3 files changed, 85 insertions, 0 deletions

diff --git a/src/libcharon/bus/bus.c b/src/libcharon/bus/bus.c
index 6a9fcce02..97d09c40a 100644
--- a/src/libcharon/bus/bus.c
+++ b/src/libcharon/bus/bus.c
@@ -640,6 +640,38 @@ METHOD(bus_t, authorize, bool,
 	return success;
 }
 
+METHOD(bus_t, narrow, void,
+	private_bus_t *this, child_sa_t *child_sa, narrow_hook_t type,
+	linked_list_t *local, linked_list_t *remote)
+{
+	enumerator_t *enumerator;
+	ike_sa_t *ike_sa;
+	entry_t *entry;
+	bool keep;
+
+	ike_sa = this->thread_sa->get(this->thread_sa);
+
+	this->mutex->lock(this->mutex);
+	enumerator = this->listeners->create_enumerator(this->listeners);
+	while (enumerator->enumerate(enumerator, &entry))
+	{
+		if (entry->calling || !entry->listener->narrow)
+		{
+			continue;
+		}
+		entry->calling++;
+		keep = entry->listener->narrow(entry->listener, ike_sa, child_sa,
+									   type, local, remote);
+		entry->calling--;
+		if (!keep)
+		{
+			unregister_listener(this, entry, enumerator);
+		}
+	}
+	enumerator->destroy(enumerator);
+	this->mutex->unlock(this->mutex);
+}
+
 METHOD(bus_t, destroy, void,
 	private_bus_t *this)
 {
@@ -676,6 +708,7 @@ bus_t *bus_create()
 			.child_updown = _child_updown,
 			.child_rekey = _child_rekey,
 			.authorize = _authorize,
+			.narrow = _narrow,
 			.destroy = _destroy,
 		},
 		.listeners = linked_list_create(),
diff --git a/src/libcharon/bus/bus.h b/src/libcharon/bus/bus.h
index 8cf392eae..df555d83e 100644
--- a/src/libcharon/bus/bus.h
+++ b/src/libcharon/bus/bus.h
@@ -22,6 +22,7 @@
 #define BUS_H_
 
 typedef enum alert_t alert_t;
+typedef enum narrow_hook_t narrow_hook_t;
 typedef struct bus_t bus_t;
 
 #include <stdarg.h>
@@ -86,6 +87,31 @@ enum alert_t {
 };
 
 /**
+ * Kind of narrow hook.
+ *
+ * There is a non-authenticated (IKE_AUTH) and a authenticated
+ * (CREATE_CHILD_SA) narrowing hook for the initiator. Only one of these
+ * hooks is invoked before the exchange.
+ * To verify the traffic selectors negotiated, each PRE hook has a POST
+ * counterpart that follows. POST hooks are invoked with an authenticated peer.
+ * It is usually not a good idea to narrow in the POST hooks,
+ * as the resulting traffic selector is not negotiated and results
+ * in non-matching policies.
+ */
+enum narrow_hook_t {
+	/** invoked as initiator before exchange, peer is not yet authenticated */
+	NARROW_INITIATOR_PRE_NOAUTH,
+	/** invoked as initiator before exchange, peer is authenticated */
+	NARROW_INITIATOR_PRE_AUTH,
+	/** invoked as responder during exchange, peer is authenticated */
+	NARROW_RESPONDER,
+	/** invoked as initiator after exchange, follows a INITIATOR_PRE_NOAUTH */
+	NARROW_INITIATOR_POST_NOAUTH,
+	/** invoked as initiator after exchange, follows a INITIATOR_PRE_AUTH */
+	NARROW_INITIATOR_POST_AUTH,
+};
+
+/**
  * The bus receives events and sends them to all registered listeners.
  *
  * Any events sent to are delivered to all registered listeners. Threads
@@ -217,6 +243,17 @@ struct bus_t {
 	bool (*authorize)(bus_t *this, bool final);
 
 	/**
+	 * CHILD_SA traffic selector narrowing hook.
+	 *
+	 * @param child_sa	CHILD_SA set up with these traffic selectors
+	 * @param type		type of hook getting invoked
+	 * @param local		list of local traffic selectors to narrow
+	 * @param remote	list of remote traffic selectors to narrow
+	 */
+	void (*narrow)(bus_t *this, child_sa_t *child_sa, narrow_hook_t type,
+				   linked_list_t *local, linked_list_t *remote);
+
+	/**
 	 * IKE_SA keymat hook.
 	 *
 	 * @param ike_sa	IKE_SA this keymat belongs to
diff --git a/src/libcharon/bus/listeners/listener.h b/src/libcharon/bus/listeners/listener.h
index 9a51a2ef4..45c61c0c0 100644
--- a/src/libcharon/bus/listeners/listener.h
+++ b/src/libcharon/bus/listeners/listener.h
@@ -173,6 +173,21 @@ struct listener_t {
 	 */
 	bool (*authorize)(listener_t *this, ike_sa_t *ike_sa,
 					  bool final, bool *success);
+
+	/**
+	 * CHILD_SA traffic selector narrowing hook.
+	 *
+	 * This hook is invoked for each CHILD_SA and allows plugins to modify
+	 * the traffic selector list negotiated for this CHILD_SA.
+	 *
+	 * @param ike_sa	IKE_SA the created CHILD_SA is created in
+	 * @param child_sa	CHILD_SA set up with these traffic selectors
+	 * @param type		type of hook getting invoked
+	 * @param local		list of local traffic selectors to narrow
+	 * @param remote	list of remote traffic selectors to narrow
+	 */
+	bool (*narrow)(listener_t *this, ike_sa_t *ike_sa, child_sa_t *child_sa,
+				narrow_hook_t type, linked_list_t *local, linked_list_t *remote);
 };
 
 #endif /** LISTENER_H_ @}*/