t, add_policies, status_t,
other_sa.ah.spi = this->other_spi;
}
priority = this->state == CHILD_CREATED ? POLICY_PRIORITY_ROUTED
: POLICY_PRIORITY_DEFAULT;
/* enumerate pairs of traffic selectors */
enumerator = create_policy_enumerator(this);
while (enumerator->enumerate(enumerator, &my_ts, &other_ts))
@@ -717,20 +720,20 @@ METHOD(child_sa_t, add_policies, status_t,
hydra->kernel_interface,
this->my_addr, this->other_addr, my_ts, other_ts,
POLICY_OUT, POLICY_IPSEC, &other_sa,
this->mark_out, routed);
this->mark_out, priority);
status |= hydra->kernel_interface->add_policy(
hydra->kernel_interface,
this->other_addr, this->my_addr, other_ts, my_ts,
POLICY_IN, POLICY_IPSEC, &my_sa,
this->mark_in, routed);
this->mark_in, priority);
if (this->mode != MODE_TRANSPORT)
{
status |= hydra->kernel_interface->add_policy(
hydra->kernel_interface,
this->other_addr, this->my_addr, other_ts, my_ts,
POLICY_FWD, POLICY_IPSEC, &my_sa,
this->mark_in, routed);
this->mark_in, priority);
}
if (status != SUCCESS)
@@ -838,15 +841,15 @@ METHOD(child_sa_t, update, status_t,
/* remove old policies first */
hydra->kernel_interface->del_policy(hydra->kernel_interface,
my_ts, other_ts, POLICY_OUT, this->reqid,
this->mark_out, FALSE);
this->mark_out, POLICY_PRIORITY_DEFAULT);
hydra->kernel_interface->del_policy(hydra->kernel_interface,
other_ts, my_ts, POLICY_IN, this->reqid,
this->mark_in, FALSE);
this->mark_in, POLICY_PRIORITY_DEFAULT);
if (this->mode != MODE_TRANSPORT)
{
hydra->kernel_interface->del_policy(hydra->kernel_interface,
other_ts, my_ts, POLICY_FWD, this->reqid,
this->mark_in, FALSE);
this->mark_in, POLICY_PRIORITY_DEFAULT);
}
/* check whether we have to update a "dynamic" traffic selector */
@@ -872,15 +875,15 @@ METHOD(child_sa_t, update, status_t,
/* reinstall updated policies */
hydra->kernel_interface->add_policy(hydra->kernel_interface,
me, other, my_ts, other_ts, POLICY_OUT, POLICY_IPSEC,
&other_sa, this->mark_out, FALSE);
&other_sa, this->mark_out, POLICY_PRIORITY_DEFAULT);
hydra->kernel_interface->add_policy(hydra->kernel_interface,
other, me, other_ts, my_ts, POLICY_IN, POLICY_IPSEC,
&my_sa, this->mark_in, FALSE);
&my_sa, this->mark_in, POLICY_PRIORITY_DEFAULT);
if (this->mode != MODE_TRANSPORT)
{
hydra->kernel_interface->add_policy(hydra->kernel_interface,
other, me, other_ts, my_ts, POLICY_FWD, POLICY_IPSEC,
&my_sa, this->mark_in, FALSE);
&my_sa, this->mark_in, POLICY_PRIORITY_DEFAULT);
}
}
enumerator->destroy(enumerator);
@@ -913,7 +916,10 @@ METHOD(child_sa_t, destroy, void,
{
enumerator_t *enumerator;
traffic_selector_t *my_ts, *other_ts;
bool unrouted = (this->state == CHILD_ROUTED);
policy_priority_t priority;
priority = this->state == CHILD_ROUTED ? POLICY_PRIORITY_ROUTED
: POLICY_PRIORITY_DEFAULT;
set_state(this, CHILD_DESTROYING);
@@ -947,15 +953,15 @@ METHOD(child_sa_t, destroy, void,
{
hydra->kernel_interface->del_policy(hydra->kernel_interface,
my_ts, other_ts, POLICY_OUT, this->reqid,
this->mark_out, unrouted);
this->mark_out, priority);
hydra->kernel_interface->del_policy(hydra->kernel_interface,
other_ts, my_ts, POLICY_IN, this->reqid,
this->mark_in, unrouted);
this->mark_in, priority);
if (this->mode != MODE_TRANSPORT)
{
hydra->kernel_interface->del_policy(hydra->kernel_interface,
other_ts, my_ts, POLICY_FWD, this->reqid,
this->mark_in, unrouted);
this->mark_in, priority);
}
}
enumerator->destroy(enumerator);
src/libcharon/sa/shunt_manager.c
+9 -6
View File
@@ -69,19 +69,22 @@ static bool install_shunt_policy(child_cfg_t *child)
status |= hydra->kernel_interface->add_policy(
hydra->kernel_interface, host_any, host_any,
my_ts, other_ts, POLICY_OUT, policy_type,
&sa, child->get_mark(child, FALSE), FALSE);
&sa, child->get_mark(child, FALSE),
POLICY_PRIORITY_DEFAULT);
/* install in policy */
status |= hydra->kernel_interface->add_policy(
hydra->kernel_interface, host_any, host_any,
other_ts, my_ts, POLICY_IN, policy_type,
&sa, child->get_mark(child, TRUE), FALSE);
&sa, child->get_mark(child, TRUE),
POLICY_PRIORITY_DEFAULT);
/* install forward policy */
status |= hydra->kernel_interface->add_policy(
hydra->kernel_interface, host_any, host_any,
other_ts, my_ts, POLICY_FWD, policy_type,
&sa, child->get_mark(child, TRUE), FALSE);
&sa, child->get_mark(child, TRUE),
POLICY_PRIORITY_DEFAULT);
}
e_other_ts->destroy(e_other_ts);
}
@@ -150,19 +153,19 @@ static void uninstall_shunt_policy(child_cfg_t *child)
status |= hydra->kernel_interface->del_policy(
hydra->kernel_interface, my_ts, other_ts,
POLICY_OUT, 0, child->get_mark(child, FALSE),
FALSE);
POLICY_PRIORITY_DEFAULT);
/* uninstall in policy */
status |= hydra->kernel_interface->del_policy(
hydra->kernel_interface, other_ts, my_ts,
POLICY_IN, 0, child->get_mark(child, TRUE),
FALSE);
POLICY_PRIORITY_DEFAULT);
/* uninstall forward policy */
status |= hydra->kernel_interface->del_policy(
hydra->kernel_interface, other_ts, my_ts,
POLICY_FWD, 0, child->get_mark(child, TRUE),
FALSE);
POLICY_PRIORITY_DEFAULT);
}
e_other_ts->destroy(e_other_ts);
}