diff options
Diffstat (limited to 'src/libhydra/plugins')
3 files changed, 25 insertions, 25 deletions
diff --git a/src/libhydra/plugins/kernel_klips/kernel_klips_ipsec.c b/src/libhydra/plugins/kernel_klips/kernel_klips_ipsec.c index 042d98936..0df5f8baf 100644 --- a/src/libhydra/plugins/kernel_klips/kernel_klips_ipsec.c +++ b/src/libhydra/plugins/kernel_klips/kernel_klips_ipsec.c @@ -1969,13 +1969,13 @@ METHOD(kernel_ipsec_t, del_sa, status_t, METHOD(kernel_ipsec_t, add_policy, status_t, private_kernel_klips_ipsec_t *this, host_t *src, host_t *dst, traffic_selector_t *src_ts, traffic_selector_t *dst_ts, - policy_dir_t direction, policy_type_t type, u_int32_t spi, u_int32_t ah_spi, - u_int32_t reqid, mark_t mark, ipsec_mode_t mode, u_int16_t ipcomp, - u_int16_t cpi, bool routed) + policy_dir_t direction, policy_type_t type, ipsec_sa_cfg_t *sa, + mark_t mark, bool routed) { unsigned char request[PFKEY_BUFFER_SIZE]; struct sadb_msg *msg, *out; policy_entry_t *policy, *found = NULL; + u_int32_t spi; u_int8_t satype; size_t len; @@ -1986,8 +1986,10 @@ METHOD(kernel_ipsec_t, add_policy, status_t, } /* tunnel mode policies direct the packets into the pseudo IPIP SA */ - satype = (mode == MODE_TUNNEL) ? SADB_X_SATYPE_IPIP : - proto2satype(spi ? IPPROTO_ESP : IPPROTO_AH); + satype = (sa->mode == MODE_TUNNEL) ? SADB_X_SATYPE_IPIP + : proto2satype(sa->esp.use ? IPPROTO_ESP + : IPPROTO_AH); + spi = sa->esp.use ? sa->esp.spi : sa->ah.spi; /* create a policy */ policy = create_policy_entry(src_ts, dst_ts, direction); @@ -2019,7 +2021,7 @@ METHOD(kernel_ipsec_t, add_policy, status_t, /* the reqid is always set to the latest child SA that trapped this * policy. we will need this reqid upon receiving an acquire. */ - policy->reqid = reqid; + policy->reqid = sa->reqid; /* increase the trap counter */ policy->trapcount++; @@ -2097,7 +2099,7 @@ METHOD(kernel_ipsec_t, add_policy, status_t, route_entry_t *route = malloc_thing(route_entry_t); route->src_ip = NULL; - if (mode != MODE_TRANSPORT && src->get_family(src) != AF_INET6 && + if (sa->mode != MODE_TRANSPORT && src->get_family(src) != AF_INET6 && this->install_routes) { hydra->kernel_interface->get_address_by_ts(hydra->kernel_interface, diff --git a/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c b/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c index 06c4125a4..55158af48 100644 --- a/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c +++ b/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c @@ -1617,9 +1617,8 @@ METHOD(kernel_ipsec_t, update_sa, status_t, METHOD(kernel_ipsec_t, add_policy, status_t, private_kernel_netlink_ipsec_t *this, host_t *src, host_t *dst, traffic_selector_t *src_ts, traffic_selector_t *dst_ts, - policy_dir_t direction, policy_type_t type, u_int32_t spi, u_int32_t ah_spi, - u_int32_t reqid, mark_t mark, ipsec_mode_t mode, u_int16_t ipcomp, - u_int16_t cpi, bool routed) + policy_dir_t direction, policy_type_t type, ipsec_sa_cfg_t *sa, + mark_t mark, bool routed) { policy_entry_t *current, *policy; bool found = FALSE; @@ -1715,11 +1714,11 @@ METHOD(kernel_ipsec_t, add_policy, status_t, u_int8_t proto; bool use; } protos[] = { - { IPPROTO_COMP, ipcomp != IPCOMP_NONE }, - { IPPROTO_ESP, spi != 0 }, - { IPPROTO_AH, ah_spi != 0 }, + { IPPROTO_COMP, sa->ipcomp.transform != IPCOMP_NONE }, + { IPPROTO_ESP, sa->esp.use }, + { IPPROTO_AH, sa->ah.use }, }; - ipsec_mode_t proto_mode = mode; + ipsec_mode_t proto_mode = sa->mode; rthdr->rta_type = XFRMA_TMPL; rthdr->rta_len = 0; /* actual length is set below */ @@ -1738,7 +1737,7 @@ METHOD(kernel_ipsec_t, add_policy, status_t, return FAILED; } - tmpl->reqid = reqid; + tmpl->reqid = sa->reqid; tmpl->id.proto = protos[i].proto; tmpl->aalgos = tmpl->ealgos = tmpl->calgos = ~0; tmpl->mode = mode2kernel(proto_mode); @@ -1793,7 +1792,7 @@ METHOD(kernel_ipsec_t, add_policy, status_t, * - routing is not disabled via strongswan.conf */ if (policy->route == NULL && direction == POLICY_FWD && - mode != MODE_TRANSPORT && this->install_routes) + sa->mode != MODE_TRANSPORT && this->install_routes) { route_entry_t *route = malloc_thing(route_entry_t); diff --git a/src/libhydra/plugins/kernel_pfkey/kernel_pfkey_ipsec.c b/src/libhydra/plugins/kernel_pfkey/kernel_pfkey_ipsec.c index 20d1b1205..1b18f6a9c 100644 --- a/src/libhydra/plugins/kernel_pfkey/kernel_pfkey_ipsec.c +++ b/src/libhydra/plugins/kernel_pfkey/kernel_pfkey_ipsec.c @@ -1593,9 +1593,8 @@ METHOD(kernel_ipsec_t, del_sa, status_t, METHOD(kernel_ipsec_t, add_policy, status_t, private_kernel_pfkey_ipsec_t *this, host_t *src, host_t *dst, traffic_selector_t *src_ts, traffic_selector_t *dst_ts, - policy_dir_t direction, policy_type_t type, u_int32_t spi, u_int32_t ah_spi, - u_int32_t reqid, mark_t mark, ipsec_mode_t mode, u_int16_t ipcomp, - u_int16_t cpi, bool routed) + policy_dir_t direction, policy_type_t type, ipsec_sa_cfg_t *sa, + mark_t mark, bool routed) { unsigned char request[PFKEY_BUFFER_SIZE]; struct sadb_msg *msg, *out; @@ -1612,7 +1611,7 @@ METHOD(kernel_ipsec_t, add_policy, status_t, } /* create a policy */ - policy = create_policy_entry(src_ts, dst_ts, direction, reqid); + policy = create_policy_entry(src_ts, dst_ts, direction, sa->reqid); /* find a matching policy */ this->mutex->lock(this->mutex); @@ -1661,13 +1660,13 @@ METHOD(kernel_ipsec_t, add_policy, status_t, /* one or more sadb_x_ipsecrequest extensions are added to the sadb_x_policy extension */ req = (struct sadb_x_ipsecrequest*)(pol + 1); - req->sadb_x_ipsecrequest_proto = spi ? IPPROTO_ESP : IPPROTO_AH; + req->sadb_x_ipsecrequest_proto = sa->esp.use ? IPPROTO_ESP : IPPROTO_AH; /* !!! the length of this struct MUST be in octets instead of 64 bit words */ req->sadb_x_ipsecrequest_len = sizeof(struct sadb_x_ipsecrequest); - req->sadb_x_ipsecrequest_mode = mode2kernel(mode); - req->sadb_x_ipsecrequest_reqid = reqid; + req->sadb_x_ipsecrequest_mode = mode2kernel(sa->mode); + req->sadb_x_ipsecrequest_reqid = sa->reqid; req->sadb_x_ipsecrequest_level = IPSEC_LEVEL_UNIQUE; - if (mode == MODE_TUNNEL) + if (sa->mode == MODE_TUNNEL) { len = hostcpy(req + 1, src); req->sadb_x_ipsecrequest_len += len; @@ -1741,7 +1740,7 @@ METHOD(kernel_ipsec_t, add_policy, status_t, * - routing is not disabled via strongswan.conf */ if (policy->route == NULL && direction == POLICY_FWD && - mode != MODE_TRANSPORT && src->get_family(src) != AF_INET6 && + sa->mode != MODE_TRANSPORT && src->get_family(src) != AF_INET6 && this->install_routes) { route_entry_t *route = malloc_thing(route_entry_t); |