From fbedc6a45b9c18f13972c8e1a7ada0ef5fb67210 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Wed, 27 Jul 2011 13:41:35 +0200 Subject: Remove policies in kernel interfaces based on their priority. This allows to unroute a connection while the same connection is currently established. In this case both CHILD_SAs share the same reqid but the installed policies have different priorities. --- src/libhydra/kernel/kernel_interface.h | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) (limited to 'src/libhydra/kernel/kernel_interface.h') diff --git a/src/libhydra/kernel/kernel_interface.h b/src/libhydra/kernel/kernel_interface.h index a7f8e26a8..4c2f7ef99 100644 --- a/src/libhydra/kernel/kernel_interface.h +++ b/src/libhydra/kernel/kernel_interface.h @@ -188,7 +188,7 @@ struct kernel_interface_t { * @param type type of policy, POLICY_(IPSEC|PASS|DROP) * @param sa details about the SA(s) tied to this policy * @param mark mark for this policy - * @param routed TRUE, if this policy is routed in the kernel + * @param priority priority of this policy * @return SUCCESS if operation completed */ status_t (*add_policy) (kernel_interface_t *this, @@ -196,7 +196,8 @@ struct kernel_interface_t { traffic_selector_t *src_ts, traffic_selector_t *dst_ts, policy_dir_t direction, policy_type_t type, - ipsec_sa_cfg_t *sa, mark_t mark, bool routed); + ipsec_sa_cfg_t *sa, mark_t mark, + policy_priority_t priority); /** * Query the use time of a policy. @@ -230,14 +231,14 @@ struct kernel_interface_t { * @param direction direction of traffic, POLICY_(IN|OUT|FWD) * @param reqid unique ID of the associated SA * @param mark optional mark - * @param unrouted TRUE, if this policy is unrouted from the kernel + * @param priority priority of the policy * @return SUCCESS if operation completed */ status_t (*del_policy) (kernel_interface_t *this, traffic_selector_t *src_ts, traffic_selector_t *dst_ts, policy_dir_t direction, u_int32_t reqid, - mark_t mark, bool unrouted); + mark_t mark, policy_priority_t priority); /** * Get our outgoing source address for a destination. -- cgit v1.2.3